Make ApplyFlags a scoped enumeration

Convert ApplyFlags to a scoped enum, drop the now-redundant `Tap`
prefix from its enumerators and replace the hand-written bitwise
operators by opting in to enum_bitops.

No functional change.

.cspell.config.yaml

@@ -103,6 +103,7 @@ words:
   - dearmor
   - decryptor
   - dedented
+  - dedup
   - deleteme
   - demultiplexer
   - deserializaton
@@ -344,6 +345,7 @@ words:
   - unambiguity
   - unauthorizes
   - unauthorizing
+  - undeserializable
   - unergonomic
   - unfetched
   - unfindable

.github/scripts/levelization/results/ordering.txt

@@ -62,6 +62,7 @@ libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
+test.app > tests.libxrpl
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config

.github/workflows/cargo-audit.yml

@@ -8,6 +8,7 @@ on:
     branches:
       - "develop"
       - "release/*"
+      - "staging/*"
     paths:
       - "crates/**/Cargo.toml"
       - "crates/Cargo.lock"

.github/workflows/on-pr.yml

@@ -243,7 +243,7 @@ jobs:
       - should-run
       - build-test
     # Only run when committing to a PR that targets a release branch.
-    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
+    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
       remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}

.github/workflows/on-trigger.yml

@@ -1,14 +1,16 @@
 # This workflow runs all workflows to build and test the code on various Linux
 # flavors, as well as on MacOS and Windows, on a scheduled basis, on merge into
-# the 'develop' or 'release*' branches, or when requested manually. Upon pushes
-# to the develop branch it also uploads the libxrpl recipe to the Conan remote.
+# the 'develop', 'release/*' or 'staging/*' branches, or when requested
+# manually. Upon pushes to the develop branch, it also uploads the libxrpl
+# recipe to the Conan remote.
 name: Trigger
 
 on:
   push:
     branches:
       - "develop"
-      - "release*"
+      - "release/*"
+      - "staging/*"
     paths:
       # These paths are unique to `on-trigger.yml`.
       - ".github/workflows/on-trigger.yml"
@@ -62,9 +64,9 @@ on:
   workflow_dispatch:
 
 concurrency:
-  # When a PR is merged into the develop branch it will be assigned a unique
+  # When a PR is merged into the develop branch, it will be assigned a unique
   # group identifier, so execution will continue even if another PR is merged
-  # while it is still running. In all other cases the group identifier is shared
+  # while it is still running. In all other cases, the group identifier is shared
   # per branch, so that any in-progress runs are cancelled when a new commit is
   # pushed.
   group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
@@ -98,7 +100,7 @@ jobs:
       # However, we do not enable ccache for events targeting a release branch,
       # to protect against the rare case that the output produced by ccache is
       # not identical to a regular compilation.
-      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release') }}
+      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release/') }}
       os: ${{ matrix.os }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/pre-commit.yml

@@ -8,7 +8,8 @@ on:
   push:
     branches:
       - "develop"
-      - "release*"
+      - "release/*"
+      - "staging/*"
   workflow_dispatch:
 
 jobs:

.github/workflows/reusable-clang-tidy.yml

@@ -123,13 +123,19 @@ jobs:
 
       - name: Fix style
         if: ${{ steps.files_changed.outcome != 'success' }}
+        # pre-commit installs every hook's environment, even for hooks that match
+        # no files, and node-based hooks need libatomic, which this image lacks.
+        # Exit code 1 just means hooks modified files or found issues.
+        env:
+          SKIP: prettier,cspell
         run: |
-          pre-commit run --all-files || true
+          git add --update
+          pre-commit run || [ $? -eq 1 ]
 
       - name: Generate git diff
         if: ${{ steps.files_changed.outcome != 'success' }}
         run: |
-          git diff | tee "${DIFF_FILE}"
+          git diff HEAD | tee "${DIFF_FILE}"
 
       - name: Upload clang-tidy diff output
         if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}

AGENTS.md

@@ -4,18 +4,24 @@ This file provides guidance to AI coding agents (Claude Code, and other AGENTS.m
 
 ## Build
 
-For the build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`). Nix development shells are available in the repo (not required) — see [docs/build/nix.md](./docs/build/nix.md) for setup and variants.
+Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
+
+```bash
+nix develop
+```
+
+For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
 
 Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
 
 ## Testing
 
-The legacy unit tests under `src/test/` are a custom framework (derived from Beast, not Boost.Test/GTest/Catch) built into the `xrpld` binary; see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. The gtest suites under `src/tests/` build into the separate `xrpl_tests` and `xrpld_tests` binaries (run with `--gtest_filter=...`). Notes not covered there:
+Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
 
 - A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
-- `--unittest-arg=<string>` passes one string to every suite that runs; a suite reads it with `arg()` and interprets it itself. Only a few suites use it (e.g. `TheoreticalQuality`, the nodestore `import` test); for the rest it has no effect.
+- `--unittest-arg` does nothing — don't use it.
 - Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
-- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/` (see [src/test/AGENTS.md](./src/test/AGENTS.md) for conventions specific to that directory). `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
+- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
 
 ## Lint/Format
 
@@ -23,14 +29,14 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup
 
 ## Code Style
 
-New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages). New public functions/methods need a Doxygen-style comment.
-
-Comments should explain _why_, not _what_/_how_ — the code already shows that. Only describe what/how when the code itself would otherwise be confusing (a non-obvious workaround, a subtle invariant, a surprising constraint).
+New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
 
 ## Architecture
 
-See [ARCHITECTURE.md](./ARCHITECTURE.md) for the directory-by-directory map of the codebase.
+Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
 
-## Keeping docs current
-
-When you add or change a convention, or touch a subsystem that has its own `AGENTS.md`, `README.md`, or `ARCHITECTURE.md`, update that documentation in the same change rather than leaving it stale.
+- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
+- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
+- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
+- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
+- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

API-CHANGELOG.md

@@ -36,6 +36,8 @@ Version 3.5.0 is not yet released.
 - `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 - `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 - `account_currencies`, `account_nfts`, `account_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before an invalid or missing `account`. An invalid `limit` or `marker` is reported before `lgrNotFound` or `actNotFound`, and for `account_offers` also before `actMalformed`. A request with a single problem returns the same error as before. [#8561](https://github.com/XRPLF/rippled/pull/8561)
+- `deposit_authorized`: A `credentials` entry that is all zeros (for example `"0"` or 64 `0` characters) now returns a `badCredentials` error instead of looking up a credential that can never exist.
+- `account_info`, `account_lines`, `account_channels`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `account`, or `ident` for `account_info`. For `account_lines`, a `peer` that is not a string, or an invalid `limit` or `marker`, is reported before `lgrNotFound`, `actNotFound` or a malformed `account`, and an invalid `limit` or `marker` also before a malformed `peer`. For `account_channels`, a malformed `account` is reported before `lgrNotFound`, and an invalid `destination_account`, `limit` or `marker` before `lgrNotFound` or `actNotFound`. A request with a single problem returns the same error as before. [#8573](https://github.com/XRPLF/rippled/pull/8573)
 
 ### Bugfixes in 3.5.0
 

ARCHITECTURE.md

@@ -1,9 +0,0 @@
-# Architecture
-
-Paths below reflect the current layout; update this doc if modularization moves a subsystem to a different directory.
-
-- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths — see [src/libxrpl/tx/AGENTS.md](./src/libxrpl/tx/AGENTS.md) for amendment-gating conventions). `tx/transactors/` has one file per transaction type, grouped by subsystem: `payment/`, `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `proposal/`, `account/`, `system/`.
-- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
-- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
-- `src/tests/` — gtest unit tests, with `libxrpl/` and `xrpld/` subtrees, gradually replacing the `src/test` equivalents.
-- `crates/` — a Rust workspace (only built with `-Drust=ON`; today only `xrpl_tests` links it, so `-Dtests=ON` is needed to exercise it) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

BUILD.md

@@ -2,33 +2,12 @@
 | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
-## Minimum Requirements
+## Supported platforms
 
-For the hardware needed to run a node, see
-[System Requirements](https://xrpl.org/system-requirements.html).
-
-For the software needed to build xrpld, see the
-[environment setup guide](./docs/build/environment.md).
-
-## Operating Systems
-
-### Linux
-
-The Ubuntu Linux distribution has received the highest level of quality
-assurance, testing, and support. We also support Red Hat and use Debian
-internally.
-Our Linux CI tooling is distro-independent and uses a Nix-based environment, so it should be possible to build on other Linux distributions as well, although we have not tested them.
-
-### macOS
-
-Many `xrpld` engineers use macOS for development.
-The minimum supported version is macOS 15 (Sequoia).
-CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
-
-### Windows
-
-Windows is used by some engineers for development only, and is not recommended
-for production use.
+Building and testing are supported on Linux, macOS, and (best effort) Windows;
+see [Supported development platforms](./docs/build/environment.md#supported-development-platforms).
+Running `xrpld` is officially supported on Linux only;
+see [Requirements](./docs/install.md#requirements).
 
 ## Steps
 

CONTRIBUTING.md

@@ -332,7 +332,7 @@ This ensures that configuration changes don't introduce new warnings across the
 
 ### Installing clang-tidy
 
-See the [environment setup guide](./docs/build/environment.md#clang-tidy) for how to get clang-tidy.
+The [Nix development shell](./docs/build/nix.md) provides `clang-tidy` at the [tested version](./docs/build/environment.md#tested-compiler-versions).
 
 ### Running clang-tidy locally
 

cfg/xrpld-example.cfg

@@ -1360,6 +1360,39 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
+#   gas_limit = <gas>
+#
+#       The gas limit is the maximum amount of gas that can be
+#       consumed by a single transaction. The gas limit is used to prevent
+#       transactions from consuming too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_limit = 1000000      # 1 million gas
+#
+#   bytecode_size_limit = <bytes>
+#
+#       The bytecode size limit is the maximum size of a WASM extension in
+#       bytes. The size limit is used to prevent extensions from consuming
+#       too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           bytecode_size_limit = 100000      # 100 kb
+#
+#   gas_price = <micro-drops>
+#
+#       The gas price is the conversion between WASM gas and its price in drops.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings

cmake/XrplCore.cmake

@@ -297,7 +297,10 @@ if(xrpld)
         VALUE_TYPE "::json::Value"
         VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
         HANDLERS
+            account_channels
             account_currencies
+            account_info
+            account_lines
             account_nfts
             account_offers
             book_changes

conan.lock

@@ -3,7 +3,7 @@
     "requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.23#56e8946f5b3fb949a3732e1a51135ca2%1790977482.197086",
+        "xrpl-rpc-spec/0.1.25#2daa763e2d86ccc4ad0a0fa4d1983e9f%1791907455.579992",
         "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
         "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",

conanfile.py

@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
         "nudb/2.0.9",
         "openssl/3.6.3",
         "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.23",
+        "xrpl-rpc-spec/0.1.25",
         "zlib/1.3.2",
     ]
 

docs/build/environment.md

@@ -4,6 +4,18 @@ This document explains how to set one up.
 
 [BUILD.md]: ../../BUILD.md
 
+## Supported development platforms
+
+- **Linux**: the [Nix development shell](./nix.md),
+  which provides the same toolchain CI uses on any distribution.
+- **macOS** 15 (Sequoia) or newer: the [Nix development shell](./nix.md),
+  or the system [Apple Clang](#macos-apple-clang).
+  CI runs on macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
+- **Windows**: best effort, see [Windows](#windows).
+
+For the platforms supported for running `xrpld`,
+see [Requirements](../install.md#requirements).
+
 ## Tested compiler versions
 
 `xrpld` is built in the **C++23** dialect by default, so your toolchain has to
@@ -35,20 +47,16 @@ compiler building. Treat support for anything outside the table as best-effort.
 
 ## Required tools
 
-Besides a compiler, building `xrpld` requires:
-
-| Tool                                        | Minimum version |
-| ------------------------------------------- | --------------- |
-| [Git](https://git-scm.com/downloads)        | any recent      |
-| [Python](https://www.python.org/downloads/) | 3.11            |
-| [Conan](https://conan.io/downloads.html)    | 2.17            |
-| [CMake](https://cmake.org/download/)        | 3.16            |
+Besides a compiler, building `xrpld` requires
+[Git](https://git-scm.com/downloads),
+[Python](https://www.python.org/downloads/),
+[Conan](https://conan.io/downloads.html),
+and [CMake](https://cmake.org/download/).
+Building with `-Drust=ON` additionally requires a Rust toolchain,
+see [Rust](#rust).
 
 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
-(see below). On Windows they have to be installed manually.
-
-Building with `-Drust=ON` additionally requires a Rust toolchain, see
-[Rust](#rust). A default build does not, so it is not in the table above.
+at the versions CI uses, recorded in [`nix/check-tools/`](../../nix/check-tools).
 
 Once they are in place, verify that everything is installed and runnable with:
 
@@ -58,60 +66,19 @@ Once they are in place, verify that everything is installed and runnable with:
 
 ## Linux and macOS
 
-The **recommended way** to get a development environment on Linux and macOS is
-the Nix development shell. It provides the exact tooling used in CI — `git`,
-`python`, `conan`, `cmake`, `clang-tidy`, `clang-format`, and everything else —
-with a single command and without installing anything system-wide:
+Use the [Nix development shell](./nix.md):
+it provides the compiler and every tool CI uses,
+without installing anything system-wide.
 
-```bash
-nix --experimental-features 'nix-command flakes' develop
-```
+### macOS: Apple Clang
 
-On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
-Clang. If you instead opt to use your system-wide Apple Clang (via
-`nix develop .#apple-clang`), you need to manage its version yourself (see
-below).
-
-See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler and why we recommend Nix
-over a hand-maintained environment.
-
-### macOS: managing the Apple Clang version
-
-If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
-the compiler version is whatever your installed Xcode (or Command Line Tools)
-provides. The following command should return a version greater than or equal to
-the [tested one](#tested-compiler-versions):
-
-```bash
-clang --version
-```
-
-If you develop other applications using Xcode, you might be consistently
-updating to the newest version of Apple Clang, which will likely cause issues
-building xrpld. You may want to install and pin a specific version of Xcode:
-
-1. **Download Xcode**
-   - Visit [Apple Developer Downloads](https://developer.apple.com/download/more/)
-   - Sign in with your Apple Developer account
-   - Search for an Xcode version that includes the expected Apple Clang version
-   - Download the `.xip` file
-
-2. **Install and configure Xcode**
-
-   ```bash
-   # Extract the .xip file and rename for version management
-   # Example: Xcode_16.2.app
-
-   # Move to Applications directory
-   sudo mv Xcode_16.2.app /Applications/
-
-   # Set as default toolchain (persistent)
-   sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-
-   # Set as environment variable (temporary)
-   export DEVELOPER_DIR=/Applications/Xcode_16.2.app/Contents/Developer
-   ```
+You can also build with the system Apple Clang,
+installing the other [required tools](#required-tools) any way you like
+(or getting them from `nix develop .#apple-clang`).
+Its version is whatever your installed Xcode (or Command Line Tools) provides,
+so check that `clang --version` is at least the [tested one](#tested-compiler-versions).
+If several Xcode versions are installed,
+select one with `sudo xcode-select -s <path>` or the `DEVELOPER_DIR` environment variable.
 
 ## Windows
 
@@ -123,8 +90,7 @@ manually:
   "x64 Native Tools Command Prompt". CI configures CMake with the
   `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
-- Python, Conan, and CMake, at the versions listed in
-  [Required tools](#required-tools).
+- recent releases of Python, Conan, and CMake
 - a [Rust toolchain](https://rustup.rs) — only needed to build with
   `-Drust=ON`, see [Rust](#rust)
 
@@ -145,16 +111,5 @@ version.
 Everything else the Rust build needs on the CMake side comes from Conan along
 with the rest of the dependencies, so there is nothing further to install.
 
-## Clang-tidy
-
-`clang-tidy` is required to run static analysis checks locally (see
-[CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. The version this project uses is listed in
-[Tested compiler versions](#tested-compiler-versions).
-
-On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
-version out of the box — run it via `run-clang-tidy`. No separate installation
-is needed.
-
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [packages.nix]: ../../nix/packages.nix

docs/build/nix.md

@@ -9,9 +9,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
-- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
-- **Works on Linux and macOS**: Consistent experience across platforms
 
 ## Install Nix
 
@@ -27,13 +25,8 @@ From the root of the xrpld repository, enter the default development shell:
 nix --experimental-features 'nix-command flakes' develop
 ```
 
-This will:
-
-- Download and set up all required development tools (CMake, Ninja, Conan, etc.)
-- Configure the appropriate compiler for your platform:
-  - **Linux**: GCC (provided by Nix)
-  - **macOS**: Clang (provided by Nix)
-
+This downloads and sets up all required development tools (CMake, Ninja, Conan, etc.)
+and the compiler for your platform (see [Platform notes](#platform-notes)).
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.
 
 ### Platform notes

docs/install.md

@@ -10,6 +10,19 @@ and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
 where `yum` is a symlink to `dnf`.
 To build from source instead, see [BUILD.md](../BUILD.md).
 
+## Requirements
+
+Linux is the only operating system officially supported for running `xrpld`;
+macOS and Windows builds are for development only.
+
+Any x86-64 Linux distribution with APT or DNF and glibc 2.31 or newer should work
+(see [How libc is handled](../nix/docker/README.md#how-libc-is-handled)).
+CI tests the packages on Debian 11–13, Ubuntu 20.04–26.04,
+RHEL (UBI) 9–10, AlmaLinux 9–10, and Rocky Linux 9–10.
+
+For the hardware needed to run a node,
+see [System Requirements](https://xrpl.org/system-requirements.html).
+
 ## Release channels
 
 Packages are published to four channels:

include/xrpl/basics/Number.h

@@ -352,9 +352,9 @@ class Number final
     using rep = std::int64_t;
     using InternalRep = MantissaRange::rep;
 
-    bool negative_{false};
     InternalRep mantissa_{0};
     int exponent_{std::numeric_limits<int>::lowest()};
+    bool negative_{false};
 
 public:
     // The range for the exponent when normalized
@@ -650,8 +650,12 @@ private:
     shiftExponent(int exponentDelta) const;
 };
 
+// The number class currently has 3 tail padding bytes. If you are adding new
+// members, try to fit them there before expanding the size of the class.
+static_assert(sizeof(Number) == 16);
+
 constexpr Number::Number(bool negative, InternalRep mantissa, int exponent, Unchecked) noexcept
-    : negative_(negative), mantissa_{mantissa}, exponent_{exponent}
+    : mantissa_{mantissa}, exponent_{exponent}, negative_(negative)
 {
 }
 

include/xrpl/basics/enum_bitops.h

@@ -0,0 +1,200 @@
+#pragma once
+
+#include <concepts>
+#include <type_traits>
+#include <utility>
+
+namespace xrpl {
+
+/**
+ * Opt-in bitwise operators for scoped enumerations.
+ *
+ * Provides `&`, `|`, `^`, `~` and the corresponding compound assignment forms
+ * for any scoped enumeration with an unsigned underlying type that opts in by
+ * specializing @ref OptIn:
+ *
+ * @code
+ * namespace xrpl {
+ *
+ * enum class MyFlags : std::uint32_t { a = 1, b = 2, c = 4 };
+ *
+ * template <>
+ * struct enum_bitops::OptIn<MyFlags> : std::true_type {};
+ *
+ * }  // namespace xrpl
+ * @endcode
+ *
+ * The operators are constexpr and noexcept, and return the enumeration type.
+ *
+ * @par Where the specialization may be declared
+ *   In namespace xrpl, or at global scope with full qualification, and after
+ *   the enumeration is defined but before the operators are first used. This
+ *   cannot be done in a nested namespace or at class scope; for enumerations
+ *   nested in a class this means after the class definition.
+ *
+ * @par Where the operators are found
+ *   The operators are declared in namespace xrpl, so argument-dependent lookup
+ *   will find them only for enumerations declared in xrpl or nested in a class
+ *   declared directly in xrpl. Enumerations in a nested namespace will only be
+ *   found from code inside xrpl, and only if no enclosing scope declares an
+ *   operator of the same name; elsewhere they require using-declarations.
+ */
+namespace enum_bitops {
+
+/**
+ * Types that may be opted in to the bitwise operators.
+ *
+ * Satisfied by a scoped enumeration whose underlying type is an unsigned
+ * integer type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Eligible = std::is_scoped_enum_v<T> && std::unsigned_integral<std::underlying_type_t<T>>;
+
+/**
+ * Opt-in switch for the bitwise operators.
+ *
+ * The primary template derives from std::false_type. Specialize it to derive
+ * from std::true_type to enable the operators for an @ref Eligible enumeration.
+ *
+ * @tparam T The scoped enumeration to opt in.
+ */
+template <Eligible T>
+struct OptIn : std::false_type
+{
+};
+
+/**
+ * Enumerations for which the bitwise operators are enabled.
+ *
+ * Satisfied when @p T satisfies @ref Eligible and @ref OptIn has been
+ * specialized for it to derive from std::true_type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Candidate = Eligible<T> && OptIn<T>::value;
+
+}  // namespace enum_bitops
+
+// These are declared in xrpl, not in enum_bitops, so that argument-dependent
+// lookup finds them for enumerations whose associated namespace is xrpl.
+
+/**
+ * @name Bitwise operators for opted-in scoped enumerations
+ *
+ * Each operator applies the corresponding built-in operator to the
+ * underlying values and converts the result back to the enumeration type.
+ * Both operands must have the same enumeration type; there is no implicit
+ * conversion to or from the underlying type.
+ */
+/** @{ */
+
+/**
+ * Bitwise AND.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in both @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator&(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) & std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in @p lhs, in @p rhs, or in both.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator|(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) | std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise exclusive OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in exactly one of @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator^(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) ^ std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise complement.
+ *
+ * The result has every bit of the underlying type that is clear in
+ * @p val, including bits that no enumerator names. It is intended for
+ * clearing flags, as in `flags & ~flag`.
+ *
+ * @param val The operand.
+ * @return The complement of @p val.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator~(T val) noexcept
+{
+    return static_cast<T>(~std::to_underlying(val));
+}
+
+/**
+ * Bitwise AND assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator&=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs & rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator|=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs | rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise exclusive OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator^=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs ^ rhs;
+    return lhs;
+}
+
+/** @} */
+
+}  // namespace xrpl

include/xrpl/config/Constants.h

@@ -94,6 +94,7 @@ struct Keys
     static constexpr auto kBbtOptions = "bbt_options";
     static constexpr auto kBgThreads = "bg_threads";
     static constexpr auto kBlockSize = "block_size";
+    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
     static constexpr auto kCacheAge = "cache_age";
     static constexpr auto kCacheMb = "cache_mb";
     static constexpr auto kCacheSize = "cache_size";
@@ -108,6 +109,8 @@ struct Keys
     static constexpr auto kFileSizeMult = "file_size_mult";
     static constexpr auto kFilterBits = "filter_bits";
     static constexpr auto kFilterFull = "filter_full";
+    static constexpr auto kGasLimit = "gas_limit";
+    static constexpr auto kGasPrice = "gas_price";
     static constexpr auto kHardSet = "hard_set";
     static constexpr auto kHighThreads = "high_threads";
     static constexpr auto kHoldTime = "hold_time";

include/xrpl/consensus/AGENTS.md

@@ -1,3 +0,0 @@
-# AGENTS.md — consensus
-
-See [README.md](./README.md) for a short pointer, and [docs/consensus.md](../../../docs/consensus.md) for the full consensus design.

include/xrpl/consensus/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

include/xrpl/ledger/ApplyView.h

@@ -1,7 +1,7 @@
 #pragma once
 
 #include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/safe_cast.h>
+#include <xrpl/basics/enum_bitops.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/ReadView.h>
@@ -22,80 +22,39 @@
 
 namespace xrpl {
 
-// Bitwise flag enum with existing operator overloads
-// NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-enum ApplyFlags : std::uint32_t {
-    TapNone = 0x00,
+enum class ApplyFlags : std::uint32_t {
+    None = 0x00,
 
     // This is a local transaction with the
     // fail_hard flag set.
-    TapFailHard = 0x10,
+    FailHard = 0x10,
 
     // This is not the transaction's last pass
     // Transaction can be retried, soft failures allowed
-    TapRetry = 0x20,
+    Retry = 0x20,
 
     // Transaction came from a privileged source
-    TapUnlimited = 0x400,
+    Unlimited = 0x400,
 
     // Transaction is executing as part of a batch
-    TapBatch = 0x800,
+    Batch = 0x800,
 
     // Transaction shouldn't be applied
     // Signatures shouldn't be checked
-    TapDryRun = 0x1000,
+    DryRun = 0x1000,
 
     // Transaction is being preflighted as the payload of a
     // TransactionProposalCreate. Its signatures are collected on-ledger
     // afterward, so signature-presence checks (e.g. Batch signer matching)
     // are skipped at proposal-creation time (On-Chain Cosigner spec
     // §5.3.1.2).
-    TapProposal = 0x2000,
+    Proposal = 0x2000,
 };
 
-constexpr ApplyFlags
-operator|(ApplyFlags const& lhs, ApplyFlags const& rhs)
+template <>
+struct enum_bitops::OptIn<ApplyFlags> : std::true_type
 {
-    return safeCast<ApplyFlags>(
-        safeCast<std::underlying_type_t<ApplyFlags>>(lhs) |
-        safeCast<std::underlying_type_t<ApplyFlags>>(rhs));
-}
-
-static_assert((TapFailHard | TapRetry) == safeCast<ApplyFlags>(0x30u), "ApplyFlags operator |");
-static_assert((TapRetry | TapFailHard) == safeCast<ApplyFlags>(0x30u), "ApplyFlags operator |");
-
-constexpr ApplyFlags
-operator&(ApplyFlags const& lhs, ApplyFlags const& rhs)
-{
-    return safeCast<ApplyFlags>(
-        safeCast<std::underlying_type_t<ApplyFlags>>(lhs) &
-        safeCast<std::underlying_type_t<ApplyFlags>>(rhs));
-}
-
-static_assert((TapFailHard & TapRetry) == TapNone, "ApplyFlags operator &");
-static_assert((TapRetry & TapFailHard) == TapNone, "ApplyFlags operator &");
-
-constexpr ApplyFlags
-operator~(ApplyFlags const& flags)
-{
-    return safeCast<ApplyFlags>(~safeCast<std::underlying_type_t<ApplyFlags>>(flags));
-}
-
-static_assert(~TapRetry == safeCast<ApplyFlags>(0xFFFFFFDFu), "ApplyFlags operator ~");
-
-inline ApplyFlags
-operator|=(ApplyFlags& lhs, ApplyFlags const& rhs)
-{
-    lhs = lhs | rhs;
-    return lhs;
-}
-
-inline ApplyFlags
-operator&=(ApplyFlags& lhs, ApplyFlags const& rhs)
-{
-    lhs = lhs & rhs;
-    return lhs;
-}
+};
 
 //------------------------------------------------------------------------------
 

include/xrpl/ledger/Ledger.h

@@ -257,13 +257,42 @@ public:
         header_.validated = true;
     }
 
-    void
+    /**
+     * Mark this ledger as accepted and attempt to make it immutable.
+     *
+     * The close-time fields are recorded first, since the ledger hash covers
+     * them.
+     *
+     * @param closeTime The consensus-agreed close time.
+     * @param closeResolution The close time resolution.
+     * @param correctCloseTime Whether consensus agreed on the close time. If
+     *        false, kSLcfNoConsensusTime is recorded in closeFlags instead.
+     * @return What setImmutable() returned.
+     */
+    [[nodiscard]] bool
     setAccepted(
         NetClock::time_point closeTime,
         NetClock::duration closeResolution,
         bool correctCloseTime);
 
-    void
+    /**
+     * Mark this ledger as immutable, so it can no longer be modified.
+     *
+     * A ledger built or loaded locally cannot have an invalid map, since only
+     * a map syncing against hashes from outside can be proven impossible (see
+     * SHAMap::addKnownNode), so a caller on such a path may treat a false
+     * return as a broken internal invariant. A caller assembling a ledger from
+     * peer data may not: for it, false is an outcome a peer can produce.
+     *
+     * @param rehash Whether to recompute the ledger hash from the header
+     *        fields. The transaction and account hashes are recomputed from the
+     *        maps too, but only the first time.
+     * @return false if either map is Invalid, leaving the immutable flag as it
+     *         was and the header untouched. A map invalidated partway through can
+     *         still leave the other one immutable, so a false return means the
+     *         ledger must be discarded rather than retried.
+     */
+    [[nodiscard]] bool
     setImmutable(bool rehash = true);
 
     bool
@@ -272,23 +301,28 @@ public:
         return immutable_;
     }
 
-    /*  Mark this ledger as "should be full".
+    /**
+     * @return Whether both maps can still be the maps the header names. See
+     *         SHAMap::isValid().
+     */
+    [[nodiscard]] bool
+    mapsValid() const
+    {
+        return txMap_.isValid() && stateMap_.isValid();
+    }
 
-        "Full" is metadata property of the ledger, it indicates
-        that the local server wants all the corresponding nodes
-        in durable storage.
-
-        This is marked `const` because it reflects metadata
-        and not data that is in common with other nodes on the
-        network.
-    */
+    /**
+     * Mark this ledger as "should be full", indicating that the local server
+     * wants all the corresponding nodes in durable storage.
+     *
+     * Const because it reflects metadata, not data this ledger shares with
+     * other nodes on the network.
+     */
     void
     setFull() const
     {
-        txMap_.setFull();
-        txMap_.setLedgerSeq(header_.seq);
-        stateMap_.setFull();
-        stateMap_.setLedgerSeq(header_.seq);
+        txMap_.setFull(header_.seq);
+        stateMap_.setFull(header_.seq);
     }
 
     void
@@ -418,6 +452,22 @@ private:
     static std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
     deserializeTxPlusMeta(SHAMapItem const& item);
 
+    /**
+     * Make both maps immutable.
+     *
+     * Each map is settled on its own, so neither is left mid-sync because the
+     * other refused.
+     *
+     * @return Whether both maps are immutable.
+     */
+    [[nodiscard]] bool
+    setMapsImmutable()
+    {
+        bool const txImmutable = txMap_.setImmutable();
+        bool const stateImmutable = stateMap_.setImmutable();
+        return txImmutable && stateImmutable;
+    }
+
     bool immutable_;
 
     // A SHAMap containing the transactions associated with this ledger.

include/xrpl/ledger/helpers/EscrowHelpers.h

@@ -14,6 +14,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
@@ -27,6 +28,8 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 
+#include <cstdint>
+
 namespace xrpl {
 
 /**
@@ -560,4 +563,54 @@ escrowUnlockApplyHelper<MPTIssue>(
         journal);
 }
 
+/**
+ * Smart escrow kill switches, driven by the voted FeeSettings.
+ *
+ * Zeroing `bytecodeSizeLimit` stops new uploads while leaving existing escrows
+ * finishable without forcing holders to wait for `CancelAfter`.
+ * Zeroing `gasLimit` stops both.
+ */
+/** @{ */
+inline bool
+isBytecodeUploadDisabled(Fees const& fees)
+{
+    return fees.bytecodeSizeLimit == 0 || fees.gasLimit == 0;
+}
+
+inline bool
+isBytecodeExecutionDisabled(Fees const& fees)
+{
+    return fees.gasLimit == 0;
+}
+/** @} */
+
+/**
+ * Owner count an escrow costs.
+ *
+ *  An escrow costs one increment per started 500 bytes of bytecode, and one
+ *  increment if it carries no bytecode.
+ */
+template <class T>
+int32_t
+calculateAdditionalReserve(T const& finishFunction)
+{
+    static auto constexpr kBytecodeReserveIncrement = 500;
+
+    if (!finishFunction)
+        return 1;
+
+    auto const size = finishFunction->size();
+    if (size == 0)
+    {
+        // LCOV_EXCL_START
+        // Empty Bytecode is refused at create, so no escrow carries it. Ceiling
+        // division would answer 0, which would subtract less than the create added.
+        UNREACHABLE("xrpl::calculateAdditionalReserve : empty Bytecode");
+        return 1;
+        // LCOV_EXCL_STOP
+    }
+
+    return static_cast<int32_t>((size + kBytecodeReserveIncrement - 1) / kBytecodeReserveIncrement);
+}
+
 }  // namespace xrpl

include/xrpl/ledger/helpers/LendingHelpers.h

@@ -330,14 +330,6 @@ adjustImpreciseNumber(
         value = 0;
 }
 
-inline int
-getAssetsTotalScale(SLE::ConstRef vaultSle)
-{
-    if (!vaultSle)
-        return Number::kMinExponent - 1;  // LCOV_EXCL_LINE
-    return scale(vaultSle->at(sfAssetsTotal), vaultSle->at(sfAsset));
-}
-
 /**
  * Apply a signed delta to a LoanBroker's DebtTotal: on FixedPrecision Vaults,
  * add the exact delta (DebtTotal moves by exactly the same amount as the

include/xrpl/ledger/helpers/VaultHelpers.h

@@ -164,18 +164,20 @@ posteriorAssetScale(
 
 /**
  * Shared core of creditToPosteriorAvailableScale and
- * creditToPosteriorBrokerCoverScale: floors reference + raw at scale and
- * returns the difference from reference, so the delta applied is exactly
- * what moves reference onto the floored sum. See
- * creditToPosteriorAvailableScale's doc for why the sum, not raw alone,
- * must be floored. raw is the exact amount; it is not rounded on its own
- * before being added to reference.
+ * creditToPosteriorBrokerCoverScale: floors reference + raw at the sum's
+ * own live scale (never finer than baseScale) and returns the difference
+ * from reference, so the delta applied is exactly what moves reference onto
+ * the floored sum. See creditToPosteriorAvailableScale's doc for why the
+ * sum, not raw alone, must be floored. raw is the exact amount; it is not
+ * rounded on its own before being added to reference. The sum and its scale
+ * are computed once, in roundingMode, so a Downward credit is always
+ * between zero and raw.
  */
 [[nodiscard]] STAmount
 creditToPosteriorScale(
     Asset const& asset,
     Number const& reference,
-    int atScale,
+    int baseScale,
     Number const& raw,
     Number::RoundingMode roundingMode);
 

include/xrpl/nodestore/AGENTS.md

@@ -1,3 +0,0 @@
-# AGENTS.md — nodestore
-
-See [README.md](./README.md) for backend and benchmark design.

include/xrpl/nodestore/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

include/xrpl/protocol/ConfidentialTransfer.h

@@ -348,16 +348,19 @@ isAuditorMirrorCurrent(SLE const& issuance, SLE const& mptoken);
 areMirrorsCurrent(SLE const& issuance, SLE const& mptoken);
 
 /**
- * @brief Set the holder's issuer mirror epoch to match the issuance's current issuer key epoch.
+ * @brief Set the holder's issuer mirror epoch, and the issuer mirror key, to match the issuance's
+ * current key.
  *
  * Call this after writing the issuer mirror ciphertext under the issuance's
  * currently registered issuer key, so that the mirror reads as current afterwards.
+ * Also records sfIssuerMirrorEncryptionKey as the issuance's current issuer key
+ * (both fields stay absent at epoch 0, where the original issuer key applies).
  *
  * @param issuance The MPTokenIssuance ledger object.
  * @param mptoken  The holder's MPToken ledger entry to update.
  */
 void
-setIssuerMirrorEpoch(SLE const& issuance, SLE& mptoken);
+setIssuerMirrorCurrent(SLE const& issuance, SLE& mptoken);
 
 /**
  * @brief Set the holder's auditor mirror epoch to match the issuance's current auditor key epoch.
@@ -372,16 +375,18 @@ void
 setAuditorMirrorEpoch(SLE const& issuance, SLE& mptoken);
 
 /**
- * @brief Set the holder's MPToken mirror epochs to match the issuance's current key epochs.
+ * @brief Set the holder's MPToken mirror epochs, and the issuer mirror key, to match the issuance's
+ * current keys.
  *
  * Call this after writing mirror ciphertexts under the issuance's currently
- * registered keys, so that the mirrors read as current afterwards.
+ * registered keys, so that the mirrors read as current afterwards. Also records
+ * sfIssuerMirrorEncryptionKey via setIssuerMirrorCurrent.
  *
  * @param issuance The MPTokenIssuance ledger object.
  * @param mptoken  The holder's MPToken ledger entry to update.
  */
 void
-setMirrorEpochs(SLE const& issuance, SLE& mptoken);
+setMirrorsCurrent(SLE const& issuance, SLE& mptoken);
 
 /**
  * @brief Verifies revealed amount encryptions for all recipients.

include/xrpl/protocol/Fees.h

@@ -10,6 +10,25 @@ namespace xrpl {
 // This was the reference fee units used in the old fee calculation.
 inline constexpr std::uint32_t kFeeUnitsDeprecated = 10;
 
+// Number of micro-drops in one drop.
+inline constexpr std::uint32_t microDropsPerDrop{1'000'000};
+
+/**
+ * Hard protocol bounds on the Feature Extension fee settings. A voted value
+ * can never fall outside these, so `preflight`, which has no view, may bound
+ * against them. Gas and bytecode limits are capped; gas price has a floor
+ * (zero would make WASM execution effectively free).
+ */
+inline constexpr std::uint32_t kMaxGasLimit{2'000'000};
+inline constexpr std::uint32_t kMaxBytecodeSizeLimit{200'000};
+inline constexpr std::uint32_t kMinGasPrice{1};
+
+// The following default values of fee settings will seed into FeeSettings
+// and write to the ledger on featureSmartEscrow activation.
+inline constexpr std::uint32_t kDefaultGasLimit{1'000'000};
+inline constexpr std::uint32_t kDefaultBytecodeSizeLimit{100'000};
+inline constexpr std::uint32_t kDefaultGasPrice{1'000'000};
+
 /**
  * Reflects the fee settings for a particular ledger.
  *
@@ -33,13 +52,47 @@ struct Fees
      */
     XRPAmount increment{0};
 
+    /**
+     * @brief Gas limit for Feature Extensions (instructions).
+     *
+     * This and the one below default to the protocol values rather than 0,
+     * because an explicit 0 is the voted kill switch.
+     */
+    std::uint32_t gasLimit{kDefaultGasLimit};
+
+    /**
+     * @brief Bytecode size limit for Feature Extensions (bytes).
+     */
+    std::uint32_t bytecodeSizeLimit{kDefaultBytecodeSizeLimit};
+
+    /**
+     * @brief Price of WASM gas (micro-drops).
+     */
+    std::uint32_t gasPrice{kDefaultGasPrice};
+
     explicit Fees() = default;
     Fees(Fees const&) = default;
     Fees&
     operator=(Fees const&) = default;
 
     Fees(XRPAmount base, XRPAmount reserve, XRPAmount increment)
-        : base(base), reserve(reserve), increment(increment)
+        : base{base}, reserve{reserve}, increment{increment}
+    {
+    }
+
+    Fees(
+        XRPAmount base,
+        XRPAmount reserve,
+        XRPAmount increment,
+        std::uint32_t gasLimit,
+        std::uint32_t bytecodeSizeLimit,
+        std::uint32_t gasPrice)
+        : base{base}
+        , reserve{reserve}
+        , increment{increment}
+        , gasLimit{gasLimit}
+        , bytecodeSizeLimit{bytecodeSizeLimit}
+        , gasPrice{gasPrice}
     {
     }
 

include/xrpl/protocol/Protocol.h

@@ -398,6 +398,11 @@ constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono:
  */
 constexpr std::uint8_t kMaxAssetCheckDepth = 5;
 
+/**
+ * Maximum length of a Data field in Escrow object that can be updated by WASM code.
+ */
+constexpr std::size_t kMaxWasmDataLength = 1 * 1024;  // 1KB
+
 /**
  * A ledger index.
  */

include/xrpl/protocol/STPathSet.h

@@ -2,6 +2,8 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/UnorderedContainers.h>
+#include <xrpl/basics/enum_bitops.h>
+#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
@@ -15,37 +17,43 @@
 #include <cstdint>
 #include <memory>
 #include <optional>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
 namespace xrpl {
 
+enum class STPathElementType : std::uint8_t {
+    // clang-format off
+
+    None     = 0x00,  ///< No element; also terminates the serialized path set.
+    Account  = 0x01,  ///< Rippling through an account (vs taking an offer).
+    Currency = 0x10,  ///< Currency follows.
+    Issuer   = 0x20,  ///< Issuer follows.
+    Mpt      = 0x40,  ///< MPT follows.
+    Boundary = 0xFF,  ///< Boundary between alternate paths.
+
+    Asset    = Currency | Mpt,                      ///< Either asset kind.
+    All      = Account | Currency | Issuer | Mpt,   ///< Every value-carrying bit.
+
+    // clang-format on
+};
+
+template <>
+struct enum_bitops::OptIn<STPathElementType> : std::true_type
+{
+};
+
 class STPathElement final : public CountedObject<STPathElement>
 {
-    unsigned int type_;
+    STPathElementType type_ = STPathElementType::None;
+    bool isOffer_ = true;
     AccountID accountID_;
     PathAsset assetID_;
     AccountID issuerID_;
 
-    bool isOffer_;
-    std::size_t hashValue_;
-
 public:
-    // Bitwise values (typeCurrency | typeMPT)
-    // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-    enum Type {
-        TypeNone = 0x00,
-        TypeAccount = 0x01,   // Rippling through an account (vs taking an offer).
-        TypeCurrency = 0x10,  // Currency follows.
-        TypeIssuer = 0x20,    // Issuer follows.
-        TypeMpt = 0x40,       // MPT follows.
-        TypeBoundary = 0xFF,  // Boundary between alternate paths.
-        TypeAsset = TypeCurrency | TypeMpt,
-        TypeAll = TypeAccount | TypeCurrency | TypeIssuer | TypeMpt,
-        // Combination of all types.
-    };
-
-    STPathElement();
+    STPathElement() = default;
     STPathElement(STPathElement const&) = default;
     STPathElement&
     operator=(STPathElement const&) = default;
@@ -62,42 +70,42 @@ public:
         bool forceAsset = false);
 
     STPathElement(
-        unsigned int uType,
+        STPathElementType type,
         AccountID const& account,
         PathAsset const& asset,
         AccountID const& issuer);
 
-    [[nodiscard]] std::uint32_t
-    getNodeType() const;
+    [[nodiscard]] STPathElementType
+    getNodeType() const noexcept;
 
     [[nodiscard]] bool
-    isOffer() const;
+    isOffer() const noexcept;
 
     [[nodiscard]] bool
-    isAccount() const;
+    isAccount() const noexcept;
 
     [[nodiscard]] bool
-    hasIssuer() const;
+    hasIssuer() const noexcept;
 
     [[nodiscard]] bool
-    hasCurrency() const;
+    hasCurrency() const noexcept;
 
     [[nodiscard]] bool
-    hasMPT() const;
+    hasMPT() const noexcept;
 
     [[nodiscard]] bool
-    hasAsset() const;
+    hasAsset() const noexcept;
 
     [[nodiscard]] bool
-    isNone() const;
+    isNone() const noexcept;
 
     // Nodes are either an account ID or a offer prefix. Offer prefixs denote a
     // class of offers.
     [[nodiscard]] AccountID const&
-    getAccountID() const;
+    getAccountID() const noexcept;
 
     [[nodiscard]] PathAsset const&
-    getPathAsset() const;
+    getPathAsset() const noexcept;
 
     [[nodiscard]] Currency const&
     getCurrency() const;
@@ -106,17 +114,18 @@ public:
     getMPTID() const;
 
     [[nodiscard]] AccountID const&
-    getIssuerID() const;
+    getIssuerID() const noexcept;
 
     [[nodiscard]] bool
-    isType(Type const& pe) const;
+    isType(STPathElementType pe) const noexcept;
 
-    bool
-    operator==(STPathElement const& t) const;
-
-private:
-    static std::size_t
-    getHash(STPathElement const& element);
+    friend bool
+    operator==(STPathElement const& lhs, STPathElement const& rhs) noexcept
+    {
+        return lhs.isType(STPathElementType::Account) == rhs.isType(STPathElementType::Account) &&
+            lhs.accountID_ == rhs.accountID_ && lhs.assetID_ == rhs.assetID_ &&
+            lhs.issuerID_ == rhs.issuerID_;
+    }
 };
 
 template <class Hasher>
@@ -124,7 +133,7 @@ void
 hash_append(Hasher& h, STPathElement const& e) noexcept
 {
     using beast::hash_append;
-    hash_append(h, (e.getNodeType() & STPathElement::TypeAccount) != 0u);
+    hash_append(h, e.isType(STPathElementType::Account));
     hash_append(h, e.getAccountID());
     hash_append(h, e.getPathAsset());
     hash_append(h, e.getIssuerID());
@@ -337,29 +346,16 @@ private:
 
 // ------------ STPathElement ------------
 
-inline STPathElement::STPathElement() : type_(TypeNone), isOffer_(true)
-{
-    // hashValue_ is derived from the whole object, so it is computed in the body
-    // once every other member is initialized (as in the other constructors).
-    // NOLINTNEXTLINE(cppcoreguidelines-prefer-member-initializer)
-    hashValue_ = getHash(*this);
-}
-
 inline STPathElement::STPathElement(
     std::optional<AccountID> const& account,
     std::optional<PathAsset> const& asset,
     std::optional<AccountID> const& issuer)
-    : type_(TypeNone)
 {
-    if (!account)
-    {
-        isOffer_ = true;
-    }
-    else
+    if (account)
     {
         isOffer_ = false;
         accountID_ = *account;
-        type_ |= TypeAccount;
+        type_ |= STPathElementType::Account;
         XRPL_ASSERT(
             accountID_ != noAccount(), "xrpl::STPathElement::STPathElement : account is set");
     }
@@ -367,17 +363,15 @@ inline STPathElement::STPathElement(
     if (asset)
     {
         assetID_ = *asset;
-        type_ |= assetID_.holds<Currency>() ? TypeCurrency : TypeMpt;
+        type_ |= assetID_.holds<Currency>() ? STPathElementType::Currency : STPathElementType::Mpt;
     }
 
     if (issuer)
     {
         issuerID_ = *issuer;
-        type_ |= TypeIssuer;
+        type_ |= STPathElementType::Issuer;
         XRPL_ASSERT(issuerID_ != noAccount(), "xrpl::STPathElement::STPathElement : issuer is set");
     }
-
-    hashValue_ = getHash(*this);
 }
 
 inline STPathElement::STPathElement(
@@ -385,108 +379,94 @@ inline STPathElement::STPathElement(
     PathAsset const& asset,
     AccountID const& issuer,
     bool forceAsset)
-    : type_(TypeNone)
-    , accountID_(account)
-    , assetID_(asset)
-    , issuerID_(issuer)
-    , isOffer_(isXRP(accountID_))
+    : isOffer_(isXRP(account)), accountID_(account), assetID_(asset), issuerID_(issuer)
 {
     if (!isOffer_)
-        type_ |= TypeAccount;
+        type_ |= STPathElementType::Account;
 
     if (forceAsset || !isXRP(assetID_))
-        type_ |= asset.holds<Currency>() ? TypeCurrency : TypeMpt;
+        type_ |= asset.holds<Currency>() ? STPathElementType::Currency : STPathElementType::Mpt;
 
     if (!isXRP(issuer))
-        type_ |= TypeIssuer;
-
-    hashValue_ = getHash(*this);
+        type_ |= STPathElementType::Issuer;
 }
 
 inline STPathElement::STPathElement(
-    unsigned int uType,
+    STPathElementType type,
     AccountID const& account,
     PathAsset const& asset,
     AccountID const& issuer)
-    : type_(uType)
-    , accountID_(account)
-    , assetID_(asset)
-    , issuerID_(issuer)
-    , isOffer_(isXRP(accountID_))
+    : type_(type), isOffer_(isXRP(account)), accountID_(account), assetID_(asset), issuerID_(issuer)
 {
     assetID_.visit(
-        [&](Currency const&) { type_ = type_ & (~Type::TypeMpt); },
-        [&](MPTID const&) { type_ = type_ & (~Type::TypeCurrency); });
-    // hashValue_ must be computed after type_ is adjusted above, so this cannot
-    // be a member initializer.
-    // NOLINTNEXTLINE(cppcoreguidelines-prefer-member-initializer)
-    hashValue_ = getHash(*this);
+        [&](Currency const&) { type_ &= ~STPathElementType::Mpt; },
+        [&](MPTID const&) { type_ &= ~STPathElementType::Currency; });
 }
 
-inline std::uint32_t
-STPathElement::getNodeType() const
+inline STPathElementType
+STPathElement::getNodeType() const noexcept
 {
     return type_;
 }
 
 inline bool
-STPathElement::isOffer() const
+STPathElement::isOffer() const noexcept
 {
     return isOffer_;
 }
 
 inline bool
-STPathElement::isAccount() const
+STPathElement::isAccount() const noexcept
 {
     return !isOffer();
 }
 
 inline bool
-STPathElement::isType(Type const& pe) const
+STPathElement::isType(STPathElementType pe) const noexcept
 {
-    return (type_ & pe) != 0u;
+    return (type_ & pe) != STPathElementType::None;
 }
 
 inline bool
-STPathElement::hasIssuer() const
+STPathElement::hasIssuer() const noexcept
 {
-    return isType(STPathElement::TypeIssuer);
+    return isType(STPathElementType::Issuer);
 }
 
 inline bool
-STPathElement::hasCurrency() const
+STPathElement::hasCurrency() const noexcept
 {
-    return isType(STPathElement::TypeCurrency);
+    return isType(STPathElementType::Currency);
 }
 
 inline bool
-STPathElement::hasMPT() const
+STPathElement::hasMPT() const noexcept
 {
-    return isType(STPathElement::TypeMpt);
+    return isType(STPathElementType::Mpt);
 }
 
 inline bool
-STPathElement::hasAsset() const
+STPathElement::hasAsset() const noexcept
 {
-    return isType(STPathElement::TypeAsset);
+    return isType(STPathElementType::Asset);
 }
 
 inline bool
-STPathElement::isNone() const
+STPathElement::isNone() const noexcept
 {
-    return getNodeType() == STPathElement::TypeNone;
+    return getNodeType() == STPathElementType::None;
 }
 
 // Nodes are either an account ID or a offer prefix. Offer prefixs denote a
 // class of offers.
 inline AccountID const&
-STPathElement::getAccountID() const
+STPathElement::getAccountID() const noexcept
 {
     return accountID_;
 }
 
 inline PathAsset const&
-STPathElement::getPathAsset() const
+STPathElement::getPathAsset() const noexcept
 {
     return assetID_;
 }
@@ -504,18 +484,11 @@ STPathElement::getMPTID() const
 }
 
 inline AccountID const&
-STPathElement::getIssuerID() const
+STPathElement::getIssuerID() const noexcept
 {
     return issuerID_;
 }
 
-inline bool
-STPathElement::operator==(STPathElement const& t) const
-{
-    return (type_ & TypeAccount) == (t.type_ & TypeAccount) && hashValue_ == t.hashValue_ &&
-        accountID_ == t.accountID_ && assetID_ == t.assetID_ && issuerID_ == t.issuerID_;
-}
-
 // ------------ STPath ------------
 
 inline STPath::STPath(std::vector<STPathElement> p) : path_(std::move(p))

include/xrpl/protocol/TER.h

@@ -133,7 +133,6 @@ enum TEMcodes : TERUnderlyingType {
     temBAD_MPT,
     temBAD_CIPHERTEXT,
     temINVALID_BYTECODE,
-    temTEMP_DISABLED,
 };
 
 //------------------------------------------------------------------------------
@@ -184,6 +183,8 @@ enum TEFcodes : TERUnderlyingType {
     tefBAD_PATH_COUNT,
     tefNO_BYTECODE,
     tefBYTECODE_NOT_INCLUDED,
+    tefTEMP_DISABLED,
+    tefEXCEEDS_LIMIT,
 };
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/detail/ledger_entries.macro

@@ -417,6 +417,7 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfAuditorEncryptionKey,     SoeOptional},
     {sfIssuerKeyEpoch,           SoeOptional},
     {sfAuditorKeyEpoch,          SoeOptional},
+    {sfInitialIssuerEncryptionKey, SoeOptional},
     {sfConfidentialOutstandingAmount, SoeDefault},
 }))
 
@@ -438,6 +439,7 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
     {sfAuditorEncryptedBalance,     SoeOptional},
     {sfIssuerKeyMirrorEpoch,        SoeOptional},
     {sfAuditorKeyMirrorEpoch,       SoeOptional},
+    {sfIssuerMirrorEncryptionKey,   SoeOptional},
     {sfHolderEncryptionKey,         SoeOptional},
     {sfRecoveryKey,                 SoeOptional},
 }))

include/xrpl/protocol/detail/sfields.macro

@@ -333,6 +333,8 @@ TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
 TYPED_SFIELD(sfBytecode,                    VL,     47)
 TYPED_SFIELD(sfRecoveryKey,                 VL,     48)
+TYPED_SFIELD(sfInitialIssuerEncryptionKey,  VL,     49)
+TYPED_SFIELD(sfIssuerMirrorEncryptionKey,   VL,     50)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)

include/xrpl/protocol/jss.h

@@ -252,6 +252,9 @@ JSS(expected_date);                  // out: any (warnings)
 JSS(expected_date_UTC);              // out: any (warnings)
 JSS(expected_ledger_size);           // out: TxQ
 JSS(expiration);                     // out: AccountOffers, AccountChannels, ValidatorList, amm_info
+JSS(gas_limit);                      // out: NetworkOPs
+JSS(bytecode_size_limit);            // out: NetworkOPs
+JSS(gas_price);                      // out: NetworkOPs
 JSS(fail_hard);                      // in: Sign, Submit
 JSS(failed);                         // out: InboundLedger
 JSS(feature);                        // in: Feature

include/xrpl/protocol_autogen/ledger_entries/MPToken.h

@@ -316,6 +316,30 @@ public:
         return this->sle_->isFieldPresent(sfAuditorKeyMirrorEpoch);
     }
 
+    /**
+     * @brief Get sfIssuerMirrorEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getIssuerMirrorEncryptionKey() const
+    {
+        if (hasIssuerMirrorEncryptionKey())
+            return this->sle_->at(sfIssuerMirrorEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfIssuerMirrorEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasIssuerMirrorEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfIssuerMirrorEncryptionKey);
+    }
+
     /**
      * @brief Get sfHolderEncryptionKey (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -565,6 +589,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfIssuerMirrorEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setIssuerMirrorEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerMirrorEncryptionKey] = value;
+        return *this;
+    }
+
     /**
      * @brief Set sfHolderEncryptionKey (SoeOptional)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h

@@ -399,6 +399,30 @@ public:
         return this->sle_->isFieldPresent(sfAuditorKeyEpoch);
     }
 
+    /**
+     * @brief Get sfInitialIssuerEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getInitialIssuerEncryptionKey() const
+    {
+        if (hasInitialIssuerEncryptionKey())
+            return this->sle_->at(sfInitialIssuerEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfInitialIssuerEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasInitialIssuerEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfInitialIssuerEncryptionKey);
+    }
+
     /**
      * @brief Get sfConfidentialOutstandingAmount (SoeDefault)
      * @return The field value, or std::nullopt if not present.
@@ -670,6 +694,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfInitialIssuerEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setInitialIssuerEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfInitialIssuerEncryptionKey] = value;
+        return *this;
+    }
+
     /**
      * @brief Set sfConfidentialOutstandingAmount (SoeDefault)
      * @return Reference to this builder for method chaining.

include/xrpl/shamap/AGENTS.md

@@ -1,3 +0,0 @@
-# AGENTS.md — shamap
-
-See [README.md](./README.md) for the SHAMap design.

include/xrpl/shamap/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

include/xrpl/shamap/SHAMap.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Blob.h>
 #include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/Log.h>
 #include <xrpl/basics/SHAMapHash.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
@@ -17,6 +18,7 @@
 #include <xrpl/shamap/SHAMapNodeID.h>
 #include <xrpl/shamap/SHAMapTreeNode.h>
 
+#include <atomic>
 #include <condition_variable>
 #include <cstddef>
 #include <cstdint>
@@ -40,7 +42,7 @@ class SHAMapSyncFilter;
 /**
  * Describes the current state of a given SHAMap
  */
-enum class SHAMapState {
+enum class SHAMapState : std::uint8_t {
     /**
      * The map is in flux and objects can be added and removed.
      *
@@ -120,16 +122,42 @@ private:
      */
     std::uint32_t cowid_ = 1;
 
+    // ledgerSeq_, state_ and full_ are touched on the nodestore fetch path and on a
+    // getMissingNodes() walk, neither of which may block, so pin them lock-free.
+    static_assert(std::atomic<std::uint32_t>::is_always_lock_free);
+    static_assert(std::atomic<SHAMapState>::is_always_lock_free);
+    static_assert(std::atomic<bool>::is_always_lock_free);
+
     /**
      * The sequence of the ledger that this map references, if any.
+     *
+     * Written when a map's ledger sequence is established (Ledger::setFull(),
+     * InboundLedger) while a nodestore reader thread reads it. Relaxed either
+     * way: it serves as a lookup hint for a nodestore keyed by hash.
      */
-    std::uint32_t ledgerSeq_ = 0;
+    std::atomic<std::uint32_t> ledgerSeq_ = 0;
 
     SHAMapTreeNodePtr root_;
-    mutable SHAMapState state_;
+
+    /**
+     * The map's state.
+     *
+     * A getMissingNodes() walk writes it, through setInvalid() and
+     * clearSynching(), while whatever drives the acquisition reads it.
+     * The walk runs with the acquisition's lock released, so this is atomic
+     * rather than guarded.
+     */
+    mutable std::atomic<SHAMapState> state_;
     SHAMapType const type_;
-    bool backed_ = true;         // Map is backed by the database
-    mutable bool full_ = false;  // Map is believed complete in database
+    bool backed_ = true;  // Map is backed by the database
+
+    /**
+     * Map is believed complete in database.
+     *
+     * Atomic because finishFetch() clears it on any nodestore reader thread,
+     * several of which can run at once.
+     */
+    mutable std::atomic<bool> full_ = false;
 
 public:
     /**
@@ -152,7 +180,14 @@ public:
     SHAMap&
     operator=(SHAMap const&) = delete;
 
-    // Take a snapshot of the given map:
+    /**
+     * Take a snapshot of the given map.
+     *
+     * @param other The map to snapshot. An Invalid source yields an Invalid
+     *        snapshot.
+     * @param isMutable Whether the snapshot may be modified. Ignored when other
+     *        is Invalid.
+     */
     SHAMap(SHAMap const& other, bool isMutable);
 
     // build new map
@@ -190,17 +225,33 @@ public:
 
     //--------------------------------------------------------------------------
 
-    // Returns a new map that's a snapshot of this one.
-    // Handles copy on write for mutable snapshots.
+    /**
+     * Return a new map that is a snapshot of this one.
+     *
+     * Handles copy on write for mutable snapshots. An invalid map yields an
+     * invalid snapshot.
+     *
+     * @param isMutable Whether the snapshot may be modified.
+     * @return The snapshot.
+     */
     std::shared_ptr<SHAMap>
     snapShot(bool isMutable) const;
 
-    /*  Mark this SHAMap as "should be full", indicating
-        that the local server wants all the corresponding nodes
-        in durable storage.
-    */
+    /**
+     * Mark this map as "should be full": the local server wants every node
+     * it references in durable storage, so a nodestore miss is a gap to report.
+     *
+     * Publishes the ledger sequence before the flag. The sequence store is
+     * relaxed and the flag store is release, and finishFetch() reads the
+     * sequence only after acquiring the flag, so the one miss that withdraws
+     * the flag always reports the sequence stored here. Keeping both stores in
+     * one place is what makes that order impossible to get wrong.
+     *
+     * @param ledgerSeq Sequence of the ledger this map belongs to, which the
+     *        gap report names.
+     */
     void
-    setFull();
+    setFull(std::uint32_t ledgerSeq);
 
     void
     setLedgerSeq(std::uint32_t lseq);
@@ -296,9 +347,13 @@ public:
      * concurrency, to discover nodes referenced in the
      * SHAMap but not available locally.
      *
+     * Only a leaf may occupy a position at or beyond kLeafDepth. A map that
+     * breaks that is marked Invalid and the traversal is abandoned, so callers
+     * ask isValid() to tell an empty result from a satisfied map.
+     *
      * @param maxNodes The maximum number of found nodes to return
      * @param filter The filter to use when retrieving nodes
-     * @param return The nodes known to be missing
+     * @return The nodes known to be missing, or empty if the map is Invalid
      */
     std::vector<std::pair<SHAMapNodeID, UInt256>>
     getMissingNodes(int maxNodes, SHAMapSyncFilter const* filter);
@@ -341,6 +396,9 @@ public:
      * This function is used when receiving the root node of a SHAMap from a peer during ledger
      * synchronization. The node must already have been deserialized.
      *
+     * A root offered under a hash the map does not hold names another tree and
+     * is reported as invalid data. A root matching that hash is a duplicate.
+     *
      * @param hash The expected hash of the root node.
      * @param rootNode A deserialized root node to add.
      * @param filter Optional sync filter to track received nodes.
@@ -360,6 +418,10 @@ public:
      * is inserted at the position specified by nodeID. The node must already have been
      * deserialized.
      *
+     * A node that no valid tree can hold makes the map Invalid, which is
+     * terminal: the root hash committed to an impossible shape, so no peer
+     * can satisfy it.
+     *
      * @param nodeID The position in the tree where this node belongs.
      * @param treeNode A deserialized tree node to add.
      * @param filter Optional sync filter to track received nodes.
@@ -375,16 +437,57 @@ public:
         SHAMapTreeNodePtr treeNode,
         SHAMapSyncFilter const* filter);
 
-    // status functions
-    void
+    /**
+     * Mark this map as immutable, so it can no longer be modified.
+     *
+     * @return false if the map is Invalid and was left unchanged, true
+     *         otherwise.
+     */
+    [[nodiscard]] bool
     setImmutable();
-    bool
+
+    /**
+     * @return Whether the map is being synced against a hash it was given, so
+     *         its hash is fixed while nodes may still be added.
+     */
+    [[nodiscard]] bool
     isSynching() const;
+
+    /**
+     * @return Whether the map is settled, with its hash and nodes fixed.
+     */
+    [[nodiscard]] bool
+    isImmutable() const;
+
+    /**
+     * Mark this map as syncing, fixing its hash while still allowing missing
+     * nodes to be added.
+     *
+     * The map must be freshly constructed. The body asserts that the map is not
+     * Invalid, so a caller that ignores the precondition stops a build with
+     * assertions enabled.
+     */
     void
     setSynching();
+
+    /**
+     * Mark this map as no longer syncing, so it can be modified again.
+     *
+     * Moves only a Synching map. An Immutable map stays settled, a Modifying
+     * map has nothing to clear, and Invalid is terminal.
+     */
     void
     clearSynching();
-    bool
+
+    /**
+     * Whether the map can still be the map it claims to be.
+     *
+     * A map that is merely missing nodes is valid, and stays valid until
+     * something proves the tree it is syncing against cannot exist.
+     *
+     * @return Whether the map has not been proven impossible.
+     */
+    [[nodiscard]] bool
     isValid() const;
 
     // caution: otherMap must be accessed only by this function
@@ -524,6 +627,51 @@ private:
     using DeltaRef =
         std::pair<boost::intrusive_ptr<SHAMapItem const>, boost::intrusive_ptr<SHAMapItem const>>;
 
+    /**
+     * The sequence of the ledger this map references, read atomically.
+     *
+     * @return The sequence, or zero if the map references no ledger.
+     */
+    [[nodiscard]] std::uint32_t
+    ledgerSeq() const;
+
+    /**
+     * The current state, read atomically.
+     *
+     * Orders state_ alone. The tree's nodes carry no ordering guarantees.
+     *
+     * @return The state as of the call, which a concurrent walk may already
+     *         have moved past.
+     */
+    [[nodiscard]] SHAMapState
+    state() const;
+
+    /**
+     * Record that the map is provably not the one it claims to be.
+     *
+     * Private because only the map itself can prove that, from a node that
+     * contradicts the hashes it is syncing against. Cannot fail, since
+     * Invalid outranks every other state; see trySetState().
+     */
+    void
+    setInvalid();
+
+    /**
+     * Move the map to a new state, atomically.
+     *
+     * With clearSynching(), the only writer of state_ past construction, so
+     * the order between the states lives in one place: Invalid outranks all
+     * of them and is always stored, while every other transition is refused
+     * once the map is Invalid, which is what makes that verdict terminal.
+     * clearSynching() is narrower and moves only Synching.
+     *
+     * @param desired The state to move to.
+     * @return false if the map is Invalid and the requested state is not,
+     *         leaving it unchanged; true otherwise.
+     */
+    bool
+    trySetState(SHAMapState desired);
+
     // tree node cache operations
     SHAMapTreeNodePtr
     cacheLookup(SHAMapHash const& hash) const;
@@ -739,46 +887,120 @@ private:
 };
 
 inline void
-SHAMap::setFull()
+SHAMap::setFull(std::uint32_t ledgerSeq)
 {
-    full_ = true;
+    ledgerSeq_.store(ledgerSeq, std::memory_order_relaxed);
+    full_.store(true, std::memory_order_release);
 }
 
 inline void
 SHAMap::setLedgerSeq(std::uint32_t lseq)
 {
-    ledgerSeq_ = lseq;
+    ledgerSeq_.store(lseq, std::memory_order_relaxed);
 }
 
-inline void
+inline std::uint32_t
+SHAMap::ledgerSeq() const
+{
+    return ledgerSeq_.load(std::memory_order_relaxed);
+}
+
+inline SHAMapState
+SHAMap::state() const
+{
+    return state_.load(std::memory_order_acquire);
+}
+
+inline bool
+SHAMap::trySetState(SHAMapState desired)
+{
+    // Invalid is stored outright: a walk reaching that verdict has to win against a thread
+    // settling the map.
+    if (desired == SHAMapState::Invalid)
+    {
+        state_.store(SHAMapState::Invalid, std::memory_order_release);
+        return true;
+    }
+
+    // A failed exchange both reports the state and refreshes expected, so no load is needed
+    // ahead of the loop.
+    auto expected = SHAMapState::Modifying;
+    while (expected != SHAMapState::Invalid)
+    {
+        if (state_.compare_exchange_weak(
+                expected, desired, std::memory_order_acq_rel, std::memory_order_acquire))
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
+inline bool
 SHAMap::setImmutable()
 {
-    XRPL_ASSERT(state_ != SHAMapState::Invalid, "xrpl::SHAMap::setImmutable : state is valid");
-    state_ = SHAMapState::Immutable;
+    SOMETIMES(!isValid(), "xrpl::SHAMap::setImmutable : map is invalid");
+    return trySetState(SHAMapState::Immutable);
 }
 
 inline bool
 SHAMap::isSynching() const
 {
-    return state_ == SHAMapState::Synching;
+    return state() == SHAMapState::Synching;
+}
+
+inline bool
+SHAMap::isImmutable() const
+{
+    return state() == SHAMapState::Immutable;
 }
 
 inline void
 SHAMap::setSynching()
 {
-    state_ = SHAMapState::Synching;
+    // Guarded, so this is not a way out of Invalid.
+    if (!trySetState(SHAMapState::Synching))
+    {
+        // Only ever called on a freshly constructed map.
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::SHAMap::setSynching : map is invalid");
+        // LCOV_EXCL_STOP
+    }
 }
 
 inline void
 SHAMap::clearSynching()
 {
-    state_ = SHAMapState::Modifying;
+    // Only Synching moves. A walk can end after the ledger settled, and then the map stays
+    // Immutable; a Modifying map has nothing to clear; an invalid map stays invalid. Only that
+    // last refusal is logged, since a concurrent walk is what produces it.
+    auto expected = SHAMapState::Synching;
+    if (state_.compare_exchange_strong(
+            expected, SHAMapState::Modifying, std::memory_order_acq_rel, std::memory_order_acquire))
+    {
+        return;
+    }
+
+    bool const invalid = expected == SHAMapState::Invalid;
+    SOMETIMES(invalid, "xrpl::SHAMap::clearSynching : map is invalid");
+    if (invalid)
+    {
+        JLOG(journal_.warn()) << "Refused to clear synching on an invalid map, root hash "
+                              << root_->getHash();
+    }
 }
 
 inline bool
 SHAMap::isValid() const
 {
-    return state_ != SHAMapState::Invalid;
+    return state() != SHAMapState::Invalid;
+}
+
+inline void
+SHAMap::setInvalid()
+{
+    // Through trySetState() like every other transition, so state_ has one writer funnel.
+    trySetState(SHAMapState::Invalid);
 }
 
 inline void

include/xrpl/shamap/SHAMapInnerNode.h

@@ -31,7 +31,19 @@ private:
      */
     TaggedPointer hashesAndChildren_;
 
-    std::uint32_t fullBelowGen_ = 0;
+    // Pin that wrapping fullBelowGen_ in an atomic keeps the packed layout, and that the load
+    // isFullBelow() does once per node of every walk stays lock-free.
+    static_assert(std::atomic<std::uint32_t>::is_always_lock_free);
+    static_assert(sizeof(std::atomic<std::uint32_t>) == sizeof(std::uint32_t));
+    static_assert(alignof(std::atomic<std::uint32_t>) == alignof(std::uint32_t));
+
+    /**
+     * Written from more than one thread, since canonicalization shares a node
+     * between maps and a walk can run with the acquisition lock released (see
+     * SHAMap::state_). Relaxed both ways, since a generation is only compared
+     * for equality and the children it vouches for are published through lock_.
+     */
+    std::atomic<std::uint32_t> fullBelowGen_ = 0;
     std::uint16_t isBranch_ = 0;
 
     /**
@@ -204,13 +216,13 @@ SHAMapInnerNode::getBranchCount() const
 inline bool
 SHAMapInnerNode::isFullBelow(std::uint32_t generation) const
 {
-    return fullBelowGen_ == generation;
+    return fullBelowGen_.load(std::memory_order_relaxed) == generation;
 }
 
 inline void
 SHAMapInnerNode::setFullBelowGen(std::uint32_t gen)
 {
-    fullBelowGen_ = gen;
+    fullBelowGen_.store(gen, std::memory_order_relaxed);
 }
 
 }  // namespace xrpl

include/xrpl/tx/ApplyContext.h

@@ -51,7 +51,8 @@ public:
         beast::Journal journal = beast::Journal{beast::Journal::getNullSink()})
         : ApplyContext(registry, base, std::nullopt, tx, preclaimResult, baseFee, flags, journal)
     {
-        XRPL_ASSERT((flags & TapBatch) == 0, "Batch apply flag should not be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::None, "Batch apply flag should not be set");
     }
 
     std::reference_wrapper<ServiceRegistry> registry;

include/xrpl/tx/Transactor.h

@@ -59,10 +59,11 @@ public:
         , parentBatchId(parentBatchId)
         , j(j)
     {
-        XRPL_ASSERT((flags & TapBatch) == TapBatch, "Batch apply flag should be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::Batch, "Batch apply flag should be set");
         XRPL_ASSERT_IF(
-            (flags & TapProposal) != TapNone,
-            (flags & TapDryRun) != TapNone,
+            (flags & ApplyFlags::Proposal) != ApplyFlags::None,
+            (flags & ApplyFlags::DryRun) != ApplyFlags::None,
             "xrpl::PreflightContext : proposal preflight implies dry run");
     }
 
@@ -74,10 +75,11 @@ public:
         beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
         : registry(registry), tx(tx), rules(std::move(rules)), flags(flags), j(j)
     {
-        XRPL_ASSERT((flags & TapBatch) == 0, "Batch apply flag should not be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::None, "Batch apply flag should not be set");
         XRPL_ASSERT_IF(
-            (flags & TapProposal) != TapNone,
-            (flags & TapDryRun) != TapNone,
+            (flags & ApplyFlags::Proposal) != ApplyFlags::None,
+            (flags & ApplyFlags::DryRun) != ApplyFlags::None,
             "xrpl::PreflightContext : proposal preflight implies dry run");
     }
 
@@ -116,7 +118,7 @@ public:
         , j(j)
     {
         XRPL_ASSERT(
-            parentBatchId.has_value() == ((flags & TapBatch) == TapBatch),
+            parentBatchId.has_value() == ((flags & ApplyFlags::Batch) == ApplyFlags::Batch),
             "Parent Batch ID should be set if batch apply flag is set");
     }
 
@@ -129,7 +131,8 @@ public:
         beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
         : PreclaimContext(registry, view, preflightResult, tx, flags, std::nullopt, j)
     {
-        XRPL_ASSERT((flags & TapBatch) == 0, "Batch apply flag should not be set");
+        XRPL_ASSERT(
+            (flags & ApplyFlags::Batch) == ApplyFlags::None, "Batch apply flag should not be set");
     }
 
     PreclaimContext&

include/xrpl/tx/applySteps.h

@@ -41,7 +41,7 @@ struct ApplyResult
 inline bool
 isTecClaimHardFail(TER ter, ApplyFlags flags)
 {
-    return isTecClaim(ter) && ((flags & TapRetry) == 0u);
+    return isTecClaim(ter) && ((flags & ApplyFlags::Retry) == ApplyFlags::None);
 }
 
 /**

include/xrpl/tx/invariants/CosignerInvariant.h

@@ -0,0 +1,52 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <cstdint>
+#include <set>
+#include <vector>
+
+namespace xrpl {
+
+class ReadView;
+
+/**
+ * @brief Invariants for TransactionProposal ledger entries.
+ *
+ * - Only transaction types implementing proposal lifecycle operations may
+ *   create or modify proposals, and a failed one leaves no proposal effect.
+ * - A proposal is deleted only by TransactionProposalCancel or together with
+ *   the Ticket it is keyed to, and a deleted Ticket takes the proposal keyed
+ *   to it along.
+ * - Collected signer arrays remain sorted, unique, and bounded.
+ */
+class ValidTransactionProposal
+{
+    // The Ticket each deleted proposal was keyed to; a proposal may go with
+    // its Ticket, or by Cancel, and no other way.
+    std::vector<uint256> ticketsOfDeletedProposals_;
+    // The proposal each deleted Ticket was keyed to, whether or not one
+    // existed; none may survive its Ticket.
+    std::vector<Keylet> proposalsOfDeletedTickets_;
+    std::set<uint256> deletedTickets_;
+    std::uint32_t created_ = 0;
+    std::uint32_t modified_ = 0;
+    std::uint32_t deleted_ = 0;
+    bool invalidSignerArrays_ = false;
+
+public:
+    void
+    visitEntry(bool isDelete, SLE::ConstRef before, SLE::ConstRef after);
+
+    [[nodiscard]] bool
+    finalize(STTx const& tx, TER result, XRPAmount, ReadView const& view, beast::Journal const& j)
+        const;
+};
+
+}  // namespace xrpl

include/xrpl/tx/invariants/InvariantCheck.h

@@ -9,6 +9,7 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/invariants/AMMInvariant.h>
+#include <xrpl/tx/invariants/CosignerInvariant.h>
 #include <xrpl/tx/invariants/DirectoryInvariant.h>
 #include <xrpl/tx/invariants/FreezeInvariant.h>
 #include <xrpl/tx/invariants/LoanBrokerInvariant.h>
@@ -483,6 +484,7 @@ using InvariantChecks = std::tuple<
     ValidAmounts,
     ValidMPTTransfer,
     ObjectHasPseudoAccount,
+    ValidTransactionProposal,
     SponsorshipOwnerCountsMatch,
     SponsorshipAccountCountMatchesField>;
 

include/xrpl/tx/transactors/escrow/EscrowCreate.h

@@ -20,11 +20,14 @@ public:
     {
     }
 
+    static bool
+    checkExtraFeatures(PreflightContext const& ctx);
+
     static TxConsequences
     makeTxConsequences(PreflightContext const& ctx);
 
-    static bool
-    checkExtraFeatures(PreflightContext const& ctx);
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
 
     static NotTEC
     preflight(PreflightContext const& ctx);

include/xrpl/tx/transactors/lending/LoanManage.h

@@ -5,6 +5,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/XRPAmount.h>
@@ -45,9 +46,29 @@ public:
         SLE::Ref loanSle,
         SLE::Ref brokerSle,
         SLE::Ref vaultSle,
-        Asset const& vaultAsset,
         beast::Journal j);
 
+    /**
+     * @brief Compute the First-Loss Capital cover amount for a defaulted Loan on a FixedPrecision
+     * Vault, capped at the LoanBroker's CoverAvailable and floored so that AssetsAvailable + cover
+     * is exactly on its posterior grid.
+     *
+     * The LoanBroker absorbs the rounding. When CoverAvailable - cover needs finer digits than the
+     * broker's posterior grid, it rounds to nearest, as the broker's trust line does, so
+     * CoverAvailable can move by up to half a posterior ulp more or less than the cover. When the
+     * two grids differ, no cover is exact on both sides; the Vault side is kept exact.
+     *
+     * The one exception: when AssetsAvailable has digits finer than the 16-digit cover can carry,
+     * no cover cancels them, and the balance writer rounds AssetsAvailable + cover to nearest,
+     * by at most half a posterior ulp. VaultDeposit and LoanPay credits have the same limit.
+     * @param loanSle The Loan being defaulted.
+     * @param brokerSle The Loan's LoanBroker.
+     * @param vaultSle The LoanBroker's Vault.
+     * @return The cover amount, in the Vault's Asset.
+     */
+    static STAmount
+    calculateDefaultCover(SLE::Ref loanSle, SLE::Ref brokerSle, SLE::Ref vaultSle);
+
     /**
      * Helper function that might be needed by other transactors
      */

include/xrpl/tx/transactors/system/Change.h

@@ -52,6 +52,13 @@ private:
     TER
     applyFee();
 
+    /**
+     * Write the default Feature Extension fee settings into FeeSettings on
+     * `featureSmartEscrow` activation.
+     */
+    void
+    initializeVMFees();
+
     TER
     applyUNLModify();
 };

src/libxrpl/ledger/Ledger.cpp

@@ -200,11 +200,23 @@ Ledger::Ledger(
                 sle->at(sfReserveIncrement) = *f;
             sle->at(sfReferenceFeeUnits) = kFeeUnitsDeprecated;
         }
+        if (std::ranges::find(amendments, featureSmartEscrow) != amendments.end())
+        {
+            sle->at(sfGasLimit) = fees.gasLimit;
+            sle->at(sfBytecodeSizeLimit) = fees.bytecodeSizeLimit;
+            sle->at(sfGasPrice) = fees.gasPrice;
+        }
         rawInsert(sle);
     }
 
     stateMap_.flushDirty(NodeObjectType::AccountNode);
-    setImmutable();
+    // Built locally. See Ledger::setImmutable().
+    if (!setImmutable())
+    {
+        // LCOV_EXCL_START
+        logicError("Ledger::Ledger(CreateGenesisT, ...): genesis ledger map is invalid");
+        // LCOV_EXCL_STOP
+    }
 }
 
 Ledger::Ledger(
@@ -215,7 +227,7 @@ Ledger::Ledger(
     Fees const& fees,
     Family& family,
     beast::Journal j)
-    : immutable_(true)
+    : immutable_(false)
     , txMap_(SHAMapType::TRANSACTION, info.txHash, family)
     , stateMap_(SHAMapType::STATE, info.accountHash, family)
     , fees_(fees)
@@ -238,8 +250,20 @@ Ledger::Ledger(
         JLOG(j.warn()) << "Don't have state data root for ledger" << header_.seq;
     }
 
-    txMap_.setImmutable();
-    stateMap_.setImmutable();
+    // Loaded locally. See Ledger::setImmutable().
+    if (setMapsImmutable())
+    {
+        immutable_ = true;
+    }
+    else
+    {
+        // LCOV_EXCL_START
+        JLOG(j.error()) << "Invalid map for ledger " << header_.seq;
+        UNREACHABLE("xrpl::Ledger::Ledger(LedgerHeader const&, ...) : map is invalid");
+        // Treat it as a damaged ledger: the code below recomputes the hash and re-acquires.
+        loaded = false;
+        // LCOV_EXCL_STOP
+    }
 
     if (!setup())
         loaded = false;
@@ -310,27 +334,50 @@ Ledger::Ledger(
     setup();
 }
 
-void
+bool
 Ledger::setImmutable(bool rehash)
 {
-    // Force update, since this is the only
-    // place the hash transitions to valid
-    if (!immutable_ && rehash)
+    // A map found structurally invalid during sync must never be made immutable: isValid() tests
+    // only for Invalid, and an immutable ledger is treated as persistable. Asked before anything is
+    // written, so a refusal leaves the header exactly as it was rather than half relabeled.
+    if (!mapsValid())
+        return false;
+
+    // Read here but written to the header below, once the maps are settled: getHash() can unshare a
+    // dirty tree, so it has to run while the map is still mutable, while a write to the header must
+    // wait until both maps have made it. Skipped once the ledger is immutable, since its maps can
+    // no longer change.
+    bool const deriveMapHashes = !immutable_ && rehash;
+    UInt256 const txHash = deriveMapHashes ? txMap_.getHash().asUInt256() : UInt256{};
+    UInt256 const accountHash = deriveMapHashes ? stateMap_.getHash().asUInt256() : UInt256{};
+
+    // Both were valid at the check above, but a concurrent walk can invalidate one in between (see
+    // SHAMap::state_), so the result is checked. setInvalid() outranks Immutable and can land
+    // after both maps have been settled, so this narrows the window it guards.
+    bool const bothImmutable = setMapsImmutable();
+    SOMETIMES(!bothImmutable, "xrpl::Ledger::setImmutable : map invalidated while going immutable");
+    if (!bothImmutable)
+        return false;
+
+    // Written only now, so losing the race above leaves the header describing what the ledger was
+    // built from rather than a map that has since been abandoned. Forced rather than conditional,
+    // since this is the only place the hash transitions to valid.
+    if (deriveMapHashes)
     {
-        header_.txHash = txMap_.getHash().asUInt256();
-        header_.accountHash = stateMap_.getHash().asUInt256();
+        header_.txHash = txHash;
+        header_.accountHash = accountHash;
     }
 
     if (rehash)
         header_.hash = calculateLedgerHash(header_);
 
+    // Set last, so isImmutable() reports only a ledger whose maps are both immutable.
     immutable_ = true;
-    txMap_.setImmutable();
-    stateMap_.setImmutable();
     setup();
+    return true;
 }
 
-void
+bool
 Ledger::setAccepted(
     NetClock::time_point closeTime,
     NetClock::duration closeResolution,
@@ -342,7 +389,17 @@ Ledger::setAccepted(
     header_.closeTime = closeTime;
     header_.closeTimeResolution = closeResolution;
     header_.closeFlags = correctCloseTime ? 0 : kSLcfNoConsensusTime;
-    setImmutable();
+    // Built locally. See Ledger::setImmutable().
+    if (!setImmutable())
+    {
+        // LCOV_EXCL_START
+        JLOG(j_.error()) << "Invalid map for accepted ledger " << header_.seq;
+        UNREACHABLE("xrpl::Ledger::setAccepted : map is invalid");
+        return false;
+        // LCOV_EXCL_STOP
+    }
+
+    return true;
 }
 
 bool
@@ -566,6 +623,7 @@ Ledger::setup()
         {
             bool oldFees = false;
             bool newFees = false;
+            bool extensionFees = false;
             {
                 auto const baseFee = sle->at(~sfBaseFee);
                 auto const reserveBase = sle->at(~sfReserveBase);
@@ -600,6 +658,20 @@ Ledger::setup()
                 assign(fees_.increment, reserveIncrementXRP);
                 newFees = baseFeeXRP || reserveBaseXRP || reserveIncrementXRP;
             }
+            {
+                auto const gasLimit = sle->at(~sfGasLimit);
+                auto const bytecodeSizeLimit = sle->at(~sfBytecodeSizeLimit);
+                auto const gasPrice = sle->at(~sfGasPrice);
+
+                // An absent field resolves to the protocol constant.
+                if (rules_.enabled(featureSmartEscrow))
+                {
+                    fees_.gasLimit = gasLimit.value_or(kDefaultGasLimit);
+                    fees_.bytecodeSizeLimit = bytecodeSizeLimit.value_or(kDefaultBytecodeSizeLimit);
+                    fees_.gasPrice = gasPrice.value_or(kDefaultGasPrice);
+                }
+                extensionFees = gasLimit || bytecodeSizeLimit || gasPrice;
+            }
             if (oldFees && newFees)
             {
                 // Should be all of one or the other, but not both
@@ -610,6 +682,12 @@ Ledger::setup()
                 // Can't populate the new fees before the amendment is enabled
                 ret = false;
             }
+            if (!rules_.enabled(featureSmartEscrow) && extensionFees)
+            {
+                // Can't populate the extension fees before the amendment is
+                // enabled
+                ret = false;
+            }
         }
     }
     catch (SHAMapMissingNode const&)

src/libxrpl/ledger/helpers/AGENTS.md

@@ -1,7 +0,0 @@
-# AGENTS.md — ledger/helpers
-
-A helper that takes an `SLE`/`std::shared_ptr<SLE const>` should `XRPL_ASSERT` that it's non-null and of the expected ledger-entry type at entry, and keep a real runtime check/error-return alongside the assert (asserts compile out in release builds) — the established idiom in this directory is `std::expected<..., TER>`, returning `std::unexpected(tec*)` on failure. Don't invent a new error-handling idiom for this.
-
-Prefer a single amendment-enabled block and a single disabled block over scattering `rules.enabled(...)` checks through a function, even if the two blocks are similar. When a file or function checks more than one amendment, name local enablement booleans per-amendment (e.g. `fix340Enabled` for `fixCleanup3_4_0`), not a generic `fixEnabled`.
-
-Only use `UNREACHABLE` for genuinely impossible paths, not to avoid writing a test for one that's reachable but rare. When a branch marked `UNREACHABLE` is excluded from coverage, wrap it in `LCOV_EXCL_START`/`LCOV_EXCL_STOP`.

src/libxrpl/ledger/helpers/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

src/libxrpl/ledger/helpers/LendingHelpers.cpp

@@ -130,8 +130,8 @@ creditToPosteriorBrokerCoverScale(
     }
 
     Number const reference = broker->at(sfCoverAvailable);
-    int const scale = detail::getPosteriorBrokerCoverScale(vault, broker, raw);
-    return detail::creditToPosteriorScale(asset, reference, scale, raw, roundingMode);
+    return detail::creditToPosteriorScale(
+        asset, reference, getVaultBaseScale(vault), raw, roundingMode);
 }
 
 [[nodiscard]] STAmount

src/libxrpl/ledger/helpers/ProposalHelpers.cpp

@@ -43,6 +43,9 @@ constexpr auto kProposalTxTypes = std::to_array<TxType>({
 bool
 isValidProposalTxnType(STObject const& proposedTx)
 {
+    if (!proposedTx.isFieldPresent(sfTransactionType))
+        return false;
+
     auto const type = proposedTx.getFieldU16(sfTransactionType);
 
     if (std::ranges::find(kProposalTxTypes, type) != kProposalTxTypes.end())

src/libxrpl/ledger/helpers/SponsorHelpers.cpp

@@ -4,6 +4,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/EscrowHelpers.h>
 #include <xrpl/ledger/helpers/OracleHelpers.h>
 #include <xrpl/ledger/helpers/ProposalHelpers.h>
 #include <xrpl/protocol/AccountID.h>
@@ -319,6 +320,8 @@ getLedgerEntryOwnerCount(SLE const& sle)
             UNREACHABLE("AccountRoots are not supported by object sponsorship.");
             return 0;
             // LCOV_EXCL_STOP
+        case ltESCROW:
+            return calculateAdditionalReserve(sle[~sfBytecode]);
         default:
             return 1;
     }

src/libxrpl/ledger/helpers/VaultHelpers.cpp

@@ -48,7 +48,7 @@ fixedBaseScale(SLE::ConstRef vault)
 }
 
 // Thin, vault-specific wrapper over posteriorAssetScale: used by
-// getPosteriorVaultScale and creditToPosteriorAvailableScale.
+// getPosteriorVaultScale and the cash outflow rounding below.
 [[nodiscard]] int
 posteriorScale(SLE::ConstRef vault, Number const& reference, Number const& delta)
 {
@@ -195,11 +195,11 @@ posteriorAssetScale(
 creditToPosteriorScale(
     Asset const& asset,
     Number const& reference,
-    int atScale,
+    int baseScale,
     Number const& raw,
     Number::RoundingMode roundingMode)
 {
-    // Floor the SUM (reference + raw), not just raw, at atScale. See
+    // Floor the SUM (reference + raw), not just raw. See
     // creditToPosteriorAvailableScale's doc: a delta floored on its own grid
     // can still leave a 17-digit sum once the reference has crossed a power
     // of ten.
@@ -208,9 +208,21 @@ creditToPosteriorScale(
     // than Number holds (the sum is on the posterior grid, the reference on
     // the finer one). Compute both under roundingMode, not the caller's
     // ambient mode, so the credit this returns never exceeds raw.
+    //
+    // Take the grid from this same sum. A sum just under a power of ten that
+    // rounds up to it in another mode would pick the coarser grid, and
+    // flooring the unrounded sum on it would land below reference.
     NumberRoundModeGuard const rg(roundingMode);
-    Number const flooredSum = roundToAsset(asset, reference + raw, atScale, roundingMode);
-    return STAmount{asset, flooredSum - reference};
+    Number const sum = reference + raw;
+    int const atScale = liveScale(sum, asset, baseScale);
+    Number const flooredSum = roundToAsset(asset, sum, atScale, roundingMode);
+    STAmount const credit{asset, flooredSum - reference};
+    XRPL_ASSERT_PARTS(
+        roundingMode != Number::RoundingMode::Downward ||
+            (credit >= beast::kZero && Number(credit) <= raw),
+        "xrpl::detail::creditToPosteriorScale",
+        "credit is between zero and raw");
+    return credit;
 }
 
 [[nodiscard]] int
@@ -399,8 +411,8 @@ creditToPosteriorAvailableScale(
     }
 
     Number const reference = vault->at(sfAssetsAvailable);
-    int const scale = posteriorScale(vault, reference, raw);
-    return detail::creditToPosteriorScale(asset, reference, scale, raw, roundingMode);
+    return detail::creditToPosteriorScale(
+        asset, reference, fixedBaseScale(vault), raw, roundingMode);
 }
 
 [[nodiscard]] Number

src/libxrpl/protocol/ConfidentialTransfer.cpp

@@ -435,18 +435,25 @@ areMirrorsCurrent(SLE const& issuance, SLE const& mptoken)
 }
 
 void
-setIssuerMirrorEpoch(SLE const& issuance, SLE& mptoken)
+setIssuerMirrorCurrent(SLE const& issuance, SLE& mptoken)
 {
     XRPL_ASSERT(
         issuance.getType() == ltMPTOKEN_ISSUANCE,
-        "xrpl::setIssuerMirrorEpoch : issuance MPTokenIssuance object");
+        "xrpl::setIssuerMirrorCurrent : issuance MPTokenIssuance object");
     XRPL_ASSERT(
-        mptoken.getType() == ltMPTOKEN, "xrpl::setIssuerMirrorEpoch : mptoken MPToken object");
+        mptoken.getType() == ltMPTOKEN, "xrpl::setIssuerMirrorCurrent : mptoken MPToken object");
 
     // Unlike the auditor mirror, the issuer mirror is not optional: every
     // confidential MPToken carries one, so there is no existence check here.
+    //
+    // Record the key and epoch under which the mirror is now encrypted. Both fields remain absent
+    // at epoch 0: such mirrors use the original issuer key. The original key is stored in
+    // sfInitialIssuerEncryptionKey after the first rotation.
     if (auto const epoch = issuance[~sfIssuerKeyEpoch].value_or(0); epoch != 0)
+    {
         mptoken[sfIssuerKeyMirrorEpoch] = epoch;
+        mptoken[sfIssuerMirrorEncryptionKey] = issuance[sfIssuerEncryptionKey];
+    }
 }
 
 void
@@ -466,9 +473,9 @@ setAuditorMirrorEpoch(SLE const& issuance, SLE& mptoken)
 }
 
 void
-setMirrorEpochs(SLE const& issuance, SLE& mptoken)
+setMirrorsCurrent(SLE const& issuance, SLE& mptoken)
 {
-    setIssuerMirrorEpoch(issuance, mptoken);
+    setIssuerMirrorCurrent(issuance, mptoken);
     setAuditorMirrorEpoch(issuance, mptoken);
 }
 

src/libxrpl/protocol/STPathSet.cpp

@@ -1,11 +1,10 @@
 #include <xrpl/protocol/STPathSet.h>
 
 #include <xrpl/basics/CountedObject.h>
-#include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/contract.h>
-#include <xrpl/beast/hash/uhash.h>
+#include <xrpl/basics/safe_cast.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
@@ -17,7 +16,9 @@
 #include <xrpl/protocol/jss.h>
 
 #include <algorithm>
-#include <cstddef>
+#include <concepts>
+#include <cstdint>
+#include <format>
 #include <memory>
 #include <stdexcept>
 #include <utility>
@@ -25,41 +26,6 @@
 
 namespace xrpl {
 
-std::size_t
-STPathElement::getHash(STPathElement const& element)
-{
-    std::size_t hashAccount = 2654435761;
-    std::size_t hashCurrency = 2654435761;
-    std::size_t hashIssuer = 2654435761;
-
-    // NIKB NOTE: This doesn't have to be a secure hash as speed is more
-    //            important. We don't even really need to fully hash the whole
-    //            base_uint here, as a few bytes would do for our use.
-    //
-    // The note above is only true because the result of this function reaches
-    // nothing but STPathElement::operator==, where it is a fast-reject
-    // prefilter ahead of the field comparisons that decide the answer.  Do not
-    // use it to key a container.
-
-    for (auto const x : element.getAccountID())
-        hashAccount += (hashAccount * 257) ^ x;
-
-    // Check pathAsset type instead of element's type_
-    // In some cases type_ might be account but the asset
-    // is still set to either MPT or currency (see Pathfinder::addLink())
-    element.getPathAsset().visit(
-        [&](MPTID const& mpt) { hashCurrency += beast::Uhash<>{}(mpt); },
-        [&](Currency const& currency) {
-            for (auto const x : currency)
-                hashCurrency += (hashCurrency * 509) ^ x;
-        });
-
-    for (auto const x : element.getIssuerID())
-        hashIssuer += (hashIssuer * 911) ^ x;
-
-    return (hashAccount ^ hashCurrency ^ hashIssuer);
-}
-
 // For guidance on deciding which option to pursue:
 // 1. Try to decrease the size of the STPathSet first.  For instance, if a std::optional was
 //    injected into the type, could you get the same functionality using a std::unique_ptr instead?
@@ -108,62 +74,57 @@ STPathSet::operator=(STPathSet const& other)
 STPathSet::STPathSet(SerialIter& sit, SField const& name) : STBase(name)
 {
     std::vector<STPathElement> path;
-    for (;;)
-    {
-        int const iType = sit.get8();
 
-        if (iType == STPathElement::TypeNone || iType == STPathElement::TypeBoundary)
+    STPathElementType type = STPathElementType::None;
+
+    do
+    {
+        type = safeCast<STPathElementType>(sit.get8());
+
+        if (type == STPathElementType::None || type == STPathElementType::Boundary)
         {
             if (path.empty())
-            {
-                JLOG(debugLog().error()) << "Empty path in pathset";
-                Throw<std::runtime_error>("empty path");
-            }
+                Throw<std::runtime_error>("bad path element: empty path");
 
             // Move rather than converting the vector to an STPath by copy.
             value_.emplace_back(std::move(path));
             path.clear();
 
-            if (iType == STPathElement::TypeNone)
-                return;
+            continue;
         }
-        else if ((iType & ~STPathElement::TypeAll) != 0)
-        {
-            JLOG(debugLog().error()) << "Bad path element " << iType << " in pathset";
-            Throw<std::runtime_error>("bad path element");
-        }
-        else
-        {
-            auto const hasAccount = (iType & STPathElement::TypeAccount) != 0u;
-            auto const hasCurrency = (iType & STPathElement::TypeCurrency) != 0u;
-            auto const hasIssuer = (iType & STPathElement::TypeIssuer) != 0u;
-            auto const hasMPT = (iType & STPathElement::TypeMpt) != 0u;
 
-            AccountID account;
-            PathAsset asset;
-            AccountID issuer;
+        if ((type & ~STPathElementType::All) != STPathElementType::None)
+            Throw<std::runtime_error>(
+                std::format("bad path element: <{:#04x}>", std::to_underlying(type)));
 
-            if (hasAccount)
-                account = sit.get160();
+        bool const hasAccount = (type & STPathElementType::Account) == STPathElementType::Account;
+        bool const hasCurrency =
+            (type & STPathElementType::Currency) == STPathElementType::Currency;
+        bool const hasMPT = (type & STPathElementType::Mpt) == STPathElementType::Mpt;
+        bool const hasIssuer = (type & STPathElementType::Issuer) == STPathElementType::Issuer;
 
-            if (hasCurrency && hasMPT)
-            {
-                JLOG(debugLog().error()) << "Bad path element MPT and Currency in pathset";
-                Throw<std::runtime_error>("bad path element: MPT and Currency");
-            }
+        if (hasCurrency && hasMPT)
+            Throw<std::runtime_error>("bad path element: MPT and Currency");
 
-            if (hasCurrency)
-                asset = Currency::fromRaw(sit.get160());
+        AccountID account;
+        PathAsset asset;
+        AccountID issuer;
 
-            if (hasMPT)
-                asset = sit.get192();
+        if (hasAccount)
+            account = sit.get160();
 
-            if (hasIssuer)
-                issuer = sit.get160();
+        if (hasCurrency)
+            asset = Currency::fromRaw(sit.get160());
 
-            path.emplace_back(account, asset, issuer, hasCurrency || hasMPT);
-        }
-    }
+        if (hasMPT)
+            asset = sit.get192();
+
+        if (hasIssuer)
+            issuer = sit.get160();
+
+        path.emplace_back(account, asset, issuer, hasCurrency || hasMPT);
+
+    } while (type != STPathElementType::None);
 }
 
 STBase*
@@ -217,24 +178,22 @@ STPath::getJson(JsonOptions) const
     for (auto const& it : path_)
     {
         json::Value elem(json::ValueType::Object);
-        auto const iType = it.getNodeType();
 
-        elem[jss::type] = iType;
+        elem[jss::type] = safeCast<std::uint32_t>(it.getNodeType());
 
-        if ((iType & STPathElement::TypeAccount) != 0u)
+        if (it.isType(STPathElementType::Account))
             elem[jss::account] = to_string(it.getAccountID());
 
         XRPL_ASSERT(
-            ((iType & STPathElement::TypeCurrency) == 0u) ||
-                ((iType & STPathElement::TypeMpt) == 0u),
+            !(it.hasCurrency() && it.hasMPT()),
             "xrpl::STPath::getJson : not type Currency and MPT");
-        if ((iType & STPathElement::TypeCurrency) != 0u)
+        if (it.hasCurrency())
             elem[jss::currency] = to_string(it.getCurrency());
 
-        if ((iType & STPathElement::TypeMpt) != 0u)
+        if (it.hasMPT())
             elem[jss::mpt_issuance_id] = to_string(it.getMPTID());
 
-        if ((iType & STPathElement::TypeIssuer) != 0u)
+        if (it.hasIssuer())
             elem[jss::issuer] = to_string(it.getIssuerID());
 
         ret.append(elem);
@@ -266,34 +225,42 @@ STPathSet::add(Serializer& s) const
     XRPL_ASSERT(getFName().fieldType == STI_PATHSET, "xrpl::STPathSet::add : valid field type");
     bool first = true;
 
+    // Workaround, since `Serializer` does not accept strongly-typed enums
+    // yet. When support is added, the static_assert will trigger, and the
+    // lambda can be removed entirely.
+    auto const toByte = [](std::same_as<STPathElementType> auto t) noexcept {
+        static_assert(
+            !requires(Serializer& ser) { ser.add8(t); },
+            "Serializer::add8 now accepts STPathElementType directly; remove toByte.");
+        return std::to_underlying(t);
+    };
+
     for (auto const& spPath : value_)
     {
         if (!first)
-            s.add8(STPathElement::TypeBoundary);
+            s.add8(toByte(STPathElementType::Boundary));
 
         for (auto const& speElement : spPath)
         {
-            int const iType = speElement.getNodeType();
+            s.add8(toByte(speElement.getNodeType()));
 
-            s.add8(iType);
-
-            if ((iType & STPathElement::TypeAccount) != 0u)
+            if (speElement.isType(STPathElementType::Account))
                 s.addBitString(speElement.getAccountID());
 
-            if ((iType & STPathElement::TypeMpt) != 0u)
+            if (speElement.hasMPT())
                 s.addBitString(speElement.getMPTID());
 
-            if ((iType & STPathElement::TypeCurrency) != 0u)
+            if (speElement.hasCurrency())
                 s.addBitString(speElement.getCurrency());
 
-            if ((iType & STPathElement::TypeIssuer) != 0u)
+            if (speElement.hasIssuer())
                 s.addBitString(speElement.getIssuerID());
         }
 
         first = false;
     }
 
-    s.add8(STPathElement::TypeNone);
+    s.add8(toByte(STPathElementType::None));
 }
 
 }  // namespace xrpl

src/libxrpl/protocol/TER.cpp

@@ -137,6 +137,8 @@ transResults()
         MAKE_ERROR(tefBAD_PATH_COUNT,              "Malformed: Too many paths."),
         MAKE_ERROR(tefNO_BYTECODE,                 "There is no WASM code to run, but a WASM-specific field was included."),
         MAKE_ERROR(tefBYTECODE_NOT_INCLUDED,       "WASM code requires a field that was not included."),
+        MAKE_ERROR(tefTEMP_DISABLED,               "The transaction requires logic that is currently temporarily disabled."),
+        MAKE_ERROR(tefEXCEEDS_LIMIT,               "The transaction exceeds a limit set by fee voting."),
 
         MAKE_ERROR(telLOCAL_ERROR,            "Local failure."),
         MAKE_ERROR(telBAD_DOMAIN,             "Domain too long."),
@@ -209,7 +211,6 @@ transResults()
         MAKE_ERROR(temINVALID_INNER_BATCH,       "Malformed: Invalid inner batch transaction."),
         MAKE_ERROR(temBAD_CIPHERTEXT,            "Malformed: Invalid ciphertext."),
         MAKE_ERROR(temINVALID_BYTECODE,          "Malformed: Provided byte code is invalid."),
-        MAKE_ERROR(temTEMP_DISABLED,             "The transaction requires logic that is currently temporarily disabled."),
 
         MAKE_ERROR(terRETRY,                  "Retry transaction."),
         MAKE_ERROR(terFUNDS_SPENT,            "DEPRECATED."),

src/libxrpl/shamap/SHAMap.cpp

@@ -26,6 +26,7 @@
 
 #include <boost/smart_ptr/intrusive_ptr.hpp>
 
+#include <atomic>
 #include <cstdint>
 #include <exception>
 #include <functional>
@@ -77,14 +78,23 @@ SHAMap::SHAMap(SHAMap const& other, bool isMutable)
     : f_(other.f_)
     , journal_(other.f_.journal())
     , cowid_(other.cowid_ + 1)
-    , ledgerSeq_(other.ledgerSeq_)
+    , ledgerSeq_(other.ledgerSeq())
     , root_(other.root_)
-    , state_(isMutable ? SHAMapState::Modifying : SHAMapState::Immutable)
     , type_(other.type_)
     , backed_(other.backed_)
 {
+    // A snapshot shares the source's root, so Invalid carries over. Read once into a local, since
+    // the source's state can change while this runs.
+    auto const otherState = other.state();
+    auto const ownState = [&] {
+        if (otherState == SHAMapState::Invalid)
+            return SHAMapState::Invalid;
+        return isMutable ? SHAMapState::Modifying : SHAMapState::Immutable;
+    }();
+    state_.store(ownState, std::memory_order_release);
+
     // If either map may change, they cannot share nodes
-    if ((state_ != SHAMapState::Immutable) || (other.state_ != SHAMapState::Immutable))
+    if ((ownState != SHAMapState::Immutable) || (otherState != SHAMapState::Immutable))
     {
         unshare();
     }
@@ -105,7 +115,7 @@ SHAMap::dirtyUp(NodePathStack& stack, UInt256 const& target, SHAMapTreeNodePtr c
     // child can be an inner node or a leaf
 
     XRPL_ASSERT(
-        (state_ != SHAMapState::Synching) && (state_ != SHAMapState::Immutable),
+        (state() != SHAMapState::Synching) && (state() != SHAMapState::Immutable),
         "xrpl::SHAMap::dirtyUp : valid state");
     XRPL_ASSERT(child && (child->cowid() == cowid_), "xrpl::SHAMap::dirtyUp : valid child input");
 
@@ -170,7 +180,7 @@ SHAMapTreeNodePtr
 SHAMap::fetchNodeFromDB(SHAMapHash const& hash) const
 {
     XRPL_ASSERT(backed_, "xrpl::SHAMap::fetchNodeFromDB : is backed");
-    auto const obj = f_.db().fetchNodeObject(hash.asUInt256(), ledgerSeq_);
+    auto const obj = f_.db().fetchNodeObject(hash.asUInt256(), ledgerSeq());
     return finishFetch(hash, obj);
 }
 
@@ -183,10 +193,17 @@ SHAMap::finishFetch(SHAMapHash const& hash, std::shared_ptr<NodeObject> const& o
     {
         if (!object)
         {
-            if (full_)
+            // A missing node disproves full_, so withdraw it and report the gap. The exchange
+            // makes exactly one reader report it, and its acquire pairs with the release store in
+            // setFull(). It needs no release: the only other reader of full_ is this same path,
+            // and a reader that loses the exchange does nothing with what the winner did. The load
+            // ahead of it is relaxed, since all it decides is whether to try the exchange: a stale
+            // true costs one exchange that loses, and a stale false means another reader won, or
+            // setFull() is not visible yet and the gap goes unreported.
+            if (full_.load(std::memory_order_relaxed) &&
+                full_.exchange(false, std::memory_order_acquire))
             {
-                full_ = false;
-                f_.missingNodeAcquireBySeq(ledgerSeq_, hash.asUInt256());
+                f_.missingNodeAcquireBySeq(ledgerSeq(), hash.asUInt256());
             }
             return {};
         }
@@ -219,7 +236,7 @@ SHAMap::checkFilter(SHAMapHash const& hash, SHAMapSyncFilter const* filter) cons
             auto node = SHAMapTreeNode::makeFromPrefix(makeSlice(*nodeData), hash);
             if (node)
             {
-                filter->gotNode(true, hash, ledgerSeq_, std::move(*nodeData), node->getType());
+                filter->gotNode(true, hash, ledgerSeq(), std::move(*nodeData), node->getType());
                 if (backed_)
                     canonicalize(hash, node);
             }
@@ -399,7 +416,7 @@ SHAMap::descendAsync(
         {
             f_.db().asyncFetch(
                 hash.asUInt256(),
-                ledgerSeq_,
+                ledgerSeq(),
                 [this, hash, cb{std::move(callback)}](std::shared_ptr<NodeObject> const& object) {
                     auto const node = finishFetch(hash, object);
                     cb(node, hash);
@@ -424,7 +441,7 @@ SHAMap::unshareNode(intr_ptr::SharedPtr<Node> node, SHAMapNodeID const& nodeID)
     if (node->cowid() != cowid_)
     {
         // have a CoW
-        XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::unshareNode : not immutable");
+        XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::unshareNode : not immutable");
         node = intr_ptr::staticPointerCast<Node>(node->clone(cowid_));
         if (nodeID.isRoot())
             root_ = node;
@@ -637,7 +654,7 @@ bool
 SHAMap::delItem(UInt256 const& id)
 {
     // delete the item with this ID
-    XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::delItem : not immutable");
+    XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::delItem : not immutable");
 
     NodePathStack stack;
     walkTowardsKey(id, &stack);
@@ -719,7 +736,7 @@ SHAMap::delItem(UInt256 const& id)
 bool
 SHAMap::addGiveItem(SHAMapNodeType type, boost::intrusive_ptr<SHAMapItem const> item)
 {
-    XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::addGiveItem : not immutable");
+    XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::addGiveItem : not immutable");
     XRPL_ASSERT(type != SHAMapNodeType::TnInner, "xrpl::SHAMap::addGiveItem : valid type input");
 
     // add the specified item, does not update
@@ -810,7 +827,7 @@ SHAMap::updateGiveItem(SHAMapNodeType type, boost::intrusive_ptr<SHAMapItem cons
     // can't change the tag but can change the hash
     UInt256 const tag = item->key();
 
-    XRPL_ASSERT(state_ != SHAMapState::Immutable, "xrpl::SHAMap::updateGiveItem : not immutable");
+    XRPL_ASSERT(state() != SHAMapState::Immutable, "xrpl::SHAMap::updateGiveItem : not immutable");
 
     NodePathStack stack;
     walkTowardsKey(tag, &stack);
@@ -901,7 +918,7 @@ SHAMap::writeNode(NodeObjectType t, SHAMapTreeNodePtr node) const
 
     Serializer s;
     node->serializeWithPrefix(s);
-    f_.db().store(t, std::move(s.modData()), node->getHash().asUInt256(), ledgerSeq_);
+    f_.db().store(t, std::move(s.modData()), node->getHash().asUInt256(), ledgerSeq());
     return node;
 }
 

src/libxrpl/shamap/SHAMapInnerNode.cpp

@@ -16,6 +16,7 @@
 #include <xrpl/shamap/detail/TaggedPointer.h>
 #include <xrpl/shamap/detail/TaggedPointer.ipp>
 
+#include <atomic>
 #include <cstddef>
 #include <cstdint>
 #include <mutex>
@@ -77,7 +78,9 @@ SHAMapInnerNode::clone(std::uint32_t cowid) const
     auto p = intr_ptr::makeShared<SHAMapInnerNode>(cowid, branchCount);
     p->hash_ = hash_;
     p->isBranch_ = isBranch_;
-    p->fullBelowGen_ = fullBelowGen_;
+    // Relaxed, as everywhere. p is not reachable by another thread until this returns.
+    p->fullBelowGen_.store(
+        fullBelowGen_.load(std::memory_order_relaxed), std::memory_order_relaxed);
     SHAMapHash* cloneHashes = nullptr;
     SHAMapHash* thisHashes = nullptr;
     SHAMapTreeNodePtr* cloneChildren = nullptr;

src/libxrpl/shamap/SHAMapSync.cpp

@@ -31,6 +31,25 @@
 
 namespace xrpl {
 
+namespace {
+
+/**
+ * Whether a depth is at or past the deepest an inner node may occupy.
+ *
+ * Nibbles run out at SHAMap::kLeafDepth, so only a leaf may sit there. True for
+ * every deeper position too, which lies past the end of a key.
+ *
+ * @param depth The depth to judge.
+ * @return Whether an inner node at that depth makes the map impossible.
+ */
+[[nodiscard]] bool
+isLeafDepth(unsigned int depth)
+{
+    return depth >= SHAMap::kLeafDepth;
+}
+
+}  // namespace
+
 void
 SHAMap::visitLeaves(
     std::function<void(boost::intrusive_ptr<SHAMapItem const> const& item)> const& leafFunction)
@@ -143,13 +162,10 @@ SHAMap::visitDifferences(
         if (!function(*node))
             return;
 
-        // Nibbles run out at kLeafDepth, so only a leaf belongs there. A well-formed map never
-        // holds an inner node at that depth: addKnownNode marks the map invalid rather than hooking
-        // one in, and fetch-pack data is hash-verified against a validated root, so reaching this
-        // means a defect or a corrupt store, not something a peer can provoke. Report the node
-        // anyway - the wire form carries no depth, and the recipient hooks blobs in by hash - but
-        // skip the children rather than letting getChildNodeID throw on them.
-        if (nodeID.getDepth() >= kLeafDepth)
+        // Only a leaf belongs at kLeafDepth. The node is still reported, since the wire form
+        // carries no depth and the recipient hooks blobs by hash. Its children are skipped, since
+        // getChildNodeID has no answer past kLeafDepth.
+        if (isLeafDepth(nodeID.getDepth()))
         {
             // LCOV_EXCL_START
             UNREACHABLE("xrpl::SHAMap::visitDifferences : inner node at leaf depth");
@@ -207,7 +223,12 @@ SHAMap::gmnProcessNodes(MissingNodes& mn, MissingNodes::StackEntry& se)
             // we already know this child node is missing
             fullBelow = false;
         }
-        else if (!backed_ || !f_.getFullBelowCache()->touchIfExists(childHash.asUInt256()))
+        // The depth test precedes the cache lookup for the same reason it does in addKnownNode():
+        // the cache is keyed by node hash and shared across maps, and a hash covers a node's
+        // children but not its depth. Skipping the shortcut forgoes an optimization only.
+        else if (
+            !backed_ || isLeafDepth(nodeID.getDepth() + 1) ||
+            !f_.getFullBelowCache()->touchIfExists(childHash.asUInt256()))
         {
             bool pending = false;
             auto d = descendAsync(
@@ -238,6 +259,17 @@ SHAMap::gmnProcessNodes(MissingNodes& mn, MissingNodes::StackEntry& se)
                 if (--mn.max <= 0)
                     return;
             }
+            else if (d->isInner() && isLeafDepth(nodeID.getDepth() + 1))
+            {
+                // Only a leaf belongs that deep (see isLeafDepth and SHAMap::addKnownNode). A node
+                // resolved locally reaches the walk without passing through addKnownNode(), so the
+                // walk reaches this verdict itself. Ordered ahead of the full-below test below,
+                // which canonicalization shares across maps.
+                JLOG(journal_.warn()) << "Inner node at branch " << branch << " below " << nodeID
+                                      << " makes the map invalid";
+                setInvalid();
+                return;
+            }
             else if (d->isInner() && !safeDowncast<SHAMapInnerNode*>(d)->isFullBelow(mn.generation))
             {
                 mn.stack.push(se);
@@ -301,6 +333,8 @@ SHAMap::gmnProcessDeferredReads(MissingNodes& mn)
         }
         else if ((mn.max > 0) && mn.missingHashes.insert(nodeHash).second)
         {
+            // getChildNodeID() is safe here: gmnProcessNodes refuses to descend into an inner node
+            // at kLeafDepth, so a deferred parent sits at most one level above it.
             mn.missingNodes.emplace_back(parentID.getChildNodeID(branch), nodeHash.asUInt256());
             --mn.max;
         }
@@ -311,17 +345,20 @@ SHAMap::gmnProcessDeferredReads(MissingNodes& mn)
     mn.deferred = 0;
 }
 
-/**
- * Get a list of node IDs and hashes for nodes that are part of this SHAMap
- * but not available locally.  The filter can hold alternate sources of
- * nodes that are not permanently stored locally
- */
 std::vector<std::pair<SHAMapNodeID, UInt256>>
 SHAMap::getMissingNodes(int max, SHAMapSyncFilter const* filter)
 {
     XRPL_ASSERT(root_->getHash().isNonZero(), "xrpl::SHAMap::getMissingNodes : nonzero root hash");
     XRPL_ASSERT(max > 0, "xrpl::SHAMap::getMissingNodes : valid max input");
 
+    if (!isValid())
+    {
+        // The root node's own hash, since getHash() unshares the tree on a zero hash.
+        JLOG(journal_.warn()) << "getMissingNodes called on an invalid map, root hash "
+                              << root_->getHash() << " seq " << ledgerSeq();
+        return {};
+    }
+
     MissingNodes mn(
         max,
         filter,
@@ -354,6 +391,11 @@ SHAMap::getMissingNodes(int max, SHAMapSyncFilter const* filter)
         {
             gmnProcessNodes(mn, pos);
 
+            // The walk just invalidated the map. The loop stops descending here but falls through
+            // to the drain below, since every posted read must be drained while `mn` is alive.
+            if (!isValid())
+                break;
+
             if (mn.max <= 0)
                 break;
 
@@ -383,6 +425,11 @@ SHAMap::getMissingNodes(int max, SHAMapSyncFilter const* filter)
         if (mn.deferred != 0)
             gmnProcessDeferredReads(mn);
 
+        // Reads are drained, so the map can be abandoned. What was collected belongs to a tree
+        // that cannot exist.
+        if (!isValid())
+            return {};
+
         if (mn.max <= 0)
             return std::move(mn.missingNodes);
 
@@ -416,6 +463,11 @@ SHAMap::getMissingNodes(int max, SHAMapSyncFilter const* filter)
 
     } while (node != nullptr);
 
+    // addKnownNode() on another thread can write the verdict after the loop's own test, so the map
+    // is judged once more before the result is returned.
+    if (!isValid())
+        return {};  // LCOV_EXCL_LINE: only that other thread reaches this, so no test does
+
     if (mn.missingNodes.empty())
         clearSynching();
 
@@ -527,11 +579,19 @@ SHAMap::addRootNode(
     XRPL_ASSERT(cowid_ >= 1, "xrpl::SHAMap::addRootNode : valid cowid");
     XRPL_ASSERT(rootNode, "xrpl::SHAMap::addRootNode : non-null root node");
 
-    // we already have a root_ node
+    // A map syncs against one hash and installs a root once, so a root already held is a duplicate
+    // only once it hashes to the hash asked for.
     if (root_->getHash().isNonZero())
     {
         JLOG(journal_.trace()) << "Got root node, already have one";
-        XRPL_ASSERT(root_->getHash() == hash, "xrpl::SHAMap::addRootNode : valid hash");
+
+        if (root_->getHash() != hash)
+        {
+            JLOG(journal_.warn()) << "Root node offered under hash " << hash
+                                  << ", but the map holds " << root_->getHash();
+            return SHAMapAddNode::invalid();
+        }
+
         return SHAMapAddNode::duplicate();
     }
 
@@ -555,7 +615,7 @@ SHAMap::addRootNode(
         Serializer s;
         root_->serializeWithPrefix(s);
         filter->gotNode(
-            false, root_->getHash(), ledgerSeq_, std::move(s.modData()), root_->getType());
+            false, root_->getHash(), ledgerSeq(), std::move(s.modData()), root_->getType());
     }
 
     return SHAMapAddNode::useful();
@@ -598,7 +658,13 @@ SHAMap::addKnownNode(
         }
 
         auto childHash = inner->getChildHash(branch);
-        if (f_.getFullBelowCache()->touchIfExists(childHash.asUInt256()))
+
+        // Depth before the cache: the cache is keyed by node hash and shared across the family, and
+        // a hash covers a node's children but not its depth, so the same subtree can be cached as
+        // complete at one depth and reached at another. Skipping the shortcut only forgoes an
+        // optimization.
+        if (!isLeafDepth(currNodeID.getDepth() + 1) &&
+            f_.getFullBelowCache()->touchIfExists(childHash.asUInt256()))
         {
             return SHAMapAddNode::duplicate();
         }
@@ -616,25 +682,32 @@ SHAMap::addKnownNode(
             return SHAMapAddNode::invalid();
         }
 
-        // Inner nodes must be at a level strictly less than 64
-        // but leaf nodes (while notionally at level 64) can be
-        // at any depth up to and including 64:
-        if ((currNodeID.getDepth() > kLeafDepth) ||
-            (treeNode->isInner() && currNodeID.getDepth() == kLeafDepth))
+        // Only leaves may sit at kLeafDepth (see isLeafDepth), so an inner node there makes the map
+        // impossible. The node is reported as bad data.
+        //
+        // Every node from the root down hash-verified to get here, so it is the requested root hash
+        // itself that commits to a shape no valid tree can have. The verdict belongs to that hash
+        // rather than to our copy of the tree.
+        bool const badDepth = treeNode->isInner() && isLeafDepth(currNodeID.getDepth());
+        SOMETIMES(badDepth, "xrpl::SHAMap::addKnownNode : map is invalid");
+        if (badDepth)
         {
-            // Map is provably invalid
-            state_ = SHAMapState::Invalid;
-            return SHAMapAddNode::useful();
+            JLOG(journal_.warn()) << "Node " << nodeID << " makes the map invalid at "
+                                  << currNodeID;
+            setInvalid();
+            return SHAMapAddNode::invalid();
         }
 
-        if (currNodeID != nodeID)
+        // The data hashes to the child at currNodeID but claims to belong at nodeID, so it is not
+        // the node that was asked for. Only the label is wrong, so the map stays sound and the node
+        // is still obtainable from another sender.
+        bool const badPosition = (currNodeID != nodeID);
+        SOMETIMES(badPosition, "xrpl::SHAMap::addKnownNode : node ID does not match its position");
+        if (badPosition)
         {
-            // Either this node is broken or we didn't request it (yet)
-            JLOG(journal_.warn()) << "unable to hook node " << nodeID;
-            JLOG(journal_.info()) << " stuck at " << currNodeID;
-            JLOG(journal_.info()) << "got depth=" << nodeID.getDepth()
-                                  << ", walked to= " << currNodeID.getDepth();
-            return SHAMapAddNode::useful();
+            JLOG(journal_.warn()) << "Unable to hook node " << nodeID << ", stuck at "
+                                  << currNodeID;
+            return SHAMapAddNode::invalid();
         }
 
         if (backed_)
@@ -647,7 +720,7 @@ SHAMap::addKnownNode(
             Serializer s;
             treeNode->serializeWithPrefix(s);
             filter->gotNode(
-                false, childHash, ledgerSeq_, std::move(s.modData()), treeNode->getType());
+                false, childHash, ledgerSeq(), std::move(s.modData()), treeNode->getType());
         }
 
         return SHAMapAddNode::useful();
@@ -766,7 +839,7 @@ SHAMap::hasLeafNode(UInt256 const& tag, SHAMapHash const& targetNodeHash) const
         // Same kLeafDepth hazard as in visitDifferences above. That guard bounds the caller's own
         // traversal, not the map queried here, and the loop below descends from this map's root
         // independently, so this check is what keeps a malformed map from reaching getChildNodeID.
-        if (nodeID.getDepth() >= kLeafDepth)
+        if (isLeafDepth(nodeID.getDepth()))
         {
             // LCOV_EXCL_START
             UNREACHABLE("xrpl::SHAMap::hasLeafNode : inner node at leaf depth");
@@ -849,8 +922,8 @@ SHAMap::verifyProofPath(UInt256 const& rootHash, UInt256 const& key, std::vector
                 // there. These nodes come off the wire, so a peer can still claim an inner one;
                 // reject it rather than passing this depth to selectBranch.
                 SOMETIMES(
-                    depth >= kLeafDepth, "xrpl::SHAMap::verifyProofPath : inner at leaf depth");
-                if (depth >= kLeafDepth)
+                    isLeafDepth(depth), "xrpl::SHAMap::verifyProofPath : inner at leaf depth");
+                if (isLeafDepth(depth))
                     return false;
 
                 auto const nodeId = SHAMapNodeID::createID(depth, key);
@@ -859,10 +932,9 @@ SHAMap::verifyProofPath(UInt256 const& rootHash, UInt256 const& key, std::vector
             }
             else
             {
-                // The hash chain up to rootHash only proves this leaf sits where the path claims,
-                // not that it is the leaf for `key`: a peer could substitute any other leaf whose
-                // subtree hashes to the same value at every level above it. Checking the terminal
-                // leaf's own key is what ties the proof to `key` specifically.
+                // The hash chain up to rootHash proves this leaf sits where the path claims. Any
+                // leaf whose subtree hashes the same at every level above satisfies that chain, so
+                // the terminal leaf's own key is what ties the proof to `key`.
                 if (leafKey(*node) != key)
                     return false;
 

src/libxrpl/tx/AGENTS.md

@@ -1,15 +1,5 @@
 # AGENTS.md — tx
 
-## When an amendment is required
+See the repo-level [AGENTS.md](../../../AGENTS.md) for general build/test/style guidance.
 
-A change needs an amendment if it affects transaction processing, ledger objects, or anything else about the binary format or hash of the ledger. An amendment is optional if a change only affects what transactions get proposed for consensus (e.g. fee escalation). Otherwise, don't use one.
-
-New amendments (and fixes, i.e. `fix*` amendments) are added to [`include/xrpl/protocol/detail/features.macro`](../../../include/xrpl/protocol/detail/features.macro), as an `XRPL_FEATURE(...)` or `XRPL_FIX(...)` entry added to the top of the list (the list is kept in reverse chronological order). Once the pre-amendment code path for a retired amendment is removed, move its entry to `XRPL_RETIRE_FEATURE(...)`/`XRPL_RETIRE_FIX(...)` instead of deleting it.
-
-When adding a new amendment or transaction type, check its interaction with: invariants, fees, Deposit Auth, Batch transaction inclusion/exclusion, Permission Delegation inclusion/exclusion, Freeze/Deep Freeze (IOU) and Lock (MPT), Clawback, Credentials and Permissioned Domain, the case where the submitting account is the asset's issuer, and numeric over/underflow. Stick to existing paradigms rather than inventing new ones — consistency between features matters more than a locally "better" design.
-
-New (or deleted) invariant checks must be amendment-gated: they introduce (or remove) a way for a transaction to fail, and an un-gated change risks validators disagreeing on a transaction's result, i.e. a network fork.
-
-See [transactors/AGENTS.md](./transactors/AGENTS.md) for conventions on writing the amendment-gated code itself.
-
-A change to transaction/signing behavior that's visible through the public API also needs an `API-CHANGELOG.md` entry — see [../../xrpld/rpc/AGENTS.md](../../xrpld/rpc/AGENTS.md) for the full rule.
+Any change to transaction-processing behavior must be gated behind an amendment. New amendments (and fixes, i.e. `fix*` amendments) are added to [`include/xrpl/protocol/detail/features.macro`](../../../include/xrpl/protocol/detail/features.macro), as an `XRPL_FEATURE(...)` or `XRPL_FIX(...)` entry added to the top of the list (the list is kept in reverse chronological order). Once the pre-amendment code path for a retired amendment is removed, move its entry to `XRPL_RETIRE_FEATURE(...)`/`XRPL_RETIRE_FIX(...)` instead of deleting it.

src/libxrpl/tx/ApplyContext.cpp

@@ -38,7 +38,7 @@ ApplyContext::ApplyContext(
     , parentBatchId_(parentBatchId)
 {
     XRPL_ASSERT(
-        parentBatchId.has_value() == ((flags_ & TapBatch) == TapBatch),
+        parentBatchId.has_value() == ((flags_ & ApplyFlags::Batch) == ApplyFlags::Batch),
         "Parent Batch ID should be set if batch apply flag is set");
     view_.emplace(&base_, flags_);
 }
@@ -53,13 +53,14 @@ std::optional<TxMeta>
 ApplyContext::apply(TER ter)
 {
     // NOLINTNEXTLINE(bugprone-unchecked-optional-access) view_ emplaced in constructor
-    return view_->apply(base_, tx, ter, parentBatchId_, (flags_ & TapDryRun) != 0u, journal);
+    return view_->apply(
+        base_, tx, ter, parentBatchId_, (flags_ & ApplyFlags::DryRun) != ApplyFlags::None, journal);
 }
 
 void
 ApplyContext::addOrderBook(Book const& book)
 {
-    if ((flags_ & TapDryRun) == TapNone)
+    if ((flags_ & ApplyFlags::DryRun) == ApplyFlags::None)
         registry.get().getOrderBookDB().addOrderBook(book);
 }
 

src/libxrpl/tx/Transactor.cpp

@@ -135,7 +135,7 @@ preflightCheckSigningKey(STObject const& sigObject, beast::Journal j)
 std::optional<NotTEC>
 preflightCheckSimulateKeys(ApplyFlags flags, STObject const& sigObject, beast::Journal j)
 {
-    if ((flags & TapDryRun) != 0u)  // simulation
+    if ((flags & ApplyFlags::DryRun) != ApplyFlags::None)  // simulation
     {
         std::optional<Slice> const signature = sigObject[~sfTxnSignature];
         if (signature && !signature->empty())
@@ -510,7 +510,8 @@ Transactor::minimumFee(
     Fees const& fees,
     ApplyFlags flags)
 {
-    return scaleFeeLoad(baseFee, registry.getFeeTrack(), fees, (flags & TapUnlimited) != 0u);
+    return scaleFeeLoad(
+        baseFee, registry.getFeeTrack(), fees, (flags & ApplyFlags::Unlimited) != ApplyFlags::None);
 }
 
 TER
@@ -521,7 +522,7 @@ Transactor::checkFee(PreclaimContext const& ctx, XRPAmount baseFee)
 
     auto const feePaid = ctx.tx[sfFee].xrp();
 
-    if ((ctx.flags & TapBatch) != 0u)
+    if ((ctx.flags & ApplyFlags::Batch) != ApplyFlags::None)
     {
         if (feePaid == beast::kZero)
             return tesSUCCESS;
@@ -984,7 +985,8 @@ Transactor::checkSign(
         return tesSUCCESS;
     }
 
-    if (((flags & TapDryRun) != 0u) && pkSigner.empty() && !sigObject.isFieldPresent(sfSigners))
+    if (((flags & ApplyFlags::DryRun) != ApplyFlags::None) && pkSigner.empty() &&
+        !sigObject.isFieldPresent(sfSigners))
     {
         // simulate: skip signature validation when neither SigningPubKey nor
         // Signers are provided
@@ -1155,7 +1157,7 @@ Transactor::checkMultiSign(
         }
 
         XRPL_ASSERT(
-            (flags & TapDryRun) || !spk.empty(),
+            (flags & ApplyFlags::DryRun) != ApplyFlags::None || !spk.empty(),
             "xrpl::Transactor::checkMultiSign : non-empty signer or "
             "simulation");
         AccountID const signingAcctIDFromPubKey =
@@ -1643,7 +1645,7 @@ Transactor::operator()()
         if (ctx_.size() > kOversizeMetaDataCap)
             result = tecOVERSIZE;
 
-        if (isTecClaim(result) && ((view().flags() & TapFailHard) != 0u))
+        if (isTecClaim(result) && ((view().flags() & ApplyFlags::FailHard) != ApplyFlags::None))
         {
             // If the TapFailHard flag is set, a tec result
             // must not do anything
@@ -1723,7 +1725,7 @@ Transactor::operator()()
     // Once we call apply, we will no longer be able to look at view()
     metadata = ctx_.apply(result);
 
-    if ((ctx_.flags() & TapDryRun) != 0u)
+    if ((ctx_.flags() & ApplyFlags::DryRun) != ApplyFlags::None)
         return logger(result, false, std::move(metadata));
 
     return logger(result, canApply, std::move(metadata));

src/libxrpl/tx/apply.cpp

@@ -215,7 +215,7 @@ applyBatchTransactions(
     auto const applyOneTransaction = [&registry, &j, &parentBatchId, &batchView](STTx const& tx) {
         OpenView perTxBatchView(kBatchView, batchView);
 
-        auto const ret = apply(registry, perTxBatchView, parentBatchId, tx, TapBatch, j);
+        auto const ret = apply(registry, perTxBatchView, parentBatchId, tx, ApplyFlags::Batch, j);
         XRPL_ASSERT(
             ret.applied == (isTesSuccess(ret.ter) || isTecClaim(ret.ter)),
             "Inner transaction should not be applied");
@@ -274,7 +274,7 @@ applyTransaction(
 {
     // Returns false if the transaction has need not be retried.
     if (retryAssured)
-        flags = flags | TapRetry;
+        flags = flags | ApplyFlags::Retry;
 
     JLOG(j.debug()) << "TXN " << txn.getTransactionID() << (retryAssured ? "/retry" : "/final");
 

src/libxrpl/tx/applySteps.cpp

@@ -31,6 +31,8 @@
 #include <xrpl/protocol/detail/transactions.macro>
 
 #undef TRANSACTION
+#undef TRANSACTION_INCLUDE
+
 #pragma pop_macro("TRANSACTION")
 
 // DO NOT INCLUDE TRANSACTOR HEADER FILES HERE.
@@ -346,7 +348,8 @@ preflight(
     // builds; re-check the same invariant here so a release build can't
     // silently skip a proposed transaction's signature-presence checks
     // outside of a dry run.
-    if ((flags & TapProposal) != TapNone && (flags & TapDryRun) == TapNone)
+    if ((flags & ApplyFlags::Proposal) != ApplyFlags::None &&
+        (flags & ApplyFlags::DryRun) == ApplyFlags::None)
     {
         // LCOV_EXCL_START
         JLOG(j.fatal()) << "apply (preflight): TapProposal set without TapDryRun.";
@@ -377,7 +380,8 @@ preflight(
     PreflightContext const pfCtx(registry, tx, parentBatchId, rules, flags, j);
 
     // See the comment in the other preflight() overload above.
-    if ((flags & TapProposal) != TapNone && (flags & TapDryRun) == TapNone)
+    if ((flags & ApplyFlags::Proposal) != ApplyFlags::None &&
+        (flags & ApplyFlags::DryRun) == ApplyFlags::None)
     {
         // LCOV_EXCL_START
         JLOG(j.fatal()) << "apply (preflight): TapProposal set without TapDryRun.";

src/libxrpl/tx/invariants/CosignerInvariant.cpp

@@ -0,0 +1,225 @@
+#include <xrpl/tx/invariants/CosignerInvariant.h>
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/SeqProxy.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+
+namespace xrpl {
+
+namespace {
+
+bool
+validSignerArray(STArray const& signers, std::size_t limit, SField const& elementName)
+{
+    if (signers.size() > limit)
+        return false;
+
+    std::optional<AccountID> previous;
+    for (auto const& signer : signers)
+    {
+        if (signer.getFName() != elementName || !signer.isFieldPresent(sfAccount))
+            return false;
+
+        auto const account = signer.getAccountID(sfAccount);
+        if (previous && account <= *previous)
+            return false;
+        previous = account;
+    }
+    return true;
+}
+
+bool
+validNestedSigners(STObject const& signature)
+{
+    return !signature.isFieldPresent(sfSigners) ||
+        validSignerArray(signature.getFieldArray(sfSigners), STTx::kMaxMultiSigners, sfSigner);
+}
+
+bool
+validSignerArrays(STObject const& proposedTx)
+{
+    if (!validNestedSigners(proposedTx))
+        return false;
+
+    for (auto const* field :
+         std::array<SField const*, 2>{&sfCounterpartySignature, &sfSponsorSignature})
+    {
+        if (proposedTx.isFieldPresent(*field) &&
+            !validNestedSigners(proposedTx.getFieldObject(*field)))
+            return false;
+    }
+
+    if (!proposedTx.isFieldPresent(sfBatchSigners))
+        return true;
+
+    auto const& batchSigners = proposedTx.getFieldArray(sfBatchSigners);
+    if (!validSignerArray(batchSigners, kMaxBatchSigners, sfBatchSigner))
+        return false;
+
+    return std::ranges::all_of(
+        batchSigners, [](auto const& batchSigner) { return validNestedSigners(batchSigner); });
+}
+
+// The Ticket a proposal is keyed to: the one its proposed transaction spends.
+uint256
+proposalTicketKey(SLE const& proposal)
+{
+    auto const& proposedTx = proposal.getFieldObject(sfProposedTransaction);
+    return keylet::ticket(
+               proposedTx.getAccountID(sfAccount),
+               SeqProxy::rawTicket(proposedTx.getFieldU32(sfTicketSequence)))
+        .key;
+}
+
+}  // namespace
+
+void
+ValidTransactionProposal::visitEntry(bool isDelete, SLE::ConstRef before, SLE::ConstRef after)
+{
+    // `after` is always present (on deletion it holds the final state), so it
+    // alone determines the entry type. LedgerEntryTypesMatch owns malformed
+    // type transitions; skip them rather than read one side with the other's
+    // schema.
+    if (!after || (before && before->getType() != after->getType()))
+        return;
+
+    auto const type = after->getType();
+
+    // Consuming a Ticket deletes the proposal keyed to it (XLS-0103 §4.5).
+    // Remember each Ticket that went, so finalize can tell a proposal deleted
+    // with its Ticket from one that simply vanished, and the proposal each
+    // Ticket was keyed to, so finalize can check that none stayed behind.
+    if (type == ltTICKET)
+    {
+        if (isDelete)
+        {
+            deletedTickets_.insert(after->key());
+            proposalsOfDeletedTickets_.push_back(
+                keylet::txProposal(
+                    after->getAccountID(sfAccount), after->getFieldU32(sfTicketSequence)));
+        }
+        return;
+    }
+
+    if (type != ltTRANSACTION_PROPOSAL)
+        return;
+
+    if (!before)
+    {
+        ++created_;
+    }
+    else if (isDelete)
+    {
+        ++deleted_;
+        ticketsOfDeletedProposals_.push_back(proposalTicketKey(*before));
+    }
+    else
+    {
+        ++modified_;
+    }
+
+    // A live proposal's signer lists must stay submittable: within size
+    // limits, sorted by account, and free of duplicates.
+    if (!isDelete && !validSignerArrays(after->getFieldObject(sfProposedTransaction)))
+        invalidSignerArrays_ = true;
+}
+
+bool
+ValidTransactionProposal::finalize(
+    STTx const& tx,
+    TER result,
+    XRPAmount,
+    ReadView const& view,
+    beast::Journal const& j) const
+{
+    if (!view.rules().enabled(featureCosign))
+        return true;
+
+    if (invalidSignerArrays_)
+    {
+        JLOG(j.fatal()) << "Invariant failed: TransactionProposal signer arrays are not canonical.";
+        return false;
+    }
+
+    // A proposal leaves the ledger in two ways (XLS-0103 §4.5): a
+    // TransactionProposalCancel deletes the proposal it names, and consuming
+    // the Ticket a proposal is keyed to deletes the proposal with it, whether
+    // the proposed transaction executed (or failed with a claimed-fee tec) or
+    // AccountDelete swept the target's Tickets.
+    std::uint32_t deletedWithTicket = 0;
+    for (auto const& ticketKey : ticketsOfDeletedProposals_)
+    {
+        if (deletedTickets_.contains(ticketKey))
+            ++deletedWithTicket;
+    }
+
+    bool const succeeded = isTesSuccess(result);
+    bool effectsMatch = false;
+    if (tx.getTxnType() == ttTRANSACTION_PROPOSAL_CREATE)
+    {
+        effectsMatch = created_ == (succeeded ? 1u : 0u) && modified_ == 0 && deleted_ == 0;
+    }
+    else if (tx.getTxnType() == ttTRANSACTION_PROPOSAL_CANCEL)
+    {
+        // A Cancel deletes one proposal and nothing else. It cannot
+        // spend a reserved Ticket, so no proposal goes with its Ticket here.
+        effectsMatch = created_ == 0 && modified_ == 0 && deletedWithTicket == 0 &&
+            deleted_ == (succeeded ? 1u : 0u);
+    }
+    else
+    {
+        // Any other transaction deletes a proposal only together with its
+        // Ticket, and modifies at most one, only as a successful
+        // SponsorshipTransfer.
+        // TODO: extend this when TransactionProposalSign is implemented.
+        std::uint32_t const modifiable =
+            tx.getTxnType() == ttSPONSORSHIP_TRANSFER && succeeded ? 1 : 0;
+        effectsMatch = created_ == 0 && modified_ <= modifiable && deleted_ == deletedWithTicket;
+    }
+
+    if (!effectsMatch)
+    {
+        JLOG(j.fatal())
+            << "Invariant failed: TransactionProposal changes do not match transaction result.";
+        return false;
+    }
+
+    // The other direction of the deletion rule: ticketDelete deletes the
+    // proposal keyed to a Ticket along with it (XLS-0103 §4.5), so no
+    // proposal may outlive its Ticket, orphaned on a key that can no longer
+    // be spent.
+    bool const orphaned = std::ranges::any_of(
+        proposalsOfDeletedTickets_, [&view](Keylet const& keylet) { return view.exists(keylet); });
+    if (orphaned)
+    {
+        JLOG(j.fatal())
+            << "Invariant failed: TransactionProposal outlived the Ticket it is keyed to.";
+        return false;
+    }
+
+    return true;
+}
+
+}  // namespace xrpl

src/libxrpl/tx/invariants/InvariantCheck.cpp

@@ -935,8 +935,12 @@ ValidClawback::finalize(
                         return !mptV2Enabled;
                     }
 
+                    // IOU balances keep 16 significant digits, so a clawback
+                    // much smaller than the balance changes it by a rounded
+                    // amount, possibly zero. Compare with the same rounded
+                    // subtraction the balance update performs.
                     if (*afterBalance > *beforeBalance ||
-                        (*beforeBalance - *afterBalance) != std::min(*beforeBalance, clawAmount))
+                        *afterBalance != *beforeBalance - std::min(*beforeBalance, clawAmount))
                     {
                         JLOG(j.fatal())
                             << "Invariant failed: trustline clawback balance change is invalid";

src/libxrpl/tx/paths/BookStep.cpp

@@ -254,6 +254,15 @@ private:
         TAmounts<TIn, TOut> const& stepAmt,
         TOut const& ownerGives) const;
 
+    template <template <typename, typename> typename Offer>
+    void
+    tryConsumeOffer(
+        PaymentSandbox& sb,
+        Offer<TIn, TOut>& offer,
+        TAmounts<TIn, TOut> const& ofrAmt,
+        TAmounts<TIn, TOut> const& stepAmt,
+        TOut const& ownerGives) const;
+
     // If clobQuality is available and has a better quality then return nullopt,
     // otherwise if amm liquidity is available return AMM offer adjusted based
     // on clobQuality.
@@ -810,10 +819,11 @@ BookStep<TIn, TOut, TDerived>::forEachOffer(
         auto const amtIn = [&](TIn const& in) { return capInMPT && *maxIn_ < in ? *maxIn_ : in; };
         try
         {
-            // All arithmetic in this block runs before the offer is consumed.
             // A crafted MPTokensV2 offer can overflow while transfer rates or
-            // crossing limits are applied; remove that unusable offer instead
-            // of letting it persist as a tecINTERNAL source.
+            // crossing limits are applied, here or in the callback's
+            // limitStepIn()/limitStepOut(); remove that unusable offer instead
+            // of letting it persist as a tecINTERNAL source. Overflows while
+            // consuming the offer are handled by tryConsumeOffer().
             stpAmt.in = mulRatio(amtIn(ofrAmt.in), ofrInRate, QUALITY_ONE, /*roundUp*/ true);
 
             // owner pays the transfer fee. An MPT gross-up that doesn't fit in
@@ -941,16 +951,9 @@ BookStep<TIn, TOut, TDerived>::forEachOffer(
                 removeOffer("Removing offer with overflowing amount calculation");
                 return true;
             }
-            // An overflow can only be produced by a crafted MPT offer, and MPT
-            // offers require featureMPTokensV2 (enforced at OfferCreate
-            // preflight). So the amendment is always enabled when we get here
-            // and this legacy re-throw is unreachable in practice.
-            // LCOV_EXCL_START
-            XRPL_ASSERT(
-                sb.rules().enabled(featureMPTokensV2),
-                "xrpl::BookStep::forEachOffer : overflow implies MPTokensV2");
+            // Legacy behavior: the exception escapes flow() and the
+            // transaction fails with tecINTERNAL.
             throw;
-            // LCOV_EXCL_STOP
         }
     };
 
@@ -991,6 +994,32 @@ BookStep<TIn, TOut, TDerived>::forEachOffer(
     return {offers.permToRemove(), counter.count()};
 }
 
+template <class TIn, class TOut, class TDerived>
+template <template <typename, typename> typename Offer>
+void
+BookStep<TIn, TOut, TDerived>::tryConsumeOffer(
+    PaymentSandbox& sb,
+    Offer<TIn, TOut>& offer,
+    TAmounts<TIn, TOut> const& ofrAmt,
+    TAmounts<TIn, TOut> const& stepAmt,
+    TOut const& ownerGives) const
+{
+    try
+    {
+        // Under MPTokensV2, an overflow while consuming the offer fails the
+        // strand instead of being handled by forEachOffer().
+        consumeOffer(sb, offer, ofrAmt, stepAmt, ownerGives);
+    }
+    catch (std::overflow_error const&)
+    {
+        if (sb.rules().enabled(featureMPTokensV2))
+        {
+            Throw<FlowException>(tecINTERNAL, "Overflow while consuming offer");
+        }
+        throw;
+    }
+}
+
 template <class TIn, class TOut, class TDerived>
 template <template <typename, typename> typename Offer>
 void
@@ -1072,7 +1101,7 @@ std::optional<std::variant<Quality, AMMOffer<TIn, TOut>>>
 BookStep<TIn, TOut, TDerived>::tip(ReadView const& view) const
 {
     // This can be simplified (and sped up) if directories are never empty.
-    Sandbox sb(&view, TapNone);
+    Sandbox sb(&view, ApplyFlags::None);
     BookTip bt(sb, book_);
     auto const lobQuality = bt.step(j_) ? std::optional<Quality>(bt.quality()) : std::nullopt;
     // Multi-path offer generates an offer with the quality
@@ -1192,7 +1221,7 @@ BookStep<TIn, TOut, TDerived>::revImp(
             savedOuts.insert(stpAmt.out);
             result = TAmounts<TIn, TOut>(sum(savedIns), sum(savedOuts));
             remainingOut = out - result.out;
-            this->consumeOffer(sb, offer, ofrAmt, stpAmt, ownerGives);
+            this->tryConsumeOffer(sb, offer, ofrAmt, stpAmt, ownerGives);
             // return true b/c even if the payment is satisfied,
             // we need to consume the offer. An offer limited by what the
             // issuer can issue is not consumed, though: its remainder is still
@@ -1224,7 +1253,7 @@ BookStep<TIn, TOut, TDerived>::revImp(
         savedOuts.insert(remainingOut);
         result.in = sum(savedIns);
         result.out = out;
-        this->consumeOffer(sb, offer, ofrAdjAmt, stpAdjAmt, ownerGivesAdj);
+        this->tryConsumeOffer(sb, offer, ofrAdjAmt, stpAdjAmt, ownerGivesAdj);
 
         // Explicitly check whether the offer is funded.  Given that we have
         // (stpAmt.out > remainingOut), it's natural to assume the offer
@@ -1408,7 +1437,7 @@ BookStep<TIn, TOut, TDerived>::fwdImp(
         savedOuts = std::move(savedOutsAdj);
         result = resultAdj;
         remainingIn = in - result.in;
-        this->consumeOffer(sb, offer, ofrAdjAmt, stpAdjAmt, ownerGivesAdj);
+        this->tryConsumeOffer(sb, offer, ofrAdjAmt, stpAdjAmt, ownerGivesAdj);
 
         // When the mantissas of two iou amounts differ by less than ten, then
         // subtracting them leaves a result of zero. This can cause the check
@@ -1512,6 +1541,18 @@ BookStep<TIn, TOut, TDerived>::check(StrandContext const& ctx) const
         return temBAD_PATH;
     }
 
+    // An issuer paying with its own MPT issues it into the first book. A
+    // holder-sourced strand records the MPT in the first MPTEndpointStep and
+    // so rejects a later book that outputs it again; do the same here. The
+    // step after such a book issues the MPT a second time and the payment
+    // engine cannot keep the two within MaximumAmount once StrandFlow
+    // rebuilds the sandbox on a limiting step.
+    if (ctx.isFirst && book_.in.holds<MPTIssue>() && book_.in.getIssuer() == ctx.strandSrc &&
+        ctx.view.rules().enabled(featureMPTokensV2))
+    {
+        ctx.seenDirectAssets[0].insert(book_.in);
+    }
+
     // Do not allow two books to output the same issue. This may cause offers on
     // one step to unfund offers in another step.
     if (!ctx.seenBookOuts.insert(book_.out).second ||

src/libxrpl/tx/paths/MPTEndpointStep.cpp

@@ -6,6 +6,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/PaymentSandbox.h>
+#include <xrpl/ledger/View.h>
 #include <xrpl/ledger/helpers/MPTokenHelpers.h>
 #include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
@@ -874,15 +875,18 @@ MPTEndpointStep<TDerived>::check(StrandContext const& ctx) const
 
     // pure issue/redeem can't be frozen (issuer/holder)
     // For the first step: check global freeze of the step's own asset.
-    // For the last step: check only the per-holder MPToken lock.
+    // For the last step: check only the per-holder lock.
     // Global freeze of the deliver asset is not checked here
     // because MPT semantics allow issuer<->holder transfers even when globally
     // locked — only holder-to-holder DEX paths are restricted.
+    // For both steps: a vault share inherits the freeze of the vault's
+    // underlying asset.
     if (!(ctx.isLast && ctx.isFirst))
     {
         auto const& account = ctx.isFirst ? src_ : dst_;
         bool const frozen = (ctx.isFirst && isGlobalFrozen(ctx.view, mptIssue_)) ||
-            isIndividualFrozen(ctx.view, account, mptIssue_);
+            isIndividualFrozen(ctx.view, account, mptIssue_) ||
+            isVaultPseudoAccountFrozen(ctx.view, account, mptIssue_, 0);
         if (frozen)
             return terLOCKED;
     }

src/libxrpl/tx/paths/PaySteps.cpp

@@ -57,10 +57,8 @@ checkNear(IOUAmount const& expected, IOUAmount const& actual)
 static bool
 isXRPAccount(STPathElement const& pe)
 {
-    if (pe.getNodeType() != STPathElement::TypeAccount)
-        return false;
-    return isXRP(pe.getAccountID());
-};
+    return pe.getNodeType() == STPathElementType::Account && isXRP(pe.getAccountID());
+}
 
 static std::pair<TER, std::unique_ptr<Step>>
 toStep(
@@ -71,11 +69,8 @@ toStep(
 {
     auto& j = ctx.j;
 
-    if (ctx.isFirst && e1->isAccount() &&
-        ((e1->getNodeType() & STPathElement::TypeCurrency) != 0u) && e1->getPathAsset().isXRP())
-    {
+    if (ctx.isFirst && e1->isAccount() && e1->hasCurrency() && e1->getPathAsset().isXRP())
         return makeXrpEndpointStep(ctx, e1->getAccountID());
-    }
 
     if (ctx.isLast && isXRPAccount(*e1) && e2->isAccount())
         return makeXrpEndpointStep(ctx, e2->getAccountID());
@@ -117,15 +112,9 @@ toStep(
         // LCOV_EXCL_STOP
     }
 
-    XRPL_ASSERT(
-        (e2->getNodeType() & STPathElement::TypeAsset) ||
-            (e2->getNodeType() & STPathElement::TypeIssuer),
-        "xrpl::toStep : currency or issuer");
-    PathAsset const outAsset =
-        ((e2->getNodeType() & STPathElement::TypeAsset) != 0u) ? e2->getPathAsset() : curAsset;
-    auto const outIssuer = ((e2->getNodeType() & STPathElement::TypeIssuer) != 0u)
-        ? e2->getIssuerID()
-        : curAsset.getIssuer();
+    XRPL_ASSERT(e2->hasAsset() || e2->hasIssuer(), "xrpl::toStep : currency or issuer");
+    PathAsset const outAsset = e2->hasAsset() ? e2->getPathAsset() : curAsset;
+    auto const outIssuer = e2->hasIssuer() ? e2->getIssuerID() : curAsset.getIssuer();
 
     if (isXRP(curAsset) && outAsset.isXRP())
     {
@@ -197,16 +186,15 @@ toStrand(
     for (std::size_t i = 0; i < path.size(); ++i)
     {
         auto const& pe = path[i];
-        auto const t = pe.getNodeType();
 
-        if (((t & ~STPathElement::TypeAll) != 0u) || (t == 0u))
+        if ((pe.getNodeType() & ~STPathElementType::All) != STPathElementType::None || pe.isNone())
             return {temBAD_PATH, Strand{}};
 
-        bool const hasAccount = (t & STPathElement::TypeAccount) != 0u;
-        bool const hasIssuer = (t & STPathElement::TypeIssuer) != 0u;
-        bool const hasCurrency = (t & STPathElement::TypeCurrency) != 0u;
-        bool const hasMPT = (t & STPathElement::TypeMpt) != 0u;
-        bool const hasAsset = (t & STPathElement::TypeAsset) != 0u;
+        bool const hasAccount = pe.isType(STPathElementType::Account);
+        bool const hasIssuer = pe.hasIssuer();
+        bool const hasCurrency = pe.hasCurrency();
+        bool const hasMPT = pe.hasMPT();
+        bool const hasAsset = pe.hasAsset();
 
         if (hasAccount && (hasIssuer || hasCurrency))
             return {temBAD_PATH, Strand{}};
@@ -250,9 +238,7 @@ toStrand(
     }();
 
     // Currency or MPT
-    auto const hasAsset = [](STPathElement const pe) {
-        return pe.getNodeType() & STPathElement::TypeAsset;
-    };
+    auto const hasAsset = [](STPathElement const& pe) { return pe.hasAsset(); };
 
     std::vector<STPathElement> normPath;
     // reserve enough for the path, the implied source, destination,
@@ -263,10 +249,10 @@ toStrand(
         // transaction, as defined by the transaction's Account field. The Asset
         // is either SendMax or Deliver.
         auto const t = [&] {
-            auto const t = STPathElement::TypeAccount | STPathElement::TypeIssuer;
+            auto const t = STPathElementType::Account | STPathElementType::Issuer;
             return curAsset.visit(
-                [&](MPTIssue const&) { return t | STPathElement::TypeMpt; },
-                [&](Issue const&) { return t | STPathElement::TypeCurrency; });
+                [&](MPTIssue const&) { return t | STPathElementType::Mpt; },
+                [&](Issue const&) { return t | STPathElementType::Currency; });
         }();
         // If MPT then the issuer is the actual issuer, it is never the source
         // account.
@@ -435,7 +421,7 @@ toStrand(
                     return {msr.first, Strand{}};
                 result.push_back(std::move(msr.second));
                 impliedPE.emplace(
-                    STPathElement::TypeAccount, curAsset.getIssuer(), xrpCurrency(), xrpAccount());
+                    STPathElementType::Account, curAsset.getIssuer(), xrpCurrency(), xrpAccount());
                 cur = &*impliedPE;
             }
         }
@@ -450,7 +436,7 @@ toStrand(
                     return {msr.first, Strand{}};
                 result.push_back(std::move(msr.second));
                 impliedPE.emplace(
-                    STPathElement::TypeAccount, curAsset.getIssuer(), xrpCurrency(), xrpAccount());
+                    STPathElementType::Account, curAsset.getIssuer(), xrpCurrency(), xrpAccount());
                 cur = &*impliedPE;
             }
         }

src/libxrpl/tx/transactors/AGENTS.md

@@ -1,13 +0,0 @@
-# AGENTS.md — transactors
-
-Prefer a single object-level invariant over duplicating the same delta/balance check in every transactor that touches an object — e.g. one invariant asserting a Vault's pseudo-account balance and `assetsAvailable` always move together, rather than repeating that check in `VaultDeposit`, `VaultWithdraw`, `VaultClawback`, `LoanSet`, etc.
-
-## Gating amendment-dependent code
-
-Prefer a single amendment-enabled block and a single disabled block over scattering `rules.enabled(...)` checks through a function, even if the two blocks are similar.
-
-When a file or function checks more than one amendment, name local enablement booleans per-amendment (e.g. `fix340Enabled` for `fixCleanup3_4_0`), not a generic `fixEnabled` — it becomes ambiguous once a second amendment is checked in the same scope.
-
-## `UNREACHABLE` and test coverage
-
-Only use `UNREACHABLE` for genuinely impossible paths, not to avoid writing a test for one that's reachable but rare. When a branch marked `UNREACHABLE` is excluded from coverage, wrap it in `LCOV_EXCL_START`/`LCOV_EXCL_STOP`.

src/libxrpl/tx/transactors/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

src/libxrpl/tx/transactors/account/AccountSet.cpp

@@ -187,7 +187,8 @@ AccountSet::preclaim(PreclaimContext const& ctx)
         if (!dirIsEmpty(ctx.view, keylet::ownerDir(id)))
         {
             JLOG(ctx.j.trace()) << "Retry: Owner directory not empty.";
-            return ((ctx.flags & TapRetry) != 0u) ? TER{terOWNERS} : TER{tecOWNERS};
+            return ((ctx.flags & ApplyFlags::Retry) != ApplyFlags::None) ? TER{terOWNERS}
+                                                                         : TER{tecOWNERS};
         }
     }
 

src/libxrpl/tx/transactors/dex/OfferCreate.cpp

@@ -297,7 +297,8 @@ OfferCreate::checkAcceptAsset(
         JLOG(j.debug()) << "delay: can't receive IOUs from non-existent issuer: "
                         << to_string(asset.getIssuer());
 
-        return ((flags & TapRetry) != 0u) ? TER{terNO_ACCOUNT} : TER{tecNO_ISSUER};
+        return ((flags & ApplyFlags::Retry) != ApplyFlags::None) ? TER{terNO_ACCOUNT}
+                                                                 : TER{tecNO_ISSUER};
     }
 
     // An account cannot create a trustline to itself, so no line can exist
@@ -320,7 +321,8 @@ OfferCreate::checkAcceptAsset(
                 {
                     JLOG(j.debug()) << "delay: can't receive IOUs from issuer with "
                                        "DisallowIncomingTrustline set";
-                    return ((flags & TapRetry) != 0u) ? TER{terNO_LINE} : TER{tecNO_LINE};
+                    return ((flags & ApplyFlags::Retry) != ApplyFlags::None) ? TER{terNO_LINE}
+                                                                             : TER{tecNO_LINE};
                 }
             }
 
@@ -328,7 +330,8 @@ OfferCreate::checkAcceptAsset(
             {
                 if (!trustLine)
                 {
-                    return ((flags & TapRetry) != 0u) ? TER{terNO_LINE} : TER{tecNO_LINE};
+                    return ((flags & ApplyFlags::Retry) != ApplyFlags::None) ? TER{terNO_LINE}
+                                                                             : TER{tecNO_LINE};
                 }
 
                 // Entries have a canonical representation, determined by a
@@ -344,7 +347,8 @@ OfferCreate::checkAcceptAsset(
                     JLOG(j.debug()) << "delay: can't receive IOUs from "
                                        "issuer without auth.";
 
-                    return ((flags & TapRetry) != 0u) ? TER{terNO_AUTH} : TER{tecNO_AUTH};
+                    return ((flags & ApplyFlags::Retry) != ApplyFlags::None) ? TER{terNO_AUTH}
+                                                                             : TER{tecNO_AUTH};
                 }
             }
 

src/libxrpl/tx/transactors/escrow/EscrowCancel.cpp

@@ -110,11 +110,16 @@ EscrowCancel::doApply()
     auto const sle = ctx_.view().peek(keylet::account(account));
     STAmount const amount = escrow->getFieldAmount(sfAmount);
 
+    auto const reserveToSubtract = calculateAdditionalReserve((*escrow)[~sfBytecode]);
+
     // The return can re-create a holding the owner deleted while the escrow
     // was pending; the removed escrow must not be counted against its reserve.
     bool const recycleReserve = ctx_.view().rules().enabled(fixCleanup3_4_0);
     if (recycleReserve)
-        decreaseOwnerCountForObject(ctx_.view(), sle, escrow.mutableRawSle(), 1, ctx_.journal);
+    {
+        decreaseOwnerCountForObject(
+            ctx_.view(), sle, escrow.mutableRawSle(), reserveToSubtract, ctx_.journal);
+    }
 
     // Transfer amount back to the owner
     if (isXRP(amount))
@@ -160,7 +165,10 @@ EscrowCancel::doApply()
     }
 
     if (!recycleReserve)
-        decreaseOwnerCountForObject(ctx_.view(), sle, escrow.mutableRawSle(), 1, ctx_.journal);
+    {
+        decreaseOwnerCountForObject(
+            ctx_.view(), sle, escrow.mutableRawSle(), reserveToSubtract, ctx_.journal);
+    }
 
     // Remove escrow from ledger
     escrow.erase();

src/libxrpl/tx/transactors/escrow/EscrowCreate.cpp

@@ -4,8 +4,8 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/conditions/Condition.h>
-#include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/ledger/entries/EscrowEntry.h>
 #include <xrpl/ledger/helpers/AccountRootHelpers.h>
@@ -16,6 +16,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
@@ -130,6 +131,19 @@ escrowCreatePreflightHelper<MPTIssue>(PreflightContext const& ctx)
     return tesSUCCESS;
 }
 
+XRPAmount
+EscrowCreate::calculateBaseFee(ReadView const& view, STTx const& tx)
+{
+    XRPAmount txnFees{Transactor::calculateBaseFee(view, tx)};
+    if (tx.isFieldPresent(sfBytecode))
+    {
+        // Ten base fees in all: `Transactor::calculateBaseFee` charges one,
+        // this adds nine. Plus 5 drops per byte.
+        txnFees += 9 * view.fees().base + 5 * tx[sfBytecode].size();
+    }
+    return txnFees;
+}
+
 NotTEC
 EscrowCreate::preflight(PreflightContext const& ctx)
 {
@@ -161,12 +175,19 @@ EscrowCreate::preflight(PreflightContext const& ctx)
         ctx.tx[sfCancelAfter] <= ctx.tx[sfFinishAfter])
         return temBAD_EXPIRATION;
 
+    if (ctx.tx.isFieldPresent(sfBytecode) && !ctx.tx.isFieldPresent(sfCancelAfter))
+        return temBAD_EXPIRATION;
+
     // In the absence of a FinishAfter, the escrow can be finished
     // immediately, which can be confusing. When creating an escrow,
     // we want to ensure that either a FinishAfter time is explicitly
     // specified or a completion condition is attached.
-    if (!ctx.tx[~sfFinishAfter] && !ctx.tx[~sfCondition])
+    if (!ctx.tx[~sfFinishAfter] && !ctx.tx[~sfCondition] && !ctx.tx[~sfBytecode])
+    {
+        JLOG(ctx.j.debug()) << "Must have at least one of FinishAfter, "
+                               "Condition, or Bytecode.";
         return temMALFORMED;
+    }
 
     if (auto const cb = ctx.tx[~sfCondition])
     {
@@ -182,6 +203,33 @@ EscrowCreate::preflight(PreflightContext const& ctx)
         }
     }
 
+    if (ctx.tx.isFieldPresent(sfData))
+    {
+        if (!ctx.tx.isFieldPresent(sfBytecode))
+        {
+            JLOG(ctx.j.debug()) << "EscrowCreate with Data requires Bytecode";
+            return temMALFORMED;
+        }
+        auto const data = ctx.tx.getFieldVL(sfData);
+        if (data.size() > kMaxWasmDataLength)
+        {
+            JLOG(ctx.j.debug()) << "EscrowCreate.Data bad size " << data.size();
+            return temMALFORMED;
+        }
+    }
+
+    // amendment was checked by checkExtraFeatures
+    if (ctx.tx.isFieldPresent(sfBytecode))
+    {
+        auto const code = ctx.tx.getFieldVL(sfBytecode);
+        // Protocol ceiling only; `preflight` has no view.
+        if (code.empty() || code.size() > kMaxBytecodeSizeLimit)
+        {
+            JLOG(ctx.j.debug()) << "EscrowCreate.Bytecode bad size " << code.size();
+            return temMALFORMED;
+        }
+    }
+
     return tesSUCCESS;
 }
 
@@ -216,6 +264,30 @@ EscrowCreate::preclaim(PreclaimContext const& ctx)
             !isTesSuccess(ret))
             return ret;
     }
+
+    // The limits are voted, so they can change between ledgers. A `tef`, unlike
+    // a `tem`, does not mark the transaction bad for the hold time.
+    if (ctx.tx.isFieldPresent(sfBytecode))
+    {
+        auto const& fees = ctx.view.fees();
+        if (isBytecodeUploadDisabled(fees))
+        {
+            JLOG(ctx.j.debug()) << "WASM runtime deactivated by fee voting";
+            return tefTEMP_DISABLED;
+        }
+
+        auto const code = ctx.tx.getFieldVL(sfBytecode);
+        if (code.size() > fees.bytecodeSizeLimit)
+        {
+            JLOG(ctx.j.debug()) << "EscrowCreate.Bytecode over voted limit " << code.size();
+            return tefEXCEEDS_LIMIT;
+        }
+
+        // TODO(SmartEscrow): screen the module itself here - that it compiles,
+        // and that it imports and exports what the engine can serve - once the
+        // WASM engine lands. Until then any blob of the right size is taken.
+    }
+
     return tesSUCCESS;
 }
 
@@ -236,6 +308,7 @@ EscrowCreate::doApply()
 
     // Check reserve and funds availability
     STAmount const amount{ctx_.tx[sfAmount]};
+    auto const reserveToAdd = calculateAdditionalReserve(ctx_.tx[~sfBytecode]);
 
     auto const balance = sle->getFieldAmount(sfBalance).xrp();
     // First check: whoever is on the hook for the new owner increment
@@ -243,8 +316,8 @@ EscrowCreate::doApply()
     // validates the sponsor's reserve + remaining credit. When
     // unsponsored this hits the source branch and validates the
     // source's pre-lock balance against base + (currentOC+1)*increment.
-    if (auto const ret =
-            checkReserve(ctx_.getApplyViewContext(), sle, balance, {.ownerCountDelta = 1}, j_);
+    if (auto const ret = checkReserve(
+            ctx_.getApplyViewContext(), sle, balance, {.ownerCountDelta = reserveToAdd}, j_);
         !isTesSuccess(ret))
         return ret;
 
@@ -258,11 +331,15 @@ EscrowCreate::doApply()
         // checkReserve) because that helper diverts to the sponsor's balance
         // when a sponsor is present and would ignore the source's post-lock
         // balance entirely. ownerCountDelta differs by case:
-        // - sponsored:   0  — sponsor covers the new owner increment, so the
-        //                source only owes reserve for its current owners.
-        // - unsponsored: 1  — source owes reserve including the new increment.
+        // - sponsored:   0            — sponsor covers the new owner increment, so
+        //                the source only owes reserve for its current owners.
+        // - unsponsored: reserveToAdd — source owes reserve including the new
+        //                increment, which Bytecode can make larger than one unit.
         auto const sourceReserve = accountReserve(
-            ctx_.view(), sle, j_, {.ownerCountDelta = getTxReserveSponsorID(ctx_.tx) ? 0 : 1});
+            ctx_.view(),
+            sle,
+            j_,
+            {.ownerCountDelta = getTxReserveSponsorID(ctx_.tx) ? 0 : reserveToAdd});
         if (balance - STAmount(amount).xrp() < sourceReserve)
             return tecUNFUNDED;
     }
@@ -289,6 +366,8 @@ EscrowCreate::doApply()
     (*escrow)[~sfCancelAfter] = ctx_.tx[~sfCancelAfter];
     (*escrow)[~sfFinishAfter] = ctx_.tx[~sfFinishAfter];
     (*escrow)[~sfDestinationTag] = ctx_.tx[~sfDestinationTag];
+    (*escrow)[~sfBytecode] = ctx_.tx[~sfBytecode];
+    (*escrow)[~sfData] = ctx_.tx[~sfData];
 
     if (ctx_.view().rules().enabled(fixIncludeKeyletFields))
     {
@@ -356,7 +435,7 @@ EscrowCreate::doApply()
     }
 
     // increment owner count
-    increaseOwnerCount(ctx_.getApplyViewContext(), sle, 1, ctx_.journal);
+    increaseOwnerCount(ctx_.getApplyViewContext(), sle, reserveToAdd, ctx_.journal);
     addSponsorToLedgerEntry(ctx_.getApplyViewContext(), escrow.mutableRawSle());
     ctx_.view().update(sle);
     return tesSUCCESS;

src/libxrpl/tx/transactors/escrow/EscrowFinish.cpp

@@ -16,6 +16,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/SField.h>
@@ -27,6 +28,8 @@
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/Transactor.h>
 
+#include <cstdint>
+#include <optional>
 #include <system_error>
 #include <variant>
 
@@ -79,7 +82,24 @@ EscrowFinish::preflight(PreflightContext const& ctx)
     // If you specify a condition, then you must also specify
     // a fulfillment.
     if (static_cast<bool>(cb) != static_cast<bool>(fb))
+    {
+        JLOG(ctx.j.debug()) << "Condition != Fulfillment";
         return temMALFORMED;
+    }
+
+    if (auto const allowance = ctx.tx[~sfGas]; allowance)
+    {
+        // Protocol ceiling only; `preflight` has no view.
+        if (*allowance == 0)
+        {
+            return temBAD_LIMIT;
+        }
+        if (*allowance > kMaxGasLimit)
+        {
+            JLOG(ctx.j.debug()) << "Gas too large: " << *allowance;
+            return temBAD_LIMIT;
+        }
+    }
 
     return tesSUCCESS;
 }
@@ -148,7 +168,15 @@ EscrowFinish::calculateBaseFee(ReadView const& view, STTx const& tx)
     {
         extraFee += view.fees().base * (32 + (fb->size() / 16));
     }
-
+    if (auto const allowance = tx[~sfGas]; allowance)
+    {
+        // The extra fee is the allowance in drops, rounded up to the nearest
+        // whole drop. Widen before multiplying: both factors are 32-bit.
+        std::uint64_t const allowanceFee =
+            ((std::uint64_t{*allowance} * view.fees().gasPrice) + microDropsPerDrop - 1) /
+            microDropsPerDrop;
+        extraFee += allowanceFee;
+    }
     return Transactor::calculateBaseFee(view, tx) + extraFee;
 }
 
@@ -162,25 +190,66 @@ EscrowFinish::preclaim(PreclaimContext const& ctx)
             return err;
     }
 
-    if (ctx.view.rules().enabled(featureTokenEscrow))
+    if (ctx.view.rules().enabled(featureTokenEscrow) ||
+        ctx.view.rules().enabled(featureSmartEscrow))
     {
+        // this check is done in doApply before this amendment is enabled
         auto const seqProxy = SeqProxy::rawSequence(ctx.tx[sfOfferSequence]);
         EscrowEntryR const escrow(ctx.tx[sfOwner], seqProxy, ctx.view);
         if (!escrow)
             return tecNO_TARGET;
 
-        AccountID const dest = (*escrow)[sfDestination];
-        STAmount const amount = (*escrow)[sfAmount];
-
-        if (!isXRP(amount))
+        if (ctx.view.rules().enabled(featureSmartEscrow))
         {
-            if (auto const ret = std::visit(
-                    [&]<typename T>(T const&) {
-                        return escrowUnlockPreclaimHelper<T>(ctx.view, dest, amount);
-                    },
-                    amount.asset().value());
-                !isTesSuccess(ret))
-                return ret;
+            if (escrow->isFieldPresent(sfBytecode))
+            {
+                if (!ctx.tx.isFieldPresent(sfGas))
+                {
+                    JLOG(ctx.j.debug()) << "Bytecode requires Gas";
+                    return tefBYTECODE_NOT_INCLUDED;
+                }
+
+                // The limits are voted, so they can change between ledgers.
+                // A `tef`, unlike a `tem`, does not mark the transaction bad
+                // for the hold time.
+                auto const& fees = ctx.view.fees();
+                if (isBytecodeExecutionDisabled(fees))
+                {
+                    JLOG(ctx.j.debug()) << "WASM runtime deactivated by fee voting";
+                    return tefTEMP_DISABLED;
+                }
+
+                if (ctx.tx[sfGas] > fees.gasLimit)
+                {
+                    JLOG(ctx.j.debug()) << "Gas over voted limit: " << ctx.tx[sfGas];
+                    return tefEXCEEDS_LIMIT;
+                }
+            }
+            else
+            {
+                if (ctx.tx.isFieldPresent(sfGas))
+                {
+                    JLOG(ctx.j.debug()) << "Bytecode not present, "
+                                           "Gas present";
+                    return tefNO_BYTECODE;
+                }
+            }
+        }
+        if (ctx.view.rules().enabled(featureTokenEscrow))
+        {
+            AccountID const dest = (*escrow)[sfDestination];
+            STAmount const amount = (*escrow)[sfAmount];
+
+            if (!isXRP(amount))
+            {
+                if (auto const ret = std::visit(
+                        [&]<typename T>(T const&) {
+                            return escrowUnlockPreclaimHelper<T>(ctx.view, dest, amount);
+                        },
+                        amount.asset().value());
+                    !isTesSuccess(ret))
+                    return ret;
+            }
         }
     }
     return tesSUCCESS;
@@ -193,7 +262,8 @@ EscrowFinish::doApply()
     EscrowEntryW escrow(ctx_.tx[sfOwner], seqProxy, ctx_.view(), j_);
     if (!escrow)
     {
-        if (ctx_.view().rules().enabled(featureTokenEscrow))
+        if (ctx_.view().rules().enabled(featureTokenEscrow) ||
+            ctx_.view().rules().enabled(featureSmartEscrow))
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
         return tecNO_TARGET;
@@ -211,6 +281,20 @@ EscrowFinish::doApply()
     if ((*escrow)[~sfCancelAfter] && after(now, (*escrow)[sfCancelAfter]))
         return tecNO_PERMISSION;
 
+    AccountID const destID = (*escrow)[sfDestination];
+    auto const sled = ctx_.view().peek(keylet::account(destID));
+    if (ctx_.view().rules().enabled(featureSmartEscrow))
+    {
+        // NOTE: Escrow payments cannot be used to fund accounts.
+        if (!sled)
+            return tecNO_DST;
+
+        if (auto err =
+                verifyDepositPreauth(ctx_.tx, ctx_.view(), accountID_, destID, sled, ctx_.journal);
+            !isTesSuccess(err))
+            return err;
+    }
+
     // Check cryptocondition fulfillment
     {
         auto const id = ctx_.tx.getTransactionID();
@@ -264,16 +348,33 @@ EscrowFinish::doApply()
             return tecCRYPTOCONDITION_ERROR;
     }
 
-    // NOTE: Escrow payments cannot be used to fund accounts.
-    AccountID const destID = (*escrow)[sfDestination];
-    auto const sled = ctx_.view().peek(keylet::account(destID));
-    if (!sled)
-        return tecNO_DST;
+    if (!ctx_.view().rules().enabled(featureSmartEscrow))
+    {
+        // NOTE: Escrow payments cannot be used to fund accounts.
+        if (!sled)
+            return tecNO_DST;
 
-    if (auto err =
-            verifyDepositPreauth(ctx_.tx, ctx_.view(), accountID_, destID, sled, ctx_.journal);
-        !isTesSuccess(err))
-        return err;
+        if (auto err =
+                verifyDepositPreauth(ctx_.tx, ctx_.view(), accountID_, destID, sled, ctx_.journal);
+            !isTesSuccess(err))
+            return err;
+    }
+
+    // Execute custom release function
+    if ((*escrow)[~sfBytecode])
+    {
+        // TODO(SmartEscrow): run the escrow's contract here once the WASM
+        // engine lands. That change also brings with it the reporting the run
+        // produces - the gas it consumed and the code it returned, in the
+        // transaction metadata - and the tecBYTECODE_REJECTED result that lets
+        // a rejected escrow survive with the data the contract wrote.
+        //
+        // Until then an escrow carrying bytecode can be created, funded and
+        // cancelled, but not finished. Reachable only under featureSmartEscrow,
+        // which is Supported::No.
+        JLOG(j_.debug()) << "EscrowFinish: no WASM engine to run the escrow's bytecode";
+        return tecFAILED_PROCESSING;
+    }
 
     AccountID const account = (*escrow)[sfAccount];
 
@@ -301,13 +402,18 @@ EscrowFinish::doApply()
         }
     }
 
+    auto const reserveToSubtract = calculateAdditionalReserve((*escrow)[~sfBytecode]);
+
     // Delivery can auto-create the destination's holding; the removed escrow
     // must not be counted against its reserve. The two share a reserve payer
     // for a self-escrow, or when one sponsor covers both.
     bool const recycleReserve =
         ctx_.view().rules().enabled(featureSponsor) || ctx_.view().rules().enabled(fixCleanup3_4_0);
     if (recycleReserve)
-        decreaseOwnerCountForObject(ctx_.view(), account, escrow.mutableRawSle(), 1, ctx_.journal);
+    {
+        decreaseOwnerCountForObject(
+            ctx_.view(), account, escrow.mutableRawSle(), reserveToSubtract, ctx_.journal);
+    }
 
     STAmount const amount = escrow->getFieldAmount(sfAmount);
     // Transfer amount to destination
@@ -359,7 +465,10 @@ EscrowFinish::doApply()
     ctx_.view().update(sled);
 
     if (!recycleReserve)
-        decreaseOwnerCountForObject(ctx_.view(), account, escrow.mutableRawSle(), 1, ctx_.journal);
+    {
+        decreaseOwnerCountForObject(
+            ctx_.view(), account, escrow.mutableRawSle(), reserveToSubtract, ctx_.journal);
+    }
 
     // Remove escrow from ledger
     escrow.erase();

src/libxrpl/tx/transactors/lending/LoanManage.cpp

@@ -3,6 +3,7 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Number.h>
 #include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/View.h>
@@ -129,25 +130,133 @@ LoanManage::preclaim(PreclaimContext const& ctx)
         return tecNO_PERMISSION;
     }
 
-    if (auto const vault = ctx.view.read(keylet::vault(loanBrokerSle->at(sfVaultID)));
-        vault && getVaultVersion(vault) == VaultVersion::FixedPrecision)
-    {
-        // FixedPrecision Vaults are not yet supported by LoanManage.
-        return tecNO_PERMISSION;
-    }
-
     return tesSUCCESS;
 }
 
+STAmount
+LoanManage::calculateDefaultCover(SLE::Ref loanSle, SLE::Ref brokerSle, SLE::Ref vaultSle)
+{
+    auto const vaultAsset = vaultSle->at(sfAsset);
+
+    Number const principalOutstanding = loanSle->at(sfPrincipalOutstanding);
+
+    TenthBips32 const coverRateMinimum{brokerSle->at(sfCoverRateMinimum)};
+    TenthBips32 const coverRateLiquidation{brokerSle->at(sfCoverRateLiquidation)};
+
+    Number const rawCover = [&] {
+        NumberRoundModeGuard const mg(Number::RoundingMode::Upward);
+        // Compute minimum cover
+        Number const minimumCover =
+            tenthBipsOfValue(brokerSle->at(sfDebtTotal).value(), coverRateMinimum);
+
+        // Apply coverRateLiquidation
+        return std::min(tenthBipsOfValue(minimumCover, coverRateLiquidation), principalOutstanding);
+    }();
+
+    // rawCover is a product of multiplication and can carry more digits than STAmount's. Keep the
+    // cap as an exact Number: rounding it to 16 digits first could drop digits that change
+    // floor16(AssetsAvailable + cover).
+    Number const cappedCover = std::min(rawCover, *brokerSle->at(sfCoverAvailable));
+
+    if (Asset{vaultAsset}.integral())
+    {
+        // Fix the mode so the STAmount conversion truncates the fractional part.
+        NumberRoundModeGuard const mg(Number::RoundingMode::TowardsZero);
+        return STAmount{vaultAsset, cappedCover};
+    }
+
+    // Floor AssetsAvailable + cover at its posterior grid so the Vault side is exact, unless
+    // AssetsAvailable has digits finer than the 16-digit cover can carry. The LoanBroker absorbs
+    // the rounding: CoverAvailable - cover may need finer digits than its posterior grid and
+    // rounds to nearest, as the broker's trust line does. Downward also keeps the 19-digit
+    // AssetsAvailable + cover sum from rounding up past cappedCover.
+    NumberRoundModeGuard const mg(Number::RoundingMode::Downward);
+    return creditToPosteriorAvailableScale(vaultSle, cappedCover, Number::RoundingMode::Downward);
+}
+
+namespace {
+
+// Defaults a Loan on a FixedPrecision Vault. Cover is the raw XLS-66
+// First-Loss Capital amount, capped at the LoanBroker's CoverAvailable and
+// floored so AssetsAvailable + cover lands exactly on its posterior grid (a
+// no-op for integral assets). AssetsAvailable rises by cover through the cash writer;
+// AssetsDeployed drops by the Loan's full PrincipalOutstanding exactly, and
+// AssetsTotal is re-derived from AssetsAvailable + AssetsDeployed by the
+// writer's sync -- this function never touches sfAssetsTotal directly.
+[[nodiscard]] TER
+defaultLoanFixedPrecision(
+    ApplyView& view,
+    SLE::Ref loanSle,
+    SLE::Ref brokerSle,
+    SLE::Ref vaultSle,
+    beast::Journal j)
+{
+    Number const principalOutstanding = loanSle->at(sfPrincipalOutstanding);
+    Number const scheduledInterest = loanSle->at(sfTotalValueOutstanding) - principalOutstanding -
+        loanSle->at(sfManagementFeeOutstanding);
+
+    STAmount const coverAmount = LoanManage::calculateDefaultCover(loanSle, brokerSle, vaultSle);
+
+    // The broker's CoverAvailable decrease and the broker-to-vault transfer
+    // both use this amount. AssetsAvailable + cover is exact unless
+    // AssetsAvailable has digits finer than the 16-digit cover can carry; then
+    // adjustVaultBalances rounds the sum. CoverAvailable - cover may need finer
+    // digits than the broker's posterior grid; it rounds to nearest, as the
+    // broker's trust line does.
+
+    Number const loss = loanSle->isFlag(lsfLoanImpaired) ? -principalOutstanding : 0;
+    if (auto const ter = adjustVaultBalances(
+            vaultSle,
+            {
+                .cash = coverAmount,
+                .deployed = -principalOutstanding,
+                .yield = -scheduledInterest,
+                .loss = loss,
+            },
+            j);
+        !isTesSuccess(ter))
+        return ter;  // LCOV_EXCL_LINE
+    view.update(vaultSle);
+
+    brokerSle->at(sfDebtTotal) -= principalOutstanding;
+    brokerSle->at(sfCoverAvailable) -= coverAmount;
+    view.update(brokerSle);
+
+    loanSle->setFlag(lsfLoanDefault);
+    loanSle->at(sfTotalValueOutstanding) = 0;
+    loanSle->at(sfPaymentRemaining) = 0;
+    loanSle->at(sfPrincipalOutstanding) = 0;
+    loanSle->at(sfManagementFeeOutstanding) = 0;
+    loanSle->at(sfNextPaymentDueDate) = 0;
+    view.update(loanSle);
+
+    if (coverAmount == beast::kZero)
+        return tesSUCCESS;
+
+    return accountSend(
+        view,
+        brokerSle->at(sfAccount),
+        vaultSle->at(sfAccount),
+        coverAmount,
+        j,
+        {},
+        WaiveTransferFee::Yes);
+}
+
+}  // namespace
+
 TER
 LoanManage::defaultLoan(
     ApplyView& view,
     SLE::Ref loanSle,
     SLE::Ref brokerSle,
     SLE::Ref vaultSle,
-    Asset const& vaultAsset,
     beast::Journal j)
 {
+    if (getVaultVersion(vaultSle) == VaultVersion::FixedPrecision)
+        return defaultLoanFixedPrecision(view, loanSle, brokerSle, vaultSle, j);
+
+    auto const vaultAsset = *vaultSle->at(sfAsset);
     // Calculate the amount of the Default that First-Loss Capital covers:
 
     std::int32_t const loanScale = loanSle->at(sfLoanScale);
@@ -184,7 +293,7 @@ LoanManage::defaultLoan(
     // The vault may be at a different scale than the loan. Reduce rounding
     // errors during the accounting by rounding some of the values to that
     // scale.
-    auto const vaultScale = getAssetsTotalScale(vaultSle);
+    auto const vaultScale = getVaultScale(vaultSle);
 
     {
         // Decrease the Total Value of the Vault:
@@ -307,22 +416,39 @@ LoanManage::impairLoan(
         return tecTOO_SOON;
     }
 
+    bool const fixedPrecision = getVaultVersion(vaultSle) == VaultVersion::FixedPrecision;
     Number const lossUnrealized = loanVaultExposure(vaultSle, loanSle);
 
-    // The vault may be at a different scale than the loan. Reduce rounding
-    // errors during the accounting by rounding some of the values to that
-    // scale.
-    auto const vaultScale = getAssetsTotalScale(vaultSle);
-
-    // Update the Vault object(set "paper loss")
-    auto const vaultLossUnrealizedProxy = vaultSle->at(sfLossUnrealized);
-    adjustImpreciseNumber(vaultLossUnrealizedProxy, lossUnrealized, vaultAsset, vaultScale);
-    if (vaultLossUnrealizedProxy > vaultSle->at(sfAssetsTotal) - vaultSle->at(sfAssetsAvailable))
+    // Update the Vault object (set "paper loss")
+    if (fixedPrecision)
     {
-        // Having a loss greater than the vault's unavailable assets
-        // will leave the vault in an invalid / inconsistent state.
-        JLOG(j.warn()) << "Vault unrealized loss is too large, and will corrupt the vault.";
-        return tecLIMIT_EXCEEDED;
+        // adjustVaultBalances's own LU' > AD' check covers the comparison
+        // against AssetsDeployed.
+        if (auto const ter = adjustVaultBalances(vaultSle, {.loss = lossUnrealized}, j);
+            !isTesSuccess(ter))
+        {
+            // LCOV_EXCL_START
+            JLOG(j.warn()) << "Vault unrealized loss is too large, and will corrupt the vault.";
+            return ter;
+            // LCOV_EXCL_STOP
+        }
+    }
+    else
+    {
+        auto const vaultLossUnrealizedProxy = vaultSle->at(sfLossUnrealized);
+        // The vault may be at a different scale than the loan. Reduce rounding
+        // errors during the accounting by rounding some of the values to that
+        // scale.
+        auto const vaultScale = getVaultScale(vaultSle);
+        adjustImpreciseNumber(vaultLossUnrealizedProxy, lossUnrealized, vaultAsset, vaultScale);
+        if (vaultLossUnrealizedProxy >
+            vaultSle->at(sfAssetsTotal) - vaultSle->at(sfAssetsAvailable))
+        {
+            // Having a loss greater than the vault's unavailable assets
+            // will leave the vault in an invalid / inconsistent state.
+            JLOG(j.warn()) << "Vault unrealized loss is too large, and will corrupt the vault.";
+            return tecLIMIT_EXCEEDED;  // LCOV_EXCL_LINE
+        }
     }
     view.update(vaultSle);
 
@@ -351,23 +477,32 @@ LoanManage::unimpairLoan(
     Asset const& vaultAsset,
     beast::Journal j)
 {
-    // The vault may be at a different scale than the loan. Reduce rounding
-    // errors during the accounting by rounding some of the values to that
-    // scale.
-    auto const vaultScale = getAssetsTotalScale(vaultSle);
-
-    // Update the Vault object(clear "paper loss")
-    auto const vaultLossUnrealizedProxy = vaultSle->at(sfLossUnrealized);
+    // Update the Vault object (clear "paper loss")
+    bool const fixedPrecision = getVaultVersion(vaultSle) == VaultVersion::FixedPrecision;
     Number const lossReversed = loanVaultExposure(vaultSle, loanSle);
-    if (vaultLossUnrealizedProxy < lossReversed)
+    if (fixedPrecision)
     {
-        // LCOV_EXCL_START
-        JLOG(j.warn()) << "Vault unrealized loss is less than the amount to be cleared";
-        return tefBAD_LEDGER;
-        // LCOV_EXCL_STOP
+        // adjustVaultBalances's own LU' < 0 check covers the comparison.
+        if (auto const ter = adjustVaultBalances(vaultSle, {.loss = -lossReversed}, j);
+            !isTesSuccess(ter))
+            return ter;  // LCOV_EXCL_LINE
+    }
+    else
+    {
+        auto const vaultLossUnrealizedProxy = vaultSle->at(sfLossUnrealized);
+        if (vaultLossUnrealizedProxy < lossReversed)
+        {
+            // LCOV_EXCL_START
+            JLOG(j.warn()) << "Vault unrealized loss is less than the amount to be cleared";
+            return tefBAD_LEDGER;
+            // LCOV_EXCL_STOP
+        }
+        // The vault may be at a different scale than the loan. Reduce rounding
+        // errors during the accounting by rounding some of the values to that
+        // scale.
+        auto const vaultScale = getVaultScale(vaultSle);
+        adjustImpreciseNumber(vaultLossUnrealizedProxy, -lossReversed, vaultAsset, vaultScale);
     }
-    // Reverse the "paper loss"
-    adjustImpreciseNumber(vaultLossUnrealizedProxy, -lossReversed, vaultAsset, vaultScale);
 
     view.update(vaultSle);
 
@@ -422,7 +557,7 @@ LoanManage::doApply()
         // Valid flag combinations are checked in preflight. No flags is valid -
         // just a noop.
         if (tx.isFlag(tfLoanDefault))
-            return defaultLoan(view, loanSle, brokerSle, vaultSle, vaultAsset, j_);
+            return defaultLoan(view, loanSle, brokerSle, vaultSle, j_);
         if (tx.isFlag(tfLoanImpair))
             return impairLoan(view, loanSle, vaultSle, vaultAsset, j_);
         if (tx.isFlag(tfLoanUnimpair))
@@ -435,9 +570,27 @@ LoanManage::doApply()
     // path. Post-amendment, we call associateAsset on all successful paths.
     if (view.rules().enabled(fixCleanup3_1_3) && isTesSuccess(result))
     {
+        bool const fixedPrecision = getVaultVersion(vaultSle) == VaultVersion::FixedPrecision;
+        [[maybe_unused]] bool const assetsEqualBeforeStore =
+            fixedPrecision && vaultSle->at(sfAssetsAvailable) == vaultSle->at(sfAssetsTotal);
+
         associateAsset(*loanSle, vaultAsset);
         associateAsset(*brokerSle, vaultAsset);
         associateAsset(*vaultSle, vaultAsset);
+
+        if (fixedPrecision)
+        {
+            [[maybe_unused]] Number const assetsAvailableAfter = *vaultSle->at(sfAssetsAvailable);
+            [[maybe_unused]] Number const assetsTotalAfter = *vaultSle->at(sfAssetsTotal);
+            XRPL_ASSERT_PARTS(
+                assetsAvailableAfter <= assetsTotalAfter,
+                "xrpl::LoanManage::doApply",
+                "assets available must not be greater than assets outstanding");
+            XRPL_ASSERT_PARTS(
+                !assetsEqualBeforeStore || assetsAvailableAfter == assetsTotalAfter,
+                "xrpl::LoanManage::doApply",
+                "equal assets remain equal after storage");
+        }
     }
 
     return result;

src/libxrpl/tx/transactors/lending/LoanPay.cpp

@@ -46,14 +46,12 @@ isPaymentAmountInvalid(STAmount const& amount)
     return amount <= beast::kZero;
 }
 
-// Returns the account's true, unclamped balance in `asset`, for use only in
-// fund-conservation checks. accountHolds(..., SpendableHandling::FullBalance)
-// cannot be used for this: for XRP it always defers to xrpLiquid, which
-// subtracts the account's reserve, so a payee sitting below its own reserve
-// would appear to receive nothing even though its raw ledger balance grew.
-// That mismatch is exactly what a conservation check must not see.
+// Returns the balance stored on the ledger for a holder of `asset`: the raw
+// XRP balance (not xrpLiquid, which subtracts the reserve), or the signed
+// trust line or MPToken balance with no trust limit added. Not meaningful for
+// the issuer, which holds no balance of its own.
 STAmount
-conservationBalance(ReadView const& view, AccountID const& id, Asset const& asset, beast::Journal j)
+storedBalance(ReadView const& view, AccountID const& id, Asset const& asset, beast::Journal j)
 {
     if (isXRP(asset))
     {
@@ -62,6 +60,25 @@ conservationBalance(ReadView const& view, AccountID const& id, Asset const& asse
             return STAmount{asset};  // LCOV_EXCL_LINE
         return view.balanceHookIOU(id, xrpAccount(), sle->getFieldAmount(sfBalance));
     }
+    return accountHolds(
+        view,
+        id,
+        asset,
+        FreezeHandling::IgnoreFreeze,
+        AuthHandling::IgnoreAuth,
+        j,
+        SpendableHandling::SimpleBalance);
+}
+
+// Returns the account's balance in `asset`, for use only in fund-conservation
+// checks. A holder's is its stored balance: a spendable balance would add the
+// opposite trust limit, which can hide a small credit in rounding. An issuer
+// has no stored balance, so its spendable balance is used instead.
+STAmount
+conservationBalance(ReadView const& view, AccountID const& id, Asset const& asset, beast::Journal j)
+{
+    if (id != asset.getIssuer())
+        return storedBalance(view, id, asset, j);
     return accountHolds(
         view,
         id,
@@ -283,11 +300,6 @@ LoanPay::preclaim(PreclaimContext const& ctx)
         return tefBAD_LEDGER;
         // LCOV_EXCL_STOP
     }
-    if (getVaultVersion(vaultSle) == VaultVersion::FixedPrecision)
-    {
-        // FixedPrecision Vaults are not yet supported by LoanPay.
-        return tecNO_PERMISSION;
-    }
     auto const asset = vaultSle->at(sfAsset);
     auto const vaultPseudoAccount = vaultSle->at(sfAccount);
 
@@ -362,11 +374,11 @@ LoanPay::doApply()
     auto const asset = *vaultSle->at(sfAsset);
 
     // Determine where to send the broker's fee
-    auto coverAvailableProxy = brokerSle->at(sfCoverAvailable);
     TenthBips32 const coverRateMinimum{brokerSle->at(sfCoverRateMinimum)};
     auto debtTotalProxy = brokerSle->at(sfDebtTotal);
 
-    auto const vaultScale = getAssetsTotalScale(vaultSle);
+    bool const fixedPrecision = getVaultVersion(vaultSle) == VaultVersion::FixedPrecision;
+    auto const vaultScale = getVaultScale(vaultSle);
 
     // Send the broker fee to the owner if they have sufficient cover available,
     // _and_ if the owner can receive funds
@@ -392,7 +404,8 @@ LoanPay::doApply()
             return roundToAsset(
                 asset, tenthBipsOfValue(debtTotalProxy.value(), coverRateMinimum), loanScale);
         }();
-        return coverAvailableProxy >= minCover && !isDeepFrozen(view, brokerOwner, asset) &&
+        return brokerSle->at(sfCoverAvailable) >= minCover &&
+            !isDeepFrozen(view, brokerOwner, asset) &&
             !requireAuth(view, asset, brokerOwner, AuthType::StrongAuth);
     }();
 
@@ -425,6 +438,12 @@ LoanPay::doApply()
         }
     }
 
+    auto const scheduledInterest = [&loanSle] {
+        return loanSle->at(sfTotalValueOutstanding) - loanSle->at(sfPrincipalOutstanding) -
+            loanSle->at(sfManagementFeeOutstanding);
+    };
+    Number const scheduledInterestBefore = fixedPrecision ? scheduledInterest() : kNumZero;
+
     LoanPaymentType const paymentType = [&tx] {
         // preflight already checked that at most one flag is set.
         if (tx.isFlag(tfLoanLatePayment))
@@ -438,7 +457,6 @@ LoanPay::doApply()
 
     std::expected<LoanPaymentParts, TER> const paymentParts =
         loanMakePayment(asset, view, loanSle, brokerSle, amount, paymentType, j_);
-
     if (!paymentParts)
     {
         XRPL_ASSERT_PARTS(
@@ -446,10 +464,12 @@ LoanPay::doApply()
         return paymentParts.error();
     }
 
-    // If the payment computation completed without error, the loanSle object
-    // has been modified.
+    // If the payment computation completed without error, the loanSle object has been modified.
     view.update(loanSle);
 
+    Number const scheduledInterestDelta =
+        fixedPrecision ? scheduledInterest() - scheduledInterestBefore : kNumZero;
+
     XRPL_ASSERT_PARTS(
         // It is possible to pay 0 principal
         paymentParts->principalPaid >= 0,
@@ -476,35 +496,49 @@ LoanPay::doApply()
         // LCOV_EXCL_STOP
     }
 
-    auto const [assetsTotalDelta, debtTotalDelta] = loanPaymentDeltas(vaultSle, *paymentParts);
+    //------------------------------------------------------
+    // LoanBroker object state changes
+    view.update(brokerSle);
+
+    Number const assetsAvailableBefore = *vaultSle->at(sfAssetsAvailable);
+    Number const assetsTotalBefore = vaultSle->at(sfAssetsTotal);
+
+    auto const totalPaidToVaultRaw = paymentParts->principalPaid + paymentParts->interestPaid;
+    auto const deltas = loanPaymentDeltas(vaultSle, *paymentParts);
+    // FixedPrecision never writes sfAssetsTotal directly, so assetsTotalDelta
+    // (cash_basis's interestPaid) is unused here and only meaningful for
+    // Legacy/CashBasis below.
+    Number const assetsTotalDelta = fixedPrecision ? kNumZero : deltas.assetsTotalDelta;
+    Number const debtTotalDelta = deltas.debtTotalDelta;
+    STAmount const totalPaidToVaultRounded = fixedPrecision
+        // Pass the exact Number sum: rounding it to 16 digits first could drop
+        // a tail that moves floor16(AssetsAvailable + sum).
+        ? creditToPosteriorAvailableScale(
+              vaultSle, totalPaidToVaultRaw, Number::RoundingMode::Downward)
+        : STAmount{
+              asset,
+              roundToAsset(asset, totalPaidToVaultRaw, vaultScale, Number::RoundingMode::Downward)};
+    XRPL_ASSERT_PARTS(
+        !asset.integral() || totalPaidToVaultRaw == Number(totalPaidToVaultRounded),
+        "xrpl::LoanPay::doApply",
+        "rounding does nothing for integral asset");
+    Number const totalPaidToBrokerRaw = paymentParts->feePaid;
+    // Fee redirect into cover is an inflow to CoverAvailable, so it must
+    // floor the sum (see creditToPosteriorBrokerCoverScale's doc), not just
+    // the delta. Legacy/CashBasis keeps the fee as the original, unrounded
+    // Number: only the FixedPrecision path is 16-digit-rounded via STAmount.
+    Number const totalPaidToBroker = fixedPrecision && !sendBrokerFeeToOwner
+        // The exact fee, for the same reason as totalPaidToVaultRounded.
+        ? Number(creditToPosteriorBrokerCoverScale(
+              vaultSle, brokerSle, totalPaidToBrokerRaw, Number::RoundingMode::Downward))
+        : totalPaidToBrokerRaw;
 
     JLOG(j_.debug()) << "Loan Pay: principal paid: " << paymentParts->principalPaid
                      << ", interest paid: " << paymentParts->interestPaid
                      << ", fee paid: " << paymentParts->feePaid
                      << ", assets total delta: " << assetsTotalDelta
-                     << ", debt total delta: " << debtTotalDelta;
-
-    //------------------------------------------------------
-    // LoanBroker object state changes
-    view.update(brokerSle);
-
-    auto assetsAvailableProxy = vaultSle->at(sfAssetsAvailable);
-    auto assetsTotalProxy = vaultSle->at(sfAssetsTotal);
-
-    auto const totalPaidToVaultRaw = paymentParts->principalPaid + paymentParts->interestPaid;
-    auto const totalPaidToVaultRounded =
-        roundToAsset(asset, totalPaidToVaultRaw, vaultScale, Number::RoundingMode::Downward);
-    XRPL_ASSERT_PARTS(
-        !asset.integral() || totalPaidToVaultRaw == totalPaidToVaultRounded,
-        "xrpl::LoanPay::doApply",
-        "rounding does nothing for integral asset");
-    auto const totalPaidToBroker = paymentParts->feePaid;
-
-    XRPL_ASSERT_PARTS(
-        (totalPaidToVaultRaw + totalPaidToBroker) ==
-            (paymentParts->principalPaid + paymentParts->interestPaid + paymentParts->feePaid),
-        "xrpl::LoanPay::doApply",
-        "payments add up");
+                     << ", debt total delta: " << debtTotalDelta
+                     << ", scheduled interest delta: " << scheduledInterestDelta;
 
     // Decrease LoanBroker Debt by the amount paid, add the Loan value change
     // (which might be negative). debtTotalDelta may be negative, increasing the
@@ -514,45 +548,35 @@ LoanPay::doApply()
         "xrpl::LoanPay::doApply",
         "debtTotalDelta rounding good");
     // Despite our best efforts, it's possible for rounding errors to accumulate
-    // in the loan broker's debt total. This is because the broker may have more
-    // than one loan with significantly different scales.
-    adjustImpreciseNumber(debtTotalProxy, -debtTotalDelta, asset, vaultScale);
+    // in the loan broker's debt total on Legacy/CashBasis Vaults. This is because
+    // the broker may have more than one loan with significantly different scales.
+    adjustBrokerDebtTotal(brokerSle, vaultSle, -debtTotalDelta, vaultScale);
 
     //------------------------------------------------------
     // Vault object state changes
     view.update(vaultSle);
 
-    Number const assetsAvailableBefore = *assetsAvailableProxy;
-    Number const assetsTotalBefore = *assetsTotalProxy;
-#if !NDEBUG
+    if (fixedPrecision)
     {
-        Number const pseudoAccountBalanceBefore = accountHolds(
-            view,
-            vaultPseudoAccount,
-            asset,
-            FreezeHandling::IgnoreFreeze,
-            AuthHandling::IgnoreAuth,
-            j_);
-
-        XRPL_ASSERT_PARTS(
-            assetsAvailableBefore == pseudoAccountBalanceBefore,
-            "xrpl::LoanPay::doApply",
-            "vault pseudo balance agrees before");
+        // AssetsDeployed drops by exactly the principal paid this payment,
+        // taken from the Loan's own payment split rather than the
+        // broker-side debtTotalDelta.
+        if (auto const ter = adjustVaultBalances(
+                vaultSle,
+                {
+                    .cash = totalPaidToVaultRounded,
+                    .deployed = -paymentParts->principalPaid,
+                    .yield = scheduledInterestDelta,
+                },
+                j_);
+            !isTesSuccess(ter))
+            return ter;
+    }
+    else
+    {
+        vaultSle->at(sfAssetsAvailable) += totalPaidToVaultRounded;
+        vaultSle->at(sfAssetsTotal) += assetsTotalDelta;
     }
-#endif
-
-    assetsAvailableProxy += totalPaidToVaultRounded;
-    assetsTotalProxy += assetsTotalDelta;
-
-    XRPL_ASSERT_PARTS(
-        *assetsAvailableProxy <= *assetsTotalProxy,
-        "xrpl::LoanPay::doApply",
-        "assets available must not be greater than assets outstanding");
-
-    JLOG(j_.debug()) << "total paid to vault raw: " << totalPaidToVaultRaw
-                     << ", total paid to vault rounded: " << totalPaidToVaultRounded
-                     << ", total paid to broker: " << totalPaidToBroker
-                     << ", amount from transaction: " << amount;
 
     // Move funds
     XRPL_ASSERT_PARTS(
@@ -563,10 +587,11 @@ LoanPay::doApply()
     if (!sendBrokerFeeToOwner)
     {
         // If there is not enough first-loss capital, add the fee to First Loss
-        // Cover Pool. Note that this moves the entire fee - it does not attempt
-        // to split it. The broker can Withdraw it later if they want, or leave
-        // it for future needs.
-        coverAvailableProxy += totalPaidToBroker;
+        // Cover Pool. FixedPrecision rounds the redirected fee at the
+        // posterior cover scale; any sub-unit remainder is forgiven. The
+        // broker can Withdraw the credited amount later or leave it for future
+        // needs.
+        brokerSle->at(sfCoverAvailable) += totalPaidToBroker;
     }
 
     associateAsset(*loanSle, asset);
@@ -574,28 +599,48 @@ LoanPay::doApply()
     associateAsset(*vaultSle, asset);
 
     // Duplicate some checks after rounding
-    Number const assetsAvailableAfter = *assetsAvailableProxy;
-    Number const assetsTotalAfter = *assetsTotalProxy;
+    Number const assetsAvailableAfter = vaultSle->at(sfAssetsAvailable);
+    Number const assetsTotalAfter = vaultSle->at(sfAssetsTotal);
 
-    XRPL_ASSERT_PARTS(
-        assetsAvailableAfter <= assetsTotalAfter,
-        "xrpl::LoanPay::doApply",
-        "assets available must not be greater than assets outstanding");
     if (assetsAvailableAfter == assetsAvailableBefore)
     {
-        // An unchanged assetsAvailable indicates that the amount paid to the
-        // vault was zero, or rounded to zero. That should be impossible, but I
-        // can't rule it out for extreme edge cases, so fail gracefully if it
-        // happens.
-        //
-        // LCOV_EXCL_START
-        JLOG(j_.warn()) << "LoanPay: Vault assets available unchanged after rounding: "  //
-                        << "Before: " << assetsAvailableBefore                           //
-                        << ", After: " << assetsAvailableAfter;
-        return tecPRECISION_LOSS;
-        // LCOV_EXCL_STOP
+        // Credit rounded to zero. On FixedPrecision, if this payment also
+        // closes the Loan (XLS-66 section 3.2.8's terminal exception), let
+        // it through: AssetsDeployed (vault) and DebtTotal (broker) already
+        // dropped by the exact remaining principal, and YieldUnrealized was already
+        // reduced by this payment's scheduled interest, above. No cash moves for the sub-unit
+        // remainder; the Vault forgives it. A non-terminal zero-credit payment is still rejected:
+        // letting it through would change the Loan's schedule with no cash movement at all.
+        if (fixedPrecision && loanSle->at(sfPaymentRemaining) == 0)
+        {
+            JLOG(j_.debug()) << "LoanPay: terminal payment closed the Loan with a zero cash "
+                                "credit; the sub-unit remainder is forgiven. Principal: "
+                             << paymentParts->principalPaid
+                             << ", Interest: " << paymentParts->interestPaid;
+
+            // Nothing moves for this terminal close when the sub-unit remainder is forgiven and
+            // either no fee is owed or the fee goes to the broker owner who is also the borrower,
+            // i.e. the owner would pay itself. Return before the transfer and its conservation
+            // checks, since they assume some transfer happens.
+            if (totalPaidToVaultRounded == beast::kZero &&
+                (totalPaidToBroker == beast::kZero || brokerPayee == accountID_))
+            {
+                return tesSUCCESS;
+            }
+        }
+        else
+        {
+            JLOG(j_.warn()) << "LoanPay: Vault assets available unchanged after rounding: "  //
+                            << "Before: " << assetsAvailableBefore                           //
+                            << ", After: " << assetsAvailableAfter                           //
+                            << ", Credit: " << totalPaidToVaultRounded                       //
+                            << ", Principal: " << paymentParts->principalPaid                //
+                            << ", Interest: " << paymentParts->interestPaid;
+            return tecPRECISION_LOSS;
+        }
     }
-    if (assetsTotalDelta != beast::kZero && assetsTotalAfter == assetsTotalBefore)
+    if (!fixedPrecision && assetsTotalDelta != beast::kZero &&
+        assetsTotalAfter == assetsTotalBefore)
     {
         // Non-zero assetsTotalDelta with an unchanged assetsTotal indicates that
         // the actual value change rounded to zero. That should be impossible, but
@@ -611,7 +656,8 @@ LoanPay::doApply()
         return tecPRECISION_LOSS;
         // LCOV_EXCL_STOP
     }
-    if (assetsTotalDelta == beast::kZero && assetsTotalAfter != assetsTotalBefore)
+    if (!fixedPrecision && assetsTotalDelta == beast::kZero &&
+        assetsTotalAfter != assetsTotalBefore)
     {
         // A change in assetsTotal when there was no assetsTotalDelta indicates
         // that something really weird happened. That should be flat out
@@ -690,22 +736,6 @@ LoanPay::doApply()
             WaiveTransferFee::Yes))
         return ter;
 
-#if !NDEBUG
-    {
-        Number const pseudoAccountBalanceAfter = accountHolds(
-            view,
-            vaultPseudoAccount,
-            asset,
-            FreezeHandling::IgnoreFreeze,
-            AuthHandling::IgnoreAuth,
-            j_);
-        XRPL_ASSERT_PARTS(
-            assetsAvailableAfter == pseudoAccountBalanceAfter,
-            "xrpl::LoanPay::doApply",
-            "vault pseudo balance agrees after");
-    }
-#endif
-
     // Check that funds are conserved
     auto const accountBalanceAfter = conservationBalance(view, accountID_, asset, j_);
     auto const vaultBalanceAfter = accountID_ == vaultPseudoAccount
@@ -754,10 +784,6 @@ LoanPay::doApply()
     }();
 
     // No object changes are made below this point
-    XRPL_ASSERT_PARTS(
-        Number::getround() == Number::RoundingMode::ToNearest,
-        "xrpl::LoanPay::doApply",
-        "Number rounding ToNearest");
     NumberRoundModeGuard const mg(Number::RoundingMode::ToNearest);
 
     auto const accountBalanceBeforeRounded = roundToScale(accountBalanceBefore, balanceScale);
@@ -808,8 +834,26 @@ LoanPay::doApply()
                      << ", total " << to_string(totalBalanceChangeRounded) << " ("
                      << Number(totalBalanceChange) << ")";
 
+    // Each trust line rounds its own change to 16 digits, so a side can move by up to one unit
+    // of its balance less or more than was sent. Integral assets move exactly.
+    auto const roundingUnit = [&](STAmount const& before, STAmount const& after) {
+        Number unit{0};
+        if (asset.integral())
+            return unit;
+        for (auto const& balance : {before, after})
+        {
+            if (balance != beast::kZero)
+                unit = std::max(unit, Number{1, balance.exponent()});
+        }
+        return unit;
+    };
+    Number const accountUnit = roundingUnit(accountBalanceBefore, accountBalanceAfter);
+    Number const vaultUnit = roundingUnit(vaultBalanceBefore, vaultBalanceAfter);
+    Number const brokerUnit = roundingUnit(brokerBalanceBefore, brokerBalanceAfter);
+
     bool const goodRounding = totalBalanceBeforeRounded == totalBalanceAfterRounded ||
-        totalBalanceChangeRounded == beast::kZero;
+        totalBalanceChangeRounded == beast::kZero ||
+        abs(Number(totalBalanceChange)) <= accountUnit + vaultUnit + brokerUnit;
     if (totalBalanceBeforeRounded != totalBalanceAfterRounded)
     {
         JLOG((goodRounding ? j_.debug() : j_.warn()))
@@ -830,11 +874,20 @@ LoanPay::doApply()
         goodRounding, "xrpl::LoanPay::doApply", "funds are conserved (with rounding)");
 
     XRPL_ASSERT_PARTS(
-        accountBalanceAfter < accountBalanceBefore || accountID_ == asset.getIssuer(),
+        // A payment below one unit of the payer's balance can round away on its trust line. A fee
+        // the owner-borrower pays to itself does not leave its balance.
+        accountBalanceAfter < accountBalanceBefore || accountID_ == asset.getIssuer() ||
+            (accountBalanceAfter == accountBalanceBefore &&
+             totalPaidToVaultRounded +
+                     (brokerPayee == accountID_ ? Number{0} : totalPaidToBroker) <=
+                 accountUnit),
         "xrpl::LoanPay::doApply",
         "account balance decreased");
     XRPL_ASSERT_PARTS(
-        vaultBalanceAfter >= beast::kZero && brokerBalanceAfter >= beast::kZero,
+        // A broker owner may owe the issuer on a reciprocal IOU trust line, so
+        // its stored balance can be negative. Pseudo-accounts cannot.
+        vaultBalanceAfter >= beast::kZero &&
+            (brokerBalanceAfter >= beast::kZero || (sendBrokerFeeToOwner && !asset.integral())),
         "xrpl::LoanPay::doApply",
         "non-negative vault and broker balances");
     XRPL_ASSERT_PARTS(
@@ -846,7 +899,11 @@ LoanPay::doApply()
         "xrpl::LoanPay::doApply",
         "broker balance did not decrease");
     XRPL_ASSERT_PARTS(
-        vaultBalanceAfter > vaultBalanceBefore || brokerBalanceAfter > brokerBalanceBefore,
+        // An IOU issuer's spendable balance does not change when it is paid, and a credit below
+        // one unit of the payee's balance can round away on its trust line.
+        vaultBalanceAfter > vaultBalanceBefore || brokerBalanceAfter > brokerBalanceBefore ||
+            brokerPayee == asset.getIssuer() ||
+            (Number(totalPaidToVaultRounded) <= vaultUnit && totalPaidToBroker <= brokerUnit),
         "xrpl::LoanPay::doApply",
         "vault and/or broker balance increased");
 

src/libxrpl/tx/transactors/lending/LoanSet.cpp

@@ -93,7 +93,8 @@ LoanSet::preflight(PreflightContext const& ctx)
     // A proposed LoanSet is stored unsigned; its CounterpartySignature is
     // collected on-ledger afterward, so its absence here is expected, not an
     // error (On-Chain Cosigner spec §5.3.1.2).
-    if (!tx.isFlag(tfInnerBatchTxn) && !counterPartySig && (ctx.flags & TapProposal) == 0)
+    if (!tx.isFlag(tfInnerBatchTxn) && !counterPartySig &&
+        (ctx.flags & ApplyFlags::Proposal) == ApplyFlags::None)
     {
         JLOG(ctx.j.warn()) << "LoanSet transaction must have a CounterpartySignature.";
         return temBAD_SIGNER;

src/libxrpl/tx/transactors/proposal/TransactionProposalCancel.cpp

@@ -37,7 +37,7 @@ TransactionProposalCancel::preclaim(PreclaimContext const& ctx)
 
     // Never read the zero keylet. Preflight already rejected a zero
     // ProposalID, and no real proposal can have one (every ProposalID is a
-    // hash), so reaching here with zero is an internal error. (and a mathematical rarity. )
+    // hash), so reaching here with zero is an internal error (and a mathematical rarity).
     if (proposalID == beast::kZero)
         return tefINTERNAL;  // LCOV_EXCL_LINE
 

src/libxrpl/tx/transactors/proposal/TransactionProposalCreate.cpp

@@ -54,8 +54,8 @@ TransactionProposalCreate::preflight(PreflightContext const& ctx)
     try
     {
         STTx const stx{STObject{proposedTx}};
-        auto const inner =
-            xrpl::preflight(ctx.registry, ctx.rules, stx, TapDryRun | TapProposal, ctx.j);
+        auto const inner = xrpl::preflight(
+            ctx.registry, ctx.rules, stx, ApplyFlags::DryRun | ApplyFlags::Proposal, ctx.j);
         if (!isTesSuccess(inner.ter))
         {
             JLOG(ctx.j.debug()) << "TransactionProposalCreate: proposed txn "

src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp

@@ -205,7 +205,7 @@ SponsorshipTransfer::preflight(PreflightContext const& ctx)
     // is collected on-ledger afterward, so its absence here is expected, not
     // an error (On-Chain Cosigner spec §5.3.1.2).
     if (isAccountReserveSponsorship && !ctx.tx.isFieldPresent(sfSponsorSignature) &&
-        (ctx.flags & TapProposal) == 0)
+        (ctx.flags & ApplyFlags::Proposal) == ApplyFlags::None)
     {
         JLOG(ctx.j.debug()) << "preflight: account sponsorship requires sfSponsorSignature";
         return temMALFORMED;

src/libxrpl/tx/transactors/system/Batch.cpp

@@ -371,7 +371,8 @@ Batch::preflight(PreflightContext const& ctx)
         // TapBatch — PreflightContext with a parentBatchId requires it.
         // LoanSet already short-circuits on tfInnerBatchTxn; it is also in
         // kDisabledTxTypes, so it never reaches this call.
-        ApplyFlags const innerFlags = TapBatch | (ctx.flags & (TapProposal | TapDryRun));
+        ApplyFlags const innerFlags =
+            ApplyFlags::Batch | (ctx.flags & (ApplyFlags::Proposal | ApplyFlags::DryRun));
         if (auto const preflightResult =
                 xrpl::preflight(ctx.registry, ctx.rules, parentBatchId, stx, innerFlags, ctx.j);
             !isTesSuccess(preflightResult.ter))
@@ -443,7 +444,7 @@ Batch::preflightSigValidated(PreflightContext const& ctx)
     // A proposed Batch is stored unsigned; its BatchSigners are collected
     // on-ledger afterward, so the signer-presence match belongs to submission
     // time, not proposal creation (On-Chain Cosigner spec §5.3.1.2).
-    if ((ctx.flags & TapProposal) != 0)
+    if ((ctx.flags & ApplyFlags::Proposal) != ApplyFlags::None)
         return tesSUCCESS;
 
     auto const parentBatchId = ctx.tx.getTransactionID();

src/libxrpl/tx/transactors/system/Change.cpp

@@ -12,6 +12,7 @@
 #include <xrpl/ledger/entries/FeeSettingsEntry.h>
 #include <xrpl/ledger/entries/NegativeUNLEntry.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SField.h>
@@ -124,12 +125,23 @@ Change::preclaim(PreclaimContext const& ctx)
                     ctx.tx.isFieldPresent(sfReserveIncrementDrops))
                     return temDISABLED;
             }
-            // The ttFEE transaction format defines these fields as optional,
-            // but they are unconditionally forbidden until FeeVoteImpl is
-            // updated to populate them (SmartEscrow behavioral port).
-            if (ctx.tx.isFieldPresent(sfGasLimit) || ctx.tx.isFieldPresent(sfBytecodeSizeLimit) ||
-                ctx.tx.isFieldPresent(sfGasPrice))
-                return temDISABLED;
+            if (ctx.view.rules().enabled(featureSmartEscrow))
+            {
+                if (!ctx.tx.isFieldPresent(sfGasLimit) ||
+                    !ctx.tx.isFieldPresent(sfBytecodeSizeLimit) ||
+                    !ctx.tx.isFieldPresent(sfGasPrice))
+                    return temMALFORMED;
+                if (ctx.tx[sfGasLimit] > kMaxGasLimit ||
+                    ctx.tx[sfBytecodeSizeLimit] > kMaxBytecodeSizeLimit ||
+                    ctx.tx[sfGasPrice] < kMinGasPrice)
+                    return temBAD_FEE;
+            }
+            else
+            {
+                if (ctx.tx.isFieldPresent(sfGasLimit) ||
+                    ctx.tx.isFieldPresent(sfBytecodeSizeLimit) || ctx.tx.isFieldPresent(sfGasPrice))
+                    return temDISABLED;
+            }
             return tesSUCCESS;
         case ttAMENDMENT:
         case ttUNL_MODIFY:
@@ -164,6 +176,28 @@ Change::preCompute()
     XRPL_ASSERT(accountID_ == beast::kZero, "xrpl::Change::preCompute : zero account");
 }
 
+void
+Change::initializeVMFees()
+{
+    FeeSettingsEntryW feeObject(view());
+
+    if (!feeObject)
+    {
+        feeObject.newSLE();
+        feeObject.insert();
+    }
+
+    // Compile-time constants, never `FeeSetup`: every node applies this
+    // pseudo-transaction, so reading local config here would diverge.
+    feeObject->at(sfGasLimit) = kDefaultGasLimit;
+    feeObject->at(sfBytecodeSizeLimit) = kDefaultBytecodeSizeLimit;
+    feeObject->at(sfGasPrice) = kDefaultGasPrice;
+
+    feeObject.update();
+
+    JLOG(j_.info()) << "Feature Extension fees initialized on SmartEscrow activation";
+}
+
 TER
 Change::applyAmendment()
 {
@@ -240,6 +274,9 @@ Change::applyAmendment()
                              << " activated: server blocked.";
             ctx_.registry.get().getOPs().setAmendmentBlocked();
         }
+
+        if (amendment == featureSmartEscrow)
+            initializeVMFees();
     }
 
     if (newMajorities.empty())
@@ -266,14 +303,12 @@ Change::applyFee()
         feeObject.newSLE();
         feeObject.insert();
     }
-    auto const set = [](FeeSettingsEntryW& feeObject, STTx const& tx, auto const& field) {
-        feeObject->at(field) = tx[field];
+    auto const set = [](FeeSettingsEntryW& feeObject, STTx const& tx, auto const&... fields) {
+        ((feeObject->at(fields) = tx[fields]), ...);
     };
     if (view().rules().enabled(featureXRPFees))
     {
-        set(feeObject, ctx_.tx, sfBaseFeeDrops);
-        set(feeObject, ctx_.tx, sfReserveBaseDrops);
-        set(feeObject, ctx_.tx, sfReserveIncrementDrops);
+        set(feeObject, ctx_.tx, sfBaseFeeDrops, sfReserveBaseDrops, sfReserveIncrementDrops);
         // Ensure the old fields are removed
         feeObject->makeFieldAbsent(sfBaseFee);
         feeObject->makeFieldAbsent(sfReferenceFeeUnits);
@@ -282,10 +317,11 @@ Change::applyFee()
     }
     else
     {
-        set(feeObject, ctx_.tx, sfBaseFee);
-        set(feeObject, ctx_.tx, sfReferenceFeeUnits);
-        set(feeObject, ctx_.tx, sfReserveBase);
-        set(feeObject, ctx_.tx, sfReserveIncrement);
+        set(feeObject, ctx_.tx, sfBaseFee, sfReferenceFeeUnits, sfReserveBase, sfReserveIncrement);
+    }
+    if (view().rules().enabled(featureSmartEscrow))
+    {
+        set(feeObject, ctx_.tx, sfGasLimit, sfBytecodeSizeLimit, sfGasPrice);
     }
 
     feeObject.update();

src/libxrpl/tx/transactors/token/ConfidentialMPTClawback.cpp

@@ -214,7 +214,7 @@ ConfidentialMPTClawback::doApply()
     // proof using the corresponding stale private key. The mirrors are updated
     // to the current epoch during execution.
     if (view().rules().enabled(featureConfidentialMPTKeyRotation))
-        setMirrorEpochs(*sleIssuance, *sleHolderMPToken);
+        setMirrorsCurrent(*sleIssuance, *sleHolderMPToken);
 
     // Decrease Global Confidential Outstanding Amount
     auto const oldCOA = (*sleIssuance)[sfConfidentialOutstandingAmount];

src/libxrpl/tx/transactors/token/ConfidentialMPTConvert.cpp

@@ -345,7 +345,7 @@ ConfidentialMPTConvert::doApply()
 
         // Initialize key epochs when registering the keys.
         if (view().rules().enabled(featureConfidentialMPTKeyRotation))
-            setMirrorEpochs(*sleIssuance, *sleMptoken);
+            setMirrorsCurrent(*sleIssuance, *sleMptoken);
 
         // Spending balance starts at zero. Must use canonical zero encryption
         // (deterministic ciphertext) so the ledger state is reproducible.

src/libxrpl/tx/transactors/token/ConfidentialMPTHolderKeyUpdate.cpp

@@ -85,6 +85,9 @@ ConfidentialMPTHolderKeyUpdate::preflight(PreflightContext const& ctx)
     if (hasInbox && ctx.tx[sfConfidentialBalanceInbox].length() != kEcGamalEncryptedTotalLength)
         return temBAD_CIPHERTEXT;
 
+    // TODO: Check the sfZKProof length for each mode once the proof sizes are available from
+    // mpt-crypto.
+
     if (!isValidCompressedECPoint(ctx.tx[sfHolderEncryptionKey]))
         return temMALFORMED;
 
@@ -143,6 +146,9 @@ ConfidentialMPTHolderKeyUpdate::preclaim(PreclaimContext const& ctx)
     if (ctx.tx.isFlag(tfHolderKeyRecovery) && sleMptoken->isFieldPresent(sfRecoveryKey))
         return tecNO_PERMISSION;
 
+    // TODO: Verify sfZKProof. Rotation mode proves the new spending and inbox ciphertexts hold the
+    // same amounts as the current ones under the new key; Recovery mode proves knowledge of the
+    // private key for the new sfHolderEncryptionKey.
     return tesSUCCESS;
 }
 

src/libxrpl/tx/transactors/token/ConfidentialMPTMirrorUpdate.cpp

@@ -201,6 +201,9 @@ ConfidentialMPTMirrorUpdate::preclaim(PreclaimContext const& ctx)
             return tecNO_PERMISSION;
     }
 
+    // TODO: Verify sfZKProof. Issuer mode must anchor on sfIssuerEncryptedBalance under the
+    // key that encrypted it; Holder mode anchors on sfConfidentialBalanceSpending under
+    // sfHolderEncryptionKey.
     return tesSUCCESS;
 }
 
@@ -241,7 +244,7 @@ ConfidentialMPTMirrorUpdate::doApply()
     if (ctx_.tx.isFieldPresent(sfIssuerEncryptedAmount))
     {
         (*sleMptoken)[sfIssuerEncryptedBalance] = ctx_.tx[sfIssuerEncryptedAmount];
-        setIssuerMirrorEpoch(*sleIssuance, *sleMptoken);
+        setIssuerMirrorCurrent(*sleIssuance, *sleMptoken);
     }
 
     if (ctx_.tx.isFieldPresent(sfAuditorEncryptedAmount))

src/libxrpl/tx/transactors/token/MPTokenIssuanceSet.cpp

@@ -453,10 +453,7 @@ MPTokenIssuanceSet::doApply()
             return tecINTERNAL;  // LCOV_EXCL_LINE
 
         // NOTE: presence must be checked before the key is overwritten below.
-        bool const isRotation = sle->isFieldPresent(keyField);
-        sle->setFieldVL(keyField, *pubKey);
-
-        if (isRotation)
+        if (sle->isFieldPresent(keyField))
         {
             // Preclaim rejects overwriting an existing key unless the amendment is
             // enabled.
@@ -479,9 +476,20 @@ MPTokenIssuanceSet::doApply()
                 // LCOV_EXCL_STOP
             }
 
+            // Proofs over sfIssuerEncryptedBalance must be verified against the issuer key
+            // that encrypted the mirror balance.
+            //
+            // - Mirrors migrated after an issuer key rotation store their new key in
+            //   MPToken's sfIssuerMirrorEncryptionKey.
+            // - Mirrors that were never migrated carry no record and remain under the original key.
+            //
+            // Save the original key here in MPTokenIssuance object during the first key rotation
+            if (keyField == sfIssuerEncryptionKey && !sle->isFieldPresent(epochField))
+                (*sle)[sfInitialIssuerEncryptionKey] = (*sle)[keyField];
+
             (*sle)[epochField] = epoch + 1;
         }
-
+        (*sle)[keyField] = *pubKey;
         return tesSUCCESS;
     };
 

src/test/AGENTS.md

@@ -1,5 +0,0 @@
-# AGENTS.md — test
-
-See [README.md](./README.md) for basic `--unittest` invocation.
-
-Shared test setup/helper code used by more than one test file belongs in `jtx/`, not copy-pasted across test files.

src/test/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

src/test/app/AMMExtendedMPT_test.cpp

@@ -1941,11 +1941,11 @@ private:
             auto const flowResult = [&] {
                 STAmount const deliver(eth(51'000'000));
                 STAmount smax(btc(61'000'000));
-                PaymentSandbox sb(env.current().get(), TapNone);
+                PaymentSandbox sb(env.current().get(), ApplyFlags::None);
                 STPathSet paths;
                 auto const ipe = [](MPTTester const& iss) {
                     return STPathElement(
-                        STPathElement::TypeMpt | STPathElement::TypeIssuer,
+                        STPathElementType::Mpt | STPathElementType::Issuer,
                         xrpAccount(),
                         PathAsset{iss.issuanceID()},
                         iss.issuer());
@@ -1979,7 +1979,7 @@ private:
             env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal j) {
                 if (flowResult.removableOffers.empty())
                     return false;
-                Sandbox sb(&view, TapNone);
+                Sandbox sb(&view, ApplyFlags::None);
                 for (auto const& o : flowResult.removableOffers)
                 {
                     if (auto const ok = sb.peek(keylet::offer(o)))

src/test/app/AMMExtended_test.cpp

@@ -2015,11 +2015,11 @@ private:
             auto const flowResult = [&] {
                 STAmount const deliver(USD(51));
                 STAmount smax(BTC(61));
-                PaymentSandbox sb(env.current().get(), TapNone);
+                PaymentSandbox sb(env.current().get(), ApplyFlags::None);
                 STPathSet paths;
                 auto const ipe = [](Issue const& iss) {
                     return STPathElement(
-                        STPathElement::TypeCurrency | STPathElement::TypeIssuer,
+                        STPathElementType::Currency | STPathElementType::Issuer,
                         xrpAccount(),
                         iss.currency,
                         iss.account);
@@ -2053,7 +2053,7 @@ private:
             env.app().getOpenLedger().modify([&](OpenView& view, beast::Journal j) {
                 if (flowResult.removableOffers.empty())
                     return false;
-                Sandbox sb(&view, TapNone);
+                Sandbox sb(&view, ApplyFlags::None);
                 for (auto const& o : flowResult.removableOffers)
                 {
                     if (auto const ok = sb.peek(keylet::offer(o)))