Merge the test migration branch

Bring in Stdcoroutine-3, which now carries the migration plan and the
latest develop.

.clang-tidy

@@ -5,10 +5,7 @@ Checks: "-*,
   -bugprone-exception-escape,
   -bugprone-implicit-widening-of-multiplication-result,
   -bugprone-narrowing-conversions,
-  -bugprone-signed-bitwise,
-  -bugprone-std-exception-baseclass,
   -bugprone-throwing-static-initialization,
-  -bugprone-unhandled-code-paths,
 
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-c-arrays,
@@ -17,7 +14,6 @@ Checks: "-*,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-avoid-non-const-global-variables,
   -cppcoreguidelines-c-copy-assignment-signature,
-  -cppcoreguidelines-explicit-constructor,
   -cppcoreguidelines-interfaces-global-init,
   -cppcoreguidelines-macro-usage,
   -cppcoreguidelines-missing-std-forward,
@@ -36,7 +32,6 @@ Checks: "-*,
   llvm-namespace-comment,
 
   misc-*,
-  -misc-explicit-constructor,
   -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
@@ -50,8 +45,6 @@ Checks: "-*,
   -modernize-avoid-c-style-cast,
   -modernize-return-braced-init-list,
   -modernize-use-integer-sign-comparison,
-  -modernize-use-string-view,
-  -modernize-use-structured-binding,
   -modernize-use-trailing-return-type,
 
   performance-*,
@@ -60,7 +53,6 @@ Checks: "-*,
   -performance-noexcept-move-constructor,
   -performance-unnecessary-copy-initialization,
   -performance-unnecessary-value-param,
-  -performance-use-std-move,
 
   readability-*,
   -readability-avoid-const-params-in-decls,
@@ -73,11 +65,7 @@ Checks: "-*,
   -readability-named-parameter,
   -readability-qualified-auto,
   -readability-redundant-access-specifiers,
-  -readability-redundant-nested-if,
-  -readability-redundant-qualified-alias,
   -readability-static-accessed-through-instance,
-  -readability-trailing-comma,
-  -readability-trivial-switch,
   -readability-uppercase-literal-suffix
   "
 # ---
@@ -93,10 +81,6 @@ CheckOptions:
   bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
   bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
 
-  # New in clang-tidy 23; disabled until the code is updated
-  misc-const-correctness.AnalyzeAutoVariables: false
-  misc-const-correctness.AnalyzeLambdas: false
-  misc-const-correctness.AnalyzeParameters: false
   misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/.*;openssl/obj_mac\\.h"
 
   readability-braces-around-statements.ShortStatementLines: 2

.cspell.config.yaml

@@ -83,6 +83,7 @@ words:
   - coeffs
   - coldwallet
   - compr
+  - cppcoro
   - conanfile
   - conanrun
   - confs
@@ -129,6 +130,7 @@ words:
   - fsanitize
   - funclets
   - Gamal
+  - gantt
   - gcov
   - gcovr
   - ghead
@@ -178,6 +180,7 @@ words:
   - ltype
   - mathbunnyru
   - mcmodel
+  - Mankawde
   - MEMORYSTATUSEX
   - MPTAMM
   - MPTDEX
@@ -247,6 +250,7 @@ words:
   - protobuf
   - protos
   - ptrs
+  - Pratik
   - pushd
   - pyenv
   - pyparsing
@@ -255,10 +259,11 @@ words:
   - queuable
   - Raphson
   - rcflags
-  - reencrypted
   - replayer
   - repodata
   - repomd
+  - repost
+  - reposts
   - rerandomize
   - rerandomization
   - rerandomized
@@ -306,6 +311,7 @@ words:
   - sponsees
   - SRPMS
   - sslws
+  - stackful
   - statsd
   - STATSDCOLLECTOR
   - stissue

.envrc

@@ -8,7 +8,3 @@ watch_file rust-toolchain.toml
 watch_dir conan
 
 use flake
-
-# Optional, untracked local overrides. To use a different shell, put e.g.
-# `use flake .#formal-verification` in .envrc.local.
-source_env_if_exists .envrc.local

.gersemi/definitions.cmake

@@ -108,75 +108,3 @@ endfunction()
 
 function(patch_nix_binary target)
 endfunction()
-
-function(rpcspec_generate_instantiations)
-    set(options)
-    set(oneValueArgs OUT_VAR VALUE_TYPE VIEW_HEADER INCLUDE_DIR)
-    set(multiValueArgs HANDLERS)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(corrosion_import_crate)
-    set(options
-        ALL_FEATURES
-        NO_DEFAULT_FEATURES
-        NO_STD
-        NO_LINKER_OVERRIDE
-        NO_USES_TERMINAL
-        LOCKED
-        FROZEN
-    )
-    set(oneValueArgs MANIFEST_PATH PROFILE IMPORTED_CRATES)
-    set(multiValueArgs
-        CRATE_TYPES
-        CRATES
-        FEATURES
-        FLAGS
-        OVERRIDE_CRATE_TYPE
-    )
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(corrosion_set_env_vars target_name env_var)
-endfunction()
-
-function(corrosion_add_cxxbridge cxx_target)
-    set(options)
-    set(oneValueArgs CRATE)
-    set(multiValueArgs FILES)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(_unlink_libgcc_s crate)
-endfunction()
-
-function(add_xrpl_crate name)
-    set(options)
-    set(oneValueArgs CRATE)
-    set(multiValueArgs FILES)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()

.git-blame-ignore-revs

@@ -5,18 +5,6 @@
 # This file is sorted in reverse chronological order, with the most recent commits at the top.
 # The commits listed here are ignored by git blame, which is useful for formatting-only commits that would otherwise obscure the history of changes to a file.
 
-# chore: CamelCase for typedef/using in `clang-tidy` (#8177)
-97a1824537d20d82d25bf151a37a7a4532ebf085
-# chore: Rename CamelCase namespaces to snake_case (#7933)
-06488c1318d96f56d0536251bee08ac85fa7fdd3
-# style: Unify style for all Doxygen comments (#7776)
-73b6852a122854140336e6e6bc30a3a4b41aa5fd
-# style: More clang-tidy identifier renaming (#7290)
-a830ab10efed8d3e59ef2fc15d66efdf9c6bb0d8
-# refactor: Rename static constants (#7120)
-5b6e8b6f93b19c1e3f6a3467a25639031d9d9a53
-# chore: More fixes for bad renames (#7092)
-7afdd71a54d562b32a50b29a5aa00bb997dc9053
 # refactor: Enable clang-tidy `readability-identifier-naming` check (#6571)
 8995564ed6b9e453e144bb663303072a3c1ba305
 # refactor: Enable remaining clang-tidy `cppcoreguidelines` checks (#6538)

.github/actions/build-deps/action.yml

@@ -15,9 +15,9 @@ inputs:
     required: false
     default: "false"
   log_verbosity:
-    description: 'The logging verbosity ("quiet", "verbose"), or empty to use the Conan defaults.'
+    description: "The logging verbosity."
     required: false
-    default: ""
+    default: "verbose"
   sanitizers:
     description: "The sanitizers to enable."
     required: false
@@ -35,16 +35,6 @@ runs:
         LOG_VERBOSITY: ${{ inputs.log_verbosity }}
         SANITIZERS: ${{ inputs.sanitizers }}
       run: |
-        # By default, leave the verbosity unset, so CMake configure output is
-        # shown, but compile commands and Boost's b2 debug output (~85k lines
-        # when "verbose") are not.
-        VERBOSITY_ARGS=()
-        if [[ -n "${LOG_VERBOSITY}" ]]; then
-            VERBOSITY_ARGS=(
-                --conf:all tools.build:verbosity="${LOG_VERBOSITY}"
-                --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}"
-            )
-        fi
         conan install \
             --profile:all ci \
             --build="${BUILD_OPTION}" \
@@ -52,13 +42,6 @@ runs:
             --options:host='&:xrpld=True' \
             --settings:all build_type="${BUILD_TYPE}" \
             --conf:all tools.build:jobs=${BUILD_NPROC} \
-            "${VERBOSITY_ARGS[@]}" \
-            --format=json \
-            . >"${RUNNER_TEMP}/conan-graph.json"
-
-    # Tools that run during the build may only load glibc from the Nix store,
-    # as their package ID survives a GCC runtime update.
-    - name: Check build-context packages for Nix store dependencies (Linux)
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      run: ./bin/nix/check-build-context-runtime.sh "${RUNNER_TEMP}/conan-graph.json"
+            --conf:all tools.build:verbosity="${LOG_VERBOSITY}" \
+            --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}" \
+            .

.github/actions/release-info/action.yml

@@ -36,4 +36,4 @@ runs:
 
     - name: Determine release channel and package release
       id: release_info
-      uses: XRPLF/actions/release-info@a9f2eeca6fb3980ba3a84cf68566f1c69ad30674
+      uses: XRPLF/actions/release-info@ebcf6cea14eee258697308a51fea55cad777581b

.github/scripts/levelization/results/ordering.txt

@@ -174,7 +174,6 @@ test.server > xrpl.basics
 test.server > xrpl.config
 test.server > xrpld.app
 test.server > xrpld.core
-test.server > xrpld.rpc
 test.server > xrpl.json
 test.server > xrpl.protocol
 test.server > xrpl.server

.github/scripts/releasing/check-merge-back-commits.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-
-# Exit the script as soon as an error occurs.
-set -euo pipefail
-
-# This script fails if <head> merges a release back into <base>,
-# but also adds commits that aren't on a release or staging branch, see RELEASING.md.
-# Merge commits are allowed.
-# Usage: .github/scripts/releasing/check-merge-back-commits.sh <base> <head>
-
-if [ "$#" -ne 2 ]; then
-    echo "Usage: $0 <base> <head>"
-    exit 1
-fi
-
-BASE=$1
-HEAD=$2
-
-SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
-# shellcheck source=.github/scripts/releasing/common.sh
-source "${SCRIPT_DIR}/common.sh"
-load_release_branches
-
-# A PR is a merge-back if some of its commits are on a release or staging branch.
-PR_COUNT=$(git rev-list --no-merges --count "${BASE}..${HEAD}")
-NEW_COUNT=$(git rev-list --no-merges --count "${BASE}..${HEAD}" --not "${BRANCHES[@]}")
-if ((NEW_COUNT == PR_COUNT)); then
-    echo "This PR doesn't merge a release back."
-    exit 0
-fi
-if ((NEW_COUNT == 0)); then
-    echo "This merge-back adds no commits of its own."
-    exit 0
-fi
-
-echo "This PR merges a release back, but also adds commits that aren't on a release or staging branch:"
-git log --no-merges --format='  %h %s' "${BASE}..${HEAD}" --not "${BRANCHES[@]}"
-echo
-echo "Make these changes in a separate PR, see RELEASING.md."
-exit 1

.github/scripts/releasing/check-no-copied-release-commits.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # Exit the script as soon as an error occurs.
 set -euo pipefail
@@ -21,10 +21,11 @@ patch_ids() {
     git log --no-merges --patch --no-color --no-ext-diff "$@" | git patch-id --stable | sort
 }
 
-SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
-# shellcheck source=.github/scripts/releasing/common.sh
-source "${SCRIPT_DIR}/common.sh"
-load_release_branches
+mapfile -t BRANCHES < <(git for-each-ref --format='%(refname)' 'refs/remotes/*/release/*' 'refs/remotes/*/staging/*')
+if [ "${#BRANCHES[@]}" -eq 0 ]; then
+    echo "Error: No release or staging branches found."
+    exit 1
+fi
 
 # Each line is "<patch-id> <commit>".
 RELEASE_PATCHES=$(patch_ids "${BRANCHES[@]}" --not "${HEAD}")

.github/scripts/releasing/check-no-merge-back.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-
-# Exit the script as soon as an error occurs.
-set -euo pipefail
-
-# This script fails if <head> contains release or staging commits that <base> does not,
-# i.e. if <head> merges a release back into <base>.
-# Used in the merge queue, which squashes PRs and would drop the merge commit, see RELEASING.md.
-# Usage: .github/scripts/releasing/check-no-merge-back.sh <base> <head>
-
-if [ "$#" -ne 2 ]; then
-    echo "Usage: $0 <base> <head>"
-    exit 1
-fi
-
-BASE=$1
-HEAD=$2
-
-SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
-# shellcheck source=.github/scripts/releasing/common.sh
-source "${SCRIPT_DIR}/common.sh"
-load_release_branches
-
-RELEASE_COMMITS=$(git rev-list "${BRANCHES[@]}" --not "${BASE}")
-HEAD_COMMITS=$(git rev-list "${BASE}..${HEAD}")
-# The release commits in <head>, newest first.
-MERGED=$(grep -xF -f <(echo "${RELEASE_COMMITS}") <<<"${HEAD_COMMITS}" || true)
-if [ -z "${MERGED}" ]; then
-    echo "No release commits are merged back."
-    exit 0
-fi
-
-echo "This PR merges $(wc -l <<<"${MERGED}" | tr -d ' ') release commits back, e.g.:"
-head -5 <<<"${MERGED}" | xargs git log --no-walk --format='  %h %s'
-echo
-echo "Merge-backs must not go through the merge queue, which squashes them."
-echo "Fast-forward develop to the PR branch instead, see RELEASING.md."
-exit 1

.github/scripts/releasing/check-releases-merged.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # Exit the script as soon as an error occurs.
 set -euo pipefail

.github/scripts/releasing/common.sh

@@ -1,12 +0,0 @@
-# shellcheck shell=bash
-
-# Helpers shared by the release checks in this directory, see RELEASING.md.
-
-# Sets BRANCHES to all release and staging branches, and fails if there are none.
-load_release_branches() {
-    mapfile -t BRANCHES < <(git for-each-ref --format='%(refname)' 'refs/remotes/*/release/*' 'refs/remotes/*/staging/*')
-    if [ "${#BRANCHES[@]}" -eq 0 ]; then
-        echo "Error: No release or staging branches found."
-        exit 1
-    fi
-}

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-3d526d4",
+  "image_tag": "sha-060957e",
   "configs": {
     "ubuntu": [
       {
@@ -74,7 +74,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f"
         }
       },
       {
@@ -86,7 +86,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f",
           "variant": "assert"
         }
       }
@@ -101,7 +101,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-3a2d19f"
         }
       }
     ]

.github/workflows/build-nix-images.yml

@@ -12,7 +12,8 @@ on:
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
-      - "bin/nix/default-loader-path.sh"
+      - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"
@@ -24,8 +25,8 @@ on:
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
       - "bin/check-tools.sh"
-      - "bin/nix/default-loader-path.sh"
-      - "bin/install/sanitizer-libs.sh"
+      - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
   workflow_dispatch:
 
 concurrency:

.github/workflows/build-packaging-images.yml

@@ -5,12 +5,13 @@ on:
     branches:
       - develop
     paths:
-      - "bin/install/packaging-tools.sh"
+      - ".github/workflows/build-packaging-images.yml"
+      - "bin/install-packaging-tools.sh"
       - "package/images/packaging/**"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install/packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
       - "package/images/packaging/**"
   workflow_dispatch:
 

.github/workflows/build-pre-commit-image.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - develop
     paths:
+      - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
       - "rust-toolchain.toml"
   pull_request:

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/on-pr.yml

@@ -93,8 +93,9 @@ jobs:
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
+            bin/check-nix-store-refs.sh
             bin/check-tools.sh
-            bin/nix/**
+            bin/default-loader-path.sh
             cfg/**
             cmake/**
             conan/**
@@ -165,31 +166,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Check for copied release commits
-        if: ${{ github.event_name == 'pull_request' }}
         env:
-          BASE: ${{ github.event.pull_request.base.sha }}
-          HEAD: ${{ github.event.pull_request.head.sha }}
+          BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          HEAD: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
         run: .github/scripts/releasing/check-no-copied-release-commits.sh "${BASE}" "${HEAD}"
-      # Runs even if the previous check fails, so that both problems are reported at once.
-      - name: Check merge-back has no new commits
-        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        env:
-          BASE: ${{ github.event.pull_request.base.sha }}
-          HEAD: ${{ github.event.pull_request.head.sha }}
-        run: .github/scripts/releasing/check-merge-back-commits.sh "${BASE}" "${HEAD}"
-      # The queue squashes PRs, so check the PR's own branch, named in the queue branch.
-      - name: Check the merge queue doesn't merge a release back
-        if: ${{ github.event_name == 'merge_group' }}
-        env:
-          BASE: ${{ github.event.merge_group.base_sha }}
-          HEAD_REF: ${{ github.event.merge_group.head_ref }}
-        run: |
-          if ! [[ "${HEAD_REF}" =~ /pr-([0-9]+)-[0-9a-f]+$ ]]; then
-              echo "Error: Can't find the PR number in '${HEAD_REF}'."
-              exit 1
-          fi
-          git fetch --no-tags origin "refs/pull/${BASH_REMATCH[1]}/head"
-          .github/scripts/releasing/check-no-merge-back.sh "${BASE}" FETCH_HEAD
 
   clang-tidy:
     needs: should-run

.github/workflows/on-trigger.yml

@@ -31,8 +31,9 @@ on:
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
+      - "bin/check-nix-store-refs.sh"
       - "bin/check-tools.sh"
-      - "bin/nix/**"
+      - "bin/default-loader-path.sh"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"

.github/workflows/pre-commit.yml

@@ -17,4 +17,4 @@ jobs:
     uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-70b8fd3" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

.github/workflows/publish-docs.yml

@@ -41,7 +41,7 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-build-test-config.yml

@@ -186,6 +186,9 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ inputs.build_type }}
+          # Set the verbosity to "quiet" for Windows to avoid an excessive
+          # amount of logs. For other OSes, the "verbose" logs are more useful.
+          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ inputs.sanitizers }}
 
       - name: Configure CMake
@@ -254,20 +257,20 @@ jobs:
       # cache included, since what it holds is what gets uploaded and reused.
       - name: Check the build output for Nix store references (Nix toolchain)
         if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}"
+        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"
 
       - name: Check the Conan cache for Nix store references (Nix toolchain)
         if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
 
       # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
       # images always references the store. Same condition it uses.
       - name: Check for Nix store references (Linux)
         if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
         run: |
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
 
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}

.github/workflows/reusable-clang-tidy.yml

@@ -34,7 +34,7 @@ jobs:
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3d526d4"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
     permissions:
       contents: read
       issues: write
@@ -73,6 +73,7 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ env.BUILD_TYPE }}
+          log_verbosity: verbose
 
       - name: Configure CMake
         working-directory: ${{ env.BUILD_DIR }}

.github/workflows/reusable-package.yml

@@ -269,23 +269,14 @@ jobs:
     env:
       CONTEXT: image-context
       IMAGE: ${{ matrix.target == 'voidstar' && 'xrpld-voidstar' || 'xrplf/xrpld' }}:${{ github.ref_type == 'tag' && github.ref_name || 'develop' }}
+      # Docker Hub is public, so a private build never reaches it;
+      # the Antithesis registry is not.
+      PUSH: ${{ inputs.publish && (matrix.target == 'voidstar' || github.event.repository.visibility == 'public') }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
-
-      # Docker Hub is public, so it only gets builds whose packages are public:
-      # those of a public codebase, and stable releases.
-      # The Antithesis registry is private, so it gets every build.
-      - name: Decide whether to push
-        env:
-          PUSH: ${{ inputs.publish && (matrix.target == 'voidstar' || github.event.repository.visibility == 'public' || steps.release_info.outputs.channel == 'stable') }}
-        run: echo "PUSH=${PUSH}" | tee -a "${GITHUB_ENV}"
-
       - name: Download package artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/reusable-rust.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +70,7 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}

.github/workflows/upload-conan-deps.yml

@@ -108,11 +108,14 @@ jobs:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ matrix.build_type }}
           force_build: ${{ github.event_name == 'schedule' || github.event.inputs.force_source_build == 'true' }}
+          # Set the verbosity to "quiet" for Windows to avoid an excessive
+          # amount of logs. For other OSes, the "verbose" logs are more useful.
+          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
       - name: Check the Conan cache for Nix store references (Nix toolchain)
         if: ${{ matrix.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}

.gitignore

@@ -92,9 +92,6 @@ target/
 # Direnv's directory
 /.direnv
 
-# Direnv's local, per-developer overrides
-/.envrc.local
-
 # clangd cache
 /.cache
 

.pre-commit-config.yaml

@@ -60,7 +60,7 @@ repos:
         types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: a9a8a861f30ed207ead7d5a3b7e8032283ba5da7 # frozen: v23.1.2
+    rev: e2b496dc2bd8340c2524cb9a2d2a943cde1bb6df # frozen: v23.1.1
     hooks:
       - id: clang-format
         args: [--style=file]
@@ -82,10 +82,9 @@ repos:
         files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: 28010ddd6016e1a0f7bd232acb6536ef996ae897 # frozen: 0.29.2
+    rev: f1c4833f8cf23c6d952673abc73525411a5719e8 # frozen: 0.29.1
     hooks:
       - id: gersemi
-        args: [-i, --warnings-as-errors]
 
   - repo: https://github.com/rbubley/mirrors-prettier
     rev: ef4a397f916211b4a39ccf9d3d9cbb6562157251 # frozen: v3.9.9
@@ -96,19 +95,19 @@ repos:
   # Scoped to package/: the rest of the repo's Python has pre-existing findings,
   # so widening these is its own change.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253 # frozen: v0.16.10
+    rev: a56c0b927e6465d37cae3e97d35d4d18ab2b96cd # frozen: v0.16.9
     hooks:
       - id: ruff-check
         args: [--fix]
         files: ^package/.*\.py$
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 96ae3e5802f3fe2d551e703e18f0a367d1a81ac2 # frozen: 26.10.0
+    rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 2834ec6639549dd6796205c8f011dedcd587288b # frozen: v2.4.0
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee # frozen: v2.3.1
     hooks:
       - id: mypy
         args: [--strict]

API-CHANGELOG.md

@@ -22,34 +22,6 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## Unreleased
-
-### Bugfixes
-
-- A request echoed back in an error reply now has every credential-bearing field masked: `admin_password`, `admin_user`, `passphrase`, `password`, `secret`, `seed`, `seed_hex`, `url_password`, `url_username` and `username`. Nesting no longer matters, so a credential inside `params` is masked too. The same masking is applied to every request and reply written to the log, and it covers six further names that only a reply carries: `master_key`, `master_seed`, `master_seed_hex`, `validation_key`, `validation_private_key` and `validation_seed`, which is how `wallet_propose` and `validation_create` used to write a live private key to the log. A request or reply written to the log is truncated at 10,000 characters.
-- The command line client no longer prints a credential the operator did not type. A failing command echoes the request it built under `request_sent`, which carries the `admin_password` the client copies out of `[port_rpc]` in the config, so `./xrpld account_info rBogus` printed that password to stdout and into any captured output. `request_sent` is now masked. The `rpc` member beside it, which echoes the arguments as they were typed, is unchanged. The command line client also no longer writes an unparsed `json` or `ripple_path_find` argument to its trace log before parsing it, where a `secret` inside that argument could not be masked; it logs the parsed request instead, masked. The reply it receives is logged the same way, parsed and masked, where the raw body was written before, a `validation_create` answer included.
-- A WebSocket frame that does not parse, or exceeds the request size limit, is answered `{"type": "error", "error": "jsonInvalid", "size": <bytes>}`. The frame's body is reported by size rather than echoed back in a `value` member, since a body that does not parse has no fields to mask. A client that read `value` gets `size` instead.
-- Four error codes that named no HTTP status of their own, and so answered 200 on a reply reporting an error, now name one: `actMalformed`, `alreadyMultisig` and `alreadySingleSig` answer 400, and `actNotFound` answers 404. **No shipped envelope reports these four.** A request sending `ripplerpc: "3.0"` still receives 200 for all four, as it always has, so `account_info` on a malformed account or one the ledger does not hold answers 200 exactly as before.
-- `submit`, `simulate`, `transaction_entry`, `ledger_entry` and `ledger_accept`: Errors from these methods now include `error_code` and `error_message` alongside the `error` token, as every other method already did. Each error now answers the status its code names: 400 for a malformed request, 404 for `transactionNotFound`, 500 for an internal failure, and 501 for `notYetImplemented` and `notStandAlone`. That status change reaches only a request sending `ripplerpc: "3.0"`, which is the envelope that derives the status from the error. With `ripplerpc` `"1.0"` the status stays 200 and the two new members appear beside `error`; with `"2.0"` the status stays 200, `error_code` appears, and the `code` and `message` members carry the code and the message rather than null, since that envelope copies them from `error_code` and `error_message` and drops `error_message`.
-
-## XRP Ledger server version 3.5.0
-
-Version 3.5.0 is not yet released.
-
-### Additions in 3.5.0
-
-- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive the same `transaction` message as the `transactions` stream for each validated transaction whose metadata affects a subscribed issuance. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
-- `ledger_entry`: Add full support for checks, NFT offers, payment channels, and signer lists. ([#6319](https://github.com/XRPLF/rippled/pull/6319))
-
-### Bugfixes in 3.5.0
-
-- `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
-- `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
-
-### Bugfixes in 3.5.0
-
-- `feature`: The admin-only `vetoed` field now returns `invalidParams` unless its value is a boolean. [#7583](https://github.com/XRPLF/rippled/pull/7583)
-
 ## XRP Ledger server version 3.4.0
 
 Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
@@ -70,7 +42,6 @@ Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta
 - `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 - `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
 - `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
-- `transaction_entry`: An object or an array in `tx_hash` now returns `malformedRequest`, like any other value that is not a hex hash, instead of an `internal` error.
 
 ## XRP Ledger server version 3.3.0
 

BUILD.md

@@ -41,13 +41,15 @@ branch.
 git checkout develop
 ```
 
-For a release or release candidate, check out its [tag](https://github.com/XRPLF/rippled/releases), e.g.:
+For a release candidate, choose the relevant release branch, e.g.
+`release/3.2.x`.
 
 ```bash
-git checkout 3.4.0
+git checkout release/3.2.x
 ```
 
-See [RELEASING.md](./RELEASING.md) for how branches and releases are organized.
+For a stable release, choose one of the [tagged
+releases](https://github.com/XRPLF/rippled/releases).
 
 A build reports `0.0.0-dev` with its short commit hash as build metadata, e.g.
 `0.0.0-dev+0123abc`. Only builds of a release, from a tag in CI or a versioned

BoostToStdCoroutineTaskList.md

@@ -0,0 +1,142 @@
+# Boost.Coroutine to C++20 Migration — Task List
+
+> Parent document: [BoostToStdCoroutineSwitchPlan.md](BoostToStdCoroutineSwitchPlan.md)
+
+---
+
+## Milestone 1: New Coroutine Primitives
+
+- [ ] **1.1** Design `CoroTask<T>` class with `promise_type`
+  - Define `promise_type` with `initial_suspend`, `final_suspend`, `unhandled_exception`, `return_value`/`return_void`
+  - Implement `FinalAwaiter` for continuation support
+  - Implement move-only RAII handle wrapper
+  - Support both `CoroTask<T>` and `CoroTask<void>`
+
+- [ ] **1.2** Design and implement `JobQueueAwaiter`
+  - `await_suspend()` calls `jq_.addJob(type, name, [h]{ h.resume(); })`
+  - Handle `addJob()` failure (shutdown) — resume with error flag or throw
+  - Integrate `nSuspend_` counter increment/decrement
+
+- [ ] **1.3** Implement `LocalValues` swap in new coroutine resume path
+  - Before `handle.resume()`: save thread-local, install coroutine-local
+  - After `handle.resume()` returns: restore thread-local
+  - Ensure this works when coroutine migrates between threads
+
+- [ ] **1.4** Add `postCoroTask()` template to `JobQueue`
+  - Accept callable returning `CoroTask<void>`
+  - Schedule initial execution on JobQueue (mirror `postCoro()` behavior)
+  - Return a handle/shared_ptr for join/cancel
+
+- [ ] **1.5** Write unit tests (`src/test/core/CoroTask_test.cpp`)
+  - Test `CoroTask<void>` runs to completion
+  - Test `CoroTask<int>` returns value
+  - Test exception propagation across co_await
+  - Test coroutine destruction before completion
+  - Test `JobQueueAwaiter` schedules on correct thread
+  - Test `LocalValue` isolation across 4+ coroutines
+  - Test shutdown rejection (addJob returns false)
+  - Test `correct_order` equivalent (yield → join → post → complete)
+  - Test `incorrect_order` equivalent (post → yield → complete)
+  - Test multiple sequential co_await points
+
+- [ ] **1.6** Verify build on GCC 12+, Clang 16+
+- [ ] **1.7** Run ASAN + TSAN on new tests
+- [ ] **1.8** Run full `--unittest` suite (no regressions)
+- [ ] **1.9** Self-review and create PR #1
+
+---
+
+## Milestone 2: Entry Point Migration
+
+- [ ] **2.1** Migrate `ServerHandler::onRequest()` (`ServerHandler.cpp:287`)
+  - Replace `m_jobQueue.postCoro(jtCLIENT_RPC, ...)` with `postCoroTask()`
+  - Update lambda to return `CoroTask<void>` (add `co_return`)
+  - Update `processSession` to accept new coroutine type
+
+- [ ] **2.2** Migrate `ServerHandler::onWSMessage()` (`ServerHandler.cpp:325`)
+  - Replace `m_jobQueue.postCoro(jtCLIENT_WEBSOCKET, ...)` with `postCoroTask()`
+  - Update lambda signature
+
+- [ ] **2.3** Migrate `GRPCServer::CallData::process()` (`GRPCServer.cpp:102`)
+  - Replace `app_.getJobQueue().postCoro(JobType::jtRPC, ...)` with `postCoroTask()`
+  - Update `process(shared_ptr<Coro> coro)` overload signature
+
+- [ ] **2.4** Update `RPC::Context` (`Context.h:27`)
+  - Replace `std::shared_ptr<JobQueue::Coro> coro{}` with new coroutine wrapper type
+  - Ensure all code that accesses `context.coro` compiles
+
+- [ ] **2.5** Update `ServerHandler.h` signatures
+  - `processSession()` and `processRequest()` parameter types
+
+- [ ] **2.6** Update `GRPCServer.h` signatures
+  - `process()` method parameter types
+
+- [ ] **2.7** Run full `--unittest` suite
+- [ ] **2.8** Manual smoke test: HTTP + WS + gRPC RPC requests
+- [ ] **2.9** Run ASAN + TSAN
+- [ ] **2.10** Self-review and create PR #2
+
+---
+
+## Milestone 3: Handler Migration
+
+- [ ] **3.1** Migrate `doRipplePathFind()` (`RipplePathFind.cpp`)
+  - Replace `context.coro->yield()` with `co_await PathFindAwaiter{...}`
+  - Replace continuation lambda's `coro->post()` / `coro->resume()` with awaiter scheduling
+  - Handle shutdown case (post failure) in awaiter
+
+- [ ] **3.2** Create `PathFindAwaiter` (or use generic `JobQueueAwaiter`)
+  - Encapsulate the continuation + yield pattern from `RipplePathFind.cpp` lines 108-132
+
+- [ ] **3.3** Update `Path_test.cpp`
+  - Replace `postCoro` usage with `postCoroTask`
+  - Ensure `context.coro` usage matches new type
+
+- [ ] **3.4** Update `AMMTest.cpp`
+  - Replace `postCoro` usage with `postCoroTask`
+
+- [ ] **3.5** Rewrite `Coroutine_test.cpp` for new API
+  - `correct_order`: postCoroTask → co_await → join → resume → complete
+  - `incorrect_order`: post before yield equivalent
+  - `thread_specific_storage`: 4 coroutines with LocalValue isolation
+
+- [ ] **3.6** Update `JobQueue_test.cpp` `testPostCoro`
+  - Migrate to `postCoroTask` API
+
+- [ ] **3.7** Verify `ripple_path_find` works end-to-end with new coroutines
+- [ ] **3.8** Test shutdown-during-pathfind scenario
+- [ ] **3.9** Run full `--unittest` suite
+- [ ] **3.10** Run ASAN + TSAN
+- [ ] **3.11** Self-review and create PR #3
+
+---
+
+## Milestone 4: Cleanup & Validation
+
+- [ ] **4.1** Delete `include/xrpl/core/Coro.ipp`
+- [ ] **4.2** Remove from `JobQueue.h`:
+  - `#include <boost/coroutine2/all.hpp>`
+  - `struct Coro_create_t`
+  - `class Coro` (entire class)
+  - `postCoro()` template
+  - Comment block (lines 322-377) describing old race condition
+- [ ] **4.3** Update `cmake/deps/Boost.cmake`:
+  - Remove `coroutine` from `find_package(Boost REQUIRED COMPONENTS ...)`
+  - Remove `Boost::coroutine` from `target_link_libraries`
+- [ ] **4.4** Update `cmake/XrplInterface.cmake`:
+  - Remove `BOOST_COROUTINES2_NO_DEPRECATION_WARNING`
+- [ ] **4.5** Run memory benchmark
+  - Create N=1000 coroutines, compare RSS: before vs after
+  - Document results
+- [ ] **4.6** Run context switch benchmark
+  - 100K yield/resume cycles, compare latency: before vs after
+  - Document results
+- [ ] **4.7** Run RPC throughput benchmark
+  - Concurrent `ripple_path_find` requests, compare throughput
+  - Document results
+- [ ] **4.8** Run full `--unittest` suite
+- [ ] **4.9** Run ASAN, TSAN, UBSan
+  - Confirm `__asan_handle_no_return` warnings are gone
+- [ ] **4.10** Verify build on all supported compilers
+- [ ] **4.11** Self-review and create PR #4
+- [ ] **4.12** Document final benchmark results in PR description

CONTRIBUTING.md

@@ -14,13 +14,9 @@ The following branches exist in the main project repository:
 
 - `develop`: The latest set of unreleased features, and the most common
   starting point for contributions.
-- `staging/*` (e.g. `staging/3.4.x`): Staging branches, one per release line,
-  where fixes for that line are developed.
-- `release/*` (e.g. `release/3.4.x`): Release branches, one per release line,
-  holding the latest public release candidate or release for that line.
-  Releases are published as [tagged releases](https://github.com/XRPLF/rippled/releases).
-
-See [RELEASING.md](./RELEASING.md) for how these branches are used.
+- `release/*` (e.g. `release/3.2.x`): Release branches, one per release line,
+  holding the latest release candidate, or stable release for that line.
+  Stable releases are published as [tagged releases](https://github.com/XRPLF/rippled/releases).
 
 The tip of each branch must be signed. In order for GitHub to sign a
 squashed commit that it builds from your pull request, GitHub must know
@@ -149,8 +145,8 @@ tl;dr
 
 In general, pull requests use `develop` as the base branch.
 
-The exceptions are fixes for an existing release line,
-which use that line's staging branch (e.g. `staging/3.4.x`) as the base.
+The exceptions are fixes, improvements, and hotfixes for an existing release,
+which use that release's branch (e.g. `release/3.2.x`) as the base.
 
 If your changes are not quite ready, but you want to make it easily available
 for preliminary examination or review, you can create a "Draft" pull request.
@@ -595,16 +591,15 @@ the suggested commit message, or modify it as needed.
 
 #### Slightly more complicated pull requests
 
-Some pull requests need to be pushed to their base branch (usually `develop`)
-as more than one commit.
-A PR author may _request_ to merge as separate commits. They
+Some pull requests need to be pushed to `develop` as more than one
+commit. A PR author may _request_ to merge as separate commits. They
 must _justify_ why separate commits are needed, and _specify_ how they
 would like the commits to be merged. If you disagree with the author,
 discuss it with them directly.
 
 If the process is reasonable, follow it. The simplest option is to do a
-fast forward only merge (`--ff-only`) on the command line
-and push to the base branch.
+fast forward only merge (`--ff-only`) on the command line and push to
+`develop`.
 
 Some examples of when separate commits are worthwhile are:
 
@@ -617,10 +612,9 @@ Some examples of when separate commits are worthwhile are:
 
 Either way, check that:
 
-- The commits are based on the current tip of the base branch.
-- The commits are clean:
-  No merge commits (except when merging a release, see [RELEASING.md](./RELEASING.md)),
-  no "[FOLD]" or "fixup!" messages.
+- The commits are based on the current tip of `develop`.
+- The commits are clean: No merge commits (except when reverse
+  merging), no "[FOLD]" or "fixup!" messages.
 - All commits are signed. If the commits are not signed by the author, use
   `git commit --amend -S` to sign them yourself.
 - At least one (but preferably all) of the commits has the PR number
@@ -632,8 +626,578 @@ use them!**
 
 ### Releases
 
-Releases, release branches, and merging releases back into `develop`
-are described in [RELEASING.md](./RELEASING.md).
+All releases, including release candidates and betas, are handled
+differently from typical PRs. Most importantly, never use
+the Github UI to merge a release.
+
+Xrpld uses a linear workflow model that can be summarized as:
+
+1. In between releases, developers work against the `develop` branch.
+2. Periodically, a maintainer will build and tag a beta version from
+   `develop`, which is pushed to `release`.
+   - Betas are usually released every two to three weeks, though that
+     schedule can vary depending on progress, availability, and other
+     factors.
+3. When the changes in `develop` are considered stable and mature enough
+   to be ready to release, a release candidate (RC) is built and tagged
+   from `develop`, and merged to `release`.
+   - Further development for that release (primarily fixes) then
+     continues against `release`, while other development continues on
+     `develop`. Effectively, `release` is forked from `develop`. Changes
+     to `release` must be reverse merged to `develop`.
+4. When the candidate has passed testing and is ready for release, the
+   final release is merged to `master`.
+5. If any issues are found post-release, a hotfix / point release may be
+   created, which is merged to `master`, and then reverse merged to
+   `develop`.
+
+#### Betas, and the first release candidate
+
+##### Preparing the `develop` branch
+
+1. Optimally, the `develop` branch will be ready to go, with all
+   relevant PRs already merged.
+2. If there are any PRs pending, merge them **BEFORE** preparing the beta.
+   1. If only one or two PRs need to be merged, merge those PRs [as
+      normal](#when-and-how-to-merge-pull-requests), updating the second
+      one, and waiting for CI to finish in between.
+   2. If there are several pending PRs, do not use the Github UI,
+      because the delays waiting for CI in between each merge will be
+      unnecessarily onerous. (Incidentally, this process can also be
+      used to merge if the Github UI has issues.) Merge each PR branch
+      directly to a `release-next` on your local machine and create a single
+      PR, then push your branch to `develop`.
+      1. Squash the changes from each PR, one commit each (unless more
+         are needed), being sure to sign each commit and update the
+         commit message to include the PR number. You may be able to use
+         a fast-forward merge for the first PR.
+      2. Push your branch.
+      3. Continue to [Making the release](#making-the-release) to update
+         the version number, etc.
+
+      The workflow may look something like:
+
+```
+git fetch --multiple upstreams user1 user2 user3 [...]
+git checkout -B release-next --no-track upstream/develop
+
+# Only do an ff-only merge if pr-branch1 is either already
+# squashed, or needs to be merged with separate commits,
+# and has no merge commits.
+# Use -S on the ff-only merge if pr-branch1 isn't signed.
+git merge [-S] --ff-only user1/pr-branch1
+
+git merge --squash user2/pr-branch2
+git commit -S # Use the commit message provided on the PR
+
+git merge --squash user3/pr-branch3
+git commit -S # Use the commit message provided on the PR
+
+[...]
+
+# Make sure the commits look right
+git log --show-signature "upstream/develop..HEAD"
+
+git push --set-upstream origin
+
+# Continue to "Making the release" to update the version number, so
+# everything can be done in one PR.
+```
+
+You can also use the [squash-branches] script.
+
+You may also need to manually close the open PRs after the changes are
+merged to `develop`. Be sure to include the commit ID.
+
+##### Making the release
+
+This includes, betas, and the first release candidate (RC).
+
+1. If you didn't create one [preparing the `develop`
+   branch](#preparing-the-develop-branch), Ensure there is no old
+   `release-next` branch hanging around. Then make a `release-next`
+   branch that only changes the version number. e.g.
+
+```
+git fetch upstreams
+
+git checkout --no-track -B release-next upstream/develop
+
+v="A.B.C-bD"
+build=$( find -name BuildInfo.cpp )
+sed 's/\(^.*versionString =\).*$/\1 "'${v}'"/' ${build} > version.cpp && mv -vi version.cpp ${build}
+
+git diff
+
+git add ${build}
+
+git commit -S -m "Set version to ${v}"
+
+# You could use your "origin" repo, but some CI tests work better on upstream.
+git push upstream-push
+git fetch upstreams
+git branch --set-upstream-to=upstream/release-next
+```
+
+You can also use the [update-version] script. 2. Create a Pull Request for `release-next` with **`develop`** as
+the base branch.
+
+1.  Use the title "[TRIVIAL] Set version to X.X.X-bX".
+2.  Instead of the default description template, use the following:
+
+```
+## High Level Overview of Change
+
+This PR only changes the version number. It will be merged as
+soon as Github CI actions successfully complete.
+```
+
+3. Wait for CI to successfully complete, and get someone to approve
+   the PR. (It is safe to ignore known CI issues.)
+4. Push the updated `develop` branch using your `release-next`
+   branch. **Do not use the Github UI. It's important to preserve
+   commit IDs.**
+
+```
+git push upstream-push release-next:develop
+```
+
+5. In the unlikely event that the push fails because someone has merged
+   something else in the meantime, rebase your branch onto the updated
+   `develop` branch, push again, and go back to step 3.
+6. Ensure that your PR against `develop` is closed. Github should do it
+   automatically.
+7. Once this is done, forward progress on `develop` can continue
+   (other PRs may be merged).
+8. Now create a Pull Request for `release-next` with **`release`** as
+   the base branch. Instead of the default template, reuse and update
+   the message from the previous release. Include the following verbiage
+   somewhere in the description:
+
+```
+The base branch is `release`. [All releases (including
+betas)](https://github.com/XRPLF/rippled/blob/develop/CONTRIBUTING.md#before-you-start)
+go in `release`. This PR branch will be pushed directly to `release` (not
+squashed or rebased, and not using the GitHub UI).
+```
+
+7. Sign-offs for the three platforms (Linux, Mac, Windows) usually occur
+   offline, but at least one approval will be needed on the PR.
+   - If issues are discovered during testing, simply abandon the
+     release. It's easy to start a new release, it should be easy to
+     abandon one. **DO NOT REUSE THE VERSION NUMBER.** e.g. If you
+     abandon 2.4.0-b1, the next attempt will be 2.4.0-b2.
+8. Once everything is ready to go, push to `release`.
+
+```
+git fetch upstreams
+
+# Just to be safe, do a dry run first:
+git push --dry-run upstream-push release-next:release
+
+# If everything looks right, push the branch
+git push upstream-push release-next:release
+
+# Check that all of the branches are updated
+git fetch upstreams
+git log -1 --oneline
+# The output should look like:
+# 0123456789 (HEAD -> upstream/release-next, upstream/release,
+#            upstream/develop) Set version to 2.4.0-b1
+# Note that upstream/develop may not be on this commit, but
+# upstream/release must be.
+# Other branches, including some from upstream-push, may also be
+# present.
+```
+
+9. Tag the release, too.
+
+```
+git tag <version number>
+git push upstream-push <version number>
+```
+
+10. Delete the `release-next` branch on the repo. Use the Github UI or:
+
+```
+git push --delete upstream-push release-next
+```
+
+11. Finally [create a new release on
+    Github](https://github.com/XRPLF/rippled/releases).
+
+#### Release candidates after the first
+
+Once the first release candidate is [merged into
+release](#making-the-release), then `release` and `develop` _are allowed
+to diverge_.
+
+If a bug or issue is discovered in a version that has a release
+candidate being tested, any fix and new version will need to be applied
+against `release`, then reverse-merged to `develop`. This helps keep git
+history as linear as possible.
+
+A `release-next` branch will be created from `release`, and any further
+work for that release must be based on `release-next`. Specifically,
+PRs must use `release-next` as the base, and those PRs will be merged
+directly to `release-next` when approved. Changes should be restricted
+to bug fixes, but other changes may be necessary from time to time.
+
+1. Open any PRs for the pending release using `release-next` as the base,
+   so they can be merged directly in to it. Unlike `develop`, though,
+   `release-next` can be thrown away and recreated if necessary.
+2. Once a new release candidate is ready, create a version commit as in
+   step 1 [above](#making-the-release) on `release-next`. You can use
+   the [update-version] script for this, too.
+3. Jump to step 8 ("Now create a Pull Request for `release-next` with
+   **`release`** as the base") from the process
+   [above](#making-the-release) to merge `release-next` into `release`.
+
+##### Follow up: reverse merge
+
+Once the RC is merged and tagged, it needs to be reverse merged into
+`develop` as soon as possible.
+
+1. Create a branch, based on `upstream/develop`.
+   The branch name is not important, but could include "mergeNNNrcN".
+   E.g. For release A.B.C-rcD, use `mergeABCrcD`.
+
+```
+git fetch upstreams
+
+git checkout --no-track -b mergeABCrcD upstream/develop
+```
+
+2. Merge `release` into your branch.
+
+```
+# I like the "--edit --log --verbose" parameters, but they are
+# not required.
+git merge upstream/release
+```
+
+3. `BuildInfo.cpp` will have a conflict with the version number.
+   Resolve it with the version from `develop` - the higher version.
+4. Push your branch to your repo (or `upstream` if you have permission),
+   and open a normal PR against `develop`. The "High level overview" can
+   simply indicate that this is a merge of the RC. The "Context" should
+   summarize the changes from the RC. Include the following text
+   prominently:
+
+```
+This PR must be merged manually using a push. Do not use the Github UI.
+```
+
+5. Depending on the complexity of the changes, and/or merge conflicts,
+   the PR may need a thorough review, or just a sign-off that the
+   merge was done correctly.
+6. If `develop` is updated before this PR is merged, do not merge
+   `develop` back into your branch. Instead rebase preserving merges,
+   or do the merge again. (See also the `rerere` git config setting.)
+
+```
+git rebase --rebase-merges upstream/develop
+# OR
+git reset --hard upstream/develop
+git merge upstream/release
+```
+
+7. When the PR is ready, push it to `develop`.
+
+```
+git fetch upstreams
+
+# Make sure the commits look right
+git log --show-signature "upstream/develop^..HEAD"
+
+git push upstream-push mergeABCrcD:develop
+
+git fetch upstreams
+```
+
+Development on `develop` can proceed as normal.
+
+#### Final releases
+
+A final release is any release that is not a beta or RC, such as 2.2.0.
+
+Only code that has already been tested and vetted across all three
+platforms should be included in a final release. Most of the time, that
+means that the commit immediately preceding the commit setting the
+version number will be an RC. Occasionally, there may be last-minute bug
+fixes included as well. If so, those bug fixes must have been tested
+internally as if they were RCs (at minimum, ensuring unit tests pass,
+and the app starts, syncs, and stops cleanly across all three
+platforms.)
+
+_If in doubt, make an RC first._
+
+The process for building a final release is very similar to [the process
+for building a beta](#making-the-release), except the code will be
+moving from `release` to `master` instead of from `develop` to
+`release`, and both branches will be pushed at the same time.
+
+1. Ensure there is no old `master-next` branch hanging around.
+   Then make a `master-next` branch that only changes the version
+   number. As above, or using the
+   [update-version] script.
+2. Create a Pull Request for `master-next` with **`master`** as
+   the base branch. Instead of the default template, reuse and update
+   the message from the previous final release. Include the following verbiage
+   somewhere in the description:
+
+```
+The base branch is `master`. This PR branch will be pushed directly to
+`release` and `master` (not squashed or rebased, and not using the
+GitHub UI).
+```
+
+7. Sign-offs for the three platforms (Linux, Mac, Windows) usually occur
+   offline, but at least one approval will be needed on the PR.
+   - If issues are discovered during testing, close the PR, delete
+     `master-next`, and move development back to `release`, [issuing
+     more RCs as necessary](#release-candidates-after-the-first)
+8. Once everything is ready to go, push to `release` and `master`.
+
+```
+git fetch upstreams
+
+# Just to be safe, do dry runs first:
+git push --dry-run upstream-push master-next:release
+git push --dry-run upstream-push master-next:master
+
+# If everything looks right, push the branch
+git push upstream-push master-next:release
+git push upstream-push master-next:master
+
+# Check that all of the branches are updated
+git fetch upstreams
+git log -1 --oneline
+# The output should look like:
+# 0123456789 (HEAD -> upstream/master-next, upstream/master,
+#            upstream/release) Set version to A.B.0
+# Note that both upstream/release and upstream/master must be on this
+# commit.
+# Other branches, including some from upstream-push, may also be
+# present.
+```
+
+9. Tag the release, too.
+
+```
+git tag <version number>
+git push upstream-push <version number>
+```
+
+10. Delete the `master-next` branch on the repo. Use the Github UI or:
+
+```
+git push --delete upstream-push master-next
+```
+
+11. [Create a new release on
+    Github](https://github.com/XRPLF/rippled/releases). Be sure that
+    "Set as the latest release" is checked.
+12. Open a PR to update the [API-CHANGELOG](API-CHANGELOG.md) and `API-VERSION-[n].md` with the changes for this release (if any are missing).
+13. Finally, [reverse merge the release into `develop`](#follow-up-reverse-merge).
+
+#### Special cases: point releases, hotfixes, etc.
+
+On occasion, a bug or issue is discovered in a version that already
+had a final release. Most of the time, development will have started
+on the next version, and will usually have changes in `develop`
+and often in `release`.
+
+Because git history is kept as linear as possible, any fix and new
+version will need to be applied against `master`.
+
+The process for building a hotfix release is very similar to [the
+process for building release candidates after the
+first](#release-candidates-after-the-first) and [for building a final
+release](#final-releases), except the changes will be done against
+`master` instead of `release`.
+
+If there is only a single issue for the hotfix, the work can be done in
+any branch. When it's ready to merge, jump to step 3 using your branch
+instead of `master-next`.
+
+1. Create a `master-next` branch from `master`.
+
+```
+git checkout --no-track -b master-next upstream/master
+git push upstream-push
+git fetch upstreams
+```
+
+2. Open any PRs for the pending hotfix using `master-next` as the base,
+   so they can be merged directly in to it. Unlike `develop`, though,
+   `master-next` can be thrown away and recreated if necessary.
+3. Once the hotfix is ready, create a version commit using the same
+   steps as above, or use the
+   [update-version] script.
+4. Create a Pull Request for `master-next` with **`master`** as
+   the base branch. Instead of the default template, reuse and update
+   the message from the previous final release. Include the following verbiage
+   somewhere in the description:
+
+```
+The base branch is `master`. This PR branch will be pushed directly to
+`master` (not squashed or rebased, and not using the GitHub UI).
+```
+
+7. Sign-offs for the three platforms (Linux, Mac, Windows) usually occur
+   offline, but at least one approval will be needed on the PR.
+   - If issues are discovered during testing, update `master-next` as
+     needed, but ensure that the changes are properly squashed, and the
+     version setting commit remains last
+8. Once everything is ready to go, push to `master` **only**.
+
+```
+git fetch upstreams
+
+# Just to be safe, do a dry run first:
+git push --dry-run upstream-push master-next:master
+
+# If everything looks right, push the branch
+git push upstream-push master-next:master
+
+# Check that all of the branches are updated
+git fetch upstreams
+git log -1 --oneline
+# The output should look like:
+# 0123456789 (HEAD -> upstream/master-next, upstream/master) Set version
+#            to 2.4.1
+# Note that upstream/master must be on this commit. upstream/release and
+# upstream/develop should not.
+# Other branches, including some from upstream-push, may also be
+# present.
+```
+
+9. Tag the release, too.
+
+```
+git tag <version number>
+git push upstream-push <version number>
+```
+
+9. Delete the `master-next` branch on the repo.
+
+```
+git push --delete upstream-push master-next
+```
+
+10. [Create a new release on
+    Github](https://github.com/XRPLF/rippled/releases). Be sure that
+    "Set as the latest release" is checked.
+
+Once the hotfix is released, it needs to be reverse merged into
+`develop` as soon as possible. It may also need to be merged into
+`release` if a release candidate is under development.
+
+1. Create a branch in your own repo, based on `upstream/develop`.
+   The branch name is not important, but could include "mergeNNN".
+   E.g. For release 2.2.3, use `merge223`.
+
+```
+git fetch upstreams
+
+git checkout --no-track -b merge223 upstream/develop
+```
+
+2. Merge master into your branch.
+
+```
+# I like the "--edit --log --verbose" parameters, but they are
+# not required.
+git merge upstream/master
+```
+
+3. `BuildInfo.cpp` will have a conflict with the version number.
+   Resolve it with the version from `develop` - the higher version.
+4. Push your branch to your repo, and open a normal PR against
+   `develop`. The "High level overview" can simply indicate that this
+   is a merge of the hotfix version. The "Context" should summarize
+   the changes from the hotfix. Include the following text
+   prominently:
+
+```
+This PR must be merged manually using a --ff-only merge. Do not use the Github UI.
+```
+
+5. Depending on the complexity of the hotfix, and/or merge conflicts,
+   the PR may need a thorough review, or just a sign-off that the
+   merge was done correctly.
+6. If `develop` is updated before this PR is merged, do not merge
+   `develop` back into your branch. Instead rebase preserving merges,
+   or do the merge again. (See also the `rerere` git config setting.)
+
+```
+git rebase --rebase-merges upstream/develop
+# OR
+git reset --hard upstream/develop
+git merge upstream/master
+```
+
+7. When the PR is ready, push it to `develop`.
+
+```
+git fetch upstreams
+
+# Make sure the commits look right
+git log --show-signature "upstream/develop..HEAD"
+
+git push upstream-push HEAD:develop
+```
+
+Development on `develop` can proceed as normal. It is recommended to
+create a beta (or RC) immediately to ensure that everything worked as
+expected.
+
+##### An even rarer scenario: A hotfix on an old release
+
+Historically, once a final release is tagged and packages are released,
+versions older than the latest final release are no longer supported.
+However, there is a possibility that a very high severity bug may occur
+in a non-amendment blocked version that is still being run by
+a significant fraction of users, which would necessitate a hotfix / point
+release to that version as well as any later versions.
+
+This scenario would follow the same basic procedure as above,
+except that _none_ of `develop`, `release`, or `master`
+would be touched during the release process.
+
+In this example, consider if version 2.1.1 needed to be patched.
+
+1. Create two branches in the main (`upstream`) repo.
+
+```
+git fetch upstreams
+
+# Create a base branch off the tag
+git checkout --no-track -b master-2.1.2 2.1.1
+git push upstream-push
+
+# Create a working branch
+git checkout --no-track -b master212-next master-2.1.2
+git push upstream-push
+
+git fetch upstreams
+```
+
+2. Work continues as above, except using `master-2.1.2`as
+   the base branch for any merging, packaging, etc.
+3. After the release is tagged and packages are built, you could
+   potentially delete both branches, e.g. `master-2.1.2` and
+   `master212-next`. However, it may be useful to keep `master-2.1.2`
+   around indefinitely for reference.
+4. Assuming that a hotfix is also released for the latest
+   version in parallel with this one, or if the issue is
+   already fixed in the latest version, do no do any
+   reverse merges. However, if it is not, it probably makes
+   sense to reverse merge `master-2.1.2` into `master`,
+   release a hotfix for _that_ version, then reverse merge
+   from `master` to `develop`. (Please don't do this unless absolutely
+   necessary.)
 
 [contrib]: https://docs.github.com/en/get-started/quickstart/contributing-to-projects
 [squash]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/about-pull-request-merges#squash-and-merge-your-commits
@@ -641,3 +1205,5 @@ are described in [RELEASING.md](./RELEASING.md).
 [xrpld]: https://github.com/XRPLF/rippled
 [signing]: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification
 [setup-upstreams]: ./bin/git/setup-upstreams.sh
+[squash-branches]: ./bin/git/squash-branches.sh
+[update-version]: ./bin/git/update-version.sh

RELEASING.md

@@ -1,152 +0,0 @@
-# Branching and Release Management
-
-This document describes how we branch, release, and merge releases back into `develop`.
-It does not define version naming
-(e.g., what constitutes a major-minor, patch, or beta release).
-
-Examples use `X.Y` for a release line:
-`X` and `Y` are placeholders, while the trailing `x` is literal,
-e.g., `release/X.Y.x` is `release/3.4.x` for the `3.4` line.
-
-## Branches
-
-| Branch          | Purpose                                                                                   |
-| :-------------- | :---------------------------------------------------------------------------------------- |
-| `develop`       | Main development branch. Betas and the first RC of a major-minor release are tagged here. |
-| `staging/X.Y.x` | Where fixes for the `X.Y` line are developed and RCs are prepared.                        |
-| `release/X.Y.x` | The last public RC or release of the `X.Y` line.                                          |
-
-A release line is named `X.Y.x`
-because one branch serves every patch release of that line (`X.Y.0`, `X.Y.1`, `X.Y.2`, ...).
-The `/` groups branches hierarchically,
-so tools can filter them and protection rules can target `release/*` and `staging/*`.
-
-## Principles
-
-- **Releases are merged back into `develop`, never cherry-picked or rebased onto it.**
-  Cherry-picked and rebased commits get new hashes,
-  so Git can't tell that `develop` already has them.
-  Future merges then replay them and produce artificial conflicts,
-  and it's hard to verify that every fix actually reached `develop`.
-  Merging keeps a single history:
-  Git knows exactly which release commits `develop` contains,
-  and no fix is left behind.
-- **Branches only move forward.**
-  `develop`, `staging/X.Y.x`, and `release/X.Y.x` are never rewritten.
-- **Cherry-picking only goes from `develop` to a staging branch**,
-  for fixes that must get into a release after the code freeze
-  (see [Emergency Fixes From `develop`](#emergency-fixes-from-develop)).
-- **Security fixes are prepared privately and published with the release that contains them**,
-  so vulnerabilities are not disclosed prematurely.
-
-## Release Lifecycle
-
-This diagram shows a major-minor release and its first patch release.
-The staging and release branches are drawn as one line.
-
-```text
-develop                            staging/X.Y.x & release/X.Y.x
-   │
-   ├── Tag: X.Y.0-b1
-   ├── Tag: X.Y.0-bN
-   ├── Tag: X.Y.0-rc1 ───────────────┐ (branches created)
-   │                                 │
-   │  (development continues)        ├── Fixes
-   │                                 ├── Tag: X.Y.0-rcN
-   │                                 ├── Tag: X.Y.0 (final)
-   ◀──── (merge) ────────────────────┤
-   │                                 ├── Fixes
-   │                                 ├── Tag: X.Y.1-rcN
-   │                                 ├── Tag: X.Y.1 (final)
-   ◀──── (merge) ────────────────────┤
-   │
-   ▼
-```
-
-### Betas, First RC & Branching
-
-> [!NOTE]
-> This phase applies only to a new major-minor release (e.g., `X.Y.0`).
-> Patch releases work on the existing branches of the line.
-
-1. **Betas:** All beta versions (e.g., `X.Y.0-b1`) are built and tagged directly on `develop`.
-2. **First RC:** We release the first RC (`X.Y.0-rc1`)
-   once everything that should be included in the release has been merged.
-3. **Branches:** `staging/X.Y.x` and `release/X.Y.x` are created from `develop`
-   at the commit tagged `X.Y.0-rc1`.
-   The first RC also kicks off the QE process.
-4. **Code freeze:** No new features or unrelated changes are pulled from `develop`
-   into `staging/X.Y.x` or `release/X.Y.x`.
-   Only critical stabilization fixes go into the line.
-5. **No large changes on `develop`:** Until `X.Y.0` is [merged back](#merging-back-into-develop),
-   large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
-   are not merged into `develop`,
-   so that fixes on the line and the merge back don't run into conflicts.
-
-### Release Candidates
-
-1. Fixes are developed against `staging/X.Y.x`.
-2. When ready, a new RC is created on `staging/X.Y.x`,
-   and `release/X.Y.x` is fast-forwarded to it.
-
-RCs that contain unpublished security fixes are not published,
-and don't touch the public branches.
-
-RCs are not merged back into `develop`:
-`X.Y.0-rc1` is tagged on `develop` itself,
-and all later changes reach `develop` with the [final release](#final-release).
-
-### Final Release
-
-Security fixes become public as soon as they reach the public repo,
-so these steps happen only once the release is ready to be published,
-one right after the other.
-
-1. Unpublished security fixes, if any, are merged into `staging/X.Y.x`.
-2. `release/X.Y.x` is fast-forwarded to `staging/X.Y.x`,
-   and the release is tagged on it.
-3. The release is immediately [merged back into `develop`](#merging-back-into-develop).
-   For a major-minor release, this lifts the freeze on large changes in `develop`.
-
-### Merging Back Into `develop`
-
-The merge back is a regular PR into `develop`
-whose branch contains a real merge commit of the release tag:
-
-1. Create a branch from `develop`, run `git merge --no-ff <tag>`, and resolve any conflicts.
-2. Once the PR is approved, `develop` is fast-forwarded to the PR branch,
-   so the merge commit lands as it is.
-   Never squash or rebase it.
-   Never add it to the merge queue either: the queue squashes PRs, which would drop the merge commit.
-3. If `develop` moves while the PR is open, redo the merge on top of the new `develop`.
-
-After the merge, `git log develop..<tag>` must be empty.
-
-## Special Cases
-
-### Emergency Fixes From `develop`
-
-If a commit was merged to `develop`
-and needs to be included in a release after the code freeze:
-
-1. Create a PR that cherry-picks the commit onto `staging/X.Y.x`.
-2. Leave `develop` as it is, with no reverts.
-3. Follow the [release candidates](#release-candidates) process as usual.
-
-When the release is later merged back into `develop`,
-both sides already contain the same change,
-so the merge usually resolves it cleanly or with a trivial conflict.
-From Git's perspective, the cherry-picked commit then becomes part of `develop` too.
-
-### Several Supported Lines
-
-When a fix must ship in more than one supported line (e.g., `X.Y` and `X.(Y+1)`),
-the lines are merged upwards rather than cherry-picked between:
-
-1. The fix goes into the oldest line first.
-2. After that line's release,
-   its `release/X.Y.x` is merged into the staging branch of the next newer line,
-   and so on up to the newest line.
-3. The newest line is merged back into `develop` as usual.
-
-This way every newer line, and eventually `develop`, contains the history of the older lines.

bin/check-nix-store-refs.sh

@@ -10,7 +10,7 @@
 # alone; the scripts in a Conan cache are all git hook samples and autotools
 # scratch, 36 false positives to 0 real.
 #
-# Usage: bin/nix/check-nix-store-refs.sh <path>
+# Usage: bin/check-nix-store-refs.sh <path>
 
 set -euo pipefail
 

bin/check-tools.sh

@@ -20,32 +20,19 @@
 # development setups, but not in the macOS CI environment. They are checked
 # everywhere except when running in CI on macOS.
 #
-# Tools that Nix also exposes under a version-suffixed name
-# (`clang-tidy-<v>`, `g++-<v>`, ...) are probed under both names:
-# a suffixed name can break while the plain one still works
-# (see mkVersionedToolLinks in nix/packages.nix).
-# The suffix is the major version of the plain `clang` / `gcc` on PATH.
-#
-# Tools scoped to a single dev shell rather than to commonPackages are checked
-# only in that shell, keyed off XRPL_DEVSHELL.
+# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
+# `g++-15`, ...) are probed under both names: a suffixed name can break while
+# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
 #
 # Environment variables:
 #   CI                      if set, skip the tools above when on macOS.
 #   CHECK_TOOLS_SKIP_CLONE  if set, skip the git-over-HTTPS connectivity check.
-#   XRPL_DEVSHELL           active dev shell; selects shell-specific tools.
 
 set -uo pipefail
 
-# major_version <compiler>
-# Major version of a compiler on PATH, or "unknown" when it isn't there.
-major_version() {
-    local version
-    version="$("$1" -dumpversion 2>/dev/null)" || version=""
-    version="${version%%.*}"
-    printf '%s' "${version:-unknown}"
-}
-
-llvm_version="$(major_version clang)"
+# Version suffixes of the Nix tool links, tracking nix/packages.nix.
+gcc_version=15
+llvm_version=22
 
 missing=()
 checked=0
@@ -121,7 +108,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check ClangBuildAnalyzer
     check curl
     check file
-    check jq
     check less
     check make
     # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
@@ -177,20 +163,11 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check rustfmt
 fi
 
-# Lean4 is in the formal-verification shell only, not in commonPackages.
-if [ "${XRPL_DEVSHELL:-}" = "formal-verification" ]; then
-    echo
-    echo "Formal verification toolchain:"
-    check lean
-    check lake
-fi
-
 # GCC is the default compiler on Linux. macOS uses the system Apple Clang
 # instead, so GCC/g++/gcov are not expected there.
 if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
-    gcc_version="$(major_version gcc)"
     check gcc
     check "gcc-${gcc_version}"
     check g++

bin/nix/check-build-context-runtime.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# Fail if a binary of a build-context Conan package loads anything from the Nix
-# store other than glibc, or cannot resolve a library at all.
-#
-# Only binaries linked by the Nix toolchain are checked, i.e. those recording a
-# store path as their interpreter or RUNPATH. Prebuilt upstream binaries (such
-# as the ones the cmake package ships) use the system loader instead.
-#
-# Build-context packages provide the tools that run during the build (protoc,
-# grpc_cpp_plugin, ...). Their package ID does not change when a Nix toolchain
-# update moves the GCC runtime to a new store path, so a cached binary has to
-# get by with the pinned glibc alone. See docs/build/nix.md.
-#
-# Usage: bin/nix/check-build-context-runtime.sh <graph.json>
-#   <graph.json> is the output of `conan install --format=json`.
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ]; then
-    echo "usage: $0 <graph.json>" >&2
-    exit 2
-fi
-
-if [ "$(uname -s)" != "Linux" ]; then
-    echo "$0: Linux only" >&2
-    exit 2
-fi
-
-folders="$(jq -r '.graph.nodes[] | select(.context == "build" and .package_folder) | .package_folder' "$1" | sort -u)"
-
-checked=0
-failed=0
-
-while IFS= read -r file; do
-    case "$(file -b "${file}")" in
-        ELF*) ;;
-        *) continue ;;
-    esac
-    [[ "$(readelf -ldW "${file}")" == */nix/store/* ]] || continue
-    checked=$((checked + 1))
-
-    # `ldd` lists the interpreter and every library as the loader resolves them.
-    if deps="$(ldd "${file}" 2>&1)"; then
-        bad="$(printf '%s\n' "${deps}" |
-            grep -E 'not found|/nix/store/' |
-            grep -vE '/nix/store/[^/]+-glibc-[^/]+/' || true)"
-    else
-        case "${deps}" in
-            *"not a dynamic executable"*) continue ;;
-        esac
-        bad="${deps}"
-    fi
-    if [ -n "${bad}" ]; then
-        failed=$((failed + 1))
-        echo "::error file=${file}::loads a library from the Nix store other than glibc"
-        echo "${file}"
-        echo "${bad}" | sed 's/^/    /'
-    fi
-done < <(
-    # shellcheck disable=SC2086 # one folder per line, no spaces in Conan paths
-    [ -z "${folders}" ] || find ${folders} -type f \( -perm -u+x -o -name '*.so*' \)
-)
-
-echo "Build-context packages: checked ${checked} binaries, ${failed} failed."
-[ "${failed}" -eq 0 ]

bin/pre-commit/Dockerfile

@@ -23,7 +23,7 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF
 
-ARG PRE_COMMIT_VERSION=4.6.2
+ARG PRE_COMMIT_VERSION=4.6.0
 RUN pip install --no-cache --break-system-packages \
     pre-commit==${PRE_COMMIT_VERSION}
 

bin/pre-commit/clang_tidy_check.py

@@ -26,6 +26,8 @@ import sys
 import tempfile
 from pathlib import Path
 
+CLANG_TIDY_VERSION = 22
+
 # Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
 # the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
 # compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
@@ -37,21 +39,8 @@ TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}
 FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
 
 
-def clang_tidy_major() -> str | None:
-    """Major version of the `clang-tidy` on PATH, which run-clang-tidy invokes."""
-    if not (clang_tidy := shutil.which("clang-tidy")):
-        return None
-    output = subprocess.run(
-        [clang_tidy, "--version"], capture_output=True, text=True
-    ).stdout
-    m = re.search(r"LLVM version (\d+)", output)
-    return m.group(1) if m else None
-
-
-def find_tool(name: str, version: str | None) -> str | None:
-    """Prefer `<name>-<version>`, so a host tool of another version can't win."""
-    candidates = ([f"{name}-{version}"] if version else []) + [name]
-    for candidate in candidates:
+def find_tool(name: str) -> str | None:
+    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
         if path := shutil.which(candidate):
             return path
     return None
@@ -114,9 +103,8 @@ def main():
     if not files:
         return 0
 
-    version = clang_tidy_major()
-    run_clang_tidy = find_tool("run-clang-tidy", version)
-    clang_apply_replacements = find_tool("clang-apply-replacements", version)
+    run_clang_tidy = find_tool("run-clang-tidy")
+    clang_apply_replacements = find_tool("clang-apply-replacements")
     missing = [
         name
         for name, path in (
@@ -126,10 +114,9 @@ def main():
         if not path
     ]
     if missing:
-        tried = f" (tried the '-{version}' suffix too)" if version else ""
         print(
             f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
-            f"was not found in PATH{tried}.",
+            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
             file=sys.stderr,
         )
         return 1

cmake/PatchNixBinary.cmake

@@ -17,7 +17,7 @@
    (runtime libraries resolved through the rpath) are skipped too.
    Everywhere else `patch_nix_binary` is a no-op.
 
-   The default loader is resolved by bin/nix/default-loader-path.sh.
+   The default loader is resolved by bin/default-loader-path.sh.
 #]===================================================================]
 
 include_guard(GLOBAL)
@@ -25,7 +25,7 @@ include_guard(GLOBAL)
 include(CompilationEnv)
 
 # Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/nix/default-loader-path.sh")
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")
 
 if(
     is_linux

cmake/XrplCore.cmake

@@ -292,14 +292,6 @@ if(xrpld)
     )
     target_sources(xrpld PRIVATE ${sources})
 
-    rpcspec_generate_instantiations(
-        OUT_VAR rpcspec_instantiations
-        VALUE_TYPE "::json::Value"
-        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
-        HANDLERS book_changes ledger transaction_entry
-    )
-    target_sources(xrpld PRIVATE ${rpcspec_instantiations})
-
     if(tests)
         file(
             GLOB_RECURSE sources
@@ -330,7 +322,6 @@ if(xrpld)
         # antithesis_instrumentation.h, which is not exported as INTERFACE
         target_include_directories(
             xrpld
-            SYSTEM
             PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
         )
     endif()

cmake/XrplSanitizers.cmake

@@ -77,24 +77,19 @@ if(is_clang)
     message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()
 
-# Define the SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN,
-# XRPL_TSAN and XRPL_UBSAN per active sanitizer, so that code can test for a
-# specific one with #ifdef instead of parsing the dot-joined SANITIZERS string.
+# Define SANITIZERS macro for BuildInfo.cpp
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
     set(enable_asan ON)
     list(APPEND sanitizers_list "ASAN")
-    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
     set(enable_tsan ON)
     list(APPEND sanitizers_list "TSAN")
-    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
     set(enable_ubsan ON)
     list(APPEND sanitizers_list "UBSAN")
-    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()
 
 if(sanitizers_list)

cmake/deps/Boost.cmake

@@ -39,21 +39,12 @@ if(Boost_COMPILER)
     target_link_libraries(xrpl_boost INTERFACE Boost::disable_autolinking)
 endif()
 
-# GCC 14+ has a false positive -Wuninitialized warning in Boost.Coroutine2's
-# state.hpp when compiled with -O3. This is due to GCC's intentional behavior
-# change (Bug #98871, #119388) where warnings from inlined system header code
-# are no longer suppressed by -isystem. The warning occurs in operator|= in
-# boost/coroutine2/detail/state.hpp when inlined from push_control_block::destroy().
-# See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119388
-if(is_gcc AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 14)
-    target_compile_options(xrpl_boost INTERFACE -Wno-uninitialized)
-endif()
-
 # Boost.Context's ucontext backend has ASAN fiber-switching annotations
 # (start/finish_switch_fiber) that are compiled in when BOOST_USE_ASAN is defined.
-# This tells ASAN about coroutine stack switches, preventing false positive
-# stack-use-after-scope errors. BOOST_USE_UCONTEXT ensures the ucontext backend
-# is selected (fcontext does not support ASAN annotations).
+# This tells ASAN about fiber stack switches used by boost::asio::spawn,
+# preventing false positive stack-use-after-scope errors.
+# BOOST_USE_UCONTEXT ensures the ucontext backend is selected (fcontext does
+# not support ASAN annotations).
 # These defines must match what Boost was compiled with (see conan/profiles/sanitizers).
 if(enable_asan)
     target_compile_definitions(

conan.lock

@@ -3,7 +3,7 @@
     "requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
+        "xrpl-rpc-spec/0.1.19#870b2d3abcfbbf13b61c2d3c69495060%1790348286.187549",
         "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
         "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -20,7 +20,7 @@
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
+        "grpc/1.81.1#b87796a4269034856cbc1a2522db16eb%1788275071.530512",
         "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1785888854.601666",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
@@ -34,15 +34,11 @@
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
         "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",

conan/global.conf

@@ -3,13 +3,5 @@
 core:non_interactive=True
 core.download:parallel={{ os.cpu_count() }}
 core.upload:parallel={{ os.cpu_count() }}
-# Fall back to Conan Center's source backups when a recipe's upstream URL is down
-# (e.g. the GNU FTP mirrors), see
-# https://github.com/conan-io/conan-center-index/issues/28147#issuecomment-3183544772
-# The backups are only tried once every upstream URL has used up its retries,
-# so keep the retries low.
-core.sources:download_urls=["origin", "https://c3i.jfrog.io/artifactory/conan-center-backup-sources"]
-tools.files.download:retry=1
+tools.files.download:retry=5
 tools.files.download:retry_wait=10
-# Fail fast on unreachable hosts (default connect timeout is 30s), keep the 60s read timeout.
-core.net.http:timeout=(5, 60)

conan/profiles/default

@@ -29,9 +29,9 @@ os.version={{ min_macos_version }}
 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
 {# Instead it hand-rolls the compiler for user-config.jam, #}
-{# and its fallback probes a version-suffixed binary (e.g. `g++-<major>`) before plain `g++`. #}
-{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-<major>` suffix), #}
-{# so on a host that also has a system `g++-<major>` the probe escapes Nix #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
 {# and picks the system compiler, which is mismatched with the Nix libraries #}
 {# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
 {# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
@@ -49,31 +49,8 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
 
-{% if os == "Linux" and context == "build" %}
-{# Build-context executables (protoc, grpc_cpp_plugin, build tools) run during the build #}
-{# and would otherwise load libstdc++/libgcc from a Nix store path #}
-{# that might change with a Nix toolchain update. #}
-{# --as-needed drops the ones they link but don't use, #}
-{# such as libatomic for grpc_cpp_plugin on arm64. #}
-{% set static_runtime_flags = ["-static-libstdc++", "-static-libgcc", "-Wl,--as-needed"] %}
-tools.build:exelinkflags+={{ static_runtime_flags }}
-tools.info.package_id:confs+=["tools.build:exelinkflags"]
-{% endif %}
-
-{% if os == "Linux" and context == "build" %}
-{# b2 links itself with its own script, which ignores exelinkflags #}
-{# and only takes CXXFLAGS when use_cxx_env is set (see [buildenv] below). #}
-[options]
-b2/*:use_cxx_env=True
-{% endif %}
-
-[buildenv]
-{# gRPC emits thousands of compiler warnings that we cannot act on. #}
-{# CMake picks up CXXFLAGS, and unlike tools.build:cxxflags, #}
-{# this is not part of the package ID, so binaries stay shareable. #}
-grpc/*:CXXFLAGS=-w
-
 {% if os == "Macos" %}
+[buildenv]
 {# os.version adds -mmacosx-version-min to compiler command lines, #}
 {# but Boost.Context's b2 assembly (.S) rule ignores it, #}
 {# so those objects keep the host SDK version and still warn at link time. #}
@@ -81,7 +58,3 @@ grpc/*:CXXFLAGS=-w
 {# Scoped to boost/* since it is the only gap. #}
 boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
 {% endif %}
-
-{% if os == "Linux" and context == "build" %}
-b2/*:CXXFLAGS={{ static_runtime_flags | join(" ") }}
-{% endif %}

conan/profiles/sanitizers

@@ -5,9 +5,6 @@ include(default)
 
 {% if not sanitizers %}
 {# Sanitizers not configured; no additional settings needed #}
-{% elif context == "build" %}
-{# Build-context packages are tools we run, not code we test, #}
-{# so don't instrument them #}
 {% else %}
 
 {% if compiler == "msvc" %}

conanfile.py

@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
         "nudb/2.0.9",
         "openssl/3.6.3",
         "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.21",
+        "xrpl-rpc-spec/0.1.19",
         "zlib/1.3.2",
     ]
 
@@ -49,8 +49,7 @@ class Xrpl(ConanFile):
     ]
 
     tool_requires = [
-        "grpc/<host_version>",
-        "protobuf/<host_version>",
+        "protobuf/6.33.5",
     ]
 
     default_options = {
@@ -68,7 +67,7 @@ class Xrpl(ConanFile):
         "boost/*:without_cobalt": True,
         "boost/*:without_context": False,
         "boost/*:without_coroutine": True,
-        "boost/*:without_coroutine2": False,
+        "boost/*:without_coroutine2": True,
         "date/*:header_only": True,
         "ed25519/*:shared": False,
         "grpc/*:shared": False,
@@ -124,10 +123,6 @@ class Xrpl(ConanFile):
         "xxhash/*:shared": False,
     }
 
-    # default_options only reach the host context;
-    # give tool_requires (and their dependencies) the same dependency options.
-    default_build_options = {k: v for k, v in default_options.items() if "/" in k}
-
     def set_version(self):
         self.version = self.version or DEV_VERSION
 
@@ -154,7 +149,7 @@ class Xrpl(ConanFile):
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
-        "bin/nix/default-loader-path.sh",
+        "bin/default-loader-path.sh",
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",

crates/CMakeLists.txt

@@ -80,12 +80,13 @@ function(add_xrpl_crate name)
     # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
     # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
     if(is_msvc)
-        corrosion_set_env_vars(${ARG_CRATE} "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>")
+        corrosion_set_env_vars(
+            ${ARG_CRATE}
+            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
+        )
     endif()
-    corrosion_add_cxxbridge(
-        ${name}_cxxbridge
-        CRATE ${ARG_CRATE}
-        FILES ${ARG_FILES}
+    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
+                            ${ARG_FILES}
     )
     # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
     # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the

docs/build/environment.md

@@ -10,15 +10,14 @@ This document explains how to set one up.
 support it — see [compiler support for C++23][cpp23-support].
 The versions currently tested in CI are:
 
-| Compiler    | Version                         |
-| ----------- | ------------------------------- |
-| GCC         | `gccVersion` in [packages.nix]  |
-| Clang       | `llvmVersion` in [packages.nix] |
-| Apple Clang | 21                              |
-| MSVC        | Visual Studio 2026              |
+| Compiler    | Version            |
+| ----------- | ------------------ |
+| GCC         | 15.2               |
+| Clang       | 22                 |
+| Apple Clang | 21                 |
+| MSVC        | Visual Studio 2026 |
 
-LLVM tools (`clang-tidy` and `clang-format`)
-come from the same LLVM release as Clang.
+LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
 
 ### Older compilers
 
@@ -157,4 +156,3 @@ version out of the box — run it via `run-clang-tidy`. No separate installation
 is needed.
 
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
-[packages.nix]: ../../nix/packages.nix

docs/build/nix.md

@@ -183,36 +183,24 @@ at link or run time.
 > configuration CI covers, and no dependency binaries are published for it.
 
 This is checked rather than assumed.
-[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) takes one
-file or directory and fails if a binary under it resolves a store path at run time.
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) takes one file
+or directory and fails if a binary under it resolves a store path at run time.
 CI runs it over the build output and the Conan cache, and again in the upload job
 before anything is published. You can run it yourself:
 
 ```bash
-bin/nix/check-nix-store-refs.sh build
-bin/nix/check-nix-store-refs.sh ~/.conan2-nix
+bin/check-nix-store-refs.sh build
+bin/check-nix-store-refs.sh ~/.conan2-nix
 ```
 
 It works on Linux too, but asserts something narrower there: the toolchain always
-writes the store into `PT_INTERP` and `RUNPATH`. That is fine for the pinned
-glibc, whose path does not move, but not for the GCC runtime, which moves with
-every GCC update. So [`conan/profiles/default`](../../conan/profiles/default)
-links build-context packages, whose executables run during the build, with
-`-static-libstdc++ -static-libgcc -Wl,--as-needed`, and
-[`conan/profiles/sanitizers`](../../conan/profiles/sanitizers) does not
-instrument them. CI checks that they load nothing from the store but glibc, from
-the graph `conan install --format=json` writes:
+writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
+whose store is fixed for its lifetime, so that is fine. Only the binaries
+[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
+system loader have to be clean, and those are what CI checks:
 
 ```bash
-bin/nix/check-build-context-runtime.sh graph.json
-```
-
-Only the binaries [`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake)
-retargets to the system loader have to be fully clean, and those are what CI
-checks:
-
-```bash
-bin/nix/check-nix-store-refs.sh build/xrpld
+bin/check-nix-store-refs.sh build/xrpld
 ```
 
 ### The libresolv stub

docs/build/nix_troubleshooting.md

@@ -178,11 +178,11 @@ A binary stops starting after a `nix flake update`, or after
 dyld[57271]: Library not loaded: /nix/store/…-libresolv-93/lib/libresolv.9.dylib
 ```
 
-[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) finds the
-same thing without having to run anything, and names the file:
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) finds the same
+thing without having to run anything, and names the file:
 
 ```
-$ bin/nix/check-nix-store-refs.sh ~/.conan2-nix
+$ bin/check-nix-store-refs.sh ~/.conan2-nix
 ::error file=/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig::references the Nix store at run time
 /Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig
     /nix/store/p4lp3xq4imd1qzqh08x8vcq2zfhi7rca-libresolv-93/lib/libresolv.9.dylib

external/antithesis-sdk/CMakeLists.txt

@@ -6,7 +6,7 @@ project(antithesis-sdk-cpp VERSION 0.4.4 LANGUAGES CXX)
 add_library(antithesis-sdk-cpp INTERFACE antithesis_sdk.h)
 
 # Note, both sections below created by xrpld project
-target_include_directories(antithesis-sdk-cpp SYSTEM INTERFACE
+target_include_directories(antithesis-sdk-cpp INTERFACE
   $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
   $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
 )

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1791130267,
-        "narHash": "sha256-1sjwcQMcgAbmiip/VivBSiK8p2bTkQGOvCuO7vnwfx4=",
+        "lastModified": 1781173989,
+        "narHash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9013764fcc0ea99fa16cf7aa7decf8a5c3889dd2",
+        "rev": "8c91a71d13451abc40eb9dae8910f972f979852f",
         "type": "github"
       },
       "original": {
@@ -47,11 +47,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1791189933,
-        "narHash": "sha256-Y8eN7ki0Urx4Ojf4w1xSpWg8uk/3lJqK+E0Oth77rH0=",
+        "lastModified": 1784611586,
+        "narHash": "sha256-OfqgY+0hp/zseZB7uyH0U8kIDPS4scZZCyAurEplvG0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "e60029353d0c48d216bc4b065168ccd4079c166f",
+        "rev": "14f58845249f3552a89b07772626b8d3c632fa86",
         "type": "github"
       },
       "original": {

include/xrpl/basics/MathUtilities.h

@@ -3,84 +3,9 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
-#include <cstdint>
-#include <limits>
-#include <optional>
 
 namespace xrpl {
 
-/**
- * Add two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical sum is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedAdd(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
-        return std::nullopt;
-
-    return a + b;
-}
-
-/**
- * Subtract two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical difference is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedSub(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
-        return std::nullopt;
-
-    return a - b;
-}
-
-static_assert(checkedAdd(0, 0) == 0);
-static_assert(checkedAdd(1, -1) == 0);
-static_assert(checkedAdd(-5, 2) == -3);
-static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::max(), 1).has_value());
-static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::min(), -1).has_value());
-static_assert(
-    checkedAdd(std::numeric_limits<std::int64_t>::max() - 1, 1) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedAdd(
-        std::numeric_limits<std::int64_t>::min(),
-        std::numeric_limits<std::int64_t>::max()) == -1);
-static_assert(
-    checkedAdd(
-        std::numeric_limits<std::int64_t>::max(),
-        std::numeric_limits<std::int64_t>::min()) == -1);
-static_assert(
-    !checkedAdd(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::max())
-         .has_value());
-static_assert(
-    !checkedAdd(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::min())
-         .has_value());
-
-static_assert(checkedSub(0, 0) == 0);
-static_assert(checkedSub(1, 1) == 0);
-static_assert(checkedSub(-5, 2) == -7);
-static_assert(checkedSub(-5, -2) == -3);
-static_assert(!checkedSub(std::numeric_limits<std::int64_t>::min(), 1).has_value());
-static_assert(!checkedSub(std::numeric_limits<std::int64_t>::max(), -1).has_value());
-static_assert(
-    checkedSub(std::numeric_limits<std::int64_t>::min() + 1, 1) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedSub(-1, std::numeric_limits<std::int64_t>::max()) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    !checkedSub(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::min())
-         .has_value());
-static_assert(
-    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
-         .has_value());
-
 /**
  * Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]

include/xrpl/basics/Number.h

@@ -110,10 +110,10 @@ static_assert(
  *
  * However, it does not have sufficient precision to represent the full integer
  * range of int64_t values (-2^63 to 2^63-1), which are needed for XRP and MPT
- * values. The implementation of SingleAssetVault, LendingProtocol, and
- * MPTokensV2 need to represent those integer values accurately and precisely,
- * both for the STNumber field type, and for internal calculations. That
- * necessitated the "large" scale.
+ * values. The implementation of SingleAssetVault, and LendingProtocol need to
+ * represent those integer values accurately and precisely, both for the
+ * STNumber field type, and for internal calculations. That necessitated the
+ * "large" scale.
  *
  * The "Large" scales are intended to represent all values that can be represented
  * by an STAmount - IOUs, XRP, and MPTs. It has a min value of 10^18, and a max
@@ -134,8 +134,8 @@ struct MantissaRange final
     // NOLINTBEGIN(readability-enum-initial-value)
     // The values don't matter, except for Large
     enum class MantissaScale {
-        // Small can be removed when any of featureSingleAssetVault, featureLendingProtocol, or
-        // featureMPTokensV2 are retired
+        // Small can be removed when either featureSingleAssetVault or featureLendingProtocol are
+        // retired
         Small,
         // LargeLegacy can be removed when fixCleanup3_2_0 is retired
         LargeLegacy,
@@ -311,10 +311,10 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  *
  * The mantissa range may be changed at runtime via setMantissaScale(). The
  * default mantissa range is "large". The range is updated whenever transaction
- * processing begins, based on whether SingleAssetVault, LendingProtocol, or
- * MPTokensV2 are enabled. If any is enabled, the mantissa range is set to
- * "large". If not, it is set to "small", preserving backward compatibility and
- * correct "amendment-gating".
+ * processing begins, based on whether SingleAssetVault or LendingProtocol are
+ * enabled. If either is enabled, the mantissa range is set to "large". If not,
+ * it is set to "small", preserving backward compatibility and correct
+ * "amendment-gating".
  *
  * It is extremely unlikely that any more calls to setMantissaScale() will be
  * needed outside of unit tests.
@@ -344,8 +344,8 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  * set/getMantissaScale() functions may be most appropriate. However, if the
  * test has anything to do with transaction processing, it should enable or
  * disable the amendments that control the mantissa range choice
- * (SingleAssetVault, LendingProtocol, and MPTokensV2), and/or check if any of
- * those amendments are enabled to determine which result to expect.
+ * (SingleAssetVault and LendingProtocol), and/or check if either of those
+ * amendments are enabled to determine which result to expect.
  */
 class Number final
 {

include/xrpl/basics/StringUtilities.h

@@ -36,7 +36,7 @@ template <typename T>
 concept SomeChar = std::same_as<std::remove_cvref_t<T>, int8_t> ||
     std::same_as<std::remove_cvref_t<T>, char> || std::same_as<std::remove_cvref_t<T>, uint8_t>;
 
-inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = [] {
+inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = []() {
     std::array<std::optional<int>, 256> t{};
 
     for (int i = 0; i < 10; ++i)

include/xrpl/basics/TaggedCache.ipp

@@ -783,7 +783,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this] {
+    return std::thread([&, this]() {
         int cacheRemovals = 0;
         int mapRemovals = 0;
 
@@ -863,7 +863,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this] {
+    return std::thread([&, this]() {
         // NOLINTBEGIN https://github.com/XRPLF/rippled/issues/7056
         int cacheRemovals = 0;
         int mapRemovals = 0;

include/xrpl/basics/partitioned_unordered_map.h

@@ -17,7 +17,7 @@
 namespace xrpl {
 
 template <typename Key>
-std::size_t
+static std::size_t
 extract(Key const& key)
 {
     return key;

include/xrpl/beast/container/detail/aged_ordered_container.h

@@ -1604,7 +1604,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
     requires(!IsBoostReverseIterator<Iterator>::value)
 {
-    unlinkAndDeleteElement(&*(pos++).iterator());
+    unlinkAndDeleteElement(&*((pos++).iterator()));
     return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }
 
@@ -1617,7 +1617,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
     requires(!IsBoostReverseIterator<Iterator>::value)
 {
     for (; first != last;)
-        unlinkAndDeleteElement(&*(first++).iterator());
+        unlinkAndDeleteElement(&*((first++).iterator()));
 
     return beast::detail::AgedContainerIterator<false, Iterator>(first.iterator());
 }

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -2404,7 +2404,7 @@ beast::detail::AgedContainerIterator<false, Iterator>
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::erase(
     beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
 {
-    unlinkAndDeleteElement(&*(pos++).iterator());
+    unlinkAndDeleteElement(&*((pos++).iterator()));
     return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }
 
@@ -2424,7 +2424,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
     beast::detail::AgedContainerIterator<IsConst, Iterator> last)
 {
     for (; first != last;)
-        unlinkAndDeleteElement(&*(first++).iterator());
+        unlinkAndDeleteElement(&*((first++).iterator()));
 
     return beast::detail::AgedContainerIterator<false, Iterator>(first.iterator());
 }

include/xrpl/beast/hash/hash_append.h

@@ -390,7 +390,7 @@ void
 hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
     requires(IsContiguouslyHashable<Key, Hasher>::value)
 {
-    h(&v.begin(), v.size() * sizeof(Key));
+    h(&(v.begin()), v.size() * sizeof(Key));
 }
 // tuple
 

include/xrpl/beast/insight/HookImpl.h

@@ -8,7 +8,7 @@ namespace beast::insight {
 class HookImpl : public std::enable_shared_from_this<HookImpl>
 {
 public:
-    using HandlerType = std::function<void()>;
+    using HandlerType = std::function<void(void)>;
 
     virtual ~HookImpl() = 0;
 };

include/xrpl/beast/net/IPAddress.h

@@ -61,7 +61,7 @@ isMulticast(Address const& addr)
 inline bool
 isPrivate(Address const& addr)
 {
-    return addr.is_v4() ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
+    return (addr.is_v4()) ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
 }
 
 /**
@@ -70,7 +70,7 @@ isPrivate(Address const& addr)
 inline bool
 isPublic(Address const& addr)
 {
-    return addr.is_v4() ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
+    return (addr.is_v4()) ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
 }
 
 }  // namespace ip

include/xrpl/beast/type_name.h

@@ -34,7 +34,7 @@ typeName()
         name += " volatile";
     if (std::is_lvalue_reference_v<T>)
     {
-        name += '&';
+        name += "&";
     }
     else if (std::is_rvalue_reference_v<T>)
     {

include/xrpl/beast/unit_test/suite.h

@@ -20,7 +20,7 @@ namespace beast::unit_test {
 namespace detail {
 
 template <class String>
-std::string
+static std::string
 makeReason(String const& reason, char const* file, int line)
 {
     std::string s(reason);

include/xrpl/beast/unit_test/thread.h

@@ -47,8 +47,8 @@ public:
     template <class F, class... Args>
     explicit Thread(Suite& s, F&& f, Args&&... args) : s_(&s)
     {
-        std::function<void()> b = [f = std::forward<F>(f),
-                                   ... args = std::forward<Args>(args)] mutable {
+        std::function<void(void)> b = [f = std::forward<F>(f),
+                                       ... args = std::forward<Args>(args)]() mutable {
             std::invoke(f, args...);
         };
         t_ = std::thread(&Thread::run, this, std::move(b));
@@ -94,7 +94,7 @@ public:
 
 private:
     void
-    run(std::function<void()> f)
+    run(std::function<void(void)> f)
     {
         try
         {

include/xrpl/core/Coro.ipp

@@ -1,136 +0,0 @@
-#pragma once
-
-#include <utility>
-
-namespace xrpl {
-
-/**
- * Coroutine stack size (1.5 MB). Increased from 1 MB because
- * ASAN-instrumented deep call stacks exceeded the original limit.
- */
-constexpr std::size_t kCoroStackSize = 1536 * 1024;
-
-template <class F>
-JobQueue::Coro::Coro(CoroCreateT, JobQueue& jq, JobType type, std::string name, F&& f)
-    : jq_(jq)
-    , type_(type)
-    , name_(std::move(name))
-    , coro_(
-          boost::context::protected_fixedsize_stack(kCoroStackSize),
-          [this, fn = std::forward<F>(f)](boost::coroutines2::coroutine<void>::push_type& doYield) {
-              yield_ = &doYield;
-              yield();
-              fn(shared_from_this());
-#ifndef NDEBUG
-              finished_ = true;
-#endif
-          })
-{
-}
-
-inline JobQueue::Coro::~Coro()
-{
-#ifndef NDEBUG
-    XRPL_ASSERT(finished_, "xrpl::JobQueue::Coro::~Coro : is finished");
-#endif
-}
-
-inline void
-JobQueue::Coro::yield() const
-{
-    {
-        std::scoped_lock const lock(jq_.mutex_);
-        ++jq_.nSuspend_;
-    }
-    (*yield_)();
-}
-
-inline bool
-JobQueue::Coro::post()
-{
-    {
-        std::scoped_lock const lk(mutexRun_);
-        running_ = true;
-    }
-
-    // sp keeps 'this' alive
-    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()] { resume(); }))
-    {
-        return true;
-    }
-
-    // The coroutine will not run.  Clean up running_.
-    std::scoped_lock const lk(mutexRun_);
-    running_ = false;
-    cv_.notify_all();
-    return false;
-}
-
-inline void
-JobQueue::Coro::resume()
-{
-    {
-        std::scoped_lock const lk(mutexRun_);
-        running_ = true;
-    }
-    {
-        std::scoped_lock const lk(jq_.mutex_);
-        --jq_.nSuspend_;
-    }
-    auto saved = detail::getLocalValues().release();
-    detail::getLocalValues().reset(&lvs_);
-    std::scoped_lock const lock(mutex_);
-    // A late resume() can arrive after the coroutine has already completed.
-    // This is an expected (if rare) outcome of the race condition documented
-    // in JobQueue.h:354-377 where post() schedules a resume job before the
-    // coroutine yields — the mutex serializes access, but by the time this
-    // resume() acquires the lock the coroutine may have already run to
-    // completion. Calling operator() on a completed boost::coroutine2 is
-    // undefined behavior, so we must check and skip invoking the coroutine
-    // body if it has already completed.
-    if (coro_)
-    {
-        coro_();
-    }
-    detail::getLocalValues().release();
-    detail::getLocalValues().reset(saved);
-    std::scoped_lock const lk(mutexRun_);
-    running_ = false;
-    cv_.notify_all();
-}
-
-inline bool
-JobQueue::Coro::runnable() const
-{
-    return static_cast<bool>(coro_);
-}
-
-inline void
-JobQueue::Coro::expectEarlyExit()
-{
-#ifndef NDEBUG
-    if (!finished_)
-#endif
-    {
-        // expectEarlyExit() must only ever be called from outside the
-        // Coro's stack.  It you're inside the stack you can simply return
-        // and be done.
-        //
-        // That said, since we're outside the Coro's stack, we need to
-        // decrement the nSuspend that the Coro's call to yield caused.
-        std::scoped_lock const lock(jq_.mutex_);
-        --jq_.nSuspend_;
-#ifndef NDEBUG
-        finished_ = true;
-#endif
-    }
-}
-
-inline void
-JobQueue::Coro::join()
-{
-    std::unique_lock<std::mutex> lk(mutexRun_);
-    cv_.wait(lk, [this] { return !running_; });
-}
-
-}  // namespace xrpl

include/xrpl/core/CoroTask.h

@@ -0,0 +1,713 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+
+#include <coroutine>
+#include <exception>
+#include <type_traits>
+#include <utility>
+#include <variant>
+
+namespace xrpl {
+
+template <typename T = void>
+class CoroTask;
+
+/**
+ * CoroTask<void> -- coroutine return type for void-returning coroutines.
+ *
+ * Class / Dependency Diagram
+ * ==========================
+ *
+ *   CoroTask<void>
+ *   +-----------------------------------------------+
+ *   | - handle_ : Handle (coroutine_handle<promise>) |
+ *   +-----------------------------------------------+
+ *   | + handle(), done()                             |
+ *   | + await_ready/suspend/resume  (Awaiter iface)  |
+ *   +-----------------------------------------------+
+ *            |  owns
+ *            v
+ *   promise_type
+ *   +-----------------------------------------------+
+ *   | - exception_    : std::exception_ptr           |
+ *   | - continuation_ : std::coroutine_handle<>      |
+ *   +-----------------------------------------------+
+ *   | + get_return_object() -> CoroTask              |
+ *   | + initial_suspend()   -> suspend_always (lazy) |
+ *   | + final_suspend()     -> FinalAwaiter          |
+ *   | + return_void()                                |
+ *   | + unhandled_exception()                        |
+ *   +-----------------------------------------------+
+ *            |  returns at final_suspend
+ *            v
+ *   FinalAwaiter
+ *   +-----------------------------------------------+
+ *   | await_suspend(h):                              |
+ *   |   if continuation_ set -> symmetric transfer   |
+ *   |   else                 -> noop_coroutine        |
+ *   +-----------------------------------------------+
+ *
+ * Design Notes
+ * ------------
+ * - Lazy start: initial_suspend returns suspend_always, so the coroutine
+ *   body does not execute until the handle is explicitly resumed.
+ * - Symmetric transfer: await_suspend returns a coroutine_handle instead
+ *   of void/bool, allowing the scheduler to jump directly to the next
+ *   coroutine without growing the call stack.
+ * - Continuation chaining: when one CoroTask is co_await-ed inside
+ *   another, the caller's handle is stored as continuation_ so
+ *   FinalAwaiter can resume it when this task finishes.
+ * - Move-only: the handle is exclusively owned; copy is deleted.
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Basic void coroutine (the most common case in xrpld):
+ *
+ *      CoroTask<void> doWork(std::shared_ptr<CoroTaskRunner> runner) {
+ *          // do something
+ *          co_await runner->suspend();   // yield control
+ *          // resumed later via runner->post() or runner->resume()
+ *          co_return;
+ *      }
+ *
+ * 2. co_await-ing one CoroTask<void> from another (chaining):
+ *
+ *      CoroTask<void> inner() {
+ *          // ...
+ *          co_return;
+ *      }
+ *      CoroTask<void> outer() {
+ *          co_await inner();   // continuation_ links outer -> inner
+ *          co_return;          // FinalAwaiter resumes outer
+ *      }
+ *
+ * 3. Exceptions propagate through co_await:
+ *
+ *      CoroTask<void> failing() {
+ *          throw std::runtime_error("oops");
+ *          co_return;
+ *      }
+ *      CoroTask<void> caller() {
+ *          try { co_await failing(); }
+ *          catch (std::runtime_error const&) { // caught here }
+ *      }
+ *
+ * Caveats / Pitfalls
+ * ==================
+ *
+ * BUG-RISK: Dangling references in coroutine parameters.
+ *   Coroutine parameters are copied into the frame, but references
+ *   are NOT -- they are stored as-is. If the referent goes out of scope
+ *   before the coroutine finishes, you get use-after-free.
+ *
+ *      // BROKEN -- local dies before coroutine runs:
+ *      CoroTask<void> bad(int& ref) { co_return; }
+ *      void launch() {
+ *          int local = 42;
+ *          auto task = bad(local);  // frame stores &local
+ *      }  // local destroyed; frame holds dangling ref
+ *
+ *      // FIX -- pass by value, or ensure lifetime via shared_ptr.
+ *
+ * BUG-RISK: GCC 14 corrupts reference captures in coroutine lambdas.
+ *   When a lambda that returns CoroTask captures by reference ([&]),
+ *   GCC 14 may generate a corrupted coroutine frame. Always capture
+ *   by explicit pointer-to-value instead:
+ *
+ *      // BROKEN on GCC 14:
+ *      jq.postCoroTask(t, n, [&](auto) -> CoroTask<void> { ... });
+ *
+ *      // FIX -- capture pointers explicitly:
+ *      jq.postCoroTask(t, n, [ptr = &val](auto) -> CoroTask<void> { ... });
+ *
+ * BUG-RISK: Resuming a destroyed or completed CoroTask.
+ *   Calling handle().resume() after the coroutine has already run to
+ *   completion (done() == true) is undefined behavior. The CoroTaskRunner
+ *   guards against this with an XRPL_ASSERT, but standalone usage of
+ *   CoroTask must check done() before resuming.
+ *
+ * BUG-RISK: Moving a CoroTask that is being awaited.
+ *   If task A is co_await-ed by task B (so A.continuation_ == B), moving
+ *   or destroying A will invalidate the continuation link. Never move
+ *   or reassign a CoroTask while it is mid-execution or being awaited.
+ *
+ * LIMITATION: CoroTask is fire-and-forget for the top-level owner.
+ *   There is no built-in notification when the coroutine finishes.
+ *   The caller must use external synchronization (e.g. CoroTaskRunner::join
+ *   or a gate/condition_variable) to know when it is done.
+ *
+ * LIMITATION: No cancellation token.
+ *   There is no way to cancel a suspended CoroTask from outside. The
+ *   coroutine body must cooperatively check a flag (e.g. jq_.isStopping())
+ *   after each co_await and co_return early if needed.
+ *
+ * LIMITATION: Stackless -- cannot suspend from nested non-coroutine calls.
+ *   If a coroutine calls a regular function that wants to "yield", it
+ *   cannot. Only the immediate coroutine body can use co_await.
+ *   This is acceptable for xrpld because all yield() sites are shallow.
+ */
+template <>
+class CoroTask<void>
+{
+public:
+    // The C++ coroutine protocol mandates these names (promise_type,
+    // initial_suspend, await_ready, ...) and instance-callable awaiter
+    // methods, which conflict with the project naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct promise_type;
+    using Handle = std::coroutine_handle<promise_type>;
+
+    /**
+     * Coroutine promise. Compiler uses this to manage coroutine state.
+     * Stores the exception (if any) and the continuation handle for
+     * symmetric transfer back to the awaiting coroutine.
+     */
+    struct promise_type
+    {
+        // Captured exception from the coroutine body, rethrown in
+        // await_resume() when this task is co_await-ed by a caller.
+        std::exception_ptr exception_;
+
+        // Handle to the coroutine that is co_await-ing this task.
+        // Set by await_suspend(). FinalAwaiter uses it for symmetric
+        // transfer back to the caller. Null if this is a top-level task.
+        std::coroutine_handle<> continuation_;
+
+        /**
+         * Create the CoroTask return object.
+         * Called by the compiler at coroutine creation.
+         */
+        CoroTask
+        get_return_object()
+        {
+            return CoroTask{Handle::from_promise(*this)};
+        }
+
+        /**
+         * Lazy start. The coroutine body does not execute until the
+         * handle is explicitly resumed (e.g. by CoroTaskRunner::resume).
+         */
+        std::suspend_always
+        initial_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Awaiter returned by final_suspend(). Uses symmetric transfer:
+         * if a continuation exists, transfers control directly to it
+         * (tail-call, no stack growth). Otherwise returns noop_coroutine
+         * so the coroutine frame stays alive for the owner to destroy.
+         */
+        struct FinalAwaiter
+        {
+            /**
+             * Always false. We need await_suspend to run for
+             * symmetric transfer.
+             */
+            bool
+            await_ready() noexcept
+            {
+                return false;
+            }
+
+            /**
+             * Symmetric transfer: returns the continuation handle so
+             * the compiler emits a tail-call instead of a nested resume.
+             * If no continuation is set, returns noop_coroutine to
+             * suspend at final_suspend without destroying the frame.
+             *
+             * @param h Handle to this completing coroutine
+             *
+             * @return Continuation handle, or noop_coroutine
+             */
+            std::coroutine_handle<>
+            await_suspend(Handle h) noexcept
+            {
+                if (auto cont = h.promise().continuation_)
+                    return cont;
+                return std::noop_coroutine();
+            }
+
+            void
+            await_resume() noexcept
+            {
+            }
+        };
+
+        /**
+         * Returns FinalAwaiter for symmetric transfer at coroutine end.
+         */
+        FinalAwaiter
+        final_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Called by the compiler for `co_return;` (void coroutine).
+         */
+        void
+        return_void()
+        {
+        }
+
+        /**
+         * Called by the compiler when an exception escapes the coroutine
+         * body. Captures it for later rethrowing in await_resume().
+         */
+        void
+        unhandled_exception()
+        {
+            exception_ = std::current_exception();
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+    /**
+     * Default constructor. Creates an empty (null handle) task.
+     */
+    CoroTask() = default;
+
+    /**
+     * Takes ownership of a compiler-generated coroutine handle.
+     *
+     * @param h Coroutine handle to own
+     */
+    explicit CoroTask(Handle h) : handle_(h)
+    {
+    }
+
+    /**
+     * Destroys the coroutine frame if this task owns one.
+     */
+    ~CoroTask()
+    {
+        if (handle_)
+            handle_.destroy();
+    }
+
+    /**
+     * Move constructor. Transfers handle ownership, leaves other empty.
+     */
+    CoroTask(CoroTask&& other) noexcept : handle_(std::exchange(other.handle_, {}))
+    {
+    }
+
+    /**
+     * Move assignment. Destroys current frame (if any), takes other's.
+     */
+    CoroTask&
+    operator=(CoroTask&& other) noexcept
+    {
+        if (this != &other)
+        {
+            if (handle_)
+                handle_.destroy();
+            handle_ = std::exchange(other.handle_, {});
+        }
+        return *this;
+    }
+
+    CoroTask(CoroTask const&) = delete;
+    CoroTask&
+    operator=(CoroTask const&) = delete;
+
+    /**
+     * @return The underlying coroutine_handle
+     */
+    [[nodiscard]] Handle
+    handle() const
+    {
+        return handle_;
+    }
+
+    /**
+     * @return true if the coroutine has run to completion (or thrown)
+     */
+    [[nodiscard]] bool
+    done() const
+    {
+        return handle_ && handle_.done();
+    }
+
+    // -- Awaiter interface: allows `co_await someCoroTask;` --
+
+    /**
+     * Always false. This task is lazy, so co_await always suspends
+     * the caller to set up the continuation link.
+     */
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    [[nodiscard]] bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Stores the caller's handle as our continuation, then returns
+     * our handle for symmetric transfer (caller suspends, we resume).
+     *
+     * @param caller Handle of the coroutine doing co_await on us
+     *
+     * @return Our handle for symmetric transfer
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> caller) noexcept
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<void>::await_suspend : handle is valid");
+        handle_.promise().continuation_ = caller;
+        return handle_;  // Symmetric transfer
+    }
+
+    /**
+     * Called in the awaiting coroutine's context after this task
+     * completes. Rethrows any exception captured by
+     * unhandled_exception().
+     */
+    void
+    await_resume()
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<void>::await_resume : handle is valid");
+        if (auto& ep = handle_.promise().exception_)
+            std::rethrow_exception(ep);
+    }
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+private:
+    // Exclusively-owned coroutine handle. Null after move or default
+    // construction. Destroyed in the destructor.
+    Handle handle_;
+};
+
+/**
+ * CoroTask<T> -- coroutine return type for value-returning coroutines.
+ *
+ * Class / Dependency Diagram
+ * ==========================
+ *
+ *   CoroTask<T>
+ *   +-----------------------------------------------+
+ *   | - handle_ : Handle (coroutine_handle<promise>) |
+ *   +-----------------------------------------------+
+ *   | + handle(), done()                             |
+ *   | + await_ready/suspend/resume  (Awaiter iface)  |
+ *   +-----------------------------------------------+
+ *            |  owns
+ *            v
+ *   promise_type
+ *   +-----------------------------------------------+
+ *   | - result_       : variant<monostate, T,        |
+ *   |                           exception_ptr>       |
+ *   | - continuation_ : std::coroutine_handle<>      |
+ *   +-----------------------------------------------+
+ *   | + get_return_object() -> CoroTask              |
+ *   | + initial_suspend()   -> suspend_always (lazy) |
+ *   | + final_suspend()     -> FinalAwaiter          |
+ *   | + return_value(T)     -> stores in result_[1]  |
+ *   | + unhandled_exception -> stores in result_[2]  |
+ *   +-----------------------------------------------+
+ *            |  returns at final_suspend
+ *            v
+ *   FinalAwaiter  (same symmetric-transfer pattern as CoroTask<void>)
+ *
+ * Value Extraction
+ * ----------------
+ * await_resume() inspects the variant:
+ *   - index 2 (exception_ptr) -> rethrow
+ *   - index 1 (T)             -> return value via move
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Simple value return:
+ *
+ *      CoroTask<int> computeAnswer() { co_return 42; }
+ *
+ *      CoroTask<void> caller() {
+ *          int v = co_await computeAnswer();  // v == 42
+ *      }
+ *
+ * 2. Chaining value-returning coroutines:
+ *
+ *      CoroTask<int> add(int a, int b) { co_return a + b; }
+ *      CoroTask<int> doubleSum(int a, int b) {
+ *          int s = co_await add(a, b);
+ *          co_return s * 2;
+ *      }
+ *
+ * 3. Exception propagation from inner to outer:
+ *
+ *      CoroTask<int> failing() {
+ *          throw std::runtime_error("bad");
+ *          co_return 0;  // never reached
+ *      }
+ *      CoroTask<void> caller() {
+ *          try {
+ *              int v = co_await failing();  // throws here
+ *          } catch (std::runtime_error const& e) {
+ *              // e.what() == "bad"
+ *          }
+ *      }
+ *
+ * Caveats / Pitfalls (in addition to CoroTask<void> caveats above)
+ * ================================================================
+ *
+ * BUG-RISK: await_resume() moves the value out of the variant.
+ *   Calling co_await on the same CoroTask<T> instance twice is undefined
+ *   behavior -- the second call will see a moved-from T. CoroTask is
+ *   single-shot: one co_return, one co_await.
+ *
+ * BUG-RISK: T must be move-constructible.
+ *   return_value(T) takes by value and moves into the variant.
+ *   Types that are not movable cannot be used as T.
+ *
+ * LIMITATION: No co_yield support.
+ *   CoroTask<T> only supports a single co_return. It does not implement
+ *   yield_value(), so using co_yield inside a CoroTask<T> coroutine is a
+ *   compile error. For streaming values, a different return type
+ *   (e.g. Generator<T>) would be needed.
+ *
+ * LIMITATION: Result is only accessible via co_await.
+ *   There is no .get() or .result() method. The value can only be
+ *   extracted by co_await-ing the CoroTask<T> from inside another
+ *   coroutine. For extracting results in non-coroutine code, pass a
+ *   pointer to the caller and write through it (as the tests do).
+ */
+template <typename T>
+class CoroTask
+{
+    static_assert(
+        std::is_move_constructible_v<T>,
+        "CoroTask<T> requires T to be move-constructible");
+
+public:
+    // The C++ coroutine protocol mandates these names (promise_type,
+    // initial_suspend, await_ready, ...) and instance-callable awaiter
+    // methods, which conflict with the project naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct promise_type;
+    using Handle = std::coroutine_handle<promise_type>;
+
+    /**
+     * Coroutine promise for value-returning coroutines.
+     * Stores the result as a variant: monostate (not yet set),
+     * T (co_return value), or exception_ptr (unhandled exception).
+     */
+    struct promise_type
+    {
+        // Tri-state result:
+        //   index 0 (monostate) -- coroutine has not yet completed
+        //   index 1 (T)         -- co_return value stored here
+        //   index 2 (exception) -- unhandled exception captured here
+        std::variant<std::monostate, T, std::exception_ptr> result_;
+
+        // Handle to the coroutine co_await-ing this task. Used by
+        // FinalAwaiter for symmetric transfer. Null for top-level tasks.
+        std::coroutine_handle<> continuation_;
+
+        /**
+         * Create the CoroTask return object.
+         * Called by the compiler at coroutine creation.
+         */
+        CoroTask
+        get_return_object()
+        {
+            return CoroTask{Handle::from_promise(*this)};
+        }
+
+        /**
+         * Lazy start. Coroutine body does not run until explicitly resumed.
+         */
+        std::suspend_always
+        initial_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Symmetric-transfer awaiter at coroutine completion.
+         * Same pattern as CoroTask<void>::FinalAwaiter.
+         */
+        struct FinalAwaiter
+        {
+            bool
+            await_ready() noexcept
+            {
+                return false;
+            }
+
+            /**
+             * Returns continuation for symmetric transfer, or
+             * noop_coroutine if this is a top-level task.
+             *
+             * @param h Handle to this completing coroutine
+             *
+             * @return Continuation handle, or noop_coroutine
+             */
+            std::coroutine_handle<>
+            await_suspend(Handle h) noexcept
+            {
+                if (auto cont = h.promise().continuation_)
+                    return cont;
+                return std::noop_coroutine();
+            }
+
+            void
+            await_resume() noexcept
+            {
+            }
+        };
+
+        FinalAwaiter
+        final_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Called by the compiler for `co_return value;`.
+         * Moves the value into result_ at index 1.
+         *
+         * @param value The value to store
+         */
+        void
+        return_value(T value)
+        {
+            result_.template emplace<1>(std::move(value));
+        }
+
+        /**
+         * Captures unhandled exceptions at index 2 of result_.
+         * Rethrown later in await_resume().
+         */
+        void
+        unhandled_exception()
+        {
+            result_.template emplace<2>(std::current_exception());
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+    /**
+     * Default constructor. Creates an empty (null handle) task.
+     */
+    CoroTask() = default;
+
+    /**
+     * Takes ownership of a compiler-generated coroutine handle.
+     *
+     * @param h Coroutine handle to own
+     */
+    explicit CoroTask(Handle h) : handle_(h)
+    {
+    }
+
+    /**
+     * Destroys the coroutine frame if this task owns one.
+     */
+    ~CoroTask()
+    {
+        if (handle_)
+            handle_.destroy();
+    }
+
+    /**
+     * Move constructor. Transfers handle ownership, leaves other empty.
+     */
+    CoroTask(CoroTask&& other) noexcept : handle_(std::exchange(other.handle_, {}))
+    {
+    }
+
+    /**
+     * Move assignment. Destroys current frame (if any), takes other's.
+     */
+    CoroTask&
+    operator=(CoroTask&& other) noexcept
+    {
+        if (this != &other)
+        {
+            if (handle_)
+                handle_.destroy();
+            handle_ = std::exchange(other.handle_, {});
+        }
+        return *this;
+    }
+
+    CoroTask(CoroTask const&) = delete;
+    CoroTask&
+    operator=(CoroTask const&) = delete;
+
+    /**
+     * @return The underlying coroutine_handle
+     */
+    [[nodiscard]] Handle
+    handle() const
+    {
+        return handle_;
+    }
+
+    /**
+     * @return true if the coroutine has run to completion (or thrown)
+     */
+    [[nodiscard]] bool
+    done() const
+    {
+        return handle_ && handle_.done();
+    }
+
+    // -- Awaiter interface: allows `T val = co_await someCoroTask;` --
+
+    /**
+     * Always false. co_await always suspends to set up continuation.
+     */
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    [[nodiscard]] bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Stores caller as continuation, returns our handle for
+     * symmetric transfer.
+     *
+     * @param caller Handle of the coroutine doing co_await on us
+     *
+     * @return Our handle for symmetric transfer
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> caller) noexcept
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<T>::await_suspend : handle is valid");
+        handle_.promise().continuation_ = caller;
+        return handle_;
+    }
+
+    /**
+     * Extracts the result: rethrows if exception, otherwise moves
+     * the T value out of the variant. Single-shot: calling twice
+     * on the same task is undefined (moved-from T).
+     *
+     * @return The co_return-ed value
+     */
+    T
+    await_resume()
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<T>::await_resume : handle is valid");
+        auto& result = handle_.promise().result_;
+        if (auto* ep = std::get_if<2>(&result))
+            std::rethrow_exception(*ep);
+        return std::get<1>(std::move(result));
+    }
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+private:
+    // Exclusively-owned coroutine handle. Null after move or default
+    // construction. Destroyed in the destructor.
+    Handle handle_;
+};
+
+}  // namespace xrpl

include/xrpl/core/CoroTaskRunner.ipp

@@ -0,0 +1,448 @@
+#pragma once
+
+/**
+ * @file CoroTaskRunner.ipp
+ *
+ * CoroTaskRunner inline implementation.
+ *
+ * This file contains the business logic for managing C++20 coroutines
+ * on the JobQueue. It is included at the bottom of JobQueue.h.
+ *
+ * Data Flow: suspend / post / resume cycle
+ * =========================================
+ *
+ *         coroutine body                 CoroTaskRunner              JobQueue
+ *         --------------                 --------------              --------
+ *              |
+ *    co_await runner->suspend()
+ *              |
+ *              +--- await_suspend ------> onSuspend()
+ *              |                            ++nSuspend_ ------------> nSuspend_
+ *              |                          [coroutine is now suspended]
+ *              |
+ *              .    (externally or by yieldAndPost())
+ *              .
+ *              +--- (caller calls) -----> post()
+ *              |                            ++runCount_
+ *              |                            addJob(resume) ----------> job enqueued
+ *              |                                                        |
+ *              |                                                      [worker picks up]
+ *              |                                                        |
+ *              +--- <----- resume() <-----------------------------------+
+ *              |             --nSuspend_ ------> nSuspend_
+ *              |             swap in LocalValues (lvs_)
+ *              |             task_.handle().resume()
+ *              |                |
+ *              |    [coroutine body continues here]
+ *              |                |
+ *              |             swap out LocalValues
+ *              |             --runCount_
+ *              |             cv_.notify_all()
+ *              v
+ *
+ * Thread Safety
+ * =============
+ * - mutex_     : guards task_.handle().resume() so that post()-before-suspend
+ *                races cannot resume the coroutine while it is still running.
+ *                (See the race condition discussion in JobQueue.h)
+ * - mutexRun_ : guards runCount_ counter; used by join() to wait until
+ *                all in-flight resume operations complete.
+ * - jq_.mutex_: guards nSuspend_ increments/decrements.
+ *
+ * Common Mistakes When Modifying This File
+ * =========================================
+ *
+ * 1. Changing lock ordering.
+ *    resume() acquires locks sequentially (never held simultaneously):
+ *    jq_.mutex_ (released immediately), then mutex_ (held across resume),
+ *    then mutexRun_ (released after decrement). post() acquires only
+ *    mutexRun_. Any new code path must follow the same order.
+ *
+ * 2. Removing the shared_from_this() capture in post().
+ *    The lambda passed to addJob captures [this, sp = shared_from_this()].
+ *    If you remove sp, 'this' can be destroyed before the job runs,
+ *    causing use-after-free. The sp capture is load-bearing.
+ *
+ * 3. Forgetting to decrement nSuspend_ on a new code path.
+ *    Every ++nSuspend_ must have a matching --nSuspend_. If you add a new
+ *    suspension path (e.g. a new awaiter) and forget to decrement on resume
+ *    or on failure, JobQueue::stop() will hang.
+ *
+ * 4. Calling task_.handle().resume() without holding mutex_.
+ *    This allows a race where the coroutine runs on two threads
+ *    simultaneously. Always hold mutex_ around resume().
+ *
+ * 5. Swapping LocalValues outside of the mutex_ critical section.
+ *    The swap-in and swap-out of LocalValues must bracket the resume()
+ *    call. If you move the swap-out before the lock_guard(mutex_) is
+ *    released, you break LocalValue isolation for any code that runs
+ *    after the coroutine suspends but before the lock is dropped.
+ */
+
+namespace xrpl {
+
+/**
+ * Construct a CoroTaskRunner. Sets runCount_ to 0; does not
+ * create the coroutine. Call init() afterwards.
+ *
+ * @param jq   The JobQueue this coroutine will run on
+ * @param type Job type for scheduling priority
+ * @param name Human-readable name for logging
+ */
+inline JobQueue::CoroTaskRunner::CoroTaskRunner(
+    CreateT,
+    JobQueue& jq,
+    JobType type,
+    std::string name)
+    : jq_(jq), type_(type), name_(std::move(name))
+{
+}
+
+/**
+ * Initialize with a coroutine-returning callable.
+ * Stores the callable on the heap (FuncStore) so it outlives the
+ * coroutine frame. Coroutine frames store a reference to the
+ * callable's implicit object parameter (the lambda). If the callable
+ * is a temporary, that reference dangles after the caller returns.
+ * Keeping the callable alive here ensures the coroutine's captures
+ * remain valid.
+ *
+ * @param f Callable: CoroTask<void>(shared_ptr<CoroTaskRunner>)
+ */
+template <class F>
+void
+JobQueue::CoroTaskRunner::init(F&& f)
+{
+    using Fn = std::decay_t<F>;
+    auto store = std::make_unique<FuncStore<Fn>>(std::forward<F>(f));
+    task_ = store->func(shared_from_this());
+    storedFunc_ = std::move(store);
+}
+
+/**
+ * Destructor. Waits for any in-flight resume() to complete, then
+ * asserts (debug) that the coroutine has finished or
+ * expectEarlyExit() was called.
+ *
+ * The join() call is necessary because with async dispatch the
+ * coroutine runs on a worker thread. The gate signal (which wakes
+ * the test thread) can arrive before resume() has set finished_.
+ * join() synchronizes via mutexRun_, establishing a happens-before
+ * edge: finished_ = true -> unlock(mutexRun_) in resume() ->
+ * lock(mutexRun_) in join() -> read finished_.
+ */
+inline JobQueue::CoroTaskRunner::~CoroTaskRunner()
+{
+#ifndef NDEBUG
+    join();
+    XRPL_ASSERT(finished_, "xrpl::JobQueue::CoroTaskRunner::~CoroTaskRunner : is finished");
+#endif
+}
+
+/**
+ * Increment the JobQueue's suspended-coroutine count (nSuspend_).
+ */
+inline void
+JobQueue::CoroTaskRunner::onSuspend()
+{
+    std::scoped_lock const lock(jq_.mutex_);
+    ++jq_.nSuspend_;
+}
+
+/**
+ * Decrement nSuspend_ without resuming.
+ */
+inline void
+JobQueue::CoroTaskRunner::onUndoSuspend()
+{
+    std::scoped_lock const lock(jq_.mutex_);
+    --jq_.nSuspend_;
+}
+
+/**
+ * Return a SuspendAwaiter whose await_suspend() increments nSuspend_
+ * before the coroutine actually suspends. The caller must later call
+ * post() or resume() to continue execution.
+ *
+ * @return Awaiter for use with `co_await runner->suspend()`
+ */
+inline auto
+JobQueue::CoroTaskRunner::suspend()
+{
+    /**
+     * Custom awaiter for suspend(). Always suspends (await_ready
+     * returns false) and increments nSuspend_ in await_suspend().
+     */
+    // The C++ coroutine protocol mandates these awaiter names and
+    // instance-callable methods, which conflict with the project
+    // naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct SuspendAwaiter
+    {
+        CoroTaskRunner& runner_;  // The runner that owns this coroutine.
+
+        /**
+         * Always returns false so the coroutine suspends.
+         */
+        [[nodiscard]] bool
+        await_ready() const noexcept
+        {
+            return false;
+        }
+
+        /**
+         * Called when the coroutine suspends. Increments nSuspend_
+         * so the JobQueue knows a coroutine is waiting.
+         */
+        void
+        await_suspend(std::coroutine_handle<>) const
+        {
+            runner_.onSuspend();
+        }
+
+        void
+        await_resume() const noexcept
+        {
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+    return SuspendAwaiter{*this};
+}
+
+/**
+ * Suspend and immediately repost on the JobQueue. Equivalent to
+ * `co_await JobQueueAwaiter{runner}` but uses an inline struct
+ * to work around a GCC-12 codegen bug (see declaration in JobQueue.h).
+ *
+ * If the JobQueue is stopping (post fails), the suspend count is
+ * undone and the coroutine continues immediately via symmetric
+ * transfer back to its own handle.
+ *
+ * @return An inline YieldPostAwaiter
+ */
+inline auto
+JobQueue::CoroTaskRunner::yieldAndPost()
+{
+    // The C++ coroutine protocol mandates these awaiter names and
+    // instance-callable methods, which conflict with the project
+    // naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct YieldPostAwaiter
+    {
+        CoroTaskRunner& runner_;
+
+        [[nodiscard]] bool
+        await_ready() const noexcept
+        {
+            return false;
+        }
+
+        /**
+         * Returns a coroutine_handle<> (symmetric transfer) rather than
+         * void + h.resume(). Two reasons:
+         *
+         *  1. h.resume() runs the coroutine nested inside this frame. A
+         *     coroutine that yields in a loop against a stopping JobQueue
+         *     fails post() every iteration, so the stack grows without
+         *     bound. Symmetric transfer is a tail call and does not nest.
+         *
+         *  2. After h.resume() returns, the coroutine may have completed
+         *     and destroyed its frame -- the frame this awaiter lives in.
+         *     Returning from await_suspend would then touch freed memory.
+         *
+         * A bool return would also avoid nesting, but GCC-12 miscompiles
+         * bool-returning await_suspend (see JobQueueAwaiter.h).
+         *
+         * @return noop_coroutine() to stay suspended (job posted);
+         *         the caller's handle to continue now (JQ stopping)
+         */
+        std::coroutine_handle<>
+        await_suspend(std::coroutine_handle<> h)
+        {
+            runner_.onSuspend();
+            if (!runner_.post())
+            {
+                runner_.onUndoSuspend();
+                return h;
+            }
+            return std::noop_coroutine();
+        }
+
+        void
+        await_resume() const noexcept
+        {
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+    return YieldPostAwaiter{*this};
+}
+
+/**
+ * Schedule coroutine resumption as a job on the JobQueue.
+ * A shared_ptr capture (sp) prevents this CoroTaskRunner from being
+ * destroyed while the job is queued but not yet executed.
+ *
+ * @return false if the JobQueue rejected the job (shutting down)
+ */
+inline bool
+JobQueue::CoroTaskRunner::post()
+{
+    {
+        std::scoped_lock const lk(mutexRun_);
+        ++runCount_;
+    }
+
+    // sp prevents 'this' from being destroyed while the job is pending
+    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()]() { resume(); }))
+    {
+        return true;
+    }
+
+    // The coroutine will not run. Undo the runCount_ increment.
+    std::scoped_lock const lk(mutexRun_);
+    --runCount_;
+    cv_.notify_all();
+    return false;
+}
+
+/**
+ * Resume the coroutine on the current thread.
+ *
+ * Steps:
+ *   1. Decrement nSuspend_ (under jq_.mutex_)
+ *   2. Swap in this coroutine's LocalValues for thread-local isolation
+ *   3. Resume the coroutine handle (under mutex_)
+ *   4. Swap out LocalValues, restoring the thread's previous state
+ *   5. Decrement runCount_ and notify join() waiters
+ *
+ * @pre post() must have been called before resume(). Direct calls
+ *      without a prior post() will corrupt runCount_ and break join().
+ * Note: runCount_ is NOT incremented here — post() already did that.
+ * This ensures join() stays blocked for the entire post->resume lifetime.
+ */
+inline void
+JobQueue::CoroTaskRunner::resume()
+{
+    {
+        std::scoped_lock const lock(jq_.mutex_);
+        --jq_.nSuspend_;
+    }
+    auto saved = detail::getLocalValues().release();
+    detail::getLocalValues().reset(&lvs_);
+    std::scoped_lock const lock(mutex_);
+    XRPL_ASSERT(
+        task_.handle() && !task_.done(),
+        "xrpl::JobQueue::CoroTaskRunner::resume : task handle is valid and not done");
+    if (task_.handle() && !task_.done())
+    {
+        task_.handle().resume();
+    }
+    else
+    {
+        // A resume() with no coroutine to run (e.g. a duplicate external
+        // post() after completion). Resuming a null or finished handle is
+        // undefined behavior, so skip it -- this matches the old
+        // Coro::resume() `if (coro_)` guard. The bookkeeping below still
+        // runs to balance the ++runCount_ done by the post() that
+        // scheduled this call.
+        JLOG(jq_.journal_.warn())
+            << "CoroTaskRunner::resume called for coroutine '" << name_
+            << "' with no runnable coroutine (duplicate post or already completed)";
+    }
+    detail::getLocalValues().release();
+    detail::getLocalValues().reset(saved);
+    if (task_.done())
+    {
+        finished_ = true;
+        // An exception that escapes a top-level coroutine body is captured
+        // by promise_type::unhandled_exception() but has no awaiter to
+        // rethrow it, so it would vanish with the frame. Surface it in the
+        // log. (The old Boost path propagated it out of resume() instead.)
+        if (auto const& ep = task_.handle().promise().exception_)
+        {
+            try
+            {
+                std::rethrow_exception(ep);
+            }
+            catch (std::exception const& e)
+            {
+                JLOG(jq_.journal_.error())
+                    << "Unhandled exception in coroutine '" << name_ << "': " << e.what();
+            }
+            catch (...)
+            {
+                JLOG(jq_.journal_.error())
+                    << "Unhandled non-standard exception in coroutine '" << name_ << "'";
+            }
+        }
+        // Break the shared_ptr cycle: frame -> shared_ptr<runner> -> this.
+        // Use std::move (not task_ = {}) so task_.handle_ is null BEFORE the
+        // frame is destroyed. operator= would destroy the frame while handle_
+        // still holds the old value -- a re-entrancy hazard on GCC-12 if
+        // frame destruction triggers runner cleanup.
+        [[maybe_unused]] auto completed = std::move(task_);
+    }
+    std::scoped_lock const lk(mutexRun_);
+    --runCount_;
+    cv_.notify_all();
+}
+
+/**
+ * @return true if the coroutine has not yet run to completion
+ */
+inline bool
+JobQueue::CoroTaskRunner::runnable() const
+{
+    // After normal completion, task_ is reset to break the shared_ptr cycle
+    // (handle_ becomes null). A null handle means the coroutine is done.
+    return task_.handle() && !task_.done();
+}
+
+/**
+ * Handle early termination when the coroutine never ran (e.g. JobQueue
+ * is stopping). Decrements nSuspend_ and destroys the coroutine frame
+ * to break the shared_ptr cycle: frame -> lambda -> runner -> frame.
+ */
+inline void
+JobQueue::CoroTaskRunner::expectEarlyExit()
+{
+    if (!finished_)
+    {
+        std::scoped_lock const lock(jq_.mutex_);
+        --jq_.nSuspend_;
+        finished_ = true;
+    }
+    // Break the shared_ptr cycle: frame -> shared_ptr<runner> -> this.
+    // The coroutine is at initial_suspend and never ran user code, so
+    // destroying it is safe. Use std::move (not task_ = {}) so
+    // task_.handle_ is null before the frame is destroyed.
+    {
+        [[maybe_unused]] auto completed = std::move(task_);
+    }
+    storedFunc_.reset();
+}
+
+/**
+ * Block until all pending/active resume operations complete.
+ * Uses cv_ + mutexRun_ to wait until runCount_ reaches 0 or
+ * finished_ becomes true. The finished_ check handles the case
+ * where resume() is called directly (without post()), which
+ * decrements runCount_ below zero. In that scenario runCount_
+ * never returns to 0, but finished_ becoming true guarantees
+ * the coroutine is done and no more resumes will occur.
+ *
+ * Note: when join() returns via the finished_ disjunct, the final
+ * resume() call may still be executing its post-completion
+ * bookkeeping (the --runCount_ / notify after finished_ is set).
+ * That is safe -- the coroutine body has fully completed and the
+ * runner is kept alive by the resume job's shared_ptr -- but
+ * callers must not assume resume() itself has returned.
+ */
+inline void
+JobQueue::CoroTaskRunner::join()
+{
+    std::unique_lock<std::mutex> lk(mutexRun_);
+    cv_.wait(lk, [this]() { return runCount_ == 0 || finished_; });
+}
+
+}  // namespace xrpl

include/xrpl/core/JobQueue.h

@@ -1,25 +1,17 @@
 #pragma once
 
 #include <xrpl/basics/LocalValue.h>
-#include <xrpl/core/ClosureCounter.h>
-#include <xrpl/core/JobTypeData.h>
-#include <xrpl/core/detail/Workers.h>
-#include <xrpl/json/json_value.h>
-
-// Include only the specific Boost.Coroutine2 headers actually used here.
-// Avoid `boost/coroutine2/all.hpp` because it transitively pulls in
-// `boost/context/pooled_fixedsize_stack.hpp`, whose `.malloc()` / `.free()`
-// member calls on `boost::pool` collide with MSVC's `_CRTDBG_MAP_ALLOC` macros
-// in Debug builds (see cmake/XrplCompiler.cmake).
 #include <xrpl/beast/insight/Collector.h>
 #include <xrpl/beast/insight/Gauge.h>
 #include <xrpl/beast/insight/Hook.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/ClosureCounter.h>
+#include <xrpl/core/CoroTask.h>
 #include <xrpl/core/Job.h>
+#include <xrpl/core/JobTypeData.h>
 #include <xrpl/core/LoadEvent.h>
-
-#include <boost/context/protected_fixedsize_stack.hpp>
-#include <boost/coroutine2/coroutine.hpp>
+#include <xrpl/core/detail/Workers.h>
+#include <xrpl/json/json_value.h>
 
 #include <atomic>
 #include <chrono>
@@ -40,10 +32,6 @@ class PerfLog;
 }  // namespace perf
 
 class Logs;
-struct CoroCreateT
-{
-    explicit CoroCreateT() = default;
-};
 
 /**
  * A pool of threads to perform work.
@@ -60,93 +48,414 @@ class JobQueue : private Workers::Callback
 {
 public:
     /**
-     * Coroutines must run to completion.
+     * C++20 coroutine lifecycle manager.
+     *
+     *  Class / Inheritance / Dependency Diagram
+     *  =========================================
+     *
+     *  std::enable_shared_from_this<CoroTaskRunner>
+     *            ^
+     *            | (public inheritance)
+     *            |
+     *  CoroTaskRunner
+     *  +---------------------------------------------------+
+     *  | - lvs_         : detail::LocalValues               |
+     *  | - jq_          : JobQueue&                         |
+     *  | - type_        : JobType                           |
+     *  | - name_        : std::string                       |
+     *  | - runCount_    : int         (in-flight resumes)    |
+     *  | - mutex_       : std::mutex      (coroutine guard) |
+     *  | - mutexRun_    : std::mutex      (join guard)      |
+     *  | - cv_          : condition_variable                 |
+     *  | - task_        : CoroTask<void>                    |
+     *  | - storedFunc_  : unique_ptr<FuncBase> (type-erased)|
+     *  +---------------------------------------------------+
+     *  | + init(F&&)         : set up coroutine callable    |
+     *  | + onSuspend()       : ++jq_.nSuspend_              |
+     *  | + onUndoSuspend()   : --jq_.nSuspend_              |
+     *  | + suspend()         : returns SuspendAwaiter       |
+     *  | + post()            : schedule resume on JobQueue  |
+     *  | + resume()          : resume coroutine on caller   |
+     *  | + runnable()        : !task_.done()                |
+     *  | + expectEarlyExit() : teardown for failed post     |
+     *  | + join()            : block until not running       |
+     *  +---------------------------------------------------+
+     *          |                          |
+     *          | owns                     | references
+     *          v                          v
+     *    CoroTask<void>             JobQueue
+     *    (coroutine frame)          (thread pool + nSuspend_)
+     *
+     *    FuncBase / FuncStore<F>    (type-erased heap storage
+     *                                for the coroutine lambda)
+     *
+     *  Coroutine Lifecycle (Control Flow)
+     *  ===================================
+     *
+     *  Caller thread              JobQueue worker thread
+     *  -------------              ----------------------
+     *  postCoroTask(f)
+     *    |
+     *    +-- reserve a jobCounter_ slot (reject if JQ shutting down)
+     *    +-- ++nSuspend_  (lazy start counts as suspended)
+     *    +-- make_shared<CoroTaskRunner>
+     *    +-- init(f)
+     *    |     +-- store lambda on heap (FuncStore)
+     *    |     +-- task_ = f(shared_from_this())
+     *    |           [coroutine created, suspended at initial_suspend]
+     *    +-- post()
+     *    |     +-- ++runCount_
+     *    |     +-- addJob(type_, [resume]{})
+     *    |                                    resume()
+     *    |                                      |
+     *    |                                      +-- --nSuspend_
+     *    |                                      +-- swap in LocalValues
+     *    |                                      +-- task_.handle().resume()
+     *    |                                      |     [coroutine body runs]
+     *    |                                      |     ...
+     *    |                                      |     co_await suspend()
+     *    |                                      |       +-- ++nSuspend_
+     *    |                                      |       [coroutine suspends]
+     *    |                                      +-- swap out LocalValues
+     *    |                                      +-- --runCount_
+     *    |                                      +-- cv_.notify_all()
+     *    |
+     *  post()  <-- called externally or by yieldAndPost()
+     *    +-- ++runCount_
+     *    +-- addJob(type_, [resume]{})
+     *                                         resume()
+     *                                           |
+     *                                           +-- [coroutine body continues]
+     *                                           +-- co_return
+     *                                           +-- --runCount_
+     *                                           +-- cv_.notify_all()
+     *  join()
+     *    +-- cv_.wait([]{runCount_ == 0})
+     *    +-- [done]
+     *
+     *  Usage Examples
+     *  ==============
+     *
+     *  1. Fire-and-forget coroutine (most common pattern):
+     *
+     *      jq.postCoroTask(JtClient, "MyWork",
+     *          [](auto runner) -> CoroTask<void> {
+     *              doSomeWork();
+     *              co_await runner->suspend();  // yield to other jobs
+     *              doMoreWork();
+     *              co_return;
+     *          });
+     *
+     *  2. Manually controlling suspend / resume (external trigger):
+     *
+     *      auto runner = jq.postCoroTask(JtClient, "ExtTrigger",
+     *          [&result](auto runner) -> CoroTask<void> {
+     *              startAsyncOperation(callback);
+     *              co_await runner->suspend();
+     *              // callback called runner->post() to get here
+     *              result = collectResult();
+     *              co_return;
+     *          });
+     *      // ... later, from the callback:
+     *      runner->post();   // reschedule the coroutine on the JobQueue
+     *
+     *  3. Using yieldAndPost() for automatic suspend + repost:
+     *
+     *      jq.postCoroTask(JtClient, "AutoRepost",
+     *          [](auto runner) -> CoroTask<void> {
+     *              step1();
+     *              co_await runner->yieldAndPost();  // yield + auto-repost
+     *              step2();
+     *              co_await runner->yieldAndPost();
+     *              step3();
+     *              co_return;
+     *          });
+     *
+     *  4. Checking shutdown after co_await (cooperative cancellation):
+     *
+     *      jq.postCoroTask(JtClient, "Cancellable",
+     *          [&jq](auto runner) -> CoroTask<void> {
+     *              while (moreWork()) {
+     *                  co_await runner->yieldAndPost();
+     *                  if (jq.isStopping())
+     *                      co_return;  // bail out cleanly
+     *                  processNextItem();
+     *              }
+     *              co_return;
+     *          });
+     *
+     *  Caveats / Pitfalls
+     *  ==================
+     *
+     *  BUG-RISK: Calling suspend() without a matching post()/resume().
+     *    After co_await runner->suspend(), the coroutine is parked and
+     *    nSuspend_ is incremented.  If nothing ever calls post() or
+     *    resume(), the coroutine is leaked and JobQueue::stop() will
+     *    hang forever waiting for nSuspend_ to reach zero.
+     *
+     *  BUG-RISK: Calling post() on an already-running coroutine.
+     *    post() schedules a resume() job.  If the coroutine has not
+     *    actually suspended yet (no co_await executed), the resume job
+     *    will try to call handle().resume() while the coroutine is still
+     *    running on another thread.  This is UB.  The mutex_ prevents
+     *    data corruption but the logic is wrong — always co_await
+     *    suspend() before calling post().  (The test incorrect_order()
+     *    shows this works only because mutex_ serializes the calls.)
+     *
+     *  BUG-RISK: Dropping the shared_ptr<CoroTaskRunner> before join().
+     *    The CoroTaskRunner destructor asserts that finished_ is true
+     *    (the coroutine completed). If you let the last shared_ptr die
+     *    while the coroutine is still running or suspended, you get an
+     *    assertion failure in debug and UB in release.  Always call
+     *    join() or expectEarlyExit() first.
+     *
+     *  BUG-RISK: Lambda captures outliving the coroutine frame.
+     *    The lambda passed to postCoroTask is heap-allocated (FuncStore)
+     *    to prevent dangling.  But objects captured by pointer still need
+     *    their own lifetime management.  If you capture a raw pointer to
+     *    a stack variable, and the stack frame exits before the coroutine
+     *    finishes, the pointer dangles.  Use shared_ptr or ensure the
+     *    pointed-to object outlives the coroutine.
+     *
+     *  BUG-RISK: Forgetting co_return in a void coroutine.
+     *    If the coroutine body falls off the end without co_return,
+     *    the compiler may silently treat it as co_return (per standard),
+     *    but some compilers warn.  Always write explicit co_return.
+     *
+     *  LIMITATION: CoroTaskRunner only supports CoroTask<void>.
+     *    The task_ member is CoroTask<void>.  To return values from
+     *    the top-level coroutine, write through a captured pointer
+     *    (as the tests demonstrate), or co_await inner CoroTask<T>
+     *    coroutines that return values.
+     *
+     *  LIMITATION: One coroutine per CoroTaskRunner.
+     *    init() must be called exactly once.  You cannot reuse a
+     *    CoroTaskRunner to run a second coroutine.  Create a new one
+     *    via postCoroTask() instead.
+     *
+     *  LIMITATION: No timeout on join().
+     *    join() blocks indefinitely.  If the coroutine is suspended
+     *    and never posted, join() will deadlock.  Use timed waits
+     *    on the gate pattern (condition_variable + wait_for) in tests.
      */
-    class Coro : public std::enable_shared_from_this<Coro>
+    class CoroTaskRunner : public std::enable_shared_from_this<CoroTaskRunner>
     {
     private:
+        // Per-coroutine thread-local storage. Swapped in before resume()
+        // and swapped out after, so each coroutine sees its own LocalValue
+        // state regardless of which worker thread executes it.
         detail::LocalValues lvs_;
+
+        // Back-reference to the owning JobQueue. Used to post jobs,
+        // increment/decrement nSuspend_, and acquire jq_.mutex_.
         JobQueue& jq_;
+
+        // Job type passed to addJob() when posting this coroutine.
         JobType type_;
+
+        // Human-readable name for this coroutine job (for logging).
         std::string name_;
-        bool running_{false};
+
+        // Number of in-flight resume operations (pending + active).
+        // Incremented by post(), decremented when resume() finishes.
+        // Guarded by mutexRun_. join() blocks until this reaches 0.
+        //
+        // A counter (not a bool) is needed because post() can be called
+        // from within the coroutine body (e.g. via yieldAndPost()),
+        // enqueuing a second resume while the first is still running.
+        // A bool would be clobbered: R2.post() sets true, then R1's
+        // cleanup sets false — losing the fact that R2 is still pending.
+        int runCount_ = 0;
+
+        // Serializes all coroutine resume() calls, preventing concurrent
+        // execution of the coroutine body on multiple threads. Handles the
+        // race where post() enqueues a resume before the coroutine has
+        // actually suspended (post-before-suspend pattern).
         std::mutex mutex_;
+
+        // Guards runCount_. Used with cv_ for join() to wait
+        // until all pending/active resume operations complete.
         std::mutex mutexRun_;
+
+        // Notified when runCount_ reaches zero, allowing
+        // join() waiters to wake up.
         std::condition_variable cv_;
-        boost::coroutines2::coroutine<void>::push_type* yield_{};
-        boost::coroutines2::coroutine<void>::pull_type coro_;
-#ifndef NDEBUG
+
+        // The coroutine handle wrapper. Owns the coroutine frame.
+        // Set by init(). Reset to empty in resume() upon coroutine
+        // completion (to break the shared_ptr cycle) or in
+        // expectEarlyExit() on early termination.
+        CoroTask<void> task_;
+
+        /**
+         * Type-erased base for heap-stored callables.
+         * Prevents the coroutine lambda from being destroyed before
+         * the coroutine frame is done with it.
+         *
+         * @see FuncStore
+         */
+        struct FuncBase
+        {
+            virtual ~FuncBase() = default;
+        };
+
+        /**
+         * Concrete type-erased storage for a callable of type F.
+         * The coroutine frame stores a reference to the lambda's implicit
+         * object parameter. If the lambda is a temporary, that reference
+         * dangles after the call returns. FuncStore keeps it alive on
+         * the heap for the lifetime of the CoroTaskRunner.
+         */
+        template <class F>
+        struct FuncStore : FuncBase
+        {
+            F func;  // The stored callable (coroutine lambda).
+            explicit FuncStore(F&& f) : func(std::move(f))
+            {
+            }
+        };
+
+        // Heap-allocated callable storage. Set by init(), ensures the
+        // lambda outlives the coroutine frame that references it.
+        std::unique_ptr<FuncBase> storedFunc_;
+
+        // True once the coroutine has completed or expectEarlyExit() was
+        // called. Asserted in the destructor (debug) to catch leaked
+        // runners. Available in all builds to guard expectEarlyExit()
+        // against double-decrementing nSuspend_.
         bool finished_ = false;
-#endif
 
     public:
-        template <class F>
-        Coro(CoroCreateT, JobQueue&, JobType, std::string, F&&);
-
-        // Not copy-constructible or assignable
-        Coro(Coro const&) = delete;
-        Coro&
-        operator=(Coro const&) = delete;
-
-        ~Coro();
+        /**
+         * Tag type for private construction. Prevents external code
+         * from constructing CoroTaskRunner directly. Use postCoroTask().
+         */
+        struct CreateT
+        {
+            explicit CreateT() = default;
+        };
 
         /**
-         * Suspend coroutine execution.
-         *  Effects:
-         *    The coroutine's stack is saved.
-         *    The associated Job thread is released.
-         *  Note:
-         *    The associated Job function returns.
-         *    Undefined behavior if called consecutively without a corresponding
-         * post.
+         * Construct a CoroTaskRunner. Private by convention (CreateT tag).
+         *
+         * @param jq   The JobQueue this coroutine will run on
+         * @param type Job type for scheduling priority
+         * @param name Human-readable name for logging
+         */
+        CoroTaskRunner(CreateT, JobQueue&, JobType, std::string);
+
+        CoroTaskRunner(CoroTaskRunner const&) = delete;
+        CoroTaskRunner&
+        operator=(CoroTaskRunner const&) = delete;
+
+        /**
+         * Destructor. Asserts (debug) that the coroutine has finished
+         * or expectEarlyExit() was called.
+         */
+        ~CoroTaskRunner();
+
+        /**
+         * Initialize with a coroutine-returning callable.
+         * Must be called exactly once, after the object is managed by
+         * shared_ptr (because init uses shared_from_this internally).
+         * This is handled automatically by postCoroTask().
+         *
+         * @param f Callable: CoroTask<void>(shared_ptr<CoroTaskRunner>)
+         */
+        template <class F>
+        void
+        init(F&& f);
+
+        /**
+         * Increment the JobQueue's suspended-coroutine count (nSuspend_).
+         * Called when the coroutine is about to suspend. Every call
+         * must be balanced by a corresponding decrement (via resume()
+         * or onUndoSuspend()), or JobQueue::stop() will hang.
          */
         void
-        yield() const;
+        onSuspend();
 
         /**
-         * Schedule coroutine execution.
-         * Effects:
-         *   Returns immediately.
-         *   A new job is scheduled to resume the execution of the coroutine.
-         *   When the job runs, the coroutine's stack is restored and execution
-         *     continues at the beginning of coroutine function or the
-         * statement after the previous call to yield. Undefined behavior if
-         * called after the coroutine has completed with a return (as opposed to
-         * a yield()). Undefined behavior if post() or resume() called
-         * consecutively without a corresponding yield.
+         * Decrement nSuspend_ without resuming.
+         * Used to undo onSuspend() when a scheduled post() fails
+         * (e.g. JobQueue is stopping).
+         */
+        void
+        onUndoSuspend();
+
+        /**
+         * Suspend the coroutine.
+         * The awaiter's await_suspend() increments nSuspend_ before the
+         * coroutine actually suspends. The caller must later call post()
+         * or resume() to continue execution.
          *
-         * @return true if the Coro's job is added to the JobQueue.
+         * @return An awaiter for use with `co_await runner->suspend()`
+         */
+        auto
+        suspend();
+
+        /**
+         * Suspend the coroutine and immediately repost it on the
+         * JobQueue. Combines suspend() + post() atomically inside
+         * await_suspend, so there is no window where an external
+         * event could race between the two.
+         *
+         * Equivalent to JobQueueAwaiter but defined as an inline
+         * awaiter returned from a member function. This avoids a
+         * GCC-12 coroutine codegen bug where an external awaiter
+         * struct (JobQueueAwaiter) used at multiple co_await points
+         * corrupts the coroutine state machine's resume index,
+         * causing the coroutine to hang on the third resumption.
+         *
+         * @return An awaiter for use with `co_await runner->yieldAndPost()`
+         */
+        auto
+        yieldAndPost();
+
+        /**
+         * Schedule coroutine resumption as a job on the JobQueue.
+         * Captures shared_from_this() to prevent this runner from being
+         * destroyed while the job is queued.
+         *
+         * @return true if the job was accepted; false if the JobQueue
+         *         is stopping (caller must handle cleanup)
          */
         bool
         post();
 
         /**
-         * Resume coroutine execution.
-         * Effects:
-         *    The coroutine continues execution from where it last left off
-         *      using this same thread.
-         *    If the coroutine has already completed, returns immediately
-         *      (handles the documented post-before-yield race condition).
-         * Undefined behavior if resume() or post() called consecutively
-         *   without a corresponding yield.
+         * Resume the coroutine on the current thread.
+         * Decrements nSuspend_, swaps in LocalValues, resumes the
+         * coroutine handle, swaps out LocalValues, and notifies join()
+         * waiters. Lock ordering (sequential, non-overlapping):
+         * jq_.mutex_ -> mutex_ -> mutexRun_.
+         *
+         * @pre post() must have been called before resume(). Direct
+         *      calls without a prior post() will corrupt runCount_
+         *      and break join().
          */
         void
         resume();
 
         /**
-         * Returns true if the Coro is still runnable (has not returned).
+         * @return true if the coroutine has not yet run to completion
          */
-        [[nodiscard]] bool
+        bool
         runnable() const;
 
         /**
-         * Once called, the Coro allows early exit without an assert.
+         * Handle early termination when the coroutine never ran.
+         * Decrements nSuspend_ and destroys the coroutine frame to
+         * break the shared_ptr cycle (frame -> lambda -> runner -> frame).
+         * Called by postCoroTask() when post() fails.
          */
         void
         expectEarlyExit();
 
         /**
-         * Waits until coroutine returns from the user function.
+         * Block until all pending/active resume operations complete.
+         * Uses cv_ + mutexRun_ to wait until runCount_ reaches 0.
+         * Warning: deadlocks if the coroutine is suspended and never posted.
          */
         void
         join();
@@ -184,18 +493,18 @@ public:
     }
 
     /**
-     * Creates a coroutine and adds a job to the queue which will run it.
+     * Creates a C++20 coroutine and adds a job to the queue to run it.
      *
      * @param t The type of job.
      * @param name Name of the job.
-     * @param f Has a signature of void(std::shared_ptr<Coro>). Called when the
-     * job executes.
+     * @param f Callable with signature
+     * CoroTask<void>(std::shared_ptr<CoroTaskRunner>).
      *
-     * @return shared_ptr to posted Coro.  nullptr if post was not successful.
+     * @return shared_ptr to posted CoroTaskRunner. nullptr if not successful.
      */
     template <class F>
-    std::shared_ptr<Coro>
-    postCoro(JobType t, std::string const& name, F&& f);
+    std::shared_ptr<CoroTaskRunner>
+    postCoroTask(JobType t, std::string const& name, F&& f);
 
     /**
      * Jobs waiting at this priority.
@@ -256,8 +565,6 @@ public:
     isStopped() const;
 
 private:
-    friend class Coro;
-
     using JobDataMap = std::map<JobType, JobTypeData>;
 
     beast::Journal journal_;
@@ -358,88 +665,89 @@ private:
     getJobLimit(JobType type);
 };
 
-/*
-    An RPC command is received and is handled via ServerHandler(HTTP) or
-    Handler(websocket), depending on the connection type. The handler then calls
-    the JobQueue::postCoro() method to create a coroutine and run it at a later
-    point. This frees up the handler thread and allows it to continue handling
-    other requests while the RPC command completes its work asynchronously.
-
-    postCoro() creates a Coro object. When the Coro ctor is called, and its
-    coro_ member is initialized (a boost::coroutines::pull_type), execution
-    automatically passes to the coroutine, which we don't want at this point,
-    since we are still in the handler thread context. It's important to note
-   here that construction of a boost pull_type automatically passes execution to
-   the coroutine. A pull_type object automatically generates a push_type that is
-    passed as a parameter (do_yield) in the signature of the function the
-    pull_type was created with. This function is immediately called during coro_
-    construction and within it, Coro::yield_ is assigned the push_type
-    parameter (do_yield) address and called (yield()) so we can return execution
-    back to the caller's stack.
-
-    postCoro() then calls Coro::post(), which schedules a job on the job
-    queue to continue execution of the coroutine in a JobQueue worker thread at
-    some later time. When the job runs, we lock on the Coro::mutex_ and call
-    coro_ which continues where we had left off. Since we the last thing we did
-    in coro_ was call yield(), the next thing we continue with is calling the
-    function param f, that was passed into Coro ctor. It is within this
-    function body that the caller specifies what he would like to do while
-    running in the coroutine and allow them to suspend and resume execution.
-    A task that relies on other events to complete, such as path finding, calls
-    Coro::yield() to suspend its execution while waiting on those events to
-    complete and continue when signaled via the Coro::post() method.
-
-    There is a potential race condition that exists here where post() can get
-    called before yield() after f is called. Technically the problem only occurs
-    if the job that post() scheduled is executed before yield() is called.
-    If the post() job were to be executed before yield(), undefined behavior
-    would occur. The lock ensures that coro_ is not called again until we exit
-    the coroutine. At which point a scheduled resume() job waiting on the lock
-    would gain entry. resume() checks if the coroutine has already completed
-    (coro_ converts to false) and, if so, skips invoking operator() since
-    calling operator() on a completed boost::coroutine2 pull_type is undefined
-    behavior.
-
-    The race condition occurs as follows:
-
-        1- The coroutine is running.
-        2- The coroutine is about to suspend, but before it can do so, it must
-            arrange for some event to wake it up.
-        3- The coroutine arranges for some event to wake it up.
-        4- Before the coroutine can suspend, that event occurs and the
-   resumption of the coroutine is scheduled on the job queue. 5- Again, before
-   the coroutine can suspend, the resumption of the coroutine is dispatched. 6-
-   Again, before the coroutine can suspend, the resumption code runs the
-            coroutine.
-        The coroutine is now running in two threads.
-
-        The lock prevents this from happening as step 6 will block until the
-            lock is released which only happens after the coroutine completes.
-*/
-
 }  // namespace xrpl
 
-#include <xrpl/core/Coro.ipp>  // IWYU pragma: keep
+#include <xrpl/core/CoroTaskRunner.ipp>  // IWYU pragma: keep
 
 namespace xrpl {
 
+// postCoroTask — entry point for launching a C++20 coroutine on the JobQueue.
+//
+// Control Flow
+// ============
+//
+//   postCoroTask(t, name, f)
+//     |
+//     +-- 1. Reserve a jobCounter_ slot — reject if JQ shutting down
+//     |
+//     +-- 2. ++nSuspend_   (the coroutine uses lazy-start, so it is
+//     |        "suspended" from the JQ's perspective before its first resume.
+//     |        This keeps the JQ shutdown logic correct — it waits for
+//     |        nSuspend_ to reach 0).
+//     |
+//     +-- 3. Create CoroTaskRunner (shared_ptr, ref-counted)
+//     |
+//     +-- 4. runner->init(f)
+//     |        +-- Heap-allocate the lambda (FuncStore) to prevent
+//     |        |   dangling captures in the coroutine frame
+//     |        +-- task_ = f(shared_from_this())
+//     |              [coroutine created but NOT started — lazy initial_suspend]
+//     |
+//     +-- 5. runner->post()
+//     |        +-- addJob(type_, [resume]{})   → resume on worker thread
+//     |        +-- failure (JQ stopping):
+//     |              +-- runner->expectEarlyExit()
+//     |              |     --nSuspend_, destroy coroutine frame
+//     |              +-- return nullptr
+//     |
+//     +-- 6. Release the jobCounter_ slot (on return)
+//
+// Why reserve a jobCounter_ slot?
+// ===============================
+// JobQueue::stop() joins jobCounter_ before it acquires mutex_ and asserts
+// nSuspend_ == 0.  Without a reservation, stop() could run to completion in
+// the window between the ++nSuspend_ in step 2 and the balancing post() or
+// expectEarlyExit() in step 5, tripping that assert.  Holding a slot blocks
+// stop()'s join() for the whole function, closing the window.  wrap() also
+// returns nullopt once the counter is joined, so it doubles as the shutdown
+// check — a plain stopping_ read cannot do this, because the read and the
+// ++nSuspend_ are not a single atomic step.
+//
+// Why async post() instead of synchronous resume()?
+// ==================================================
+// The initial dispatch MUST use async post() so the coroutine body runs on
+// a JobQueue worker thread, not the caller's thread.  resume() swaps the
+// caller's thread-local LocalValues with the coroutine's private copy.
+// If the coroutine mutates LocalValues (e.g. thread_specific_storage test),
+// those mutations bleed back into the caller's thread-local state after the
+// swap-out, corrupting subsequent tests that share the same thread pool.
+// Async post() avoids this by running the coroutine on a worker thread whose
+// LocalValues are managed by the thread pool, not by the caller.
+//
 template <class F>
-std::shared_ptr<JobQueue::Coro>
-JobQueue::postCoro(JobType t, std::string const& name, F&& f)
+std::shared_ptr<JobQueue::CoroTaskRunner>
+JobQueue::postCoroTask(JobType t, std::string const& name, F&& f)
 {
-    /*  First param is a detail type to make construction private.
-        Last param is the function the coroutine runs. Signature of
-        void(std::shared_ptr<Coro>).
-    */
-    auto coro = std::make_shared<Coro>(CoroCreateT{}, *this, t, name, std::forward<F>(f));
-    if (!coro->post())
+    // Held until this function returns. Null once jobCounter_ is joined,
+    // which is how a shutting-down JobQueue rejects new coroutines.
+    auto const shutdownGuard = jobCounter_.wrap([]() {});
+    if (!shutdownGuard)
+        return nullptr;
+
+    // Account for the initial suspension (CoroTask uses lazy start).
     {
-        // The Coro was not successfully posted.  Disable it so it's destructor
-        // can run with no negative side effects.  Then destroy it.
-        coro->expectEarlyExit();
-        coro.reset();
+        std::scoped_lock const lock(mutex_);
+        ++nSuspend_;
     }
-    return coro;
+
+    auto runner = std::make_shared<CoroTaskRunner>(CoroTaskRunner::CreateT{}, *this, t, name);
+    runner->init(std::forward<F>(f));
+    if (!runner->post())
+    {
+        runner->expectEarlyExit();
+        runner.reset();
+    }
+    return runner;
 }
 
 }  // namespace xrpl

include/xrpl/core/JobQueueAwaiter.h

@@ -0,0 +1,212 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/JobQueue.h>
+
+#include <coroutine>
+#include <memory>
+
+namespace xrpl {
+
+/**
+ * Awaiter that suspends and immediately reschedules on the JobQueue.
+ * Equivalent to calling yield() followed by post() in the old Coro API.
+ *
+ * Usage:
+ *     co_await JobQueueAwaiter{runner};
+ *
+ * What it waits for: The coroutine is re-queued as a job and resumes
+ * when a worker thread picks it up.
+ *
+ * Which thread resumes: A JobQueue worker thread.
+ *
+ * What await_resume() returns: void.
+ *
+ * Dependency Diagram
+ * ==================
+ *
+ *   JobQueueAwaiter
+ *   +----------------------------------------------+
+ *   | + runner : shared_ptr<CoroTaskRunner>         |
+ *   +----------------------------------------------+
+ *   | + await_ready()   -> false (always suspend)   |
+ *   | + await_suspend() -> bool (suspend or cancel) |
+ *   | + await_resume()  -> void                     |
+ *   +----------------------------------------------+
+ *          |                         |
+ *          | uses                    | uses
+ *          v                         v
+ *   CoroTaskRunner              JobQueue
+ *   .onSuspend()                (via runner->post() -> addJob)
+ *   .onUndoSuspend()
+ *   .post()
+ *
+ * Control Flow (await_suspend)
+ * ============================
+ *
+ *   co_await JobQueueAwaiter{runner}
+ *     |
+ *     +-- await_ready() -> false
+ *     +-- await_suspend(handle)
+ *           |
+ *           +-- runner->onSuspend()     // ++nSuspend_
+ *           +-- runner->post()          // addJob to JobQueue
+ *           |     |
+ *           |     +-- success? return noop_coroutine()
+ *           |     |     // coroutine stays suspended;
+ *           |     |     // worker thread will call resume()
+ *           |     +-- failure? (JQ stopping)
+ *           |           +-- runner->onUndoSuspend()  // --nSuspend_
+ *           |           +-- return handle  // symmetric transfer back
+ *           |                              // coroutine continues immediately
+ *           |                              // so it can clean up and co_return
+ *
+ * DEPRECATED — prefer `co_await runner->yieldAndPost()`
+ * =====================================================
+ *
+ * GCC-12 has a coroutine codegen bug where using this external awaiter
+ * struct at multiple co_await points in the same coroutine corrupts the
+ * state machine's resume index. After the second co_await, the third
+ * resumption enters handle().resume() but never reaches await_resume()
+ * or any subsequent user code — the coroutine hangs indefinitely.
+ *
+ * The fix is `co_await runner->yieldAndPost()`, which defines the
+ * awaiter as an inline struct inside a CoroTaskRunner member function.
+ * GCC-12 handles inline awaiters correctly at multiple co_await points.
+ *
+ * This struct is retained for single-use scenarios and documentation
+ * purposes. For any code that may use co_await in a loop or at
+ * multiple points, always use `runner->yieldAndPost()`.
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Yield and auto-repost (preferred — works on all compilers):
+ *
+ *     CoroTask<void> handler(auto runner) {
+ *         doPartA();
+ *         co_await runner->yieldAndPost();   // yield + repost
+ *         doPartB();                         // runs on a worker thread
+ *         co_return;
+ *     }
+ *
+ * 2. Multiple yield points in a loop:
+ *
+ *     CoroTask<void> batchProcessor(auto runner) {
+ *         for (auto& item : items) {
+ *             process(item);
+ *             co_await runner->yieldAndPost();  // let other jobs run
+ *         }
+ *         co_return;
+ *     }
+ *
+ * 3. Graceful shutdown — checking after resume:
+ *
+ *     CoroTask<void> longTask(auto runner, JobQueue& jq) {
+ *         while (hasWork()) {
+ *             co_await runner->yieldAndPost();
+ *             // If JQ is stopping, await_suspend resumes the coroutine
+ *             // immediately without re-queuing. Always check
+ *             // isStopping() to decide whether to proceed:
+ *             if (jq.isStopping())
+ *                 co_return;
+ *             doNextChunk();
+ *         }
+ *         co_return;
+ *     }
+ *
+ * Caveats / Pitfalls
+ * ==================
+ *
+ * BUG-RISK: Using a stale or null runner.
+ *   The runner shared_ptr must be valid and point to the CoroTaskRunner
+ *   that owns the coroutine currently executing. Passing a runner from
+ *   a different coroutine, or a default-constructed shared_ptr, is UB.
+ *
+ * BUG-RISK: Assuming resume happens on the same thread.
+ *   After co_await, the coroutine resumes on whatever worker thread
+ *   picks up the job. Do not rely on thread-local state unless it is
+ *   managed through LocalValue (which CoroTaskRunner automatically
+ *   swaps in/out).
+ *
+ * BUG-RISK: Ignoring the shutdown path.
+ *   When the JobQueue is stopping, post() fails and await_suspend()
+ *   resumes the coroutine immediately (symmetric transfer back to h).
+ *   The coroutine body continues on the same thread. If your code
+ *   after co_await assumes it was re-queued and is running on a worker
+ *   thread, that assumption breaks during shutdown. Always handle the
+ *   "JQ is stopping" case, either by checking jq.isStopping() or by
+ *   letting the coroutine fall through to co_return naturally.
+ *
+ * DIFFERENCE from runner->suspend() + runner->post():
+ *   Both JobQueueAwaiter and yieldAndPost() combine suspend + post
+ *   in one atomic operation. With the manual suspend()/post() pattern,
+ *   there is a window between the two calls where an external event
+ *   could race. The atomic awaiters remove that window — onSuspend()
+ *   and post() happen within the same await_suspend() call while the
+ *   coroutine is guaranteed to be suspended. Use yieldAndPost() unless
+ *   you need an external party to decide *when* to call post().
+ */
+struct JobQueueAwaiter
+{
+    // The CoroTaskRunner that owns the currently executing coroutine.
+    std::shared_ptr<JobQueue::CoroTaskRunner> runner;
+
+    /**
+     * Always returns false so the coroutine suspends.
+     */
+    // The C++ coroutine protocol mandates these awaiter names and
+    // instance-callable methods, which conflict with the project
+    // naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    [[nodiscard]] bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Increment nSuspend (equivalent to yield()) and schedule resume
+     * on the JobQueue (equivalent to post()). If the JobQueue is
+     * stopping, undoes the suspend count and transfers back to the
+     * coroutine so it can clean up and co_return.
+     *
+     * Returns a coroutine_handle<> (symmetric transfer) instead of
+     * bool to work around a GCC-12 codegen bug where bool-returning
+     * await_suspend leaves the coroutine in an invalid state —
+     * neither properly suspended nor resumed — causing a hang.
+     *
+     * WARNING: GCC-12 has an additional codegen bug where using this
+     * external awaiter struct at multiple co_await points in the same
+     * coroutine corrupts the state machine's resume index, causing the
+     * coroutine to hang on the third resumption. Prefer
+     * `co_await runner->yieldAndPost()` which uses an inline awaiter
+     * that GCC-12 handles correctly.
+     *
+     * @return noop_coroutine() to stay suspended (job posted);
+     *         the caller's handle to resume immediately (JQ stopping)
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> h)
+    {
+        XRPL_ASSERT(runner, "xrpl::JobQueueAwaiter::await_suspend : runner is valid");
+        runner->onSuspend();
+        if (!runner->post())
+        {
+            // JobQueue is stopping. Undo the suspend count and
+            // transfer back to the coroutine so it can clean up
+            // and co_return.
+            runner->onUndoSuspend();
+            return h;
+        }
+        return std::noop_coroutine();
+    }
+
+    void
+    await_resume() const noexcept
+    {
+    }
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+};
+
+}  // namespace xrpl

include/xrpl/json/json_value.h

@@ -3,13 +3,11 @@
 #include <xrpl/basics/Number.h>
 #include <xrpl/json/json_forwards.h>
 
-#include <concepts>
 #include <cstring>
 #include <iterator>
 #include <limits>
 #include <map>
 #include <string>
-#include <string_view>
 #include <vector>
 
 /**
@@ -200,15 +198,6 @@ public:
      */
     Value(StaticString const& value);
     Value(std::string const& value);
-    /**
-     * @brief Constructs a value from a string view.
-     *
-     * The characters are copied, so the view need not outlive the call and need
-     * not be NUL-terminated.
-     *
-     * @param value The characters to copy.
-     */
-    Value(std::string_view value);
     Value(bool value);
     Value(Value const& other);
     ~Value();
@@ -483,32 +472,6 @@ toJson(xrpl::Number const& number)
 bool
 operator==(Value const&, Value const&);
 
-/**
- * Compares a value with a string view, reading the value's characters in place
- * rather than building a Value from the view.
- *
- * Constrained to the exact type: a string literal converts equally well to a
- * view and to a Value, so a plain overload makes `value == "literal"`
- * ambiguous.
- *
- * @param x The value to compare.
- * @param y The characters to compare it against.
- * @return Whether `x` is a string whose characters up to its first NUL are
- *         exactly the characters of `y`.
- */
-template <class T>
-    requires std::same_as<T, std::string_view>
-bool
-operator==(Value const& x, T y)
-{
-    if (!x.isString())
-        return false;
-
-    // A string `Value` can hold a null pointer, which names no characters, so it equals no view.
-    char const* const s = x.asCString();
-    return s != nullptr && std::string_view{s} == y;
-}
-
 bool
 operator<(Value const&, Value const&);
 

include/xrpl/ledger/entries/AmendmentsEntry.h

@@ -1,17 +1,11 @@
 #pragma once
 
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/entries/SLEBase.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
-#include <xrpl/protocol/SField.h>
-
-#include <map>
-#include <set>
 
 namespace xrpl {
 
@@ -31,52 +25,6 @@ public:
         : Base(keylet::amendments(), view, j)
     {
     }
-
-    /**
-     * Returns the set of amendments this entry reports as enabled.
-     *
-     * @return the set of enabled amendments.
-     */
-    [[nodiscard]] std::set<UInt256>
-    enabledAmendments() const
-    {
-        std::set<UInt256> amendments;
-
-        if (this->exists() && (*this)->isFieldPresent(sfAmendments))
-        {
-            auto const& v = (*this)->getFieldV256(sfAmendments);
-            amendments.insert_range(v);
-        }
-
-        return amendments;
-    }
-
-    /**
-     * Returns a map of amendments that have achieved majority, to the time
-     * majority was reached.
-     *
-     * @return a map of amendment to the time majority was reached.
-     */
-    [[nodiscard]] std::map<UInt256, NetClock::time_point>
-    majorityAmendments() const
-    {
-        std::map<UInt256, NetClock::time_point> ret;
-
-        if (this->exists() && (*this)->isFieldPresent(sfMajorities))
-        {
-            using TimePoint = NetClock::time_point;
-            using Duration = TimePoint::duration;
-
-            auto const majorities = (*this)->getFieldArray(sfMajorities);
-
-            for (auto const& m : majorities)
-            {
-                ret[m.getFieldH256(sfAmendment)] = TimePoint(Duration(m.getFieldU32(sfCloseTime)));
-            }
-        }
-
-        return ret;
-    }
 };
 
 using AmendmentsEntryR = AmendmentsEntry<ReadView>;

include/xrpl/ledger/entries/LedgerHashesEntry.h

@@ -1,17 +1,11 @@
 #pragma once
 
-#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/entries/SLEBase.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/LedgerFormats.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STVector256.h>
-
-#include <cstddef>
-#include <optional>
 
 namespace xrpl {
 
@@ -31,31 +25,6 @@ public:
         : Base(keylet::skip(), view, j)
     {
     }
-
-    /**
-     * Looks up a hash `diff` slots back from the most recent entry in the
-     * sfHashes vector (diff == 0 is the most recent entry).
-     *
-     * Callers decide which skip list entry to read and how to translate a
-     * target ledger sequence into `diff`; this only does the bounds check
-     * and vector indexing shared by both the recent (stride 1) and distant
-     * (stride 256) skip lists.
-     *
-     * @param diff how many slots back from the most recent hash to look up;
-     * 0 is the most recent hash.
-     * @return the hash at that slot, or std::nullopt if the entry does not
-     * exist or `diff` is out of range.
-     */
-    [[nodiscard]] std::optional<UInt256>
-    hashAt(std::size_t diff) const
-    {
-        if (!this->exists())
-            return std::nullopt;
-        STVector256 const vec = (*this)->getFieldV256(sfHashes);
-        if (vec.size() > diff)
-            return vec[vec.size() - diff - 1];
-        return std::nullopt;
-    }
 };
 
 using LedgerHashesEntryR = LedgerHashesEntry<ReadView>;

include/xrpl/ledger/helpers/AMMHelpers.h

@@ -353,7 +353,7 @@ changeSpotPriceQuality(
         }
         if (auto const nTakerPaysPropose = (-b + root2(res)) / (2 * a); nTakerPaysPropose > 0)
         {
-            auto const nTakerPays = [&] {
+            auto const nTakerPays = [&]() {
                 // The fee might make the AMM offer quality less than CLOB
                 // quality. Therefore, AMM offer has to satisfy this constraint:
                 // o / i >= q. Substituting o with swapAssetIn() gives: i <= O /
@@ -372,8 +372,8 @@ changeSpotPriceQuality(
             auto const takerPays =
                 toAmount<TIn>(getAsset(pool.in), nTakerPays, Number::RoundingMode::Upward);
             // should not fail
-            auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
-            if (Quality{amounts} < quality &&
+            if (auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
+                Quality{amounts} < quality &&
                 !withinRelativeDistance(Quality{amounts}, quality, Number(1, -7)))
             {
                 JLOG(j.error()) << "changeSpotPriceQuality failed: " << to_string(pool.in) << " "
@@ -382,19 +382,21 @@ changeSpotPriceQuality(
                                 << " " << to_string(amounts.out);
                 Throw<std::runtime_error>("changeSpotPriceQuality failed");
             }
-
-            JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
-                            << to_string(pool.out) << " "
-                            << " " << quality << " " << tfee << " " << to_string(amounts.in) << " "
-                            << to_string(amounts.out);
-            return amounts;
+            else
+            {
+                JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
+                                << to_string(pool.out) << " "
+                                << " " << quality << " " << tfee << " " << to_string(amounts.in)
+                                << " " << to_string(amounts.out);
+                return amounts;
+            }
         }
         JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in) << " "
                         << to_string(pool.out) << " " << quality << " " << tfee;
         return std::nullopt;
     }
 
-    auto amounts = [&] {
+    auto amounts = [&]() {
         bool const inIntegral = getAsset(pool.in).integral();
         bool const outIntegral = getAsset(pool.out).integral();
 

include/xrpl/ledger/helpers/EscrowHelpers.h

@@ -2,10 +2,8 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
@@ -29,291 +27,6 @@
 
 namespace xrpl {
 
-/**
- * Validate that @p account may lock @p amount of a token for later delivery
- * to @p dest.
- *
- * The lock-side counterpart of escrowUnlockPreclaimHelper: every issuer
- * control (locking opt-in, authorization, freeze/lock, transferability,
- * spendable balance) that gates locking token value lives here, so any
- * transactor that locks funds applies the same rules. The signature is
- * view-based rather than PreclaimContext-based so it can also run from
- * doApply.
- */
-template <ValidIssueType T>
-TER
-escrowLockPreclaimHelper(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& dest,
-    STAmount const& amount,
-    beast::Journal j);
-
-template <>
-inline TER
-escrowLockPreclaimHelper<Issue>(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& dest,
-    STAmount const& amount,
-    beast::Journal j)
-{
-    auto const& issue = amount.get<Issue>();
-    auto const& issuer = amount.getIssuer();
-    // If the issuer is the same as the account, return tecNO_PERMISSION
-    if (issuer == account)
-        return tecNO_PERMISSION;
-
-    // If the lsfAllowTrustLineLocking is not enabled, return tecNO_PERMISSION
-    auto const sleIssuer = view.read(keylet::account(issuer));
-    if (!sleIssuer)
-        return tecNO_ISSUER;
-    if (!sleIssuer->isFlag(lsfAllowTrustLineLocking))
-        return tecNO_PERMISSION;
-
-    // If the account does not have a trustline to the issuer, return tecNO_LINE
-    auto const sleRippleState = view.read(keylet::trustLine(account, issuer, issue.currency));
-    if (!sleRippleState)
-        return tecNO_LINE;
-
-    STAmount const balance = (*sleRippleState)[sfBalance];
-
-    // If balance is positive, issuer must have higher address than account
-    if (balance > beast::kZero && issuer < account)
-        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
-
-    // If balance is negative, issuer must have lower address than account
-    if (balance < beast::kZero && issuer > account)
-        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
-
-    // If the issuer has requireAuth set, check if the account is authorized
-    if (auto const ter = requireAuth(view, issue, account); !isTesSuccess(ter))
-        return ter;
-
-    // If the issuer has requireAuth set, check if the destination is authorized
-    if (auto const ter = requireAuth(view, issue, dest); !isTesSuccess(ter))
-        return ter;
-
-    // If the issuer has frozen the account, return tecFROZEN
-    if (isFrozen(view, account, issue))
-        return tecFROZEN;
-
-    // If the issuer has frozen the destination, return tecFROZEN
-    if (isFrozen(view, dest, issue))
-        return tecFROZEN;
-
-    STAmount const spendableAmount =
-        accountHolds(view, account, issue.currency, issuer, FreezeHandling::IgnoreFreeze, j);
-
-    // If the balance is less than or equal to 0, return tecINSUFFICIENT_FUNDS
-    if (spendableAmount <= beast::kZero)
-        return tecINSUFFICIENT_FUNDS;
-
-    // If the spendable amount is less than the amount, return
-    // tecINSUFFICIENT_FUNDS
-    if (spendableAmount < amount)
-        return tecINSUFFICIENT_FUNDS;
-
-    // If the amount is not addable to the balance, return tecPRECISION_LOSS
-    if (!canAdd(spendableAmount, amount))
-        return tecPRECISION_LOSS;
-
-    return tesSUCCESS;
-}
-
-template <>
-inline TER
-escrowLockPreclaimHelper<MPTIssue>(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& dest,
-    STAmount const& amount,
-    beast::Journal j)
-{
-    AccountID const issuer = amount.getIssuer();
-    // If the issuer is the same as the account, return tecNO_PERMISSION
-    if (issuer == account)
-        return tecNO_PERMISSION;
-
-    // If the mpt does not exist, return tecOBJECT_NOT_FOUND
-    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
-    auto const sleIssuance = view.read(issuanceKey);
-    if (!sleIssuance)
-        return tecOBJECT_NOT_FOUND;
-
-    // If the lsfMPTCanEscrow is not enabled, return tecNO_PERMISSION
-    if (!sleIssuance->isFlag(lsfMPTCanEscrow))
-        return tecNO_PERMISSION;
-
-    // If the issuer is not the same as the issuer of the mpt, return
-    // tecNO_PERMISSION
-    if (sleIssuance->getAccountID(sfIssuer) != issuer)
-        return tecNO_PERMISSION;  // LCOV_EXCL_LINE
-
-    // If the account does not have the mpt, return tecOBJECT_NOT_FOUND
-    if (!view.exists(keylet::mptoken(issuanceKey.key, account)))
-        return tecOBJECT_NOT_FOUND;
-
-    // If the issuer has requireAuth set, check if the account is
-    // authorized
-    auto const& mptIssue = amount.get<MPTIssue>();
-    if (auto const ter = requireAuth(view, mptIssue, account, AuthType::WeakAuth);
-        !isTesSuccess(ter))
-        return ter;
-
-    // If the issuer has requireAuth set, check if the destination is
-    // authorized
-    if (auto const ter = requireAuth(view, mptIssue, dest, AuthType::WeakAuth); !isTesSuccess(ter))
-        return ter;
-
-    // If the issuer has frozen the account, return tecLOCKED
-    if (isFrozen(view, account, *sleIssuance))
-        return tecLOCKED;
-
-    // If the issuer has frozen the destination, return tecLOCKED
-    if (isFrozen(view, dest, *sleIssuance))
-        return tecLOCKED;
-
-    // If the mpt cannot be transferred, return tecNO_AUTH
-    if (auto const ter = canTransfer(view, mptIssue, account, dest); !isTesSuccess(ter))
-        return ter;
-
-    STAmount const spendableAmount = accountHolds(
-        view,
-        account,
-        amount.get<MPTIssue>(),
-        FreezeHandling::IgnoreFreeze,
-        AuthHandling::IgnoreAuth,
-        j);
-
-    // If the balance is less than or equal to 0, return tecINSUFFICIENT_FUNDS
-    if (spendableAmount <= beast::kZero)
-        return tecINSUFFICIENT_FUNDS;
-
-    // If the spendable amount is less than the amount, return
-    // tecINSUFFICIENT_FUNDS
-    if (spendableAmount < amount)
-        return tecINSUFFICIENT_FUNDS;
-
-    return tesSUCCESS;
-}
-
-template <ValidIssueType T>
-TER
-escrowLockApplyHelper(
-    ApplyView& view,
-    AccountID const& issuer,
-    AccountID const& sender,
-    STAmount const& amount,
-    beast::Journal journal);
-
-template <>
-inline TER
-escrowLockApplyHelper<Issue>(
-    ApplyView& view,
-    AccountID const& issuer,
-    AccountID const& sender,
-    STAmount const& amount,
-    beast::Journal journal)
-{
-    // Defensive: Issuer cannot create an escrow
-    if (issuer == sender)
-        return tecINTERNAL;  // LCOV_EXCL_LINE
-
-    auto const ter =
-        directSendNoFee(view, sender, issuer, amount, !amount.holds<MPTIssue>(), journal);
-    if (!isTesSuccess(ter))
-        return ter;  // LCOV_EXCL_LINE
-    return tesSUCCESS;
-}
-
-template <>
-inline TER
-escrowLockApplyHelper<MPTIssue>(
-    ApplyView& view,
-    AccountID const& issuer,
-    AccountID const& sender,
-    STAmount const& amount,
-    beast::Journal journal)
-{
-    // Defensive: Issuer cannot create an escrow
-    if (issuer == sender)
-        return tecINTERNAL;  // LCOV_EXCL_LINE
-
-    auto const ter = lockEscrowMPT(view, sender, amount, journal);
-    if (!isTesSuccess(ter))
-        return ter;  // LCOV_EXCL_LINE
-    return tesSUCCESS;
-}
-
-template <ValidIssueType T>
-TER
-escrowUnlockPreclaimHelper(
-    ReadView const& view,
-    AccountID const& account,
-    STAmount const& amount,
-    bool checkFreeze = true);
-
-template <>
-inline TER
-escrowUnlockPreclaimHelper<Issue>(
-    ReadView const& view,
-    AccountID const& account,
-    STAmount const& amount,
-    bool checkFreeze)
-{
-    AccountID const& issuer = amount.getIssuer();
-    // If the issuer is the same as the account, return tesSUCCESS
-    if (issuer == account)
-        return tesSUCCESS;
-
-    // If the issuer has requireAuth set, check if the destination is authorized
-    if (auto const ter = requireAuth(view, amount.get<Issue>(), account); !isTesSuccess(ter))
-        return ter;
-
-    // If the issuer has deep frozen the destination, return tecFROZEN
-    if (checkFreeze &&
-        isDeepFrozen(view, account, amount.get<Issue>().currency, amount.getIssuer()))
-        return tecFROZEN;
-
-    return tesSUCCESS;
-}
-
-template <>
-inline TER
-escrowUnlockPreclaimHelper<MPTIssue>(
-    ReadView const& view,
-    AccountID const& account,
-    STAmount const& amount,
-    bool checkFreeze)
-{
-    AccountID const& issuer = amount.getIssuer();
-    // If the issuer is the same as the account, return tesSUCCESS
-    if (issuer == account)
-        return tesSUCCESS;
-
-    // If the mpt does not exist, return tecOBJECT_NOT_FOUND
-    auto const issuanceKey = keylet::mptokenIssuance(amount.get<MPTIssue>().getMptID());
-    auto const sleIssuance = view.read(issuanceKey);
-    if (!sleIssuance)
-        return tecOBJECT_NOT_FOUND;
-
-    // If the issuer has requireAuth set, check if the account is
-    // authorized
-    auto const& mptIssue = amount.get<MPTIssue>();
-    if (auto const ter = requireAuth(view, mptIssue, account, AuthType::WeakAuth);
-        !isTesSuccess(ter))
-        return ter;
-
-    // If the issuer has frozen the account, return tecLOCKED
-    if (checkFreeze && isFrozen(view, account, *sleIssuance))
-        return tecLOCKED;
-
-    return tesSUCCESS;
-}
-
-//------------------------------------------------------------------------------
-
 template <ValidIssueType T>
 TER
 escrowUnlockApplyHelper(
@@ -342,6 +55,9 @@ escrowUnlockApplyHelper<Issue>(
     bool createAsset,
     beast::Journal journal)
 {
+    auto const& issue = amount.get<Issue>();
+    Keylet const trustLineKey = keylet::trustLine(receiver, issue);
+    bool const recvLow = issuer > receiver;
     bool const senderIssuer = issuer == sender;
     bool const receiverIssuer = issuer == receiver;
 
@@ -351,10 +67,6 @@ escrowUnlockApplyHelper<Issue>(
     if (receiverIssuer)
         return tesSUCCESS;
 
-    auto const& issue = amount.get<Issue>();
-    Keylet const trustLineKey = keylet::trustLine(receiver, issue);
-    bool const recvLow = issuer > receiver;
-
     if (!ctx.view.exists(trustLineKey) && createAsset)
     {
         // Can the account cover the trust line's reserve?

include/xrpl/net/AutoSocket.h

@@ -103,7 +103,7 @@ public:
     void
     asyncHandshake(HandshakeType type, Callback cbFunc)
     {
-        if ((type == SslSocket::client) || secure_)
+        if ((type == SslSocket::client) || (secure_))
         {
             // must be ssl
             secure_ = true;

include/xrpl/nodestore/detail/EncodedBlob.h

@@ -67,7 +67,7 @@ class EncodedBlob
 
 public:
     explicit EncodedBlob(std::shared_ptr<NodeObject> const& obj)
-        : size_([&obj] {
+        : size_([&obj]() {
             XRPL_ASSERT(obj, "xrpl::node_store::EncodedBlob::EncodedBlob : non-null input");
 
             if (!obj)

include/xrpl/protocol/ApiVersion.h

@@ -6,21 +6,31 @@
 #include <xrpl/protocol/jss.h>
 
 #include <cstddef>
-#include <string_view>
 #include <type_traits>
 #include <utility>
 
 namespace xrpl {
 
 /**
- * The `api_version` numbers this server serves.
+ * API version numbers used in later API versions
  *
- * A request naming a version in [kApiMinimumSupportedVersion,
- * kApiMaximumSupportedVersion] is served. With `[beta_rpc_api]` set to `1` in
- * the config the range extends to kApiBetaVersion.
+ * Requests with a version number in the range
+ * [apiMinimumSupportedVersion, apiMaximumSupportedVersion]
+ * are supported.
  *
- * A request naming no version is served at kApiVersionIfUnspecified, which is 1
- * because a request wanting any later version states it.
+ * If [beta_rpc_api] is enabled in config, the version numbers
+ * in the range [apiMinimumSupportedVersion, apiBetaVersion]
+ * are supported.
+ *
+ * Network Requests without explicit version numbers use
+ * apiVersionIfUnspecified. apiVersionIfUnspecified is 1,
+ * because all the RPC requests with a version >= 2 must
+ * explicitly specify the version in the requests.
+ * Note that apiVersionIfUnspecified will be lower than
+ * apiMinimumSupportedVersion when we stop supporting API
+ * version 1.
+ *
+ * Command line Requests use apiCommandLineVersion.
  */
 
 namespace rpc {
@@ -47,16 +57,6 @@ static_assert(kApiMaximumSupportedVersion >= kApiMinimumSupportedVersion);
 static_assert(kApiBetaVersion >= kApiMaximumSupportedVersion);
 static_assert(kApiMaximumValidVersion >= kApiMaximumSupportedVersion);
 
-/**
- * Values accepted in the `ripplerpc` request field, which selects the shape of
- * the JSON-RPC reply envelope. Distinct from `kJsonRpcVersion` in JsonRpc.h,
- * which names the JSON-RPC protocol itself, and from the `api_version`
- * constants above, which select the content of the response.
- */
-inline constexpr std::string_view kRippleRpcVersion1{"1.0"};
-inline constexpr std::string_view kRippleRpcVersion2{"2.0"};
-inline constexpr std::string_view kRippleRpcVersion3{"3.0"};
-
 inline void
 setVersion(json::Value& parent, unsigned int apiVersion, bool betaEnabled)
 {

include/xrpl/protocol/Book.h

@@ -55,7 +55,7 @@ hash_append(Hasher& h, Book const& b)
     using beast::hash_append;
     hash_append(h, b.in, b.out);
     if (b.domain)
-        hash_append(h, *b.domain);
+        hash_append(h, *(b.domain));
 }
 
 Book

include/xrpl/protocol/ErrorCodes.h

@@ -144,27 +144,7 @@ enum ErrorCodeI {
     RpcEntryNotFound = 98,
     RpcUnexpectedLedgerType = 99,
 
-    // submit + simulate
-    RpcInvalidTransaction = 100,
-    RpcInternalSubmit = 101,
-    RpcInternalJson = 102,
-    RpcInternalSimulate = 103,
-
-    // transaction_entry
-    RpcFieldNotFoundTransaction = 104,
-    RpcNotYetImplemented = 105,
-    RpcTransactionNotFound = 106,
-
-    // transaction_entry + ledger_entry
-    RpcMalformedRequest = 107,
-
-    // ledger_accept
-    RpcNotStandAlone = 108,
-
-    // ledger_entry, API version 1 only
-    RpcUnknownOption = 109,
-
-    RpcLast = RpcUnknownOption  // rpcLAST should always equal the last code.
+    RpcLast = RpcUnexpectedLedgerType  // rpcLAST should always equal the last code.
 };
 
 /**
@@ -200,6 +180,11 @@ struct ErrorInfo
     {
     }
 
+    constexpr ErrorInfo(ErrorCodeI code, char const* token, char const* message)
+        : code(code), token(token), message(message), httpStatus(200)
+    {
+    }
+
     constexpr ErrorInfo(ErrorCodeI code, char const* token, char const* message, int httpStatus)
         : code(code), token(token), message(message), httpStatus(httpStatus)
     {

include/xrpl/protocol/JsonRpc.h

@@ -1,20 +0,0 @@
-#pragma once
-
-#include <string_view>
-
-namespace xrpl::rpc {
-
-/**
- * Constants of the JSON-RPC 2.0 protocol itself.
- *
- * Kept apart from the `api_version` and `ripplerpc` constants in ApiVersion.h,
- * which go when support for API versions 1 and 2 goes.
- */
-
-/**
- * Value of the `jsonrpc` member of a request and of its reply, fixed at "2.0"
- * by the JSON-RPC specification.
- */
-inline constexpr std::string_view kJsonRpcVersion{"2.0"};
-
-}  // namespace xrpl::rpc

include/xrpl/protocol/LedgerFormats.h

@@ -208,10 +208,7 @@ enum LedgerEntryType : std::uint16_t {
                                                                                                                                    \
     LEDGER_OBJECT(Sponsorship,                                                                                                     \
         LSF_FLAG(lsfSponsorshipRequireSignForFee, 0x00010000)                                                                      \
-        LSF_FLAG(lsfSponsorshipRequireSignForReserve, 0x00020000))                                                                 \
-                                                                                                                                   \
-    LEDGER_OBJECT(LoanBroker,                                                                                                      \
-        LSF_FLAG(lsfLoanBrokerPrivate, 0x00010000))
+        LSF_FLAG(lsfSponsorshipRequireSignForReserve, 0x00020000))
 
 // clang-format on
 

include/xrpl/protocol/LedgerShortcut.h

@@ -0,0 +1,28 @@
+#pragma once
+
+namespace xrpl {
+
+/**
+ * @brief Enumeration of ledger shortcuts for specifying which ledger to use.
+ *
+ * These shortcuts provide a convenient way to reference commonly used ledgers
+ * without needing to specify their exact hash or sequence number.
+ */
+enum class LedgerShortcut {
+    /**
+     * The current working ledger (open, not yet closed)
+     */
+    Current,
+
+    /**
+     * The most recently closed ledger (may not be validated)
+     */
+    Closed,
+
+    /**
+     * The most recently validated ledger
+     */
+    Validated
+};
+
+}  // namespace xrpl

include/xrpl/protocol/STObject.h

@@ -457,7 +457,9 @@ private:
     // The remove_cv and remove_reference are necessitated by the STBitString
     // types.  Their value() returns by const ref.  We return those types
     // by value.
-    template <typename T, typename V = std::remove_cvref_t<decltype(std::declval<T>().value())>>
+    template <
+        typename T,
+        typename V = std::remove_cv_t<std::remove_reference_t<decltype(std::declval<T>().value())>>>
     V
     getFieldByValue(SField const& field) const;
 

include/xrpl/protocol/STValidation.h

@@ -188,7 +188,7 @@ private:
 template <class LookupNodeID>
 STValidation::STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, DeserializeOptions options)
     : STObject(validationFormat(), sit, sfValidation, options.requireCanonicalOrder)
-    , signingPubKey_([this] {
+    , signingPubKey_([this]() {
         auto const spk = getFieldVL(sfSigningPubKey);
 
         if (publicKeyType(makeSlice(spk)) != KeyType::Secp256k1)

include/xrpl/protocol/Serializer.h

@@ -252,7 +252,7 @@ public:
     {
         auto success = (offset + (Bits / 8)) <= data_.size();
         if (success)
-            memcpy(data.begin(), &data_.front() + offset, (Bits / 8));
+            memcpy(data.begin(), &(data_.front()) + offset, (Bits / 8));
         return success;
     }
 

include/xrpl/protocol/TER.h

@@ -449,7 +449,7 @@ public:
     // Trait tells the requires-clause which types are allowed for construction.
     template <typename T>
     constexpr TERSubset(T rhs)
-        requires(Trait<std::remove_cvref_t<T>>::value)
+        requires(Trait<std::remove_cv_t<std::remove_reference_t<T>>>::value)
         : code_(TERtoInt(rhs))
     {
     }

include/xrpl/protocol/TxFlags.h

@@ -226,10 +226,6 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfLoanUnimpair, 0x00040000),                                                                                                                   \
         MASK_ADJ(0))                                                                                                                                           \
                                                                                                                                                                \
-    TRANSACTION(LoanBrokerSet,                                                                                                                                 \
-        TF_FLAG(tfLoanBrokerPrivate, 0x00010000),                                                                                                              \
-        MASK_ADJ(0))                                                                                                                                           \
-                                                                                                                                                               \
     TRANSACTION(SponsorshipSet,                                                                                                                                \
         TF_FLAG(tfSponsorshipSetRequireSignForFee, 0x00010000)                                                                                                 \
         TF_FLAG(tfSponsorshipClearRequireSignForFee, 0x00020000)                                                                                               \
@@ -242,12 +238,6 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfSponsorshipEnd, 0x00010000)                                                                                                                  \
         TF_FLAG(tfSponsorshipCreate, 0x00020000)                                                                                                               \
         TF_FLAG(tfSponsorshipReassign, 0x00040000),                                                                                                            \
-        MASK_ADJ(0))                                                                                                                                          \
-                                                                                                                                                               \
-    TRANSACTION(ConfidentialMPTHolderKeyUpdate,                                                                                                                \
-        TF_FLAG(tfHolderKeyRotation, 0x00010000)                                                                                                               \
-        TF_FLAG(tfHolderKeyRecovery, 0x00020000)                                                                                                               \
-        TF_FLAG(tfCancelRecovery, 0x00040000),                                                                                                                 \
         MASK_ADJ(0))
 
 // clang-format on

include/xrpl/protocol/TxMeta.h

@@ -12,12 +12,10 @@
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/UintTypes.h>
 
 #include <boost/container/flat_set.hpp>
 
 #include <cstdint>
-#include <flat_set>
 #include <optional>
 
 namespace xrpl {
@@ -117,9 +115,6 @@ public:
         parentBatchID_ = id;
     }
 
-    [[nodiscard]] std::flat_set<MPTID>
-    getAffectedMPTs() const;
-
 private:
     UInt256 transactionID_;
     std::uint32_t ledgerSeq_;

include/xrpl/protocol/detail/features.macro

@@ -20,7 +20,6 @@ XRPL_FEATURE(SmartEscrow,                 Supported::No,  VoteBehavior::DefaultN
 XRPL_FEATURE(LendingProtocolV1_2,         Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_5_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ConfidentialMPTKeyRotation,  Supported::No,  VoteBehavior::DefaultNo)
-XRPL_FIX    (BatchV1_2,                   Supported::Yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (Cleanup3_4_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -439,7 +439,6 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
     {sfIssuerKeyMirrorEpoch,        SoeOptional},
     {sfAuditorKeyMirrorEpoch,       SoeOptional},
     {sfHolderEncryptionKey,         SoeOptional},
-    {sfRecoveryKey,                 SoeOptional},
 }))
 
 /** A ledger object which tracks Oracle
@@ -549,7 +548,6 @@ LEDGER_ENTRY(ltLOAN_BROKER, 0x0088, LoanBroker, loan_broker, ({
     {sfCoverAvailable,       SoeDefault},
     {sfCoverRateMinimum,     SoeDefault},
     {sfCoverRateLiquidation, SoeDefault},
-    {sfDomainID,             SoeOptional},
 }))
 
 /** A ledger object representing a loan between a Borrower and a Loan Broker

include/xrpl/protocol/detail/sfields.macro

@@ -330,7 +330,6 @@ TYPED_SFIELD(sfAuditorEncryptionKey,        VL,     44)
 TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
 TYPED_SFIELD(sfBytecode,                    VL,     47)
-TYPED_SFIELD(sfRecoveryKey,                 VL,     48)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)

include/xrpl/protocol/detail/transactions.macro

@@ -900,7 +900,6 @@ TRANSACTION(ttLOAN_BROKER_SET, 74, LoanBrokerSet,
     {sfDebtMaximum, SoeOptional},
     {sfCoverRateMinimum, SoeOptional},
     {sfCoverRateLiquidation, SoeOptional},
-    {sfDomainID,             SoeOptional},
 }))
 
 /** This transaction deletes a Loan Broker */
@@ -1148,27 +1147,12 @@ TRANSACTION(ttCONFIDENTIAL_MPT_MIRROR_UPDATE, 92, ConfidentialMPTMirrorUpdate,
     {sfZKProof, SoeRequired},
 }))
 
-/** This transaction rotates or recovers a confidential MPT holder's ElGamal encryption key,
-    or cancels a recovery. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/token/ConfidentialMPTHolderKeyUpdate.h>
-#endif
-TRANSACTION(ttCONFIDENTIAL_MPT_HOLDER_KEY_UPDATE, 93, ConfidentialMPTHolderKeyUpdate,
-    ({.amendment = featureConfidentialMPTKeyRotation}),
-    ({
-    {sfMPTokenIssuanceID, SoeRequired},
-    {sfHolderEncryptionKey, SoeOptional},
-    {sfConfidentialBalanceSpending, SoeOptional},
-    {sfConfidentialBalanceInbox, SoeOptional},
-    {sfZKProof, SoeOptional},
-}))
-
 /** This transaction posts an unsigned transaction on-ledger as a
     TransactionProposal, pending multi-signature collection. */
 #if TRANSACTION_INCLUDE
 #   include <xrpl/tx/transactors/proposal/TransactionProposalCreate.h>
 #endif
-TRANSACTION(ttTRANSACTION_PROPOSAL_CREATE, 95, TransactionProposalCreate,
+TRANSACTION(ttTRANSACTION_PROPOSAL_CREATE, 93, TransactionProposalCreate,
     ({.amendment = featureCosign}),
     ({
     {sfProposedTransaction, SoeRequired},