Merge remote-tracking branch 'upstream/release/3.4.x' into develop

Signed-off-by: JCW <a1q123456@users.noreply.github.com>
Co-authored-by: Vito <5780819+Tapanito@users.noreply.github.com>
Co-authored-by: Ed Hennis <ed@ripple.com>

.clang-tidy

@@ -5,7 +5,10 @@ Checks: "-*,
   -bugprone-exception-escape,
   -bugprone-implicit-widening-of-multiplication-result,
   -bugprone-narrowing-conversions,
+  -bugprone-signed-bitwise,
+  -bugprone-std-exception-baseclass,
   -bugprone-throwing-static-initialization,
+  -bugprone-unhandled-code-paths,
 
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-c-arrays,
@@ -14,6 +17,7 @@ Checks: "-*,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-avoid-non-const-global-variables,
   -cppcoreguidelines-c-copy-assignment-signature,
+  -cppcoreguidelines-explicit-constructor,
   -cppcoreguidelines-interfaces-global-init,
   -cppcoreguidelines-macro-usage,
   -cppcoreguidelines-missing-std-forward,
@@ -32,6 +36,7 @@ Checks: "-*,
   llvm-namespace-comment,
 
   misc-*,
+  -misc-explicit-constructor,
   -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
@@ -45,6 +50,8 @@ Checks: "-*,
   -modernize-avoid-c-style-cast,
   -modernize-return-braced-init-list,
   -modernize-use-integer-sign-comparison,
+  -modernize-use-string-view,
+  -modernize-use-structured-binding,
   -modernize-use-trailing-return-type,
 
   performance-*,
@@ -53,6 +60,7 @@ Checks: "-*,
   -performance-noexcept-move-constructor,
   -performance-unnecessary-copy-initialization,
   -performance-unnecessary-value-param,
+  -performance-use-std-move,
 
   readability-*,
   -readability-avoid-const-params-in-decls,
@@ -65,7 +73,11 @@ Checks: "-*,
   -readability-named-parameter,
   -readability-qualified-auto,
   -readability-redundant-access-specifiers,
+  -readability-redundant-nested-if,
+  -readability-redundant-qualified-alias,
   -readability-static-accessed-through-instance,
+  -readability-trailing-comma,
+  -readability-trivial-switch,
   -readability-uppercase-literal-suffix
   "
 # ---
@@ -81,6 +93,10 @@ CheckOptions:
   bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
   bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
 
+  # New in clang-tidy 23; disabled until the code is updated
+  misc-const-correctness.AnalyzeAutoVariables: false
+  misc-const-correctness.AnalyzeLambdas: false
+  misc-const-correctness.AnalyzeParameters: false
   misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/.*;openssl/obj_mac\\.h"
 
   readability-braces-around-statements.ShortStatementLines: 2

.cspell.config.yaml

@@ -255,6 +255,7 @@ words:
   - queuable
   - Raphson
   - rcflags
+  - reencrypted
   - replayer
   - repodata
   - repomd

.gersemi/definitions.cmake

@@ -108,3 +108,75 @@ endfunction()
 
 function(patch_nix_binary target)
 endfunction()
+
+function(rpcspec_generate_instantiations)
+    set(options)
+    set(oneValueArgs OUT_VAR VALUE_TYPE VIEW_HEADER INCLUDE_DIR)
+    set(multiValueArgs HANDLERS)
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()
+
+function(corrosion_import_crate)
+    set(options
+        ALL_FEATURES
+        NO_DEFAULT_FEATURES
+        NO_STD
+        NO_LINKER_OVERRIDE
+        NO_USES_TERMINAL
+        LOCKED
+        FROZEN
+    )
+    set(oneValueArgs MANIFEST_PATH PROFILE IMPORTED_CRATES)
+    set(multiValueArgs
+        CRATE_TYPES
+        CRATES
+        FEATURES
+        FLAGS
+        OVERRIDE_CRATE_TYPE
+    )
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()
+
+function(corrosion_set_env_vars target_name env_var)
+endfunction()
+
+function(corrosion_add_cxxbridge cxx_target)
+    set(options)
+    set(oneValueArgs CRATE)
+    set(multiValueArgs FILES)
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()
+
+function(_unlink_libgcc_s crate)
+endfunction()
+
+function(add_xrpl_crate name)
+    set(options)
+    set(oneValueArgs CRATE)
+    set(multiValueArgs FILES)
+    cmake_parse_arguments(
+        THIS_FUNCTION_PREFIX
+        "${options}"
+        "${oneValueArgs}"
+        "${multiValueArgs}"
+        ${ARGN}
+    )
+endfunction()

.git-blame-ignore-revs

@@ -5,6 +5,18 @@
 # This file is sorted in reverse chronological order, with the most recent commits at the top.
 # The commits listed here are ignored by git blame, which is useful for formatting-only commits that would otherwise obscure the history of changes to a file.
 
+# chore: CamelCase for typedef/using in `clang-tidy` (#8177)
+97a1824537d20d82d25bf151a37a7a4532ebf085
+# chore: Rename CamelCase namespaces to snake_case (#7933)
+06488c1318d96f56d0536251bee08ac85fa7fdd3
+# style: Unify style for all Doxygen comments (#7776)
+73b6852a122854140336e6e6bc30a3a4b41aa5fd
+# style: More clang-tidy identifier renaming (#7290)
+a830ab10efed8d3e59ef2fc15d66efdf9c6bb0d8
+# refactor: Rename static constants (#7120)
+5b6e8b6f93b19c1e3f6a3467a25639031d9d9a53
+# chore: More fixes for bad renames (#7092)
+7afdd71a54d562b32a50b29a5aa00bb997dc9053
 # refactor: Enable clang-tidy `readability-identifier-naming` check (#6571)
 8995564ed6b9e453e144bb663303072a3c1ba305
 # refactor: Enable remaining clang-tidy `cppcoreguidelines` checks (#6538)

.github/actions/build-deps/action.yml

@@ -15,9 +15,9 @@ inputs:
     required: false
     default: "false"
   log_verbosity:
-    description: "The logging verbosity."
+    description: 'The logging verbosity ("quiet", "verbose"), or empty to use the Conan defaults.'
     required: false
-    default: "verbose"
+    default: ""
   sanitizers:
     description: "The sanitizers to enable."
     required: false
@@ -35,6 +35,16 @@ runs:
         LOG_VERBOSITY: ${{ inputs.log_verbosity }}
         SANITIZERS: ${{ inputs.sanitizers }}
       run: |
+        # By default, leave the verbosity unset, so CMake configure output is
+        # shown, but compile commands and Boost's b2 debug output (~85k lines
+        # when "verbose") are not.
+        VERBOSITY_ARGS=()
+        if [[ -n "${LOG_VERBOSITY}" ]]; then
+            VERBOSITY_ARGS=(
+                --conf:all tools.build:verbosity="${LOG_VERBOSITY}"
+                --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}"
+            )
+        fi
         conan install \
             --profile:all ci \
             --build="${BUILD_OPTION}" \
@@ -42,6 +52,13 @@ runs:
             --options:host='&:xrpld=True' \
             --settings:all build_type="${BUILD_TYPE}" \
             --conf:all tools.build:jobs=${BUILD_NPROC} \
-            --conf:all tools.build:verbosity="${LOG_VERBOSITY}" \
-            --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}" \
-            .
+            "${VERBOSITY_ARGS[@]}" \
+            --format=json \
+            . >"${RUNNER_TEMP}/conan-graph.json"
+
+    # Tools that run during the build may only load glibc from the Nix store,
+    # as their package ID survives a GCC runtime update.
+    - name: Check build-context packages for Nix store dependencies (Linux)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      run: ./bin/nix/check-build-context-runtime.sh "${RUNNER_TEMP}/conan-graph.json"

.github/scripts/levelization/results/ordering.txt

@@ -194,7 +194,6 @@ tests.libxrpl > xrpl.resource
 tests.libxrpl > xrpl.server
 tests.libxrpl > xrpl.shamap
 tests.libxrpl > xrpl.tx
-tests.xrpld > xrpld.app
 tests.xrpld > xrpld.rpc
 tests.xrpld > xrpl.json
 tests.xrpld > xrpl.protocol

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-060957e",
+  "image_tag": "sha-3d526d4",
   "configs": {
     "ubuntu": [
       {
@@ -74,7 +74,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd"
         }
       },
       {
@@ -86,7 +86,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd",
           "variant": "assert"
         }
       }
@@ -101,7 +101,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-3a2d19f"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-e6055dd"
         }
       }
     ]

.github/workflows/build-nix-images.yml

@@ -12,8 +12,7 @@ on:
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
-      - "bin/default-loader-path.sh"
-      - "bin/install-sanitizer-libs.sh"
+      - "bin/nix/default-loader-path.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"
@@ -25,8 +24,8 @@ on:
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
-      - "bin/install-sanitizer-libs.sh"
+      - "bin/nix/default-loader-path.sh"
+      - "bin/install/sanitizer-libs.sh"
   workflow_dispatch:
 
 concurrency:

.github/workflows/build-packaging-images.yml

@@ -5,13 +5,12 @@ on:
     branches:
       - develop
     paths:
-      - ".github/workflows/build-packaging-images.yml"
-      - "bin/install-packaging-tools.sh"
+      - "bin/install/packaging-tools.sh"
       - "package/images/packaging/**"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install-packaging-tools.sh"
+      - "bin/install/packaging-tools.sh"
       - "package/images/packaging/**"
   workflow_dispatch:
 

.github/workflows/build-pre-commit-image.yml

@@ -5,7 +5,6 @@ on:
     branches:
       - develop
     paths:
-      - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
       - "rust-toolchain.toml"
   pull_request:

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/on-pr.yml

@@ -93,9 +93,8 @@ jobs:
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
-            bin/check-nix-store-refs.sh
             bin/check-tools.sh
-            bin/default-loader-path.sh
+            bin/nix/**
             cfg/**
             cmake/**
             conan/**

.github/workflows/on-trigger.yml

@@ -31,9 +31,8 @@ on:
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
-      - "bin/check-nix-store-refs.sh"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
+      - "bin/nix/**"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"

.github/workflows/pre-commit.yml

@@ -17,4 +17,4 @@ jobs:
     uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-70b8fd3" }'

.github/workflows/publish-docs.yml

@@ -41,7 +41,7 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-build-test-config.yml

@@ -186,9 +186,6 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ inputs.build_type }}
-          # Set the verbosity to "quiet" for Windows to avoid an excessive
-          # amount of logs. For other OSes, the "verbose" logs are more useful.
-          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ inputs.sanitizers }}
 
       - name: Configure CMake
@@ -257,20 +254,20 @@ jobs:
       # cache included, since what it holds is what gets uploaded and reused.
       - name: Check the build output for Nix store references (Nix toolchain)
         if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"
+        run: ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}"
 
       - name: Check the Conan cache for Nix store references (Nix toolchain)
         if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
 
       # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
       # images always references the store. Same condition it uses.
       - name: Check for Nix store references (Linux)
         if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
         run: |
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
+          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
+          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
 
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}

.github/workflows/reusable-clang-tidy.yml

@@ -34,7 +34,7 @@ jobs:
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3d526d4"
     permissions:
       contents: read
       issues: write
@@ -73,7 +73,6 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ env.BUILD_TYPE }}
-          log_verbosity: verbose
 
       - name: Configure CMake
         working-directory: ${{ env.BUILD_DIR }}

.github/workflows/reusable-rust.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +70,7 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}

.github/workflows/upload-conan-deps.yml

@@ -108,14 +108,11 @@ jobs:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ matrix.build_type }}
           force_build: ${{ github.event_name == 'schedule' || github.event.inputs.force_source_build == 'true' }}
-          # Set the verbosity to "quiet" for Windows to avoid an excessive
-          # amount of logs. For other OSes, the "verbose" logs are more useful.
-          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
       - name: Check the Conan cache for Nix store references (Nix toolchain)
         if: ${{ matrix.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}

.pre-commit-config.yaml

@@ -60,7 +60,7 @@ repos:
         types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: e2b496dc2bd8340c2524cb9a2d2a943cde1bb6df # frozen: v23.1.1
+    rev: a9a8a861f30ed207ead7d5a3b7e8032283ba5da7 # frozen: v23.1.2
     hooks:
       - id: clang-format
         args: [--style=file]
@@ -82,9 +82,10 @@ repos:
         files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: f1c4833f8cf23c6d952673abc73525411a5719e8 # frozen: 0.29.1
+    rev: 28010ddd6016e1a0f7bd232acb6536ef996ae897 # frozen: 0.29.2
     hooks:
       - id: gersemi
+        args: [-i, --warnings-as-errors]
 
   - repo: https://github.com/rbubley/mirrors-prettier
     rev: ef4a397f916211b4a39ccf9d3d9cbb6562157251 # frozen: v3.9.9
@@ -95,19 +96,19 @@ repos:
   # Scoped to package/: the rest of the repo's Python has pre-existing findings,
   # so widening these is its own change.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: a56c0b927e6465d37cae3e97d35d4d18ab2b96cd # frozen: v0.16.9
+    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253 # frozen: v0.16.10
     hooks:
       - id: ruff-check
         args: [--fix]
         files: ^package/.*\.py$
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
+    rev: 96ae3e5802f3fe2d551e703e18f0a367d1a81ac2 # frozen: 26.10.0
     hooks:
       - id: black
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee # frozen: v2.3.1
+    rev: 2834ec6639549dd6796205c8f011dedcd587288b # frozen: v2.4.0
     hooks:
       - id: mypy
         args: [--strict]

API-CHANGELOG.md

@@ -28,7 +28,17 @@ Version 3.5.0 is not yet released.
 
 ### Additions in 3.5.0
 
-- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive a message with `type` `mptTransaction` for each validated transaction whose metadata affects a subscribed issuance; the message has the same fields as the `transactions` stream. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
+- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive the same `transaction` message as the `transactions` stream for each validated transaction whose metadata affects a subscribed issuance. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
+- `ledger_entry`: Add full support for checks, NFT offers, payment channels, and signer lists. ([#6319](https://github.com/XRPLF/rippled/pull/6319))
+
+### Bugfixes in 3.5.0
+
+- `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
+- `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
+
+### Bugfixes in 3.5.0
+
+- `feature`: The admin-only `vetoed` field now returns `invalidParams` unless its value is a boolean. [#7583](https://github.com/XRPLF/rippled/pull/7583)
 
 ## XRP Ledger server version 3.4.0
 
@@ -50,6 +60,7 @@ Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta
 - `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 - `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
 - `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
+- `transaction_entry`: An object or an array in `tx_hash` now returns `malformedRequest`, like any other value that is not a hex hash, instead of an `internal` error.
 
 ## XRP Ledger server version 3.3.0
 

bin/check-tools.sh

@@ -20,9 +20,11 @@
 # development setups, but not in the macOS CI environment. They are checked
 # everywhere except when running in CI on macOS.
 #
-# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
-# `g++-15`, ...) are probed under both names: a suffixed name can break while
-# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
+# Tools that Nix also exposes under a version-suffixed name
+# (`clang-tidy-<v>`, `g++-<v>`, ...) are probed under both names:
+# a suffixed name can break while the plain one still works
+# (see mkVersionedToolLinks in nix/packages.nix).
+# The suffix is the major version of the plain `clang` / `gcc` on PATH.
 #
 # Tools scoped to a single dev shell rather than to commonPackages are checked
 # only in that shell, keyed off XRPL_DEVSHELL.
@@ -34,9 +36,16 @@
 
 set -uo pipefail
 
-# Version suffixes of the Nix tool links, tracking nix/packages.nix.
-gcc_version=15
-llvm_version=22
+# major_version <compiler>
+# Major version of a compiler on PATH, or "unknown" when it isn't there.
+major_version() {
+    local version
+    version="$("$1" -dumpversion 2>/dev/null)" || version=""
+    version="${version%%.*}"
+    printf '%s' "${version:-unknown}"
+}
+
+llvm_version="$(major_version clang)"
 
 missing=()
 checked=0
@@ -112,6 +121,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check ClangBuildAnalyzer
     check curl
     check file
+    check jq
     check less
     check make
     # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
@@ -180,6 +190,7 @@ fi
 if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
+    gcc_version="$(major_version gcc)"
     check gcc
     check "gcc-${gcc_version}"
     check g++

bin/nix/check-build-context-runtime.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Fail if a binary of a build-context Conan package loads anything from the Nix
+# store other than glibc, or cannot resolve a library at all.
+#
+# Only binaries linked by the Nix toolchain are checked, i.e. those recording a
+# store path as their interpreter or RUNPATH. Prebuilt upstream binaries (such
+# as the ones the cmake package ships) use the system loader instead.
+#
+# Build-context packages provide the tools that run during the build (protoc,
+# grpc_cpp_plugin, ...). Their package ID does not change when a Nix toolchain
+# update moves the GCC runtime to a new store path, so a cached binary has to
+# get by with the pinned glibc alone. See docs/build/nix.md.
+#
+# Usage: bin/nix/check-build-context-runtime.sh <graph.json>
+#   <graph.json> is the output of `conan install --format=json`.
+
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+    echo "usage: $0 <graph.json>" >&2
+    exit 2
+fi
+
+if [ "$(uname -s)" != "Linux" ]; then
+    echo "$0: Linux only" >&2
+    exit 2
+fi
+
+folders="$(jq -r '.graph.nodes[] | select(.context == "build" and .package_folder) | .package_folder' "$1" | sort -u)"
+
+checked=0
+failed=0
+
+while IFS= read -r file; do
+    case "$(file -b "${file}")" in
+        ELF*) ;;
+        *) continue ;;
+    esac
+    [[ "$(readelf -ldW "${file}")" == */nix/store/* ]] || continue
+    checked=$((checked + 1))
+
+    # `ldd` lists the interpreter and every library as the loader resolves them.
+    if deps="$(ldd "${file}" 2>&1)"; then
+        bad="$(printf '%s\n' "${deps}" |
+            grep -E 'not found|/nix/store/' |
+            grep -vE '/nix/store/[^/]+-glibc-[^/]+/' || true)"
+    else
+        case "${deps}" in
+            *"not a dynamic executable"*) continue ;;
+        esac
+        bad="${deps}"
+    fi
+    if [ -n "${bad}" ]; then
+        failed=$((failed + 1))
+        echo "::error file=${file}::loads a library from the Nix store other than glibc"
+        echo "${file}"
+        echo "${bad}" | sed 's/^/    /'
+    fi
+done < <(
+    # shellcheck disable=SC2086 # one folder per line, no spaces in Conan paths
+    [ -z "${folders}" ] || find ${folders} -type f \( -perm -u+x -o -name '*.so*' \)
+)
+
+echo "Build-context packages: checked ${checked} binaries, ${failed} failed."
+[ "${failed}" -eq 0 ]

bin/nix/check-nix-store-refs.sh

@@ -10,7 +10,7 @@
 # alone; the scripts in a Conan cache are all git hook samples and autotools
 # scratch, 36 false positives to 0 real.
 #
-# Usage: bin/check-nix-store-refs.sh <path>
+# Usage: bin/nix/check-nix-store-refs.sh <path>
 
 set -euo pipefail
 

bin/pre-commit/Dockerfile

@@ -23,7 +23,7 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF
 
-ARG PRE_COMMIT_VERSION=4.6.0
+ARG PRE_COMMIT_VERSION=4.6.2
 RUN pip install --no-cache --break-system-packages \
     pre-commit==${PRE_COMMIT_VERSION}
 

bin/pre-commit/clang_tidy_check.py

@@ -26,8 +26,6 @@ import sys
 import tempfile
 from pathlib import Path
 
-CLANG_TIDY_VERSION = 22
-
 # Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
 # the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
 # compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
@@ -39,8 +37,21 @@ TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}
 FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
 
 
-def find_tool(name: str) -> str | None:
-    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
+def clang_tidy_major() -> str | None:
+    """Major version of the `clang-tidy` on PATH, which run-clang-tidy invokes."""
+    if not (clang_tidy := shutil.which("clang-tidy")):
+        return None
+    output = subprocess.run(
+        [clang_tidy, "--version"], capture_output=True, text=True
+    ).stdout
+    m = re.search(r"LLVM version (\d+)", output)
+    return m.group(1) if m else None
+
+
+def find_tool(name: str, version: str | None) -> str | None:
+    """Prefer `<name>-<version>`, so a host tool of another version can't win."""
+    candidates = ([f"{name}-{version}"] if version else []) + [name]
+    for candidate in candidates:
         if path := shutil.which(candidate):
             return path
     return None
@@ -103,8 +114,9 @@ def main():
     if not files:
         return 0
 
-    run_clang_tidy = find_tool("run-clang-tidy")
-    clang_apply_replacements = find_tool("clang-apply-replacements")
+    version = clang_tidy_major()
+    run_clang_tidy = find_tool("run-clang-tidy", version)
+    clang_apply_replacements = find_tool("clang-apply-replacements", version)
     missing = [
         name
         for name, path in (
@@ -114,9 +126,10 @@ def main():
         if not path
     ]
     if missing:
+        tried = f" (tried the '-{version}' suffix too)" if version else ""
         print(
             f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
-            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
+            f"was not found in PATH{tried}.",
             file=sys.stderr,
         )
         return 1

cmake/PatchNixBinary.cmake

@@ -17,7 +17,7 @@
    (runtime libraries resolved through the rpath) are skipped too.
    Everywhere else `patch_nix_binary` is a no-op.
 
-   The default loader is resolved by bin/default-loader-path.sh.
+   The default loader is resolved by bin/nix/default-loader-path.sh.
 #]===================================================================]
 
 include_guard(GLOBAL)
@@ -25,7 +25,7 @@ include_guard(GLOBAL)
 include(CompilationEnv)
 
 # Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/nix/default-loader-path.sh")
 
 if(
     is_linux

cmake/XrplCore.cmake

@@ -292,6 +292,14 @@ if(xrpld)
     )
     target_sources(xrpld PRIVATE ${sources})
 
+    rpcspec_generate_instantiations(
+        OUT_VAR rpcspec_instantiations
+        VALUE_TYPE "::json::Value"
+        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
+        HANDLERS book_changes ledger transaction_entry
+    )
+    target_sources(xrpld PRIVATE ${rpcspec_instantiations})
+
     if(tests)
         file(
             GLOB_RECURSE sources
@@ -322,6 +330,7 @@ if(xrpld)
         # antithesis_instrumentation.h, which is not exported as INTERFACE
         target_include_directories(
             xrpld
+            SYSTEM
             PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
         )
     endif()

cmake/XrplSanitizers.cmake

@@ -77,19 +77,24 @@ if(is_clang)
     message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()
 
-# Define SANITIZERS macro for BuildInfo.cpp
+# Define the SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN,
+# XRPL_TSAN and XRPL_UBSAN per active sanitizer, so that code can test for a
+# specific one with #ifdef instead of parsing the dot-joined SANITIZERS string.
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
     set(enable_asan ON)
     list(APPEND sanitizers_list "ASAN")
+    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
     set(enable_tsan ON)
     list(APPEND sanitizers_list "TSAN")
+    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
     set(enable_ubsan ON)
     list(APPEND sanitizers_list "UBSAN")
+    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()
 
 if(sanitizers_list)

conan.lock

@@ -3,7 +3,7 @@
     "requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.19#870b2d3abcfbbf13b61c2d3c69495060%1790348286.187549",
+        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
         "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
         "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -20,7 +20,7 @@
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#b87796a4269034856cbc1a2522db16eb%1788275071.530512",
+        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
         "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1785888854.601666",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
@@ -34,11 +34,15 @@
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
+        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
         "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
+        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",

conan/global.conf

@@ -3,5 +3,13 @@
 core:non_interactive=True
 core.download:parallel={{ os.cpu_count() }}
 core.upload:parallel={{ os.cpu_count() }}
-tools.files.download:retry=5
+# Fall back to Conan Center's source backups when a recipe's upstream URL is down
+# (e.g. the GNU FTP mirrors), see
+# https://github.com/conan-io/conan-center-index/issues/28147#issuecomment-3183544772
+# The backups are only tried once every upstream URL has used up its retries,
+# so keep the retries low.
+core.sources:download_urls=["origin", "https://c3i.jfrog.io/artifactory/conan-center-backup-sources"]
+tools.files.download:retry=1
 tools.files.download:retry_wait=10
+# Fail fast on unreachable hosts (default connect timeout is 30s), keep the 60s read timeout.
+core.net.http:timeout=(5, 60)

conan/profiles/default

@@ -29,9 +29,9 @@ os.version={{ min_macos_version }}
 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
 {# Instead it hand-rolls the compiler for user-config.jam, #}
-{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
-{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
-{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-<major>`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-<major>` suffix), #}
+{# so on a host that also has a system `g++-<major>` the probe escapes Nix #}
 {# and picks the system compiler, which is mismatched with the Nix libraries #}
 {# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
 {# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
@@ -49,8 +49,31 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
 
-{% if os == "Macos" %}
+{% if os == "Linux" and context == "build" %}
+{# Build-context executables (protoc, grpc_cpp_plugin, build tools) run during the build #}
+{# and would otherwise load libstdc++/libgcc from a Nix store path #}
+{# that might change with a Nix toolchain update. #}
+{# --as-needed drops the ones they link but don't use, #}
+{# such as libatomic for grpc_cpp_plugin on arm64. #}
+{% set static_runtime_flags = ["-static-libstdc++", "-static-libgcc", "-Wl,--as-needed"] %}
+tools.build:exelinkflags+={{ static_runtime_flags }}
+tools.info.package_id:confs+=["tools.build:exelinkflags"]
+{% endif %}
+
+{% if os == "Linux" and context == "build" %}
+{# b2 links itself with its own script, which ignores exelinkflags #}
+{# and only takes CXXFLAGS when use_cxx_env is set (see [buildenv] below). #}
+[options]
+b2/*:use_cxx_env=True
+{% endif %}
+
 [buildenv]
+{# gRPC emits thousands of compiler warnings that we cannot act on. #}
+{# CMake picks up CXXFLAGS, and unlike tools.build:cxxflags, #}
+{# this is not part of the package ID, so binaries stay shareable. #}
+grpc/*:CXXFLAGS=-w
+
+{% if os == "Macos" %}
 {# os.version adds -mmacosx-version-min to compiler command lines, #}
 {# but Boost.Context's b2 assembly (.S) rule ignores it, #}
 {# so those objects keep the host SDK version and still warn at link time. #}
@@ -58,3 +81,7 @@ tools.info.package_id:confs+=["user.package:cppstd_version"]
 {# Scoped to boost/* since it is the only gap. #}
 boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
 {% endif %}
+
+{% if os == "Linux" and context == "build" %}
+b2/*:CXXFLAGS={{ static_runtime_flags | join(" ") }}
+{% endif %}

conan/profiles/sanitizers

@@ -5,6 +5,9 @@ include(default)
 
 {% if not sanitizers %}
 {# Sanitizers not configured; no additional settings needed #}
+{% elif context == "build" %}
+{# Build-context packages are tools we run, not code we test, #}
+{# so don't instrument them #}
 {% else %}
 
 {% if compiler == "msvc" %}

conanfile.py

@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
         "nudb/2.0.9",
         "openssl/3.6.3",
         "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.19",
+        "xrpl-rpc-spec/0.1.21",
         "zlib/1.3.2",
     ]
 
@@ -49,7 +49,8 @@ class Xrpl(ConanFile):
     ]
 
     tool_requires = [
-        "protobuf/6.33.5",
+        "grpc/<host_version>",
+        "protobuf/<host_version>",
     ]
 
     default_options = {
@@ -123,6 +124,10 @@ class Xrpl(ConanFile):
         "xxhash/*:shared": False,
     }
 
+    # default_options only reach the host context;
+    # give tool_requires (and their dependencies) the same dependency options.
+    default_build_options = {k: v for k, v in default_options.items() if "/" in k}
+
     def set_version(self):
         self.version = self.version or DEV_VERSION
 
@@ -149,7 +154,7 @@ class Xrpl(ConanFile):
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
-        "bin/default-loader-path.sh",
+        "bin/nix/default-loader-path.sh",
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",

crates/CMakeLists.txt

@@ -80,13 +80,12 @@ function(add_xrpl_crate name)
     # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
     # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
     if(is_msvc)
-        corrosion_set_env_vars(
-            ${ARG_CRATE}
-            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
-        )
+        corrosion_set_env_vars(${ARG_CRATE} "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>")
     endif()
-    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
-                            ${ARG_FILES}
+    corrosion_add_cxxbridge(
+        ${name}_cxxbridge
+        CRATE ${ARG_CRATE}
+        FILES ${ARG_FILES}
     )
     # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
     # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the

docs/build/environment.md

@@ -10,14 +10,15 @@ This document explains how to set one up.
 support it — see [compiler support for C++23][cpp23-support].
 The versions currently tested in CI are:
 
-| Compiler    | Version            |
-| ----------- | ------------------ |
-| GCC         | 15.2               |
-| Clang       | 22                 |
-| Apple Clang | 21                 |
-| MSVC        | Visual Studio 2026 |
+| Compiler    | Version                         |
+| ----------- | ------------------------------- |
+| GCC         | `gccVersion` in [packages.nix]  |
+| Clang       | `llvmVersion` in [packages.nix] |
+| Apple Clang | 21                              |
+| MSVC        | Visual Studio 2026              |
 
-LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
+LLVM tools (`clang-tidy` and `clang-format`)
+come from the same LLVM release as Clang.
 
 ### Older compilers
 
@@ -156,3 +157,4 @@ version out of the box — run it via `run-clang-tidy`. No separate installation
 is needed.
 
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
+[packages.nix]: ../../nix/packages.nix

docs/build/nix.md

@@ -183,24 +183,36 @@ at link or run time.
 > configuration CI covers, and no dependency binaries are published for it.
 
 This is checked rather than assumed.
-[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) takes one file
-or directory and fails if a binary under it resolves a store path at run time.
+[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) takes one
+file or directory and fails if a binary under it resolves a store path at run time.
 CI runs it over the build output and the Conan cache, and again in the upload job
 before anything is published. You can run it yourself:
 
 ```bash
-bin/check-nix-store-refs.sh build
-bin/check-nix-store-refs.sh ~/.conan2-nix
+bin/nix/check-nix-store-refs.sh build
+bin/nix/check-nix-store-refs.sh ~/.conan2-nix
 ```
 
 It works on Linux too, but asserts something narrower there: the toolchain always
-writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
-whose store is fixed for its lifetime, so that is fine. Only the binaries
-[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
-system loader have to be clean, and those are what CI checks:
+writes the store into `PT_INTERP` and `RUNPATH`. That is fine for the pinned
+glibc, whose path does not move, but not for the GCC runtime, which moves with
+every GCC update. So [`conan/profiles/default`](../../conan/profiles/default)
+links build-context packages, whose executables run during the build, with
+`-static-libstdc++ -static-libgcc -Wl,--as-needed`, and
+[`conan/profiles/sanitizers`](../../conan/profiles/sanitizers) does not
+instrument them. CI checks that they load nothing from the store but glibc, from
+the graph `conan install --format=json` writes:
 
 ```bash
-bin/check-nix-store-refs.sh build/xrpld
+bin/nix/check-build-context-runtime.sh graph.json
+```
+
+Only the binaries [`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake)
+retargets to the system loader have to be fully clean, and those are what CI
+checks:
+
+```bash
+bin/nix/check-nix-store-refs.sh build/xrpld
 ```
 
 ### The libresolv stub

docs/build/nix_troubleshooting.md

@@ -178,11 +178,11 @@ A binary stops starting after a `nix flake update`, or after
 dyld[57271]: Library not loaded: /nix/store/…-libresolv-93/lib/libresolv.9.dylib
 ```
 
-[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) finds the same
-thing without having to run anything, and names the file:
+[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) finds the
+same thing without having to run anything, and names the file:
 
 ```
-$ bin/check-nix-store-refs.sh ~/.conan2-nix
+$ bin/nix/check-nix-store-refs.sh ~/.conan2-nix
 ::error file=/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig::references the Nix store at run time
 /Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig
     /nix/store/p4lp3xq4imd1qzqh08x8vcq2zfhi7rca-libresolv-93/lib/libresolv.9.dylib

external/antithesis-sdk/CMakeLists.txt

@@ -6,7 +6,7 @@ project(antithesis-sdk-cpp VERSION 0.4.4 LANGUAGES CXX)
 add_library(antithesis-sdk-cpp INTERFACE antithesis_sdk.h)
 
 # Note, both sections below created by xrpld project
-target_include_directories(antithesis-sdk-cpp INTERFACE
+target_include_directories(antithesis-sdk-cpp SYSTEM INTERFACE
   $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
   $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
 )

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781173989,
-        "narHash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE=",
+        "lastModified": 1791130267,
+        "narHash": "sha256-1sjwcQMcgAbmiip/VivBSiK8p2bTkQGOvCuO7vnwfx4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c91a71d13451abc40eb9dae8910f972f979852f",
+        "rev": "9013764fcc0ea99fa16cf7aa7decf8a5c3889dd2",
         "type": "github"
       },
       "original": {
@@ -47,11 +47,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784611586,
-        "narHash": "sha256-OfqgY+0hp/zseZB7uyH0U8kIDPS4scZZCyAurEplvG0=",
+        "lastModified": 1791189933,
+        "narHash": "sha256-Y8eN7ki0Urx4Ojf4w1xSpWg8uk/3lJqK+E0Oth77rH0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "14f58845249f3552a89b07772626b8d3c632fa86",
+        "rev": "e60029353d0c48d216bc4b065168ccd4079c166f",
         "type": "github"
       },
       "original": {

include/xrpl/basics/MathUtilities.h

@@ -3,9 +3,84 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
 
 namespace xrpl {
 
+/**
+ * Add two signed 64-bit integers, returning std::nullopt when the exact
+ * mathematical sum is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedAdd(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
+        return std::nullopt;
+
+    return a + b;
+}
+
+/**
+ * Subtract two signed 64-bit integers, returning std::nullopt when the exact
+ * mathematical difference is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedSub(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
+        return std::nullopt;
+
+    return a - b;
+}
+
+static_assert(checkedAdd(0, 0) == 0);
+static_assert(checkedAdd(1, -1) == 0);
+static_assert(checkedAdd(-5, 2) == -3);
+static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::max(), 1).has_value());
+static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::min(), -1).has_value());
+static_assert(
+    checkedAdd(std::numeric_limits<std::int64_t>::max() - 1, 1) ==
+    std::numeric_limits<std::int64_t>::max());
+static_assert(
+    checkedAdd(
+        std::numeric_limits<std::int64_t>::min(),
+        std::numeric_limits<std::int64_t>::max()) == -1);
+static_assert(
+    checkedAdd(
+        std::numeric_limits<std::int64_t>::max(),
+        std::numeric_limits<std::int64_t>::min()) == -1);
+static_assert(
+    !checkedAdd(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::max())
+         .has_value());
+static_assert(
+    !checkedAdd(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::min())
+         .has_value());
+
+static_assert(checkedSub(0, 0) == 0);
+static_assert(checkedSub(1, 1) == 0);
+static_assert(checkedSub(-5, 2) == -7);
+static_assert(checkedSub(-5, -2) == -3);
+static_assert(!checkedSub(std::numeric_limits<std::int64_t>::min(), 1).has_value());
+static_assert(!checkedSub(std::numeric_limits<std::int64_t>::max(), -1).has_value());
+static_assert(
+    checkedSub(std::numeric_limits<std::int64_t>::min() + 1, 1) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(
+    checkedSub(-1, std::numeric_limits<std::int64_t>::max()) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(
+    !checkedSub(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::min())
+         .has_value());
+static_assert(
+    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
+         .has_value());
+
 /**
  * Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]

include/xrpl/basics/Number.h

@@ -110,10 +110,10 @@ static_assert(
  *
  * However, it does not have sufficient precision to represent the full integer
  * range of int64_t values (-2^63 to 2^63-1), which are needed for XRP and MPT
- * values. The implementation of SingleAssetVault, and LendingProtocol need to
- * represent those integer values accurately and precisely, both for the
- * STNumber field type, and for internal calculations. That necessitated the
- * "large" scale.
+ * values. The implementation of SingleAssetVault, LendingProtocol, and
+ * MPTokensV2 need to represent those integer values accurately and precisely,
+ * both for the STNumber field type, and for internal calculations. That
+ * necessitated the "large" scale.
  *
  * The "Large" scales are intended to represent all values that can be represented
  * by an STAmount - IOUs, XRP, and MPTs. It has a min value of 10^18, and a max
@@ -134,8 +134,8 @@ struct MantissaRange final
     // NOLINTBEGIN(readability-enum-initial-value)
     // The values don't matter, except for Large
     enum class MantissaScale {
-        // Small can be removed when either featureSingleAssetVault or featureLendingProtocol are
-        // retired
+        // Small can be removed when any of featureSingleAssetVault, featureLendingProtocol, or
+        // featureMPTokensV2 are retired
         Small,
         // LargeLegacy can be removed when fixCleanup3_2_0 is retired
         LargeLegacy,
@@ -311,10 +311,10 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  *
  * The mantissa range may be changed at runtime via setMantissaScale(). The
  * default mantissa range is "large". The range is updated whenever transaction
- * processing begins, based on whether SingleAssetVault or LendingProtocol are
- * enabled. If either is enabled, the mantissa range is set to "large". If not,
- * it is set to "small", preserving backward compatibility and correct
- * "amendment-gating".
+ * processing begins, based on whether SingleAssetVault, LendingProtocol, or
+ * MPTokensV2 are enabled. If any is enabled, the mantissa range is set to
+ * "large". If not, it is set to "small", preserving backward compatibility and
+ * correct "amendment-gating".
  *
  * It is extremely unlikely that any more calls to setMantissaScale() will be
  * needed outside of unit tests.
@@ -344,8 +344,8 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  * set/getMantissaScale() functions may be most appropriate. However, if the
  * test has anything to do with transaction processing, it should enable or
  * disable the amendments that control the mantissa range choice
- * (SingleAssetVault and LendingProtocol), and/or check if either of those
- * amendments are enabled to determine which result to expect.
+ * (SingleAssetVault, LendingProtocol, and MPTokensV2), and/or check if any of
+ * those amendments are enabled to determine which result to expect.
  */
 class Number final
 {

include/xrpl/basics/StringUtilities.h

@@ -36,7 +36,7 @@ template <typename T>
 concept SomeChar = std::same_as<std::remove_cvref_t<T>, int8_t> ||
     std::same_as<std::remove_cvref_t<T>, char> || std::same_as<std::remove_cvref_t<T>, uint8_t>;
 
-inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = []() {
+inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = [] {
     std::array<std::optional<int>, 256> t{};
 
     for (int i = 0; i < 10; ++i)

include/xrpl/basics/TaggedCache.ipp

@@ -783,7 +783,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this]() {
+    return std::thread([&, this] {
         int cacheRemovals = 0;
         int mapRemovals = 0;
 
@@ -863,7 +863,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this]() {
+    return std::thread([&, this] {
         // NOLINTBEGIN https://github.com/XRPLF/rippled/issues/7056
         int cacheRemovals = 0;
         int mapRemovals = 0;

include/xrpl/basics/partitioned_unordered_map.h

@@ -17,7 +17,7 @@
 namespace xrpl {
 
 template <typename Key>
-static std::size_t
+std::size_t
 extract(Key const& key)
 {
     return key;

include/xrpl/beast/container/detail/aged_ordered_container.h

@@ -1604,7 +1604,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
     requires(!IsBoostReverseIterator<Iterator>::value)
 {
-    unlinkAndDeleteElement(&*((pos++).iterator()));
+    unlinkAndDeleteElement(&*(pos++).iterator());
     return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }
 
@@ -1617,7 +1617,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
     requires(!IsBoostReverseIterator<Iterator>::value)
 {
     for (; first != last;)
-        unlinkAndDeleteElement(&*((first++).iterator()));
+        unlinkAndDeleteElement(&*(first++).iterator());
 
     return beast::detail::AgedContainerIterator<false, Iterator>(first.iterator());
 }

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -2404,7 +2404,7 @@ beast::detail::AgedContainerIterator<false, Iterator>
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::erase(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
 {
-    unlinkAndDeleteElement(&*((pos++).iterator()));
+    unlinkAndDeleteElement(&*(pos++).iterator());
     return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }
 
@@ -2424,7 +2424,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
     beast::detail::AgedContainerIterator<IsConst, Iterator> last)
 {
     for (; first != last;)
-        unlinkAndDeleteElement(&*((first++).iterator()));
+        unlinkAndDeleteElement(&*(first++).iterator());
 
     return beast::detail::AgedContainerIterator<false, Iterator>(first.iterator());
 }

include/xrpl/beast/hash/hash_append.h

@@ -390,7 +390,7 @@ void
 hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
     requires(IsContiguouslyHashable<Key, Hasher>::value)
 {
-    h(&(v.begin()), v.size() * sizeof(Key));
+    h(&v.begin(), v.size() * sizeof(Key));
 }
 // tuple
 

include/xrpl/beast/insight/HookImpl.h

@@ -8,7 +8,7 @@ namespace beast::insight {
 class HookImpl : public std::enable_shared_from_this<HookImpl>
 {
 public:
-    using HandlerType = std::function<void(void)>;
+    using HandlerType = std::function<void()>;
 
     virtual ~HookImpl() = 0;
 };

include/xrpl/beast/net/IPAddress.h

@@ -61,7 +61,7 @@ isMulticast(Address const& addr)
 inline bool
 isPrivate(Address const& addr)
 {
-    return (addr.is_v4()) ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
+    return addr.is_v4() ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
 }
 
 /**
@@ -70,7 +70,7 @@ isPrivate(Address const& addr)
 inline bool
 isPublic(Address const& addr)
 {
-    return (addr.is_v4()) ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
+    return addr.is_v4() ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
 }
 
 }  // namespace ip

include/xrpl/beast/type_name.h

@@ -34,7 +34,7 @@ typeName()
         name += " volatile";
     if (std::is_lvalue_reference_v<T>)
     {
-        name += "&";
+        name += '&';
     }
     else if (std::is_rvalue_reference_v<T>)
     {

include/xrpl/beast/unit_test/suite.h

@@ -20,7 +20,7 @@ namespace beast::unit_test {
 namespace detail {
 
 template <class String>
-static std::string
+std::string
 makeReason(String const& reason, char const* file, int line)
 {
     std::string s(reason);

include/xrpl/beast/unit_test/thread.h

@@ -47,8 +47,8 @@ public:
     template <class F, class... Args>
     explicit Thread(Suite& s, F&& f, Args&&... args) : s_(&s)
     {
-        std::function<void(void)> b = [f = std::forward<F>(f),
-                                       ... args = std::forward<Args>(args)]() mutable {
+        std::function<void()> b = [f = std::forward<F>(f),
+                                   ... args = std::forward<Args>(args)] mutable {
             std::invoke(f, args...);
         };
         t_ = std::thread(&Thread::run, this, std::move(b));
@@ -94,7 +94,7 @@ public:
 
 private:
     void
-    run(std::function<void(void)> f)
+    run(std::function<void()> f)
     {
         try
         {

include/xrpl/core/Coro.ipp

@@ -54,7 +54,7 @@ JobQueue::Coro::post()
     }
 
     // sp keeps 'this' alive
-    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()]() { resume(); }))
+    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()] { resume(); }))
     {
         return true;
     }
@@ -130,7 +130,7 @@ inline void
 JobQueue::Coro::join()
 {
     std::unique_lock<std::mutex> lk(mutexRun_);
-    cv_.wait(lk, [this]() { return !running_; });
+    cv_.wait(lk, [this] { return !running_; });
 }
 
 }  // namespace xrpl

include/xrpl/ledger/entries/AmendmentsEntry.h

@@ -1,11 +1,17 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/entries/SLEBase.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+
+#include <map>
+#include <set>
 
 namespace xrpl {
 
@@ -25,6 +31,52 @@ public:
         : Base(keylet::amendments(), view, j)
     {
     }
+
+    /**
+     * Returns the set of amendments this entry reports as enabled.
+     *
+     * @return the set of enabled amendments.
+     */
+    [[nodiscard]] std::set<UInt256>
+    enabledAmendments() const
+    {
+        std::set<UInt256> amendments;
+
+        if (this->exists() && (*this)->isFieldPresent(sfAmendments))
+        {
+            auto const& v = (*this)->getFieldV256(sfAmendments);
+            amendments.insert_range(v);
+        }
+
+        return amendments;
+    }
+
+    /**
+     * Returns a map of amendments that have achieved majority, to the time
+     * majority was reached.
+     *
+     * @return a map of amendment to the time majority was reached.
+     */
+    [[nodiscard]] std::map<UInt256, NetClock::time_point>
+    majorityAmendments() const
+    {
+        std::map<UInt256, NetClock::time_point> ret;
+
+        if (this->exists() && (*this)->isFieldPresent(sfMajorities))
+        {
+            using TimePoint = NetClock::time_point;
+            using Duration = TimePoint::duration;
+
+            auto const majorities = (*this)->getFieldArray(sfMajorities);
+
+            for (auto const& m : majorities)
+            {
+                ret[m.getFieldH256(sfAmendment)] = TimePoint(Duration(m.getFieldU32(sfCloseTime)));
+            }
+        }
+
+        return ret;
+    }
 };
 
 using AmendmentsEntryR = AmendmentsEntry<ReadView>;

include/xrpl/ledger/entries/LedgerHashesEntry.h

@@ -1,11 +1,17 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/entries/SLEBase.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STVector256.h>
+
+#include <cstddef>
+#include <optional>
 
 namespace xrpl {
 
@@ -25,6 +31,31 @@ public:
         : Base(keylet::skip(), view, j)
     {
     }
+
+    /**
+     * Looks up a hash `diff` slots back from the most recent entry in the
+     * sfHashes vector (diff == 0 is the most recent entry).
+     *
+     * Callers decide which skip list entry to read and how to translate a
+     * target ledger sequence into `diff`; this only does the bounds check
+     * and vector indexing shared by both the recent (stride 1) and distant
+     * (stride 256) skip lists.
+     *
+     * @param diff how many slots back from the most recent hash to look up;
+     * 0 is the most recent hash.
+     * @return the hash at that slot, or std::nullopt if the entry does not
+     * exist or `diff` is out of range.
+     */
+    [[nodiscard]] std::optional<UInt256>
+    hashAt(std::size_t diff) const
+    {
+        if (!this->exists())
+            return std::nullopt;
+        STVector256 const vec = (*this)->getFieldV256(sfHashes);
+        if (vec.size() > diff)
+            return vec[vec.size() - diff - 1];
+        return std::nullopt;
+    }
 };
 
 using LedgerHashesEntryR = LedgerHashesEntry<ReadView>;

include/xrpl/ledger/helpers/AMMHelpers.h

@@ -353,7 +353,7 @@ changeSpotPriceQuality(
         }
         if (auto const nTakerPaysPropose = (-b + root2(res)) / (2 * a); nTakerPaysPropose > 0)
         {
-            auto const nTakerPays = [&]() {
+            auto const nTakerPays = [&] {
                 // The fee might make the AMM offer quality less than CLOB
                 // quality. Therefore, AMM offer has to satisfy this constraint:
                 // o / i >= q. Substituting o with swapAssetIn() gives: i <= O /
@@ -372,8 +372,8 @@ changeSpotPriceQuality(
             auto const takerPays =
                 toAmount<TIn>(getAsset(pool.in), nTakerPays, Number::RoundingMode::Upward);
             // should not fail
-            if (auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
-                Quality{amounts} < quality &&
+            auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
+            if (Quality{amounts} < quality &&
                 !withinRelativeDistance(Quality{amounts}, quality, Number(1, -7)))
             {
                 JLOG(j.error()) << "changeSpotPriceQuality failed: " << to_string(pool.in) << " "
@@ -382,21 +382,19 @@ changeSpotPriceQuality(
                                 << " " << to_string(amounts.out);
                 Throw<std::runtime_error>("changeSpotPriceQuality failed");
             }
-            else
-            {
-                JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
-                                << to_string(pool.out) << " "
-                                << " " << quality << " " << tfee << " " << to_string(amounts.in)
-                                << " " << to_string(amounts.out);
-                return amounts;
-            }
+
+            JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
+                            << to_string(pool.out) << " "
+                            << " " << quality << " " << tfee << " " << to_string(amounts.in) << " "
+                            << to_string(amounts.out);
+            return amounts;
         }
         JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in) << " "
                         << to_string(pool.out) << " " << quality << " " << tfee;
         return std::nullopt;
     }
 
-    auto amounts = [&]() {
+    auto amounts = [&] {
         bool const inIntegral = getAsset(pool.in).integral();
         bool const outIntegral = getAsset(pool.out).integral();
 

include/xrpl/ledger/helpers/EscrowHelpers.h

@@ -2,8 +2,10 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
@@ -27,6 +29,291 @@
 
 namespace xrpl {
 
+/**
+ * Validate that @p account may lock @p amount of a token for later delivery
+ * to @p dest.
+ *
+ * The lock-side counterpart of escrowUnlockPreclaimHelper: every issuer
+ * control (locking opt-in, authorization, freeze/lock, transferability,
+ * spendable balance) that gates locking token value lives here, so any
+ * transactor that locks funds applies the same rules. The signature is
+ * view-based rather than PreclaimContext-based so it can also run from
+ * doApply.
+ */
+template <ValidIssueType T>
+TER
+escrowLockPreclaimHelper(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& dest,
+    STAmount const& amount,
+    beast::Journal j);
+
+template <>
+inline TER
+escrowLockPreclaimHelper<Issue>(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& dest,
+    STAmount const& amount,
+    beast::Journal j)
+{
+    auto const& issue = amount.get<Issue>();
+    auto const& issuer = amount.getIssuer();
+    // If the issuer is the same as the account, return tecNO_PERMISSION
+    if (issuer == account)
+        return tecNO_PERMISSION;
+
+    // If the lsfAllowTrustLineLocking is not enabled, return tecNO_PERMISSION
+    auto const sleIssuer = view.read(keylet::account(issuer));
+    if (!sleIssuer)
+        return tecNO_ISSUER;
+    if (!sleIssuer->isFlag(lsfAllowTrustLineLocking))
+        return tecNO_PERMISSION;
+
+    // If the account does not have a trustline to the issuer, return tecNO_LINE
+    auto const sleRippleState = view.read(keylet::trustLine(account, issuer, issue.currency));
+    if (!sleRippleState)
+        return tecNO_LINE;
+
+    STAmount const balance = (*sleRippleState)[sfBalance];
+
+    // If balance is positive, issuer must have higher address than account
+    if (balance > beast::kZero && issuer < account)
+        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
+
+    // If balance is negative, issuer must have lower address than account
+    if (balance < beast::kZero && issuer > account)
+        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
+
+    // If the issuer has requireAuth set, check if the account is authorized
+    if (auto const ter = requireAuth(view, issue, account); !isTesSuccess(ter))
+        return ter;
+
+    // If the issuer has requireAuth set, check if the destination is authorized
+    if (auto const ter = requireAuth(view, issue, dest); !isTesSuccess(ter))
+        return ter;
+
+    // If the issuer has frozen the account, return tecFROZEN
+    if (isFrozen(view, account, issue))
+        return tecFROZEN;
+
+    // If the issuer has frozen the destination, return tecFROZEN
+    if (isFrozen(view, dest, issue))
+        return tecFROZEN;
+
+    STAmount const spendableAmount =
+        accountHolds(view, account, issue.currency, issuer, FreezeHandling::IgnoreFreeze, j);
+
+    // If the balance is less than or equal to 0, return tecINSUFFICIENT_FUNDS
+    if (spendableAmount <= beast::kZero)
+        return tecINSUFFICIENT_FUNDS;
+
+    // If the spendable amount is less than the amount, return
+    // tecINSUFFICIENT_FUNDS
+    if (spendableAmount < amount)
+        return tecINSUFFICIENT_FUNDS;
+
+    // If the amount is not addable to the balance, return tecPRECISION_LOSS
+    if (!canAdd(spendableAmount, amount))
+        return tecPRECISION_LOSS;
+
+    return tesSUCCESS;
+}
+
+template <>
+inline TER
+escrowLockPreclaimHelper<MPTIssue>(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& dest,
+    STAmount const& amount,
+    beast::Journal j)
+{
+    AccountID const issuer = amount.getIssuer();
+    // If the issuer is the same as the account, return tecNO_PERMISSION
+    if (issuer == account)
+        return tecNO_PERMISSION;
+
+    // If the mpt does not exist, return tecOBJECT_NOT_FOUND
+    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
+    auto const sleIssuance = view.read(issuanceKey);
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    // If the lsfMPTCanEscrow is not enabled, return tecNO_PERMISSION
+    if (!sleIssuance->isFlag(lsfMPTCanEscrow))
+        return tecNO_PERMISSION;
+
+    // If the issuer is not the same as the issuer of the mpt, return
+    // tecNO_PERMISSION
+    if (sleIssuance->getAccountID(sfIssuer) != issuer)
+        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
+
+    // If the account does not have the mpt, return tecOBJECT_NOT_FOUND
+    if (!view.exists(keylet::mptoken(issuanceKey.key, account)))
+        return tecOBJECT_NOT_FOUND;
+
+    // If the issuer has requireAuth set, check if the account is
+    // authorized
+    auto const& mptIssue = amount.get<MPTIssue>();
+    if (auto const ter = requireAuth(view, mptIssue, account, AuthType::WeakAuth);
+        !isTesSuccess(ter))
+        return ter;
+
+    // If the issuer has requireAuth set, check if the destination is
+    // authorized
+    if (auto const ter = requireAuth(view, mptIssue, dest, AuthType::WeakAuth); !isTesSuccess(ter))
+        return ter;
+
+    // If the issuer has frozen the account, return tecLOCKED
+    if (isFrozen(view, account, *sleIssuance))
+        return tecLOCKED;
+
+    // If the issuer has frozen the destination, return tecLOCKED
+    if (isFrozen(view, dest, *sleIssuance))
+        return tecLOCKED;
+
+    // If the mpt cannot be transferred, return tecNO_AUTH
+    if (auto const ter = canTransfer(view, mptIssue, account, dest); !isTesSuccess(ter))
+        return ter;
+
+    STAmount const spendableAmount = accountHolds(
+        view,
+        account,
+        amount.get<MPTIssue>(),
+        FreezeHandling::IgnoreFreeze,
+        AuthHandling::IgnoreAuth,
+        j);
+
+    // If the balance is less than or equal to 0, return tecINSUFFICIENT_FUNDS
+    if (spendableAmount <= beast::kZero)
+        return tecINSUFFICIENT_FUNDS;
+
+    // If the spendable amount is less than the amount, return
+    // tecINSUFFICIENT_FUNDS
+    if (spendableAmount < amount)
+        return tecINSUFFICIENT_FUNDS;
+
+    return tesSUCCESS;
+}
+
+template <ValidIssueType T>
+TER
+escrowLockApplyHelper(
+    ApplyView& view,
+    AccountID const& issuer,
+    AccountID const& sender,
+    STAmount const& amount,
+    beast::Journal journal);
+
+template <>
+inline TER
+escrowLockApplyHelper<Issue>(
+    ApplyView& view,
+    AccountID const& issuer,
+    AccountID const& sender,
+    STAmount const& amount,
+    beast::Journal journal)
+{
+    // Defensive: Issuer cannot create an escrow
+    if (issuer == sender)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const ter =
+        directSendNoFee(view, sender, issuer, amount, !amount.holds<MPTIssue>(), journal);
+    if (!isTesSuccess(ter))
+        return ter;  // LCOV_EXCL_LINE
+    return tesSUCCESS;
+}
+
+template <>
+inline TER
+escrowLockApplyHelper<MPTIssue>(
+    ApplyView& view,
+    AccountID const& issuer,
+    AccountID const& sender,
+    STAmount const& amount,
+    beast::Journal journal)
+{
+    // Defensive: Issuer cannot create an escrow
+    if (issuer == sender)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const ter = lockEscrowMPT(view, sender, amount, journal);
+    if (!isTesSuccess(ter))
+        return ter;  // LCOV_EXCL_LINE
+    return tesSUCCESS;
+}
+
+template <ValidIssueType T>
+TER
+escrowUnlockPreclaimHelper(
+    ReadView const& view,
+    AccountID const& account,
+    STAmount const& amount,
+    bool checkFreeze = true);
+
+template <>
+inline TER
+escrowUnlockPreclaimHelper<Issue>(
+    ReadView const& view,
+    AccountID const& account,
+    STAmount const& amount,
+    bool checkFreeze)
+{
+    AccountID const& issuer = amount.getIssuer();
+    // If the issuer is the same as the account, return tesSUCCESS
+    if (issuer == account)
+        return tesSUCCESS;
+
+    // If the issuer has requireAuth set, check if the destination is authorized
+    if (auto const ter = requireAuth(view, amount.get<Issue>(), account); !isTesSuccess(ter))
+        return ter;
+
+    // If the issuer has deep frozen the destination, return tecFROZEN
+    if (checkFreeze &&
+        isDeepFrozen(view, account, amount.get<Issue>().currency, amount.getIssuer()))
+        return tecFROZEN;
+
+    return tesSUCCESS;
+}
+
+template <>
+inline TER
+escrowUnlockPreclaimHelper<MPTIssue>(
+    ReadView const& view,
+    AccountID const& account,
+    STAmount const& amount,
+    bool checkFreeze)
+{
+    AccountID const& issuer = amount.getIssuer();
+    // If the issuer is the same as the account, return tesSUCCESS
+    if (issuer == account)
+        return tesSUCCESS;
+
+    // If the mpt does not exist, return tecOBJECT_NOT_FOUND
+    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
+    auto const sleIssuance = view.read(issuanceKey);
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    // If the issuer has requireAuth set, check if the account is
+    // authorized
+    auto const& mptIssue = amount.get<MPTIssue>();
+    if (auto const ter = requireAuth(view, mptIssue, account, AuthType::WeakAuth);
+        !isTesSuccess(ter))
+        return ter;
+
+    // If the issuer has frozen the account, return tecLOCKED
+    if (checkFreeze && isFrozen(view, account, *sleIssuance))
+        return tecLOCKED;
+
+    return tesSUCCESS;
+}
+
+//------------------------------------------------------------------------------
+
 template <ValidIssueType T>
 TER
 escrowUnlockApplyHelper(
@@ -55,9 +342,6 @@ escrowUnlockApplyHelper<Issue>(
     bool createAsset,
     beast::Journal journal)
 {
-    auto const& issue = amount.get<Issue>();
-    Keylet const trustLineKey = keylet::trustLine(receiver, issue);
-    bool const recvLow = issuer > receiver;
     bool const senderIssuer = issuer == sender;
     bool const receiverIssuer = issuer == receiver;
 
@@ -67,6 +351,10 @@ escrowUnlockApplyHelper<Issue>(
     if (receiverIssuer)
         return tesSUCCESS;
 
+    auto const& issue = amount.get<Issue>();
+    Keylet const trustLineKey = keylet::trustLine(receiver, issue);
+    bool const recvLow = issuer > receiver;
+
     if (!ctx.view.exists(trustLineKey) && createAsset)
     {
         // Can the account cover the trust line's reserve?

include/xrpl/net/AutoSocket.h

@@ -103,7 +103,7 @@ public:
     void
     asyncHandshake(HandshakeType type, Callback cbFunc)
     {
-        if ((type == SslSocket::client) || (secure_))
+        if ((type == SslSocket::client) || secure_)
         {
             // must be ssl
             secure_ = true;

include/xrpl/nodestore/detail/EncodedBlob.h

@@ -67,7 +67,7 @@ class EncodedBlob
 
 public:
     explicit EncodedBlob(std::shared_ptr<NodeObject> const& obj)
-        : size_([&obj]() {
+        : size_([&obj] {
             XRPL_ASSERT(obj, "xrpl::node_store::EncodedBlob::EncodedBlob : non-null input");
 
             if (!obj)

include/xrpl/protocol/Book.h

@@ -55,7 +55,7 @@ hash_append(Hasher& h, Book const& b)
     using beast::hash_append;
     hash_append(h, b.in, b.out);
     if (b.domain)
-        hash_append(h, *(b.domain));
+        hash_append(h, *b.domain);
 }
 
 Book

include/xrpl/protocol/LedgerFormats.h

@@ -208,7 +208,10 @@ enum LedgerEntryType : std::uint16_t {
                                                                                                                                    \
     LEDGER_OBJECT(Sponsorship,                                                                                                     \
         LSF_FLAG(lsfSponsorshipRequireSignForFee, 0x00010000)                                                                      \
-        LSF_FLAG(lsfSponsorshipRequireSignForReserve, 0x00020000))
+        LSF_FLAG(lsfSponsorshipRequireSignForReserve, 0x00020000))                                                                 \
+                                                                                                                                   \
+    LEDGER_OBJECT(LoanBroker,                                                                                                      \
+        LSF_FLAG(lsfLoanBrokerPrivate, 0x00010000))
 
 // clang-format on
 

include/xrpl/protocol/LedgerShortcut.h

@@ -1,28 +0,0 @@
-#pragma once
-
-namespace xrpl {
-
-/**
- * @brief Enumeration of ledger shortcuts for specifying which ledger to use.
- *
- * These shortcuts provide a convenient way to reference commonly used ledgers
- * without needing to specify their exact hash or sequence number.
- */
-enum class LedgerShortcut {
-    /**
-     * The current working ledger (open, not yet closed)
-     */
-    Current,
-
-    /**
-     * The most recently closed ledger (may not be validated)
-     */
-    Closed,
-
-    /**
-     * The most recently validated ledger
-     */
-    Validated
-};
-
-}  // namespace xrpl

include/xrpl/protocol/STObject.h

@@ -457,9 +457,7 @@ private:
     // The remove_cv and remove_reference are necessitated by the STBitString
     // types.  Their value() returns by const ref.  We return those types
     // by value.
-    template <
-        typename T,
-        typename V = std::remove_cv_t<std::remove_reference_t<decltype(std::declval<T>().value())>>>
+    template <typename T, typename V = std::remove_cvref_t<decltype(std::declval<T>().value())>>
     V
     getFieldByValue(SField const& field) const;
 

include/xrpl/protocol/STValidation.h

@@ -188,7 +188,7 @@ private:
 template <class LookupNodeID>
 STValidation::STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, DeserializeOptions options)
     : STObject(validationFormat(), sit, sfValidation, options.requireCanonicalOrder)
-    , signingPubKey_([this]() {
+    , signingPubKey_([this] {
         auto const spk = getFieldVL(sfSigningPubKey);
 
         if (publicKeyType(makeSlice(spk)) != KeyType::Secp256k1)

include/xrpl/protocol/Serializer.h

@@ -252,7 +252,7 @@ public:
     {
         auto success = (offset + (Bits / 8)) <= data_.size();
         if (success)
-            memcpy(data.begin(), &(data_.front()) + offset, (Bits / 8));
+            memcpy(data.begin(), &data_.front() + offset, (Bits / 8));
         return success;
     }
 

include/xrpl/protocol/TER.h

@@ -449,7 +449,7 @@ public:
     // Trait tells the requires-clause which types are allowed for construction.
     template <typename T>
     constexpr TERSubset(T rhs)
-        requires(Trait<std::remove_cv_t<std::remove_reference_t<T>>>::value)
+        requires(Trait<std::remove_cvref_t<T>>::value)
         : code_(TERtoInt(rhs))
     {
     }

include/xrpl/protocol/TxFlags.h

@@ -226,6 +226,10 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfLoanUnimpair, 0x00040000),                                                                                                                   \
         MASK_ADJ(0))                                                                                                                                           \
                                                                                                                                                                \
+    TRANSACTION(LoanBrokerSet,                                                                                                                                 \
+        TF_FLAG(tfLoanBrokerPrivate, 0x00010000),                                                                                                              \
+        MASK_ADJ(0))                                                                                                                                           \
+                                                                                                                                                               \
     TRANSACTION(SponsorshipSet,                                                                                                                                \
         TF_FLAG(tfSponsorshipSetRequireSignForFee, 0x00010000)                                                                                                 \
         TF_FLAG(tfSponsorshipClearRequireSignForFee, 0x00020000)                                                                                               \
@@ -238,6 +242,12 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfSponsorshipEnd, 0x00010000)                                                                                                                  \
         TF_FLAG(tfSponsorshipCreate, 0x00020000)                                                                                                               \
         TF_FLAG(tfSponsorshipReassign, 0x00040000),                                                                                                            \
+        MASK_ADJ(0))                                                                                                                                          \
+                                                                                                                                                               \
+    TRANSACTION(ConfidentialMPTHolderKeyUpdate,                                                                                                                \
+        TF_FLAG(tfHolderKeyRotation, 0x00010000)                                                                                                               \
+        TF_FLAG(tfHolderKeyRecovery, 0x00020000)                                                                                                               \
+        TF_FLAG(tfCancelRecovery, 0x00040000),                                                                                                                 \
         MASK_ADJ(0))
 
 // clang-format on

include/xrpl/protocol/detail/features.macro

@@ -20,6 +20,7 @@ XRPL_FEATURE(SmartEscrow,                 Supported::No,  VoteBehavior::DefaultN
 XRPL_FEATURE(LendingProtocolV1_2,         Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_5_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ConfidentialMPTKeyRotation,  Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FIX    (BatchV1_2,                   Supported::Yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (Cleanup3_4_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -439,6 +439,7 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
     {sfIssuerKeyMirrorEpoch,        SoeOptional},
     {sfAuditorKeyMirrorEpoch,       SoeOptional},
     {sfHolderEncryptionKey,         SoeOptional},
+    {sfRecoveryKey,                 SoeOptional},
 }))
 
 /** A ledger object which tracks Oracle
@@ -548,6 +549,7 @@ LEDGER_ENTRY(ltLOAN_BROKER, 0x0088, LoanBroker, loan_broker, ({
     {sfCoverAvailable,       SoeDefault},
     {sfCoverRateMinimum,     SoeDefault},
     {sfCoverRateLiquidation, SoeDefault},
+    {sfDomainID,             SoeOptional},
 }))
 
 /** A ledger object representing a loan between a Borrower and a Loan Broker

include/xrpl/protocol/detail/sfields.macro

@@ -330,6 +330,7 @@ TYPED_SFIELD(sfAuditorEncryptionKey,        VL,     44)
 TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
 TYPED_SFIELD(sfBytecode,                    VL,     47)
+TYPED_SFIELD(sfRecoveryKey,                 VL,     48)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)

include/xrpl/protocol/detail/transactions.macro

@@ -900,6 +900,7 @@ TRANSACTION(ttLOAN_BROKER_SET, 74, LoanBrokerSet,
     {sfDebtMaximum, SoeOptional},
     {sfCoverRateMinimum, SoeOptional},
     {sfCoverRateLiquidation, SoeOptional},
+    {sfDomainID,             SoeOptional},
 }))
 
 /** This transaction deletes a Loan Broker */
@@ -1147,12 +1148,27 @@ TRANSACTION(ttCONFIDENTIAL_MPT_MIRROR_UPDATE, 92, ConfidentialMPTMirrorUpdate,
     {sfZKProof, SoeRequired},
 }))
 
+/** This transaction rotates or recovers a confidential MPT holder's ElGamal encryption key,
+    or cancels a recovery. */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/token/ConfidentialMPTHolderKeyUpdate.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MPT_HOLDER_KEY_UPDATE, 93, ConfidentialMPTHolderKeyUpdate,
+    ({.amendment = featureConfidentialMPTKeyRotation}),
+    ({
+    {sfMPTokenIssuanceID, SoeRequired},
+    {sfHolderEncryptionKey, SoeOptional},
+    {sfConfidentialBalanceSpending, SoeOptional},
+    {sfConfidentialBalanceInbox, SoeOptional},
+    {sfZKProof, SoeOptional},
+}))
+
 /** This transaction posts an unsigned transaction on-ledger as a
     TransactionProposal, pending multi-signature collection. */
 #if TRANSACTION_INCLUDE
 #   include <xrpl/tx/transactors/proposal/TransactionProposalCreate.h>
 #endif
-TRANSACTION(ttTRANSACTION_PROPOSAL_CREATE, 93, TransactionProposalCreate,
+TRANSACTION(ttTRANSACTION_PROPOSAL_CREATE, 95, TransactionProposalCreate,
     ({.amendment = featureCosign}),
     ({
     {sfProposedTransaction, SoeRequired},

include/xrpl/protocol_autogen/ledger_entries/LoanBroker.h

@@ -335,6 +335,30 @@ public:
     {
         return this->sle_->isFieldPresent(sfCoverRateLiquidation);
     }
+
+    /**
+     * @brief Get sfDomainID (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT256::type::value_type>
+    getDomainID() const
+    {
+        if (hasDomainID())
+            return this->sle_->at(sfDomainID);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfDomainID is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasDomainID() const
+    {
+        return this->sle_->isFieldPresent(sfDomainID);
+    }
 };
 
 /**
@@ -578,6 +602,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfDomainID (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    LoanBrokerBuilder&
+    setDomainID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
+    {
+        object_[sfDomainID] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the completed LoanBroker wrapper.
      * @param index The ledger entry index.

include/xrpl/protocol_autogen/ledger_entries/MPToken.h

@@ -339,6 +339,30 @@ public:
     {
         return this->sle_->isFieldPresent(sfHolderEncryptionKey);
     }
+
+    /**
+     * @brief Get sfRecoveryKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getRecoveryKey() const
+    {
+        if (hasRecoveryKey())
+            return this->sle_->at(sfRecoveryKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfRecoveryKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasRecoveryKey() const
+    {
+        return this->sle_->isFieldPresent(sfRecoveryKey);
+    }
 };
 
 /**
@@ -552,6 +576,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfRecoveryKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setRecoveryKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfRecoveryKey] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the completed MPToken wrapper.
      * @param index The ledger entry index.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTHolderKeyUpdate.h

@@ -0,0 +1,279 @@
+// This file is auto-generated. Do not edit.
+#pragma once
+
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/STParsedJSON.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol_autogen/TransactionBase.h>
+#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
+#include <xrpl/json/json_value.h>
+
+#include <stdexcept>
+#include <optional>
+
+namespace xrpl::transactions {
+
+class ConfidentialMPTHolderKeyUpdateBuilder;
+
+/**
+ * @brief Transaction: ConfidentialMPTHolderKeyUpdate
+ *
+ * Type: ttCONFIDENTIAL_MPT_HOLDER_KEY_UPDATE (93)
+ * Delegable: Delegation::NotDelegable
+ * Amendment: featureConfidentialMPTKeyRotation
+ * Privileges: Privilege::NoPriv
+ *
+ * Immutable wrapper around STTx providing type-safe field access.
+ * Use ConfidentialMPTHolderKeyUpdateBuilder to construct new transactions.
+ */
+class ConfidentialMPTHolderKeyUpdate : public TransactionBase
+{
+public:
+    static constexpr xrpl::TxType txType = ttCONFIDENTIAL_MPT_HOLDER_KEY_UPDATE;
+
+    /**
+     * @brief Construct a ConfidentialMPTHolderKeyUpdate transaction wrapper from an existing STTx object.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    explicit ConfidentialMPTHolderKeyUpdate(std::shared_ptr<STTx const> tx)
+        : TransactionBase(std::move(tx))
+    {
+        // Verify transaction type
+        if (tx_->getTxnType() != txType)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTHolderKeyUpdate");
+        }
+    }
+
+    // Transaction-specific field getters
+
+    /**
+     * @brief Get sfMPTokenIssuanceID (SoeRequired)
+     * @return The field value.
+     */
+    [[nodiscard]]
+    SF_UINT192::type::value_type
+    getMPTokenIssuanceID() const
+    {
+        return this->tx_->at(sfMPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Get sfHolderEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getHolderEncryptionKey() const
+    {
+        if (hasHolderEncryptionKey())
+        {
+            return this->tx_->at(sfHolderEncryptionKey);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfHolderEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasHolderEncryptionKey() const
+    {
+        return this->tx_->isFieldPresent(sfHolderEncryptionKey);
+    }
+
+    /**
+     * @brief Get sfConfidentialBalanceSpending (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getConfidentialBalanceSpending() const
+    {
+        if (hasConfidentialBalanceSpending())
+        {
+            return this->tx_->at(sfConfidentialBalanceSpending);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfConfidentialBalanceSpending is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasConfidentialBalanceSpending() const
+    {
+        return this->tx_->isFieldPresent(sfConfidentialBalanceSpending);
+    }
+
+    /**
+     * @brief Get sfConfidentialBalanceInbox (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getConfidentialBalanceInbox() const
+    {
+        if (hasConfidentialBalanceInbox())
+        {
+            return this->tx_->at(sfConfidentialBalanceInbox);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfConfidentialBalanceInbox is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasConfidentialBalanceInbox() const
+    {
+        return this->tx_->isFieldPresent(sfConfidentialBalanceInbox);
+    }
+
+    /**
+     * @brief Get sfZKProof (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getZKProof() const
+    {
+        if (hasZKProof())
+        {
+            return this->tx_->at(sfZKProof);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfZKProof is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasZKProof() const
+    {
+        return this->tx_->isFieldPresent(sfZKProof);
+    }
+};
+
+/**
+ * @brief Builder for ConfidentialMPTHolderKeyUpdate transactions.
+ *
+ * Provides a fluent interface for constructing transactions with method chaining.
+ * Uses STObject internally for flexible transaction construction.
+ * Inherits common field setters from TransactionBuilderBase.
+ */
+class ConfidentialMPTHolderKeyUpdateBuilder : public TransactionBuilderBase<ConfidentialMPTHolderKeyUpdateBuilder>
+{
+public:
+    /**
+     * @brief Construct a new ConfidentialMPTHolderKeyUpdateBuilder with required fields.
+     * @param account The account initiating the transaction.
+     * @param mPTokenIssuanceID The sfMPTokenIssuanceID field value.
+     * @param sequence Optional sequence number for the transaction.
+     * @param fee Optional fee for the transaction.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder(SF_ACCOUNT::type::value_type account,
+                     std::decay_t<typename SF_UINT192::type::value_type> const& mPTokenIssuanceID,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
+                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
+)
+        : TransactionBuilderBase<ConfidentialMPTHolderKeyUpdateBuilder>(ttCONFIDENTIAL_MPT_HOLDER_KEY_UPDATE, account, sequence, fee)
+    {
+        setMPTokenIssuanceID(mPTokenIssuanceID);
+    }
+
+    /**
+     * @brief Construct a ConfidentialMPTHolderKeyUpdateBuilder from an existing STTx object.
+     * @param tx The existing transaction to copy from.
+     * @throws std::runtime_error if the transaction type doesn't match.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder(std::shared_ptr<STTx const> tx)
+    {
+        if (tx->getTxnType() != ttCONFIDENTIAL_MPT_HOLDER_KEY_UPDATE)
+        {
+            throw std::runtime_error("Invalid transaction type for ConfidentialMPTHolderKeyUpdateBuilder");
+        }
+        object_ = *tx;
+    }
+
+    /**
+     * @brief Transaction-specific field setters
+     */
+
+    /**
+     * @brief Set sfMPTokenIssuanceID (SoeRequired)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder&
+    setMPTokenIssuanceID(std::decay_t<typename SF_UINT192::type::value_type> const& value)
+    {
+        object_[sfMPTokenIssuanceID] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfHolderEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder&
+    setHolderEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfHolderEncryptionKey] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfConfidentialBalanceSpending (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder&
+    setConfidentialBalanceSpending(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfConfidentialBalanceSpending] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfConfidentialBalanceInbox (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder&
+    setConfidentialBalanceInbox(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfConfidentialBalanceInbox] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfZKProof (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    ConfidentialMPTHolderKeyUpdateBuilder&
+    setZKProof(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfZKProof] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Build and return the ConfidentialMPTHolderKeyUpdate wrapper.
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @return The constructed transaction wrapper.
+     */
+    ConfidentialMPTHolderKeyUpdate
+    build(PublicKey const& publicKey, SecretKey const& secretKey)
+    {
+        sign(publicKey, secretKey);
+        return ConfidentialMPTHolderKeyUpdate{std::make_shared<STTx>(std::move(object_))};
+    }
+};
+
+}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/LoanBrokerSet.h

@@ -213,6 +213,32 @@ public:
     {
         return this->tx_->isFieldPresent(sfCoverRateLiquidation);
     }
+
+    /**
+     * @brief Get sfDomainID (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT256::type::value_type>
+    getDomainID() const
+    {
+        if (hasDomainID())
+        {
+            return this->tx_->at(sfDomainID);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfDomainID is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasDomainID() const
+    {
+        return this->tx_->isFieldPresent(sfDomainID);
+    }
 };
 
 /**
@@ -336,6 +362,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfDomainID (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    LoanBrokerSetBuilder&
+    setDomainID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
+    {
+        object_[sfDomainID] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the LoanBrokerSet wrapper.
      * @param publicKey The public key for signing.

include/xrpl/protocol_autogen/transactions/TransactionProposalCreate.h

@@ -18,7 +18,7 @@ class TransactionProposalCreateBuilder;
 /**
  * @brief Transaction: TransactionProposalCreate
  *
- * Type: ttTRANSACTION_PROPOSAL_CREATE (93)
+ * Type: ttTRANSACTION_PROPOSAL_CREATE (95)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureCosign
  * Privileges: Privilege::NoPriv

include/xrpl/rdb/DatabaseCon.h

@@ -178,7 +178,7 @@ public:
     {
         using namespace std::chrono_literals;
         LockedSociSession session = perf::measureDurationAndLog(
-            [&]() { return LockedSociSession(session_, lock_); }, "checkoutDb", 10ms, j_);
+            [&] { return LockedSociSession(session_, lock_); }, "checkoutDb", 10ms, j_);
 
         return session;
     }

include/xrpl/rdb/RelationalDatabase.h

@@ -9,7 +9,6 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/ErrorCodes.h>
 #include <xrpl/protocol/LedgerHeader.h>
-#include <xrpl/protocol/LedgerShortcut.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/TxMeta.h>
 #include <xrpl/protocol/TxSearched.h>
@@ -105,21 +104,6 @@ public:
     using TxnMetaLedgerType = std::tuple<Blob, Blob, std::uint32_t>;
     using MetaTxsList = std::vector<TxnMetaLedgerType>;
 
-    using LedgerSequence = uint32_t;
-    using LedgerHash = UInt256;
-    using LedgerSpecifier = std::variant<LedgerRange, LedgerShortcut, LedgerSequence, LedgerHash>;
-
-    struct AccountTxArgs
-    {
-        AccountID account;
-        std::optional<LedgerSpecifier> ledger;
-        bool binary = false;
-        bool forward = false;
-        uint32_t limit = 0;
-        std::optional<AccountTxMarker> marker;
-        std::optional<DelegateFilter> delegate;
-    };
-
     struct AccountTxResult
     {
         std::variant<AccountTxs, MetaTxsList> transactions;

include/xrpl/server/InfoSub.h

@@ -279,7 +279,7 @@ public:
         virtual bool
         unsubPeerStatus(std::uint64_t uListener) = 0;
         virtual void
-        pubPeerStatus(std::function<json::Value(void)> const&) = 0;
+        pubPeerStatus(std::function<json::Value()> const&) = 0;
 
         virtual bool
         subConsensus(Ref ispListener) = 0;

include/xrpl/server/SimpleWriter.h

@@ -41,7 +41,7 @@ public:
     }
 
     bool
-    prepare(std::size_t bytes, std::function<void(void)>) override
+    prepare(std::size_t bytes, std::function<void()>) override
     {
         return true;
     }

include/xrpl/server/WSSession.h

@@ -47,7 +47,7 @@ public:
      * empty vector.
      */
     virtual std::pair<boost::tribool, std::vector<boost::asio::const_buffer>>
-    prepare(std::size_t bytes, std::function<void(void)> resume) = 0;
+    prepare(std::size_t bytes, std::function<void()> resume) = 0;
 };
 
 template <class Streambuf>
@@ -62,7 +62,7 @@ public:
     }
 
     std::pair<boost::tribool, std::vector<boost::asio::const_buffer>>
-    prepare(std::size_t bytes, std::function<void(void)>) override
+    prepare(std::size_t bytes, std::function<void()>) override
     {
         if (sb_.size() == 0)
             return {true, {}};

include/xrpl/server/Writer.h

@@ -34,7 +34,7 @@ public:
      * @return `true` if the writer is ready to provide more data.
      */
     virtual bool
-    prepare(std::size_t bytes, std::function<void(void)> resume) = 0;
+    prepare(std::size_t bytes, std::function<void()> resume) = 0;
 
     /**
      * Returns a ConstBufferSequence representing the input sequence.

include/xrpl/server/detail/BaseHTTPPeer.h

@@ -342,10 +342,10 @@ BaseHTTPPeer<Handler, Impl>::doWriter(
     bool keepAlive,
     YieldContext doYield)
 {
-    std::function<void(void)> resume;
+    std::function<void()> resume;
     {
         auto const p = impl().shared_from_this();
-        resume = std::function<void(void)>([this, p, writer, keepAlive]() {
+        resume = std::function<void()>([this, p, writer, keepAlive] {
             util::spawn(strand_, [p, writer, keepAlive](YieldContext doYield) {
                 p->doWriter(writer, keepAlive, doYield);
             });

include/xrpl/server/detail/Door.h

@@ -99,7 +99,7 @@ private:
         port_.protocol.contains("wss2") || port_.protocol.contains("peer")};
     bool plain_{
         port_.protocol.contains("http") || port_.protocol.contains("ws") ||
-        (port_.protocol.contains("ws2"))};
+        port_.protocol.contains("ws2")};
     static constexpr std::chrono::milliseconds kInitialAcceptDelay{50};
     static constexpr std::chrono::milliseconds kMaxAcceptDelay{2000};
     std::chrono::milliseconds acceptDelay_{kInitialAcceptDelay};

include/xrpl/server/detail/io_list.h

@@ -60,7 +60,7 @@ private:
     bool closed_ = false;
     std::condition_variable cv_;
     boost::container::flat_map<Work*, std::weak_ptr<Work>> map_;
-    std::function<void(void)> f_;
+    std::function<void()> f_;
 
 public:
     IOList() = default;
@@ -171,7 +171,7 @@ IOList::Work::destroy()
 {
     if (!ios_)
         return;
-    std::function<void(void)> f;
+    std::function<void()> f;
     {
         std::scoped_lock const lock(ios_->m_);
         ios_->map_.erase(this);

include/xrpl/tx/invariants/InvariantCheck.h

@@ -18,6 +18,8 @@
 #include <xrpl/tx/invariants/SponsorshipInvariant.h>
 #include <xrpl/tx/invariants/VaultInvariant.h>
 
+#include <boost/multiprecision/cpp_int.hpp>
+
 #include <cstdint>
 #include <set>
 #include <string>
@@ -139,7 +141,7 @@ public:
  */
 class XRPNotCreated
 {
-    std::int64_t drops_ = 0;
+    boost::multiprecision::int128_t drops_ = 0;
 
 public:
     void

include/xrpl/tx/invariants/MPTInvariant.h

@@ -42,10 +42,21 @@ class ValidMPTIssuance
      */
     bool referenceHoldingMutated_ = false;
 
+    /**
+     * Flags cleared on an existing MPTokenIssuance, except lsfMPTLocked,
+     * which tfMPTUnlock clears legitimately. Every other issuance flag is
+     * fixed at creation or set-once via MPTokenIssuanceSet, so any bit
+     * accumulated here is a bug. Enforced post-fixCleanup3_5_0.
+     */
+    std::uint32_t issuanceFlagsCleared_ = 0;
+
     /**
      * MPTokens and RippleStates deleted during apply. finalize() checks each
      * holder's AccountRoot to detect vault pseudo-account holdings deleted
      * outside VaultDelete. All these checks are gated on fixCleanup3_2_0.
+     *
+     * Under fixCleanup3_5_0, finalize() also rejects any MPToken erased with
+     * a non-zero sfMPTAmount.
      */
     std::vector<std::shared_ptr<SLE const>> deletedHoldings_;
 
@@ -138,8 +149,9 @@ public:
  * - Convert/ConvertBack symmetry:
  * Regular MPToken balance change (±X) == COA (Confidential Outstanding Amount) change (∓X)
  * - Cannot delete MPToken with non-zero confidential state:
- * Cannot delete if sfIssuerEncryptedBalance exists
- * Cannot delete if sfConfidentialBalanceInbox and sfConfidentialBalanceSpending exist
+ * Cannot delete if any of sfConfidentialBalanceSpending, sfConfidentialBalanceInbox,
+ * sfIssuerEncryptedBalance or sfAuditorEncryptedBalance is present, and the issuance's
+ * sfConfidentialOutstandingAmount is non-zero. Mirrors MPTokenAuthorize::preclaim.
  * - Privacy flag consistency:
  * MPToken confidential balance fields can only be created or changed if
  * lsfMPTCanHoldConfidentialBalance is set on the issuance.
@@ -162,6 +174,8 @@ class ValidConfidentialMPToken
         std::int64_t outstandingDelta = 0;
         SLE::const_pointer issuance;
         bool deletedWithEncrypted = false;
+        // True when an erased MPToken had a non-zero pre-tx public balance.
+        bool deletedWithBalanceBefore = false;
         bool badConsistency = false;
         bool badCOA = false;
         bool changesConfidentialFields = false;

include/xrpl/tx/paths/detail/Steps.h

@@ -1,6 +1,8 @@
 #pragma once
 
+#include <xrpl/basics/MathUtilities.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/protocol/AccountID.h>
@@ -23,6 +25,7 @@
 #include <ostream>
 #include <stdexcept>
 #include <string>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
@@ -502,6 +505,46 @@ public:
 };
 /** @endcond */
 
+/** @cond INTERNAL */
+template <class T>
+[[nodiscard]] std::optional<T>
+checkedStepAddOpt(T const& lhs, T const& rhs)
+{
+    if constexpr (std::is_same_v<T, XRPAmount>)
+    {
+        if (auto const r = checkedAdd(lhs.drops(), rhs.drops()))
+            return XRPAmount{*r};
+        return std::nullopt;
+    }
+    else if constexpr (std::is_same_v<T, MPTAmount>)
+    {
+        if (auto const r = checkedAdd(lhs.value(), rhs.value()))
+            return MPTAmount{*r};
+        return std::nullopt;
+    }
+    else if constexpr (std::is_same_v<T, IOUAmount>)
+    {
+        // IOUAmount is Number-backed and throws on overflow.
+        return lhs + rhs;
+    }
+    else
+    {
+        // A new amount type must decide explicitly how to add; do not fall back
+        // to an unchecked add.
+        static_assert(sizeof(T) == 0, "checkedStepAddOpt: unsupported amount type");
+    }
+}
+
+template <class T>
+[[nodiscard]] T
+checkedStepAdd(T const& lhs, T const& rhs)
+{
+    if (auto const r = checkedStepAddOpt(lhs, rhs))
+        return *r;
+    Throw<FlowException>(tecPATH_DRY);
+}
+/** @endcond */
+
 /** @cond INTERNAL */
 // Check equal with tolerance
 bool

include/xrpl/tx/paths/detail/StrandFlow.h

@@ -31,7 +31,6 @@
 #include <cstdint>
 #include <iterator>
 #include <memory>
-#include <numeric>
 #include <optional>
 #include <tuple>
 #include <type_traits>
@@ -408,7 +407,7 @@ limitOut(
     if (!qf || qf->isConst())
         return remainingOut;
 
-    auto const out = [&]() {
+    auto const out = [&] {
         auto const out = qf->outFromAvgQ(limitQuality);
         if (!out)
             return remainingOut;
@@ -646,11 +645,21 @@ flow(
     boost::container::flat_multiset<TOutAmt> savedOuts;
     savedOuts.reserve(maxTries);
 
-    auto sum = [](auto const& col) {
+    // Returns std::nullopt if the aggregate overflows; callers treat that as a
+    // dry path.
+    auto sum = [](auto const& col) -> std::optional<std::decay_t<decltype(*col.begin())>> {
         using TResult = std::decay_t<decltype(*col.begin())>;
         if (col.empty())
             return TResult{beast::kZero};
-        return std::accumulate(col.begin() + 1, col.end(), *col.begin());
+        TResult total = *col.begin();
+        for (auto it = col.begin() + 1; it != col.end(); ++it)
+        {
+            auto const next = checkedStepAddOpt(total, *it);
+            if (!next)
+                return std::nullopt;
+            total = *next;
+        }
+        return total;
     };
 
     // These offers only need to be removed if the payment is not
@@ -670,7 +679,7 @@ flow(
         ammContext.setMultiPath(activeStrands.size() > 1);
 
         // Limit only if one strand and limitQuality
-        auto const limitRemainingOut = [&]() {
+        auto const limitRemainingOut = [&] {
             if (activeStrands.size() == 1 && limitQuality)
             {
                 if (auto const strand = activeStrands.get(0))
@@ -749,9 +758,17 @@ flow(
         {
             savedIns.insert(best->in);
             savedOuts.insert(best->out);
-            remainingOut = outReq - sum(savedOuts);
+            auto const sumOut = sum(savedOuts);
+            if (!sumOut)
+                return {tecPATH_DRY, std::move(ofrsToRmOnFail)};
+            remainingOut = outReq - *sumOut;
             if (sendMax)
-                remainingIn = *sendMax - sum(savedIns);
+            {
+                auto const sumIn = sum(savedIns);
+                if (!sumIn)
+                    return {tecPATH_DRY, std::move(ofrsToRmOnFail)};
+                remainingIn = *sendMax - *sumIn;
+            }
 
             if (flowDebugInfo)
             {
@@ -786,8 +803,12 @@ flow(
             break;
     }
 
-    auto const actualOut = sum(savedOuts);
-    auto const actualIn = sum(savedIns);
+    auto const actualOutOpt = sum(savedOuts);
+    auto const actualInOpt = sum(savedIns);
+    if (!actualOutOpt || !actualInOpt)
+        return {tecPATH_DRY, std::move(ofrsToRmOnFail)};
+    auto const actualOut = *actualOutOpt;
+    auto const actualIn = *actualInOpt;
 
     JLOG(j.trace()) << "Total flow: in: " << to_string(actualIn)
                     << " out: " << to_string(actualOut);

include/xrpl/tx/transactors/lending/LoanBrokerSet.h

@@ -10,6 +10,7 @@
 #include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
 #include <vector>
 
 namespace xrpl {
@@ -32,6 +33,9 @@ public:
     static std::vector<OptionaledField<STNumber>> const&
     getValueFields();
 
+    static std::uint32_t
+    getFlagsMask(PreflightContext const& ctx);
+
     static TER
     preclaim(PreclaimContext const& ctx);
 

include/xrpl/tx/transactors/system/Batch.h

@@ -57,6 +57,12 @@ public:
         ReadView const& view,
         beast::Journal const& j) override;
 
+    /**
+     * Inner transaction types that preflight rejects before LendingProtocolV1_2.
+     *
+     * Once the amendment is enabled the list only matters when replaying older
+     * ledgers. Remove it when LendingProtocolV1_2 is retired.
+     */
     static constexpr auto kDisabledTxTypes = std::to_array<TxType>({
         ttVAULT_CREATE,
         ttVAULT_SET,

include/xrpl/tx/transactors/token/ConfidentialMPTHolderKeyUpdate.h

@@ -0,0 +1,84 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/tx/ApplyContext.h>
+#include <xrpl/tx/Transactor.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+/**
+ * @brief Allows a confidential MPT holder to rotate or recover their ElGamal
+ * encryption key, or to cancel a pending recovery.
+ *
+ * Submitted by the holder. Exactly one of three modes must be selected via
+ * the transaction flags:
+ *
+ * - Rotation (tfHolderKeyRotation): the holder still has their current
+ *   ElGamal private key. They provide a new public key along with their
+ *   current spending/inbox balances re-encrypted under that new key. The
+ *   holder's encryption key and confidential balances are updated
+ *   immediately.
+ *
+ * - Recovery (tfHolderKeyRecovery): the holder has lost their current
+ *   private key. They provide a new public key but cannot provide
+ *   re-encrypted balances. The new key is recorded as a pending
+ *   sfRecoveryKey; the confidential balances are left untouched. Completing
+ *   the recovery (rewriting the balances) is done separately by the issuer
+ *   via ConfidentialMPTRecoverBalance.
+ *
+ * - Cancel (tfCancelRecovery): the holder revokes a pending recovery
+ *   authorization created by a prior Recovery-mode transaction. No key,
+ *   balances, or proof are carried; authorization is via the holder's
+ *   ordinary XRPL signature. sfRecoveryKey is removed and everything else
+ *   is left untouched. Fails if no recovery is pending.
+ *
+ * @note Zero-knowledge proof verification for Rotation and Recovery is
+ * deferred to a follow-up once the mpt-crypto constructions are finalized.
+ */
+class ConfidentialMPTHolderKeyUpdate : public Transactor
+{
+public:
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
+
+    explicit ConfidentialMPTHolderKeyUpdate(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static bool
+    checkExtraFeatures(PreflightContext const& ctx);
+
+    static std::uint32_t
+    getFlagsMask(PreflightContext const& ctx);
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+
+    void
+    visitInvariantEntry(bool isDelete, SLE::ConstRef before, SLE::ConstRef after) override;
+
+    [[nodiscard]] bool
+    finalizeInvariants(
+        STTx const& tx,
+        TER result,
+        XRPAmount fee,
+        ReadView const& view,
+        beast::Journal const& j) override;
+};
+
+}  // namespace xrpl

nix/check-tools/macos.txt

@@ -2,145 +2,148 @@ Detected OS: macos (Darwin arm64)
 
 Core build tools:
   ✅ cmake
-     cmake version 4.1.2
-     /nix/store/gvabsb4yqb5xsqzqph54rijnn4zpihnp-cmake-4.1.2/bin/cmake
+     cmake version 4.4.3
+     /nix/store/q85csxf4s4shx89zif097h1ql4ax1rrz-cmake-4.4.3/bin/cmake
   ✅ conan
-     Conan version 2.28.1
-     /nix/store/9jiyxmkpwmn6dcqs0765s83riw3l5ail-conan-2.28.1/bin/conan
+     Conan version 2.33.0
+     /nix/store/rp0zf22rx3iwnhxp4d53ncirn4lzg68j-conan-2.33.0/bin/conan
   ✅ git
-     git version 2.54.0
-     /nix/store/a14yxcqvv9x2l9mllgpirzhvz93pgprg-git-2.54.0/bin/git
+     git version 2.55.0
+     /nix/store/gw7c7m0dwca5lg4152x9lpmxpj171bzw-git-2.55.0/bin/git
   ✅ python3
-     Python 3.13.13
-     /nix/store/ygxqin6ydzjfawywqpp5pal8wv6sf5bh-python3-3.13.13/bin/python3.13
+     Python 3.14.7
+     /nix/store/0kcws5blwbdyxqxjd1w8hjipz61xny3k-python3-3.14.7/bin/python3.14
 
 Development tooling:
   ✅ ccache
      ccache version 4.13.6
-     /nix/store/57davyvs6p6dkrl3svzwg1ph18wsy4cz-ccache-4.13.6/bin/ccache
+     /nix/store/ydr5nlzxp1djb5256y0zzqa87vz55gsk-ccache-4.13.6/bin/ccache
   ✅ clang
-     clang version 22.1.7
-     /nix/store/192glrb2cldvziyf3378mzjqbzx3ih4g-clang-wrapper-22.1.7/bin/clang
-  ✅ clang-22
-     clang version 22.1.7
-     /nix/store/rbap7zqq7mw00fyqa02p5rj7gqjp4w5i-clang-22/bin/clang-22
+     clang version 23.1.0
+     /nix/store/2c16z6akvv65znb8330sl5qpklaf3194-clang-wrapper-23.1.0/bin/clang
+  ✅ clang-23
+     clang version 23.1.0
+     /nix/store/vfd0q2395vyn0bsjsh1b4068icy1x9ph-clang-23/bin/clang-23
   ✅ clang++
-     clang version 22.1.7
-     /nix/store/192glrb2cldvziyf3378mzjqbzx3ih4g-clang-wrapper-22.1.7/bin/clang++
-  ✅ clang++-22
-     clang version 22.1.7
-     /nix/store/v9haf787f7bcz0mq1sad4bpyx21pj6li-clang++-22/bin/clang++-22
+     clang version 23.1.0
+     /nix/store/2c16z6akvv65znb8330sl5qpklaf3194-clang-wrapper-23.1.0/bin/clang++
+  ✅ clang++-23
+     clang version 23.1.0
+     /nix/store/0i6kfnif2v4sqyv5fzfg8a9n09rw9lkp-clang++-23/bin/clang++-23
   ✅ ClangBuildAnalyzer
      ClangBuildAnalyzer 1.6.0
-     /nix/store/4l50ds9fa2mkvh7wg8qzrlbmjs12sb8l-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
+     /nix/store/c7jjnw29ra78jdlzjww2m374izhy05n8-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
   ✅ curl
-     curl 8.20.0 (aarch64-apple-darwin25.3.0) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
-     /nix/store/kclq0czaxvsgh4ym9ld7b6iwy50l1snk-curl-8.20.0-bin/bin/curl
+     curl 8.22.0 (aarch64-apple-darwin25.6.0) libcurl/8.22.0 OpenSSL/3.5.8 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.70.0 mit-krb5/1.22.2
+     /nix/store/pq1h17abqy6q5y6k5dn9qj0fwb89flba-curl-8.22.0-bin/bin/curl
   ✅ file
-     file-5.47
-     /nix/store/dax63li7wwcbqxxkkgzc4g2rx7d4w86x-file-5.47/bin/file
+     file-5.48
+     /nix/store/y44vpziwbzfm8020dzlqqbybyyy7lb6g-file-5.48/bin/file
+  ✅ jq
+     jq-1.8.2
+     /nix/store/wm7v59a2lhj1w2k8jz53spcs1iizm9lv-jq-1.8.2-bin/bin/jq
   ✅ less
-     less 692 (PCRE2 regular expressions)
-     /nix/store/lvr16y75r1pdxpdv0aph5ak2yd0hkvqm-less-692/bin/less
+     less 710 (PCRE2 regular expressions)
+     /nix/store/3yn3dx5fwg5i0inqqzwnxq7f6lwhpjqa-less-710/bin/less
   ✅ make
      GNU Make 4.4.1
-     /nix/store/8wwiw8pwyhrkzyq28hqzxfl4z84lks81-gnumake-4.4.1/bin/make
+     /nix/store/8l4wgxmhdxfvc9g18y76bnxl1ghgcp7n-gnumake-4.4.1/bin/make
   ✅ netstat
      present
-     /nix/store/qsd1kzqb0ahrk433vmyl245gp623j19s-network_cmds-730.80.3/bin/netstat
+     /nix/store/57fqvgdav8lrmzndkwm7qrgksl01yj23-network_cmds-741.100.2/bin/netstat
   ✅ ninja
      1.13.2
-     /nix/store/bqykhrblarkj4fl0hz2mf8ngwfv6x6bz-ninja-1.13.2/bin/ninja
+     /nix/store/infm4vlx71q83bqz0k559w1gn4b0rq4i-ninja-1.13.2/bin/ninja
   ✅ perl
-     v5.42.0
-     /nix/store/js13ri9fvm0ajk1fpd3acigys2a9whdv-perl-5.42.0/bin/perl
+     v5.42.3
+     /nix/store/7rvr6qjfzk2ybzn1imjw6c6qq1n1a9cr-perl-5.42.3/bin/perl
   ✅ pkg-config
      0.29.2
-     /nix/store/lzrwr375jqhhbca116kja96xf1md83l8-pkg-config-wrapper-0.29.2/bin/pkg-config
+     /nix/store/nhgylvj98klqggy54h7gbc3b2ia4a00y-pkg-config-wrapper-0.29.2/bin/pkg-config
   ✅ vim
      VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
-     /nix/store/6vbkykg92w603c0sw3mkk7p7mfaawbns-vim-9.2.0389/bin/vim
+     /nix/store/akaa9kqm3b8rlkv61kvsqr2l2j70rvxb-vim-9.2.1001/bin/vim
   ✅ zip
      Zip 3.0
-     /nix/store/z6ph729vcakbvz3wh8ln1wk6mi06w487-zip-3.0/bin/zip
+     /nix/store/dvawr36npnad4xa6dxi2ss0fw44aa82r-zip-3.0/bin/zip
   ✅ clang-apply-replacements
-     clang-apply-replacements version 22.1.7
-     /nix/store/vzyyjf3cm1hbj9wcr2qcb66x6j98zpy7-clang-tools-22.1.7/bin/clang-apply-replacements
-  ✅ clang-apply-replacements-22
-     clang-apply-replacements version 22.1.7
-     /nix/store/m3ii69rca4077lf4wlk7m3jcag1fs577-clang-apply-replacements-22/bin/clang-apply-replacements-22
+     clang-apply-replacements version 23.1.0
+     /nix/store/mva6ngy45m9in3m2lsfccj1y0z6n1f5s-clang-tools-23.1.0/bin/clang-apply-replacements
+  ✅ clang-apply-replacements-23
+     clang-apply-replacements version 23.1.0
+     /nix/store/872k02mqr21hxwcpfwaqkxljfj60aak0-clang-apply-replacements-23/bin/clang-apply-replacements-23
   ✅ clang-format
-     clang-format version 22.1.7
-     /nix/store/vzyyjf3cm1hbj9wcr2qcb66x6j98zpy7-clang-tools-22.1.7/bin/clang-format
-  ✅ clang-format-22
-     clang-format version 22.1.7
-     /nix/store/4fawqy6ngqcsqd2ygyyzm93q0xy3f5gs-clang-format-22/bin/clang-format-22
+     clang-format version 23.1.0
+     /nix/store/mva6ngy45m9in3m2lsfccj1y0z6n1f5s-clang-tools-23.1.0/bin/clang-format
+  ✅ clang-format-23
+     clang-format version 23.1.0
+     /nix/store/wf30x6lcya44n2y1fagd6q7x7p4gyl6f-clang-format-23/bin/clang-format-23
   ✅ clang-tidy
-     LLVM version 22.1.7
-     /nix/store/vzyyjf3cm1hbj9wcr2qcb66x6j98zpy7-clang-tools-22.1.7/bin/clang-tidy
-  ✅ clang-tidy-22
-     LLVM version 22.1.7
-     /nix/store/jqw4280saixaxxihwdba9ldm2fsm6dr3-clang-tidy-22/bin/clang-tidy-22
+     LLVM version 23.1.0
+     /nix/store/mva6ngy45m9in3m2lsfccj1y0z6n1f5s-clang-tools-23.1.0/bin/clang-tidy
+  ✅ clang-tidy-23
+     LLVM version 23.1.0
+     /nix/store/kgx00aass66g02p1s4gqqf65kq39m4ci-clang-tidy-23/bin/clang-tidy-23
   ✅ dot
-     dot - graphviz version 12.2.1 (0)
-     /nix/store/ijb4fbnqa6wzlpqnhb6q9knqpf7qqn5z-graphviz-12.2.1/bin/dot
+     dot - graphviz version 15.1.1 (0)
+     /nix/store/mc99a6bpbk2waym2cnw6ifmxli4ndb4x-graphviz-15.1.1/bin/dot
   ✅ doxygen
-     1.16.1
-     /nix/store/kbryjdpq9jizjb0ws0nzbf2h2ymbdiwm-doxygen-1.16.1/bin/doxygen
+     1.17.0
+     /nix/store/kz43yaj0wg6fx6cbrcmi2442z1ramy0c-doxygen-1.17.0/bin/doxygen
   ✅ gcovr
      gcovr 8.4
-     /nix/store/wn8jiyh9p0bybs96s4163qp3k8vfmczx-python3.13-gcovr-8.4/bin/gcovr
+     /nix/store/czj1vxsizrbba280gg22cys40qxkqjgr-python3.14-gcovr-8.4/bin/gcovr
   ✅ gh
-     gh version 2.94.0 (nixpkgs)
-     /nix/store/fhnpw0hs0gjms1ha6ap02jq7rx13gkbp-gh-2.94.0/bin/gh
+     gh version 2.102.0 (2026-09-30)
+     /nix/store/s8bahl6zssvry93ihivfmk1l6c58byrr-gh-2.102.0/bin/gh
   ✅ git-cliff
-     git-cliff 2.13.1
-     /nix/store/cy0wwhgxa7yvrz97zydbq6sqmixc90fq-git-cliff-2.13.1/bin/git-cliff
+     git-cliff 2.14.2
+     /nix/store/k4m5yk0qb7hfslwsq1zjajz1d94j12bj-git-cliff-2.14.2/bin/git-cliff
   ✅ git-lfs
-     git-lfs/3.7.1 (3.7.1; darwin arm64; go 1.26.3)
-     /nix/store/k9r7zjfjplqa4d5s71cqvf2iv73jd9mc-git-lfs-3.7.1/bin/git-lfs
+     git-lfs/3.8.0 (3.8.0; darwin arm64; go 1.26.8)
+     /nix/store/wzixjr3yb40a13m2q654hm3bdjn6sal3-git-lfs-3.8.0/bin/git-lfs
   ✅ gpg
      gpg (GnuPG) 2.4.9
-     /nix/store/cgh6iwzz5jgx9z5whka4vgj210i6npc6-gnupg-2.4.9/bin/gpg
+     /nix/store/0ldfwnwx385i5kh7cyvxx4mkvgjhs5rh-gnupg-2.4.9/bin/gpg
   ✅ pre-commit
-     pre-commit 4.5.1
-     /nix/store/z3cca68620w0w10f090szgzdnmh1waf2-pre-commit-4.5.1/bin/pre-commit
+     pre-commit 4.6.2
+     /nix/store/ivh54xypg9qvd3ha9lis0i8p4nkf8n7a-pre-commit-4.6.2/bin/pre-commit
   ✅ run-clang-tidy
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/4x28x911z2f9y7adqlh3qspp4a16dig7-run-clang-tidy/bin/run-clang-tidy
-  ✅ run-clang-tidy-22
+     /nix/store/zjbzr154xan5xg9pmjiv0zkwklyb94wv-run-clang-tidy/bin/run-clang-tidy
+  ✅ run-clang-tidy-23
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/x8iymrh76sk5q91ryg5pa7i32s6gfh34-run-clang-tidy-22/bin/run-clang-tidy-22
+     /nix/store/svhfrpgx2j581brsqmkpav9b286v22yy-run-clang-tidy-23/bin/run-clang-tidy-23
 
 Rust toolchain:
   ✅ cargo
      cargo 1.97.1 (c980f4866 2026-06-30)
-     /nix/store/bnfk1sl4s9angb0vj1cj9a5y5zvqinwy-rust-minimal-1.97.1/bin/cargo
+     /nix/store/gklji8yq8yrx1k039c10kwz60vqf2dxj-rust-minimal-1.97.1/bin/cargo
   ✅ cargo-audit
-     cargo-audit-audit 0.22.1
-     /nix/store/snwkga2f5gyf404h7mmp9wriwxb8v65f-cargo-audit-0.22.1/bin/cargo-audit
+     cargo-audit-audit 0.22.2
+     /nix/store/7jgrwj557l91940aj0ag4i924ima1cqn-cargo-audit-0.22.2/bin/cargo-audit
   ✅ cargo-llvm-cov
-     cargo-llvm-cov 0.8.5
-     /nix/store/fpiqdh91gwyxalqp409ynm0s0g086w7w-cargo-llvm-cov-0.8.5/bin/cargo-llvm-cov
+     cargo-llvm-cov 0.9.0
+     /nix/store/5q1h285z8zzkw2qxig9a0b1avcsk1cf0-cargo-llvm-cov-0.9.0/bin/cargo-llvm-cov
   ✅ cargo-nextest
-     cargo-nextest 0.9.137
-     /nix/store/ylz7m947mhkgsp6i7611id3s3gcd58nq-cargo-nextest-0.9.137/bin/cargo-nextest
+     cargo-nextest 0.9.146
+     /nix/store/69v3hx3k597hcxd2zy7yad7fg0aw5yxd-cargo-nextest-0.9.146/bin/cargo-nextest
   ✅ clippy-driver
      clippy 0.1.97 (8bab26f4f6 2026-07-14)
-     /nix/store/bnfk1sl4s9angb0vj1cj9a5y5zvqinwy-rust-minimal-1.97.1/bin/clippy-driver
+     /nix/store/gklji8yq8yrx1k039c10kwz60vqf2dxj-rust-minimal-1.97.1/bin/clippy-driver
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f4 2026-07-14)
-     /nix/store/j6apc5pmd0giy15da9p650r8zklslmvi-rust-analyzer-preview-1.97.1-aarch64-apple-darwin/bin/rust-analyzer
+     /nix/store/30rbyk8gx7v53fxqhs4pp0fvxfjycspr-rust-analyzer-preview-1.97.1-aarch64-apple-darwin/bin/rust-analyzer
   ✅ rust-nightly
-     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
-     /nix/store/fqpjz4l0nsnji8b2pz57mnj0akbp6hcl-rust-nightly/bin/rust-nightly
+     rustc 1.101.0-nightly (282215592 2026-10-04)
+     /nix/store/a9552rf3pylcnkijc1z0hf1lcnv50djq-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
-     /nix/store/bnfk1sl4s9angb0vj1cj9a5y5zvqinwy-rust-minimal-1.97.1/bin/rustc
+     /nix/store/gklji8yq8yrx1k039c10kwz60vqf2dxj-rust-minimal-1.97.1/bin/rustc
   ✅ rustfmt
      rustfmt 1.9.0-stable (8bab26f4f6 2026-07-14)
-     /nix/store/5ymwgr9jqjz7zzbmj0j5vqbwcd3kp0vm-rustfmt-preview-1.97.1-aarch64-apple-darwin/bin/rustfmt
+     /nix/store/0jmdipyn8266j9kqx2xxm2qkxlrlrjfc-rustfmt-preview-1.97.1-aarch64-apple-darwin/bin/rustfmt
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 
-✅ All 45 checked tools are present and runnable.
+✅ All 46 checked tools are present and runnable.

nix/check-tools/nix-ubuntu-amd64.txt

@@ -2,173 +2,176 @@ Detected OS: linux (Linux x86_64)
 
 Core build tools:
   ✅ cmake
-     cmake version 4.1.2
-     /nix/store/r9941n32g4wyvggz2703dlplbdq8a6rd-cmake-4.1.2/bin/cmake
+     cmake version 4.4.3
+     /nix/store/jcvvpih1046akxcwh9hdiak5q24jqcf0-cmake-4.4.3/bin/cmake
   ✅ conan
-     Conan version 2.28.1
-     /nix/store/lxny9y4jvjdws7hgz1mygvb7hjrpmna5-conan-2.28.1/bin/conan
+     Conan version 2.33.0
+     /nix/store/b4lnzrqc60glhl9al1nakfc0vd20kdna-conan-2.33.0/bin/conan
   ✅ git
-     git version 2.54.0
-     /nix/store/bcnisk3ydfgv26v2gw3zlky24g00yww2-git-2.54.0/bin/git
+     git version 2.55.0
+     /nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git
   ✅ python3
-     Python 3.13.13
-     /nix/store/60m4rxhg2fldqaak400c0lry96ijrzqn-python3-3.13.13/bin/python3.13
+     Python 3.14.7
+     /nix/store/lb41b0anx1f98y9y5s9mdv97gjgsq740-python3-3.14.7/bin/python3.14
 
 Development tooling:
   ✅ ccache
      ccache version 4.13.6
-     /nix/store/c9wwl7s5i6rsfwvf4v0xbbmzx5m6jgfr-ccache-4.13.6/bin/ccache
+     /nix/store/p1a1s700dqsw1b3b8d2ba64nqw68zgpy-ccache-4.13.6/bin/ccache
   ✅ clang
-     clang version 22.1.7
-     /nix/store/ff0hrp9r9i3pa5arkdw0sgmzp8d576qi-clang-wrapper-22.1.7/bin/clang
-  ✅ clang-22
-     clang version 22.1.7
-     /nix/store/dagc2rq44gfbr7w7yvvqca3yqpc9gqbq-clang-22/bin/clang-22
+     clang version 23.1.0
+     /nix/store/mlqh1xrp0zi3i5g9b0zjcz6zlbbzdgb8-clang-wrapper-23.1.0/bin/clang
+  ✅ clang-23
+     clang version 23.1.0
+     /nix/store/xgi7q1bady9dk89zvjmiicjzzp1gvm7x-clang-23/bin/clang-23
   ✅ clang++
-     clang version 22.1.7
-     /nix/store/ff0hrp9r9i3pa5arkdw0sgmzp8d576qi-clang-wrapper-22.1.7/bin/clang++
-  ✅ clang++-22
-     clang version 22.1.7
-     /nix/store/l5m8clin1npl605wdkd8mr18ggxww3z4-clang++-22/bin/clang++-22
+     clang version 23.1.0
+     /nix/store/mlqh1xrp0zi3i5g9b0zjcz6zlbbzdgb8-clang-wrapper-23.1.0/bin/clang++
+  ✅ clang++-23
+     clang version 23.1.0
+     /nix/store/4slsaz29v72xgc4g36cp94f0p41a81pv-clang++-23/bin/clang++-23
   ✅ ClangBuildAnalyzer
      ClangBuildAnalyzer 1.6.0
-     /nix/store/bshlmn8fqw55nsnm581xqlfbahfkykxx-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
+     /nix/store/gvx8im1c89vspwb8ixa91lr1dagbi241-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
   ✅ curl
-     curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
-     /nix/store/zbwymrp4lcfjc4kkk0n4779v0kjjz58z-curl-8.20.0-bin/bin/curl
+     curl 8.22.0 (x86_64-pc-linux-gnu) libcurl/8.22.0 OpenSSL/3.5.8 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.70.0 mit-krb5/1.22.2
+     /nix/store/305w9ipyg497mz9dq31abdf61qk58k29-curl-8.22.0-bin/bin/curl
   ✅ file
-     file-5.47
-     /nix/store/bizyfqdw0h67wzqmp10knmf9s2pqahdb-file-5.47/bin/file
+     file-5.48
+     /nix/store/g0fbnccaan8q0rxlw43xnbyb90i94vlc-file-5.48/bin/file
+  ✅ jq
+     jq-1.8.2
+     /nix/store/m3y7hqmy20nd1ps6qy8410a326255bf0-jq-1.8.2-bin/bin/jq
   ✅ less
-     less 692 (PCRE2 regular expressions)
-     /nix/store/c6bacbn93qg4a7g9n4czww8rg24dvysr-less-692/bin/less
+     less 710 (PCRE2 regular expressions)
+     /nix/store/zi4d0awnc6crz18s177bv9y2yz9al3lq-less-710/bin/less
   ✅ make
      GNU Make 4.4.1
-     /nix/store/d3bwqm6bymhy3pdgbvf7vxjqfp31m3j1-gnumake-4.4.1/bin/make
+     /nix/store/z565rgmn9vccv2h0g87z725pw610jmm8-gnumake-4.4.1/bin/make
   ✅ netstat
      net-tools 2.10
-     /nix/store/jmyzqvgflnswmws7rnxx6g3zbj680xvd-net-tools-2.10/bin/netstat
+     /nix/store/9i6j9lrsliyz1ww2f8xx18z36wc9n38a-net-tools-2.10/bin/netstat
   ✅ ninja
      1.13.2
-     /nix/store/7a235m7crqbb4h49sak20fqxpw3n7hr0-ninja-1.13.2/bin/ninja
+     /nix/store/4nsdla28c4177ssp0hlyv5l2yzj8wcba-ninja-1.13.2/bin/ninja
   ✅ perl
-     v5.42.0
-     /nix/store/6plwsm6pkq79yjv4xvy8csk2pd4hzr67-perl-5.42.0/bin/perl
+     v5.42.3
+     /nix/store/8g4dmf7l8q1mf9w4wfmlcl8gvdgmhb8v-perl-5.42.3/bin/perl
   ✅ pkg-config
      0.29.2
-     /nix/store/1m05k7xgfnw6jc21xxk5681ni3ar97wf-pkg-config-wrapper-0.29.2/bin/pkg-config
+     /nix/store/b9izmrfjp0qnnyahdwwrzdwi87s1h179-pkg-config-wrapper-0.29.2/bin/pkg-config
   ✅ vim
      VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
-     /nix/store/hvyqx52g4g2fxhgpans3fksjj6lmlyaw-vim-9.2.0389/bin/vim
+     /nix/store/9swnd5pf8p8w1gwcbhdpm2yx705kbp38-vim-9.2.1001/bin/vim
   ✅ zip
      Zip 3.0
-     /nix/store/qnd2ag67hrjj0b6vbmisdshf50r6s72n-zip-3.0/bin/zip
+     /nix/store/5ypvkry3qra47dylc9kfk36r1q9vha80-zip-3.0/bin/zip
   ✅ clang-apply-replacements
-     clang-apply-replacements version 22.1.7
-     /nix/store/4zp1rjpj2xijrv4kqpwsy3ixwb2r6nlk-clang-tools-22.1.7/bin/clang-apply-replacements
-  ✅ clang-apply-replacements-22
-     clang-apply-replacements version 22.1.7
-     /nix/store/py2wihg0a96qcppv4hjmww547xabr0fb-clang-apply-replacements-22/bin/clang-apply-replacements-22
+     clang-apply-replacements version 23.1.0
+     /nix/store/ipnj8b3s6f00ngi26fi7p5h9lxv6a3s3-clang-tools-23.1.0/bin/clang-apply-replacements
+  ✅ clang-apply-replacements-23
+     clang-apply-replacements version 23.1.0
+     /nix/store/lbyc9hrkkymybah7b6n8c7sijlgldfz0-clang-apply-replacements-23/bin/clang-apply-replacements-23
   ✅ clang-format
-     clang-format version 22.1.7
-     /nix/store/4zp1rjpj2xijrv4kqpwsy3ixwb2r6nlk-clang-tools-22.1.7/bin/clang-format
-  ✅ clang-format-22
-     clang-format version 22.1.7
-     /nix/store/kz820ccifjlwqnwqjsx7kbiajrgsmbrh-clang-format-22/bin/clang-format-22
+     clang-format version 23.1.0
+     /nix/store/ipnj8b3s6f00ngi26fi7p5h9lxv6a3s3-clang-tools-23.1.0/bin/clang-format
+  ✅ clang-format-23
+     clang-format version 23.1.0
+     /nix/store/40w351b7i7aqhpl5wmicfnp2ij8k12g9-clang-format-23/bin/clang-format-23
   ✅ clang-tidy
-     LLVM version 22.1.7
-     /nix/store/4zp1rjpj2xijrv4kqpwsy3ixwb2r6nlk-clang-tools-22.1.7/bin/clang-tidy
-  ✅ clang-tidy-22
-     LLVM version 22.1.7
-     /nix/store/gdrkvpw846lkyzh8y9p3zx50g6ml2v84-clang-tidy-22/bin/clang-tidy-22
+     LLVM version 23.1.0
+     /nix/store/ipnj8b3s6f00ngi26fi7p5h9lxv6a3s3-clang-tools-23.1.0/bin/clang-tidy
+  ✅ clang-tidy-23
+     LLVM version 23.1.0
+     /nix/store/40rj38k5ygq7sawkiv0cdaljclbspwz9-clang-tidy-23/bin/clang-tidy-23
   ✅ dot
-     dot - graphviz version 12.2.1 (0)
-     /nix/store/12rgns2296s4qcja778gvcbx61z77rc4-graphviz-12.2.1/bin/dot
+     dot - graphviz version 15.1.1 (0)
+     /nix/store/f7r47nc0d13xa4c2xaaxa6dp3pzm9sp1-graphviz-15.1.1/bin/dot
   ✅ doxygen
-     1.16.1
-     /nix/store/k0vzr5lvgq1byraknzwvk51wcgpnsrkh-doxygen-1.16.1/bin/doxygen
+     1.17.0
+     /nix/store/q6yx2nsimj9xmckmgw4br2cnapbgnqpk-doxygen-1.17.0/bin/doxygen
   ✅ gcovr
      gcovr 8.4
-     /nix/store/iyzi7fpyclqrha054adnizvif02lg49x-python3.13-gcovr-8.4/bin/gcovr
+     /nix/store/shx7mfl8n4kx11icvwyj5x7cmf6z5ahq-python3.14-gcovr-8.4/bin/gcovr
   ✅ gh
-     gh version 2.94.0 (nixpkgs)
-     /nix/store/pidh15szlsb1vc41xdsa3xbdghdazvby-gh-2.94.0/bin/gh
+     gh version 2.102.0 (2026-09-30)
+     /nix/store/66h5dr9v94x04myh2kabx06rq9763jfc-gh-2.102.0/bin/gh
   ✅ git-cliff
-     git-cliff 2.13.1
-     /nix/store/1q851fs62shgjhc03fxxdkpzxdjg7k11-git-cliff-2.13.1/bin/git-cliff
+     git-cliff 2.14.2
+     /nix/store/sl19b42d69b3w2vb9pxp6jbqk841z8vj-git-cliff-2.14.2/bin/git-cliff
   ✅ git-lfs
-     git-lfs/3.7.1 (3.7.1; linux amd64; go 1.26.3)
-     /nix/store/6ljwpal7b1756708m33vj0crpral7mvl-git-lfs-3.7.1/bin/git-lfs
+     git-lfs/3.8.0 (3.8.0; linux amd64; go 1.26.8)
+     /nix/store/rp9ld1f6h83xmf2rb5fpib5wmr46fy9f-git-lfs-3.8.0/bin/git-lfs
   ✅ gpg
      gpg (GnuPG) 2.4.9
-     /nix/store/wx7vk8babxkgy813r70yc67vcwnmagbx-gnupg-2.4.9/bin/gpg
+     /nix/store/8gm9aq3sspqmvvh7c0x7djcivj2x7yvn-gnupg-2.4.9/bin/gpg
   ✅ pre-commit
-     pre-commit 4.5.1
-     /nix/store/bj6i9vl34cij5h0r165y40hrjqak0bmz-pre-commit-4.5.1/bin/pre-commit
+     pre-commit 4.6.2
+     /nix/store/6blf72f7sdmlrqjggxvk5ij4cxb7fk4c-pre-commit-4.6.2/bin/pre-commit
   ✅ run-clang-tidy
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/sbg911hs9dbclrzlp04br3iyfpgnaj6r-run-clang-tidy/bin/run-clang-tidy
-  ✅ run-clang-tidy-22
+     /nix/store/y7isn3dr8bildnp78vk5nhcav63g80dz-run-clang-tidy/bin/run-clang-tidy
+  ✅ run-clang-tidy-23
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/n8yak1ap308gvi7gmrniw0ybsx80fjws-run-clang-tidy-22/bin/run-clang-tidy-22
+     /nix/store/pm5a8465hs9zb5i116b39i0y3xfpw6n3-run-clang-tidy-23/bin/run-clang-tidy-23
 
 Rust toolchain:
   ✅ cargo
      cargo 1.97.1 (c980f4866 2026-06-30)
-     /nix/store/88abzp43ywyzql1rhf8jh5aj5n5j7xzr-cargo-1.97.1-x86_64-unknown-linux-gnu/bin/cargo
+     /nix/store/60b0cz400q34wj2gzav5a41i7y6jzlw3-cargo-1.97.1-x86_64-unknown-linux-gnu/bin/cargo
   ✅ cargo-audit
-     cargo-audit-audit 0.22.1
-     /nix/store/2w9if868piw98xz057sz97jnjvf7hnvf-cargo-audit-0.22.1/bin/cargo-audit
+     cargo-audit-audit 0.22.2
+     /nix/store/kksgynfwir3pfii9qkbj3gcc61an0d4s-cargo-audit-0.22.2/bin/cargo-audit
   ✅ cargo-llvm-cov
-     cargo-llvm-cov 0.8.5
-     /nix/store/jjpdf1l6izz6607a346ykra9sndzaw7h-cargo-llvm-cov-0.8.5/bin/cargo-llvm-cov
+     cargo-llvm-cov 0.9.0
+     /nix/store/4y8qxx0mlm22hnxlw2cmbcwpxispw02h-cargo-llvm-cov-0.9.0/bin/cargo-llvm-cov
   ✅ cargo-nextest
-     cargo-nextest 0.9.137
-     /nix/store/jhkr7gwyrchkml33gyns9cy0yn7b57qc-cargo-nextest-0.9.137/bin/cargo-nextest
+     cargo-nextest 0.9.146
+     /nix/store/q0anzqrazmdr8n1049ca28098q6lv2y8-cargo-nextest-0.9.146/bin/cargo-nextest
   ✅ clippy-driver
      clippy 0.1.97 (8bab26f4f6 2026-07-14)
-     /nix/store/40d3mzka7r1ps71l0yv2fs6616nbw85m-rust-minimal-1.97.1/bin/clippy-driver
+     /nix/store/kk0kqdc4f7am21yp30rr8jcrnib5xqzy-rust-minimal-1.97.1/bin/clippy-driver
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f 2026-07-14)
-     /nix/store/lr3m97p3hx1k22a7c44pb0wa7rbayhfi-rust-analyzer-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rust-analyzer
+     /nix/store/4mglk7qw9jqbv5nwlx9ahdnpcn5sz70r-rust-analyzer-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rust-analyzer
   ✅ rust-nightly
-     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
-     /nix/store/j7kf7a5h4xypzp6x1skg4dsdx2k4fwb3-rust-nightly/bin/rust-nightly
+     rustc 1.101.0-nightly (282215592 2026-10-04)
+     /nix/store/qwyzkvba3f9569wjj45b4iyb7nz7qbnr-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
-     /nix/store/40d3mzka7r1ps71l0yv2fs6616nbw85m-rust-minimal-1.97.1/bin/rustc
+     /nix/store/kk0kqdc4f7am21yp30rr8jcrnib5xqzy-rust-minimal-1.97.1/bin/rustc
   ✅ rustfmt
      rustfmt 1.9.0-stable (8bab26f4f6 2026-07-14)
-     /nix/store/6f1icmb2za20kxn30pgmbv5jq9fnbf4z-rustfmt-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rustfmt
+     /nix/store/y5gf8a3hix7pnwzdwcfpf3acqhzv3xy6-rustfmt-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rustfmt
 
 GCC toolchain:
   ✅ gcc
-     gcc (GCC) 15.2.0
-     /nix/store/3dd6y3pq00i3r85l45jvz63wjya403nl-gcc-wrapper-15.2.0/bin/gcc
+     gcc (GCC) 15.3.0
+     /nix/store/bslmkbaiymxxdc6lwcdb1qyw745nds5j-gcc-wrapper-15.3.0/bin/gcc
   ✅ gcc-15
-     gcc (GCC) 15.2.0
-     /nix/store/d6iri2s6bzqq5ac3fg25j6hgnn1lz44f-gcc-15/bin/gcc-15
+     gcc (GCC) 15.3.0
+     /nix/store/h6f2qc8kgwf7r81gwb10csvpjqfc2404-gcc-15/bin/gcc-15
   ✅ g++
-     g++ (GCC) 15.2.0
-     /nix/store/3dd6y3pq00i3r85l45jvz63wjya403nl-gcc-wrapper-15.2.0/bin/g++
+     g++ (GCC) 15.3.0
+     /nix/store/bslmkbaiymxxdc6lwcdb1qyw745nds5j-gcc-wrapper-15.3.0/bin/g++
   ✅ g++-15
-     g++ (GCC) 15.2.0
-     /nix/store/gm3msmmxq055lm9gprkfjj9d2gdz1mpg-g++-15/bin/g++-15
+     g++ (GCC) 15.3.0
+     /nix/store/jwncv76v61ld9l99v0b1dkmf810if65s-g++-15/bin/g++-15
   ✅ cpp
-     cpp (GCC) 15.2.0
-     /nix/store/3dd6y3pq00i3r85l45jvz63wjya403nl-gcc-wrapper-15.2.0/bin/cpp
+     cpp (GCC) 15.3.0
+     /nix/store/bslmkbaiymxxdc6lwcdb1qyw745nds5j-gcc-wrapper-15.3.0/bin/cpp
   ✅ cpp-15
-     cpp (GCC) 15.2.0
-     /nix/store/bn3gmn0m7g4gn2i0yml46fljc7mghiq5-cpp-15/bin/cpp-15
+     cpp (GCC) 15.3.0
+     /nix/store/jmi558xj8v7lz2fm6wrradh40dp48zx9-cpp-15/bin/cpp-15
   ✅ gcov
-     gcov (GCC) 15.2.0
-     /nix/store/xvv5sm5i8x0ks6ypfkzl7c4j9srnxz7k-gcc-15.2.0/bin/gcov
+     gcov (GCC) 15.3.0
+     /nix/store/n2ab7kf7mm84hna35x463mizcy52pf1h-gcc-15.3.0/bin/gcov
 
 Mold:
   ✅ mold
-     mold 2.41.0 (compatible with GNU ld)
-     /nix/store/2w6fpgxjzzyqmd25wzplm23dfa49a0p2-mold-unwrapped-wrapper-2.41.0/bin/mold
+     mold 2.42.1 (compatible with GNU ld)
+     /nix/store/9dcddrfxlfl9n3wfibi5jkmp22bjkvkh-mold-unwrapped-wrapper-2.42.1/bin/mold
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 
-✅ All 53 checked tools are present and runnable.
+✅ All 54 checked tools are present and runnable.

nix/check-tools/nix-ubuntu-arm64.txt

@@ -2,173 +2,176 @@ Detected OS: linux (Linux aarch64)
 
 Core build tools:
   ✅ cmake
-     cmake version 4.1.2
-     /nix/store/nkcpxjifkambzlrwh27a8igvhnbchibg-cmake-4.1.2/bin/cmake
+     cmake version 4.4.3
+     /nix/store/39cq2g3d3flq2lmb6hc09grxs4xaax8p-cmake-4.4.3/bin/cmake
   ✅ conan
-     Conan version 2.28.1
-     /nix/store/8i2gyqgc00xvxg9xm6y7n0ilncdv8imw-conan-2.28.1/bin/conan
+     Conan version 2.33.0
+     /nix/store/grz6a77mllqzzmg198qagx1r9zhvfijw-conan-2.33.0/bin/conan
   ✅ git
-     git version 2.54.0
-     /nix/store/ixp98f9avf8ikpdrmp40cj33g0dazyp9-git-2.54.0/bin/git
+     git version 2.55.0
+     /nix/store/kj6aff4gmz3snpp35rl3gysbl9srd81a-git-2.55.0/bin/git
   ✅ python3
-     Python 3.13.13
-     /nix/store/lqn6mbgzzdrqq2qkwddcmxj9z6amdd86-python3-3.13.13/bin/python3.13
+     Python 3.14.7
+     /nix/store/81ag9nxz1flw3xjkv1vvqg8y2ipx2ins-python3-3.14.7/bin/python3.14
 
 Development tooling:
   ✅ ccache
      ccache version 4.13.6
-     /nix/store/2q39xi2kbi04ibga7635f2sl148d1mzv-ccache-4.13.6/bin/ccache
+     /nix/store/nzb1lir9sw06fn4635kfx055myqanaz8-ccache-4.13.6/bin/ccache
   ✅ clang
-     clang version 22.1.7
-     /nix/store/xjqffrq9i7la058s9865ig71l9sp1ys5-clang-wrapper-22.1.7/bin/clang
-  ✅ clang-22
-     clang version 22.1.7
-     /nix/store/vcf6ilfwn57828hwzyp6zlyr24j9j6yw-clang-22/bin/clang-22
+     clang version 23.1.0
+     /nix/store/g8sc13kz6jarzip643hk01832x40v8ms-clang-wrapper-23.1.0/bin/clang
+  ✅ clang-23
+     clang version 23.1.0
+     /nix/store/j8qvcg9150s5n09qg8p62q5z3ci02hd9-clang-23/bin/clang-23
   ✅ clang++
-     clang version 22.1.7
-     /nix/store/xjqffrq9i7la058s9865ig71l9sp1ys5-clang-wrapper-22.1.7/bin/clang++
-  ✅ clang++-22
-     clang version 22.1.7
-     /nix/store/xby0f6gamr7m27zp5cndsvghbp9lgb3c-clang++-22/bin/clang++-22
+     clang version 23.1.0
+     /nix/store/g8sc13kz6jarzip643hk01832x40v8ms-clang-wrapper-23.1.0/bin/clang++
+  ✅ clang++-23
+     clang version 23.1.0
+     /nix/store/n62cn5w7fgbslamy3dgm8zhl5yly7zq0-clang++-23/bin/clang++-23
   ✅ ClangBuildAnalyzer
      ClangBuildAnalyzer 1.6.0
-     /nix/store/h893hd4q1bb6ily2lby5dzyfrrzd2nvj-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
+     /nix/store/ml2991pbdhh0qcxqj9331lhpsg449vky-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
   ✅ curl
-     curl 8.20.0 (aarch64-unknown-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
-     /nix/store/i1s0lqwlrmjd2dxzgy2p84cxqqsb0bmk-curl-8.20.0-bin/bin/curl
+     curl 8.22.0 (aarch64-unknown-linux-gnu) libcurl/8.22.0 OpenSSL/3.5.8 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.70.0 mit-krb5/1.22.2
+     /nix/store/94c2x2bl3xb7mx43sg1bs1hd7pnw83ac-curl-8.22.0-bin/bin/curl
   ✅ file
-     file-5.47
-     /nix/store/dx973zg9km2w9albsib2vw9wyvacfrlw-file-5.47/bin/file
+     file-5.48
+     /nix/store/66sd1x1hls0yijibn00iz08jh4fnas9z-file-5.48/bin/file
+  ✅ jq
+     jq-1.8.2
+     /nix/store/kr5py0dcqc9f3l9148qd1axh0z77lld3-jq-1.8.2-bin/bin/jq
   ✅ less
-     less 692 (PCRE2 regular expressions)
-     /nix/store/1blb3s7hhsr77wqi598m6k1qkfp3ms0w-less-692/bin/less
+     less 710 (PCRE2 regular expressions)
+     /nix/store/n6z9dv3yjlgvfx1nmrx6qzyv8vzim1l2-less-710/bin/less
   ✅ make
      GNU Make 4.4.1
-     /nix/store/9ngw1ippk25jjj5fjxv36xbp6iq7rxdx-gnumake-4.4.1/bin/make
+     /nix/store/q07jxvck60qgrg4p1ywypddh5zz6i9s2-gnumake-4.4.1/bin/make
   ✅ netstat
      net-tools 2.10
-     /nix/store/7vdsz21f0s499s5yyqzp5s4676q4yxdd-net-tools-2.10/bin/netstat
+     /nix/store/rfmhd3f8drg3wqyr2mhyrlkd7vyp2pxv-net-tools-2.10/bin/netstat
   ✅ ninja
      1.13.2
-     /nix/store/8ksx98gsbn5lmlizcmw57yd4sg0k2p58-ninja-1.13.2/bin/ninja
+     /nix/store/lfkdyggn1ffslfd830l35jrvapr5lzri-ninja-1.13.2/bin/ninja
   ✅ perl
-     v5.42.0
-     /nix/store/5wnly69vv1i3y97al4v3xrqymf9hlzgq-perl-5.42.0/bin/perl
+     v5.42.3
+     /nix/store/nyp5q4d2cb0pghi4i7nscb97bqkb6kp3-perl-5.42.3/bin/perl
   ✅ pkg-config
      0.29.2
-     /nix/store/c7vwy0gl1q0agl2h22gi0m9dg7xxad2l-pkg-config-wrapper-0.29.2/bin/pkg-config
+     /nix/store/h82n3d0wdrgskdc3yvmz5l3c50h2snvp-pkg-config-wrapper-0.29.2/bin/pkg-config
   ✅ vim
      VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
-     /nix/store/v8c7pvx26irvy9k5sbwd183cyvckzzb3-vim-9.2.0389/bin/vim
+     /nix/store/h39h0qq4i80sp3yd7sxjn2wf497v5rln-vim-9.2.1001/bin/vim
   ✅ zip
      Zip 3.0
-     /nix/store/5mh19mvbv9ym2sm9vymyyaac5l2cj2jq-zip-3.0/bin/zip
+     /nix/store/lfwhq17wfcmjy823fldhlhxj1hjchdzc-zip-3.0/bin/zip
   ✅ clang-apply-replacements
-     clang-apply-replacements version 22.1.7
-     /nix/store/s53p2m776iqaz7acgr5csgpsd18w15h7-clang-tools-22.1.7/bin/clang-apply-replacements
-  ✅ clang-apply-replacements-22
-     clang-apply-replacements version 22.1.7
-     /nix/store/bg4kn8z81hk7b9284rjqvr51wpfjqc24-clang-apply-replacements-22/bin/clang-apply-replacements-22
+     clang-apply-replacements version 23.1.0
+     /nix/store/jh9xhz6gwxyz3rfx7vy5g4j5d71w940r-clang-tools-23.1.0/bin/clang-apply-replacements
+  ✅ clang-apply-replacements-23
+     clang-apply-replacements version 23.1.0
+     /nix/store/1ajzrfr62m3cianfh9i97r30a7vp1xmb-clang-apply-replacements-23/bin/clang-apply-replacements-23
   ✅ clang-format
-     clang-format version 22.1.7
-     /nix/store/s53p2m776iqaz7acgr5csgpsd18w15h7-clang-tools-22.1.7/bin/clang-format
-  ✅ clang-format-22
-     clang-format version 22.1.7
-     /nix/store/79v57mzcw8ng8kl7p961ck08ymhp31v7-clang-format-22/bin/clang-format-22
+     clang-format version 23.1.0
+     /nix/store/jh9xhz6gwxyz3rfx7vy5g4j5d71w940r-clang-tools-23.1.0/bin/clang-format
+  ✅ clang-format-23
+     clang-format version 23.1.0
+     /nix/store/5nfddq7xgbp4zmj8jn7xk1pxyyn5wiwl-clang-format-23/bin/clang-format-23
   ✅ clang-tidy
-     LLVM version 22.1.7
-     /nix/store/s53p2m776iqaz7acgr5csgpsd18w15h7-clang-tools-22.1.7/bin/clang-tidy
-  ✅ clang-tidy-22
-     LLVM version 22.1.7
-     /nix/store/wdyd6cb9z1lyi37lbzvwldgcc7yv1n5c-clang-tidy-22/bin/clang-tidy-22
+     LLVM version 23.1.0
+     /nix/store/jh9xhz6gwxyz3rfx7vy5g4j5d71w940r-clang-tools-23.1.0/bin/clang-tidy
+  ✅ clang-tidy-23
+     LLVM version 23.1.0
+     /nix/store/cawfgsx0vsslc1f007cavmy8md9drb1r-clang-tidy-23/bin/clang-tidy-23
   ✅ dot
-     dot - graphviz version 12.2.1 (0)
-     /nix/store/58rrk4yzwpmyxvl8cqm18h3dhv24zf00-graphviz-12.2.1/bin/dot
+     dot - graphviz version 15.1.1 (0)
+     /nix/store/vz4zb8d1rfigzzdn3i0hd4kff28vk02l-graphviz-15.1.1/bin/dot
   ✅ doxygen
-     1.16.1
-     /nix/store/hq32kzwpl89wgr49iq0gmqn9r5n072zq-doxygen-1.16.1/bin/doxygen
+     1.17.0
+     /nix/store/6q4z332wc9jnvad71wjj87lgjxidhgzl-doxygen-1.17.0/bin/doxygen
   ✅ gcovr
      gcovr 8.4
-     /nix/store/sml3xbbfhhlhk6h7jnlg19pdbx9b764b-python3.13-gcovr-8.4/bin/gcovr
+     /nix/store/v548fjz51k2nmr257vjnd0zp3bxpc2r1-python3.14-gcovr-8.4/bin/gcovr
   ✅ gh
-     gh version 2.94.0 (nixpkgs)
-     /nix/store/7hh2qi0gj2ifbxbl56cjzbiyfc379bji-gh-2.94.0/bin/gh
+     gh version 2.102.0 (2026-09-30)
+     /nix/store/vgg6gnq74h76b4r2ac2q9366f2s5qxwx-gh-2.102.0/bin/gh
   ✅ git-cliff
-     git-cliff 2.13.1
-     /nix/store/bidn3pz53yd6qlg711917xx0q10hqmqv-git-cliff-2.13.1/bin/git-cliff
+     git-cliff 2.14.2
+     /nix/store/hrlgliq7l3fl2qrdlc197mvscs4n03rd-git-cliff-2.14.2/bin/git-cliff
   ✅ git-lfs
-     git-lfs/3.7.1 (3.7.1; linux arm64; go 1.26.3)
-     /nix/store/4rsklvkbac5bayy0zv12kxyvspi4sshd-git-lfs-3.7.1/bin/git-lfs
+     git-lfs/3.8.0 (3.8.0; linux arm64; go 1.26.8)
+     /nix/store/pa2g4xdvr4a73m6mv4cqs0pik1ka1xp5-git-lfs-3.8.0/bin/git-lfs
   ✅ gpg
      gpg (GnuPG) 2.4.9
-     /nix/store/ka4i8zz5ni3rzqnzcxbfvwr95fk8pn6q-gnupg-2.4.9/bin/gpg
+     /nix/store/3qc90b7qkxz7na3xnpd2qb8yvcq8zdp6-gnupg-2.4.9/bin/gpg
   ✅ pre-commit
-     pre-commit 4.5.1
-     /nix/store/n981w6hjfar2l81kxbxs2wxl64vwa5kj-pre-commit-4.5.1/bin/pre-commit
+     pre-commit 4.6.2
+     /nix/store/5f3av75nc7n7xbf2hlvlagzpp2g8g562-pre-commit-4.6.2/bin/pre-commit
   ✅ run-clang-tidy
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/4z2fyklg78klallr7x9j02kz92hnxp4m-run-clang-tidy/bin/run-clang-tidy
-  ✅ run-clang-tidy-22
+     /nix/store/nlg35d9ccslsq5qny7raxyyyrxgk7vsq-run-clang-tidy/bin/run-clang-tidy
+  ✅ run-clang-tidy-23
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/f8m0p9ad40brp9ahy4i0h27kqjkya1j9-run-clang-tidy-22/bin/run-clang-tidy-22
+     /nix/store/a50nf8hp8p8l8pgcf9fs0j25hij5acw3-run-clang-tidy-23/bin/run-clang-tidy-23
 
 Rust toolchain:
   ✅ cargo
      cargo 1.97.1 (c980f4866 2026-06-30)
-     /nix/store/6hch2qrr86n2sa2m90lrpxrfxxwbkayl-cargo-1.97.1-aarch64-unknown-linux-gnu/bin/cargo
+     /nix/store/nci0zxxj2fiq0dlkpqzbnqfh27wz4sq4-cargo-1.97.1-aarch64-unknown-linux-gnu/bin/cargo
   ✅ cargo-audit
-     cargo-audit-audit 0.22.1
-     /nix/store/9rxbrn9aa2r1z96186s69pc7vzizyfch-cargo-audit-0.22.1/bin/cargo-audit
+     cargo-audit-audit 0.22.2
+     /nix/store/zldaj03mfz9f21yiby5yymq7v8vqygd7-cargo-audit-0.22.2/bin/cargo-audit
   ✅ cargo-llvm-cov
-     cargo-llvm-cov 0.8.5
-     /nix/store/vwjsi159n89szrx4yh5pc3jlf2gp4fld-cargo-llvm-cov-0.8.5/bin/cargo-llvm-cov
+     cargo-llvm-cov 0.9.0
+     /nix/store/iwpcfjah31fgn99ph32ajzz7i22j6al5-cargo-llvm-cov-0.9.0/bin/cargo-llvm-cov
   ✅ cargo-nextest
-     cargo-nextest 0.9.137
-     /nix/store/qb6bcg2fjvm3r9s9j98nmffmf9xwh45s-cargo-nextest-0.9.137/bin/cargo-nextest
+     cargo-nextest 0.9.146
+     /nix/store/p5svqr8x1rr7b1i8595pr8qafsr7s6fm-cargo-nextest-0.9.146/bin/cargo-nextest
   ✅ clippy-driver
      clippy 0.1.97 (8bab26f4f6 2026-07-14)
-     /nix/store/a6p27cg6b8szfixfyvkssx6l0c345zw8-rust-minimal-1.97.1/bin/clippy-driver
+     /nix/store/ny64zks16ms5d70jk1qsiwsk0fr33ipp-rust-minimal-1.97.1/bin/clippy-driver
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f 2026-07-14)
-     /nix/store/262830dlw2517lnagfx7i7agqgl4fmsd-rust-analyzer-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rust-analyzer
+     /nix/store/d9s5skhvi1qxj940mylwym2rjicnc2kq-rust-analyzer-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rust-analyzer
   ✅ rust-nightly
-     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
-     /nix/store/c59pxk1yikdlf129qwyg4fplmxcrha0k-rust-nightly/bin/rust-nightly
+     rustc 1.101.0-nightly (282215592 2026-10-04)
+     /nix/store/rbsf1gr6f9ikv2izlyh8im117w6hs7h5-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
-     /nix/store/a6p27cg6b8szfixfyvkssx6l0c345zw8-rust-minimal-1.97.1/bin/rustc
+     /nix/store/ny64zks16ms5d70jk1qsiwsk0fr33ipp-rust-minimal-1.97.1/bin/rustc
   ✅ rustfmt
      rustfmt 1.9.0-stable (8bab26f4f6 2026-07-14)
-     /nix/store/nd8g81wv1smnvdpy4whpcyv2siwjmaan-rustfmt-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rustfmt
+     /nix/store/dplvgjikmv8909rk0dkqr90ryjg7xn0j-rustfmt-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rustfmt
 
 GCC toolchain:
   ✅ gcc
-     gcc (GCC) 15.2.0
-     /nix/store/rn6svg593xsmn8qcjzk8x9pa1i62c4kb-gcc-wrapper-15.2.0/bin/gcc
+     gcc (GCC) 15.3.0
+     /nix/store/g7z555pl99vnwif4jxa05nk1qdc33i1n-gcc-wrapper-15.3.0/bin/gcc
   ✅ gcc-15
-     gcc (GCC) 15.2.0
-     /nix/store/h489d1rmjisfbxh5kmsb0a7c35j8qsdf-gcc-15/bin/gcc-15
+     gcc (GCC) 15.3.0
+     /nix/store/vbdsfjk3j1xy5z329sl2d8vp6mq6x09i-gcc-15/bin/gcc-15
   ✅ g++
-     g++ (GCC) 15.2.0
-     /nix/store/rn6svg593xsmn8qcjzk8x9pa1i62c4kb-gcc-wrapper-15.2.0/bin/g++
+     g++ (GCC) 15.3.0
+     /nix/store/g7z555pl99vnwif4jxa05nk1qdc33i1n-gcc-wrapper-15.3.0/bin/g++
   ✅ g++-15
-     g++ (GCC) 15.2.0
-     /nix/store/9ywmhz8bmzknrn3pn84g46z8hj3vrmw5-g++-15/bin/g++-15
+     g++ (GCC) 15.3.0
+     /nix/store/9ghl998ry4cxlsg6hnq5rn2iipnlkccm-g++-15/bin/g++-15
   ✅ cpp
-     cpp (GCC) 15.2.0
-     /nix/store/rn6svg593xsmn8qcjzk8x9pa1i62c4kb-gcc-wrapper-15.2.0/bin/cpp
+     cpp (GCC) 15.3.0
+     /nix/store/g7z555pl99vnwif4jxa05nk1qdc33i1n-gcc-wrapper-15.3.0/bin/cpp
   ✅ cpp-15
-     cpp (GCC) 15.2.0
-     /nix/store/vmjilh1b830qz9yh0a1jj5ads0jxizdk-cpp-15/bin/cpp-15
+     cpp (GCC) 15.3.0
+     /nix/store/wj0mv2fv2lhglvpjzhscqpbigkvik6br-cpp-15/bin/cpp-15
   ✅ gcov
-     gcov (GCC) 15.2.0
-     /nix/store/rmwf5hpi1y2m1wpnfvlxmrhksm4djk2j-gcc-15.2.0/bin/gcov
+     gcov (GCC) 15.3.0
+     /nix/store/mszfsj00qnv9ygqcqz3w02qzxxskhvlb-gcc-15.3.0/bin/gcov
 
 Mold:
   ✅ mold
-     mold 2.41.0 (compatible with GNU ld)
-     /nix/store/f5qh5a0bx1dslmnf5n5gx0s6aljbswq3-mold-unwrapped-wrapper-2.41.0/bin/mold
+     mold 2.42.1 (compatible with GNU ld)
+     /nix/store/gbq334xbibaz4gn184j7gs58m2spgwi7-mold-unwrapped-wrapper-2.42.1/bin/mold
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 
-✅ All 53 checked tools are present and runnable.
+✅ All 54 checked tools are present and runnable.