refactor: Screen wasm modules with a wasmi ModuleInspector instead of a pre-scan

chore: Merge develop

.clang-tidy

@@ -5,7 +5,10 @@ Checks: "-*,
   -bugprone-exception-escape,
   -bugprone-implicit-widening-of-multiplication-result,
   -bugprone-narrowing-conversions,
+  -bugprone-signed-bitwise,
+  -bugprone-std-exception-baseclass,
   -bugprone-throwing-static-initialization,
+  -bugprone-unhandled-code-paths,
 
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-c-arrays,
@@ -14,6 +17,7 @@ Checks: "-*,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-avoid-non-const-global-variables,
   -cppcoreguidelines-c-copy-assignment-signature,
+  -cppcoreguidelines-explicit-constructor,
   -cppcoreguidelines-interfaces-global-init,
   -cppcoreguidelines-macro-usage,
   -cppcoreguidelines-missing-std-forward,
@@ -32,6 +36,7 @@ Checks: "-*,
   llvm-namespace-comment,
 
   misc-*,
+  -misc-explicit-constructor,
   -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
@@ -45,6 +50,8 @@ Checks: "-*,
   -modernize-avoid-c-style-cast,
   -modernize-return-braced-init-list,
   -modernize-use-integer-sign-comparison,
+  -modernize-use-string-view,
+  -modernize-use-structured-binding,
   -modernize-use-trailing-return-type,
 
   performance-*,
@@ -53,6 +60,7 @@ Checks: "-*,
   -performance-noexcept-move-constructor,
   -performance-unnecessary-copy-initialization,
   -performance-unnecessary-value-param,
+  -performance-use-std-move,
 
   readability-*,
   -readability-avoid-const-params-in-decls,
@@ -65,7 +73,10 @@ Checks: "-*,
   -readability-named-parameter,
   -readability-qualified-auto,
   -readability-redundant-access-specifiers,
+  -readability-redundant-nested-if,
+  -readability-redundant-qualified-alias,
   -readability-static-accessed-through-instance,
+  -readability-trivial-switch,
   -readability-uppercase-literal-suffix
   "
 # ---
@@ -90,6 +101,13 @@ CheckOptions:
   readability-identifier-naming.ClassCase: CamelCase
   readability-identifier-naming.StructCase: CamelCase
   readability-identifier-naming.UnionCase: CamelCase
+  readability-identifier-naming.TypeAliasCase: CamelCase
+  readability-identifier-naming.TypedefCase: CamelCase
+  # Member type names mandated by std/Boost concepts. Subtrees that need more
+  # than these carry their own .clang-tidy (include/xrpl/{beast,basics,protocol,
+  # peerfinder}, src/test/beast); one-off cases use an inline NOLINT.
+  readability-identifier-naming.TypeAliasIgnoredRegexp: "^(const_iterator|const_reference|difference_type|duration|iterator|iterator_category|key_type|mapped_type|period|pointer|reference|rep|result_type|size_type|time_point|value_type)$"
+  readability-identifier-naming.TypedefIgnoredRegexp: "^(const_iterator|const_reference|difference_type|duration|iterator|iterator_category|key_type|mapped_type|period|pointer|reference|rep|result_type|size_type|time_point|value_type)$"
   readability-identifier-naming.EnumCase: CamelCase
   readability-identifier-naming.EnumConstantCase: CamelCase
   readability-identifier-naming.ScopedEnumConstantCase: CamelCase
@@ -122,5 +140,5 @@ CheckOptions:
   readability-identifier-naming.GlobalFunctionIgnoredRegexp: "^(to_string|hash_append|tuple_hash)$"
 
 HeaderFilterRegex: '^.*/(tests?|xrpl|xrpld)/.*\.(h|hpp|ipp)$'
-ExcludeHeaderFilterRegex: '^.*/protocol_autogen/.*\.(h|hpp)$'
+ExcludeHeaderFilterRegex: '^.*/protocol_autogen/.*\.(h|hpp)$|^.*\.pb\.h$'
 WarningsAsErrors: "*"

.cspell.config.yaml

@@ -7,6 +7,7 @@ ignorePaths:
   - cmake/**
   - LICENSE.md
   - .clang-tidy
+  - nix/check-tools/*.txt # generated, and full of Nix store hashes
 language: en
 allowCompoundWords: true # TODO (#6334)
 ignoreRandomStrings: true
@@ -63,12 +64,14 @@ words:
   - blindings
   - bookdir
   - Bougalis
+  - bthomee
   - Britto
   - Btrfs
   - Buildx
   - canonicality
   - cdylib
   - canonicalised
+  - cctools
   - changespq
   - checkme
   - choco
@@ -111,6 +114,7 @@ words:
   - disablerepo
   - distro
   - doxyfile
+  - dsymutil
   - dxrpl
   - elgamal
   - enabled
@@ -143,6 +147,7 @@ words:
   - impls
   - inequation
   - initialiser
+  - Injectivity
   - insuf
   - insuff
   - invasively
@@ -172,10 +177,12 @@ words:
   - LOCALGOOD
   - logwstream
   - Lombrozo
+  - lresolv
   - lseq
   - lsmf
   - ltype
   - mathbunnyru
+  - maxima
   - mcmodel
   - MEMORYSTATUSEX
   - MPTAMM
@@ -195,6 +202,7 @@ words:
   - mptokenissuance
   - mptokens
   - mpts
+  - mpt
   - mtgox
   - multisig
   - multisign
@@ -225,6 +233,7 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
+  - otool
   - oxalica
   - pargs
   - partitioner
@@ -254,12 +263,17 @@ words:
   - queuable
   - Raphson
   - rcflags
+  - reencrypted
   - replayer
+  - repodata
+  - repomd
   - rerandomize
   - rerandomization
   - rerandomized
   - rerandomizes
   - rerere
+  - retargeted
+  - retargets
   - retriable
   - RIPD
   - ripdtop
@@ -295,6 +309,7 @@ words:
   - sles
   - soci
   - socidb
+  - Sonatype
   - sponsee
   - sponsees
   - SRPMS
@@ -365,6 +380,7 @@ words:
   - vfalco
   - vinnie
   - wasmi
+  - wasmparser
   - Werror
   - wextra
   - wptr
@@ -373,13 +389,18 @@ words:
   - wthread
   - xbridge
   - xchain
+  - xcrun
   - xfloat
   - ximinez
   - XMACRO
+  - xored
+  - xrp
   - xrpkuwait
   - xrpl
   - xrpld
   - xrplf
   - xxhash
   - xxhasher
+  - zstdio
   - CGNAT
+  - ungated

.envrc

@@ -1,3 +1,14 @@
 watch_file nix/*.nix
 
+# Pinned Rust toolchain, read by nix/packages.nix via fromRustupToolchainFile.
+watch_file rust-toolchain.toml
+
+# The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
+# change in there has to invalidate direnv's cached environment.
+watch_dir conan
+
 use flake
+
+# Optional, untracked local overrides. To use a different shell, put e.g.
+# `use flake .#formal-verification` in .envrc.local.
+source_env_if_exists .envrc.local

.gersemi/definitions.cmake

@@ -108,3 +108,75 @@ endfunction()
 
 function(patch_nix_binary target)
 endfunction()
+
+function(rpcspec_generate_instantiations)
+    set(options)
+    set(oneValueArgs OUT_VAR VALUE_TYPE VIEW_HEADER INCLUDE_DIR)
+    set(multiValueArgs HANDLERS)
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()
+
+function(corrosion_import_crate)
+    set(options
+        ALL_FEATURES
+        NO_DEFAULT_FEATURES
+        NO_STD
+        NO_LINKER_OVERRIDE
+        NO_USES_TERMINAL
+        LOCKED
+        FROZEN
+    )
+    set(oneValueArgs MANIFEST_PATH PROFILE IMPORTED_CRATES)
+    set(multiValueArgs
+        CRATE_TYPES
+        CRATES
+        FEATURES
+        FLAGS
+        OVERRIDE_CRATE_TYPE
+    )
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()
+
+function(corrosion_set_env_vars target_name env_var)
+endfunction()
+
+function(corrosion_add_cxxbridge cxx_target)
+    set(options)
+    set(oneValueArgs CRATE)
+    set(multiValueArgs FILES)
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()
+
+function(_unlink_libgcc_s crate)
+endfunction()
+
+function(add_xrpl_crate name)
+    set(options)
+    set(oneValueArgs CRATE)
+    set(multiValueArgs FILES)
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()

.git-blame-ignore-revs

@@ -5,6 +5,18 @@
 # This file is sorted in reverse chronological order, with the most recent commits at the top.
 # The commits listed here are ignored by git blame, which is useful for formatting-only commits that would otherwise obscure the history of changes to a file.
 
+# chore: CamelCase for typedef/using in `clang-tidy` (#8177)
+97a1824537d20d82d25bf151a37a7a4532ebf085
+# chore: Rename CamelCase namespaces to snake_case (#7933)
+06488c1318d96f56d0536251bee08ac85fa7fdd3
+# style: Unify style for all Doxygen comments (#7776)
+73b6852a122854140336e6e6bc30a3a4b41aa5fd
+# style: More clang-tidy identifier renaming (#7290)
+a830ab10efed8d3e59ef2fc15d66efdf9c6bb0d8
+# refactor: Rename static constants (#7120)
+5b6e8b6f93b19c1e3f6a3467a25639031d9d9a53
+# chore: More fixes for bad renames (#7092)
+7afdd71a54d562b32a50b29a5aa00bb997dc9053
 # refactor: Enable clang-tidy `readability-identifier-naming` check (#6571)
 8995564ed6b9e453e144bb663303072a3c1ba305
 # refactor: Enable remaining clang-tidy `cppcoreguidelines` checks (#6538)

.github/actions/build-deps/action.yml

@@ -15,9 +15,9 @@ inputs:
     required: false
     default: "false"
   log_verbosity:
-    description: "The logging verbosity."
+    description: 'The logging verbosity ("quiet", "verbose"), or empty to use the Conan defaults.'
     required: false
-    default: "verbose"
+    default: ""
   sanitizers:
     description: "The sanitizers to enable."
     required: false
@@ -35,6 +35,16 @@ runs:
         LOG_VERBOSITY: ${{ inputs.log_verbosity }}
         SANITIZERS: ${{ inputs.sanitizers }}
       run: |
+        # By default, leave the verbosity unset, so CMake configure output is
+        # shown, but compile commands and Boost's b2 debug output (~85k lines
+        # when "verbose") are not.
+        VERBOSITY_ARGS=()
+        if [[ -n "${LOG_VERBOSITY}" ]]; then
+            VERBOSITY_ARGS=(
+                --conf:all tools.build:verbosity="${LOG_VERBOSITY}"
+                --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}"
+            )
+        fi
         conan install \
             --profile:all ci \
             --build="${BUILD_OPTION}" \
@@ -42,6 +52,13 @@ runs:
             --options:host='&:xrpld=True' \
             --settings:all build_type="${BUILD_TYPE}" \
             --conf:all tools.build:jobs=${BUILD_NPROC} \
-            --conf:all tools.build:verbosity="${LOG_VERBOSITY}" \
-            --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}" \
-            .
+            "${VERBOSITY_ARGS[@]}" \
+            --format=json \
+            . >"${RUNNER_TEMP}/conan-graph.json"
+
+    # Tools that run during the build may only load glibc from the Nix store,
+    # as their package ID survives a GCC runtime update.
+    - name: Check build-context packages for Nix store dependencies (Linux)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      run: ./bin/nix/check-build-context-runtime.sh "${RUNNER_TEMP}/conan-graph.json"

.github/actions/cargo-cache/action.yml

@@ -0,0 +1,39 @@
+name: Use cargo artifacts cache
+description: >
+  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
+  when saving the cache, rust-cache deletes all binaries that were already
+  present there, which on persistent self-hosted runners wipes the tools
+  installed by prepare-runner. Harmless on ephemeral runners, but kept
+  consistent everywhere.
+
+inputs:
+  workspaces:
+    description: "Workspaces to cache, as 'workspace -> target' lines."
+    required: false
+    default: crates
+  key:
+    description: "Additional part of the cache key."
+    required: false
+    default: ""
+  cache-directories:
+    description: "Additional non-workspace directories to cache."
+    required: false
+    default: ""
+  save-if:
+    description: >
+      Condition for saving the cache after the job. Defaults to save only from develop branch
+    required: false
+    default: ${{ github.ref == 'refs/heads/develop' }}
+
+runs:
+  using: composite
+
+  steps:
+    - name: Use cargo artifacts cache
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        cache-bin: "false"
+        cache-directories: ${{ inputs.cache-directories }}
+        key: ${{ inputs.key }}
+        save-if: ${{ inputs.save-if }}
+        workspaces: ${{ inputs.workspaces }}

.github/actions/generate-version/action.yml

@@ -1,44 +0,0 @@
-name: Generate build version number
-description: "Generate build version number."
-
-outputs:
-  version:
-    description: "The generated build version number."
-    value: ${{ steps.version.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    # When a tag is pushed, the version is used as-is.
-    - name: Generate version for tag event
-      if: ${{ startsWith(github.ref, 'refs/tags/') }}
-      shell: bash
-      env:
-        VERSION: ${{ github.ref_name }}
-      run: echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
-
-    # When a tag is not pushed, then the version (e.g. 1.2.3-b0) is extracted
-    # from the BuildInfo.cpp file and the shortened commit hash appended to it.
-    # We use a plus sign instead of a hyphen because Conan recipe versions do
-    # not support two hyphens.
-    - name: Generate version for non-tag event
-      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-      shell: bash
-      run: |
-        echo 'Extracting version from BuildInfo.cpp.'
-        VERSION="$(cat src/libxrpl/protocol/BuildInfo.cpp | grep "versionString =" | awk -F '"' '{print $2}')"
-        if [[ -z "${VERSION}" ]]; then
-            echo 'Unable to extract version from BuildInfo.cpp.'
-            exit 1
-        fi
-
-        echo 'Appending shortened commit hash to version.'
-        SHA='${{ github.sha }}'
-        VERSION="${VERSION}+${SHA:0:7}"
-
-        echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
-
-    - name: Output version
-      id: version
-      shell: bash
-      run: echo "version=${VERSION}" >>"${GITHUB_OUTPUT}"

.github/actions/release-info/action.yml

@@ -0,0 +1,39 @@
+name: Release info
+description: "Derive the version, release channel and package release number for this build."
+
+outputs:
+  version:
+    description: "The build version number."
+    value: ${{ steps.version.outputs.version }}
+  channel:
+    description: "The release channel this build belongs to."
+    value: ${{ steps.release_info.outputs.channel }}
+  pkg_release:
+    description: "The package release number: 1 for a tag, <run number>.<commit date>git<short commit hash> otherwise."
+    value: ${{ steps.release_info.outputs.pkg_release }}
+
+runs:
+  using: composite
+  steps:
+    # A tag names its own version. Anything else is a development build named by
+    # its commit hash, matching what cmake/XrplVersion.cmake derives: the head of
+    # a pull request rather than the merge commit GitHub creates for it.
+    - name: Determine version
+      id: version
+      shell: bash
+      env:
+        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+        REF_NAME: ${{ github.ref_name }}
+        SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      run: |
+        if [[ "${IS_TAG}" == "true" ]]; then
+            version="${REF_NAME}"
+        else
+            version="0.0.0-dev+${SHA:0:7}"
+        fi
+
+        echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
+
+    - name: Determine release channel and package release
+      id: release_info
+      uses: XRPLF/actions/release-info@a9f2eeca6fb3980ba3a84cf68566f1c69ad30674

.github/actions/setup-nix-env/action.yml

@@ -0,0 +1,70 @@
+name: Setup Nix environment
+description: "Build the flake's CI environment and put its tools on PATH."
+
+# The environment from nix/ci-env.nix, the same one the Linux CI images bake in
+# (see nix/docker). Exported onto PATH rather than entered with `nix develop`:
+# the composite actions below run plain `bash` and would escape a dev shell.
+
+runs:
+  using: composite
+
+  steps:
+    - name: Build the CI environment
+      id: build
+      shell: bash
+      env:
+        # --out-link doubles as a GC root for the length of the job.
+        OUT_LINK: ${{ runner.temp }}/xrpld-ci-env
+      run: |
+        # --extra-experimental-features: flakes may not be on in the runner's nix.conf.
+        nix --extra-experimental-features "nix-command flakes" \
+            build .#default --out-link "${OUT_LINK}" --print-build-logs
+        echo "path=$(readlink -f "${OUT_LINK}")" >>"${GITHUB_OUTPUT}"
+
+    - name: Export the environment
+      shell: bash
+      env:
+        ENV_PATH: ${{ steps.build.outputs.path }}
+      run: |
+        echo "${ENV_PATH}/bin" >>"${GITHUB_PATH}"
+
+        # Already KEY=VALUE per line. See `darwinEnv` in nix/ci-env.nix.
+        ENV_FILE="${ENV_PATH}/share/xrpld-ci-env/env"
+        if [ -f "${ENV_FILE}" ]; then
+            cat "${ENV_FILE}" >>"${GITHUB_ENV}"
+        fi
+
+        # XrplSanity.cmake otherwise rejects a Nix compiler as one that leaked.
+        echo "XRPL_DEVSHELL=ci-env" >>"${GITHUB_ENV}"
+
+        # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
+        # own trust store, and pinning would break TLS to hosts relying on it.
+
+        # In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
+        # prepare-runner hands the system toolchain - but under its own name:
+        # that Conan is a different version, and the two would migrate each
+        # other's cache.
+        echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
+
+    # Config, profiles and remote, exactly as the dev shell sets them up on
+    # entry; the `setup-conan` action is skipped for this toolchain.
+    - name: Setup Conan
+      shell: bash
+      run: ./conan/init.sh
+
+    # `Check tools` runs later but swallows failures; a bad export would just
+    # build with the system toolchain.
+    - name: Verify the toolchain resolves into the Nix store
+      shell: bash
+      run: |
+        for tool in clang clang++ cmake ninja conan; do
+            path="$(command -v "${tool}" || true)"
+            echo "${tool} -> ${path:-<not found>}"
+            case "${path}" in
+                /nix/store/*) ;;
+                *)
+                    echo "::error::${tool} does not resolve into the Nix store"
+                    exit 1
+                    ;;
+            esac
+        done

.github/dependabot.yml

@@ -4,7 +4,8 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
-      - .github/actions/generate-version/
+      - .github/actions/cargo-cache/
+      - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/
     schedule:
@@ -28,10 +29,9 @@ updates:
       time: "04:00"
       timezone: Etc/GMT
     commit-message:
-      prefix: "ci: [DEPENDABOT] "
+      prefix: "chore: [DEPENDABOT] "
     target-branch: develop
     open-pull-requests-limit: 10
-    # Bundle all Rust dependency bumps into a single PR per run to reduce noise.
     groups:
       rust-dependencies:
         patterns:

.github/pull_request_template.md

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
 If there is a relevant task or issue, please link it here.
 -->
 
-### Context of Change
+## Context of Change
 
 <!--
 Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
 If there is a spec or design document for this feature, please link it here.
 -->
 
-### API Impact
+## API Impact
 
 <!--
 Please check [x] relevant options, delete irrelevant ones.

.github/scripts/levelization/results/ordering.txt

@@ -1,6 +1,9 @@
 benchmarks.libxrpl > xrpl.basics
 benchmarks.libxrpl > xrpl.config
 benchmarks.libxrpl > xrpl.nodestore
+benchmarks.libxrpl > xrpl.protocol
+benchmarks.libxrpl > xrpl.protocol_autogen
+benchmarks.libxrpl > xrpl.tx
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
@@ -82,7 +85,6 @@ test.app > xrpl.tx
 test.basics > test.jtx
 test.basics > xrpl.basics
 test.basics > xrpl.core
-test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
 test.beast > xrpl.basics
@@ -113,6 +115,7 @@ test.jtx > xrpl.config
 test.jtx > xrpl.core
 test.jtx > xrpld.app
 test.jtx > xrpld.core
+test.jtx > xrpld.overlay
 test.jtx > xrpld.rpc
 test.jtx > xrpl.json
 test.jtx > xrpl.ledger
@@ -194,6 +197,9 @@ tests.libxrpl > xrpl.resource
 tests.libxrpl > xrpl.server
 tests.libxrpl > xrpl.shamap
 tests.libxrpl > xrpl.tx
+tests.xrpld > xrpld.rpc
+tests.xrpld > xrpl.json
+tests.xrpld > xrpl.protocol
 xrpl.conditions > xrpl.basics
 xrpl.conditions > xrpl.protocol
 xrpl.config > xrpl.basics
@@ -286,10 +292,10 @@ xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
 xrpld.perflog > xrpl.core
 xrpld.perflog > xrpld.app
-xrpld.perflog > xrpld.rpc
 xrpld.perflog > xrpl.json
 xrpld.perflog > xrpl.nodestore
 xrpld.perflog > xrpl.protocol
+xrpld.perflog > xrpl.server
 xrpld.rpc > xrpl.basics
 xrpld.rpc > xrpl.config
 xrpld.rpc > xrpl.core

.github/scripts/releasing/check-merge-back-commits.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# Exit the script as soon as an error occurs.
+set -euo pipefail
+
+# This script fails if <head> merges a release back into <base>,
+# but also adds commits that aren't on a release or staging branch, see RELEASING.md.
+# Merge commits are allowed.
+# Usage: .github/scripts/releasing/check-merge-back-commits.sh <base> <head>
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: $0 <base> <head>"
+    exit 1
+fi
+
+BASE=$1
+HEAD=$2
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+# shellcheck source=.github/scripts/releasing/common.sh
+source "${SCRIPT_DIR}/common.sh"
+load_release_branches
+
+# A PR is a merge-back if some of its commits are on a release or staging branch.
+PR_COUNT=$(git rev-list --no-merges --count "${BASE}..${HEAD}")
+NEW_COUNT=$(git rev-list --no-merges --count "${BASE}..${HEAD}" --not "${BRANCHES[@]}")
+if ((NEW_COUNT == PR_COUNT)); then
+    echo "This PR doesn't merge a release back."
+    exit 0
+fi
+if ((NEW_COUNT == 0)); then
+    echo "This merge-back adds no commits of its own."
+    exit 0
+fi
+
+echo "This PR merges a release back, but also adds commits that aren't on a release or staging branch:"
+git log --no-merges --format='  %h %s' "${BASE}..${HEAD}" --not "${BRANCHES[@]}"
+echo
+echo "Make these changes in a separate PR, see RELEASING.md."
+exit 1

.github/scripts/releasing/check-no-copied-release-commits.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# Exit the script as soon as an error occurs.
+set -euo pipefail
+
+# This script fails if the commits in <base>..<head> copy commits from a release or staging branch
+# (e.g. by rebasing or cherry-picking them) instead of merging that branch, see RELEASING.md.
+# Commits are compared by patch-id,
+# and only against release and staging commits that <head> does not already contain.
+# Usage: .github/scripts/releasing/check-no-copied-release-commits.sh <base> <head>
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: $0 <base> <head>"
+    exit 1
+fi
+
+BASE=$1
+HEAD=$2
+
+patch_ids() {
+    git log --no-merges --patch --no-color --no-ext-diff "$@" | git patch-id --stable | sort
+}
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+# shellcheck source=.github/scripts/releasing/common.sh
+source "${SCRIPT_DIR}/common.sh"
+load_release_branches
+
+# Each line is "<patch-id> <commit>".
+RELEASE_PATCHES=$(patch_ids "${BRANCHES[@]}" --not "${HEAD}")
+PR_PATCHES=$(patch_ids "${BASE}..${HEAD}")
+
+# Each line is "<patch-id> <release commit> <PR commit>".
+COPIES=$(join <(echo "${RELEASE_PATCHES}") <(echo "${PR_PATCHES}"))
+if [ -z "${COPIES}" ]; then
+    echo "No copied release commits found."
+    exit 0
+fi
+
+echo "These commits copy release commits instead of merging them:"
+while read -r _ RELEASE_COMMIT PR_COMMIT; do
+    echo "  $(git log -1 --format='%h %s' "${PR_COMMIT}") (copies ${RELEASE_COMMIT:0:10})"
+done <<<"${COPIES}"
+echo
+echo "Merge the release tag (or branch) instead, see RELEASING.md."
+exit 1

.github/scripts/releasing/check-no-merge-back.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Exit the script as soon as an error occurs.
+set -euo pipefail
+
+# This script fails if <head> contains release or staging commits that <base> does not,
+# i.e. if <head> merges a release back into <base>.
+# Used in the merge queue, which squashes PRs and would drop the merge commit, see RELEASING.md.
+# Usage: .github/scripts/releasing/check-no-merge-back.sh <base> <head>
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: $0 <base> <head>"
+    exit 1
+fi
+
+BASE=$1
+HEAD=$2
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+# shellcheck source=.github/scripts/releasing/common.sh
+source "${SCRIPT_DIR}/common.sh"
+load_release_branches
+
+RELEASE_COMMITS=$(git rev-list "${BRANCHES[@]}" --not "${BASE}")
+HEAD_COMMITS=$(git rev-list "${BASE}..${HEAD}")
+# The release commits in <head>, newest first.
+MERGED=$(grep -xF -f <(echo "${RELEASE_COMMITS}") <<<"${HEAD_COMMITS}" || true)
+if [ -z "${MERGED}" ]; then
+    echo "No release commits are merged back."
+    exit 0
+fi
+
+echo "This PR merges $(wc -l <<<"${MERGED}" | tr -d ' ') release commits back, e.g.:"
+head -5 <<<"${MERGED}" | xargs git log --no-walk --format='  %h %s'
+echo
+echo "Merge-backs must not go through the merge queue, which squashes them."
+echo "Fast-forward develop to the PR branch instead, see RELEASING.md."
+exit 1

.github/scripts/releasing/check-releases-merged.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# Exit the script as soon as an error occurs.
+set -euo pipefail
+
+# This script fails if a final release (a tag like 3.4.0) on a release branch
+# is not merged back into <develop> within a few days, see RELEASING.md.
+# Usage: .github/scripts/releasing/check-releases-merged.sh <develop>
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <develop>"
+    exit 1
+fi
+
+DEVELOP=$1
+GRACE_DAYS=3
+
+mapfile -t MERGED_ARGS < <(git for-each-ref --format='--merged=%(refname)' 'refs/remotes/*/release/*')
+if [ "${#MERGED_ARGS[@]}" -eq 0 ]; then
+    echo "Error: No release branches found."
+    exit 1
+fi
+
+# Tags on a release branch that <develop> does not contain.
+TAGS=$(git for-each-ref --format='%(refname:short) %(creatordate:unix)' \
+    "${MERGED_ARGS[@]}" --no-merged="${DEVELOP}" 'refs/tags/[0-9]*')
+
+MISSING=0
+while read -r TAG CREATED; do
+    if ! [[ "${TAG}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+        continue
+    fi
+    if (($(date +%s) - CREATED < GRACE_DAYS * 86400)); then
+        echo "${TAG}: not merged yet, still within the ${GRACE_DAYS}-day grace period."
+    else
+        echo "${TAG}: not merged into develop."
+        MISSING=1
+    fi
+done <<<"${TAGS}"
+
+if [ "${MISSING}" -ne 0 ]; then
+    echo
+    echo "Merge the missing releases back into develop, see RELEASING.md."
+    exit 1
+fi
+echo "No releases past the grace period are missing from develop."

.github/scripts/releasing/common.sh

@@ -0,0 +1,12 @@
+# shellcheck shell=bash
+
+# Helpers shared by the release checks in this directory, see RELEASING.md.
+
+# Sets BRANCHES to all release and staging branches, and fails if there are none.
+load_release_branches() {
+    mapfile -t BRANCHES < <(git for-each-ref --format='%(refname)' 'refs/remotes/*/release/*' 'refs/remotes/*/staging/*')
+    if [ "${#BRANCHES[@]}" -eq 0 ]; then
+        echo "Error: No release or staging branches found."
+        exit 1
+    fi
+}

.github/scripts/rename/binary.sh

@@ -49,7 +49,7 @@ ${SED_COMMAND} -i -E 's@ripple/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@xrpld \(`xrpld`\)@xrpld@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' CONTRIBUTING.md
-${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/build/install.md
+${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/install.md
 
 popd
 echo "Processing complete."

.github/scripts/rename/config.sh

@@ -62,7 +62,7 @@ ${SED_COMMAND} -i 's@ripple/@xrpld/@g' src/test/core/Config_test.cpp
 ${SED_COMMAND} -i 's/Rippled/File/g' src/test/core/Config_test.cpp
 
 # Restore the old config file name in the code that maintains support for now.
-${SED_COMMAND} -i 's/kConfigLegacyName = "xrpld.cfg"/kConfigLegacyName = "rippled.cfg"/g' src/xrpld/core/detail/Config.cpp
+${SED_COMMAND} -i 's/kConfigLegacyName = "xrpld.cfg"/kConfigLegacyName = "rippled.cfg"/g' src/xrpld/core/Config.h
 
 # Restore an URL.
 ${SED_COMMAND} -i 's/connect-your-xrpld-to-the-xrp-test-net.html/connect-your-rippled-to-the-xrp-test-net.html/g' cfg/xrpld-example.cfg

.github/scripts/rename/docs.sh

@@ -77,8 +77,8 @@ ${SED_COMMAND} -i 's/Ripple integrators/XRPL developers/' README.md
 ${SED_COMMAND} -i 's/sanitizer-configuration-for-rippled/sanitizer-configuration-for-xrpld/' docs/build/sanitizers.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/levelization/README.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/strategy-matrix/generate.py
-${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/build/install.md
-${SED_COMMAND} -i '[email protected]/XRPLF/[email protected]/XRPLF/rippled@g' docs/build/install.md
+${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/install.md
+${SED_COMMAND} -i '[email protected]/XRPLF/[email protected]/XRPLF/rippled@g' docs/install.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' docs/Doxyfile
 ${SED_COMMAND} -i 's/ripple_basics/basics/' include/xrpl/basics/CountedObject.h
 ${SED_COMMAND} -i 's/<ripple/<xrpl/' include/xrpl/protocol/AccountID.h
@@ -90,7 +90,7 @@ ${SED_COMMAND} -i 's/www.ripple.com/www.xrpl.org/g' src/test/protocol/Seed_test.
 # Restore specific changes.
 ${SED_COMMAND} -i 's@b5efcc/src/xrpld@b5efcc/src/ripple@' include/xrpl/protocol/README.md
 ${SED_COMMAND} -i 's/dbPrefix_ = "xrpldb"/dbPrefix_ = "rippledb"/' src/xrpld/app/misc/SHAMapStoreImp.h # cspell: disable-line
-${SED_COMMAND} -i 's/kConfigLegacyName = "xrpld.cfg"/kConfigLegacyName = "rippled.cfg"/' src/xrpld/core/detail/Config.cpp
+${SED_COMMAND} -i 's/kConfigLegacyName = "xrpld.cfg"/kConfigLegacyName = "rippled.cfg"/' src/xrpld/core/Config.h
 
 popd
 echo "Renaming complete."

.github/scripts/strategy-matrix/generate.py

@@ -7,7 +7,20 @@ from pathlib import Path
 
 THIS_DIR = Path(__file__).parent.resolve()
 
-_BASE_CMAKE_ARGS = ["-Dtests=ON", "-Dwerr=ON", "-Dxrpld=ON", "-Dwextra=ON"]
+_BASE_CMAKE_ARGS = [
+    "-Dtests=ON",
+    "-Dwerr=ON",
+    "-Dxrpld=ON",
+    "-Dwextra=ON",
+]
+
+# The package formats a config can be packaged as, each with its own
+# install-test job in reusable-package.yml.
+PACKAGE_TYPES = ("deb", "rpm")
+
+# The package name a variant suffixes, as build_pkg.py's BASE_NAME spells it:
+# the two have to agree, or the artifact globs miss what was built.
+BASE_NAME = "xrpld"
 
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.
 _SANITIZER_SUFFIX: dict[str, str] = {
@@ -17,6 +30,19 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 }
 
 
+def config_name(
+    distro: str,
+    compiler: str,
+    build_type: str,
+    arch: str,
+    suffix: str = "",
+    sanitizer: str = "",
+) -> str:
+    """Name a config. Its artifacts are named after it, so packaging reuses this."""
+    parts = [s for s in [suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s]
+    return "-".join([f"{distro}-{compiler}-{build_type.lower()}-{arch}", *parts])
+
+
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
@@ -31,17 +57,37 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 
 
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
-# built for pull requests by default; the full matrix adds the rest. Packaging
-# configs declare it too, but packaging is gated in the workflow, not by it.
+# built for pull requests by default; the full matrix adds the rest.
 #
-# Configs may also opt into 'benchmark' to smoke-run the benchmarks. Note that
-# the flag applies to every entry a config expands into, so only set it on
-# configs that expand to a single combination.
+# Configs may also opt into 'benchmark' to smoke-run the benchmarks, or carry a
+# 'package' map to be packaged as well. Note that either applies to every entry
+# a config expands into, so only set them on configs that expand to a single
+# combination.
+
+
+@dataclasses.dataclass
+class PackageConfig:
+    """The 'package' map of a config whose binaries are also packaged."""
+
+    type: str  # has to match what the image provides
+    # The packaging container image: a vanilla distro image, not the nix image
+    # the config itself builds in.
+    image: str
+    # A flavour of the package, named xrpld-<variant>, for a config whose
+    # binaries are not the plain release build. A variant needs no counterpart
+    # in the other format.
+    variant: str = ""
+
+    def __post_init__(self) -> None:
+        assert self.type in PACKAGE_TYPES, (
+            f"unsupported package type {self.type!r}: "
+            f"use one of {', '.join(PACKAGE_TYPES)}."
+        )
 
 
 @dataclasses.dataclass
 class LinuxConfig:
-    """One entry in linux.json's 'configs' or 'package_configs' arrays."""
+    """One entry in a linux.json 'configs' array."""
 
     compiler: list[str]
     build_type: list[str]
@@ -51,7 +97,11 @@ class LinuxConfig:
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
-    image: str = ""  # only used by package_configs entries
+    package: PackageConfig | None = None  # set to also package this config
+
+    def __post_init__(self) -> None:
+        if isinstance(self.package, dict):
+            self.package = PackageConfig(**self.package)
 
 
 @dataclasses.dataclass
@@ -60,22 +110,16 @@ class LinuxFile:
 
     image_tag: str
     configs: dict[str, list[LinuxConfig]]  # distro → configs
-    package_configs: dict[str, list[LinuxConfig]]  # distro → packaging configs
 
     @classmethod
     def load(cls, path: Path) -> "LinuxFile":
         data = json.loads(path.read_text())
-
-        def parse(section: dict) -> dict[str, list[LinuxConfig]]:
-            return {
-                distro: [LinuxConfig(**c) for c in cfgs]
-                for distro, cfgs in section.items()
-            }
-
         return cls(
             image_tag=data["image_tag"],
-            configs=parse(data["configs"]),
-            package_configs=parse(data.get("package_configs", {})),
+            configs={
+                distro: [LinuxConfig(**c) for c in cfgs]
+                for distro, cfgs in data["configs"].items()
+            },
         )
 
 
@@ -88,6 +132,9 @@ class PlatformConfig:
     build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
     benchmark: bool = False  # if true, smoke-run the benchmarks after testing
     extra_cmake_args: str = ""
+    # "" is the runner's system compiler, "nix" the flake's CI environment.
+    # macOS only: Linux always builds in a Nix image, Windows has no Nix.
+    toolchain: str = ""
 
     def __post_init__(self) -> None:
         if isinstance(self.build_type, str):
@@ -137,6 +184,7 @@ class MatrixEntry:
     sanitizers: str
     image: str = ""  # container image; empty for macOS/Windows (runs natively)
     compiler: str = ""  # compiler name ("gcc" or "clang"); empty for macOS/Windows
+    toolchain: str = ""  # "nix" for the flake's CI environment; see PlatformConfig
 
 
 @dataclasses.dataclass
@@ -146,7 +194,9 @@ class PackagingEntry:
     xrpld_artifact_name: str
     validator_keys_artifact_name: str
     image: str
-    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps
+    package_type: str  # "deb" or "rpm"; drives the format-specific steps
+    package_variant: str  # passed to build_pkg.py --variant; empty for xrpld
+    package_name: str  # the name it builds under, which the artifact globs use
 
 
 # ---------------------------------------------------------------------------
@@ -187,13 +237,9 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                 effective_sanitizers,
                 effective_archs.items(),
             ):
-                name = f"{distro}-{compiler}-{build_type.lower()}-{arch}"
-                suffix_parts = [
-                    s for s in [cfg.suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s
-                ]
-                if suffix_parts:
-                    name += "-" + "-".join(suffix_parts)
-
+                name = config_name(
+                    distro, compiler, build_type, arch, cfg.suffix, sanitizer
+                )
                 entries.append(
                     MatrixEntry(
                         config_name=name,
@@ -213,33 +259,59 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 
 
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
-    """Generate the packaging matrix from a LinuxFile's package_configs section.
+    """Generate the packaging matrix from the configs that carry a 'package' map.
 
-    Packaging uses vanilla distro images (debian:bookworm, ubi9, …) instead of
-    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
-    is taken from the distro's archive rather than from nixpkgs. Each config
-    entry carries its own 'image'.
+    Packaging consumes the binaries that config's build job uploaded, so the
+    artifact names come from the same config name, and a packaged config is one
+    that passes -Dvalidator_keys=ON.
 
-    The artifact names must match what the build job uploads: one artifact per
-    binary, each named after the build config.
+    Packaging itself runs in vanilla distro images (debian:trixie, almalinux:10)
+    instead of the nix-based build images, because deb/rpm tooling (debhelper,
+    rpm-build) is taken from the distro's archive rather than from nixpkgs.
     """
     entries = []
-    for distro, configs in linux.package_configs.items():
+    for distro, configs in linux.configs.items():
         for cfg in configs:
-            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
-                config_name = f"{distro}-{compiler}-{build_type.lower()}-amd64"
+            if cfg.package is None:
+                continue
+            for compiler, build_type, arch in itertools.product(
+                cfg.compiler, cfg.build_type, cfg.arch
+            ):
+                # The packaging workflow hardcodes an amd64 runner.
+                assert arch == "amd64", f"cannot package {distro} on {arch}"
+                name = config_name(distro, compiler, build_type, arch, cfg.suffix)
                 entries.append(
                     PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{config_name}",
-                        validator_keys_artifact_name=f"validator-keys-{config_name}",
-                        image=cfg.image,
-                        distro=distro,
+                        xrpld_artifact_name=f"xrpld-{name}",
+                        validator_keys_artifact_name=f"validator-keys-{name}",
+                        image=cfg.package.image,
+                        package_type=cfg.package.type,
+                        package_variant=cfg.package.variant,
+                        package_name=(
+                            f"{BASE_NAME}-{cfg.package.variant}"
+                            if cfg.package.variant
+                            else BASE_NAME
+                        ),
                     )
                 )
 
     return entries
 
 
+def package_names_by_type(entries: list[PackagingEntry]) -> dict[str, list[str]]:
+    """The names of the packages in 'entries', keyed by format.
+
+    Derived from the packaging matrix rather than listed again, so the packages
+    the install-test jobs look for are the packages that were built.
+    """
+    return {
+        package_type: sorted(
+            {e.package_name for e in entries if e.package_type == package_type}
+        )
+        for package_type in PACKAGE_TYPES
+    }
+
+
 def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a PlatformFile (macOS or Windows) into matrix entries.
 
@@ -253,9 +325,12 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
         if minimal and not cfg.minimal:
             continue
         for build_type in cfg.build_type:
+            name = f"{platform_name}-{arch}-{build_type.lower()}"
+            if cfg.toolchain:
+                name += f"-{cfg.toolchain}"
             entries.append(
                 MatrixEntry(
-                    config_name=f"{platform_name}-{arch}-{build_type.lower()}",
+                    config_name=name,
                     cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                     cmake_target="install" if is_windows else "all",
                     build_only=cfg.build_only,
@@ -263,6 +338,7 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
                     build_type=build_type,
                     architecture=Architecture(platform=pf.platform, runner=pf.runner),
                     sanitizers="",
+                    toolchain=cfg.toolchain,
                 )
             )
     return entries
@@ -304,6 +380,10 @@ if __name__ == "__main__":
 
     if args.packaging:
         matrix = expand_linux_packaging(LinuxFile.load(THIS_DIR / "linux.json"))
+        # One list per format, so each install-test job installs the packages its
+        # own format produced.
+        for package_type, names in package_names_by_type(matrix).items():
+            print(f"{package_type}_package_names={json.dumps(names)}")
     else:
         if args.config in ("linux", None):
             matrix += expand_linux_matrix(

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-fecfc0c",
+  "image_tag": "sha-3d526d4",
   "configs": {
     "ubuntu": [
       {
@@ -71,7 +71,24 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
+        "extra_cmake_args": "-Dvalidator_keys=ON",
+        "package": {
+          "type": "deb",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd"
+        }
+      },
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false,
+        "suffix": "assert",
+        "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
+        "package": {
+          "type": "deb",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd",
+          "variant": "assert"
+        }
       }
     ],
 
@@ -81,28 +98,11 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
-      }
-    ]
-  },
-  "package_configs": {
-    "debian": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
-      }
-    ],
-
-    "rhel": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
+        "extra_cmake_args": "-Dvalidator_keys=ON",
+        "package": {
+          "type": "rpm",
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-e6055dd"
+        }
       }
     ]
   }

.github/scripts/strategy-matrix/macos.json

@@ -12,6 +12,19 @@
       "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
       "build_only": true,
       "minimal": false
+    },
+    {
+      "build_type": "Release",
+      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
+      "toolchain": "nix",
+      "minimal": false
+    },
+    {
+      "build_type": "Debug",
+      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
+      "toolchain": "nix",
+      "build_only": true,
+      "minimal": false
     }
   ]
 }

.github/workflows/build-nix-images.yml

@@ -5,16 +5,14 @@ on:
     branches:
       - develop
     paths:
-      - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
       - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
-      - "bin/install-sanitizer-libs.sh"
+      - "!nix/check-tools/**"
+      - "bin/nix/default-loader-path.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"
@@ -24,9 +22,10 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
+      - "!nix/check-tools/**"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
-      - "bin/install-sanitizer-libs.sh"
+      - "bin/nix/default-loader-path.sh"
+      - "bin/install/sanitizer-libs.sh"
   workflow_dispatch:
 
 concurrency:
@@ -58,7 +57,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@696384b292577293292daed06af0306d1b83bd7d
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -5,14 +5,13 @@ on:
     branches:
       - develop
     paths:
-      - ".github/workflows/build-packaging-images.yml"
-      - "package/Dockerfile"
-      - "package/install-packaging-tools.sh"
+      - "bin/install/packaging-tools.sh"
+      - "package/images/packaging/**"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "package/Dockerfile"
-      - "package/install-packaging-tools.sh"
+      - "bin/install/packaging-tools.sh"
+      - "package/images/packaging/**"
   workflow_dispatch:
 
 concurrency:
@@ -33,14 +32,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # Newest of each distro: these images only wrap pre-built binaries, so
+        # they set no floor for consumers. build_pkg.py pins the RPM dist tag.
         distro:
           - name: debian
-            base_image: debian:bookworm
+            base_image: debian:trixie
+          # AlmaLinux rather than UBI, which does not ship rpm-sign.
           - name: rhel
-            base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+            base_image: almalinux:10
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@696384b292577293292daed06af0306d1b83bd7d
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
-      dockerfile: package/Dockerfile
+      dockerfile: package/images/packaging/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
       push: ${{ github.event_name == 'push' }}

.github/workflows/build-pre-commit-image.yml

@@ -5,7 +5,6 @@ on:
     branches:
       - develop
     paths:
-      - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
       - "rust-toolchain.toml"
   pull_request:
@@ -30,7 +29,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@696384b292577293292daed06af0306d1b83bd7d
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -1,8 +1,3 @@
-# This workflow audits the Rust dependencies in crates/ for known security
-# advisories using cargo-audit. It runs on a weekly schedule, whenever the
-# dependency graph changes (Cargo.lock / Cargo.toml), and on demand. On a
-# scheduled run, a failure opens a tracking issue (matching the clang-tidy
-# workflow's behavior); on push/PR it simply fails the check.
 name: Cargo audit
 
 on:
@@ -12,7 +7,7 @@ on:
   push:
     branches:
       - "develop"
-      - "release*"
+      - "release/*"
     paths:
       - "crates/**/Cargo.toml"
       - "crates/Cargo.lock"
@@ -39,14 +34,14 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-debian:sha-2e25435
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run cargo audit
         id: audit
@@ -71,7 +66,7 @@ jobs:
 
       - name: Create issue
         if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
+        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
         with:
           title: "cargo audit found vulnerabilities"
           body_file: /tmp/cargo-audit-issue.md
@@ -81,4 +76,5 @@ jobs:
         if: ${{ steps.audit.outcome != 'success' }}
         run: |
           echo "cargo audit found advisories!"
+          cat /tmp/cargo-audit.txt
           exit 1

.github/workflows/check-pr-description.yml

@@ -13,7 +13,6 @@ on:
       - ready_for_review
     branches:
       - develop
-      - "release-*"
       - "release/*"
       - "staging/*"
 

.github/workflows/check-pr-title.yml

@@ -13,7 +13,6 @@ on:
       - ready_for_review
     branches:
       - develop
-      - "release-*"
       - "release/*"
       - "staging/*"
 

.github/workflows/check-releases-merged.yml

@@ -0,0 +1,60 @@
+# This workflow checks that every final release on a release branch
+# has been merged back into develop, see RELEASING.md.
+name: Check releases merged
+
+on:
+  schedule:
+    # 06:47 UTC every Monday.
+    - cron: "47 6 * * 1"
+  push:
+    branches:
+      - "develop"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  OUTPUT_FILE: /tmp/releases-merged.txt
+  ISSUE_FILE: /tmp/releases-merged-issue.md
+
+jobs:
+  releases-merged:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Needed to open an issue on scheduled failures.
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The check needs the full history of develop, the release branches and tags.
+          fetch-depth: 0
+
+      - name: Check releases are merged into develop
+        run: |
+          set -o pipefail
+          .github/scripts/releasing/check-releases-merged.sh origin/develop | tee "${OUTPUT_FILE}"
+
+      - name: Prepare issue body
+        if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'XRPLF/rippled' }}
+        run: |
+          {
+              echo '```'
+              cat "${OUTPUT_FILE}"
+              echo '```'
+          } >"${ISSUE_FILE}"
+
+      - name: Create issue
+        if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'XRPLF/rippled' }}
+        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        with:
+          title: "Releases not merged back into develop"
+          body_file: ${{ env.ISSUE_FILE }}
+          labels: "Bug"

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
         with:
           enable_ccache: false
 
@@ -108,7 +108,7 @@ jobs:
 
       - name: Upload regenerated snapshot
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: check-tools-${{ runner.os }}-${{ runner.arch }}
           path: ${{ matrix.snapshot }}

.github/workflows/on-pr.yml

@@ -77,13 +77,15 @@ jobs:
 
             # Keep the paths below in sync with those in `on-trigger.yml`.
             .github/actions/build-deps/**
-            .github/actions/generate-version/**
+            .github/actions/release-info/**
             .github/actions/setup-conan/**
+            .github/actions/setup-nix-env/**
             .github/scripts/strategy-matrix/**
             .github/workflows/reusable-build-test-config.yml
             .github/workflows/reusable-build-test.yml
             .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
+            .github/workflows/reusable-package-test-install.yml
             .github/workflows/reusable-package.yml
             .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
@@ -92,7 +94,7 @@ jobs:
             .clang-tidy
             .codecov.yml
             bin/check-tools.sh
-            bin/default-loader-path.sh
+            bin/nix/**
             cfg/**
             cmake/**
             conan/**
@@ -104,6 +106,9 @@ jobs:
             CMakeLists.txt
             conanfile.py
             conan.lock
+            flake.lock
+            flake.nix
+            nix/**
             LICENSE.md
             package/**
             README.md
@@ -144,6 +149,48 @@ jobs:
     if: ${{ needs.should-run.outputs.go == 'true' }}
     uses: ./.github/workflows/reusable-check-rename.yml
 
+  # Runs regardless of the changed files.
+  # PRs into staging branches are skipped, since fixes may be cherry-picked between release lines.
+  check-release-commits:
+    needs: should-run
+    if: ${{ github.event.pull_request.base.ref == 'develop' || github.event.merge_group.base_ref == 'refs/heads/develop' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The check needs the full history of the release and staging branches.
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check for copied release commits
+        if: ${{ github.event_name == 'pull_request' }}
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: .github/scripts/releasing/check-no-copied-release-commits.sh "${BASE}" "${HEAD}"
+      # Runs even if the previous check fails, so that both problems are reported at once.
+      - name: Check merge-back has no new commits
+        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: .github/scripts/releasing/check-merge-back-commits.sh "${BASE}" "${HEAD}"
+      # The queue squashes PRs, so check the PR's own branch, named in the queue branch.
+      - name: Check the merge queue doesn't merge a release back
+        if: ${{ github.event_name == 'merge_group' }}
+        env:
+          BASE: ${{ github.event.merge_group.base_sha }}
+          HEAD_REF: ${{ github.event.merge_group.head_ref }}
+        run: |
+          if ! [[ "${HEAD_REF}" =~ /pr-([0-9]+)-[0-9a-f]+$ ]]; then
+              echo "Error: Can't find the PR number in '${HEAD_REF}'."
+              exit 1
+          fi
+          git fetch --no-tags origin "refs/pull/${BASH_REMATCH[1]}/head"
+          .github/scripts/releasing/check-no-merge-back.sh "${BASE}" FETCH_HEAD
+
   clang-tidy:
     needs: should-run
     if: ${{ needs.should-run.outputs.go == 'true' }}
@@ -184,6 +231,12 @@ jobs:
     # matrix (i.e. not yet labeled "Ready to merge" or "Full CI build").
     if: ${{ needs.should-run.outputs.go == 'true' && (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'Ready to merge') || contains(github.event.pull_request.labels.*.name, 'Full CI build')) }}
     uses: ./.github/workflows/reusable-package.yml
+    with:
+      # A pull request builds packages to prove they still build, and publishes
+      # nothing. Stated rather than left to the input's default, so that changing
+      # that default cannot start publishing from pull requests. No secrets are
+      # passed either, which is the second reason a publish here cannot succeed.
+      publish: false
 
   upload-recipe:
     needs:
@@ -218,6 +271,7 @@ jobs:
       - check-autogen
       - check-levelization
       - check-rename
+      - check-release-commits
       - clang-tidy
       - build-test
       - rust

.github/workflows/on-tag.yml

@@ -1,5 +1,12 @@
-# This workflow uploads the libxrpl recipe to the Conan remote and builds
-# release packages when a versioned tag is pushed.
+# When a versioned tag is pushed, this workflow:
+#
+#   - builds and tests the release binaries
+#   - uploads the libxrpl recipe to the Conan remote
+#   - builds the DEB and RPM packages
+#   - publishes those packages to the XRPLF package repositories
+#
+# Nothing is published unless the build passes, which is also where CMake
+# rejects a tag that is not a valid version, e.g. 3.2.01.
 name: Tag
 
 on:
@@ -18,13 +25,14 @@ defaults:
 jobs:
   upload-recipe:
     if: ${{ github.repository == 'XRPLF/rippled' }}
+    needs: build-test
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
       remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
       remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   build-test:
-    if: ${{ github.repository == 'XRPLF/rippled' }}
+    if: ${{ github.repository_owner == 'XRPLF' }}
     uses: ./.github/workflows/reusable-build-test.yml
     strategy:
       fail-fast: true
@@ -37,6 +45,16 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   package:
-    if: ${{ github.repository == 'XRPLF/rippled' }}
+    if: ${{ github.repository_owner == 'XRPLF' }}
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
+    with:
+      publish: true
+    secrets:
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}
+      dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}
+      antithesis_docker_host: ${{ secrets.ANTITHESIS_DOCKER_HOST }}
+      antithesis_docker_path: ${{ secrets.ANTITHESIS_DOCKER_PATH }}
+      antithesis_docker_credentials: ${{ secrets.ANTITHESIS_DOCKER_CREDENTIALS }}

.github/workflows/on-trigger.yml

@@ -15,13 +15,15 @@ on:
 
       # Keep the paths below in sync with those in `on-pr.yml`.
       - ".github/actions/build-deps/**"
-      - ".github/actions/generate-version/**"
+      - ".github/actions/release-info/**"
       - ".github/actions/setup-conan/**"
+      - ".github/actions/setup-nix-env/**"
       - ".github/scripts/strategy-matrix/**"
       - ".github/workflows/reusable-build-test-config.yml"
       - ".github/workflows/reusable-build-test.yml"
       - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
+      - ".github/workflows/reusable-package-test-install.yml"
       - ".github/workflows/reusable-package.yml"
       - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
@@ -30,7 +32,7 @@ on:
       - ".clang-tidy"
       - ".codecov.yml"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
+      - "bin/nix/**"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
@@ -42,6 +44,9 @@ on:
       - "CMakeLists.txt"
       - "conanfile.py"
       - "conan.lock"
+      - "flake.lock"
+      - "flake.nix"
+      - "nix/**"
       - "LICENSE.md"
       - "package/**"
       - "README.md"
@@ -115,3 +120,15 @@ jobs:
   package:
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
+    with:
+      # Packages are built on every trigger; only develop pushes in XRPLF/rippled
+      # publish them, matching upload-recipe above.
+      publish: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
+    secrets:
+      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}
+      dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}
+      antithesis_docker_host: ${{ secrets.ANTITHESIS_DOCKER_HOST }}
+      antithesis_docker_path: ${{ secrets.ANTITHESIS_DOCKER_PATH }}
+      antithesis_docker_credentials: ${{ secrets.ANTITHESIS_DOCKER_CREDENTIALS }}

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@d7f2acb47d9662e1e2f8b1f5feffa6d21cc3290a
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-70b8fd3" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
         with:
           enable_ccache: false
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/reusable-build-test-config.yml

@@ -69,6 +69,12 @@ on:
         type: string
         default: ""
 
+      toolchain:
+        description: 'Where the toolchain comes from ("nix" to build the flake CI environment on the runner, empty for the system one). macOS only: Linux always builds in a Nix image, and Nix has no Windows support.'
+        required: false
+        type: string
+        default: ""
+
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -111,6 +117,9 @@ jobs:
       VOIDSTAR_ENABLED: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
       VALIDATOR_KEYS_ENABLED: ${{ contains(inputs.cmake_args, '-Dvalidator_keys=ON') }}
       SANITIZERS_ENABLED: ${{ inputs.sanitizers != '' }}
+      # The binaries reusable-package.yml consumes. A private repository skips
+      # them except on a tag push, which is what produces its release packages.
+      PACKAGING_ARTIFACTS_ENABLED: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
     steps:
       - name: Cleanup workspace (macOS and Windows)
         if: ${{ runner.os == 'macOS' || runner.os == 'Windows' }}
@@ -120,10 +129,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
+      # Before any step that uses a build tool, composite actions included.
+      - name: Setup Nix environment
+        if: ${{ inputs.toolchain == 'nix' }}
+        uses: ./.github/actions/setup-nix-env
+
       - name: Set ccache log file
         if: ${{ inputs.ccache_enabled && runner.debug == '1' }}
         run: echo "CCACHE_LOGFILE=${{ runner.temp }}/ccache.log" >>"${GITHUB_ENV}"
@@ -148,7 +162,21 @@ jobs:
         with:
           compiler: ${{ inputs.compiler }}
 
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
+        with:
+          cache-directories: ${{ env.BUILD_DIR }}/corrosion
+          key: ${{ inputs.config_name }}
+          # two workspaces here because build artifacts are located in 2 places:
+          # - crates/target when cargo is called directly
+          # - build/cargo when cargo is called by cmake
+          workspaces: |
+            crates
+            crates -> ${{ runner.os == 'Windows' && format('../{0}/x64/{1}/cargo', env.BUILD_DIR, inputs.build_type) || format('../{0}/cargo', env.BUILD_DIR) }}
+
+      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
+        if: ${{ inputs.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ inputs.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -158,9 +186,6 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ inputs.build_type }}
-          # Set the verbosity to "quiet" for Windows to avoid an excessive
-          # amount of logs. For other OSes, the "verbose" logs are more useful.
-          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ inputs.sanitizers }}
 
       - name: Configure CMake
@@ -168,6 +193,19 @@ jobs:
         env:
           BUILD_TYPE: ${{ inputs.build_type }}
           CMAKE_ARGS: ${{ inputs.cmake_args }}
+          # GitHub creates a merge commit for a PR
+          # https://www.kenmuse.com/blog/the-many-shas-of-a-github-pull-request/
+          #
+          # We:
+          # - explicitly provide branch name
+          # - use `github.event.pull_request.head.sha` to get the SHA of last commit in the PR branch
+          #
+          # This way it works both for PRs and pushes to branches.
+          GITHUB_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
+          GITHUB_HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}"
+          #
+          # If tag is being pushed, we use that version.
+          FORCE_XRPLD_VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || '' }}
         run: |
           cmake \
               -G '${{ runner.os == 'Windows' && 'Visual Studio 18 2026' || 'Ninja' }}' \
@@ -212,6 +250,25 @@ jobs:
               --target "${CMAKE_TARGET}" \
               2>&1 | tee "${GITHUB_WORKSPACE}/build.log"
 
+      # Nothing may reference the store, so whole trees are checked - the Conan
+      # cache included, since what it holds is what gets uploaded and reused.
+      - name: Check the build output for Nix store references (Nix toolchain)
+        if: ${{ inputs.toolchain == 'nix' }}
+        run: ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}"
+
+      - name: Check the Conan cache for Nix store references (Nix toolchain)
+        if: ${{ inputs.toolchain == 'nix' }}
+        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+
+      # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
+      # images always references the store. Same condition it uses.
+      - name: Check for Nix store references (Linux)
+        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
+        run: |
+          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
+          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
+
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
         run: |
@@ -222,8 +279,8 @@ jobs:
           fi
 
       - name: Upload the binary (Linux)
-        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: xrpld-${{ inputs.config_name }}
           path: ${{ env.BUILD_DIR }}/xrpld
@@ -236,8 +293,8 @@ jobs:
         run: ./validator-keys --unittest
 
       - name: Upload the validator-keys binary
-        if: ${{ github.event.repository.visibility == 'public' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: validator-keys-${{ inputs.config_name }}
           path: |
@@ -248,7 +305,7 @@ jobs:
 
       - name: Upload the test binary (Linux)
         if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: xrpl_tests-${{ inputs.config_name }}
           path: ${{ env.BUILD_DIR }}/xrpl_tests
@@ -264,7 +321,7 @@ jobs:
 
       - name: Upload server definitions
         if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-definitions
           path: ${{ env.BUILD_DIR }}/server_definitions.json
@@ -276,7 +333,7 @@ jobs:
         working-directory: ${{ env.BUILD_DIR }}
         run: |
           ldd ./xrpld
-          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+)' | wc -l)" -eq 0 ]; then
+          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+|libgcc)' | wc -l)" -eq 0 ]; then
               echo 'The binary is statically linked.'
           else
               echo 'The binary is dynamically linked.'
@@ -289,18 +346,12 @@ jobs:
         run: |
           ./xrpld --version | grep libvoidstar
 
-      - name: Run Rust tests
-        if: ${{ !inputs.build_only }}
-        working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
-
       - name: Run the separate tests
         if: ${{ !inputs.build_only }}
         working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
-        run: ./xrpl_tests
+        run: |
+          ./xrpl_tests
+          ./xrpld_tests
 
       - name: Run the embedded tests
         if: ${{ !inputs.build_only }}
@@ -331,6 +382,14 @@ jobs:
 
           LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"
 
+      - name: Run Rust tests
+        if: ${{ !inputs.build_only }}
+        working-directory: crates
+        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
+        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
+        # whose C++ shims only the CMake build defines. The other runners cover these tests.
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a
       # performance measurement, so there is nothing to gain from repeating it
@@ -396,7 +455,7 @@ jobs:
 
       - name: Upload coverage report
         if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           disable_search: true
           disable_telem: true

.github/workflows/reusable-build-test.yml

@@ -51,5 +51,6 @@ jobs:
       config_name: ${{ matrix.config_name }}
       sanitizers: ${{ matrix.sanitizers }}
       compiler: ${{ matrix.compiler || '' }}
+      toolchain: ${{ matrix.toolchain || '' }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/reusable-clang-tidy.yml

@@ -27,14 +27,14 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-fecfc0c"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3d526d4"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
         with:
           enable_ccache: false
 
@@ -59,6 +59,12 @@ jobs:
         with:
           compiler: ${{ env.COMPILER }}
 
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
+        with:
+          cache-directories: ${{ env.BUILD_DIR }}/corrosion
+          workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
+
       - name: Setup Conan
         uses: ./.github/actions/setup-conan
 
@@ -67,7 +73,6 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ env.BUILD_TYPE }}
-          log_verbosity: verbose
 
       - name: Configure CMake
         working-directory: ${{ env.BUILD_DIR }}
@@ -82,17 +87,10 @@ jobs:
               -Dverify_headers=ON \
               ..
 
-      # clang-tidy needs headers generated from proto files
-      - name: Build libxrpl.libpb
+      - name: Build clang-tidy prerequisites
         working-directory: ${{ env.BUILD_DIR }}
         run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl.libpb
-
-      # clang-tidy needs cxxbridge headers generated from Rust crates
-      - name: Build xrpl_crates
-        working-directory: ${{ env.BUILD_DIR }}
-        run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl_crates
+          ninja -j ${{ steps.nproc.outputs.nproc }} tidy_prerequisites
 
       - name: Run clang tidy
         id: run_clang_tidy
@@ -110,7 +108,7 @@ jobs:
 
       - name: Upload clang-tidy output
         if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           path: ${{ env.OUTPUT_FILE }}
           archive: false
@@ -134,7 +132,7 @@ jobs:
 
       - name: Upload clang-tidy diff output
         if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           path: ${{ env.DIFF_FILE }}
           archive: false
@@ -186,7 +184,7 @@ jobs:
 
       - name: Create issue
         if: ${{ steps.run_clang_tidy.outcome != 'success' && inputs.create_issue_on_failure }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
+        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
         with:
           title: "Clang-tidy check failed"
           body_file: ${{ env.ISSUE_FILE }}

.github/workflows/reusable-package-test-install.yml

@@ -0,0 +1,120 @@
+# Install one package format on every distro family it targets, one job per
+# package name and image, and run the binaries there. Called once per format by
+# reusable-package.yml, which owns the names and the image lists.
+name: Install packages
+
+on:
+  workflow_call:
+    inputs:
+      package_type:
+        description: 'The package format to install ("deb" or "rpm").'
+        required: true
+        type: string
+      package_names:
+        description: "JSON array of package names built for this format."
+        required: true
+        type: string
+      images:
+        description: "JSON array of container images to install in."
+        required: true
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  PACKAGE_DIR: packages
+
+jobs:
+  install:
+    strategy:
+      fail-fast: false
+      matrix:
+        package_name: ${{ fromJson(inputs.package_names) }}
+        image: ${{ fromJson(inputs.images) }}
+    name: "${{ matrix.package_name }} on ${{ matrix.image }}"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    container: ${{ matrix.image }}
+    timeout-minutes: 5
+
+    steps:
+      # Every package lands in one directory; the step below picks its own,
+      # which keeps this independent of the artifact names.
+      - name: Download package artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: "*-pkg"
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
+
+      - name: Find the package
+        id: find
+        env:
+          PACKAGE_NAME: ${{ matrix.package_name }}
+          PACKAGE_TYPE: ${{ inputs.package_type }}
+        run: |
+          # The version follows the name, separated by '_' in a DEB and '-' in an
+          # RPM. Requiring a digit after it is what keeps 'xrpld' from picking up
+          # another package, such as 'xrpld-assert'.
+          pattern="${PACKAGE_NAME}[_-][0-9]*.${PACKAGE_TYPE}"
+          package="$(find "${PACKAGE_DIR}" -type f -name "${pattern}" -print -quit)"
+          test -n "${package}" || {
+              echo "no ${pattern} found in ${PACKAGE_DIR}" >&2
+              exit 1
+          }
+          echo "package=${package}" >>"${GITHUB_OUTPUT}"
+
+      # Debian 11 went end-of-life on 2026-08-31
+      # (https://www.debian.org/News/2026/20260831) and its packages are
+      # already partly gone from deb.debian.org, so switch to the
+      # snapshot.debian.org entries the image ships commented out in its
+      # sources.list: they are pinned to the snapshot the image was built
+      # from, so they serve every version it needs and never go away.
+      # Snapshots keep their original, long-passed Valid-Until, hence the
+      # disabled check; the retries absorb snapshot.debian.org's throttling.
+      - name: Switch Debian 11 to snapshot.debian.org
+        if: ${{ matrix.image == 'debian:11' }}
+        run: |
+          sed -i 's|^deb |# deb |; s|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list
+          printf '%s\n' \
+              'Acquire::Check-Valid-Until "false";' \
+              'Acquire::Retries "3";' \
+              >/etc/apt/apt.conf.d/99snapshot
+
+      - name: Install the DEB
+        if: ${{ inputs.package_type == 'deb' }}
+        env:
+          DEBIAN_FRONTEND: noninteractive
+          PACKAGE: ${{ steps.find.outputs.package }}
+        run: |
+          # Stock Debian and Ubuntu images carry no package lists, so apt has
+          # nothing to resolve the systemd dependency from until it fetches them.
+          apt-get update -qq
+          apt-get install -y "./${PACKAGE}"
+
+      - name: Install the RPM
+        if: ${{ inputs.package_type == 'rpm' }}
+        env:
+          PACKAGE: ${{ steps.find.outputs.package }}
+        run: dnf install -y "./${PACKAGE}"
+
+      - name: Run xrpld
+        run: xrpld --version
+
+      - name: Run validator-keys
+        run: validator-keys --version
+
+      - name: Run rippled, the legacy compatibility symlink
+        run: rippled --version
+
+      - name: Check the service account
+        run: id xrpld
+
+      - name: Check the state directory
+        run: test -d /var/lib/xrpld
+
+      - name: Check the log directory
+        run: test -d /var/log/xrpld

.github/workflows/reusable-package.yml

@@ -1,17 +1,57 @@
-# Build Linux packages (DEB and RPM) from pre-built binary artifacts (xrpld and
-# validator-keys). Discovers which configurations to package from linux.json
-# (configs in "package_configs") and fans out one job per distro. Only
-# linux/amd64 is supported; the runner is hardcoded in the job below.
+# Build, verify and publish Linux packages from the pre-built xrpld and
+# validator-keys artifacts, in these stages:
+#
+#   - 'package' builds and signs one format per config that carries a "package"
+#     map in linux.json; that map names the container image and the format
+#   - 'test-install-deb' and 'test-install-rpm' call
+#     reusable-package-test-install.yml to install what was built on a range of
+#     distros and run the binaries there, so a package that cannot be installed
+#     never reaches Nexus
+#   - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
+#     unless 'publish: true'
+#   - 'docker' builds an Ubuntu image from the tested DEB, and one with the
+#     voidstar binary for Antithesis, pushing them to Docker Hub and to the
+#     Antithesis registry only with 'publish: true'
+#
+# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
 name: Package
 
 on:
   workflow_call:
     inputs:
-      pkg_release:
-        description: "Package release number. Increment when repackaging the same executable."
+      publish:
+        description: "Whether to publish the packages after building them."
+        required: false
+        type: boolean
+        default: false
+      nexus_url:
+        description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
         required: false
         type: string
-        default: "1"
+        default: https://packages-upload.xrplf.org
+
+    secrets:
+      remote_username:
+        description: "The username of a Nexus account with write access to the repositories."
+        required: false
+      remote_password:
+        description: "The password or token for that Nexus account."
+        required: false
+      signing_key:
+        description: "Armoured PGP private key used to sign the RPMs."
+        required: false
+      dockerhub_token:
+        description: "A Docker Hub organization access token for xrplf, with push access to xrplf/xrpld."
+        required: false
+      antithesis_docker_host:
+        description: "The host of the Antithesis container registry, e.g. us-central1-docker.pkg.dev."
+        required: false
+      antithesis_docker_path:
+        description: "The repository path in that registry, the image name excluded."
+        required: false
+      antithesis_docker_credentials:
+        description: "The JSON key of a service account with push access to that repository."
+        required: false
 
 defaults:
   run:
@@ -19,12 +59,15 @@ defaults:
 
 env:
   BUILD_DIR: build
+  PACKAGE_DIR: packages
 
 jobs:
   generate-matrix:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.generate.outputs.matrix }}
+      deb_package_names: ${{ steps.generate.outputs.deb_package_names }}
+      rpm_package_names: ${{ steps.generate.outputs.rpm_package_names }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +84,7 @@ jobs:
 
   package:
     needs: [generate-matrix]
-    if: ${{ github.event.repository.visibility == 'public' }}
+    if: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
@@ -50,38 +93,256 @@ jobs:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
     container: ${{ matrix.image }}
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        with:
+          enable_ccache: false
+
+      - name: Download pre-built xrpld binary
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: ${{ matrix.xrpld_artifact_name }}
+          path: ${{ env.BUILD_DIR }}
+
+      - name: Download pre-built validator-keys binary
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: ${{ matrix.validator_keys_artifact_name }}
+          path: ${{ env.BUILD_DIR }}
+
+      - name: Make binaries executable
+        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
+
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
+
+      - name: Build package
+        env:
+          PACKAGE_TYPE: ${{ matrix.package_type }}
+          PACKAGE_VARIANT: ${{ matrix.package_variant }}
+          PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
+          CHANNEL: ${{ steps.release_info.outputs.channel }}
+        run: |
+          ./package/build_pkg.py \
+              --package-type "${PACKAGE_TYPE}" \
+              --build-dir "${BUILD_DIR}" \
+              --pkg-release "${PKG_RELEASE}" \
+              --variant "${PACKAGE_VARIANT}" \
+              --channel "${CHANNEL}"
+
+      # Before the upload, so the artifact, the tested package and the published
+      # package are the same bytes.
+      - name: Sign RPM
+        if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
+        env:
+          PKG_SIGNING_KEY: ${{ secrets.signing_key }}
+        run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
+
+      # Split from the debug symbols, which are an order of magnitude larger, so
+      # that test-install downloads only what it installs. In the globs below the
+      # version follows the name, separated by '_' in a DEB and '-' in an RPM. A
+      # version starts with a digit and a longer name does not, so that one digit
+      # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
+      - name: Upload package artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: ${{ matrix.xrpld_artifact_name }}-pkg
+          path: |
+            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}_[0-9]*.deb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/${{ matrix.package_name }}-[0-9]*.rpm
+          if-no-files-found: error
+
+      - name: Upload debug symbol artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
+          path: |
+            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}-dbgsym_[0-9]*.deb
+            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}-dbgsym_[0-9]*.ddeb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/${{ matrix.package_name }}-debuginfo-[0-9]*.rpm
+          if-no-files-found: error
+
+  # One call per format, so a variant packaged for one format is installed for
+  # that format alone. The images are every distro family that format targets,
+  # oldest release first, so both ends of the dependency range the packages
+  # declare are exercised.
+  test-install-deb:
+    needs: [generate-matrix, package]
+    name: install deb
+    uses: ./.github/workflows/reusable-package-test-install.yml
+    with:
+      package_type: deb
+      package_names: ${{ needs.generate-matrix.outputs.deb_package_names }}
+      images: |
+        [
+          "debian:11",
+          "debian:12",
+          "debian:13",
+          "ubuntu:20.04",
+          "ubuntu:22.04",
+          "ubuntu:24.04",
+          "ubuntu:26.04"
+        ]
+
+  test-install-rpm:
+    needs: [generate-matrix, package]
+    name: install rpm
+    uses: ./.github/workflows/reusable-package-test-install.yml
+    with:
+      package_type: rpm
+      package_names: ${{ needs.generate-matrix.outputs.rpm_package_names }}
+      images: |
+        [
+          "almalinux:9",
+          "almalinux:10",
+          "rockylinux/rockylinux:9",
+          "rockylinux/rockylinux:10",
+          "registry.access.redhat.com/ubi9/ubi",
+          "registry.access.redhat.com/ubi10/ubi"
+        ]
+
+  publish:
+    needs: [generate-matrix, package, test-install-deb, test-install-rpm]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+    name: "publish ${{ matrix.xrpld_artifact_name }}${{ !inputs.publish && ' (dry run)' || '' }}"
+    permissions:
+      contents: read
+    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
+    container: ${{ matrix.image }}
     timeout-minutes: 30
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Download pre-built xrpld binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
         with:
-          name: ${{ matrix.xrpld_artifact_name }}
-          path: ${{ env.BUILD_DIR }}
+          enable_ccache: false
 
-      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      # Both artifacts, so the debug symbols are published alongside the package.
+      - name: Download package artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          name: ${{ matrix.validator_keys_artifact_name }}
-          path: ${{ env.BUILD_DIR }}
+          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
 
-      - name: Make binaries executable
-        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
 
-      - name: Build package
+      - name: Publish package
         env:
-          PKG_RELEASE: ${{ inputs.pkg_release }}
-        run: ./package/build_pkg.sh
+          CHANNEL: ${{ steps.release_info.outputs.channel }}
+          DRY_RUN_OPTION: ${{ !inputs.publish && '--dry-run' || '' }}
+          NEXUS_URL: ${{ inputs.nexus_url }}
+          NEXUS_USERNAME: ${{ inputs.publish && secrets.remote_username || '' }}
+          NEXUS_PASSWORD: ${{ inputs.publish && secrets.remote_password || '' }}
+        run: |
+          publish_pkg.py \
+              --channel "${CHANNEL}" \
+              --package-dir "${PACKAGE_DIR}" \
+              --nexus-url "${NEXUS_URL}" \
+              ${DRY_RUN_OPTION}
 
-      - name: Upload package artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+  docker:
+    needs: [test-install-deb, test-install-rpm]
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [xrpld, voidstar]
+    name: "docker ${{ matrix.target }}${{ !inputs.publish && ' (dry run)' || '' }}"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CONTEXT: image-context
+      IMAGE: ${{ matrix.target == 'voidstar' && 'xrpld-voidstar' || 'xrplf/xrpld' }}:${{ github.ref_type == 'tag' && github.ref_name || 'develop' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
+
+      # Docker Hub is public, so it only gets builds whose packages are public:
+      # those of a public codebase, and stable releases.
+      # The Antithesis registry is private, so it gets every build.
+      - name: Decide whether to push
+        env:
+          PUSH: ${{ inputs.publish && (matrix.target == 'voidstar' || github.event.repository.visibility == 'public' || steps.release_info.outputs.channel == 'stable') }}
+        run: echo "PUSH=${PUSH}" | tee -a "${GITHUB_ENV}"
+
+      - name: Download package artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg
-          path: |
-            ${{ env.BUILD_DIR }}/debbuild/*.deb
-            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
-          if-no-files-found: error
+          pattern: "*-pkg"
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
+
+      - name: Download voidstar binary
+        if: ${{ matrix.target == 'voidstar' }}
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: xrpld-ubuntu-clang-debug-amd64-voidstar
+          path: ${{ env.CONTEXT }}
+
+      - name: Build image
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          mkdir -p "${CONTEXT}"
+          find "${PACKAGE_DIR}" -type f -name 'xrpld_[0-9]*.deb' -exec cp {} "${CONTEXT}/" \;
+          docker build --pull --file package/images/xrpld/Dockerfile --target "${TARGET}" --tag "${IMAGE}" "${CONTEXT}"
+
+      - name: Start the server
+        run: |
+          container="$(docker run --detach "${IMAGE}" --standalone --silent --conf /etc/xrpld/xrpld.cfg)"
+          trap 'docker rm --force "${container}" >/dev/null' EXIT
+
+          for _ in $(seq 30); do
+              output="$(docker exec "${container}" xrpld --conf /etc/xrpld/xrpld.cfg server_info || true)"
+              if [[ "${output}" == *'"status" : "success"'* ]]; then
+                  exit 0
+              fi
+              sleep 2
+          done
+
+          docker logs "${container}"
+          exit 1
+
+      - name: Log in to Docker Hub
+        if: ${{ env.PUSH == 'true' && matrix.target == 'xrpld' }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: xrplf
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Log in to the Antithesis registry
+        if: ${{ env.PUSH == 'true' && matrix.target == 'voidstar' }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ secrets.antithesis_docker_host }}
+          username: _json_key
+          password: ${{ secrets.antithesis_docker_credentials }}
+
+      - name: Push image
+        if: ${{ env.PUSH == 'true' }}
+        env:
+          REGISTRY: ${{ matrix.target == 'voidstar' && format('{0}/{1}/', secrets.antithesis_docker_host, secrets.antithesis_docker_path) || '' }}
+        run: |
+          docker tag "${IMAGE}" "${REGISTRY}${IMAGE}"
+          docker push "${REGISTRY}${IMAGE}"

.github/workflows/reusable-rust.yml

@@ -1,8 +1,9 @@
 # Clippy, coverage and documentation for the Rust crates in crates/. Each runs
 # as an independent job on a GitHub-hosted runner, but inside the same container
 # image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints, coverage instrumentation and the cargo cache) matches
-# what production builds use.
+# (and therefore the lints and the cargo cache) matches what production builds
+# use. Coverage is the exception: it needs the nightly rustc that honours
+# #[coverage(off)], which the image carries alongside the pinned stable.
 #
 # Rust unit tests are deliberately NOT run here. They run as part of the C++
 # build (reusable-build-test-config.yml), which already compiles the crates on a
@@ -14,7 +15,7 @@ on:
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
-        required: false
+        required: true
 
 defaults:
   run:
@@ -27,37 +28,36 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
+      - name: Use the nightly Rust toolchain
+        run: rust-nightly path >>"${GITHUB_PATH}"
+
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
 
       - name: Upload coverage report
         if: ${{ github.repository == 'XRPLF/rippled' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           disable_search: true
           disable_telem: true
@@ -70,15 +70,13 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
+      - name: Use cargo artifacts cache
+        uses: ./.github/actions/cargo-cache
 
       - name: Build documentation
         env:

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -49,9 +49,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Generate build version number
-        id: version
-        uses: ./.github/actions/generate-version
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        with:
+          enable_ccache: false
+
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
 
       - name: Set up Conan
         uses: ./.github/actions/setup-conan
@@ -63,33 +68,17 @@ jobs:
         run: conan remote login "${REMOTE_NAME}" "${CONAN_LOGIN_USERNAME_XRPLF}" --password "${CONAN_PASSWORD_XRPLF}"
 
       - name: Upload Conan recipe (version)
+        env:
+          VERSION: ${{ steps.release_info.outputs.version }}
         run: |
-          conan export . --version=${{ steps.version.outputs.version }}
-          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
+          conan export . --version="${VERSION}"
+          conan upload --confirm --check --remote="${REMOTE_NAME}" "xrpl/${VERSION}"
 
-      # When this workflow is triggered by a push event, it will always be when merging into the
-      # 'develop' branch, see on-trigger.yml.
       - name: Upload Conan recipe (develop)
-        if: ${{ github.event_name == 'push' }}
+        if: ${{ github.ref == 'refs/heads/develop' }}
         run: |
           conan export . --version=develop
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/develop
 
-      # When this workflow is triggered by a pull request event, it will always be when merging into
-      # one of the 'release' branches, see on-pr.yml.
-      - name: Upload Conan recipe (rc)
-        if: ${{ github.event_name == 'pull_request' }}
-        run: |
-          conan export . --version=rc
-          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/rc
-
-      # When this workflow is triggered by a push event, it will always be when tagging a final
-      # release, see on-tag.yml.
-      - name: Upload Conan recipe (release)
-        if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        run: |
-          conan export . --version=release
-          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
-
     outputs:
-      ref: xrpl/${{ steps.version.outputs.version }}
+      ref: xrpl/${{ steps.release_info.outputs.version }}

.github/workflows/upload-conan-deps.yml

@@ -68,10 +68,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
         with:
           enable_ccache: false
 
+      # Before any step that uses a build tool, composite actions included.
+      - name: Setup Nix environment
+        if: ${{ matrix.toolchain == 'nix' }}
+        uses: ./.github/actions/setup-nix-env
+
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574
 
@@ -87,7 +92,9 @@ jobs:
         with:
           compiler: ${{ matrix.compiler }}
 
+      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
+        if: ${{ matrix.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ matrix.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -101,11 +108,12 @@ jobs:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ matrix.build_type }}
           force_build: ${{ github.event_name == 'schedule' || github.event.inputs.force_source_build == 'true' }}
-          # Set the verbosity to "quiet" for Windows to avoid an excessive
-          # amount of logs. For other OSes, the "verbose" logs are more useful.
-          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
+      - name: Check the Conan cache for Nix store references (Nix toolchain)
+        if: ${{ matrix.toolchain == 'nix' }}
+        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"

.gitignore

@@ -72,11 +72,16 @@ DerivedData
 /.zed/
 
 # AI tools.
+# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
+# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
+# personal/local variants below are ignored.
 /.agent
 /.agents
 /.augment
-/.claude
-/CLAUDE.md
+/.claude/settings.local.json
+AGENTS.override.md
+CLAUDE.local.md
+GEMINI.local.md
 
 # Python
 __pycache__
@@ -87,6 +92,9 @@ target/
 # Direnv's directory
 /.direnv
 
+# Direnv's local, per-developer overrides
+/.envrc.local
+
 # clangd cache
 /.cache
 

.pre-commit-config.yaml

@@ -53,9 +53,14 @@ repos:
         entry: ./bin/pre-commit/check_doxygen_style.py
         language: python
         types_or: [c++, c]
+      - id: fix-gtest-names
+        name: "fix gtest names: CamelCase suite, snake_case test case"
+        entry: ./bin/pre-commit/fix_gtest_names.py
+        language: python
+        types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: f4d7745e17a28aad7eed2f4874ca8d1568c11c4c # frozen: v22.1.8
+    rev: a9a8a861f30ed207ead7d5a3b7e8032283ba5da7 # frozen: v23.1.2
     hooks:
       - id: clang-format
         args: [--style=file]
@@ -70,25 +75,47 @@ repos:
         language: system
         types: [rust]
         pass_filenames: false # rustfmt formats the whole workspace
+      - id: check-coverage-attrs
+        name: check Rust coverage attributes
+        entry: ./bin/pre-commit/check_rust_coverage_attrs.py
+        language: python
+        files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
+    rev: 28010ddd6016e1a0f7bd232acb6536ef996ae897 # frozen: 0.29.2
     hooks:
       - id: gersemi
+        args: [-i, --warnings-as-errors]
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 9337a74165b178ae2c766f60bee7252a0f06f3e8 # frozen: v3.9.5
+    rev: ef4a397f916211b4a39ccf9d3d9cbb6562157251 # frozen: v3.9.9
     hooks:
       - id: prettier
         args: [--end-of-line=auto]
 
+  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
+  # so widening these is its own change.
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253 # frozen: v0.16.10
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+        files: ^package/.*\.py$
+
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
+    rev: 96ae3e5802f3fe2d551e703e18f0a367d1a81ac2 # frozen: 26.10.0
     hooks:
       - id: black
 
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: 2834ec6639549dd6796205c8f011dedcd587288b # frozen: v2.4.0
+    hooks:
+      - id: mypy
+        args: [--strict]
+        files: ^package/.*\.py$
+
   - repo: https://github.com/scop/pre-commit-shfmt
-    rev: 05c1426671b9237fb5e1444dd63aa5731bec0dfb # frozen: v3.13.1-1
+    rev: 479be5958357ba5ab65ce47172117348516860e9 # frozen: v3.14.1-1
     hooks:
       - id: shfmt
         args: [--write, --indent=4, --case-indent=true]
@@ -107,7 +134,7 @@ repos:
         files: \.md$
 
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: ea11f9efc0bec520073405bc30552da887ba71bc # frozen: v10.0.1
+    rev: f5c5d72342f35643988a9ffa0705c05bd3ff8383 # frozen: v10.3.0
     hooks:
       - id: cspell
         name: check changed files spelling

AGENTS.md

@@ -0,0 +1,42 @@
+# AGENTS.md
+
+This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
+
+## Build
+
+Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
+
+```bash
+nix develop
+```
+
+For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
+
+Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
+
+## Testing
+
+Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
+
+- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
+- `--unittest-arg` does nothing — don't use it.
+- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
+- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
+
+## Lint/Format
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
+
+## Code Style
+
+New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
+
+## Architecture
+
+Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
+
+- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
+- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
+- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
+- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
+- `crates/` — a Rust workspace holding the WebAssembly engine that runs Smart Escrow contracts, bridged into C++ via `cxxbridge`/the `cxx` crate; see [crates/README.md](./crates/README.md) for more details.

API-CHANGELOG.md

@@ -22,17 +22,67 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## Unreleased
+## XRP Ledger server version 3.5.0
 
-This section contains changes targeting a future version.
+Version 3.5.0 is not yet released.
 
-### Additions
+### Additions in 3.5.0
 
-- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
-  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
+- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive the same `transaction` message as the `transactions` stream for each validated transaction whose metadata affects a subscribed issuance. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
+- `ledger_entry`: Add full support for checks, NFT offers, payment channels, and signer lists. ([#6319](https://github.com/XRPLF/rippled/pull/6319))
+
+### Bugfixes in 3.5.0
+
+- `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
+- `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
+
+### Bugfixes in 3.5.0
+
+- `feature`: The admin-only `vetoed` field now returns `invalidParams` unless its value is a boolean. [#7583](https://github.com/XRPLF/rippled/pull/7583)
+
+## XRP Ledger server version 3.4.0
+
+Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
+
+### Additions in 3.4.0
+
+- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
+
+### Bugfixes in 3.4.0
+
+- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
+- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
+- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
+- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
+- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
+- `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
+- `transaction_entry`: An object or an array in `tx_hash` now returns `malformedRequest`, like any other value that is not a hex hash, instead of an `internal` error.
+
+## XRP Ledger server version 3.3.0
+
+[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
+
+### Additions in 3.3.0
+
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
+
+## XRP Ledger server version 3.2.1
+
+[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.2.0
+
+[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
+
+### Additions in 3.2.0
 
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
-
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
   - `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
   - `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -40,9 +90,8 @@ This section contains changes targeting a future version.
   - `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
   - `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
 
-### Bugfixes
+### Bugfixes in 3.2.0
 
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -55,6 +104,24 @@ This section contains changes targeting a future version.
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 
+## XRP Ledger server version 3.1.3
+
+[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.1.2
+
+[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.1.1
+
+[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
+
+This release contains bug fixes only and no API changes.
+
 ## XRP Ledger server version 3.1.0
 
 [Version 3.1.0](https://github.com/XRPLF/rippled/releases/tag/3.1.0) was released on Jan 27, 2026.

BUILD.md

@@ -1,37 +1,17 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
 ## Minimum Requirements
 
-See [System Requirements](https://xrpl.org/system-requirements.html).
+For the hardware needed to run a node, see
+[System Requirements](https://xrpl.org/system-requirements.html).
 
-Building xrpld generally requires Git, Python, Conan, CMake, and a C++
-compiler.
-
-- [Python](https://www.python.org/downloads/)
-- [Conan](https://conan.io/downloads.html)
-- [CMake](https://cmake.org/download/)
-
-You can verify that the required tools are installed and runnable with:
-
-```bash
-./bin/check-tools.sh
-```
-
-`xrpld` is written in the C++23 dialect. The [tested compiler versions][cpp23-support] are:
-
-| Compiler    | Version         |
-| ----------- | --------------- |
-| GCC         | 15.2            |
-| Clang       | 22              |
-| Apple Clang | 21              |
-| MSVC        | 19.44[^windows] |
+For the software needed to build xrpld, see the
+[environment setup guide](./docs/build/environment.md).
 
 ## Operating Systems
 
-Please see the [environment setup guide](./docs/build/environment.md) for detailed instructions for all platforms.
-
 ### Linux
 
 The Ubuntu Linux distribution has received the highest level of quality
@@ -47,9 +27,8 @@ CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOY
 
 ### Windows
 
-Windows is used by some engineers for development only.
-
-[^windows]: Windows is not recommended for production use.
+Windows is used by some engineers for development only, and is not recommended
+for production use.
 
 ## Steps
 
@@ -62,49 +41,41 @@ branch.
 git checkout develop
 ```
 
-For a release candidate, choose the relevant release branch, e.g.
-`release/3.2.x`.
+For a release or release candidate, check out its [tag](https://github.com/XRPLF/rippled/releases), e.g.:
 
 ```bash
-git checkout release/3.2.x
+git checkout 3.4.0
 ```
 
-For a stable release, choose one of the [tagged
-releases](https://github.com/XRPLF/rippled/releases).
+See [RELEASING.md](./RELEASING.md) for how branches and releases are organized.
+
+A build reports `0.0.0-dev` with its short commit hash as build metadata, e.g.
+`0.0.0-dev+0123abc`. Only builds of a release, from a tag in CI or a versioned
+Conan reference, report a release version. To use another version, set the
+`FORCE_XRPLD_VERSION` environment variable when running CMake, e.g.
+`FORCE_XRPLD_VERSION=3.4.0`.
 
 ### Set Up Conan
 
-After you have a [C++ development environment](./docs/build/environment.md) ready with Git, Python,
-Conan, CMake, and a C++ compiler, you may need to set up your Conan profile.
-
-These instructions assume a basic familiarity with Conan and CMake. If you are
-unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
-[Getting Started][conan-getting-started] walkthrough.
-
-#### Profiles
-
-We recommend that you install our Conan profiles:
+Once your [development environment](./docs/build/environment.md) is ready, set
+Conan up for this repository:
 
 ```bash
-conan config install conan/profiles/ -tf $(conan config home)/profiles/
+./conan/init.sh
 ```
 
-You can check your Conan profile by running:
+That installs our [`global.conf`](./conan/global.conf), our Conan
+[profiles](./conan/profiles), and the `xrplf` remote that hosts some of our
+dependencies. It honours `CONAN_HOME` and never deletes an existing Conan home,
+so it is safe to re-run — it only overwrites the files it manages.
 
-```bash
-conan profile show
-```
+> [!TIP]
+> In the [Nix development shell](./docs/build/nix.md#conan-configuration) this is
+> already done for you: the script runs on entry.
 
-If the default profile is not suitable for your environment, you can create a custom profile and pass it to Conan.
-More information on customizing Conan can be found in the [Advanced Conan configuration](./docs/build/advanced_conan.md).
-
-#### Add xrplf remote
-
-Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
-
-```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
-```
+You can inspect the resulting profile with `conan profile show`. If it is not
+suitable for your environment, create a custom profile and pass it to Conan — see
+[Advanced Conan configuration](./docs/build/advanced_conan.md).
 
 ### Set Up Ccache
 
@@ -269,10 +240,14 @@ which is only enabled when the `coverage` option is set, e.g. with
 Prerequisites for the coverage report:
 
 - [gcovr tool][gcovr] (can be installed e.g. with [pip][python-pip])
-- `gcov` for GCC (installed with the compiler by default) or
-- `llvm-cov` for Clang (installed with the compiler by default)
+- `gcov` for GCC or `llvm-cov` for Clang, usually installed with the compiler
 - `Debug` build type
 
+> [!NOTE]
+> Clang coverage is not available in the [Nix development shell](./docs/build/nix.md#building-xrpld-in-the-nix-shell):
+> its `clang` shells do not ship `llvm-cov`. Use a `gcc` shell instead (`.#gcc`,
+> or `.#gcc-plain` on Linux), which provides a `gcov` matching its compiler.
+
 A coverage report is created when the following steps are completed, in order:
 
 1. `xrpld` binary built with instrumentation data, enabled by the `coverage`
@@ -345,6 +320,22 @@ memory) since they concatenate sources into fewer translation units. Non-unity
 builds may be faster for incremental builds, and can be helpful for detecting
 `#include` omissions.
 
+### Rust crates
+
+The build compiles the Rust workspace in `crates/` and generates the cxxbridge
+bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
+at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
+[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
+as described in [Rust](./docs/build/environment.md#rust).
+
+The crates also have their own Rust unit tests. Those are run with `cargo` and
+need only the Rust toolchain, independently of CMake (CI runs them with
+`cargo nextest`):
+
+```bash
+cargo test --manifest-path crates/Cargo.toml --workspace
+```
+
 ### Verifying headers
 
 The regular build only compiles `.cpp` files, so a header is only ever checked
@@ -389,10 +380,14 @@ After any updates or changes to dependencies, you may need to do the following:
 4. [Regenerate lockfile](./docs/build/advanced_conan.md#conan-lockfile).
 5. Re-run [conan install](#build-and-test).
 
+If you are using the Nix development shell, whether prebuilt Conan binaries apply
+depends on your platform — see
+[Prebuilt packages](./docs/build/nix.md#prebuilt-packages).
+
 #### ERROR: Package not resolved
 
 If you're seeing an error like `ERROR: Package 'snappy/1.1.10' not resolved: Unable to find 'snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246' in remotes.`,
-please [add `xrplf` remote](#add-xrplf-remote) or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
+please [set Conan up](#set-up-conan) so the `xrplf` remote is configured, or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
 
 ### `protobuf/port_def.inc` file not found
 
@@ -412,7 +407,6 @@ For example, if you want to build Debug:
 1. For conan install, pass `--settings build_type=Debug`
 2. For cmake, pass `-DCMAKE_BUILD_TYPE=Debug`
 
-[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [conan-getting-started]: https://docs.conan.io/en/latest/getting_started.html
 [unity-build]: https://en.wikipedia.org/wiki/Unity_build
 [gcovr]: https://gcovr.com/en/stable/getting-started.html

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CMakeLists.txt

@@ -77,7 +77,6 @@ endif()
 include(PatchNixBinary)
 
 include(XrplSanity)
-include(XrplVersion)
 include(XrplSettings)
 # this check has to remain in the top-level cmake because of the early return statement
 if(packages_only)
@@ -115,6 +114,7 @@ find_package(secp256k1 REQUIRED)
 find_package(SOCI REQUIRED)
 find_package(SQLite3 REQUIRED)
 find_package(xxHash REQUIRED)
+find_package(xrpl-rpc-spec REQUIRED)
 
 target_link_libraries(
     xrpl_libs
@@ -158,6 +158,8 @@ if(coverage)
     include(XrplCov)
 endif()
 
+add_custom_target(tidy_prerequisites)
+
 add_subdirectory(crates)
 include(XrplCore)
 include(XrplProtocolAutogen)
@@ -170,6 +172,7 @@ include(XrplPackaging)
 if(tests)
     include(CTest)
     add_subdirectory(src/tests/libxrpl)
+    add_subdirectory(src/tests/xrpld)
 endif()
 
 if(benchmark)

CONTRIBUTING.md

@@ -14,9 +14,13 @@ The following branches exist in the main project repository:
 
 - `develop`: The latest set of unreleased features, and the most common
   starting point for contributions.
-- `release/*` (e.g. `release/3.2.x`): Release branches, one per release line,
-  holding the latest release candidate, or stable release for that line.
-  Stable releases are published as [tagged releases](https://github.com/XRPLF/rippled/releases).
+- `staging/*` (e.g. `staging/3.4.x`): Staging branches, one per release line,
+  where fixes for that line are developed.
+- `release/*` (e.g. `release/3.4.x`): Release branches, one per release line,
+  holding the latest public release candidate or release for that line.
+  Releases are published as [tagged releases](https://github.com/XRPLF/rippled/releases).
+
+See [RELEASING.md](./RELEASING.md) for how these branches are used.
 
 The tip of each branch must be signed. In order for GitHub to sign a
 squashed commit that it builds from your pull request, GitHub must know
@@ -59,6 +63,17 @@ to an existing XLS. Neither change will be released (in an amendment's
 case, marked as `Supported::yes`) until the corresponding XLS's status
 is `Final`.
 
+## AI coding agents
+
+[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
+
+If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
+
+- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
+- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
+
+Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
+
 ## Before making a pull request
 
 (Or marking a draft pull request as ready.)
@@ -82,7 +97,7 @@ If you create new source files, they must be organized as follows:
   under `include/xrpl`, and source (`.cpp`) files must go under
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
-- All test source files must go under `src/test`.
+- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
 - All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest
@@ -134,8 +149,8 @@ tl;dr
 
 In general, pull requests use `develop` as the base branch.
 
-The exceptions are fixes, improvements, and hotfixes for an existing release,
-which use that release's branch (e.g. `release/3.2.x`) as the base.
+The exceptions are fixes for an existing release line,
+which use that line's staging branch (e.g. `staging/3.4.x`) as the base.
 
 If your changes are not quite ready, but you want to make it easily available
 for preliminary examination or review, you can create a "Draft" pull request.
@@ -225,8 +240,9 @@ environment, so you don't need to install most of the individual tools
 yourself. The version of each hook sourced from an external repository
 (`clang-format`, `gersemi`, etc.) is pinned in that file, so running the hooks
 locally uses exactly the same versions as CI. A few `local` hooks — most notably
-`clang-tidy` — run tools from your own environment; see
-[Installing clang-tidy](#installing-clang-tidy) for how to get those.
+`clang-tidy` and `cargo fmt` — run tools from your own environment; see
+[Installing clang-tidy](#installing-clang-tidy) and
+[Rust](./docs/build/environment.md#rust) for how to get those.
 
 To get started, install `pre-commit` and enable the git hook scripts:
 
@@ -255,6 +271,7 @@ The hooks configured in this repository include, among others:
 - `clang-tidy` — C++ static analysis (see [Clang-tidy](#clang-tidy)); opt in with `TIDY=1`
 - `fix-include-style`, `fix-pragma-once`, `check-doxygen-style` — C++ hygiene
 - `gersemi` — CMake formatting
+- `cargo fmt` — Rust formatting for the crates in `crates/`
 - `prettier`, `black`, `shfmt` — formatting for JavaScript/JSON/Markdown, Python, and shell
 - `cspell` — spell checking
 
@@ -319,7 +336,11 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must build the project to generate required files (particularly protobuf headers). Refer to [`BUILD.md`](./BUILD.md) for build instructions.
+Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
+
+```bash
+cmake --build build --target tidy_prerequisites
+```
 
 #### Via pre-commit (recommended)
 
@@ -462,8 +483,12 @@ exists, then no other unit test will be executed, apart from `TestSuiteName`.
     elsewhere in the codebase.
 12. Use clear and self-explanatory names for functions, variables,
     structs and classes.
-13. Use TitleCase for classes, structs and filenames, camelCase for
-    function and variable names, lower case for namespaces and folders.
+13. Use TitleCase for classes, structs, type aliases and filenames,
+    camelCase for function and variable names, lower case for namespaces and
+    folders. The exception is a type alias that generic code looks up by name
+    (`value_type`, `iterator`, `result_type`, and the rest of the standard
+    container, hash and clock members), which keeps its snake_case spelling;
+    `.clang-tidy` lists the names that are allowed.
 14. Provide as many comments as you feel that a competent programmer
     would need to understand what your code does.
 
@@ -570,15 +595,16 @@ the suggested commit message, or modify it as needed.
 
 #### Slightly more complicated pull requests
 
-Some pull requests need to be pushed to `develop` as more than one
-commit. A PR author may _request_ to merge as separate commits. They
+Some pull requests need to be pushed to their base branch (usually `develop`)
+as more than one commit.
+A PR author may _request_ to merge as separate commits. They
 must _justify_ why separate commits are needed, and _specify_ how they
 would like the commits to be merged. If you disagree with the author,
 discuss it with them directly.
 
 If the process is reasonable, follow it. The simplest option is to do a
-fast forward only merge (`--ff-only`) on the command line and push to
-`develop`.
+fast forward only merge (`--ff-only`) on the command line
+and push to the base branch.
 
 Some examples of when separate commits are worthwhile are:
 
@@ -591,9 +617,10 @@ Some examples of when separate commits are worthwhile are:
 
 Either way, check that:
 
-- The commits are based on the current tip of `develop`.
-- The commits are clean: No merge commits (except when reverse
-  merging), no "[FOLD]" or "fixup!" messages.
+- The commits are based on the current tip of the base branch.
+- The commits are clean:
+  No merge commits (except when merging a release, see [RELEASING.md](./RELEASING.md)),
+  no "[FOLD]" or "fixup!" messages.
 - All commits are signed. If the commits are not signed by the author, use
   `git commit --amend -S` to sign them yourself.
 - At least one (but preferably all) of the commits has the PR number
@@ -605,578 +632,8 @@ use them!**
 
 ### Releases
 
-All releases, including release candidates and betas, are handled
-differently from typical PRs. Most importantly, never use
-the Github UI to merge a release.
-
-Xrpld uses a linear workflow model that can be summarized as:
-
-1. In between releases, developers work against the `develop` branch.
-2. Periodically, a maintainer will build and tag a beta version from
-   `develop`, which is pushed to `release`.
-   - Betas are usually released every two to three weeks, though that
-     schedule can vary depending on progress, availability, and other
-     factors.
-3. When the changes in `develop` are considered stable and mature enough
-   to be ready to release, a release candidate (RC) is built and tagged
-   from `develop`, and merged to `release`.
-   - Further development for that release (primarily fixes) then
-     continues against `release`, while other development continues on
-     `develop`. Effectively, `release` is forked from `develop`. Changes
-     to `release` must be reverse merged to `develop`.
-4. When the candidate has passed testing and is ready for release, the
-   final release is merged to `master`.
-5. If any issues are found post-release, a hotfix / point release may be
-   created, which is merged to `master`, and then reverse merged to
-   `develop`.
-
-#### Betas, and the first release candidate
-
-##### Preparing the `develop` branch
-
-1. Optimally, the `develop` branch will be ready to go, with all
-   relevant PRs already merged.
-2. If there are any PRs pending, merge them **BEFORE** preparing the beta.
-   1. If only one or two PRs need to be merged, merge those PRs [as
-      normal](#when-and-how-to-merge-pull-requests), updating the second
-      one, and waiting for CI to finish in between.
-   2. If there are several pending PRs, do not use the Github UI,
-      because the delays waiting for CI in between each merge will be
-      unnecessarily onerous. (Incidentally, this process can also be
-      used to merge if the Github UI has issues.) Merge each PR branch
-      directly to a `release-next` on your local machine and create a single
-      PR, then push your branch to `develop`.
-      1. Squash the changes from each PR, one commit each (unless more
-         are needed), being sure to sign each commit and update the
-         commit message to include the PR number. You may be able to use
-         a fast-forward merge for the first PR.
-      2. Push your branch.
-      3. Continue to [Making the release](#making-the-release) to update
-         the version number, etc.
-
-      The workflow may look something like:
-
-```
-git fetch --multiple upstreams user1 user2 user3 [...]
-git checkout -B release-next --no-track upstream/develop
-
-# Only do an ff-only merge if pr-branch1 is either already
-# squashed, or needs to be merged with separate commits,
-# and has no merge commits.
-# Use -S on the ff-only merge if pr-branch1 isn't signed.
-git merge [-S] --ff-only user1/pr-branch1
-
-git merge --squash user2/pr-branch2
-git commit -S # Use the commit message provided on the PR
-
-git merge --squash user3/pr-branch3
-git commit -S # Use the commit message provided on the PR
-
-[...]
-
-# Make sure the commits look right
-git log --show-signature "upstream/develop..HEAD"
-
-git push --set-upstream origin
-
-# Continue to "Making the release" to update the version number, so
-# everything can be done in one PR.
-```
-
-You can also use the [squash-branches] script.
-
-You may also need to manually close the open PRs after the changes are
-merged to `develop`. Be sure to include the commit ID.
-
-##### Making the release
-
-This includes, betas, and the first release candidate (RC).
-
-1. If you didn't create one [preparing the `develop`
-   branch](#preparing-the-develop-branch), Ensure there is no old
-   `release-next` branch hanging around. Then make a `release-next`
-   branch that only changes the version number. e.g.
-
-```
-git fetch upstreams
-
-git checkout --no-track -B release-next upstream/develop
-
-v="A.B.C-bD"
-build=$( find -name BuildInfo.cpp )
-sed 's/\(^.*versionString =\).*$/\1 "'${v}'"/' ${build} > version.cpp && mv -vi version.cpp ${build}
-
-git diff
-
-git add ${build}
-
-git commit -S -m "Set version to ${v}"
-
-# You could use your "origin" repo, but some CI tests work better on upstream.
-git push upstream-push
-git fetch upstreams
-git branch --set-upstream-to=upstream/release-next
-```
-
-You can also use the [update-version] script. 2. Create a Pull Request for `release-next` with **`develop`** as
-the base branch.
-
-1.  Use the title "[TRIVIAL] Set version to X.X.X-bX".
-2.  Instead of the default description template, use the following:
-
-```
-## High Level Overview of Change
-
-This PR only changes the version number. It will be merged as
-soon as Github CI actions successfully complete.
-```
-
-3. Wait for CI to successfully complete, and get someone to approve
-   the PR. (It is safe to ignore known CI issues.)
-4. Push the updated `develop` branch using your `release-next`
-   branch. **Do not use the Github UI. It's important to preserve
-   commit IDs.**
-
-```
-git push upstream-push release-next:develop
-```
-
-5. In the unlikely event that the push fails because someone has merged
-   something else in the meantime, rebase your branch onto the updated
-   `develop` branch, push again, and go back to step 3.
-6. Ensure that your PR against `develop` is closed. Github should do it
-   automatically.
-7. Once this is done, forward progress on `develop` can continue
-   (other PRs may be merged).
-8. Now create a Pull Request for `release-next` with **`release`** as
-   the base branch. Instead of the default template, reuse and update
-   the message from the previous release. Include the following verbiage
-   somewhere in the description:
-
-```
-The base branch is `release`. [All releases (including
-betas)](https://github.com/XRPLF/rippled/blob/develop/CONTRIBUTING.md#before-you-start)
-go in `release`. This PR branch will be pushed directly to `release` (not
-squashed or rebased, and not using the GitHub UI).
-```
-
-7. Sign-offs for the three platforms (Linux, Mac, Windows) usually occur
-   offline, but at least one approval will be needed on the PR.
-   - If issues are discovered during testing, simply abandon the
-     release. It's easy to start a new release, it should be easy to
-     abandon one. **DO NOT REUSE THE VERSION NUMBER.** e.g. If you
-     abandon 2.4.0-b1, the next attempt will be 2.4.0-b2.
-8. Once everything is ready to go, push to `release`.
-
-```
-git fetch upstreams
-
-# Just to be safe, do a dry run first:
-git push --dry-run upstream-push release-next:release
-
-# If everything looks right, push the branch
-git push upstream-push release-next:release
-
-# Check that all of the branches are updated
-git fetch upstreams
-git log -1 --oneline
-# The output should look like:
-# 0123456789 (HEAD -> upstream/release-next, upstream/release,
-#            upstream/develop) Set version to 2.4.0-b1
-# Note that upstream/develop may not be on this commit, but
-# upstream/release must be.
-# Other branches, including some from upstream-push, may also be
-# present.
-```
-
-9. Tag the release, too.
-
-```
-git tag <version number>
-git push upstream-push <version number>
-```
-
-10. Delete the `release-next` branch on the repo. Use the Github UI or:
-
-```
-git push --delete upstream-push release-next
-```
-
-11. Finally [create a new release on
-    Github](https://github.com/XRPLF/rippled/releases).
-
-#### Release candidates after the first
-
-Once the first release candidate is [merged into
-release](#making-the-release), then `release` and `develop` _are allowed
-to diverge_.
-
-If a bug or issue is discovered in a version that has a release
-candidate being tested, any fix and new version will need to be applied
-against `release`, then reverse-merged to `develop`. This helps keep git
-history as linear as possible.
-
-A `release-next` branch will be created from `release`, and any further
-work for that release must be based on `release-next`. Specifically,
-PRs must use `release-next` as the base, and those PRs will be merged
-directly to `release-next` when approved. Changes should be restricted
-to bug fixes, but other changes may be necessary from time to time.
-
-1. Open any PRs for the pending release using `release-next` as the base,
-   so they can be merged directly in to it. Unlike `develop`, though,
-   `release-next` can be thrown away and recreated if necessary.
-2. Once a new release candidate is ready, create a version commit as in
-   step 1 [above](#making-the-release) on `release-next`. You can use
-   the [update-version] script for this, too.
-3. Jump to step 8 ("Now create a Pull Request for `release-next` with
-   **`release`** as the base") from the process
-   [above](#making-the-release) to merge `release-next` into `release`.
-
-##### Follow up: reverse merge
-
-Once the RC is merged and tagged, it needs to be reverse merged into
-`develop` as soon as possible.
-
-1. Create a branch, based on `upstream/develop`.
-   The branch name is not important, but could include "mergeNNNrcN".
-   E.g. For release A.B.C-rcD, use `mergeABCrcD`.
-
-```
-git fetch upstreams
-
-git checkout --no-track -b mergeABCrcD upstream/develop
-```
-
-2. Merge `release` into your branch.
-
-```
-# I like the "--edit --log --verbose" parameters, but they are
-# not required.
-git merge upstream/release
-```
-
-3. `BuildInfo.cpp` will have a conflict with the version number.
-   Resolve it with the version from `develop` - the higher version.
-4. Push your branch to your repo (or `upstream` if you have permission),
-   and open a normal PR against `develop`. The "High level overview" can
-   simply indicate that this is a merge of the RC. The "Context" should
-   summarize the changes from the RC. Include the following text
-   prominently:
-
-```
-This PR must be merged manually using a push. Do not use the Github UI.
-```
-
-5. Depending on the complexity of the changes, and/or merge conflicts,
-   the PR may need a thorough review, or just a sign-off that the
-   merge was done correctly.
-6. If `develop` is updated before this PR is merged, do not merge
-   `develop` back into your branch. Instead rebase preserving merges,
-   or do the merge again. (See also the `rerere` git config setting.)
-
-```
-git rebase --rebase-merges upstream/develop
-# OR
-git reset --hard upstream/develop
-git merge upstream/release
-```
-
-7. When the PR is ready, push it to `develop`.
-
-```
-git fetch upstreams
-
-# Make sure the commits look right
-git log --show-signature "upstream/develop^..HEAD"
-
-git push upstream-push mergeABCrcD:develop
-
-git fetch upstreams
-```
-
-Development on `develop` can proceed as normal.
-
-#### Final releases
-
-A final release is any release that is not a beta or RC, such as 2.2.0.
-
-Only code that has already been tested and vetted across all three
-platforms should be included in a final release. Most of the time, that
-means that the commit immediately preceding the commit setting the
-version number will be an RC. Occasionally, there may be last-minute bug
-fixes included as well. If so, those bug fixes must have been tested
-internally as if they were RCs (at minimum, ensuring unit tests pass,
-and the app starts, syncs, and stops cleanly across all three
-platforms.)
-
-_If in doubt, make an RC first._
-
-The process for building a final release is very similar to [the process
-for building a beta](#making-the-release), except the code will be
-moving from `release` to `master` instead of from `develop` to
-`release`, and both branches will be pushed at the same time.
-
-1. Ensure there is no old `master-next` branch hanging around.
-   Then make a `master-next` branch that only changes the version
-   number. As above, or using the
-   [update-version] script.
-2. Create a Pull Request for `master-next` with **`master`** as
-   the base branch. Instead of the default template, reuse and update
-   the message from the previous final release. Include the following verbiage
-   somewhere in the description:
-
-```
-The base branch is `master`. This PR branch will be pushed directly to
-`release` and `master` (not squashed or rebased, and not using the
-GitHub UI).
-```
-
-7. Sign-offs for the three platforms (Linux, Mac, Windows) usually occur
-   offline, but at least one approval will be needed on the PR.
-   - If issues are discovered during testing, close the PR, delete
-     `master-next`, and move development back to `release`, [issuing
-     more RCs as necessary](#release-candidates-after-the-first)
-8. Once everything is ready to go, push to `release` and `master`.
-
-```
-git fetch upstreams
-
-# Just to be safe, do dry runs first:
-git push --dry-run upstream-push master-next:release
-git push --dry-run upstream-push master-next:master
-
-# If everything looks right, push the branch
-git push upstream-push master-next:release
-git push upstream-push master-next:master
-
-# Check that all of the branches are updated
-git fetch upstreams
-git log -1 --oneline
-# The output should look like:
-# 0123456789 (HEAD -> upstream/master-next, upstream/master,
-#            upstream/release) Set version to A.B.0
-# Note that both upstream/release and upstream/master must be on this
-# commit.
-# Other branches, including some from upstream-push, may also be
-# present.
-```
-
-9. Tag the release, too.
-
-```
-git tag <version number>
-git push upstream-push <version number>
-```
-
-10. Delete the `master-next` branch on the repo. Use the Github UI or:
-
-```
-git push --delete upstream-push master-next
-```
-
-11. [Create a new release on
-    Github](https://github.com/XRPLF/rippled/releases). Be sure that
-    "Set as the latest release" is checked.
-12. Open a PR to update the [API-CHANGELOG](API-CHANGELOG.md) and `API-VERSION-[n].md` with the changes for this release (if any are missing).
-13. Finally, [reverse merge the release into `develop`](#follow-up-reverse-merge).
-
-#### Special cases: point releases, hotfixes, etc.
-
-On occasion, a bug or issue is discovered in a version that already
-had a final release. Most of the time, development will have started
-on the next version, and will usually have changes in `develop`
-and often in `release`.
-
-Because git history is kept as linear as possible, any fix and new
-version will need to be applied against `master`.
-
-The process for building a hotfix release is very similar to [the
-process for building release candidates after the
-first](#release-candidates-after-the-first) and [for building a final
-release](#final-releases), except the changes will be done against
-`master` instead of `release`.
-
-If there is only a single issue for the hotfix, the work can be done in
-any branch. When it's ready to merge, jump to step 3 using your branch
-instead of `master-next`.
-
-1. Create a `master-next` branch from `master`.
-
-```
-git checkout --no-track -b master-next upstream/master
-git push upstream-push
-git fetch upstreams
-```
-
-2. Open any PRs for the pending hotfix using `master-next` as the base,
-   so they can be merged directly in to it. Unlike `develop`, though,
-   `master-next` can be thrown away and recreated if necessary.
-3. Once the hotfix is ready, create a version commit using the same
-   steps as above, or use the
-   [update-version] script.
-4. Create a Pull Request for `master-next` with **`master`** as
-   the base branch. Instead of the default template, reuse and update
-   the message from the previous final release. Include the following verbiage
-   somewhere in the description:
-
-```
-The base branch is `master`. This PR branch will be pushed directly to
-`master` (not squashed or rebased, and not using the GitHub UI).
-```
-
-7. Sign-offs for the three platforms (Linux, Mac, Windows) usually occur
-   offline, but at least one approval will be needed on the PR.
-   - If issues are discovered during testing, update `master-next` as
-     needed, but ensure that the changes are properly squashed, and the
-     version setting commit remains last
-8. Once everything is ready to go, push to `master` **only**.
-
-```
-git fetch upstreams
-
-# Just to be safe, do a dry run first:
-git push --dry-run upstream-push master-next:master
-
-# If everything looks right, push the branch
-git push upstream-push master-next:master
-
-# Check that all of the branches are updated
-git fetch upstreams
-git log -1 --oneline
-# The output should look like:
-# 0123456789 (HEAD -> upstream/master-next, upstream/master) Set version
-#            to 2.4.1
-# Note that upstream/master must be on this commit. upstream/release and
-# upstream/develop should not.
-# Other branches, including some from upstream-push, may also be
-# present.
-```
-
-9. Tag the release, too.
-
-```
-git tag <version number>
-git push upstream-push <version number>
-```
-
-9. Delete the `master-next` branch on the repo.
-
-```
-git push --delete upstream-push master-next
-```
-
-10. [Create a new release on
-    Github](https://github.com/XRPLF/rippled/releases). Be sure that
-    "Set as the latest release" is checked.
-
-Once the hotfix is released, it needs to be reverse merged into
-`develop` as soon as possible. It may also need to be merged into
-`release` if a release candidate is under development.
-
-1. Create a branch in your own repo, based on `upstream/develop`.
-   The branch name is not important, but could include "mergeNNN".
-   E.g. For release 2.2.3, use `merge223`.
-
-```
-git fetch upstreams
-
-git checkout --no-track -b merge223 upstream/develop
-```
-
-2. Merge master into your branch.
-
-```
-# I like the "--edit --log --verbose" parameters, but they are
-# not required.
-git merge upstream/master
-```
-
-3. `BuildInfo.cpp` will have a conflict with the version number.
-   Resolve it with the version from `develop` - the higher version.
-4. Push your branch to your repo, and open a normal PR against
-   `develop`. The "High level overview" can simply indicate that this
-   is a merge of the hotfix version. The "Context" should summarize
-   the changes from the hotfix. Include the following text
-   prominently:
-
-```
-This PR must be merged manually using a --ff-only merge. Do not use the Github UI.
-```
-
-5. Depending on the complexity of the hotfix, and/or merge conflicts,
-   the PR may need a thorough review, or just a sign-off that the
-   merge was done correctly.
-6. If `develop` is updated before this PR is merged, do not merge
-   `develop` back into your branch. Instead rebase preserving merges,
-   or do the merge again. (See also the `rerere` git config setting.)
-
-```
-git rebase --rebase-merges upstream/develop
-# OR
-git reset --hard upstream/develop
-git merge upstream/master
-```
-
-7. When the PR is ready, push it to `develop`.
-
-```
-git fetch upstreams
-
-# Make sure the commits look right
-git log --show-signature "upstream/develop..HEAD"
-
-git push upstream-push HEAD:develop
-```
-
-Development on `develop` can proceed as normal. It is recommended to
-create a beta (or RC) immediately to ensure that everything worked as
-expected.
-
-##### An even rarer scenario: A hotfix on an old release
-
-Historically, once a final release is tagged and packages are released,
-versions older than the latest final release are no longer supported.
-However, there is a possibility that a very high severity bug may occur
-in a non-amendment blocked version that is still being run by
-a significant fraction of users, which would necessitate a hotfix / point
-release to that version as well as any later versions.
-
-This scenario would follow the same basic procedure as above,
-except that _none_ of `develop`, `release`, or `master`
-would be touched during the release process.
-
-In this example, consider if version 2.1.1 needed to be patched.
-
-1. Create two branches in the main (`upstream`) repo.
-
-```
-git fetch upstreams
-
-# Create a base branch off the tag
-git checkout --no-track -b master-2.1.2 2.1.1
-git push upstream-push
-
-# Create a working branch
-git checkout --no-track -b master212-next master-2.1.2
-git push upstream-push
-
-git fetch upstreams
-```
-
-2. Work continues as above, except using `master-2.1.2`as
-   the base branch for any merging, packaging, etc.
-3. After the release is tagged and packages are built, you could
-   potentially delete both branches, e.g. `master-2.1.2` and
-   `master212-next`. However, it may be useful to keep `master-2.1.2`
-   around indefinitely for reference.
-4. Assuming that a hotfix is also released for the latest
-   version in parallel with this one, or if the issue is
-   already fixed in the latest version, do no do any
-   reverse merges. However, if it is not, it probably makes
-   sense to reverse merge `master-2.1.2` into `master`,
-   release a hotfix for _that_ version, then reverse merge
-   from `master` to `develop`. (Please don't do this unless absolutely
-   necessary.)
+Releases, release branches, and merging releases back into `develop`
+are described in [RELEASING.md](./RELEASING.md).
 
 [contrib]: https://docs.github.com/en/get-started/quickstart/contributing-to-projects
 [squash]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/about-pull-request-merges#squash-and-merge-your-commits
@@ -1184,5 +641,3 @@ git fetch upstreams
 [xrpld]: https://github.com/XRPLF/rippled
 [signing]: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification
 [setup-upstreams]: ./bin/git/setup-upstreams.sh
-[squash-branches]: ./bin/git/squash-branches.sh
-[update-version]: ./bin/git/update-version.sh

README.md

@@ -54,6 +54,7 @@ Here are some good places to start learning the source code:
 | `./docs`   | Source documentation files and doxygen config. |
 | `./cfg`    | Example configuration files.                   |
 | `./src`    | Source code.                                   |
+| `./crates` | Rust source code.                              |
 
 Some of the directories under `src` are external repositories included using
 git-subtree. See those directories' README files for more details.

RELEASING.md

@@ -0,0 +1,152 @@
+# Branching and Release Management
+
+This document describes how we branch, release, and merge releases back into `develop`.
+It does not define version naming
+(e.g., what constitutes a major-minor, patch, or beta release).
+
+Examples use `X.Y` for a release line:
+`X` and `Y` are placeholders, while the trailing `x` is literal,
+e.g., `release/X.Y.x` is `release/3.4.x` for the `3.4` line.
+
+## Branches
+
+| Branch          | Purpose                                                                                   |
+| :-------------- | :---------------------------------------------------------------------------------------- |
+| `develop`       | Main development branch. Betas and the first RC of a major-minor release are tagged here. |
+| `staging/X.Y.x` | Where fixes for the `X.Y` line are developed and RCs are prepared.                        |
+| `release/X.Y.x` | The last public RC or release of the `X.Y` line.                                          |
+
+A release line is named `X.Y.x`
+because one branch serves every patch release of that line (`X.Y.0`, `X.Y.1`, `X.Y.2`, ...).
+The `/` groups branches hierarchically,
+so tools can filter them and protection rules can target `release/*` and `staging/*`.
+
+## Principles
+
+- **Releases are merged back into `develop`, never cherry-picked or rebased onto it.**
+  Cherry-picked and rebased commits get new hashes,
+  so Git can't tell that `develop` already has them.
+  Future merges then replay them and produce artificial conflicts,
+  and it's hard to verify that every fix actually reached `develop`.
+  Merging keeps a single history:
+  Git knows exactly which release commits `develop` contains,
+  and no fix is left behind.
+- **Branches only move forward.**
+  `develop`, `staging/X.Y.x`, and `release/X.Y.x` are never rewritten.
+- **Cherry-picking only goes from `develop` to a staging branch**,
+  for fixes that must get into a release after the code freeze
+  (see [Emergency Fixes From `develop`](#emergency-fixes-from-develop)).
+- **Security fixes are prepared privately and published with the release that contains them**,
+  so vulnerabilities are not disclosed prematurely.
+
+## Release Lifecycle
+
+This diagram shows a major-minor release and its first patch release.
+The staging and release branches are drawn as one line.
+
+```text
+develop                            staging/X.Y.x & release/X.Y.x
+   │
+   ├── Tag: X.Y.0-b1
+   ├── Tag: X.Y.0-bN
+   ├── Tag: X.Y.0-rc1 ───────────────┐ (branches created)
+   │                                 │
+   │  (development continues)        ├── Fixes
+   │                                 ├── Tag: X.Y.0-rcN
+   │                                 ├── Tag: X.Y.0 (final)
+   ◀──── (merge) ────────────────────┤
+   │                                 ├── Fixes
+   │                                 ├── Tag: X.Y.1-rcN
+   │                                 ├── Tag: X.Y.1 (final)
+   ◀──── (merge) ────────────────────┤
+   │
+   ▼
+```
+
+### Betas, First RC & Branching
+
+> [!NOTE]
+> This phase applies only to a new major-minor release (e.g., `X.Y.0`).
+> Patch releases work on the existing branches of the line.
+
+1. **Betas:** All beta versions (e.g., `X.Y.0-b1`) are built and tagged directly on `develop`.
+2. **First RC:** We release the first RC (`X.Y.0-rc1`)
+   once everything that should be included in the release has been merged.
+3. **Branches:** `staging/X.Y.x` and `release/X.Y.x` are created from `develop`
+   at the commit tagged `X.Y.0-rc1`.
+   The first RC also kicks off the QE process.
+4. **Code freeze:** No new features or unrelated changes are pulled from `develop`
+   into `staging/X.Y.x` or `release/X.Y.x`.
+   Only critical stabilization fixes go into the line.
+5. **No large changes on `develop`:** Until `X.Y.0` is [merged back](#merging-back-into-develop),
+   large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
+   are not merged into `develop`,
+   so that fixes on the line and the merge back don't run into conflicts.
+
+### Release Candidates
+
+1. Fixes are developed against `staging/X.Y.x`.
+2. When ready, a new RC is created on `staging/X.Y.x`,
+   and `release/X.Y.x` is fast-forwarded to it.
+
+RCs that contain unpublished security fixes are not published,
+and don't touch the public branches.
+
+RCs are not merged back into `develop`:
+`X.Y.0-rc1` is tagged on `develop` itself,
+and all later changes reach `develop` with the [final release](#final-release).
+
+### Final Release
+
+Security fixes become public as soon as they reach the public repo,
+so these steps happen only once the release is ready to be published,
+one right after the other.
+
+1. Unpublished security fixes, if any, are merged into `staging/X.Y.x`.
+2. `release/X.Y.x` is fast-forwarded to `staging/X.Y.x`,
+   and the release is tagged on it.
+3. The release is immediately [merged back into `develop`](#merging-back-into-develop).
+   For a major-minor release, this lifts the freeze on large changes in `develop`.
+
+### Merging Back Into `develop`
+
+The merge back is a regular PR into `develop`
+whose branch contains a real merge commit of the release tag:
+
+1. Create a branch from `develop`, run `git merge --no-ff <tag>`, and resolve any conflicts.
+2. Once the PR is approved, `develop` is fast-forwarded to the PR branch,
+   so the merge commit lands as it is.
+   Never squash or rebase it.
+   Never add it to the merge queue either: the queue squashes PRs, which would drop the merge commit.
+3. If `develop` moves while the PR is open, redo the merge on top of the new `develop`.
+
+After the merge, `git log develop..<tag>` must be empty.
+
+## Special Cases
+
+### Emergency Fixes From `develop`
+
+If a commit was merged to `develop`
+and needs to be included in a release after the code freeze:
+
+1. Create a PR that cherry-picks the commit onto `staging/X.Y.x`.
+2. Leave `develop` as it is, with no reverts.
+3. Follow the [release candidates](#release-candidates) process as usual.
+
+When the release is later merged back into `develop`,
+both sides already contain the same change,
+so the merge usually resolves it cleanly or with a trivial conflict.
+From Git's perspective, the cherry-picked commit then becomes part of `develop` too.
+
+### Several Supported Lines
+
+When a fix must ship in more than one supported line (e.g., `X.Y` and `X.(Y+1)`),
+the lines are merged upwards rather than cherry-picked between:
+
+1. The fix goes into the oldest line first.
+2. After that line's release,
+   its `release/X.Y.x` is merged into the staging branch of the next newer line,
+   and so on up to the newest line.
+3. The newest line is merged back into `develop` as usual.
+
+This way every newer line, and eventually `develop`, contains the history of the older lines.

bin/check-tools.sh

@@ -15,25 +15,55 @@
 #   - Windows: the core build tools only (CMake, Conan, Git, Python).
 #              MSVC is expected to be provided separately and is not checked here.
 #
-# Some tools (clang-format, doxygen, gcovr, gh, git-cliff, gpg, pre-commit,
-# run-clang-tidy) are present in our Linux CI images and in local development
-# setups, but not in the macOS CI environment. They are checked everywhere
-# except when running in CI on macOS.
+# Some tools (clang-format, clang-tidy, doxygen, gcovr, gh, git-cliff, gpg,
+# pre-commit, run-clang-tidy) are present in our Linux CI images and in local
+# development setups, but not in the macOS CI environment. They are checked
+# everywhere except when running in CI on macOS.
+#
+# Tools that Nix also exposes under a version-suffixed name
+# (`clang-tidy-<v>`, `g++-<v>`, ...) are probed under both names:
+# a suffixed name can break while the plain one still works
+# (see mkVersionedToolLinks in nix/packages.nix).
+# The suffix is the major version of the plain `clang` / `gcc` on PATH.
+#
+# Tools scoped to a single dev shell rather than to commonPackages are checked
+# only in that shell, keyed off XRPL_DEVSHELL.
 #
 # Environment variables:
 #   CI                      if set, skip the tools above when on macOS.
 #   CHECK_TOOLS_SKIP_CLONE  if set, skip the git-over-HTTPS connectivity check.
+#   XRPL_DEVSHELL           active dev shell; selects shell-specific tools.
 
 set -uo pipefail
 
+# major_version <compiler>
+# Major version of a compiler on PATH, or "unknown" when it isn't there.
+major_version() {
+    local version
+    version="$("$1" -dumpversion 2>/dev/null)" || version=""
+    version="${version%%.*}"
+    printf '%s' "${version:-unknown}"
+}
+
+llvm_version="$(major_version clang)"
+
 missing=()
 checked=0
 
+# tool_path <name>
+# Fully resolved path of a tool, so the snapshots record which derivation
+# provides it. Prints nothing when it isn't on PATH.
+tool_path() {
+    local path
+    path="$(command -v "$1" 2>/dev/null)" || return 0
+    readlink -f "${path}" 2>/dev/null || printf '%s' "${path}"
+}
+
 # check <name> [probe-command...]
 # Runs the probe (default: "<name> --version"), capturing both stdout and
-# stderr, and prints one aligned line: the status, the name, and the first
-# non-blank line of the probe output (its version). Records <name> as missing
-# if the command is not found or exits non-zero.
+# stderr, and prints three lines: the status and name, the first non-blank line
+# of the probe output (its version, or the error when it failed), and the tool's
+# resolved path. Records <name> as missing if it is not found or exits non-zero.
 check() {
     local name="$1"
     shift
@@ -43,14 +73,17 @@ check() {
     fi
 
     checked=$((checked + 1))
-    local output version
+    local output version path
+    path="$(tool_path "${name}")"
     if output="$("${probe[@]}" 2>&1)"; then
-        version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
-        printf '  [ ok ] %-20s %s\n' "${name}" "${version}"
+        printf '  ✅ %s\n' "${name}"
     else
-        printf '  [MISS] %s\n' "${name}"
+        printf '  ❌ %s\n' "${name}"
         missing+=("${name}")
     fi
+    version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
+    printf '     %s\n' "${version:-(no output)}"
+    printf '     %s\n' "${path:-(not found)}"
 }
 
 case "$(uname -s)" in
@@ -82,10 +115,13 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     echo "Development tooling:"
     check ccache
     check clang
+    check "clang-${llvm_version}"
     check clang++
+    check "clang++-${llvm_version}"
     check ClangBuildAnalyzer
     check curl
     check file
+    check jq
     check less
     check make
     # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
@@ -101,7 +137,14 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     # setups, but not in the macOS CI environment. So check them everywhere
     # except when running in CI on macOS.
     if [ "${os}" = "linux" ] || [ -z "${CI:-}" ]; then
+        check clang-apply-replacements
+        check "clang-apply-replacements-${llvm_version}"
         check clang-format
+        check "clang-format-${llvm_version}"
+        # clang-tidy leads --version with the LLVM banner, not the version.
+        tidy_probe="--version | grep -m1 -oE 'LLVM version [0-9.]+'"
+        check clang-tidy sh -c "clang-tidy ${tidy_probe}"
+        check "clang-tidy-${llvm_version}" sh -c "clang-tidy-${llvm_version} ${tidy_probe}"
         check dot
         check doxygen
         check gcovr
@@ -112,6 +155,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
         # pre-commit, or its alternative implementation prek
         check pre-commit sh -c 'pre-commit --version || prek --version'
         check run-clang-tidy run-clang-tidy --help
+        check "run-clang-tidy-${llvm_version}" "run-clang-tidy-${llvm_version}" --help
     fi
 fi
 
@@ -126,19 +170,33 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-audit cargo audit --version
     check cargo-llvm-cov cargo llvm-cov --version
     check cargo-nextest cargo nextest --version
-    check clippy clippy-driver --version
+    check clippy-driver
     check rust-analyzer
+    check rust-nightly rust-nightly run rustc --version
     check rustc
     check rustfmt
 fi
 
+# Lean4 is in the formal-verification shell only, not in commonPackages.
+if [ "${XRPL_DEVSHELL:-}" = "formal-verification" ]; then
+    echo
+    echo "Formal verification toolchain:"
+    check lean
+    check lake
+fi
+
 # GCC is the default compiler on Linux. macOS uses the system Apple Clang
 # instead, so GCC/g++/gcov are not expected there.
 if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
+    gcc_version="$(major_version gcc)"
     check gcc
+    check "gcc-${gcc_version}"
     check g++
+    check "g++-${gcc_version}"
+    check cpp
+    check "cpp-${gcc_version}"
     check gcov
 
     echo
@@ -163,9 +221,9 @@ else
     checked=$((checked + 1))
     tmp_clone="$(mktemp -d)"
     if git clone --depth 1 https://github.com/XRPLF/actions.git "${tmp_clone}/actions" >/dev/null 2>&1; then
-        printf '  [ ok ] git clone over HTTPS\n'
+        printf '  ✅ git clone over HTTPS\n'
     else
-        printf '  [MISS] git clone over HTTPS\n'
+        printf '  ❌ git clone over HTTPS\n'
         missing+=("git-https-clone")
     fi
     rm -rf "${tmp_clone}"
@@ -173,9 +231,9 @@ fi
 
 echo
 if [ "${#missing[@]}" -eq 0 ]; then
-    echo "All ${checked} checked tools are present and runnable."
+    echo "✅ All ${checked} checked tools are present and runnable."
 else
-    echo "Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
+    echo "❌ Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
     for tool in "${missing[@]}"; do
         echo "  - ${tool}" >&2
     done

bin/git/update-version.sh

@@ -1,56 +0,0 @@
-#!/bin/bash
-
-if [[ $# -ne 3 || "$1" == "--help" || "$1" = "-h" ]]; then
-    name=$(basename $0)
-    cat <<-USAGE
-    Usage: $name workbranch base/branch version
-
-    * workbranch will be created locally from base/branch. If it exists,
-        it will be reused, so make sure you don't overwrite any work.
-    * base/branch may be specified as user:branch to allow easy copying
-        from Github PRs.
-USAGE
-    exit 0
-fi
-
-work="$1"
-shift
-
-base=$(echo "$1" | sed "s/:/\//")
-shift
-
-version=$1
-shift
-
-set -e
-
-git fetch upstreams
-
-git checkout -B "${work}" --no-track "${base}"
-
-push=$(git rev-parse --abbrev-ref --symbolic-full-name '@{push}' \
-    2>/dev/null) || true
-if [[ "${push}" != "" ]]; then
-    echo "Warning: ${push} may already exist."
-fi
-
-build=$(find -name BuildInfo.cpp)
-sed 's/\(^.*versionString =\).*$/\1 "'${version}'"/' ${build} >version.cpp &&
-    diff "${build}" version.cpp && exit 1 ||
-    mv -vi version.cpp ${build}
-
-git diff
-
-git add ${build}
-
-git commit -S -m "Set version to ${version}"
-
-git log --oneline --first-parent ${base}^..
-
-cat <<PUSH
-
--------------------------------------------------------------------
-This script will not push. Verify everything is correct, then push
-to your repo, and create a PR as described in CONTRIBUTING.md.
--------------------------------------------------------------------
-PUSH

bin/install/packaging-tools.sh

@@ -22,23 +22,41 @@ case "${ID}" in
         ;;
 esac
 
+# Packaging runs in a vanilla distro image, so the tooling comes from the distro's
+# archive rather than from nixpkgs:
+#
+#   - debhelper and dpkg-dev build the DEB, and lintian checks it
+#   - binutils gives debian/rules the readelf its glibc-floor check runs; it
+#     already arrives via dpkg-dev, but that tool is called directly
+#   - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
+#     supplying the systemd and find-debuginfo macros the spec uses
+#   - rpm-sign and gnupg2 sign the built RPM
+#   - python3 runs the packaging scripts
+#   - git gives build_pkg.py the commit timestamp it stamps files with
+#   - ca-certificates lets git and the packaging scripts verify TLS
 function install() {
     case "${ID}" in
         debian | ubuntu)
             apt-get update -y
             apt-get install -y --no-install-recommends \
+                binutils \
                 ca-certificates \
                 debhelper \
                 debhelper-compat \
                 dpkg-dev \
-                git
+                git \
+                lintian \
+                python3
             ;;
 
         rhel | centos | rocky | almalinux)
             dnf install -y --setopt=install_weak_deps=False \
                 git \
-                rpm-build \
+                gnupg2 \
+                python3 \
                 redhat-rpm-config \
+                rpm-build \
+                rpm-sign \
                 systemd-rpm-macros
             ;;
     esac

bin/nix/check-build-context-runtime.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Fail if a binary of a build-context Conan package loads anything from the Nix
+# store other than glibc, or cannot resolve a library at all.
+#
+# Only binaries linked by the Nix toolchain are checked, i.e. those recording a
+# store path as their interpreter or RUNPATH. Prebuilt upstream binaries (such
+# as the ones the cmake package ships) use the system loader instead.
+#
+# Build-context packages provide the tools that run during the build (protoc,
+# grpc_cpp_plugin, ...). Their package ID does not change when a Nix toolchain
+# update moves the GCC runtime to a new store path, so a cached binary has to
+# get by with the pinned glibc alone. See docs/build/nix.md.
+#
+# Usage: bin/nix/check-build-context-runtime.sh <graph.json>
+#   <graph.json> is the output of `conan install --format=json`.
+
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+    echo "usage: $0 <graph.json>" >&2
+    exit 2
+fi
+
+if [ "$(uname -s)" != "Linux" ]; then
+    echo "$0: Linux only" >&2
+    exit 2
+fi
+
+folders="$(jq -r '.graph.nodes[] | select(.context == "build" and .package_folder) | .package_folder' "$1" | sort -u)"
+
+checked=0
+failed=0
+
+while IFS= read -r file; do
+    case "$(file -b "${file}")" in
+        ELF*) ;;
+        *) continue ;;
+    esac
+    [[ "$(readelf -ldW "${file}")" == */nix/store/* ]] || continue
+    checked=$((checked + 1))
+
+    # `ldd` lists the interpreter and every library as the loader resolves them.
+    if deps="$(ldd "${file}" 2>&1)"; then
+        bad="$(printf '%s\n' "${deps}" |
+            grep -E 'not found|/nix/store/' |
+            grep -vE '/nix/store/[^/]+-glibc-[^/]+/' || true)"
+    else
+        case "${deps}" in
+            *"not a dynamic executable"*) continue ;;
+        esac
+        bad="${deps}"
+    fi
+    if [ -n "${bad}" ]; then
+        failed=$((failed + 1))
+        echo "::error file=${file}::loads a library from the Nix store other than glibc"
+        echo "${file}"
+        echo "${bad}" | sed 's/^/    /'
+    fi
+done < <(
+    # shellcheck disable=SC2086 # one folder per line, no spaces in Conan paths
+    [ -z "${folders}" ] || find ${folders} -type f \( -perm -u+x -o -name '*.so*' \)
+)
+
+echo "Build-context packages: checked ${checked} binaries, ${failed} failed."
+[ "${failed}" -eq 0 ]

bin/nix/check-nix-store-refs.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# Fail if a binary under <path> records a /nix/store path it resolves at run
+# time. See docs/build/nix.md#prebuilt-packages for why that matters.
+#
+# <path> is a file or a directory. macOS: nothing may reference the store, so
+# point it at whole trees. Linux: the toolchain always writes the store into
+# PT_INTERP and RUNPATH, so only at what cmake/PatchNixBinary.cmake retargets.
+#
+# Only Mach-O / ELF is inspected. Static archives hold store paths in debug info
+# alone; the scripts in a Conan cache are all git hook samples and autotools
+# scratch, 36 false positives to 0 real.
+#
+# Usage: bin/nix/check-nix-store-refs.sh <path>
+
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+    echo "usage: $0 <path>" >&2
+    exit 2
+fi
+
+if [ ! -e "$1" ]; then
+    echo "$0: no such path: $1" >&2
+    exit 2
+fi
+
+case "$(uname -s)" in
+    Darwin)
+        format=Mach-O
+        recorded_paths=macho_recorded_paths
+        tool=otool
+        ;;
+    Linux)
+        format=ELF
+        recorded_paths=elf_recorded_paths
+        tool=readelf
+        ;;
+    *)
+        echo "Unsupported OS - skipping the Nix store reference check."
+        exit 0
+        ;;
+esac
+
+# `pipefail` would catch this too, but only as a bare nonzero exit.
+if ! command -v "${tool}" >/dev/null; then
+    echo "$0: ${tool} not found; cannot inspect binaries" >&2
+    exit 2
+fi
+
+# Both list what the file records. `ldd` would answer what this machine resolves
+# now, which is wrong both ways: store paths for a correctly patched binary,
+# silence for a store RUNPATH that resolves nowhere.
+
+# `name` covers LC_ID_DYLIB and LC_LOAD*_DYLIB, `path` covers LC_RPATH.
+macho_recorded_paths() {
+    otool -l "$1" | sed -nE 's#^ *(name|path) ([^ ]*).*#\2#p'
+}
+
+# RPATH and RUNPATH are colon-separated.
+elf_recorded_paths() {
+    readelf -ldW "$1" |
+        sed -nE \
+            -e 's#.*program interpreter: ([^]]*)\].*#\1#p' \
+            -e 's#.*\((RPATH|RUNPATH|NEEDED)\).*\[([^]]*)\].*#\2#p' |
+        tr ':' '\n'
+}
+
+checked=0
+skipped=0
+leaked=0
+
+while IFS= read -r file; do
+    case "$(file -b "${file}" 2>/dev/null)" in
+        *"${format}"*) ;;
+        *)
+            skipped=$((skipped + 1))
+            continue
+            ;;
+    esac
+    checked=$((checked + 1))
+
+    # Filter after extracting, or a search path starting elsewhere ($ORIGIN)
+    # hides the rest. `sed` not `grep`: grep calls "no matches" a failure, and
+    # the `|| true` that would need masks a broken pipeline too.
+    refs="$("${recorded_paths}" "${file}" | sed -n '\#^/nix/store/#p' | sort -u)"
+    if [ -n "${refs}" ]; then
+        leaked=$((leaked + 1))
+        echo "::error file=${file}::references the Nix store at run time"
+        echo "${file}"
+        echo "${refs}" | sed 's/^/    /'
+    fi
+done < <(find "$1" -type f \( -perm -u+x -o -name '*.dylib' -o -name '*.so*' \))
+
+echo "$1: checked ${checked}, skipped ${skipped}, ${leaked} with Nix store references."
+
+if [ "${leaked}" -ne 0 ]; then
+    cat >&2 <<'EOF'
+
+Fixes, in order of preference:
+  - A Conan package built before this check existed: drop it
+    (`conan remove '<name>/*'`) and rebuild.
+  - A binary that should have been retargeted to the system loader: check that
+    cmake/PatchNixBinary.cmake ran for it.
+  - Link the macOS system library instead of the Nix one - see
+    libresolvSystemStub in nix/darwin.nix.
+  - No system library exists (libstdc++): link it statically.
+  - None of the above: pin the toolchain into the package ID, following
+    `user.package:libc_version` in conan/profiles/ci.
+EOF
+    exit 1
+fi

bin/pre-commit/Dockerfile

@@ -23,7 +23,7 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF
 
-ARG PRE_COMMIT_VERSION=4.6.0
+ARG PRE_COMMIT_VERSION=4.6.2
 RUN pip install --no-cache --break-system-packages \
     pre-commit==${PRE_COMMIT_VERSION}
 

bin/pre-commit/check_rust_coverage_attrs.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""
+Check that Rust unit tests stay out of the coverage report.
+
+cargo-llvm-cov instruments the test code along with everything else, so a test
+module that is not excluded counts its own body as covered and inflates the
+reported number. Excluding it takes two attributes:
+
+  * every `#[cfg(test)]` module carries
+    `#[cfg_attr(coverage_nightly, coverage(off))]`;
+  * every crate root (lib.rs, main.rs) carries
+    `#![cfg_attr(coverage_nightly, feature(coverage_attribute))]`, which the
+    attribute above needs in order to compile.
+
+Both are inert outside the coverage job: cargo-llvm-cov defines
+`coverage_nightly` only when it runs on a nightly toolchain.
+
+The crate-root gate is checked even in a crate that has no tests yet, because
+that is what lets the first test module added later carry the attribute without
+a build failure. Missing it is a hard error, so it cannot go unnoticed; a
+missing `coverage(off)` fails open, which is why this check exists.
+
+Matching is on exact attribute text, which works because `cargo fmt` runs over
+the whole workspace in the hook ahead of this one: rustfmt puts every attribute
+on its own line and normalizes what is inside it, turning `#[cfg( test )]`
+and `#[cfg(test,)]` alike into `#[cfg(test)]`. So there is nothing here that
+parses Rust. The price is that a cfg this file does not spell out literally --
+`all(test, ...)`, `any(test, ...)`, `not(test)` -- is reported rather than
+classified, on the grounds that guessing at coverage semantics is how a check
+like this ends up quietly wrong.
+
+Usage: ./bin/pre-commit/check_rust_coverage_attrs.py <file1> <file2> ...
+
+Exit status is non-zero if any violation is found.
+"""
+
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+CRATE_ROOTS = {"lib.rs", "main.rs"}
+
+FEATURE_ATTR = "#![cfg_attr(coverage_nightly, feature(coverage_attribute))]"
+COVERAGE_OFF_ATTR = "#[cfg_attr(coverage_nightly, coverage(off))]"
+CFG_TEST_ATTR = "#[cfg(test)]"
+
+# Any other cfg that mentions `test`. String literals are blanked before this
+# runs, so `feature = "test"` does not read as the `test` cfg.
+RE_CFG_MENTIONS_TEST = re.compile(r"^#\[cfg\(.*\btest\b.*\)\]$")
+RE_STRING = re.compile(r'"(?:[^"\\]|\\.)*"')
+RE_MOD = re.compile(r"^(?:pub(?:\([^)]*\))?\s+)?mod\s+([A-Za-z_]\w*)")
+
+
+@dataclass(frozen=True)
+class Finding:
+    line: int
+    label: str
+    message: str
+
+
+def _check_module(attrs: list[str], line: int, name: str) -> list[Finding]:
+    """Findings for one module, given the attributes attached to it."""
+    if COVERAGE_OFF_ATTR in attrs:
+        return []  # excluded from coverage; which cfg gates it does not matter
+    if CFG_TEST_ATTR in attrs:
+        return [
+            Finding(
+                line,
+                "missing-coverage-off",
+                f"`mod {name}` is #[cfg(test)] but not excluded from coverage; "
+                f"add {COVERAGE_OFF_ATTR}",
+            )
+        ]
+    unclassified = [
+        attr for attr in attrs if RE_CFG_MENTIONS_TEST.match(RE_STRING.sub('""', attr))
+    ]
+    if unclassified:
+        return [
+            Finding(
+                line,
+                "unclassified-cfg",
+                f"`mod {name}` is gated on {unclassified[0]}, which this check "
+                f"cannot tell apart from a module that ships in the library; "
+                f"add {COVERAGE_OFF_ATTR} if it is test-only, or teach this "
+                f"check the cfg if it is not",
+            )
+        ]
+    return []
+
+
+def _check_test_modules(lines: list[str]) -> list[Finding]:
+    """Findings for every test module that is not excluded from coverage."""
+    findings: list[Finding] = []
+    attrs: list[str] = []
+    attrs_line = 0
+    for number, raw in enumerate(lines, start=1):
+        stripped = raw.strip()
+        # Blank lines and comments are allowed between an attribute and its item.
+        if not stripped or stripped.startswith("//"):
+            continue
+        if stripped.startswith("#["):
+            if not attrs:
+                attrs_line = number
+            attrs.append(stripped)
+            continue
+        module = RE_MOD.match(stripped)
+        if module is not None and attrs:
+            findings += _check_module(attrs, attrs_line, module.group(1))
+        attrs = []
+    return findings
+
+
+def _check_crate_root(name: str, lines: list[str]) -> list[Finding]:
+    """A finding if a crate root is missing the coverage_attribute feature gate."""
+    if name not in CRATE_ROOTS:
+        return []
+    if any(line.strip() == FEATURE_ATTR for line in lines):
+        return []
+    return [
+        Finding(
+            1,
+            "missing-feature-gate",
+            f"crate root is missing {FEATURE_ATTR}",
+        )
+    ]
+
+
+def check_source(name: str, text: str) -> list[Finding]:
+    """Findings for one file's contents; `name` is its base name (lib.rs, ...)."""
+    lines = text.splitlines()
+    return _check_crate_root(name, lines) + _check_test_modules(lines)
+
+
+def check_file(path: Path) -> list[Finding]:
+    return check_source(path.name, path.read_text(encoding="utf-8"))
+
+
+def main() -> int:
+    total = 0
+    for path in (Path(name) for name in sys.argv[1:]):
+        for finding in check_file(path):
+            total += 1
+            print(f"{path}:{finding.line}: {finding.label}: {finding.message}")
+    return 1 if total else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/pre-commit/clang_tidy_check.py

@@ -26,8 +26,6 @@ import sys
 import tempfile
 from pathlib import Path
 
-CLANG_TIDY_VERSION = 22
-
 # Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
 # the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
 # compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
@@ -39,8 +37,21 @@ TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}
 FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
 
 
-def find_tool(name: str) -> str | None:
-    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
+def clang_tidy_major() -> str | None:
+    """Major version of the `clang-tidy` on PATH, which run-clang-tidy invokes."""
+    if not (clang_tidy := shutil.which("clang-tidy")):
+        return None
+    output = subprocess.run(
+        [clang_tidy, "--version"], capture_output=True, text=True
+    ).stdout
+    m = re.search(r"LLVM version (\d+)", output)
+    return m.group(1) if m else None
+
+
+def find_tool(name: str, version: str | None) -> str | None:
+    """Prefer `<name>-<version>`, so a host tool of another version can't win."""
+    candidates = ([f"{name}-{version}"] if version else []) + [name]
+    for candidate in candidates:
         if path := shutil.which(candidate):
             return path
     return None
@@ -103,8 +114,9 @@ def main():
     if not files:
         return 0
 
-    run_clang_tidy = find_tool("run-clang-tidy")
-    clang_apply_replacements = find_tool("clang-apply-replacements")
+    version = clang_tidy_major()
+    run_clang_tidy = find_tool("run-clang-tidy", version)
+    clang_apply_replacements = find_tool("clang-apply-replacements", version)
     missing = [
         name
         for name, path in (
@@ -114,9 +126,10 @@ def main():
         if not path
     ]
     if missing:
+        tried = f" (tried the '-{version}' suffix too)" if version else ""
         print(
             f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
-            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
+            f"was not found in PATH{tried}.",
             file=sys.stderr,
         )
         return 1

bin/pre-commit/fix_gtest_names.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+
+"""
+Rewrites gtest names to the required style in this project: the suite name is
+CamelCase, the test-case name is snake_case.
+
+    TEST(SuiteName, test_case_name)
+
+The gtest `DISABLED_` prefix is kept verbatim on either name.
+
+Both conversions fold acronyms the way a reader expects:
+`SetAndResetAccountTxnID` -> `set_and_reset_account_txn_id`, not
+`set_and_reset_account_txn_i_d`.
+
+The first argument of `TEST_F`, `TEST_P`, `TYPED_TEST` and `TYPED_TEST_P` is a
+fixture class rather than a free identifier, so rewriting it here would leave
+the class it names behind. Those are reported for a human to rename (clang-tidy
+checks the class declaration itself, via readability-identifier-naming).
+
+Usage: ./bin/pre-commit/fix_gtest_names.py <file1> <file2> ...
+"""
+
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+# A test-case definition, `MACRO(SuiteOrFixture, TestName)`, anchored at the
+# start of a line so that commented-out definitions and project macros that
+# merely look similar (`TEST_EXPECT(...)`) are left alone. The `\s*` between
+# arguments allows for a definition clang-format wrapped over several lines.
+PATTERN = re.compile(
+    r"(?P<head>^[ \t]*(?P<macro>TYPED_TEST_P|TYPED_TEST|TEST_F|TEST_P|TEST)\s*\(\s*)"
+    r"(?P<suite>\w+)(?P<mid>\s*,\s*)(?P<name>\w+)(?P<tail>\s*\))",
+    re.MULTILINE,
+)
+
+# The macros whose first argument names a fixture class, not a free identifier.
+FIXTURE_MACROS = ("TEST_F", "TEST_P", "TYPED_TEST", "TYPED_TEST_P")
+
+DISABLED = "DISABLED_"
+
+ACRONYM_BOUNDARY = re.compile(r"([A-Z]+)([A-Z][a-z])")
+WORD_BOUNDARY = re.compile(r"([a-z\d])([A-Z])")
+
+
+def _split_disabled(name: str) -> tuple[str, str]:
+    """Splits off gtest's `DISABLED_` prefix, which is kept verbatim."""
+    if name.startswith(DISABLED):
+        return DISABLED, name[len(DISABLED) :]
+    return "", name
+
+
+def snake_case(name: str) -> str:
+    """Returns the name in snake_case, leaving acronyms whole.
+
+    `SetAndResetAccountTxnID` -> `set_and_reset_account_txn_id`,
+    `parseStatRSSkB` -> `parse_stat_rs_sk_b`.
+    """
+    prefix, core = _split_disabled(name)
+    core = ACRONYM_BOUNDARY.sub(r"\1_\2", core)
+    return prefix + WORD_BOUNDARY.sub(r"\1_\2", core).lower()
+
+
+def camel_case(name: str) -> str:
+    """Returns the name in CamelCase, capitalizing each underscored word.
+
+    Only the letters that have to change are touched, so acronyms survive: a
+    conversion that went via snake_case would turn `SHAMapTest` into
+    `ShaMapTest`, whereas here it is already CamelCase and stays put.
+    `json_value` -> `JsonValue`, `parseStatRSSkB` -> `ParseStatRSSkB`.
+    """
+    prefix, core = _split_disabled(name)
+    return prefix + "".join(w[:1].upper() + w[1:] for w in core.split("_") if w)
+
+
+def _corrected(match: re.Match) -> tuple[str, str]:
+    """Returns the suite and test-case names this definition should end up with."""
+    suite = match["suite"]
+    return (
+        suite if match["macro"] in FIXTURE_MACROS else camel_case(suite),
+        snake_case(match["name"]),
+    )
+
+
+def fix_source(text: str) -> tuple[str, list[str]]:
+    """Returns the corrected text and one `line: message` report per bad name."""
+    # gtest joins the suite and test names into one class name, so two test
+    # cases whose joined names agree cannot coexist: `TEST(a, b_c)` and
+    # `TEST(a_b, c)` both define `a_b_c_Test`. A rename that would introduce
+    # such a clash is reported for a human instead of applied.
+    joined = Counter("_".join(_corrected(m)) for m in PATTERN.finditer(text))
+    reports = []
+
+    def rewrite(match: re.Match) -> str:
+        suite, name = match["suite"], match["name"]
+        new_suite, new_name = _corrected(match)
+        line = text.count("\n", 0, match.start()) + 1
+
+        if match["macro"] in FIXTURE_MACROS and camel_case(suite) != suite:
+            reports.append(
+                f"{line}: fixture '{suite}' is not CamelCase: rename the class "
+                f"to '{camel_case(suite)}' by hand"
+            )
+        if (new_suite, new_name) == (suite, name):
+            return match[0]
+        if joined[f"{new_suite}_{new_name}"] > 1:
+            reports.append(
+                f"{line}: cannot rename '{suite}, {name}' to '{new_suite}, "
+                f"{new_name}': another test case already generates that name"
+            )
+            return match[0]
+        if new_suite != suite:
+            reports.append(f"{line}: renamed suite '{suite}' to '{new_suite}'")
+        if new_name != name:
+            reports.append(f"{line}: renamed test case '{name}' to '{new_name}'")
+        return match["head"] + new_suite + match["mid"] + new_name + match["tail"]
+
+    return PATTERN.sub(rewrite, text), reports
+
+
+def fix_names(path: Path) -> bool:
+    """Corrects one file's gtest names, reporting each on stdout."""
+    original = path.read_text(encoding="utf-8")
+    fixed, reports = fix_source(original)
+    for report in reports:
+        print(f"{path}:{report}")
+    if fixed != original:
+        path.write_text(fixed, encoding="utf-8")
+    return not reports
+
+
+def main() -> int:
+    files = [Path(f) for f in sys.argv[1:]]
+    success = True
+
+    for path in files:
+        success &= fix_names(path)
+
+    return 0 if success else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/pre-commit/test_fix_gtest_names.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""
+Tests for fix_gtest_names.py.
+
+Run directly (no test framework needed):
+    ./bin/pre-commit/test_fix_gtest_names.py
+or under pytest:
+    pytest bin/pre-commit/test_fix_gtest_names.py
+"""
+
+import sys
+import textwrap
+
+from fix_gtest_names import camel_case, fix_source, snake_case
+
+
+def dedent(text: str) -> str:
+    """Removes a fixture's common indentation and its leading newline.
+
+    Lets fixtures be written as indented triple-quoted here-docs while keeping
+    honest 1-based line numbers.
+    """
+    return textwrap.dedent(text).lstrip("\n")
+
+
+def fixed(text: str) -> str:
+    return fix_source(dedent(text))[0]
+
+
+def reports(text: str) -> list[str]:
+    return fix_source(dedent(text))[1]
+
+
+# --- conversion --------------------------------------------------------------
+
+
+def test_snake_case_conversion() -> None:
+    assert snake_case("BadInputs") == "bad_inputs"
+    assert snake_case("mulDiv") == "mul_div"
+    assert snake_case("already_snake") == "already_snake"
+    assert snake_case("base64") == "base64"
+
+
+def test_snake_case_keeps_acronyms_whole() -> None:
+    assert snake_case("SetAndResetAccountTxnID") == "set_and_reset_account_txn_id"
+    assert snake_case("XRPToIOU") == "xrp_to_iou"
+    assert snake_case("STAmountMath") == "st_amount_math"
+
+
+def test_camel_case_conversion() -> None:
+    assert camel_case("json_value") == "JsonValue"
+    assert camel_case("mulDiv") == "MulDiv"
+    assert camel_case("scope") == "Scope"
+    assert camel_case("base64") == "Base64"
+
+
+def test_camel_case_leaves_acronyms_alone() -> None:
+    # A snake_case round-trip would give `ShaMapTest` / `ParseStatmRsSkB` here.
+    assert camel_case("SHAMapTest") == "SHAMapTest"
+    assert camel_case("parseStatmRSSkB") == "ParseStatmRSSkB"
+    assert camel_case("XRPAmount") == "XRPAmount"
+    assert camel_case("CSPRNG") == "CSPRNG"
+
+
+def test_disabled_prefix_preserved() -> None:
+    assert snake_case("DISABLED_FooBar") == "DISABLED_foo_bar"
+    assert snake_case("DISABLED_foo_bar") == "DISABLED_foo_bar"
+    assert snake_case("DISABLED_") == "DISABLED_"
+    assert camel_case("DISABLED_foo_bar") == "DISABLED_FooBar"
+    assert camel_case("DISABLED_") == "DISABLED_"
+
+
+# --- what counts as a test definition ---------------------------------------
+
+
+def test_all_macros_recognized() -> None:
+    code = """
+    TEST(Suite, oneName)
+    TEST_F(Fixture, twoName)
+    TEST_P(Fixture, threeName)
+    TYPED_TEST(Fixture, fourName)
+    TYPED_TEST_P(Fixture, fiveName)
+    """
+    assert fixed(code) == dedent("""
+        TEST(Suite, one_name)
+        TEST_F(Fixture, two_name)
+        TEST_P(Fixture, three_name)
+        TYPED_TEST(Fixture, four_name)
+        TYPED_TEST_P(Fixture, five_name)
+        """)
+
+
+def test_conforming_definitions_untouched() -> None:
+    code = """
+    TEST(AccountSet, bad_inputs)
+    TEST_F(MutexMakeTest, default_constructor)
+    TEST(SHAMap, DISABLED_slow_path)
+    """
+    assert reports(code) == []
+    assert fixed(code) == dedent(code)
+
+
+def test_lookalikes_ignored() -> None:
+    code = """
+    // TEST(Suite, notATest)
+    TEST_EXPECT(someCall())
+    TEST_EXPECTS(amount == value, amount.getText())
+    INSTANTIATE_TEST_SUITE_P(Prefix, Fixture, testValues());
+    auto x = TEST(Suite, notATest);
+    TYPED_TEST_SUITE(Fixture, MyTypes);
+    """
+    assert reports(code) == []
+    assert fixed(code) == dedent(code)
+
+
+def test_indented_and_wrapped_definitions() -> None:
+    code = """
+    namespace ripple {
+        TEST(Suite, indentedName)
+    }
+    TEST_F(
+        SomeVeryLongFixtureName,
+        wrappedName)
+    """
+    assert fixed(code) == dedent("""
+        namespace ripple {
+            TEST(Suite, indented_name)
+        }
+        TEST_F(
+            SomeVeryLongFixtureName,
+            wrapped_name)
+        """)
+
+
+# --- rewriting --------------------------------------------------------------
+
+
+def test_only_the_two_names_are_rewritten() -> None:
+    code = """
+    TEST(mulDiv, mulDiv)
+    {
+        auto const mulDiv = 1;  // mulDiv stays
+    }
+    """
+    assert fixed(code) == dedent("""
+        TEST(MulDiv, mul_div)
+        {
+            auto const mulDiv = 1;  // mulDiv stays
+        }
+        """)
+
+
+def test_suite_name_camel_cased() -> None:
+    code = """
+    TEST(json_value, limits)
+    TEST(scope, ScopeExit)
+    """
+    assert reports(code) == [
+        "1: renamed suite 'json_value' to 'JsonValue'",
+        "2: renamed suite 'scope' to 'Scope'",
+        "2: renamed test case 'ScopeExit' to 'scope_exit'",
+    ]
+    assert fixed(code) == dedent("""
+        TEST(JsonValue, limits)
+        TEST(Scope, scope_exit)
+        """)
+
+
+def test_fixture_reported_but_not_renamed() -> None:
+    # The first argument names a class, so only a human (or clang-tidy) can
+    # rename it; the test-case name is still fixed.
+    code = """
+    TEST_F(my_fixture, someTest)
+    """
+    assert reports(code) == [
+        "1: fixture 'my_fixture' is not CamelCase: rename the class to "
+        "'MyFixture' by hand",
+        "1: renamed test case 'someTest' to 'some_test'",
+    ]
+    assert fixed(code) == dedent("""
+        TEST_F(my_fixture, some_test)
+        """)
+
+
+def test_reports_carry_line_numbers() -> None:
+    code = """
+    #include <foo.h>
+
+    TEST(Suite, firstName)
+
+    TEST(Suite, secondName)
+    """
+    assert reports(code) == [
+        "3: renamed test case 'firstName' to 'first_name'",
+        "5: renamed test case 'secondName' to 'second_name'",
+    ]
+
+
+# --- collisions -------------------------------------------------------------
+
+
+def test_collision_reported_and_not_applied() -> None:
+    # Both would define `Suite_mul_div_Test`.
+    code = """
+    TEST(Suite, mulDiv)
+    TEST(Suite, mul_div)
+    """
+    assert reports(code) == [
+        "1: cannot rename 'Suite, mulDiv' to 'Suite, mul_div': another test "
+        "case already generates that name"
+    ]
+    assert fixed(code) == dedent(code)
+
+
+def test_collision_between_converging_suites() -> None:
+    # Both suites camel-case to `SuiteA`, so both would define
+    # `SuiteA_one_test_Test`.
+    code = """
+    TEST(SuiteA, oneTest)
+    TEST(Suite_a, one_test)
+    """
+    assert [r.split(":")[1].strip() for r in reports(code)] == [
+        "cannot rename 'SuiteA, oneTest' to 'SuiteA, one_test'",
+        "cannot rename 'Suite_a, one_test' to 'SuiteA, one_test'",
+    ]
+    assert fixed(code) == dedent(code)
+
+
+def test_same_name_in_different_suites_is_not_a_collision() -> None:
+    code = """
+    TEST(SuiteOne, mulDiv)
+    TEST(SuiteTwo, mulDiv)
+    """
+    assert fixed(code) == dedent("""
+        TEST(SuiteOne, mul_div)
+        TEST(SuiteTwo, mul_div)
+        """)
+
+
+def main() -> int:
+    tests = sorted(
+        (name, fn)
+        for name, fn in globals().items()
+        if name.startswith("test_") and callable(fn)
+    )
+    failed = 0
+    for name, fn in tests:
+        try:
+            fn()
+            print(f"PASS {name}")
+        except AssertionError as exc:
+            failed += 1
+            print(f"FAIL {name}: {exc!r}")
+    print(f"\n{len(tests) - failed}/{len(tests)} passed")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

cfg/xrpld-example.cfg

@@ -1094,8 +1094,8 @@
 #                           Default is 100.
 #
 #       back_off_milliseconds
-#                           Number of milliseconds to wait between
-#                           online_delete batches to allow other functions
+#                           Number of milliseconds to wait between online_delete
+#                           SQL deletion batches to allow other functions
 #                           to catch up.
 #                           Default is 100.
 #
@@ -1109,10 +1109,22 @@
 #                           The online delete process checks periodically
 #                           that xrpld is still in sync with the network,
 #                           and that the validated ledger is less than
-#                           'age_threshold_seconds' old. If not, then continue
+#                           'age_threshold_seconds' old, and that all
+#                           recent ledgers are available. If not, then continue
 #                           sleeping for this number of seconds and
 #                           checking until healthy.
-#                           Default is 5.
+#                           Default is 2.
+#
+#       max_waiting_ledgers
+#                           The maximum number of ledgers that may be validated
+#                           while online deletion is waiting for the node to get
+#                           fully synced with the rest of the network. If more than
+#                           this number of ledgers are validated while waiting, then
+#                           online deletion gives up on the current ledger and tries
+#                           again later. Note this only affects situations that cause
+#                           rotation to wait, such as going out of sync, or missing
+#                           ledgers. Forward progress is not penalized. Minimum is 64.
+#                           Default is the online_delete value.
 #
 #   Notes:
 #       The 'node_db' entry configures the primary, persistent storage.
@@ -1348,6 +1360,39 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
+#   gas_limit = <gas>
+#
+#       The gas limit is the maximum amount of gas that can be
+#       consumed by a single transaction. The gas limit is used to prevent
+#       transactions from consuming too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_limit = 1000000      # 1 million gas
+#
+#   bytecode_size_limit = <bytes>
+#
+#       The bytecode size limit is the maximum size of a WASM extension in
+#       bytes. The size limit is used to prevent extensions from consuming
+#       too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           bytecode_size_limit = 100000      # 100 kb
+#
+#   gas_price = <micro-drops>
+#
+#       The gas price is the conversion between WASM gas and its price in drops.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings

cmake/GitInfo.cmake

@@ -1,28 +0,0 @@
-include_guard()
-
-set(GIT_BUILD_BRANCH "")
-set(GIT_COMMIT_HASH "")
-
-find_package(Git)
-if(NOT Git_FOUND)
-    message(WARNING "Git not found. Git branch and commit hash will be empty.")
-    return()
-endif()
-
-set(GIT_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/.git)
-
-execute_process(
-    COMMAND
-        ${GIT_EXECUTABLE} --git-dir=${GIT_DIRECTORY} rev-parse --abbrev-ref HEAD
-    OUTPUT_STRIP_TRAILING_WHITESPACE
-    OUTPUT_VARIABLE GIT_BUILD_BRANCH
-)
-
-execute_process(
-    COMMAND ${GIT_EXECUTABLE} --git-dir=${GIT_DIRECTORY} rev-parse HEAD
-    OUTPUT_STRIP_TRAILING_WHITESPACE
-    OUTPUT_VARIABLE GIT_COMMIT_HASH
-)
-
-message(STATUS "Git branch: ${GIT_BUILD_BRANCH}")
-message(STATUS "Git commit hash: ${GIT_COMMIT_HASH}")

cmake/PatchNixBinary.cmake

@@ -17,7 +17,7 @@
    (runtime libraries resolved through the rpath) are skipped too.
    Everywhere else `patch_nix_binary` is a no-op.
 
-   The default loader is resolved by bin/default-loader-path.sh.
+   The default loader is resolved by bin/nix/default-loader-path.sh.
 #]===================================================================]
 
 include_guard(GLOBAL)
@@ -25,7 +25,7 @@ include_guard(GLOBAL)
 include(CompilationEnv)
 
 # Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/nix/default-loader-path.sh")
 
 if(
     is_linux

cmake/XrplAddBenchmark.cmake

@@ -29,6 +29,14 @@ function(xrpl_add_benchmark name)
     # XrplCore.cmake. Each file compiles fine on its own.
     set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
 
+    # Land next to `xrpl_tests` in the build root rather than buried under
+    # `src/benchmarks/libxrpl/`. A benchmark is something a person runs by hand,
+    # repeatedly, and comparing two of them should not mean typing two long paths.
+    set_target_properties(
+        ${target}
+        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
+    )
+
     isolate_headers(
         ${target}
         "${CMAKE_SOURCE_DIR}/src"

cmake/XrplCompiler.cmake

@@ -120,7 +120,10 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
+    target_link_libraries(
+        common
+        INTERFACE -errorreport:none -machine:X64 -ignore:4099
+    )
 else()
     target_compile_options(
         common
@@ -266,10 +269,50 @@ elseif(use_lld)
     )
     if("${LD_VERSION}" MATCHES "LLD")
         target_link_libraries(common INTERFACE -fuse-ld=lld)
+        # remembered for the linker flag probe below
+        set(fuse_ld_flag "-fuse-ld=lld")
     endif()
     unset(LD_VERSION)
 endif()
 
+# Linker warnings are errors where we control the toolchain and the dependencies: CI and the Nix dev shell.
+# On non-Nix macOS we suppress the deployment target warning: an old Conan profile may not pin os.version.
+# Only the new Apple linker understands the flag, so probe the actual linker (lld may be selected above).
+if(is_macos OR is_linux)
+    if(is_ci OR is_nix_compiler)
+        if(is_macos)
+            set(fatal_warnings_flag "-Wl,-fatal_warnings")
+        else()
+            set(fatal_warnings_flag "-Wl,--fatal-warnings")
+        endif()
+        message(
+            STATUS
+            "Treating all linker warnings as errors (${fatal_warnings_flag})"
+        )
+        target_link_options(common INTERFACE "${fatal_warnings_flag}")
+        unset(fatal_warnings_flag)
+    elseif(is_macos)
+        set(silence_flag "-Wl,-deployment_target_mismatches,suppress")
+        set(probe_flags ${fuse_ld_flag} "${silence_flag}")
+        include(CheckLinkerFlag)
+        check_linker_flag(
+            CXX
+            "${probe_flags}"
+            have_deployment_target_mismatches
+        )
+        if(have_deployment_target_mismatches)
+            message(
+                STATUS
+                "Silencing macOS deployment target mismatch warnings (${silence_flag})"
+            )
+            target_link_options(common INTERFACE "${silence_flag}")
+        endif()
+        unset(probe_flags)
+        unset(silence_flag)
+    endif()
+endif()
+unset(fuse_ld_flag)
+
 if(assert)
     foreach(var_ CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS_RELEASE)
         string(REGEX REPLACE "[-/]DNDEBUG" "" ${var_} "${${var_}}")

cmake/XrplCore.cmake

@@ -51,6 +51,8 @@ target_compile_options(
 
 target_link_libraries(xrpl.libpb PUBLIC protobuf::libprotobuf gRPC::grpc++)
 
+add_dependencies(tidy_prerequisites xrpl.libpb)
+
 # TODO: Clean up the number of library targets later.
 add_library(xrpl.imports.main INTERFACE)
 
@@ -79,7 +81,7 @@ include(target_link_modules)
 add_module(xrpl beast)
 target_link_libraries(xrpl.libxrpl.beast PUBLIC xrpl.imports.main)
 
-include(GitInfo)
+include(XrplVersion)
 add_module(xrpl git)
 target_compile_definitions(
     xrpl.libxrpl.git
@@ -109,6 +111,11 @@ target_link_libraries(
     xrpl.libxrpl.protocol
     PUBLIC xrpl.libxrpl.crypto xrpl.libxrpl.git xrpl.libxrpl.json
 )
+# Only on BuildInfo.cpp, so a new version does not rebuild the whole module.
+set_source_files_properties(
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/libxrpl/protocol/BuildInfo.cpp
+    PROPERTIES COMPILE_DEFINITIONS XRPLD_VERSION="${XRPLD_VERSION}"
+)
 
 # Level 05
 add_module(xrpl protocol_autogen)
@@ -205,16 +212,10 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-# The wasm engine is a Rust crate reached over cxx: the bridge target supplies the
-# generated `lib.h` and `rust/cxx.h` that `tx/wasm` compiles against, and the Rust
-# static library everything downstream links. PUBLIC because the include path travels
-# with the module's own public headers.
 target_link_libraries(
     xrpl.libxrpl.tx
     PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
 )
-# Those headers do not exist at configure time, and the header-verification target
-# compiles this module's headers on their own, so both need the crates built first.
 add_dependencies(xrpl.libxrpl.tx xrpl_crates)
 
 add_module(xrpl consensus)
@@ -295,6 +296,14 @@ if(xrpld)
     )
     target_sources(xrpld PRIVATE ${sources})
 
+    rpcspec_generate_instantiations(
+        OUT_VAR rpcspec_instantiations
+        VALUE_TYPE "::json::Value"
+        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
+        HANDLERS book_changes ledger transaction_entry
+    )
+    target_sources(xrpld PRIVATE ${rpcspec_instantiations})
+
     if(tests)
         file(
             GLOB_RECURSE sources
@@ -304,7 +313,14 @@ if(xrpld)
         target_sources(xrpld PRIVATE ${sources})
     endif()
 
-    target_link_libraries(xrpld Xrpl::boost Xrpl::opts Xrpl::libs xrpl.libxrpl)
+    target_link_libraries(
+        xrpld
+        Xrpl::boost
+        Xrpl::opts
+        Xrpl::libs
+        xrpl.libxrpl
+        rpcspec::rpcspec
+    )
     exclude_if_included(xrpld)
     # define a macro for tests that might need to
     # be excluded or run differently in CI environment
@@ -318,6 +334,7 @@ if(xrpld)
         # antithesis_instrumentation.h, which is not exported as INTERFACE
         target_include_directories(
             xrpld
+            SYSTEM
             PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
         )
     endif()

cmake/XrplCov.cmake

@@ -44,10 +44,11 @@ setup_target_for_coverage_gcovr(
     EXCLUDE
         "src/test"
         "src/tests"
+        "src/benchmarks"
         "include/xrpl/beast/test"
         "include/xrpl/beast/unit_test"
         "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"
-    DEPENDENCIES xrpld xrpl_tests
+    DEPENDENCIES xrpld xrpl_tests xrpld_tests
 )
 
 add_code_coverage_to_target(opts INTERFACE)

cmake/XrplPackaging.cmake

@@ -1,7 +1,7 @@
 #[===================================================================[
    Linux packaging support: 'package' target.
 
-   The packaging script (package/build_pkg.sh) installs to FHS-standard
+   The packaging script (package/build_pkg.py) installs to FHS-standard
    paths (/usr/bin, /etc/xrpld, etc.) regardless of CMAKE_INSTALL_PREFIX,
    so no prefix guard is needed here.
 #]===================================================================]
@@ -38,19 +38,26 @@ if(NOT TARGET validator-keys)
     return()
 endif()
 
-set(package_env
-    SRC_DIR=${CMAKE_SOURCE_DIR}
-    BUILD_DIR=${CMAKE_BINARY_DIR}
-    PKG_RELEASE=${pkg_release}
-)
+if(DPKG_BUILDPACKAGE_EXECUTABLE)
+    set(pkg_type deb)
+else()
+    set(pkg_type rpm)
+endif()
+
+# Unquoted below, so an empty value adds no argument at all.
+set(pkg_variant_option "")
+if(assert)
+    set(pkg_variant_option --variant=assert)
+endif()
 
 add_custom_target(
     package
     COMMAND
-        ${CMAKE_COMMAND} -E env ${package_env}
-        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
+        ${CMAKE_SOURCE_DIR}/package/build_pkg.py --package-type=${pkg_type}
+        --build-dir=${CMAKE_BINARY_DIR} --pkg-release=${pkg_release}
+        ${pkg_variant_option} --channel=UNRELEASED
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
     DEPENDS xrpld validator-keys
-    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
+    COMMENT "Building Linux ${pkg_type} package"
     VERBATIM
 )

cmake/XrplSanitizers.cmake

@@ -77,19 +77,24 @@ if(is_clang)
     message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()
 
-# Define SANITIZERS macro for BuildInfo.cpp
+# Define the SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN,
+# XRPL_TSAN and XRPL_UBSAN per active sanitizer, so that code can test for a
+# specific one with #ifdef instead of parsing the dot-joined SANITIZERS string.
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
     set(enable_asan ON)
     list(APPEND sanitizers_list "ASAN")
+    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
     set(enable_tsan ON)
     list(APPEND sanitizers_list "TSAN")
+    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
     set(enable_ubsan ON)
     list(APPEND sanitizers_list "UBSAN")
+    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()
 
 if(sanitizers_list)

cmake/XrplVersion.cmake

@@ -1,15 +1,75 @@
-#[===================================================================[
-   read version from source
-#]===================================================================]
+find_package(Git)
 
-file(STRINGS src/libxrpl/protocol/BuildInfo.cpp BUILD_INFO)
-foreach(line_ ${BUILD_INFO})
-    if(line_ MATCHES "versionString[ ]*=[ ]*\"(.+)\"")
-        set(xrpld_version ${CMAKE_MATCH_1})
-    endif()
-endforeach()
-if(xrpld_version)
-    message(STATUS "xrpld version: ${xrpld_version}")
-else()
-    message(FATAL_ERROR "unable to determine xrpld version")
+set(GIT_BUILD_BRANCH "")
+set(GIT_COMMIT_HASH "")
+
+if(DEFINED ENV{GITHUB_BRANCH_NAME})
+    set(GIT_BUILD_BRANCH $ENV{GITHUB_BRANCH_NAME})
+    set(GIT_COMMIT_HASH $ENV{GITHUB_HEAD_SHA})
+elseif(Git_FOUND AND EXISTS "${CMAKE_CURRENT_LIST_DIR}/../.git")
+    execute_process(
+        COMMAND ${GIT_EXECUTABLE} rev-parse --abbrev-ref HEAD
+        WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}/..
+        OUTPUT_VARIABLE GIT_BUILD_BRANCH
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        COMMAND_ERROR_IS_FATAL ANY
+    )
+
+    execute_process(
+        COMMAND ${GIT_EXECUTABLE} rev-parse HEAD
+        WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}/..
+        OUTPUT_VARIABLE GIT_COMMIT_HASH
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        COMMAND_ERROR_IS_FATAL ANY
+    )
 endif()
+
+message(STATUS "Git branch: ${GIT_BUILD_BRANCH}")
+message(STATUS "Git commit hash: ${GIT_COMMIT_HASH}")
+
+if(
+    DEFINED ENV{FORCE_XRPLD_VERSION}
+    AND NOT "$ENV{FORCE_XRPLD_VERSION}" STREQUAL ""
+)
+    message(
+        STATUS
+        "Using explicitly provided '$ENV{FORCE_XRPLD_VERSION}' as xrpld version"
+    )
+
+    set(XRPLD_VERSION "$ENV{FORCE_XRPLD_VERSION}")
+
+    # The rules beast::SemanticVersion::parse applies, so that an invalid version
+    # fails here rather than when xrpld starts. It reads each number as an int.
+    set(SEMVER_NUMBER "(0|[1-9][0-9]*)")
+    set(SEMVER_PRE_RELEASE "[A-Za-z1-9-][A-Za-z0-9-]*")
+    set(SEMVER_METADATA "[A-Za-z0-9-]+")
+    set(SEMVER_NUMBER_MAX 2147483647)
+    if(
+        NOT XRPLD_VERSION
+            MATCHES
+            "^${SEMVER_NUMBER}\\.${SEMVER_NUMBER}\\.${SEMVER_NUMBER}(-${SEMVER_PRE_RELEASE}(\\.${SEMVER_PRE_RELEASE})*)?(\\+${SEMVER_METADATA}(\\.${SEMVER_METADATA})*)?$"
+        OR CMAKE_MATCH_1 GREATER SEMVER_NUMBER_MAX
+        OR CMAKE_MATCH_2 GREATER SEMVER_NUMBER_MAX
+        OR CMAKE_MATCH_3 GREATER SEMVER_NUMBER_MAX
+    )
+        message(
+            FATAL_ERROR
+            "FORCE_XRPLD_VERSION '${XRPLD_VERSION}' is not a semantic version xrpld accepts, see https://semver.org"
+        )
+    endif()
+else()
+    message(STATUS "Using '0.0.0-dev+<git short rev>' as xrpld version")
+
+    if(GIT_COMMIT_HASH STREQUAL "")
+        message(
+            FATAL_ERROR
+            "Unable to determine xrpld version without git, set FORCE_XRPLD_VERSION"
+        )
+    endif()
+
+    string(SUBSTRING ${GIT_COMMIT_HASH} 0 7 GIT_COMMIT_HASH_SHORT)
+
+    set(XRPLD_VERSION "0.0.0-dev+${GIT_COMMIT_HASH_SHORT}")
+endif()
+
+message(STATUS "Build version: ${XRPLD_VERSION}")

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,6 +8,7 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
+import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -53,28 +54,89 @@ def create_transaction_parser():
     return macro_parser
 
 
+# Defaults for xrpl::TxSettings members, mirroring
+# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
+# the members that differ from these.
+SETTING_DEFAULTS = {
+    "delegable": "Delegation::NotDelegable",
+    "amendment": "UInt256{}",
+    "privileges": "Privilege::NoPriv",
+}
+
+
+def parse_settings(settings_str):
+    """Parse a TxSettings blob into a dict, filling in defaults.
+
+    Args:
+        settings_str: A string like '({.delegable = Delegation::NotDelegable,
+                      .privileges = Privilege::CreateAcct})', or '({})'.
+
+    Returns:
+        A dict with a value for every key in SETTING_DEFAULTS.
+    """
+    body = settings_str.strip()
+    if not (body.startswith("(") and body.endswith(")")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1].strip()
+    if not (body.startswith("{") and body.endswith("}")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1]
+
+    # Strip comments, which may be interleaved with the designated initializers.
+    body = re.sub(r"//[^\n]*", "", body)
+
+    settings = dict(SETTING_DEFAULTS)
+    seen = set()
+    # Each entry runs from '.key =' up to the next '.key =' or the end.
+    for key, value in re.findall(
+        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
+    ):
+        if key not in SETTING_DEFAULTS:
+            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
+        settings[key] = " ".join(value.split()).rstrip(",")
+        seen.add(key)
+
+    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
+    # Every '.member' in the blob must have been consumed above.
+    if len(re.findall(r"\.\w+", body)) != len(seen):
+        raise ValueError(f"Could not parse every setting in {settings_str!r}")
+
+    # A blob with content but no designated initializer is positional, which
+    # would otherwise be read as "all defaults" and silently generate the
+    # wrong output.
+    if body.strip() and not seen:
+        raise ValueError(
+            "TxSettings requires designated initializers (.member = value), "
+            f"got {settings_str!r}"
+        )
+
+    return settings
+
+
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
-                    'uint256{}', 'createAcct', '({...})']
+                   ['ttPAYMENT', '0', 'Payment',
+                    '({.privileges = Privilege::CreateAcct})', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 7:
+    if len(args_list) < 5:
         raise ValueError(
-            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    delegable = args_list[3]
-    amendments = args_list[4]
-    privileges = args_list[5]
+    settings = parse_settings(args_list[3])
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -84,9 +146,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": delegable,
-        "amendments": amendments,
-        "privileges": privileges,
+        "delegable": settings["delegable"],
+        "amendments": settings["amendment"],
+        "privileges": settings["privileges"],
         "fields": fields,
     }
 

cmake/scripts/codegen/templates/LedgerEntry.h.mako

@@ -209,7 +209,7 @@ ${field['typeData']['setter_type']} ${field['paramName']}${',' if i < len(requir
      * @return The constructed ledger entry wrapper.
      */
     ${name}
-    build(uint256 const& index)
+    build(UInt256 const& index)
     {
         return ${name}{std::make_shared<SLE>(std::move(object_), index)};
     }

cmake/scripts/codegen/templates/LedgerEntryTests.cpp.mako

@@ -31,7 +31,7 @@ namespace xrpl::ledger_entries {
 // builder's STObject and the wrapper's SLE.
 TEST(${name}Tests, BuilderSettersRoundTrip)
 {
-    uint256 const index{1u};
+    UInt256 const index{1u};
 
 % for field in fields:
     auto const ${field["paramName"]}Value = ${canonical_expr(field)};
@@ -85,7 +85,7 @@ TEST(${name}Tests, BuilderSettersRoundTrip)
 // from that SLE, build a new wrapper, and verify all fields (and validate()).
 TEST(${name}Tests, BuilderFromSleRoundTrip)
 {
-    uint256 const index{2u};
+    UInt256 const index{2u};
 
 % for field in fields:
     auto const ${field["paramName"]}Value = ${canonical_expr(field)};
@@ -146,7 +146,7 @@ TEST(${name}Tests, BuilderFromSleRoundTrip)
 // 3) Verify wrapper throws when constructed from wrong ledger entry type.
 TEST(${name}Tests, WrapperThrowsOnWrongEntryType)
 {
-    uint256 const index{3u};
+    UInt256 const index{3u};
 
     // Build a valid ledger entry of a different type
     // Ticket requires: Account, OwnerNode, TicketSequence, PreviousTxnID, PreviousTxnLgrSeq
@@ -177,7 +177,7 @@ TEST(${name}Tests, WrapperThrowsOnWrongEntryType)
 // 4) Verify builder throws when constructed from wrong ledger entry type.
 TEST(${name}Tests, BuilderThrowsOnWrongEntryType)
 {
-    uint256 const index{4u};
+    UInt256 const index{4u};
 
     // Build a valid ledger entry of a different type
 % if wrong_le_include == "Ticket":
@@ -207,7 +207,7 @@ TEST(${name}Tests, BuilderThrowsOnWrongEntryType)
 // 5) Build with only required fields and verify optional fields return nullopt.
 TEST(${name}Tests, OptionalFieldsReturnNullopt)
 {
-    uint256 const index{3u};
+    UInt256 const index{3u};
 
 % for field in required_fields:
     auto const ${field["paramName"]}Value = ${canonical_expr(field)};

conan.lock

@@ -3,6 +3,7 @@
     "requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
+        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
         "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
         "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -19,10 +20,11 @@
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
-        "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1782494504.298",
+        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
+        "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1785888854.601666",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
+        "corrosion/0.6.1#bfa292df0a957bc70a450ff316cd9435%1786119416.131296",
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
@@ -32,11 +34,15 @@
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
+        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
         "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
+        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
@@ -44,6 +50,10 @@
     ],
     "python_requires": [],
     "overrides": {
+        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c": [
+            null,
+            "boost/1.91.0#ea540ca2133d831b560036aa24dece3c"
+        ],
         "protobuf/[>=5.27.0 <7]": [
             "protobuf/6.33.5"
         ],

conan/global.conf

@@ -3,5 +3,13 @@
 core:non_interactive=True
 core.download:parallel={{ os.cpu_count() }}
 core.upload:parallel={{ os.cpu_count() }}
-tools.files.download:retry=5
+# Fall back to Conan Center's source backups when a recipe's upstream URL is down
+# (e.g. the GNU FTP mirrors), see
+# https://github.com/conan-io/conan-center-index/issues/28147#issuecomment-3183544772
+# The backups are only tried once every upstream URL has used up its retries,
+# so keep the retries low.
+core.sources:download_urls=["origin", "https://c3i.jfrog.io/artifactory/conan-center-backup-sources"]
+tools.files.download:retry=1
 tools.files.download:retry_wait=10
+# Fail fast on unreachable hosts (default connect timeout is 30s), keep the 60s read timeout.
+core.net.http:timeout=(5, 60)

conan/init.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
+# Safe to re-run; never deletes the Conan home.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+CONAN_DIR="$(conan config home)"
+
+echo "Installing Conan configuration into ${CONAN_DIR}"
+conan config install "${SCRIPT_DIR}/global.conf"
+conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
+# This script manages these files, so make them read-only - Conan does not
+# preserve the source mode. Only the files: the directories must stay writable
+# for `conan config install` to replace them.
+chmod a-w "${CONAN_DIR}/global.conf"
+find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +
+
+echo "Adding the xrplf Conan remote"
+# --index 0: our patched recipes must win over Conan Center.
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/

conan/profiles/default

@@ -1,10 +1,7 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
-{% set compiler_version = version %}
-{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
-{% endif %}
 {% if os == "Macos" %}
 {# Minimum macOS the dependencies target. #}
 {# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}
@@ -32,9 +29,9 @@ os.version={{ min_macos_version }}
 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
 {# Instead it hand-rolls the compiler for user-config.jam, #}
-{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
-{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
-{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-<major>`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-<major>` suffix), #}
+{# so on a host that also has a system `g++-<major>` the probe escapes Nix #}
 {# and picks the system compiler, which is mismatched with the Nix libraries #}
 {# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
 {# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
@@ -52,8 +49,31 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
 
-{% if os == "Macos" %}
+{% if os == "Linux" and context == "build" %}
+{# Build-context executables (protoc, grpc_cpp_plugin, build tools) run during the build #}
+{# and would otherwise load libstdc++/libgcc from a Nix store path #}
+{# that might change with a Nix toolchain update. #}
+{# --as-needed drops the ones they link but don't use, #}
+{# such as libatomic for grpc_cpp_plugin on arm64. #}
+{% set static_runtime_flags = ["-static-libstdc++", "-static-libgcc", "-Wl,--as-needed"] %}
+tools.build:exelinkflags+={{ static_runtime_flags }}
+tools.info.package_id:confs+=["tools.build:exelinkflags"]
+{% endif %}
+
+{% if os == "Linux" and context == "build" %}
+{# b2 links itself with its own script, which ignores exelinkflags #}
+{# and only takes CXXFLAGS when use_cxx_env is set (see [buildenv] below). #}
+[options]
+b2/*:use_cxx_env=True
+{% endif %}
+
 [buildenv]
+{# gRPC emits thousands of compiler warnings that we cannot act on. #}
+{# CMake picks up CXXFLAGS, and unlike tools.build:cxxflags, #}
+{# this is not part of the package ID, so binaries stay shareable. #}
+grpc/*:CXXFLAGS=-w
+
+{% if os == "Macos" %}
 {# os.version adds -mmacosx-version-min to compiler command lines, #}
 {# but Boost.Context's b2 assembly (.S) rule ignores it, #}
 {# so those objects keep the host SDK version and still warn at link time. #}
@@ -61,3 +81,7 @@ tools.info.package_id:confs+=["user.package:cppstd_version"]
 {# Scoped to boost/* since it is the only gap. #}
 boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
 {% endif %}
+
+{% if os == "Linux" and context == "build" %}
+b2/*:CXXFLAGS={{ static_runtime_flags | join(" ") }}
+{% endif %}

conan/profiles/sanitizers

@@ -5,6 +5,9 @@ include(default)
 
 {% if not sanitizers %}
 {# Sanitizers not configured; no additional settings needed #}
+{% elif context == "build" %}
+{# Build-context packages are tools we run, not code we test, #}
+{# so don't instrument them #}
 {% else %}
 
 {% if compiler == "msvc" %}

conanfile.py

@@ -1,9 +1,13 @@
+import os
 import re
 
 from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
+from conan.tools.env import Environment
 
 from conan import ConanFile
 
+DEV_VERSION = "0.0.0-dev"
+
 
 class Xrpl(ConanFile):
     name = "xrpl"
@@ -28,6 +32,7 @@ class Xrpl(ConanFile):
     }
 
     requires = [
+        "corrosion/0.6.1",
         "ed25519/2015.03",
         "fast_float/8.2.10",
         "grpc/1.81.1",
@@ -35,6 +40,7 @@ class Xrpl(ConanFile):
         "nudb/2.0.9",
         "openssl/3.6.3",
         "soci/4.0.3",
+        "xrpl-rpc-spec/0.1.21",
         "zlib/1.3.2",
     ]
 
@@ -43,7 +49,8 @@ class Xrpl(ConanFile):
     ]
 
     tool_requires = [
-        "protobuf/6.33.5",
+        "grpc/<host_version>",
+        "protobuf/<host_version>",
     ]
 
     default_options = {
@@ -113,17 +120,16 @@ class Xrpl(ConanFile):
         "soci/*:shared": False,
         "soci/*:with_sqlite3": True,
         "soci/*:with_boost": True,
+        "xrpl-rpc-spec/*:server": "xrpld",
         "xxhash/*:shared": False,
     }
 
+    # default_options only reach the host context;
+    # give tool_requires (and their dependencies) the same dependency options.
+    default_build_options = {k: v for k, v in default_options.items() if "/" in k}
+
     def set_version(self):
-        if self.version is None:
-            path = f"{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp"
-            regex = r"versionString\s?=\s?\"(.*)\""
-            with open(path, encoding="utf-8") as file:
-                matches = (re.search(regex, line) for line in file)
-                match = next(m for m in matches if m)
-                self.version = match.group(1)
+        self.version = self.version or DEV_VERSION
 
     def configure(self):
         if self.settings.compiler == "apple-clang":
@@ -148,11 +154,16 @@ class Xrpl(ConanFile):
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
+        "bin/nix/default-loader-path.sh",
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",
+        "crates/*",
+        "crates/.cargo/*",
+        "!crates/target/*",
         "external/*",
         "include/*",
+        "rust-toolchain.toml",
         "src/*",
     )
 
@@ -165,6 +176,17 @@ class Xrpl(ConanFile):
     generators = "CMakeDeps"
 
     def generate(self):
+        # The sources in the Conan cache have no git history, so the version
+        # comes from the reference, unless it is not one, like 'develop'.
+        if not os.path.exists(os.path.join(self.source_folder, ".git")):
+            version = str(self.version)
+            env = Environment()
+            env.define(
+                "FORCE_XRPLD_VERSION",
+                version if re.match(r"\d+\.\d+\.\d+", version) else DEV_VERSION,
+            )
+            env.vars(self).save_script("xrpld_version")
+
         tc = CMakeToolchain(self)
         tc.variables["tests"] = self.options.tests
         tc.variables["benchmark"] = self.options.benchmark

crates/.cargo/config.toml

@@ -1,5 +1,17 @@
-[target.x86_64-unknown-linux-gnu]
+# The Rust static libraries are linked into C++ targets, so the runtime linkage
+# here has to match what the C++ build uses (see cmake/XrplCompiler.cmake).
+#
+# macOS needs nothing: AppleClang cannot link libgcc/libc++ statically, so the
+# C++ build skips those flags on Apple as well.
+
+# Both amd64 and arm64 Linux builds link libgcc statically. This only affects
+# links that rustc itself drives (`cargo test` binaries and the like) — the
+# `staticlib` crates consumed by CMake are archived, not linked, so rustc
+# silently ignores link args for them. Keeping libgcc_s.so.1 off the xrpld link
+# line is handled in crates/CMakeLists.txt instead.
+[target.'cfg(target_os = "linux")']
 rustflags = ["-C", "link-args=-static-libgcc"]
 
-[target.x86_64-pc-windows-msvc]
+# Windows builds use the static MSVC runtime.
+[target.'cfg(windows)']
 rustflags = ["-C", "target-feature=+crt-static"]

crates/CMakeLists.txt

@@ -1,58 +1,109 @@
-set(CORROSION_VERSION 0.6.1)
-
-find_package(Corrosion ${CORROSION_VERSION} QUIET)
-if(NOT Corrosion_FOUND)
-    include(FetchContent)
-    FetchContent_Declare(
-        Corrosion
-        GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-        GIT_TAG v${CORROSION_VERSION}
-    )
-    FetchContent_MakeAvailable(Corrosion)
-endif()
+find_package(Corrosion REQUIRED)
 
 corrosion_import_crate(MANIFEST_PATH ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml)
 
-file(
-    WRITE "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
-    "# Auto-generated by crates/CMakeLists.txt. Do not edit.\n"
-    "# Neutralizes clang-tidy for corrosion/cxxbridge-generated C++.\n"
-    "# One check kept enabled to avoid clang-tidy's \"no checks enabled\" error.\n"
-    "Checks: '-*,google-readability-todo'\n"
-    "WarningsAsErrors: ''\n"
-    "HeaderFilterRegex: ''\n"
-    "InheritParentConfig: false\n"
+# The generated C++ lands in the build tree, so put a .clang-tidy next to it to
+# keep clang-tidy from analyzing code we don't own.
+configure_file(
+    generated.clang-tidy
+    "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
+    COPYONLY
 )
 
-# Umbrella target that aggregates all crate-generated code (cxxbridge headers,
-# etc.). Build this before running clang-tidy so generated headers are present.
 add_custom_target(xrpl_crates)
+add_dependencies(tidy_prerequisites xrpl_crates)
+
+# On macOS, ld warns `ignoring duplicate libraries` when linking a crate.
+# Corrosion is the source of both duplicates it names:
+#
+# * The crate archive and its cxxbridge archive, because
+#   `corrosion_add_cxxbridge` makes the two depend on each other, and CMake
+#   repeats a static library cycle on the link line so single-pass linkers can
+#   resolve it. (LINK_INTERFACE_MULTIPLICITY can only raise that count.)
+# * `-lSystem`, which Corrosion copies from rustc's `native-static-libs` even
+#   though the compiler driver always links libSystem.
+#
+# ld needs neither: it resolves the cycle from one copy of each archive and
+# links libSystem once. So silence the warning rather than rewrite Corrosion's
+# link interface, which the cycle is also part of. The option itself is old —
+# Xcode 15 is only where the warning became the default — and the check below
+# leaves it out on a linker that does not know it.
+if(is_macos)
+    include(CheckLinkerFlag)
+    check_linker_flag(
+        CXX
+        -Wl,-no_warn_duplicate_libraries
+        have_no_warn_duplicate_libraries
+    )
+endif()
+
+function(_unlink_libgcc_s crate)
+    if(NOT (is_linux AND static))
+        return()
+    endif()
+
+    # Corrosion exposes a crate's staticlib as an imported `<crate>-static`
+    # target and puts the native libs in its INTERFACE_LINK_LIBRARIES. If either
+    # of those changes, warn instead of silently letting libgcc_s.so.1 return.
+    set(imported "${crate}-static")
+    if(NOT TARGET ${imported})
+        message(
+            FATAL_ERROR
+            "Corrosion did not create the imported target '${imported}', so "
+            "libgcc_s cannot be removed from the link interface of '${crate}'. "
+            "xrpld will link libgcc_s.so.1 dynamically. Check where Corrosion "
+            "${CORROSION_VERSION} now records `native-static-libs`."
+        )
+        return()
+    endif()
+
+    get_target_property(libs ${imported} INTERFACE_LINK_LIBRARIES)
+    if(NOT "gcc_s" IN_LIST libs)
+        message(
+            WARNING
+            "'gcc_s' was not in the link interface of '${imported}' as "
+            "expected. If the Rust toolchain stopped reporting it this "
+            "workaround is obsolete and can be deleted; otherwise xrpld may "
+            "link libgcc_s.so.1 dynamically. Verify with: "
+            "objdump -p xrpld | grep NEEDED"
+        )
+        return()
+    endif()
+
+    list(REMOVE_ITEM libs gcc_s)
+    set_property(TARGET ${imported} PROPERTY INTERFACE_LINK_LIBRARIES ${libs})
+endfunction()
 
-# add_xrpl_crate(<name> CRATE <crate> FILES <file>...) Creates a cxxbridge
-# target <name>_cxxbridge and registers it with xrpl_crates.
 function(add_xrpl_crate name)
     cmake_parse_arguments(ARG "" "CRATE" "FILES" ${ARGN})
-    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
-                            ${ARG_FILES}
+    _unlink_libgcc_s(${ARG_CRATE})
+    # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
+    # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
+    if(is_msvc)
+        corrosion_set_env_vars(${ARG_CRATE} "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>")
+    endif()
+    corrosion_add_cxxbridge(
+        ${name}_cxxbridge
+        CRATE ${ARG_CRATE}
+        FILES ${ARG_FILES}
     )
     # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
     # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
     # existence check — build-time ordering is enforced by the custom commands.
     set_target_properties(${name}_cxxbridge PROPERTIES INTERFACE_SOURCES "")
+    if(have_no_warn_duplicate_libraries)
+        target_link_options(
+            ${name}_cxxbridge
+            INTERFACE -Wl,-no_warn_duplicate_libraries
+        )
+    endif()
     add_dependencies(xrpl_crates ${name}_cxxbridge)
 endfunction()
 
 add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
 
-# Test-only, and deliberately not part of xrpl_wasm_vm_ffi: it carries the `wat` assembler,
-# which the engine's `wasmi default-features = false` exists to keep out of the consensus
-# path. Linked from src/tests/libxrpl only, so the shipped node cannot contain it.
 add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
 
-# The wasm bridge `include!`s a project header, so its generated translation unit needs
-# the project's include root. Deliberately only that: a header reached from here must
-# stay light enough to compile without the Boost paths this target does not get, which
-# is why `HostContext.h` forward-declares `xrpl::HostFunctions` instead of including it.
 target_include_directories(
     xrpl_wasm_vm_ffi_cxxbridge
     PRIVATE ${CMAKE_SOURCE_DIR}/include

crates/Cargo.lock

@@ -69,9 +69,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.198"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
+checksum = "c8a02bfeba9074b2bbb39492c9b0908ec854f455a3cccdcde7a1de55e2315e40"
 dependencies = [
  "cc",
  "cxx-build",
@@ -84,9 +84,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.198"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
+checksum = "bbc2ac76997619d2d888b58ad79488f1c835de41ca4dd3dd7082acf4ecb0a50f"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -99,9 +99,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.198"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
+checksum = "54a486ed16a3f2a053fe7f5b98db4c1a59846a23e8cb9e49f9d1bd48830d51a2"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -113,15 +113,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.198"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
+checksum = "c72569be94e2283764d334cd285980b747dbe221e27e315484eb6bcd93fa808a"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.198"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
+checksum = "423e795284a7f7b3f843c956a5322c4bc497b60c2dd1a6339da10313cb18d575"
 dependencies = [
  "indexmap",
  "proc-macro2",
@@ -348,49 +348,45 @@ dependencies = [
 
 [[package]]
 name = "wasmi"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2300d0f78cba12f14e29e8dd157ea64050c0a688179aefdb2050105805594a0c"
+version = "2.0.0"
+source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
 dependencies = [
  "spin",
  "wasmi_collections",
  "wasmi_core",
  "wasmi_ir",
- "wasmparser 0.239.0",
+ "wasmparser 0.228.0",
 ]
 
 [[package]]
 name = "wasmi_collections"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a8c42a2a76148d43097b1d7cc2a5bf33d5c23bd4dd69015fc887e311767884"
+version = "2.0.0"
+source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
 dependencies = [
  "string-interner",
 ]
 
 [[package]]
 name = "wasmi_core"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9013136083d988725953390bf668b64b7a218fabf26f8b913bbc59546b97ee27"
+version = "2.0.0"
+source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
 dependencies = [
  "libm",
 ]
 
 [[package]]
 name = "wasmi_ir"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1fa003f79156f406d62ef0e1464dc03e11ace37170e9fa7524299a75ad8f68"
+version = "2.0.0"
+source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
 dependencies = [
  "wasmi_core",
 ]
 
 [[package]]
 name = "wasmparser"
-version = "0.239.0"
+version = "0.228.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9d90bb93e764f6beabf1d02028c70a2156a6583e63ac4218dd07ef733368b0"
+checksum = "4abf1132c1fdf747d56bbc1bb52152400c70f336870f968b85e89ea422198ae3"
 dependencies = [
  "bitflags",
  "indexmap",
@@ -476,6 +472,7 @@ version = "0.1.0"
 dependencies = [
  "cxx",
  "wat",
+ "xrpl-host-functions",
 ]
 
 [[package]]

crates/Cargo.toml

@@ -1,15 +1,34 @@
 [workspace]
-members = ["xrpl-wasm-vm-ffi", "xrpl-wasm-vm", "xrpl-wasm-testkit", "xrpl-host-functions", "xrpl-host-functions-macros"]
+members = [
+    "xrpl-wasm-vm-ffi",
+    "xrpl-wasm-vm",
+    "xrpl-wasm-testkit",
+    "xrpl-host-functions",
+    "xrpl-host-functions-macros",
+]
 resolver = "3"
 
 [workspace.dependencies]
-cxx = { version = "1.0.198", features = ["c++20"] }
+cxx = { version = "1.0.199", features = ["c++20"] }
+
+# Not for merge: builds against a wasmi fork with `ModuleInspector`
+# (TimothyBanks/wasmi, branch `parser_callback`) until it is accepted upstream.
+# All four crates come from the fork so that there is one `wasmi_core`.
+[patch.crates-io]
+wasmi = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
+wasmi_core = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
+wasmi_ir = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
+wasmi_collections = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
 
 [workspace.package]
 edition = "2024"
 
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage_nightly)' ] }
+
 [profile.release]
 opt-level = 3
 overflow-checks = true
 lto = true
+codegen-units = 1
 debug = true

crates/README.md

@@ -0,0 +1,120 @@
+# Rust crates
+
+This directory holds the WebAssembly engine that runs Smart Escrow contracts,
+bridged into C++ via `cxxbridge`/the `cxx` crate.
+
+The workspace is built unconditionally — `add_subdirectory(crates)` in the
+top-level `CMakeLists.txt` is not behind an option, and
+`xrpl_wasm_vm_ffi_cxxbridge` is a `PUBLIC` dependency of
+`xrpl.libxrpl.tx` (see `cmake/XrplCore.cmake`). The Rust toolchain pinned in
+[`rust-toolchain.toml`](../rust-toolchain.toml) is therefore required to build
+`libxrpl` at all; the Nix devshell provides it automatically.
+
+## The crates
+
+Dependencies run in one direction: the ABI crate at the bottom, the engine on
+top of it, and the two bridges at the edge.
+
+### `xrpl-host-functions`
+
+The wasm host ABI, declared exactly once. A `host_functions!` block at the
+bottom of `src/lib.rs` generates the `HostFunctions` trait a host implements and
+the `HostFunctionSpec` table a wasm engine registers from. Only the vocabulary
+the declarations are written in — `HostError`, `HostResult`, `TraceDataType`,
+`HASH_LEN` — is hand-written.
+
+**Add or change a host function here**, never in the engine or the bridge: the
+expansion names nothing this file does not, so neither side of the FFI boundary
+gets to restate a signature.
+
+`no_std`, because this crate is also what a guest contract links against.
+
+### `xrpl-host-functions-macros`
+
+The proc macro behind that block, plus the `wasmi_glue!` marshalling it
+generates. An implementation detail of the crate above — nothing else should
+depend on it.
+
+The dev-dependency back on `xrpl-host-functions` is a deliberate cycle: the
+doctests declare host functions returning `HostResult`, which the facade crate
+hand-writes. Cargo allows it because dev-dependencies sit outside the library
+build graph.
+
+### `xrpl-wasm-vm`
+
+The engine itself, on `wasmi`: preflight validation (`preflight/`), gas
+metering and execution (`vm.rs`), and host-call dispatch (`abi.rs`, `args.rs`,
+`register.rs`).
+
+Two lint decisions are load-bearing, both because this is a consensus path:
+
+- `forbid(unsafe_code)`, so "every guest access reaches linear memory only
+  through wasmi's bounds-checked slice operations" is a property rather than a
+  claim.
+- The truncating, wrapping and sign-losing cast lints are `deny` and each
+  remaining cast is argued for at its site — a bad cast here changes what a
+  contract is charged or told.
+
+It pins `wasmi` with `default-features = false` deliberately. wasmi's `wat`
+feature is on by default and makes `Module::new` accept text as readily as
+binary, which would turn a transaction's validity into a build flag.
+
+Not bridged to C++ directly; it reaches `xrpld` through `xrpl-wasm-vm-ffi`.
+
+### `xrpl-wasm-vm-ffi`
+
+The cxx bridge into `xrpld`. Three crossings:
+
+- **In:** C++ calls `run_escrow`, once per escrow finish.
+- **Back out:** that run's host calls leave through the C++ `HostContext`, which
+  `CxxHost` presents to the engine as an ordinary `HostFunctions` implementor.
+- **In only:** C++ screens a module with `check_escrow`. Screening needs no
+  host, so nothing comes back out.
+
+The C++ side is `src/libxrpl/tx/wasm/WasmVM.cpp` and
+`src/libxrpl/tx/wasm/HostContext.cpp`.
+
+**Neither language may unwind into the other**, and the two halves are not
+symmetric:
+
+- A **Rust panic** is caught here, by `guarded`. Letting one reach C++ is
+  undefined behaviour, and `[profile.release]` enables overflow checks, so this
+  is a live path rather than a formality.
+- A **C++ exception** is stopped on the C++ side: every `HostContext` method is
+  `noexcept` and catches its own. That is what makes `guarded` sufficient.
+
+Everything hand-written here is private, so `cargo doc` needs
+`--document-private-items` to show any of it. That is also why this crate,
+unlike `xrpl-wasm-vm`, does not `deny(unreachable_pub)` — cxx's expansion is
+`pub` throughout by necessity.
+
+### `xrpl-wasm-testkit`
+
+**Test-only.** Assembles WebAssembly text for the C++ test suite, and exposes
+the gas price of each host function by its guest import name for the C++ gas
+benchmarks (read through the bridge rather than transcribed into C++, so the
+numbers cannot drift silently).
+
+A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the
+separation is the point: putting `compile_wat` on the production bridge would
+link `wat` into `xrpld` even if nothing called it. Linked only into
+`xrpl_tests`, never into `libxrpl` or `xrpld`, so "no text assembler in the
+shipped node" holds by the link graph rather than by a flag someone can flip.
+
+## Testing
+
+```bash
+cargo test --manifest-path crates/Cargo.toml --workspace
+```
+
+CI uses `cargo nextest`. This is independent of the CMake build.
+
+One gap that command does not cover: it never compiles `xrpl-host-functions`
+with its `wasmi_glue` feature **off**, because `xrpl-wasm-vm` enables the
+feature and Cargo unifies features across a workspace build. The feature-off
+configuration is the one a guest contract sees, so after touching that crate
+also run:
+
+```bash
+cargo check -p xrpl-host-functions --manifest-path crates/Cargo.toml
+```

crates/generated.clang-tidy

@@ -0,0 +1,10 @@
+---
+# Neutralizes clang-tidy for the corrosion/cxxbridge-generated C++. Copied into
+# the crates build directory by crates/CMakeLists.txt, next to the generated
+# sources, so clang-tidy picks it up instead of the top-level configuration.
+#
+# One check is kept enabled to avoid clang-tidy's "no checks enabled" error.
+Checks: "-*,google-readability-todo"
+WarningsAsErrors: ""
+HeaderFilterRegex: ""
+InheritParentConfig: false

crates/xrpl-host-functions-macros/Cargo.toml

@@ -11,8 +11,11 @@ syn = { version = "3", features = ["full"] }
 quote = "1"
 proc-macro2 = "1"
 
-# The expansion names `::xrpl_host_functions::HostFnSpec`, so the doctest needs the
-# facade crate. Cargo allows this cycle because dev-dependencies are outside the
-# library build graph.
+# The doctest declares host functions returning `HostResult`, which the facade
+# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
+# the library build graph.
 [dev-dependencies]
 xrpl-host-functions.path = "../xrpl-host-functions"
+
+[lints]
+workspace = true

crates/xrpl-host-functions-macros/src/enums.rs

@@ -0,0 +1,289 @@
+//! `#[coded_enum]`: an enum of wire codes, and the `ALL`/`code`/`from_code` set
+//! that must not fall behind its variants.
+//!
+//! Rust cannot enumerate an enum's variants — an exhaustive `match` forces an arm per
+//! variant but gives nothing to iterate — so `ALL` is trustworthy only by being
+//! generated from them, as `HostFunctionSpec::ALL` is from the `host_functions!` block.
+
+use proc_macro2::TokenStream;
+use quote::quote;
+use syn::{Expr, ExprLit, ExprUnary, Fields, Ident, ItemEnum, Lit, UnOp, Variant};
+
+use crate::errors;
+
+/// One variant as the expansion reads it: the name `ALL` lists and the code
+/// `from_code` matches.
+struct WireVariant<'a> {
+    ident: &'a Ident,
+    code: &'a Expr,
+}
+
+pub(crate) fn expand(args: TokenStream, item: TokenStream) -> syn::Result<TokenStream> {
+    if !args.is_empty() {
+        return Err(syn::Error::new_spanned(
+            args,
+            "`#[coded_enum]` takes no arguments",
+        ));
+    }
+
+    let item: ItemEnum = syn::parse2(item)?;
+    let variants = wire_variants(&item)?;
+
+    let attrs = &item.attrs;
+    let vis = &item.vis;
+    let name = &item.ident;
+    let declarations = item.variants.iter();
+    let identifiers = variants.iter().map(|variant| variant.ident);
+    let arms = variants.iter().map(|variant| {
+        let (ident, code) = (variant.ident, variant.code);
+        quote! { #code => Some(Self::#ident) }
+    });
+
+    Ok(quote! {
+        #(#attrs)*
+        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+        #[repr(i32)]
+        #vis enum #name {
+            #(#declarations,)*
+        }
+
+        impl #name {
+            /// Every variant, in declaration order — the whole set, and whole by
+            /// construction.
+            pub const ALL: &'static [Self] = &[#(Self::#identifiers,)*];
+
+            /// The wire value that names this variant.
+            #[inline]
+            pub const fn code(self) -> i32 {
+                self as i32
+            }
+
+            /// The variant `code` names, or `None` if no variant does — what an
+            /// unnamed code means is the caller's to decide.
+            pub const fn from_code(code: i32) -> Option<Self> {
+                match code {
+                    #(#arms,)*
+                    _ => None,
+                }
+            }
+        }
+    })
+}
+
+/// Every variant, checked against what the expansion needs of it, or every
+/// mistake in the list.
+fn wire_variants(item: &ItemEnum) -> syn::Result<Vec<WireVariant<'_>>> {
+    // `#[repr(i32)]` is rejected on a variantless enum, and there is nothing for a
+    // wire enum with no codes to mean anyway.
+    if item.variants.is_empty() {
+        return Err(syn::Error::new_spanned(
+            item,
+            "`#[coded_enum]` needs at least one variant",
+        ));
+    }
+
+    let mut errors = Vec::new();
+    let variants = item
+        .variants
+        .iter()
+        .filter_map(|variant| {
+            let code = errors::record(code_of(variant), &mut errors)?;
+            Some(WireVariant {
+                ident: &variant.ident,
+                code,
+            })
+        })
+        .collect();
+
+    errors::into_result(variants, errors)
+}
+
+/// The code a variant is declared with.
+fn code_of(variant: &Variant) -> syn::Result<&Expr> {
+    if !matches!(variant.fields, Fields::Unit) {
+        return Err(syn::Error::new_spanned(
+            &variant.fields,
+            "a wire enum's variants carry no data: the code is the whole of what crosses",
+        ));
+    }
+
+    let Some((_, code)) = &variant.discriminant else {
+        return Err(syn::Error::new_spanned(
+            variant,
+            "missing `= <code>`: a wire value is declared, never implied by position",
+        ));
+    };
+
+    if !is_integer_literal(code) {
+        return Err(syn::Error::new_spanned(
+            code,
+            "a wire value must be an integer literal, since `from_code` matches it as a pattern",
+        ));
+    }
+
+    Ok(code)
+}
+
+/// `-2147483648` and `7`, but not `i32::MIN` or `1 + 1`: the discriminant is emitted
+/// into pattern position unchanged, where an expression means something else or nothing.
+fn is_integer_literal(code: &Expr) -> bool {
+    match code {
+        Expr::Lit(ExprLit {
+            lit: Lit::Int(_), ..
+        }) => true,
+        Expr::Unary(ExprUnary {
+            op: UnOp::Neg(_),
+            expr,
+            ..
+        }) => is_integer_literal(expr),
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
+mod tests {
+    use super::*;
+
+    /// The whole expansion for the smallest list that exercises every generated
+    /// item, negative codes included.
+    #[test]
+    fn generates_the_enum_and_the_three_items_over_it() {
+        let generated = generated(quote! {
+            /// How a trace buffer is read.
+            pub enum TraceDataType {
+                /// Eight little-endian bytes.
+                Int64 = 1,
+                Unnamed = -2,
+            }
+        });
+
+        for expected in [
+            // The declaration reaches the output as written, doc comments and all,
+            // under the derives and the representation `code` casts through.
+            "# [doc = r\" How a trace buffer is read.\"] \
+             # [derive (Debug , Clone , Copy , PartialEq , Eq)] # [repr (i32)] \
+             pub enum TraceDataType { # [doc = r\" Eight little-endian bytes.\"] Int64 = 1 , \
+             Unnamed = - 2 , }",
+            "pub const ALL : & 'static [Self] = & [Self :: Int64 , Self :: Unnamed ,] ;",
+            "pub const fn code (self) -> i32 { self as i32 }",
+            "pub const fn from_code (code : i32) -> Option < Self > \
+             { match code { 1 => Some (Self :: Int64) , - 2 => Some (Self :: Unnamed) , \
+             _ => None , } }",
+        ] {
+            assert!(generated.contains(expected), "missing {expected:?}");
+        }
+    }
+
+    /// The visibility is the caller's: a `pub` the macro supplied would be one the
+    /// declaration could not take back.
+    #[test]
+    fn keeps_the_declared_visibility() {
+        assert!(
+            generated(quote! {
+                enum Private {
+                    One = 1,
+                }
+            })
+            .contains("enum Private"),
+            "the expansion should not widen a private enum"
+        );
+    }
+
+    /// A variant with no code would take one from its position, which is the
+    /// mistake that silently renumbers a wire value.
+    #[test]
+    fn rejects_a_variant_without_a_code() {
+        let messages = messages(quote! {
+            pub enum Ordering {
+                Equal = 0,
+                Greater,
+            }
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(messages[0].contains("missing `= <code>`"), "{messages:?}");
+    }
+
+    /// The two shapes a code is tempting to write as and cannot be: a constant's
+    /// path, and arithmetic.
+    #[test]
+    fn rejects_a_code_that_is_not_an_integer_literal() {
+        let messages = messages(quote! {
+            pub enum Ordering {
+                Equal = i32::MIN,
+                Greater = 1 + 1,
+            }
+        });
+
+        assert_eq!(messages.len(), 2, "{messages:?}");
+        for message in &messages {
+            assert!(message.contains("must be an integer literal"), "{message}");
+        }
+    }
+
+    #[test]
+    fn rejects_a_variant_carrying_data() {
+        let messages = messages(quote! {
+            pub enum Ordering {
+                Equal(u8) = 0,
+            }
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(messages[0].contains("carry no data"), "{messages:?}");
+    }
+
+    /// `#[repr(i32)]` is rejected on a variantless enum, so the diagnostic has to
+    /// be this one rather than rustc's.
+    #[test]
+    fn rejects_an_enum_with_no_variants() {
+        let messages = messages(quote! {
+            pub enum Nothing {}
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(messages[0].contains("at least one variant"), "{messages:?}");
+    }
+
+    /// Every mistake in one build, as `host_functions!` reports a block.
+    #[test]
+    fn reports_every_mistake_in_the_list() {
+        let messages = messages(quote! {
+            pub enum Ordering {
+                Equal,
+                Greater = 1 + 1,
+            }
+        });
+
+        assert_eq!(messages.len(), 2, "{messages:?}");
+    }
+
+    #[test]
+    fn rejects_arguments() {
+        let error = expand(quote!(i64), quote! { pub enum Ordering { Equal = 0, } })
+            .expect_err("expected the argument to be refused");
+
+        assert!(error.to_string().contains("takes no arguments"));
+    }
+
+    #[test]
+    fn rejects_an_item_that_is_not_an_enum() {
+        expand(quote!(), quote! { pub struct Ordering; })
+            .expect_err("expected a struct to be refused");
+    }
+
+    fn generated(item: TokenStream) -> String {
+        expand(quote!(), item)
+            .expect("the enum should expand")
+            .to_string()
+    }
+
+    /// The messages of every diagnostic recorded by one failed `expand`.
+    fn messages(item: TokenStream) -> Vec<String> {
+        let Err(error) = expand(quote!(), item) else {
+            panic!("expected expansion to fail");
+        };
+        error.into_iter().map(|error| error.to_string()).collect()
+    }
+}

crates/xrpl-host-functions-macros/src/errors.rs

@@ -10,3 +10,24 @@ pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
         first
     })
 }
+
+/// `value`, or the folded diagnostics if any were recorded.
+pub(crate) fn into_result<T>(value: T, errors: Vec<syn::Error>) -> syn::Result<T> {
+    match combine(errors) {
+        Some(error) => Err(error),
+        None => Ok(value),
+    }
+}
+
+/// `result`'s value, or `None` with its error filed in `errors` — so a check that
+/// yields a value can be reported like one that yields nothing, and the caller
+/// keeps going.
+pub(crate) fn record<T>(result: syn::Result<T>, errors: &mut Vec<syn::Error>) -> Option<T> {
+    match result {
+        Ok(value) => Some(value),
+        Err(error) => {
+            errors.push(error);
+            None
+        }
+    }
+}

crates/xrpl-host-functions-macros/src/glue.rs

@@ -0,0 +1,472 @@
+//! The wasmi registration, generated from the declarations the ABI table is
+//! generated from — so the closure a guest links against cannot disagree with the
+//! signature preflight screens it by.
+//!
+//! Emitted as a `macro_rules!` rather than as the registration itself, because the
+//! crate the expansion lands in is `no_std`, zero-dependency and links into the
+//! guest, and a `macro_rules!` body is inert tokens until someone expands it.
+//!
+//! The body therefore resolves in two crates at once and names nothing free:
+//! `$crate` is the ABI crate, `$env` the module the caller passes in, and every
+//! other path starts at `::wasmi` or `::core`. `$env` is matched as an `ident`
+//! because `$env:path` used as `$env::Foo` is `error: missing angle brackets in
+//! associated item path`.
+//!
+//! The one file that knows an engine's calling convention: how a region arrives as
+//! two wasm parameters, where the gas charge goes, and which helper a result-less
+//! function takes. A second engine would be a second file like it.
+
+use proc_macro2::TokenStream;
+use quote::{ToTokens, quote};
+
+use crate::lowering::{ResultType, WasmValType};
+use crate::parsed_host_function::{Param, ParsedHostFunction};
+
+/// The `wasmi_glue!` macro: the trait a VM implements one body per host function
+/// in, and the registration that hands each of them to a `Linker`.
+pub(crate) fn wasmi_glue(functions: &[ParsedHostFunction]) -> TokenStream {
+    let bodies = functions.iter().map(body_declaration);
+    let registrations = functions.iter().map(registration);
+    let assertions = charging_assertions();
+    let env = env();
+
+    quote! {
+        /// Expands to the wasmi glue for this ABI: the `HostFunctionBodies` trait
+        /// and `register_host_functions`, at the scope it is called in. A
+        /// declaration added to the ABI is then a missing trait item rather than a
+        /// forgotten registration.
+        ///
+        /// `$env` names a module holding everything the expansion reaches for on
+        /// the engine's side, since this crate can name none of it: the store type
+        /// `VmState`, the charging helpers `charged` and `charged_unreported` with
+        /// their `CallResult`, and the argument types `InBytes`, `InStr`, `InU32`,
+        /// `OutBytes` and `TraceCode`.
+        ///
+        /// ```ignore
+        /// mod glue_env {
+        ///     pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
+        ///     pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
+        ///     pub(crate) use crate::vm::VmState;
+        /// }
+        ///
+        /// xrpl_host_functions::wasmi_glue!(glue_env);
+        /// ```
+        ///
+        /// The module supplies the spellings; the shapes are pinned by the
+        /// expansion. Each argument type implements [`FromWasmRegion`] or
+        /// [`FromWasmScalar`] — which one is the ABI's decision, so a declared
+        /// `u32` is a region — and each charging helper's signature is asserted
+        /// against a `const _`.
+        #[cfg(feature = "wasmi_glue")]
+        #[macro_export]
+        macro_rules! wasmi_glue {
+            ($env:ident) => {
+                /// One body per host function: what the engine runs once the call's
+                /// gas is charged and its arguments are off the wire.
+                ///
+                /// The methods take no receiver, so a registered closure captures
+                /// nothing — which is what satisfies wasmi's
+                /// `Fn + Send + Sync + 'static` bound, and why the implementor
+                /// itself need not be `'static`. A body does not charge gas; the
+                /// generated closure does, so it cannot be forgotten or charged
+                /// twice.
+                pub(crate) trait HostFunctionBodies {
+                    #(#bodies)*
+                }
+
+                /// Register every host function on `linker`, one `func_wrap` per
+                /// declaration, at the ABI's derived wasm signature — so an import
+                /// that passes [`crate::check`] links here by construction.
+                pub(crate) fn register_host_functions<B: HostFunctionBodies>(
+                    linker: &mut ::wasmi::Linker<#env::VmState<'_>>,
+                ) -> ::core::result::Result<(), ::wasmi::errors::LinkerError> {
+                    #(#registrations)*
+                    Ok(())
+                }
+
+                #assertions
+            };
+        }
+    }
+}
+
+/// The macro argument every engine-side path is qualified by.
+fn env() -> TokenStream {
+    quote!($env)
+}
+
+/// The signature of each charging helper, pinned as a `const _` the expansion
+/// carries: the one part of the contract neither `$env` nor the argument traits
+/// state.
+///
+/// Its value is the diagnostic. A changed helper is already a type error at the
+/// call, but there it is failed inference inside a generated closure and here it
+/// is one line stating the signature that was expected.
+fn charging_assertions() -> TokenStream {
+    let env = env();
+    let assertion = |helper: TokenStream, answer: TokenStream| {
+        quote! {
+            const _: fn(
+                &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
+                $crate::HostFunctionSpec,
+                fn(&mut ::wasmi::Caller<'_, #env::VmState<'_>>) -> #env::CallResult<#answer>,
+            ) -> ::core::result::Result<#answer, ::wasmi::Error> = #env::#helper;
+        }
+    };
+
+    let reported = assertion(quote!(charged), quote!(i32));
+    let unreported = assertion(quote!(charged_unreported), quote!(()));
+
+    quote! {
+        #reported
+        #unreported
+    }
+}
+
+/// `fn check_keylet(caller: &mut Caller<'_, $env::VmState<'_>>, account:
+/// $env::InBytes, seq: $env::InU32, out: $env::OutBytes) ->
+/// $env::CallResult<i32>;`
+fn body_declaration(function: &ParsedHostFunction) -> TokenStream {
+    let env = env();
+    let name = &function.signature.ident;
+    let params = function.params().iter().map(|param| {
+        let name = &param.name;
+        let ty = param.ty.argument_type(&env);
+        quote! { #name: #ty }
+    });
+    let answer = answer_type(function.result());
+
+    quote! {
+        fn #name(
+            caller: &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
+            #(#params),*
+        ) -> #answer;
+    }
+}
+
+/// One `linker.func_wrap(…)?;`: the wasm signature as the closure's parameters,
+/// the gas charge around the call, and the body between them.
+fn registration(function: &ParsedHostFunction) -> TokenStream {
+    let env = env();
+    let body = &function.signature.ident;
+    let spec = spec_path(function);
+    let params = function.params().iter().flat_map(closure_params);
+    let arguments = function.params().iter().map(lift);
+    let (answer, charge) = match function.result() {
+        ResultType::BufferLength | ResultType::Value => (quote!(i32), quote!(#env::charged)),
+        ResultType::Nothing => (quote!(()), quote!(#env::charged_unreported)),
+    };
+
+    quote! {
+        linker.func_wrap(
+            $crate::HOST_MODULE,
+            #spec.wasm_name(),
+            |mut caller: ::wasmi::Caller<'_, #env::VmState<'_>>, #(#params),*|
+             -> ::core::result::Result<#answer, ::wasmi::Error> {
+                #charge(&mut caller, #spec, |caller| {
+                    B::#body(caller, #(#arguments),*)
+                })
+            },
+        )?;
+    }
+}
+
+/// `$crate::HostFunctionSpec::CheckKeylet` — the one name the expansion reaches
+/// back into the ABI crate for.
+fn spec_path(function: &ParsedHostFunction) -> TokenStream {
+    let variant = &function.variant;
+    quote! { $crate::HostFunctionSpec::#variant }
+}
+
+/// One declared parameter as the closure declares it: `account_ptr: i32,
+/// account_len: i32`, or `field: i32`.
+///
+/// Names and types both come from the lowering, so the arity a closure is
+/// registered at *is* the derived arity.
+fn closure_params(param: &Param) -> Vec<TokenStream> {
+    param
+        .ty
+        .wasm_names(&param.name)
+        .into_iter()
+        .zip(param.ty.as_wasm_params())
+        .map(|(name, val_type)| {
+            let ty = rust_type(*val_type);
+            quote! { #name: #ty }
+        })
+        .collect()
+}
+
+/// The argument a body is handed, built from the wasm parameters it arrived as:
+/// `<$env::InBytes as $crate::FromWasmRegion>::from_wasm(account_ptr,
+/// account_len)`, or the scalar itself.
+///
+/// Qualified rather than an inherent call, so the arity comes from the trait the
+/// lowering chose: an argument type implementing the other one is an unsatisfied
+/// bound named at the type, where `Ty::from_wasm(a, b)` would be an unrelated
+/// arity error named here.
+fn lift(param: &Param) -> TokenStream {
+    let Some(argument_trait) = param.ty.argument_trait() else {
+        return param.name.to_token_stream();
+    };
+    let ty = param.ty.argument_type(&env());
+    let names = param.ty.wasm_names(&param.name);
+
+    quote! { <#ty as $crate::#argument_trait>::from_wasm(#(#names),*) }
+}
+
+/// What a body answers: the value the guest is told, or nothing at all for the
+/// function whose whole effect is on the host.
+fn answer_type(result: ResultType) -> TokenStream {
+    let env = env();
+    match result {
+        ResultType::BufferLength | ResultType::Value => quote!(#env::CallResult<i32>),
+        ResultType::Nothing => quote!(#env::CallResult<()>),
+    }
+}
+
+/// A wasm value type as a closure parameter spells it — a Rust type, not
+/// [`WasmValType`]'s own `ToTokens`, which spells the ABI crate's variant.
+fn rust_type(val_type: WasmValType) -> TokenStream {
+    match val_type {
+        WasmValType::I32 => quote!(i32),
+        WasmValType::I64 => quote!(i64),
+    }
+}
+
+#[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
+mod tests {
+    use super::*;
+    use proc_macro2::{Delimiter, Group, TokenTree};
+    use syn::parse_quote;
+
+    fn parsed(function: syn::TraitItemFn) -> ParsedHostFunction {
+        ParsedHostFunction::parse(function).expect("the declaration should parse")
+    }
+
+    /// The declaration whose declared and wasm parameter lists differ most:
+    /// `account`, `out` and `seq` are a `(ptr, len)` pair each, so three arguments
+    /// to the body and six on the wire.
+    #[test]
+    fn lowers_a_declaration_to_a_body_and_a_registration() {
+        let keylet = parsed(parse_quote! {
+            #[gas = 350]
+            #[wasm_name = "check_id"]
+            fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
+        });
+
+        assert_eq!(
+            body_declaration(&keylet).to_string(),
+            "fn check_keylet (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
+             account : $ env :: InBytes , seq : $ env :: InU32 , out : $ env :: OutBytes) \
+             -> $ env :: CallResult < i32 > ;"
+        );
+
+        assert_eq!(
+            registration(&keylet).to_string(),
+            "linker . func_wrap ($ crate :: HOST_MODULE , \
+             $ crate :: HostFunctionSpec :: CheckKeylet . wasm_name () , \
+             | mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
+             account_ptr : i32 , account_len : i32 , seq_ptr : i32 , seq_len : i32 , \
+             out_ptr : i32 , out_len : i32 | \
+             -> :: core :: result :: Result < i32 , :: wasmi :: Error > \
+             { $ env :: charged (& mut caller , \
+             $ crate :: HostFunctionSpec :: CheckKeylet , | caller | \
+             { B :: check_keylet (caller , \
+             < $ env :: InBytes as $ crate :: FromWasmRegion > \
+             :: from_wasm (account_ptr , account_len) , \
+             < $ env :: InU32 as $ crate :: FromWasmRegion > :: from_wasm (seq_ptr , seq_len) , \
+             < $ env :: OutBytes as $ crate :: FromWasmRegion > \
+             :: from_wasm (out_ptr , out_len)) }) } ,) ? ;"
+        );
+    }
+
+    /// A wasm scalar is passed through as itself, in declaration order: no pair,
+    /// no argument type, and an `i64` that stays one.
+    #[test]
+    fn passes_the_wasm_scalars_through_untouched() {
+        let from_int = parsed(parse_quote! {
+            #[gas = 100]
+            #[wasm_name = "float_from_int"]
+            fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
+        });
+
+        assert_eq!(
+            body_declaration(&from_int).to_string(),
+            "fn float_from_int (caller : & mut :: wasmi :: Caller < '_ , \
+             $ env :: VmState < '_ >> , \
+             x : i64 , out : $ env :: OutBytes , mode : i32) -> $ env :: CallResult < i32 > ;"
+        );
+
+        let registration = registration(&from_int).to_string();
+        assert!(
+            registration.contains(
+                "| mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
+                 x : i64 , out_ptr : i32 , out_len : i32 , mode : i32 |"
+            ),
+            "{registration}"
+        );
+        assert!(
+            registration.contains(
+                "B :: float_from_int (caller , x , \
+                 < $ env :: OutBytes as $ crate :: FromWasmRegion > \
+                 :: from_wasm (out_ptr , out_len) , mode)"
+            ),
+            "{registration}"
+        );
+    }
+
+    /// The function that answers nothing takes the other charging helper, derived
+    /// from its declared `HostResult<()>` rather than named as a special case.
+    /// Its `TraceCode` is also the only place `FromWasmScalar` is reached for.
+    #[test]
+    fn a_declaration_that_answers_nothing_takes_the_other_charge() {
+        let trace = parsed(trace_declaration());
+
+        assert_eq!(
+            body_declaration(&trace).to_string(),
+            "fn trace (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
+             msg : $ env :: InStr , data_type : $ env :: TraceCode , data : $ env :: InBytes) \
+             -> $ env :: CallResult < () > ;"
+        );
+
+        let registration = registration(&trace).to_string();
+        assert!(
+            registration.contains(":: core :: result :: Result < () , :: wasmi :: Error >"),
+            "{registration}"
+        );
+        assert!(
+            registration.contains("$ env :: charged_unreported (& mut caller"),
+            "{registration}"
+        );
+        assert!(
+            registration.contains(
+                "B :: trace (caller , \
+                 < $ env :: InStr as $ crate :: FromWasmRegion > :: from_wasm (msg_ptr , msg_len) , \
+                 < $ env :: TraceCode as $ crate :: FromWasmScalar > :: from_wasm (data_type) , \
+                 < $ env :: InBytes as $ crate :: FromWasmRegion > \
+                 :: from_wasm (data_ptr , data_len))"
+            ),
+            "{registration}"
+        );
+    }
+
+    /// The two worlds the macro body resolves in: the ABI crate through `$crate`,
+    /// and one engine by name. `names_no_crate_of_its_own` holds the ABI half of
+    /// the expansion to naming neither.
+    #[test]
+    fn reaches_the_abi_crate_through_dollar_crate_and_the_engine_by_name() {
+        let glue = code(wasmi_glue(&[parsed(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
+        })]));
+
+        assert!(
+            glue.contains("$ crate :: HostFunctionSpec :: GetLedgerSqn"),
+            "{glue}"
+        );
+        assert!(glue.contains("$ crate :: HOST_MODULE"), "{glue}");
+        assert!(glue.contains(":: wasmi :: Linker"), "{glue}");
+        assert!(!glue.contains("xrpl_host_functions"), "{glue}");
+    }
+
+    /// Every engine-side item is reached through the module the macro is handed: a
+    /// bare name would resolve against whatever the call site has in scope.
+    ///
+    /// `charged` covers `charged_unreported`, being its prefix.
+    #[test]
+    fn names_the_engine_s_own_items_only_through_the_module_it_is_handed() {
+        let glue = code(wasmi_glue(&[
+            parsed(trace_declaration()),
+            parsed(parse_quote! {
+                #[gas = 350]
+                #[wasm_name = "check_id"]
+                fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8])
+                    -> HostResult<usize>;
+            }),
+        ]));
+
+        for item in [
+            "VmState",
+            "CallResult",
+            "charged",
+            "InBytes",
+            "InStr",
+            "InU32",
+            "OutBytes",
+            "TraceCode",
+        ] {
+            for (index, _) in glue.match_indices(item) {
+                assert!(
+                    glue[..index].ends_with("$ env :: "),
+                    "`{item}` named outside `$env`: {glue}"
+                );
+            }
+        }
+    }
+
+    /// The charging helpers' signatures, which nothing else in the contract
+    /// states.
+    #[test]
+    fn pins_both_charging_helpers_signatures() {
+        assert_eq!(
+            charging_assertions().to_string(),
+            "const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
+             $ crate :: HostFunctionSpec , \
+             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
+             -> $ env :: CallResult < i32 > ,) \
+             -> :: core :: result :: Result < i32 , :: wasmi :: Error > = $ env :: charged ; \
+             const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
+             $ crate :: HostFunctionSpec , \
+             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
+             -> $ env :: CallResult < () > ,) \
+             -> :: core :: result :: Result < () , :: wasmi :: Error > \
+             = $ env :: charged_unreported ;"
+        );
+    }
+
+    fn trace_declaration() -> syn::TraitItemFn {
+        parse_quote! {
+            #[gas = 30]
+            #[wasm_name = "trace"]
+            fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
+        }
+    }
+
+    /// The expansion's code alone. `to_string` renders a doc comment as a
+    /// `#[doc = "…"]` literal, and the macro's own documentation names the very
+    /// items the scans above look for.
+    fn code(tokens: TokenStream) -> String {
+        fn is_doc(tree: Option<&TokenTree>) -> bool {
+            let Some(TokenTree::Group(group)) = tree else {
+                return false;
+            };
+            group.delimiter() == Delimiter::Bracket
+                && matches!(group.stream().into_iter().next(),
+                            Some(TokenTree::Ident(ident)) if ident == "doc")
+        }
+
+        fn strip(tokens: TokenStream) -> TokenStream {
+            let mut trees = tokens.into_iter().peekable();
+            let mut kept = Vec::new();
+            while let Some(tree) = trees.next() {
+                match tree {
+                    TokenTree::Punct(ref punct)
+                        if punct.as_char() == '#' && is_doc(trees.peek()) =>
+                    {
+                        trees.next();
+                    }
+                    TokenTree::Group(group) => kept.push(TokenTree::Group(Group::new(
+                        group.delimiter(),
+                        strip(group.stream()),
+                    ))),
+                    other => kept.push(other),
+                }
+            }
+            kept.into_iter().collect()
+        }
+
+        strip(tokens).to_string()
+    }
+}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -1,4 +1,9 @@
+#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
+
+mod enums;
 mod errors;
+mod glue;
+mod lowering;
 mod parsed_host_function;
 
 use std::collections::HashSet;
@@ -20,12 +25,43 @@ use parsed_host_function::ParsedHostFunction;
 /// are kept and appear on the generated items.
 ///
 /// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the expansion refers to and holds the one declaration
-/// block. The expansion names those types by absolute path, so a call site needs
-/// `xrpl-host-functions` as a dependency but no imports from it.
+/// hand-writes the types the declarations refer to and holds the one declaration
+/// block.
+///
+/// # What it generates
+///
+/// Four items, in the scope the block is written in:
+///
+/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
+///   receiver, parameters, return type and doc comment exactly as written. An
+///   execution environment implements it; the rest of the expansion does not
+///   mention it.
+/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
+///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
+///   carrying that declaration's doc comment. Its `const fn wasm_name`, `gas`,
+///   `wasm_params` and `wasm_result` are the ABI metadata, and `ALL` is every
+///   variant in declaration order — what a wasm engine iterates to build its
+///   import table.
+/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
+///   so those accessors read from a single `match` over the declarations, and
+///   never appears in a signature a caller can name.
+/// - `macro_rules! wasmi_glue`: the registration for a wasmi engine, emitted as a
+///   macro rather than as code because it names an engine this crate must not
+///   depend on. Inert until expanded — see its own documentation.
+///
+/// The wasm signature is derived from the declared types rather than stated a
+/// second time: `i32` and `i64` are the wasm scalars spelled as themselves, every
+/// other parameter type is marshalled through a `(ptr, len)` pair or an `i32`
+/// code, and the result comes from the `HostResult<T>` success type. The glue is
+/// generated from that same derivation, so the closure a guest links against and
+/// the signature it is screened by are one statement.
+///
+/// Outside the glue's body the expansion builds only `Self::Variant` and
+/// `WasmValType` paths, so the block compiles wherever the types it names —
+/// `HostResult` and `WasmValType` — resolve.
 ///
 /// ```
-/// use xrpl_host_functions::HostResult;
+/// use xrpl_host_functions::{HostResult, WasmValType};
 /// use xrpl_host_functions_macros::host_functions;
 ///
 /// host_functions! {
@@ -40,26 +76,49 @@ use parsed_host_function::ParsedHostFunction;
 ///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
 /// }
 ///
-/// // A `HostFunctions` trait, holding the declarations verbatim:
-/// struct Host;
-/// impl HostFunctions for Host {
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize> {
-///         out[..4].copy_from_slice(&7u32.to_le_bytes());
-///         Ok(4)
-///     }
-///     fn trace_num(&self, _msg: &str, _number: i64) -> HostResult<()> { Ok(()) }
+/// // The trait's methods are the declarations, down to the `&self` receiver the
+/// // VM calls the host through.
+/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
+///     host.get_ledger_sqn(out)
 /// }
 ///
-/// // A `HostFunctionSpec` enum carrying the ABI metadata as a `const` table:
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.gas(), 60);
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_name(), "trace_num");
-/// assert_eq!(HostFunctionSpec::ALL.len(), 2);
+/// // The metadata is a `const` table, so gas and import names are available at
+/// // compile time rather than looked up at run time.
+/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
+/// assert_eq!(TRACE_GAS, 500);
+///
+/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
+/// assert_eq!(
+///     HostFunctionSpec::ALL,
+///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
+/// );
+///
+/// // So is the wasm signature: `out: &mut [u8]` is the pair `(ptr, len)`, and
+/// // `HostResult<usize>` answers the length written to it.
+/// assert_eq!(
+///     HostFunctionSpec::GetLedgerSqn.wasm_params(),
+///     &[WasmValType::I32, WasmValType::I32],
+/// );
+/// assert_eq!(
+///     HostFunctionSpec::GetLedgerSqn.wasm_result(),
+///     Some(WasmValType::I32),
+/// );
+///
+/// // `trace_num` answers nothing at all, so its import has no result.
+/// assert_eq!(
+///     HostFunctionSpec::TraceNum.wasm_params(),
+///     &[WasmValType::I32, WasmValType::I32, WasmValType::I64],
+/// );
+/// assert_eq!(HostFunctionSpec::TraceNum.wasm_result(), None);
 /// ```
 ///
-/// A declaration must be a plain `fn` taking `&self` and returning
-/// `HostResult<T>`, with no body and no generics: it maps to exactly one wasm
-/// import signature. Two declarations may not share a `wasm_name`, nor collapse to
-/// the same PascalCase variant.
+/// A declaration must be a plain `fn` taking `&self`, with no body and no
+/// generics: it maps to exactly one wasm import signature. Its parameters must be
+/// `i32`, `i64`, `u32`, `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`, and it
+/// must return `HostResult<usize>` if it writes an output region,
+/// `HostResult<i32>` or `HostResult<FloatOrdering>` if it answers a value directly,
+/// or `HostResult<()>` if it answers nothing. Two declarations may not share a
+/// `wasm_name`, nor collapse to the same PascalCase variant.
 #[proc_macro]
 pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
     expand(input.into())
@@ -67,7 +126,62 @@ pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream
         .into()
 }
 
+/// Declares an enum of wire codes, together with the `ALL`, `code` and
+/// `from_code` set that must not fall behind its variants.
+///
+/// The enum is written as an ordinary one — its own doc comment, its own
+/// visibility, one `Variant = code,` per line — and the attribute supplies the
+/// derives and the `#[repr(i32)]` that `code` casts through. Rust cannot enumerate
+/// an enum's variants, so `ALL` is the only complete set a test can iterate.
+///
+/// A variant carries no data and states its code as an integer literal, since that
+/// literal is also the pattern `from_code` matches it by. What an unnamed code means
+/// is the caller's to decide, being a different condition per enum.
+///
+/// ```
+/// use xrpl_host_functions_macros::coded_enum;
+///
+/// /// How a trace buffer is to be read.
+/// #[coded_enum]
+/// pub enum TraceDataType {
+///     /// 8 little-endian bytes, rendered as a signed decimal.
+///     Int64 = 1,
+///     /// A 20-byte account ID, rendered as base58.
+///     Account = 4,
+/// }
+///
+/// assert_eq!(TraceDataType::Account.code(), 4);
+/// assert_eq!(TraceDataType::from_code(4), Some(TraceDataType::Account));
+/// assert_eq!(TraceDataType::from_code(2), None);
+/// assert_eq!(
+///     TraceDataType::ALL,
+///     &[TraceDataType::Int64, TraceDataType::Account],
+/// );
+/// ```
+#[proc_macro_attribute]
+pub fn coded_enum(
+    args: proc_macro::TokenStream,
+    item: proc_macro::TokenStream,
+) -> proc_macro::TokenStream {
+    enums::expand(args.into(), item.into())
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
+}
+
 fn expand(input: TokenStream) -> syn::Result<TokenStream> {
+    let functions = parse_block(input)?;
+    let abi = abi_items(&functions);
+    let glue = glue::wasmi_glue(&functions);
+
+    Ok(quote! {
+        #abi
+        #glue
+    })
+}
+
+/// Every declaration in the block, parsed and checked against each other, or
+/// every mistake in it.
+fn parse_block(input: TokenStream) -> syn::Result<Vec<ParsedHostFunction>> {
     let HostFunctionsInput { functions } = parse2(input)?;
 
     let mut parsed = Vec::with_capacity(functions.len());
@@ -85,7 +199,7 @@ fn expand(input: TokenStream) -> syn::Result<TokenStream> {
         return Err(error);
     }
 
-    Ok(generate(&parsed))
+    Ok(parsed)
 }
 
 /// Names two declarations may not share, because the generated code would then
@@ -119,7 +233,9 @@ fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
     errors
 }
 
-fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
+/// The ABI itself: the trait a host implements and the table everything else
+/// reads. `glue::wasmi_glue` is the other half of the expansion.
+fn abi_items(functions: &[ParsedHostFunction]) -> TokenStream {
     let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
     let variants = functions
         .iter()
@@ -154,20 +270,21 @@ fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
         /// handing over a region clamped to the field cap — but it cannot take
         /// back what a method already put there. A host that wrote a truncated
         /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore. C++'s
-        /// `setData` is the reference point: it wrote only on a value that fit.
+        /// guest memory behind a refusal the guest is told to ignore.
         pub trait HostFunctions {
             #(#trait_methods)*
         }
 
-        /// One row of the ABI table: what [`HostFunctionSpec::wasm_name`] and
-        /// [`HostFunctionSpec::gas`] read from.
+        /// One row of the ABI table: what [`HostFunctionSpec`]'s accessors
+        /// read from.
         ///
-        /// Private, and the only reason it exists is to keep both of them fed
+        /// Private, and the only reason it exists is to keep all of them fed
         /// from a single `match` over the declarations.
         struct HostFnSpec {
             name: &'static str,
             gas: u64,
+            wasm_params: &'static [WasmValType],
+            wasm_result: Option<WasmValType>,
         }
 
         /// Identifies one host function, and is the compile-time source of its
@@ -213,6 +330,25 @@ fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
             pub const fn gas(self) -> u64 {
                 self.spec().gas
             }
+
+            /// The wasm parameters this function is imported with, in wire
+            /// order — the list a guest's import must match, which the
+            /// declaration's own parameter list is not: a declared parameter
+            /// marshalled through a `(ptr, len)` region is two of these.
+            ///
+            /// Usable in `const` context, so import lists can be built at
+            /// compile time.
+            pub const fn wasm_params(self) -> &'static [WasmValType] {
+                self.spec().wasm_params
+            }
+
+            /// The wasm result this function answers with, or `None` for the
+            /// one whose whole effect is on the host. An `i32` where there is
+            /// one, whether the host answered a value or the length of what it
+            /// wrote — the wire does not distinguish those.
+            pub const fn wasm_result(self) -> Option<WasmValType> {
+                self.spec().wasm_result
+            }
         }
     }
 }
@@ -232,6 +368,7 @@ impl Parse for HostFunctionsInput {
 }
 
 #[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
 mod tests {
     use super::*;
 
@@ -244,10 +381,10 @@ mod tests {
     fn reports_mistakes_from_every_function() {
         let error = expand(quote! {
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
 
             #[gas = 2000]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
+            fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
         })
         .expect_err("expected parsing to fail");
 
@@ -271,12 +408,19 @@ mod tests {
         error.into_iter().map(|error| error.to_string()).collect()
     }
 
+    /// The ABI half of the expansion alone: the glue's body is written against
+    /// another crate entirely, so the tests below about what the expansion may
+    /// name are not about it.
+    fn abi_expansion(input: TokenStream) -> String {
+        abi_items(&parse_block(input).expect("the block should parse")).to_string()
+    }
+
     #[test]
     fn generates_the_trait_the_enum_and_the_table() {
         let generated = expand(quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
 
             #[gas = 500]
             #[wasm_name = "trace_num"]
@@ -287,41 +431,54 @@ mod tests {
 
         for expected in [
             "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self) -> HostResult < [u8 ; 4] > ;",
+            "fn get_ledger_sqn (& self , out : & mut [u8]) -> HostResult < usize > ;",
             "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
             "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
             "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
             // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , }",
+            "struct HostFnSpec { name : & 'static str , gas : u64 , \
+             wasm_params : & 'static [WasmValType] , wasm_result : Option < WasmValType > , }",
             "const fn spec (self) -> HostFnSpec",
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }",
+            // Two wasm parameters for the one declared region, and a result for
+            // the length written to it.
+            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 , \
+             wasm_params : & [WasmValType :: I32 , WasmValType :: I32] , \
+             wasm_result : Some (WasmValType :: I32) , }",
+            "Self :: TraceNum => HostFnSpec { name : \"trace_num\" , gas : 500u64 , \
+             wasm_params : & [WasmValType :: I32 , WasmValType :: I32 , WasmValType :: I64] , \
+             wasm_result : None , }",
             "pub const fn wasm_name (self) -> & 'static str",
             "pub const fn gas (self) -> u64",
+            "pub const fn wasm_params (self) -> & 'static [WasmValType]",
+            "pub const fn wasm_result (self) -> Option < WasmValType >",
+            // The fourth item; its contents are `glue`'s own tests.
+            "macro_rules ! wasmi_glue",
         ] {
             assert!(generated.contains(expected), "missing {expected:?}");
         }
     }
 
-    /// The expansion stands alone: every name in it is either generated here or
-    /// written in the declarations, so it cannot depend on the crate it lands in.
+    /// The ABI reaches for nothing outside the crate it lands in, which is what
+    /// lets that crate stay zero-dependency and link into the guest. The glue is
+    /// not held to this — its body names one engine throughout, and `glue`'s own
+    /// tests pin that instead.
     #[test]
     fn names_no_crate_of_its_own() {
-        let generated = expand(quote! {
+        let generated = abi_expansion(quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap()
-        .to_string();
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
+        });
 
         assert!(!generated.contains("xrpl_host_functions"), "{generated}");
 
-        // `Self::Variant` is the only path the expansion may build: anything else
-        // would reach out of the generated code. Doc comments spell paths without
-        // spaces (`Self::ALL`), so they do not match.
+        // Two roots and no others: `Self::Variant` and `WasmValType::I32`.
+        // Doc comments spell paths without spaces (`Self::ALL`), so they do not
+        // match.
         for (index, _) in generated.match_indices(" :: ") {
+            let prefix = &generated[..index];
             assert!(
-                generated[..index].ends_with("Self"),
+                prefix.ends_with("Self") || prefix.ends_with("WasmValType"),
                 "path out of the expansion at {index}: {generated}"
             );
         }
@@ -331,13 +488,11 @@ mod tests {
     /// become part of the ABI crate's public surface.
     #[test]
     fn keeps_the_table_row_private() {
-        let generated = expand(quote! {
+        let generated = abi_expansion(quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap()
-        .to_string();
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
+        });
 
         assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
         assert!(!generated.contains("pub const fn spec"), "{generated}");
@@ -368,11 +523,11 @@ mod tests {
         let messages = messages(quote! {
             #[gas = 60]
             #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self) -> HostResult<i32>;
 
             #[gas = 70]
             #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger__sqn(&self) -> HostResult<i32>;
         });
 
         assert_eq!(messages.len(), 1, "{messages:?}");

crates/xrpl-host-functions-macros/src/lowering.rs

@@ -0,0 +1,492 @@
+//! The wire shape of a declaration: everything a declared Rust type decides — the
+//! wasm value types it lowers to, the names those wasm parameters take, the type a
+//! generated body is handed for it, and which of the ABI's two argument traits
+//! builds that type. Kept as one set of `match` arms because the four must agree.
+//!
+//! The whole mapping, and the only place it is written down: a type no arm here
+//! names is a type the ABI does not have, not one that falls back to something.
+//!
+//! Two rows are worth knowing before reading a declaration:
+//!
+//! - **`u32` is not a scalar.** It is a `(ptr, len)` region holding four
+//!   little-endian bytes, which is how the guest SDK passes a sequence number.
+//! - **`usize` and `i32` results are the same on the wire and not
+//!   interchangeable**: the first is the length of what was written to an output
+//!   region, the second the answer itself — as is `FloatOrdering`, a third spelling.
+//!
+//! Matching is on types as they are spelled — a proc macro resolves nothing, so
+//! `type Bytes = u32; … x: Bytes` is unrecognizable — but on a path's last
+//! segment, so any of these types may be spelled qualified.
+
+use proc_macro2::TokenStream;
+use quote::{ToTokens, format_ident, quote};
+use syn::{Ident, PathArguments, Type, TypePath, TypeReference};
+
+/// What a host function may be handed, and what each costs on the wire.
+///
+/// Declaration order is wasm parameter order, so a reader of a declaration is
+/// reading the import the guest links against.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ParamType {
+    /// `i32`, passed through as itself. Also the spelling for a raw scalar
+    /// whose signedness the ABI does not fix.
+    I32,
+    /// `i64`, passed through as itself.
+    I64,
+    /// `TraceDataType`: an `i32` code the engine resolves to the enum before a
+    /// host sees it.
+    TraceDataType,
+    /// `&[u8]`: a borrowed input region.
+    InBytes,
+    /// `&str`: an input region whose read is also the UTF-8 check.
+    InStr,
+    /// `u32`: an input region holding four little-endian bytes.
+    InU32,
+    /// `&mut [u8]`: the writable output region.
+    OutBytes,
+}
+
+/// The success type of the `HostResult<T>` every declaration returns. These three
+/// are what the ABI has; any other `T` is an error.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ResultType {
+    /// `usize`: the true length of a value written to an output region, which
+    /// the engine turns into the wire's `i32` or into `BufferTooSmall` /
+    /// `DataFieldTooLarge`. Never itself the wire type.
+    BufferLength,
+    /// `i32` or `FloatOrdering`: the answer, from a function that writes no region.
+    /// One variant for both — one wire result, and the declared type still reaches the
+    /// trait verbatim.
+    Value,
+    /// `()`: no wasm result at all — the call's whole effect is on the host, and
+    /// an `Err` reaches the guest in no form.
+    Nothing,
+}
+
+/// The wasm value types this ABI uses, mirroring `xrpl_host_functions::WasmValType`.
+///
+/// Mirrored rather than shared because the dependency runs the other way: the ABI
+/// crate depends on this one, so nothing here can name its types. The [`ToTokens`]
+/// impl below is the whole of the crossing, and emits references to that enum's
+/// variants — so falling out of sync with it is a compile error at the
+/// `host_functions!` call site rather than drift.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum WasmValType {
+    I32,
+    I64,
+}
+
+impl ParamType {
+    /// Recognizes the declared type, or refuses it against its own span.
+    pub(crate) fn parse(ty: &Type) -> syn::Result<Self> {
+        const ALLOWED: &str = "a host function's parameter must be `i32`, `i64`, `u32`, \
+                               `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`";
+
+        let recognized = match ty {
+            // A lifetime on the reference changes nothing on the wire.
+            Type::Reference(TypeReference {
+                mutability, elem, ..
+            }) => match (mutability, &**elem) {
+                (None, Type::Slice(slice)) if is_named(&slice.elem, "u8") => Some(Self::InBytes),
+                (Some(_), Type::Slice(slice)) if is_named(&slice.elem, "u8") => {
+                    Some(Self::OutBytes)
+                }
+                (None, elem) if is_named(elem, "str") => Some(Self::InStr),
+                _ => None,
+            },
+            _ => match last_path_segment(ty) {
+                Some(name) if name == "i32" => Some(Self::I32),
+                Some(name) if name == "i64" => Some(Self::I64),
+                Some(name) if name == "u32" => Some(Self::InU32),
+                Some(name) if name == "TraceDataType" => Some(Self::TraceDataType),
+                _ => None,
+            },
+        };
+
+        recognized.ok_or_else(|| syn::Error::new_spanned(ty, ALLOWED))
+    }
+
+    /// The wasm parameters this declared type lowers to, in order. `InBytes` and
+    /// `OutBytes` lower alike, so a region's direction survives only in the
+    /// variant.
+    pub(crate) fn as_wasm_params(self) -> &'static [WasmValType] {
+        match self {
+            Self::I32 | Self::TraceDataType => &[WasmValType::I32],
+            Self::I64 => &[WasmValType::I64],
+            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
+                &[WasmValType::I32, WasmValType::I32]
+            }
+        }
+    }
+
+    /// What a declaration calls each of those wasm parameters: the declared name
+    /// for a scalar, and `{name}_ptr`/`{name}_len` for the pair a region lowers
+    /// to.
+    ///
+    /// **It must answer as many names as [`Self::as_wasm_params`] answers types**,
+    /// since the generated closure declares them one against the other — hence the
+    /// matching arms, and `lowers_every_declared_parameter_type`'s row-by-row
+    /// length check.
+    pub(crate) fn wasm_names(self, name: &Ident) -> Vec<Ident> {
+        match self {
+            Self::I32 | Self::I64 | Self::TraceDataType => vec![name.clone()],
+            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
+                vec![format_ident!("{name}_ptr"), format_ident!("{name}_len")]
+            }
+        }
+    }
+
+    /// The type a generated body takes this parameter as: a wasm scalar spelled as
+    /// itself, everything else the argument type carrying its shape and direction —
+    /// which is what makes an input region used as an output one a compile error
+    /// naming both.
+    ///
+    /// The argument types are the engine's, so `vm` is the path they are reached
+    /// under; which types need it is decided here, a wasm scalar being `i32` under
+    /// every engine.
+    pub(crate) fn argument_type(self, vm: &TokenStream) -> TokenStream {
+        match self {
+            Self::I32 => quote!(i32),
+            Self::I64 => quote!(i64),
+            Self::TraceDataType => quote!(#vm::TraceCode),
+            Self::InBytes => quote!(#vm::InBytes),
+            Self::InStr => quote!(#vm::InStr),
+            Self::InU32 => quote!(#vm::InU32),
+            Self::OutBytes => quote!(#vm::OutBytes),
+        }
+    }
+
+    /// Which of the ABI's two argument traits builds this parameter's argument
+    /// type, or `None` for a wasm scalar, which reaches a body as itself.
+    ///
+    /// The arity is the whole of the distinction — `FromWasmRegion` takes the two
+    /// of a `(ptr, len)` pair, `FromWasmScalar` the one of a code — so this answers
+    /// alongside [`Self::as_wasm_params`] rather than from a predicate elsewhere.
+    pub(crate) fn argument_trait(self) -> Option<TokenStream> {
+        match self {
+            Self::I32 | Self::I64 => None,
+            Self::TraceDataType => Some(quote!(FromWasmScalar)),
+            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
+                Some(quote!(FromWasmRegion))
+            }
+        }
+    }
+
+    /// Whether this parameter is a region the host writes to — what
+    /// [`ResultType::BufferLength`] is the length *of*.
+    pub(crate) fn is_out_region(self) -> bool {
+        matches!(self, Self::OutBytes)
+    }
+}
+
+impl ResultType {
+    /// Recognizes the success type of a declaration's `HostResult<T>`, or
+    /// refuses it against its own span.
+    pub(crate) fn parse(success: &Type) -> syn::Result<Self> {
+        const ALLOWED: &str = "a host function must return `HostResult<usize>` for a value it \
+                               writes to an output region, `HostResult<i32>` or \
+                               `HostResult<FloatOrdering>` for one it answers directly, or \
+                               `HostResult<()>` for none at all";
+
+        if let Type::Tuple(tuple) = success
+            && tuple.elems.is_empty()
+        {
+            return Ok(Self::Nothing);
+        }
+
+        match last_path_segment(success) {
+            Some(name) if name == "usize" => Ok(Self::BufferLength),
+            Some(name) if name == "i32" || name == "FloatOrdering" => Ok(Self::Value),
+            _ => Err(syn::Error::new_spanned(success, ALLOWED)),
+        }
+    }
+
+    /// The generated table's `wasm_result` field: `Some(WasmValType::I32)`, or
+    /// `None` for the function that answers nothing.
+    ///
+    /// Spelled out here rather than left to `quote`'s `Option` impl, which emits
+    /// nothing at all for `None`.
+    pub(crate) fn wasm_result_tokens(self) -> TokenStream {
+        match self.as_wasm_result() {
+            Some(val_type) => quote! { Some(#val_type) },
+            None => quote! { None },
+        }
+    }
+
+    /// Whether the value reaches the guest as the length of what was written to
+    /// an output region.
+    pub(crate) fn is_buffer_length(self) -> bool {
+        matches!(self, Self::BufferLength)
+    }
+
+    /// The wasm result, which does not distinguish a length from a value.
+    fn as_wasm_result(self) -> Option<WasmValType> {
+        match self {
+            Self::BufferLength | Self::Value => Some(WasmValType::I32),
+            Self::Nothing => None,
+        }
+    }
+}
+
+/// `WasmValType::I32` — the ABI crate's variant, named but never defined here.
+impl ToTokens for WasmValType {
+    fn to_tokens(&self, tokens: &mut TokenStream) {
+        tokens.extend(match self {
+            Self::I32 => quote! { WasmValType::I32 },
+            Self::I64 => quote! { WasmValType::I64 },
+        });
+    }
+}
+
+/// The last segment of a plain path type, when it carries no generic arguments:
+/// `i32`, `core::primitive::i32` and `TraceDataType` all answer their own name,
+/// `Vec<u8>` and `[u8; 4]` nothing.
+fn last_path_segment(ty: &Type) -> Option<&Ident> {
+    let Type::Path(TypePath {
+        qself: None, path, ..
+    }) = ty
+    else {
+        return None;
+    };
+    let last = path.segments.last()?;
+    matches!(last.arguments, PathArguments::None).then_some(&last.ident)
+}
+
+/// Whether `ty` is the named primitive, however it is spelled.
+fn is_named(ty: &Type, name: &str) -> bool {
+    last_path_segment(ty).is_some_and(|segment| segment == name)
+}
+
+#[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
+mod tests {
+    use super::*;
+    use syn::parse_quote;
+
+    use WasmValType::{I32, I64};
+
+    /// Every declared parameter type and everything it decides: what it costs on
+    /// the wire, what a body is handed for it, and which trait builds that.
+    ///
+    /// The names are asserted by length rather than spelling, since a type
+    /// answering fewer names than value types is the one way these answers can
+    /// contradict each other.
+    #[test]
+    fn lowers_every_declared_parameter_type() {
+        let mapping: [(Type, &[WasmValType], &str, Option<&str>); 7] = [
+            (parse_quote!(i32), &[I32], "i32", None),
+            (parse_quote!(i64), &[I64], "i64", None),
+            (
+                parse_quote!(TraceDataType),
+                &[I32],
+                "vm :: TraceCode",
+                Some("FromWasmScalar"),
+            ),
+            (
+                parse_quote!(&[u8]),
+                &[I32, I32],
+                "vm :: InBytes",
+                Some("FromWasmRegion"),
+            ),
+            (
+                parse_quote!(&str),
+                &[I32, I32],
+                "vm :: InStr",
+                Some("FromWasmRegion"),
+            ),
+            (
+                parse_quote!(u32),
+                &[I32, I32],
+                "vm :: InU32",
+                Some("FromWasmRegion"),
+            ),
+            (
+                parse_quote!(&mut [u8]),
+                &[I32, I32],
+                "vm :: OutBytes",
+                Some("FromWasmRegion"),
+            ),
+        ];
+        let declared_name = format_ident!("seq");
+        let vm = quote!(vm);
+
+        for (declared, wasm, argument, argument_trait) in mapping {
+            let param = ParamType::parse(&declared)
+                .unwrap_or_else(|_| panic!("`{}` should be a parameter type", quoted(&declared)));
+
+            assert_eq!(param.as_wasm_params(), wasm, "`{}`", quoted(&declared));
+            assert_eq!(
+                param.argument_type(&vm).to_string(),
+                argument,
+                "`{}`",
+                quoted(&declared)
+            );
+            assert_eq!(
+                param
+                    .argument_trait()
+                    .map(|name| name.to_string())
+                    .as_deref(),
+                argument_trait,
+                "`{}`",
+                quoted(&declared)
+            );
+            assert_eq!(
+                param.wasm_names(&declared_name).len(),
+                wasm.len(),
+                "one name per wasm parameter: `{}`",
+                quoted(&declared)
+            );
+        }
+    }
+
+    /// A region's two wasm parameters are named off the declaration, so the
+    /// generated closure reads as the declaration does.
+    #[test]
+    fn names_a_region_s_pair_after_the_declared_parameter() {
+        let seq = format_ident!("seq");
+
+        let names = |declared: Type| {
+            ParamType::parse(&declared)
+                .expect("a parameter type")
+                .wasm_names(&seq)
+                .iter()
+                .map(Ident::to_string)
+                .collect::<Vec<_>>()
+        };
+
+        assert_eq!(names(parse_quote!(u32)), ["seq_ptr", "seq_len"]);
+        assert_eq!(names(parse_quote!(i32)), ["seq"]);
+    }
+
+    /// The two `(ptr, len)` pairs lower alike but are told apart, since only the
+    /// direction says who may write to the region.
+    #[test]
+    fn keeps_the_regions_apart() {
+        let input: Type = parse_quote!(&[u8]);
+        let output: Type = parse_quote!(&mut [u8]);
+
+        assert!(!ParamType::parse(&input).unwrap().is_out_region());
+        assert!(ParamType::parse(&output).unwrap().is_out_region());
+    }
+
+    /// A type outside the mapping is refused rather than lowered to a guess.
+    #[test]
+    fn refuses_parameter_types_outside_the_mapping() {
+        let outside: [Type; 11] = [
+            parse_quote!(u64),
+            parse_quote!(u8),
+            parse_quote!(usize),
+            parse_quote!(bool),
+            parse_quote!(Vec<u8>),
+            parse_quote!([u8; 4]),
+            parse_quote!(&mut str),
+            parse_quote!(&i32),
+            parse_quote!(&[i32]),
+            parse_quote!(&Foo),
+            parse_quote!(()),
+        ];
+
+        for declared in outside {
+            let Err(error) = ParamType::parse(&declared) else {
+                panic!("`{}` should not be a parameter type", quoted(&declared));
+            };
+            assert!(
+                error.to_string().contains("must be `i32`"),
+                "`{}`: {error}",
+                quoted(&declared)
+            );
+        }
+    }
+
+    /// The declared success types, and the wasm result each becomes. `usize` and `i32`
+    /// agree on the wire and are separate rows; `FloatOrdering` shares `i32`'s.
+    #[test]
+    fn lowers_every_success_type() {
+        let mapping: [(Type, ResultType, Option<WasmValType>); 4] = [
+            (parse_quote!(usize), ResultType::BufferLength, Some(I32)),
+            (parse_quote!(i32), ResultType::Value, Some(I32)),
+            (parse_quote!(FloatOrdering), ResultType::Value, Some(I32)),
+            (parse_quote!(()), ResultType::Nothing, None),
+        ];
+
+        for (declared, expected, wasm_result) in mapping {
+            let result = ResultType::parse(&declared)
+                .unwrap_or_else(|_| panic!("`{}` should be a success type", quoted(&declared)));
+
+            assert_eq!(result, expected, "`{}`", quoted(&declared));
+            assert_eq!(
+                result.as_wasm_result(),
+                wasm_result,
+                "`{}`",
+                quoted(&declared)
+            );
+        }
+    }
+
+    /// The distinction the wasm result loses: which of the two `i32` results was
+    /// declared decides how the value reaches the guest.
+    #[test]
+    fn tells_a_length_from_a_value() {
+        assert!(ResultType::BufferLength.is_buffer_length());
+        assert!(!ResultType::Value.is_buffer_length());
+        assert!(!ResultType::Nothing.is_buffer_length());
+    }
+
+    #[test]
+    fn refuses_success_types_outside_the_mapping() {
+        let outside: [Type; 6] = [
+            parse_quote!(u32),
+            parse_quote!(i64),
+            parse_quote!(bool),
+            parse_quote!([u8; 32]),
+            parse_quote!(Vec<u8>),
+            parse_quote!((usize, i32)),
+        ];
+
+        for declared in outside {
+            let Err(error) = ResultType::parse(&declared) else {
+                panic!("`{}` should not be a success type", quoted(&declared));
+            };
+            assert!(
+                error
+                    .to_string()
+                    .contains("must return `HostResult<usize>`"),
+                "`{}`: {error}",
+                quoted(&declared)
+            );
+        }
+    }
+
+    /// A qualified spelling is the same type, matching how the return type finds
+    /// `HostResult`.
+    #[test]
+    fn accepts_qualified_spellings() {
+        let qualified: Type = parse_quote!(core::primitive::i32);
+        assert_eq!(ParamType::parse(&qualified).unwrap(), ParamType::I32);
+
+        let qualified: Type = parse_quote!(xrpl_host_functions::TraceDataType);
+        assert_eq!(
+            ParamType::parse(&qualified).unwrap(),
+            ParamType::TraceDataType
+        );
+    }
+
+    /// The emitted tokens name the ABI crate's variants, which is the whole of
+    /// what crosses out of this crate. Pinned here so a break in the mirror is a
+    /// failure with a span rather than a rustc error at the call site.
+    #[test]
+    fn emits_references_to_the_hand_written_variants() {
+        assert_eq!(I32.to_token_stream().to_string(), "WasmValType :: I32");
+        assert_eq!(I64.to_token_stream().to_string(), "WasmValType :: I64");
+
+        assert_eq!(
+            ResultType::BufferLength.wasm_result_tokens().to_string(),
+            "Some (WasmValType :: I32)"
+        );
+        assert_eq!(ResultType::Nothing.wasm_result_tokens().to_string(), "None");
+    }
+
+    fn quoted(ty: &Type) -> String {
+        ty.to_token_stream().to_string()
+    }
+}

crates/xrpl-host-functions-macros/src/parsed_host_function.rs

@@ -1,11 +1,13 @@
 use proc_macro2::TokenStream;
-use quote::{format_ident, quote};
+use quote::{ToTokens, format_ident, quote};
 use syn::{
-    Attribute, Expr, ExprLit, Ident, Lit, LitStr, PathArguments, ReceiverKind, ReturnType, Safety,
-    Signature, TraitItemFn, Type, TypePath,
+    Attribute, FnArg, GenericArgument, Ident, LitInt, LitStr, Pat, PatIdent, PatType,
+    PathArguments, ReceiverKind, ReturnType, Safety, Signature, TraitItemFn, Type, TypePath,
+    parse::Parse,
 };
 
 use crate::errors;
+use crate::lowering::{ParamType, ResultType, WasmValType};
 
 /// `#[gas = N]`: the base gas charged before the call runs.
 const GAS: &str = "gas";
@@ -16,6 +18,16 @@ const DOC: &str = "doc";
 /// The alias every declaration returns its success type through.
 const HOST_RESULT: &str = "HostResult";
 
+/// One declared parameter: the name it states its purpose with, and the type
+/// that decides its wire form.
+///
+/// The name is carried because the generated glue spells it — as the body's
+/// parameter, and as `{name}_ptr`/`{name}_len` for a region.
+pub(crate) struct Param {
+    pub(crate) name: Ident,
+    pub(crate) ty: ParamType,
+}
+
 /// One entry of a `host_functions!` block: its ABI metadata and its signature.
 pub(crate) struct ParsedHostFunction {
     pub(crate) gas: u64,
@@ -27,10 +39,24 @@ pub(crate) struct ParsedHostFunction {
     /// The enum variant this declaration becomes, spanned at the function name.
     pub(crate) variant: Ident,
     pub(crate) signature: Signature,
+    /// The declared parameters, in order, with the receiver dropped: `&self` is
+    /// not part of the wasm ABI.
+    params: Vec<Param>,
+    /// What the declaration's `HostResult<T>` answers with.
+    result: ResultType,
 }
 
 impl ParsedHostFunction {
-    /// `#[doc …] fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;`
+    /// The declared parameters, in declaration order, which is wire order.
+    pub(crate) fn params(&self) -> &[Param] {
+        &self.params
+    }
+
+    pub(crate) fn result(&self) -> ResultType {
+        self.result
+    }
+
+    /// `#[doc …] fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;`
     pub(crate) fn trait_method(&self) -> TokenStream {
         let docs = &self.docs;
         // The declaration is already a trait method: emitted verbatim, so what
@@ -53,19 +79,39 @@ impl ParsedHostFunction {
         }
     }
 
-    /// `Self::GetLedgerSqn => HostFnSpec { name: "ldgr_index", gas: 60u64 }`
+    /// `Self::GetLedgerSqn => HostFnSpec { name: "ldgr_index", gas: 60u64,
+    /// wasm_params: &[WasmValType::I32, WasmValType::I32], wasm_result:
+    /// Some(WasmValType::I32) }`
     pub(crate) fn spec_arm(&self) -> TokenStream {
         let Self {
             gas,
             wasm_name,
             variant,
+            result,
             ..
         } = self;
+        let wasm_params = self.wasm_params();
+        let wasm_result = result.wasm_result_tokens();
+
         quote! {
-            Self::#variant => HostFnSpec { name: #wasm_name, gas: #gas }
+            Self::#variant => HostFnSpec {
+                name: #wasm_name,
+                gas: #gas,
+                wasm_params: &[#(#wasm_params),*],
+                wasm_result: #wasm_result,
+            }
         }
     }
 
+    /// The wasm parameters this declaration lowers to, in wire order and flat:
+    /// nothing in the sequence says which two came from one declared region.
+    fn wasm_params(&self) -> impl Iterator<Item = WasmValType> {
+        self.params
+            .iter()
+            .flat_map(|param| param.ty.as_wasm_params())
+            .copied()
+    }
+
     pub(crate) fn parse(function: TraitItemFn) -> syn::Result<Self> {
         let mut gas = None;
         let mut wasm_name = None;
@@ -85,8 +131,8 @@ impl ParsedHostFunction {
                 }
             } else if attr.path().is_ident(WASM_NAME) {
                 saw_wasm_name = true;
-                if let Err(error) =
-                    string_value(&attr).and_then(|v| set_once(&mut wasm_name, v, &attr))
+                if let Err(error) = value::<LitStr>(&attr, "a string literal")
+                    .and_then(|v| set_once(&mut wasm_name, v, &attr))
                 {
                     errors.push(error);
                 }
@@ -126,27 +172,30 @@ impl ParsedHostFunction {
             ));
         }
         errors.extend(check_receiver(&function.sig).err());
-        errors.extend(check_return_type(&function.sig).err());
         if let Some(name) = &wasm_name {
             errors.extend(check_wasm_name(name).err());
         }
-        reject_modifiers(&function.sig, &mut errors);
+        errors.extend(reject_modifiers(&function.sig).err());
+
+        // The wasm signature, derived from the declared types. The two halves are
+        // held to each other only once both are known.
+        let params = errors::record(parse_params(&function.sig), &mut errors);
+        let result = errors::record(parse_result(&function.sig), &mut errors);
+        if let (Some(params), Some(result)) = (&params, result) {
+            errors.extend(check_result_matches_regions(&function.sig, params, result).err());
+        }
 
         // A name whose PascalCase form is not a legal variant is reported here
         // rather than emitted, which would either panic or fail downstream.
-        let variant = match variant_ident(&function.sig.ident) {
-            Ok(variant) => Some(variant),
-            Err(error) => {
-                errors.push(error);
-                None
-            }
-        };
+        let variant = errors::record(variant_ident(&function.sig.ident), &mut errors);
 
         if let Some(error) = errors::combine(errors) {
             return Err(error);
         }
 
-        let (Some(gas), Some(wasm_name), Some(variant)) = (gas, wasm_name, variant) else {
+        let (Some(gas), Some(wasm_name), Some(variant), Some(params), Some(result)) =
+            (gas, wasm_name, variant, params, result)
+        else {
             unreachable!("every absent field is reported above");
         };
 
@@ -156,6 +205,8 @@ impl ParsedHostFunction {
             docs,
             variant,
             signature: function.sig,
+            params,
+            result,
         })
     }
 }
@@ -189,6 +240,77 @@ fn check_receiver(signature: &Signature) -> syn::Result<()> {
     Ok(())
 }
 
+/// The declared parameters, lowered, with the receiver skipped. Every parameter
+/// is reported against its own span, so a declaration surfaces all of its
+/// parameter mistakes in one build rather than one per rebuild.
+fn parse_params(signature: &Signature) -> syn::Result<Vec<Param>> {
+    let mut params = Vec::new();
+    let mut errors = Vec::new();
+
+    for input in &signature.inputs {
+        // The receiver, which Rust's grammar puts first and nowhere else, and
+        // which `check_receiver` holds to `&self`.
+        let FnArg::Typed(PatType { pat, ty, .. }) = input else {
+            continue;
+        };
+        // Both halves recorded, so a parameter that is both badly named and badly
+        // typed answers for each.
+        let name = errors::record(parameter_name(pat), &mut errors);
+        let ty = errors::record(ParamType::parse(ty), &mut errors);
+        if let (Some(name), Some(ty)) = (name, ty) {
+            params.push(Param { name, ty });
+        }
+    }
+
+    errors::into_result(params, errors)
+}
+
+/// The parameter's name, which must be a plain identifier: it is how the
+/// declaration states what the parameter is for, the wasm signature it lowers to
+/// being all `i32`s.
+fn parameter_name(pat: &Pat) -> syn::Result<Ident> {
+    if let Pat::Ident(PatIdent {
+        by_ref: None,
+        mutability: None,
+        subpat: None,
+        ident,
+        ..
+    }) = pat
+    {
+        return Ok(ident.clone());
+    }
+
+    Err(syn::Error::new_spanned(
+        pat,
+        "a host function's parameter must be a plain name, as in `seq: u32`",
+    ))
+}
+
+/// `HostResult<usize>` and an output region are one fact stated twice: the length
+/// answered is the length of what was written *there*, so either alone is a
+/// declaration nothing can serve.
+fn check_result_matches_regions(
+    signature: &Signature,
+    params: &[Param],
+    result: ResultType,
+) -> syn::Result<()> {
+    let writes_a_region = params.iter().any(|param| param.ty.is_out_region());
+
+    match (result.is_buffer_length(), writes_a_region) {
+        (true, false) => Err(syn::Error::new_spanned(
+            &signature.ident,
+            "a host function returning `HostResult<usize>` must take an output region \
+             (`&mut [u8]`): the length it answers is the length of what it wrote there",
+        )),
+        (false, true) => Err(syn::Error::new_spanned(
+            &signature.ident,
+            "a host function taking an output region (`&mut [u8]`) must return \
+             `HostResult<usize>`: the length it wrote is what the guest is answered",
+        )),
+        (true, true) | (false, false) => Ok(()),
+    }
+}
+
 /// Every declaration returns `HostResult<T>`, including the ones that yield
 /// nothing (`HostResult<()>`).
 ///
@@ -196,7 +318,9 @@ fn check_receiver(signature: &Signature) -> syn::Result<()> {
 /// all: lift the arguments out of guest memory, call the host, then turn `Ok(T)`
 /// into the wire's non-negative `i32` and `Err(e)` into a negative code or a trap.
 /// A function returning a bare `T` would need its own arm.
-fn check_return_type(signature: &Signature) -> syn::Result<()> {
+///
+/// The wrapper is checked here; which `T`s the ABI has is [`ResultType`]'s.
+fn parse_result(signature: &Signature) -> syn::Result<ResultType> {
     const SHAPE: &str = "a host function must return `HostResult<T>` — \
                          `HostResult<()>` if it yields nothing";
 
@@ -226,21 +350,29 @@ fn check_return_type(signature: &Signature) -> syn::Result<()> {
             format!("`{HOST_RESULT}` needs its success type: `{HOST_RESULT}<T>`"),
         ));
     };
-    if arguments.args.len() != 1 {
-        return Err(syn::Error::new_spanned(
-            arguments,
-            format!("`{HOST_RESULT}` takes exactly one type: `{HOST_RESULT}<T>`"),
-        ));
-    }
-    Ok(())
+    // One argument, and a type: neither `HostResult<'a>` nor `HostResult<i32, i32>`
+    // names a success type.
+    let success = match (arguments.args.len(), arguments.args.first()) {
+        (1, Some(GenericArgument::Type(success))) => success,
+        _ => {
+            return Err(syn::Error::new_spanned(
+                arguments,
+                format!("`{HOST_RESULT}` takes exactly one type: `{HOST_RESULT}<T>`"),
+            ));
+        }
+    };
+
+    ResultType::parse(success)
 }
 
 /// `const`, `async`, `unsafe`/`safe` and `extern "…"` have no meaning in the
 /// wasm ABI, and would otherwise pass silently into the generated trait.
-fn reject_modifiers(signature: &Signature, errors: &mut Vec<syn::Error>) {
+fn reject_modifiers(signature: &Signature) -> syn::Result<()> {
     const PLAIN: &str =
         "a host function must be a plain `fn`: this modifier is not part of the wasm ABI";
 
+    let mut errors = Vec::new();
+
     if let Some(constness) = &signature.constness {
         errors.push(syn::Error::new_spanned(constness, PLAIN));
     }
@@ -255,6 +387,8 @@ fn reject_modifiers(signature: &Signature, errors: &mut Vec<syn::Error>) {
     if let Some(abi) = &signature.abi {
         errors.push(syn::Error::new_spanned(abi, PLAIN));
     }
+
+    errors::into_result((), errors)
 }
 
 /// The wasm import name reaches the engine's import table verbatim, so it is
@@ -335,39 +469,28 @@ fn set_once<T>(slot: &mut Option<T>, value: T, attr: &Attribute) -> syn::Result<
     Ok(())
 }
 
-fn int_value(attr: &Attribute) -> syn::Result<u64> {
-    match &attr.meta.require_name_value()?.value {
-        Expr::Lit(ExprLit {
-            lit: Lit::Int(int), ..
-        }) => {
-            // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>`
-            // would report a negative value as "invalid digit found in string".
-            if int.base10_digits().starts_with('-') {
-                return Err(syn::Error::new_spanned(
-                    int,
-                    format!("`{}` must not be negative", path_name(attr)),
-                ));
-            }
-            int.base10_parse()
-        }
-        other => Err(syn::Error::new_spanned(
-            other,
-            format!("`{}` expects an integer literal", path_name(attr)),
-        )),
-    }
+/// The value of `#[name = <value>]`, parsed as `T`.
+///
+/// `expected` completes "`gas` expects …": syn's own message for the wrong kind
+/// of literal names neither the attribute nor what it wanted.
+fn value<T: Parse>(attr: &Attribute, expected: &str) -> syn::Result<T> {
+    let expr = &attr.meta.require_name_value()?.value;
+    syn::parse2(expr.to_token_stream()).map_err(|_| {
+        syn::Error::new_spanned(expr, format!("`{}` expects {expected}", path_name(attr)))
+    })
 }
 
-fn string_value(attr: &Attribute) -> syn::Result<LitStr> {
-    match &attr.meta.require_name_value()?.value {
-        Expr::Lit(ExprLit {
-            lit: Lit::Str(string),
-            ..
-        }) => Ok(string.clone()),
-        other => Err(syn::Error::new_spanned(
-            other,
-            format!("`{}` expects a string literal", path_name(attr)),
-        )),
+fn int_value(attr: &Attribute) -> syn::Result<u64> {
+    let int: LitInt = value(attr, "an integer literal")?;
+    // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>` would
+    // report a negative value as "invalid digit found in string".
+    if int.base10_digits().starts_with('-') {
+        return Err(syn::Error::new_spanned(
+            int,
+            format!("`{}` must not be negative", path_name(attr)),
+        ));
     }
+    int.base10_parse()
 }
 
 /// The attribute's path as written, for diagnostics: `gas`, or `foo::bar`.
@@ -381,10 +504,10 @@ fn path_name(attr: &Attribute) -> String {
 }
 
 #[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
 mod tests {
     use super::*;
-    use quote::ToTokens;
-    use syn::parse_quote;
+    use syn::{Expr, ExprLit, Lit, parse_quote};
 
     /// The message of every diagnostic recorded by one failed `parse`.
     ///
@@ -412,7 +535,7 @@ mod tests {
         let parsed = ParsedHostFunction::parse(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         })
         .unwrap();
 
@@ -483,7 +606,7 @@ mod tests {
         let messages = messages(parse_quote! {
             #[gas = -5]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
 
         assert_eq!(messages.len(), 1, "{messages:?}");
@@ -495,7 +618,7 @@ mod tests {
         let empty = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = ""]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
         assert_eq!(empty.len(), 1, "{empty:?}");
         assert_eq!(empty[0], "the wasm name must not be empty");
@@ -503,7 +626,7 @@ mod tests {
         let spaced = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
         assert_eq!(spaced.len(), 1, "{spaced:?}");
         assert!(spaced[0].contains("may only contain"), "{spaced:?}");
@@ -512,10 +635,10 @@ mod tests {
     #[test]
     fn rejects_signature_modifiers() {
         for declaration in [
-            quote! { unsafe fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { async fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { const fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { extern "C" fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
+            quote! { unsafe fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>; },
+            quote! { async fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>; },
+            quote! { const fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>; },
+            quote! { extern "C" fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>; },
         ] {
             let function: TraitItemFn = syn::parse2(quote! {
                 #[gas = 60]
@@ -536,7 +659,7 @@ mod tests {
             /// Hashes `data`.
             #[gas = 2000]
             #[wasm_name = "sha512_half"]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
+            fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
         })
         .unwrap();
 
@@ -548,24 +671,27 @@ mod tests {
             "{method}"
         );
         assert!(
-            method
-                .contains("fn sha512_half (& self , data : & [u8]) -> HostResult < [u8 ; 32] > ;"),
+            method.contains(
+                "fn sha512_half (& self , data : & [u8] , out : & mut [u8]) -> HostResult < usize > ;"
+            ),
             "{method}"
         );
     }
 
     #[test]
-    fn spec_arm_carries_the_name_and_the_gas() {
+    fn spec_arm_carries_the_name_the_gas_and_the_wasm_signature() {
         let parsed = ParsedHostFunction::parse(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         })
         .unwrap();
 
         assert_eq!(
             parsed.spec_arm().to_string(),
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }"
+            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 , \
+             wasm_params : & [WasmValType :: I32 , WasmValType :: I32] , \
+             wasm_result : Some (WasmValType :: I32) , }"
         );
     }
 
@@ -577,7 +703,7 @@ mod tests {
             /// Third line.
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         })
         .unwrap();
 
@@ -588,34 +714,192 @@ mod tests {
     #[test]
     fn preserves_parameters_and_return_type() {
         let traced = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 500]
+            #[gas = 30]
             #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data: &[u8], as_hex: bool) -> HostResult<()>;
+            fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
         })
         .unwrap();
-        // The receiver is `inputs[0]`; the three wasm parameters follow it.
+
+        // The receiver is `inputs[0]`; the three declared parameters follow it.
         assert_eq!(traced.signature.inputs.len(), 4);
         assert_eq!(
             traced.signature.output.to_token_stream().to_string(),
             "-> HostResult < () >"
         );
+    }
 
-        let hashed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 2000]
-            #[wasm_name = "sha512_half"]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; HASH_LEN]>;
+    /// Why the declared parameter list and the wasm signature are different
+    /// lengths: `account`, `seq` and `out` are a `(ptr, len)` pair each — `seq`
+    /// too, reading like a scalar but holding four little-endian bytes.
+    #[test]
+    fn derives_the_wasm_signature_from_the_declared_types() {
+        let keylet = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 350]
+            #[wasm_name = "check_id"]
+            fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
         })
         .unwrap();
+
         assert_eq!(
-            hashed.signature.output.to_token_stream().to_string(),
-            "-> HostResult < [u8 ; HASH_LEN] >"
+            declared(&keylet),
+            ["account: InBytes", "seq: InU32", "out: OutBytes"]
+        );
+        assert_eq!(
+            keylet.wasm_params().collect::<Vec<_>>(),
+            [WasmValType::I32; 6]
+        );
+        assert_eq!(keylet.result, ResultType::BufferLength);
+    }
+
+    /// The scalars are the exception: spelled as themselves, and in declaration
+    /// order, which is wire order.
+    #[test]
+    fn passes_the_wasm_scalars_through_in_declaration_order() {
+        let from_int = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 100]
+            #[wasm_name = "float_from_int"]
+            fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
+        })
+        .unwrap();
+
+        assert_eq!(
+            from_int.wasm_params().collect::<Vec<_>>(),
+            [
+                WasmValType::I64,
+                WasmValType::I32,
+                WasmValType::I32,
+                WasmValType::I32
+            ]
+        );
+    }
+
+    /// `&self` is `inputs[0]` and is not a parameter. Read as one it would be a
+    /// declared type the ABI does not have, refusing every declaration.
+    #[test]
+    fn does_not_read_the_receiver_as_a_parameter() {
+        let array_len = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 40]
+            #[wasm_name = "tx_arr_len"]
+            fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
+        })
+        .unwrap();
+
+        assert_eq!(declared(&array_len), ["field: I32"]);
+        assert_eq!(array_len.result, ResultType::Value);
+    }
+
+    /// The declared parameters as `name: Type`, which is what the glue spells.
+    fn declared(function: &ParsedHostFunction) -> Vec<String> {
+        function
+            .params()
+            .iter()
+            .map(|param| format!("{}: {:?}", param.name, param.ty))
+            .collect()
+    }
+
+    /// One diagnostic per parameter, each on its own span, so a declaration's
+    /// mistakes all surface in one build.
+    #[test]
+    fn rejects_parameter_types_the_abi_does_not_have() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self, flag: bool, data: Vec<u8>) -> HostResult<i32>;
+        });
+
+        assert_eq!(messages.len(), 2, "{messages:?}");
+        assert!(
+            messages.iter().all(|m| m.contains("must be `i32`")),
+            "{messages:?}"
+        );
+    }
+
+    #[test]
+    fn rejects_parameters_that_are_not_plain_names() {
+        for parameter in [
+            quote! { _: i32 },
+            quote! { mut field: i32 },
+            quote! { (field, flag): i32 },
+        ] {
+            let function: TraitItemFn = syn::parse2(quote! {
+                #[gas = 40]
+                #[wasm_name = "tx_arr_len"]
+                fn get_tx_array_len(&self, #parameter) -> HostResult<i32>;
+            })
+            .unwrap_or_else(|_| panic!("`{parameter}` should parse"));
+
+            let messages = messages(function);
+            assert!(
+                messages.iter().any(|m| m.contains("must be a plain name")),
+                "`{parameter}`: {messages:?}"
+            );
+        }
+    }
+
+    /// Two mistakes on one parameter are two diagnostics, neither standing in for
+    /// the other.
+    #[test]
+    fn reports_a_parameter_s_name_and_its_type_separately() {
+        let messages = messages(parse_quote! {
+            #[gas = 40]
+            #[wasm_name = "tx_arr_len"]
+            fn get_tx_array_len(&self, _: bool) -> HostResult<i32>;
+        });
+
+        assert_eq!(messages.len(), 2, "{messages:?}");
+        assert!(messages[0].contains("must be a plain name"), "{messages:?}");
+        assert!(messages[1].contains("must be `i32`"), "{messages:?}");
+    }
+
+    /// The success type is held to the three the ABI has. `[u8; 4]` is the one
+    /// worth pinning: it says what the value *is*, which is the guest SDK's
+    /// business and not the wire's.
+    #[test]
+    fn rejects_success_types_the_abi_does_not_have() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(
+            messages[0].contains("must return `HostResult<usize>`"),
+            "{messages:?}"
+        );
+    }
+
+    /// Each half of the pairing refused on its own: a length with nowhere to have
+    /// written the value, and a written region whose length the guest never learns.
+    #[test]
+    fn rejects_a_result_that_does_not_match_the_regions() {
+        let no_region = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<usize>;
+        });
+        assert_eq!(no_region.len(), 1, "{no_region:?}");
+        assert!(
+            no_region[0].contains("must take an output region"),
+            "{no_region:?}"
+        );
+
+        let unreported = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<i32>;
+        });
+        assert_eq!(unreported.len(), 1, "{unreported:?}");
+        assert!(
+            unreported[0].contains("must return `HostResult<usize>`"),
+            "{unreported:?}"
         );
     }
 
     #[test]
     fn reports_both_missing_attributes_at_once() {
         let messages = messages(parse_quote! {
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
 
         assert_eq!(messages.len(), 2);
@@ -628,7 +912,7 @@ mod tests {
         let messages = messages(parse_quote! {
             #[gas = 60]
             #[wsam_name = "typo"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
 
         // The typo'd attribute, plus the `wasm_name` it failed to be.
@@ -644,7 +928,7 @@ mod tests {
         let gas = messages(parse_quote! {
             #[gas = "60"]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
         assert_eq!(gas.len(), 1, "{gas:?}");
         assert!(
@@ -655,7 +939,7 @@ mod tests {
         let name = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = 7]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
         assert_eq!(name.len(), 1, "{name:?}");
         assert!(
@@ -669,7 +953,7 @@ mod tests {
         let messages = messages(parse_quote! {
             #[gas = 99999999999999999999999]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
 
         assert_eq!(messages.len(), 1, "{messages:?}");
@@ -681,7 +965,7 @@ mod tests {
         let bare = messages(parse_quote! {
             #[gas]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
         assert_eq!(bare.len(), 1, "{bare:?}");
         assert!(bare[0].contains("gas = ..."), "{bare:?}");
@@ -689,7 +973,7 @@ mod tests {
         let list = messages(parse_quote! {
             #[gas(60)]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
         assert_eq!(list.len(), 1, "{list:?}");
     }
@@ -701,7 +985,7 @@ mod tests {
             #[gas = 70]
             #[wasm_name = "ldgr_index"]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
 
         assert_eq!(messages.len(), 2, "{messages:?}");
@@ -718,7 +1002,7 @@ mod tests {
         let messages = messages(parse_quote! {
             #[gas = "60"]
             #[wasm_name = 7]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
         });
 
         assert_eq!(messages.len(), 2, "{messages:?}");
@@ -733,7 +1017,7 @@ mod tests {
         let messages = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> { Ok([0; 4]) }
+            fn get_ledger_sqn(&self) -> HostResult<i32> { Ok(0) }
         });
 
         assert_eq!(messages.len(), 1, "{messages:?}");
@@ -745,7 +1029,7 @@ mod tests {
         let parameter = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn<T>(&self) -> HostResult<T>;
+            fn get_ledger_sqn<T>(&self) -> HostResult<i32>;
         });
         assert_eq!(parameter.len(), 1, "{parameter:?}");
         assert!(
@@ -756,7 +1040,7 @@ mod tests {
         let clause = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> where Self: Sized;
+            fn get_ledger_sqn(&self) -> HostResult<i32> where Self: Sized;
         });
         assert_eq!(clause.len(), 1, "{clause:?}");
     }
@@ -766,7 +1050,7 @@ mod tests {
         let messages = messages(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn() -> HostResult<[u8; 4]>;
+            fn get_ledger_sqn(out: &mut [u8]) -> HostResult<usize>;
         });
 
         assert_eq!(messages.len(), 1, "{messages:?}");
@@ -790,7 +1074,7 @@ mod tests {
             let function: TraitItemFn = syn::parse2(quote! {
                 #[gas = 60]
                 #[wasm_name = "ldgr_index"]
-                fn get_ledger_sqn(#receiver) -> HostResult<[u8; 4]>;
+                fn get_ledger_sqn(#receiver) -> HostResult<i32>;
             })
             .unwrap_or_else(|_| panic!("`{receiver}` should parse"));
 
@@ -838,7 +1122,7 @@ mod tests {
         let parsed = ParsedHostFunction::parse(parse_quote! {
             #[gas = 60]
             #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> xrpl_host_functions::HostResult<[u8; 4]>;
+            fn get_ledger_sqn(&self) -> xrpl_host_functions::HostResult<i32>;
         })
         .unwrap();
 
@@ -846,7 +1130,7 @@ mod tests {
             parsed
                 .trait_method()
                 .to_string()
-                .contains("xrpl_host_functions :: HostResult < [u8 ; 4] >"),
+                .contains("xrpl_host_functions :: HostResult < i32 >"),
             "{}",
             parsed.trait_method()
         );

crates/xrpl-host-functions/Cargo.toml

@@ -5,3 +5,19 @@ edition.workspace = true
 
 [dependencies]
 xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"
+
+# `wasmi_glue!` and the two argument traits it marshals through are a host's
+# business, and this crate is what a contract links against — so the feature is
+# what keeps `cargo doc` here showing a contract developer only the ABI. It costs
+# nothing either way: a `macro_rules!` is inert and a trait with no impls emits
+# nothing.
+#
+# `xrpl-wasm-vm` enables it and features unify across the graph, so the off
+# configuration is only ever checked by `cargo check -p xrpl-host-functions`,
+# which is in the loop in `tmp/notes/wasm-vm/testing.md` for that reason.
+[features]
+default = []
+wasmi_glue = []
+
+[lints]
+workspace = true