fix: Count a duplicate as an answer when timing out a TX-set acquire

takeNodes() recorded progress only for a batch that hooked a node in, so a
batch of nodes already held recorded none. trigger() sends to every peer it is
given, so on a fan-out whichever peer loses the race sends exactly such a batch,
and onTimer() then treats a set that is plainly being answered as stalled. A
duplicate now counts alongside a node hooked in, bounded to a peer already
asked and to an acquisition still running.

gotData() also deserializes a whole node list, at a hash apiece, before
takeNodes() can tell it the set is already settled and the result will be
discarded. wantsReplyFrom() moves that decision ahead of the parse, and the
late-reply allowance moves with it into chargeLateReply(), shared with
takeNodesLocked() so a reply is charged exactly once whichever site sees it.

TransactionAcquire_test covers the fan-out case, both bounds, and the parse
order, which is observable through the fee tier. One existing assertion in
testPartialBatchIsCounted is inverted: it pinned the behavior this changes.

.cspell.config.yaml

@@ -102,6 +102,7 @@ words:
   - dearmor
   - decryptor
   - dedented
+  - dedup
   - deleteme
   - demultiplexer
   - deserializaton
@@ -341,12 +342,15 @@ words:
   - unambiguity
   - unauthorizes
   - unauthorizing
+  - undeserializable
   - unergonomic
   - unfetched
   - unfindable
   - unflatten
   - unfund
   - unimpair
+  - unjudged
+  - unpersistable
   - unroutable
   - unscalable
   - unserviced
@@ -366,6 +370,7 @@ words:
   - venv
   - vfalco
   - vinnie
+  - vkeylet
   - wasmi
   - wextra
   - wptr

.github/actions/setup-nix-env/action.yml

@@ -40,11 +40,10 @@ runs:
         # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
         # own trust store, and pinning would break TLS to hosts relying on it.
 
-        # In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
-        # prepare-runner hands the system toolchain - but under its own name:
-        # that Conan is a different version, and the two would migrate each
-        # other's cache.
-        echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
+        # Workspace-local, so `cleanup-workspace` clears it, but not the
+        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
+        # different version, and the two would migrate each other's cache.
+        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
 
     # Config, profiles and remote, exactly as the dev shell sets them up on
     # entry; the `setup-conan` action is skipped for this toolchain.

.github/pull_request_template.md

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
 If there is a relevant task or issue, please link it here.
 -->
 
-## Context of Change
+### Context of Change
 
 <!--
 Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
 If there is a spec or design document for this feature, please link it here.
 -->
 
-## API Impact
+### API Impact
 
 <!--
 Please check [x] relevant options, delete irrelevant ones.

.github/scripts/levelization/results/ordering.txt

@@ -62,6 +62,7 @@ libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
+test.app > tests.libxrpl
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-060957e",
+  "image_tag": "sha-473fe44",
   "configs": {
     "ubuntu": [
       {
@@ -74,7 +74,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-b6a8995"
         }
       }
     ],
@@ -88,7 +88,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-49cdc10"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-b6a8995"
         }
       }
     ]

.github/workflows/build-nix-images.yml

@@ -5,13 +5,15 @@ on:
     branches:
       - develop
     paths:
+      - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
       - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/**"
+      - "!nix/check-tools/*.txt"
+      - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   pull_request:
@@ -23,7 +25,7 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/**"
+      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
@@ -58,7 +60,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -41,7 +41,7 @@ jobs:
           # AlmaLinux rather than UBI, which does not ship rpm-sign.
           - name: rhel
             base_image: almalinux:10
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
       dockerfile: package/docker/Dockerfile

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
     with:
       runs_on: ubuntu-latest
       container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 

.github/workflows/reusable-clang-tidy.yml

@@ -34,7 +34,7 @@ jobs:
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-473fe44"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/reusable-package.yml

@@ -1,14 +1,11 @@
-# Build, verify and publish Linux packages from the pre-built xrpld and
-# validator-keys artifacts, in three stages:
+# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
 #
-#   - 'package' builds and signs one format per config that carries a "package"
-#     map in linux.json; that map names the container image and the format
-#   - 'test-install' installs what was built on a range of distros and runs the
-#     binaries there, so a package that cannot be installed never reaches Nexus
-#   - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
-#     unless 'publish: true'
+#   - one job per config that carries a "package" map in linux.json
+#   - that map names the container image and the format it builds there
+#   - every job ends with the image's publish_pkg.py, uploading what it built
+#     with 'publish: true' and doing a --dry-run otherwise
 #
-# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
+# Only linux/amd64 is supported; the runner is hardcoded in the job below.
 name: Package
 
 on:
@@ -42,7 +39,6 @@ defaults:
 
 env:
   BUILD_DIR: build
-  PACKAGE_DIR: packages
 
 jobs:
   generate-matrix:
@@ -74,14 +70,14 @@ jobs:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
     container: ${{ matrix.image }}
-    timeout-minutes: 10
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 
@@ -116,184 +112,24 @@ jobs:
               --pkg-release "${PKG_RELEASE}" \
               --channel "${CHANNEL}"
 
-      # Before the upload, so the artifact, the tested package and the published
-      # package are the same bytes.
+      # Before the upload, so the artifact and the published package are the
+      # same bytes. DEBs are not signed, so the key is never set on that job.
       - name: Sign RPM
         if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
         env:
           PKG_SIGNING_KEY: ${{ secrets.signing_key }}
         run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
 
-      # Split from the debug symbols, which are an order of magnitude larger, so
-      # that test-install downloads only what it installs.
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}-pkg
           path: |
-            ${{ env.BUILD_DIR }}/debbuild/xrpld_*.deb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-[0-9]*.rpm
+            ${{ env.BUILD_DIR }}/debbuild/*.deb
+            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
           if-no-files-found: error
 
-      - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
-          path: |
-            ${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.deb
-            ${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.ddeb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-debuginfo-*.rpm
-          if-no-files-found: error
-
-  # Every distro family the packages target, oldest release first, so both ends
-  # of the dependency range they declare are exercised.
-  test-install:
-    needs: [package]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - package_type: deb
-            image: debian:11
-          - package_type: deb
-            image: debian:12
-          - package_type: deb
-            image: debian:13
-          - package_type: deb
-            image: ubuntu:20.04
-          - package_type: deb
-            image: ubuntu:22.04
-          - package_type: deb
-            image: ubuntu:24.04
-          - package_type: deb
-            image: ubuntu:26.04
-
-          - package_type: rpm
-            image: almalinux:9
-          - package_type: rpm
-            image: almalinux:10
-          - package_type: rpm
-            image: rockylinux/rockylinux:9
-          - package_type: rpm
-            image: rockylinux/rockylinux:10
-          - package_type: rpm
-            image: registry.access.redhat.com/ubi9/ubi
-          - package_type: rpm
-            image: registry.access.redhat.com/ubi10/ubi
-    name: "install ${{ matrix.package_type }} on ${{ matrix.image }}"
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    container: ${{ matrix.image }}
-    timeout-minutes: 5
-
-    steps:
-      # Both formats land in one directory; the step below picks its own by
-      # extension, so this stays independent of the artifact names.
-      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: "*-pkg"
-          merge-multiple: true
-          path: ${{ env.PACKAGE_DIR }}
-
-      - name: Find the package
-        id: find
-        env:
-          PACKAGE_TYPE: ${{ matrix.package_type }}
-        run: |
-          package="$(find "${PACKAGE_DIR}" -type f -name "*.${PACKAGE_TYPE}" -print -quit)"
-          test -n "${package}" || {
-              echo "no .${PACKAGE_TYPE} found in ${PACKAGE_DIR}" >&2
-              exit 1
-          }
-          echo "package=${package}" >>"${GITHUB_OUTPUT}"
-
-      # Debian 11 went end-of-life on 2026-08-31
-      # (https://www.debian.org/News/2026/20260831) and its packages are
-      # already partly gone from deb.debian.org, so switch to the
-      # snapshot.debian.org entries the image ships commented out in its
-      # sources.list: they are pinned to the snapshot the image was built
-      # from, so they serve every version it needs and never go away.
-      # Snapshots keep their original, long-passed Valid-Until, hence the
-      # disabled check; the retries absorb snapshot.debian.org's throttling.
-      - name: Switch Debian 11 to snapshot.debian.org
-        if: ${{ matrix.image == 'debian:11' }}
-        run: |
-          sed -i 's|^deb |# deb |; s|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list
-          printf '%s\n' \
-              'Acquire::Check-Valid-Until "false";' \
-              'Acquire::Retries "3";' \
-              >/etc/apt/apt.conf.d/99snapshot
-
-      - name: Install the DEB
-        if: ${{ matrix.package_type == 'deb' }}
-        env:
-          DEBIAN_FRONTEND: noninteractive
-          PACKAGE: ${{ steps.find.outputs.package }}
-        run: |
-          # Stock Debian and Ubuntu images carry no package lists, so apt has
-          # nothing to resolve the systemd dependency from until it fetches them.
-          apt-get update -qq
-          apt-get install -y "./${PACKAGE}"
-
-      - name: Install the RPM
-        if: ${{ matrix.package_type == 'rpm' }}
-        env:
-          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y "./${PACKAGE}"
-
-      - name: Run xrpld
-        run: xrpld --version
-
-      - name: Run validator-keys
-        run: validator-keys --version
-
-      - name: Run rippled, the legacy compatibility symlink
-        run: rippled --version
-
-      - name: Check the service account
-        run: id xrpld
-
-      - name: Check the state directory
-        run: test -d /var/lib/xrpld
-
-      - name: Check the log directory
-        run: test -d /var/log/xrpld
-
-  publish:
-    needs: [generate-matrix, package, test-install]
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    name: "publish ${{ matrix.xrpld_artifact_name }}"
-    permissions:
-      contents: read
-    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: ${{ matrix.image }}
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
-      # Both artifacts, so the debug symbols are published alongside the package.
-      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
-          merge-multiple: true
-          path: ${{ env.PACKAGE_DIR }}
-
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
-
       - name: Publish package
         env:
           CHANNEL: ${{ steps.release_info.outputs.channel }}
@@ -304,6 +140,6 @@ jobs:
         run: |
           publish_pkg.py \
               --channel "${CHANNEL}" \
-              --package-dir "${PACKAGE_DIR}" \
+              --package-dir "${BUILD_DIR}" \
               --nexus-url "${NEXUS_URL}" \
               ${DRY_RUN_OPTION}

.github/workflows/reusable-rust.yml

@@ -1,9 +1,8 @@
 # Clippy, coverage and documentation for the Rust crates in crates/. Each runs
 # as an independent job on a GitHub-hosted runner, but inside the same container
 # image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints and the cargo cache) matches what production builds
-# use. Coverage is the exception: it needs the nightly rustc that honours
-# #[coverage(off)], which the image carries alongside the pinned stable.
+# (and therefore the lints, coverage instrumentation and the cargo cache) matches
+# what production builds use.
 #
 # Rust unit tests are deliberately NOT run here. They run as part of the C++
 # build (reusable-build-test-config.yml), which already compiles the crates on a
@@ -28,7 +27,7 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,14 +40,11 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Use the nightly Rust toolchain
-        run: rust-nightly path >>"${GITHUB_PATH}"
-
       - name: Use cargo artifacts cache
         uses: ./.github/actions/cargo-cache
 
@@ -70,7 +66,7 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -50,7 +50,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.gitignore

@@ -72,16 +72,11 @@ DerivedData
 /.zed/
 
 # AI tools.
-# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
-# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
-# personal/local variants below are ignored.
 /.agent
 /.agents
 /.augment
-/.claude/settings.local.json
-AGENTS.override.md
-CLAUDE.local.md
-GEMINI.local.md
+/.claude
+/CLAUDE.md
 
 # Python
 __pycache__

.pre-commit-config.yaml

@@ -70,11 +70,6 @@ repos:
         language: system
         types: [rust]
         pass_filenames: false # rustfmt formats the whole workspace
-      - id: check-coverage-attrs
-        name: check Rust coverage attributes
-        entry: ./bin/pre-commit/check_rust_coverage_attrs.py
-        language: python
-        files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7

AGENTS.md

@@ -1,42 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
-
-## Build
-
-Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
-
-```bash
-nix develop
-```
-
-For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
-
-Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
-
-## Testing
-
-Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
-
-- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
-- `--unittest-arg` does nothing — don't use it.
-- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
-- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
-
-## Lint/Format
-
-See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
-
-## Code Style
-
-New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
-
-## Architecture
-
-Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
-
-- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
-- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
-- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
-- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
-- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

API-CHANGELOG.md

@@ -22,48 +22,17 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## XRP Ledger server version 3.4.0
+## Unreleased
 
-Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
+This section contains changes targeting a future version.
 
-### Additions in 3.4.0
+### Additions
 
-- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
-
-### Bugfixes in 3.4.0
-
-- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
-- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
-- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
-- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
-- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
-- `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
-
-## XRP Ledger server version 3.3.0
-
-[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
-
-### Additions in 3.3.0
-
-- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
-
-## XRP Ledger server version 3.2.1
-
-[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.2.0
-
-[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
-
-### Additions in 3.2.0
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
+  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
 
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
+
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
   - `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
   - `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -71,8 +40,9 @@ This release contains bug fixes only and no API changes.
   - `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
   - `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
 
-### Bugfixes in 3.2.0
+### Bugfixes
 
+- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -84,24 +54,11 @@ This release contains bug fixes only and no API changes.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
-
-## XRP Ledger server version 3.1.3
-
-[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.1.2
-
-[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.1.1
-
-[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
-
-This release contains bug fixes only and no API changes.
+- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 
 ## XRP Ledger server version 3.1.0
 

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

CONTRIBUTING.md

@@ -59,17 +59,6 @@ to an existing XLS. Neither change will be released (in an amendment's
 case, marked as `Supported::yes`) until the corresponding XLS's status
 is `Final`.
 
-## AI coding agents
-
-[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
-
-If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
-
-- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
-- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
-
-Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
-
 ## Before making a pull request
 
 (Or marking a draft pull request as ready.)
@@ -93,7 +82,7 @@ If you create new source files, they must be organized as follows:
   under `include/xrpl`, and source (`.cpp`) files must go under
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
-- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
+- All test source files must go under `src/test`.
 - All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest

bin/check-tools.sh

@@ -158,7 +158,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-nextest cargo nextest --version
     check clippy-driver
     check rust-analyzer
-    check rust-nightly rust-nightly run rustc --version
     check rustc
     check rustfmt
 fi

bin/install-packaging-tools.sh

@@ -25,9 +25,7 @@ esac
 # Packaging runs in a vanilla distro image, so the tooling comes from the distro's
 # archive rather than from nixpkgs:
 #
-#   - debhelper and dpkg-dev build the DEB, and lintian checks it
-#   - binutils gives debian/rules the readelf its glibc-floor check runs; it
-#     already arrives via dpkg-dev, but that tool is called directly
+#   - debhelper and dpkg-dev build the DEB
 #   - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
 #     supplying the systemd and find-debuginfo macros the spec uses
 #   - rpm-sign and gnupg2 sign the built RPM
@@ -39,13 +37,11 @@ function install() {
         debian | ubuntu)
             apt-get update -y
             apt-get install -y --no-install-recommends \
-                binutils \
                 ca-certificates \
                 debhelper \
                 debhelper-compat \
                 dpkg-dev \
                 git \
-                lintian \
                 python3
             ;;
 

bin/pre-commit/check_rust_coverage_attrs.py

@@ -1,149 +0,0 @@
-#!/usr/bin/env python3
-"""
-Check that Rust unit tests stay out of the coverage report.
-
-cargo-llvm-cov instruments the test code along with everything else, so a test
-module that is not excluded counts its own body as covered and inflates the
-reported number. Excluding it takes two attributes:
-
-  * every `#[cfg(test)]` module carries
-    `#[cfg_attr(coverage_nightly, coverage(off))]`;
-  * every crate root (lib.rs, main.rs) carries
-    `#![cfg_attr(coverage_nightly, feature(coverage_attribute))]`, which the
-    attribute above needs in order to compile.
-
-Both are inert outside the coverage job: cargo-llvm-cov defines
-`coverage_nightly` only when it runs on a nightly toolchain.
-
-The crate-root gate is checked even in a crate that has no tests yet, because
-that is what lets the first test module added later carry the attribute without
-a build failure. Missing it is a hard error, so it cannot go unnoticed; a
-missing `coverage(off)` fails open, which is why this check exists.
-
-Matching is on exact attribute text, which works because `cargo fmt` runs over
-the whole workspace in the hook ahead of this one: rustfmt puts every attribute
-on its own line and normalizes what is inside it, turning `#[cfg( test )]`
-and `#[cfg(test,)]` alike into `#[cfg(test)]`. So there is nothing here that
-parses Rust. The price is that a cfg this file does not spell out literally --
-`all(test, ...)`, `any(test, ...)`, `not(test)` -- is reported rather than
-classified, on the grounds that guessing at coverage semantics is how a check
-like this ends up quietly wrong.
-
-Usage: ./bin/pre-commit/check_rust_coverage_attrs.py <file1> <file2> ...
-
-Exit status is non-zero if any violation is found.
-"""
-
-import re
-import sys
-from dataclasses import dataclass
-from pathlib import Path
-
-CRATE_ROOTS = {"lib.rs", "main.rs"}
-
-FEATURE_ATTR = "#![cfg_attr(coverage_nightly, feature(coverage_attribute))]"
-COVERAGE_OFF_ATTR = "#[cfg_attr(coverage_nightly, coverage(off))]"
-CFG_TEST_ATTR = "#[cfg(test)]"
-
-# Any other cfg that mentions `test`. String literals are blanked before this
-# runs, so `feature = "test"` does not read as the `test` cfg.
-RE_CFG_MENTIONS_TEST = re.compile(r"^#\[cfg\(.*\btest\b.*\)\]$")
-RE_STRING = re.compile(r'"(?:[^"\\]|\\.)*"')
-RE_MOD = re.compile(r"^(?:pub(?:\([^)]*\))?\s+)?mod\s+([A-Za-z_]\w*)")
-
-
-@dataclass(frozen=True)
-class Finding:
-    line: int
-    label: str
-    message: str
-
-
-def _check_module(attrs: list[str], line: int, name: str) -> list[Finding]:
-    """Findings for one module, given the attributes attached to it."""
-    if COVERAGE_OFF_ATTR in attrs:
-        return []  # excluded from coverage; which cfg gates it does not matter
-    if CFG_TEST_ATTR in attrs:
-        return [
-            Finding(
-                line,
-                "missing-coverage-off",
-                f"`mod {name}` is #[cfg(test)] but not excluded from coverage; "
-                f"add {COVERAGE_OFF_ATTR}",
-            )
-        ]
-    unclassified = [
-        attr for attr in attrs if RE_CFG_MENTIONS_TEST.match(RE_STRING.sub('""', attr))
-    ]
-    if unclassified:
-        return [
-            Finding(
-                line,
-                "unclassified-cfg",
-                f"`mod {name}` is gated on {unclassified[0]}, which this check "
-                f"cannot tell apart from a module that ships in the library; "
-                f"add {COVERAGE_OFF_ATTR} if it is test-only, or teach this "
-                f"check the cfg if it is not",
-            )
-        ]
-    return []
-
-
-def _check_test_modules(lines: list[str]) -> list[Finding]:
-    """Findings for every test module that is not excluded from coverage."""
-    findings: list[Finding] = []
-    attrs: list[str] = []
-    attrs_line = 0
-    for number, raw in enumerate(lines, start=1):
-        stripped = raw.strip()
-        # Blank lines and comments are allowed between an attribute and its item.
-        if not stripped or stripped.startswith("//"):
-            continue
-        if stripped.startswith("#["):
-            if not attrs:
-                attrs_line = number
-            attrs.append(stripped)
-            continue
-        module = RE_MOD.match(stripped)
-        if module is not None and attrs:
-            findings += _check_module(attrs, attrs_line, module.group(1))
-        attrs = []
-    return findings
-
-
-def _check_crate_root(name: str, lines: list[str]) -> list[Finding]:
-    """A finding if a crate root is missing the coverage_attribute feature gate."""
-    if name not in CRATE_ROOTS:
-        return []
-    if any(line.strip() == FEATURE_ATTR for line in lines):
-        return []
-    return [
-        Finding(
-            1,
-            "missing-feature-gate",
-            f"crate root is missing {FEATURE_ATTR}",
-        )
-    ]
-
-
-def check_source(name: str, text: str) -> list[Finding]:
-    """Findings for one file's contents; `name` is its base name (lib.rs, ...)."""
-    lines = text.splitlines()
-    return _check_crate_root(name, lines) + _check_test_modules(lines)
-
-
-def check_file(path: Path) -> list[Finding]:
-    return check_source(path.name, path.read_text(encoding="utf-8"))
-
-
-def main() -> int:
-    total = 0
-    for path in (Path(name) for name in sys.argv[1:]):
-        for finding in check_file(path):
-            total += 1
-            print(f"{path}:{finding.line}: {finding.label}: {finding.message}")
-    return 1 if total else 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

cmake/XrplSanitizers.cmake

@@ -77,19 +77,24 @@ if(is_clang)
     message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()
 
-# Define SANITIZERS macro for BuildInfo.cpp
+# Define SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN/XRPL_TSAN/XRPL_UBSAN per
+# active sanitizer, so other code can test for a specific one with #ifdef instead of parsing
+# the dot-joined SANITIZERS string.
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
     set(enable_asan ON)
     list(APPEND sanitizers_list "ASAN")
+    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
     set(enable_tsan ON)
     list(APPEND sanitizers_list "TSAN")
+    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
     set(enable_ubsan ON)
     list(APPEND sanitizers_list "UBSAN")
+    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()
 
 if(sanitizers_list)

crates/Cargo.toml

@@ -8,9 +8,6 @@ cxx = { version = "1.0.198", features = ["c++20"] }
 [workspace.package]
 edition = "2024"
 
-[workspace.lints.rust]
-unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage_nightly)' ] }
-
 [profile.release]
 opt-level = 3
 overflow-checks = true

crates/hello_world/Cargo.toml

@@ -8,6 +8,3 @@ crate-type = ["staticlib"]
 
 [dependencies]
 cxx.workspace = true
-
-[lints]
-workspace = true

crates/hello_world/src/lib.rs

@@ -1,5 +1,3 @@
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
 #[cxx::bridge(namespace = "rs::hello_world")]
 mod ffi {
     extern "Rust" {
@@ -10,14 +8,3 @@ mod ffi {
 pub fn hello_world() -> String {
     "hello_world".to_string()
 }
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn hello_world_returns_hello_world() {
-        assert_eq!(hello_world(), "hello_world")
-    }
-}

include/xrpl/core/HashRouter.h

@@ -34,10 +34,7 @@ enum class HashRouterFlags : std::uint16_t {
     PRIVATE4 = 0x0800,
     // Used in EscrowFinish.cpp
     PRIVATE5 = 0x1000,
-    PRIVATE6 = 0x2000,
-    // Used in apply.cpp
-    PRIVATE7 = 0x4000,
-    PRIVATE8 = 0x8000
+    PRIVATE6 = 0x2000
 };
 
 constexpr HashRouterFlags

include/xrpl/ledger/Ledger.h

@@ -257,13 +257,43 @@ public:
         header_.validated = true;
     }
 
-    void
+    /**
+     * Mark this ledger as accepted and attempt to make it immutable.
+     *
+     * The close-time fields are recorded before the maps are settled, since the
+     * ledger hash covers them.
+     *
+     * @param closeTime The consensus-agreed close time.
+     * @param closeResolution The close time resolution.
+     * @param correctCloseTime Whether consensus agreed on the close time; if
+     *        false, kSLcfNoConsensusTime is recorded in closeFlags instead.
+     * @return What setImmutable() returned, so false means the ledger must be
+     *         discarded rather than retried.
+     */
+    [[nodiscard]] bool
     setAccepted(
         NetClock::time_point closeTime,
         NetClock::duration closeResolution,
         bool correctCloseTime);
 
-    void
+    /**
+     * Mark this ledger as immutable, so it can no longer be modified.
+     *
+     * A locally built or loaded ledger can never fail this call: only a map
+     * syncing against externally supplied hashes can become Invalid (see
+     * SHAMap::addKnownNode). A ledger assembled from peer data can fail it;
+     * there, false is an expected outcome, not an internal invariant break.
+     *
+     * @param rehash Whether to recompute the ledger hash from the header
+     *        fields. The transaction and account hashes are recomputed from
+     *        the maps too, but only the first time and only if the header
+     *        did not supply them.
+     * @return false if either map is Invalid, leaving the immutable flag
+     *         unset and the header untouched. A map invalidated partway
+     *         through can still leave the other one immutable, so false means
+     *         the ledger must be discarded rather than retried.
+     */
+    [[nodiscard]] bool
     setImmutable(bool rehash = true);
 
     bool
@@ -272,23 +302,38 @@ public:
         return immutable_;
     }
 
-    /*  Mark this ledger as "should be full".
+    /**
+     * Whether neither map has been found invalid.
+     *
+     * Read by whatever assembles the ledger, which cannot tell a map that
+     * is merely incomplete from one that has been abandoned by looking at
+     * what a walk returned. See SHAMap::isValid().
+     *
+     * @return Whether both maps can still be the maps the header names.
+     */
+    [[nodiscard]] bool
+    mapsValid() const
+    {
+        return txMap_.isValid() && stateMap_.isValid();
+    }
 
-        "Full" is metadata property of the ledger, it indicates
-        that the local server wants all the corresponding nodes
-        in durable storage.
-
-        This is marked `const` because it reflects metadata
-        and not data that is in common with other nodes on the
-        network.
-    */
+    /**
+     * Mark this ledger as "should be full", indicating that the local server
+     * wants all the corresponding nodes in durable storage.
+     *
+     * Const because it reflects metadata, not data this ledger shares with
+     * other nodes on the network.
+     */
     void
     setFull() const
     {
-        txMap_.setFull();
+        // Sequence before flag, per map: setLedgerSeq() stores relaxed and setFull() stores
+        // release, so only this order publishes the sequence to SHAMap::finishFetch(), which
+        // reads it after winning the exchange on the flag.
         txMap_.setLedgerSeq(header_.seq);
-        stateMap_.setFull();
+        txMap_.setFull();
         stateMap_.setLedgerSeq(header_.seq);
+        stateMap_.setFull();
     }
 
     void
@@ -418,8 +463,37 @@ private:
     static std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
     deserializeTxPlusMeta(SHAMapItem const& item);
 
+    /**
+     * Make both maps immutable, without short-circuiting.
+     *
+     * A concurrent walk can invalidate one map after the other is settled,
+     * so both calls are always made rather than one guarding the other:
+     * each map becomes Immutable or stays Invalid on its own, and neither
+     * is left mid-sync because the other refused.
+     *
+     * @return Whether both maps are immutable.
+     */
+    [[nodiscard]] bool
+    setMapsImmutable()
+    {
+        bool const txImmutable = txMap_.setImmutable();
+        bool const stateImmutable = stateMap_.setImmutable();
+        return txImmutable && stateImmutable;
+    }
+
     bool immutable_;
 
+    /**
+     * Whether the header's transaction and account hashes came from outside and
+     * so must not be derived from the maps.
+     *
+     * True only for a ledger built from a header, whose maps are then
+     * synced against the hashes it carries. Deriving them would turn a
+     * ledger verified against a hash we asked for into one that is merely
+     * self-consistent. Fixed at construction, unlike immutable_.
+     */
+    bool const mapHashesFromHeader_ = false;
+
     // A SHAMap containing the transactions associated with this ledger.
     SHAMap mutable txMap_;
 

include/xrpl/ledger/helpers/CredentialHelpers.h

@@ -14,6 +14,7 @@
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/TER.h>
 
+#include <cstdint>
 #include <memory>
 #include <set>
 #include <utility>
@@ -33,6 +34,32 @@ checkExpired(SLE const& sleCredential, NetClock::time_point const& closed);
 [[nodiscard]] TER
 deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j);
 
+/**
+ * @brief Remove credentials pinned to a pseudo-account's owner directory.
+ *
+ * Cleans up credentials that were linked to a pseudo-account (Vault, LoanBroker,
+ * AMM), which such an account can neither accept nor delete. Only credentials
+ * are removed; every other object is left in place. The walk visits at most
+ * @p maxNodesToDelete directory entries and charges the ones it leaves alone
+ * against that budget too, so a directory holding other objects yields fewer
+ * than @p maxNodesToDelete deletions. On reaching the bound the result is
+ * `tecINCOMPLETE` and the caller must propagate it so a later transaction
+ * resumes.
+ *
+ * @param view Mutable ledger view.
+ * @param pseudoAcct The pseudo-account whose directory is cleaned.
+ * @param maxNodesToDelete Upper bound on directory entries processed in one call.
+ * @param j Journal for diagnostics.
+ * @return tesSUCCESS once no credentials remain, tecINCOMPLETE if the bound was
+ *         reached, or a deletion error.
+ */
+[[nodiscard]] TER
+deletePseudoAccountCredentials(
+    ApplyView& view,
+    AccountID const& pseudoAcct,
+    std::uint16_t maxNodesToDelete,
+    beast::Journal j);
+
 // Amendment and parameters checks for sfCredentialIDs field
 NotTEC
 checkFields(STTx const& tx, Rules const& rules, beast::Journal j);

include/xrpl/ledger/helpers/RippleStateHelpers.h

@@ -239,13 +239,8 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
 //------------------------------------------------------------------------------
 
 /**
- * XRP and the issuer itself are always tesSUCCESS. Otherwise, after
- * fixCleanup3_4_0, an existing trust line returns tecDUPLICATE without
- * consulting issuer freeze or DefaultRipple; both still apply on the create
- * path (DefaultRipple off is terNO_RIPPLE). canAddHolding() ignores existing
- * holdings, so transactors that may create a holding in doApply should gate
- * their preclaim call on it: after the amendment only when no holding
- * exists, before it always.
+ * Any transactors that call addEmptyHolding() in doApply must call
+ * canAddHolding() in preflight with the same View and Asset
  */
 [[nodiscard]] TER
 addEmptyHolding(

include/xrpl/ledger/helpers/TokenHelpers.h

@@ -38,12 +38,6 @@ enum class FreezeHandling { IgnoreFreeze, ZeroIfFrozen };
  */
 enum class AuthHandling { IgnoreAuth, ZeroIfUnauthorized };
 
-/**
- * Controls whether the recipient owner-reserve check is enforced when
- * auto-creating a trustline or MPToken during AMMWithdraw or AMMClawback.
- */
-enum class ReserveHandling : bool { EnforceReserve, IgnoreReserve };
-
 /**
  * Controls whether to include the account's full spendable balance
  */
@@ -325,12 +319,6 @@ transferRate(ReadView const& view, STAmount const& amount);
 [[nodiscard]] TER
 canAddHolding(ReadView const& view, Asset const& asset);
 
-/**
- * True if the account already holds this asset (or is the issuer / XRP).
- */
-[[nodiscard]] bool
-holdingExists(ReadView const& view, AccountID const& account, Asset const& asset);
-
 [[nodiscard]] TER
 addEmptyHolding(
     ApplyViewContext ctx,

include/xrpl/peerfinder/Config.h

@@ -26,8 +26,7 @@ struct Config
     /**
      * The largest number of public peer slots to allow.
      * This includes both inbound and outbound, but does not include
-     * fixed peers. A configuration built by `makeConfig` always holds
-     * `maxPeers == inPeers + outPeers`.
+     * fixed peers.
      */
     std::size_t maxPeers{tuning::kDefaultMaxPeers};
 

include/xrpl/protocol/ConfidentialTransfer.h

@@ -6,7 +6,6 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STInteger.h>  // IWYU pragma: keep
-#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
@@ -302,63 +301,6 @@ verifySchnorrProof(Slice const& pubKeySlice, Slice const& proofSlice, uint256 co
 NotTEC
 checkEncryptedAmountFormat(STObject const& object);
 
-/**
- * @brief Checks whether a holder's issuer mirror is encrypted under the
- * issuance's currently registered issuer key.
- *
- * Verifies that the holder's issuer mirror epoch matches the active issuer key
- * epoch on the issuance. An absent mirror epoch defaults to epoch 0. A holder without an issuer
- * mirror is considered stale, as there is no key anchor for future re-encryptions.
- *
- * @param issuance The MPTokenIssuance ledger object.
- * @param mptoken  The holder's MPToken ledger object.
- * @return true if the MPToken's issuer mirror is current. false if stale.
- */
-[[nodiscard]] bool
-isIssuerMirrorCurrent(SLE const& issuance, SLE const& mptoken);
-
-/**
- * @brief Checks whether a holder's auditor mirror is encrypted under the
- * issuance's currently registered auditor key.
- *
- * Verifies that the holder's auditor mirror epoch matches the active auditor key
- * epoch on the issuance. An absent mirror epoch defaults to epoch 0. An issuance
- * without an auditor key requires no auditor mirror and is considered current.
- *
- * @param issuance The MPTokenIssuance ledger object.
- * @param mptoken  The holder's MPToken ledger object.
- * @return true if the auditor mirror is current or not required.
- */
-[[nodiscard]] bool
-isAuditorMirrorCurrent(SLE const& issuance, SLE const& mptoken);
-
-/**
- * @brief Checks whether each mirror a holder is required to have is encrypted
- * under the issuance's currently registered ElGamal keys.
- *
- * Verifies that both the issuer mirror and the auditor mirror (if required)
- * are current. This serves as a combined check, ensuring all necessary
- * holder mirror epochs match the active key epochs on the issuance.
- *
- * @param issuance The MPTokenIssuance ledger object.
- * @param mptoken  The holder's MPToken ledger object.
- * @return true if the required mirrors are current.
- */
-[[nodiscard]] bool
-areMirrorsCurrent(SLE const& issuance, SLE const& mptoken);
-
-/**
- * @brief Set the holder's MPToken mirror epochs to match the issuance's current key epochs.
- *
- * Call this after writing mirror ciphertexts under the issuance's currently
- * registered keys, so that the mirrors read as current afterwards.
- *
- * @param issuance The MPTokenIssuance ledger object.
- * @param mptoken  The holder's MPToken ledger entry to update.
- */
-void
-setMirrorEpochs(SLE const& issuance, SLE& mptoken);
-
 /**
  * @brief Verifies revealed amount encryptions for all recipients.
  *

include/xrpl/protocol/HashPrefix.h

@@ -92,26 +92,6 @@ enum class HashPrefix : std::uint32_t {
      * Batch
      */
     Batch = detail::makeHashPrefix('B', 'C', 'H'),
-
-    /**
-     * inner transaction to sign as the counterparty
-     */
-    CounterpartyTxSign = detail::makeHashPrefix('C', 'P', 'T'),
-
-    /**
-     * inner transaction to multi-sign as the counterparty
-     */
-    CounterpartyTxMultiSign = detail::makeHashPrefix('C', 'P', 'M'),
-
-    /**
-     * inner transaction to sign as the sponsor
-     */
-    SponsorTxSign = detail::makeHashPrefix('S', 'P', 'N'),
-
-    /**
-     * inner transaction to multi-sign as the sponsor
-     */
-    SponsorTxMultiSign = detail::makeHashPrefix('S', 'P', 'M'),
 };
 
 template <class Hasher>

include/xrpl/protocol/NFTSyntheticSerializer.h

@@ -0,0 +1,19 @@
+#pragma once
+
+#include <xrpl/json/json_forwards.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TxMeta.h>
+
+#include <memory>
+
+namespace xrpl::rpc {
+
+/**
+ * Adds common synthetic fields to transaction-related JSON responses
+ */
+/** @{ */
+void
+insertNFTSyntheticInJson(json::Value&, std::shared_ptr<STTx const> const&, TxMeta const&);
+/** @} */
+
+}  // namespace xrpl::rpc

include/xrpl/protocol/Protocol.h

@@ -12,7 +12,6 @@
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
-#include <limits>
 
 namespace xrpl {
 
@@ -349,24 +348,13 @@ enum class VaultPhase : std::uint8_t {
     Redemption,
 };
 
-/**
- * Minimum gap between a closed-ended loan's final scheduled payment and the
- * vault's RedemptionDate. LoanSet rejects a schedule whose final payment is
- * fewer than this many seconds before RedemptionDate.
- */
-constexpr std::uint32_t kLoanRedemptionBuffer = std::chrono::seconds{60}.count();
-
 /**
  * Bounds on the length of a closed-ended vault's Investment phase
  * (RedemptionDate - SubscriptionDate). At vault creation the gap must satisfy
  * kMinInvestmentPeriod <= gap < kMaxInvestmentPeriod.
- *
- * 180s is enough to originate a loan that uses the minimum payment interval
- * and kLoanRedemptionBuffer after StartDate, which is strictly after
- * SubscriptionDate. The interval and buffer need not be equal; only their
- * sum plus one second must fit in this floor.
  */
-constexpr std::uint32_t kMinInvestmentPeriod = std::chrono::seconds{180}.count();
+constexpr std::uint32_t kMinInvestmentPeriod =
+    std::chrono::seconds{std::chrono::minutes{1}}.count();
 // This is 946708560 seconds which 30 x 365.2425 days (the average length of a Gregorian year).
 constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono::years{30}}.count();
 
@@ -408,6 +396,16 @@ using TxID = uint256;
  */
 constexpr std::uint16_t kMaxDeletableAmmTrustLines = 512;
 
+/**
+ * The maximum number of owner-directory entries to walk when clearing
+ * credentials pinned to a pseudo-account, in a single transaction.
+ *
+ * The walk stops after this many entries whether or not each one turns out to
+ * be a credential, so a directory that also holds other objects yields fewer
+ * deletions per transaction.
+ */
+constexpr std::uint16_t kMaxDeletablePseudoAccountCredentials = 512;
+
 /**
  * The maximum length of a URI inside an Oracle
  */
@@ -545,11 +543,6 @@ constexpr std::size_t kEcClawbackProofLength = SECP256K1_COMPACT_CLAWBACK_PROOF_
  */
 constexpr std::uint32_t kConfidentialFeeMultiplier = 9;
 
-/**
- * Maximum value a confidential MPT key epoch may reach.
- */
-constexpr std::uint32_t kMaxKeyEpoch = std::numeric_limits<std::uint32_t>::max();
-
 /**
  * Compressed EC point prefix for even y-coordinate
  */

include/xrpl/protocol/STTx.h

@@ -5,7 +5,6 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
@@ -14,7 +13,6 @@
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/Sign.h>
 #include <xrpl/protocol/TxFormats.h>
 
 #include <boost/container/flat_set.hpp>
@@ -107,36 +105,14 @@ public:
     [[nodiscard]] json::Value
     getJson(JsonOptions options, bool binary) const;
 
-    /**
-     * Sign the transaction as its account.
-     *
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     */
-    void
-    sign(PublicKey const& publicKey, SecretKey const& secretKey);
-
-    /**
-     * Sign the transaction in one of its signature fields.
-     *
-     * The signature is bound to the role that made it, so it cannot be moved
-     * into another role.
-     *
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @param role The role signing the transaction.
-     * @param rules The current ledger rules.
-     */
     void
     sign(
         PublicKey const& publicKey,
         SecretKey const& secretKey,
-        SignatureRole role,
-        Rules const& rules);
+        std::optional<std::reference_wrapper<SField const>> signatureTarget = {});
 
     /**
      * Check the signature.
-     *
      * @param rules The current ledger rules.
      * @return `true` if valid signature. If invalid, the error message string.
      */
@@ -144,7 +120,7 @@ public:
     checkSign(Rules const& rules) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkBatchSign() const;
+    checkBatchSign(Rules const& rules) const;
 
     // SQL Functions with metadata.
     static std::string const&
@@ -186,28 +162,28 @@ public:
 private:
     /**
      * Check the signature.
-     *
      * @param rules The current ledger rules.
      * @param sigObject Reference to object that contains the signature fields.
      *     Will be *this more often than not.
-     * @param role The role that made the signature in sigObject. Determines
-     *     the signing prefix, which binds the signature to that role.
      * @return `true` if valid signature. If invalid, the error message string.
      */
     [[nodiscard]] std::expected<void, std::string>
-    checkSign(Rules const& rules, STObject const& sigObject, SignatureRole role) const;
+    checkSign(Rules const& rules, STObject const& sigObject) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkSingleSign(STObject const& sigObject, HashPrefix prefix) const;
+    checkSingleSign(STObject const& sigObject) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkMultiSign(STObject const& sigObject, HashPrefix prefix) const;
+    checkMultiSign(Rules const& rules, STObject const& sigObject) const;
 
     [[nodiscard]] std::expected<void, std::string>
     checkBatchSingleSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkBatchMultiSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
+    checkBatchMultiSign(
+        STObject const& batchSigner,
+        Rules const& rules,
+        std::vector<uint256> const& txIds) const;
 
     void
     buildBatchTxns();

include/xrpl/protocol/Sign.h

@@ -4,65 +4,13 @@
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/Serializer.h>
 
-#include <optional>
-
 namespace xrpl {
 
-/**
- * The signature slots on a transaction.
- *
- * Each role signs different bytes, so a signature cannot be moved from the
- * role that made it into another role. See signingPrefix.
- */
-enum class SignatureRole {
-    /**
-     * The transaction's own signature, in sfTxnSignature or sfSigners.
-     */
-    Transaction,
-    /**
-     * The counterparty's signature, in sfCounterpartySignature.
-     */
-    Counterparty,
-    /**
-     * The sponsor's signature, in sfSponsorSignature.
-     */
-    Sponsor
-};
-
-/**
- * The field that holds this role's signature.
- *
- * @return The signature field, or nullptr for SignatureRole::Transaction,
- * whose signature lives at the top level of the transaction.
- */
-[[nodiscard]] SField const*
-signatureField(SignatureRole role);
-
-/**
- * The role that signs into the given field.
- *
- * @return The role, or an unseated optional if the field does not hold a
- * transaction signature.
- */
-[[nodiscard]] std::optional<SignatureRole>
-signatureRole(SField const& sigField);
-
-/**
- * The hash prefix that binds a transaction signature to the role that made it.
- *
- * @param role The role making the signature.
- * @param multiSigning Whether the signature is a multi-signature.
- * @param rules The current ledger rules.
- */
-[[nodiscard]] HashPrefix
-signingPrefix(SignatureRole role, bool multiSigning, Rules const& rules);
-
 /**
  * Sign an STObject
  *
@@ -101,12 +49,9 @@ verify(
 
 /**
  * Return a Serializer suitable for computing a multisigning TxnSignature.
- *
- * @param prefix Prefix to insert before the serialized object. Get it from
- * signingPrefix, so that the signature is bound to the role making it.
  */
 Serializer
-buildMultiSigningData(STObject const& obj, AccountID const& signingID, HashPrefix prefix);
+buildMultiSigningData(STObject const& obj, AccountID const& signingID);
 
 /**
  * Break the multi-signing hash computation into 2 parts for optimization.
@@ -122,7 +67,7 @@ buildMultiSigningData(STObject const& obj, AccountID const& signingID, HashPrefi
  *     signer's unique data.
  */
 Serializer
-startMultiSigningData(STObject const& obj, HashPrefix prefix);
+startMultiSigningData(STObject const& obj);
 
 inline void
 finishMultiSigningData(AccountID const& signingID, Serializer& s)

include/xrpl/protocol/TER.h

@@ -129,11 +129,8 @@ enum TEMcodes : TERUnderlyingType {
     temARRAY_TOO_LARGE,
     temBAD_TRANSFER_FEE,
     temINVALID_INNER_BATCH,
-
     temBAD_MPT,
     temBAD_CIPHERTEXT,
-    temINVALID_BYTECODE,
-    temTEMP_DISABLED,
 };
 
 //------------------------------------------------------------------------------
@@ -182,8 +179,6 @@ enum TEFcodes : TERUnderlyingType {
     tefINVALID_LEDGER_FIX_TYPE,
     tefNO_DST_PARTIAL,
     tefBAD_PATH_COUNT,
-    tefNO_BYTECODE,
-    tefBYTECODE_NOT_INCLUDED,
 };
 
 //------------------------------------------------------------------------------
@@ -375,8 +370,6 @@ enum TECcodes : TERUnderlyingType {
     tecNO_DELEGATE_PERMISSION = 198,
     tecBAD_PROOF = 199,
     tecNO_SPONSOR_PERMISSION = 200,
-    tecOUT_OF_GAS = 201,
-    tecBYTECODE_REJECTED = 202,
 };
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/detail/features.macro

@@ -15,10 +15,6 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
-XRPL_FEATURE(SmartEscrow,                 Supported::No,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(LendingProtocolV1_2,         Supported::No,  VoteBehavior::DefaultNo)
-XRPL_FIX    (Cleanup3_5_0,                Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(ConfidentialMPTKeyRotation,  Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_4_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -309,11 +309,6 @@ LEDGER_ENTRY(ltFEE_SETTINGS, 0x0073, FeeSettings, fee, ({
     {sfBaseFeeDrops,           SoeOptional},
     {sfReserveBaseDrops,       SoeOptional},
     {sfReserveIncrementDrops,  SoeOptional},
-    // Smart Escrow fields
-    {sfGasLimit,               SoeOptional},
-    {sfBytecodeSizeLimit,      SoeOptional},
-    {sfGasPrice,               SoeOptional},
-
     {sfPreviousTxnID,          SoeOptional},
     {sfPreviousTxnLgrSeq,      SoeOptional},
 }))
@@ -344,8 +339,6 @@ LEDGER_ENTRY(ltESCROW, 0x0075, Escrow, escrow, ({
     {sfCondition,            SoeOptional},
     {sfCancelAfter,          SoeOptional},
     {sfFinishAfter,          SoeOptional},
-    {sfBytecode,             SoeOptional},
-    {sfData,                 SoeOptional},
     {sfSourceTag,            SoeOptional},
     {sfDestinationTag,       SoeOptional},
     {sfOwnerNode,            SoeRequired},
@@ -415,8 +408,6 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfReferenceHolding,         SoeOptional},
     {sfIssuerEncryptionKey,      SoeOptional},
     {sfAuditorEncryptionKey,     SoeOptional},
-    {sfIssuerKeyEpoch,           SoeOptional},
-    {sfAuditorKeyEpoch,          SoeOptional},
     {sfConfidentialOutstandingAmount, SoeDefault},
 }))
 
@@ -436,8 +427,6 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
     {sfConfidentialBalanceVersion,  SoeDefault},
     {sfIssuerEncryptedBalance,      SoeOptional},
     {sfAuditorEncryptedBalance,     SoeOptional},
-    {sfIssuerKeyMirrorEpoch,        SoeOptional},
-    {sfAuditorKeyMirrorEpoch,       SoeOptional},
     {sfHolderEncryptionKey,         SoeOptional},
 }))
 

include/xrpl/protocol/detail/sfields.macro

@@ -119,15 +119,6 @@ TYPED_SFIELD(sfRemainingOwnerCount,      UINT32,    73)
 TYPED_SFIELD(sfSponsorFlags,             UINT32,    74)
 TYPED_SFIELD(sfSubscriptionDate,         UINT32,    75)
 TYPED_SFIELD(sfRedemptionDate,           UINT32,    76)
-TYPED_SFIELD(sfIssuerKeyEpoch,           UINT32,    77)
-TYPED_SFIELD(sfAuditorKeyEpoch,          UINT32,    78)
-TYPED_SFIELD(sfIssuerKeyMirrorEpoch,     UINT32,    79)
-TYPED_SFIELD(sfAuditorKeyMirrorEpoch,    UINT32,    80)
-TYPED_SFIELD(sfGasLimit,                 UINT32,    81)
-TYPED_SFIELD(sfBytecodeSizeLimit,        UINT32,    82)
-TYPED_SFIELD(sfGasPrice,                 UINT32,    83)
-TYPED_SFIELD(sfGas,                      UINT32,    84)
-TYPED_SFIELD(sfGasUsed,                  UINT32,    85)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -243,7 +234,6 @@ TYPED_SFIELD(sfManagementFeeOutstanding, NUMBER,     17, SField::kSmdNeedsAsset
 // 32-bit signed (common)
 TYPED_SFIELD(sfLoanScale,                INT32,      1)
 TYPED_SFIELD(sfRemainingOwnerCountDelta, INT32,      2)
-TYPED_SFIELD(sfVMReturnCode,             INT32,      3)
 
 // currency amount (common)
 TYPED_SFIELD(sfAmount,                   AMOUNT,     1)
@@ -328,7 +318,6 @@ TYPED_SFIELD(sfAuditorEncryptedAmount,      VL,     43)
 TYPED_SFIELD(sfAuditorEncryptionKey,        VL,     44)
 TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
-TYPED_SFIELD(sfBytecode,                    VL,     47)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)

include/xrpl/protocol/detail/transactions.macro

@@ -66,13 +66,11 @@ TRANSACTION(ttPAYMENT, 0, Payment,
 #endif
 TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate, ({.delegable = Delegation::Delegable}), ({
     {sfDestination, SoeRequired},
-    {sfDestinationTag, SoeOptional},
     {sfAmount, SoeRequired, SoeMptSupported},
     {sfCondition, SoeOptional},
     {sfCancelAfter, SoeOptional},
     {sfFinishAfter, SoeOptional},
-    {sfBytecode, SoeOptional},
-    {sfData, SoeOptional},
+    {sfDestinationTag, SoeOptional},
 }))
 
 /** This transaction type completes an existing escrow. */
@@ -85,7 +83,6 @@ TRANSACTION(ttESCROW_FINISH, 2, EscrowFinish, ({.delegable = Delegation::Delegab
     {sfFulfillment, SoeOptional},
     {sfCondition, SoeOptional},
     {sfCredentialIDs, SoeOptional},
-    {sfGas, SoeOptional},
 }))
 
 
@@ -1164,10 +1161,6 @@ TRANSACTION(ttFEE, 101, SetFee,
     {sfBaseFeeDrops, SoeOptional},
     {sfReserveBaseDrops, SoeOptional},
     {sfReserveIncrementDrops, SoeOptional},
-    // Smart Escrow fields
-    {sfGasLimit, SoeOptional},
-    {sfBytecodeSizeLimit, SoeOptional},
-    {sfGasPrice, SoeOptional},
 }))
 
 /** This system-generated transaction type is used to update the network's negative UNL

include/xrpl/protocol/jss.h

@@ -278,7 +278,6 @@ JSS(frozen_balances);                // out: GatewayBalances
 JSS(full);                           // in: LedgerClearer, handlers/Ledger
 JSS(full_reply);                     // out: PathFind
 JSS(fullbelow_size);                 // out: GetCounts
-JSS(gateway);                        // in: noripple_check
 JSS(git);                            // out: server_info
 JSS(good);                           // out: RPCVersion
 JSS(hash);                           // out: NetworkOPs, InboundLedger, LedgerToJson, STTx; field
@@ -482,7 +481,6 @@ JSS(ports);                       // out: NetworkOPs
 JSS(previous);                    // out: Reservations
 JSS(previous_ledger);             // out: LedgerPropose
 JSS(price);                       // out: amm_info, AuctionSlot
-JSS(problems);                    // out: noripple_check
 JSS(proof);                       // in: BookOffers
 JSS(propose_seq);                 // out: LedgerPropose
 JSS(proposers);                   // out: NetworkOPs, LedgerConsensus
@@ -662,7 +660,6 @@ JSS(url);                         // in/out: Subscribe, Unsubscribe
 JSS(url_password);                // in: Subscribe
 JSS(url_username);                // in: Subscribe
 JSS(urlgravatar);                 //
-JSS(user);                        // in: noripple_check
 JSS(username);                    // in: Subscribe
 JSS(validated);                   // out: NetworkOPs, RPCHelpers, AccountTx*, Tx
 JSS(validator_list_expires);      // out: NetworkOps, ValidatorList

include/xrpl/protocol_autogen/ledger_entries/Escrow.h

@@ -174,54 +174,6 @@ public:
         return this->sle_->isFieldPresent(sfFinishAfter);
     }
 
-    /**
-     * @brief Get sfBytecode (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getBytecode() const
-    {
-        if (hasBytecode())
-            return this->sle_->at(sfBytecode);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfBytecode is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasBytecode() const
-    {
-        return this->sle_->isFieldPresent(sfBytecode);
-    }
-
-    /**
-     * @brief Get sfData (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getData() const
-    {
-        if (hasData())
-            return this->sle_->at(sfData);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfData is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasData() const
-    {
-        return this->sle_->isFieldPresent(sfData);
-    }
-
     /**
      * @brief Get sfSourceTag (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -501,28 +453,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfBytecode (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowBuilder&
-    setBytecode(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfBytecode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfData (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowBuilder&
-    setData(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfData] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfSourceTag (SoeOptional)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/ledger_entries/FeeSettings.h

@@ -213,78 +213,6 @@ public:
         return this->sle_->isFieldPresent(sfReserveIncrementDrops);
     }
 
-    /**
-     * @brief Get sfGasLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasLimit() const
-    {
-        if (hasGasLimit())
-            return this->sle_->at(sfGasLimit);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasLimit() const
-    {
-        return this->sle_->isFieldPresent(sfGasLimit);
-    }
-
-    /**
-     * @brief Get sfBytecodeSizeLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getBytecodeSizeLimit() const
-    {
-        if (hasBytecodeSizeLimit())
-            return this->sle_->at(sfBytecodeSizeLimit);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfBytecodeSizeLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasBytecodeSizeLimit() const
-    {
-        return this->sle_->isFieldPresent(sfBytecodeSizeLimit);
-    }
-
-    /**
-     * @brief Get sfGasPrice (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasPrice() const
-    {
-        if (hasGasPrice())
-            return this->sle_->at(sfGasPrice);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasPrice is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasPrice() const
-    {
-        return this->sle_->isFieldPresent(sfGasPrice);
-    }
-
     /**
      * @brief Get sfPreviousTxnID (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -447,39 +375,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfGasLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    FeeSettingsBuilder&
-    setGasLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfBytecodeSizeLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    FeeSettingsBuilder&
-    setBytecodeSizeLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfBytecodeSizeLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfGasPrice (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    FeeSettingsBuilder&
-    setGasPrice(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasPrice] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfPreviousTxnID (SoeOptional)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/ledger_entries/MPToken.h

@@ -268,54 +268,6 @@ public:
         return this->sle_->isFieldPresent(sfAuditorEncryptedBalance);
     }
 
-    /**
-     * @brief Get sfIssuerKeyMirrorEpoch (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getIssuerKeyMirrorEpoch() const
-    {
-        if (hasIssuerKeyMirrorEpoch())
-            return this->sle_->at(sfIssuerKeyMirrorEpoch);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfIssuerKeyMirrorEpoch is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasIssuerKeyMirrorEpoch() const
-    {
-        return this->sle_->isFieldPresent(sfIssuerKeyMirrorEpoch);
-    }
-
-    /**
-     * @brief Get sfAuditorKeyMirrorEpoch (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getAuditorKeyMirrorEpoch() const
-    {
-        if (hasAuditorKeyMirrorEpoch())
-            return this->sle_->at(sfAuditorKeyMirrorEpoch);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfAuditorKeyMirrorEpoch is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasAuditorKeyMirrorEpoch() const
-    {
-        return this->sle_->isFieldPresent(sfAuditorKeyMirrorEpoch);
-    }
-
     /**
      * @brief Get sfHolderEncryptionKey (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -519,28 +471,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfIssuerKeyMirrorEpoch (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    MPTokenBuilder&
-    setIssuerKeyMirrorEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfIssuerKeyMirrorEpoch] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfAuditorKeyMirrorEpoch (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    MPTokenBuilder&
-    setAuditorKeyMirrorEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfAuditorKeyMirrorEpoch] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfHolderEncryptionKey (SoeOptional)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h

@@ -351,54 +351,6 @@ public:
         return this->sle_->isFieldPresent(sfAuditorEncryptionKey);
     }
 
-    /**
-     * @brief Get sfIssuerKeyEpoch (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getIssuerKeyEpoch() const
-    {
-        if (hasIssuerKeyEpoch())
-            return this->sle_->at(sfIssuerKeyEpoch);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfIssuerKeyEpoch is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasIssuerKeyEpoch() const
-    {
-        return this->sle_->isFieldPresent(sfIssuerKeyEpoch);
-    }
-
-    /**
-     * @brief Get sfAuditorKeyEpoch (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getAuditorKeyEpoch() const
-    {
-        if (hasAuditorKeyEpoch())
-            return this->sle_->at(sfAuditorKeyEpoch);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfAuditorKeyEpoch is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasAuditorKeyEpoch() const
-    {
-        return this->sle_->isFieldPresent(sfAuditorKeyEpoch);
-    }
-
     /**
      * @brief Get sfConfidentialOutstandingAmount (SoeDefault)
      * @return The field value, or std::nullopt if not present.
@@ -648,28 +600,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfIssuerKeyEpoch (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    MPTokenIssuanceBuilder&
-    setIssuerKeyEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfIssuerKeyEpoch] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfAuditorKeyEpoch (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    MPTokenIssuanceBuilder&
-    setAuditorKeyEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfAuditorKeyEpoch] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfConfidentialOutstandingAmount (SoeDefault)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/transactions/EscrowCreate.h

@@ -58,32 +58,6 @@ public:
         return this->tx_->at(sfDestination);
     }
 
-    /**
-     * @brief Get sfDestinationTag (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getDestinationTag() const
-    {
-        if (hasDestinationTag())
-        {
-            return this->tx_->at(sfDestinationTag);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfDestinationTag is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasDestinationTag() const
-    {
-        return this->tx_->isFieldPresent(sfDestinationTag);
-    }
-
     /**
      * @brief Get sfAmount (SoeRequired)
      * @note This field supports MPT (Multi-Purpose Token) amounts.
@@ -175,55 +149,29 @@ public:
     }
 
     /**
-     * @brief Get sfBytecode (SoeOptional)
+     * @brief Get sfDestinationTag (SoeOptional)
      * @return The field value, or std::nullopt if not present.
      */
     [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getBytecode() const
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getDestinationTag() const
     {
-        if (hasBytecode())
+        if (hasDestinationTag())
         {
-            return this->tx_->at(sfBytecode);
+            return this->tx_->at(sfDestinationTag);
         }
         return std::nullopt;
     }
 
     /**
-     * @brief Check if sfBytecode is present.
+     * @brief Check if sfDestinationTag is present.
      * @return True if the field is present, false otherwise.
      */
     [[nodiscard]]
     bool
-    hasBytecode() const
+    hasDestinationTag() const
     {
-        return this->tx_->isFieldPresent(sfBytecode);
-    }
-
-    /**
-     * @brief Get sfData (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getData() const
-    {
-        if (hasData())
-        {
-            return this->tx_->at(sfData);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfData is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasData() const
-    {
-        return this->tx_->isFieldPresent(sfData);
+        return this->tx_->isFieldPresent(sfDestinationTag);
     }
 };
 
@@ -284,17 +232,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfDestinationTag (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowCreateBuilder&
-    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfDestinationTag] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfAmount (SoeRequired)
      * @note This field supports MPT (Multi-Purpose Token) amounts.
@@ -341,24 +278,13 @@ public:
     }
 
     /**
-     * @brief Set sfBytecode (SoeOptional)
+     * @brief Set sfDestinationTag (SoeOptional)
      * @return Reference to this builder for method chaining.
      */
     EscrowCreateBuilder&
-    setBytecode(std::decay_t<typename SF_VL::type::value_type> const& value)
+    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
     {
-        object_[sfBytecode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfData (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowCreateBuilder&
-    setData(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfData] = value;
+        object_[sfDestinationTag] = value;
         return *this;
     }
 

include/xrpl/protocol_autogen/transactions/EscrowFinish.h

@@ -146,32 +146,6 @@ public:
     {
         return this->tx_->isFieldPresent(sfCredentialIDs);
     }
-
-    /**
-     * @brief Get sfGas (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGas() const
-    {
-        if (hasGas())
-        {
-            return this->tx_->at(sfGas);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGas is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGas() const
-    {
-        return this->tx_->isFieldPresent(sfGas);
-    }
 };
 
 /**
@@ -275,17 +249,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfGas (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowFinishBuilder&
-    setGas(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGas] = value;
-        return *this;
-    }
-
     /**
      * @brief Build and return the EscrowFinish wrapper.
      * @param publicKey The public key for signing.

include/xrpl/protocol_autogen/transactions/SetFee.h

@@ -254,84 +254,6 @@ public:
     {
         return this->tx_->isFieldPresent(sfReserveIncrementDrops);
     }
-
-    /**
-     * @brief Get sfGasLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasLimit() const
-    {
-        if (hasGasLimit())
-        {
-            return this->tx_->at(sfGasLimit);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasLimit() const
-    {
-        return this->tx_->isFieldPresent(sfGasLimit);
-    }
-
-    /**
-     * @brief Get sfBytecodeSizeLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getBytecodeSizeLimit() const
-    {
-        if (hasBytecodeSizeLimit())
-        {
-            return this->tx_->at(sfBytecodeSizeLimit);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfBytecodeSizeLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasBytecodeSizeLimit() const
-    {
-        return this->tx_->isFieldPresent(sfBytecodeSizeLimit);
-    }
-
-    /**
-     * @brief Get sfGasPrice (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasPrice() const
-    {
-        if (hasGasPrice())
-        {
-            return this->tx_->at(sfGasPrice);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasPrice is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasPrice() const
-    {
-        return this->tx_->isFieldPresent(sfGasPrice);
-    }
 };
 
 /**
@@ -464,39 +386,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfGasLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    SetFeeBuilder&
-    setGasLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfBytecodeSizeLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    SetFeeBuilder&
-    setBytecodeSizeLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfBytecodeSizeLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfGasPrice (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    SetFeeBuilder&
-    setGasPrice(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasPrice] = value;
-        return *this;
-    }
-
     /**
      * @brief Build and return the SetFee wrapper.
      * @param publicKey The public key for signing.

include/xrpl/shamap/SHAMap.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Blob.h>
 #include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/Log.h>
 #include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
@@ -16,6 +17,7 @@
 #include <xrpl/shamap/SHAMapMissingNode.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
+#include <atomic>
 #include <condition_variable>
 #include <cstddef>
 #include <cstdint>
@@ -40,7 +42,7 @@ class SHAMapSyncFilter;
 /**
  * Describes the current state of a given SHAMap
  */
-enum class SHAMapState {
+enum class SHAMapState : std::uint8_t {
     /**
      * The map is in flux and objects can be added and removed.
      *
@@ -120,16 +122,43 @@ private:
      */
     std::uint32_t cowid_ = 1;
 
+    // ledgerSeq_, state_ and full_ are touched on the nodestore fetch path and on a
+    // getMissingNodes() walk, neither of which may block, so pin them lock-free.
+    static_assert(std::atomic<std::uint32_t>::is_always_lock_free);
+    static_assert(std::atomic<SHAMapState>::is_always_lock_free);
+    static_assert(std::atomic<bool>::is_always_lock_free);
+
     /**
      * The sequence of the ledger that this map references, if any.
+     *
+     * Written when a map's ledger sequence is established (Ledger::setFull(),
+     * InboundLedger) while a nodestore reader thread reads it. Relaxed either
+     * way: it only serves as a lookup hint for a nodestore keyed by hash, so
+     * it orders nothing else.
      */
-    std::uint32_t ledgerSeq_ = 0;
+    std::atomic<std::uint32_t> ledgerSeq_ = 0;
 
     SHAMapTreeNodePtr root_;
-    mutable SHAMapState state_;
+
+    /**
+     * The map's state.
+     *
+     * A getMissingNodes() walk writes it, through setInvalid() and
+     * clearSynching(), while whatever drives the acquisition reads it.
+     * Nothing here requires the caller to hold a lock across the walk, and
+     * the acquisition code does not, so this is atomic rather than guarded.
+     */
+    std::atomic<SHAMapState> state_;
     SHAMapType const type_;
-    bool backed_ = true;         // Map is backed by the database
-    mutable bool full_ = false;  // Map is believed complete in database
+    bool backed_ = true;  // Map is backed by the database
+
+    /**
+     * Map is believed complete in database.
+     *
+     * finishFetch() clears it on whichever nodestore reader thread completes a
+     * read - several at once for the reads a getMissingNodes() walk posts.
+     */
+    mutable std::atomic<bool> full_ = false;
 
 public:
     /**
@@ -152,7 +181,14 @@ public:
     SHAMap&
     operator=(SHAMap const&) = delete;
 
-    // Take a snapshot of the given map:
+    /**
+     * Take a snapshot of the given map.
+     *
+     * @param other The map to snapshot. An Invalid source yields an Invalid
+     *        snapshot, since the two share the same node structure.
+     * @param isMutable Whether the snapshot may be modified. Ignored when other
+     *        is Invalid, since that state outranks both alternatives.
+     */
     SHAMap(SHAMap const& other, bool isMutable);
 
     // build new map
@@ -190,8 +226,15 @@ public:
 
     //--------------------------------------------------------------------------
 
-    // Returns a new map that's a snapshot of this one.
-    // Handles copy on write for mutable snapshots.
+    /**
+     * Return a new map that is a snapshot of this one.
+     *
+     * Handles copy on write for mutable snapshots. An invalid map yields an
+     * invalid snapshot, since the two share the same node structure.
+     *
+     * @param isMutable Whether the snapshot may be modified.
+     * @return The snapshot.
+     */
     std::shared_ptr<SHAMap>
     snapShot(bool isMutable) const;
 
@@ -296,9 +339,14 @@ public:
      * concurrency, to discover nodes referenced in the
      * SHAMap but not available locally.
      *
+     * Marks the map Invalid and abandons the traversal on meeting an inner
+     * node at or beyond kLeafDepth, a shape no valid tree can have, so
+     * callers must re-check isValid() before reading an empty result as
+     * "nothing left to fetch".
+     *
      * @param maxNodes The maximum number of found nodes to return
      * @param filter The filter to use when retrieving nodes
-     * @param return The nodes known to be missing
+     * @return The nodes known to be missing, or empty if the map is Invalid
      */
     std::vector<std::pair<SHAMapNodeID, uint256>>
     getMissingNodes(int maxNodes, SHAMapSyncFilter const* filter);
@@ -365,6 +413,11 @@ public:
      * @param filter Optional sync filter to track received nodes.
      * @return Status indicating whether the node was useful, duplicate, or invalid.
      *
+     * A node no valid tree could hold makes the map Invalid, which is
+     * terminal: the root hash committed to an impossible shape, so no peer
+     * can satisfy it. An acquisition reaching this verdict must give up
+     * rather than retry; nothing may promote the map back to a valid state.
+     *
      * @note This function expects the treeNode to be a valid, deserialized SHAMapTreeNode. The
      *       caller is responsible for deserialization and basic validation before calling this
      *       function. This also means that the nodeID must be consistent with the node's content.
@@ -375,16 +428,55 @@ public:
         SHAMapTreeNodePtr treeNode,
         SHAMapSyncFilter const* filter);
 
-    // status functions
-    void
+    /**
+     * Mark this map as immutable, so it can no longer be modified.
+     *
+     * @return false if the map is Invalid and was left unchanged, true
+     *         otherwise.
+     */
+    [[nodiscard]] bool
     setImmutable();
-    bool
+
+    /**
+     * Whether the map's hash is fixed while nodes may still be added to it.
+     *
+     * @return Whether the map is being synced against a hash it was given.
+     */
+    [[nodiscard]] bool
     isSynching() const;
+
+    /**
+     * Mark this map as syncing, fixing its hash while still allowing missing
+     * nodes to be added.
+     *
+     * Left unchanged if the map is Invalid, which is terminal - though that
+     * case is itself treated as unreachable (and asserts in a build with
+     * assertions enabled), since nothing should call this on a map that has
+     * already been judged.
+     */
     void
     setSynching();
+
+    /**
+     * Mark this map as no longer syncing, so it can be modified again.
+     *
+     * Does nothing if the map is Invalid, which is terminal.
+     */
     void
     clearSynching();
-    bool
+
+    /**
+     * Whether the map can still be the map it claims to be.
+     *
+     * Not "complete" and not "self-consistent": a map that is merely missing
+     * nodes is valid, and stays valid until something proves the tree it is
+     * syncing against cannot exist. Only the map itself reaches that
+     * verdict, and only from a node the hashes it was given cannot
+     * accommodate.
+     *
+     * @return Whether the map has not been proven impossible.
+     */
+    [[nodiscard]] bool
     isValid() const;
 
     // caution: otherMap must be accessed only by this function
@@ -424,6 +516,52 @@ private:
     using DeltaRef =
         std::pair<boost::intrusive_ptr<SHAMapItem const>, boost::intrusive_ptr<SHAMapItem const>>;
 
+    /**
+     * The sequence of the ledger this map references, read atomically.
+     *
+     * @return The sequence, or zero if the map references no ledger.
+     */
+    [[nodiscard]] std::uint32_t
+    ledgerSeq() const;
+
+    /**
+     * The current state, read atomically.
+     *
+     * Orders state_ alone. The tree's nodes are still mutated without
+     * ordering guarantees, so this says nothing about whether the rest of
+     * the map is safe to read concurrently.
+     *
+     * @return The state as of the call, which a concurrent walk may
+     *         already have moved past.
+     */
+    [[nodiscard]] SHAMapState
+    state() const;
+
+    /**
+     * Record that the map is provably not the one it claims to be.
+     *
+     * Private because only the map itself can prove that, from a node that
+     * contradicts the hashes it is syncing against. Cannot fail, since
+     * Invalid outranks every other state; see trySetState().
+     */
+    void
+    setInvalid();
+
+    /**
+     * Move the map to a new state, atomically.
+     *
+     * The only writer of state_ past construction, so the order between
+     * the states lives in one place: Invalid outranks all of them and is
+     * always stored, while every other transition is refused once the map
+     * is Invalid, which is what makes that verdict terminal.
+     *
+     * @param desired The state to move to.
+     * @return false if the map is Invalid and the requested state is not,
+     *         leaving it unchanged; true otherwise.
+     */
+    bool
+    trySetState(SHAMapState desired);
+
     // tree node cache operations
     SHAMapTreeNodePtr
     cacheLookup(SHAMapHash const& hash) const;
@@ -639,44 +777,113 @@ private:
 inline void
 SHAMap::setFull()
 {
-    full_ = true;
+    full_.store(true, std::memory_order_release);
 }
 
 inline void
 SHAMap::setLedgerSeq(std::uint32_t lseq)
 {
-    ledgerSeq_ = lseq;
+    ledgerSeq_.store(lseq, std::memory_order_relaxed);
 }
 
-inline void
+inline std::uint32_t
+SHAMap::ledgerSeq() const
+{
+    return ledgerSeq_.load(std::memory_order_relaxed);
+}
+
+inline SHAMapState
+SHAMap::state() const
+{
+    return state_.load(std::memory_order_acquire);
+}
+
+inline bool
+SHAMap::trySetState(SHAMapState desired)
+{
+    // Stored outright rather than exchanged, since Invalid outranks every other state: only the map
+    // itself reaches that verdict, from a node that contradicts the hashes it is syncing against,
+    // so a walk that reaches it has to win however it interleaves with a thread settling the map.
+    // An exchange that refused to overwrite Immutable would leave a map proven impossible reporting
+    // itself sound, which is the one thing nothing downstream could recover from.
+    if (desired == SHAMapState::Invalid)
+    {
+        state_.store(SHAMapState::Invalid, std::memory_order_release);
+        return true;
+    }
+
+    // Compare-exchange rather than check-then-store, so the refusal to leave Invalid holds no
+    // matter how this call interleaves with another thread's. Invalid is the only state this
+    // refuses to leave; the loop simply retries if another one is stored meanwhile. No load ahead
+    // of it, since a failed exchange both reports the state and refreshes expected.
+    auto expected = SHAMapState::Modifying;
+    while (expected != SHAMapState::Invalid)
+    {
+        if (state_.compare_exchange_weak(
+                expected, desired, std::memory_order_acq_rel, std::memory_order_acquire))
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
+inline bool
 SHAMap::setImmutable()
 {
-    XRPL_ASSERT(state_ != SHAMapState::Invalid, "xrpl::SHAMap::setImmutable : state is valid");
-    state_ = SHAMapState::Immutable;
+    SOMETIMES(!isValid(), "xrpl::SHAMap::setImmutable : map is invalid");
+    return trySetState(SHAMapState::Immutable);
 }
 
 inline bool
 SHAMap::isSynching() const
 {
-    return state_ == SHAMapState::Synching;
+    return state() == SHAMapState::Synching;
 }
 
 inline void
 SHAMap::setSynching()
 {
-    state_ = SHAMapState::Synching;
+    // Guarded, so this is not a way out of Invalid, matching clearSynching().
+    if (!trySetState(SHAMapState::Synching))
+    {
+        // Unreachable today, though not because the map is Modifying: a ledger built from a header
+        // starts out with both maps Synching already. It is unreachable because this is only ever
+        // called on a map that has just been constructed, so nothing can have synced against it and
+        // reached a verdict on it yet.
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::SHAMap::setSynching : map is invalid");
+        // LCOV_EXCL_STOP
+    }
 }
 
 inline void
 SHAMap::clearSynching()
 {
-    state_ = SHAMapState::Modifying;
+    // Guarded, so an invalid map stays invalid rather than being moved back to Modifying, which
+    // passes isValid(). Refusing is the contract rather than a broken invariant, so this reports
+    // instead of asserting: peer data produces the verdict, so an UNREACHABLE here would be an
+    // abort a peer could ask for.
+    SOMETIMES(!isValid(), "xrpl::SHAMap::clearSynching : map is invalid");
+    if (!trySetState(SHAMapState::Modifying))
+    {
+        JLOG(journal_.warn()) << "Refused to clear synching on an invalid map, root hash "
+                              << root_->getHash();
+    }
 }
 
 inline bool
 SHAMap::isValid() const
 {
-    return state_ != SHAMapState::Invalid;
+    return state() != SHAMapState::Invalid;
+}
+
+inline void
+SHAMap::setInvalid()
+{
+    // Through trySetState() like every other transition, so nothing writes state_ behind its back
+    // and the order between the states is stated once. Cannot fail: Invalid outranks all of them.
+    trySetState(SHAMapState::Invalid);
 }
 
 inline void

include/xrpl/shamap/SHAMapAddNode.h

@@ -14,35 +14,140 @@ private:
 
 public:
     SHAMapAddNode();
+
+    /**
+     * Record one node that was rejected.
+     *
+     * Counted rather than merely flagged, so a batch that carries on past a
+     * rejected node reports one per node instead of just that it happened.
+     */
     void
     incInvalid();
+
+    /**
+     * Record one node that was hooked into the map.
+     *
+     * Counted so a batch's tally can be read back through getGood().
+     */
     void
     incUseful();
+
+    /**
+     * Record one node the map already held.
+     *
+     * Counted separately from a useful node: it is not new data, but it is
+     * also not a rejection - see isGood().
+     */
     void
     incDuplicate();
-    void
-    reset();
+
+    /**
+     * How many nodes were hooked into the map, which isUseful() only reports
+     * the presence of.
+     *
+     * @return The count.
+     */
     [[nodiscard]] int
     getGood() const;
+    /**
+     * How many nodes were rejected, which isInvalid() only reports the presence
+     * of. A batch that stops on its first bad node counts one; one that carries
+     * on counts each.
+     *
+     * @return The count.
+     */
+    [[nodiscard]] int
+    getBad() const;
+
+    /**
+     * How many nodes the batch already held, which no other accessor reports: a
+     * duplicate counts as neither good nor bad.
+     *
+     * @return The count.
+     */
+    [[nodiscard]] int
+    getDuplicate() const;
+
+    /**
+     * Whether the batch overall was worth the exchange: nodes accepted or
+     * already held outnumber the ones rejected.
+     *
+     * A duplicate counts on the accepted side, since the peer answered a
+     * request rather than sent something unasked for; see incDuplicate().
+     *
+     * @return Whether the batch was good.
+     */
     [[nodiscard]] bool
     isGood() const;
+
+    /**
+     * Whether any node in the batch was rejected.
+     *
+     * @return Whether at least one node was bad.
+     */
     [[nodiscard]] bool
     isInvalid() const;
+
+    /**
+     * Whether any node in the batch was hooked into the map.
+     *
+     * @return Whether at least one node was useful.
+     */
     [[nodiscard]] bool
     isUseful() const;
+
+    /**
+     * A verdict recording one duplicate node.
+     *
+     * @return The verdict.
+     */
+    static SHAMapAddNode
+    duplicate();
+
+    /**
+     * A verdict recording one useful node.
+     *
+     * @return The verdict.
+     */
+    static SHAMapAddNode
+    useful();
+
+    /**
+     * A verdict recording one invalid node.
+     *
+     * @return The verdict.
+     */
+    static SHAMapAddNode
+    invalid();
+
+    /**
+     * Clear every count back to zero.
+     */
+    void
+    reset();
+
+    /**
+     * Render the tally as a log line.
+     *
+     * A format rather than an API: a caller that needs the counts themselves
+     * should read them through getGood(), getBad() and getDuplicate() instead
+     * of parsing this.
+     *
+     * @return The tally, e.g. "good:2 bad:1 dupe:1", or "no nodes processed" if
+     *         every count is zero.
+     */
     [[nodiscard]] std::string
     get() const;
 
+    /**
+     * Add another verdict's counts into this one.
+     *
+     * @param n The verdict to add.
+     * @return This verdict, updated.
+     */
     SHAMapAddNode&
     operator+=(SHAMapAddNode const& n);
 
-    static SHAMapAddNode
-    duplicate();
-    static SHAMapAddNode
-    useful();
-    static SHAMapAddNode
-    invalid();
-
 private:
     SHAMapAddNode(int good, int bad, int duplicate);
 };
@@ -74,18 +179,30 @@ SHAMapAddNode::incDuplicate()
     ++duplicate_;
 }
 
-inline void
-SHAMapAddNode::reset()
-{
-    good_ = bad_ = duplicate_ = 0;
-}
-
 inline int
 SHAMapAddNode::getGood() const
 {
     return good_;
 }
 
+inline int
+SHAMapAddNode::getBad() const
+{
+    return bad_;
+}
+
+inline int
+SHAMapAddNode::getDuplicate() const
+{
+    return duplicate_;
+}
+
+inline bool
+SHAMapAddNode::isGood() const
+{
+    return (good_ + duplicate_) > bad_;
+}
+
 inline bool
 SHAMapAddNode::isInvalid() const
 {
@@ -98,22 +215,6 @@ SHAMapAddNode::isUseful() const
     return good_ > 0;
 }
 
-inline SHAMapAddNode&
-SHAMapAddNode::operator+=(SHAMapAddNode const& n)
-{
-    good_ += n.good_;
-    bad_ += n.bad_;
-    duplicate_ += n.duplicate_;
-
-    return *this;
-}
-
-inline bool
-SHAMapAddNode::isGood() const
-{
-    return (good_ + duplicate_) > bad_;
-}
-
 inline SHAMapAddNode
 SHAMapAddNode::duplicate()
 {
@@ -132,6 +233,12 @@ SHAMapAddNode::invalid()
     return SHAMapAddNode(0, 1, 0);
 }
 
+inline void
+SHAMapAddNode::reset()
+{
+    good_ = bad_ = duplicate_ = 0;
+}
+
 inline std::string
 SHAMapAddNode::get() const
 {
@@ -160,4 +267,14 @@ SHAMapAddNode::get() const
     return ret;
 }
 
+inline SHAMapAddNode&
+SHAMapAddNode::operator+=(SHAMapAddNode const& n)
+{
+    good_ += n.good_;
+    bad_ += n.bad_;
+    duplicate_ += n.duplicate_;
+
+    return *this;
+}
+
 }  // namespace xrpl

include/xrpl/shamap/SHAMapInnerNode.h

@@ -31,7 +31,25 @@ private:
      */
     TaggedPointer hashesAndChildren_;
 
-    std::uint32_t fullBelowGen_ = 0;
+    // Inner nodes are allocated in the millions into a deliberately packed layout, so pin that
+    // wrapping fullBelowGen_ leaves every member at the offset it had, and that isFullBelow() does
+    // not take a mutex once per node of every walk.
+    static_assert(std::atomic<std::uint32_t>::is_always_lock_free);
+    static_assert(sizeof(std::atomic<std::uint32_t>) == sizeof(std::uint32_t));
+    static_assert(alignof(std::atomic<std::uint32_t>) == alignof(std::uint32_t));
+
+    /**
+     * Written from more than one thread: canonicalization shares nodes between
+     * maps, so concurrent walks of different maps reach the same node, and a
+     * single map's walk can run with the acquisition lock released (see
+     * SHAMap::state_).
+     *
+     * Relaxed both ways: a generation is only ever compared for equality
+     * and publishes nothing, since the children it vouches for are
+     * published through lock_. Ordering it would cost a barrier per inner
+     * node of every walk.
+     */
+    std::atomic<std::uint32_t> fullBelowGen_ = 0;
     std::uint16_t isBranch_ = 0;
 
     /**
@@ -204,13 +222,13 @@ SHAMapInnerNode::getBranchCount() const
 inline bool
 SHAMapInnerNode::isFullBelow(std::uint32_t generation) const
 {
-    return fullBelowGen_ == generation;
+    return fullBelowGen_.load(std::memory_order_relaxed) == generation;
 }
 
 inline void
 SHAMapInnerNode::setFullBelowGen(std::uint32_t gen)
 {
-    fullBelowGen_ = gen;
+    fullBelowGen_.store(gen, std::memory_order_relaxed);
 }
 
 }  // namespace xrpl

include/xrpl/tx/Transactor.h

@@ -259,13 +259,6 @@ public:
     static XRPAmount
     calculateBaseFee(ReadView const& view, STTx const& tx, std::uint32_t extraBaseFeeMultiplier);
 
-    // Exposed for invariant checks (e.g. ValidVault) that need to know which
-    // ledger entry actually pays a transaction's fee, distinguishing an
-    // ordinary sender, a delegate, and pre-funded vs. co-signed fee
-    // sponsorship.
-    static FeePayer
-    getFeePayer(ReadView const& view, STTx const& tx);
-
     /* Do NOT define an invokePreflight function in a derived class.
        Instead, define:
 
@@ -532,6 +525,9 @@ private:
     std::pair<TER, XRPAmount>
     reset(XRPAmount fee);
 
+    static FeePayer
+    getFeePayer(ReadView const& view, STTx const& tx);
+
     TER
     consumeSeqProxy(SLE::pointer const& sleAccount);
     TER

include/xrpl/tx/invariants/MPTInvariant.h

@@ -215,13 +215,6 @@ class ValidMPTTransfer
     // Deleted MPToken
     // MPToken key: true if MPTAuthorized is set
     hash_map<uint256, bool> deletedAuthorized_;
-    // Every touched AccountRoot (not only pseudos):
-    // AccountID -> whether it was a pseudo-account BEFORE this transaction
-    // applied. Needed because a transaction may erase a pseudo-account and
-    // move MPT out of it in the same transaction; by finalize() time the
-    // view no longer shows it as a pseudo-account (or as existing at all).
-    // False entries freeze the pre-tx classification for touched non-pseudos.
-    hash_map<AccountID, bool> pseudoAccountsBefore_;
 
 public:
     /**

include/xrpl/tx/invariants/VaultInvariant.h

@@ -131,57 +131,20 @@ private:
     deltaAssets(AccountID const& id) const;
 
     /**
-     * @brief Return the AccountRoot whose XRP balance actually absorbed a
-     *        transaction's fee, if any.
+     * @brief Return the vault-asset delta for the transaction's sending
+     *        account, adjusted for the fee.
      *
-     * Mirrors @c Transactor::getFeePayer, but resolves to @c std::nullopt for
-     * a pre-funded sponsorship: that fee is drawn from the @c ltSponsorship
-     * object's @c sfFeeAmount, never from the sponsor's own AccountRoot, so
-     * there is no balance to add back there.
+     * Calls @c deltaAssets for @c tx[sfAccount] and, for non-delegated XRP
+     * transactions, adds the consumed fee back so the invariant sees the net
+     * asset movement rather than the fee-reduced balance change.
      *
-     * @param view Read-only view of the ledger after the transaction.
-     * @param tx   The transaction being applied.
-     * @return The fee-paying AccountRoot's id, or @c std::nullopt when the
-     *         fee was not drawn from any AccountRoot balance.
-     */
-    [[nodiscard]] static std::optional<AccountID>
-    feePayerAccountRoot(ReadView const& view, STTx const& tx);
-
-    /**
-     * @brief Return the vault-asset delta for a party inspected as a
-     *        withdrawal/deposit counterparty, adjusted for the fee.
-     *
-     * Calls @c deltaAssets for @p id and, for XRP transactions, adds the
-     * consumed fee back only when @p id is the AccountRoot that actually
-     * paid it (per @c feePayerAccountRoot) -- so the invariant sees the net
-     * asset movement rather than a fee-reduced balance change, regardless of
-     * whether @p id is the sender, a distinct destination, a delegate, or a
-     * co-signed fee sponsor. Post-@c fixCleanup3_4_0, any resulting
-     * economically-zero delta is always normalized to absence.
-     *
-     * Pre-@c fixCleanup3_4_0 this replicates the legacy behaviour exactly:
-     * only @c tx[sfAccount] could ever receive a fee correction (and only
-     * when it was itself, per @c STTx::getFeePayerID, the fee payer). After
-     * that sender-only correction a zero delta is collapsed to absence; if
-     * the correction does not apply, a present-zero delta is kept as-is.
-     *
-     * @param view          Read-only view of the ledger after the transaction.
-     * @param id            Account being inspected as sender or destination.
-     * @param tx            The transaction being applied.
-     * @param fee           Fee charged by this transaction.
-     * @param fix340Enabled Whether @c fixCleanup3_4_0 is enabled, as already
-     *                      determined once by @c finalize.
+     * @param tx  The transaction being applied.
+     * @param fee Fee charged by this transaction.
      * @return The fee-adjusted delta, or @c std::nullopt if the net delta is
-     *         zero (always post-amendment; pre-amendment only after the
-     *         sender-only fee correction) or the entry was not touched.
+     *         zero or the account entry was not touched.
      */
     [[nodiscard]] std::optional<DeltaInfo>
-    deltaAssetsForParty(
-        ReadView const& view,
-        AccountID const& id,
-        STTx const& tx,
-        XRPAmount fee,
-        bool fix340Enabled) const;
+    deltaAssetsTxAccount(STTx const& tx, XRPAmount fee) const;
 
     /**
      * @brief Return the vault-share balance-change delta for an account.
@@ -211,8 +174,8 @@ private:
      *
      * For a closed-ended vault, a loan may only be originated while the vault is in the Investment
      * phase (strictly past @c SubscriptionDate and before @c RedemptionDate). Open-ended vaults (@c
-     * NoPhase) are unaffected. The complementary maturity bound (final payment precedes @c
-     * RedemptionDate by at least @c kLoanRedemptionBuffer) is enforced by @c ValidLoan.
+     * NoPhase) are unaffected. The complementary maturity bound (final payment strictly precedes @c
+     * RedemptionDate) is enforced by @c ValidLoan.
      */
     [[nodiscard]] bool
     finalizeLoanSet(ReadView const& view, beast::Journal const& j) const;

include/xrpl/tx/transactors/dex/AMMWithdraw.h

@@ -109,11 +109,6 @@ public:
      * @param lpTokens current LPT balance
      * @param lpTokensWithdraw amount of tokens to withdraw
      * @param tfee trading fee in basis points
-     * @param freezeHandling whether a frozen balance is reported as zero
-     * @param authHandling whether an unauthorized MPT balance is reported as
-     *        zero
-     * @param reserveHandling whether the recipient owner-reserve check is
-     *        enforced when a trustline or MPToken has to be auto-created
      * @param withdrawAll if withdrawing all lptokens
      * @param priorBalance balance before fees
      * @return
@@ -133,7 +128,6 @@ public:
         std::uint16_t tfee,
         FreezeHandling freezeHandling,
         AuthHandling authHandling,
-        ReserveHandling reserveHandling,
         WithdrawAll withdrawAll,
         XRPAmount const& priorBalance,
         beast::Journal const& journal);
@@ -156,11 +150,6 @@ public:
      * @param lpTokensAMMBalance current AMM LPT balance
      * @param lpTokensWithdraw amount of lptokens to withdraw
      * @param tfee trading fee in basis points
-     * @param freezeHandling whether a frozen balance is reported as zero
-     * @param authHandling whether an unauthorized MPT balance is reported as
-     *        zero
-     * @param reserveHandling whether the recipient owner-reserve check is
-     *        enforced when a trustline or MPToken has to be auto-created
      * @param withdrawAll if withdraw all lptokens
      * @param priorBalance balance before fees
      * @return
@@ -180,7 +169,6 @@ public:
         std::uint16_t tfee,
         FreezeHandling freezeHandling,
         AuthHandling authHandling,
-        ReserveHandling reserveHandling,
         WithdrawAll withdrawAll,
         XRPAmount const& priorBalance,
         beast::Journal const& journal);

nix/check-tools/macos.txt

@@ -131,9 +131,6 @@ Rust toolchain:
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f4 2026-07-14)
      /nix/store/j6apc5pmd0giy15da9p650r8zklslmvi-rust-analyzer-preview-1.97.1-aarch64-apple-darwin/bin/rust-analyzer
-  ✅ rust-nightly
-     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
-     /nix/store/fqpjz4l0nsnji8b2pz57mnj0akbp6hcl-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
      /nix/store/bnfk1sl4s9angb0vj1cj9a5y5zvqinwy-rust-minimal-1.97.1/bin/rustc
@@ -143,4 +140,4 @@ Rust toolchain:
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 
-✅ All 45 checked tools are present and runnable.
+✅ All 44 checked tools are present and runnable.

nix/check-tools/nix-ubuntu-amd64.txt

@@ -131,9 +131,6 @@ Rust toolchain:
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f 2026-07-14)
      /nix/store/lr3m97p3hx1k22a7c44pb0wa7rbayhfi-rust-analyzer-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rust-analyzer
-  ✅ rust-nightly
-     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
-     /nix/store/j7kf7a5h4xypzp6x1skg4dsdx2k4fwb3-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
      /nix/store/40d3mzka7r1ps71l0yv2fs6616nbw85m-rust-minimal-1.97.1/bin/rustc
@@ -171,4 +168,4 @@ Mold:
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 
-✅ All 53 checked tools are present and runnable.
+✅ All 52 checked tools are present and runnable.

nix/check-tools/nix-ubuntu-arm64.txt

@@ -131,9 +131,6 @@ Rust toolchain:
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f 2026-07-14)
      /nix/store/262830dlw2517lnagfx7i7agqgl4fmsd-rust-analyzer-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rust-analyzer
-  ✅ rust-nightly
-     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
-     /nix/store/c59pxk1yikdlf129qwyg4fplmxcrha0k-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
      /nix/store/a6p27cg6b8szfixfyvkssx6l0c345zw8-rust-minimal-1.97.1/bin/rustc
@@ -171,4 +168,4 @@ Mold:
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 
-✅ All 53 checked tools are present and runnable.
+✅ All 52 checked tools are present and runnable.

nix/docker/Dockerfile

@@ -10,8 +10,6 @@ RUN mkdir -p ~/.config/nix && \
 COPY nix/ci-env.nix /tmp/build/nix/ci-env.nix
 COPY nix/linux.nix /tmp/build/nix/linux.nix
 COPY nix/packages.nix /tmp/build/nix/packages.nix
-COPY nix/rust-nightly.sh /tmp/build/nix/rust-nightly.sh
-COPY nix/rust.nix /tmp/build/nix/rust.nix
 COPY nix/utils.nix /tmp/build/nix/utils.nix
 COPY flake.nix /tmp/build/
 COPY flake.lock /tmp/build/

nix/packages.nix

@@ -16,7 +16,23 @@ let
     exec ${pkgs.python3}/bin/python3 ${llvmPackages.clang-unwrapped}/bin/run-clang-tidy "$@"
   '';
 
-  rust = import ./rust.nix { inherit pkgs; };
+  # rust-overlay's toolchain propagates the *default* stdenv.cc onto the PATH (so
+  # cargo has a linker). That default may be different from the clang we pin here,
+  # so it shadows our clang and the build can silently use a different compiler
+  # version. Drop that cc from every propagation channel instead of pinning a
+  # replacement: the toolchain then carries no compiler and cargo just uses the
+  # active shell's stdenv cc. Must cover all channels — rust-overlay uses both
+  # propagatedBuildInputs and depsHostHostPropagated.
+  rustToolchainBase = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
+  rustToolchain =
+    let
+      defaultCc = pkgs.stdenv.cc; # default compiler from nixpkgs stdenv
+      withoutDefaultCc = builtins.filter (dep: (dep.outPath or "") != defaultCc.outPath);
+    in
+    rustToolchainBase.overrideAttrs (old: {
+      propagatedBuildInputs = withoutDefaultCc (old.propagatedBuildInputs or [ ]);
+      depsHostHostPropagated = withoutDefaultCc (old.depsHostHostPropagated or [ ]);
+    });
 
   # Nix wraps its toolchain so that binaries are exposed only under unsuffixed
   # names (gcc, g++, clang-tidy, ...). Several tools probe for a
@@ -92,38 +108,41 @@ in
     mkGcov
     ;
 
-  commonPackages =
-    (with pkgs; [
-      clangToolLinks
-      runClangTidyLink
-      ccache
-      clangbuildanalyzer
-      clangTools
-      cmake
-      conan
-      curlMinimal # needed for codecov/codecov-action
-      doxygen
-      file # needed for cpack in Clio
-      gcovr
-      gh
-      git
-      git-cliff
-      git-lfs
-      gnumake
-      gnupg # needed for signing commits & codecov/codecov-action
-      graphviz
-      less # needed for git diff
-      mold
-      nettools # provides netstat, used to debug failures in CI
-      ninja
-      patchelf
-      perl # needed for openssl
-      pkg-config
-      pre-commit
-      python3
-      runClangTidy
-      vim
-      zip
-    ])
-    ++ rust.packages;
+  commonPackages = with pkgs; [
+    clangToolLinks
+    runClangTidyLink
+    ccache
+    clangbuildanalyzer
+    clangTools
+    cmake
+    conan
+    curlMinimal # needed for codecov/codecov-action
+    doxygen
+    file # needed for cpack in Clio
+    gcovr
+    gh
+    git
+    git-cliff
+    git-lfs
+    gnumake
+    gnupg # needed for signing commits & codecov/codecov-action
+    graphviz
+    less # needed for git diff
+    mold
+    nettools # provides netstat, used to debug failures in CI
+    ninja
+    patchelf
+    perl # needed for openssl
+    pkg-config
+    pre-commit
+    python3
+    runClangTidy
+    vim
+    zip
+    # Rust packages
+    cargo-audit
+    cargo-llvm-cov
+    cargo-nextest
+    rustToolchain
+  ];
 }

nix/rust-nightly.sh

@@ -1,23 +0,0 @@
-#!@runtimeShell@
-# Reaches the nightly Rust toolchain, which is deliberately kept off PATH.
-# Packaged by nix/rust.nix, which explains why.
-
-set -euo pipefail
-
-usage() {
-    echo "usage: rust-nightly (path | run <command>...)" >&2
-    exit 2
-}
-
-case "${1-}" in
-    path) printf '%s\n' "@rustNightlyBin@" ;;
-    run)
-        shift
-        if [[ $# -eq 0 ]]; then
-            usage
-        fi
-        export PATH="@rustNightlyBin@:${PATH}"
-        exec "$@"
-        ;;
-    *) usage ;;
-esac

nix/rust.nix

@@ -1,84 +0,0 @@
-# The Rust half of the tool set shared by the CI environment and the dev shell:
-# the stable toolchain pinned by rust-toolchain.toml, the nightly the Rust
-# coverage job needs, and the cargo plugins. Consumed by packages.nix.
-{ pkgs }:
-let
-  # rust-overlay's toolchain propagates the *default* stdenv.cc onto the PATH (so
-  # cargo has a linker). That default may be different from the clang we pin
-  # elsewhere, so it shadows our clang and the build can silently use a different
-  # compiler version. Drop that cc from every propagation channel instead of
-  # pinning a replacement: the toolchain then carries no compiler and cargo just
-  # uses the active shell's stdenv cc.
-  #
-  # The channel list is every list mkDerivation propagates to a dependent's
-  # environment (including the two legacy aliases). rust-overlay currently only
-  # uses propagatedBuildInputs and depsHostHostPropagated, but covering all of
-  # them means an upstream switch to another channel cannot quietly put the
-  # compiler back on PATH.
-  dropDefaultCc =
-    toolchain:
-    let
-      defaultCc = pkgs.stdenv.cc; # default compiler from nixpkgs stdenv
-      withoutDefaultCc = builtins.filter (dep: (dep.outPath or "") != defaultCc.outPath);
-    in
-    toolchain.overrideAttrs (
-      old:
-      pkgs.lib.genAttrs [
-        "depsBuildBuildPropagated"
-        "propagatedNativeBuildInputs" # alias of depsBuildHostPropagated
-        "depsBuildTargetPropagated"
-        "depsHostHostPropagated"
-        "propagatedBuildInputs" # alias of depsHostTargetPropagated
-        "depsTargetTargetPropagated"
-      ] (channel: withoutDefaultCc (old.${channel} or [ ]))
-    );
-
-  rustToolchain = dropDefaultCc (pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml);
-
-  # cargo-llvm-cov honours the #[coverage(off)] that keeps unit tests out of the
-  # coverage report only under a nightly rustc, and looks for llvm-profdata and
-  # llvm-cov in that same toolchain's sysroot — hence llvm-tools-preview.
-  #
-  # Not every nightly ships every component, so `nightly.latest` breaks on the
-  # days llvm-tools-preview is absent; selectLatestNightlyWith walks back to the
-  # newest one that has it. The result is the newest such nightly *known to the
-  # locked rust-overlay*, which means updating flake.lock moves the compiler that
-  # produces the coverage numbers — and with it the rustc version recorded in
-  # nix/check-tools/*.txt, so those snapshots need regenerating alongside.
-  rustNightly = dropDefaultCc (
-    pkgs.rust-bin.selectLatestNightlyWith (
-      toolchain: toolchain.minimal.override { extensions = [ "llvm-tools-preview" ]; }
-    )
-  );
-
-  # A second toolchain cannot go on PATH: its cargo and rustc would collide with
-  # the pinned stable's in the ci-env buildEnv, which resolves collisions by
-  # picking one silently. Reaching the nightly only through this wrapper keeps it
-  # in the image closure (the Docker build copies the whole closure, not just
-  # what is linked into /bin) while leaving it inactive everywhere that does not
-  # ask for it.
-  #
-  # The script's `path` subcommand exists for scopes wider than one command — a
-  # CI job appending to $GITHUB_PATH, so that the cargo cache action's own
-  # `rustc -vV` probe, which runs in a step of its own, agrees with the toolchain
-  # the build will use.
-  rustNightlyScript = pkgs.replaceVarsWith {
-    name = "rust-nightly";
-    src = ./rust-nightly.sh;
-    dir = "bin";
-    isExecutable = true;
-    replacements = {
-      inherit (pkgs) runtimeShell;
-      rustNightlyBin = "${rustNightly}/bin";
-    };
-  };
-in
-{
-  packages = [
-    pkgs.cargo-audit
-    pkgs.cargo-llvm-cov
-    pkgs.cargo-nextest
-    rustNightlyScript
-    rustToolchain
-  ];
-}

package/README.md

@@ -15,7 +15,7 @@ package/
     publish_pkg.py      Uploads built packages to the XRPLF Nexus repositories (called by CI, and shipped in that image)
   rpm/
     xrpld.spec      RPM spec
-  debian/           Debian control files (control, rules, copyright, xrpld.docs, xrpld.links, xrpld.lintian-overrides, source/format)
+  debian/           Debian control files (control, rules, copyright, xrpld.docs, xrpld.links, source/format)
   shared/
     xrpld.service       systemd unit file (used by both RPM and DEB)
     xrpld.sysusers      sysusers.d config (used by both RPM and DEB)
@@ -34,10 +34,10 @@ image and both CI and local builds pick it up — and names the format that imag
 builds in `type`, which CI passes to `build_pkg.py` as `--package-type`; the two
 have to stay in step.
 
-| Package type | Image (`configs.<distro>[].package.image` in `linux.json`) | Tools required                                                 |
-| ------------ | ---------------------------------------------------------- | -------------------------------------------------------------- |
-| RPM          | `ghcr.io/xrplf/xrpld/packaging-rhel:sha-<sha>`             | `rpmbuild`, `rpmsign`                                          |
-| DEB          | `ghcr.io/xrplf/xrpld/packaging-debian:sha-<sha>`           | `dpkg-buildpackage`, debhelper with compat level 13, `lintian` |
+| Package type | Image (`configs.<distro>[].package.image` in `linux.json`) | Tools required                                      |
+| ------------ | ---------------------------------------------------------- | --------------------------------------------------- |
+| RPM          | `ghcr.io/xrplf/xrpld/packaging-rhel:sha-<sha>`             | `rpmbuild`, `rpmsign`                               |
+| DEB          | `ghcr.io/xrplf/xrpld/packaging-debian:sha-<sha>`           | `dpkg-buildpackage`, debhelper with compat level 13 |
 
 To print the full packaging matrix (artifact names and images) for the current
 `linux.json`:
@@ -51,19 +51,13 @@ To print the full packaging matrix (artifact names and images) for the current
 ### Via CI
 
 Caller workflows (`on-pr.yml`, `on-tag.yml`, `on-trigger.yml`) call
-`reusable-package.yml`, which runs in three stages:
-
-1. `package` fans out one job per config carrying a `package` map, building and
-   signing in that config's container, and uploading `<config>-pkg` alongside
-   `<config>-pkg-debug` for the much larger debug symbols.
-2. `test-install` installs `<config>-pkg` in the container of every distro the
-   packages target and runs the binaries there, so one that cannot be installed
-   never reaches Nexus.
-3. `publish` uploads both artifacts, or lists what it would upload.
-
-The packaging script derives the package version from the downloaded binary's
-`xrpld --version` output; no CMake configure or build step is needed inside the
-packaging job.
+`reusable-package.yml`. That workflow generates its own packaging matrix from
+the configs that carry a `package` map (via `generate.py --packaging`) and fans
+out one job per distro. Each job downloads the pre-built `xrpld` and
+`validator-keys` binary artifacts and runs in that distro's container, building
+the format `package.type` declares. The packaging script derives the package
+version from the downloaded binary's `xrpld --version` output; no CMake
+configure or build step is needed inside the packaging job.
 
 The binaries come from the `debian` and `rhel` build configs themselves — the
 ones carrying the `package` map — which pass `-Dvalidator_keys=ON` so that the
@@ -100,7 +94,8 @@ docker run --rm \
     --pkg-release "${PKG_RELEASE}" \
     --channel UNRELEASED
 
-# Output (the deb image writes build/debbuild/*.deb instead):
+# Output:
+#   build/debbuild/*.deb         (DEB + dbgsym; Debian names both .deb)
 #   build/rpmbuild/RPMS/x86_64/*.rpm
 ```
 
@@ -160,9 +155,9 @@ the last, and the date and hash say which commit a package on
 `packages.xrplf.org` came from. Both reach the packaging scripts as arguments,
 so neither script derives anything itself.
 
-Publishing is its own job, gated behind `test-install`, uploading from the same
-image that built the packages with the `publish_pkg.py` shipped in it — the
-same copy other repositories run. Without `publish: true` the job is a
+Publishing is the last step of each packaging job, uploading from the container
+that built the packages with the `publish_pkg.py` shipped in the image — the
+same copy other repositories run. Without `publish: true` the step is a
 `--dry-run`, listing the uploads it would make without needing credentials, so
 any run that builds packages also exercises the upload routing. `on-trigger.yml`
 passes `publish: true` for develop pushes in `XRPLF/rippled` and `on-tag.yml`
@@ -207,9 +202,6 @@ the final release. If that normalized package version still contains `-`,
 packaging fails because RPM forbids `-` in `Version`, and Debian uses `-` as
 the upstream/revision separator.
 
-> [!NOTE]
-> Debug and sanitizer builds are not packaged yet.
-
 `pkg_version` is the normalized package metadata version derived inside
 `build_pkg.py` from the binary-reported `xrpld` version (`-` pre-release
 separator converted to `~`). It is not a separate user input.
@@ -287,45 +279,37 @@ service restart.
 2. Stages the binaries, configs, `README.md`, `LICENSE.md`, and
    `validator-keys-LICENSE`.
 3. Copies `package/debian/` control files into `debbuild/source/debian/`.
-4. Copies shared service/sysusers/tmpfiles/logrotate into `debian/` where `dh_installsystemd`, `dh_installsysusers`, `dh_installtmpfiles` and `dh_installlogrotate` pick them up automatically.
+4. Copies shared service/sysusers/tmpfiles into `debian/` where `dh_installsystemd`, `dh_installsysusers`, and `dh_installtmpfiles` pick them up automatically.
 5. Generates a minimal `debian/changelog` using `${pkg_version}-${PKG_RELEASE}`,
    where `pkg_version` is derived from the binary-reported `xrpld` version.
 6. Runs `dpkg-buildpackage -b --no-sign -d` (`-d` skips the build-dependency check, since the binary is already built). `debian/rules` uses manual `install` commands.
-
-   It also rewrites the `libc6` bound to `LIBC_MIN` in `debian/rules`, the glibc
-   the Nix toolchain builds against. `dpkg-shlibdeps` would otherwise derive it
-   from the build host's symbols file — on trixie that yields `libc6 (>= 2.34)`
-   because of `sysconf`, locking out distros the binaries run on. A check fails
-   the build if either binary outgrows `LIBC_MIN`.
-
 7. Output: `debbuild/*.deb`, the binary package and the `-dbgsym` package.
    Debian gives dbgsym packages a `.deb` extension; only Ubuntu uses `.ddeb`.
 
 ## Post-build verification
 
 ```bash
-# DEB (one invocation per package: the dbgsym package is a .deb too)
-for deb in debbuild/*.deb; do dpkg-deb -c "${deb}"; done | grep -E 'systemd|sysusers|tmpfiles'
-lintian -I debbuild/*.deb
+# DEB
+dpkg-deb -c debbuild/*.deb | grep -E 'systemd|sysusers|tmpfiles'
 
 # RPM
 rpm -qlp rpmbuild/RPMS/x86_64/*.rpm
-```
 
-`lintian` still reports `embedded-library zlib`, `no-manual-page` and
-`initial-upload-closes-no-bugs`; only the `/usr/local` tags are overridden.
+# Optional, and not in the packaging image: apt-get install -y lintian
+lintian -I debbuild/*.deb
+```
 
 ## Reproducibility
 
-Both formats build reproducibly as they are: the same binaries at the same
-commit give byte-identical packages on a rebuild, and nothing has to be
-exported by hand.
+`build_pkg.py` sets `SOURCE_DATE_EPOCH` from the latest git commit time and
+exports it; the RPM spec clamps file modification times to it via
+`%build_mtime_policy`. The remaining variables
+below further improve reproducibility but are _not_ set by the script — export
+them yourself if needed:
 
-`build_pkg.py` sets `SOURCE_DATE_EPOCH` from the latest git commit time.
-`dpkg-buildpackage` honours it on its own; the RPM spec sets three macros:
-
-- `%clamp_mtime_to_source_date_epoch` — file modification times, from
-  `SOURCE_DATE_EPOCH`.
-- `%use_source_date_epoch_as_buildtime` — the `BUILDTIME` header, from the
-  same.
-- `%_buildhost` — pinned, so the builder's hostname stays out of the header.
+```bash
+export TZ=UTC
+export LC_ALL=C.UTF-8
+export GZIP=-n
+export DEB_BUILD_OPTIONS="noautodbgsym reproducible=+fixfilepath"
+```

package/build_pkg.py

@@ -19,7 +19,7 @@ from pathlib import Path
 # This script lives in the repository it packages.
 SRC_DIR = Path(__file__).resolve().parents[1]
 
-PRE_RELEASE = re.compile(r"^(b|rc)(0|[1-9][0-9]*)(\+.*)?$")
+PRE_RELEASE = re.compile(r"^(b0|b[1-9][0-9]*|rc[0-9]+)(\+.*)?$")
 
 # Files both packaging systems consume, staged under the same names.
 STAGED_FROM_BUILD = ("xrpld", "validator-keys", "validator-keys-LICENSE")
@@ -133,14 +133,6 @@ def stage_common(build_dir: Path, dest: Path) -> None:
         shutil.copy2(build_dir / name, dest / name)
     for source, name in STAGED_FROM_SRC.items():
         shutil.copy2(SRC_DIR / source, dest / name)
-
-
-def stage_units(dest: Path) -> None:
-    """Copy the systemd, sysusers, tmpfiles and logrotate files into dest.
-
-    Each format wants them somewhere else: rpmbuild reads them from SOURCES,
-    debhelper from debian/.
-    """
     for name in STAGED_UNITS:
         shutil.copy2(SRC_DIR / "package" / "shared" / name, dest / name)
 
@@ -154,7 +146,6 @@ def build_rpm(build_dir: Path, *, version: str, pkg_release: str) -> None:
     spec = topdir / "SPECS" / "xrpld.spec"
     shutil.copy2(SRC_DIR / "package" / "rpm" / "xrpld.spec", spec)
     stage_common(build_dir, topdir / "SOURCES")
-    stage_units(topdir / "SOURCES")
 
     run(
         "rpmbuild",
@@ -187,7 +178,8 @@ def build_deb(
     shutil.copytree(SRC_DIR / "package" / "debian", staging / "debian")
 
     # debhelper picks these up from debian/ automatically.
-    stage_units(staging / "debian")
+    for name in STAGED_UNITS:
+        shutil.copy2(staging / name, staging / "debian" / name)
 
     date = datetime.fromtimestamp(epoch, timezone.utc).strftime(
         "%a, %d %b %Y %H:%M:%S %z"
@@ -201,6 +193,8 @@ def build_deb(
         """)
     (staging / "debian" / "changelog").write_text(changelog)
 
+    (staging / "debian" / "rules").chmod(0o755)
+
     run("dpkg-buildpackage", "-b", "--no-sign", "-d", cwd=staging)
 
 

package/debian/control

@@ -4,7 +4,6 @@ Priority: optional
 Maintainer: XRPL Foundation <contact@xrplf.org>
 Rules-Requires-Root: no
 Build-Depends:
- binutils,
  debhelper-compat (= 13)
 Standards-Version: 4.7.0
 Homepage: https://github.com/XRPLF/rippled
@@ -12,6 +11,8 @@ Vcs-Git: https://github.com/XRPLF/rippled.git
 Vcs-Browser: https://github.com/XRPLF/rippled
 
 Package: xrpld
+Section: net
+Priority: optional
 Architecture: any
 Depends:
  ${shlibs:Depends},

package/debian/copyright

@@ -1,5 +1,5 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: xrpld
+Upstream-Name: rippled
 Source: https://github.com/XRPLF/rippled
 
 Files: *
@@ -15,7 +15,7 @@ Copyright: 2016, Ripple Labs Inc.
  2009-2010, Satoshi Nakamoto
  2011, The Bitcoin developers
  2003-2005, Tom Wu
-License: ISC and BSL-1.0 and MIT and Tom-Wu
+License: ISC
 Comment: Built from https://github.com/ripple/validator-keys-tool at the commit
  pinned in cmake/XrplValidatorKeys.cmake. Besides ISC-licensed code it
  incorporates work under the Boost Software License 1.0 (ASIO), the MIT/X11
@@ -35,74 +35,3 @@ License: ISC
  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-License: BSL-1.0
- Boost Software License - Version 1.0 - August 17th, 2003
- .
- Permission is hereby granted, free of charge, to any person or organization
- obtaining a copy of the software and accompanying documentation covered by
- this license (the "Software") to use, reproduce, display, distribute,
- execute, and transmit the Software, and to prepare derivative works of the
- Software, and to permit third-parties to whom the Software is furnished to
- do so, all subject to the following:
- .
- The copyright notices in the Software and this entire statement, including
- the above license grant, this restriction and the following disclaimer,
- must be included in all copies of the Software, in whole or in part, and
- all derivative works of the Software, unless such copies or derivative
- works are solely in the form of machine-executable object code generated by
- a source language processor.
- .
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
- SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
- FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
- ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- DEALINGS IN THE SOFTWARE.
-
-License: MIT
- Permission is hereby granted, free of charge, to any person obtaining a
- copy of this software and associated documentation files (the "Software"),
- to deal in the Software without restriction, including without limitation
- the rights to use, copy, modify, merge, publish, distribute, sublicense,
- and/or sell copies of the Software, and to permit persons to whom the
- Software is furnished to do so, subject to the following conditions:
- .
- The above copyright notice and this permission notice shall be included in
- all copies or substantial portions of the Software.
- .
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- DEALINGS IN THE SOFTWARE.
-
-License: Tom-Wu
- Permission is hereby granted, free of charge, to any person obtaining
- a copy of this software and associated documentation files (the
- "Software"), to deal in the Software without restriction, including
- without limitation the rights to use, copy, modify, merge, publish,
- distribute, sublicense, and/or sell copies of the Software, and to
- permit persons to whom the Software is furnished to do so, subject to
- the following conditions:
- .
- The above copyright notice and this permission notice shall be
- included in all copies or substantial portions of the Software.
- .
- THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
- EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
- WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
- .
- IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL,
- INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER
- RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF
- THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT
- OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- .
- In addition, the following condition applies:
- .
- All redistributions must retain an intact copy of this copyright notice
- and disclaimer.

package/debian/rules

@@ -2,12 +2,6 @@
 
 export DH_VERBOSE = 1
 
-# The glibc the Nix toolchain builds against, and so the real floor for the
-# binaries. dpkg-shlibdeps would instead derive libc6 (>= 2.34) from the build
-# host's symbols file, where sysconf carries that minver, locking out distros
-# the binaries actually run on.
-LIBC_MIN = 2.31
-
 %:
 	dh $@
 
@@ -17,8 +11,6 @@ override_dh_auto_configure override_dh_auto_build override_dh_auto_test:
 override_dh_installsystemd:
 	dh_installsystemd --no-stop-on-upgrade xrpld.service
 
-# The tmpfiles snippet sets ownership to the xrpld user, so the sysusers snippet
-# has to be emitted first: run it early and make its own sequence slot a no-op.
 execute_before_dh_installtmpfiles:
 	dh_installsysusers
 
@@ -30,23 +22,5 @@ override_dh_install:
 	install -D -m 0644 xrpld.cfg        debian/xrpld/etc/xrpld/xrpld.cfg
 	install -D -m 0644 validators.txt   debian/xrpld/etc/xrpld/validators.txt
 
-override_dh_shlibdeps:
-	dh_shlibdeps
-	# Guards against the toolchain moving past LIBC_MIN and the packages then
-	# claiming a floor they do not meet.
-	for binary in xrpld validator-keys; do \
-		needed=$$(readelf --dyn-syms --wide $$binary \
-			| grep -o 'GLIBC_[0-9.]*' | sed 's/GLIBC_//' | sort -uV | tail -1); \
-		if [ -z "$$needed" ]; then \
-			echo "$$binary: no GLIBC_ symbol versions read, cannot check LIBC_MIN" >&2; \
-			exit 1; \
-		fi; \
-		if dpkg --compare-versions "$$needed" gt "$(LIBC_MIN)"; then \
-			echo "$$binary needs glibc $$needed, above LIBC_MIN $(LIBC_MIN)" >&2; \
-			exit 1; \
-		fi; \
-	done
-	sed -i 's/libc6 (>= [0-9.]*)/libc6 (>= $(LIBC_MIN))/' debian/xrpld.substvars
-
 override_dh_dwz:
 	@:

package/debian/xrpld.docs

@@ -1,3 +1,2 @@
 README.md
-LICENSE.md
 validator-keys-LICENSE

package/debian/xrpld.links

@@ -1,3 +1,2 @@
-# Legacy compatibility for pre-FHS package layouts.
-# TODO: remove after rippled fully deprecated.
+# Legacy compat symlinks (remove next major release)
 usr/bin/xrpld          usr/local/bin/rippled

package/debian/xrpld.lintian-overrides

@@ -1,6 +0,0 @@
-# The /usr/local/bin/rippled symlink is deliberate compatibility for pre-FHS
-# layouts, so the Policy 9.1.2 tags it raises are expected.
-# TODO: remove alongside debian/xrpld.links after rippled fully deprecated.
-xrpld: dir-in-usr-local [usr/local/bin/]
-xrpld: file-in-usr-local [usr/local/bin/rippled]
-xrpld: file-in-unusual-dir [usr/local/bin/rippled]

package/docker/Dockerfile

@@ -2,9 +2,9 @@ ARG BASE_IMAGE=debian:trixie
 
 FROM ${BASE_IMAGE}
 
-# Bind-mounted rather than copied in, so the installer never lands in a layer.
-RUN --mount=type=bind,source=bin/install-packaging-tools.sh,target=/install-packaging-tools.sh \
-    /install-packaging-tools.sh
+COPY bin/install-packaging-tools.sh /tmp/install-packaging-tools.sh
+
+RUN /tmp/install-packaging-tools.sh
 
 # See ../README.md, "Publishing from other repositories".
 COPY package/docker/publish_pkg.py /usr/local/bin/publish_pkg.py

package/docker/publish_pkg.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 """Publish built DEB and RPM packages to the XRPLF repositories on Nexus.
 
-Knows nothing about what it uploads beyond the channel, so it publishes whatever
-built the packages; see package/README.md, "Publishing from other repositories".
+Takes packages and a channel, and nothing else, so it publishes whatever built
+them; see package/README.md, "Publishing from other repositories".
 
 RPMs are uploaded to the hosted repository, but yum clients install from the
 'rpm-<channel>' group repository in front of it, which serves signed metadata.
@@ -29,9 +29,6 @@ STALL_TIMEOUT = 300
 ATTEMPTS = 4
 RETRY_DELAY = 5
 
-# 429 is Nexus asking to slow down, not a rejection, so it retries like a 5xx.
-RETRYABLE_STATUSES = (429,)
-
 
 def build_opener() -> urllib.request.OpenerDirector:
     """An opener with no redirect handler, so a 3xx raises instead of being followed.
@@ -50,9 +47,9 @@ def build_opener() -> urllib.request.OpenerDirector:
 def upload(url: str, method: str, headers: dict[str, str], package: Path) -> None:
     """Send one package, retrying only what is worth retrying.
 
-    A 4xx other than 429 is a deterministic rejection, so it is reported at once
-    rather than re-sending the whole body three more times. Nexus explains what
-    it rejected in the response body, so that body is always surfaced.
+    A 4xx is a deterministic rejection, so it is reported at once rather than
+    re-sending the whole body three more times. Nexus explains what it rejected
+    in the response body, so that body is always surfaced.
     """
     opener = build_opener()
 
@@ -70,7 +67,7 @@ def upload(url: str, method: str, headers: dict[str, str], package: Path) -> Non
         except urllib.error.HTTPError as error:
             detail = error.read().decode(errors="replace").strip()
             reason = f"HTTP {error.code}: {detail}"
-            retryable = error.code >= 500 or error.code in RETRYABLE_STATUSES
+            retryable = error.code >= 500
         except (urllib.error.URLError, OSError) as error:
             reason = str(error)
             retryable = True
@@ -124,8 +121,6 @@ def main() -> None:
         token = base64.b64encode(f"{username}:{password}".encode()).decode()
         auth = {"Authorization": f"Basic {token}"}
 
-    # Deliberately not shared with sign_rpm.py: this script ships standalone in
-    # the packaging image for other repositories to run.
     packages = sorted(
         path
         for path in package_dir.rglob("*")

package/rpm/xrpld.spec

@@ -17,11 +17,6 @@ URL:      https://github.com/XRPLF/rippled
 ExclusiveArch: x86_64 aarch64
 BuildRequires: systemd-rpm-macros
 
-# These have to precede %%debug_package: it opens the debuginfo subpackage, and
-# any tag after it is silently dropped from the main package.
-%{?systemd_requires}
-%{?sysusers_requires_compat}
-
 %undefine _debugsource_packages
 %debug_package
 # Level 3 rather than the el9 default of 19: it shrinks the multi-gigabyte
@@ -30,13 +25,10 @@ BuildRequires: systemd-rpm-macros
 %global _binary_payload w3.zstdio
 %global _find_debuginfo_dwz_opts %{nil}
 
-# Reproducibility: the first two take their value from the SOURCE_DATE_EPOCH
-# build_pkg.py exports. Without these the header records the wall clock and the
-# build container's hostname, so two builds of the same commit differ.
-%global clamp_mtime_to_source_date_epoch 1
-%global use_source_date_epoch_as_buildtime 1
-%global _buildhost xrplf.org
+%build_mtime_policy clamp_to_source_date_epoch
 
+%{?systemd_requires}
+%{?sysusers_requires_compat}
 
 %description
 xrpld is the reference implementation of the XRP Ledger protocol. It
@@ -61,7 +53,7 @@ install -Dm0644 %{_sourcedir}/validators.txt       %{buildroot}%{_sysconfdir}/%{
 install -Dm0644 %{_sourcedir}/xrpld.service        %{buildroot}%{_unitdir}/xrpld.service
 install -Dm0644 %{_sourcedir}/xrpld.sysusers       %{buildroot}%{_sysusersdir}/xrpld.conf
 install -Dm0644 %{_sourcedir}/xrpld.tmpfiles       %{buildroot}%{_tmpfilesdir}/xrpld.conf
-install -d %{buildroot}%{_presetdir}
+install -Dm0644 /dev/null %{buildroot}%{_presetdir}/50-xrpld.preset
 cat >%{buildroot}%{_presetdir}/50-xrpld.preset <<'EOF'
 enable xrpld.service
 EOF
@@ -84,7 +76,7 @@ ln -s %{_bindir}/%{name} %{buildroot}/usr/local/bin/rippled
 %sysusers_create_package %{name} %{_sourcedir}/xrpld.sysusers
 
 %post
-%tmpfiles_create_package %{name} %{_sourcedir}/xrpld.tmpfiles
+systemd-tmpfiles --create %{_tmpfilesdir}/xrpld.conf || :
 %systemd_post xrpld.service
 
 %preun
@@ -94,12 +86,11 @@ ln -s %{_bindir}/%{name} %{buildroot}/usr/local/bin/rippled
 %systemd_postun xrpld.service
 
 %files
-%attr(0755,root,root) %dir %{_docdir}/%{name}
 %license %{_docdir}/%{name}/LICENSE.md
 %license %{_docdir}/%{name}/validator-keys-LICENSE
 %doc %{_docdir}/%{name}/README.md
 
-%attr(0755,root,root) %dir %{_sysconfdir}/%{name}
+%dir %{_sysconfdir}/%{name}
 
 %{_bindir}/%{name}
 %{_bindir}/validator-keys
@@ -110,7 +101,7 @@ ln -s %{_bindir}/%{name} %{buildroot}/usr/local/bin/rippled
 
 
 %{_unitdir}/xrpld.service
-%attr(0644,root,root) %{_presetdir}/50-xrpld.preset
+%{_presetdir}/50-xrpld.preset
 %{_sysusersdir}/xrpld.conf
 %{_tmpfilesdir}/xrpld.conf
 %ghost %dir /var/lib/xrpld

package/shared/xrpld.service

@@ -17,8 +17,6 @@ ProtectHome=true
 PrivateTmp=true
 User=xrpld
 Group=xrpld
-# xrpld.tmpfiles creates these at install and boot; these recreate them on
-# every start, so a removed directory does not stop the service.
 StateDirectory=xrpld
 StateDirectoryMode=0750
 LogsDirectory=xrpld

package/sign_rpm.py

@@ -107,8 +107,6 @@ def main() -> None:
     args = parser.parse_args()
     package_dir: Path = args.package_dir
 
-    # Deliberately not shared with publish_pkg.py, which ships standalone in the
-    # packaging image.
     rpms = sorted(path for path in package_dir.rglob("*.rpm") if path.is_file())
     # Signing nothing would otherwise look like a successful signing.
     assert rpms, f"no RPMs found in {package_dir}"

src/libxrpl/ledger/Ledger.cpp

@@ -202,7 +202,14 @@ Ledger::Ledger(
     }
 
     stateMap_.flushDirty(NodeObjectType::AccountNode);
-    setImmutable();
+    // Built locally; see Ledger::setImmutable(). Failed deterministically rather than handing back
+    // a mutable ledger that would abort later at a site that cannot explain why; logicError() logs.
+    if (!setImmutable())
+    {
+        // LCOV_EXCL_START
+        logicError("Ledger::Ledger(CreateGenesisT, ...): genesis ledger map is invalid");
+        // LCOV_EXCL_STOP
+    }
 }
 
 Ledger::Ledger(
@@ -213,7 +220,7 @@ Ledger::Ledger(
     Fees const& fees,
     Family& family,
     beast::Journal j)
-    : immutable_(true)
+    : immutable_(false)
     , txMap_(SHAMapType::TRANSACTION, info.txHash, family)
     , stateMap_(SHAMapType::STATE, info.accountHash, family)
     , fees_(fees)
@@ -236,8 +243,20 @@ Ledger::Ledger(
         JLOG(j.warn()) << "Don't have state data root for ledger" << header_.seq;
     }
 
-    txMap_.setImmutable();
-    stateMap_.setImmutable();
+    // Loaded locally; see Ledger::setImmutable().
+    if (setMapsImmutable())
+    {
+        immutable_ = true;
+    }
+    else
+    {
+        // LCOV_EXCL_START
+        JLOG(j.error()) << "Invalid map for ledger " << header_.seq;
+        UNREACHABLE("xrpl::Ledger::Ledger(LedgerHeader const&, ...) : map is invalid");
+        // Treat it as a damaged ledger: the code below recomputes the hash and re-acquires.
+        loaded = false;
+        // LCOV_EXCL_STOP
+    }
 
     if (!setup())
         loaded = false;
@@ -278,8 +297,12 @@ Ledger::Ledger(Ledger const& prevLedger, NetClock::time_point closeTime)
     }
 }
 
+// The maps start out Synching and are filled in afterwards, by an acquisition syncing against the
+// hashes the header carries or by a replay that only reads the header. So those hashes are input
+// rather than derived, and immutable_ stays false until setImmutable() finds both maps sound.
 Ledger::Ledger(LedgerHeader const& info, Rules rules, Family& family)
-    : immutable_(true)
+    : immutable_(false)
+    , mapHashesFromHeader_(true)
     , txMap_(SHAMapType::TRANSACTION, info.txHash, family)
     , stateMap_(SHAMapType::STATE, info.accountHash, family)
     , rules_(std::move(rules))
@@ -308,27 +331,52 @@ Ledger::Ledger(
     setup();
 }
 
-void
+bool
 Ledger::setImmutable(bool rehash)
 {
-    // Force update, since this is the only
-    // place the hash transitions to valid
-    if (!immutable_ && rehash)
+    // A map found structurally invalid during sync must never be made immutable: isValid() tests
+    // only for Invalid, and an immutable ledger is treated as persistable. Asked before anything is
+    // written, so a refusal leaves the header exactly as it was rather than half relabelled.
+    if (!mapsValid())
+        return false;
+
+    // Read here but written to the header below, once the maps are settled: getHash() can unshare a
+    // dirty tree, so it has to run while the map is still mutable, while a write to the header must
+    // wait until both maps have made it. Skipped once the ledger is immutable, since its maps can
+    // no longer change, and skipped when the header supplied these hashes: deriving them from a map
+    // that fell short of its target would relabel the ledger instead of failing.
+    bool const deriveMapHashes = !immutable_ && !mapHashesFromHeader_ && rehash;
+    uint256 const txHash = deriveMapHashes ? txMap_.getHash().asUInt256() : uint256{};
+    uint256 const accountHash = deriveMapHashes ? stateMap_.getHash().asUInt256() : uint256{};
+
+    // Both were valid at the check above, but a concurrent walk can invalidate one in between (see
+    // SHAMap::state_), so the result is checked rather than assumed. Best-effort by nature: the
+    // guard narrows the window, it does not close it, since setInvalid() outranks Immutable and can
+    // land after both maps have been settled.
+    bool const bothImmutable = setMapsImmutable();
+    SOMETIMES(!bothImmutable, "xrpl::Ledger::setImmutable : map invalidated while going immutable");
+    if (!bothImmutable)
+        return false;
+
+    // Written only now, so losing the race above leaves the header describing what the ledger was
+    // built from rather than a map that has since been abandoned. Forced rather than conditional,
+    // since this is the only place the hash transitions to valid.
+    if (deriveMapHashes)
     {
-        header_.txHash = txMap_.getHash().asUInt256();
-        header_.accountHash = stateMap_.getHash().asUInt256();
+        header_.txHash = txHash;
+        header_.accountHash = accountHash;
     }
 
     if (rehash)
         header_.hash = calculateLedgerHash(header_);
 
+    // Set last, so isImmutable() never reports a ledger whose maps are not both immutable.
     immutable_ = true;
-    txMap_.setImmutable();
-    stateMap_.setImmutable();
     setup();
+    return true;
 }
 
-void
+bool
 Ledger::setAccepted(
     NetClock::time_point closeTime,
     NetClock::duration closeResolution,
@@ -340,7 +388,17 @@ Ledger::setAccepted(
     header_.closeTime = closeTime;
     header_.closeTimeResolution = closeResolution;
     header_.closeFlags = correctCloseTime ? 0 : kSLcfNoConsensusTime;
-    setImmutable();
+    // Built locally; see Ledger::setImmutable().
+    if (!setImmutable())
+    {
+        // LCOV_EXCL_START
+        JLOG(j_.error()) << "Invalid map for accepted ledger " << header_.seq;
+        UNREACHABLE("xrpl::Ledger::setAccepted : map is invalid");
+        return false;
+        // LCOV_EXCL_STOP
+    }
+
+    return true;
 }
 
 bool

src/libxrpl/ledger/View.cpp

@@ -543,19 +543,12 @@ doWithdraw(
 {
     auto const dstSle = ctx.view.read(keylet::account(dstAcct));
 
-    // Create a trust line or MPToken for a self-destination only when there
-    // is a payout to credit. Post-fixCleanup3_4_0, a zero-value withdraw
-    // (e.g. share redemption from a fully impaired vault) must not insert
-    // an empty holding: that records a one-sided zero delta and can also
-    // create+delete MPTokens in the same transaction.
+    // Create trust line or MPToken for the receiving account
     if (dstAcct == senderAcct)
     {
-        if (amount > beast::kZero || !ctx.view.rules().enabled(fixCleanup3_4_0))
-        {
-            if (auto const ter = addEmptyHolding(ctx, senderAcct, priorBalance, amount.asset(), j);
-                !isTesSuccess(ter) && ter != tecDUPLICATE)
-                return ter;
-        }
+        if (auto const ter = addEmptyHolding(ctx, senderAcct, priorBalance, amount.asset(), j);
+            !isTesSuccess(ter) && ter != tecDUPLICATE)
+            return ter;
     }
     else
     {

src/libxrpl/ledger/helpers/AMMHelpers.cpp

@@ -11,6 +11,7 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/Sandbox.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/CredentialHelpers.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
@@ -690,6 +691,12 @@ deleteAMMTrustLines(
 
                 return {deleteAMMTrustLine(sb, sleItem, ammAccountID, j), SkipEntry::No};
             }
+            // A credential naming the pseudo-account as subject can't be
+            // accepted or deleted by it and would otherwise permanently pin the
+            // AMM. Clean it up here, inside the same bounded walk, so the
+            // pinned AMM can still be deleted.
+            if (sb.rules().enabled(fixCleanup3_4_0) && nodeType == ltCREDENTIAL)
+                return {credentials::deleteSLE(sb, sleItem, j), SkipEntry::No};
             // LCOV_EXCL_START
             JLOG(j.error()) << "deleteAMMObjects: deleting non-trustline or non-MPT " << nodeType;
             return {tecINTERNAL, SkipEntry::No};
@@ -767,6 +774,8 @@ deleteAMMAccount(Sandbox& sb, Asset const& asset, Asset const& asset2, beast::Jo
         // LCOV_EXCL_STOP
     }
 
+    // deleteAMMTrustLines also removes any credentials pinned to the AMM
+    // pseudo-account, within its bounded walk.
     if (auto const ter = deleteAMMTrustLines(sb, ammAccountID, kMaxDeletableAmmTrustLines, j);
         !isTesSuccess(ter))
         return ter;
@@ -908,6 +917,11 @@ isOnlyLiquidityProvider(ReadView const& view, Issue const& ammIssue, AccountID c
                 ++nMPT;
                 continue;
             }
+            // A credential naming the pseudo-account as subject can be pinned
+            // to its owner directory. Ignore it here; deleteAMMTrustLines
+            // removes it when the AMM is deleted.
+            if (view.rules().enabled(fixCleanup3_4_0) && entryType == ltCREDENTIAL)
+                continue;
             if (entryType != ltRIPPLE_STATE)
                 return std::unexpected<TER>(tecINTERNAL);  // LCOV_EXCL_LINE
             auto const lowLimit = sle->getFieldAmount(sfLowLimit);

src/libxrpl/ledger/helpers/CredentialHelpers.cpp

@@ -5,8 +5,10 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
@@ -127,6 +129,36 @@ deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j)
     return tesSUCCESS;
 }
 
+TER
+deletePseudoAccountCredentials(
+    ApplyView& view,
+    AccountID const& pseudoAcct,
+    std::uint16_t maxNodesToDelete,
+    beast::Journal j)
+{
+    XRPL_ASSERT(
+        isPseudoAccount(view.read(keylet::account(pseudoAcct))),
+        "xrpl::credentials::deletePseudoAccountCredentials : is a pseudo-account");
+
+    // Delete the credentials linked into the pseudo-account's owner directory,
+    // visiting at most maxNodesToDelete entries. Any other object is left in
+    // place; the caller's own checks decide whether the remaining directory
+    // blocks deletion. If the bound is reached, cleanupOnAccountDelete returns
+    // tecINCOMPLETE and the caller propagates it so a later transaction resumes.
+    return cleanupOnAccountDelete(
+        view,
+        keylet::ownerDir(pseudoAcct),
+        [&view, &j](LedgerEntryType nodeType, uint256 const&, SLE::pointer& sleItem)
+            -> std::pair<TER, SkipEntry> {
+            if (nodeType == ltCREDENTIAL)
+                return {deleteSLE(view, sleItem, j), SkipEntry::No};
+
+            return {tesSUCCESS, SkipEntry::Yes};
+        },
+        j,
+        maxNodesToDelete);
+}
+
 NotTEC
 checkFields(STTx const& tx, Rules const& rules, beast::Journal j)
 {

src/libxrpl/ledger/helpers/MPTokenHelpers.cpp

@@ -184,8 +184,6 @@ addEmptyHolding(
     auto const mpt = ctx.view.peek(keylet::mptokenIssuance(mptID));
     if (!mpt)
         return tefINTERNAL;  // LCOV_EXCL_LINE
-    // Unlike IOU addEmptyHolding (post-fixCleanup3_4_0), a locked issuance is
-    // still rejected before the "MPToken already exists" short circuit.
     if (mpt->isFlag(lsfMPTLocked))
         return tefINTERNAL;  // LCOV_EXCL_LINE
     if (ctx.view.peek(keylet::mptoken(mptID, accountID)))

src/libxrpl/ledger/helpers/RippleStateHelpers.cpp

@@ -652,32 +652,21 @@ addEmptyHolding(
 
     auto const& issuerId = issue.getIssuer();
     auto const& currency = issue.currency;
+    if (isGlobalFrozen(ctx.view, issuerId))
+        return tecFROZEN;  // LCOV_EXCL_LINE
+
     auto const& srcId = issuerId;
     auto const& dstId = accountID;
     auto const high = srcId > dstId;
     auto const index = keylet::trustLine(srcId, dstId, currency);
-    // Post-fixCleanup3_4_0: an existing line is a no-op. Issuer freeze and
-    // DefaultRipple only matter when this function has to create a line.
-    bool const fix340Enabled = ctx.view.rules().enabled(fixCleanup3_4_0);
-    if (fix340Enabled && ctx.view.exists(index))
-        return tecDUPLICATE;
-
-    if (isGlobalFrozen(ctx.view, issuerId))
-        return tecFROZEN;  // LCOV_EXCL_LINE
-
     auto const sleSrc = ctx.view.peek(keylet::account(srcId));
     auto const sleDst = ctx.view.peek(keylet::account(dstId));
     if (!sleDst || !sleSrc)
         return tefINTERNAL;  // LCOV_EXCL_LINE
-    // Create path: DefaultRipple is still required. terNO_RIPPLE is
-    // intentional so VaultWithdraw / CoverWithdraw fail in preclaim via
-    // canAddHolding (retryable, no fee) rather than claiming a tec* fee
-    // in doApply. Transactor::operator() will not apply and will not
-    // convert it to tefINTERNAL.
     if (!sleSrc->isFlag(lsfDefaultRipple))
-        return fix340Enabled ? TER{terNO_RIPPLE} : tecINTERNAL;
+        return tecINTERNAL;  // LCOV_EXCL_LINE
     // If the line already exists, don't create it again.
-    if (!fix340Enabled && ctx.view.exists(index))
+    if (ctx.view.read(index))
         return tecDUPLICATE;
 
     // A reserve sponsor only covers tx.Account's own objects.

src/libxrpl/ledger/helpers/TokenHelpers.cpp

@@ -583,32 +583,6 @@ canAddHolding(ReadView const& view, Asset const& asset)
         asset.value());
 }
 
-[[nodiscard]] bool
-holdingExists(ReadView const& view, AccountID const& account, Issue const& issue)
-{
-    if (issue.native() || account == issue.getIssuer())
-        return true;
-    return view.exists(keylet::trustLine(account, issue));
-}
-
-[[nodiscard]] bool
-holdingExists(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue)
-{
-    if (account == mptIssue.getIssuer())
-        return true;
-    return view.exists(keylet::mptoken(mptIssue.getMptID(), account));
-}
-
-[[nodiscard]] bool
-holdingExists(ReadView const& view, AccountID const& account, Asset const& asset)
-{
-    return std::visit(
-        [&]<ValidIssueType TIss>(TIss const& issue) -> bool {
-            return holdingExists(view, account, issue);
-        },
-        asset.value());
-}
-
 TER
 addEmptyHolding(
     ApplyViewContext ctx,

src/libxrpl/peerfinder/Config.cpp

@@ -107,12 +107,8 @@ Config::makeConfig(
     else
     {
         config.outPeers = *limits.outPeers;
-
-        // Inbound slots only exist if we accept incoming connections, and
-        // `maxPeers` is the total across both directions. The legacy branch
-        // above upholds the same two invariants.
-        config.inPeers = config.wantIncoming ? *limits.inPeers : 0;
-        config.maxPeers = config.inPeers + config.outPeers;
+        config.inPeers = *limits.inPeers;
+        config.maxPeers = 0;
     }
 
     // This will cause servers configured as validators to request that

src/libxrpl/protocol/BuildInfo.cpp

@@ -23,7 +23,7 @@ namespace {
 //------------------------------------------------------------------------------
 // clang-format off
 // NOLINTNEXTLINE(readability-identifier-naming)
-char const* const versionString = "3.4.0-rc1"
+char const* const versionString = "3.4.0-b3"
     // clang-format on
     ;
 

src/libxrpl/protocol/ConfidentialTransfer.cpp

@@ -6,11 +6,9 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBlob.h>
-#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
@@ -399,59 +397,6 @@ checkEncryptedAmountFormat(STObject const& object)
     return tesSUCCESS;
 }
 
-bool
-isIssuerMirrorCurrent(SLE const& issuance, SLE const& mptoken)
-{
-    XRPL_ASSERT(
-        issuance.getType() == ltMPTOKEN_ISSUANCE,
-        "xrpl::isIssuerMirrorCurrent : issuance MPTokenIssuance object");
-    XRPL_ASSERT(
-        mptoken.getType() == ltMPTOKEN, "xrpl::isIssuerMirrorCurrent : mptoken MPToken object");
-
-    return mptoken.isFieldPresent(sfIssuerEncryptedBalance) &&
-        mptoken[~sfIssuerKeyMirrorEpoch].value_or(0) == issuance[~sfIssuerKeyEpoch].value_or(0);
-}
-
-bool
-isAuditorMirrorCurrent(SLE const& issuance, SLE const& mptoken)
-{
-    XRPL_ASSERT(
-        issuance.getType() == ltMPTOKEN_ISSUANCE,
-        "xrpl::isAuditorMirrorCurrent : issuance MPTokenIssuance object");
-    XRPL_ASSERT(
-        mptoken.getType() == ltMPTOKEN, "xrpl::isAuditorMirrorCurrent : mptoken MPToken object");
-
-    if (!issuance.isFieldPresent(sfAuditorEncryptionKey))
-        return true;
-
-    return mptoken.isFieldPresent(sfAuditorEncryptedBalance) &&
-        mptoken[~sfAuditorKeyMirrorEpoch].value_or(0) == issuance[~sfAuditorKeyEpoch].value_or(0);
-}
-
-bool
-areMirrorsCurrent(SLE const& issuance, SLE const& mptoken)
-{
-    return isIssuerMirrorCurrent(issuance, mptoken) && isAuditorMirrorCurrent(issuance, mptoken);
-}
-
-void
-setMirrorEpochs(SLE const& issuance, SLE& mptoken)
-{
-    XRPL_ASSERT(
-        issuance.getType() == ltMPTOKEN_ISSUANCE,
-        "xrpl::setMirrorEpochs : issuance MPTokenIssuance object");
-    XRPL_ASSERT(mptoken.getType() == ltMPTOKEN, "xrpl::setMirrorEpochs : mptoken MPToken object");
-
-    if (auto const epoch = issuance[~sfIssuerKeyEpoch].value_or(0); epoch != 0)
-        mptoken[sfIssuerKeyMirrorEpoch] = epoch;
-
-    if (mptoken.isFieldPresent(sfAuditorEncryptedBalance))
-    {
-        if (auto const epoch = issuance[~sfAuditorKeyEpoch].value_or(0); epoch != 0)
-            mptoken[sfAuditorKeyMirrorEpoch] = epoch;
-    }
-}
-
 TER
 verifySchnorrProof(Slice const& pubKeySlice, Slice const& proofSlice, uint256 const& contextHash)
 {

src/libxrpl/protocol/NFTSyntheticSerializer.cpp

@@ -0,0 +1,24 @@
+#include <xrpl/protocol/NFTSyntheticSerializer.h>
+
+#include <xrpl/json/json_value.h>
+#include <xrpl/protocol/NFTokenID.h>
+#include <xrpl/protocol/NFTokenOfferID.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TxMeta.h>
+#include <xrpl/protocol/jss.h>
+
+#include <memory>
+
+namespace xrpl::rpc {
+
+void
+insertNFTSyntheticInJson(
+    json::Value& response,
+    std::shared_ptr<STTx const> const& transaction,
+    TxMeta const& transactionMeta)
+{
+    insertNFTokenID(response[jss::meta], transaction, transactionMeta);
+    insertNFTokenOfferID(response[jss::meta], transaction, transactionMeta);
+}
+
+}  // namespace xrpl::rpc

src/libxrpl/protocol/STTx.cpp

@@ -168,10 +168,10 @@ STTx::getMentionedAccounts() const
 }
 
 static Blob
-getSigningData(STTx const& that, HashPrefix prefix)
+getSigningData(STTx const& that)
 {
     Serializer s;
-    s.add32(prefix);
+    s.add32(HashPrefix::TxSign);
     that.addWithoutSigningFields(s);
     return s.getData();
 }
@@ -212,42 +212,30 @@ STTx::getSeqProxy() const
     return SeqProxy::rawTicket(*ticketSeq);
 }
 
-void
-STTx::sign(PublicKey const& publicKey, SecretKey const& secretKey)
-{
-    // The account's own signature always covers the plain transaction prefix;
-    // see signingPrefix for the role signatures that do not.
-    auto const data = getSigningData(*this, HashPrefix::TxSign);
-
-    setFieldVL(sfTxnSignature, xrpl::sign(publicKey, secretKey, makeSlice(data)));
-    tid_ = getHash(HashPrefix::TransactionId);
-}
-
 void
 STTx::sign(
     PublicKey const& publicKey,
     SecretKey const& secretKey,
-    SignatureRole role,
-    Rules const& rules)
+    std::optional<std::reference_wrapper<SField const>> signatureTarget)
 {
-    auto const data = getSigningData(*this, signingPrefix(role, false, rules));
+    auto const data = getSigningData(*this);
 
     auto const sig = xrpl::sign(publicKey, secretKey, makeSlice(data));
 
-    if (auto const target = signatureField(role))
+    if (signatureTarget)
     {
-        peekFieldObject(*target).setFieldVL(sfTxnSignature, sig);
+        auto& target = peekFieldObject(*signatureTarget);
+        target.setFieldVL(sfTxnSignature, sig);
     }
     else
     {
         setFieldVL(sfTxnSignature, sig);
     }
-
     tid_ = getHash(HashPrefix::TransactionId);
 }
 
 std::expected<void, std::string>
-STTx::checkSign(Rules const& rules, STObject const& sigObject, SignatureRole role) const
+STTx::checkSign(Rules const& rules, STObject const& sigObject) const
 {
     try
     {
@@ -256,10 +244,8 @@ STTx::checkSign(Rules const& rules, STObject const& sigObject, SignatureRole rol
         // multi-signing.  Otherwise we're single-signing.
 
         Blob const& signingPubKey = sigObject.getFieldVL(sfSigningPubKey);
-        bool const multiSigning = signingPubKey.empty();
-        auto const prefix = signingPrefix(role, multiSigning, rules);
-        return multiSigning ? checkMultiSign(sigObject, prefix)
-                            : checkSingleSign(sigObject, prefix);
+        return signingPubKey.empty() ? checkMultiSign(rules, sigObject)
+                                     : checkSingleSign(sigObject);
     }
     catch (...)
     {
@@ -270,20 +256,20 @@ STTx::checkSign(Rules const& rules, STObject const& sigObject, SignatureRole rol
 std::expected<void, std::string>
 STTx::checkSign(Rules const& rules) const
 {
-    if (auto const ret = checkSign(rules, *this, SignatureRole::Transaction); !ret)
+    if (auto const ret = checkSign(rules, *this); !ret)
         return ret;
 
     if (isFieldPresent(sfCounterpartySignature))
     {
         auto const counterSig = getFieldObject(sfCounterpartySignature);
-        if (auto const ret = checkSign(rules, counterSig, SignatureRole::Counterparty); !ret)
+        if (auto const ret = checkSign(rules, counterSig); !ret)
             return std::unexpected("Counterparty: " + ret.error());
     }
 
     if (isFieldPresent(sfSponsorSignature))
     {
         auto const sponsorSignatureObj = getFieldObject(sfSponsorSignature);
-        if (auto const ret = checkSign(rules, sponsorSignatureObj, SignatureRole::Sponsor); !ret)
+        if (auto const ret = checkSign(rules, sponsorSignatureObj); !ret)
             return std::unexpected("Sponsor: " + ret.error());
     }
 
@@ -291,14 +277,14 @@ STTx::checkSign(Rules const& rules) const
     // of signature checking.
     if (isFieldPresent(sfBatchSigners))
     {
-        if (auto const ret = checkBatchSign(); !ret)
+        if (auto const ret = checkBatchSign(rules); !ret)
             return ret;
     }
     return {};
 }
 
 std::expected<void, std::string>
-STTx::checkBatchSign() const
+STTx::checkBatchSign(Rules const& rules) const
 {
     try
     {
@@ -332,7 +318,7 @@ STTx::checkBatchSign() const
         for (auto const& signer : signers)
         {
             Blob const& signingPubKey = signer.getFieldVL(sfSigningPubKey);
-            auto const result = signingPubKey.empty() ? checkBatchMultiSign(signer, txIds)
+            auto const result = signingPubKey.empty() ? checkBatchMultiSign(signer, rules, txIds)
                                                       : checkBatchSingleSign(signer, txIds);
 
             if (!result)
@@ -461,9 +447,9 @@ singleSignHelper(STObject const& sigObject, Slice const& data)
 }
 
 std::expected<void, std::string>
-STTx::checkSingleSign(STObject const& sigObject, HashPrefix prefix) const
+STTx::checkSingleSign(STObject const& sigObject) const
 {
-    auto const data = getSigningData(*this, prefix);
+    auto const data = getSigningData(*this);
     return singleSignHelper(sigObject, makeSlice(data));
 }
 
@@ -481,7 +467,8 @@ std::expected<void, std::string>
 multiSignHelper(
     STObject const& sigObject,
     std::optional<AccountID> txnAccountID,
-    std::function<Serializer(AccountID const&)> makeMsg)
+    std::function<Serializer(AccountID const&)> makeMsg,
+    Rules const& rules)
 {
     // Make sure the MultiSigners are present.  Otherwise they are not
     // attempting multi-signing and we just have a bad SigningPubKey.
@@ -554,7 +541,10 @@ multiSignHelper(
 }
 
 std::expected<void, std::string>
-STTx::checkBatchMultiSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const
+STTx::checkBatchMultiSign(
+    STObject const& batchSigner,
+    Rules const& rules,
+    std::vector<uint256> const& txIds) const
 {
     XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchMultiSign : batch transaction");
     // We can ease the computational load inside the loop a bit by
@@ -565,15 +555,18 @@ STTx::checkBatchMultiSign(STObject const& batchSigner, std::vector<uint256> cons
     serializeBatch(dataStart, getAccountID(sfAccount), getSeqProxy().value(), getFlags(), txIds);
     dataStart.addBitString(batchSignerAccount);
     return multiSignHelper(
-        batchSigner, batchSignerAccount, [&dataStart](AccountID const& accountID) -> Serializer {
+        batchSigner,
+        batchSignerAccount,
+        [&dataStart](AccountID const& accountID) -> Serializer {
             Serializer s = dataStart;
             finishMultiSigningData(accountID, s);
             return s;
-        });
+        },
+        rules);
 }
 
 std::expected<void, std::string>
-STTx::checkMultiSign(STObject const& sigObject, HashPrefix prefix) const
+STTx::checkMultiSign(Rules const& rules, STObject const& sigObject) const
 {
     // Used inside the loop in multiSignHelper to enforce that
     // the account owner may not multisign for themselves.
@@ -585,13 +578,16 @@ STTx::checkMultiSign(STObject const& sigObject, HashPrefix prefix) const
     // We can ease the computational load inside the loop a bit by
     // pre-constructing part of the data that we hash.  Fill a Serializer
     // with the stuff that stays constant from signature to signature.
-    Serializer dataStart = startMultiSigningData(*this, prefix);
+    Serializer dataStart = startMultiSigningData(*this);
     return multiSignHelper(
-        sigObject, txnAccountID, [&dataStart](AccountID const& accountID) -> Serializer {
+        sigObject,
+        txnAccountID,
+        [&dataStart](AccountID const& accountID) -> Serializer {
             Serializer s = dataStart;
             finishMultiSigningData(accountID, s);
             return s;
-        });
+        },
+        rules);
 }
 
 void

src/libxrpl/protocol/STValidation.cpp

@@ -59,10 +59,6 @@ STValidation::validationFormat()
         {sfBaseFeeDrops,          SoeOptional},
         {sfReserveBaseDrops,      SoeOptional},
         {sfReserveIncrementDrops, SoeOptional},
-        // featureSmartEscrow
-        {sfGasLimit,               SoeOptional},
-        {sfBytecodeSizeLimit,      SoeOptional},
-        {sfGasPrice,               SoeOptional},
     };
     // clang-format on
 

src/libxrpl/protocol/Sign.cpp

@@ -1,77 +1,17 @@
 #include <xrpl/protocol/Sign.h>
 
-#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STExchange.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/Serializer.h>
 
-#include <optional>
-
 namespace xrpl {
 
-SField const*
-signatureField(SignatureRole role)
-{
-    switch (role)
-    {
-        case SignatureRole::Transaction:
-            return nullptr;
-        case SignatureRole::Counterparty:
-            return &sfCounterpartySignature;
-        case SignatureRole::Sponsor:
-            return &sfSponsorSignature;
-    }
-    UNREACHABLE("xrpl::signatureField : unknown SignatureRole");
-    return nullptr;
-}
-
-std::optional<SignatureRole>
-signatureRole(SField const& sigField)
-{
-    if (sigField == sfCounterpartySignature)
-        return SignatureRole::Counterparty;
-    if (sigField == sfSponsorSignature)
-        return SignatureRole::Sponsor;
-    return std::nullopt;
-}
-
-// Signature validity depends on fixCleanup3_4_0: a role signature covers
-// different bytes before and after the amendment activates. checkValidity
-// caches its verdict per transaction ID, so it keeps two separate cache slots
-// for role-signature transactions (kSfSiggoodOldPrefix / kSfSigbadOldPrefix in
-// tx/apply.cpp) to keep a pre-fix verdict from being reused in the post-fix
-// era, and vice versa. See the block comment in tx/apply.cpp for the details
-// and the reason both directions matter.
-HashPrefix
-signingPrefix(SignatureRole role, bool multiSigning, Rules const& rules)
-{
-    // Before fixCleanup3_4_0 every signature on a transaction covered the same
-    // bytes, so a signature could be moved from one role to another.
-    if (!rules.enabled(fixCleanup3_4_0))
-        return multiSigning ? HashPrefix::TxMultiSign : HashPrefix::TxSign;
-
-    switch (role)
-    {
-        case SignatureRole::Transaction:
-            return multiSigning ? HashPrefix::TxMultiSign : HashPrefix::TxSign;
-        case SignatureRole::Counterparty:
-            return multiSigning ? HashPrefix::CounterpartyTxMultiSign
-                                : HashPrefix::CounterpartyTxSign;
-        case SignatureRole::Sponsor:
-            return multiSigning ? HashPrefix::SponsorTxMultiSign : HashPrefix::SponsorTxSign;
-    }
-    UNREACHABLE("xrpl::signingPrefix : unknown SignatureRole");
-    return multiSigning ? HashPrefix::TxMultiSign : HashPrefix::TxSign;
-}
-
 void
 sign(
     STObject& st,
@@ -130,18 +70,18 @@ verify(STObject const& st, HashPrefix const& prefix, PublicKey const& pk, SF_VL
 // So, if we support multiple levels of signing, then we'll need to
 // incorporate the "signing for" accounts into the signing data as well.
 Serializer
-buildMultiSigningData(STObject const& obj, AccountID const& signingID, HashPrefix prefix)
+buildMultiSigningData(STObject const& obj, AccountID const& signingID)
 {
-    Serializer s{startMultiSigningData(obj, prefix)};
+    Serializer s{startMultiSigningData(obj)};
     finishMultiSigningData(signingID, s);
     return s;
 }
 
 Serializer
-startMultiSigningData(STObject const& obj, HashPrefix prefix)
+startMultiSigningData(STObject const& obj)
 {
     Serializer s;
-    s.add32(prefix);
+    s.add32(HashPrefix::TxMultiSign);
     obj.addWithoutSigningFields(s);
     return s;
 }

src/libxrpl/protocol/TER.cpp

@@ -108,8 +108,6 @@ transResults()
         MAKE_ERROR(tecPRECISION_LOSS,                "The amounts used by the transaction cannot interact."),
         MAKE_ERROR(tecBAD_PROOF,                     "Proof cannot be verified"),
         MAKE_ERROR(tecNO_SPONSOR_PERMISSION,         "Sponsor has not authorized this transaction."),
-        MAKE_ERROR(tecOUT_OF_GAS,                    "The WASM code ran out of gas during execution."),
-        MAKE_ERROR(tecBYTECODE_REJECTED,             "The custom WASM code that was run rejected your transaction."),
 
         MAKE_ERROR(tefALREADY,                     "The exact transaction was already in this ledger."),
         MAKE_ERROR(tefBAD_ADD_AUTH,                "Not authorized to add account."),
@@ -135,8 +133,6 @@ transResults()
         MAKE_ERROR(tefINVALID_LEDGER_FIX_TYPE,     "The LedgerFixType field has an invalid value."),
         MAKE_ERROR(tefNO_DST_PARTIAL,              "Partial payment to create account not allowed."),
         MAKE_ERROR(tefBAD_PATH_COUNT,              "Malformed: Too many paths."),
-        MAKE_ERROR(tefNO_BYTECODE,                 "There is no WASM code to run, but a WASM-specific field was included."),
-        MAKE_ERROR(tefBYTECODE_NOT_INCLUDED,       "WASM code requires a field that was not included."),
 
         MAKE_ERROR(telLOCAL_ERROR,            "Local failure."),
         MAKE_ERROR(telBAD_DOMAIN,             "Domain too long."),
@@ -208,8 +204,6 @@ transResults()
         MAKE_ERROR(temBAD_TRANSFER_FEE,          "Malformed: Transfer fee is outside valid range."),
         MAKE_ERROR(temINVALID_INNER_BATCH,       "Malformed: Invalid inner batch transaction."),
         MAKE_ERROR(temBAD_CIPHERTEXT,            "Malformed: Invalid ciphertext."),
-        MAKE_ERROR(temINVALID_BYTECODE,          "Malformed: Provided byte code is invalid."),
-        MAKE_ERROR(temTEMP_DISABLED,             "The transaction requires logic that is currently temporarily disabled."),
 
         MAKE_ERROR(terRETRY,                  "Retry transaction."),
         MAKE_ERROR(terFUNDS_SPENT,            "DEPRECATED."),

src/libxrpl/shamap/SHAMap.cpp

@@ -26,6 +26,7 @@
 
 #include <boost/smart_ptr/intrusive_ptr.hpp>
 
+#include <atomic>
 #include <cstdint>
 #include <exception>
 #include <functional>
@@ -77,14 +78,25 @@ SHAMap::SHAMap(SHAMap const& other, bool isMutable)
     : f_(other.f_)
     , journal_(other.f_.journal())
     , cowid_(other.cowid_ + 1)
-    , ledgerSeq_(other.ledgerSeq_)
+    , ledgerSeq_(other.ledgerSeq())
     , root_(other.root_)
-    , state_(isMutable ? SHAMapState::Modifying : SHAMapState::Immutable)
     , type_(other.type_)
     , backed_(other.backed_)
 {
+    // A snapshot shares the source's root, so Invalid carries over rather than being promoted to
+    // Modifying or Immutable, either of which would pass isValid(). Carried rather than refused,
+    // since a constructor cannot refuse. Read once into a local, or a concurrent walk could have
+    // the source report one state here and another below.
+    auto const otherState = other.state();
+    auto const ownState = [&] {
+        if (otherState == SHAMapState::Invalid)
+            return SHAMapState::Invalid;
+        return isMutable ? SHAMapState::Modifying : SHAMapState::Immutable;
+    }();
+    state_.store(ownState, std::memory_order_release);
+
     // If either map may change, they cannot share nodes
-    if ((state_ != SHAMapState::Immutable) || (other.state_ != SHAMapState::Immutable))
+    if ((ownState != SHAMapState::Immutable) || (otherState != SHAMapState::Immutable))
     {
         unshare();
     }
@@ -105,7 +117,7 @@ SHAMap::dirtyUp(SharedPtrNodeStack& stack, uint256 const& target, SHAMapTreeNode
     // child can be an inner node or a leaf
 
     XRPL_ASSERT(
-        (state_ != SHAMapState::Synching) && (state_ != SHAMapState::Immutable),
+        (state() != SHAMapState::Synching) && (state() != SHAMapState::Immutable),
         "xrpl::SHAMap::dirtyUp : valid state");
     XRPL_ASSERT(child && (child->cowid() == cowid_), "xrpl::SHAMap::dirtyUp : valid child input");
 
@@ -165,7 +177,7 @@ SHAMapTreeNodePtr
 SHAMap::fetchNodeFromDB(SHAMapHash const& hash) const
 {
     XRPL_ASSERT(backed_, "xrpl::SHAMap::fetchNodeFromDB : is backed");
-    auto obj = f_.db().fetchNodeObject(hash.asUInt256(), ledgerSeq_);
+    auto obj = f_.db().fetchNodeObject(hash.asUInt256(), ledgerSeq());
     return finishFetch(hash, obj);
 }
 
@@ -178,10 +190,15 @@ SHAMap::finishFetch(SHAMapHash const& hash, std::shared_ptr<NodeObject> const& o
     {
         if (!object)
         {
-            if (full_)
+            // A missing node disproves full_, so withdraw it and report the gap. The exchange
+            // rather than a test-then-clear pair is what leaves only one of the reader threads
+            // that miss reporting; the relaxed load ahead of it keeps a map that is already not
+            // full off the exclusive-write path, since full_ shares a cache line with state_ and
+            // ledgerSeq_ and a walk posts up to 512 reads per pass.
+            if (full_.load(std::memory_order_relaxed) &&
+                full_.exchange(false, std::memory_order_acq_rel))
             {
-                full_ = false;
-                f_.missingNodeAcquireBySeq(ledgerSeq_, hash.asUInt256());
+                f_.missingNodeAcquireBySeq(ledgerSeq(), hash.asUInt256());
             }
             return {};
         }
@@ -214,7 +231,7 @@ SHAMap::checkFilter(SHAMapHash const& hash, SHAMapSyncFilter const* filter) cons
             auto node = SHAMapTreeNode::makeFromPrefix(makeSlice(*nodeData), hash);
             if (node)
             {
-                filter->gotNode(true, hash, ledgerSeq_, std::move(*nodeData), node->getType());
+                filter->gotNode(true, hash, ledgerSeq(), std::move(*nodeData), node->getType());
                 if (backed_)
                     canonicalize(hash, node);
             }
@@ -394,7 +411,7 @@ SHAMap::descendAsync(
         {
             f_.db().asyncFetch(
                 hash.asUInt256(),
-                ledgerSeq_,
+                ledgerSeq(),
                 [this, hash, cb{std::move(callback)}](std::shared_ptr<NodeObject> const& object) {
                     auto node = finishFetch(hash, object);
                     cb(node, hash);
@@ -419,7 +436,7 @@ SHAMap::unshareNode(intr_ptr::SharedPtr<Node> node, SHAMapNodeID const& nodeID)
     if (node->cowid() != cowid_)
     {
         // have a CoW
-        XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::unshareNode : not immutable");
+        XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::unshareNode : not immutable");
         node = intr_ptr::staticPointerCast<Node>(node->clone(cowid_));
         if (nodeID.isRoot())
             root_ = node;
@@ -673,7 +690,7 @@ bool
 SHAMap::delItem(uint256 const& id)
 {
     // delete the item with this ID
-    XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::delItem : not immutable");
+    XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::delItem : not immutable");
 
     SharedPtrNodeStack stack;
     walkTowardsKey(id, &stack);
@@ -755,7 +772,7 @@ SHAMap::delItem(uint256 const& id)
 bool
 SHAMap::addGiveItem(SHAMapNodeType type, boost::intrusive_ptr<SHAMapItem const> item)
 {
-    XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::addGiveItem : not immutable");
+    XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::addGiveItem : not immutable");
     XRPL_ASSERT(type != SHAMapNodeType::TnInner, "xrpl::SHAMap::addGiveItem : valid type input");
 
     // add the specified item, does not update
@@ -846,7 +863,7 @@ SHAMap::updateGiveItem(SHAMapNodeType type, boost::intrusive_ptr<SHAMapItem cons
     // can't change the tag but can change the hash
     uint256 const tag = item->key();
 
-    XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::updateGiveItem : not immutable");
+    XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::updateGiveItem : not immutable");
 
     SharedPtrNodeStack stack;
     walkTowardsKey(tag, &stack);
@@ -937,7 +954,7 @@ SHAMap::writeNode(NodeObjectType t, SHAMapTreeNodePtr node) const
 
     Serializer s;
     node->serializeWithPrefix(s);
-    f_.db().store(t, std::move(s.modData()), node->getHash().asUInt256(), ledgerSeq_);
+    f_.db().store(t, std::move(s.modData()), node->getHash().asUInt256(), ledgerSeq());
     return node;
 }
 

src/libxrpl/shamap/SHAMapInnerNode.cpp

@@ -16,6 +16,7 @@
 #include <xrpl/shamap/detail/TaggedPointer.h>
 #include <xrpl/shamap/detail/TaggedPointer.ipp>
 
+#include <atomic>
 #include <cstddef>
 #include <cstdint>
 #include <mutex>
@@ -77,7 +78,10 @@ SHAMapInnerNode::clone(std::uint32_t cowid) const
     auto p = intr_ptr::makeShared<SHAMapInnerNode>(cowid, branchCount);
     p->hash_ = hash_;
     p->isBranch_ = isBranch_;
-    p->fullBelowGen_ = fullBelowGen_;
+    // Relaxed, as everywhere: the generation is only ever compared for equality, and p is not
+    // reachable by another thread until this returns.
+    p->fullBelowGen_.store(
+        fullBelowGen_.load(std::memory_order_relaxed), std::memory_order_relaxed);
     SHAMapHash* cloneHashes = nullptr;
     SHAMapHash* thisHashes = nullptr;
     SHAMapTreeNodePtr* cloneChildren = nullptr;