Simplify and harden Serializer and SerialIter:

Reduce both classes to a small, header-only interface built on Slice.

Serializer becomes a strictly append-only buffer and SerialIter a
strictly forward-only reader; all deprecated and duplicated paths
are removed and data copying is entirely eliminated. But the wire
format, you'll be happy to know, remains unchanged.

Serializer:
- Make the buffer append-only. Remove modData, resize, chop, mutable
  begin/end and getDataPtr, the (void const*, size_t) constructor, and
  the read-side helpers get8, getInteger and getBitString.
- Collapse the accessors (peekData, getData, getDataPtr, getDataLength,
  getLength, getString, begin/end, operator==) into slice(), data()
  and size().
- Add takeData(), which moves the buffer out. Use it wherever callers
  copied via getData/peekData or reached in with std::move(modData()).
- addRaw and addVL take a Slice only; the Blob, (void const*, int),
  Serializer and iterator-range overloads are removed. Both throw if
  the input aliases the serializer's own storage.
- Funnel every append through one private write(), which reserves for
  the combined size of its parts before inserting. An add that throws
  leaves the serializer unchanged.
- Constrain add8/add16/add32/add64 on the exact argument type: no
  implicit conversions, no bool or character types, and the width must
  match the function name. Call sites that relied on silent narrowing
  now cast explicitly.
- The add functions return void rather than the offset written to.
- Replace getSHA512Half() with a hash_append hidden friend; callers
  use sha512Half(s).
- Move the VL length-prefix constants into xrpl::detail as std::size_t
  and fold header encoding into addVL. Remove addEncoded,
  encodeLengthLength, decodeLengthLength and decodeVLLength; decoding
  now lives in SerialIter::getVL.

SerialIter:
- Construct only, and explicitly, from a Slice. Remove the
  (void const*, size_t) and array-reference constructors. A null
  pointer with a non-zero size throws.
- Remove reset() and skip(), and with them the used_ counter. A reader
  cannot be rewound; copy it to retain a position.
- getVL() returns a Slice into the underlying buffer instead of a Blob
  copy. Remove getVLDataLength, getSlice, getRaw, getVLBuffer and
  getRawHelper.
- Route every read through a single bounds-checked consume(). Integers
  are decoded with std::bit_cast and std::byteswap, which drops the
  boost::endian dependency.
- Replace getBytesLeft() with size(), returning std::size_t, and add
  slice() for the unread remainder.
- getBitString<T> takes the BaseUInt type rather than <Bits, Tag>, so
  tagged types (AccountID, Currency, MPTID) are read directly.
- Add geti16() and mark the accessors [[nodiscard]].

Error reporting:
- VL length errors, on both the encode and the decode side, now throw
  std::runtime_error; they previously threw std::overflow_error.
- Short reads all throw std::runtime_error("short buffer") in place of
  the per-function messages.

Other changes:
- Slice: add overlap() global utility function, used for the aliasing
  checks above.
- sqlBlobLiteral takes a Slice.
- LedgerHeader: remove deserializePrefixedHeader. Its caller in
  InboundLedger skips the prefix locally; the prefix is still not
  validated, which is now marked with a FIXME.
- STAccount: deserialize from the getVL slice via AccountID::fromRaw
  and remove the (SField, Buffer) constructor.
- STVector256: serialize the whole vector with a single addVL, relying
  on contiguous storage and the absence of padding in UInt256.
- STInteger: static_assert that the type is serializable and dispatch
  add() on sizeof(Integer). Read STInteger<std::int32_t> with geti32().
  Log an unknown transaction result code as a number instead of a raw
  character.
- STTx: fold the four-argument getMetaSQL overload into its only
  caller.
- SHAMapTreeNode: the two leaf deserializers share a splitTag helper
  that slices off the trailing tag, replacing the copy into a
  Serializer followed by getBitString-at-offset and chop. The size
  check is done once, up front.
- SHAMap::getNodeFat: serialize each node into its own Serializer and
  move the buffer into the reply instead of copying out of a shared
  one.
- LedgerMaster::getCloseTimeByHash: parse the stored header with
  deserializeHeader instead of skipping hard-coded offsets.
- ConsensusTransSetSF::gotNode and LedgerReplayMsgHandler parse
  directly from the incoming bytes without an intermediate Serializer
  copy.
- TransactionSign: use sterilize() for the serialization round trip.

Tests:
- Port to the new interfaces; byte payloads become std::array so they
  can go through makeSlice.
- STAccount: the bad-size case now covers both a short and a long
  field, and fails if no exception is thrown. Previously it passed
  silently in that case.

.github/actions/build-deps/action.yml

@@ -44,12 +44,4 @@ runs:
             --conf:all tools.build:jobs=${BUILD_NPROC} \
             --conf:all tools.build:verbosity="${LOG_VERBOSITY}" \
             --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}" \
-            --format=json \
-            . >"${RUNNER_TEMP}/conan-graph.json"
-
-    # Tools that run during the build may only load glibc from the Nix store,
-    # as their package ID survives a GCC runtime update.
-    - name: Check build-context packages for Nix store dependencies (Linux)
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      run: ./bin/check-build-context-runtime.sh "${RUNNER_TEMP}/conan-graph.json"
+            .

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-1798262",
+  "image_tag": "sha-060957e",
   "configs": {
     "ubuntu": [
       {
@@ -74,7 +74,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f"
         }
       },
       {
@@ -86,7 +86,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f",
           "variant": "assert"
         }
       }
@@ -101,7 +101,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-3a2d19f"
         }
       }
     ]

.github/workflows/build-nix-images.yml

@@ -13,6 +13,7 @@ on:
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
       - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"

.github/workflows/build-packaging-images.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - develop
     paths:
+      - ".github/workflows/build-packaging-images.yml"
       - "bin/install-packaging-tools.sh"
       - "package/images/packaging/**"
   pull_request:

.github/workflows/build-pre-commit-image.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - develop
     paths:
+      - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
       - "rust-toolchain.toml"
   pull_request:

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-1798262
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/pre-commit.yml

@@ -17,4 +17,4 @@ jobs:
     uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-3a2d19f" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

.github/workflows/publish-docs.yml

@@ -41,7 +41,7 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-1798262
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-clang-tidy.yml

@@ -34,7 +34,7 @@ jobs:
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-1798262"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
     permissions:
       contents: read
       issues: write

.github/workflows/reusable-rust.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-1798262
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-1798262
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +70,7 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-1798262
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-1798262
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}

API-CHANGELOG.md

@@ -29,7 +29,6 @@ Version 3.5.0 is not yet released.
 ### Additions in 3.5.0
 
 - `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive a message with `type` `mptTransaction` for each validated transaction whose metadata affects a subscribed issuance; the message has the same fields as the `transactions` stream. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
-- `ledger_entry`: Add full support for checks, NFT offers, payment channels, and signer lists. ([#6319](https://github.com/XRPLF/rippled/pull/6319))
 
 ### Bugfixes in 3.5.0
 

bin/check-build-context-runtime.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-# Fail if a binary of a build-context Conan package loads anything from the Nix
-# store other than glibc, or cannot resolve a library at all.
-#
-# Only binaries linked by the Nix toolchain are checked, i.e. those recording a
-# store path as their interpreter or RUNPATH. Prebuilt upstream binaries (such
-# as the ones the cmake package ships) use the system loader instead.
-#
-# Build-context packages provide the tools that run during the build (protoc,
-# grpc_cpp_plugin, ...). Their package ID does not change when a Nix toolchain
-# update moves the GCC runtime to a new store path, so a cached binary has to
-# get by with the pinned glibc alone. See docs/build/nix.md.
-#
-# Usage: bin/check-build-context-runtime.sh <graph.json>
-#   <graph.json> is the output of `conan install --format=json`.
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ]; then
-    echo "usage: $0 <graph.json>" >&2
-    exit 2
-fi
-
-if [ "$(uname -s)" != "Linux" ]; then
-    echo "$0: Linux only" >&2
-    exit 2
-fi
-
-# TODO: Add jq to the Nix packages and use it here instead of Python.
-folders="$(python3 -c '
-import json, sys
-for node in json.load(open(sys.argv[1]))["graph"]["nodes"].values():
-    if node["context"] == "build" and node.get("package_folder"):
-        print(node["package_folder"])
-' "$1" | sort -u)"
-
-checked=0
-failed=0
-
-while IFS= read -r file; do
-    case "$(file -b "${file}")" in
-        ELF*) ;;
-        *) continue ;;
-    esac
-    [[ "$(readelf -ldW "${file}")" == */nix/store/* ]] || continue
-    checked=$((checked + 1))
-
-    # `ldd` lists the interpreter and every library as the loader resolves them.
-    if deps="$(ldd "${file}" 2>&1)"; then
-        bad="$(printf '%s\n' "${deps}" |
-            grep -E 'not found|/nix/store/' |
-            grep -vE '/nix/store/[^/]+-glibc-[^/]+/' || true)"
-    else
-        case "${deps}" in
-            *"not a dynamic executable"*) continue ;;
-        esac
-        bad="${deps}"
-    fi
-    if [ -n "${bad}" ]; then
-        failed=$((failed + 1))
-        echo "::error file=${file}::loads a library from the Nix store other than glibc"
-        echo "${file}"
-        echo "${bad}" | sed 's/^/    /'
-    fi
-done < <(
-    # shellcheck disable=SC2086 # one folder per line, no spaces in Conan paths
-    [ -z "${folders}" ] || find ${folders} -type f \( -perm -u+x -o -name '*.so*' \)
-)
-
-echo "Build-context packages: checked ${checked} binaries, ${failed} failed."
-[ "${failed}" -eq 0 ]

bin/pre-commit/Dockerfile

@@ -23,7 +23,7 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF
 
-ARG PRE_COMMIT_VERSION=4.6.2
+ARG PRE_COMMIT_VERSION=4.6.0
 RUN pip install --no-cache --break-system-packages \
     pre-commit==${PRE_COMMIT_VERSION}
 

cmake/XrplSanitizers.cmake

@@ -77,24 +77,19 @@ if(is_clang)
     message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()
 
-# Define the SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN,
-# XRPL_TSAN and XRPL_UBSAN per active sanitizer, so that code can test for a
-# specific one with #ifdef instead of parsing the dot-joined SANITIZERS string.
+# Define SANITIZERS macro for BuildInfo.cpp
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
     set(enable_asan ON)
     list(APPEND sanitizers_list "ASAN")
-    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
     set(enable_tsan ON)
     list(APPEND sanitizers_list "TSAN")
-    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
     set(enable_ubsan ON)
     list(APPEND sanitizers_list "UBSAN")
-    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()
 
 if(sanitizers_list)

cmake/scripts/codegen/templates/LedgerEntryTests.cpp.mako

@@ -31,7 +31,7 @@ namespace xrpl::ledger_entries {
 // builder's STObject and the wrapper's SLE.
 TEST(${name}Tests, BuilderSettersRoundTrip)
 {
-    UInt256 const index{1u};
+    constexpr UInt256 index{1};
 
 % for field in fields:
     auto const ${field["paramName"]}Value = ${canonical_expr(field)};
@@ -85,7 +85,7 @@ TEST(${name}Tests, BuilderSettersRoundTrip)
 // from that SLE, build a new wrapper, and verify all fields (and validate()).
 TEST(${name}Tests, BuilderFromSleRoundTrip)
 {
-    UInt256 const index{2u};
+    constexpr UInt256 index{2};
 
 % for field in fields:
     auto const ${field["paramName"]}Value = ${canonical_expr(field)};
@@ -146,7 +146,7 @@ TEST(${name}Tests, BuilderFromSleRoundTrip)
 // 3) Verify wrapper throws when constructed from wrong ledger entry type.
 TEST(${name}Tests, WrapperThrowsOnWrongEntryType)
 {
-    UInt256 const index{3u};
+    constexpr UInt256 index{3};
 
     // Build a valid ledger entry of a different type
     // Ticket requires: Account, OwnerNode, TicketSequence, PreviousTxnID, PreviousTxnLgrSeq
@@ -177,7 +177,7 @@ TEST(${name}Tests, WrapperThrowsOnWrongEntryType)
 // 4) Verify builder throws when constructed from wrong ledger entry type.
 TEST(${name}Tests, BuilderThrowsOnWrongEntryType)
 {
-    UInt256 const index{4u};
+    constexpr UInt256 index{4};
 
     // Build a valid ledger entry of a different type
 % if wrong_le_include == "Ticket":
@@ -207,7 +207,7 @@ TEST(${name}Tests, BuilderThrowsOnWrongEntryType)
 // 5) Build with only required fields and verify optional fields return nullopt.
 TEST(${name}Tests, OptionalFieldsReturnNullopt)
 {
-    UInt256 const index{3u};
+    constexpr UInt256 index{3};
 
 % for field in required_fields:
     auto const ${field["paramName"]}Value = ${canonical_expr(field)};

conan.lock

@@ -20,7 +20,7 @@
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
+        "grpc/1.81.1#b87796a4269034856cbc1a2522db16eb%1788275071.530512",
         "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1785888854.601666",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
@@ -34,15 +34,11 @@
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
         "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",

conan/profiles/default

@@ -49,17 +49,6 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
 
-{% if os == "Linux" and context == "build" %}
-{# Build-context executables (protoc, grpc_cpp_plugin, build tools) run during the build #}
-{# and would otherwise load libstdc++/libgcc from a Nix store path #}
-{# that might change with a Nix toolchain update. #}
-{# --as-needed drops the ones they link but don't use, #}
-{# such as libatomic for grpc_cpp_plugin on arm64. #}
-{% set static_runtime_flags = ["-static-libstdc++", "-static-libgcc", "-Wl,--as-needed"] %}
-tools.build:exelinkflags+={{ static_runtime_flags }}
-tools.info.package_id:confs+=["tools.build:exelinkflags"]
-{% endif %}
-
 {% if os == "Macos" %}
 [buildenv]
 {# os.version adds -mmacosx-version-min to compiler command lines, #}
@@ -69,13 +58,3 @@ tools.info.package_id:confs+=["tools.build:exelinkflags"]
 {# Scoped to boost/* since it is the only gap. #}
 boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
 {% endif %}
-
-{% if os == "Linux" and context == "build" %}
-{# b2 links itself with its own script, which ignores exelinkflags #}
-{# and only takes CXXFLAGS when use_cxx_env is set. #}
-[options]
-b2/*:use_cxx_env=True
-
-[buildenv]
-b2/*:CXXFLAGS={{ static_runtime_flags | join(" ") }}
-{% endif %}

conan/profiles/sanitizers

@@ -5,9 +5,6 @@ include(default)
 
 {% if not sanitizers %}
 {# Sanitizers not configured; no additional settings needed #}
-{% elif context == "build" %}
-{# Build-context packages are tools we run, not code we test, #}
-{# so don't instrument them #}
 {% else %}
 
 {% if compiler == "msvc" %}

conanfile.py

@@ -49,8 +49,7 @@ class Xrpl(ConanFile):
     ]
 
     tool_requires = [
-        "grpc/<host_version>",
-        "protobuf/<host_version>",
+        "protobuf/6.33.5",
     ]
 
     default_options = {
@@ -124,10 +123,6 @@ class Xrpl(ConanFile):
         "xxhash/*:shared": False,
     }
 
-    # default_options only reach the host context;
-    # give tool_requires (and their dependencies) the same dependency options.
-    default_build_options = {k: v for k, v in default_options.items() if "/" in k}
-
     def set_version(self):
         self.version = self.version or DEV_VERSION
 

docs/build/nix.md

@@ -194,22 +194,10 @@ bin/check-nix-store-refs.sh ~/.conan2-nix
 ```
 
 It works on Linux too, but asserts something narrower there: the toolchain always
-writes the store into `PT_INTERP` and `RUNPATH`. That is fine for the pinned
-glibc, whose path does not move, but not for the GCC runtime, which moves with
-every GCC update. So [`conan/profiles/default`](../../conan/profiles/default)
-links build-context packages, whose executables run during the build, with
-`-static-libstdc++ -static-libgcc -Wl,--as-needed`, and
-[`conan/profiles/sanitizers`](../../conan/profiles/sanitizers) does not
-instrument them. CI checks that they load nothing from the store but glibc, from
-the graph `conan install --format=json` writes:
-
-```bash
-bin/check-build-context-runtime.sh graph.json
-```
-
-Only the binaries [`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake)
-retargets to the system loader have to be fully clean, and those are what CI
-checks:
+writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
+whose store is fixed for its lifetime, so that is fine. Only the binaries
+[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
+system loader have to be clean, and those are what CI checks:
 
 ```bash
 bin/check-nix-store-refs.sh build/xrpld

include/xrpl/basics/CountedObject.h

@@ -1,29 +1,31 @@
 #pragma once
 
-#include <xrpl/beast/type_name.h>
+#include <xrpl/beast/utility/instrumentation.h>
 
+#include <boost/core/type_name.hpp>
+
+#include <algorithm>
 #include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <iterator>
 #include <string>
+#include <type_traits>
 #include <utility>
-#include <vector>
 
 namespace xrpl {
 
 /**
  * Manages all counted object types.
+ *
+ * Counters register themselves on a lock-free intrusive list maintained
+ * by this object when constructed. Because counters are never destroyed
+ * or removed, the ABA problem does not apply.
+ *
+ * The registry is iterable as a forward range.
  */
 class CountedObjects
 {
-public:
-    static CountedObjects&
-    getInstance() noexcept;
-
-    using Entry = std::pair<std::string, int>;
-    using List = std::vector<Entry>;
-
-    [[nodiscard]] List
-    getCounts(int minimumThreshold) const;
-
 public:
     /**
      * Implementation for @ref CountedObject.
@@ -33,68 +35,147 @@ public:
     class Counter
     {
     public:
-        Counter(std::string name) noexcept : name_(std::move(name)), count_(0)
-        {
-            // Insert ourselves at the front of the lock-free linked list
-            CountedObjects& instance = CountedObjects::getInstance();
-            Counter* head = nullptr;
+        Counter(std::string name) noexcept;
 
-            do
-            {
-                head = instance.head_.load();
-                next_ = head;
-            } while (instance.head_.exchange(this) != head);
+        // Counters are intrusive list nodes whose addresses are published
+        // in the registry; they must never be copied or moved. The atomic
+        // members already force this, but we make it explicit.
+        Counter(Counter const&) = delete;
+        Counter&
+        operator=(Counter const&) = delete;
+        Counter(Counter&&) = delete;
+        Counter&
+        operator=(Counter&&) = delete;
 
-            ++instance.count_;
-        }
-
-        ~Counter() noexcept = default;
-
-        int
+        std::uint32_t
         increment() noexcept
         {
-            return ++count_;
+            auto const newCount = count_.fetch_add(1, std::memory_order::relaxed) + 1;
+            XRPL_ASSERT(newCount != 0, "xrpl::CountedObjects::Counter::increment : no overflow");
+
+            auto maxCount = maxCount_.load(std::memory_order::relaxed);
+
+            while (newCount > maxCount &&
+                   !maxCount_.compare_exchange_weak(maxCount, newCount, std::memory_order::relaxed))
+            {
+            }
+
+            return newCount;
         }
 
-        int
+        std::uint32_t
         decrement() noexcept
         {
-            return --count_;
+            auto const prev = count_.fetch_sub(1, std::memory_order::relaxed);
+            XRPL_ASSERT(prev != 0, "xrpl::CountedObjects::Counter::decrement : no underflow");
+            return prev - 1;
         }
 
-        [[nodiscard]] int
-        getCount() const noexcept
+        [[nodiscard]] std::uint32_t
+        count() const noexcept
         {
-            return count_.load();
+            return count_.load(std::memory_order::relaxed);
         }
 
-        [[nodiscard]] Counter*
-        getNext() const noexcept
+        [[nodiscard]] std::uint32_t
+        max() const noexcept
         {
-            return next_;
+            return std::max(
+                count_.load(std::memory_order::relaxed),
+                maxCount_.load(std::memory_order::relaxed));
         }
 
         [[nodiscard]] std::string const&
-        getName() const noexcept
+        name() const noexcept
         {
             return name_;
         }
 
     private:
+        friend class CountedObjects;
+
+        Counter* next_ = nullptr;
+        std::atomic<std::uint32_t> count_ = 0;
+        std::atomic<std::uint32_t> maxCount_ = 0;
         std::string const name_;
-        std::atomic<int> count_;
-        Counter* next_;
     };
 
-private:
-    CountedObjects() noexcept;
-    ~CountedObjects() noexcept = default;
+    class Iterator
+    {
+    public:
+        using value_type = Counter const;
+        using reference = value_type&;
+        using pointer = value_type*;
+        using difference_type = std::ptrdiff_t;
+        using iterator_category = std::forward_iterator_tag;
+
+        explicit Iterator(Counter* c = nullptr) noexcept : current_(c)
+        {
+        }
+
+        reference
+        operator*() const noexcept
+        {
+            return *current_;
+        }
+
+        pointer
+        operator->() const noexcept
+        {
+            return current_;
+        }
+
+        Iterator&
+        operator++() noexcept
+        {
+            current_ = current_->next_;
+            return *this;
+        }
+
+        Iterator
+        operator++(int) noexcept
+        {
+            auto tmp = *this;
+            ++*this;
+            return tmp;
+        }
+
+        bool
+        operator==(Iterator const&) const noexcept = default;
+
+    private:
+        Counter* current_;
+    };
+
+    constexpr CountedObjects() noexcept = default;
+
+    [[nodiscard]] auto
+    begin() const noexcept
+    {
+        return Iterator{head_.load(std::memory_order::acquire)};
+    }
+
+    [[nodiscard]] auto
+    end() const noexcept
+    {
+        return Iterator{};
+    }
 
 private:
-    std::atomic<int> count_;
-    std::atomic<Counter*> head_;
+    std::atomic<Counter*> head_ = nullptr;
 };
 
+/** The global counted object registry. */
+inline constinit CountedObjects gCountedObjects;
+
+inline CountedObjects::Counter::Counter(std::string name) noexcept
+    : next_(gCountedObjects.head_.load(std::memory_order::relaxed)), name_(std::move(name))
+{
+    while (!gCountedObjects.head_.compare_exchange_weak(
+        next_, this, std::memory_order::release, std::memory_order::relaxed))
+        ;
+}
+
 //------------------------------------------------------------------------------
 
 /**
@@ -103,27 +184,37 @@ private:
  * Derived classes have their instances counted automatically. This is used
  * for reporting purposes.
  *
+ * The constructors are private and `Object` is befriended so that the
+ * CRTP parameter must be the deriving class itself: a copy-paste error
+ * like `class B : public CountedObject<A>` fails to compile instead of
+ * silently polluting A's count.
+ *
+ * @note This class has no move operations by design: a derived class's
+ *       move constructor falls back to the copy constructor for this
+ *       base, so the newly created instance is counted. This keeps the
+ *       invariant that count is the number of outstanding subobjects.
+ *
+ * @warning Counted objects constructed during dynamic initialization of
+ *          other translation units may have their increments discarded when
+ *          counter itself is dynamically initialized. Do not create counted
+ *          objects before main() begins.
+ *
  * @ingroup basics
  */
 template <class Object>
+    requires std::is_class_v<Object>
 class CountedObject
 {
-private:
-    static auto&
-    getCounter() noexcept
-    {
-        static CountedObjects::Counter kC{beast::typeName<Object>()};
-        return kC;
-    }
+    static inline CountedObjects::Counter counter{boost::core::type_name<Object>()};
 
     CountedObject() noexcept
     {
-        getCounter().increment();
+        counter.increment();
     }
 
     CountedObject(CountedObject const&) noexcept
     {
-        getCounter().increment();
+        counter.increment();
     }
 
     CountedObject&
@@ -132,7 +223,7 @@ private:
 public:
     ~CountedObject() noexcept
     {
-        getCounter().decrement();
+        counter.decrement();
     }
 
     friend Object;

include/xrpl/basics/Slice.h

@@ -253,4 +253,27 @@ makeSlice(std::basic_string_view<char, Traits> s)
     return Slice(s.data(), s.size());
 }
 
+/**
+ * Checks whether two byte ranges share at least one byte of storage.
+ *
+ *  Each slice is treated as the half-open range [data, data + size), so
+ *  ranges that merely touch do not overlap. An empty slice overlaps
+ *  nothing, wherever it points.
+ *
+ *  @param a The first range.
+ *  @param b The second range.
+ *  @return true if the ranges overlap, false otherwise.
+ */
+[[nodiscard]] inline bool
+overlap(Slice a, Slice b) noexcept
+{
+    if (a.empty() || b.empty())
+        return false;
+
+    auto const a0 = reinterpret_cast<std::uintptr_t>(a.data());
+    auto const b0 = reinterpret_cast<std::uintptr_t>(b.data());
+
+    return a0 < b0 + b.size() && b0 < a0 + a.size();
+}
+
 }  // namespace xrpl

include/xrpl/basics/StringUtilities.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Slice.h>
 
 #include <boost/utility/string_view.hpp>
 
@@ -28,7 +29,7 @@ namespace xrpl {
  * @return The input, encoded as a blob literal.
  */
 std::string
-sqlBlobLiteral(Blob const& blob);
+sqlBlobLiteral(Slice blob);
 
 namespace detail {
 

include/xrpl/basics/contract.h

@@ -1,7 +1,8 @@
 #pragma once
 
 #include <xrpl/basics/sanitizers.h>
-#include <xrpl/beast/type_name.h>
+
+#include <boost/core/type_name.hpp>
 
 #include <exception>
 #include <string>
@@ -55,7 +56,7 @@ Throw(Args&&... args)
         std::is_convertible_v<E*, std::exception*>, "Exception must derive from std::exception.");
 
     E e(std::forward<Args>(args)...);
-    logThrow(std::string("Throwing exception of type " + beast::typeName<E>() + ": ") + e.what());
+    logThrow("Throwing exception of type " + boost::core::type_name<E>() + ": " + e.what());
     throw std::move(e);
 }
 

include/xrpl/basics/enum_bitops.h

@@ -0,0 +1,200 @@
+#pragma once
+
+#include <concepts>
+#include <type_traits>
+#include <utility>
+
+namespace xrpl {
+
+/**
+ * Opt-in bitwise operators for scoped enumerations.
+ *
+ * Provides `&`, `|`, `^`, `~` and the corresponding compound assignment forms
+ * for any scoped enumeration with an unsigned underlying type that opts in by
+ * specializing @ref OptIn:
+ *
+ * @code
+ * namespace xrpl {
+ *
+ * enum class MyFlags : std::uint32_t { a = 1, b = 2, c = 4 };
+ *
+ * template <>
+ * struct enum_bitops::OptIn<MyFlags> : std::true_type {};
+ *
+ * }  // namespace xrpl
+ * @endcode
+ *
+ * The operators are constexpr and noexcept, and return the enumeration type.
+ *
+ * @par Where the specialization may be declared
+ *   In namespace xrpl, or at global scope with full qualification, and after
+ *   the enumeration is defined but before the operators are first used. This
+ *   cannot be done in a nested namespace or at class scope; for enumerations
+ *   nested in a class this means after the class definition.
+ *
+ * @par Where the operators are found
+ *   The operators are declared in namespace xrpl, so argument-dependent lookup
+ *   will find them only for enumerations declared in xrpl or nested in a class
+ *   declared directly in xrpl. Enumerations in a nested namespace will only be
+ *   found from code inside xrpl, and only if no enclosing scope declares an
+ *   operator of the same name; elsewhere they require using-declarations.
+ */
+namespace enum_bitops {
+
+/**
+ * Types that may be opted in to the bitwise operators.
+ *
+ * Satisfied by a scoped enumeration whose underlying type is an unsigned
+ * integer type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Eligible = std::is_scoped_enum_v<T> && std::unsigned_integral<std::underlying_type_t<T>>;
+
+/**
+ * Opt-in switch for the bitwise operators.
+ *
+ * The primary template derives from std::false_type. Specialize it to derive
+ * from std::true_type to enable the operators for an @ref Eligible enumeration.
+ *
+ * @tparam T The scoped enumeration to opt in.
+ */
+template <Eligible T>
+struct OptIn : std::false_type
+{
+};
+
+/**
+ * Enumerations for which the bitwise operators are enabled.
+ *
+ * Satisfied when @p T satisfies @ref Eligible and @ref OptIn has been
+ * specialized for it to derive from std::true_type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Candidate = Eligible<T> && OptIn<T>::value;
+
+}  // namespace enum_bitops
+
+// These are declared in xrpl, not in enum_bitops, so that argument-dependent
+// lookup finds them for enumerations whose associated namespace is xrpl.
+
+/**
+ * @name Bitwise operators for opted-in scoped enumerations
+ *
+ * Each operator applies the corresponding built-in operator to the
+ * underlying values and converts the result back to the enumeration type.
+ * Both operands must have the same enumeration type; there is no implicit
+ * conversion to or from the underlying type.
+ */
+/** @{ */
+
+/**
+ * Bitwise AND.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in both @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator&(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) & std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in @p lhs, in @p rhs, or in both.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator|(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) | std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise exclusive OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in exactly one of @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator^(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) ^ std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise complement.
+ *
+ * The result has every bit of the underlying type that is clear in
+ * @p val, including bits that no enumerator names. It is intended for
+ * clearing flags, as in `flags & ~flag`.
+ *
+ * @param val The operand.
+ * @return The complement of @p val.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator~(T val) noexcept
+{
+    return static_cast<T>(~std::to_underlying(val));
+}
+
+/**
+ * Bitwise AND assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator&=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs & rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator|=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs | rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise exclusive OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator^=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs ^ rhs;
+    return lhs;
+}
+
+/** @} */
+
+}  // namespace xrpl

include/xrpl/basics/safe_cast.h

@@ -2,107 +2,212 @@
 
 #include <xrpl/beast/utility/instrumentation.h>  // IWYU pragma: keep
 
+#include <concepts>
+#include <cstdint>
+#include <limits>
+#include <memory>
 #include <type_traits>
+#include <utility>
 
 namespace xrpl {
 
-// safe_cast adds compile-time checks to a static_cast to ensure that
-// the destination can hold all values of the source.  This is particularly
-// handy when the source or destination is an enumeration type.
+/** Every value of @p Src can be represented by @p Dest.
 
-template <class Src, class Dest>
-concept SafeToCast = (std::is_integral_v<Src> && std::is_integral_v<Dest>) &&
-    (std::is_signed_v<Src> || std::is_unsigned_v<Dest>) &&
-    (std::is_signed_v<Src> != std::is_signed_v<Dest> ? sizeof(Dest) > sizeof(Src)
-                                                     : sizeof(Dest) >= sizeof(Src));
+    Given two integral types, the cast is safe when the destination can
+    hold every possible value of the source.
 
-template <class Dest, class Src>
+    Comparing the bounds requires care: we use @c std::cmp_less_equal and
+    @c std::cmp_greater_equal; the plain relational operators would apply
+    arithmetic conversions, resulting in incorrect results when comparing
+    across signedness.
+
+    Because @c std::cmp_* requires standard signed or unsigned integer
+    arguments, which excludes character types and bool, we first widen
+    all type bounds to the maximum-width integer type while preserving
+    signedness.
+
+    @note Extended integer types, like __int128 on gcc, cannot be safely
+          widened to a standard integer type, so the concept will reject
+          them.
+*/
+template <typename Src, typename Dest>
+concept SafeToCast = std::is_integral_v<Src> && std::is_integral_v<Dest> && []() consteval {
+    using WideSrc = std::conditional_t<std::is_signed_v<Src>, std::intmax_t, std::uintmax_t>;
+    using WideDest = std::conditional_t<std::is_signed_v<Dest>, std::intmax_t, std::uintmax_t>;
+
+    // Note: this guard must be an evaluated branch, and not a
+    // static_assert. The lambda body is outside the immediate
+    // context, so a substitution-time failure here would be a
+    // hard error rather than leaving the concept unsatisfied.
+    if constexpr (sizeof(Src) > sizeof(WideSrc) || sizeof(Dest) > sizeof(WideDest))
+    {
+        return false;
+    }
+    else
+    {
+        return std::cmp_less_equal(
+                   static_cast<WideDest>(std::numeric_limits<Dest>::min()),
+                   static_cast<WideSrc>(std::numeric_limits<Src>::min())) &&
+            std::cmp_greater_equal(
+                   static_cast<WideDest>(std::numeric_limits<Dest>::max()),
+                   static_cast<WideSrc>(std::numeric_limits<Src>::max()));
+    }
+}();
+
+/** Compile-time-checked static_cast that rejects non-value preserving casts.
+
+    @note There is deliberately no enum-to-enum overload, and no overload
+          returning the underlying type of an enum. For the latter, use
+          @c std::to_underlying.
+*/
+/** @{ */
+template <typename Dest, typename Src>
+    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
 constexpr Dest
 safeCast(Src s) noexcept
-    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
 {
     static_assert(
-        std::is_signed_v<Dest> || std::is_unsigned_v<Src>, "Cannot cast signed to unsigned");
-    constexpr unsigned kNotSame = std::is_signed_v<Dest> != std::is_signed_v<Src>;
-    static_assert(
-        sizeof(Dest) >= sizeof(Src) + kNotSame,
-        "Destination is too small to hold all values of source");
+        SafeToCast<Src, Dest>, "This cast is not value-preserving. Please use unsafeCast instead.");
     return static_cast<Dest>(s);
 }
 
-template <class Dest, class Src>
+template <typename Dest, typename Src>
+    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
 constexpr Dest
 safeCast(Src s) noexcept
-    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
 {
     return static_cast<Dest>(safeCast<std::underlying_type_t<Dest>>(s));
 }
 
-template <class Dest, class Src>
+template <typename Dest, typename Src>
+    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
 constexpr Dest
 safeCast(Src s) noexcept
-    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
 {
-    return safeCast<Dest>(static_cast<std::underlying_type_t<Src>>(s));
+    return safeCast<Dest>(std::to_underlying(s));
 }
+/** @} */
 
-// unsafe_cast explicitly flags a static_cast as not necessarily able to hold
-// all values of the source. It includes a compile-time check so that if
-// underlying types become safe, it can be converted to a safe_cast.
+/** Integral-to-integral cast that is known to be narrowing or sign-erasing.
 
-template <class Dest, class Src>
+    This explicitly flags a conversion that can lose information for some
+    values of the source type, where the call site accepts that loss (or
+    truncation is the intended behavior).
+
+    The compile-time check ensures the cast remains "unsafe": if the types
+    involved later change such that the conversion becomes inherently
+    value-preserving, the static assertion fires with instructions to
+    migrate the call site to @ref safeCast.
+
+    If the conversion's safety depends on a runtime precondition rather
+    than on the types, or varies across instantiations of generic code,
+    use @ref checkedCast instead.
+*/
+/** @{ */
+template <typename Dest, typename Src>
+    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
 constexpr Dest
 unsafeCast(Src s) noexcept
-    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
 {
     static_assert(
-        !SafeToCast<Src, Dest>,
-        "Only unsafe if casting signed to unsigned or "
-        "destination is too small");
+        !SafeToCast<Src, Dest>, "This cast is value-preserving. Please use safeCast instead.");
     return static_cast<Dest>(s);
 }
 
-template <class Dest, class Src>
+template <typename Dest, typename Src>
+    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
 constexpr Dest
 unsafeCast(Src s) noexcept
-    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
 {
     return static_cast<Dest>(unsafeCast<std::underlying_type_t<Dest>>(s));
 }
 
-template <class Dest, class Src>
+template <typename Dest, typename Src>
+    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
 constexpr Dest
 unsafeCast(Src s) noexcept
-    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
 {
-    return unsafeCast<Dest>(static_cast<std::underlying_type_t<Src>>(s));
+    return unsafeCast<Dest>(std::to_underlying(s));
+}
+/** @} */
+
+/** Integral-to-integral cast when the caller has performed a bounds check.
+
+    This documents that a runtime precondition or external invariant, which
+    is not necessarily visible to the compiler, guarantees that the requested
+    conversion is value-preserving for the values that can actually occur.
+
+    This is primarily meant for generic code, where the same expression may
+    be value-preserving for one instantiation but not for another, making
+    both @ref safeCast and @ref unsafeCast unusable.
+
+    Unlike @ref safeCast and @ref unsafeCast, this imposes no static check
+    on the type relationship: the caller's claim is about runtime values,
+    not about types.
+*/
+/** @{ */
+template <typename Dest, typename Src>
+    requires(std::is_integral_v<Dest> && std::is_integral_v<Src>)
+constexpr Dest
+checkedCast(Src s) noexcept
+{
+    return static_cast<Dest>(s);
 }
 
+template <typename Dest, typename Src>
+    requires(std::is_enum_v<Dest> && std::is_integral_v<Src>)
+constexpr Dest
+checkedCast(Src s) noexcept
+{
+    return static_cast<Dest>(checkedCast<std::underlying_type_t<Dest>>(s));
+}
+
+template <typename Dest, typename Src>
+    requires(std::is_integral_v<Dest> && std::is_enum_v<Src>)
+constexpr Dest
+checkedCast(Src s) noexcept
+{
+    return checkedCast<Dest>(std::to_underlying(s));
+}
+/** @} */
+
+/** Downcast within a class hierarchy, verified in debug builds.
+
+    Performs a static_cast down a hierarchy, but in debug builds verifies
+    via dynamic_cast that the object's dynamic type actually permits the
+    downcast. Both build modes execute the same conversion; debug builds
+    merely add the check.
+
+    The pointer form passes null through unchanged, as dynamic_cast does.
+
+    @note The check requires @p Src to be polymorphic; in release builds
+          an invalid downcast is undefined behavior on use, exactly as
+          with a bare static_cast.
+*/
+/** @{ */
 template <class Dest, class Src>
-    requires std::is_pointer_v<Dest>
+    requires(
+        std::is_pointer_v<Dest> && std::is_polymorphic_v<Src> &&
+        std::derived_from<std::remove_pointer_t<Dest>, Src> &&
+        (std::is_const_v<std::remove_pointer_t<Dest>> || !std::is_const_v<Src>) &&
+        (std::is_volatile_v<std::remove_pointer_t<Dest>> || !std::is_volatile_v<Src>))
 inline Dest
 safeDowncast(Src* s) noexcept
 {
-#ifdef NDEBUG
+    XRPL_ASSERT(
+        s == nullptr || dynamic_cast<Dest>(s) != nullptr, "xrpl::safeDowncast : valid downcast");
     return static_cast<Dest>(s);  // NOLINT(cppcoreguidelines-pro-type-static-cast-downcast)
-#else
-    auto* result = dynamic_cast<Dest>(s);
-    XRPL_ASSERT(result != nullptr, "xrpl::safeDowncast : pointer downcast is valid");
-    return result;
-#endif
 }
 
 template <class Dest, class Src>
-    requires std::is_lvalue_reference_v<Dest>
+    requires(
+        std::is_lvalue_reference_v<Dest> && std::is_polymorphic_v<Src> &&
+        std::derived_from<std::remove_reference_t<Dest>, Src>)
 inline Dest
 safeDowncast(Src& s) noexcept
 {
-#ifndef NDEBUG
-    XRPL_ASSERT(
-        dynamic_cast<std::add_pointer_t<std::remove_reference_t<Dest>>>(&s) != nullptr,
-        "xrpl::safeDowncast : reference downcast is valid");
-#endif
-    return static_cast<Dest>(s);  // NOLINT(cppcoreguidelines-pro-type-static-cast-downcast)
+    return *safeDowncast<std::add_pointer_t<std::remove_reference_t<Dest>>>(std::addressof(s));
 }
+/** @} */
 
 }  // namespace xrpl

include/xrpl/basics/spinlock.h

@@ -4,88 +4,215 @@
 
 #include <xrpl/beast/utility/instrumentation.h>
 
+#include <boost/predef/architecture.h>
+
 #include <atomic>
+#include <concepts>
 #include <limits>
 #include <type_traits>
 
-#ifndef __aarch64__
+#if BOOST_ARCH_X86
 #include <immintrin.h>
 #endif
 
 namespace xrpl {
 
+/** An unsigned integral type suitable for use as a spinlock.
+
+    The type must be always lock-free when wrapped in std::atomic, so
+    that lock operations cannot themselves take a (library-level) lock.
+ */
+template <typename T>
+concept SpinlockValueType = std::is_unsigned_v<T> && std::atomic<T>::is_always_lock_free;
+
+/** A spinlock value type that additionally supports the atomic bitwise
+    operations required to pack multiple locks into a single integer.
+ */
+template <typename T>
+concept PackedSpinlockValueType = SpinlockValueType<T> && requires(std::atomic<T>& a, T v) {
+    { a.fetch_or(v) } -> std::same_as<T>;
+    { a.fetch_and(v) } -> std::same_as<T>;
+};
+
 namespace detail {
-/**
- * Inform the processor that we are in a tight spin-wait loop.
- *
- * Spinlocks caught in tight loops can result in the processor's pipeline
- * filling up with comparison operations, resulting in a misprediction at
- * the time the lock is finally acquired, necessitating pipeline flushing
- * which is ridiculously expensive and results in very high latency.
- *
- * This function instructs the processor to "pause" for some architecture
- * specific amount of time, to prevent this.
+
+/** Inform the processor that we are in a tight spin-wait loop.
+
+    Spinlocks caught in tight loops can result in the processor's pipeline
+    filling up with comparison operations, resulting in a misprediction at
+    the time the lock is finally acquired, necessitating pipeline flushing
+    which is ridiculously expensive and results in very high latency.
+
+    This function instructs the processor to "pause" for some architecture
+    specific amount of time, to prevent this.
  */
 inline void
 spinPause() noexcept
 {
-#ifdef __aarch64__
-    asm volatile("yield");
-#else
+#if BOOST_ARCH_X86
     _mm_pause();
+#elif BOOST_ARCH_ARM
+    asm volatile("yield" ::: "memory");
+#else
+#error No implementation available for spinPause to use
 #endif
 }
 
 }  // namespace detail
 
-/** @{ */
-/**
- * Classes to handle arrays of spinlocks packed into a single atomic integer:
- *
- * Packed spinlocks allow for tremendously space-efficient lock-sharding
- * but they come at a cost.
- *
- * First, the implementation is necessarily low-level and uses advanced
- * features like memory ordering and highly platform-specific tricks to
- * maximize performance. This imposes a significant and ongoing cost to
- * developers.
- *
- * Second, and perhaps most important, is that the packing of multiple
- * locks into a single integer which, albeit space-efficient, also has
- * performance implications stemming from data dependencies, increased
- * cache-coherency traffic between processors and heavier loads on the
- * processor's load/store units.
- *
- * To be sure, these locks can have advantages but they are definitely
- * not general purpose locks and should not be thought of or used that
- * way. The use cases for them are likely few and far between; without
- * a compelling reason to use them, backed by profiling data, it might
- * be best to use one of the standard locking primitives instead. Note
- * that in most common platforms, `std::mutex` is so heavily optimized
- * that it can, usually, outperform spinlocks.
- *
- * @tparam T An unsigned integral type (e.g. std::uint16_t)
- */
+//------------------------------------------------------------------------------
 
-/**
- * A class that grabs a single packed spinlock from an atomic integer.
- *
- * This class meets the requirements of Lockable:
- *     https://en.cppreference.com/w/cpp/named_req/Lockable
+/** Attempt to acquire a spinlock without blocking.
+
+    @note This interface is primarily intended for one-shot attempts to
+          acquire the lock. Avoid calling this function directly from a
+          loop and use @ref spinLock instead.
+
+    @tparam T An unsigned integral type.
+    @param lock The atomic variable used as the lock.
+    @return true if the lock was acquired, false if it was already held.
  */
-template <class T>
+template <SpinlockValueType T>
+[[nodiscard]] bool
+spinTryLock(std::atomic<T>& lock) noexcept
+{
+    // A compare-exchange is required here, not an unconditional exchange:
+    // a failed attempt must not modify the lock word, in case the atomic
+    // is shared with PackedSpinlock).
+    T expected = 0;
+
+    return lock.compare_exchange_strong(
+        expected,
+        std::numeric_limits<T>::max(),
+        std::memory_order::acquire,
+        std::memory_order::relaxed);
+    ;
+}
+
+/** Acquire a spinlock, blocking until available.
+
+    Uses a TTAS (test-and-test-and-set) pattern, so waiters share the cache
+    line read-only, helping to avoid unnecessary coherency traffic.
+
+    @tparam T An unsigned integral type.
+    @param lock The atomic variable used as the lock.
+ */
+template <SpinlockValueType T>
+void
+spinLock(std::atomic<T>& lock) noexcept
+{
+    do
+    {
+        // Relaxed ordering is sufficient for the spin: this load is only
+        // a filter. The acquire on the successful exchange in spinTryLock
+        // is what synchronizes the critical section.
+        while (lock.load(std::memory_order::relaxed) != 0)
+            detail::spinPause();
+    } while (!spinTryLock(lock));
+}
+
+/** Release a spinlock.
+
+    @tparam T An unsigned integral type.
+    @param lock The atomic variable used as the lock.
+ */
+template <SpinlockValueType T>
+void
+spinUnlock(std::atomic<T>& lock) noexcept
+{
+    lock.store(0, std::memory_order::release);
+}
+
+//------------------------------------------------------------------------------
+
+/** A Lockable interface to a spinlock implemented on top of an atomic.
+
+    @tparam T An unsigned integral type.
+
+    @note Using `PackedSpinlock` and `Spinlock` against the same underlying
+          atomic integer is possible but can result in `Spinlock` not being
+          able to acquire the lock during periods of high contention due to
+          the way the two locks operate: `Spinlock` spins and tries to grab
+          all the bits at once, whereas any given `PackedSpinlock` instance
+          only tries to grab one bit at a time. Caveat emptor.
+
+    This class meets the requirements of Lockable:
+        https://en.cppreference.com/w/cpp/named_req/Lockable
+ */
+template <SpinlockValueType T>
+class Spinlock
+{
+    std::atomic<T>& lock_;
+
+public:
+    Spinlock(Spinlock const&) = delete;
+    Spinlock&
+    operator=(Spinlock const&) = delete;
+
+    /** Construct a spinlock handle.
+
+        @param lock The atomic integer to spin against.
+
+        @note For performance reasons, you should strive to have `lock` be
+              on a cacheline by itself.
+     */
+    explicit Spinlock(std::atomic<T>& lock) noexcept : lock_(lock)
+    {
+    }
+
+    [[nodiscard]] bool
+    try_lock() noexcept  // NOLINT(readability-identifier-naming)
+    {
+        return spinTryLock(lock_);
+    }
+
+    void
+    lock() noexcept
+    {
+        spinLock(lock_);
+    }
+
+    void
+    unlock() noexcept
+    {
+        spinUnlock(lock_);
+    }
+};
+
+//------------------------------------------------------------------------------
+
+/** A Lockable interface to a packed spinlock implemented on top of an atomic.
+
+    Packed spinlocks offer tremendous space-efficient lock-sharding but
+    they come at a cost.
+
+    First, the implementation is necessarily low-level and uses advanced
+    features like memory ordering and highly platform-specific tricks to
+    maximize performance. This imposes a significant and ongoing cost to
+    developers.
+
+    Second, and perhaps most important, is that the packing of multiple
+    locks into a single integer which, albeit space-efficient, also has
+    performance implications stemming from data dependencies, increased
+    cache-coherency traffic between processors and heavier loads on the
+    processor's load/store units.
+
+    To be sure, these locks can have advantages but they are definitely
+    not general purpose locks and should not be thought of or used that
+    way. The use cases for them are likely few and far between; without
+    a compelling reason to use them, backed by profiling data, it might
+    be best to use one of the standard locking primitives instead. Note
+    that in most common platforms, `std::mutex` is so heavily optimized
+    that it can, usually, outperform spinlocks.
+
+    @tparam T An unsigned integral type (e.g. std::uint16_t)
+
+    This class meets the requirements of Lockable:
+        https://en.cppreference.com/w/cpp/named_req/Lockable
+ */
+template <PackedSpinlockValueType T>
 class PackedSpinlock
 {
-    // clang-format off
-    static_assert(std::is_unsigned_v<T>);
-    static_assert(std::atomic<T>::is_always_lock_free);
-    static_assert(
-        std::is_same_v<decltype(std::declval<std::atomic<T>&>().fetch_or(0)), T> &&
-        std::is_same_v<decltype(std::declval<std::atomic<T>&>().fetch_and(0)), T>,
-        "std::atomic<T>::fetch_and(T) and std::atomic<T>::fetch_and(T) are required by packed_spinlock");
-    // clang-format on
-
-private:
     std::atomic<T>& bits_;
     T const mask_;
 
@@ -94,120 +221,49 @@ public:
     PackedSpinlock&
     operator=(PackedSpinlock const&) = delete;
 
-    /**
-     * A single spinlock packed inside the specified atomic
-     *
-     * @param lock The atomic integer inside which the spinlock is packed.
-     * @param index The index of the spinlock this object acquires.
-     *
-     * @note For performance reasons, you should strive to have `lock` be
-     *       on a cacheline by itself.
+    /** Construct a packed spinlock handle for a single bit.
+
+        @param lock The atomic integer inside which the spinlock is packed.
+        @param index The index of the spinlock this object acquires.
+
+        @note For performance reasons, you should strive to have `lock` be
+              on a cacheline by itself.
      */
-    PackedSpinlock(std::atomic<T>& lock, int index) : bits_(lock), mask_(static_cast<T>(1) << index)
-    {
-        XRPL_ASSERT(
-            index >= 0 && (mask_ != 0),
-            "xrpl::PackedSpinlock::PackedSpinlock : valid index and mask");
-    }
-
-    [[nodiscard]] bool
-    try_lock()  // NOLINT(readability-identifier-naming)
-    {
-        return (bits_.fetch_or(mask_, std::memory_order_acquire) & mask_) == 0;
-    }
-
-    void
-    lock()
-    {
-        while (!try_lock())
-        {
-            // The use of relaxed memory ordering here is intentional and
-            // serves to help reduce cache coherency traffic during times
-            // of contention by avoiding writes that would definitely not
-            // result in the lock being acquired.
-            while ((bits_.load(std::memory_order_relaxed) & mask_) != 0)
-                detail::spinPause();
-        }
-    }
-
-    void
-    unlock()
-    {
-        bits_.fetch_and(~mask_, std::memory_order_release);
-    }
-};
-
-/**
- * A spinlock implemented on top of an atomic integer.
- *
- * @note Using `packed_spinlock` and `spinlock` against the same underlying
- *       atomic integer can result in `spinlock` not being able to actually
- *       acquire the lock during periods of high contention, because of how
- *       the two locks operate: `spinlock` will spin trying to grab all the
- *       bits at once, whereas any given `packed_spinlock` will only try to
- *       grab one bit at a time. Caveat emptor.
- *
- * This class meets the requirements of Lockable:
- *     https://en.cppreference.com/w/cpp/named_req/Lockable
- */
-template <class T>
-class Spinlock
-{
-    static_assert(std::is_unsigned_v<T>);
-    static_assert(std::atomic<T>::is_always_lock_free);
-
-private:
-    std::atomic<T>& lock_;
-
-public:
-    Spinlock(Spinlock const&) = delete;
-    Spinlock&
-    operator=(Spinlock const&) = delete;
-
-    /**
-     * Grabs the
-     *
-     * @param lock The atomic integer to spin against.
-     *
-     * @note For performance reasons, you should strive to have `lock` be
-     *       on a cacheline by itself.
-     */
-    Spinlock(std::atomic<T>& lock) : lock_(lock)
+    PackedSpinlock(std::atomic<T>& lock, int index) noexcept
+        : bits_(lock), mask_([index]() {
+            XRPL_ASSERT(
+                index >= 0 && index < std::numeric_limits<T>::digits,
+                "xrpl::PackedSpinlock::PackedSpinlock : valid index");
+            return static_cast<T>(T{1} << index);
+        }())
     {
     }
 
     [[nodiscard]] bool
-    try_lock()  // NOLINT(readability-identifier-naming)
+    try_lock() noexcept  // NOLINT(readability-identifier-naming)
     {
-        T expected = 0;
-
-        return lock_.compare_exchange_weak(
-            expected,
-            std::numeric_limits<T>::max(),
-            std::memory_order_acquire,
-            std::memory_order_relaxed);
+        return (bits_.fetch_or(mask_, std::memory_order::acquire) & mask_) == 0;
     }
 
     void
-    lock()
+    lock() noexcept
     {
-        while (!try_lock())
+        do
         {
             // The use of relaxed memory ordering here is intentional and
             // serves to help reduce cache coherency traffic during times
-            // of contention by avoiding writes that would definitely not
-            // result in the lock being acquired.
-            while (lock_.load(std::memory_order_relaxed) != 0)
+            // of contention by avoiding writes that are unlikely to grab
+            // the requested lock.
+            while ((bits_.load(std::memory_order::relaxed) & mask_) != 0)
                 detail::spinPause();
-        }
+        } while (!try_lock());
     }
 
     void
-    unlock()
+    unlock() noexcept
     {
-        lock_.store(0, std::memory_order_release);
+        bits_.fetch_and(~mask_, std::memory_order::release);
     }
 };
-/** @} */
 
 }  // namespace xrpl

include/xrpl/beast/type_name.h

@@ -1,47 +0,0 @@
-#pragma once
-
-#include <cstdlib>
-#include <string>
-#include <type_traits>
-#include <typeinfo>
-
-#ifndef _MSC_VER
-#include <cxxabi.h>
-#endif
-
-namespace beast {
-
-template <typename T>
-std::string
-typeName()
-{
-    using TR = std::remove_reference_t<T>;
-
-    std::string name = typeid(TR).name();
-
-#ifndef _MSC_VER
-    if (auto s = abi::__cxa_demangle(name.c_str(), nullptr, nullptr, nullptr))
-    {
-        name = s;
-        // NOLINTNEXTLINE(cppcoreguidelines-no-malloc)
-        std::free(s);
-    }
-#endif
-
-    if (std::is_const_v<TR>)
-        name += " const";
-    if (std::is_volatile_v<TR>)
-        name += " volatile";
-    if (std::is_lvalue_reference_v<T>)
-    {
-        name += "&";
-    }
-    else if (std::is_rvalue_reference_v<T>)
-    {
-        name += "&&";
-    }
-
-    return name;
-}
-
-}  // namespace beast

include/xrpl/beast/utility/Zero.h

@@ -2,26 +2,24 @@
 
 #pragma once
 
+#include <compare>
+#include <concepts>
+
 namespace beast {
 
 /**
  * Zero allows classes to offer efficient comparisons to zero.
  *
- * Zero is a struct to allow classes to efficiently compare with zero without
- * requiring an rvalue construction.
- *
  * It's often the case that we have classes which combine a number and a unit.
  * In such cases, comparisons like t > 0 or t != 0 make sense, but comparisons
- * like t > 1 or t != 1 do not.
+ * like t > 1 or t != 1 do not. Comparing against kZero expresses exactly that,
+ * without constructing a T.
  *
- * The class Zero allows such comparisons to be easily made.
- *
- * The comparing class T either needs to have a method called signum() which
- * returns a positive number, 0, or a negative; or there needs to be a signum
- * function which resolves in the namespace which takes an instance of T and
- * returns a positive, zero or negative number.
+ * A type T participates if either `t.signum()` or an unqualified `signum(t)`
+ * found by argument-dependent lookup returns an integer that is negative,
+ * zero, or positive according to the sign of t. Both `t == kZero` and
+ * `kZero == t` work, as do all six relational operators in either order.
  */
-
 struct Zero
 {
     explicit Zero() = default;
@@ -30,115 +28,44 @@ struct Zero
 inline constexpr Zero kZero{};
 
 /**
- * Default implementation of signum calls the method on the class.
+ * Default implementation of signum: call the member function.
  */
-template <typename T>
-auto
-signum(T const& t)
+template <class T>
+    requires requires(T const& t) {
+        { t.signum() } -> std::integral;
+    }
+[[nodiscard]] constexpr auto
+signum(T const& t) noexcept(noexcept(t.signum()))
 {
     return t.signum();
 }
 
-namespace detail::zero_helper {
+namespace detail {
 
-// For argument dependent lookup to function properly, calls to signum must
-// be made from a namespace that does not include overloads of the function..
+/**
+ * A type with a usable signum: either the member-based default above, or a
+ * `signum(t)` overload in T's own namespace, found by ADL. A user overload
+ * that is a better match than the template wins, as usual.
+ */
 template <class T>
-auto
-callSignum(T const& t)
+concept HasSignum = requires(T const& t) {
+    { signum(t) } -> std::integral;
+};
+
+}  // namespace detail
+
+template <detail::HasSignum T>
+[[nodiscard]] constexpr bool
+operator==(T const& t, Zero) noexcept(noexcept(signum(t)))
 {
-    return signum(t);
+    return signum(t) == 0;
 }
 
-}  // namespace detail::zero_helper
-
-// Handle operators where T is on the left side using signum.
-
-template <typename T>
-bool
-operator==(T const& t, Zero)
+template <detail::HasSignum T>
+[[nodiscard]] constexpr std::strong_ordering
+operator<=>(T const& t, Zero) noexcept(noexcept(signum(t)))
 {
-    return detail::zero_helper::callSignum(t) == 0;
-}
-
-template <typename T>
-bool
-operator!=(T const& t, Zero)
-{
-    return detail::zero_helper::callSignum(t) != 0;
-}
-
-template <typename T>
-bool
-operator<(T const& t, Zero)
-{
-    return detail::zero_helper::callSignum(t) < 0;
-}
-
-template <typename T>
-bool
-operator>(T const& t, Zero)
-{
-    return detail::zero_helper::callSignum(t) > 0;
-}
-
-template <typename T>
-bool
-operator>=(T const& t, Zero)
-{
-    return detail::zero_helper::callSignum(t) >= 0;
-}
-
-template <typename T>
-bool
-operator<=(T const& t, Zero)
-{
-    return detail::zero_helper::callSignum(t) <= 0;
-}
-
-// Handle operators where T is on the right side by
-// reversing the operation, so that T is on the left side.
-
-template <typename T>
-bool
-operator==(Zero, T const& t)
-{
-    return t == kZero;
-}
-
-template <typename T>
-bool
-operator!=(Zero, T const& t)
-{
-    return t != kZero;
-}
-
-template <typename T>
-bool
-operator<(Zero, T const& t)
-{
-    return t > kZero;
-}
-
-template <typename T>
-bool
-operator>(Zero, T const& t)
-{
-    return t < kZero;
-}
-
-template <typename T>
-bool
-operator>=(Zero, T const& t)
-{
-    return t <= kZero;
-}
-
-template <typename T>
-bool
-operator<=(Zero, T const& t)
-{
-    return t >= kZero;
+    return signum(t) <=> 0;
 }
 
 }  // namespace beast

include/xrpl/ledger/ApplyView.h

@@ -1,7 +1,7 @@
 #pragma once
 
 #include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/safe_cast.h>
+#include <xrpl/basics/enum_bitops.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/ReadView.h>
@@ -22,80 +22,39 @@
 
 namespace xrpl {
 
-// Bitwise flag enum with existing operator overloads
-// NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-enum ApplyFlags : std::uint32_t {
-    TapNone = 0x00,
+enum class ApplyFlags : std::uint32_t {
+    None = 0x00,
 
     // This is a local transaction with the
     // fail_hard flag set.
-    TapFailHard = 0x10,
+    FailHard = 0x10,
 
     // This is not the transaction's last pass
     // Transaction can be retried, soft failures allowed
-    TapRetry = 0x20,
+    Retry = 0x20,
 
     // Transaction came from a privileged source
-    TapUnlimited = 0x400,
+    Unlimited = 0x400,
 
     // Transaction is executing as part of a batch
-    TapBatch = 0x800,
+    Batch = 0x800,
 
     // Transaction shouldn't be applied
     // Signatures shouldn't be checked
-    TapDryRun = 0x1000,
+    DryRun = 0x1000,
 
     // Transaction is being preflighted as the payload of a
     // TransactionProposalCreate. Its signatures are collected on-ledger
     // afterward, so signature-presence checks (e.g. Batch signer matching)
     // are skipped at proposal-creation time (On-Chain Cosigner spec
     // §5.3.1.2).
-    TapProposal = 0x2000
+    Proposal = 0x2000
 };
 
-constexpr ApplyFlags
-operator|(ApplyFlags const& lhs, ApplyFlags const& rhs)
+template <>
+struct enum_bitops::OptIn<ApplyFlags> : std::true_type
 {
-    return safeCast<ApplyFlags>(
-        safeCast<std::underlying_type_t<ApplyFlags>>(lhs) |
-        safeCast<std::underlying_type_t<ApplyFlags>>(rhs));
-}
-
-static_assert((TapFailHard | TapRetry) == safeCast<ApplyFlags>(0x30u), "ApplyFlags operator |");
-static_assert((TapRetry | TapFailHard) == safeCast<ApplyFlags>(0x30u), "ApplyFlags operator |");
-
-constexpr ApplyFlags
-operator&(ApplyFlags const& lhs, ApplyFlags const& rhs)
-{
-    return safeCast<ApplyFlags>(
-        safeCast<std::underlying_type_t<ApplyFlags>>(lhs) &
-        safeCast<std::underlying_type_t<ApplyFlags>>(rhs));
-}
-
-static_assert((TapFailHard & TapRetry) == TapNone, "ApplyFlags operator &");
-static_assert((TapRetry & TapFailHard) == TapNone, "ApplyFlags operator &");
-
-constexpr ApplyFlags
-operator~(ApplyFlags const& flags)
-{
-    return safeCast<ApplyFlags>(~safeCast<std::underlying_type_t<ApplyFlags>>(flags));
-}
-
-static_assert(~TapRetry == safeCast<ApplyFlags>(0xFFFFFFDFu), "ApplyFlags operator ~");
-
-inline ApplyFlags
-operator|=(ApplyFlags& lhs, ApplyFlags const& rhs)
-{
-    lhs = lhs | rhs;
-    return lhs;
-}
-
-inline ApplyFlags
-operator&=(ApplyFlags& lhs, ApplyFlags const& rhs)
-{
-    lhs = lhs & rhs;
-    return lhs;
-}
+};
 
 //------------------------------------------------------------------------------
 

include/xrpl/nodestore/detail/DecodedBlob.h

@@ -1,8 +1,10 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/nodestore/NodeObject.h>
 
 #include <memory>
+#include <optional>
 
 namespace xrpl::node_store {
 
@@ -23,7 +25,7 @@ public:
     /**
      * Construct the decoded blob from raw data.
      */
-    DecodedBlob(void const* key, void const* value, int valueBytes);
+    DecodedBlob(std::optional<uint256> key, void const* value, int valueBytes);
 
     /**
      * Determine if the decoding was successful.
@@ -43,10 +45,10 @@ public:
 private:
     bool success_{false};
 
-    void const* key_;
+    uint256 key_;
     NodeObjectType objectType_{NodeObjectType::Unknown};
     unsigned char const* objectData_{nullptr};
-    int dataBytes_;
+    int dataBytes_ = 0;
 };
 
 }  // namespace xrpl::node_store

include/xrpl/nodestore/detail/EncodedBlob.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/nodestore/NodeObject.h>
 
@@ -37,11 +38,6 @@ namespace xrpl::node_store {
 
 class EncodedBlob
 {
-    /**
-     * The 32-byte key of the serialized object.
-     */
-    std::array<std::uint8_t, 32> key_{};
-
     /**
      * A pre-allocated buffer for the serialized object.
      *
@@ -65,6 +61,11 @@ class EncodedBlob
      */
     std::uint8_t* const ptr_;
 
+    /**
+     * The 32-byte key of the serialized object.
+     */
+    uint256 key_;
+
 public:
     explicit EncodedBlob(std::shared_ptr<NodeObject> const& obj)
         : size_([&obj]() {
@@ -76,11 +77,12 @@ public:
             return obj->getData().size() + 9;
         }())
         , ptr_((size_ <= payload_.size()) ? payload_.data() : new std::uint8_t[size_])
+        , key_(obj->getHash())
     {
         std::fill_n(ptr_, 8, std::uint8_t{0});
         ptr_[8] = static_cast<std::uint8_t>(obj->getType());
+
         std::copy_n(obj->getData().data(), obj->getData().size(), ptr_ + 9);
-        std::copy_n(obj->getHash().data(), obj->getHash().size(), key_.data());
     }
 
     ~EncodedBlob()
@@ -95,10 +97,10 @@ public:
             delete[] ptr_;
     }
 
-    [[nodiscard]] void const*
+    [[nodiscard]] uint256 const&
     getKey() const noexcept
     {
-        return static_cast<void const*>(key_.data());
+        return key_;
     }
 
     [[nodiscard]] std::size_t

include/xrpl/protocol/AccountID.h

@@ -61,14 +61,22 @@ parseBase58(std::string const& s);
 /**
  * A special account that's used as the "issuer" for XRP.
  */
-AccountID const&
-xrpAccount();
+constexpr inline AccountID const&
+xrpAccount() noexcept
+{
+    static constexpr AccountID kAccount(beast::kZero);
+    return kAccount;
+}
 
 /**
  * A placeholder for empty accounts.
  */
-AccountID const&
-noAccount();
+constexpr inline AccountID const&
+noAccount() noexcept
+{
+    static constexpr AccountID kAccount = xrpAccount().next();
+    return kAccount;
+}
 
 /**
  * Convert hex or base58 string to AccountID.
@@ -80,10 +88,10 @@ bool
 toIssuer(AccountID&, std::string const&);
 
 // DEPRECATED Should be checking the currency or native flag
-inline bool
-isXRP(AccountID const& c)
+constexpr inline bool
+isXRP(AccountID const& c) noexcept
 {
-    return c == beast::kZero;
+    return c == xrpAccount();
 }
 
 // DEPRECATED
@@ -101,22 +109,6 @@ operator<<(std::ostream& os, AccountID const& x)
     return os;
 }
 
-/**
- * Initialize the global cache used to map AccountID to base58 conversions.
- *
- * The cache is optional and need not be initialized. But because conversion
- * is expensive (it requires a SHA-256 operation) in most cases the overhead
- * of the cache is worth the benefit.
- *
- * @param count The number of entries the cache should accommodate. Zero will
- *              disable the cache, releasing any memory associated with it.
- *
- * @note The function will only initialize the cache the first time it is
- *       invoked. Subsequent invocations do nothing.
- */
-void
-initAccountIdCache(std::size_t count);
-
 }  // namespace xrpl
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/KnownFormats.h

@@ -1,10 +1,10 @@
 #pragma once
 
 #include <xrpl/basics/contract.h>
-#include <xrpl/beast/type_name.h>
 #include <xrpl/protocol/SOTemplate.h>
 
 #include <boost/container/flat_map.hpp>
+#include <boost/core/type_name.hpp>
 
 #include <algorithm>
 #include <cstddef>
@@ -84,7 +84,7 @@ public:
      * Derived classes will load the object with all the known formats.
      */
 private:
-    KnownFormats() : name_(beast::typeName<Derived>())
+    KnownFormats() : name_(boost::core::type_name<Derived>())
     {
     }
 

include/xrpl/protocol/LedgerHeader.h

@@ -75,12 +75,6 @@ addRaw(LedgerHeader const&, Serializer&, bool includeHash = false);
 LedgerHeader
 deserializeHeader(Slice data, bool hasHash = false);
 
-/**
- * Deserialize a ledger header (prefixed with 4 bytes) from a byte array.
- */
-LedgerHeader
-deserializePrefixedHeader(Slice data, bool hasHash = false);
-
 /**
  * Calculate the hash of a ledger header.
  */

include/xrpl/protocol/STAccount.h

@@ -19,8 +19,8 @@ private:
     // But an STAccount is always 160 bits, so we can store it with less
     // overhead in an xrpl::UInt160.  However, so the serialized format of the
     // STAccount stays unchanged, we serialize and deserialize like an STBlob.
-    AccountID value_;
-    bool default_;
+    AccountID value_{};
+    bool default_{true};
 
 public:
     using value_type = AccountID;
@@ -28,7 +28,6 @@ public:
     STAccount();
 
     STAccount(SField const& n);
-    STAccount(SField const& n, Buffer const& v);
     STAccount(SerialIter& sit, SField const& name);
     STAccount(SField const& n, AccountID const& v);
 

include/xrpl/protocol/STBitString.h

@@ -33,7 +33,20 @@ public:
 
     STBitString(SField const& n);
     STBitString(value_type const& v);
+
+    template <typename Tag>
+        requires(!std::is_void_v<Tag>)
+    STBitString(BaseUInt<Bits, Tag> const& v) : value_(v)
+    {
+    }
+
     STBitString(SField const& n, value_type const& v);
+    template <typename Tag>
+        requires(!std::is_void_v<Tag>)
+    STBitString(SField const& n, BaseUInt<Bits, Tag> const& v) : STBase(n), value_(v)
+    {
+    }
+
     STBitString(SerialIter& sit, SField const& name);
 
     [[nodiscard]] SerializedTypeID
@@ -91,7 +104,7 @@ inline STBitString<Bits>::STBitString(SField const& n, value_type const& v) : ST
 
 template <int Bits>
 inline STBitString<Bits>::STBitString(SerialIter& sit, SField const& name)
-    : STBitString(name, sit.getBitString<Bits>())
+    : STBitString(name, sit.getBitString<value_type>())
 {
 }
 
@@ -158,7 +171,7 @@ STBitString<Bits>::add(Serializer& s) const
 {
     XRPL_ASSERT(getFName().isBinary(), "xrpl::STBitString::add : field is binary");
     XRPL_ASSERT(getFName().fieldType == getSType(), "xrpl::STBitString::add : field type match");
-    s.addBitString<Bits>(value_);
+    s.addBitString(value_);
 }
 
 template <int Bits>
@@ -166,7 +179,7 @@ template <typename Tag>
 void
 STBitString<Bits>::setValue(BaseUInt<Bits, Tag> const& v)
 {
-    value_ = v;
+    value_ = value_type{v};
 }
 
 template <int Bits>

include/xrpl/protocol/STInteger.h

@@ -16,12 +16,13 @@ namespace xrpl {
 template <typename Integer>
 class STInteger : public STBase, public CountedObject<STInteger<Integer>>
 {
+    static_assert(
+        SerializableInteger<Integer>,
+        "STInteger requires an integer type that Serializer can append");
+
 public:
     using value_type = Integer;
 
-private:
-    Integer value_;
-
 public:
     explicit STInteger(Integer v);
     STInteger(SField const& n, Integer v = 0);
@@ -62,6 +63,8 @@ private:
     move(std::size_t n, void* buf) override;
 
     friend class xrpl::detail::STVar;
+
+    Integer value_;
 };
 
 using STUInt8 = STInteger<unsigned char>;
@@ -101,7 +104,15 @@ STInteger<Integer>::add(Serializer& s) const
 {
     XRPL_ASSERT(getFName().isBinary(), "xrpl::STInteger::add : field is binary");
     XRPL_ASSERT(getFName().fieldType == getSType(), "xrpl::STInteger::add : field type match");
-    s.addInteger(value_);
+
+    if constexpr (sizeof(Integer) == 1)
+        s.add8(value_);
+    else if constexpr (sizeof(Integer) == 2)
+        s.add16(value_);
+    else if constexpr (sizeof(Integer) == 4)
+        s.add32(value_);
+    else
+        s.add64(value_);
 }
 
 template <typename Integer>

include/xrpl/protocol/STPathSet.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/enum_bitops.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
@@ -15,6 +16,7 @@
 #include <cstdint>
 #include <memory>
 #include <optional>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
@@ -22,18 +24,8 @@ namespace xrpl {
 
 class STPathElement final : public CountedObject<STPathElement>
 {
-    unsigned int type_;
-    AccountID accountID_;
-    PathAsset assetID_;
-    AccountID issuerID_;
-
-    bool isOffer_;
-    std::size_t hashValue_;
-
 public:
-    // Bitwise values (typeCurrency | typeMPT)
-    // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-    enum Type {
+    enum class Type : std::uint8_t {
         TypeNone = 0x00,
         TypeAccount = 0x01,   // Rippling through an account (vs taking an offer).
         TypeCurrency = 0x10,  // Currency follows.
@@ -45,6 +37,8 @@ public:
         // Combination of all types.
     };
 
+    using enum Type;
+
     STPathElement();
     STPathElement(STPathElement const&) = default;
     STPathElement&
@@ -62,42 +56,42 @@ public:
         bool forceAsset = false);
 
     STPathElement(
-        unsigned int uType,
+        Type type,
         AccountID const& account,
         PathAsset const& asset,
         AccountID const& issuer);
 
-    [[nodiscard]] std::uint32_t
-    getNodeType() const;
+    [[nodiscard]] Type
+    getNodeType() const noexcept;
 
     [[nodiscard]] bool
-    isOffer() const;
+    isOffer() const noexcept;
 
     [[nodiscard]] bool
-    isAccount() const;
+    isAccount() const noexcept;
 
     [[nodiscard]] bool
-    hasIssuer() const;
+    hasIssuer() const noexcept;
 
     [[nodiscard]] bool
-    hasCurrency() const;
+    hasCurrency() const noexcept;
 
     [[nodiscard]] bool
-    hasMPT() const;
+    hasMPT() const noexcept;
 
     [[nodiscard]] bool
-    hasAsset() const;
+    hasAsset() const noexcept;
 
     [[nodiscard]] bool
-    isNone() const;
+    isNone() const noexcept;
 
     // Nodes are either an account ID or a offer prefix. Offer prefixs denote a
     // class of offers.
     [[nodiscard]] AccountID const&
-    getAccountID() const;
+    getAccountID() const noexcept;
 
     [[nodiscard]] PathAsset const&
-    getPathAsset() const;
+    getPathAsset() const noexcept;
 
     [[nodiscard]] Currency const&
     getCurrency() const;
@@ -106,17 +100,35 @@ public:
     getMPTID() const;
 
     [[nodiscard]] AccountID const&
-    getIssuerID() const;
+    getIssuerID() const noexcept;
 
     [[nodiscard]] bool
-    isType(Type const& pe) const;
+    isType(Type pe) const noexcept;
 
-    bool
-    operator==(STPathElement const& t) const;
+    friend bool
+    operator==(STPathElement const& lhs, STPathElement const& rhs) noexcept
+    {
+        return lhs.isType(TypeAccount) == rhs.isType(TypeAccount) &&
+            lhs.hashValue_ == rhs.hashValue_ && lhs.accountID_ == rhs.accountID_ &&
+            lhs.assetID_ == rhs.assetID_ && lhs.issuerID_ == rhs.issuerID_;
+    }
 
 private:
     static std::size_t
     getHash(STPathElement const& element);
+
+    Type type_;
+    AccountID accountID_;
+    PathAsset assetID_;
+    AccountID issuerID_;
+
+    bool isOffer_;
+    std::size_t hashValue_;
+};
+
+template <>
+struct enum_bitops::OptIn<STPathElement::Type> : std::true_type
+{
 };
 
 template <class Hasher>
@@ -124,7 +136,7 @@ void
 hash_append(Hasher& h, STPathElement const& e) noexcept
 {
     using beast::hash_append;
-    hash_append(h, (e.getNodeType() & STPathElement::TypeAccount) != 0u);
+    hash_append(h, e.isType(STPathElement::TypeAccount));
     hash_append(h, e.getAccountID());
     hash_append(h, e.getPathAsset());
     hash_append(h, e.getIssuerID());
@@ -404,11 +416,11 @@ inline STPathElement::STPathElement(
 }
 
 inline STPathElement::STPathElement(
-    unsigned int uType,
+    Type type,
     AccountID const& account,
     PathAsset const& asset,
     AccountID const& issuer)
-    : type_(uType)
+    : type_(type)
     , accountID_(account)
     , assetID_(asset)
     , issuerID_(issuer)
@@ -423,56 +435,56 @@ inline STPathElement::STPathElement(
     hashValue_ = getHash(*this);
 }
 
-inline std::uint32_t
-STPathElement::getNodeType() const
+inline STPathElement::Type
+STPathElement::getNodeType() const noexcept
 {
     return type_;
 }
 
 inline bool
-STPathElement::isOffer() const
+STPathElement::isOffer() const noexcept
 {
     return isOffer_;
 }
 
 inline bool
-STPathElement::isAccount() const
+STPathElement::isAccount() const noexcept
 {
     return !isOffer();
 }
 
 inline bool
-STPathElement::isType(Type const& pe) const
+STPathElement::isType(Type pe) const noexcept
 {
-    return (type_ & pe) != 0u;
+    return (type_ & pe) != STPathElement::TypeNone;
 }
 
 inline bool
-STPathElement::hasIssuer() const
+STPathElement::hasIssuer() const noexcept
 {
     return isType(STPathElement::TypeIssuer);
 }
 
 inline bool
-STPathElement::hasCurrency() const
+STPathElement::hasCurrency() const noexcept
 {
     return isType(STPathElement::TypeCurrency);
 }
 
 inline bool
-STPathElement::hasMPT() const
+STPathElement::hasMPT() const noexcept
 {
     return isType(STPathElement::TypeMpt);
 }
 
 inline bool
-STPathElement::hasAsset() const
+STPathElement::hasAsset() const noexcept
 {
     return isType(STPathElement::TypeAsset);
 }
 
 inline bool
-STPathElement::isNone() const
+STPathElement::isNone() const noexcept
 {
     return getNodeType() == STPathElement::TypeNone;
 }
@@ -480,13 +492,13 @@ STPathElement::isNone() const
 // Nodes are either an account ID or a offer prefix. Offer prefixs denote a
 // class of offers.
 inline AccountID const&
-STPathElement::getAccountID() const
+STPathElement::getAccountID() const noexcept
 {
     return accountID_;
 }
 
 inline PathAsset const&
-STPathElement::getPathAsset() const
+STPathElement::getPathAsset() const noexcept
 {
     return assetID_;
 }
@@ -504,18 +516,11 @@ STPathElement::getMPTID() const
 }
 
 inline AccountID const&
-STPathElement::getIssuerID() const
+STPathElement::getIssuerID() const noexcept
 {
     return issuerID_;
 }
 
-inline bool
-STPathElement::operator==(STPathElement const& t) const
-{
-    return (type_ & TypeAccount) == (t.type_ & TypeAccount) && hashValue_ == t.hashValue_ &&
-        accountID_ == t.accountID_ && assetID_ == t.assetID_ && issuerID_ == t.issuerID_;
-}
-
 // ------------ STPath ------------
 
 inline STPath::STPath(std::vector<STPathElement> p) : path_(std::move(p))

include/xrpl/protocol/STTx.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Blob.h>
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
@@ -153,13 +154,6 @@ public:
     [[nodiscard]] std::string
     getMetaSQL(std::uint32_t inLedger, std::string const& escapedMetaData) const;
 
-    [[nodiscard]] std::string
-    getMetaSQL(
-        Serializer rawTxn,
-        std::uint32_t inLedger,
-        TxnSql status,
-        std::string const& escapedMetaData) const;
-
     /**
      * The IDs of the inner transactions of a Batch.
      */

include/xrpl/protocol/SystemParameters.h

@@ -14,7 +14,7 @@ namespace xrpl {
 // Various protocol and system specific constant globals.
 
 /* The name of the system. */
-static inline std::string const&
+inline std::string const&
 systemName()
 {
     static std::string const kName = "xrpld";
@@ -52,11 +52,10 @@ isLegalAmountSigned(XRPAmount const& amount)
 }
 
 /* The currency code for the native currency. */
-static inline std::string const&
+inline std::string
 systemCurrencyCode()
 {
-    static std::string const kCode = "XRP";
-    return kCode;
+    return "XRP";
 }
 
 /**

include/xrpl/protocol/UintTypes.h

@@ -61,26 +61,40 @@ using Domain = BaseUInt<256>;
 /**
  * XRP currency.
  */
-Currency const&
-xrpCurrency();
+constexpr inline Currency const&
+xrpCurrency() noexcept
+{
+    static constexpr Currency const kCurrency(beast::kZero);
+    return kCurrency;
+}
 
 /**
  * A placeholder for empty currencies.
  */
-Currency const&
-noCurrency();
+constexpr inline Currency const&
+noCurrency() noexcept
+{
+    static constexpr Currency const kCurrency(xrpCurrency().next());
+    return kCurrency;
+}
 
 /**
  * We deliberately disallow the currency that looks like "XRP" because too
  * many people were using it instead of the correct XRP currency.
+ *
+ * Note that this doesn't catch "xRP" or "xrp" or other case variations.
  */
-Currency const&
-badCurrency();
-
-inline bool
-isXRP(Currency const& c)
+constexpr inline Currency const&
+badCurrency() noexcept
 {
-    return c == beast::kZero;
+    static constexpr Currency kCurrency{"0000000000000000000000005852500000000000"};
+    return kCurrency;
+}
+
+constexpr inline bool
+isXRP(Currency const& c) noexcept
+{
+    return c == xrpCurrency();
 }
 
 /**
@@ -98,7 +112,7 @@ to_string(Currency const& c);
  *       to rewrite some unit test code.
  */
 bool
-toCurrency(Currency&, std::string const&);
+toCurrency(Currency&, std::string_view);
 
 /**
  * Tries to convert a string to a Currency, returns noCurrency() on failure.
@@ -107,8 +121,7 @@ toCurrency(Currency&, std::string const&);
  *       unfortunate; changing this will require very careful checking
  *       everywhere and may mean having to rewrite some unit test code.
  */
-Currency
-toCurrency(std::string const&);
+Currency toCurrency(std::string_view);
 
 inline std::ostream&
 operator<<(std::ostream& os, Currency const& x)

include/xrpl/protocol/digest.h

@@ -8,6 +8,7 @@
 #include <array>
 #include <cstddef>
 #include <cstdint>
+#include <span>
 #include <type_traits>
 
 namespace xrpl {
@@ -182,7 +183,7 @@ public:
     operator result_type() noexcept
     {
         auto const digest = Sha512Hasher::result_type(h_);
-        return result_type::fromVoid(digest.data());
+        return result_type{std::span{digest}.first<result_type::size()>()};
     }
 
 private:

include/xrpl/protocol/jss.h

@@ -392,6 +392,7 @@ JSS(max_ledger);                  // in/out: LedgerCleaner
 JSS(max_queue_size);              // out: TxQ
 JSS(max_spend_drops);             // out: AccountInfo
 JSS(max_spend_drops_total);       // out: AccountInfo
+JSS(maximum);
 JSS(mean);                        // out: get_aggregate_price
 JSS(median);                      // out: get_aggregate_price
 JSS(median_fee);                  // out: TxQ

include/xrpl/protocol/nft.h

@@ -8,6 +8,7 @@
 
 #include <cstdint>
 #include <cstring>
+#include <span>
 
 namespace xrpl::nft {
 
@@ -98,7 +99,8 @@ getTaxon(UInt256 const& id)
 inline AccountID
 getIssuer(UInt256 const& id)
 {
-    return AccountID::fromVoid(id.data() + 4);
+    return AccountID{
+        std::span<unsigned char const, uint256::size()>{id}.subspan<4, AccountID::size()>()};
 }
 
 }  // namespace xrpl::nft

include/xrpl/protocol/nftPageMask.h

@@ -2,13 +2,10 @@
 
 #include <xrpl/basics/base_uint.h>
 
-#include <string_view>
-
 namespace xrpl::nft {
 
 // NFT directory pages order their contents based only on the low 96 bits of
 // the NFToken value.  This mask provides easy access to the necessary mask.
-constexpr UInt256 kPageMask(
-    std::string_view("0000000000000000000000000000000000000000ffffffffffffffffffffffff"));
+constexpr UInt256 kPageMask{"0000000000000000000000000000000000000000ffffffffffffffffffffffff"};
 
 }  // namespace xrpl::nft

include/xrpl/protocol/serialize.h

@@ -18,7 +18,7 @@ serializeBlob(Object const& o)
 {
     Serializer s;
     o.add(s);
-    return s.peekData();
+    return s.takeData();
 }
 
 /**

include/xrpl/shamap/SHAMapItem.h

@@ -1,6 +1,5 @@
 #pragma once
 
-#include <xrpl/basics/ByteUtilities.h>
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/SlabAllocator.h>
 #include <xrpl/basics/Slice.h>
@@ -15,12 +14,13 @@
 #include <cstdint>
 #include <cstring>
 #include <memory>
+#include <new>
 #include <type_traits>
 
 namespace xrpl {
 
 // an item stored in a SHAMap
-class SHAMapItem : public CountedObject<SHAMapItem>
+class alignas(8) SHAMapItem : public CountedObject<SHAMapItem>
 {
     // These are used to support boost::intrusive_ptr reference counting
     // These functions are used internally by boost::intrusive_ptr to handle
@@ -101,15 +101,15 @@ namespace detail {
 // The slab cutoffs and the number of megabytes per allocation are customized
 // based on the number of objects of each size we expect to need at any point
 // in time and with an eye to minimize the number of slack bytes in a block.
-inline SlabAllocatorSet<SHAMapItem> gSlabber({
-    {  128, megabytes(std::size_t(60)) },
-    {  192, megabytes(std::size_t(46)) },
-    {  272, megabytes(std::size_t(60)) },
-    {  384, megabytes(std::size_t(56)) },
-    {  564, megabytes(std::size_t(40)) },
-    {  772, megabytes(std::size_t(46)) },
-    { 1052, megabytes(std::size_t(60)) },
-});
+inline constinit slab::Allocator<SHAMapItem, slab::HeapFallback,
+    slab::Config<1000000, 128>,
+    slab::Config<1000000, 296>,
+    slab::Config<125000, 392>,
+    slab::Config<125000, 520>,
+    slab::Config<62500, 760>,
+    slab::Config<62500, 856>,
+    slab::Config<31250, 1048>
+> gSlabber;
 // clang-format on
 
 }  // namespace detail
@@ -150,23 +150,13 @@ makeShamapitem(UInt256 const& tag, Slice data)
     XRPL_ASSERT(
         data.size() <= megabytes<std::size_t>(16), "xrpl::makeShamapitem : maximum input size");
 
-    // NOLINTNEXTLINE(misc-const-correctness)
-    std::uint8_t* raw = detail::gSlabber.allocate(data.size());
-
-    // If we can't grab memory from the slab allocators, we fall back to
-    // the standard library and try to grab a precisely-sized memory block:
-    if (raw == nullptr)
-        raw = new std::uint8_t[sizeof(SHAMapItem) + data.size()];
-
     // We do not increment the reference count here on purpose: the
-    // constructor of SHAMapItem explicitly sets it to 1. We use the fact
-    // that the refcount can never be zero before incrementing as an
-    // invariant.
-    return {new (raw) SHAMapItem{tag, data}, false};
-}
+    // constructor of SHAMapItem explicitly sets it to 1.
+    if (auto raw = detail::gSlabber.allocate(data.size())) [[likely]]
+        return {new (raw) SHAMapItem{tag, data}, false};
 
-static_assert(alignof(SHAMapItem) != 40);
-static_assert(alignof(SHAMapItem) == 8 || alignof(SHAMapItem) == 4);
+    Throw<std::bad_alloc>();
+}
 
 inline boost::intrusive_ptr<SHAMapItem>
 makeShamapitem(SHAMapItem const& other)

include/xrpl/tx/ApplyContext.h

@@ -51,7 +51,8 @@ public:
         beast::Journal journal = beast::Journal{beast::Journal::getNullSink()})
         : ApplyContext(registry, base, std::nullopt, tx, preclaimResult, baseFee, flags, journal)
     {
-        XRPL_ASSERT((flags & TapBatch) == 0, "Batch apply flag should not be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::None, "Batch apply flag should not be set");
     }
 
     std::reference_wrapper<ServiceRegistry> registry;

include/xrpl/tx/Transactor.h

@@ -59,10 +59,11 @@ public:
         , parentBatchId(parentBatchId)
         , j(j)
     {
-        XRPL_ASSERT((flags & TapBatch) == TapBatch, "Batch apply flag should be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::Batch, "Batch apply flag should be set");
         XRPL_ASSERT_IF(
-            (flags & TapProposal) != TapNone,
-            (flags & TapDryRun) != TapNone,
+            (flags & ApplyFlags::Proposal) != ApplyFlags::None,
+            (flags & ApplyFlags::DryRun) != ApplyFlags::None,
             "xrpl::PreflightContext : proposal preflight implies dry run");
     }
 
@@ -74,10 +75,11 @@ public:
         beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
         : registry(registry), tx(tx), rules(std::move(rules)), flags(flags), j(j)
     {
-        XRPL_ASSERT((flags & TapBatch) == 0, "Batch apply flag should not be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::None, "Batch apply flag should not be set");
         XRPL_ASSERT_IF(
-            (flags & TapProposal) != TapNone,
-            (flags & TapDryRun) != TapNone,
+            (flags & ApplyFlags::Proposal) != ApplyFlags::None,
+            (flags & ApplyFlags::DryRun) != ApplyFlags::None,
             "xrpl::PreflightContext : proposal preflight implies dry run");
     }
 
@@ -116,7 +118,7 @@ public:
         , j(j)
     {
         XRPL_ASSERT(
-            parentBatchId.has_value() == ((flags & TapBatch) == TapBatch),
+            parentBatchId.has_value() == ((flags & ApplyFlags::Batch) == ApplyFlags::Batch),
             "Parent Batch ID should be set if batch apply flag is set");
     }
 
@@ -129,7 +131,8 @@ public:
         beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
         : PreclaimContext(registry, view, preflightResult, tx, flags, std::nullopt, j)
     {
-        XRPL_ASSERT((flags & TapBatch) == 0, "Batch apply flag should not be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::None, "Batch apply flag should not be set");
     }
 
     PreclaimContext&

include/xrpl/tx/applySteps.h

@@ -41,7 +41,7 @@ struct ApplyResult
 inline bool
 isTecClaimHardFail(TER ter, ApplyFlags flags)
 {
-    return isTecClaim(ter) && ((flags & TapRetry) == 0u);
+    return isTecClaim(ter) && ((flags & ApplyFlags::Retry) == ApplyFlags::None);
 }
 
 /**

include/xrpl/tx/invariants/MPTInvariant.h

@@ -42,14 +42,6 @@ class ValidMPTIssuance
      */
     bool referenceHoldingMutated_ = false;
 
-    /**
-     * Flags cleared on an existing MPTokenIssuance, except lsfMPTLocked,
-     * which tfMPTUnlock clears legitimately. Every other issuance flag is
-     * fixed at creation or set-once via MPTokenIssuanceSet, so any bit
-     * accumulated here is a bug. Enforced post-fixCleanup3_5_0.
-     */
-    std::uint32_t issuanceFlagsCleared_ = 0;
-
     /**
      * MPTokens and RippleStates deleted during apply. finalize() checks each
      * holder's AccountRoot to detect vault pseudo-account holdings deleted

include/xrpl/tx/transactors/system/Batch.h

@@ -57,12 +57,6 @@ public:
         ReadView const& view,
         beast::Journal const& j) override;
 
-    /**
-     * Inner transaction types that preflight rejects before LendingProtocolV1_2.
-     *
-     * Once the amendment is enabled the list only matters when replaying older
-     * ledgers. Remove it when LendingProtocolV1_2 is retired.
-     */
     static constexpr auto kDisabledTxTypes = std::to_array<TxType>({
         ttVAULT_CREATE,
         ttVAULT_SET,

nix/check-tools/nix-ubuntu-amd64.txt

@@ -2,172 +2,172 @@ Detected OS: linux (Linux x86_64)
 
 Core build tools:
   ✅ cmake
-     cmake version 4.4.3
-     /nix/store/jcvvpih1046akxcwh9hdiak5q24jqcf0-cmake-4.4.3/bin/cmake
+     cmake version 4.1.2
+     /nix/store/r9941n32g4wyvggz2703dlplbdq8a6rd-cmake-4.1.2/bin/cmake
   ✅ conan
-     Conan version 2.32.0
-     /nix/store/q0g5grbh7zm8gfhhnq5h6fm1rbs9yv3n-conan-2.32.0/bin/conan
+     Conan version 2.28.1
+     /nix/store/lxny9y4jvjdws7hgz1mygvb7hjrpmna5-conan-2.28.1/bin/conan
   ✅ git
-     git version 2.55.0
-     /nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git
+     git version 2.54.0
+     /nix/store/bcnisk3ydfgv26v2gw3zlky24g00yww2-git-2.54.0/bin/git
   ✅ python3
-     Python 3.14.7
-     /nix/store/lb41b0anx1f98y9y5s9mdv97gjgsq740-python3-3.14.7/bin/python3.14
+     Python 3.13.13
+     /nix/store/60m4rxhg2fldqaak400c0lry96ijrzqn-python3-3.13.13/bin/python3.13
 
 Development tooling:
   ✅ ccache
      ccache version 4.13.6
-     /nix/store/p1a1s700dqsw1b3b8d2ba64nqw68zgpy-ccache-4.13.6/bin/ccache
+     /nix/store/c9wwl7s5i6rsfwvf4v0xbbmzx5m6jgfr-ccache-4.13.6/bin/ccache
   ✅ clang
-     clang version 22.1.8
-     /nix/store/dggxva67vs7virgsmd6xkwd6p7zsc5pn-clang-wrapper-22.1.8/bin/clang
+     clang version 22.1.7
+     /nix/store/ff0hrp9r9i3pa5arkdw0sgmzp8d576qi-clang-wrapper-22.1.7/bin/clang
   ✅ clang-22
-     clang version 22.1.8
-     /nix/store/ckz6y10v5dbyswpf9f6hd8kjfv84f920-clang-22/bin/clang-22
+     clang version 22.1.7
+     /nix/store/dagc2rq44gfbr7w7yvvqca3yqpc9gqbq-clang-22/bin/clang-22
   ✅ clang++
-     clang version 22.1.8
-     /nix/store/dggxva67vs7virgsmd6xkwd6p7zsc5pn-clang-wrapper-22.1.8/bin/clang++
+     clang version 22.1.7
+     /nix/store/ff0hrp9r9i3pa5arkdw0sgmzp8d576qi-clang-wrapper-22.1.7/bin/clang++
   ✅ clang++-22
-     clang version 22.1.8
-     /nix/store/lsishk8fwbdmlwr5fbwyd3yhhjsm67qr-clang++-22/bin/clang++-22
+     clang version 22.1.7
+     /nix/store/l5m8clin1npl605wdkd8mr18ggxww3z4-clang++-22/bin/clang++-22
   ✅ ClangBuildAnalyzer
      ClangBuildAnalyzer 1.6.0
-     /nix/store/gvx8im1c89vspwb8ixa91lr1dagbi241-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
+     /nix/store/bshlmn8fqw55nsnm581xqlfbahfkykxx-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
   ✅ curl
-     curl 8.22.0 (x86_64-pc-linux-gnu) libcurl/8.22.0 OpenSSL/3.5.8 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.70.0 mit-krb5/1.22.2
-     /nix/store/305w9ipyg497mz9dq31abdf61qk58k29-curl-8.22.0-bin/bin/curl
+     curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+     /nix/store/zbwymrp4lcfjc4kkk0n4779v0kjjz58z-curl-8.20.0-bin/bin/curl
   ✅ file
-     file-5.48
-     /nix/store/g0fbnccaan8q0rxlw43xnbyb90i94vlc-file-5.48/bin/file
+     file-5.47
+     /nix/store/bizyfqdw0h67wzqmp10knmf9s2pqahdb-file-5.47/bin/file
   ✅ less
-     less 710 (PCRE2 regular expressions)
-     /nix/store/zi4d0awnc6crz18s177bv9y2yz9al3lq-less-710/bin/less
+     less 692 (PCRE2 regular expressions)
+     /nix/store/c6bacbn93qg4a7g9n4czww8rg24dvysr-less-692/bin/less
   ✅ make
      GNU Make 4.4.1
-     /nix/store/z565rgmn9vccv2h0g87z725pw610jmm8-gnumake-4.4.1/bin/make
+     /nix/store/d3bwqm6bymhy3pdgbvf7vxjqfp31m3j1-gnumake-4.4.1/bin/make
   ✅ netstat
      net-tools 2.10
-     /nix/store/9i6j9lrsliyz1ww2f8xx18z36wc9n38a-net-tools-2.10/bin/netstat
+     /nix/store/jmyzqvgflnswmws7rnxx6g3zbj680xvd-net-tools-2.10/bin/netstat
   ✅ ninja
      1.13.2
-     /nix/store/4nsdla28c4177ssp0hlyv5l2yzj8wcba-ninja-1.13.2/bin/ninja
+     /nix/store/7a235m7crqbb4h49sak20fqxpw3n7hr0-ninja-1.13.2/bin/ninja
   ✅ perl
-     v5.42.3
-     /nix/store/8g4dmf7l8q1mf9w4wfmlcl8gvdgmhb8v-perl-5.42.3/bin/perl
+     v5.42.0
+     /nix/store/6plwsm6pkq79yjv4xvy8csk2pd4hzr67-perl-5.42.0/bin/perl
   ✅ pkg-config
      0.29.2
-     /nix/store/b9izmrfjp0qnnyahdwwrzdwi87s1h179-pkg-config-wrapper-0.29.2/bin/pkg-config
+     /nix/store/1m05k7xgfnw6jc21xxk5681ni3ar97wf-pkg-config-wrapper-0.29.2/bin/pkg-config
   ✅ vim
      VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
-     /nix/store/9swnd5pf8p8w1gwcbhdpm2yx705kbp38-vim-9.2.1001/bin/vim
+     /nix/store/hvyqx52g4g2fxhgpans3fksjj6lmlyaw-vim-9.2.0389/bin/vim
   ✅ zip
      Zip 3.0
-     /nix/store/5ypvkry3qra47dylc9kfk36r1q9vha80-zip-3.0/bin/zip
+     /nix/store/qnd2ag67hrjj0b6vbmisdshf50r6s72n-zip-3.0/bin/zip
   ✅ clang-apply-replacements
-     clang-apply-replacements version 22.1.8
-     /nix/store/dykdkqyz48al2mllwjpwgdxyxgkwhk9x-clang-tools-22.1.8/bin/clang-apply-replacements
+     clang-apply-replacements version 22.1.7
+     /nix/store/4zp1rjpj2xijrv4kqpwsy3ixwb2r6nlk-clang-tools-22.1.7/bin/clang-apply-replacements
   ✅ clang-apply-replacements-22
-     clang-apply-replacements version 22.1.8
-     /nix/store/m0aqc6dbryn1mvr0m2zsxxgpmahcvp6v-clang-apply-replacements-22/bin/clang-apply-replacements-22
+     clang-apply-replacements version 22.1.7
+     /nix/store/py2wihg0a96qcppv4hjmww547xabr0fb-clang-apply-replacements-22/bin/clang-apply-replacements-22
   ✅ clang-format
-     clang-format version 22.1.8
-     /nix/store/dykdkqyz48al2mllwjpwgdxyxgkwhk9x-clang-tools-22.1.8/bin/clang-format
+     clang-format version 22.1.7
+     /nix/store/4zp1rjpj2xijrv4kqpwsy3ixwb2r6nlk-clang-tools-22.1.7/bin/clang-format
   ✅ clang-format-22
-     clang-format version 22.1.8
-     /nix/store/grpzqmx46d3xr3ssrz4ibkl9xr7rvjzj-clang-format-22/bin/clang-format-22
+     clang-format version 22.1.7
+     /nix/store/kz820ccifjlwqnwqjsx7kbiajrgsmbrh-clang-format-22/bin/clang-format-22
   ✅ clang-tidy
-     LLVM version 22.1.8
-     /nix/store/dykdkqyz48al2mllwjpwgdxyxgkwhk9x-clang-tools-22.1.8/bin/clang-tidy
+     LLVM version 22.1.7
+     /nix/store/4zp1rjpj2xijrv4kqpwsy3ixwb2r6nlk-clang-tools-22.1.7/bin/clang-tidy
   ✅ clang-tidy-22
-     LLVM version 22.1.8
-     /nix/store/v9g20lw1q1qq9ljwvh5k580hgd9hmsv8-clang-tidy-22/bin/clang-tidy-22
+     LLVM version 22.1.7
+     /nix/store/gdrkvpw846lkyzh8y9p3zx50g6ml2v84-clang-tidy-22/bin/clang-tidy-22
   ✅ dot
-     dot - graphviz version 15.1.1 (0)
-     /nix/store/f7r47nc0d13xa4c2xaaxa6dp3pzm9sp1-graphviz-15.1.1/bin/dot
+     dot - graphviz version 12.2.1 (0)
+     /nix/store/12rgns2296s4qcja778gvcbx61z77rc4-graphviz-12.2.1/bin/dot
   ✅ doxygen
-     1.17.0
-     /nix/store/q6yx2nsimj9xmckmgw4br2cnapbgnqpk-doxygen-1.17.0/bin/doxygen
+     1.16.1
+     /nix/store/k0vzr5lvgq1byraknzwvk51wcgpnsrkh-doxygen-1.16.1/bin/doxygen
   ✅ gcovr
      gcovr 8.4
-     /nix/store/shx7mfl8n4kx11icvwyj5x7cmf6z5ahq-python3.14-gcovr-8.4/bin/gcovr
+     /nix/store/iyzi7fpyclqrha054adnizvif02lg49x-python3.13-gcovr-8.4/bin/gcovr
   ✅ gh
-     gh version 2.102.0 (2026-09-30)
-     /nix/store/66h5dr9v94x04myh2kabx06rq9763jfc-gh-2.102.0/bin/gh
+     gh version 2.94.0 (nixpkgs)
+     /nix/store/pidh15szlsb1vc41xdsa3xbdghdazvby-gh-2.94.0/bin/gh
   ✅ git-cliff
-     git-cliff 2.14.2
-     /nix/store/sl19b42d69b3w2vb9pxp6jbqk841z8vj-git-cliff-2.14.2/bin/git-cliff
+     git-cliff 2.13.1
+     /nix/store/1q851fs62shgjhc03fxxdkpzxdjg7k11-git-cliff-2.13.1/bin/git-cliff
   ✅ git-lfs
-     git-lfs/3.8.0 (3.8.0; linux amd64; go 1.26.8)
-     /nix/store/rp9ld1f6h83xmf2rb5fpib5wmr46fy9f-git-lfs-3.8.0/bin/git-lfs
+     git-lfs/3.7.1 (3.7.1; linux amd64; go 1.26.3)
+     /nix/store/6ljwpal7b1756708m33vj0crpral7mvl-git-lfs-3.7.1/bin/git-lfs
   ✅ gpg
      gpg (GnuPG) 2.4.9
-     /nix/store/8gm9aq3sspqmvvh7c0x7djcivj2x7yvn-gnupg-2.4.9/bin/gpg
+     /nix/store/wx7vk8babxkgy813r70yc67vcwnmagbx-gnupg-2.4.9/bin/gpg
   ✅ pre-commit
-     pre-commit 4.6.2
-     /nix/store/6blf72f7sdmlrqjggxvk5ij4cxb7fk4c-pre-commit-4.6.2/bin/pre-commit
+     pre-commit 4.5.1
+     /nix/store/bj6i9vl34cij5h0r165y40hrjqak0bmz-pre-commit-4.5.1/bin/pre-commit
   ✅ run-clang-tidy
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/a760dc8nldq1715410384bkk83idmm00-run-clang-tidy/bin/run-clang-tidy
+     /nix/store/sbg911hs9dbclrzlp04br3iyfpgnaj6r-run-clang-tidy/bin/run-clang-tidy
   ✅ run-clang-tidy-22
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/xwh85m9sa5h8fnpnlmqwfnf2sz9l59mm-run-clang-tidy-22/bin/run-clang-tidy-22
+     /nix/store/n8yak1ap308gvi7gmrniw0ybsx80fjws-run-clang-tidy-22/bin/run-clang-tidy-22
 
 Rust toolchain:
   ✅ cargo
      cargo 1.97.1 (c980f4866 2026-06-30)
-     /nix/store/60b0cz400q34wj2gzav5a41i7y6jzlw3-cargo-1.97.1-x86_64-unknown-linux-gnu/bin/cargo
+     /nix/store/88abzp43ywyzql1rhf8jh5aj5n5j7xzr-cargo-1.97.1-x86_64-unknown-linux-gnu/bin/cargo
   ✅ cargo-audit
-     cargo-audit-audit 0.22.2
-     /nix/store/kksgynfwir3pfii9qkbj3gcc61an0d4s-cargo-audit-0.22.2/bin/cargo-audit
+     cargo-audit-audit 0.22.1
+     /nix/store/2w9if868piw98xz057sz97jnjvf7hnvf-cargo-audit-0.22.1/bin/cargo-audit
   ✅ cargo-llvm-cov
-     cargo-llvm-cov 0.9.0
-     /nix/store/4y8qxx0mlm22hnxlw2cmbcwpxispw02h-cargo-llvm-cov-0.9.0/bin/cargo-llvm-cov
+     cargo-llvm-cov 0.8.5
+     /nix/store/jjpdf1l6izz6607a346ykra9sndzaw7h-cargo-llvm-cov-0.8.5/bin/cargo-llvm-cov
   ✅ cargo-nextest
-     cargo-nextest 0.9.146
-     /nix/store/q0anzqrazmdr8n1049ca28098q6lv2y8-cargo-nextest-0.9.146/bin/cargo-nextest
+     cargo-nextest 0.9.137
+     /nix/store/jhkr7gwyrchkml33gyns9cy0yn7b57qc-cargo-nextest-0.9.137/bin/cargo-nextest
   ✅ clippy-driver
      clippy 0.1.97 (8bab26f4f6 2026-07-14)
-     /nix/store/kk0kqdc4f7am21yp30rr8jcrnib5xqzy-rust-minimal-1.97.1/bin/clippy-driver
+     /nix/store/40d3mzka7r1ps71l0yv2fs6616nbw85m-rust-minimal-1.97.1/bin/clippy-driver
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f 2026-07-14)
-     /nix/store/4mglk7qw9jqbv5nwlx9ahdnpcn5sz70r-rust-analyzer-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rust-analyzer
+     /nix/store/lr3m97p3hx1k22a7c44pb0wa7rbayhfi-rust-analyzer-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rust-analyzer
   ✅ rust-nightly
-     rustc 1.101.0-nightly (282215592 2026-10-04)
-     /nix/store/qwyzkvba3f9569wjj45b4iyb7nz7qbnr-rust-nightly/bin/rust-nightly
+     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
+     /nix/store/j7kf7a5h4xypzp6x1skg4dsdx2k4fwb3-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
-     /nix/store/kk0kqdc4f7am21yp30rr8jcrnib5xqzy-rust-minimal-1.97.1/bin/rustc
+     /nix/store/40d3mzka7r1ps71l0yv2fs6616nbw85m-rust-minimal-1.97.1/bin/rustc
   ✅ rustfmt
      rustfmt 1.9.0-stable (8bab26f4f6 2026-07-14)
-     /nix/store/y5gf8a3hix7pnwzdwcfpf3acqhzv3xy6-rustfmt-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rustfmt
+     /nix/store/6f1icmb2za20kxn30pgmbv5jq9fnbf4z-rustfmt-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rustfmt
 
 GCC toolchain:
   ✅ gcc
-     gcc (GCC) 15.3.0
-     /nix/store/bslmkbaiymxxdc6lwcdb1qyw745nds5j-gcc-wrapper-15.3.0/bin/gcc
+     gcc (GCC) 15.2.0
+     /nix/store/3dd6y3pq00i3r85l45jvz63wjya403nl-gcc-wrapper-15.2.0/bin/gcc
   ✅ gcc-15
-     gcc (GCC) 15.3.0
-     /nix/store/h6f2qc8kgwf7r81gwb10csvpjqfc2404-gcc-15/bin/gcc-15
+     gcc (GCC) 15.2.0
+     /nix/store/d6iri2s6bzqq5ac3fg25j6hgnn1lz44f-gcc-15/bin/gcc-15
   ✅ g++
-     g++ (GCC) 15.3.0
-     /nix/store/bslmkbaiymxxdc6lwcdb1qyw745nds5j-gcc-wrapper-15.3.0/bin/g++
+     g++ (GCC) 15.2.0
+     /nix/store/3dd6y3pq00i3r85l45jvz63wjya403nl-gcc-wrapper-15.2.0/bin/g++
   ✅ g++-15
-     g++ (GCC) 15.3.0
-     /nix/store/jwncv76v61ld9l99v0b1dkmf810if65s-g++-15/bin/g++-15
+     g++ (GCC) 15.2.0
+     /nix/store/gm3msmmxq055lm9gprkfjj9d2gdz1mpg-g++-15/bin/g++-15
   ✅ cpp
-     cpp (GCC) 15.3.0
-     /nix/store/bslmkbaiymxxdc6lwcdb1qyw745nds5j-gcc-wrapper-15.3.0/bin/cpp
+     cpp (GCC) 15.2.0
+     /nix/store/3dd6y3pq00i3r85l45jvz63wjya403nl-gcc-wrapper-15.2.0/bin/cpp
   ✅ cpp-15
-     cpp (GCC) 15.3.0
-     /nix/store/jmi558xj8v7lz2fm6wrradh40dp48zx9-cpp-15/bin/cpp-15
+     cpp (GCC) 15.2.0
+     /nix/store/bn3gmn0m7g4gn2i0yml46fljc7mghiq5-cpp-15/bin/cpp-15
   ✅ gcov
-     gcov (GCC) 15.3.0
-     /nix/store/n2ab7kf7mm84hna35x463mizcy52pf1h-gcc-15.3.0/bin/gcov
+     gcov (GCC) 15.2.0
+     /nix/store/xvv5sm5i8x0ks6ypfkzl7c4j9srnxz7k-gcc-15.2.0/bin/gcov
 
 Mold:
   ✅ mold
-     mold 2.42.1 (compatible with GNU ld)
-     /nix/store/9dcddrfxlfl9n3wfibi5jkmp22bjkvkh-mold-unwrapped-wrapper-2.42.1/bin/mold
+     mold 2.41.0 (compatible with GNU ld)
+     /nix/store/2w6fpgxjzzyqmd25wzplm23dfa49a0p2-mold-unwrapped-wrapper-2.41.0/bin/mold
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 

nix/check-tools/nix-ubuntu-arm64.txt

@@ -2,172 +2,172 @@ Detected OS: linux (Linux aarch64)
 
 Core build tools:
   ✅ cmake
-     cmake version 4.4.3
-     /nix/store/39cq2g3d3flq2lmb6hc09grxs4xaax8p-cmake-4.4.3/bin/cmake
+     cmake version 4.1.2
+     /nix/store/nkcpxjifkambzlrwh27a8igvhnbchibg-cmake-4.1.2/bin/cmake
   ✅ conan
-     Conan version 2.32.0
-     /nix/store/vbr044x1zbq062kkw53zm0sm3slv8g56-conan-2.32.0/bin/conan
+     Conan version 2.28.1
+     /nix/store/8i2gyqgc00xvxg9xm6y7n0ilncdv8imw-conan-2.28.1/bin/conan
   ✅ git
-     git version 2.55.0
-     /nix/store/kj6aff4gmz3snpp35rl3gysbl9srd81a-git-2.55.0/bin/git
+     git version 2.54.0
+     /nix/store/ixp98f9avf8ikpdrmp40cj33g0dazyp9-git-2.54.0/bin/git
   ✅ python3
-     Python 3.14.7
-     /nix/store/81ag9nxz1flw3xjkv1vvqg8y2ipx2ins-python3-3.14.7/bin/python3.14
+     Python 3.13.13
+     /nix/store/lqn6mbgzzdrqq2qkwddcmxj9z6amdd86-python3-3.13.13/bin/python3.13
 
 Development tooling:
   ✅ ccache
      ccache version 4.13.6
-     /nix/store/nzb1lir9sw06fn4635kfx055myqanaz8-ccache-4.13.6/bin/ccache
+     /nix/store/2q39xi2kbi04ibga7635f2sl148d1mzv-ccache-4.13.6/bin/ccache
   ✅ clang
-     clang version 22.1.8
-     /nix/store/7z7by1cxa52mk7hjia1pimjvsd6aizhf-clang-wrapper-22.1.8/bin/clang
+     clang version 22.1.7
+     /nix/store/xjqffrq9i7la058s9865ig71l9sp1ys5-clang-wrapper-22.1.7/bin/clang
   ✅ clang-22
-     clang version 22.1.8
-     /nix/store/pqn36q5paasw7v8sjgz5fd90mfpgkkqr-clang-22/bin/clang-22
+     clang version 22.1.7
+     /nix/store/vcf6ilfwn57828hwzyp6zlyr24j9j6yw-clang-22/bin/clang-22
   ✅ clang++
-     clang version 22.1.8
-     /nix/store/7z7by1cxa52mk7hjia1pimjvsd6aizhf-clang-wrapper-22.1.8/bin/clang++
+     clang version 22.1.7
+     /nix/store/xjqffrq9i7la058s9865ig71l9sp1ys5-clang-wrapper-22.1.7/bin/clang++
   ✅ clang++-22
-     clang version 22.1.8
-     /nix/store/m9a3slb0lcixm2csgjz9s0nvj9m5ysnq-clang++-22/bin/clang++-22
+     clang version 22.1.7
+     /nix/store/xby0f6gamr7m27zp5cndsvghbp9lgb3c-clang++-22/bin/clang++-22
   ✅ ClangBuildAnalyzer
      ClangBuildAnalyzer 1.6.0
-     /nix/store/ml2991pbdhh0qcxqj9331lhpsg449vky-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
+     /nix/store/h893hd4q1bb6ily2lby5dzyfrrzd2nvj-clangbuildanalyzer-1.6.0/bin/ClangBuildAnalyzer
   ✅ curl
-     curl 8.22.0 (aarch64-unknown-linux-gnu) libcurl/8.22.0 OpenSSL/3.5.8 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.70.0 mit-krb5/1.22.2
-     /nix/store/94c2x2bl3xb7mx43sg1bs1hd7pnw83ac-curl-8.22.0-bin/bin/curl
+     curl 8.20.0 (aarch64-unknown-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+     /nix/store/i1s0lqwlrmjd2dxzgy2p84cxqqsb0bmk-curl-8.20.0-bin/bin/curl
   ✅ file
-     file-5.48
-     /nix/store/66sd1x1hls0yijibn00iz08jh4fnas9z-file-5.48/bin/file
+     file-5.47
+     /nix/store/dx973zg9km2w9albsib2vw9wyvacfrlw-file-5.47/bin/file
   ✅ less
-     less 710 (PCRE2 regular expressions)
-     /nix/store/n6z9dv3yjlgvfx1nmrx6qzyv8vzim1l2-less-710/bin/less
+     less 692 (PCRE2 regular expressions)
+     /nix/store/1blb3s7hhsr77wqi598m6k1qkfp3ms0w-less-692/bin/less
   ✅ make
      GNU Make 4.4.1
-     /nix/store/q07jxvck60qgrg4p1ywypddh5zz6i9s2-gnumake-4.4.1/bin/make
+     /nix/store/9ngw1ippk25jjj5fjxv36xbp6iq7rxdx-gnumake-4.4.1/bin/make
   ✅ netstat
      net-tools 2.10
-     /nix/store/rfmhd3f8drg3wqyr2mhyrlkd7vyp2pxv-net-tools-2.10/bin/netstat
+     /nix/store/7vdsz21f0s499s5yyqzp5s4676q4yxdd-net-tools-2.10/bin/netstat
   ✅ ninja
      1.13.2
-     /nix/store/lfkdyggn1ffslfd830l35jrvapr5lzri-ninja-1.13.2/bin/ninja
+     /nix/store/8ksx98gsbn5lmlizcmw57yd4sg0k2p58-ninja-1.13.2/bin/ninja
   ✅ perl
-     v5.42.3
-     /nix/store/nyp5q4d2cb0pghi4i7nscb97bqkb6kp3-perl-5.42.3/bin/perl
+     v5.42.0
+     /nix/store/5wnly69vv1i3y97al4v3xrqymf9hlzgq-perl-5.42.0/bin/perl
   ✅ pkg-config
      0.29.2
-     /nix/store/h82n3d0wdrgskdc3yvmz5l3c50h2snvp-pkg-config-wrapper-0.29.2/bin/pkg-config
+     /nix/store/c7vwy0gl1q0agl2h22gi0m9dg7xxad2l-pkg-config-wrapper-0.29.2/bin/pkg-config
   ✅ vim
      VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
-     /nix/store/h39h0qq4i80sp3yd7sxjn2wf497v5rln-vim-9.2.1001/bin/vim
+     /nix/store/v8c7pvx26irvy9k5sbwd183cyvckzzb3-vim-9.2.0389/bin/vim
   ✅ zip
      Zip 3.0
-     /nix/store/lfwhq17wfcmjy823fldhlhxj1hjchdzc-zip-3.0/bin/zip
+     /nix/store/5mh19mvbv9ym2sm9vymyyaac5l2cj2jq-zip-3.0/bin/zip
   ✅ clang-apply-replacements
-     clang-apply-replacements version 22.1.8
-     /nix/store/iv4dxwnzvl0lqj8jfyibwf5ijb8hjw2i-clang-tools-22.1.8/bin/clang-apply-replacements
+     clang-apply-replacements version 22.1.7
+     /nix/store/s53p2m776iqaz7acgr5csgpsd18w15h7-clang-tools-22.1.7/bin/clang-apply-replacements
   ✅ clang-apply-replacements-22
-     clang-apply-replacements version 22.1.8
-     /nix/store/7gq05wr155k0pm1b2k73pya3l35hgifl-clang-apply-replacements-22/bin/clang-apply-replacements-22
+     clang-apply-replacements version 22.1.7
+     /nix/store/bg4kn8z81hk7b9284rjqvr51wpfjqc24-clang-apply-replacements-22/bin/clang-apply-replacements-22
   ✅ clang-format
-     clang-format version 22.1.8
-     /nix/store/iv4dxwnzvl0lqj8jfyibwf5ijb8hjw2i-clang-tools-22.1.8/bin/clang-format
+     clang-format version 22.1.7
+     /nix/store/s53p2m776iqaz7acgr5csgpsd18w15h7-clang-tools-22.1.7/bin/clang-format
   ✅ clang-format-22
-     clang-format version 22.1.8
-     /nix/store/54pnici9imw8ff0j5m7nig7dwaxrnlhv-clang-format-22/bin/clang-format-22
+     clang-format version 22.1.7
+     /nix/store/79v57mzcw8ng8kl7p961ck08ymhp31v7-clang-format-22/bin/clang-format-22
   ✅ clang-tidy
-     LLVM version 22.1.8
-     /nix/store/iv4dxwnzvl0lqj8jfyibwf5ijb8hjw2i-clang-tools-22.1.8/bin/clang-tidy
+     LLVM version 22.1.7
+     /nix/store/s53p2m776iqaz7acgr5csgpsd18w15h7-clang-tools-22.1.7/bin/clang-tidy
   ✅ clang-tidy-22
-     LLVM version 22.1.8
-     /nix/store/0mmdxscn11irlmm7jvp1c0a32712s026-clang-tidy-22/bin/clang-tidy-22
+     LLVM version 22.1.7
+     /nix/store/wdyd6cb9z1lyi37lbzvwldgcc7yv1n5c-clang-tidy-22/bin/clang-tidy-22
   ✅ dot
-     dot - graphviz version 15.1.1 (0)
-     /nix/store/vz4zb8d1rfigzzdn3i0hd4kff28vk02l-graphviz-15.1.1/bin/dot
+     dot - graphviz version 12.2.1 (0)
+     /nix/store/58rrk4yzwpmyxvl8cqm18h3dhv24zf00-graphviz-12.2.1/bin/dot
   ✅ doxygen
-     1.17.0
-     /nix/store/6q4z332wc9jnvad71wjj87lgjxidhgzl-doxygen-1.17.0/bin/doxygen
+     1.16.1
+     /nix/store/hq32kzwpl89wgr49iq0gmqn9r5n072zq-doxygen-1.16.1/bin/doxygen
   ✅ gcovr
      gcovr 8.4
-     /nix/store/v548fjz51k2nmr257vjnd0zp3bxpc2r1-python3.14-gcovr-8.4/bin/gcovr
+     /nix/store/sml3xbbfhhlhk6h7jnlg19pdbx9b764b-python3.13-gcovr-8.4/bin/gcovr
   ✅ gh
-     gh version 2.102.0 (2026-09-30)
-     /nix/store/vgg6gnq74h76b4r2ac2q9366f2s5qxwx-gh-2.102.0/bin/gh
+     gh version 2.94.0 (nixpkgs)
+     /nix/store/7hh2qi0gj2ifbxbl56cjzbiyfc379bji-gh-2.94.0/bin/gh
   ✅ git-cliff
-     git-cliff 2.14.2
-     /nix/store/hrlgliq7l3fl2qrdlc197mvscs4n03rd-git-cliff-2.14.2/bin/git-cliff
+     git-cliff 2.13.1
+     /nix/store/bidn3pz53yd6qlg711917xx0q10hqmqv-git-cliff-2.13.1/bin/git-cliff
   ✅ git-lfs
-     git-lfs/3.8.0 (3.8.0; linux arm64; go 1.26.8)
-     /nix/store/pa2g4xdvr4a73m6mv4cqs0pik1ka1xp5-git-lfs-3.8.0/bin/git-lfs
+     git-lfs/3.7.1 (3.7.1; linux arm64; go 1.26.3)
+     /nix/store/4rsklvkbac5bayy0zv12kxyvspi4sshd-git-lfs-3.7.1/bin/git-lfs
   ✅ gpg
      gpg (GnuPG) 2.4.9
-     /nix/store/3qc90b7qkxz7na3xnpd2qb8yvcq8zdp6-gnupg-2.4.9/bin/gpg
+     /nix/store/ka4i8zz5ni3rzqnzcxbfvwr95fk8pn6q-gnupg-2.4.9/bin/gpg
   ✅ pre-commit
-     pre-commit 4.6.2
-     /nix/store/5f3av75nc7n7xbf2hlvlagzpp2g8g562-pre-commit-4.6.2/bin/pre-commit
+     pre-commit 4.5.1
+     /nix/store/n981w6hjfar2l81kxbxs2wxl64vwa5kj-pre-commit-4.5.1/bin/pre-commit
   ✅ run-clang-tidy
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/b1yccjmij9qiha8a8d9yxayjdh5cg2vq-run-clang-tidy/bin/run-clang-tidy
+     /nix/store/4z2fyklg78klallr7x9j02kz92hnxp4m-run-clang-tidy/bin/run-clang-tidy
   ✅ run-clang-tidy-22
      usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
-     /nix/store/v75dyrp7vwdgx5w2fzwsy00lf94qpz0i-run-clang-tidy-22/bin/run-clang-tidy-22
+     /nix/store/f8m0p9ad40brp9ahy4i0h27kqjkya1j9-run-clang-tidy-22/bin/run-clang-tidy-22
 
 Rust toolchain:
   ✅ cargo
      cargo 1.97.1 (c980f4866 2026-06-30)
-     /nix/store/nci0zxxj2fiq0dlkpqzbnqfh27wz4sq4-cargo-1.97.1-aarch64-unknown-linux-gnu/bin/cargo
+     /nix/store/6hch2qrr86n2sa2m90lrpxrfxxwbkayl-cargo-1.97.1-aarch64-unknown-linux-gnu/bin/cargo
   ✅ cargo-audit
-     cargo-audit-audit 0.22.2
-     /nix/store/zldaj03mfz9f21yiby5yymq7v8vqygd7-cargo-audit-0.22.2/bin/cargo-audit
+     cargo-audit-audit 0.22.1
+     /nix/store/9rxbrn9aa2r1z96186s69pc7vzizyfch-cargo-audit-0.22.1/bin/cargo-audit
   ✅ cargo-llvm-cov
-     cargo-llvm-cov 0.9.0
-     /nix/store/iwpcfjah31fgn99ph32ajzz7i22j6al5-cargo-llvm-cov-0.9.0/bin/cargo-llvm-cov
+     cargo-llvm-cov 0.8.5
+     /nix/store/vwjsi159n89szrx4yh5pc3jlf2gp4fld-cargo-llvm-cov-0.8.5/bin/cargo-llvm-cov
   ✅ cargo-nextest
-     cargo-nextest 0.9.146
-     /nix/store/p5svqr8x1rr7b1i8595pr8qafsr7s6fm-cargo-nextest-0.9.146/bin/cargo-nextest
+     cargo-nextest 0.9.137
+     /nix/store/qb6bcg2fjvm3r9s9j98nmffmf9xwh45s-cargo-nextest-0.9.137/bin/cargo-nextest
   ✅ clippy-driver
      clippy 0.1.97 (8bab26f4f6 2026-07-14)
-     /nix/store/ny64zks16ms5d70jk1qsiwsk0fr33ipp-rust-minimal-1.97.1/bin/clippy-driver
+     /nix/store/a6p27cg6b8szfixfyvkssx6l0c345zw8-rust-minimal-1.97.1/bin/clippy-driver
   ✅ rust-analyzer
      rust-analyzer 1.97.1 (8bab26f 2026-07-14)
-     /nix/store/d9s5skhvi1qxj940mylwym2rjicnc2kq-rust-analyzer-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rust-analyzer
+     /nix/store/262830dlw2517lnagfx7i7agqgl4fmsd-rust-analyzer-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rust-analyzer
   ✅ rust-nightly
-     rustc 1.101.0-nightly (282215592 2026-10-04)
-     /nix/store/rbsf1gr6f9ikv2izlyh8im117w6hs7h5-rust-nightly/bin/rust-nightly
+     rustc 1.99.0-nightly (87e5904f5 2026-07-20)
+     /nix/store/c59pxk1yikdlf129qwyg4fplmxcrha0k-rust-nightly/bin/rust-nightly
   ✅ rustc
      rustc 1.97.1 (8bab26f4f 2026-07-14)
-     /nix/store/ny64zks16ms5d70jk1qsiwsk0fr33ipp-rust-minimal-1.97.1/bin/rustc
+     /nix/store/a6p27cg6b8szfixfyvkssx6l0c345zw8-rust-minimal-1.97.1/bin/rustc
   ✅ rustfmt
      rustfmt 1.9.0-stable (8bab26f4f6 2026-07-14)
-     /nix/store/dplvgjikmv8909rk0dkqr90ryjg7xn0j-rustfmt-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rustfmt
+     /nix/store/nd8g81wv1smnvdpy4whpcyv2siwjmaan-rustfmt-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rustfmt
 
 GCC toolchain:
   ✅ gcc
-     gcc (GCC) 15.3.0
-     /nix/store/g7z555pl99vnwif4jxa05nk1qdc33i1n-gcc-wrapper-15.3.0/bin/gcc
+     gcc (GCC) 15.2.0
+     /nix/store/rn6svg593xsmn8qcjzk8x9pa1i62c4kb-gcc-wrapper-15.2.0/bin/gcc
   ✅ gcc-15
-     gcc (GCC) 15.3.0
-     /nix/store/vbdsfjk3j1xy5z329sl2d8vp6mq6x09i-gcc-15/bin/gcc-15
+     gcc (GCC) 15.2.0
+     /nix/store/h489d1rmjisfbxh5kmsb0a7c35j8qsdf-gcc-15/bin/gcc-15
   ✅ g++
-     g++ (GCC) 15.3.0
-     /nix/store/g7z555pl99vnwif4jxa05nk1qdc33i1n-gcc-wrapper-15.3.0/bin/g++
+     g++ (GCC) 15.2.0
+     /nix/store/rn6svg593xsmn8qcjzk8x9pa1i62c4kb-gcc-wrapper-15.2.0/bin/g++
   ✅ g++-15
-     g++ (GCC) 15.3.0
-     /nix/store/9ghl998ry4cxlsg6hnq5rn2iipnlkccm-g++-15/bin/g++-15
+     g++ (GCC) 15.2.0
+     /nix/store/9ywmhz8bmzknrn3pn84g46z8hj3vrmw5-g++-15/bin/g++-15
   ✅ cpp
-     cpp (GCC) 15.3.0
-     /nix/store/g7z555pl99vnwif4jxa05nk1qdc33i1n-gcc-wrapper-15.3.0/bin/cpp
+     cpp (GCC) 15.2.0
+     /nix/store/rn6svg593xsmn8qcjzk8x9pa1i62c4kb-gcc-wrapper-15.2.0/bin/cpp
   ✅ cpp-15
-     cpp (GCC) 15.3.0
-     /nix/store/wj0mv2fv2lhglvpjzhscqpbigkvik6br-cpp-15/bin/cpp-15
+     cpp (GCC) 15.2.0
+     /nix/store/vmjilh1b830qz9yh0a1jj5ads0jxizdk-cpp-15/bin/cpp-15
   ✅ gcov
-     gcov (GCC) 15.3.0
-     /nix/store/mszfsj00qnv9ygqcqz3w02qzxxskhvlb-gcc-15.3.0/bin/gcov
+     gcov (GCC) 15.2.0
+     /nix/store/rmwf5hpi1y2m1wpnfvlxmrhksm4djk2j-gcc-15.2.0/bin/gcov
 
 Mold:
   ✅ mold
-     mold 2.42.1 (compatible with GNU ld)
-     /nix/store/gbq334xbibaz4gn184j7gs58m2spgwi7-mold-unwrapped-wrapper-2.42.1/bin/mold
+     mold 2.41.0 (compatible with GNU ld)
+     /nix/store/f5qh5a0bx1dslmnf5n5gx0s6aljbswq3-mold-unwrapped-wrapper-2.41.0/bin/mold
 
 Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
 

src/libxrpl/basics/CountedObject.cpp

@@ -1,39 +0,0 @@
-#include <xrpl/basics/CountedObject.h>
-
-#include <algorithm>
-
-namespace xrpl {
-
-CountedObjects&
-CountedObjects::getInstance() noexcept
-{
-    static CountedObjects kInstance;
-
-    return kInstance;
-}
-
-CountedObjects::CountedObjects() noexcept : count_(0), head_(nullptr)
-{
-}
-
-CountedObjects::List
-CountedObjects::getCounts(int minimumThreshold) const
-{
-    List counts;
-
-    // When other operations are concurrent, the count
-    // might be temporarily less than the actual count.
-    counts.reserve(count_.load());
-
-    for (auto* ctr = head_.load(); ctr != nullptr; ctr = ctr->getNext())
-    {
-        if (ctr->getCount() >= minimumThreshold)
-            counts.emplace_back(ctr->getName(), ctr->getCount());
-    }
-
-    std::ranges::sort(counts);
-
-    return counts;
-}
-
-}  // namespace xrpl

src/libxrpl/basics/StringUtilities.cpp

@@ -1,6 +1,5 @@
 #include <xrpl/basics/StringUtilities.h>
 
-#include <xrpl/basics/Blob.h>
 #include <xrpl/beast/core/LexicalCast.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 
@@ -20,7 +19,7 @@
 namespace xrpl {
 
 std::string
-sqlBlobLiteral(Blob const& blob)
+sqlBlobLiteral(Slice blob)
 {
     std::string j;
 

src/libxrpl/ledger/AcceptedLedgerTx.cpp

@@ -33,13 +33,13 @@ AcceptedLedgerTx::AcceptedLedgerTx(
 
     Serializer s;
     met->add(s);
-    rawMeta_ = std::move(s.modData());
+    rawMeta_ = s.takeData();
 
     json_ = json::ValueType::Object;
     json_[jss::transaction] = txn_->getJson(JsonOptions::Values::None);
 
     json_[jss::meta] = meta_.getJson(JsonOptions::Values::None);
-    json_[jss::raw_meta] = strHex(rawMeta_);
+    json_[jss::raw_meta] = strHex(makeSlice(rawMeta_));
 
     json_[jss::result] = transHuman(meta_.getResultTER());
 
@@ -74,7 +74,7 @@ std::string
 AcceptedLedgerTx::getEscMeta() const
 {
     XRPL_ASSERT(!rawMeta_.empty(), "xrpl::AcceptedLedgerTx::getEscMeta : metadata is set");
-    return sqlBlobLiteral(rawMeta_);
+    return sqlBlobLiteral(makeSlice(rawMeta_));
 }
 
 }  // namespace xrpl

src/libxrpl/ledger/BookDirs.cpp

@@ -80,10 +80,10 @@ BookDirs::const_iterator::operator++()
     XRPL_ASSERT(index_ != kZero, "xrpl::BookDirs::const_iterator::operator++ : nonzero index");
     if (!cdirNext(*view_, curKey_, sle_, entry_, index_))
     {
-        if (index_ == 0)
+        if (index_ == kZero)
             curKey_ = view_->succ(++curKey_, nextQuality_).value_or(kZero);
 
-        if (index_ != 0 || curKey_ == kZero)
+        if (index_ != kZero || curKey_ == kZero)
         {
             curKey_ = key_;
             entry_ = 0;

src/libxrpl/ledger/Ledger.cpp

@@ -262,7 +262,7 @@ Ledger::Ledger(Ledger const& prevLedger, NetClock::time_point closeTime)
 {
     header_.seq = prevLedger.header_.seq + 1;
     header_.parentCloseTime = prevLedger.header_.closeTime;
-    header_.hash = prevLedger.header().hash + UInt256(1);
+    header_.hash = prevLedger.header().hash.next();
     header_.drops = prevLedger.header().drops;
     header_.closeTimeResolution = prevLedger.header_.closeTimeResolution;
     header_.parentHash = prevLedger.header().hash;
@@ -363,17 +363,13 @@ Ledger::deserializeTx(SHAMapItem const& item)
 std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
 Ledger::deserializeTxPlusMeta(SHAMapItem const& item)
 {
-    std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>> result;
     SerialIter sit(item.slice());
-    {
-        SerialIter s(sit.getSlice(sit.getVLDataLength()));
-        result.first = std::make_shared<STTx const>(s);
-    }
-    {
-        SerialIter s(sit.getSlice(sit.getVLDataLength()));
-        result.second = std::make_shared<STObject const>(s, sfMetadata);
-    }
-    return result;
+
+    SerialIter txSit(sit.getVL());
+    SerialIter metaSit(sit.getVL());
+
+    return {
+        std::make_shared<STTx const>(txSit), std::make_shared<STObject const>(metaSit, sfMetadata)};
 }
 
 //------------------------------------------------------------------------------
@@ -533,9 +529,9 @@ Ledger::rawTxInsert(
     XRPL_ASSERT(metaData, "xrpl::Ledger::rawTxInsert : non-null metadata input");
 
     // low-level - just add to table
-    Serializer s(txn->getDataLength() + metaData->getDataLength() + 16);
-    s.addVL(txn->peekData());
-    s.addVL(metaData->peekData());
+    Serializer s(txn->size() + metaData->size() + 16);
+    s.addVL(txn->slice());
+    s.addVL(metaData->slice());
     if (!txMap_.addGiveItem(SHAMapNodeType::TnTransactionMd, makeShamapitem(key, s.slice())))
         logicError("duplicate_tx: " + to_string(key));
 }

src/libxrpl/ledger/helpers/AccountRootHelpers.cpp

@@ -506,7 +506,7 @@ pseudoAccountAddress(ReadView const& view, UInt256 const& pseudoOwnerKey)
         RipeshaHasher rsh;
         auto const hash = sha512Half(i, view.header().parentHash, pseudoOwnerKey);
         rsh(hash.data(), hash.size());
-        AccountID const ret = AccountID::fromRaw(static_cast<RipeshaHasher::result_type>(rsh));
+        AccountID const ret{static_cast<RipeshaHasher::result_type>(rsh)};
         if (!view.read(keylet::account(ret)))
             return ret;
     }

src/libxrpl/nodestore/DecodedBlob.cpp

@@ -1,7 +1,6 @@
 #include <xrpl/nodestore/detail/DecodedBlob.h>
 
 #include <xrpl/basics/Blob.h>
-#include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/nodestore/NodeObject.h>
@@ -12,8 +11,13 @@
 
 namespace xrpl::node_store {
 
-DecodedBlob::DecodedBlob(void const* key, void const* value, int valueBytes) : key_(key)
+DecodedBlob::DecodedBlob(std::optional<UInt256> key, void const* value, int valueBytes)
 {
+    if (!key)
+        return;
+
+    key_ = key.value();
+
     /*  Data format:
 
         Bytes
@@ -63,7 +67,7 @@ DecodedBlob::createObject()
     {
         Blob data(objectData_, objectData_ + dataBytes_);
 
-        object = NodeObject::createObject(objectType_, std::move(data), UInt256::fromVoid(key_));
+        object = NodeObject::createObject(objectType_, std::move(data), key_);
     }
 
     return object;

src/libxrpl/nodestore/backend/NuDBFactory.cpp

@@ -38,6 +38,7 @@
 #include <functional>
 #include <memory>
 #include <optional>
+#include <span>
 #include <sstream>
 #include <stdexcept>
 #include <string>
@@ -216,7 +217,7 @@ public:
             [&hash, pno, &status](void const* data, std::size_t size) {
                 nudb::detail::buffer bf;
                 auto const result = nodeobjectDecompress(data, size, bf);
-                DecodedBlob decoded(hash.data(), result.first, result.second);
+                DecodedBlob decoded(hash, result.first, result.second);
                 if (!decoded.wasOk())
                 {
                     status = Status::DataCorrupt;
@@ -240,7 +241,7 @@ public:
         nudb::error_code ec;
         nudb::detail::buffer bf;
         auto const result = nodeobjectCompress(e.getData(), e.getSize(), bf);
-        db.insert(e.getKey(), result.first, result.second, ec);
+        db.insert(e.getKey().data(), result.first, result.second, ec);
         if (ec && ec != nudb::error::key_exists)
             Throw<nudb::system_error>(ec);
     }
@@ -288,14 +289,25 @@ public:
             Throw<nudb::system_error>(ec);
         nudb::visit(
             dp,
-            [&](void const* key,
+            [&](void const* keyData,
                 std::size_t keyBytes,
                 void const* data,
                 std::size_t size,
                 nudb::error_code&) {
+                auto key = uint256::fromRaw(
+                    std::span{static_cast<unsigned char const*>(keyData), keyBytes});
+
+                if (!key) [[unlikely]]
+                {
+                    ec = make_error_code(nudb::error::invalid_key_size);
+                    return;
+                }
+
                 nudb::detail::buffer bf;
                 auto const result = nodeobjectDecompress(data, size, bf);
+
                 DecodedBlob decoded(key, result.first, result.second);
+
                 if (!decoded.wasOk())
                 {
                     ec = make_error_code(nudb::error::missing_value);

src/libxrpl/nodestore/backend/RocksDBFactory.cpp

@@ -38,6 +38,7 @@
 #include <format>
 #include <functional>
 #include <memory>
+#include <span>
 #include <stdexcept>
 #include <string>
 
@@ -111,6 +112,9 @@ public:
         if (!getIfExists(keyValues, Keys::kPath, name))
             Throw<std::runtime_error>("Missing path in RocksDBFactory backend");
 
+        if (keyBytes != uint256::size())
+            Throw<std::runtime_error>("Incorrect key size: expected 32 bytes");
+
         rocksdb::BlockBasedTableOptions tableOptions;
         options.env = env;
 
@@ -292,7 +296,7 @@ public:
 
         if (getStatus.ok())
         {
-            DecodedBlob decoded(hash.data(), string.data(), string.size());
+            DecodedBlob decoded(hash, string.data(), string.size());
 
             if (decoded.wasOk())
             {
@@ -317,8 +321,8 @@ public:
             }
             else
             {
-                status = static_cast<Status>(
-                    static_cast<int>(Status::CustomCode) + unsafeCast<int>(getStatus.code()));
+                status = checkedCast<Status>(
+                    safeCast<int>(Status::CustomCode) + safeCast<int>(getStatus.code()));
 
                 JLOG(journal.error()) << getStatus.ToString();
             }
@@ -347,7 +351,7 @@ public:
             EncodedBlob const encoded(e);
 
             wb.Put(
-                rocksdb::Slice(reinterpret_cast<char const*>(encoded.getKey()), keyBytes),
+                rocksdb::Slice(reinterpret_cast<char const*>(encoded.getKey().data()), keyBytes),
                 rocksdb::Slice(
                     reinterpret_cast<char const*>(encoded.getData()), encoded.getSize()));
         }
@@ -375,9 +379,12 @@ public:
 
         for (it->SeekToFirst(); it->Valid(); it->Next())
         {
-            if (it->key().size() == keyBytes)
+            if (it->key().size() == keyBytes && it->key().size() == uint256::size())
             {
-                DecodedBlob decoded(it->key().data(), it->value().data(), it->value().size());
+                DecodedBlob decoded(
+                    uint256::fromRaw(std::span{it->key().data(), it->key().size()}),
+                    it->value().data(),
+                    it->value().size());
 
                 if (decoded.wasOk())
                 {

src/libxrpl/protocol/AccountID.cpp

@@ -8,6 +8,8 @@
 #include <xrpl/protocol/digest.h>
 #include <xrpl/protocol/tokens.h>
 
+#include <algorithm>
+#include <array>
 #include <atomic>
 #include <cstdint>
 #include <cstring>
@@ -19,95 +21,143 @@
 
 namespace xrpl {
 
-namespace detail {
+namespace {
 
-/**
- * Caches the base58 representations of AccountIDs
+/** If true, we implement a cache for account ID lookups.
+
+    This is generally a good idea and can improve performance, especially
+    when serving client requests.
+
+    The cache may generate warnings under some sanitizers; if you want to
+    disable caching, set this variable to false.
  */
-class AccountIdCache
+constexpr bool cacheAccountIDs = true;
+
+/** Represents a cached entry for the given AccountID.
+
+    We keep the size and alignment of the structure at 64 bytes to
+    make sure it fits within a cache line and avoid false sharing.
+ */
+struct alignas(64) CachedAccountID
 {
-private:
-    struct CachedAccountID
-    {
-        AccountID id;
-        char encoding[40] = {0};
-    };
+    /** The sequence lock for the entry.
 
-    // The actual cache
-    std::vector<CachedAccountID> cache_;
+        An even value means that the data is stable, whereas an odd
+        value indicates the data is being actively modified.
 
-    // We use a hash function designed to resist algorithmic complexity attacks
-    HardenedHash<> hasher_;
+        We use a 32-bit value to ensure that the counter will never
+        return to an observed value during a read window.
+     */
+    std::atomic<std::uint32_t> seq{0};
 
-    // 64 spinlocks, packed into a single 64-bit value
-    std::atomic<std::uint64_t> locks_ = 0;
+    /** The account id. */
+    AccountID id{};
 
-public:
-    AccountIdCache(std::size_t count) : cache_(count)
-    {
-        // This is non-binding, but we try to avoid wasting memory that
-        // is caused by overallocation.
-        cache_.shrink_to_fit();
-    }
+    /** The length of the cached encoding.
 
-    std::string
-    toBase58(AccountID const& id)
-    {
-        auto const index = hasher_(id) % cache_.size();
+        This field disambiguates collisions between ACCOUNT_ZERO and
+        never-written-to slots, since they would otherwise share the
+        same encoded bits.
+     */
+    std::uint8_t len = 0;
 
-        PackedSpinlock sl(locks_, index % 64);
-
-        {
-            std::scoped_lock const lock(sl);
-
-            // The check against the first character of the encoding ensures
-            // that we don't mishandle the case of the all-zero account:
-            if (cache_[index].encoding[0] != 0 && cache_[index].id == id)
-                return cache_[index].encoding;
-        }
-
-        auto ret = encodeBase58Token(TokenType::AccountID, id.data(), id.size());
-
-        XRPL_ASSERT(ret.size() <= 38, "xrpl::detail::AccountIdCache : maximum result size");
-
-        {
-            std::scoped_lock const lock(sl);
-            cache_[index].id = id;
-            std::strcpy(cache_[index].encoding, ret.c_str());
-        }
-
-        return ret;
-    }
+    /** The actual string encoding. */
+    char encoding[39] = {0};
 };
 
-}  // namespace detail
+static_assert(sizeof(CachedAccountID) == 64 && alignof(CachedAccountID) == 64);
 
-static std::unique_ptr<detail::AccountIdCache> gAccountIdCache;
+// The actual cache to use: a simple, direct-mapped, best-effort construct.
+//
+// We do not use a hardened hash for this because an AccountID is already
+// just cryptographically generated (i.e. uniformly distributed) bits and
+// there is no amplification, since collisions do not carry an additional
+// cost.
+//
+// The size is a "nice" power of 2 because it makes the calculation of an
+// index easier.
+constinit std::array<CachedAccountID, 65536> gAccountIdCache{};
 
-void
-initAccountIdCache(std::size_t count)
-{
-    if (!gAccountIdCache && count != 0)
-        gAccountIdCache = std::make_unique<detail::AccountIdCache>(count);
-}
+}  // namespace
 
 std::string
 toBase58(AccountID const& v)
 {
-    if (gAccountIdCache)
-        return gAccountIdCache->toBase58(v);
+    // Since the input bits are generated by a cryptographically secure
+    // hash construct, we can just pick any subset of them, no muss, no
+    // fuss.
+    auto const index = [&v]() -> std::uint16_t {
+        auto const data = v.data();
 
-    return encodeBase58Token(TokenType::AccountID, v.data(), v.size());
+        return static_cast<std::uint16_t>(data[0]) | (static_cast<std::uint16_t>(data[1]) << 8);
+    }();
+
+    if constexpr (cacheAccountIDs)
+    {
+        auto& slot = gAccountIdCache[index];
+
+        // This is the optimistic, store-free read path: a collision with a
+        // concurrent writer will be detected because the seq recheck fails
+        // and we fall through to the slow path.
+        //
+        // These unsynchronized reads of the slot fields are, formally, data
+        // races and, technically speaking, result in undefined behavior and
+        // a tool like TSAN might flag them. These should not have an impact
+        // on the correctness of the returned data: the sequence lock checks
+        // ensure we discard any data that was in flux.
+        if (auto const s0 = slot.seq.load(std::memory_order::acquire);
+            (s0 & 1) == 0 && slot.len != 0 && slot.id == v)
+        {
+            char buf[38];
+            auto const len = std::min<std::size_t>(slot.len, sizeof(buf));
+            std::memcpy(buf, slot.encoding, len);
+
+            // Prevents the loads above from sinking below the recheck; the
+            // acquire on s0 constrains later operations, not earlier ones.
+            std::atomic_thread_fence(std::memory_order::acquire);
+
+            // Everything read from the slot — the gates above and the bytes in
+            // buf — precedes this recheck and is validated by it. No slot access
+            // may follow it.
+            if (slot.seq.load(std::memory_order::relaxed) == s0)
+                return std::string(buf, len);
+        }
+    }
+
+    auto ret = encodeBase58Token(TokenType::AccountID, v.data(), v.size());
+
+    XRPL_ASSERT(!ret.empty() && ret.size() <= 38, "xrpl::toBase58 : maximum result size");
+
+    if constexpr (cacheAccountIDs)
+    {
+        auto& slot = gAccountIdCache[index];
+
+        // The CAS to an odd value excludes other writers; if it fails, another
+        // thread wrote or is writing into this slot. That is not a problem: we
+        // just don't store our result into the cache this time.
+        if (auto s0 = slot.seq.load(std::memory_order::relaxed); (s0 & 1) == 0 &&
+            slot.seq.compare_exchange_strong(s0, s0 + 1, std::memory_order::acquire))
+        {
+            slot.id = v;
+            slot.len = static_cast<std::uint8_t>(ret.size());
+            std::copy_n(ret.data(), ret.size(), slot.encoding);
+
+            // The acquire on the CAS above keeps the writes from becoming visible
+            // before the seqlock transitions to an odd value, which means readers
+            // can detect an in-progress write. This release publishes them before
+            // the seqlock transitions to an even value.
+            slot.seq.store(s0 + 2, std::memory_order::release);
+        }
+    }
+
+    return ret;
 }
 
 template <>
 std::optional<AccountID>
 parseBase58(std::string const& s)
 {
-    auto const result = decodeBase58Token(s, TokenType::AccountID);
-    if (result.size() != AccountID::kBytes)
-        return std::nullopt;
-    return AccountID::fromRaw(result);
+    return AccountID::fromRaw(decodeBase58Token(s, TokenType::AccountID));
 }
 
 //------------------------------------------------------------------------------
@@ -148,25 +198,9 @@ parseBase58(std::string const& s)
 AccountID
 calcAccountID(PublicKey const& pk)
 {
-    static_assert(AccountID::kBytes == sizeof(RipeshaHasher::result_type));
-
     RipeshaHasher rsh;
     rsh(pk.data(), pk.size());
-    return AccountID::fromRaw(static_cast<RipeshaHasher::result_type>(rsh));
-}
-
-AccountID const&
-xrpAccount()
-{
-    static AccountID const kAccount(beast::kZero);
-    return kAccount;
-}
-
-AccountID const&
-noAccount()
-{
-    static AccountID const kAccount(1);
-    return kAccount;
+    return AccountID{static_cast<RipeshaHasher::result_type>(rsh)};
 }
 
 bool

src/libxrpl/protocol/Indexes.cpp

@@ -185,8 +185,9 @@ getBookBase(Book const& book)
 UInt256
 getQualityNext(UInt256 const& uBase)
 {
-    static constexpr UInt256 kNextQuality(
-        "0000000000000000000000000000000000000000000000010000000000000000");
+    static constexpr UInt256 kNextQuality{
+        "0000000000000000000000000000000000000000000000010000000000000000"};
+
     return uBase + kNextQuality;
 }
 
@@ -429,9 +430,9 @@ payChannel(AccountID const& src, AccountID const& dst, SeqProxy const& seq) noex
 Keylet
 nftokenPageMin(AccountID const& owner)
 {
-    std::array<std::uint8_t, 32> buf{};
-    std::memcpy(buf.data(), owner.data(), owner.size());
-    return {ltNFTOKEN_PAGE, UInt256::fromRaw(buf)};
+    std::array<std::uint8_t, UInt256::size()> buf{};
+    std::ranges::copy(owner, buf.begin());
+    return {ltNFTOKEN_PAGE, UInt256{buf}};
 }
 
 Keylet

src/libxrpl/protocol/LedgerHeader.cpp

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/chrono.h>
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/digest.h>
@@ -20,8 +21,8 @@ addRaw(LedgerHeader const& info, Serializer& s, bool includeHash)
     s.addBitString(info.accountHash);
     s.add32(info.parentCloseTime.time_since_epoch().count());
     s.add32(info.closeTime.time_since_epoch().count());
-    s.add8(info.closeTimeResolution.count());
-    s.add8(info.closeFlags);
+    s.add8(unsafeCast<std::uint8_t>(info.closeTimeResolution.count()));
+    s.add8(unsafeCast<std::uint8_t>(info.closeFlags));
 
     if (includeHash)
         s.addBitString(info.hash);
@@ -30,7 +31,7 @@ addRaw(LedgerHeader const& info, Serializer& s, bool includeHash)
 LedgerHeader
 deserializeHeader(Slice data, bool hasHash)
 {
-    SerialIter sit(data.data(), data.size());
+    SerialIter sit{data};
 
     LedgerHeader header;
 
@@ -50,12 +51,6 @@ deserializeHeader(Slice data, bool hasHash)
     return header;
 }
 
-LedgerHeader
-deserializePrefixedHeader(Slice data, bool hasHash)
-{
-    return deserializeHeader(data + 4, hasHash);
-}
-
 UInt256
 calculateLedgerHash(LedgerHeader const& info)
 {

src/libxrpl/protocol/PublicKey.cpp

@@ -295,11 +295,9 @@ verify(PublicKey const& publicKey, Slice const& m, Slice const& sig) noexcept
 NodeID
 calcNodeID(PublicKey const& pk)
 {
-    static_assert(NodeID::kBytes == sizeof(RipeshaHasher::result_type));
-
     RipeshaHasher h;
     h(pk.data(), pk.size());
-    return NodeID::fromRaw(static_cast<RipeshaHasher::result_type>(h));
+    return NodeID{static_cast<RipeshaHasher::result_type>(h)};
 }
 
 }  // namespace xrpl

src/libxrpl/protocol/STAccount.cpp

@@ -17,33 +17,29 @@
 
 namespace xrpl {
 
-STAccount::STAccount() : value_(beast::kZero), default_(true)
+STAccount::STAccount()
 {
 }
 
-STAccount::STAccount(SField const& n) : STBase(n), value_(beast::kZero), default_(true)
+STAccount::STAccount(SField const& n) : STBase(n)
 {
 }
 
-STAccount::STAccount(SField const& n, Buffer const& v) : STAccount(n)
+STAccount::STAccount(SerialIter& sit, SField const& name) : STAccount(name)
 {
-    if (v.empty())
-        return;  // Zero is a valid size for a defaulted STAccount.
+    if (auto const s = sit.getVL(); !s.empty())
+    {
+        // Throwing from constructors can be awkward, but this is only
+        // called from STVar::STVar (SerialIter&, SField const&) which
+        // also throws.
+        auto const id = AccountID::fromRaw(s);
 
-    // Is it safe to throw from this constructor?  Today (November 2015)
-    // the only place that calls this constructor is
-    //    STVar::STVar (SerialIter&, SField const&)
-    // which throws.  If STVar can throw in its constructor, then so can
-    // STAccount.
-    if (v.size() != UInt160::kBytes)
-        Throw<std::runtime_error>("Invalid STAccount size");
+        if (!id) [[unlikely]]
+            Throw<std::runtime_error>("Invalid STAccount size");
 
-    default_ = false;
-    memcpy(value_.begin(), v.data(), UInt160::kBytes);
-}
-
-STAccount::STAccount(SerialIter& sit, SField const& name) : STAccount(name, sit.getVLBuffer())
-{
+        value_ = *id;
+        default_ = false;
+    }
 }
 
 STAccount::STAccount(SField const& n, AccountID const& v) : STBase(n), value_(v), default_(false)
@@ -77,8 +73,13 @@ STAccount::add(Serializer& s) const
     // Preserve the serialization behavior of an STBlob:
     //  o If we are default (all zeros) serialize as an empty blob.
     //  o Otherwise serialize 160 bits.
-    int const size = isDefault() ? 0 : UInt160::kBytes;
-    s.addVL(value_.data(), size);
+    if (isDefault())
+    {
+        s.addVL(Slice{});
+        return;
+    }
+
+    s.addVL(Slice{value_.data(), value_.size()});
 }
 
 bool

src/libxrpl/protocol/STAmount.cpp

@@ -148,12 +148,12 @@ STAmount::STAmount(SerialIter& sit, SField const& name) : STBase(name)
     }
 
     Issue issue;
-    issue.currency = sit.get160();
+    issue.currency = Currency{sit.get160()};
 
     if (isXRP(issue.currency))
         Throw<std::runtime_error>("invalid native currency");
 
-    issue.account = sit.get160();
+    issue.account = AccountID{sit.get160()};
 
     if (isXRP(issue.account))
         Throw<std::runtime_error>("invalid native account");

src/libxrpl/protocol/STBlob.cpp

@@ -12,7 +12,7 @@
 
 namespace xrpl {
 
-STBlob::STBlob(SerialIter& st, SField const& name) : STBase(name), value_(st.getVLBuffer())
+STBlob::STBlob(SerialIter& st, SField const& name) : STBase(name), value_(st.getVL())
 {
 }
 
@@ -47,7 +47,7 @@ STBlob::add(Serializer& s) const
     XRPL_ASSERT(
         (getFName().fieldType == STI_VL) || (getFName().fieldType == STI_ACCOUNT),
         "xrpl::STBlob::add : valid field type");
-    s.addVL(value_.data(), value_.size());
+    s.addVL(Slice{value_.data(), value_.size()});
 }
 
 bool

src/libxrpl/protocol/STCurrency.cpp

@@ -19,16 +19,16 @@ STCurrency::STCurrency(SField const& name) : STBase{name}
 {
 }
 
-STCurrency::STCurrency(SerialIter& sit, SField const& name) : STBase{name}
-{
-    currency_ = sit.get160();
-}
-
 STCurrency::STCurrency(SField const& name, Currency const& currency)
     : STBase{name}, currency_{currency}
 {
 }
 
+STCurrency::STCurrency(SerialIter& sit, SField const& name)
+    : STCurrency{name, Currency{sit.get160()}}
+{
+}
+
 SerializedTypeID
 STCurrency::getSType() const
 {

src/libxrpl/protocol/STInteger.cpp

@@ -64,7 +64,8 @@ STUInt8::getJson(JsonOptions) const
             return token;
 
         // LCOV_EXCL_START
-        JLOG(debugLog().error()) << "Unknown result code in metadata: " << value_;
+        JLOG(debugLog().error()) << "Unknown result code in metadata: "
+                                 << safeCast<std::uint32_t>(value_);
         // LCOV_EXCL_STOP
     }
 
@@ -221,7 +222,7 @@ STUInt64::getJson(JsonOptions) const
 
 template <>
 STInteger<std::int32_t>::STInteger(SerialIter& sit, SField const& name)
-    : STInteger(name, sit.get32())
+    : STInteger(name, sit.geti32())
 {
 }
 

src/libxrpl/protocol/STIssue.cpp

@@ -28,48 +28,38 @@ STIssue::STIssue(SField const& name) : STBase{name}
 
 STIssue::STIssue(SerialIter& sit, SField const& name) : STBase{name}
 {
+    // Either the currency of an Issue or the issuer of an MPT; the
+    // following 160 bits disambiguate.
     auto const currencyOrAccount = sit.get160();
 
-    if (isXRP(Currency::fromRaw(currencyOrAccount)))
+    if (isXRP(Currency{currencyOrAccount}))
     {
         asset_ = xrpIssue();
+        return;
     }
-    // Check if MPT
-    else
+
+    // MPT is serialized as:
+    // - 160 bits MPT issuer account
+    // - 160 bits black hole account
+    // - 32 bits sequence
+    AccountID const account{sit.get160()};
+
+    // MPT
+    if (noAccount() == account)
     {
-        // MPT is serialized as:
-        // - 160 bits MPT issuer account
-        // - 160 bits black hole account
-        // - 32 bits sequence
-        AccountID const account = AccountID::fromRaw(sit.get160());
-        // MPT
-        if (noAccount() == account)
-        {
-            MPTID mptID;
-            std::uint32_t sequence = sit.get32();
-            // MPTID stores the sequence in canonical big-endian bytes. STIssue
-            // ledger bytes are the legacy LE-host encoding, so convert the
-            // native get32() value to LE bytes before copying into the MPTID.
-            sequence = boost::endian::native_to_little(sequence);
-            static_assert(MPTID::size() == sizeof(sequence) + sizeof(currencyOrAccount));
-            memcpy(mptID.data(), &sequence, sizeof(sequence));
-            memcpy(
-                mptID.data() + sizeof(sequence),
-                currencyOrAccount.data(),
-                sizeof(currencyOrAccount));
-            MPTIssue const issue{mptID};
-            asset_ = issue;
-        }
-        else
-        {
-            Issue issue;
-            issue.currency = currencyOrAccount;
-            issue.account = account;
-            if (!isConsistent(issue))
-                Throw<std::runtime_error>("invalid issue: currency and account native mismatch");
-            asset_ = issue;
-        }
+        // MPT: issuer (160), noAccount() (160), sequence (32). The sequence
+        // is stored in little-endian and get32() reads big-endian, so
+        // reverse it before building the canonical ID.
+        asset_ = MPTIssue{std::byteswap(sit.get32()), AccountID{currencyOrAccount}};
+        return;
     }
+
+    Issue const issue{Currency{currencyOrAccount}, account};
+
+    if (!isConsistent(issue))
+        Throw<std::runtime_error>("invalid issue: currency and account native mismatch");
+
+    asset_ = issue;
 }
 
 SerializedTypeID

src/libxrpl/protocol/STObject.cpp

@@ -1,13 +1,11 @@
 #include <xrpl/protocol/STObject.h>
 
-#include <xrpl/basics/Blob.h>
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/InnerObjectFormats.h>
@@ -28,6 +26,7 @@
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/detail/STVar.h>
+#include <xrpl/protocol/digest.h>
 
 #include <algorithm>
 #include <cstddef>
@@ -377,7 +376,7 @@ STObject::getHash(HashPrefix prefix) const
     Serializer s;
     s.add32(prefix);
     add(s, WhichFields::WithAllFields);
-    return s.getSHA512Half();
+    return sha512Half(s);
 }
 
 UInt256
@@ -386,7 +385,7 @@ STObject::getSigningHash(HashPrefix prefix) const
     Serializer s;
     s.add32(prefix);
     add(s, WhichFields::OmitSigningFields);
-    return s.getSHA512Half();
+    return sha512Half(s);
 }
 
 int

src/libxrpl/protocol/STPathSet.cpp

@@ -5,6 +5,7 @@
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
@@ -17,9 +18,13 @@
 #include <xrpl/protocol/jss.h>
 
 #include <algorithm>
+#include <concepts>
 #include <cstddef>
+#include <cstdint>
 #include <memory>
+#include <optional>
 #include <stdexcept>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
@@ -36,10 +41,10 @@ STPathElement::getHash(STPathElement const& element)
     //            important. We don't even really need to fully hash the whole
     //            base_uint here, as a few bytes would do for our use.
     //
-    // The note above is only true because the result of this function reaches
-    // nothing but STPathElement::operator==, where it is a fast-reject
-    // prefilter ahead of the field comparisons that decide the answer.  Do not
-    // use it to key a container.
+    // The note above is only true because the result of this function is only
+    // used by the STPathElement equality operator as a fast-reject prefilter,
+    // ahead of the field comparisons that then decide the answer. Do not use
+    // it to key a container.
 
     for (auto const x : element.getAccountID())
         hashAccount += (hashAccount * 257) ^ x;
@@ -106,12 +111,38 @@ STPathSet::operator=(STPathSet const& other)
 
 STPathSet::STPathSet(SerialIter& sit, SField const& name) : STBase(name)
 {
-    std::vector<STPathElement> path;
-    for (;;)
-    {
-        int const iType = sit.get8();
+    using enum STPathElement::Type;
 
-        if (iType == STPathElement::TypeNone || iType == STPathElement::TypeBoundary)
+    auto parsePathElementType = [](std::underlying_type_t<STPathElement::Type> byte) noexcept
+        -> std::optional<STPathElement::Type> {
+        if (byte == std::to_underlying(TypeBoundary))
+            return TypeBoundary;
+
+        constexpr auto knownBits = static_cast<std::underlying_type_t<STPathElement::Type>>(
+            std::to_underlying(TypeAccount) | std::to_underlying(TypeCurrency) |
+            std::to_underlying(TypeIssuer) | std::to_underlying(TypeMpt));
+
+        if ((byte & ~knownBits) != 0)
+            return std::nullopt;
+
+        return static_cast<STPathElement::Type>(byte);
+    };
+
+    std::vector<STPathElement> path;
+
+    std::optional<STPathElement::Type> type;
+
+    do
+    {
+        type = parsePathElementType(sit.get8());
+
+        if (!type)
+        {
+            JLOG(debugLog().error()) << "Bad path element in pathset";
+            Throw<std::runtime_error>("bad path element");
+        }
+
+        if (type == TypeNone || type == TypeBoundary)
         {
             if (path.empty())
             {
@@ -122,28 +153,11 @@ STPathSet::STPathSet(SerialIter& sit, SField const& name) : STBase(name)
             // Move rather than converting the vector to an STPath by copy.
             value_.emplace_back(std::move(path));
             path.clear();
-
-            if (iType == STPathElement::TypeNone)
-                return;
-        }
-        else if ((iType & ~STPathElement::TypeAll) != 0)
-        {
-            JLOG(debugLog().error()) << "Bad path element " << iType << " in pathset";
-            Throw<std::runtime_error>("bad path element");
         }
         else
         {
-            auto const hasAccount = (iType & STPathElement::TypeAccount) != 0u;
-            auto const hasCurrency = (iType & STPathElement::TypeCurrency) != 0u;
-            auto const hasIssuer = (iType & STPathElement::TypeIssuer) != 0u;
-            auto const hasMPT = (iType & STPathElement::TypeMpt) != 0u;
-
-            AccountID account;
-            PathAsset asset;
-            AccountID issuer;
-
-            if (hasAccount)
-                account = sit.get160();
+            bool const hasCurrency = ((*type & TypeCurrency) == TypeCurrency);
+            bool const hasMPT = ((*type & TypeMpt) == TypeMpt);
 
             if (hasCurrency && hasMPT)
             {
@@ -151,18 +165,26 @@ STPathSet::STPathSet(SerialIter& sit, SField const& name) : STBase(name)
                 Throw<std::runtime_error>("bad path element: MPT and Currency");
             }
 
+            AccountID account;
+            AccountID issuer;
+
+            if ((*type & TypeAccount) == TypeAccount)
+                account = sit.getBitString<AccountID>();
+
+            PathAsset asset;
+
             if (hasCurrency)
-                asset = Currency::fromRaw(sit.get160());
+                asset = sit.getBitString<Currency>();
 
             if (hasMPT)
-                asset = sit.get192();
+                asset = sit.getBitString<MPTID>();
 
-            if (hasIssuer)
-                issuer = sit.get160();
+            if ((*type & TypeIssuer) == TypeIssuer)
+                issuer = sit.getBitString<AccountID>();
 
             path.emplace_back(account, asset, issuer, hasCurrency || hasMPT);
         }
-    }
+    } while (type != TypeNone);
 }
 
 STBase*
@@ -216,24 +238,22 @@ STPath::getJson(JsonOptions) const
     for (auto const& it : path_)
     {
         json::Value elem(json::ValueType::Object);
-        auto const iType = it.getNodeType();
 
-        elem[jss::type] = iType;
+        elem[jss::type] = safeCast<std::uint32_t>(it.getNodeType());
 
-        if ((iType & STPathElement::TypeAccount) != 0u)
+        if (it.isType(STPathElement::TypeAccount))
             elem[jss::account] = to_string(it.getAccountID());
 
         XRPL_ASSERT(
-            ((iType & STPathElement::TypeCurrency) == 0u) ||
-                ((iType & STPathElement::TypeMpt) == 0u),
+            !(it.hasCurrency() && it.hasMPT()),
             "xrpl::STPath::getJson : not type Currency and MPT");
-        if ((iType & STPathElement::TypeCurrency) != 0u)
+        if (it.hasCurrency())
             elem[jss::currency] = to_string(it.getCurrency());
 
-        if ((iType & STPathElement::TypeMpt) != 0u)
+        if (it.hasMPT())
             elem[jss::mpt_issuance_id] = to_string(it.getMPTID());
 
-        if ((iType & STPathElement::TypeIssuer) != 0u)
+        if (it.hasIssuer())
             elem[jss::issuer] = to_string(it.getIssuerID());
 
         ret.append(elem);
@@ -265,34 +285,42 @@ STPathSet::add(Serializer& s) const
     XRPL_ASSERT(getFName().fieldType == STI_PATHSET, "xrpl::STPathSet::add : valid field type");
     bool first = true;
 
+    // Workaround, since `Serializer` does not accept strongly-typed enums
+    // yet. When support is added, the static_assert will trigger, and the
+    // lambda can be removed entirely.
+    auto const toByte = [](std::same_as<STPathElement::Type> auto t) noexcept {
+        static_assert(
+            !requires(Serializer& ser) { ser.add8(t); },
+            "Serializer::add8 now accepts STPathElement::Type directly; remove toByte.");
+        return std::to_underlying(t);
+    };
+
     for (auto const& spPath : value_)
     {
         if (!first)
-            s.add8(STPathElement::TypeBoundary);
+            s.add8(toByte(STPathElement::TypeBoundary));
 
         for (auto const& speElement : spPath)
         {
-            int const iType = speElement.getNodeType();
+            s.add8(toByte(speElement.getNodeType()));
 
-            s.add8(iType);
-
-            if ((iType & STPathElement::TypeAccount) != 0u)
+            if (speElement.isType(STPathElement::TypeAccount))
                 s.addBitString(speElement.getAccountID());
 
-            if ((iType & STPathElement::TypeMpt) != 0u)
+            if (speElement.hasMPT())
                 s.addBitString(speElement.getMPTID());
 
-            if ((iType & STPathElement::TypeCurrency) != 0u)
+            if (speElement.hasCurrency())
                 s.addBitString(speElement.getCurrency());
 
-            if ((iType & STPathElement::TypeIssuer) != 0u)
+            if (speElement.hasIssuer())
                 s.addBitString(speElement.getIssuerID());
         }
 
         first = false;
     }
 
-    s.add8(STPathElement::TypeNone);
+    s.add8(toByte(STPathElement::TypeNone));
 }
 
 }  // namespace xrpl

src/libxrpl/protocol/STTx.cpp

@@ -76,9 +76,7 @@ STTx::STTx(STObject&& object)
 
 STTx::STTx(SerialIter& sit) : STObject(sfTransaction)
 {
-    int const length = sit.getBytesLeft();
-
-    if ((length < kTxMinSizeBytes) || (length > kTxMaxSizeBytes))
+    if (auto const sz = sit.size(); (sz < kTxMinSizeBytes) || (sz > kTxMaxSizeBytes))
         Throw<std::runtime_error>("Transaction length invalid");
 
     if (set(sit))
@@ -172,7 +170,7 @@ getSigningData(STTx const& that, HashPrefix prefix)
     Serializer s;
     s.add32(prefix);
     that.addWithoutSigningFields(s);
-    return s.getData();
+    return s.takeData();
 }
 
 UInt256
@@ -363,8 +361,7 @@ STTx::getJson(JsonOptions options, bool binary) const
 
     if (binary)
     {
-        Serializer const s = STObject::getSerializer();
-        std::string const dataBin = strHex(s.peekData());
+        std::string const dataBin = strHex(getSerializer().slice());
 
         if (v1)
         {
@@ -399,22 +396,7 @@ STTx::getMetaSQLInsertReplaceHeader()
 std::string
 STTx::getMetaSQL(std::uint32_t inLedger, std::string const& escapedMetaData) const
 {
-    Serializer s;
-    add(s);
-    return getMetaSQL(s, inLedger, TxnSql::Validated, escapedMetaData);
-}
-
-// VFALCO This could be a free function elsewhere
-std::string
-STTx::getMetaSQL(
-    Serializer rawTxn,
-    std::uint32_t inLedger,
-    TxnSql status,
-    std::string const& escapedMetaData) const
-{
-    std::string rTxn = sqlBlobLiteral(rawTxn.peekData());
-
-    auto format = TxFormats::getInstance().findByType(txType_);
+    auto const format = TxFormats::getInstance().findByType(txType_);
     XRPL_ASSERT(format, "xrpl::STTx::getMetaSQL : non-null type format");
 
     return std::format(
@@ -424,8 +406,8 @@ STTx::getMetaSQL(
         toBase58(getAccountID(sfAccount)),
         getFieldU32(sfSequence),
         inLedger,
-        safeCast<char>(status),
-        rTxn,
+        safeCast<char>(TxnSql::Validated),
+        sqlBlobLiteral(getSerializer().slice()),
         escapedMetaData);
 }
 
@@ -694,7 +676,7 @@ isMemoOkay(STObject const& st, std::string& reason)
     memos.add(s);
 
     // FIXME move the memo limit into a config tunable
-    if (s.getDataLength() > 1024)
+    if (s.size() > 1024)
     {
         reason = "The memo exceeds the maximum allowed size.";
         return false;

src/libxrpl/protocol/STValidation.cpp

@@ -168,7 +168,7 @@ STValidation::getSerialized() const
 {
     Serializer s;
     add(s);
-    return s.peekData();
+    return s.takeData();
 }
 
 }  // namespace xrpl

src/libxrpl/protocol/STVector256.cpp

@@ -9,7 +9,9 @@
 #include <xrpl/protocol/Serializer.h>
 
 #include <cstddef>
+#include <cstdint>
 #include <format>
+#include <span>
 #include <stdexcept>
 #include <utility>
 
@@ -17,7 +19,7 @@ namespace xrpl {
 
 STVector256::STVector256(SerialIter& sit, SField const& name) : STBase(name)
 {
-    auto const slice = sit.getSlice(sit.getVLDataLength());
+    auto const slice = sit.getVL();
 
     if (slice.size() % UInt256::size() != 0)
     {
@@ -25,12 +27,12 @@ STVector256::STVector256(SerialIter& sit, SField const& name) : STBase(name)
             std::format("Bad serialization for STVector256: {}", slice.size()));
     }
 
-    auto const cnt = slice.size() / UInt256::size();
+    value_.reserve(slice.size() / UInt256::kBytes);
 
-    value_.reserve(cnt);
+    SerialIter inner{slice};
 
-    for (std::size_t i = 0; i != cnt; ++i)
-        value_.push_back(UInt256::fromRaw(slice.substr(i * UInt256::size(), UInt256::size())));
+    while (!inner.empty())
+        value_.push_back(inner.get256());
 }
 
 STBase*
@@ -62,7 +64,11 @@ STVector256::add(Serializer& s) const
 {
     XRPL_ASSERT(getFName().isBinary(), "xrpl::STVector256::add : field is binary");
     XRPL_ASSERT(getFName().fieldType == STI_VECTOR256, "xrpl::STVector256::add : valid field type");
-    s.addVL(value_.begin(), value_.end(), value_.size() * (256 / 8));
+
+    // Because uint256 has no padding and the container stores the values
+    // contiguously, they are already in wire layout, so we can serialize
+    // them in one go:
+    s.addVL(Slice{value_.data(), value_.size() * UInt256::size()});
 }
 
 bool

src/libxrpl/protocol/Seed.cpp

@@ -104,8 +104,9 @@ parseGenericSeed(std::string const& str, bool rfc1751)
         std::string key;
         if (RFC1751::getKeyFromEnglish(key, str) == 1)
         {
-            Blob const blob(key.rbegin(), key.rend());
-            return Seed{UInt128::fromRaw(blob)};
+            std::array<std::uint8_t, UInt128::size()> bytes{};
+            std::ranges::reverse_copy(key, bytes.begin());
+            return Seed{UInt128{bytes}};
         }
     }
 

src/libxrpl/protocol/Serializer.cpp

@@ -1,550 +0,0 @@
-#include <xrpl/protocol/Serializer.h>
-
-#include <xrpl/basics/Buffer.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/contract.h>
-#include <xrpl/basics/safe_cast.h>
-#include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/HashPrefix.h>
-#include <xrpl/protocol/digest.h>
-
-#include <boost/endian/conversion.hpp>
-
-#include <array>
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <format>
-#include <stdexcept>
-#include <type_traits>
-
-namespace xrpl {
-
-int
-Serializer::add16(std::uint16_t i)
-{
-    int const ret = data_.size();
-    data_.push_back(static_cast<unsigned char>(i >> 8));
-    data_.push_back(static_cast<unsigned char>(i & 0xff));
-    return ret;
-}
-
-int
-Serializer::add32(HashPrefix p)
-{
-    // This should never trigger; the size & type of a hash prefix are
-    // integral parts of the protocol and unlikely to ever change.
-    static_assert(std::is_same_v<std::uint32_t, std::underlying_type_t<decltype(p)>>);
-
-    return add32(safeCast<std::uint32_t>(p));
-}
-
-template <>
-int
-Serializer::addInteger(unsigned char i)
-{
-    return add8(i);
-}
-template <>
-int
-Serializer::addInteger(std::uint16_t i)
-{
-    return add16(i);
-}
-template <>
-int
-Serializer::addInteger(std::uint32_t i)
-{
-    return add32(i);
-}
-template <>
-int
-Serializer::addInteger(std::uint64_t i)
-{
-    return add64(i);
-}
-template <>
-int
-Serializer::addInteger(std::int32_t i)
-{
-    return add32(i);
-}
-
-int
-Serializer::addRaw(Blob const& vector)
-{
-    int const ret = data_.size();
-    data_.insert(data_.end(), vector.begin(), vector.end());
-    return ret;
-}
-
-int
-Serializer::addRaw(Slice slice)
-{
-    int const ret = data_.size();
-    data_.insert(data_.end(), slice.begin(), slice.end());
-    return ret;
-}
-
-int
-Serializer::addRaw(Serializer const& s)
-{
-    int const ret = data_.size();
-    data_.insert(data_.end(), s.begin(), s.end());
-    return ret;
-}
-
-int
-Serializer::addRaw(void const* ptr, int len)
-{
-    int const ret = data_.size();
-    data_.insert(data_.end(), static_cast<char const*>(ptr), static_cast<char const*>(ptr) + len);
-    return ret;
-}
-
-int
-Serializer::addFieldID(int type, int name)
-{
-    int const ret = data_.size();
-    XRPL_ASSERT(
-        (type > 0) && (type < 256) && (name > 0) && (name < 256),
-        "xrpl::Serializer::addFieldID : inputs inside range");
-
-    if (type < 16)
-    {
-        if (name < 16)
-        {
-            // common type, common name
-            data_.push_back(static_cast<unsigned char>((type << 4) | name));
-        }
-        else
-        {
-            // common type, uncommon name
-            data_.push_back(static_cast<unsigned char>(type << 4));
-            data_.push_back(static_cast<unsigned char>(name));
-        }
-    }
-    else if (name < 16)
-    {
-        // uncommon type, common name
-        data_.push_back(static_cast<unsigned char>(name));
-        data_.push_back(static_cast<unsigned char>(type));
-    }
-    else
-    {
-        // uncommon type, uncommon name
-        data_.push_back(static_cast<unsigned char>(0));
-        data_.push_back(static_cast<unsigned char>(type));
-        data_.push_back(static_cast<unsigned char>(name));
-    }
-
-    return ret;
-}
-
-int
-Serializer::add8(unsigned char byteValue)
-{
-    int const ret = data_.size();
-    data_.push_back(byteValue);
-    return ret;
-}
-
-bool
-Serializer::get8(int& byte, int offset) const
-{
-    if (offset >= data_.size())
-        return false;
-
-    byte = data_[offset];
-    return true;
-}
-
-bool
-Serializer::chop(int bytes)
-{
-    if (bytes > data_.size())
-        return false;
-
-    data_.resize(data_.size() - bytes);
-    return true;
-}
-
-UInt256
-Serializer::getSHA512Half() const
-{
-    return sha512Half(makeSlice(data_));
-}
-
-int
-Serializer::addVL(Blob const& vector)
-{
-    int const ret = addEncoded(vector.size());
-    addRaw(vector);
-    XRPL_ASSERT(
-        data_.size() == (ret + vector.size() + encodeLengthLength(vector.size())),
-        "xrpl::Serializer::addVL : size matches expected");
-    return ret;
-}
-
-int
-Serializer::addVL(Slice const& slice)
-{
-    int const ret = addEncoded(slice.size());
-    if (!slice.empty())
-        addRaw(slice.data(), slice.size());
-    return ret;
-}
-
-int
-Serializer::addVL(void const* ptr, int len)
-{
-    int const ret = addEncoded(len);
-
-    if (len != 0)
-        addRaw(ptr, len);
-
-    return ret;
-}
-
-int
-Serializer::addEncoded(int length)
-{
-    // Without this, a negative length would fall into the 1 byte case below and
-    // be cast to a first byte no header uses. A size too big for int arrives
-    // here negative as well, since callers pass sizes through this parameter.
-    if (length < kMinValueOfLengthFor1ByteHeader)
-        Throw<std::overflow_error>("addEncoded: length is negative or did not fit in an int");
-
-    std::array<std::byte, kMaxNumberOfBytesInHeader> bytes{};
-    int numBytes = 0;
-
-    if (length <= kMaxValueOfLengthFor1ByteHeader)
-    {
-        bytes[0] = static_cast<std::byte>(length);
-        numBytes = 1;
-    }
-    else if (length <= kMaxValueOfLengthFor2ByteHeader)
-    {
-        // Count from the smallest length a 2 byte header covers.
-        int const offset = length - kMinValueOfLengthFor2ByteHeader;
-        bytes[0] = static_cast<std::byte>(
-            kMinValueOfFirstByteFor2ByteHeader + (offset / kNumberOfValuesInOneByte));
-        bytes[1] = static_cast<std::byte>(offset % kNumberOfValuesInOneByte);
-        numBytes = 2;
-    }
-    else if (length <= kMaxValueOfLengthFor3ByteHeader)
-    {
-        int const offset = length - kMinValueOfLengthFor3ByteHeader;
-        bytes[0] = static_cast<std::byte>(
-            kMinValueOfFirstByteFor3ByteHeader + (offset / kNumberOfValuesInTwoBytes));
-        bytes[1] =
-            static_cast<std::byte>((offset / kNumberOfValuesInOneByte) % kNumberOfValuesInOneByte);
-        bytes[2] = static_cast<std::byte>(offset % kNumberOfValuesInOneByte);
-        numBytes = 3;
-    }
-    else
-    {
-        Throw<std::overflow_error>("addEncoded: length is too large to encode");
-    }
-
-    return addRaw(bytes.data(), numBytes);
-}
-
-int
-Serializer::encodeLengthLength(int length)
-{
-    if (length < kMinValueOfLengthFor1ByteHeader)
-    {
-        Throw<std::overflow_error>(
-            "encodeLengthLength: length is negative or did not fit in an int");
-    }
-
-    if (length <= kMaxValueOfLengthFor1ByteHeader)
-        return 1;
-
-    if (length <= kMaxValueOfLengthFor2ByteHeader)
-        return 2;
-
-    if (length <= kMaxValueOfLengthFor3ByteHeader)
-        return 3;
-
-    Throw<std::overflow_error>("encodeLengthLength: length is too large to encode");
-}
-
-int
-Serializer::decodeLengthLength(std::byte firstByte)
-{
-    int const firstByteValue = std::to_integer<int>(firstByte);
-
-    if (firstByteValue <= kMaxValueOfFirstByteFor1ByteHeader)
-        return 1;
-
-    if (firstByteValue <= kMaxValueOfFirstByteFor2ByteHeader)
-        return 2;
-
-    if (firstByteValue <= kMaxValueOfFirstByteFor3ByteHeader)
-        return 3;
-
-    Throw<std::overflow_error>("decodeLengthLength: first byte does not start any header");
-}
-
-int
-Serializer::decodeVLLength(std::byte firstByte)
-{
-    int const length = std::to_integer<int>(firstByte);
-
-    // A bigger value means a longer header, so it is not a length by itself.
-    if (length > kMaxValueOfLengthFor1ByteHeader)
-        Throw<std::overflow_error>("decodeVLLength 1 byte: first byte is not a length");
-
-    return length;
-}
-
-int
-Serializer::decodeVLLength(std::byte firstByte, std::byte secondByte)
-{
-    int const firstByteValue = std::to_integer<int>(firstByte);
-
-    if (firstByteValue < kMinValueOfFirstByteFor2ByteHeader)
-        Throw<std::overflow_error>("decodeVLLength 2 byte: first byte is below the range");
-
-    if (firstByteValue > kMaxValueOfFirstByteFor2ByteHeader)
-        Throw<std::overflow_error>("decodeVLLength 2 byte: first byte is above the range");
-
-    // Both bytes are bounded by their own type, and the first one is bounded to
-    // the 2 byte range above, so this cannot leave the range the header covers.
-    return kMinValueOfLengthFor2ByteHeader +
-        ((firstByteValue - kMinValueOfFirstByteFor2ByteHeader) * kNumberOfValuesInOneByte) +
-        std::to_integer<int>(secondByte);
-}
-
-int
-Serializer::decodeVLLength(std::byte firstByte, std::byte secondByte, std::byte thirdByte)
-{
-    int const firstByteValue = std::to_integer<int>(firstByte);
-
-    if (firstByteValue < kMinValueOfFirstByteFor3ByteHeader)
-        Throw<std::overflow_error>("decodeVLLength 3 byte: first byte is below the range");
-
-    if (firstByteValue > kMaxValueOfFirstByteFor3ByteHeader)
-        Throw<std::overflow_error>("decodeVLLength 3 byte: first byte is above the range");
-
-    int const length = kMinValueOfLengthFor3ByteHeader +
-        ((firstByteValue - kMinValueOfFirstByteFor3ByteHeader) * kNumberOfValuesInTwoBytes) +
-        (std::to_integer<int>(secondByte) * kNumberOfValuesInOneByte) +
-        std::to_integer<int>(thirdByte);
-
-    // A 3 byte header reaches further than kMaxValueOfLengthFor3ByteHeader, which
-    // is as far as the encoder goes. Refuse the rest, so every length accepted
-    // here is one that can be written back.
-    if (length > kMaxValueOfLengthFor3ByteHeader)
-        Throw<std::overflow_error>("decodeVLLength 3 byte: length is too large to re-encode");
-
-    return length;
-}
-
-//------------------------------------------------------------------------------
-
-SerialIter::SerialIter(void const* data, std::size_t size) noexcept
-    : p_(reinterpret_cast<std::uint8_t const*>(data)), remain_(size)
-{
-}
-
-void
-SerialIter::reset() noexcept
-{
-    p_ -= used_;
-    remain_ += used_;
-    used_ = 0;
-}
-
-void
-SerialIter::skip(int length)
-{
-    if (remain_ < length)
-        Throw<std::runtime_error>("invalid SerialIter skip");
-    p_ += length;
-    used_ += length;
-    remain_ -= length;
-}
-
-unsigned char
-SerialIter::get8()
-{
-    if (remain_ < 1)
-        Throw<std::runtime_error>("invalid SerialIter get8");
-    unsigned char const t = *p_;
-    ++p_;
-    ++used_;
-    --remain_;
-    return t;
-}
-
-std::uint16_t
-SerialIter::get16()
-{
-    if (remain_ < 2)
-        Throw<std::runtime_error>("invalid SerialIter get16");
-    auto t = p_;
-    p_ += 2;
-    used_ += 2;
-    remain_ -= 2;
-    return (std::uint64_t(t[0]) << 8) + std::uint64_t(t[1]);
-}
-
-std::uint32_t
-SerialIter::get32()
-{
-    if (remain_ < 4)
-        Throw<std::runtime_error>("invalid SerialIter get32");
-    auto t = p_;
-    p_ += 4;
-    used_ += 4;
-    remain_ -= 4;
-    return (std::uint64_t(t[0]) << 24) + (std::uint64_t(t[1]) << 16) + (std::uint64_t(t[2]) << 8) +
-        std::uint64_t(t[3]);
-}
-
-std::uint64_t
-SerialIter::get64()
-{
-    if (remain_ < 8)
-        Throw<std::runtime_error>("invalid SerialIter get64");
-    auto t = p_;
-    p_ += 8;
-    used_ += 8;
-    remain_ -= 8;
-    return (std::uint64_t(t[0]) << 56) + (std::uint64_t(t[1]) << 48) + (std::uint64_t(t[2]) << 40) +
-        (std::uint64_t(t[3]) << 32) + (std::uint64_t(t[4]) << 24) + (std::uint64_t(t[5]) << 16) +
-        (std::uint64_t(t[6]) << 8) + std::uint64_t(t[7]);
-}
-
-std::int32_t
-SerialIter::geti32()
-{
-    if (remain_ < 4)
-        Throw<std::runtime_error>("invalid SerialIter geti32");
-    auto t = p_;
-    p_ += 4;
-    used_ += 4;
-    remain_ -= 4;
-    return boost::endian::load_big_s32(t);
-}
-
-std::int64_t
-SerialIter::geti64()
-{
-    if (remain_ < 8)
-        Throw<std::runtime_error>("invalid SerialIter geti64");
-    auto t = p_;
-    p_ += 8;
-    used_ += 8;
-    remain_ -= 8;
-    return boost::endian::load_big_s64(t);
-}
-
-void
-SerialIter::getFieldID(int& type, int& name)
-{
-    type = get8();
-    name = type & 15;
-    type >>= 4;
-
-    if (type == 0)
-    {
-        // uncommon type
-        type = get8();
-        if (type < 16)
-            Throw<std::runtime_error>(std::format("gFID: uncommon type out of range {}", type));
-    }
-
-    if (name == 0)
-    {
-        // uncommon name
-        name = get8();
-        if (name < 16)
-            Throw<std::runtime_error>(std::format("gFID: uncommon name out of range {}", name));
-    }
-}
-
-// getRaw for blob or buffer
-template <class T>
-T
-SerialIter::getRawHelper(int size)
-{
-    static_assert(std::is_same_v<T, Blob> || std::is_same_v<T, Buffer>);
-    if (remain_ < size)
-        Throw<std::runtime_error>("invalid SerialIter getRaw");
-    T result(size);
-    if (size != 0)
-    {
-        // It's normally safe to call memcpy with size set to 0 (see the
-        // C99 standard 7.21.1/2). However, here this could mean that
-        // result.data would be null, which would trigger undefined behavior.
-        std::memcpy(result.data(), p_, size);
-        p_ += size;
-        used_ += size;
-        remain_ -= size;
-    }
-    return result;
-}
-
-// VFALCO DEPRECATED Returns a copy
-Blob
-SerialIter::getRaw(int size)
-{
-    return getRawHelper<Blob>(size);
-}
-
-int
-SerialIter::getVLDataLength()
-{
-    std::byte const firstByte{get8()};
-    int datLen = 0;
-    int const lenLen = Serializer::decodeLengthLength(firstByte);
-    if (lenLen == 1)
-    {
-        datLen = Serializer::decodeVLLength(firstByte);
-    }
-    else if (lenLen == 2)
-    {
-        std::byte const secondByte{get8()};
-        datLen = Serializer::decodeVLLength(firstByte, secondByte);
-    }
-    else
-    {
-        XRPL_ASSERT(lenLen == 3, "xrpl::SerialIter::getVLDataLength : lenLen is 3");
-        std::byte const secondByte{get8()};
-        std::byte const thirdByte{get8()};
-        datLen = Serializer::decodeVLLength(firstByte, secondByte, thirdByte);
-    }
-    return datLen;
-}
-
-Slice
-SerialIter::getSlice(std::size_t bytes)
-{
-    if (bytes > remain_)
-        Throw<std::runtime_error>("invalid SerialIter getSlice");
-    Slice const s(p_, bytes);
-    p_ += bytes;
-    used_ += bytes;
-    remain_ -= bytes;
-    return s;
-}
-
-// VFALCO DEPRECATED Returns a copy
-Blob
-SerialIter::getVL()
-{
-    return getRaw(getVLDataLength());
-}
-
-Buffer
-SerialIter::getVLBuffer()
-{
-    return getRawHelper<Buffer>(getVLDataLength());
-}
-
-}  // namespace xrpl

src/libxrpl/protocol/Sign.cpp

@@ -95,7 +95,7 @@ verify(STObject const& st, HashPrefix const& prefix, PublicKey const& pk, SF_VL
     Serializer ss;
     ss.add32(prefix);
     st.addWithoutSigningFields(ss);
-    return verify(pk, Slice(ss.data(), ss.size()), Slice(sig->data(), sig->size()));
+    return verify(pk, ss.slice(), *sig);
 }
 
 // Questions regarding buildMultiSigningData:

src/libxrpl/protocol/UintTypes.cpp

@@ -35,7 +35,7 @@ constexpr std::size_t kIsoCodeLength = 3;
 std::string
 to_string(Currency const& currency)
 {
-    if (currency == beast::kZero)
+    if (currency == xrpCurrency())
         return systemCurrencyCode();
 
     if (currency == noCurrency())
@@ -62,7 +62,7 @@ to_string(Currency const& currency)
 }
 
 bool
-toCurrency(Currency& currency, std::string const& code)
+toCurrency(Currency& currency, std::string_view code)
 {
     if (code.empty() || code == systemCurrencyCode())
     {
@@ -87,7 +87,7 @@ toCurrency(Currency& currency, std::string const& code)
 }
 
 Currency
-toCurrency(std::string const& code)
+toCurrency(std::string_view code)
 {
     Currency currency;
     if (!toCurrency(currency, code))
@@ -95,25 +95,4 @@ toCurrency(std::string const& code)
     return currency;
 }
 
-Currency const&
-xrpCurrency()
-{
-    static Currency const kCurrency(beast::kZero);
-    return kCurrency;
-}
-
-Currency const&
-noCurrency()
-{
-    static Currency const kCurrency(1);
-    return kCurrency;
-}
-
-Currency const&
-badCurrency()
-{
-    static Currency const kCurrency(0x5852500000000000);
-    return kCurrency;
-}
-
 }  // namespace xrpl

src/libxrpl/protocol/XChainAttestations.cpp

@@ -209,7 +209,7 @@ AttestationClaim::message(
     Serializer s;
     o.add(s);
 
-    return std::move(s.modData());
+    return s.takeData();
 }
 
 std::vector<std::uint8_t>
@@ -346,7 +346,7 @@ AttestationCreateAccount::message(
     Serializer s;
     o.add(s);
 
-    return std::move(s.modData());
+    return s.takeData();
 }
 
 std::vector<std::uint8_t>

src/libxrpl/server/Manifest.cpp

@@ -197,9 +197,7 @@ logMftAct(
 bool
 Manifest::verify() const
 {
-    STObject st(sfGeneric);
-    SerialIter sit(serialized.data(), serialized.size());
-    st.set(sit);
+    STObject const st(SerialIter{makeSlice(serialized)}, sfGeneric);
 
     // The manifest must either have a signing key or be revoked.  This check
     // prevents us from accessing an unseated signingKey in the next check.
@@ -217,9 +215,7 @@ Manifest::verify() const
 UInt256
 Manifest::hash() const
 {
-    STObject st(sfGeneric);
-    SerialIter sit(serialized.data(), serialized.size());
-    st.set(sit);
+    STObject const st(SerialIter{makeSlice(serialized)}, sfGeneric);
     return st.getHash(HashPrefix::Manifest);
 }
 
@@ -245,7 +241,7 @@ std::optional<Blob>
 Manifest::getSignature() const
 {
     STObject st(sfGeneric);
-    SerialIter sit(serialized.data(), serialized.size());
+    SerialIter sit(makeSlice(serialized));
     st.set(sit);
     if (!get(st, sfSignature))
         return std::nullopt;
@@ -256,7 +252,7 @@ Blob
 Manifest::getMasterSignature() const
 {
     STObject st(sfGeneric);
-    SerialIter sit(serialized.data(), serialized.size());
+    SerialIter sit(makeSlice(serialized));
     st.set(sit);
     return st.getFieldVL(sfMasterSignature);
 }

src/libxrpl/shamap/SHAMap.cpp

@@ -901,7 +901,7 @@ SHAMap::writeNode(NodeObjectType t, SHAMapTreeNodePtr node) const
 
     Serializer s;
     node->serializeWithPrefix(s);
-    f_.db().store(t, std::move(s.modData()), node->getHash().asUInt256(), ledgerSeq_);
+    f_.db().store(t, s.takeData(), node->getHash().asUInt256(), ledgerSeq_);
     return node;
 }
 

src/libxrpl/shamap/SHAMapInnerNode.cpp

@@ -135,7 +135,7 @@ SHAMapInnerNode::makeFullInner(Slice data, SHAMapHash const& hash, bool hashVali
 
     for (auto i = 0u; i < kBranchFactor; ++i)
     {
-        hashes[i].asUInt256() = si.getBitString<256>();
+        hashes[i].asUInt256() = si.get256();
 
         if (hashes[i].isNonZero())
             ret->isBranch_ |= (1u << i);
@@ -173,7 +173,7 @@ SHAMapInnerNode::makeCompressedInner(Slice data)
 
     while (!si.empty())
     {
-        auto const hash = si.getBitString<256>();
+        auto const hash = si.get256();
         auto const pos = si.get8();
 
         if (pos >= kBranchFactor)
@@ -231,7 +231,7 @@ SHAMapInnerNode::serializeForWire(Serializer& s) const
         auto hashes = hashesAndChildren_.getHashes();
         iterNonEmptyChildIndexes([&](auto branchNum, auto indexNum) {
             s.addBitString(hashes[indexNum].asUInt256());
-            s.add8(branchNum);
+            s.add8(checkedCast<std::uint8_t>(branchNum));
         });
         s.add8(kWireTypeCompressedInner);
     }

src/libxrpl/shamap/SHAMapNodeID.cpp

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/shamap/SHAMap.h>
@@ -10,6 +11,7 @@
 #include <cstddef>
 #include <format>
 #include <optional>
+#include <span>
 #include <stdexcept>
 #include <string>
 
@@ -86,8 +88,8 @@ SHAMapNodeID::getRawString() const
 {
     Serializer s(33);
     s.addBitString(id_);
-    s.add8(depth_);
-    return s.getString();
+    s.add8(checkedCast<std::uint8_t>(depth_));
+    return std::string(static_cast<char const*>(s.data()), s.size());
 }
 
 SHAMapNodeID
@@ -129,14 +131,15 @@ deserializeSHAMapNodeID(void const* data, std::size_t size)
 {
     std::optional<SHAMapNodeID> ret;
 
-    if (size == 33)
+    if (size == UInt256::size() + 1)
     {
-        unsigned int const depth = *(static_cast<unsigned char const*>(data) + 32);
-        if (depth <= SHAMap::kLeafDepth)
+        std::span const bytes{static_cast<unsigned char const*>(data), size};
+
+        if (unsigned int const depth = bytes[UInt256::size()]; depth <= SHAMap::kLeafDepth)
         {
             // Reject a serialized ID carrying bits below its own depth. Checked before
-            // constructing, since the constructor asserts that same property.
-            if (auto const id = UInt256::fromVoid(data); isPrefixOfAtDepth(id, depth, id))
+            // constructing the node, since the constructor asserts that same property.
+            if (UInt256 const id{bytes.first<UInt256::size()>()}; isPrefixOfAtDepth(id, depth, id))
                 ret.emplace(depth, id);
         }
     }

src/libxrpl/shamap/SHAMapSync.cpp

@@ -461,17 +461,18 @@ SHAMap::getNodeFat(
     std::stack<std::tuple<SHAMapTreeNode*, SHAMapNodeID, std::uint32_t>> stack;
     stack.emplace(node, nodeID, depth);
 
-    Serializer s(8192);
-
     while (!stack.empty())
     {
         std::tie(node, nodeID, depth) = stack.top();
         stack.pop();
 
         // Add this node to the reply
-        s.erase();
-        node->serializeForWire(s);
-        data.emplace_back(nodeID, node->isLeaf(), s.getData());
+
+        data.emplace_back(nodeID, node->isLeaf(), [&node]() {
+            Serializer s(1024);
+            node->serializeForWire(s);
+            return s.takeData();
+        }());
 
         if (node->isInner())
         {
@@ -499,9 +500,9 @@ SHAMap::getNodeFat(
                         else if (childNode->isInner() || fatLeaves)
                         {
                             // Just include this node
-                            s.erase();
+                            Serializer s(1024);
                             childNode->serializeForWire(s);
-                            data.emplace_back(childID, childNode->isLeaf(), s.getData());
+                            data.emplace_back(childID, childNode->isLeaf(), s.takeData());
                         }
                     }
                 }
@@ -554,8 +555,7 @@ SHAMap::addRootNode(
     {
         Serializer s;
         root_->serializeWithPrefix(s);
-        filter->gotNode(
-            false, root_->getHash(), ledgerSeq_, std::move(s.modData()), root_->getType());
+        filter->gotNode(false, root_->getHash(), ledgerSeq_, s.takeData(), root_->getType());
     }
 
     return SHAMapAddNode::useful();
@@ -646,8 +646,7 @@ SHAMap::addKnownNode(
         {
             Serializer s;
             treeNode->serializeWithPrefix(s);
-            filter->gotNode(
-                false, childHash, ledgerSeq_, std::move(s.modData()), treeNode->getType());
+            filter->gotNode(false, childHash, ledgerSeq_, s.takeData(), treeNode->getType());
         }
 
         return SHAMapAddNode::useful();
@@ -815,7 +814,7 @@ SHAMap::getProofPath(UInt256 const& key) const
     {
         Serializer s;
         stack.top().first->serializeForWire(s);
-        path.emplace_back(std::move(s.modData()));
+        path.emplace_back(s.takeData());
         stack.pop();
     }
 

src/libxrpl/shamap/SHAMapTreeNode.cpp

@@ -26,6 +26,29 @@
 
 namespace xrpl {
 
+namespace {
+
+// A leaf node is serialized as the item data followed by a 32-byte tag.
+// Returns {item, tag}. Throws if there isn't room for the tag.
+std::pair<Slice, UInt256>
+splitTag(Slice data, char const* nodeType)
+{
+    if (data.size() < kMinShaMapItemBytes + UInt256::kBytes)
+    {
+        Throw<std::runtime_error>(std::format(
+            "Short {} node: {} bytes (minimum {} required)",
+            nodeType,
+            data.size(),
+            (kMinShaMapItemBytes + UInt256::kBytes)));
+    }
+
+    auto const itemSize = data.size() - UInt256::kBytes;
+
+    return {data.substr(0, itemSize), SerialIter{data + itemSize}.get256()};
+}
+
+}  // namespace
+
 SHAMapTreeNodePtr
 SHAMapTreeNode::makeTransaction(Slice data, SHAMapHash const& hash, bool hashValid)
 {
@@ -46,80 +69,26 @@ SHAMapTreeNode::makeTransaction(Slice data, SHAMapHash const& hash, bool hashVal
 SHAMapTreeNodePtr
 SHAMapTreeNode::makeTransactionWithMeta(Slice data, SHAMapHash const& hash, bool hashValid)
 {
-    Serializer s(data.data(), data.size());
-
-    UInt256 tag;
-
-    if (s.size() < tag.kBytes)
-    {
-        Throw<std::runtime_error>(std::format(
-            "Short TXN+MD node: {} bytes (minimum {} required for tag)", s.size(), tag.kBytes));
-    }
-
-    // FIXME: improve this interface so that the above check isn't needed
-    if (!s.getBitString(tag, s.size() - tag.kBytes))
-    {
-        Throw<std::out_of_range>(std::format(
-            "Short TXN+MD node: failed to read tag at offset {}", s.size() - tag.kBytes));
-    }
-
-    s.chop(tag.kBytes);
-
-    if (s.size() < kMinShaMapItemBytes)
-    {
-        Throw<std::runtime_error>(std::format(
-            "Short TXN+MD node: {} bytes after tag removal (minimum {} required)",
-            s.size(),
-            kMinShaMapItemBytes));
-    }
-
-    auto item = makeShamapitem(tag, s.slice());
+    auto const [item, tag] = splitTag(data, "TXN+MD");
 
     if (hashValid)
-        return intr_ptr::makeShared<SHAMapTxPlusMetaLeafNode>(std::move(item), 0, hash);
+        return intr_ptr::makeShared<SHAMapTxPlusMetaLeafNode>(makeShamapitem(tag, item), 0, hash);
 
-    return intr_ptr::makeShared<SHAMapTxPlusMetaLeafNode>(std::move(item), 0);
+    return intr_ptr::makeShared<SHAMapTxPlusMetaLeafNode>(makeShamapitem(tag, item), 0);
 }
 
 SHAMapTreeNodePtr
 SHAMapTreeNode::makeAccountState(Slice data, SHAMapHash const& hash, bool hashValid)
 {
-    Serializer s(data.data(), data.size());
-
-    UInt256 tag;
-
-    if (s.size() < tag.kBytes)
-    {
-        Throw<std::runtime_error>(std::format(
-            "Short AS node: {} bytes (minimum {} required for tag)", s.size(), tag.kBytes));
-    }
-
-    // FIXME: improve this interface so that the above check isn't needed
-    if (!s.getBitString(tag, s.size() - tag.kBytes))
-    {
-        Throw<std::out_of_range>(
-            std::format("Short AS node: failed to read tag at offset {}", s.size() - tag.kBytes));
-    }
-
-    s.chop(tag.kBytes);
+    auto const [item, tag] = splitTag(data, "AS");
 
     if (tag.isZero())
         Throw<std::runtime_error>("Invalid AS node");
 
-    if (s.size() < kMinShaMapItemBytes)
-    {
-        Throw<std::runtime_error>(std::format(
-            "Short AS node: {} bytes after tag removal (minimum {} required)",
-            s.size(),
-            kMinShaMapItemBytes));
-    }
-
-    auto item = makeShamapitem(tag, s.slice());
-
     if (hashValid)
-        return intr_ptr::makeShared<SHAMapAccountStateLeafNode>(std::move(item), 0, hash);
+        return intr_ptr::makeShared<SHAMapAccountStateLeafNode>(makeShamapitem(tag, item), 0, hash);
 
-    return intr_ptr::makeShared<SHAMapAccountStateLeafNode>(std::move(item), 0);
+    return intr_ptr::makeShared<SHAMapAccountStateLeafNode>(makeShamapitem(tag, item), 0);
 }
 
 SHAMapTreeNodePtr
@@ -159,11 +128,7 @@ SHAMapTreeNode::makeFromPrefix(Slice rawNode, SHAMapHash const& hash)
     if (rawNode.size() < 4)
         Throw<std::runtime_error>("prefix: short node");
 
-    // FIXME: Use SerialIter::get32?
-    // Extract the prefix
-    auto const type = safeCast<HashPrefix>(
-        (safeCast<std::uint32_t>(rawNode[0]) << 24) + (safeCast<std::uint32_t>(rawNode[1]) << 16) +
-        (safeCast<std::uint32_t>(rawNode[2]) << 8) + (safeCast<std::uint32_t>(rawNode[3])));
+    auto const type = safeCast<HashPrefix>(SerialIter{rawNode}.get32());
 
     rawNode.removePrefix(4);
 

src/libxrpl/tx/ApplyContext.cpp

@@ -38,7 +38,7 @@ ApplyContext::ApplyContext(
     , parentBatchId_(parentBatchId)
 {
     XRPL_ASSERT(
-        parentBatchId.has_value() == ((flags_ & TapBatch) == TapBatch),
+        parentBatchId.has_value() == ((flags_ & ApplyFlags::Batch) == ApplyFlags::Batch),
         "Parent Batch ID should be set if batch apply flag is set");
     view_.emplace(&base_, flags_);
 }
@@ -53,13 +53,14 @@ std::optional<TxMeta>
 ApplyContext::apply(TER ter)
 {
     // NOLINTNEXTLINE(bugprone-unchecked-optional-access) view_ emplaced in constructor
-    return view_->apply(base_, tx, ter, parentBatchId_, (flags_ & TapDryRun) != 0u, journal);
+    return view_->apply(
+        base_, tx, ter, parentBatchId_, (flags_ & ApplyFlags::DryRun) != ApplyFlags::None, journal);
 }
 
 void
 ApplyContext::addOrderBook(Book const& book)
 {
-    if ((flags_ & TapDryRun) == TapNone)
+    if ((flags_ & ApplyFlags::DryRun) == ApplyFlags::None)
         registry.get().getOrderBookDB().addOrderBook(book);
 }
 

src/libxrpl/tx/Transactor.cpp

@@ -134,7 +134,7 @@ preflightCheckSigningKey(STObject const& sigObject, beast::Journal j)
 std::optional<NotTEC>
 preflightCheckSimulateKeys(ApplyFlags flags, STObject const& sigObject, beast::Journal j)
 {
-    if ((flags & TapDryRun) != 0u)  // simulation
+    if ((flags & ApplyFlags::DryRun) != ApplyFlags::None)  // simulation
     {
         std::optional<Slice> const signature = sigObject[~sfTxnSignature];
         if (signature && !signature->empty())
@@ -510,7 +510,8 @@ Transactor::minimumFee(
     Fees const& fees,
     ApplyFlags flags)
 {
-    return scaleFeeLoad(baseFee, registry.getFeeTrack(), fees, (flags & TapUnlimited) != 0u);
+    return scaleFeeLoad(
+        baseFee, registry.getFeeTrack(), fees, (flags & ApplyFlags::Unlimited) != ApplyFlags::None);
 }
 
 TER
@@ -521,7 +522,7 @@ Transactor::checkFee(PreclaimContext const& ctx, XRPAmount baseFee)
 
     auto const feePaid = ctx.tx[sfFee].xrp();
 
-    if ((ctx.flags & TapBatch) != 0u)
+    if ((ctx.flags & ApplyFlags::Batch) != ApplyFlags::None)
     {
         if (feePaid == beast::kZero)
             return tesSUCCESS;
@@ -951,7 +952,8 @@ Transactor::checkSign(
         return tesSUCCESS;
     }
 
-    if (((flags & TapDryRun) != 0u) && pkSigner.empty() && !sigObject.isFieldPresent(sfSigners))
+    if (((flags & ApplyFlags::DryRun) != ApplyFlags::None) && pkSigner.empty() &&
+        !sigObject.isFieldPresent(sfSigners))
     {
         // simulate: skip signature validation when neither SigningPubKey nor
         // Signers are provided
@@ -1122,7 +1124,7 @@ Transactor::checkMultiSign(
         }
 
         XRPL_ASSERT(
-            (flags & TapDryRun) || !spk.empty(),
+            (flags & ApplyFlags::DryRun) != ApplyFlags::None || !spk.empty(),
             "xrpl::Transactor::checkMultiSign : non-empty signer or "
             "simulation");
         AccountID const signingAcctIDFromPubKey =
@@ -1604,7 +1606,7 @@ Transactor::operator()()
         if (ctx_.size() > kOversizeMetaDataCap)
             result = tecOVERSIZE;
 
-        if (isTecClaim(result) && ((view().flags() & TapFailHard) != 0u))
+        if (isTecClaim(result) && ((view().flags() & ApplyFlags::FailHard) != ApplyFlags::None))
         {
             // If the TapFailHard flag is set, a tec result
             // must not do anything
@@ -1684,7 +1686,7 @@ Transactor::operator()()
     // Once we call apply, we will no longer be able to look at view()
     metadata = ctx_.apply(result);
 
-    if ((ctx_.flags() & TapDryRun) != 0u)
+    if ((ctx_.flags() & ApplyFlags::DryRun) != ApplyFlags::None)
         return logger(result, false, std::move(metadata));
 
     return logger(result, canApply, std::move(metadata));

src/libxrpl/tx/apply.cpp

@@ -215,7 +215,7 @@ applyBatchTransactions(
     auto applyOneTransaction = [&registry, &j, &parentBatchId, &batchView](STTx const& tx) {
         OpenView perTxBatchView(kBatchView, batchView);
 
-        auto const ret = apply(registry, perTxBatchView, parentBatchId, tx, TapBatch, j);
+        auto const ret = apply(registry, perTxBatchView, parentBatchId, tx, ApplyFlags::Batch, j);
         XRPL_ASSERT(
             ret.applied == (isTesSuccess(ret.ter) || isTecClaim(ret.ter)),
             "Inner transaction should not be applied");
@@ -274,7 +274,7 @@ applyTransaction(
 {
     // Returns false if the transaction has need not be retried.
     if (retryAssured)
-        flags = flags | TapRetry;
+        flags = flags | ApplyFlags::Retry;
 
     JLOG(j.debug()) << "TXN " << txn.getTransactionID() << (retryAssured ? "/retry" : "/final");
 

src/libxrpl/tx/applySteps.cpp

@@ -346,7 +346,8 @@ preflight(
     // builds; re-check the same invariant here so a release build can't
     // silently skip a proposed transaction's signature-presence checks
     // outside of a dry run.
-    if ((flags & TapProposal) != TapNone && (flags & TapDryRun) == TapNone)
+    if ((flags & ApplyFlags::Proposal) != ApplyFlags::None &&
+        (flags & ApplyFlags::DryRun) == ApplyFlags::None)
     {
         // LCOV_EXCL_START
         JLOG(j.fatal()) << "apply (preflight): TapProposal set without TapDryRun.";
@@ -377,7 +378,8 @@ preflight(
     PreflightContext const pfCtx(registry, tx, parentBatchId, rules, flags, j);
 
     // See the comment in the other preflight() overload above.
-    if ((flags & TapProposal) != TapNone && (flags & TapDryRun) == TapNone)
+    if ((flags & ApplyFlags::Proposal) != ApplyFlags::None &&
+        (flags & ApplyFlags::DryRun) == ApplyFlags::None)
     {
         // LCOV_EXCL_START
         JLOG(j.fatal()) << "apply (preflight): TapProposal set without TapDryRun.";

src/libxrpl/tx/invariants/MPTInvariant.cpp

@@ -89,24 +89,17 @@ ValidMPTIssuance::visitEntry(bool isDelete, SLE::ConstRef before, SLE::ConstRef
             if (fix320Enabled && after->isFieldPresent(sfReferenceHolding))
                 referenceHoldingSetOnCreate_ = true;
         }
-        else
+        else if (fix320Enabled)
         {
-            // lsfMPTLocked is the only issuance flag with a legal clear path
-            // (tfMPTUnlock); the rest are fixed at creation or set-once.
-            issuanceFlagsCleared_ |= before->getFlags() & ~after->getFlags() & ~lsfMPTLocked;
-
-            if (fix320Enabled)
+            // Modified issuance: detect any change to sfReferenceHolding.
+            bool const beforePresent = before->isFieldPresent(sfReferenceHolding);
+            bool const afterPresent = after->isFieldPresent(sfReferenceHolding);
+            if (beforePresent != afterPresent ||
+                (afterPresent &&
+                 before->getFieldH256(sfReferenceHolding) !=
+                     after->getFieldH256(sfReferenceHolding)))
             {
-                // Modified issuance: detect any change to sfReferenceHolding.
-                bool const beforePresent = before->isFieldPresent(sfReferenceHolding);
-                bool const afterPresent = after->isFieldPresent(sfReferenceHolding);
-                if (beforePresent != afterPresent ||
-                    (afterPresent &&
-                     before->getFieldH256(sfReferenceHolding) !=
-                         after->getFieldH256(sfReferenceHolding)))
-                {
-                    referenceHoldingMutated_ = true;
-                }
+                referenceHoldingMutated_ = true;
             }
         }
     }
@@ -206,16 +199,6 @@ ValidMPTIssuance::finalize(
             return false;
     }
 
-    // Post-fixCleanup3_5_0: no transaction may clear an issuance flag other
-    // than lsfMPTLocked, so downstream code can trust set-once flags such as
-    // lsfMPTCanTransfer.
-    if (rules.enabled(fixCleanup3_5_0) && issuanceFlagsCleared_ != 0)
-    {
-        JLOG(j.fatal()) << "Invariant failed: immutable MPTokenIssuance flag cleared: "
-                        << issuanceFlagsCleared_;
-        return false;
-    }
-
     // Deleting an MPToken with a non-zero MPTAmount is rejected.
     if (rules.enabled(fixCleanup3_5_0))
     {

src/libxrpl/tx/paths/BookStep.cpp

@@ -985,7 +985,7 @@ std::optional<std::variant<Quality, AMMOffer<TIn, TOut>>>
 BookStep<TIn, TOut, TDerived>::tip(ReadView const& view) const
 {
     // This can be simplified (and sped up) if directories are never empty.
-    Sandbox sb(&view, TapNone);
+    Sandbox sb(&view, ApplyFlags::None);
     BookTip bt(sb, book_);
     auto const lobQuality = bt.step(j_) ? std::optional<Quality>(bt.quality()) : std::nullopt;
     // Multi-path offer generates an offer with the quality