refactor: Move decreaseOwnerCount onto AccountRootEntry

Replace the entry-taking decreaseOwnerCount free function with a writable member of AccountRootEntry, and drop the temporary friend declaration from the previous change. The member uses the entry's view and journal, so call sites pass their journal to the entry constructor. The AccountID-based overload stays as a shim.
refactor: Move increaseOwnerCount onto AccountRootEntry
2026-10-26 05:27:18 +00:00 · 2026-10-05 15:46:48 +01:00 · 2026-10-05 15:46:44 +01:00 · 2026-10-05 15:46:39 +01:00 · 2026-10-05 15:46:31 +01:00 · 2026-10-05 15:45:43 +01:00
978 changed files with 46576 additions and 76255 deletions
@@ -5,10 +5,7 @@ Checks: "-*,
  -bugprone-exception-escape,
  -bugprone-implicit-widening-of-multiplication-result,
  -bugprone-narrowing-conversions,
-  -bugprone-signed-bitwise,
-  -bugprone-std-exception-baseclass,
  -bugprone-throwing-static-initialization,
-  -bugprone-unhandled-code-paths,

  cppcoreguidelines-*,
  -cppcoreguidelines-avoid-c-arrays,
@@ -17,7 +14,6 @@ Checks: "-*,
  -cppcoreguidelines-avoid-magic-numbers,
  -cppcoreguidelines-avoid-non-const-global-variables,
  -cppcoreguidelines-c-copy-assignment-signature,
-  -cppcoreguidelines-explicit-constructor,
  -cppcoreguidelines-interfaces-global-init,
  -cppcoreguidelines-macro-usage,
  -cppcoreguidelines-missing-std-forward,
@@ -36,7 +32,6 @@ Checks: "-*,
  llvm-namespace-comment,

  misc-*,
-  -misc-explicit-constructor,
  -misc-multiple-inheritance,
  -misc-no-recursion,
  -misc-non-private-member-variables-in-classes,
@@ -50,8 +45,6 @@ Checks: "-*,
  -modernize-avoid-c-style-cast,
  -modernize-return-braced-init-list,
  -modernize-use-integer-sign-comparison,
-  -modernize-use-string-view,
-  -modernize-use-structured-binding,
  -modernize-use-trailing-return-type,

  performance-*,
@@ -60,7 +53,6 @@ Checks: "-*,
  -performance-noexcept-move-constructor,
  -performance-unnecessary-copy-initialization,
  -performance-unnecessary-value-param,
-  -performance-use-std-move,

  readability-*,
  -readability-avoid-const-params-in-decls,
@@ -73,10 +65,7 @@ Checks: "-*,
  -readability-named-parameter,
  -readability-qualified-auto,
  -readability-redundant-access-specifiers,
-  -readability-redundant-nested-if,
-  -readability-redundant-qualified-alias,
  -readability-static-accessed-through-instance,
-  -readability-trivial-switch,
  -readability-uppercase-literal-suffix
  "
 # ---
@@ -140,9 +129,5 @@ CheckOptions:
  readability-identifier-naming.GlobalFunctionIgnoredRegexp: "^(to_string|hash_append|tuple_hash)$"

 HeaderFilterRegex: '^.*/(tests?|xrpl|xrpld)/.*\.(h|hpp|ipp)$'
-# Skip headers reached via add_module's symlinks (<build-dir>/modules/xrpl.lib*/...).
-# verify_headers already checks each one under its real path,
-# so reporting it twice would also apply its fixes twice.
-# .ipp files are kept: they are only ever reached via the symlink.
-ExcludeHeaderFilterRegex: '^.*/protocol_autogen/.*\.(h|hpp)$|^.*\.pb\.h$|^.*/modules/xrpl\.lib[^/]+/.*\.(h|hpp)$'
+ExcludeHeaderFilterRegex: '^.*/protocol_autogen/.*\.(h|hpp)$|^.*\.pb\.h$'
 WarningsAsErrors: "*"
@@ -103,7 +103,6 @@ words:
  - dearmor
  - decryptor
  - dedented
-  - dedup
  - deleteme
  - demultiplexer
  - deserializaton
@@ -198,7 +197,6 @@ words:
  - mptokens
  - mpts
  - mtgox
-  - mudhra
  - multisig
  - multisign
  - multisigned
@@ -319,6 +317,7 @@ words:
  - sttx
  - stvar
  - stvector
+  - stxchainattestations
  - summands
  - superpeer
  - superpeers
@@ -345,7 +344,6 @@ words:
  - unambiguity
  - unauthorizes
  - unauthorizing
-  - undeserializable
  - unergonomic
  - unfetched
  - unfindable
@@ -377,6 +375,7 @@ words:
  - writeme
  - wsrch
  - wthread
+  - xbridge
  - xchain
  - xcrun
  - ximinez
@@ -108,75 +108,3 @@ endfunction()

 function(patch_nix_binary target)
 endfunction()
-
-function(rpcspec_generate_instantiations)
-    set(options)
-    set(oneValueArgs OUT_VAR VALUE_TYPE VIEW_HEADER INCLUDE_DIR)
-    set(multiValueArgs HANDLERS)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(corrosion_import_crate)
-    set(options
-        ALL_FEATURES
-        NO_DEFAULT_FEATURES
-        NO_STD
-        NO_LINKER_OVERRIDE
-        NO_USES_TERMINAL
-        LOCKED
-        FROZEN
-    )
-    set(oneValueArgs MANIFEST_PATH PROFILE IMPORTED_CRATES)
-    set(multiValueArgs
-        CRATE_TYPES
-        CRATES
-        FEATURES
-        FLAGS
-        OVERRIDE_CRATE_TYPE
-    )
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(corrosion_set_env_vars target_name env_var)
-endfunction()
-
-function(corrosion_add_cxxbridge cxx_target)
-    set(options)
-    set(oneValueArgs CRATE)
-    set(multiValueArgs FILES)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(_unlink_libgcc_s crate)
-endfunction()
-
-function(add_xrpl_crate name)
-    set(options)
-    set(oneValueArgs CRATE)
-    set(multiValueArgs FILES)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
@@ -15,9 +15,9 @@ inputs:
    required: false
    default: "false"
  log_verbosity:
-    description: 'The logging verbosity ("quiet", "verbose"), or empty to use the Conan defaults.'
+    description: "The logging verbosity."
    required: false
-    default: ""
+    default: "verbose"
  sanitizers:
    description: "The sanitizers to enable."
    required: false
@@ -35,16 +35,6 @@ runs:
        LOG_VERBOSITY: ${{ inputs.log_verbosity }}
        SANITIZERS: ${{ inputs.sanitizers }}
      run: |
-        # By default, leave the verbosity unset, so CMake configure output is
-        # shown, but compile commands and Boost's b2 debug output (~85k lines
-        # when "verbose") are not.
-        VERBOSITY_ARGS=()
-        if [[ -n "${LOG_VERBOSITY}" ]]; then
-            VERBOSITY_ARGS=(
-                --conf:all tools.build:verbosity="${LOG_VERBOSITY}"
-                --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}"
-            )
-        fi
        conan install \
            --profile:all ci \
            --build="${BUILD_OPTION}" \
@@ -52,13 +42,6 @@ runs:
            --options:host='&:xrpld=True' \
            --settings:all build_type="${BUILD_TYPE}" \
            --conf:all tools.build:jobs=${BUILD_NPROC} \
-            "${VERBOSITY_ARGS[@]}" \
-            --format=json \
-            . >"${RUNNER_TEMP}/conan-graph.json"
-
-    # Tools that run during the build may only load glibc from the Nix store,
-    # as their package ID survives a GCC runtime update.
-    - name: Check build-context packages for Nix store dependencies (Linux)
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      run: ./bin/nix/check-build-context-runtime.sh "${RUNNER_TEMP}/conan-graph.json"
+            --conf:all tools.build:verbosity="${LOG_VERBOSITY}" \
+            --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}" \
+            .
@@ -36,18 +36,3 @@ updates:
      rust-dependencies:
        patterns:
          - "*"
-
-  - package-ecosystem: uv
-    directory: /cmake/scripts/codegen
-    schedule:
-      interval: weekly
-      day: monday
-      time: "04:00"
-      timezone: Etc/GMT
-    commit-message:
-      prefix: "chore: [DEPENDABOT] "
-    target-branch: develop
-    groups:
-      codegen-dependencies:
-        patterns:
-          - "*"
@@ -62,7 +62,6 @@ libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
-test.app > tests.libxrpl
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
@@ -175,10 +174,8 @@ test.server > xrpl.basics
 test.server > xrpl.config
 test.server > xrpld.app
 test.server > xrpld.core
-test.server > xrpld.rpc
 test.server > xrpl.json
 test.server > xrpl.protocol
-test.server > xrpl.resource
 test.server > xrpl.server
 test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-d3a71b2",
+  "image_tag": "sha-060957e",
  "configs": {
    "ubuntu": [
      {
@@ -74,7 +74,7 @@
        "extra_cmake_args": "-Dvalidator_keys=ON",
        "package": {
          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-d3a71b2"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f"
        }
      },
      {
@@ -86,7 +86,7 @@
        "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
        "package": {
          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-d3a71b2",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f",
          "variant": "assert"
        }
      }
@@ -101,7 +101,7 @@
        "extra_cmake_args": "-Dvalidator_keys=ON",
        "package": {
          "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-d3a71b2"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-3a2d19f"
        }
      }
    ]
@@ -12,7 +12,8 @@ on:
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
      - "!nix/check-tools/**"
-      - "bin/nix/default-loader-path.sh"
+      - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
  pull_request:
    paths:
      - ".github/workflows/build-nix-images.yml"
@@ -24,9 +25,8 @@ on:
      - "!nix/devshell.nix"
      - "!nix/check-tools/**"
      - "bin/check-tools.sh"
-      - "bin/check-distrusted-roots.sh"
-      - "bin/nix/default-loader-path.sh"
-      - "bin/install/sanitizer-libs.sh"
+      - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
  workflow_dispatch:

 concurrency:
@@ -5,13 +5,13 @@ on:
    branches:
      - develop
    paths:
-      - "bin/install/packaging-tools.sh"
+      - ".github/workflows/build-packaging-images.yml"
+      - "bin/install-packaging-tools.sh"
      - "package/images/packaging/**"
  pull_request:
    paths:
      - ".github/workflows/build-packaging-images.yml"
-      - "bin/check-distrusted-roots.sh"
-      - "bin/install/packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
      - "package/images/packaging/**"
  workflow_dispatch:

@@ -5,12 +5,12 @@ on:
    branches:
      - develop
    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
      - "bin/pre-commit/Dockerfile"
      - "rust-toolchain.toml"
  pull_request:
    paths:
      - ".github/workflows/build-pre-commit-image.yml"
-      - "bin/check-distrusted-roots.sh"
      - "bin/pre-commit/Dockerfile"
      - "rust-toolchain.toml"
  workflow_dispatch:
@@ -8,7 +8,6 @@ on:
    branches:
      - "develop"
      - "release/*"
-      - "staging/*"
    paths:
      - "crates/**/Cargo.toml"
      - "crates/Cargo.lock"
@@ -35,7 +34,7 @@ permissions:
 jobs:
  audit:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    permissions:
      contents: read
      # Needed to open an issue on scheduled failures.
@@ -67,7 +66,7 @@ jobs:

      - name: Create issue
        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "cargo audit found vulnerabilities"
          body_file: /tmp/cargo-audit-issue.md
@@ -53,7 +53,7 @@ jobs:

      - name: Create issue
        if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'XRPLF/rippled' }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "Releases not merged back into develop"
          body_file: ${{ env.ISSUE_FILE }}
@@ -79,7 +79,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -108,7 +108,7 @@ jobs:

      - name: Upload regenerated snapshot
        if: failure()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: check-tools-${{ runner.os }}-${{ runner.arch }}
          path: ${{ matrix.snapshot }}
@@ -93,8 +93,9 @@ jobs:
            .github/workflows/reusable-upload-recipe.yml
            .clang-tidy
            .codecov.yml
+            bin/check-nix-store-refs.sh
            bin/check-tools.sh
-            bin/nix/**
+            bin/default-loader-path.sh
            cfg/**
            cmake/**
            conan/**
@@ -243,7 +244,7 @@ jobs:
      - should-run
      - build-test
    # Only run when committing to a PR that targets a release branch.
-    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') }}
+    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
    uses: ./.github/workflows/reusable-upload-recipe.yml
    secrets:
      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
@@ -1,16 +1,14 @@
 # This workflow runs all workflows to build and test the code on various Linux
 # flavors, as well as on MacOS and Windows, on a scheduled basis, on merge into
-# the 'develop', 'release/*' or 'staging/*' branches, or when requested
-# manually. Upon pushes to the develop branch, it also uploads the libxrpl
-# recipe to the Conan remote.
+# the 'develop' or 'release*' branches, or when requested manually. Upon pushes
+# to the develop branch it also uploads the libxrpl recipe to the Conan remote.
 name: Trigger

 on:
  push:
    branches:
      - "develop"
-      - "release/*"
-      - "staging/*"
+      - "release*"
    paths:
      # These paths are unique to `on-trigger.yml`.
      - ".github/workflows/on-trigger.yml"
@@ -33,8 +31,9 @@ on:
      - ".github/workflows/reusable-upload-recipe.yml"
      - ".clang-tidy"
      - ".codecov.yml"
+      - "bin/check-nix-store-refs.sh"
      - "bin/check-tools.sh"
-      - "bin/nix/**"
+      - "bin/default-loader-path.sh"
      - "cfg/**"
      - "cmake/**"
      - "conan/**"
@@ -64,9 +63,9 @@ on:
  workflow_dispatch:

 concurrency:
-  # When a PR is merged into the develop branch, it will be assigned a unique
+  # When a PR is merged into the develop branch it will be assigned a unique
  # group identifier, so execution will continue even if another PR is merged
-  # while it is still running. In all other cases, the group identifier is shared
+  # while it is still running. In all other cases the group identifier is shared
  # per branch, so that any in-progress runs are cancelled when a new commit is
  # pushed.
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
@@ -100,7 +99,7 @@ jobs:
      # However, we do not enable ccache for events targeting a release branch,
      # to protect against the rare case that the output produced by ccache is
      # not identical to a regular compilation.
-      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release/') }}
+      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release') }}
      os: ${{ matrix.os }}
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -8,14 +8,13 @@ on:
  push:
    branches:
      - "develop"
-      - "release/*"
-      - "staging/*"
+      - "release*"
  workflow_dispatch:

 jobs:
  # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
  run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@6a52459a658649a0aeaab4ebd6a8f25173f6f16f
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
    with:
      runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-d3a71b2" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'
@@ -41,13 +41,13 @@ env:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -129,7 +129,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: ${{ inputs.ccache_enabled }}

@@ -186,6 +186,9 @@ jobs:
        with:
          build_nproc: ${{ steps.nproc.outputs.nproc }}
          build_type: ${{ inputs.build_type }}
+          # Set the verbosity to "quiet" for Windows to avoid an excessive
+          # amount of logs. For other OSes, the "verbose" logs are more useful.
+          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
          sanitizers: ${{ inputs.sanitizers }}

      - name: Configure CMake
@@ -254,20 +257,20 @@ jobs:
      # cache included, since what it holds is what gets uploaded and reused.
      - name: Check the build output for Nix store references (Nix toolchain)
        if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}"
+        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"

      - name: Check the Conan cache for Nix store references (Nix toolchain)
        if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"

      # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
      # images always references the store. Same condition it uses.
      - name: Check for Nix store references (Linux)
        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
        run: |
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"

      - name: Show ccache statistics
        if: ${{ inputs.ccache_enabled }}
@@ -280,7 +283,7 @@ jobs:

      - name: Upload the binary (Linux)
        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: xrpld-${{ inputs.config_name }}
          path: ${{ env.BUILD_DIR }}/xrpld
@@ -294,7 +297,7 @@ jobs:

      - name: Upload the validator-keys binary
        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: validator-keys-${{ inputs.config_name }}
          path: |
@@ -305,7 +308,7 @@ jobs:

      - name: Upload the test binary (Linux)
        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: xrpl_tests-${{ inputs.config_name }}
          path: ${{ env.BUILD_DIR }}/xrpl_tests
@@ -321,7 +324,7 @@ jobs:

      - name: Upload server definitions
        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-definitions
          path: ${{ env.BUILD_DIR }}/server_definitions.json
@@ -34,7 +34,7 @@ jobs:
    needs: [determine-files]
    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-d3a71b2"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
    permissions:
      contents: read
      issues: write
@@ -43,7 +43,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -73,6 +73,7 @@ jobs:
        with:
          build_nproc: ${{ steps.nproc.outputs.nproc }}
          build_type: ${{ env.BUILD_TYPE }}
+          log_verbosity: verbose

      - name: Configure CMake
        working-directory: ${{ env.BUILD_DIR }}
@@ -109,7 +110,7 @@ jobs:

      - name: Upload clang-tidy output
        if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: ${{ env.OUTPUT_FILE }}
          archive: false
@@ -123,23 +124,17 @@ jobs:

      - name: Fix style
        if: ${{ steps.files_changed.outcome != 'success' }}
-        # pre-commit installs every hook's environment, even for hooks that match
-        # no files, and node-based hooks need libatomic, which this image lacks.
-        # Exit code 1 just means hooks modified files or found issues.
-        env:
-          SKIP: prettier,cspell
        run: |
-          git add --update
-          pre-commit run || [ $? -eq 1 ]
+          pre-commit run --all-files || true

      - name: Generate git diff
        if: ${{ steps.files_changed.outcome != 'success' }}
        run: |
-          git diff HEAD | tee "${DIFF_FILE}"
+          git diff | tee "${DIFF_FILE}"

      - name: Upload clang-tidy diff output
        if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: ${{ env.DIFF_FILE }}
          archive: false
@@ -191,7 +186,7 @@ jobs:

      - name: Create issue
        if: ${{ steps.run_clang_tidy.outcome != 'success' && inputs.create_issue_on_failure }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "Clang-tidy check failed"
          body_file: ${{ env.ISSUE_FILE }}
@@ -44,7 +44,7 @@ jobs:
      # Every package lands in one directory; the step below picks its own,
      # which keeps this independent of the artifact names.
      - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "*-pkg"
          merge-multiple: true
@@ -95,15 +95,11 @@ jobs:
          apt-get update -qq
          apt-get install -y "./${PACKAGE}"

-      # Rocky Linux and AlmaLinux pick a mirror from a mirrorlist, and now and
-      # then get one that serves the repository metadata at a few hundred kB/s,
-      # which alone outlasts the job's timeout. dnf only abandons a mirror below
-      # 1000 B/s for 30 s, so raise that floor to fail over to the next one fast.
      - name: Install the RPM
        if: ${{ inputs.package_type == 'rpm' }}
        env:
          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y --setopt=minrate=1M --setopt=timeout=10 "./${PACKAGE}"
+        run: dnf install -y "./${PACKAGE}"

      - name: Run xrpld
        run: xrpld --version
@@ -100,18 +100,18 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

      - name: Download pre-built xrpld binary
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}
          path: ${{ env.BUILD_DIR }}

      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.validator_keys_artifact_name }}
          path: ${{ env.BUILD_DIR }}
@@ -151,7 +151,7 @@ jobs:
      # version starts with a digit and a longer name does not, so that one digit
      # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
      - name: Upload package artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg
          path: |
@@ -160,7 +160,7 @@ jobs:
          if-no-files-found: error

      - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
          path: |
@@ -225,13 +225,13 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

      # Both artifacts, so the debug symbols are published alongside the package.
      - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
          merge-multiple: true
@@ -287,7 +287,7 @@ jobs:
        run: echo "PUSH=${PUSH}" | tee -a "${GITHUB_ENV}"

      - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "*-pkg"
          merge-multiple: true
@@ -295,7 +295,7 @@ jobs:

      - name: Download voidstar binary
        if: ${{ matrix.target == 'voidstar' }}
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: xrpld-ubuntu-clang-debug-amd64-voidstar
          path: ${{ env.CONTEXT }}
@@ -28,7 +28,7 @@ permissions:
 jobs:
  clippy:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:

  coverage:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +70,7 @@ jobs:

  doc:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -40,7 +40,7 @@ defaults:
 jobs:
  upload:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    env:
      REMOTE_NAME: ${{ inputs.remote_name }}
      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -50,7 +50,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -68,7 +68,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -108,11 +108,14 @@ jobs:
          build_nproc: ${{ steps.nproc.outputs.nproc }}
          build_type: ${{ matrix.build_type }}
          force_build: ${{ github.event_name == 'schedule' || github.event.inputs.force_source_build == 'true' }}
+          # Set the verbosity to "quiet" for Windows to avoid an excessive
+          # amount of logs. For other OSes, the "verbose" logs are more useful.
+          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
          sanitizers: ${{ matrix.sanitizers }}

      - name: Check the Conan cache for Nix store references (Nix toolchain)
        if: ${{ matrix.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"

      - name: Log into Conan remote
        if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
@@ -60,7 +60,7 @@ repos:
        types_or: [c++, c]

  - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: a9a8a861f30ed207ead7d5a3b7e8032283ba5da7 # frozen: v23.1.2
+    rev: e2b496dc2bd8340c2524cb9a2d2a943cde1bb6df # frozen: v23.1.1
    hooks:
      - id: clang-format
        args: [--style=file]
@@ -82,10 +82,9 @@ repos:
        files: ^crates/.*\.rs$

  - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: 28010ddd6016e1a0f7bd232acb6536ef996ae897 # frozen: 0.29.2
+    rev: f1c4833f8cf23c6d952673abc73525411a5719e8 # frozen: 0.29.1
    hooks:
      - id: gersemi
-        args: [-i, --warnings-as-errors]

  - repo: https://github.com/rbubley/mirrors-prettier
    rev: ef4a397f916211b4a39ccf9d3d9cbb6562157251 # frozen: v3.9.9
@@ -96,19 +95,19 @@ repos:
  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
  # so widening these is its own change.
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253 # frozen: v0.16.10
+    rev: a56c0b927e6465d37cae3e97d35d4d18ab2b96cd # frozen: v0.16.9
    hooks:
      - id: ruff-check
        args: [--fix]
        files: ^package/.*\.py$

  - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 96ae3e5802f3fe2d551e703e18f0a367d1a81ac2 # frozen: 26.10.0
+    rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
    hooks:
      - id: black

  - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 2834ec6639549dd6796205c8f011dedcd587288b # frozen: v2.4.0
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee # frozen: v2.3.1
    hooks:
      - id: mypy
        args: [--strict]
@@ -22,62 +22,13 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-

 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.

-## Unreleased
-
-### Breaking changes
-
- A JSON string holding a NUL character, written as `\u0000` or as a raw byte, now makes the request unparsable, on every transport and at every API version, and is answered as any other body that does not parse. The server stored a string only through its first NUL, so `"ripplerpc": "3.0\u0000junk"` was read as `"3.0"` and any other field was cut short the same way. The two configuration sections read by the same parser, `[rpc_startup]` and `[validator_token]`, refuse it too.
- The `ripplerpc` request field, which selects the shape of the JSON-RPC reply envelope, is now validated, and a value that is not exactly `"1.0"`, `"2.0"` or `"3.0"` is rejected. Two things it does not reach: a WebSocket session, which reads the field only to echo it back, and API version 3, where the field selects nothing and so is neither read nor checked, `ripplerpc: "banana"` and no `ripplerpc` at all being served alike. A request sending `"2"`, `" 2.0"`, `"2.00"`, `"02.0"`, `"2.0.0"`, `"10.0"` or any other text, such as `"abc"` or `"x2"`, gets a working reply today. After this ships, such a request sent alone gets HTTP 400 with `ripplerpc is not a supported version`, charged as a malformed request, and such an entry of a `"method": "batch"` body gets that error in its own reply while the batch answers 200. A client that spells the version loosely must therefore be corrected to one of the three exact values, or omit the field. Previously the value was compared as a string, which both accepted values that name no version and ordered multi-digit versions incorrectly: `"abc"` and `"x2"` sorted above `"3.0"` and so selected version 3, and `"10.0"` sorted below `"2.0"` and so selected version 1. Requests that send one of the three supported values, or omit the field, are unaffected.
- `subscribe`: every subscription a connection holds must name the same `api_version`. The first `subscribe` establishes it, and a later one naming a different version is refused with `apiVersionConflict`, registering nothing; the message names the version the connection's subscriptions are served at. The HTTP status is 400 where the envelope derives it from the error, with `ripplerpc: "3.0"` or at API version 3, and 200 with `ripplerpc` `"1.0"` or `"2.0"`, as for every error; a WebSocket frame carries no status. A `subscribe` refused for another reason, a stream name the server does not have for one, still fixes that version, since the registrations it makes are spread through the handler. A connection that subscribed one stream at `api_version` 2 and another at 1, in two calls, was previously served both at version 1, the later call's, so the first stream's shape changed under it. The version is fixed for the connection's life: a client that wants another version opens another connection. On the webhook path the subscriber is keyed on its `url` alone, so the refusal reaches a second admin because of a first admin's version, and the message names the version the url's subscriptions are served at, and no remedy: releasing a url means unsubscribing its streams, which would remove that first admin's subscription, and the server cannot tell the two callers apart. Naming the url alone does not release it, a subscriber a stream map still holds not being evicted. This reaches every API version, since version 1 and version 2 content is not interchangeable either: version 2 renames `transaction` to `tx_json` and hoists `hash`, so a version 1 client handed version 2 content finds no `transaction` member.
- `batch`: An entry of a `"method": "batch"` request that names `api_version` both inside `params` and at its own top level is now served at the version inside `params`. It was previously served at the top-level version whenever the one inside `params` resolved to version 1, so an entry asking for version 1 explicitly and something else at the top level changes which version answers it. A lone request can name both values too, and for it the version inside `params` has always won; reversing that precedence was confined to a batch entry.
-
-### Additions
-
- A JSON-RPC (HTTP) request may send its parameters as an object, `"params": {"account": "r..."}`, as well as the array of one object that was already accepted. This reaches every API version: such a request was previously rejected with HTTP 400 and `params unparsable`, and is now served. A request that already sends the array form is unaffected. An entry of a `"method": "batch"` request that carries a by-name `params` object is read for `api_version` and credentials from that object, and is dispatched on that object, as a lone request is; a one-element array holding the object is unpacked the same way, and any other `params` answers `params unparsable` for that entry, apart from `null`, an empty string, an empty array and an array holding one `null`, which read as an empty parameter object, as they do for a lone request; from API version 3, `null` and an empty string there answer `params unparsable` instead, as the version 3 paragraphs above describe. Such an entry's top-level `jsonrpc`, `ripplerpc` and `id` are read as if they sat inside that object, where the object does not name them itself, so the reply carries the entry's id and takes the envelope it named. An entry naming no `params` is dispatched as before, the entry itself being the object a handler reads. Previously such an entry was dispatched on its own members whatever `params` held, had its `api_version` read from its top level, and had its credentials ignored, since credentials were read only from an array-form `params`.
- A JSON-RPC (HTTP) request may name its `api_version` at its own top level, beside `method` and `id`, as well as inside `params`. The member is an XRPL extension, which the JSON-RPC 2.0 specification does not define; placing it beside the specification's own members is what lets a version 3 client send a specification-shaped request. This is honored from API version 3 up, so it needs `[beta_rpc_api]`; a version below that named at the top level is ignored, exactly as it always has been. Previously only an entry of a `"method": "batch"` request had its own top level read; a WebSocket request, which is one flat object, has always been read there.
-
-### Bugfixes
-
- Every credential-bearing field is masked wherever a request or a reply is echoed, logged or printed: `admin_password`, `admin_user`, `master_key`, `master_seed`, `master_seed_hex`, `passphrase`, `password`, `secret`, `seed`, `seed_hex`, `url_password`, `url_username`, `username`, `validation_key`, `validation_private_key` and `validation_seed`. The one list applies to a request echoed back in an error reply and to every request and reply written to the log. Nesting no longer matters, so a credential inside `params` is masked too. Six of the sixteen names, `master_key`, `master_seed`, `master_seed_hex`, `validation_key`, `validation_private_key` and `validation_seed`, occur only in a reply, which is how `wallet_propose` and `validation_create` used to write a live private key to the log. The `id`, `jsonrpc`, `ripplerpc` and `api_version` members a legacy reply echoes from the request are masked the same way. The command line client's trace of a reply's header covers the header only, not the body bytes read with it. A request or reply written to the log is truncated at 10,000 characters. An `[rpc_startup]` line that does not parse is reported by its position in the section alone, never by its text or by the parser's message, and no command runs for it.
- The command line client no longer prints a credential the operator did not type. A failing command echoes the request it built under `request_sent`, which carries the `admin_password` the client copies out of `[port_rpc]` in the config, so `./xrpld account_info rBogus` printed that password to stdout and into any captured output. `request_sent` is now masked. The `rpc` member beside it, which echoes the arguments as they were typed, is unchanged. The command line client also no longer writes an unparsed `json` or `ripple_path_find` argument to its trace log before parsing it, where a `secret` inside that argument could not be masked; it logs the parsed request instead, masked. The reply it receives is logged the same way, parsed and masked, where the raw body was written before, a `validation_create` answer included.
- A WebSocket frame that does not parse, or exceeds the request size limit, is answered `{"type": "error", "error": "jsonInvalid", "size": <bytes>}`. The frame's body is reported by size rather than echoed back in a `value` member, since a body that does not parse has no fields to mask. A client that read `value` gets `size` instead.
- Four error codes that named no HTTP status of their own, and so answered 200 on a reply reporting an error, now name one: `actMalformed`, `alreadyMultisig` and `alreadySingleSig` answer 400, and `actNotFound` answers 404. **Only API version 3 reports these four.** A request sending `ripplerpc: "3.0"` at API version 1 or 2 still receives 200 for all four, as it always has, so `account_info` on a malformed account or one the ledger does not hold answers 200 for those clients exactly as before.
- `submit`, `simulate`, `transaction_entry`, `ledger_entry` and `ledger_accept`: Errors from these methods now include `error_code` and `error_message` alongside the `error` token, as every other method already did. Each error now answers the status its code names: 400 for a malformed request, 404 for `transactionNotFound`, 500 for an internal failure, and 501 for `notYetImplemented` and `notStandAlone`. That status change reaches only a request sending `ripplerpc: "3.0"`, or API version 3, which are the envelopes that derive the status from the error. With `ripplerpc` `"1.0"` the status stays 200 and the two new members appear beside `error`; with `"2.0"` the status stays 200, `error_code` appears, and the `code` and `message` members carry the code and the message rather than null, since that envelope copies them from `error_code` and `error_message` and drops `error_message`. From API version 3 the fifteen `malformed*` tokens `ledger_entry` names each report the code they own instead of 31.
- A reply reporting HTTP 402 or 502 now carries a status line. Those two statuses named no case in the switch that writes one, so such a reply began with a header instead and did not parse as an HTTP response at all. Both are reachable at any API version with `ripplerpc: "3.0"`, which derives the status from the error code: 402 through `highFee` from `sign` or `submit` with a low `fee_mult_max`, and 502 through `dbDeserialization` from `tx`. The eleven statuses that already named a case report the same phrase they always have.
- An error reply to a request sending `ripplerpc: "2.0"` or `"3.0"` no longer carries a stray `"error_message": null` beside the error it reports. The member appeared only when the `Server` log partition was set to debug or lower, because the log statement read `error_message` after the reply had renamed it to `message`, and reading it put it back as null. So the reply a client received depended on the server's log level, and the log line itself printed an empty message. Both are fixed.
- A body the server rejects before it reads a request out of it now says which of four things was wrong. A body over the size limit answers `Request is too large`. A body that parses to `{}`, `[]` or `null` answers `Request is empty`. A body that parses to a non-empty array answers `Request is not a JSON object`; that is the only other document the parser accepts at the top level. All three previously answered `Unable to parse request: ` with nothing after the colon, the parser having recorded no error for them. Any other body does not parse, which includes one that is only whitespace and one whose top-level value is a string, number or boolean; it answers `Unable to parse request: ` followed by the parser's own reason, as it did before. The status is 400 for all four, as before, and this reaches every API version. The command line client reports `Request is too large` and `Request is empty` as the same class of rejection as an unparsable body, under `invalidParams` with the text in `error_what`.
- `batch`: An entry that is not identified through a secure gateway no longer clears the connection's `X-User` and forwarded-for values for the entries after it, so every entry of one body reports the role and username it would have reported on its own.
- `batch`: Every entry of a `"method": "batch"` request is now charged against the sender's resource allowance, including one rejected before it reaches a handler, and the request stops at the first entry the connection is too loaded to serve. A reply array can therefore be shorter than the request array, and its last element depends on where the batch stopped. An entry that is not a JSON object, or names an API version the server does not serve, is charged before its role is known and answered with its own rejection; if that charge took the connection over the drop threshold, the batch stops there and that rejection is the last answer. Every other entry met over the threshold is answered `Server is overloaded` and nothing follows. A client should read any reply array shorter than its request as a connection over the drop threshold, whatever the last element says. A well-behaved client is unaffected; one that sends thousands of entries in a single body no longer gets every one of them answered.
- A body the server rejects before it reads a request out of it is now charged against the sender's resource allowance, as a malformed request already was. Six conditions were free: a body over the size limit, one that does not parse, one carrying no document, one that is not a JSON object, a `"method": "batch"` naming no entry array, and a lone request naming an `api_version` the server does not serve. The answer to each is unchanged. A well-behaved client is unaffected; one that repeats such a body exhausts its allowance and is refused the next request a handler would have served. A WebSocket frame that does not parse, or exceeds the request size limit, is charged the same way, and a connection that sends only such frames is closed once it crosses the drop threshold.
- `subscribe`, `path_find`: A subscription is now served at the API version its own `subscribe` call named, rather than at the version of the most recent `subscribe` or `path_find` on the same connection. A `path_find` no longer changes the version anything that connection has subscribed is served at. An ordinary request is unaffected: it names its own version and is answered at it, so a connection subscribed at `api_version` 3 still calls `account_info` at version 1 and reads the version 1 shape.
-
 ## XRP Ledger server version 3.5.0

 Version 3.5.0 is not yet released.

-### Breaking changes in 3.5.0
-
- The `XChainBridge` amendment and its ledger entries and transactions are removed. `XChainBridge` and `fixXChainRewardRounding` are now obsolete and can no longer be voted for; neither was ever enabled on Mainnet. `ledger_entry` no longer accepts `bridge`, `xchain_owned_claim_id`, or `xchain_owned_create_account_claim_id`; `account_objects` no longer accepts those values in `type`; and `server_definitions` no longer lists the removed ledger entry types, transaction types, fields, and the `XChainBridge` serialized type.
- `subscribe` (`ledger` stream): The deprecated `fee_ref` field has been removed unconditionally from both the `subscribe` response and the `ledgerClosed` stream messages. It was previously only omitted when the `XRPFees` amendment was enabled; that amendment has now been retired, so the field is never returned. This applies to all API versions.
-
 ### Additions in 3.5.0

- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive the same `transaction` message as the `transactions` stream for each validated transaction whose metadata affects a subscribed issuance. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
- `ledger_entry`: Add full support for checks, NFT offers, payment channels, and signer lists. ([#6319](https://github.com/XRPLF/rippled/pull/6319))
-
-### Bugfixes in 3.5.0
-
- `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
- `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
- `account_currencies`, `account_nfts`, `account_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before an invalid or missing `account`. An invalid `limit` or `marker` is reported before `lgrNotFound` or `actNotFound`, and for `account_offers` also before `actMalformed`. A request with a single problem returns the same error as before. [#8561](https://github.com/XRPLF/rippled/pull/8561)
- `deposit_authorized`: A `credentials` entry that is all zeros (for example `"0"` or 64 `0` characters) now returns a `badCredentials` error instead of looking up a credential that can never exist.
- `account_info`, `account_lines`, `account_channels`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `account`, or `ident` for `account_info`. For `account_lines`, a `peer` that is not a string, or an invalid `limit` or `marker`, is reported before `lgrNotFound`, `actNotFound` or a malformed `account`, and an invalid `limit` or `marker` also before a malformed `peer`. For `account_channels`, a malformed `account` is reported before `lgrNotFound`, and an invalid `destination_account`, `limit` or `marker` before `lgrNotFound` or `actNotFound`. A request with a single problem returns the same error as before. [#8573](https://github.com/XRPLF/rippled/pull/8573)
- `deposit_authorized`, `nft_buy_offers`, `nft_sell_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `source_account`, `destination_account` or `nft_id`, and for `nft_buy_offers` / `nft_sell_offers` also before an invalid `limit`. For `deposit_authorized`, an invalid `credentials` array is reported before `lgrNotFound`, `srcActNotFound`, `dstActNotFound` or `badCredentials`. For `nft_buy_offers` and `nft_sell_offers`, an invalid `marker` is reported before `lgrNotFound` or `objectNotFound`. A request with a single problem returns the same error as before. [#8613](https://github.com/XRPLF/rippled/pull/8613)
- `nft_buy_offers`, `nft_sell_offers`: An `nft_id` that is an array or an object now returns an `invalidParams` error instead of an `internal` error. [#8613](https://github.com/XRPLF/rippled/pull/8613)
-
-### Bugfixes in 3.5.0
-
- `feature`: The admin-only `vetoed` field now returns `invalidParams` unless its value is a boolean. [#7583](https://github.com/XRPLF/rippled/pull/7583)
+- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive a message with `type` `mptTransaction` for each validated transaction whose metadata affects a subscribed issuance; the message has the same fields as the `transactions` stream. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))

 ## XRP Ledger server version 3.4.0

@@ -99,7 +50,6 @@ Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta
 - `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 - `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
 - `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
- `transaction_entry`: An object or an array in `tx_hash` now returns `malformedRequest`, like any other value that is not a hex hash, instead of an `internal` error.

 ## XRP Ledger server version 3.3.0

@@ -2,12 +2,33 @@
 | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |

-## Supported platforms
+## Minimum Requirements

-Building and testing are supported on Linux, macOS, and (best effort) Windows;
-see [Supported development platforms](./docs/build/environment.md#supported-development-platforms).
-Running `xrpld` is officially supported on Linux only;
-see [Requirements](./docs/install.md#requirements).
+For the hardware needed to run a node, see
+[System Requirements](https://xrpl.org/system-requirements.html).
+
+For the software needed to build xrpld, see the
+[environment setup guide](./docs/build/environment.md).
+
+## Operating Systems
+
+### Linux
+
+The Ubuntu Linux distribution has received the highest level of quality
+assurance, testing, and support. We also support Red Hat and use Debian
+internally.
+Our Linux CI tooling is distro-independent and uses a Nix-based environment, so it should be possible to build on other Linux distributions as well, although we have not tested them.
+
+### macOS
+
+Many `xrpld` engineers use macOS for development.
+The minimum supported version is macOS 15 (Sequoia).
+CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
+
+### Windows
+
+Windows is used by some engineers for development only, and is not recommended
+for production use.

 ## Steps

@@ -42,7 +42,7 @@ if(is_gcc)
    # GCC-specific fixes
    add_compile_options(-Wno-unknown-pragmas -Wno-subobject-linkage)
    # -Wno-subobject-linkage can be removed when we upgrade GCC version to at least 13.3
-elseif(is_any_clang)
+elseif(is_clang)
    # Clang-specific fixes
    add_compile_options(-Wno-unknown-warning-option) # Ignore unknown warning options
 elseif(is_msvc)
@@ -332,7 +332,7 @@ This ensures that configuration changes don't introduce new warnings across the

 ### Installing clang-tidy

-The [Nix development shell](./docs/build/nix.md) provides `clang-tidy` at the [tested version](./docs/build/environment.md#tested-compiler-versions).
+See the [environment setup guide](./docs/build/environment.md#clang-tidy) for how to get clang-tidy.

 ### Running clang-tidy locally

@@ -365,15 +365,14 @@ With this set, the hook will run as part of `git commit` alongside the other pre
 Then run clang-tidy on your local changes:

 ```
-run-clang-tidy -p build -allow-no-checks include src tests
+run-clang-tidy -p build -allow-no-checks src tests
 ```

-This will check all source files in the `include`, `src` and `tests` directories using the compile commands from your `build` directory.
-Headers are checked on their own, which requires the `verify_headers` CMake option (ON by default).
+This will check all source files in the `src`, `include` and `tests` directories using the compile commands from your `build` directory.
 If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix -format` to the above command:

 ```
-run-clang-tidy -p build -quiet -fix -format -allow-no-checks include src tests
+run-clang-tidy -p build -quiet -fix -format -allow-no-checks src tests
 ```

 `-format` reformats the fixed code with [`.clang-format`](./.clang-format); without it the fixes are inserted in LLVM style and the `clang-format` hook rewrites them afterwards.
@@ -34,7 +34,7 @@ so tools can filter them and protection rules can target `release/*` and `stagin
 - **Branches only move forward.**
  `develop`, `staging/X.Y.x`, and `release/X.Y.x` are never rewritten.
 - **Cherry-picking only goes from `develop` to a staging branch**,
-  for fixes that must get into a release after the [code freeze](#release-candidates)
+  for fixes that must get into a release after the code freeze
  (see [Emergency Fixes From `develop`](#emergency-fixes-from-develop)).
 - **Security fixes are prepared privately and published with the release that contains them**,
  so vulnerabilities are not disclosed prematurely.
@@ -49,7 +49,6 @@ develop                            staging/X.Y.x & release/X.Y.x
   │
   ├── Tag: X.Y.0-b1
   ├── Tag: X.Y.0-bN
-   │  (2 weeks before rc1: freeze on large changes starts)
   ├── Tag: X.Y.0-rc1 ───────────────┐ (branches created)
   │                                 │
   │  (development continues)        ├── Fixes
@@ -76,20 +75,16 @@ develop                            staging/X.Y.x & release/X.Y.x
 3. **Branches:** `staging/X.Y.x` and `release/X.Y.x` are created from `develop`
   at the commit tagged `X.Y.0-rc1`.
   The first RC also kicks off the QE process.
-
-### Freeze on Large Changes
-
-From two weeks before `X.Y.0-rc1` until `X.Y.0` is [merged back](#merging-back-into-develop),
-large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
-are not merged into `develop`.
+4. **Code freeze:** No new features or unrelated changes are pulled from `develop`
+   into `staging/X.Y.x` or `release/X.Y.x`.
+   Only critical stabilization fixes go into the line.
+5. **No large changes on `develop`:** Until `X.Y.0` is [merged back](#merging-back-into-develop),
+   large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
+   are not merged into `develop`,
+   so that fixes on the line and the merge back don't run into conflicts.

 ### Release Candidates

-After branching, the line is in code freeze:
-no new features or unrelated changes are pulled from `develop`
-into `staging/X.Y.x` or `release/X.Y.x`.
-Only critical stabilization fixes go into the line.
-
 1. Fixes are developed against `staging/X.Y.x`.
 2. When ready, a new RC is created on `staging/X.Y.x`,
   and `release/X.Y.x` is fast-forwarded to it.
@@ -111,8 +106,7 @@ one right after the other.
 2. `release/X.Y.x` is fast-forwarded to `staging/X.Y.x`,
   and the release is tagged on it.
 3. The release is immediately [merged back into `develop`](#merging-back-into-develop).
-   For a major-minor release, this lifts the [freeze on large changes](#freeze-on-large-changes)
-   in `develop`.
+   For a major-minor release, this lifts the freeze on large changes in `develop`.

 ### Merging Back Into `develop`

@@ -133,7 +127,7 @@ After the merge, `git log develop..<tag>` must be empty.
 ### Emergency Fixes From `develop`

 If a commit was merged to `develop`
-and needs to be included in a release after the [code freeze](#release-candidates):
+and needs to be included in a release after the code freeze:

 1. Create a PR that cherry-picks the commit onto `staging/X.Y.x`.
 2. Leave `develop` as it is, with no reverts.
@@ -1,60 +0,0 @@
-#!/bin/bash
-#
-# check-distrusted-roots.sh — fail if a CA bundle trusts a root of the
-# compromised eMudhra intermediates; see https://emudhra.we-have-a-problem.com/.
-#
-# Usage: check-distrusted-roots.sh [ca-bundle]
-# Defaults to the system bundle (Debian or RHEL path).
-#
-# Roots are matched by SHA-256 fingerprint, needing only bash, base64 and
-# sha256sum (nixos/nix has no awk). Only plain CERTIFICATE blocks are checked:
-# OpenSSL's TRUSTED CERTIFICATE blocks carry their own trust settings, which is
-# how nixpkgs' cacert marks a blacklisted root as rejected.
-
-set -euo pipefail
-
-declare -A ROOTS=(
-    [d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4]="AAA Certificate Services"
-    [86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b]="emSign ECC Root CA - G3"
-)
-
-BUNDLE="${1:-}"
-if [ -z "${BUNDLE}" ]; then
-    for CANDIDATE in /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt; do
-        if [ -f "${CANDIDATE}" ]; then
-            BUNDLE="${CANDIDATE}"
-            break
-        fi
-    done
-fi
-
-STATUS=0
-COUNT=0
-PEM=""
-while IFS= read -r LINE || [ -n "${LINE}" ]; do
-    case "${LINE}" in
-        "-----BEGIN CERTIFICATE-----") PEM="" ;;
-        "-----END CERTIFICATE-----")
-            COUNT=$((COUNT + 1))
-            FINGERPRINT="$(base64 -d <<<"${PEM}" | sha256sum)" || {
-                echo "ERROR: certificate ${COUNT} in ${BUNDLE} is not valid base64" >&2
-                exit 1
-            }
-            ROOT="${ROOTS[${FINGERPRINT%% *}]:-}"
-            if [ -n "${ROOT}" ]; then
-                echo "ERROR: ${BUNDLE} trusts '${ROOT}'" >&2
-                STATUS=1
-            fi
-            ;;
-        # Lines outside a CERTIFICATE block only collect until the next BEGIN.
-        *) PEM+="${LINE}" ;;
-    esac
-done <"${BUNDLE:?no system CA bundle found}"
-
-# An empty or unparsable bundle would otherwise pass.
-if [ "${COUNT}" -eq 0 ]; then
-    echo "ERROR: ${BUNDLE} has no certificates" >&2
-    exit 1
-fi
-echo "${BUNDLE}: checked ${COUNT} certificates"
-exit "${STATUS}"
@@ -10,7 +10,7 @@
 # alone; the scripts in a Conan cache are all git hook samples and autotools
 # scratch, 36 false positives to 0 real.
 #
-# Usage: bin/nix/check-nix-store-refs.sh <path>
+# Usage: bin/check-nix-store-refs.sh <path>

 set -euo pipefail

@@ -20,11 +20,9 @@
 # development setups, but not in the macOS CI environment. They are checked
 # everywhere except when running in CI on macOS.
 #
-# Tools that Nix also exposes under a version-suffixed name
-# (`clang-tidy-<v>`, `g++-<v>`, ...) are probed under both names:
-# a suffixed name can break while the plain one still works
-# (see mkVersionedToolLinks in nix/packages.nix).
-# The suffix is the major version of the plain `clang` / `gcc` on PATH.
+# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
+# `g++-15`, ...) are probed under both names: a suffixed name can break while
+# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
 #
 # Tools scoped to a single dev shell rather than to commonPackages are checked
 # only in that shell, keyed off XRPL_DEVSHELL.
@@ -36,16 +34,9 @@

 set -uo pipefail

-# major_version <compiler>
-# Major version of a compiler on PATH, or "unknown" when it isn't there.
-major_version() {
-    local version
-    version="$("$1" -dumpversion 2>/dev/null)" || version=""
-    version="${version%%.*}"
-    printf '%s' "${version:-unknown}"
-}
-
-llvm_version="$(major_version clang)"
+# Version suffixes of the Nix tool links, tracking nix/packages.nix.
+gcc_version=15
+llvm_version=22

 missing=()
 checked=0
@@ -121,7 +112,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
    check ClangBuildAnalyzer
    check curl
    check file
-    check jq
    check less
    check make
    # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
@@ -190,7 +180,6 @@ fi
 if [ "${os}" = "linux" ]; then
    echo
    echo "GCC toolchain:"
-    gcc_version="$(major_version gcc)"
    check gcc
    check "gcc-${gcc_version}"
    check g++
@@ -58,14 +58,6 @@ function install() {
                rpm-build \
                rpm-sign \
                systemd-rpm-macros
-
-            # AlmaLinux's ca-certificates still trusts the root of the compromised
-            # eMudhra intermediates; see https://emudhra.we-have-a-problem.com/.
-            # TODO: drop once it ships a fix.
-            trust extract --format=pem-bundle \
-                --filter="pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert" \
-                /etc/pki/ca-trust/source/blocklist/emSign_ECC_Root_CA_-_G3.pem
-            update-ca-trust
            ;;
    esac
 }
@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# Fail if a binary of a build-context Conan package loads anything from the Nix
-# store other than glibc, or cannot resolve a library at all.
-#
-# Only binaries linked by the Nix toolchain are checked, i.e. those recording a
-# store path as their interpreter or RUNPATH. Prebuilt upstream binaries (such
-# as the ones the cmake package ships) use the system loader instead.
-#
-# Build-context packages provide the tools that run during the build (protoc,
-# grpc_cpp_plugin, ...). Their package ID does not change when a Nix toolchain
-# update moves the GCC runtime to a new store path, so a cached binary has to
-# get by with the pinned glibc alone. See docs/build/nix.md.
-#
-# Usage: bin/nix/check-build-context-runtime.sh <graph.json>
-#   <graph.json> is the output of `conan install --format=json`.
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ]; then
-    echo "usage: $0 <graph.json>" >&2
-    exit 2
-fi
-
-if [ "$(uname -s)" != "Linux" ]; then
-    echo "$0: Linux only" >&2
-    exit 2
-fi
-
-folders="$(jq -r '.graph.nodes[] | select(.context == "build" and .package_folder) | .package_folder' "$1" | sort -u)"
-
-checked=0
-failed=0
-
-while IFS= read -r file; do
-    case "$(file -b "${file}")" in
-        ELF*) ;;
-        *) continue ;;
-    esac
-    [[ "$(readelf -ldW "${file}")" == */nix/store/* ]] || continue
-    checked=$((checked + 1))
-
-    # `ldd` lists the interpreter and every library as the loader resolves them.
-    if deps="$(ldd "${file}" 2>&1)"; then
-        bad="$(printf '%s\n' "${deps}" |
-            grep -E 'not found|/nix/store/' |
-            grep -vE '/nix/store/[^/]+-glibc-[^/]+/' || true)"
-    else
-        case "${deps}" in
-            *"not a dynamic executable"*) continue ;;
-        esac
-        bad="${deps}"
-    fi
-    if [ -n "${bad}" ]; then
-        failed=$((failed + 1))
-        echo "::error file=${file}::loads a library from the Nix store other than glibc"
-        echo "${file}"
-        echo "${bad}" | sed 's/^/    /'
-    fi
-done < <(
-    # shellcheck disable=SC2086 # one folder per line, no spaces in Conan paths
-    [ -z "${folders}" ] || find ${folders} -type f \( -perm -u+x -o -name '*.so*' \)
-)
-
-echo "Build-context packages: checked ${checked} binaries, ${failed} failed."
-[ "${failed}" -eq 0 ]
@@ -9,14 +9,13 @@ ARG DEBIAN_FRONTEND=noninteractive

 RUN <<EOF
 pkgs=()
-pkgs+=(ca-certificates)  # Trust store for curl, git, pip and nix.
-pkgs+=(curl)             # Required to install nix.
-pkgs+=(doxygen)          # Needed for Clio's check-doxygen-docs.sh.
-pkgs+=(git)              # Required for prepare-runner.
-pkgs+=(libatomic1)       # Required to run pre-commit provided `node`.
-pkgs+=(python3)          # Python 3 interpreter.
-pkgs+=(python3-venv)     # Virtual environment for Python applications.
-pkgs+=(xz-utils)         # Required to install nix
+pkgs+=(curl)         # Required to install nix.
+pkgs+=(doxygen)      # Needed for Clio's check-doxygen-docs.sh.
+pkgs+=(git)          # Required for prepare-runner.
+pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
+pkgs+=(python3)      # Python 3 interpreter.
+pkgs+=(python3-pip)  # Package manager for Python applications.
+pkgs+=(xz-utils)     # Required to install nix

 apt-get update
 apt-get install -y --no-install-recommends "${pkgs[@]}"
@@ -24,21 +23,9 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF

-# Sanity-check that the system CA bundle distrusts the compromised eMudhra roots,
-# before pip and the nix installer download anything with it.
-RUN --mount=type=bind,source=bin/check-distrusted-roots.sh,target=/check-distrusted-roots.sh \
-    /check-distrusted-roots.sh
-
-# Ahead of the system Python on PATH,
-# so `python3` and `pip` resolve to the venv and installs stay out of the system Python.
-ENV VIRTUAL_ENV="/opt/venv"
-ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
-
-ARG PRE_COMMIT_VERSION=4.6.2
-RUN <<EOF
-python3 -m venv "${VIRTUAL_ENV}"
-pip install --no-cache pre-commit==${PRE_COMMIT_VERSION}
-EOF
+ARG PRE_COMMIT_VERSION=4.6.0
+RUN pip install --no-cache --break-system-packages \
+    pre-commit==${PRE_COMMIT_VERSION}

 RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes

@@ -46,9 +33,7 @@ RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --dae
 # so nix is available in all shells including non-interactive shells (e.g., GitHub Actions).
 ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
 ENV NIX_PROFILES="/nix/var/nix/profiles/default"
-# The system bundle gets security updates through apt;
-# the one in the Nix profile is frozen at the installer's nixpkgs.
-ENV NIX_SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt"
+ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"

 # Verify nix installation
 RUN nix --version
@@ -5,6 +5,15 @@ The script determines the staged files itself (see `pass_filenames: false` in
 .pre-commit-config.yaml) so run-clang-tidy is run once and handles parallelism
 internally: pre-commit would otherwise split the files across parallel hook
 invocations that race when fixes edit a shared header.
+
+Fixes are collected with `-export-fixes` and applied by clang-apply-replacements
+in a separate step rather than with run-clang-tidy's `-fix`. The `add_module`
+build isolates each module's headers behind a per-module symlink directory
+(build/modules/<module>/...), so a header reachable from several translation
+units is referenced through different paths that all resolve to the same source
+file. clang-apply-replacements deduplicates identical replacements by their
+literal path, so those paths must be canonicalised to the real source path
+first; otherwise the same fix is applied once per path and corrupts the header.
 """

 from __future__ import annotations
@@ -14,29 +23,24 @@ import re
 import shutil
 import subprocess
 import sys
+import tempfile
 from pathlib import Path

+CLANG_TIDY_VERSION = 22
+
 # Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
 # the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
 # compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
 TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}

-
-def clang_tidy_major() -> str | None:
-    """Major version of the `clang-tidy` on PATH, which run-clang-tidy invokes."""
-    if not (clang_tidy := shutil.which("clang-tidy")):
-        return None
-    output = subprocess.run(
-        [clang_tidy, "--version"], capture_output=True, text=True
-    ).stdout
-    m = re.search(r"LLVM version (\d+)", output)
-    return m.group(1) if m else None
+# A single-quoted `FilePath:` entry in an -export-fixes YAML file, allowing the
+# `- ` marker that precedes it inside a `Replacements:` sequence. clang-tidy
+# emits paths single-quoted and doubles any embedded quote per YAML rules.
+FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")


-def find_tool(name: str, version: str | None) -> str | None:
-    """Prefer `<name>-<version>`, so a host tool of another version can't win."""
-    candidates = ([f"{name}-{version}"] if version else []) + [name]
-    for candidate in candidates:
+def find_tool(name: str) -> str | None:
+    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
        if path := shutil.which(candidate):
            return path
    return None
@@ -64,6 +68,25 @@ def staged_files(repo_root: Path) -> list[Path]:
    return [repo_root / rel for rel in output.splitlines() if rel]


+def canonicalize_fix_paths(fixes_dir: Path) -> None:
+    """Rewrite every `FilePath` in the exported fixes to its real source path.
+
+    A header included through a module's isolation symlink is recorded under that
+    symlink's path; collapsing all paths to the same real file lets
+    clang-apply-replacements recognise the per-translation-unit duplicates and
+    apply each fix once.
+    """
+    for yaml in fixes_dir.glob("*.yaml"):
+        lines = []
+        for line in yaml.read_text().splitlines():
+            if m := FILEPATH_RE.match(line):
+                path = m.group(2).replace("''", "'")
+                real = os.path.realpath(path).replace("'", "''")
+                line = f"{m.group(1)}'{real}'"
+            lines.append(line)
+        yaml.write_text("\n".join(lines) + "\n")
+
+
 def main():
    if not os.environ.get("TIDY"):
        return 0
@@ -80,13 +103,20 @@ def main():
    if not files:
        return 0

-    version = clang_tidy_major()
-    run_clang_tidy = find_tool("run-clang-tidy", version)
-    if not run_clang_tidy:
-        tried = f" (tried the '-{version}' suffix too)" if version else ""
+    run_clang_tidy = find_tool("run-clang-tidy")
+    clang_apply_replacements = find_tool("clang-apply-replacements")
+    missing = [
+        name
+        for name, path in (
+            ("run-clang-tidy", run_clang_tidy),
+            ("clang-apply-replacements", clang_apply_replacements),
+        )
+        if not path
+    ]
+    if missing:
        print(
-            f"clang-tidy check failed: TIDY is enabled but run-clang-tidy "
-            f"was not found in PATH{tried}.",
+            f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
+            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
            file=sys.stderr,
        )
        return 1
@@ -100,19 +130,27 @@ def main():
        )
        return 1

-    result = subprocess.run(
-        [
-            run_clang_tidy,
-            "-quiet",
-            "-p",
-            build_dir,
-            "-fix",
-            "-format",
-            "-allow-no-checks",
-        ]
-        + files
-    )
-    return result.returncode
+    with tempfile.TemporaryDirectory() as fixes_dir:
+        result = subprocess.run(
+            [
+                run_clang_tidy,
+                "-quiet",
+                "-p",
+                build_dir,
+                "-export-fixes",
+                fixes_dir,
+                "-allow-no-checks",
+            ]
+            + files
+        )
+        canonicalize_fix_paths(Path(fixes_dir))
+        # `FormatStyle` in .clang-tidy does not reach this path,
+        # so ask for the repository style here.
+        applied = subprocess.run(
+            [clang_apply_replacements, "--format", "--style=file", fixes_dir]
+        )
+
+    return result.returncode or applied.returncode


 if __name__ == "__main__":
@@ -1360,39 +1360,6 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
-#   gas_limit = <gas>
-#
-#       The gas limit is the maximum amount of gas that can be
-#       consumed by a single transaction. The gas limit is used to prevent
-#       transactions from consuming too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_limit = 1000000      # 1 million gas
-#
-#   bytecode_size_limit = <bytes>
-#
-#       The bytecode size limit is the maximum size of a WASM extension in
-#       bytes. The size limit is used to prevent extensions from consuming
-#       too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           bytecode_size_limit = 100000      # 100 kb
-#
-#   gas_price = <micro-drops>
-#
-#       The gas price is the conversion between WASM gas and its price in drops.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings
@@ -9,21 +9,13 @@ include_guard(GLOBAL)
 # --------------------------------------------------------------------
 # Compiler detection (C++)
 # --------------------------------------------------------------------
-# is_any_clang is true for both LLVM Clang and AppleClang. Their version numbers
-# and feature sets differ, so use is_llvm_clang or is_apple_clang when it matters.
-set(is_any_clang FALSE)
-set(is_llvm_clang FALSE)
-set(is_apple_clang FALSE)
+set(is_clang FALSE)
 set(is_gcc FALSE)
 set(is_msvc FALSE)
 set(is_xcode FALSE)

-if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
-    set(is_any_clang TRUE)
-    set(is_llvm_clang TRUE)
-elseif(CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
-    set(is_any_clang TRUE)
-    set(is_apple_clang TRUE)
+if(CMAKE_CXX_COMPILER_ID MATCHES ".*Clang") # Clang or AppleClang
+    set(is_clang TRUE)
 elseif(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
    set(is_gcc TRUE)
 elseif(MSVC)
@@ -17,7 +17,7 @@
   (runtime libraries resolved through the rpath) are skipped too.
   Everywhere else `patch_nix_binary` is a no-op.

-   The default loader is resolved by bin/nix/default-loader-path.sh.
+   The default loader is resolved by bin/default-loader-path.sh.
 #]===================================================================]

 include_guard(GLOBAL)
@@ -25,7 +25,7 @@ include_guard(GLOBAL)
 include(CompilationEnv)

 # Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/nix/default-loader-path.sh")
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")

 if(
    is_linux
@@ -130,7 +130,7 @@ else()
        INTERFACE
            -Wall
            -Wdeprecated
-            $<$<BOOL:${is_any_clang}>:-Wno-deprecated-declarations>
+            $<$<BOOL:${is_clang}>:-Wno-deprecated-declarations>
            $<$<BOOL:${wextra}>:-Wextra
            -Wno-unused-parameter>
            $<$<BOOL:${werr}>:-Werror>
@@ -177,7 +177,7 @@ else()
    if(
        is_nix_compiler
        AND is_linux
-        AND is_any_clang
+        AND is_clang
        AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
    )
        string(
@@ -204,10 +204,7 @@ if(voidstar)
            "Antithesis instrumentation requires Linux, aborting..."
        )
    elseif(
-        NOT (
-            is_llvm_clang
-            AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0
-        )
+        NOT (is_clang AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0)
    )
        message(
            FATAL_ERROR
@@ -292,25 +292,6 @@ if(xrpld)
    )
    target_sources(xrpld PRIVATE ${sources})

-    rpcspec_generate_instantiations(
-        OUT_VAR rpcspec_instantiations
-        VALUE_TYPE "::json::Value"
-        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
-        HANDLERS
-            account_channels
-            account_currencies
-            account_info
-            account_lines
-            account_nfts
-            account_offers
-            book_changes
-            deposit_authorized
-            ledger
-            nft_offers_common
-            transaction_entry
-    )
-    target_sources(xrpld PRIVATE ${rpcspec_instantiations})
-
    if(tests)
        file(
            GLOB_RECURSE sources
@@ -341,7 +322,6 @@ if(xrpld)
        # antithesis_instrumentation.h, which is not exported as INTERFACE
        target_include_directories(
            xrpld
-            SYSTEM
            PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
        )
    endif()
@@ -58,7 +58,7 @@ target_link_options(common INTERFACE ${sanitizers_linker_flags})
 # This module appends -fsanitize-ignorelist=<path> for Clang builds.
 # The ignorelist path contains CMAKE_SOURCE_DIR, so it must be set here, rather than in the Conan profile.
 # GCC does not support -fsanitize-ignorelist.
-if(is_any_clang)
+if(is_clang)
    set(ignorelist_path
        "${CMAKE_SOURCE_DIR}/sanitizers/suppressions/sanitizer-ignorelist.txt"
    )
@@ -77,24 +77,19 @@ if(is_any_clang)
    message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()

-# Define the SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN,
-# XRPL_TSAN and XRPL_UBSAN per active sanitizer, so that code can test for a
-# specific one with #ifdef instead of parsing the dot-joined SANITIZERS string.
+# Define SANITIZERS macro for BuildInfo.cpp
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
    set(enable_asan ON)
    list(APPEND sanitizers_list "ASAN")
-    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
    set(enable_tsan ON)
    list(APPEND sanitizers_list "TSAN")
-    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
    set(enable_ubsan ON)
    list(APPEND sanitizers_list "UBSAN")
-    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()

 if(sanitizers_list)
@@ -23,8 +23,11 @@ if(NOT is_multiconfig)
    endif()
 endif()

-if(is_llvm_clang)
-    if(CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0)
+if(is_clang) # both Clang and AppleClang
+    if(
+        "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang"
+        AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0
+    )
        message(FATAL_ERROR "This project requires clang 16 or later")
    endif()
 elseif(is_gcc)
@@ -62,11 +62,11 @@ if(unity)
    set(CMAKE_UNITY_BUILD ON CACHE BOOL "Do a unity build")
 endif()

-if(is_llvm_clang AND is_linux)
+if(is_clang AND is_linux)
    option(voidstar "Enable Antithesis instrumentation." OFF)
 endif()

-if(is_gcc OR is_any_clang)
+if(is_gcc OR is_clang)
    include(ProcessorCount)
    ProcessorCount(PROCESSOR_COUNT)

@@ -125,7 +125,7 @@ else()
    set(use_mold OFF CACHE BOOL "mold linker, linux only" FORCE)
 endif()

-if(is_any_clang)
+if(is_clang)
    option(use_lld "enables detection of lld linker" ON)
 else()
    set(use_lld OFF CACHE BOOL "try lld linker, clang only" FORCE)
@@ -34,12 +34,11 @@ include(create_symbolic_link)
 # sometimes `PUBLIC` and sometimes `PRIVATE`.
 # The Cs are all guaranteed to be unique.
 # We can guarantee a unique X per target by using
-# `${CMAKE_CURRENT_BINARY_DIR}/modules/${target}`.
+# `${CMAKE_CURRENT_BINARY_DIR}/include/${target}`.
 #
 # isolate_headers(target A B scope)
 function(isolate_headers target A B scope)
    file(RELATIVE_PATH C "${A}" "${B}")
-    # Keep in sync with ExcludeHeaderFilterRegex in .clang-tidy.
    set(X "${CMAKE_CURRENT_BINARY_DIR}/modules/${target}")
    set(Y "${X}/${C}")
    cmake_path(GET Y PARENT_PATH parent)
@@ -7,7 +7,7 @@
 pcpp>=1.30

 # Parser combinator library - used to parse the macro DSL
-pyparsing>=3.3.3
+pyparsing>=3.0.0

 # Template engine - used to generate C++ code from templates
-Mako>=1.4.2
+Mako>=1.2.2
@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile requirements.in --generate-hashes --output-file requirements.txt
-mako==1.4.3 \
-    --hash=sha256:723296007c870bfd6b3f0c3230dba7198096e5269297ebf5e4eff9e7ffa39d4f \
-    --hash=sha256:cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a
+mako==1.3.12 \
+    --hash=sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9 \
+    --hash=sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a
    # via -r requirements.in
 markupsafe==3.0.3 \
    --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
@@ -99,7 +99,7 @@ pcpp==1.30 \
    --hash=sha256:05fe08292b6da57f385001c891a87f40d6aa7f46787b03e8ba326d20a3297c6e \
    --hash=sha256:5af9fbce55f136d7931ae915fae03c34030a3b36c496e72d9636cedc8e2543a1
    # via -r requirements.in
-pyparsing==3.3.3 \
-    --hash=sha256:928ae7e20211f3b6f3915a72f06a0cfd29ab9d24279dd6346b6b1a7146397d36 \
-    --hash=sha256:ece8c00a69cf01b45d0b1dedabb469c90d8caf996d4fda40f147627a122849a4
+pyparsing==3.3.2 \
+    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
+    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
    # via -r requirements.in
@@ -3,11 +3,11 @@
    "requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.29#852afc87cac32aca93cc50a985d73fe0%1792359643.19817",
+        "xrpl-rpc-spec/0.1.19#870b2d3abcfbbf13b61c2d3c69495060%1790348286.187549",
        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
-        "secp256k1/0.7.1#f4d16a4d907dd057598954476ca6f88c%1792234329.790275",
+        "secp256k1/0.7.1#b1f450b7f78a36fff75bb6934a356f3a%1782338841.3729",
        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
@@ -20,7 +20,7 @@
        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
        "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
+        "grpc/1.81.1#b87796a4269034856cbc1a2522db16eb%1788275071.530512",
        "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1785888854.601666",
        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
@@ -34,15 +34,11 @@
    "build_requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
        "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
        "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
        "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
        "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
        "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
@@ -3,13 +3,5 @@
 core:non_interactive=True
 core.download:parallel={{ os.cpu_count() }}
 core.upload:parallel={{ os.cpu_count() }}
-# Fall back to Conan Center's source backups when a recipe's upstream URL is down
-# (e.g. the GNU FTP mirrors), see
-# https://github.com/conan-io/conan-center-index/issues/28147#issuecomment-3183544772
-# The backups are only tried once every upstream URL has used up its retries,
-# so keep the retries low.
-core.sources:download_urls=["origin", "https://c3i.jfrog.io/artifactory/conan-center-backup-sources"]
-tools.files.download:retry=1
+tools.files.download:retry=5
 tools.files.download:retry_wait=10
-# Fail fast on unreachable hosts (default connect timeout is 30s), keep the 60s read timeout.
-core.net.http:timeout=(5, 60)
@@ -29,9 +29,9 @@ os.version={{ min_macos_version }}
 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
 {# Instead it hand-rolls the compiler for user-config.jam, #}
-{# and its fallback probes a version-suffixed binary (e.g. `g++-<major>`) before plain `g++`. #}
-{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-<major>` suffix), #}
-{# so on a host that also has a system `g++-<major>` the probe escapes Nix #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
 {# and picks the system compiler, which is mismatched with the Nix libraries #}
 {# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
 {# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
@@ -49,31 +49,8 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]

-{% if os == "Linux" and context == "build" %}
-{# Build-context executables (protoc, grpc_cpp_plugin, build tools) run during the build #}
-{# and would otherwise load libstdc++/libgcc from a Nix store path #}
-{# that might change with a Nix toolchain update. #}
-{# --as-needed drops the ones they link but don't use, #}
-{# such as libatomic for grpc_cpp_plugin on arm64. #}
-{% set static_runtime_flags = ["-static-libstdc++", "-static-libgcc", "-Wl,--as-needed"] %}
-tools.build:exelinkflags+={{ static_runtime_flags }}
-tools.info.package_id:confs+=["tools.build:exelinkflags"]
-{% endif %}
-
-{% if os == "Linux" and context == "build" %}
-{# b2 links itself with its own script, which ignores exelinkflags #}
-{# and only takes CXXFLAGS when use_cxx_env is set (see [buildenv] below). #}
-[options]
-b2/*:use_cxx_env=True
-{% endif %}
-
-[buildenv]
-{# gRPC emits thousands of compiler warnings that we cannot act on. #}
-{# CMake picks up CXXFLAGS, and unlike tools.build:cxxflags, #}
-{# this is not part of the package ID, so binaries stay shareable. #}
-grpc/*:CXXFLAGS=-w
-
 {% if os == "Macos" %}
+[buildenv]
 {# os.version adds -mmacosx-version-min to compiler command lines, #}
 {# but Boost.Context's b2 assembly (.S) rule ignores it, #}
 {# so those objects keep the host SDK version and still warn at link time. #}
@@ -81,7 +58,3 @@ grpc/*:CXXFLAGS=-w
 {# Scoped to boost/* since it is the only gap. #}
 boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
 {% endif %}
-
-{% if os == "Linux" and context == "build" %}
-b2/*:CXXFLAGS={{ static_runtime_flags | join(" ") }}
-{% endif %}
@@ -5,9 +5,6 @@ include(default)

 {% if not sanitizers %}
 {# Sanitizers not configured; no additional settings needed #}
-{% elif context == "build" %}
-{# Build-context packages are tools we run, not code we test, #}
-{# so don't instrument them #}
 {% else %}

 {% if compiler == "msvc" %}
@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
        "nudb/2.0.9",
        "openssl/3.6.3",
        "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.29",
+        "xrpl-rpc-spec/0.1.19",
        "zlib/1.3.2",
    ]

@@ -49,8 +49,7 @@ class Xrpl(ConanFile):
    ]

    tool_requires = [
-        "grpc/<host_version>",
-        "protobuf/<host_version>",
+        "protobuf/6.33.5",
    ]

    default_options = {
@@ -124,10 +123,6 @@ class Xrpl(ConanFile):
        "xxhash/*:shared": False,
    }

-    # default_options only reach the host context;
-    # give tool_requires (and their dependencies) the same dependency options.
-    default_build_options = {k: v for k, v in default_options.items() if "/" in k}
-
    def set_version(self):
        self.version = self.version or DEV_VERSION

@@ -154,7 +149,7 @@ class Xrpl(ConanFile):
        self.requires("xxhash/0.8.3", transitive_headers=True)

    exports_sources = (
-        "bin/nix/default-loader-path.sh",
+        "bin/default-loader-path.sh",
        "CMakeLists.txt",
        "cfg/*",
        "cmake/*",
@@ -80,12 +80,13 @@ function(add_xrpl_crate name)
    # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
    # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
    if(is_msvc)
-        corrosion_set_env_vars(${ARG_CRATE} "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>")
+        corrosion_set_env_vars(
+            ${ARG_CRATE}
+            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
+        )
    endif()
-    corrosion_add_cxxbridge(
-        ${name}_cxxbridge
-        CRATE ${ARG_CRATE}
-        FILES ${ARG_FILES}
+    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
+                            ${ARG_FILES}
    )
    # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
    # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
@@ -57,9 +57,9 @@ dependencies = [

 [[package]]
 name = "cxx"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8a02bfeba9074b2bbb39492c9b0908ec854f455a3cccdcde7a1de55e2315e40"
+checksum = "13f6de320895f42e6e081abb5c7983bedcf0b6d0ff9323de0d33f620c8ac1199"
 dependencies = [
 "cc",
 "cxx-build",
@@ -72,9 +72,9 @@ dependencies = [

 [[package]]
 name = "cxx-build"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbc2ac76997619d2d888b58ad79488f1c835de41ca4dd3dd7082acf4ecb0a50f"
+checksum = "4fde53ca86b9704a943fef0f1e1d836239a6aedca5de3c65fa9f97ec0bd46d39"
 dependencies = [
 "cc",
 "codespan-reporting",
@@ -87,9 +87,9 @@ dependencies = [

 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a486ed16a3f2a053fe7f5b98db4c1a59846a23e8cb9e49f9d1bd48830d51a2"
+checksum = "07bae89236c811fd4d08ed3441759ac4ac98d752cbfd3de341315ba16ad20ec3"
 dependencies = [
 "clap",
 "codespan-reporting",
@@ -101,15 +101,15 @@ dependencies = [

 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c72569be94e2283764d334cd285980b747dbe221e27e315484eb6bcd93fa808a"
+checksum = "49045042e5fced01b80742aba5508de82aa4f13677ed3fa2b4cda709c40c5918"

 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "423e795284a7f7b3f843c956a5322c4bc497b60c2dd1a6339da10313cb18d575"
+checksum = "b181252e2e3d3b5d183afbdc033a3958b445eb3e1a0ae65fc3d4f5259f5da6fd"
 dependencies = [
 "indexmap",
 "proc-macro2",
@@ -4,33 +4,20 @@ This document explains how to set one up.

 [BUILD.md]: ../../BUILD.md

-## Supported development platforms
-
- **Linux**: the [Nix development shell](./nix.md),
-  which provides the same toolchain CI uses on any distribution.
- **macOS** 15 (Sequoia) or newer: the [Nix development shell](./nix.md),
-  or the system [Apple Clang](#macos-apple-clang).
-  CI runs on macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
- **Windows**: best effort, see [Windows](#windows).
-
-For the platforms supported for running `xrpld`,
-see [Requirements](../install.md#requirements).
-
 ## Tested compiler versions

 `xrpld` is built in the **C++23** dialect by default, so your toolchain has to
 support it — see [compiler support for C++23][cpp23-support].
 The versions currently tested in CI are:

-| Compiler    | Version                         |
-| ----------- | ------------------------------- |
-| GCC         | `gccVersion` in [packages.nix]  |
-| Clang       | `llvmVersion` in [packages.nix] |
-| Apple Clang | 21                              |
-| MSVC        | Visual Studio 2026              |
+| Compiler    | Version            |
+| ----------- | ------------------ |
+| GCC         | 15.2               |
+| Clang       | 22                 |
+| Apple Clang | 21                 |
+| MSVC        | Visual Studio 2026 |

-LLVM tools (`clang-tidy` and `clang-format`)
-come from the same LLVM release as Clang.
+LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.

 ### Older compilers

@@ -47,16 +34,20 @@ compiler building. Treat support for anything outside the table as best-effort.

 ## Required tools

-Besides a compiler, building `xrpld` requires
-[Git](https://git-scm.com/downloads),
-[Python](https://www.python.org/downloads/),
-[Conan](https://conan.io/downloads.html),
-and [CMake](https://cmake.org/download/).
-Building with `-Drust=ON` additionally requires a Rust toolchain,
-see [Rust](#rust).
+Besides a compiler, building `xrpld` requires:
+
+| Tool                                        | Minimum version |
+| ------------------------------------------- | --------------- |
+| [Git](https://git-scm.com/downloads)        | any recent      |
+| [Python](https://www.python.org/downloads/) | 3.11            |
+| [Conan](https://conan.io/downloads.html)    | 2.17            |
+| [CMake](https://cmake.org/download/)        | 3.16            |

 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
-at the versions CI uses, recorded in [`nix/check-tools/`](../../nix/check-tools).
+(see below). On Windows they have to be installed manually.
+
+Building with `-Drust=ON` additionally requires a Rust toolchain, see
+[Rust](#rust). A default build does not, so it is not in the table above.

 Once they are in place, verify that everything is installed and runnable with:

@@ -66,19 +57,60 @@ Once they are in place, verify that everything is installed and runnable with:

 ## Linux and macOS

-Use the [Nix development shell](./nix.md):
-it provides the compiler and every tool CI uses,
-without installing anything system-wide.
+The **recommended way** to get a development environment on Linux and macOS is
+the Nix development shell. It provides the exact tooling used in CI — `git`,
+`python`, `conan`, `cmake`, `clang-tidy`, `clang-format`, and everything else —
+with a single command and without installing anything system-wide:

-### macOS: Apple Clang
+```bash
+nix --experimental-features 'nix-command flakes' develop
+```

-You can also build with the system Apple Clang,
-installing the other [required tools](#required-tools) any way you like
-(or getting them from `nix develop .#apple-clang`).
-Its version is whatever your installed Xcode (or Command Line Tools) provides,
-so check that `clang --version` is at least the [tested one](#tested-compiler-versions).
-If several Xcode versions are installed,
-select one with `sudo xcode-select -s <path>` or the `DEVELOPER_DIR` environment variable.
+On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
+Clang. If you instead opt to use your system-wide Apple Clang (via
+`nix develop .#apple-clang`), you need to manage its version yourself (see
+below).
+
+See [Using the Nix development shell](./nix.md) for installation and usage
+details, including how to select a different compiler and why we recommend Nix
+over a hand-maintained environment.
+
+### macOS: managing the Apple Clang version
+
+If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
+the compiler version is whatever your installed Xcode (or Command Line Tools)
+provides. The following command should return a version greater than or equal to
+the [tested one](#tested-compiler-versions):
+
+```bash
+clang --version
+```
+
+If you develop other applications using Xcode, you might be consistently
+updating to the newest version of Apple Clang, which will likely cause issues
+building xrpld. You may want to install and pin a specific version of Xcode:
+
+1. **Download Xcode**
+   - Visit [Apple Developer Downloads](https://developer.apple.com/download/more/)
+   - Sign in with your Apple Developer account
+   - Search for an Xcode version that includes the expected Apple Clang version
+   - Download the `.xip` file
+
+2. **Install and configure Xcode**
+
+   ```bash
+   # Extract the .xip file and rename for version management
+   # Example: Xcode_16.2.app
+
+   # Move to Applications directory
+   sudo mv Xcode_16.2.app /Applications/
+
+   # Set as default toolchain (persistent)
+   sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+
+   # Set as environment variable (temporary)
+   export DEVELOPER_DIR=/Applications/Xcode_16.2.app/Contents/Developer
+   ```

 ## Windows

@@ -90,7 +122,8 @@ manually:
  "x64 Native Tools Command Prompt". CI configures CMake with the
  `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
- recent releases of Python, Conan, and CMake
+- Python, Conan, and CMake, at the versions listed in
+  [Required tools](#required-tools).
 - a [Rust toolchain](https://rustup.rs) — only needed to build with
  `-Drust=ON`, see [Rust](#rust)

@@ -111,5 +144,15 @@ version.
 Everything else the Rust build needs on the CMake side comes from Conan along
 with the rest of the dependencies, so there is nothing further to install.

+## Clang-tidy
+
+`clang-tidy` is required to run static analysis checks locally (see
+[CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
+project. The version this project uses is listed in
+[Tested compiler versions](#tested-compiler-versions).
+
+On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
+version out of the box — run it via `run-clang-tidy`. No separate installation
+is needed.
+
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
-[packages.nix]: ../../nix/packages.nix
@@ -9,7 +9,9 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
+- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
+- **Works on Linux and macOS**: Consistent experience across platforms

 ## Install Nix

@@ -25,8 +27,13 @@ From the root of the xrpld repository, enter the default development shell:
 nix --experimental-features 'nix-command flakes' develop
 ```

-This downloads and sets up all required development tools (CMake, Ninja, Conan, etc.)
-and the compiler for your platform (see [Platform notes](#platform-notes)).
+This will:
+
+- Download and set up all required development tools (CMake, Ninja, Conan, etc.)
+- Configure the appropriate compiler for your platform:
+  - **Linux**: GCC (provided by Nix)
+  - **macOS**: Clang (provided by Nix)
+
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.

 ### Platform notes
@@ -176,36 +183,24 @@ at link or run time.
 > configuration CI covers, and no dependency binaries are published for it.

 This is checked rather than assumed.
-[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) takes one
-file or directory and fails if a binary under it resolves a store path at run time.
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) takes one file
+or directory and fails if a binary under it resolves a store path at run time.
 CI runs it over the build output and the Conan cache, and again in the upload job
 before anything is published. You can run it yourself:

 ```bash
-bin/nix/check-nix-store-refs.sh build
-bin/nix/check-nix-store-refs.sh ~/.conan2-nix
+bin/check-nix-store-refs.sh build
+bin/check-nix-store-refs.sh ~/.conan2-nix
 ```

 It works on Linux too, but asserts something narrower there: the toolchain always
-writes the store into `PT_INTERP` and `RUNPATH`. That is fine for the pinned
-glibc, whose path does not move, but not for the GCC runtime, which moves with
-every GCC update. So [`conan/profiles/default`](../../conan/profiles/default)
-links build-context packages, whose executables run during the build, with
-`-static-libstdc++ -static-libgcc -Wl,--as-needed`, and
-[`conan/profiles/sanitizers`](../../conan/profiles/sanitizers) does not
-instrument them. CI checks that they load nothing from the store but glibc, from
-the graph `conan install --format=json` writes:
+writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
+whose store is fixed for its lifetime, so that is fine. Only the binaries
+[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
+system loader have to be clean, and those are what CI checks:

 ```bash
-bin/nix/check-build-context-runtime.sh graph.json
-```
-
-Only the binaries [`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake)
-retargets to the system loader have to be fully clean, and those are what CI
-checks:
-
-```bash
-bin/nix/check-nix-store-refs.sh build/xrpld
+bin/check-nix-store-refs.sh build/xrpld
 ```

 ### The libresolv stub
@@ -178,11 +178,11 @@ A binary stops starting after a `nix flake update`, or after
 dyld[57271]: Library not loaded: /nix/store/…-libresolv-93/lib/libresolv.9.dylib
 ```

-[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) finds the
-same thing without having to run anything, and names the file:
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) finds the same
+thing without having to run anything, and names the file:

 ```
-$ bin/nix/check-nix-store-refs.sh ~/.conan2-nix
+$ bin/check-nix-store-refs.sh ~/.conan2-nix
 ::error file=/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig::references the Nix store at run time
 /Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig
    /nix/store/p4lp3xq4imd1qzqh08x8vcq2zfhi7rca-libresolv-93/lib/libresolv.9.dylib
@@ -10,19 +10,6 @@ and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
 where `yum` is a symlink to `dnf`.
 To build from source instead, see [BUILD.md](../BUILD.md).

-## Requirements
-
-Linux is the only operating system officially supported for running `xrpld`;
-macOS and Windows builds are for development only.
-
-Any x86-64 Linux distribution with APT or DNF and glibc 2.31 or newer should work
-(see [How libc is handled](../nix/docker/README.md#how-libc-is-handled)).
-CI tests the packages on Debian 11–13, Ubuntu 20.04–26.04,
-RHEL (UBI) 9–10, AlmaLinux 9–10, and Rocky Linux 9–10.
-
-For the hardware needed to run a node,
-see [System Requirements](https://xrpl.org/system-requirements.html).
-
 ## Release channels

 Packages are published to four channels:
@@ -6,7 +6,7 @@ project(antithesis-sdk-cpp VERSION 0.4.4 LANGUAGES CXX)
 add_library(antithesis-sdk-cpp INTERFACE antithesis_sdk.h)

 # Note, both sections below created by xrpld project
-target_include_directories(antithesis-sdk-cpp SYSTEM INTERFACE
+target_include_directories(antithesis-sdk-cpp INTERFACE
  $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
  $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
 )
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1791130267,
-        "narHash": "sha256-1sjwcQMcgAbmiip/VivBSiK8p2bTkQGOvCuO7vnwfx4=",
+        "lastModified": 1781173989,
+        "narHash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9013764fcc0ea99fa16cf7aa7decf8a5c3889dd2",
+        "rev": "8c91a71d13451abc40eb9dae8910f972f979852f",
        "type": "github"
      },
      "original": {
@@ -47,11 +47,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1791189933,
-        "narHash": "sha256-Y8eN7ki0Urx4Ojf4w1xSpWg8uk/3lJqK+E0Oth77rH0=",
+        "lastModified": 1784611586,
+        "narHash": "sha256-OfqgY+0hp/zseZB7uyH0U8kIDPS4scZZCyAurEplvG0=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "e60029353d0c48d216bc4b065168ccd4079c166f",
+        "rev": "14f58845249f3552a89b07772626b8d3c632fa86",
        "type": "github"
      },
      "original": {
@@ -34,7 +34,7 @@ lz4Compress(void const* in, std::size_t inSize, BufferFactory&& bf)
    // data
    auto compressed = bf(outCapacity);

-    auto const compressedSize = LZ4_compress_default(
+    auto compressedSize = LZ4_compress_default(
        reinterpret_cast<char const*>(in),
        reinterpret_cast<char*>(compressed),
        inSize,
@@ -20,14 +20,12 @@ SharedIntrusive<T>::SharedIntrusive(T* p, TAdoptTag) noexcept : ptr_{p}

 template <class T>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive const& rhs)
-    : ptr_{
-          [&] {
-              auto p = rhs.unsafeGetRawPtr();
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = rhs.unsafeGetRawPtr();
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -35,14 +33,12 @@ template <class T>
 template <class TT>
    requires std::convertible_to<TT*, T*>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = rhs.unsafeGetRawPtr();
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = rhs.unsafeGetRawPtr();
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -144,14 +140,12 @@ SharedIntrusive<T>::~SharedIntrusive()
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -165,14 +159,12 @@ SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusiv
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -268,7 +260,7 @@ SharedIntrusive<T>::unsafeReleaseAndStore(T* next)
        return;

    using enum ReleaseStrongRefAction;
-    auto const action = prev->releaseStrongRef();
+    auto action = prev->releaseStrongRef();
    switch (action)
    {
        case NoOp:
@@ -369,7 +361,7 @@ WeakIntrusive<T>::unsafeReleaseNoStore()
        return;

    using enum ReleaseWeakRefAction;
-    auto const action = ptr_->releaseWeakRef();
+    auto action = ptr_->releaseWeakRef();
    switch (action)
    {
        case NoOp:
@@ -588,7 +580,7 @@ SharedWeakUnion<T>::convertToStrong()
    auto p = unsafeGetRawPtr();
    if (p && p->checkoutStrongRefFromWeak())
    {
-        [[maybe_unused]] auto const action = p->releaseWeakRef();
+        [[maybe_unused]] auto action = p->releaseWeakRef();
        XRPL_ASSERT(
            (action == ReleaseWeakRefAction::NoOp),
            "xrpl::SharedWeakUnion::convertToStrong : "
@@ -611,7 +603,7 @@ SharedWeakUnion<T>::convertToWeak()
        return false;

    using enum ReleaseStrongRefAction;
-    auto const action = p->addWeakReleaseStrongRef();
+    auto action = p->addWeakReleaseStrongRef();
    switch (action)
    {
        case NoOp:
@@ -678,7 +670,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
    if (isStrong())
    {
        using enum ReleaseStrongRefAction;
-        auto const strongAction = p->releaseStrongRef();
+        auto strongAction = p->releaseStrongRef();
        switch (strongAction)
        {
            case NoOp:
@@ -696,7 +688,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
    else
    {
        using enum ReleaseWeakRefAction;
-        auto const weakAction = p->releaseWeakRef();
+        auto weakAction = p->releaseWeakRef();
        switch (weakAction)
        {
            case NoOp:
@@ -406,10 +406,10 @@ IntrusiveRefCounts::useCount() const noexcept
 inline IntrusiveRefCounts::~IntrusiveRefCounts() noexcept
 {
 #ifndef NDEBUG
-    auto const v = refCounts_.load(std::memory_order_acquire);
+    auto v = refCounts_.load(std::memory_order_acquire);
    XRPL_ASSERT(
        (!(v & kValueMask)), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : count must be zero");
-    auto const t = v & kTagMask;
+    auto t = v & kTagMask;
    XRPL_ASSERT((!t || t == kTagMask), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : valid tag");
 #endif
 }
@@ -3,156 +3,9 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
-#include <cstdint>
-#include <limits>
-#include <optional>

 namespace xrpl {

-/**
- * Add two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical sum is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedAdd(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
-        return std::nullopt;
-
-    return a + b;
-}
-
-/**
- * Subtract two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical difference is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedSub(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
-        return std::nullopt;
-
-    return a - b;
-}
-
-/**
- * Multiply two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical product is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedMul(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if (a == 0 || b == 0)
-        return 0;
-
-    if (a > 0)
-    {
-        if (b > 0 ? a > L::max() / b : b < L::min() / a)
-            return std::nullopt;
-    }
-    else if (b > 0 ? a < L::min() / b : b < L::max() / a)
-    {
-        return std::nullopt;
-    }
-
-    return a * b;
-}
-
-static_assert(checkedAdd(0, 0) == 0);
-static_assert(checkedAdd(1, -1) == 0);
-static_assert(checkedAdd(-5, 2) == -3);
-static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::max(), 1).has_value());
-static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::min(), -1).has_value());
-static_assert(
-    checkedAdd(std::numeric_limits<std::int64_t>::max() - 1, 1) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedAdd(
-        std::numeric_limits<std::int64_t>::min(),
-        std::numeric_limits<std::int64_t>::max()) == -1);
-static_assert(
-    checkedAdd(
-        std::numeric_limits<std::int64_t>::max(),
-        std::numeric_limits<std::int64_t>::min()) == -1);
-static_assert(
-    !checkedAdd(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::max())
-         .has_value());
-static_assert(
-    !checkedAdd(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::min())
-         .has_value());
-
-static_assert(checkedSub(0, 0) == 0);
-static_assert(checkedSub(1, 1) == 0);
-static_assert(checkedSub(-5, 2) == -7);
-static_assert(checkedSub(-5, -2) == -3);
-static_assert(!checkedSub(std::numeric_limits<std::int64_t>::min(), 1).has_value());
-static_assert(!checkedSub(std::numeric_limits<std::int64_t>::max(), -1).has_value());
-static_assert(
-    checkedSub(std::numeric_limits<std::int64_t>::min() + 1, 1) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedSub(-1, std::numeric_limits<std::int64_t>::max()) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    !checkedSub(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::min())
-         .has_value());
-static_assert(
-    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
-         .has_value());
-
-static_assert(checkedMul(0, std::numeric_limits<std::int64_t>::min()) == 0);
-static_assert(checkedMul(std::numeric_limits<std::int64_t>::min(), 0) == 0);
-static_assert(checkedMul(-1, -1) == 1);
-// a > 0, b > 0
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::max(), 1) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::max() / 2, 2) ==
-    std::numeric_limits<std::int64_t>::max() - 1);
-static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, 2).has_value());
-static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::max() / 2) + 1).has_value());
-// a > 0, b < 0
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::max(), -1) ==
-    -std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, -2) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 2, -2).has_value());
-static_assert(
-    checkedMul(1, std::numeric_limits<std::int64_t>::min()) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedMul(2, std::numeric_limits<std::int64_t>::min() / 2) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::min() / 2) - 1).has_value());
-// a < 0, b > 0
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::min(), 1) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::min() / 2, 2) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(!checkedMul((std::numeric_limits<std::int64_t>::min() / 2) - 1, 2).has_value());
-static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), 2).has_value());
-// a < 0, b < 0
-static_assert(
-    checkedMul(-(std::numeric_limits<std::int64_t>::max() / 2), -2) ==
-    std::numeric_limits<std::int64_t>::max() - 1);
-static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min() / 2, -2).has_value());
-static_assert(
-    checkedMul(-1, -std::numeric_limits<std::int64_t>::max()) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), -1).has_value());
-static_assert(!checkedMul(-1, std::numeric_limits<std::int64_t>::min()).has_value());
-
 /**
 * Calculate one number divided by another number in percentage.
 * The result is rounded up to the next integer, and capped in the range [0,100]
@@ -352,9 +352,9 @@ class Number final
    using rep = std::int64_t;
    using InternalRep = MantissaRange::rep;

+    bool negative_{false};
    InternalRep mantissa_{0};
    int exponent_{std::numeric_limits<int>::lowest()};
-    bool negative_{false};

 public:
    // The range for the exponent when normalized
@@ -650,12 +650,8 @@ private:
    shiftExponent(int exponentDelta) const;
 };

-// The number class currently has 3 tail padding bytes. If you are adding new
-// members, try to fit them there before expanding the size of the class.
-static_assert(sizeof(Number) == 16);
-
 constexpr Number::Number(bool negative, InternalRep mantissa, int exponent, Unchecked) noexcept
-    : mantissa_{mantissa}, exponent_{exponent}, negative_(negative)
+    : negative_(negative), mantissa_{mantissa}, exponent_{exponent}
 {
 }

@@ -340,7 +340,7 @@ public:

        for (auto const& c : cfg)
        {
-            auto const& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);
+            auto& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);

            if (a.size() > maxSize_)
                maxSize_ = a.size();
@@ -36,7 +36,7 @@ template <typename T>
 concept SomeChar = std::same_as<std::remove_cvref_t<T>, int8_t> ||
    std::same_as<std::remove_cvref_t<T>, char> || std::same_as<std::remove_cvref_t<T>, uint8_t>;

-inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = [] {
+inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = []() {
    std::array<std::optional<int>, 256> t{};

    for (int i = 0; i < 10; ++i)
@@ -153,24 +153,6 @@ private:
        Policy policy,
        Callback&& replaceCallback = nullptr);

-    /**
-     * canonicalizeImpl variant for callers that already hold `mutex_`.
-     *
-     * The unnamed `scoped_lock<MutexType> const&` parameter is proof of
-     * ownership; this overload does not acquire the lock. Use it from other
-     * methods (e.g. fetchAndModify) that need to compose canonicalize with
-     * additional work under a single critical section, without relying on
-     * recursive-mutex re-entry.
-     */
-    template <class Policy, class Callback = std::nullptr_t>
-    bool
-    canonicalizeImpl(
-        std::scoped_lock<MutexType> const&,
-        key_type const& key,
-        CanonicalizeClientPointerType<Policy> data,
-        Policy policy,
-        Callback&& replaceCallback = nullptr);
-
 public:
    /**
     * Replace aliased objects with originals.
@@ -257,6 +239,9 @@ public:
    bool
    retrieve(key_type const& key, T& data);

+    MutexType&
+    peekMutex();
+
    std::vector<key_type>
    getKeys() const;

@@ -278,22 +263,6 @@ public:
    fetch(key_type const& digest, Handler const& h);
    // End CachedSLEs functions.

-    /**
-     * Fetch or create an entry and execute a callback while holding the lock.
-     *
-     * The entry for the given key is fetched from the cache or created if it
-     * doesn't exist. The callback is then invoked with a reference to the
-     * entry while the cache mutex is still held, allowing safe modification
-     * of the cached object.
-     *
-     * @param key The key to fetch or create
-     * @param callback Function to call with the entry under lock.
-     *                 Signature: void(T&)
-     */
-    template <class Callback>
-    void
-    fetchAndModify(key_type const& key, Callback&& callback);
-
 private:
    SharedPointerType
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l);
@@ -4,7 +4,6 @@
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/scope.h>
-#include <xrpl/beast/utility/instrumentation.h>

 #include <algorithm>

@@ -301,7 +300,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // Remove from cache, if !valid, remove from map too. Returns true if removed from cache
    std::scoped_lock const lock(mutex_);

-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);

    if (cit == cache_.end())
        return false;
@@ -336,29 +335,6 @@ template <class Policy, class Callback>
 inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    canonicalizeImpl(
-        key_type const& key,
-        CanonicalizeClientPointerType<Policy> data,
-        Policy policy,
-        Callback&& replaceCallback)
-{
-    std::scoped_lock<MutexType> const lock(mutex_);
-    return canonicalizeImpl(lock, key, data, policy, std::forward<Callback>(replaceCallback));
-}
-
-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-template <class Policy, class Callback>
-inline bool
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    canonicalizeImpl(
-        std::scoped_lock<MutexType> const&,
        key_type const& key,
        CanonicalizeClientPointerType<Policy> data,
        [[maybe_unused]] Policy policy,
@@ -378,7 +354,9 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // passing a const argument is a compile error.
    constexpr bool replaceCached = std::is_same_v<Policy, detail::ReplaceCached>;

-    auto const cit = cache_.find(key);
+    std::scoped_lock const lock(mutex_);
+
+    auto cit = cache_.find(key);

    if (cit == cache_.end())
    {
@@ -393,7 +371,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    Entry& entry = cit->second;
    entry.touch(clock_.now());

-    auto const shouldReplaceCached = [&] {
+    auto shouldReplaceCached = [&] {
        if constexpr (replaceCached)
        {
            return true;
@@ -422,7 +400,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
        return true;
    }

-    auto const cachedData = entry.lock();
+    auto cachedData = entry.lock();

    if (cachedData)
    {
@@ -585,7 +563,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    retrieve(key_type const& key, T& data)
 {
    // retrieve the value of the stored data
-    auto const entry = fetch(key);
+    auto entry = fetch(key);

    if (!entry)
        return false;
@@ -594,6 +572,22 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    return true;
 }

+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+inline auto
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    peekMutex() -> MutexType&
+{
+    return mutex_;
+}
+
 template <
    class Key,
    class T,
@@ -693,7 +687,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
            return ret;
    }

-    auto const sle = h();
+    auto sle = h();
    if (!sle)
        return {};

@@ -706,49 +700,6 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 }
 // End CachedSLEs functions.

-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-template <class Callback>
-inline void
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    fetchAndModify(key_type const& key, Callback&& callback)
-{
-    static_assert(
-        !IsKeyCache, "fetchAndModify is only supported for value caches, not key-only caches");
-    static_assert(
-        std::is_same_v<std::shared_ptr<T>, SharedPointerType> ||
-            std::is_same_v<intr_ptr::SharedPtr<T>, SharedPointerType>,
-        "fetchAndModify requires std::shared_ptr<T> or intr_ptr::SharedPtr<T>");
-
-    std::scoped_lock<MutexType> const lock(mutex_);
-
-    // Same pointer-type dispatch as insert(): the placeholder must have exactly
-    // SharedPointerType so canonicalizeImpl can write the cached pointer back.
-    SharedPointerType entry = [] {
-        if constexpr (std::is_same_v<std::shared_ptr<T>, SharedPointerType>)
-        {
-            return std::make_shared<T>();
-        }
-        else
-        {
-            return intr_ptr::makeShared<T>();
-        }
-    }();
-    canonicalizeImpl(lock, key, entry, detail::ReplaceClient{});
-
-    ALWAYS(
-        entry != nullptr, "xrpl::TaggedCache::fetchAndModify : entry present after canonicalize");
-
-    callback(*entry);
-}
-
 template <
    class Key,
    class T,
@@ -762,7 +713,7 @@ inline SharedPointerType
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l)
 {
-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);
    if (cit == cache_.end())
        return {};

@@ -832,7 +783,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
        std::atomic<int>& allRemovals,
        std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this] {
+    return std::thread([&, this]() {
        int cacheRemovals = 0;
        int mapRemovals = 0;

@@ -912,7 +863,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
        std::atomic<int>& allRemovals,
        std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this] {
+    return std::thread([&, this]() {
        // NOLINTBEGIN https://github.com/XRPLF/rippled/issues/7056
        int cacheRemovals = 0;
        int mapRemovals = 0;
@@ -195,8 +195,7 @@ private:
    {
        // Local lambda that converts a single hex char to four bits and
        // ORs those bits into a uint32_t.
-        auto const hexCharToUInt =
-            [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
+        auto hexCharToUInt = [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
            std::uint32_t nibble = 0xFFu;
            if (c < '0' || c > 'f')
                return ParseResult::BadChar;
@@ -454,7 +453,7 @@ public:
    {
        for (int i = kWidth - 1; i >= 0; --i)
        {
-            auto const prev = data_[i];
+            auto prev = data_[i];
            data_[i] = boost::endian::native_to_big(boost::endian::big_to_native(data_[i]) - 1);

            if (prev != 0)
@@ -17,7 +17,7 @@
 namespace xrpl {

 template <typename Key>
-std::size_t
+static std::size_t
 extract(Key const& key)
 {
    return key;
@@ -365,7 +365,7 @@ public:
    size() const
    {
        std::size_t ret = 0;
-        for (auto const& p : map_)
+        for (auto& p : map_)
            ret += p.size();
        return ret;
    }
@@ -1604,7 +1604,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
    beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
    requires(!IsBoostReverseIterator<Iterator>::value)
 {
-    unlinkAndDeleteElement(&*(pos++).iterator());
+    unlinkAndDeleteElement(&*((pos++).iterator()));
    return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }

@@ -1617,7 +1617,7 @@ AgedOrderedContainer<IsMulti, IsMap, Key, T, Clock, Compare, Allocator>::erase(
    requires(!IsBoostReverseIterator<Iterator>::value)
 {
    for (; first != last;)
-        unlinkAndDeleteElement(&*(first++).iterator());
+        unlinkAndDeleteElement(&*((first++).iterator()));

    return beast::detail::AgedContainerIterator<false, Iterator>(first.iterator());
 }
@@ -2404,7 +2404,7 @@ beast::detail::AgedContainerIterator<false, Iterator>
 AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>::erase(
    beast::detail::AgedContainerIterator<IsConst, Iterator> pos)
 {
-    unlinkAndDeleteElement(&*(pos++).iterator());
+    unlinkAndDeleteElement(&*((pos++).iterator()));
    return beast::detail::AgedContainerIterator<false, Iterator>(pos.iterator());
 }

@@ -2424,7 +2424,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
    beast::detail::AgedContainerIterator<IsConst, Iterator> last)
 {
    for (; first != last;)
-        unlinkAndDeleteElement(&*(first++).iterator());
+        unlinkAndDeleteElement(&*((first++).iterator()));

    return beast::detail::AgedContainerIterator<false, Iterator>(first.iterator());
 }
@@ -2536,7 +2536,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
        return false;
    for (auto iter(cbegin()), last(cend()), otherLast(other.cend()); iter != last; ++iter)
    {
-        auto const otherIter(other.find(extract(*iter)));
+        auto otherIter(other.find(extract(*iter)));
        if (otherIter == otherLast)
            return false;
    }
@@ -68,7 +68,7 @@ struct LexicalCast<Out, std::string_view>
        if (first != last && *first == '+')
            ++first;

-        auto const ret = std::from_chars(first, last, out);
+        auto ret = std::from_chars(first, last, out);

        return ret.ec == std::errc() && ret.ptr == last;
    }
@@ -390,7 +390,7 @@ void
 hash_append(Hasher& h, boost::container::flat_set<Key, Compare, Alloc> const& v) noexcept
    requires(IsContiguouslyHashable<Key, Hasher>::value)
 {
-    h(&v.begin(), v.size() * sizeof(Key));
+    h(&(v.begin()), v.size() * sizeof(Key));
 }
 // tuple

@@ -8,7 +8,7 @@ namespace beast::insight {
 class HookImpl : public std::enable_shared_from_this<HookImpl>
 {
 public:
-    using HandlerType = std::function<void()>;
+    using HandlerType = std::function<void(void)>;

    virtual ~HookImpl() = 0;
 };
@@ -61,7 +61,7 @@ isMulticast(Address const& addr)
 inline bool
 isPrivate(Address const& addr)
 {
-    return addr.is_v4() ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
+    return (addr.is_v4()) ? isPrivate(addr.to_v4()) : isPrivate(addr.to_v6());
 }

 /**
@@ -70,7 +70,7 @@ isPrivate(Address const& addr)
 inline bool
 isPublic(Address const& addr)
 {
-    return addr.is_v4() ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
+    return (addr.is_v4()) ? isPublic(addr.to_v4()) : isPublic(addr.to_v6());
 }

 }  // namespace ip
@@ -83,7 +83,7 @@ trimRight(String const& s)
 {
    using std::begin;
    using std::end;
-    auto const first(begin(s));
+    auto first(begin(s));
    auto last(end(s));
    last = trimRight(first, last);
    return {first, last};
@@ -34,7 +34,7 @@ typeName()
        name += " volatile";
    if (std::is_lvalue_reference_v<T>)
    {
-        name += '&';
+        name += "&";
    }
    else if (std::is_rvalue_reference_v<T>)
    {
@@ -32,7 +32,7 @@ public:
        Module,

        // Match nothing (used internally)
-        None,
+        None
    };

 private:
@@ -20,7 +20,7 @@ namespace beast::unit_test {
 namespace detail {

 template <class String>
-std::string
+static std::string
 makeReason(String const& reason, char const* file, int line)
 {
    std::string s(reason);
@@ -47,8 +47,8 @@ public:
    template <class F, class... Args>
    explicit Thread(Suite& s, F&& f, Args&&... args) : s_(&s)
    {
-        std::function<void()> b = [f = std::forward<F>(f),
-                                   ... args = std::forward<Args>(args)] mutable {
+        std::function<void(void)> b = [f = std::forward<F>(f),
+                                       ... args = std::forward<Args>(args)]() mutable {
            std::invoke(f, args...);
        };
        t_ = std::thread(&Thread::run, this, std::move(b));
@@ -94,7 +94,7 @@ public:

 private:
    void
-    run(std::function<void()> f)
+    run(std::function<void(void)> f)
    {
        try
        {
@@ -24,7 +24,7 @@ enum class Severity : std::uint8_t {
    Fatal = 5,

    Disabled = 6,
-    None = Disabled,
+    None = Disabled
 };

 /**
@@ -18,7 +18,7 @@ enum class Type : std::uint8_t {
    PrefixSha256 = 1,
    ThresholdSha256 = 2,
    RsaSha256 = 3,
-    Ed25519Sha256 = 4,
+    Ed25519Sha256 = 4
 };

 class Condition
@@ -49,7 +49,7 @@ public:

        using namespace der;

-        auto const p = parsePreamble(s, ec);
+        auto p = parsePreamble(s, ec);
        if (ec)
            return nullptr;

@@ -21,7 +21,7 @@ enum class Error {
    UnexpectedTag,
    LongTag,
    LargeSize,
-    PreimageTooLong,
+    PreimageTooLong
 };

 std::error_code
@@ -396,7 +396,7 @@ inline bool
 getIfExists<bool>(Section const& section, std::string const& name, bool& v)
 {
    int intVal = 0;
-    auto const stat = getIfExists(section, name, intVal);
+    auto stat = getIfExists(section, name, intVal);
    if (stat)
        v = bool(intVal);
    return stat;
@@ -94,7 +94,6 @@ struct Keys
    static constexpr auto kBbtOptions = "bbt_options";
    static constexpr auto kBgThreads = "bg_threads";
    static constexpr auto kBlockSize = "block_size";
-    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
    static constexpr auto kCacheAge = "cache_age";
    static constexpr auto kCacheMb = "cache_mb";
    static constexpr auto kCacheSize = "cache_size";
@@ -109,8 +108,6 @@ struct Keys
    static constexpr auto kFileSizeMult = "file_size_mult";
    static constexpr auto kFilterBits = "filter_bits";
    static constexpr auto kFilterFull = "filter_full";
-    static constexpr auto kGasLimit = "gas_limit";
-    static constexpr auto kGasPrice = "gas_price";
    static constexpr auto kHardSet = "hard_set";
    static constexpr auto kHighThreads = "high_threads";
    static constexpr auto kHoldTime = "hold_time";
@@ -93,14 +93,14 @@ public:
    void
    check(std::vector<TxID> accepted, Predicate&& pred)
    {
-        auto const acceptTxid = accepted.begin();
+        auto acceptTxid = accepted.begin();
        auto const ae = accepted.end();
        std::sort(acceptTxid, ae);

        // We want to remove all tracking entries for transactions that were
        // accepted as well as those which match the predicate.

-        auto const i = removeIfIntersectOrMatch(
+        auto i = removeIfIntersectOrMatch(
            tracker_.begin(),
            tracker_.end(),
            accepted.begin(),
@@ -779,7 +779,7 @@ Consensus<Adaptor>::peerProposalInternal(

    {
        // update current position
-        auto const peerPosIt = currPeerPositions_.find(peerID);
+        auto peerPosIt = currPeerPositions_.find(peerID);

        if (peerPosIt != currPeerPositions_.end())
        {
@@ -1110,7 +1110,7 @@ Consensus<Adaptor>::checkLedger(std::unique_ptr<std::stringstream> const& clog)
 {
    CLOG(clog) << "checkLedger. ";

-    auto const netLgr = adaptor_.getPrevLedger(prevLedgerID_, previousLedger_, mode_.get());
+    auto netLgr = adaptor_.getPrevLedger(prevLedgerID_, previousLedger_, mode_.get());
    CLOG(clog) << "network ledgerid " << netLgr << ",  "
               << "previous ledger " << prevLedgerID_ << ". ";

@@ -1159,8 +1159,8 @@ Consensus<Adaptor>::phaseOpen(std::unique_ptr<std::stringstream> const& clog)

    // it is shortly before ledger close time
    bool const anyTransactions = adaptor_.hasOpenTransactions();
-    auto const proposersClosed = currPeerPositions_.size();
-    auto const proposersValidated = adaptor_.proposersValidated(prevLedgerID_);
+    auto proposersClosed = currPeerPositions_.size();
+    auto proposersValidated = adaptor_.proposersValidated(prevLedgerID_);

    openTime_.tick(clock_.now());

@@ -1669,7 +1669,7 @@ Consensus<Adaptor>::haveConsensus(std::unique_ptr<std::stringstream> const& clog
    // CHECKME: should possibly count unacquired TX sets as disagreeing
    int agree = 0, disagree = 0;

-    auto const ourPosition = result_->position.position();
+    auto ourPosition = result_->position.position();

    // Count number of agreements/disagreements with our position
    for (auto const& [nodeId, peerPos] : currPeerPositions_)
@@ -1686,7 +1686,7 @@ Consensus<Adaptor>::haveConsensus(std::unique_ptr<std::stringstream> const& clog
            ++disagree;
        }
    }
-    auto const currentFinished = adaptor_.proposersFinished(previousLedger_, prevLedgerID_);
+    auto currentFinished = adaptor_.proposersFinished(previousLedger_, prevLedgerID_);

    JLOG(j_.debug()) << "Checking for TX consensus: agree=" << agree << ", disagree=" << disagree;

@@ -1812,7 +1812,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
               << ". ";
    JLOG(j_.debug()) << "createDisputes " << result_->txns.id() << " to " << o.id();

-    auto const differences = result_->txns.compare(o);
+    auto differences = result_->txns.compare(o);

    int dc = 0;

@@ -1826,7 +1826,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
            "xrpl::Consensus::createDisputes : has disputed transactions");

        TxT const tx = inThisSet ? result_->txns.find(txId) : o.find(txId);
-        auto const txID = tx.id();
+        auto txID = tx.id();

        if (result_->disputes.find(txID) != result_->disputes.end())
            continue;
@@ -1837,8 +1837,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
            tx,
            result_->txns.exists(txID),
            std::max(prevProposers_, currPeerPositions_.size()),
-            j_,
-        };
+            j_};

        // Update all of the available peer's votes on the disputed transaction
        for (auto const& [nodeId, peerPos] : currPeerPositions_)
@@ -145,26 +145,18 @@ struct ConsensusParms
    std::map<AvalancheState, AvalancheCutoff> const avalancheCutoffs{
        // {state, {time, percent, nextState}},
        // Initial state: 50% of nodes must vote yes
-        {
-            AvalancheState::Init,
-            {.consensusTime = 0, .consensusPct = 50, .next = AvalancheState::Mid},
-        },
+        {AvalancheState::Init,
+         {.consensusTime = 0, .consensusPct = 50, .next = AvalancheState::Mid}},
        // mid-consensus starts after 50% of the previous round time, and
        // requires 65% yes
-        {
-            AvalancheState::Mid,
-            {.consensusTime = 50, .consensusPct = 65, .next = AvalancheState::Late},
-        },
+        {AvalancheState::Mid,
+         {.consensusTime = 50, .consensusPct = 65, .next = AvalancheState::Late}},
        // late consensus starts after 85% time, and requires 70% yes
-        {
-            AvalancheState::Late,
-            {.consensusTime = 85, .consensusPct = 70, .next = AvalancheState::Stuck},
-        },
+        {AvalancheState::Late,
+         {.consensusTime = 85, .consensusPct = 70, .next = AvalancheState::Stuck}},
        // we're stuck after 2x time, requires 95% yes votes
-        {
-            AvalancheState::Stuck,
-            {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck},
-        },
+        {AvalancheState::Stuck,
+         {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck}},
    };

    /**
@@ -59,7 +59,7 @@ enum class ConsensusMode {
     * if we entered the round observing, but is used to indicate we did
     * have the wrongLedger at some point.
     */
-    SwitchedLedger,
+    SwitchedLedger
 };

 inline std::string
@@ -222,7 +222,7 @@ medianCloseOffset(ConsensusCloseTimes const& times)

    // Accumulate weight in time order; the first bin to reach halfWeight is
    // the (lower) weighted median. Returns true once that bin is found.
-    auto const step = [&](time_point t, std::int64_t w) {
+    auto step = [&](time_point t, std::int64_t w) {
        XRPL_ASSERT(tally < halfWeight, "xrpl::medianCloseOffset::step : median not yet found");
        tally += w;
        if (tally >= halfWeight)
@@ -267,7 +267,7 @@ enum class ConsensusState {
    No,       ///< We do not have consensus
    MovedOn,  ///< The network has consensus without us
    Expired,  ///< Consensus time limit has hard-expired
-    Yes,      ///< We have consensus along with the network
+    Yes       ///< We have consensus along with the network
 };

 /**
@@ -266,7 +266,7 @@ template <class Tx, class NodeId>
 void
 DisputedTx<Tx, NodeId>::unVote(NodeId const& peer)
 {
-    auto const it = votes_.find(peer);
+    auto it = votes_.find(peer);

    if (it != votes_.end())
    {
@@ -211,7 +211,7 @@ struct Node
    void
    erase(Node const* child)
    {
-        auto const it = std::ranges::find_if(
+        auto it = std::ranges::find_if(
            children, [child](std::unique_ptr<Node> const& curr) { return curr.get() == child; });
        XRPL_ASSERT(it != children.end(), "xrpl::Node::erase : valid input");
        std::swap(*it, children.back());
@@ -184,7 +184,7 @@ enum class ValStatus {
    /**
     * Multiple validations by a validator for different ledgers
     */
-    Conflicting,
+    Conflicting
 };

 inline std::string
@@ -366,7 +366,7 @@ private:
    removeTrie(std::scoped_lock<Mutex> const&, NodeID const& nodeID, Validation const& val)
    {
        {
-            auto const it = acquiring_.find(std::make_pair(val.seq(), val.ledgerID()));
+            auto it = acquiring_.find(std::make_pair(val.seq(), val.ledgerID()));
            if (it != acquiring_.end())
            {
                it->second.erase(nodeID);
@@ -375,7 +375,7 @@ private:
            }
        }
        {
-            auto const it = lastLedger_.find(nodeID);
+            auto it = lastLedger_.find(nodeID);
            if (it != lastLedger_.end() && it->second.id() == val.ledgerID())
            {
                trie_.remove(it->second);
@@ -443,7 +443,7 @@ private:
        // Clear any prior acquiring ledger for this node
        if (prior)
        {
-            auto const it = acquiring_.find(*prior);
+            auto it = acquiring_.find(*prior);
            if (it != acquiring_.end())
            {
                it->second.erase(nodeID);
@@ -455,7 +455,7 @@ private:
        checkAcquired(lock);

        std::pair<Seq, ID> const valPair{val.seq(), val.ledgerID()};
-        auto const it = acquiring_.find(valPair);
+        auto it = acquiring_.find(valPair);
        if (it != acquiring_.end())
        {
            it->second.insert(nodeID);
@@ -529,7 +529,7 @@ private:
            }
            else
            {
-                auto const cit = typename decltype(current_)::const_iterator{it};
+                auto cit = typename decltype(current_)::const_iterator{it};
                // contains a live record
                f(cit->first, cit->second);
                ++it;
@@ -554,7 +554,7 @@ private:
    void
    byLedger(std::scoped_lock<Mutex> const&, ID const& ledgerID, Pre&& pre, F&& f)
    {
-        auto const it = byLedger_.find(ledgerID);
+        auto it = byLedger_.find(ledgerID);
        if (it != byLedger_.end())
        {
            // Update set time since it is being used
@@ -857,7 +857,7 @@ public:
        if (!preferred)
        {
            // fall back to majority over acquiring ledgers
-            auto const it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
+            auto it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
                std::pair<Seq, ID> const& aKey = a.first;
                typename HashSet<NodeID>::size_type const& aSize = a.second.size();
                std::pair<Seq, ID> const& bKey = b.first;
@@ -937,7 +937,7 @@ public:
            return (preferred->first >= minSeq) ? preferred->second : lcl.id();

        // Otherwise, rely on peer ledgers
-        auto const it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
+        auto it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
            // Prefer larger counts, then larger ids on ties
            // (max_element expects this to return true if a < b)
            return std::tie(a.second, a.first) < std::tie(b.second, b.first);
@@ -156,7 +156,7 @@ public:
        {
            if (!allClosuresDoneCond_.wait_for(lock, wait, [this] { return closureCount_ == 0; }))
            {
-                if (auto const stream = j.error())
+                if (auto stream = j.error())
                    stream << name << " waiting for ClosureCounter::join().";
                allClosuresDoneCond_.wait(lock, [this] { return closureCount_ == 0; });
            }
@@ -54,7 +54,7 @@ JobQueue::Coro::post()
    }

    // sp keeps 'this' alive
-    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()] { resume(); }))
+    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()]() { resume(); }))
    {
        return true;
    }
@@ -130,7 +130,7 @@ inline void
 JobQueue::Coro::join()
 {
    std::unique_lock<std::mutex> lk(mutexRun_);
-    cv_.wait(lk, [this] { return !running_; });
+    cv_.wait(lk, [this]() { return !running_; });
 }

 }  // namespace xrpl
Author	SHA1	Message	Date
Mayukha Vadari	16389dcb2e	refactor: Move decreaseOwnerCount onto AccountRootEntry Replace the entry-taking decreaseOwnerCount free function with a writable member of AccountRootEntry, and drop the temporary friend declaration from the previous change. The member uses the entry's view and journal, so call sites pass their journal to the entry constructor. The AccountID-based overload stays as a shim.	2026-10-05 15:46:48 +01:00
Mayukha Vadari	97a780b29f	refactor: Move increaseOwnerCount onto AccountRootEntry Replace both entry-taking increaseOwnerCount free functions with writable members of AccountRootEntry. The members use the entry's view and journal, so call sites pass their journal to the entry constructor. The AccountID-based overload stays as a shim. adjustOwnerCountSigned becomes a private member. decreaseOwnerCount is a temporary friend so it can still call it until it moves too. adjustOwnerCountImpl moves to namespace detail, because adjustLoanBrokerOwnerCount also uses it.	2026-10-05 15:46:44 +01:00
Mayukha Vadari	654edc9a08	refactor: Move checkReserve onto AccountRootEntry Replace both entry-taking checkReserve free functions with const members of AccountRootEntry. The members keep the ApplyViewContext parameter, because the check needs the transaction, and drop the journal parameter: call sites pass their journal to the entry constructor instead.	2026-10-05 15:46:39 +01:00
Mayukha Vadari	658d04f694	Document confineOwnerCount parameters	2026-10-05 15:46:31 +01:00
Mayukha Vadari	93498952b1	refactor: Move ownerCount onto AccountRootEntry Replace the entry-taking ownerCount(sle, j, adj) free function with the const member AccountRootEntry::ownerCount(adj). The member uses the entry's journal, so call sites pass their journal to the entry constructor. confineOwnerCount moves from the anonymous namespace to namespace detail, because both the member and the owner-count helpers use it.	2026-10-05 15:45:43 +01:00
Mayukha Vadari	269f79e568	Include Keylet.h in the SLEBase test (cherry picked from commit `3cca9d3266`)	2026-10-05 15:45:38 +01:00
Mayukha Vadari	e7a8e0336a	test: Drop extern template declarations from SLEBase test An explicit instantiation declaration stops clang from emitting the inline constructors of the header-only entries at -O0, so the debug builds fail to link xrpl_tests (undefined AccountRootEntry constructors). Naming each class in a static_assert already instantiates its definition, which is all the exhaustiveness check needs. (cherry picked from commit `611415e1f9`)	2026-10-05 15:45:38 +01:00
Mayukha Vadari	1d7e40777a	refactor: Move accountReserve onto AccountRootEntry Replace the entry-taking accountReserve(view, sle, j, adj) free function with the const member AccountRootEntry::reserve(adj). The member uses the entry's own view and journal, so call sites now pass their journal to the entry constructor. The AccountID-based accountReserve overload stays as a one-line shim. Adjustment moves to AccountRootEntry.h, since the member takes it. accountCountImpl moves from the anonymous namespace to namespace detail, because both reserve() and xrpLiquid() use it.	2026-10-05 15:45:38 +01:00
Mayukha Vadari	7bb43a243b	test: Declare, not define, entry instantiations in SLEBase test The exhaustive per-entry-type check in the SLEBase gtest used explicit instantiation definitions. Once an entry class gets out-of-line member bodies in its own .cpp (with the explicit instantiation definition there), the test would instantiate the class a second time, and MSVC rejects it with C4661 because those member bodies are not visible in the test translation unit. Explicit instantiation declarations still instantiate the class definition, which is all the check needs. (cherry picked from commit `8b07abc3cd`)	2026-10-05 15:45:37 +01:00
Mayukha Vadari	d697b7843c	Document escrowDestNotAccountResult and isPseudoAccountSle parameters and return value	2026-10-05 15:45:24 +01:00
Mayukha Vadari	2de5140f20	Drop unused include from SponsorshipTransfer.cpp	2026-10-05 13:33:31 +01:00
Mayukha Vadari	edf085a697	Declare canWithdraw with AccountRootEntryR in View.h	2026-10-05 13:33:31 +01:00
Mayukha Vadari	c35ac1339b	fix: Do not adopt the escrow SLE into an AccountRootEntry Before fixCleanup3_2_0, EscrowCancel passes the escrow SLE to escrowUnlockApplyHelper as sleDest. Wrapping it in AccountRootEntryR fires the "adopted SLE matches bound entry type" assertion in Debug builds (xrpl.app.EscrowToken "IOU Cancel DoApply"). When sleDest is not an AccountRoot, return what the old code returned for it: the tx reserve sponsor's error if the escrow owner submitted the tx, else tefINTERNAL from checkReserve's type check. (cherry picked from commit `90bb3930be`)	2026-10-05 13:33:31 +01:00
Mayukha Vadari	dc1cfbc474	Drop unused include from AccountRootHelpers.h	2026-10-05 13:33:30 +01:00
Mayukha Vadari	3044073401	refactor: Use AccountRootEntry everywhere Replace raw AccountRoot SLE pointers with the AccountRootEntryR and AccountRootEntryW wrappers in src/libxrpl and src/xrpld/app. - view.read(keylet::account(...)) becomes AccountRootEntryR and view.peek(keylet::account(...)) becomes AccountRootEntryW. - AccountRoot helpers (accountReserve, checkReserve, ownerCount, increase/decreaseOwnerCount, isPseudoAccount, checkDestinationAndTag) and the sponsor helpers (getTxReserveSponsor, getEffectiveTxReserveSponsor, getLedgerEntryReserveSponsor) take or return the wrappers. A missing sponsor is std::nullopt instead of a null pointer. - Generic functions that are not migrated yet (trustCreate, dirLink, addSponsorToLedgerEntry, ...) get rawSle() or mutableRawSle(). - Invariant checks cannot build a view-bound entry, so they use isPseudoAccountSle(), now declared in InvariantCheck.h. This changes pointers only. No helper moves onto the wrapper. It is a pure refactor with no behavior change and no amendment.	2026-10-05 13:33:30 +01:00