chore: Update mpt-crypto-lib to 0.4.0-rc4 (#7813)

Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>

.clang-tidy

@@ -56,32 +56,17 @@ Checks: "-*,
 
   readability-*,
   -readability-avoid-const-params-in-decls,
-  -readability-avoid-unconditional-preprocessor-if,
   -readability-container-data-pointer,
-  -readability-delete-null-pointer,
   -readability-function-cognitive-complexity,
-  -readability-function-size,
   -readability-identifier-length,
   -readability-inconsistent-declaration-parameter-name,
   -readability-isolate-declaration,
   -readability-magic-numbers,
-  -readability-misplaced-array-index,
   -readability-named-parameter,
-  -readability-operators-representation,
   -readability-qualified-auto,
   -readability-redundant-access-specifiers,
-  -readability-redundant-control-flow,
-  -readability-redundant-function-ptr-dereference,
-  -readability-redundant-preprocessor,
-  -readability-redundant-smartptr-get,
-  -readability-redundant-string-cstr,
-  -readability-simplify-subscript-expr,
   -readability-static-accessed-through-instance,
-  -readability-string-compare,
-  -readability-uniqueptr-delete-release,
-  -readability-uppercase-literal-suffix,
-  -readability-use-anyofallof,
-  -readability-use-concise-preprocessor-directives
+  -readability-uppercase-literal-suffix
   "
 # ---
 # bugprone-narrowing-conversions,                      # This will break a lot of code but we should enable it in the future because it can eliminate a lot of bugs

.cspell.config.yaml

@@ -65,7 +65,7 @@ words:
   - Btrfs
   - Buildx
   - canonicality
-  - CGNAT
+  - canonicalised
   - changespq
   - checkme
   - choco
@@ -73,6 +73,7 @@ words:
   - citardauq
   - clawback
   - clawbacks
+  - clippy
   - cmaketoolchain
   - coeffs
   - coldwallet
@@ -114,7 +115,6 @@ words:
   - envrc
   - exceptioned
   - EXPECT_STREQ
-  - exfiltration
   - Falco
   - fcontext
   - finalizers
@@ -123,8 +123,6 @@ words:
   - fsanitize
   - funclets
   - Gamal
-  - gantt
-  - Gantt
   - gcov
   - gcovr
   - ghead
@@ -133,8 +131,6 @@ words:
   - gpgcheck
   - gpgkey
   - hotwallet
-  - hicpp
-  - htpasswd
   - hwaddress
   - hwrap
   - ifndef
@@ -173,11 +169,12 @@ words:
   - mathbunnyru
   - mcmodel
   - MEMORYSTATUSEX
+  - MPTAMM
+  - MPTDEX
   - Merkle
   - Metafuncton
   - misprediction
   - missingok
-  - MPTAMM
   - mptbalance
   - MPTDEX
   - mptflags
@@ -211,7 +208,6 @@ words:
   - nonxrp
   - noreplace
   - noripple
-  - nostd
   - nostdinc
   - notifempty
   - nudb
@@ -220,7 +216,6 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
-  - otelc
   - pargs
   - partitioner
   - paychan
@@ -229,7 +224,6 @@ words:
   - permdex
   - perminute
   - permissioned
-  - pimpl
   - pointee
   - populator
   - preauth
@@ -267,6 +261,7 @@ words:
   - rocksdb
   - Rohrs
   - roundings
+  - rustc
   - sahyadri
   - Satoshi
   - scons
@@ -287,6 +282,8 @@ words:
   - sles
   - soci
   - socidb
+  - sponsee
+  - sponsees
   - SRPMS
   - sslws
   - statsd
@@ -308,7 +305,7 @@ words:
   - takerpays
   - ters
   - TMEndpointv2
-  - traceql
+  - tparam
   - trixie
   - tx
   - txid
@@ -316,7 +313,6 @@ words:
   - txjson
   - txn
   - txns
-  - txqueue
   - txs
   - ubsan
   - UBSAN
@@ -337,6 +333,7 @@ words:
   - unserviced
   - unshareable
   - unshares
+  - unsponsored
   - unsquelch
   - unsquelched
   - unsquelching
@@ -365,7 +362,4 @@ words:
   - xrplf
   - xxhash
   - xxhasher
-  - xychart
-  - zpages
-  - pratik
-  - dedup
+  - CGNAT

.envrc

@@ -0,0 +1 @@
+use flake

.github/scripts/levelization/results/loops.txt

@@ -1,6 +1,3 @@
-Loop: xrpl.telemetry xrpld.rpc
-  xrpld.rpc > xrpl.telemetry
-
 Loop: xrpld.app xrpld.overlay
   xrpld.app > xrpld.overlay
 

.github/scripts/levelization/results/ordering.txt

@@ -45,10 +45,6 @@ libxrpl.shamap > xrpl.basics
 libxrpl.shamap > xrpl.nodestore
 libxrpl.shamap > xrpl.protocol
 libxrpl.shamap > xrpl.shamap
-libxrpl.telemetry > xrpl.basics
-libxrpl.telemetry > xrpl.config
-libxrpl.telemetry > xrpl.protocol
-libxrpl.telemetry > xrpl.telemetry
 libxrpl.tx > xrpl.basics
 libxrpl.tx > xrpl.conditions
 libxrpl.tx > xrpl.core
@@ -56,7 +52,6 @@ libxrpl.tx > xrpl.json
 libxrpl.tx > xrpl.ledger
 libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
-libxrpl.tx > xrpl.telemetry
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
 test.app > test.unit_test
@@ -164,6 +159,7 @@ test.peerfinder > xrpl.protocol
 test.protocol > test.jtx
 test.protocol > test.unit_test
 test.protocol > xrpl.basics
+test.protocol > xrpld.core
 test.protocol > xrpl.json
 test.protocol > xrpl.protocol
 test.rpc > test.jtx
@@ -203,7 +199,6 @@ tests.libxrpl > xrpl.protocol_autogen
 tests.libxrpl > xrpl.resource
 tests.libxrpl > xrpl.server
 tests.libxrpl > xrpl.shamap
-tests.libxrpl > xrpl.telemetry
 tests.libxrpl > xrpl.tx
 xrpl.conditions > xrpl.basics
 xrpl.conditions > xrpl.protocol
@@ -241,19 +236,16 @@ xrpl.server > xrpl.resource
 xrpl.shamap > xrpl.basics
 xrpl.shamap > xrpl.nodestore
 xrpl.shamap > xrpl.protocol
-xrpl.telemetry > xrpl.config
 xrpl.tx > xrpl.basics
 xrpl.tx > xrpl.core
 xrpl.tx > xrpl.ledger
 xrpl.tx > xrpl.protocol
-xrpl.tx > xrpl.telemetry
 xrpld.app > test.unit_test
 xrpld.app > xrpl.basics
 xrpld.app > xrpl.config
 xrpld.app > xrpl.core
 xrpld.app > xrpld.consensus
 xrpld.app > xrpld.core
-xrpld.app > xrpld.telemetry
 xrpld.app > xrpl.json
 xrpld.app > xrpl.ledger
 xrpld.app > xrpl.net
@@ -263,7 +255,6 @@ xrpld.app > xrpl.rdb
 xrpld.app > xrpl.resource
 xrpld.app > xrpl.server
 xrpld.app > xrpl.shamap
-xrpld.app > xrpl.telemetry
 xrpld.app > xrpl.tx
 xrpld.consensus > xrpl.basics
 xrpld.consensus > xrpl.json
@@ -281,14 +272,12 @@ xrpld.overlay > xrpl.core
 xrpld.overlay > xrpld.consensus
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
-xrpld.overlay > xrpld.telemetry
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.ledger
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource
 xrpld.overlay > xrpl.server
 xrpld.overlay > xrpl.shamap
-xrpld.overlay > xrpl.telemetry
 xrpld.overlay > xrpl.tx
 xrpld.peerfinder > xrpl.basics
 xrpld.peerfinder > xrpl.config
@@ -322,5 +311,3 @@ xrpld.shamap > xrpld.core
 xrpld.shamap > xrpl.nodestore
 xrpld.shamap > xrpl.protocol
 xrpld.shamap > xrpl.shamap
-xrpld.telemetry > xrpl.basics
-xrpld.telemetry > xrpl.telemetry

.github/scripts/otel-naming/README.md

@@ -1,70 +0,0 @@
-# OTel naming-consistency check
-
-`check_otel_naming.py` enforces the OpenTelemetry span-attribute naming
-convention documented in
-[CONTRIBUTING.md](../../../CONTRIBUTING.md#telemetry-span-attribute-naming)
-across every layer of the telemetry pipeline. The `*SpanNames.h` constants are
-the single source of truth (L1); every other layer must agree with them.
-
-## Running locally
-
-```
-python .github/scripts/otel-naming/check_otel_naming.py
-```
-
-It takes no arguments, can be run from any directory inside the repo, and uses
-only the Python standard library (no `pip install`, matching the levelization
-check). A non-zero exit code means a violation was found; the output lists each
-violation as `RULE | location | token | expected`.
-
-## What it checks
-
-The valid key set is **derived dynamically from the OTel code** — there is no
-hardcoded allowlist:
-
-- **L1 keys** come from the `namespace attr { ... }` blocks of every
-  `*SpanNames.h`, resolving the `makeStr("x")` / `join(seg::a, seg::b)` DSL
-  (cross-file, so `join(seg::rpc, ...)` resolves `seg::rpc` from the base
-  `SpanNames.h`). Each constant is resolved against **its own** header, so two
-  headers that define a same-named constant (e.g. a base `attr::ledgerHash` and
-  a domain `attr::ledgerHash`) each contribute their real wire key — a later
-  header cannot clobber an earlier one's value in a flat table.
-- **Legitimate dotted keys** = ONLY the keys the code actually sets as resource
-  attributes, i.e. the entries inside `Telemetry.cpp`'s `Resource::Create({...})`
-  call: the `semconv::service::*` keys (`service.*`) plus any `attr::<name>`
-  constants passed there (`xrpl.network.*`). A dotted key that is _declared_ in a
-  header but never set as a resource attr is a span attribute in resource
-  clothing — a Rule-A violation, even if it lives in the base `SpanNames.h`.
-
-### Rules (each fails the build, when its inputs are present)
-
-| Rule | Check                                                                                                                                                                                                                              |
-| ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| A    | No stray dotted span-attribute key (only the derived resource keys may be dotted).                                                                                                                                                 |
-| G    | Attribute keys are `lower_snake_case` (`^[a-z][a-z0-9_]*$` per dot-segment) — no camelCase, UPPERCASE, or spaces.                                                                                                                  |
-| F    | No string literals as attribute keys or span-name arguments in `setAttribute`/`addEvent`/`span`/`childSpan`. Attribute _values_ are exempt (runtime data); `*SpanNames.h` definitions and test files are exempt.                   |
-| B    | Every collector `spanmetrics.dimensions` name exists in the L1 key set.                                                                                                                                                            |
-| C    | Every Tempo span-filter tag exists in the L1 key set.                                                                                                                                                                              |
-| D    | Every dashboard label resolves to an L1 span attribute, a native-metric label (L6, emitted by MetricsRegistry), or a Prometheus/Grafana builtin. TraceQL scope prefixes (`span.`/`resource.`/…) are stripped before the L1 lookup. |
-| E    | No dotted `xrpl.<domain>.<field>` attribute key in the runbook (only the L1 resource attrs `xrpl.network.*` may be dotted). Span names, filenames, OTel-standard keys, and metric labels are not flagged.                          |
-
-Rule F runs **unconditionally** (it is a purely syntactic check on the
-call-sites and needs no `*SpanNames.h`), so a code path that calls
-`SpanGuard::span`/`setAttribute` directly without ever defining a header is
-still caught.
-
-### Warnings (printed, never fail the build)
-
-| Rule | Check                                                                                                                                                                                                                                                                                                                                                                                      |
-| ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| H    | A namespace-qualified constant (e.g. `foo::bar::myKey`) used at a telemetry call-site is not defined in any `*SpanNames.h`. The constant should live in the proper header; defining it in-place bypasses rules A/G/F. Warns rather than fails — the argument may be a legitimately dynamic value, and the header may live on a later branch. Bare locals and `std::` names are not warned. |
-
-## Presence-gated
-
-Every rule runs **only when the source files it needs are present** in the tree
-and is otherwise skipped (printed as `SKIP: <rule> — <reason>`), never failed.
-This keeps the check correct no matter how telemetry work is split across PRs —
-a stacked chain, one large PR, or independent per-stage PRs where (for example)
-the collector config lands before the dashboards. The collector/Tempo/dashboard/
-runbook layers are introduced in later phases; on a branch without them, only
-the L1-intrinsic rules (A, G, F) run.

.github/scripts/otel-naming/check_otel_naming.py

@@ -1,885 +0,0 @@
-#!/usr/bin/env python3
-
-"""
-Usage: check_otel_naming.py
-This script takes no parameters and can be called from any directory inside the
-repository (it locates the repo root via `git rev-parse`).
-
-Enforces the OpenTelemetry span-attribute naming convention documented in
-CONTRIBUTING.md ("Telemetry span attribute naming") across every layer of the
-telemetry pipeline. The `*SpanNames.h` constants are the single source of truth
-(L1); every other layer must agree with them.
-
-Design principles
------------------
-1. No hardcoded allowlist. The set of valid attribute keys — including which
-   dotted keys are legitimate resource attributes — is derived dynamically by
-   parsing the repository's own OTel code:
-     * `*SpanNames.h` `namespace attr { ... }` blocks (the underscore/bare keys
-       and the `join(seg::..., ...)` dotted resource compositions), and
-     * the keys the code passes to `Resource::Create({ ... })` in Telemetry.cpp
-       (the standard `semconv::service::*` keys -> service.name/version/...).
-
-2. Presence-gated enforcement. Every rule runs ONLY when the source files it
-   needs are present in the tree, and is otherwise skipped (never failed). This
-   keeps the check correct no matter how work is split across PRs: a stacked
-   chain, one large PR, or independent per-stage PRs where (for example) the
-   collector config lands in a different PR than the dashboards. The check never
-   assumes a file from another phase/PR exists.
-
-Layers
-------
-  L1 code      : src/**/*SpanNames.h, include/**/*SpanNames.h  (ground truth)
-  L1 resource  : src/libxrpl/telemetry/Telemetry.cpp           (dotted allowlist)
-  L1 callsites : setAttribute/addEvent/span/childSpan in src/**, include/**
-  L2 collector : docker/telemetry/otel-collector-config.yaml   (spanmetrics dims)
-  L3 tempo     : docker/telemetry/tempo.yaml                    (span filter tags)
-  L4 dashboards: docker/telemetry/grafana/dashboards/*.json     (PromQL labels)
-  L5 runbook   : docs/telemetry-runbook.md                      (attr tables)
-  L6 metrics   : MetricsRegistry.cpp instrument labels          (native-metric
-                 label keys, a valid dashboard-label source besides L1)
-
-Rules (each FAILS the build, when its inputs are present)
----------------------------------------------------------
-  A  No stray dotted span-attribute key. A dotted `<a>.<b>` used as a span
-     attribute that is not in the derived resource-key set is a violation.
-  G  Attribute keys must be lower_snake_case (^[a-z][a-z0-9_]*$ per segment).
-     Flags camelCase, UPPERCASE, spaces, and other stray characters.
-  F  No string literals as attribute keys or span-name arguments. The
-     setAttribute/addEvent key and the span/childSpan prefix/name args must
-     reference a *SpanNames.h constant, never a "literal". Attribute VALUES are
-     exempt (runtime data). Definitions inside *SpanNames.h are exempt, and
-     test files are exempt (they pass arbitrary literals to exercise the API).
-  B  Every collector spanmetrics dimension exists in the L1 key set.
-  C  Every tempo span-filter tag exists in the L1 key set.
-  D  Every dashboard label resolves to an L1 span attribute, an L6
-     native-metric label, or a builtin. TraceQL `span.`/`resource.` scope
-     prefixes are stripped before the L1 lookup.
-  E  No dotted `xrpl.<domain>.<field>` attribute key in the runbook (only the
-     L1 resource attrs xrpl.network.* may be dotted). Span names, filenames,
-     OTel-standard keys, and metric labels are not flagged.
-
-Warnings (printed, but do NOT fail the build)
-----------------------------------------------
-  H  A constant referenced at a telemetry call-site is not defined in any
-     *SpanNames.h. Span constants should live in the corresponding
-     *SpanNames.h (single source of truth); defining one in-place bypasses the
-     naming rules. A warning (not a failure) because the argument may instead
-     be a legitimately dynamic local (e.g. a computed span-name leaf).
-
-Exit code is non-zero if any present-and-enforced rule finds a violation.
-Warnings never change the exit code.
-"""
-
-import re
-import subprocess
-import sys
-from pathlib import Path
-from typing import Dict, List, Optional, Set, Tuple
-
-# ---------------------------------------------------------------------------
-# Repo location
-# ---------------------------------------------------------------------------
-
-
-def repo_root() -> Path:
-    """Return the repository root, so the script works from any CWD.
-
-    Exits with a readable message (not a traceback) if git is unavailable or the
-    CWD is outside a repository."""
-    try:
-        out = subprocess.run(
-            ["git", "rev-parse", "--show-toplevel"],
-            capture_output=True,
-            text=True,
-            check=True,
-        )
-    except (subprocess.CalledProcessError, FileNotFoundError):
-        print(
-            "error: check_otel_naming.py must be run inside the git repository.",
-            file=sys.stderr,
-        )
-        sys.exit(2)
-    return Path(out.stdout.strip())
-
-
-def read_source(path: Path) -> str:
-    """Read a file as UTF-8, tolerating stray non-UTF-8 bytes rather than
-    crashing the whole check on one bad byte."""
-    return path.read_text(encoding="utf-8", errors="ignore")
-
-
-# ---------------------------------------------------------------------------
-# Regexes (compiled once)
-# ---------------------------------------------------------------------------
-
-# A segment/string constant definition: `inline constexpr auto NAME = <expr>;`
-CONST_DEF = re.compile(r"inline\s+constexpr\s+auto\s+(\w+)\s*=\s*(.+?);", re.DOTALL)
-MAKESTR = re.compile(r'makeStr\(\s*"([^"]*)"\s*\)')
-# A `namespace <name> {` opener, to track which namespace a constant lives in.
-NS_OPEN = re.compile(r"namespace\s+([\w:]+)\s*\{")
-# A `using ::a::b::field;` re-export inside an attr block; captures the leaf.
-USING_DECL = re.compile(r"using\s+(?:::)?[\w:]*::(\w+)\s*;")
-# Telemetry call-sites whose string arguments must be constants, not literals.
-# Require a receiver so we match real SpanGuard calls, not std::span / a math
-# `span(...)` / a bare method declaration:
-#   - `SpanGuard::span(` / `SpanGuard::childSpan(`  (static factory)
-#   - `<obj>.span(` / `<obj>->setAttribute(` etc.   (member call)
-# `span`/`childSpan` additionally require the `SpanGuard`/`.`/`->` receiver;
-# `setAttribute`/`addEvent` only ever exist on a guard, so a `.`/`->` suffices.
-CALLSITE = re.compile(
-    r"(?:SpanGuard::|\.|->)\s*(setAttribute|addEvent|span|childSpan)\s*\("
-)
-# A C++ string literal (used to flag literals inside call-site argument lists).
-STRING_LITERAL = re.compile(r'"((?:[^"\\]|\\.)*)"')
-# A C++ line comment (`//` ... end of line) and a block comment (`/* ... */`).
-LINE_COMMENT = re.compile(r"//[^\n]*")
-BLOCK_COMMENT = re.compile(r"/\*.*?\*/", re.DOTALL)
-# A TraceQL scope prefix on a label (`span.`, `resource.`, `event.`, etc.).
-# Dashboards reference span attributes in TraceQL as `span.<attr>`; the bare
-# attribute is what must exist in L1, so strip the scope before validating.
-TRACEQL_SCOPE = re.compile(r"^(?:span|resource|event|link|instrumentation_scope)\.")
-# An OTel metric label key as emitted in C++: `Add(.., {{"label", ...}})` /
-# `{{"label", value}}` instrument calls in MetricsRegistry.
-METRIC_LABEL = re.compile(r'\{\{\s*"([a-z_][a-z0-9_]*)"\s*,')
-
-
-def strip_comments(text: str) -> str:
-    """Remove C/C++ `//` line comments and `/* ... */` block comments.
-
-    Used only for L1 attribute-key extraction so that a commented-out or
-    illustrative `makeStr("...")` inside a `namespace attr` block does not leak
-    into the authoritative key set. Rule F deliberately does NOT strip comments
-    — it must still see `@code` doc-comment examples so their call-site
-    arguments are held to the constant-only convention.
-
-    String literals are not specially handled; a `//` or `/*` appearing inside a
-    string is vanishingly rare in the *SpanNames.h headers and would at worst
-    drop a constant from L1 (a conservative direction).
-    """
-    text = BLOCK_COMMENT.sub("", text)
-    text = LINE_COMMENT.sub("", text)
-    return text
-
-
-# ---------------------------------------------------------------------------
-# L1: parse *SpanNames.h into the authoritative key set
-# ---------------------------------------------------------------------------
-
-
-def find_spanname_headers(root: Path) -> List[Path]:
-    return sorted(
-        p
-        for p in list((root / "src").rglob("*SpanNames.h"))
-        + list((root / "include").rglob("*SpanNames.h"))
-        if p.is_file()
-    )
-
-
-def resolve_constants(
-    text: str, symbols: Optional[Dict[str, str]] = None
-) -> Dict[str, str]:
-    """Resolve `inline constexpr auto NAME = <makeStr/join expr>` to strings.
-
-    Supports the small constexpr DSL used by SpanNames.h:
-      makeStr("x")          -> "x"
-      join(a, b)            -> resolve(a) + "." + resolve(b)
-      seg::xrpl / attr::foo -> looked up in the symbol table
-    The optional `symbols` argument seeds (and is updated in place with) the
-    table, so a global pass over ALL *SpanNames.h headers can resolve
-    cross-file references such as `join(seg::rpc, ...)` where `seg::rpc` is
-    defined in the base SpanNames.h. Keys are stored by their bare name
-    (last `::` component), so `seg::rpc` and `rpc` both resolve.
-    """
-    if symbols is None:
-        symbols = {}
-
-    def resolve_expr(expr: str) -> Optional[str]:
-        expr = expr.strip()
-        m = MAKESTR.fullmatch(expr)
-        if m:
-            return m.group(1)
-        if expr.startswith("join(") and expr.endswith(")"):
-            args = split_top_level_args(expr[len("join(") : -1])
-            parts = [resolve_expr(a) for a in args]
-            if any(p is None for p in parts):
-                return None
-            return ".".join(p for p in parts if p is not None)
-        # Bare or qualified symbol reference, e.g. `seg::xrpl` or `networkId`.
-        key = expr.split("::")[-1]
-        return symbols.get(key, symbols.get(expr))
-
-    # Iterate definitions in source order so earlier symbols are available.
-    for m in CONST_DEF.finditer(text):
-        name, expr = m.group(1), m.group(2)
-        val = resolve_expr(expr)
-        if val is not None:
-            symbols[name] = val
-    return symbols
-
-
-def build_global_symbols(headers: List[Path]) -> Dict[str, str]:
-    """Resolve constants across ALL headers so cross-file `seg::`/`join`
-    references (e.g. `join(seg::rpc, ...)` in RpcSpanNames.h, where `seg::rpc`
-    lives in the base SpanNames.h) resolve. Base SpanNames.h is processed
-    first so its `seg::` segments seed the table."""
-    symbols: Dict[str, str] = {}
-    ordered = sorted(headers, key=lambda p: (p.name != "SpanNames.h", str(p)))
-    # Two passes: the first seeds segments, the second resolves dependents.
-    # Comments are stripped so a commented-out constant cannot seed the table.
-    for _ in range(2):
-        for h in ordered:
-            resolve_constants(strip_comments(read_source(h)), symbols)
-    return symbols
-
-
-def split_top_level_args(s: str) -> List[str]:
-    """Split a comma-separated arg list, respecting nested parentheses and
-    ignoring parens/commas that appear inside a "string literal" (so a value
-    like `setAttribute(k, ",")` does not get mis-split)."""
-    args, depth, cur = [], 0, ""
-    in_str = False
-    escaped = False
-    for ch in s:
-        if in_str:
-            cur += ch
-            if escaped:
-                escaped = False
-            elif ch == "\\":
-                escaped = True
-            elif ch == '"':
-                in_str = False
-            continue
-        if ch == '"':
-            in_str = True
-            cur += ch
-        elif ch == "(":
-            depth += 1
-            cur += ch
-        elif ch == ")":
-            depth -= 1
-            cur += ch
-        elif ch == "," and depth == 0:
-            args.append(cur)
-            cur = ""
-        else:
-            cur += ch
-    if cur.strip():
-        args.append(cur)
-    return args
-
-
-def attr_namespace_spans(text: str) -> List[str]:
-    """Return the source text of each `namespace attr { ... }` block in `text`.
-
-    Brace-matched over the whole (comment-stripped) text, so a definition that
-    wraps across several physical lines is contained in one span. Nested braces
-    inside the block are balanced correctly."""
-    spans: List[str] = []
-    for opener in NS_OPEN.finditer(text):
-        if opener.group(1).split("::")[-1] != "attr":
-            continue
-        # Walk from the opening brace, balancing nesting to the matching close.
-        i = opener.end()  # one char past the namespace's `{`
-        depth = 1
-        start = i
-        while i < len(text) and depth > 0:
-            c = text[i]
-            if c == "{":
-                depth += 1
-            elif c == "}":
-                depth -= 1
-            i += 1
-        spans.append(text[start : i - 1])
-    return spans
-
-
-def attr_keys_from_header(path: Path, symbols: Dict[str, str]) -> Set[str]:
-    """Return the set of attribute-key strings declared in a header's
-    `namespace attr { ... }` block(s). `symbols` is the global cross-file
-    table, used ONLY to seed `seg::`/segment references for `join(...)`
-    resolution — never to look up an attr constant's value.
-
-    A constant DEFINED in this header is resolved against this header's OWN
-    text, so two headers that each define a same-named constant (e.g. the base
-    `attr::ledgerHash = xrpl.ledger.hash` and consensus
-    `attr::ledgerHash = ledger_hash`) each report their real wire key. The
-    global table is keyed by bare name and would otherwise let a later header
-    clobber an earlier one, erasing the real key from L1 (a Rule-A blind spot).
-    A `using`-re-export, by contrast, imports a constant defined elsewhere, so
-    it is resolved against the global table.
-
-    Comments are stripped first (a commented constant must not enter L1), and
-    each attr block is brace-matched over the whole text so multi-line
-    `inline constexpr auto NAME = join(\\n  ...);` definitions are captured."""
-    text = strip_comments(read_source(path))
-    # Local table: the global segments/symbols seed cross-file `join` parts,
-    # then this header's own definitions overwrite any same-named global entry
-    # so a locally-defined attr resolves to ITS value, not another header's.
-    local = dict(symbols)
-    resolve_constants(text, local)
-    keys: Set[str] = set()
-    for block in attr_namespace_spans(text):
-        for md in CONST_DEF.finditer(block):
-            # Resolve a locally-defined constant against the LOCAL table; this
-            # captures makeStr("x") and join(seg::y, ...) with the header's own
-            # value, immune to cross-header bare-name collisions.
-            val = local.get(md.group(1))
-            if val is not None:
-                keys.add(val)
-        # `using ::ns::attr::field;` re-exports a constant defined in ANOTHER
-        # header (e.g. PeerSpanNames imports the base ledgerHash). Resolve the
-        # imported name against the global table.
-        for um in USING_DECL.finditer(block):
-            val = symbols.get(um.group(1))
-            if val is not None:
-                keys.add(val)
-    return keys
-
-
-# ---------------------------------------------------------------------------
-# Reporting
-# ---------------------------------------------------------------------------
-
-
-class Report:
-    def __init__(self) -> None:
-        self.violations: List[Tuple[str, str, str, str]] = []
-        self.warnings: List[Tuple[str, str, str, str]] = []
-        self.skips: List[str] = []
-        self.checked: List[str] = []
-
-    def violation(self, rule: str, loc: str, token: str, expected: str) -> None:
-        self.violations.append((rule, loc, token, expected))
-
-    def warning(self, rule: str, loc: str, token: str, note: str) -> None:
-        """A non-fatal finding: printed, but does not fail the build. Used where
-        the script cannot be certain a finding is wrong (e.g. a constant used at
-        a call-site that is not defined in any *SpanNames.h — it might be a
-        misplaced constant, or a legitimately dynamic value)."""
-        self.warnings.append((rule, loc, token, note))
-
-    def skip(self, rule: str, reason: str) -> None:
-        self.skips.append(f"SKIP: {rule} — {reason}")
-
-    def ok(self, msg: str) -> None:
-        self.checked.append(f"OK:   {msg}")
-
-    def render_and_exit(self) -> None:
-        for line in self.skips:
-            print(line)
-        for line in self.checked:
-            print(line)
-        if self.warnings:
-            print("\nNaming-convention warnings (non-fatal):\n")
-            print(f"  {'RULE':<5} {'LOCATION':<48} {'TOKEN':<28} NOTE")
-            print(f"  {'-' * 5} {'-' * 48} {'-' * 28} {'-' * 30}")
-            for rule, loc, token, note in self.warnings:
-                print(f"  {rule:<5} {loc:<48} {token:<28} {note}")
-        if self.violations:
-            print("\nNaming-convention violations:\n")
-            print(f"  {'RULE':<5} {'LOCATION':<48} {'TOKEN':<28} EXPECTED")
-            print(f"  {'-' * 5} {'-' * 48} {'-' * 28} {'-' * 30}")
-            for rule, loc, token, expected in self.violations:
-                print(f"  {rule:<5} {loc:<48} {token:<28} {expected}")
-            print(
-                "\nSee CONTRIBUTING.md -> 'Telemetry span attribute naming'. "
-                "The *SpanNames.h constants are the single source of truth."
-            )
-            sys.exit(1)
-        print("\nAll present telemetry naming layers are consistent.")
-        sys.exit(0)
-
-
-def main() -> None:
-    root = repo_root()
-    report = Report()
-
-    # --- Build the L1 ground-truth key set (presence-gated) ----------------
-    headers = find_spanname_headers(root)
-    l1_keys: Set[str] = set()
-    if headers:
-        symbols = build_global_symbols(headers)
-        # Map each key to the header(s) that declare it, so Rule A can tell a
-        # legitimate resource attr (declared in the base SpanNames.h) from a
-        # stray dotted key declared in a domain header.
-        keys_by_header: Dict[Path, Set[str]] = {}
-        for h in headers:
-            hk = attr_keys_from_header(h, symbols)
-            keys_by_header[h] = hk
-            l1_keys |= hk
-        report.ok(
-            f"L1: {len(l1_keys)} attribute keys from {len(headers)} "
-            f"*SpanNames.h header(s)"
-        )
-    else:
-        report.skip("L1", "no *SpanNames.h present (not a naming-relevant tree)")
-        keys_by_header = {}
-
-    # --- Derive the legitimate dotted (resource) keys dynamically ----------
-    # ONLY the keys actually passed to Resource::Create() in Telemetry.cpp
-    # (semconv service.* + the attr:: constants set there, e.g. xrpl.network.*).
-    # A dotted key declared in a header but NOT set as a resource attr is a
-    # Rule-A violation, not an allowlist entry.
-    resource_symbols = symbols if headers else {}
-    dotted_allow = derive_dotted_resource_keys(root, resource_symbols, report)
-
-    # --- Rule A: no stray dotted span-attribute keys -----------------------
-    if l1_keys:
-        run_rule_a(keys_by_header, dotted_allow, report)
-    # --- Rule G: keys must be lower_snake_case -----------------------------
-    if l1_keys:
-        run_rule_g(keys_by_header, report)
-    # --- Rule F (+ Rule H): scan telemetry call-sites ----------------------
-    # Runs UNCONDITIONALLY: Rule F is a purely syntactic check (is this argument
-    # a literal?) and does not need the L1 key set, so a code path that uses
-    # SpanGuard::span/setAttribute directly without ever defining a *SpanNames.h
-    # is still caught. Rule H (warning) additionally flags constant references
-    # not defined in any *SpanNames.h.
-    header_symbols = spanname_symbol_names(headers)
-    run_rule_f(root, report, header_symbols)
-
-    # --- Cross-layer rules B/C/D/E (each presence-gated) -------------------
-    # L6 native-metric labels: span attributes are not the only valid dashboard
-    # labels — the MetricsRegistry emits OTel metrics whose label keys are an
-    # additional source of truth. Derive them dynamically (same principle as L1)
-    # so dashboards may reference them without tripping Rule D.
-    metric_labels = metric_label_names(root)
-    run_rule_b_collector(root, l1_keys, report)
-    run_rule_c_tempo(root, l1_keys, report)
-    run_rule_d_dashboards(root, l1_keys, metric_labels, report)
-    run_rule_e_runbook(root, l1_keys, report)
-
-    report.render_and_exit()
-
-
-def resource_create_block(text: str) -> str:
-    """Return the text inside the first `Resource::Create({ ... })` argument
-    list, brace-matched so nested `{key, value}` initializers are contained.
-    Empty string if the call is absent."""
-    m = re.search(r"Resource::Create\(\s*\{", text)
-    if not m:
-        return ""
-    i = m.end()  # one char past the opening `{`
-    depth, start = 1, i
-    while i < len(text) and depth > 0:
-        c = text[i]
-        if c == "{":
-            depth += 1
-        elif c == "}":
-            depth -= 1
-        i += 1
-    return text[start : i - 1]
-
-
-def derive_dotted_resource_keys(
-    root: Path, symbols: Dict[str, str], report: Report
-) -> Set[str]:
-    """Legitimate dotted keys = ONLY the keys the code actually sets as RESOURCE
-    attributes, i.e. the entries inside Telemetry.cpp's `Resource::Create({...})`
-    call: the standard semconv keys (`service.*`) plus any `attr::<name>`
-    constants passed there (resolved to their wire key via the global symbol
-    table, e.g. `attr::networkId` -> `xrpl.network.id`).
-
-    A dotted key DECLARED in a `*SpanNames.h` header but NOT passed to
-    Resource::Create() is a span attribute wearing the resource form — a Rule-A
-    violation, never allowlisted. Deriving the allowlist from the actual
-    resource call (not from "any dotted key in the base header") is what lets
-    Rule A catch a stray dotted span attr such as `xrpl.ledger.hash`."""
-    allow: Set[str] = set()
-    tele = root / "src" / "libxrpl" / "telemetry" / "Telemetry.cpp"
-    if not tele.is_file():
-        report.skip("resource-derive", "Telemetry.cpp not present")
-        return allow
-    block = resource_create_block(read_source(tele))
-    # semconv::<group>::k<CamelKey> -> the dotted OTel-standard key. The
-    # CamelKey already embeds the group, e.g. service::kServiceInstanceId
-    # -> service.instance.id. Split the CamelCase name into dotted lowercase
-    # segments; if it does not lead with the group, prepend the group.
-    for m in re.finditer(r"semconv::(\w+)::k(\w+)", block):
-        group, camel = m.group(1), m.group(2)
-        segments = camel_to_dotsegments(camel)
-        if segments and segments[0] == group:
-            allow.add(".".join(segments))
-        else:
-            allow.add(group + "." + ".".join(segments))
-    # attr::<name> constants set as resource attrs (e.g. networkId/networkType);
-    # resolve each to its wire key and allowlist only the dotted ones.
-    for m in re.finditer(r"attr::(\w+)", block):
-        val = symbols.get(m.group(1))
-        if val is not None and "." in val:
-            allow.add(val)
-    report.ok(f"resource dotted-key allowlist derived: {sorted(allow)}")
-    return allow
-
-
-def camel_to_dotsegments(s: str) -> List[str]:
-    """Split a CamelCase identifier into lowercase dot-segment parts, e.g.
-    `ServiceInstanceId` -> ['service', 'instance', 'id']."""
-    return [w.lower() for w in re.findall(r"[A-Z][a-z0-9]*", s)]
-
-
-def run_rule_a(
-    keys_by_header: Dict[Path, Set[str]], dotted_allow: Set[str], report: Report
-) -> None:
-    """Any dotted attribute key that is not an allowed resource key is a
-    violation, reported against the header that declares it."""
-    found = False
-    for h in sorted(keys_by_header):
-        for key in sorted(keys_by_header[h]):
-            if "." in key and key not in dotted_allow:
-                found = True
-                report.violation("A", h.name, key, "underscore form, not dotted")
-    if not found:
-        report.ok("A: no stray dotted span-attribute keys")
-
-
-# A lower_snake_case identifier segment: starts lowercase, then lowercase /
-# digits / underscores. No uppercase, no spaces, no camelCase.
-SNAKE_SEGMENT = re.compile(r"^[a-z][a-z0-9_]*$")
-
-
-def run_rule_g(keys_by_header: Dict[Path, Set[str]], report: Report) -> None:
-    """Every attribute key must be lower_snake_case. Bare/underscore keys must
-    match ^[a-z][a-z0-9_]*$; dotted resource keys must be lowercase
-    dot-separated segments (each segment lower_snake_case). Flags camelCase,
-    UPPERCASE, spaces, and other stray characters."""
-    found = False
-    for h in sorted(keys_by_header):
-        for key in sorted(keys_by_header[h]):
-            segments = key.split(".")
-            if all(SNAKE_SEGMENT.match(seg) for seg in segments):
-                continue
-            found = True
-            report.violation("G", h.name, key, "must be lower_snake_case")
-    if not found:
-        report.ok("G: all attribute keys are lower_snake_case")
-
-
-# Which argument positions of each call must be a constant (0-based). The
-# attribute VALUE position is intentionally absent: values are runtime data
-# (command names, hashes, counts), not naming-convention surface.
-#   setAttribute(key, value)        -> check arg 0 (key); value (arg 1) exempt
-#   addEvent(name[, attrs])         -> check arg 0 (event name)
-#   span(category, prefix, name)    -> check args 1,2 (prefix + span-name leaf)
-#   childSpan(name[, parentCtx])    -> check arg 0 (span-name leaf)
-CONSTANT_ARG_POSITIONS: Dict[str, Set[int]] = {
-    "setAttribute": {0},
-    "addEvent": {0},
-    "span": {1, 2},
-    "childSpan": {0},
-}
-
-
-def is_test_path(path: Path) -> bool:
-    """True if the path is test code. Tests legitimately pass arbitrary literal
-    keys/names to exercise the API mechanics, so Rule F does not apply to them.
-    Matches a `test`/`tests` directory anywhere in the path (e.g. src/test/,
-    src/tests/, .../detail/tests/)."""
-    return any(part in ("test", "tests") for part in path.parts)
-
-
-# A constant reference passed at a call-site, e.g. `rpc_span::attr::command`
-# or a bare `myKey`. We capture the leaf identifier (after the last `::`).
-IDENTIFIER_ARG = re.compile(r"^[\s&*]*([A-Za-z_][\w:]*)\s*$")
-
-
-def spanname_symbol_names(headers: List[Path]) -> Set[str]:
-    """Every `inline constexpr auto NAME = ...;` symbol defined across the
-    *SpanNames.h headers, by bare name. Used by Rule H to tell whether a
-    constant referenced at a call-site actually lives in a SpanNames header."""
-    names: Set[str] = set()
-    for h in headers:
-        for m in CONST_DEF.finditer(strip_comments(read_source(h))):
-            names.add(m.group(1))
-    return names
-
-
-def run_rule_f(root: Path, report: Report, header_symbols: Set[str]) -> None:
-    """Walk every telemetry call-site (non-test, non-*SpanNames.h) and check the
-    constant-only argument positions of setAttribute/addEvent/span/childSpan:
-
-      Rule F (FAIL): a string literal in a key / span-name position. Attribute
-        VALUES are exempt (runtime data).
-      Rule H (WARN): a constant reference whose name is not defined in any
-        *SpanNames.h. The constant should live in the corresponding
-        *SpanNames.h (single source of truth); defining it in-place bypasses
-        the naming rules. Warn rather than fail — the argument may instead be a
-        legitimately dynamic local (e.g. a computed span-name leaf)."""
-    found_f = False
-    sources = [
-        p
-        for base in ("src", "include")
-        for ext in ("*.h", "*.cpp")
-        for p in (root / base).rglob(ext)
-        if p.is_file()
-    ]
-    for path in sorted(sources):
-        if path.name.endswith("SpanNames.h") or is_test_path(path):
-            continue
-        text = read_source(path)
-        rel = path.relative_to(root)
-        for call, arglist, lineno in iter_calls(text):
-            positions = CONSTANT_ARG_POSITIONS.get(call, set())
-            args = split_top_level_args(arglist)
-            for idx in positions:
-                if idx >= len(args):
-                    continue
-                arg = args[idx]
-                lit = STRING_LITERAL.search(arg)
-                if lit:
-                    found_f = True
-                    report.violation(
-                        "F",
-                        f"{rel}:{lineno}",
-                        f'{call} arg{idx} "{lit.group(1)}"',
-                        "use a *SpanNames.h constant",
-                    )
-                    continue
-                # Not a literal: Rule H warns when a NAMESPACE-QUALIFIED constant
-                # reference (e.g. `consensus::span::accept`) is not defined in
-                # any *SpanNames.h — i.e. the constant was defined in-place
-                # instead of in the proper header. We only consider qualified
-                # refs (containing `::`): a bare lowercase identifier is almost
-                # always a legitimately dynamic local (a computed span-name leaf
-                # or attribute value), not a misplaced constant, so warning on it
-                # would be noise. Standard-library types (std::...) are skipped.
-                ident = IDENTIFIER_ARG.match(arg)
-                if not (ident and header_symbols):
-                    continue
-                ref = ident.group(1)
-                if "::" not in ref or ref.startswith("std::"):
-                    continue
-                leaf = ref.split("::")[-1]
-                if leaf not in header_symbols:
-                    report.warning(
-                        "H",
-                        f"{rel}:{lineno}",
-                        f"{call} arg{idx} {ref}",
-                        "not defined in any *SpanNames.h",
-                    )
-    if not found_f:
-        report.ok("F: no string-literal keys/names at telemetry call-sites")
-
-
-def iter_calls(text: str):
-    """Yield (call_name, raw_arglist, lineno) for each setAttribute/addEvent/
-    span/childSpan invocation, spanning multiple physical lines if needed."""
-    for m in CALLSITE.finditer(text):
-        name = m.group(1)
-        # Walk from the opening paren, balancing nesting to find the close.
-        # Parens inside a "string literal" are ignored so a value such as
-        # `setAttribute(k, ")")` does not close the call early.
-        i = m.end()  # one char past the '('
-        depth = 1
-        in_str = False
-        escaped = False
-        while i < len(text) and depth > 0:
-            c = text[i]
-            if in_str:
-                if escaped:
-                    escaped = False
-                elif c == "\\":
-                    escaped = True
-                elif c == '"':
-                    in_str = False
-            elif c == '"':
-                in_str = True
-            elif c == "(":
-                depth += 1
-            elif c == ")":
-                depth -= 1
-            i += 1
-        arglist = text[m.end() : i - 1]
-        lineno = text.count("\n", 0, m.start()) + 1
-        yield name, arglist, lineno
-
-
-def run_rule_b_collector(root: Path, l1_keys: Set[str], report: Report) -> None:
-    path = root / "docker" / "telemetry" / "otel-collector-config.yaml"
-    if not path.is_file():
-        report.skip("B", "collector config not present")
-        return
-    text = read_source(path)
-    if "spanmetrics" not in text:
-        report.skip("B", "no spanmetrics block in collector config")
-        return
-    dims = extract_spanmetrics_dimensions(text)
-    if not l1_keys:
-        report.skip("B", "no L1 key set to validate against")
-        return
-    miss = [d for d in dims if d not in l1_keys]
-    for d in miss:
-        report.violation("B", str(path.relative_to(root)), d, "must exist in L1")
-    if not miss:
-        report.ok(f"B: {len(dims)} collector dimension(s) all in L1")
-
-
-def extract_spanmetrics_dimensions(text: str) -> List[str]:
-    dims: List[str] = []
-    in_dims = False
-    for line in text.splitlines():
-        if re.search(r"\bdimensions\s*:", line):
-            in_dims = True
-            continue
-        if in_dims:
-            m = re.search(r"-\s*name\s*:\s*([A-Za-z0-9_.]+)", line)
-            if m:
-                dims.append(m.group(1))
-            elif line.strip() and not line.lstrip().startswith("-") and ":" in line:
-                in_dims = False
-    return dims
-
-
-def run_rule_c_tempo(root: Path, l1_keys: Set[str], report: Report) -> None:
-    # The trace-search filter tags live in the Grafana Tempo DATASOURCE
-    # provisioning file (search.filters[].{tag,scope}); the Tempo server
-    # tempo.yaml has no such tags. Prefer the datasource file; fall back to the
-    # server file so the rule still does something if the layout changes.
-    candidates = [
-        root / "docker/telemetry/grafana/provisioning/datasources/tempo.yaml",
-        root / "docker/telemetry/tempo.yaml",
-    ]
-    path = next((p for p in candidates if p.is_file()), None)
-    if path is None:
-        report.skip("C", "tempo datasource provisioning not present")
-        return
-    if not l1_keys:
-        report.skip("C", "no L1 key set to validate against")
-        return
-    # Pair each filter's `tag:` with its `scope:` (a few lines below it) and
-    # validate only span-scope tags — resource/intrinsic tags (service.*, name,
-    # status, duration) are not span attributes. Strip a TraceQL span. prefix.
-    lines = read_source(path).splitlines()
-    span_tags: List[str] = []
-    for i, line in enumerate(lines):
-        m = re.search(r"^\s*tag:\s*(\S+)", line)
-        if not m:
-            continue
-        scope = next(
-            (
-                sm.group(1)
-                for j in range(i, min(i + 4, len(lines)))
-                for sm in [re.search(r"scope:\s*(\S+)", lines[j])]
-                if sm
-            ),
-            "",
-        )
-        if scope == "span":
-            span_tags.append(TRACEQL_SCOPE.sub("", m.group(1)))
-    if not span_tags:
-        report.skip("C", "no span-scope filter tags in tempo datasource")
-        return
-    miss = [t for t in span_tags if t not in l1_keys]
-    for t in sorted(set(miss)):
-        report.violation("C", str(path.relative_to(root)), t, "must exist in L1")
-    if not miss:
-        report.ok(f"C: {len(span_tags)} tempo span-filter tag(s) all in L1")
-
-
-def metric_label_names(root: Path) -> Set[str]:
-    """L6: OTel native-metric label keys emitted by the telemetry code, e.g.
-    `counter->Add(1, {{"job_type", value}})` in MetricsRegistry.cpp. These are
-    a valid source of dashboard labels distinct from span attributes (L1)."""
-    labels: Set[str] = set()
-    for base in ("src", "include"):
-        for p in (root / base).rglob("*.cpp"):
-            if not p.is_file():
-                continue
-            text = read_source(p)
-            if "MetricsRegistry" not in p.name and "metric" not in text.lower():
-                continue
-            labels |= set(METRIC_LABEL.findall(text))
-    return labels
-
-
-def run_rule_d_dashboards(
-    root: Path, l1_keys: Set[str], metric_labels: Set[str], report: Report
-) -> None:
-    dash_dir = root / "docker" / "telemetry" / "grafana" / "dashboards"
-    files = sorted(dash_dir.glob("*.json")) if dash_dir.is_dir() else []
-    if not files:
-        report.skip("D", "no dashboard JSON present")
-        return
-    if not l1_keys:
-        report.skip("D", "no L1 key set to validate against")
-        return
-    builtins = {
-        "__name__",  # Prometheus reserved label for the metric name itself
-        "le",
-        "exported_instance",
-        "span_name",
-        "status_code",
-        "service_name",
-        "service_version",
-        "service_instance_id",
-        "job",
-        "instance",
-    }
-    # A dashboard label is valid if it is a span attribute (L1), a native-metric
-    # label (L6), or a Prometheus/Grafana builtin.
-    valid = l1_keys | metric_labels | builtins
-    found = False
-    for f in files:
-        try:
-            text = read_source(f)
-        except OSError:
-            continue
-        # PromQL `sum by (a, b)` and `{label="..."}` references.
-        labels: Set[str] = set()
-        for m in re.finditer(r"by\s*\(([^)]*)\)", text):
-            labels |= {x.strip() for x in m.group(1).split(",") if x.strip()}
-        for m in re.finditer(r"\b([a-z_][a-z0-9_.]*)\s*[=!]~?\s*\"", text):
-            labels.add(m.group(1))
-        for lbl in sorted(labels):
-            # Strip a TraceQL scope prefix (span./resource./...) — the bare
-            # attribute is what must resolve against L1.
-            bare = TRACEQL_SCOPE.sub("", lbl)
-            if bare in valid:
-                continue
-            found = True
-            report.violation(
-                "D",
-                str(f.relative_to(root)),
-                lbl,
-                "must exist in L1, a metric label, or be a builtin",
-            )
-    if not found:
-        report.ok(f"D: dashboard PromQL labels all resolve ({len(files)} file(s))")
-
-
-def run_rule_e_runbook(root: Path, l1_keys: Set[str], report: Report) -> None:
-    path = root / "docs" / "telemetry-runbook.md"
-    if not path.is_file():
-        report.skip("E", "runbook not present")
-        return
-    if not l1_keys:
-        report.skip("E", "no L1 key set to validate against")
-        return
-    text = read_source(path)
-    found = False
-    # Only the dotted `xrpl.<domain>.<field>` attribute form is a violation. The
-    # `xrpl.`-with-trailing-dot anchor is the discriminator: it matches the old
-    # dotted attribute convention being migrated away from, while everything
-    # else legitimately dotted in the runbook does NOT match it —
-    #   * span names      (`consensus.round`, `tx.process`)   no `xrpl.` prefix
-    #   * filenames       (`xrpld.cfg`, `RCLConsensus.cpp`)   `xrpld.`/`.cpp`, not `xrpl.`
-    #   * OTel-standard   (`service.name`, `http.method`)     no `xrpl.` prefix
-    #   * metric labels   (`xrpl_rpc_command`)                underscore, no dot
-    # Legitimate dotted resource attrs (`xrpl.network.id`/`.type`) are in L1 and
-    # are skipped. A dotted `xrpl.` token absent from L1 is a genuine doc/code
-    # mismatch (e.g. `xrpl.tx.hash` where the code emits `tx_hash`).
-    for m in re.finditer(r"`(xrpl\.[a-z][a-z0-9_.]*)`", text):
-        token = m.group(1)
-        if token in l1_keys:  # legitimate dotted resource attr (xrpl.network.*)
-            continue
-        found = True
-        report.violation(
-            "E", str(path.relative_to(root)), token, "underscore, not dotted"
-        )
-    if not found:
-        report.ok("E: runbook attribute references consistent with L1")
-
-
-if __name__ == "__main__":
-    main()

.github/scripts/otel-naming/test_check_otel_naming.py

@@ -1,864 +0,0 @@
-#!/usr/bin/env python3
-
-"""Unit tests for check_otel_naming.py.
-
-Stdlib-only (unittest), matching the dependency-free policy of the check itself.
-Run from anywhere:
-
-    python .github/scripts/otel-naming/test_check_otel_naming.py
-
-Each rule is exercised in isolation against a synthetic tree / synthetic L1 key
-set, covering positive (must flag), negative (must not flag), and boundary
-cases. Rule E (runbook dotted-attribute detection) has the densest coverage
-because its discriminator — the `xrpl.<domain>.` prefix vs span names,
-filenames, OTel-standard keys, and metric labels — is the subtlest.
-"""
-
-import contextlib
-import importlib.util
-import io
-import shutil
-import tempfile
-import unittest
-from pathlib import Path
-
-# Load the check module by path (it is not an importable package).
-_spec = importlib.util.spec_from_file_location(
-    "check_otel_naming", str(Path(__file__).with_name("check_otel_naming.py"))
-)
-chk = importlib.util.module_from_spec(_spec)
-_spec.loader.exec_module(chk)
-
-
-# A controlled L1 set used across tests: the two legitimate dotted resource
-# attrs plus a handful of underscore span-attribute keys.
-L1 = {
-    "xrpl.network.id",
-    "xrpl.network.type",
-    "tx_hash",
-    "peer_id",
-    "consensus_mode",
-    "command",
-    "rpc_status",
-    "ledger_seq",
-}
-
-
-def _run_rule_e(runbook_text: str):
-    """Run Rule E against a synthetic runbook; return the flagged tokens."""
-    d = Path(tempfile.mkdtemp())
-    try:
-        (d / "docs").mkdir()
-        (d / "docs" / "telemetry-runbook.md").write_text(runbook_text)
-        report = chk.Report()
-        chk.run_rule_e_runbook(d, set(L1), report)
-        return sorted(v[2] for v in report.violations)
-    finally:
-        shutil.rmtree(d)
-
-
-class RuleERunbook(unittest.TestCase):
-    """Rule E: only dotted `xrpl.<domain>.<field>` attribute keys are flagged."""
-
-    # ----- positive: genuine dotted attribute-key violations -----
-    def test_single_dotted_attr(self):
-        self.assertEqual(_run_rule_e("`xrpl.tx.hash`"), ["xrpl.tx.hash"])
-
-    def test_multiple_dotted_attrs(self):
-        self.assertEqual(
-            _run_rule_e("`xrpl.tx.hash` and `xrpl.consensus.mode`"),
-            ["xrpl.consensus.mode", "xrpl.tx.hash"],
-        )
-
-    def test_deep_dotted_three_segments(self):
-        self.assertEqual(
-            _run_rule_e("`xrpl.consensus.ledger.seq`"), ["xrpl.consensus.ledger.seq"]
-        )
-
-    def test_dotted_attr_with_underscore_field(self):
-        self.assertEqual(
-            _run_rule_e("`xrpl.consensus.round_id`"), ["xrpl.consensus.round_id"]
-        )
-
-    def test_repeated_token_reported_each_occurrence(self):
-        self.assertEqual(
-            _run_rule_e("`xrpl.tx.hash` ... `xrpl.tx.hash`"),
-            ["xrpl.tx.hash", "xrpl.tx.hash"],
-        )
-
-    def test_resource_attr_not_in_l1_is_flagged(self):
-        self.assertEqual(
-            _run_rule_e("`xrpl.network.unknown`"), ["xrpl.network.unknown"]
-        )
-
-    # ----- negative: legitimately-dotted tokens that must NOT be flagged -----
-    def test_span_name_single(self):
-        self.assertEqual(_run_rule_e("`consensus.round`"), [])
-
-    def test_span_name_multi_segment(self):
-        self.assertEqual(
-            _run_rule_e("`consensus.phase.open` `rpc.command.server_info`"), []
-        )
-
-    def test_filename_cfg(self):
-        self.assertEqual(_run_rule_e("`xrpld.cfg`"), [])
-
-    def test_filename_cpp(self):
-        self.assertEqual(_run_rule_e("`RCLConsensus.cpp`"), [])
-
-    def test_otel_standard_service_name(self):
-        self.assertEqual(_run_rule_e("`service.name`"), [])
-
-    def test_otel_standard_http_method(self):
-        self.assertEqual(_run_rule_e("`http.method`"), [])
-
-    def test_metric_label_underscore(self):
-        self.assertEqual(_run_rule_e("`xrpl_rpc_command`"), [])
-
-    def test_bare_underscore_attrs(self):
-        self.assertEqual(_run_rule_e("`tx_hash` `consensus_mode`"), [])
-
-    def test_legit_dotted_resource_attrs_in_l1(self):
-        self.assertEqual(_run_rule_e("`xrpl.network.id` `xrpl.network.type`"), [])
-
-    def test_prose_word(self):
-        self.assertEqual(_run_rule_e("the `command` attribute"), [])
-
-    def test_plain_prose_no_backticks(self):
-        self.assertEqual(_run_rule_e("xrpl.tx.hash without backticks is prose"), [])
-
-    # ----- boundary -----
-    def test_empty_runbook(self):
-        self.assertEqual(_run_rule_e(""), [])
-
-    def test_lookalike_prefix_xrpld(self):
-        # `xrpld.` is NOT `xrpl.` — must not match.
-        self.assertEqual(_run_rule_e("`xrpld.foo`"), [])
-
-    def test_lookalike_prefix_underscore(self):
-        # `xrpl_rpc.command` starts with `xrpl_`, not `xrpl.`.
-        self.assertEqual(_run_rule_e("`xrpl_rpc.command`"), [])
-
-    def test_uppercase_segment_not_matched(self):
-        # The pattern requires a lowercase char after `xrpl.`; uppercase keys are
-        # caught by Rule G at the L1 layer, not by the runbook text scan.
-        self.assertEqual(_run_rule_e("`xrpl.TX.hash`"), [])
-
-    def test_token_touching_table_pipes(self):
-        self.assertEqual(_run_rule_e("| `xrpl.tx.hash` | desc |"), ["xrpl.tx.hash"])
-
-    def test_mixed_line_only_xrpl_dotted_flagged(self):
-        self.assertEqual(
-            _run_rule_e("`consensus.round` uses `xrpl.tx.hash` and `service.name`"),
-            ["xrpl.tx.hash"],
-        )
-
-    def test_skips_when_runbook_absent(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            report = chk.Report()
-            chk.run_rule_e_runbook(d, set(L1), report)
-            self.assertEqual(report.violations, [])
-            self.assertTrue(any("SKIP: E" in s for s in report.skips))
-        finally:
-            shutil.rmtree(d)
-
-    def test_skips_when_l1_empty(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            (d / "docs").mkdir()
-            (d / "docs" / "telemetry-runbook.md").write_text("`xrpl.tx.hash`")
-            report = chk.Report()
-            chk.run_rule_e_runbook(d, set(), report)
-            self.assertEqual(report.violations, [])
-            self.assertTrue(any("SKIP: E" in s for s in report.skips))
-        finally:
-            shutil.rmtree(d)
-
-
-class DslParser(unittest.TestCase):
-    """The makeStr/join/seg:: constexpr DSL resolver — the foundation of the
-    L1 key set. Covers flat, nested, cross-file, alias, and multi-line forms."""
-
-    def test_flat_join(self):
-        syms = chk.resolve_constants(
-            'inline constexpr auto a = makeStr("xrpl");\n'
-            'inline constexpr auto b = makeStr("network");\n'
-            "inline constexpr auto c = join(a, b);\n"
-        )
-        self.assertEqual(syms["c"], "xrpl.network")
-
-    def test_nested_join_three_segments(self):
-        syms = chk.resolve_constants(
-            'inline constexpr auto xrpl = makeStr("xrpl");\n'
-            'inline constexpr auto network = makeStr("network");\n'
-            "inline constexpr auto networkId = "
-            'join(join(xrpl, network), makeStr("id"));\n'
-        )
-        self.assertEqual(syms["networkId"], "xrpl.network.id")
-
-    def test_qualified_seg_reference(self):
-        # `seg::rpc` resolves by its bare leaf `rpc`.
-        syms = chk.resolve_constants('inline constexpr auto rpc = makeStr("rpc");\n')
-        syms2 = chk.resolve_constants(
-            'inline constexpr auto command = join(seg::rpc, makeStr("command"));\n',
-            syms,
-        )
-        self.assertEqual(syms2["command"], "rpc.command")
-
-    def test_alias_reference(self):
-        syms = chk.resolve_constants('inline constexpr auto rpc = makeStr("rpc");\n')
-        chk.resolve_constants("inline constexpr auto alias = seg::rpc;\n", syms)
-        self.assertEqual(syms["alias"], "rpc")
-
-    def test_unresolvable_expr_omitted(self):
-        syms = chk.resolve_constants("inline constexpr auto x = join(unknown, y);\n")
-        self.assertNotIn("x", syms)
-
-    def test_split_top_level_args_respects_nesting(self):
-        self.assertEqual(
-            chk.split_top_level_args("join(seg::a, b), c"),
-            ["join(seg::a, b)", " c"],
-        )
-
-    def test_split_top_level_args_ignores_comma_in_string(self):
-        self.assertEqual(
-            chk.split_top_level_args('key, ","'),
-            ["key", ' ","'],
-        )
-
-    def test_strip_comments_removes_line_and_block(self):
-        self.assertEqual(
-            chk.strip_comments("a // line\nb /* blk */ c").split(),
-            ["a", "b", "c"],
-        )
-
-
-def _write(path: Path, text: str) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(text)
-
-
-def _header(ns_attr_body: str, prefix_seg: str = "") -> str:
-    """A minimal *SpanNames.h body: optional seg defs + a namespace attr block."""
-    return (
-        "#pragma once\n"
-        + prefix_seg
-        + "namespace xrpl::telemetry::demo::span {\n"
-        + "namespace attr {\n"
-        + ns_attr_body
-        + "}  // namespace attr\n"
-        + "}\n"
-    )
-
-
-class AttrKeyExtraction(unittest.TestCase):
-    """attr_keys_from_header: comment-stripping + multi-line + using re-export."""
-
-    def _l1(self, header_text):
-        d = Path(tempfile.mkdtemp())
-        try:
-            h = d / "src" / "DemoSpanNames.h"
-            _write(h, header_text)
-            syms = chk.build_global_symbols([h])
-            return chk.attr_keys_from_header(h, syms)
-        finally:
-            shutil.rmtree(d)
-
-    def test_single_line_makestr(self):
-        keys = self._l1(_header('inline constexpr auto k = makeStr("tx_hash");\n'))
-        self.assertIn("tx_hash", keys)
-
-    def test_multiline_constexpr_captured(self):
-        keys = self._l1(
-            _header("inline constexpr auto k =\n" '    makeStr("round_time_ms");\n')
-        )
-        self.assertIn("round_time_ms", keys)
-
-    def test_commented_makestr_not_leaked(self):
-        keys = self._l1(
-            _header(
-                'inline constexpr auto k = makeStr("good");\n'
-                '// inline constexpr auto bad = makeStr("old.dotted");\n'
-            )
-        )
-        self.assertIn("good", keys)
-        self.assertNotIn("old.dotted", keys)
-
-    def test_block_commented_makestr_not_leaked(self):
-        keys = self._l1(
-            _header(
-                'inline constexpr auto k = makeStr("good");\n'
-                '/* makeStr("blockbad") */\n'
-            )
-        )
-        self.assertNotIn("blockbad", keys)
-
-
-class CamelToDotSegments(unittest.TestCase):
-    """semconv CamelCase -> dotted OTel-standard key derivation."""
-
-    def test_service_instance_id(self):
-        self.assertEqual(
-            chk.camel_to_dotsegments("ServiceInstanceId"),
-            ["service", "instance", "id"],
-        )
-
-    def test_service_name(self):
-        self.assertEqual(chk.camel_to_dotsegments("ServiceName"), ["service", "name"])
-
-    def test_derive_keys_from_telemetry_cpp(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            tele = d / "src" / "libxrpl" / "telemetry" / "Telemetry.cpp"
-            _write(
-                tele,
-                "resource::Resource::Create({\n"
-                "  {semconv::service::kServiceName, x},\n"
-                "  {semconv::service::kServiceInstanceId, y},\n"
-                "});\n",
-            )
-            report = chk.Report()
-            allow = chk.derive_dotted_resource_keys(d, {}, report)
-            self.assertIn("service.name", allow)
-            self.assertIn("service.instance.id", allow)
-        finally:
-            shutil.rmtree(d)
-
-
-class SymbolCollision(unittest.TestCase):
-    """attr_keys_from_header must resolve a constant against ITS OWN header, so
-    two headers defining a same-named constant each report their real wire key.
-    Regression for the flat-symbol-table collision that let a later header
-    clobber an earlier one and erased a dotted key from L1 (a Rule-A blind
-    spot)."""
-
-    def _build(self, files):
-        d = Path(tempfile.mkdtemp())
-        paths = {}
-        for rel, text in files.items():
-            p = d / rel
-            _write(p, text)
-            paths[rel] = p
-        return d, paths
-
-    def test_same_named_const_not_clobbered_across_headers(self):
-        base = (
-            "#pragma once\n"
-            "namespace xrpl::telemetry {\n"
-            'namespace seg { inline constexpr auto xrpl = makeStr("xrpl");\n'
-            'inline constexpr auto ledger = makeStr("ledger"); }\n'
-            "namespace attr {\n"
-            "inline constexpr auto ledgerHash = "
-            'join(join(seg::xrpl, seg::ledger), makeStr("hash"));\n'
-            "}\n}\n"
-        )
-        cons = (
-            "#pragma once\n"
-            "namespace xrpl::telemetry::consensus::span {\n"
-            "namespace attr { inline constexpr auto ledgerHash = "
-            'makeStr("ledger_hash"); }\n}\n'
-        )
-        d, paths = self._build(
-            {
-                "include/xrpl/telemetry/SpanNames.h": base,
-                "src/xrpld/consensus/ConsensusSpanNames.h": cons,
-            }
-        )
-        try:
-            headers = chk.find_spanname_headers(d)
-            syms = chk.build_global_symbols(headers)
-            by_name = {p.name: chk.attr_keys_from_header(p, syms) for p in headers}
-            # The base header keeps its dotted key; consensus keeps the bare one.
-            self.assertIn("xrpl.ledger.hash", by_name["SpanNames.h"])
-            self.assertEqual(by_name["ConsensusSpanNames.h"], {"ledger_hash"})
-        finally:
-            shutil.rmtree(d)
-
-    def test_using_reexport_still_resolves_globally(self):
-        # A `using`-re-export imports a constant defined elsewhere; it must
-        # resolve against the global table, not the local header.
-        base = (
-            "#pragma once\n"
-            "namespace xrpl::telemetry {\n"
-            "namespace attr { inline constexpr auto txHash = "
-            'makeStr("tx_hash"); }\n}\n'
-        )
-        dom = (
-            "#pragma once\n"
-            "namespace xrpl::telemetry::tx::span {\n"
-            "namespace attr { using ::xrpl::telemetry::attr::txHash; }\n}\n"
-        )
-        d, paths = self._build(
-            {
-                "include/xrpl/telemetry/SpanNames.h": base,
-                "src/xrpld/app/misc/TxSpanNames.h": dom,
-            }
-        )
-        try:
-            headers = chk.find_spanname_headers(d)
-            syms = chk.build_global_symbols(headers)
-            keys = chk.attr_keys_from_header(
-                paths["src/xrpld/app/misc/TxSpanNames.h"], syms
-            )
-            self.assertEqual(keys, {"tx_hash"})
-        finally:
-            shutil.rmtree(d)
-
-
-class ResourceAllowlistScope(unittest.TestCase):
-    """derive_dotted_resource_keys must allowlist ONLY the dotted keys actually
-    passed to Resource::Create() — not every dotted key in the base header. A
-    dotted attr declared in a header but not set as a resource attr is a Rule-A
-    violation."""
-
-    def _derive(self, tele_text, span_text):
-        d = Path(tempfile.mkdtemp())
-        try:
-            _write(d / "src" / "libxrpl" / "telemetry" / "Telemetry.cpp", tele_text)
-            _write(d / "include" / "xrpl" / "telemetry" / "SpanNames.h", span_text)
-            headers = chk.find_spanname_headers(d)
-            syms = chk.build_global_symbols(headers)
-            allow = chk.derive_dotted_resource_keys(d, syms, chk.Report())
-            return allow, syms, headers, d
-        except Exception:
-            shutil.rmtree(d)
-            raise
-
-    def test_dotted_span_attr_not_allowlisted_and_flagged(self):
-        span = (
-            "#pragma once\n"
-            "namespace xrpl::telemetry {\n"
-            'namespace seg { inline constexpr auto xrpl = makeStr("xrpl");\n'
-            'inline constexpr auto ledger = makeStr("ledger");\n'
-            'inline constexpr auto network = makeStr("network"); }\n'
-            "namespace attr {\n"
-            "inline constexpr auto networkId = "
-            'join(join(seg::xrpl, seg::network), makeStr("id"));\n'
-            "inline constexpr auto ledgerHash = "
-            'join(join(seg::xrpl, seg::ledger), makeStr("hash"));\n'
-            "}\n}\n"
-        )
-        tele = (
-            "auto r = resource::Resource::Create({\n"
-            "  {semconv::service::kServiceName, x},\n"
-            "  {std::string(attr::networkId), n},\n"
-            "});\n"
-        )
-        allow, syms, headers, d = self._derive(tele, span)
-        try:
-            # networkId IS a resource attr; ledgerHash is NOT, despite living in
-            # the base header.
-            self.assertIn("xrpl.network.id", allow)
-            self.assertNotIn("xrpl.ledger.hash", allow)
-            kbh = {h: chk.attr_keys_from_header(h, syms) for h in headers}
-            report = chk.Report()
-            chk.run_rule_a(kbh, allow, report)
-            self.assertEqual([v[2] for v in report.violations], ["xrpl.ledger.hash"])
-        finally:
-            shutil.rmtree(d)
-
-    def test_resource_block_brace_matched(self):
-        # A nested {key,value} initializer must not truncate the block scan.
-        tele = (
-            "auto r = resource::Resource::Create({\n"
-            "  {semconv::service::kServiceName, x},\n"
-            "  {std::string(attr::networkType), t},\n"
-            "});\n"
-        )
-        span = (
-            "#pragma once\n"
-            "namespace xrpl::telemetry {\n"
-            'namespace seg { inline constexpr auto xrpl = makeStr("xrpl");\n'
-            'inline constexpr auto network = makeStr("network"); }\n'
-            "namespace attr { inline constexpr auto networkType = "
-            'join(join(seg::xrpl, seg::network), makeStr("type")); }\n}\n'
-        )
-        allow, _syms, _headers, d = self._derive(tele, span)
-        try:
-            self.assertIn("xrpl.network.type", allow)
-            self.assertIn("service.name", allow)
-        finally:
-            shutil.rmtree(d)
-
-
-def _run_rule_a(keys_by_header, allow):
-    report = chk.Report()
-    chk.run_rule_a(keys_by_header, allow, report)
-    return sorted(v[2] for v in report.violations)
-
-
-class RuleADotted(unittest.TestCase):
-    def test_dotted_attr_not_in_allow_flagged(self):
-        kbh = {Path("src/RpcSpanNames.h"): {"xrpl.tx.hash", "command"}}
-        self.assertEqual(_run_rule_a(kbh, {"xrpl.network.id"}), ["xrpl.tx.hash"])
-
-    def test_resource_attr_in_allow_passes(self):
-        kbh = {Path("src/SpanNames.h"): {"xrpl.network.id"}}
-        self.assertEqual(_run_rule_a(kbh, {"xrpl.network.id"}), [])
-
-    def test_bare_key_never_flagged(self):
-        kbh = {Path("src/TxSpanNames.h"): {"tx_hash", "command"}}
-        self.assertEqual(_run_rule_a(kbh, set()), [])
-
-
-def _run_rule_g(keys_by_header):
-    report = chk.Report()
-    chk.run_rule_g(keys_by_header, report)
-    return sorted(v[2] for v in report.violations)
-
-
-class RuleGSnakeCase(unittest.TestCase):
-    def test_camelcase_flagged(self):
-        self.assertEqual(_run_rule_g({Path("h"): {"txHash"}}), ["txHash"])
-
-    def test_uppercase_flagged(self):
-        self.assertEqual(_run_rule_g({Path("h"): {"TX_HASH"}}), ["TX_HASH"])
-
-    def test_space_flagged(self):
-        self.assertEqual(_run_rule_g({Path("h"): {"bad key"}}), ["bad key"])
-
-    def test_snake_case_passes(self):
-        self.assertEqual(_run_rule_g({Path("h"): {"tx_hash", "rpc_status"}}), [])
-
-    def test_dotted_resource_segments_pass(self):
-        self.assertEqual(_run_rule_g({Path("h"): {"xrpl.network.id"}}), [])
-
-    def test_dotted_with_bad_segment_flagged(self):
-        self.assertEqual(
-            _run_rule_g({Path("h"): {"xrpl.Network.id"}}), ["xrpl.Network.id"]
-        )
-
-
-class RuleFAndH(unittest.TestCase):
-    """run_rule_f: literal keys/span-names flagged; values & tests exempt.
-    Rule H: qualified constant not in any header warns (non-fatal)."""
-
-    def _run(self, rel_path, source, header_symbols=frozenset()):
-        d = Path(tempfile.mkdtemp())
-        try:
-            _write(d / rel_path, source)
-            report = chk.Report()
-            chk.run_rule_f(d, report, set(header_symbols))
-            return (
-                sorted(v[2] for v in report.violations),
-                sorted(w[2] for w in report.warnings),
-            )
-        finally:
-            shutil.rmtree(d)
-
-    def test_literal_key_flagged(self):
-        v, _ = self._run("src/Foo.cpp", 'g.setAttribute("lit_key", v);\n')
-        self.assertEqual(v, ['setAttribute arg0 "lit_key"'])
-
-    def test_literal_value_exempt(self):
-        v, _ = self._run("src/Foo.cpp", 'g.setAttribute(attr::command, "submit");\n')
-        self.assertEqual(v, [])
-
-    def test_span_name_args_flagged(self):
-        v, _ = self._run("src/Foo.cpp", 'SpanGuard::span(cat, "rpc", "command");\n')
-        self.assertEqual(v, ['span arg1 "rpc"', 'span arg2 "command"'])
-
-    def test_test_path_exempt(self):
-        v, _ = self._run("src/test/Foo.cpp", 'g.setAttribute("lit_key", v);\n')
-        self.assertEqual(v, [])
-
-    def test_spannames_header_exempt(self):
-        v, _ = self._run("src/DemoSpanNames.h", 'g.setAttribute("lit_key", v);\n')
-        self.assertEqual(v, [])
-
-    def test_bare_span_call_not_matched(self):
-        # No SpanGuard/./-> receiver -> not a telemetry call-site.
-        v, _ = self._run("src/Foo.cpp", 'auto s = span("not", "telemetry");\n')
-        self.assertEqual(v, [])
-
-    def test_multiline_call_reports_first_line(self):
-        v, _ = self._run("src/Foo.cpp", 'g.setAttribute(\n    "k",\n    v);\n')
-        self.assertEqual(v, ['setAttribute arg0 "k"'])
-
-    def test_paren_in_string_value_does_not_break_parsing(self):
-        # The ")" inside the value must not end the call early; key still seen.
-        v, _ = self._run("src/Foo.cpp", 'g.setAttribute("k", ")");\n')
-        self.assertEqual(v, ['setAttribute arg0 "k"'])
-
-    def test_rule_h_qualified_constant_warns(self):
-        v, w = self._run(
-            "src/Foo.cpp",
-            "g.setAttribute(consensus::span::accept, v);\n",
-            header_symbols={"command"},
-        )
-        self.assertEqual(v, [])
-        self.assertEqual(w, ["setAttribute arg0 consensus::span::accept"])
-
-    def test_rule_h_known_constant_no_warning(self):
-        _, w = self._run(
-            "src/Foo.cpp",
-            "g.setAttribute(rpc_span::attr::command, v);\n",
-            header_symbols={"command"},
-        )
-        self.assertEqual(w, [])
-
-    def test_rule_h_bare_local_no_warning(self):
-        _, w = self._run(
-            "src/Foo.cpp", "g.setAttribute(myLeaf, v);\n", header_symbols={"command"}
-        )
-        self.assertEqual(w, [])
-
-
-class RuleBCollector(unittest.TestCase):
-    def _run(self, yaml_text, l1):
-        d = Path(tempfile.mkdtemp())
-        try:
-            _write(d / "docker" / "telemetry" / "otel-collector-config.yaml", yaml_text)
-            report = chk.Report()
-            chk.run_rule_b_collector(d, set(l1), report)
-            return sorted(v[2] for v in report.violations), report.skips
-        finally:
-            shutil.rmtree(d)
-
-    def test_dimension_not_in_l1_flagged(self):
-        y = "spanmetrics:\n  dimensions:\n    - name: bogus_dim\n    - name: command\n"
-        v, _ = self._run(y, {"command"})
-        self.assertEqual(v, ["bogus_dim"])
-
-    def test_all_dimensions_in_l1_pass(self):
-        y = "spanmetrics:\n  dimensions:\n    - name: command\n    - name: rpc_status\n"
-        v, _ = self._run(y, {"command", "rpc_status"})
-        self.assertEqual(v, [])
-
-    def test_skip_when_no_spanmetrics_block(self):
-        v, skips = self._run("receivers:\n  otlp:\n", {"command"})
-        self.assertEqual(v, [])
-        self.assertTrue(any("SKIP: B" in s for s in skips))
-
-
-class RuleCTempo(unittest.TestCase):
-    """Rule C reads the Grafana Tempo DATASOURCE file's search.filters and
-    validates only span-scope tags against L1."""
-
-    DS = "docker/telemetry/grafana/provisioning/datasources/tempo.yaml"
-
-    def _run(self, yaml_text, l1):
-        d = Path(tempfile.mkdtemp())
-        try:
-            _write(d / self.DS, yaml_text)
-            report = chk.Report()
-            chk.run_rule_c_tempo(d, set(l1), report)
-            return sorted(v[2] for v in report.violations), report.skips
-        finally:
-            shutil.rmtree(d)
-
-    def _filter(self, fid, tag, scope):
-        return (
-            f"          - id: {fid}\n"
-            f"            tag: {tag}\n"
-            f'            operator: "="\n'
-            f"            scope: {scope}\n"
-            f"            type: static\n"
-        )
-
-    def test_span_tag_not_in_l1_flagged(self):
-        y = "search:\n        filters:\n" + self._filter("f1", "bogus_tag", "span")
-        v, _ = self._run(y, {"command"})
-        self.assertEqual(v, ["bogus_tag"])
-
-    def test_span_tags_in_l1_pass(self):
-        y = (
-            "search:\n        filters:\n"
-            + self._filter("f1", "command", "span")
-            + self._filter("f2", "tx_hash", "span")
-        )
-        v, _ = self._run(y, {"command", "tx_hash"})
-        self.assertEqual(v, [])
-
-    def test_resource_and_intrinsic_tags_ignored(self):
-        # service.* (resource) and name/status/duration (intrinsic) are not
-        # span attributes — they must not be validated against L1.
-        y = (
-            "search:\n        filters:\n"
-            + self._filter("f1", "service.instance.id", "resource")
-            + self._filter("f2", "name", "intrinsic")
-            + self._filter("f3", "duration", "intrinsic")
-        )
-        v, skips = self._run(y, {"command"})
-        self.assertEqual(v, [])
-        self.assertTrue(any("SKIP: C" in s for s in skips))
-
-    def test_skip_when_datasource_absent(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            report = chk.Report()
-            chk.run_rule_c_tempo(d, {"command"}, report)
-            self.assertEqual(report.violations, [])
-            self.assertTrue(any("SKIP: C" in s for s in report.skips))
-        finally:
-            shutil.rmtree(d)
-
-
-class RuleDDashboards(unittest.TestCase):
-    def _run(self, json_text, l1, metric_labels=frozenset()):
-        d = Path(tempfile.mkdtemp())
-        try:
-            _write(
-                d / "docker" / "telemetry" / "grafana" / "dashboards" / "x.json",
-                json_text,
-            )
-            report = chk.Report()
-            chk.run_rule_d_dashboards(d, set(l1), set(metric_labels), report)
-            return sorted(v[2] for v in report.violations)
-        finally:
-            shutil.rmtree(d)
-
-    def test_unknown_promql_label_flagged(self):
-        self.assertEqual(
-            self._run('"expr": "sum by (bogus_label) (x)"', {"command"}),
-            ["bogus_label"],
-        )
-
-    def test_builtin_labels_not_flagged(self):
-        self.assertEqual(
-            self._run('"expr": "sum by (le, span_name, exported_instance) (x)"', set()),
-            [],
-        )
-
-    def test_prometheus_name_label_not_flagged(self):
-        # `__name__` is the Prometheus reserved metric-name label; the renamed
-        # system-*.json dashboards use `sum by (le, __name__)`.
-        self.assertEqual(
-            self._run('"expr": "sum by (le, __name__) (rate(x[5m]))"', set()),
-            [],
-        )
-
-    def test_l1_label_passes(self):
-        self.assertEqual(self._run('"q": "{command=\\"x\\"}"', {"command"}), [])
-
-    def test_traceql_span_prefix_stripped(self):
-        # `span.establish_count` must validate against the bare L1 key.
-        self.assertEqual(
-            self._run(
-                '"expr": "count_over_time(x) by (span.establish_count)"',
-                {"establish_count"},
-            ),
-            [],
-        )
-
-    def test_traceql_resource_prefix_stripped(self):
-        self.assertEqual(self._run('"q": "{resource.service_name=\\"x\\"}"', set()), [])
-
-    def test_native_metric_label_passes(self):
-        # `job_type` / `reason` are emitted by MetricsRegistry, not span attrs.
-        self.assertEqual(
-            self._run(
-                '"expr": "sum by (job_type, reason) (x)"',
-                {"command"},
-                metric_labels={"job_type", "reason"},
-            ),
-            [],
-        )
-
-    def test_unknown_label_still_flagged_with_metric_labels(self):
-        # A label that is neither L1, metric label, nor builtin still fails.
-        self.assertEqual(
-            self._run(
-                '"expr": "sum by (bogus) (x)"',
-                {"command"},
-                metric_labels={"job_type"},
-            ),
-            ["bogus"],
-        )
-
-    def test_span_prefixed_unknown_still_flagged(self):
-        # `span.not_a_key` whose bare form is unknown is still a violation.
-        self.assertEqual(
-            self._run('"expr": "x by (span.not_a_key)"', {"command"}),
-            ["span.not_a_key"],
-        )
-
-
-class MetricLabelExtraction(unittest.TestCase):
-    """L6: native-metric label keys parsed from C++ instrument calls."""
-
-    def test_extracts_add_label(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            _write(
-                d / "src" / "xrpld" / "telemetry" / "MetricsRegistry.cpp",
-                'counter->Add(1, {{"job_type", std::string(jobType)}});\n'
-                'c2->Add(1, {{"reason", std::string(r)}});\n',
-            )
-            self.assertEqual(chk.metric_label_names(d), {"job_type", "reason"})
-        finally:
-            shutil.rmtree(d)
-
-    def test_no_metrics_file_empty(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            (d / "src").mkdir()
-            self.assertEqual(chk.metric_label_names(d), set())
-        finally:
-            shutil.rmtree(d)
-
-
-class ReportExitContract(unittest.TestCase):
-    @staticmethod
-    def _exit_code(report):
-        """Call render_and_exit (which prints + raises SystemExit), swallowing
-        its stdout, and return the exit code."""
-        with contextlib.redirect_stdout(io.StringIO()):
-            try:
-                report.render_and_exit()
-            except SystemExit as e:
-                return e.code
-        return None  # pragma: no cover - render_and_exit always exits
-
-    def test_violation_exits_nonzero(self):
-        r = chk.Report()
-        r.violation("A", "f", "tok", "exp")
-        self.assertEqual(self._exit_code(r), 1)
-
-    def test_clean_exits_zero(self):
-        r = chk.Report()
-        r.ok("all good")
-        self.assertEqual(self._exit_code(r), 0)
-
-    def test_warning_only_exits_zero(self):
-        r = chk.Report()
-        r.warning("H", "f", "tok", "note")
-        self.assertEqual(self._exit_code(r), 0)
-
-
-class RuleEReportTuple(unittest.TestCase):
-    """Assert Rule E records the full (rule, expected) tuple, not just token."""
-
-    def test_violation_tuple_fields(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            (d / "docs").mkdir()
-            (d / "docs" / "telemetry-runbook.md").write_text("`xrpl.tx.hash`")
-            report = chk.Report()
-            chk.run_rule_e_runbook(d, {"xrpl.network.id"}, report)
-            self.assertEqual(len(report.violations), 1)
-            rule, _loc, token, expected = report.violations[0]
-            self.assertEqual(rule, "E")
-            self.assertEqual(token, "xrpl.tx.hash")
-            self.assertEqual(expected, "underscore, not dotted")
-        finally:
-            shutil.rmtree(d)
-
-    def test_clean_runbook_records_ok(self):
-        d = Path(tempfile.mkdtemp())
-        try:
-            (d / "docs").mkdir()
-            (d / "docs" / "telemetry-runbook.md").write_text(
-                "`tx_hash` `consensus.round`"
-            )
-            report = chk.Report()
-            chk.run_rule_e_runbook(d, {"tx_hash"}, report)
-            self.assertEqual(report.violations, [])
-            self.assertTrue(any("E:" in c for c in report.checked))
-        finally:
-            shutil.rmtree(d)
-
-
-if __name__ == "__main__":
-    unittest.main(verbosity=2)

.github/scripts/strategy-matrix/generate.py

@@ -25,24 +25,16 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
     return " ".join(args)
 
 
-def runs_on_event(exclude_event_types: list[str], event: str | None) -> bool:
-    """Whether a config should run for the current event.
-
-    'exclude_event_types' is a list of GitHub event names (e.g.
-    ["pull_request"]) on which the config should NOT run; an empty list means
-    the config runs on every event. When no event is given (event is None), no
-    filtering is applied.
-    """
-    if event is None:
-        return True
-    return event not in exclude_event_types
-
-
 # ---------------------------------------------------------------------------
 # Input types — shapes of the JSON config files
 # ---------------------------------------------------------------------------
 
 
+# Every config must declare 'minimal'. Minimal configs form the reduced matrix
+# built for pull requests by default; the full matrix adds the rest. Packaging
+# configs declare it too, but packaging is gated in the workflow, not by it.
+
+
 @dataclasses.dataclass
 class LinuxConfig:
     """One entry in linux.json's 'configs' or 'package_configs' arrays."""
@@ -50,13 +42,11 @@ class LinuxConfig:
     compiler: list[str]
     build_type: list[str]
     arch: list[str]
+    minimal: bool
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
     image: str = ""  # only used by package_configs entries
-    # List of GitHub event names (e.g. "pull_request") on which this config
-    # should NOT run. Empty means it runs on every event.
-    exclude_event_types: list[str] = dataclasses.field(default_factory=list)
 
 
 @dataclasses.dataclass
@@ -89,11 +79,9 @@ class PlatformConfig:
     """One entry in macos.json's or windows.json's 'configs' array."""
 
     build_type: list[str]
+    minimal: bool
     build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
     extra_cmake_args: str = ""
-    # List of GitHub event names (e.g. "pull_request") on which this config
-    # should NOT run. Empty means it runs on every event.
-    exclude_event_types: list[str] = dataclasses.field(default_factory=list)
 
     def __post_init__(self) -> None:
         if isinstance(self.build_type, str):
@@ -168,20 +156,18 @@ _ARCHS: dict[str, Architecture] = {
 }
 
 
-def expand_linux_matrix(
-    linux: LinuxFile, event: str | None = None
-) -> list[MatrixEntry]:
+def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a LinuxFile into a flat list of matrix entries.
 
     Each config entry is expanded over the cross-product of its
-    compiler, build_type, sanitizers, and architecture lists. Configs that
-    exclude the current event are skipped.
+    compiler, build_type, sanitizers, and architecture lists. When 'minimal' is
+    true, only configs flagged as minimal are included.
     """
     entries: list[MatrixEntry] = []
 
     for distro, configs in linux.configs.items():
         for cfg in configs:
-            if not runs_on_event(cfg.exclude_event_types, event):
+            if minimal and not cfg.minimal:
                 continue
             # An empty sanitizers list means "one entry with no sanitizer".
             effective_sanitizers = cfg.sanitizers or [""]
@@ -240,19 +226,17 @@ def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
     return entries
 
 
-def expand_platform_matrix(
-    pf: PlatformFile, event: str | None = None
-) -> list[MatrixEntry]:
+def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a PlatformFile (macOS or Windows) into matrix entries.
 
-    Configs that exclude the current event are skipped.
+    When 'minimal' is true, only configs flagged as minimal are included.
     """
     platform_name, arch = pf.platform.split("/")
     is_windows = platform_name == "windows"
 
     entries: list[MatrixEntry] = []
     for cfg in pf.configs:
-        if not runs_on_event(cfg.exclude_event_types, event):
+        if minimal and not cfg.minimal:
             continue
         for build_type in cfg.build_type:
             entries.append(
@@ -292,12 +276,12 @@ if __name__ == "__main__":
         action="store_true",
     )
     parser.add_argument(
-        "-e",
-        "--event",
-        help="The GitHub event name that triggered the workflow (e.g. 'push', "
-        "'pull_request'). Configs are filtered by their 'event_type'. If "
-        "omitted, no filtering is applied.",
-        default=None,
+        "-m",
+        "--minimal",
+        help="Emit only the minimal matrix (the configs flagged 'minimal'), "
+        "used for pull requests by default. If omitted, the full matrix is "
+        "emitted.",
+        action="store_true",
     )
     args = parser.parse_args()
 
@@ -308,15 +292,15 @@ if __name__ == "__main__":
     else:
         if args.config in ("linux", None):
             matrix += expand_linux_matrix(
-                LinuxFile.load(THIS_DIR / "linux.json"), args.event
+                LinuxFile.load(THIS_DIR / "linux.json"), args.minimal
             )
         if args.config in ("macos", None):
             matrix += expand_platform_matrix(
-                PlatformFile.load(THIS_DIR / "macos.json"), args.event
+                PlatformFile.load(THIS_DIR / "macos.json"), args.minimal
             )
         if args.config in ("windows", None):
             matrix += expand_platform_matrix(
-                PlatformFile.load(THIS_DIR / "windows.json"), args.event
+                PlatformFile.load(THIS_DIR / "windows.json"), args.minimal
             )
 
     print(f"matrix={json.dumps({'include': [dataclasses.asdict(e) for e in matrix]})}")

.github/scripts/strategy-matrix/linux.json

@@ -2,16 +2,30 @@
   "image_tag": "sha-e29b523",
   "configs": {
     "ubuntu": [
+      {
+        "compiler": ["clang"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": true
+      },
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false
+      },
       {
         "compiler": ["gcc", "clang"],
         "build_type": ["Debug", "Release"],
-        "arch": ["amd64", "arm64"]
+        "arch": ["arm64"],
+        "minimal": false
       },
 
       {
         "compiler": ["gcc", "clang"],
         "build_type": ["Debug", "Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "sanitizers": ["address", "undefinedbehavior"]
       },
 
@@ -19,6 +33,7 @@
         "compiler": ["gcc"],
         "build_type": ["Debug"],
         "arch": ["amd64"],
+        "minimal": true,
         "suffix": "coverage",
         "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
       },
@@ -26,6 +41,7 @@
         "compiler": ["clang"],
         "build_type": ["Debug"],
         "arch": ["amd64"],
+        "minimal": false,
         "suffix": "voidstar",
         "extra_cmake_args": "-Dvoidstar=ON"
       },
@@ -33,6 +49,7 @@
         "compiler": ["clang"],
         "build_type": ["Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "suffix": "reffee",
         "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=1000"
       },
@@ -40,9 +57,9 @@
         "compiler": ["gcc"],
         "build_type": ["Debug"],
         "arch": ["amd64"],
+        "minimal": false,
         "suffix": "unity",
-        "extra_cmake_args": "-Dunity=ON",
-        "exclude_event_types": ["pull_request"]
+        "extra_cmake_args": "-Dunity=ON"
       }
     ],
 
@@ -50,7 +67,8 @@
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
-        "arch": ["amd64"]
+        "arch": ["amd64"],
+        "minimal": false
       }
     ],
 
@@ -58,7 +76,8 @@
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
-        "arch": ["amd64"]
+        "arch": ["amd64"],
+        "minimal": false
       }
     ]
   },
@@ -68,6 +87,7 @@
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
       }
     ],
@@ -77,6 +97,7 @@
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
+        "minimal": false,
         "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
       }
     ]

.github/scripts/strategy-matrix/macos.json

@@ -4,13 +4,14 @@
   "configs": [
     {
       "build_type": "Release",
-      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
+      "minimal": true
     },
     {
       "build_type": "Debug",
       "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
       "build_only": true,
-      "exclude_event_types": ["pull_request"]
+      "minimal": false
     }
   ]
 }

.github/scripts/strategy-matrix/windows.json

@@ -2,11 +2,11 @@
   "platform": "windows/amd64",
   "runner": ["self-hosted", "Windows", "dev-box-windows-2026"],
   "configs": [
-    { "build_type": "Release" },
+    { "build_type": "Release", "minimal": true },
     {
       "build_type": "Debug",
       "build_only": true,
-      "exclude_event_types": ["pull_request"]
+      "minimal": false
     }
   ]
 }

.github/workflows/conflicting-pr.yml

@@ -14,6 +14,7 @@ permissions:
 
 jobs:
   main:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'IgnoreConflicts') }}
     runs-on: ubuntu-latest
     steps:
       - name: Check if PRs are dirty

.github/workflows/on-pr.yml

@@ -1,7 +1,11 @@
-# This workflow runs all workflows to check, build and test the project on
-# various Linux flavors, as well as on MacOS and Windows, on every push to a
-# user branch. However, it will not run if the pull request is a draft unless it
-# has the 'DraftRunCI' label. For commits to PRs that target a release branch,
+# This workflow runs workflows to check, build and test the project
+# on every meaningful change on pull_request.
+# However, it will not run if the PR is a draft
+# unless it has the 'DraftRunCI' or 'Full CI build' label.
+#
+# By default a PR builds only a minimal matrix.
+# The full matrix runs once the PR is labeled "Ready to merge" or "Full CI build".
+# For commits to PRs that target a release branch,
 # it also uploads the libxrpl recipe to the Conan remote.
 name: PR
 
@@ -15,8 +19,16 @@ on:
       - reopened
       - synchronize
       - ready_for_review
+      # Trigger on label changes so toggling "Ready to merge" or "Full CI build"
+      # switches between the minimal and full matrix without needing a new push.
+      - labeled
+      - unlabeled
 
 concurrency:
+  # A single per-ref group with cancel-in-progress means any newer run (a push
+  # or a label change) supersedes the in-progress one for that ref. Keeping
+  # exactly one authoritative run per ref ensures a fast do-nothing run can never
+  # mask a real build's checks.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
@@ -25,11 +37,18 @@ defaults:
     shell: bash
 
 jobs:
-  # This job determines whether the rest of the workflow should run. It runs
-  # when the PR is not a draft (which should also cover merge-group) or
-  # has the 'DraftRunCI' label.
+  # This job determines whether the rest of the workflow should run at all,
+  # based on the current set of labels: it runs when the PR is not a draft
+  # (which should also cover merge-group) or has the 'DraftRunCI' or
+  # 'Full CI build' label. Whether a build then happens, and whether it is the
+  # minimal or full matrix, is decided further below and in the strategy matrix.
   should-run:
-    if: ${{ !github.event.pull_request.draft || contains(github.event.pull_request.labels.*.name, 'DraftRunCI') }}
+    if: >-
+      ${{
+        !github.event.pull_request.draft
+        || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
+        || contains(github.event.pull_request.labels.*.name, 'Full CI build')
+      }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -51,10 +70,8 @@ jobs:
           files: |
             # These paths are unique to `on-pr.yml`.
             .github/scripts/levelization/**
-            .github/scripts/otel-naming/**
             .github/scripts/rename/**
             .github/workflows/reusable-check-levelization.yml
-            .github/workflows/reusable-check-otel-naming.yml
             .github/workflows/reusable-check-rename.yml
             .github/workflows/on-pr.yml
 
@@ -93,15 +110,17 @@ jobs:
         # least one of:
         # * Any of the files checked in the `changes` step were modified
         # * The PR is NOT a draft and is labeled "Ready to merge"
+        # * The PR is labeled "Full CI build" (draft or not)
         # * The workflow is running from the merge queue
         id: go
         env:
           FILES: ${{ steps.changes.outputs.any_changed }}
           DRAFT: ${{ github.event.pull_request.draft }}
           READY: ${{ contains(github.event.pull_request.labels.*.name, 'Ready to merge') }}
+          FULL: ${{ contains(github.event.pull_request.labels.*.name, 'Full CI build') }}
           MERGE: ${{ github.event_name == 'merge_group' }}
         run: |
-          echo "go=${{ (env.DRAFT != 'true' && env.READY == 'true') || env.FILES == 'true' || env.MERGE == 'true' }}" >>"${GITHUB_OUTPUT}"
+          echo "go=${{ (env.DRAFT != 'true' && env.READY == 'true') || env.FULL == 'true' || env.FILES == 'true' || env.MERGE == 'true' }}" >>"${GITHUB_OUTPUT}"
           cat "${GITHUB_OUTPUT}"
     outputs:
       go: ${{ steps.go.outputs.go == 'true' }}
@@ -111,11 +130,6 @@ jobs:
     if: ${{ needs.should-run.outputs.go == 'true' }}
     uses: ./.github/workflows/reusable-check-levelization.yml
 
-  check-otel-naming:
-    needs: should-run
-    if: ${{ needs.should-run.outputs.go == 'true' }}
-    uses: ./.github/workflows/reusable-check-otel-naming.yml
-
   check-rename:
     needs: should-run
     if: ${{ needs.should-run.outputs.go == 'true' }}
@@ -149,7 +163,10 @@ jobs:
 
   package:
     needs: [should-run, build-test]
-    if: ${{ needs.should-run.outputs.go == 'true' }}
+    # Packaging consumes the debian/rhel release binaries, which are only built
+    # by the full matrix. Skip it for pull requests that ran only the minimal
+    # matrix (i.e. not yet labeled "Ready to merge" or "Full CI build").
+    if: ${{ needs.should-run.outputs.go == 'true' && (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'Ready to merge') || contains(github.event.pull_request.labels.*.name, 'Full CI build')) }}
     uses: ./.github/workflows/reusable-package.yml
 
   upload-recipe:
@@ -183,7 +200,6 @@ jobs:
     if: failure() || cancelled()
     needs:
       - check-levelization
-      - check-otel-naming
       - check-rename
       - clang-tidy
       - build-test

.github/workflows/reusable-build-test-config.yml

@@ -124,7 +124,7 @@ jobs:
       - name: Check tools
         env:
           CHECK_TOOLS_SKIP_CLONE: "1"
-        run: ./bin/check-tools.sh
+        run: ./bin/check-tools.sh || true
 
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574

.github/workflows/reusable-check-otel-naming.yml

@@ -1,28 +0,0 @@
-# This workflow checks that OpenTelemetry span-attribute names stay consistent
-# across the code (*SpanNames.h), collector, Tempo, dashboards, and docs.
-# See .github/scripts/otel-naming/check_otel_naming.py and the
-# "Telemetry span attribute naming" section in CONTRIBUTING.md.
-name: Check OTel naming
-
-# This workflow can only be triggered by other workflows.
-on: workflow_call
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-otel-naming
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  otel-naming:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - name: Check OTel naming
-        # The script is stdlib-only and reads only files already in the tree;
-        # it enforces each rule only when the layer it needs is present, so it
-        # works whether telemetry changes land in one PR or several.
-        run: python .github/scripts/otel-naming/check_otel_naming.py

.github/workflows/reusable-strategy-matrix.yml

@@ -35,5 +35,8 @@ jobs:
         id: generate
         env:
           GENERATE_CONFIG: ${{ inputs.os != '' && format('--config={0}', inputs.os) || '' }}
-          GENERATE_EVENT: ${{ github.event_name }}
-        run: ./generate.py ${GENERATE_CONFIG} --event="${GENERATE_EVENT}" >>"${GITHUB_OUTPUT}"
+          # Run only the minimal matrix for pull requests that are not yet
+          # labeled "Ready to merge" or "Full CI build". Any other event (merge
+          # queue, push, schedule, manual dispatch) runs the full matrix.
+          GENERATE_MINIMAL: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'Ready to merge') && !contains(github.event.pull_request.labels.*.name, 'Full CI build')) && '--minimal' || '' }}
+        run: ./generate.py ${GENERATE_CONFIG} ${GENERATE_MINIMAL} >>"${GITHUB_OUTPUT}"

.gitignore

@@ -86,6 +86,3 @@ __pycache__
 
 # clangd cache
 /.cache
-
-# Env. file carrying environmental setup data for local or cloud runs.
-.env.*

.pre-commit-config.yaml

@@ -32,6 +32,11 @@ repos:
         # as standalone translation units, so they have no compile_commands.json
         # entry to lint (verify_headers checks them transitively).
         exclude: '^include/xrpl/protocol_autogen|\.ipp$'
+        # run-clang-tidy --fix may edit headers included by files it is not run on,
+        # so pre-commit must not split the files across parallel hook invocations.
+        # The script determines the staged files itself and lets run-clang-tidy
+        # handle parallelism internally.
+        pass_filenames: false
       - id: fix-include-style
         name: fix include style
         entry: ./bin/pre-commit/fix_include_style.py
@@ -43,6 +48,11 @@ repos:
         language: python
         entry: ./bin/pre-commit/fix_pragma_once.py
         files: \.(h|hpp)$
+      - id: check-doxygen-style
+        name: check Doxygen comment style
+        entry: ./bin/pre-commit/check_doxygen_style.py
+        language: python
+        types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
     rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5

API-CHANGELOG.md

@@ -28,6 +28,9 @@ This section contains changes targeting a future version.
 
 ### Additions
 
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
+  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
+
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
 
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):

CMakeLists.txt

@@ -121,18 +121,6 @@ if(rocksdb)
     target_link_libraries(xrpl_libs INTERFACE RocksDB::rocksdb)
 endif()
 
-# OpenTelemetry distributed tracing (optional).
-# When ON, links against opentelemetry-cpp and defines XRPL_ENABLE_TELEMETRY
-# so that SpanGuard factory methods produce real OTel spans.
-# When OFF (default), all tracing code compiles to no-ops with zero overhead.
-# Enable via: conan install -o telemetry=True, or cmake -Dtelemetry=ON.
-option(telemetry "Enable OpenTelemetry tracing" ON)
-if(telemetry)
-    find_package(opentelemetry-cpp CONFIG REQUIRED)
-    add_compile_definitions(XRPL_ENABLE_TELEMETRY)
-    message(STATUS "OpenTelemetry tracing enabled")
-endif()
-
 # Work around changes to Conan recipe for now.
 if(TARGET nudb::core)
     set(nudb nudb::core)

CONTRIBUTING.md

@@ -84,7 +84,9 @@ If you create new source files, they must be organized as follows:
 - All other non-test files must go under `src/xrpld`.
 - All test source files must go under `src/test`.
 
-The source must be formatted according to the style guide below.
+The source must be formatted according to the style guide below. The easiest
+way to satisfy this is to install the [`pre-commit`](#pre-commit-hooks) hooks,
+which format and lint your changes automatically on every commit.
 
 Header includes must be [levelized](.github/scripts/levelization).
 
@@ -212,13 +214,61 @@ This is a non-exhaustive list of recommended style guidelines. These are
 not always strictly enforced and serve as a way to keep the codebase
 coherent rather than a set of _thou shalt not_ commandments.
 
+## Pre-commit hooks
+
+We use the [`pre-commit`](https://pre-commit.com/) framework to run the
+formatting and linting tools that keep the codebase consistent. `pre-commit`
+runs each tool configured in
+[`.pre-commit-config.yaml`](./.pre-commit-config.yaml) in its own isolated
+environment, so you don't need to install most of the individual tools
+yourself. The version of each hook sourced from an external repository
+(`clang-format`, `gersemi`, etc.) is pinned in that file, so running the hooks
+locally uses exactly the same versions as CI. A few `local` hooks — most notably
+`clang-tidy` — run tools from your own environment; see
+[Installing clang-tidy](#installing-clang-tidy) for how to get those.
+
+To get started, install `pre-commit` and enable the git hook scripts:
+
+```bash
+pip install pre-commit
+pre-commit install
+```
+
+Once installed, the hooks run automatically on your staged files every time you
+`git commit`. You can also run them on demand:
+
+```bash
+# Run all hooks against only the staged files
+pre-commit run
+
+# Run all hooks against every file in the repository
+pre-commit run --all-files
+
+# Run a single hook (e.g. clang-format) against all files
+pre-commit run clang-format --all-files
+```
+
+The hooks configured in this repository include, among others:
+
+- `clang-format` — C++/proto formatting (see [Formatting](#formatting))
+- `clang-tidy` — C++ static analysis (see [Clang-tidy](#clang-tidy)); opt in with `TIDY=1`
+- `fix-include-style`, `fix-pragma-once`, `check-doxygen-style` — C++ hygiene
+- `gersemi` — CMake formatting
+- `prettier`, `black`, `shfmt` — formatting for JavaScript/JSON/Markdown, Python, and shell
+- `cspell` — spell checking
+
+The same hooks run in CI on every pull request, so running them locally before
+you push helps you avoid CI failures.
+
 ## Formatting
 
-All code must conform to `clang-format` version 22,
-according to the settings in [`.clang-format`](./.clang-format),
-unless the result would be unreasonably difficult to read or maintain.
-To demarcate lines that should be left as-is, surround them with comments like
-this:
+All code must conform to `clang-format`, according to the settings in
+[`.clang-format`](./.clang-format), unless the result would be unreasonably
+difficult to read or maintain. The `clang-format` version is pinned in
+[`.pre-commit-config.yaml`](./.pre-commit-config.yaml), so the
+[`pre-commit`](#pre-commit-hooks) hook always formats with the same version as
+CI. To demarcate lines that should be left as-is, surround them with comments
+like this:
 
 ```
 // clang-format off
@@ -226,9 +276,21 @@ this:
 // clang-format on
 ```
 
-You can format individual files in place by running `clang-format -i <file>...`
+The easiest way to format your changes is to let the `pre-commit` hook run
+automatically on commit, or to run it manually:
+
+```bash
+pre-commit run clang-format --all-files
+```
+
+You can also format individual files in place by running `clang-format -i <file>...`
 from any directory within this project.
 
+> [!NOTE]
+> This uses whatever `clang-format` version is installed locally, which may
+> differ from the pinned version used by `pre-commit` and CI, so the results
+> can vary.
+
 There is a Continuous Integration job that runs clang-format on pull requests. If the code doesn't comply, a patch file that corrects auto-fixable formatting issues is generated.
 
 To download the patch file:
@@ -239,13 +301,6 @@ To download the patch file:
 4. Download the zip file and extract it to your local git repository. Run `git apply [patch-file-name]`.
 5. Commit and push.
 
-You can install a pre-commit hook to automatically run `clang-format` before every commit:
-
-```
-pip3 install pre-commit
-pre-commit install
-```
-
 ## Clang-tidy
 
 All code must pass `clang-tidy` checks according to the settings in [`.clang-tidy`](./.clang-tidy).
@@ -267,7 +322,7 @@ Before running clang-tidy, you must build the project to generate required files
 
 #### Via pre-commit (recommended)
 
-If you have already installed the pre-commit hooks (see above), you can run clang-tidy on your staged files using:
+If you have already installed the [`pre-commit`](#pre-commit-hooks) hooks, you can run clang-tidy on your staged files using:
 
 ```
 TIDY=1 pre-commit run clang-tidy
@@ -298,66 +353,6 @@ If you wish to automatically fix whatever clang-tidy finds _and_ is capable of f
 run-clang-tidy -p build -quiet -fix -allow-no-checks src tests
 ```
 
-## Telemetry span attribute naming
-
-OpenTelemetry span attribute keys follow these rules so they stay consistent
-across the code, the OTel collector, Tempo, Grafana dashboards, and docs. The
-constants in the `*SpanNames.h` headers are the single source of truth; every
-other layer must match them. A CI check enforces this end to end.
-
-1. Per-span unique attribute: bare field name — allowed when the field is
-   recorded by a single span/workflow, so the span name already supplies the
-   domain (e.g. `command`, `local`, `version` on `rpc.command` / `tx.process`).
-2. Shared attribute (same concept on more than one span): ONE key, reused
-   verbatim on every span that records it — the span name tells the occurrences
-   apart, so no per-emitter prefix is added. Pick the name by the field's
-   meaning: a property of a domain object keeps that object's bare field name
-   (`ledger_hash`, `ledger_seq`, `tx_hash`, `peer_id`, `full_validation`); a
-   field already qualified by a sub-kind keeps that qualifier on every emitter
-   (`proposal_trusted` on both `consensus.proposal.receive` and
-   `peer.proposal.receive`; `validation_trusted` likewise). Define it once in
-   the base `SpanNames.h` `namespace attr` block and re-export (`using`) it from
-   each domain header, so all emitters share the exact string.
-3. Collision qualifier: `<domain>_<field>` — only when a bare name would collide
-   with a DIFFERENT concept in the shared spanmetrics label space, or with the
-   OTel-reserved `status` key (e.g. `rpc_status`, `grpc_status`,
-   `consensus_phase`, `consensus_round`). This disambiguates distinct concepts
-   that share a word; it is NOT used to tag the same concept with the workflow
-   that emitted it — that is rule 2 (one shared name).
-4. Resource attribute: dotted `xrpl.<subsystem>.<field>` — reserved ONLY for
-   process/network identity set once at startup (`xrpl.network.id`,
-   `xrpl.network.type`). Never use the dotted `xrpl.` form for span attributes.
-5. Span names use `<subsystem>[.<component>]` (dotted). Only attribute _keys_
-   follow rules 1–4.
-
-All attribute keys are `lower_snake_case` (lowercase letters, digits, and
-underscores; each dot-separated segment of a resource key likewise). No
-camelCase, uppercase, or spaces.
-
-Standard OpenTelemetry semantic-convention keys keep their canonical dotted
-form (e.g. `service.*` resource attributes, `http.*` span attributes); the
-"no dotted form" rule above applies to xrpl-custom keys, not to OTel-standard
-conventions.
-
-Always reference the `*SpanNames.h` constants for attribute keys and span
-names — never pass a string literal as a key or as a `span`/`childSpan` name
-argument. (Attribute _values_ may be runtime data.)
-
-These rules are enforced by `.github/scripts/otel-naming/check_otel_naming.py`,
-run in CI on every pull request. The check derives the set of valid keys
-directly from the `*SpanNames.h` constants and the resource attributes the code
-registers, so there is no separate list to keep in sync. It cross-validates the
-collector, Tempo, dashboards, and docs against those keys, and each rule runs
-only when the file it needs is present — so it works whether telemetry changes
-land in one pull request or several. Run it locally with:
-
-```
-python .github/scripts/otel-naming/check_otel_naming.py
-```
-
-See [.github/scripts/otel-naming/README.md](.github/scripts/otel-naming/README.md)
-for the full rule list.
-
 ## Contracts and instrumentation
 
 We are using [Antithesis](https://antithesis.com/) for continuous fuzzing,

OpenTelemetryPlan/00-tracing-fundamentals.md

@@ -1,565 +0,0 @@
-# Distributed Tracing Fundamentals
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Next**: [Architecture Analysis](./01-architecture-analysis.md)
-
----
-
-## What is Distributed Tracing?
-
-Distributed tracing is a method for tracking data objects as they flow through distributed systems. In a network like XRP Ledger, a single transaction touches multiple independent nodes—each with no shared memory or logging. Distributed tracing connects these dots.
-
-**Without tracing:** You see isolated logs on each node with no way to correlate them.
-
-**With tracing:** You see the complete journey of a transaction or an event across all nodes it touched.
-
----
-
-## Actors and Actions at a Glance
-
-### Actors
-
-| Who (Plain English)                            | Technical Term  |
-| ---------------------------------------------- | --------------- |
-| A single unit of work being tracked            | Span            |
-| The complete journey of a request              | Trace           |
-| Data that links spans across services          | Trace Context   |
-| Code that creates spans and propagates context | Instrumentation |
-| Service that receives and processes traces     | Collector       |
-| Storage and visualization system               | Backend (Tempo) |
-| Decision logic for which traces to keep        | Sampler         |
-
-### Actions
-
-| What Happens (Plain English)            | Technical Term          |
-| --------------------------------------- | ----------------------- |
-| Start tracking a new operation          | Create a Span           |
-| Connect a child operation to its parent | Set `parent_span_id`    |
-| Group all related operations together   | Share a `trace_id`      |
-| Pass tracking data between services     | Context Propagation     |
-| Decide whether to record a trace        | Sampling (Head or Tail) |
-| Send completed traces to storage        | Export (OTLP)           |
-
----
-
-## Core Concepts
-
-### 1. Trace
-
-A **trace** represents the entire journey of a request through the system. It has a unique `trace_id` that stays constant across all nodes.
-
-```
-Trace ID: abc123
-├── Node A: received transaction
-├── Node B: relayed transaction
-├── Node C: included in consensus
-└── Node D: applied to ledger
-```
-
-### 2. Span
-
-A **span** represents a single unit of work within a trace. Each span has:
-
-| Attribute        | Description                      | Example                    |
-| ---------------- | -------------------------------- | -------------------------- |
-| `trace_id`       | Identifies the trace             | `event123`                 |
-| `span_id`        | Unique identifier                | `span456`                  |
-| `parent_span_id` | Parent span (if any)             | `p_span123`                |
-| `name`           | Operation name                   | `rpc.submit`               |
-| `start_time`     | When work began (local time)     | `2024-01-15T10:30:00Z`     |
-| `end_time`       | When work completed (local time) | `2024-01-15T10:30:00.050Z` |
-| `attributes`     | Key-value metadata               | `tx_hash=ABC...`           |
-| `status`         | OK, ERROR MSG                    | `OK`                       |
-
-### 3. Trace Context
-
-**Trace context** is the data that propagates between services to link spans together. It contains:
-
-- `trace_id` - The trace this span belongs to
-- `span_id` - The current span (becomes parent for child spans)
-- `trace_flags` - Sampling decisions
-
----
-
-## How Spans Form a Trace
-
-Spans have parent-child relationships forming a tree structure:
-
-```mermaid
-flowchart TB
-    subgraph trace["Trace: abc123"]
-        A["tx.submit<br/>span_id: 001<br/>50ms"] --> B["tx.validate<br/>span_id: 002<br/>5ms"]
-        A --> C["tx.relay<br/>span_id: 003<br/>10ms"]
-        A --> D["tx.apply<br/>span_id: 004<br/>30ms"]
-        D --> E["ledger.update<br/>span_id: 005<br/>20ms"]
-    end
-
-    style A fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style B fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style C fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style D fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style E fill:#bf360c,stroke:#8c2809,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **tx.submit (blue, root)**: The top-level span representing the entire transaction submission; all other spans are its descendants.
-- **tx.validate, tx.relay, tx.apply (green)**: Direct children of tx.submit, representing the three main stages -- validation, relay to peers, and application to the ledger.
-- **ledger.update (red)**: A grandchild span nested under tx.apply, representing the actual ledger state mutation triggered by applying the transaction.
-- **Arrows (parent to child)**: Each arrow indicates a parent-child span relationship where the parent's completion depends on the child finishing.
-
-The same trace visualized as a **timeline (Gantt chart)**:
-
-```
-Time →   0ms    10ms    20ms    30ms    40ms    50ms
-         ├───────────────────────────────────────────┤
-tx.submit│▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓│
-         ├─────┤
-tx.valid │▓▓▓▓▓│
-         │     ├──────────┤
-tx.relay │     │▓▓▓▓▓▓▓▓▓▓│
-         │               ├────────────────────────────┤
-tx.apply │               │▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓│
-         │                         ├──────────────────┤
-ledger   │                         │▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓│
-```
-
----
-
-## Span Relationships
-
-Spans don't always form simple parent-child trees. Distributed tracing defines several relationship types to capture different causal patterns:
-
-### 1. Parent-Child (ChildOf)
-
-The default relationship. The parent span **depends on** or **contains** the child span. The child runs within the scope of the parent.
-
-```
-tx.submit (parent)
-├── tx.validate (child)     ← parent waits for this
-├── tx.relay (child)        ← parent waits for this
-└── tx.apply (child)        ← parent waits for this
-```
-
-**When to use:** Synchronous calls, nested operations, any case where the parent's completion depends on the child.
-
-### 2. Follows-From
-
-A causal relationship where the first span **triggers** the second, but does **not wait** for it. The originator fires and moves on.
-
-```
-Time →
-
-tx.receive [=======]
-                     ↓ triggers (follows-from)
-              tx.relay   [===========]   ← runs independently
-```
-
-**When to use:** Asynchronous jobs, queued work, fire-and-forget patterns. For example, a node receives a transaction and queues it for relay — the relay span _follows from_ the receive span but the receiver doesn't wait for relaying to complete.
-
-> **OpenTracing** defined `FollowsFrom` as a first-class reference type alongside `ChildOf`.
-> **OpenTelemetry** represents this using **Span Links** with descriptive attributes instead (see below).
-
-### 3. Span Links (Cross-Trace and Non-Hierarchical)
-
-Links connect spans that are **causally related but not in a parent-child hierarchy**. Unlike parent-child, links can cross trace boundaries.
-
-```
-Trace A                          Trace B
-──────                           ──────
-batch.schedule                   batch.execute
-├─ item.enqueue (span X)    ┌──► process.item
-├─ item.enqueue (span Y) ───┤    (links to X, Y, Z)
-├─ item.enqueue (span Z)    └──►
-```
-
-**Use cases:**
-
-| Pattern              | Description                                                                 |
-| -------------------- | --------------------------------------------------------------------------- |
-| **Batch processing** | A batch span links back to all individual spans that contributed to it      |
-| **Fan-in**           | An aggregation span links to the multiple producer spans it merges          |
-| **Fan-out**          | Multiple downstream spans link back to the single span that triggered them  |
-| **Async handoff**    | A deferred job links back to the request that queued it (follows-from)      |
-| **Cross-trace**      | Correlating spans across independent traces (e.g., retries, related events) |
-
-**Link structure:** Each link carries the target span's context plus optional attributes:
-
-```
-Link {
-    trace_id:   <target trace>
-    span_id:    <target span>
-    attributes: { "link.description": "triggered by batch scheduler" }
-}
-```
-
-### Relationship Summary
-
-```mermaid
-flowchart LR
-    subgraph parent_child["Parent-Child"]
-        direction TB
-        P["Parent"] --> C["Child"]
-    end
-
-    subgraph follows_from["Follows-From"]
-        direction TB
-        A["Span A"] -.->|triggers| B["Span B"]
-    end
-
-    subgraph links["Span Links"]
-        direction TB
-        X["Span X\n(Trace 1)"] -.-|link| Y["Span Y\n(Trace 2)"]
-    end
-
-    parent_child ~~~ follows_from ~~~ links
-
-    style P fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style C fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style A fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style B fill:#bf360c,stroke:#8c2809,color:#ffffff
-    style X fill:#4a148c,stroke:#38006b,color:#ffffff
-    style Y fill:#4a148c,stroke:#38006b,color:#ffffff
-```
-
-| Relationship     | Same Trace? | Dependency?                | OTel Mechanism    |
-| ---------------- | ----------- | -------------------------- | ----------------- |
-| **Parent-Child** | Yes         | Parent depends on child    | `parent_span_id`  |
-| **Follows-From** | Usually     | Causal but no dependency   | Link + attributes |
-| **Span Link**    | Either      | Correlation, no dependency | Link + attributes |
-
----
-
-## Trace ID Generation
-
-A `trace_id` is a 128-bit (16-byte) identifier that groups all spans belonging to one logical operation. How it's generated determines how easily you can find and correlate traces later.
-
-### General Approaches
-
-#### 1. Random (W3C Default)
-
-Generate a random 128-bit ID when a trace starts. Standard approach for most services.
-
-```
-trace_id = random_128_bits()
-```
-
-| Pros                        | Cons                                          |
-| --------------------------- | --------------------------------------------- |
-| Simple, standard            | No natural correlation to domain events       |
-| Guaranteed unique per trace | If propagation is lost, trace is broken       |
-| Works with all OTel tooling | "Find trace for TX abc" requires index lookup |
-
-#### 2. Deterministic (Derived from Domain Data)
-
-Compute the trace_id from a hash of a natural identifier. Every node independently derives the **same** trace_id for the same event.
-
-```
-trace_id = SHA-256(domain_identifier)[0:16]   // truncate to 128 bits
-```
-
-| Pros                                                | Cons                                                       |
-| --------------------------------------------------- | ---------------------------------------------------------- |
-| Propagation-resilient — same ID computed everywhere | Same event processed twice (retry) shares trace_id         |
-| Natural search — domain ID maps directly to trace   | Non-standard (tooling assumes random)                      |
-| No coordination needed between nodes                | 256→128 bit truncation (collision risk negligible at ~2⁶⁴) |
-
-#### 3. Hybrid (Deterministic Prefix + Random Suffix)
-
-First 8 bytes derived from domain data, last 8 bytes random.
-
-```
-trace_id = SHA-256(domain_identifier)[0:8] || random_64_bits()
-```
-
-| Pros                                        | Cons                                     |
-| ------------------------------------------- | ---------------------------------------- |
-| Prefix search: "find all traces for TX abc" | Must propagate to maintain full trace_id |
-| Unique per processing instance              | More complex generation logic            |
-| Retries get distinct trace_ids              | Partial correlation only (prefix match)  |
-
-### XRPL Workflow Analysis
-
-XRPL has a unique advantage: its core workflows produce **globally unique 256-bit hashes** that are known on every node. This makes deterministic trace_id generation practical in ways most systems can't achieve.
-
-#### Natural Identifiers by Workflow
-
-| Workflow            | Natural Identifier                | Size       | Known at Start?               | Same on All Nodes?               |
-| ------------------- | --------------------------------- | ---------- | ----------------------------- | -------------------------------- |
-| **Transaction**     | Transaction hash (`tid_`)         | 256-bit    | Yes — computed before signing | Yes — hash of canonical tx data  |
-| **Consensus round** | Previous ledger hash + ledger seq | 256+32 bit | Yes — known when round opens  | Yes — all validators agree       |
-| **Validation**      | Ledger hash being validated       | 256-bit    | Yes — from consensus result   | Yes — same closed ledger         |
-| **Ledger catch-up** | Target ledger hash                | 256-bit    | Yes — we know what to fetch   | Yes — identifies ledger globally |
-
-#### Where These Identifiers Live in Code
-
-```
-Transaction:     STTx::getTransactionID()     → uint256 tid_
-                 TMTransaction::rawTransaction → recompute hash from bytes
-
-Consensus:       ConsensusProposal::prevLedger_ → uint256 (previous ledger hash)
-                 ConsensusProposal::position_   → uint256 (TxSet hash)
-                 LedgerHeader::seq              → uint32_t (ledger sequence)
-
-Validation:      STValidation::getLedgerHash()  → uint256
-                 STValidation::getNodeID()      → NodeID (160-bit)
-
-Ledger fetch:    InboundLedger constructor      → uint256 hash, uint32_t seq
-                 TMGetLedger::ledgerHash        → bytes (uint256)
-```
-
-### Recommended Strategy: Workflow-Scoped Deterministic
-
-Each workflow type derives its trace_id from its natural domain identifier:
-
-```
-Transaction trace:   trace_id = SHA-256("tx"    || tx_hash)[0:16]
-Consensus trace:     trace_id = SHA-256("cons"  || prev_ledger_hash || ledger_seq)[0:16]
-Ledger catch-up:     trace_id = SHA-256("fetch" || target_ledger_hash)[0:16]
-```
-
-The string prefix (`"tx"`, `"cons"`, `"fetch"`) prevents collisions between workflows that might share underlying hashes.
-
-**Why this works for XRPL:**
-
-1. **Propagation-resilient** — Even if a P2P message drops trace context, every node independently computes the same trace_id from the same tx_hash or ledger_hash. Spans still correlate.
-
-2. **Zero-cost search** — "Show me the trace for transaction ABC" becomes a direct lookup: compute `SHA-256("tx" || ABC)[0:16]` and query. No secondary index needed.
-
-3. **Cross-workflow linking via Span Links** — A consensus trace links to individual transaction traces. A validation span links to the consensus trace. This connects the full picture without forcing everything into one giant trace.
-
-### Cross-Workflow Correlation
-
-Each workflow gets its own trace. Span Links tie them together:
-
-```mermaid
-flowchart TB
-    subgraph tx_trace["Transaction Trace"]
-        direction LR
-        Tn["trace_id = f(tx_hash)"]:::note --> T1["tx.receive"] --> T2["tx.validate"] --> T3["tx.relay"]
-    end
-
-    subgraph cons_trace["Consensus Trace"]
-        direction LR
-        Cn["trace_id = f(prev_ledger, seq)"]:::note --> C1["cons.open"] --> C2["cons.propose"] --> C3["cons.accept"]
-    end
-
-    subgraph val_trace["Validation"]
-        direction LR
-        Vn["spans within consensus trace"]:::note --> V1["val.create"] --> V2["val.broadcast"]
-    end
-
-    subgraph fetch_trace["Catch-Up Trace"]
-        direction LR
-        Fn["trace_id = f(ledger_hash)"]:::note --> F1["fetch.request"] --> F2["fetch.receive"] --> F3["fetch.apply"]
-    end
-
-    C1 -.-|"span link\n(tx traces)"| T3
-    C3 --> V1
-    F1 -.-|"span link\n(target ledger)"| C3
-
-    classDef note fill:none,stroke:#888,stroke-dasharray:5 5,color:#333,font-style:italic
-    style T1 fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style T2 fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style T3 fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style C1 fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style C2 fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style C3 fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style V1 fill:#bf360c,stroke:#8c2809,color:#ffffff
-    style V2 fill:#bf360c,stroke:#8c2809,color:#ffffff
-    style F1 fill:#4a148c,stroke:#38006b,color:#ffffff
-    style F2 fill:#4a148c,stroke:#38006b,color:#ffffff
-    style F3 fill:#4a148c,stroke:#38006b,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **Transaction Trace (blue)**: An independent trace whose `trace_id` is deterministically derived from the transaction hash. Contains receive, validate, and relay spans.
-- **Consensus Trace (green)**: An independent trace whose `trace_id` is derived from the previous ledger hash and sequence number. Covers the open, propose, and accept phases.
-- **Validation (red)**: Validation spans live within the consensus trace (not a separate trace). They are created after the accept phase completes.
-- **Catch-Up Trace (purple)**: An independent trace for ledger acquisition, derived from the target ledger hash. Used when a node is behind and fetching missing ledgers.
-- **Dotted arrows (span links)**: Cross-trace correlations. Consensus links to transaction traces it included; catch-up links to the consensus trace that produced the target ledger.
-- **Solid arrow (C3 to V1)**: A parent-child relationship -- validation spans are direct children of the consensus accept span within the same trace.
-
-**How a query flows:**
-
-```
-"Why was TX abc slow?"
-  1. Compute trace_id = SHA-256("tx" || abc)[0:16]
-  2. Find transaction trace → see it was included in consensus round N
-  3. Follow span link → consensus trace for round N
-  4. See which phase was slow (propose? accept?)
-  5. If a node was catching up, follow link → catch-up trace
-```
-
-### Trade-offs to Consider
-
-| Concern                       | Mitigation                                                                                                                    |
-| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| **Retries get same trace_id** | Add `attempt` attribute to root span; spans have unique span_ids and timestamps                                               |
-| **256→128 bit truncation**    | Birthday-bound collision at ~2⁶⁴ operations — negligible for XRPL's throughput                                                |
-| **Non-standard generation**   | OTel spec allows any 16-byte non-zero value; tooling works on the hex string                                                  |
-| **Hash computation cost**     | SHA-256 is ~0.3μs per call; XRPL already computes these hashes for other purposes                                             |
-| **Late-binding identifiers**  | Ledger hash isn't known until after consensus — validation spans use ledger_seq as fallback, then link to the consensus trace |
-
----
-
-## Distributed Traces Across Nodes
-
-In distributed systems like xrpld, traces span **multiple independent nodes**. The trace context must be propagated in network messages:
-
-```mermaid
-sequenceDiagram
-    participant Client
-    participant NodeA as Node A
-    participant NodeB as Node B
-    participant NodeC as Node C
-
-    Client->>NodeA: Submit TX<br/>(no trace context)
-
-    Note over NodeA: Creates new trace<br/>trace_id: abc123<br/>span: tx.receive
-
-    NodeA->>NodeB: Relay TX<br/>(trace_id: abc123, parent: 001)
-
-    Note over NodeB: Creates child span<br/>span: tx.relay<br/>parent_span_id: 001
-
-    NodeA->>NodeC: Relay TX<br/>(trace_id: abc123, parent: 001)
-
-    Note over NodeC: Creates child span<br/>span: tx.relay<br/>parent_span_id: 001
-
-    Note over NodeA,NodeC: All spans share trace_id: abc123<br/>enabling correlation across nodes
-```
-
-**Reading the diagram:**
-
-- **Client**: The external entity that submits a transaction. It does not carry trace context -- the trace originates at the first node.
-- **Node A**: The entry point that creates a new trace (trace_id: abc123) and the root span `tx.receive`. It relays the transaction to peers with trace context attached.
-- **Node B and Node C**: Peer nodes that receive the relayed transaction along with the propagated trace context. Each creates a child span under Node A's span, preserving the same `trace_id`.
-- **Arrows with trace context**: The relay messages carry `trace_id` and `parent_span_id`, allowing each downstream node to link its spans back to the originating span on Node A.
-
----
-
-## Context Propagation
-
-For traces to work across nodes, **trace context must be propagated** in messages.
-
-### What's in the Context (~26 bytes)
-
-| Field         | Size     | Description                                             |
-| ------------- | -------- | ------------------------------------------------------- |
-| `trace_id`    | 16 bytes | Identifies the entire trace (constant across all nodes) |
-| `span_id`     | 8 bytes  | The sender's current span (becomes parent on receiver)  |
-| `trace_flags` | 1 byte   | Sampling decision (bit 0 = sampled; bits 1-7 reserved)  |
-| `trace_state` | variable | Optional vendor-specific data (typically omitted)       |
-
-### How span_id Changes at Each Hop
-
-Only **one** `span_id` travels in the context - the sender's current span. Each node:
-
-1. Extracts the received `span_id` and uses it as the `parent_span_id`
-2. Creates a **new** `span_id` for its own span
-3. Sends its own `span_id` as the parent when forwarding
-
-```
-Node A                      Node B                      Node C
-──────                      ──────                      ──────
-
-Span AAA                    Span BBB                    Span CCC
-   │                           │                           │
-   ▼                           ▼                           ▼
-Context out:                Context out:                Context out:
-├─ trace_id: abc123         ├─ trace_id: abc123         ├─ trace_id: abc123
-├─ span_id: AAA ──────────► ├─ span_id: BBB ──────────► ├─ span_id: CCC ──────►
-└─ flags: 01                └─ flags: 01                └─ flags: 01
-                               │                           │
-                          parent = AAA               parent = BBB
-```
-
-The `trace_id` stays constant, but `span_id` **changes at every hop** to maintain the parent-child chain.
-
-### Propagation Formats
-
-There are two patterns:
-
-### HTTP/RPC Headers (W3C Trace Context)
-
-```
-traceparent: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01
-             │  │                                │                │
-             │  │                                │                └── Flags (sampled)
-             │  │                                └── Parent span ID (16 hex)
-             │  └── Trace ID (32 hex)
-             └── Version
-```
-
-### Protocol Buffers (xrpld P2P messages)
-
-xrpld P2P messages such as `TMTransaction` carry the trace context in two added byte fields alongside the existing payload: `trace_parent` holds the W3C traceparent (`trace_id`, `span_id`, and `trace_flags`), and `trace_state` holds the optional W3C tracestate. Together they propagate the trace across the P2P boundary so a receiving node can attach its spans to the sender's span.
-
----
-
-## Sampling
-
-Not every trace needs to be recorded. **Sampling** reduces overhead:
-
-### Head Sampling (at trace start)
-
-```
-Request arrives → Random N% chance → Record or skip entire trace
-```
-
-- ✅ Low overhead
-- ❌ May miss interesting traces
-
-> **xrpld note**: xrpld intentionally fixes head sampling at 100% (sample
-> everything) and does not expose a configurable ratio. A per-node ratio
-> would let different nodes make divergent keep/drop decisions for the same
-> distributed trace, producing broken/partial traces. xrpld uses a
-> `ParentBased` sampler so spans with a remote parent honor the upstream
-> decision. Volume reduction is delegated to collector-side tail sampling.
-
-### Tail Sampling (after trace completes)
-
-```
-Trace completes → Collector evaluates:
-                  - Error? → KEEP
-                  - Slow? → KEEP
-                  - Normal? → Sample 10%
-```
-
-- ✅ Never loses important traces
-- ❌ Higher memory usage at collector
-
----
-
-## Key Benefits for xrpld
-
-| Challenge                          | How Tracing Helps                        |
-| ---------------------------------- | ---------------------------------------- |
-| "Where is my transaction?"         | Follow trace across all nodes it touched |
-| "Why was consensus slow?"          | See timing breakdown of each phase       |
-| "Which node is the bottleneck?"    | Compare span durations across nodes      |
-| "What happened during the outage?" | Correlate errors across the network      |
-
----
-
-## Glossary
-
-| Term                 | Definition                                                          |
-| -------------------- | ------------------------------------------------------------------- |
-| **Trace**            | Complete journey of a request, identified by `trace_id`             |
-| **Span**             | Single operation within a trace                                     |
-| **Parent-Child**     | Span relationship where the parent depends on the child             |
-| **Follows-From**     | Causal relationship where originator doesn't wait for the result    |
-| **Span Link**        | Non-hierarchical connection between spans, possibly across traces   |
-| **Deterministic ID** | Trace ID derived from domain data (e.g., tx_hash) instead of random |
-| **Context**          | Data propagated between services (`trace_id`, `span_id`, flags)     |
-| **Instrumentation**  | Code that creates spans and propagates context                      |
-| **Collector**        | Service that receives, processes, and exports traces                |
-| **Backend**          | Storage/visualization system (Tempo)                                |
-| **Head Sampling**    | Sampling decision at trace start                                    |
-| **Tail Sampling**    | Sampling decision after trace completes                             |
-
----
-
-_Next: [Architecture Analysis](./01-architecture-analysis.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/01-architecture-analysis.md

@@ -1,467 +0,0 @@
-# Architecture Analysis
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Design Decisions](./02-design-decisions.md) | [Implementation Strategy](./03-implementation-strategy.md)
-
----
-
-## 1.1 Current xrpld Architecture Overview
-
-> **WS** = WebSocket | **UNL** = Unique Node List | **TxQ** = Transaction Queue | **StatsD** = Statistics Daemon
-
-The xrpld node software consists of several interconnected components that need instrumentation for distributed tracing:
-
-```mermaid
-flowchart TB
-    subgraph xrpld["xrpld Node"]
-        subgraph services["Core Services"]
-            RPC["RPC Server<br/>(HTTP/WS/gRPC)"]
-            Overlay["Overlay<br/>(P2P Network)"]
-            Consensus["Consensus<br/>(RCLConsensus)"]
-            ValidatorList["ValidatorList<br/>(UNL Mgmt)"]
-        end
-
-        JobQueue["JobQueue<br/>(Thread Pool)"]
-
-        subgraph processing["Processing Layer"]
-            NetworkOPs["NetworkOPs<br/>(Tx Processing)"]
-            LedgerMaster["LedgerMaster<br/>(Ledger Mgmt)"]
-            NodeStore["NodeStore<br/>(Database)"]
-            InboundLedgers["InboundLedgers<br/>(Ledger Sync)"]
-        end
-
-        subgraph appservices["Application Services"]
-            PathFind["PathFinding<br/>(Payment Paths)"]
-            TxQ["TxQ<br/>(Fee Escalation)"]
-            LoadMgr["LoadManager<br/>(Fee/Load)"]
-        end
-
-        subgraph observability["Existing Observability"]
-            PerfLog["PerfLog<br/>(JSON)"]
-            Insight["Insight<br/>(StatsD)"]
-            Logging["Logging<br/>(Journal)"]
-        end
-
-        services --> JobQueue
-        JobQueue --> processing
-        JobQueue --> appservices
-    end
-
-    style xrpld fill:#424242,stroke:#212121,color:#ffffff
-    style services fill:#1565c0,stroke:#0d47a1,color:#ffffff
-    style processing fill:#2e7d32,stroke:#1b5e20,color:#ffffff
-    style appservices fill:#6a1b9a,stroke:#4a148c,color:#ffffff
-    style observability fill:#e65100,stroke:#bf360c,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **Core Services (blue)**: The entry points into xrpld -- RPC Server handles client requests, Overlay manages peer-to-peer networking, Consensus drives agreement, and ValidatorList manages trusted validators.
-- **JobQueue (center)**: The asynchronous thread pool that decouples Core Services from the Processing and Application layers. All work flows through it.
-- **Processing Layer (green)**: Core business logic -- NetworkOPs processes transactions, LedgerMaster manages ledger state, NodeStore handles persistence, and InboundLedgers synchronizes missing data.
-- **Application Services (purple)**: Higher-level features -- PathFinding computes payment routes, TxQ manages fee-based queuing, and LoadManager tracks server load.
-- **Existing Observability (orange)**: The current monitoring stack (PerfLog, Insight, Journal logging) that OpenTelemetry will complement, not replace.
-- **Arrows (Services to JobQueue to layers)**: Work originates at Core Services, is enqueued onto the JobQueue, and dispatched to Processing or Application layers for execution.
-
----
-
-## 1.1.1 Actors and Actions
-
-### Actors
-
-| Who (Plain English)                       | Technical Term             |
-| ----------------------------------------- | -------------------------- |
-| Network node running XRPL software        | xrpld node                 |
-| External client submitting requests       | RPC Client                 |
-| Network neighbor sharing data             | Peer (PeerImp)             |
-| Request handler for client queries        | RPC Server (ServerHandler) |
-| Command executor for specific RPC methods | RPCHandler                 |
-| Agreement process between nodes           | Consensus (RCLConsensus)   |
-| Transaction processing coordinator        | NetworkOPs                 |
-| Background task scheduler                 | JobQueue                   |
-| Ledger state manager                      | LedgerMaster               |
-| Payment route calculator                  | PathFinding (Pathfinder)   |
-| Transaction waiting room                  | TxQ (Transaction Queue)    |
-| Fee adjustment system                     | LoadManager                |
-| Trusted validator list manager            | ValidatorList              |
-| Protocol upgrade tracker                  | AmendmentTable             |
-| Ledger state hash tree                    | SHAMap                     |
-| Persistent key-value storage              | NodeStore                  |
-
-### Actions
-
-| What Happens (Plain English)                   | Technical Term         |
-| ---------------------------------------------- | ---------------------- |
-| Client sends a request to a node               | `rpc.request`          |
-| Node executes a specific RPC command           | `rpc.command.*`        |
-| Node receives a transaction from a peer        | `tx.receive`           |
-| Node checks if a transaction is valid          | `tx.validate`          |
-| Node forwards a transaction to neighbors       | `tx.relay`             |
-| Nodes agree on which transactions to include   | `consensus.round`      |
-| Consensus progresses through phases            | `consensus.phase.*`    |
-| Node builds a new confirmed ledger             | `ledger.build`         |
-| Node fetches missing ledger data from peers    | `ledger.acquire`       |
-| Node computes payment routes                   | `pathfind.compute`     |
-| Node queues a transaction for later processing | `txq.enqueue`          |
-| Node increases fees due to high load           | `fee.escalate`         |
-| Node fetches the latest trusted validator list | `validator.list.fetch` |
-| Node votes on a protocol amendment             | `amendment.vote`       |
-| Node synchronizes state tree data              | `shamap.sync`          |
-
----
-
-## 1.2 Key Components for Instrumentation
-
-> **TxQ** = Transaction Queue | **UNL** = Unique Node List
-
-| Component          | Location                                   | Purpose                  | Trace Value                      |
-| ------------------ | ------------------------------------------ | ------------------------ | -------------------------------- |
-| **Overlay**        | `src/xrpld/overlay/`                       | P2P communication        | Message propagation timing       |
-| **PeerImp**        | `src/xrpld/overlay/detail/PeerImp.cpp`     | Individual peer handling | Per-peer latency                 |
-| **RCLConsensus**   | `src/xrpld/app/consensus/RCLConsensus.cpp` | Consensus algorithm      | Round timing, phase analysis     |
-| **NetworkOPs**     | `src/xrpld/app/misc/NetworkOPs.cpp`        | Transaction processing   | Tx lifecycle tracking            |
-| **ServerHandler**  | `src/xrpld/rpc/detail/ServerHandler.cpp`   | RPC entry point          | Request latency                  |
-| **RPCHandler**     | `src/xrpld/rpc/detail/RPCHandler.cpp`      | Command execution        | Per-command timing               |
-| **JobQueue**       | `src/xrpl/core/JobQueue.h`                 | Async task execution     | Queue wait times                 |
-| **PathFinding**    | `src/xrpld/app/paths/`                     | Payment path computation | Path latency, cache hits         |
-| **TxQ**            | `src/xrpld/app/misc/TxQ.cpp`               | Transaction queue/fees   | Queue depth, eviction rates      |
-| **LoadManager**    | `src/xrpld/app/main/LoadManager.cpp`       | Fee escalation/load      | Fee levels, load factors         |
-| **InboundLedgers** | `src/xrpld/app/ledger/InboundLedgers.cpp`  | Ledger acquisition       | Sync time, peer reliability      |
-| **ValidatorList**  | `src/xrpld/app/misc/ValidatorList.cpp`     | UNL management           | List freshness, fetch failures   |
-| **AmendmentTable** | `src/xrpld/app/misc/AmendmentTable.cpp`    | Protocol amendments      | Voting status, activation events |
-| **SHAMap**         | `src/xrpld/shamap/`                        | State hash tree          | Sync speed, missing nodes        |
-
----
-
-## 1.3 Transaction Flow Diagram
-
-Transaction flow spans multiple nodes in the network. Each node creates linked spans to form a distributed trace:
-
-```mermaid
-sequenceDiagram
-    participant Client
-    participant PeerA as Peer A (Receive)
-    participant PeerB as Peer B (Relay)
-    participant PeerC as Peer C (Validate)
-
-    Client->>PeerA: 1. Submit TX
-
-    rect rgb(230, 245, 255)
-        Note over PeerA: tx.receive SPAN START
-        PeerA->>PeerA: HashRouter Deduplication
-        PeerA->>PeerA: tx.validate (child span)
-    end
-
-    PeerA->>PeerB: 2. Relay TX (with trace ctx)
-
-    rect rgb(230, 245, 255)
-        Note over PeerB: tx.receive (linked span)
-    end
-
-    PeerB->>PeerC: 3. Relay TX
-
-    rect rgb(230, 245, 255)
-        Note over PeerC: tx.receive (linked span)
-        PeerC->>PeerC: tx.process
-    end
-
-    Note over Client,PeerC: DISTRIBUTED TRACE (same trace_id: abc123)
-```
-
-**Reading the diagram:**
-
-- **Client**: The external entity that submits a transaction to Peer A. It has no trace context -- the trace starts at the first node.
-- **Peer A (Receive)**: The entry node that creates the root span `tx.receive`, runs HashRouter deduplication to avoid processing duplicates, and creates a child `tx.validate` span.
-- **Peer A to Peer B arrow**: The relay message carries trace context (trace_id + parent span_id), enabling Peer B to create a linked span under the same trace.
-- **Peer B (Relay)**: Receives the transaction and trace context, creates a `tx.receive` span linked to Peer A's trace, then relays onward.
-- **Peer C (Validate)**: Final hop in this example. Creates a linked `tx.receive` span and runs `tx.process` to fully process the transaction.
-- **Blue rectangles**: Highlight the span boundaries on each node, showing where instrumentation creates and closes spans.
-
-### Trace Structure
-
-```
-trace_id: abc123
-├── span: tx.receive (Peer A)
-│   ├── span: tx.validate
-│   └── span: tx.relay
-├── span: tx.receive (Peer B) [parent: Peer A]
-│   └── span: tx.relay
-└── span: tx.receive (Peer C) [parent: Peer B]
-    └── span: tx.process
-```
-
----
-
-## 1.4 Consensus Round Flow
-
-Consensus rounds are multi-phase operations that benefit significantly from tracing:
-
-```mermaid
-flowchart TB
-    subgraph round["consensus.round (root span)"]
-        attrs["Attributes:<br/>ledger_seq = 12345678<br/>consensus_mode = proposing<br/>proposers = 35"]
-
-        subgraph open["consensus.phase.open"]
-            open_desc["Duration: ~3s<br/>Waiting for transactions"]
-        end
-
-        subgraph establish["consensus.phase.establish"]
-            est_attrs["proposals_received = 28<br/>disputes_resolved = 3"]
-            est_children["├── consensus.proposal.receive (×28)<br/>├── consensus.proposal.send (×1)<br/>└── consensus.dispute.resolve (×3)"]
-        end
-
-        subgraph accept["consensus.phase.accept"]
-            acc_attrs["transactions_applied = 150<br/>ledger_hash = DEF456..."]
-            acc_children["├── ledger.build<br/>└── ledger.validate"]
-        end
-
-        attrs --> open
-        open --> establish
-        establish --> accept
-    end
-
-    style round fill:#f57f17,stroke:#e65100,color:#ffffff
-    style open fill:#1565c0,stroke:#0d47a1,color:#ffffff
-    style establish fill:#2e7d32,stroke:#1b5e20,color:#ffffff
-    style accept fill:#c2185b,stroke:#880e4f,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **consensus.round (orange, root span)**: The top-level span encompassing the entire consensus round, with attributes like ledger sequence, mode, and proposer count.
-- **consensus.phase.open (blue)**: The first phase where the node waits (~3s) to collect incoming transactions before proposing.
-- **consensus.phase.establish (green)**: The negotiation phase where validators exchange proposals, resolve disputes, and converge on a transaction set. Child spans track each proposal received/sent and each dispute resolved.
-- **consensus.phase.accept (pink)**: The final phase where the agreed transaction set is applied, a new ledger is built, and the ledger is validated. Child spans cover `ledger.build` and `ledger.validate`.
-- **Arrows (open to establish to accept)**: The sequential flow through the three consensus phases. Each phase must complete before the next begins.
-
----
-
-## 1.5 RPC Request Flow
-
-> **WS** = WebSocket
-
-RPC requests support W3C Trace Context headers for distributed tracing across services:
-
-```mermaid
-flowchart TB
-    subgraph request["rpc.request (root span)"]
-        http["HTTP Request — POST /<br/>traceparent:<br/>00-abc123...-def456...-01"]
-
-        attrs["Attributes:<br/>http.method = POST<br/>net.peer.ip = 192.168.1.100<br/>command = submit"]
-
-        subgraph enqueue["jobqueue.enqueue"]
-            job_attr["job_type = jtCLIENT_RPC"]
-        end
-
-        subgraph command["rpc.command.submit"]
-            cmd_attrs["version = 2<br/>rpc_role = user"]
-            cmd_children["├── tx.deserialize<br/>├── tx.validate_local<br/>└── tx.submit_to_network"]
-        end
-
-        response["Response: 200 OK<br/>Duration: 45ms"]
-
-        http --> attrs
-        attrs --> enqueue
-        enqueue --> command
-        command --> response
-    end
-
-    style request fill:#2e7d32,stroke:#1b5e20,color:#ffffff
-    style enqueue fill:#1565c0,stroke:#0d47a1,color:#ffffff
-    style command fill:#e65100,stroke:#bf360c,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **rpc.request (green, root span)**: The outermost span representing the full RPC request lifecycle, from HTTP receipt to response. Carries the W3C `traceparent` header for distributed tracing.
-- **HTTP Request node**: Shows the incoming POST request with its `traceparent` header and extracted attributes (method, peer IP, command name).
-- **jobqueue.enqueue (blue)**: The span covering the asynchronous handoff from the RPC thread to the JobQueue worker thread. The trace context is preserved across this async boundary.
-- **rpc.command.submit (orange)**: The span for the actual command execution, with child spans for deserialization, local validation, and network submission.
-- **Response node**: The final output with HTTP status and total duration, marking the end of the root span.
-- **Arrows (top to bottom)**: The sequential processing pipeline -- receive request, extract attributes, enqueue job, execute command, return response.
-
----
-
-## 1.6 Key Trace Points
-
-> **TxQ** = Transaction Queue
-
-The following table identifies priority instrumentation points across the codebase:
-
-| Category        | Span Name              | File                   | Method                  | Priority |
-| --------------- | ---------------------- | ---------------------- | ----------------------- | -------- |
-| **Transaction** | `tx.receive`           | `PeerImp.cpp`          | `handleTransaction()`   | High     |
-| **Transaction** | `tx.validate`          | `NetworkOPs.cpp`       | `processTransaction()`  | High     |
-| **Transaction** | `tx.process`           | `NetworkOPs.cpp`       | `doTransactionSync()`   | High     |
-| **Transaction** | `tx.relay`             | `OverlayImpl.cpp`      | `relay()`               | Medium   |
-| **Consensus**   | `consensus.round`      | `RCLConsensus.cpp`     | `startRound()`          | High     |
-| **Consensus**   | `consensus.phase.*`    | `Consensus.h`          | `timerEntry()`          | High     |
-| **Consensus**   | `consensus.proposal.*` | `RCLConsensus.cpp`     | `peerProposal()`        | Medium   |
-| **RPC**         | `rpc.request`          | `ServerHandler.cpp`    | `onRequest()`           | High     |
-| **RPC**         | `rpc.command.*`        | `RPCHandler.cpp`       | `doCommand()`           | High     |
-| **Peer**        | `peer.connect`         | `OverlayImpl.cpp`      | `onHandoff()`           | Low      |
-| **Peer**        | `peer.message.*`       | `PeerImp.cpp`          | `onMessage()`           | Low      |
-| **Ledger**      | `ledger.acquire`       | `InboundLedgers.cpp`   | `acquire()`             | Medium   |
-| **Ledger**      | `ledger.build`         | `RCLConsensus.cpp`     | `buildLCL()`            | High     |
-| **PathFinding** | `pathfind.request`     | `PathRequest.cpp`      | `doUpdate()`            | High     |
-| **PathFinding** | `pathfind.compute`     | `Pathfinder.cpp`       | `findPaths()`           | High     |
-| **TxQ**         | `txq.enqueue`          | `TxQ.cpp`              | `apply()`               | High     |
-| **TxQ**         | `txq.apply`            | `TxQ.cpp`              | `processClosedLedger()` | High     |
-| **Fee**         | `fee.escalate`         | `LoadManager.cpp`      | `raiseLocalFee()`       | Medium   |
-| **Ledger**      | `ledger.replay`        | `LedgerReplayer.h`     | `replay()`              | Medium   |
-| **Ledger**      | `ledger.delta`         | `LedgerDeltaAcquire.h` | `processData()`         | Medium   |
-| **Validator**   | `validator.list.fetch` | `ValidatorList.cpp`    | `verify()`              | Medium   |
-| **Validator**   | `validator.manifest`   | `Manifest.cpp`         | `applyManifest()`       | Low      |
-| **Amendment**   | `amendment.vote`       | `AmendmentTable.cpp`   | `doVoting()`            | Low      |
-| **SHAMap**      | `shamap.sync`          | `SHAMap.cpp`           | `fetchRoot()`           | Medium   |
-
----
-
-## 1.7 Instrumentation Priority
-
-> **TxQ** = Transaction Queue
-
-```mermaid
-quadrantChart
-    title Instrumentation Priority Matrix
-    x-axis Low Complexity --> High Complexity
-    y-axis Low Value --> High Value
-    quadrant-1 Implement First
-    quadrant-2 Plan Carefully
-    quadrant-3 Quick Wins
-    quadrant-4 Consider Later
-
-    RPC Tracing: [0.2, 0.92]
-    Transaction Tracing: [0.55, 0.88]
-    Consensus Tracing: [0.78, 0.82]
-    PathFinding: [0.38, 0.75]
-    TxQ and Fees: [0.25, 0.65]
-    Ledger Sync: [0.62, 0.58]
-    Peer Message Tracing: [0.35, 0.25]
-    JobQueue Tracing: [0.2, 0.48]
-    Validator Mgmt: [0.48, 0.42]
-    Amendment Tracking: [0.15, 0.32]
-    SHAMap Operations: [0.72, 0.45]
-```
-
----
-
-## 1.8 Observable Outcomes
-
-> **TxQ** = Transaction Queue | **UNL** = Unique Node List
-
-After implementing OpenTelemetry, operators and developers will gain visibility into the following:
-
-### 1.8.1 What You Will See: Traces
-
-| Trace Type                 | Description                                                                                 | Example Query in Grafana/Tempo                  |
-| -------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------- |
-| **Transaction Lifecycle**  | Full journey from RPC submission through validation, relay, consensus, and ledger inclusion | `{service.name="xrpld" && tx_hash="ABC123..."}` |
-| **Cross-Node Propagation** | Transaction path across multiple xrpld nodes with timing                                    | `{relay_count > 0}`                             |
-| **Consensus Rounds**       | Complete round with all phases (open, establish, accept)                                    | `{span.name=~"consensus.round.*"}`              |
-| **RPC Request Processing** | Individual command execution with timing breakdown                                          | `{command="account_info"}`                      |
-| **Ledger Acquisition**     | Peer-to-peer ledger data requests and responses                                             | `{span.name="ledger.acquire"}`                  |
-| **PathFinding Latency**    | Path computation time and cache effectiveness for payment RPCs                              | `{span.name="pathfind.compute"}`                |
-| **TxQ Behavior**           | Queue depth, eviction patterns, fee escalation during congestion                            | `{span.name=~"txq.*"}`                          |
-| **Ledger Sync**            | Full acquisition timeline including delta and transaction fetches                           | `{span.name=~"ledger.acquire.*"}`               |
-| **Validator Health**       | UNL fetch success, manifest updates, stale list detection                                   | `{span.name=~"validator.*"}`                    |
-
-### 1.8.2 What You Will See: Metrics (Derived from Traces)
-
-| Metric                        | Description                             | Dashboard Panel             |
-| ----------------------------- | --------------------------------------- | --------------------------- |
-| **RPC Latency (p50/p95/p99)** | Response time distribution per command  | Heatmap by command          |
-| **Transaction Throughput**    | Transactions processed per second       | Time series graph           |
-| **Consensus Round Duration**  | Time to complete consensus phases       | Histogram                   |
-| **Cross-Node Latency**        | Time for transaction to reach N nodes   | Line chart with percentiles |
-| **Error Rate**                | Failed transactions/RPC calls by type   | Stacked bar chart           |
-| **PathFinding Latency**       | Path computation time per currency pair | Heatmap by currency         |
-| **TxQ Depth**                 | Queued transactions over time           | Time series with thresholds |
-| **Fee Escalation Level**      | Current fee multiplier                  | Gauge with alert thresholds |
-| **Ledger Sync Duration**      | Time to acquire missing ledgers         | Histogram                   |
-
-### 1.8.3 Concrete Dashboard Examples
-
-**Transaction Trace View (Tempo):**
-
-```
-┌────────────────────────────────────────────────────────────────────────────────┐
-│ Trace: abc123... (Transaction Submission)                    Duration: 847ms   │
-├────────────────────────────────────────────────────────────────────────────────┤
-│ ├── rpc.request [ServerHandler]                              ████░░░░░░  45ms  │
-│ │   └── rpc.command.submit [RPCHandler]                      ████░░░░░░  42ms  │
-│ │       └── tx.receive [NetworkOPs]                          ███░░░░░░░  35ms  │
-│ │           ├── tx.validate [TxQ]                            █░░░░░░░░░   8ms  │
-│ │           └── tx.relay [Overlay]                           ██░░░░░░░░  15ms  │
-│ │               ├── tx.receive [Node-B]                      █████░░░░░  52ms  │
-│ │               │   └── tx.relay [Node-B]                    ██░░░░░░░░  18ms  │
-│ │               └── tx.receive [Node-C]                      ██████░░░░  65ms  │
-│ └── consensus.round [RCLConsensus]                           ████████░░ 720ms  │
-│     ├── consensus.phase.open                                 ██░░░░░░░░ 180ms  │
-│     ├── consensus.phase.establish                            █████░░░░░ 480ms  │
-│     └── consensus.phase.accept                               █░░░░░░░░░  60ms  │
-└────────────────────────────────────────────────────────────────────────────────┘
-```
-
-**RPC Performance Dashboard Panel:**
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│ RPC Command Latency (Last 1 Hour)                           │
-├─────────────────────────────────────────────────────────────┤
-│ Command          │ p50    │ p95    │ p99    │ Errors │ Rate │
-│──────────────────┼────────┼────────┼────────┼────────┼──────│
-│ account_info     │  12ms  │  45ms  │  89ms  │  0.1%  │ 150/s│
-│ submit           │  35ms  │ 120ms  │ 250ms  │  2.3%  │  45/s│
-│ ledger           │   8ms  │  25ms  │  55ms  │  0.0%  │  80/s│
-│ tx               │  15ms  │  50ms  │ 100ms  │  0.5%  │  60/s│
-│ server_info      │   5ms  │  12ms  │  20ms  │  0.0%  │ 200/s│
-└─────────────────────────────────────────────────────────────┘
-```
-
-**Consensus Health Dashboard Panel:**
-
-```mermaid
----
-config:
-    xyChart:
-        width: 1200
-        height: 400
-        plotReservedSpacePercent: 50
-        chartOrientation: vertical
-    themeVariables:
-        xyChart:
-            plotColorPalette: "#3498db"
----
-xychart-beta
-    title "Consensus Round Duration (Last 24 Hours)"
-    x-axis "Time of Day (Hours)" [0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24]
-    y-axis "Duration (seconds)" 1 --> 5
-    line [2.1, 2.4, 2.8, 3.2, 3.8, 4.3, 4.5, 5.0, 4.7, 4.0, 3.2, 2.6, 2.0]
-```
-
-### 1.8.4 Operator Actionable Insights
-
-| Scenario                  | What You'll See                                                              | Action                                           |
-| ------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------ |
-| **Slow RPC**              | Span showing which phase is slow (parsing, execution, serialization)         | Optimize specific code path                      |
-| **Transaction Stuck**     | Trace stops at validation; error attribute shows reason                      | Fix transaction parameters                       |
-| **Consensus Delay**       | Phase.establish taking too long; proposer attribute shows missing validators | Investigate network connectivity                 |
-| **Memory Spike**          | Large batch of spans correlating with memory increase                        | Tune batch_size or sampling                      |
-| **Network Partition**     | Traces missing cross-node links for specific peer                            | Check peer connectivity                          |
-| **Path Computation Slow** | pathfind.compute span shows high latency; cache miss rate in attributes      | Warm the RippleLineCache, check order book depth |
-| **TxQ Full**              | txq.enqueue spans show evictions; fee.escalate spans increasing              | Monitor fee levels, alert operators              |
-| **Ledger Sync Stalled**   | ledger.acquire spans timing out; peer reliability attributes show issues     | Check peer connectivity, add trusted peers       |
-| **UNL Stale**             | validator.list.fetch spans failing; last_update attribute aging              | Verify validator site URLs, check DNS            |
-
-### 1.8.5 Developer Debugging Workflow
-
-1. **Find Transaction**: Query by `tx_hash` to get full trace
-2. **Identify Bottleneck**: Look at span durations to find slowest component
-3. **Check Attributes**: Review `validity`, `rpc_status` for errors
-4. **Correlate Logs**: Use `trace_id` to find related PerfLog entries
-5. **Compare Nodes**: Filter by `service.instance.id` to compare behavior across nodes
-
----
-
-_Next: [Design Decisions](./02-design-decisions.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/02-design-decisions.md

@@ -1,665 +0,0 @@
-# Design Decisions
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Architecture Analysis](./01-architecture-analysis.md)
-
----
-
-## 2.1 OpenTelemetry Components
-
-> **OTLP** = OpenTelemetry Protocol
-
-### 2.1.1 SDK Selection
-
-**Primary Choice**: OpenTelemetry C++ SDK (`opentelemetry-cpp`)
-
-| Component                               | Purpose                | Required                  |
-| --------------------------------------- | ---------------------- | ------------------------- |
-| `opentelemetry-cpp::api`                | Tracing API headers    | Yes                       |
-| `opentelemetry-cpp::sdk`                | SDK implementation     | Yes                       |
-| `opentelemetry-cpp::ext`                | Extensions (exporters) | Yes                       |
-| `opentelemetry-cpp::otlp_http_exporter` | OTLP/HTTP export       | Yes (shipped in Phase 1b) |
-| `opentelemetry-cpp::otlp_grpc_exporter` | OTLP/gRPC export       | Future (not yet wired up) |
-
-### 2.1.2 Instrumentation Strategy
-
-**Manual Instrumentation** (recommended):
-
-| Approach   | Pros                                                            | Cons                                                    |
-| ---------- | --------------------------------------------------------------- | ------------------------------------------------------- |
-| **Manual** | Precise control, optimized placement, xrpld-specific attributes | More development effort                                 |
-| **Auto**   | Less code, automatic coverage                                   | Less control, potential overhead, limited customization |
-
----
-
-## 2.2 Exporter Configuration
-
-> **OTLP** = OpenTelemetry Protocol
-
-```mermaid
-flowchart TB
-    subgraph nodes["xrpld Nodes"]
-        node1["xrpld<br/>Node 1"]
-        node2["xrpld<br/>Node 2"]
-        node3["xrpld<br/>Node 3"]
-    end
-
-    collector["OpenTelemetry<br/>Collector<br/>(sidecar or standalone)"]
-
-    subgraph backends["Observability Backends"]
-        tempo["Tempo"]
-        elastic["Elastic<br/>APM"]
-    end
-
-    node1 -->|"OTLP/HTTP<br/>:4318"| collector
-    node2 -->|"OTLP/HTTP<br/>:4318"| collector
-    node3 -->|"OTLP/HTTP<br/>:4318"| collector
-
-    collector --> tempo
-    collector --> elastic
-
-    style nodes fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style backends fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style collector fill:#bf360c,stroke:#8c2809,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **xrpld Nodes (blue)**: The source of telemetry data. Each xrpld node exports spans via OTLP/HTTP on port 4318 (the only exporter shipped in Phase 1b).
-- **OpenTelemetry Collector (red)**: The central aggregation point that receives spans from all nodes. Can run as a sidecar (per-node) or standalone (shared). Handles batching, filtering, and routing.
-- **Observability Backends (green)**: The storage and visualization destinations. Tempo is the recommended backend for both development and production, and Elastic APM is an alternative. The Collector routes to one or more backends.
-- **Arrows (nodes to collector to backends)**: The data pipeline -- spans flow from nodes to the Collector over HTTP, then the Collector fans out to the configured backends.
-
-### 2.2.1 OTLP/HTTP (Shipped in Phase 1b)
-
-OTLP/HTTP is the only exporter wired up in Phase 1b. It is configured via
-`OtlpHttpExporterOptions` with the collector traces endpoint
-(`http://localhost:4318/v1/traces` by default) and a JSON content type
-(binary protobuf is also available).
-
-### 2.2.2 OTLP/gRPC (Future Work — Planned Upgrade)
-
-OTLP/gRPC is planned as a future upgrade from the HTTP exporter. The gRPC
-transport offers lower per-span overhead and tighter back-pressure semantics
-than HTTP/JSON, making it attractive for production deployments once the HTTP
-path is validated in earlier phases.
-
-Required to land this upgrade:
-
-1. Add `opentelemetry-cpp::otlp_grpc_exporter` to the Conan recipe (the
-   dependency already exists but is not linked in Phase 1b builds).
-2. Extend `TelemetryConfig.cpp` to parse an `exporter` key (`otlp_http`
-   default, `otlp_grpc` opt-in) and a gRPC endpoint override.
-3. In `Telemetry::start()` branch on the parsed exporter type and construct
-   either `OtlpHttpExporterFactory::Create(httpOpts)` or
-   `OtlpGrpcExporterFactory::Create(grpcOpts)` accordingly.
-4. Update the runbook and dashboards to document the alternate port and TLS
-   settings.
-
-When wired up, the gRPC path will use `OtlpGrpcExporterOptions` configured with
-the collector endpoint (host on port 4317), TLS credentials enabled, and a CA
-certificate path.
-
-Until that work lands, `OtlpGrpcExporterOptions` is **not** used by any code
-path in Phase 1b through Phase 5.
-
----
-
-## 2.3 Span Naming Conventions
-
-> **TxQ** = Transaction Queue | **UNL** = Unique Node List | **WS** = WebSocket
-
-### 2.3.1 Naming Schema
-
-```
-<component>.<operation>[.<sub-operation>]
-```
-
-**Examples**:
-
-- `tx.receive` - Transaction received from peer
-- `consensus.phase.establish` - Consensus establish phase
-- `rpc.command.server_info` - server_info RPC command
-
-### 2.3.2 Complete Span Catalog
-
-| Span name                      | Description                             |
-| ------------------------------ | --------------------------------------- |
-| `tx.receive`                   | Transaction received from network       |
-| `tx.validate`                  | Transaction signature/format validation |
-| `tx.process`                   | Full transaction processing             |
-| `tx.relay`                     | Transaction relay to peers              |
-| `tx.apply`                     | Apply transaction to ledger             |
-| `consensus.round`              | Complete consensus round                |
-| `consensus.phase.open`         | Open phase - collecting transactions    |
-| `consensus.phase.establish`    | Establish phase - reaching agreement    |
-| `consensus.phase.accept`       | Accept phase - applying consensus       |
-| `consensus.proposal.receive`   | Receive peer proposal                   |
-| `consensus.proposal.send`      | Send our proposal                       |
-| `consensus.validation.receive` | Receive peer validation                 |
-| `consensus.validation.send`    | Send our validation                     |
-| `rpc.request`                  | HTTP/WebSocket request handling         |
-| `rpc.command.*`                | Specific RPC command (dynamic)          |
-| `peer.connect`                 | Peer connection establishment           |
-| `peer.disconnect`              | Peer disconnection                      |
-| `peer.message.send`            | Send protocol message                   |
-| `peer.message.receive`         | Receive protocol message                |
-| `ledger.acquire`               | Ledger acquisition from network         |
-| `ledger.build`                 | Build new ledger                        |
-| `ledger.validate`              | Ledger validation                       |
-| `ledger.close`                 | Close ledger                            |
-| `ledger.replay`                | Ledger replay executed                  |
-| `ledger.delta`                 | Delta-based ledger acquired             |
-| `pathfind.request`             | Path request initiated                  |
-| `pathfind.compute`             | Path computation executed               |
-| `txq.enqueue`                  | Transaction queued                      |
-| `txq.apply`                    | Queued transaction applied              |
-| `fee.escalate`                 | Fee escalation triggered                |
-| `validator.list.fetch`         | UNL list fetched                        |
-| `validator.manifest`           | Manifest update processed               |
-| `amendment.vote`               | Amendment voting executed               |
-| `shamap.sync`                  | State tree synchronization              |
-| `job.enqueue`                  | Job added to queue                      |
-| `job.execute`                  | Job execution                           |
-
-### 2.3.3 Attribute Naming Conventions
-
-Span **names** follow §2.3.1 (dotted `<component>.<operation>`). Span
-**attribute keys** follow the rules below. The constants in the `*SpanNames.h`
-headers are the single source of truth; the collector, Tempo, the Grafana
-dashboards, and the runbook all consume these exact keys, so every layer must
-agree with the code. A CI check enforces this end to end.
-
-1. **Per-span unique attribute** → bare field name, allowed when the field is
-   recorded by a single span/workflow so the span name already supplies the
-   domain (e.g. `command`, `version`, `local` on `rpc.command`).
-2. **Shared attribute (same concept on more than one span)** → ONE key, reused
-   verbatim on every span that records it; the span name tells the occurrences
-   apart, so no per-emitter prefix is added. Name it by the field's meaning: a
-   property of a domain object keeps that object's bare field name (`ledger_hash`,
-   `ledger_seq`, `tx_hash`, `peer_id`, `full_validation`); a field already
-   qualified by a sub-kind keeps that qualifier on every emitter (`proposal_trusted`
-   on both `consensus.proposal.receive` and `peer.proposal.receive`;
-   `validation_trusted` likewise). Defined once in the base `SpanNames.h`
-   `namespace attr` block and re-exported (`using`) by each domain header.
-3. **Collision qualifier** → `<domain>_<field>`, only when a bare name would
-   collide with a DIFFERENT concept in the shared spanmetrics label space or with
-   the OTel-reserved `status` key (e.g. `rpc_status`, `grpc_status`,
-   `consensus_phase`, `consensus_round`, `consensus_mode`). This disambiguates
-   distinct concepts that share a word; it is NOT used to tag the same concept
-   with its emitting workflow — that is rule 2 (one shared name).
-4. **Resource attribute** → dotted `xrpl.<subsystem>.<field>`, reserved ONLY
-   for process/network identity set once at startup (`xrpl.network.id`,
-   `xrpl.network.type`). Span attributes are never dotted in the `xrpl.` form —
-   it blurs the resource/span scope boundary and parses awkwardly in TraceQL.
-5. **Span names** use `<subsystem>[.<component>]` (dotted, per §2.3.1). Only
-   attribute _keys_ follow rules 1–4.
-
-Standard OpenTelemetry semantic-convention keys keep their canonical dotted
-form (e.g. `service.*` resource attributes, `http.*` span attributes); the
-"no dotted form" rule applies to xrpl-custom keys only.
-
-The same rules are recorded in `CONTRIBUTING.md` (the permanent home, since
-`OpenTelemetryPlan/` is removed once the rollout completes). The attribute
-examples in §2.4 below follow these rules.
-
----
-
-## 2.4 Attribute Schema
-
-> **TxQ** = Transaction Queue | **UNL** = Unique Node List | **OTLP** = OpenTelemetry Protocol
-
-### 2.4.1 Resource Attributes (Set Once at Startup)
-
-Resource attributes identify the process and are set once at startup. They use
-the standard OpenTelemetry semantic conventions plus custom dotted `xrpl.*`
-keys (the dotted form is reserved for resource scope per §2.3.3).
-
-| Key                   | Type / value                                            | Description                    |
-| --------------------- | ------------------------------------------------------- | ------------------------------ |
-| `service.name`        | `"xrpld"`                                               | Standard `SERVICE_NAME`        |
-| `service.version`     | `BuildInfo::getVersionString()`                         | Standard `SERVICE_VERSION`     |
-| `service.instance.id` | node public key (base58)                                | Standard `SERVICE_INSTANCE_ID` |
-| `xrpl.network.id`     | network id (e.g. 0 for mainnet)                         | Network identifier             |
-| `xrpl.network.type`   | `"mainnet"` \| `"testnet"` \| `"devnet"` \| `"unknown"` | Network kind                   |
-| `xrpl.node.type`      | `"validator"` \| `"stock"` \| `"reporting"`             | Node role                      |
-| `xrpl.node.cluster`   | cluster name                                            | Cluster name, if clustered     |
-
-### 2.4.2 Span Attributes by Category
-
-> Span attribute keys use the underscore form from §2.3.3 (shared/qualified
-> keys are `<domain>_<field>`; per-span unique keys are bare). The dotted form
-> is reserved for the resource attributes in §2.4.1 above. This catalog lists
-> the planned attribute set by category; the exact emitted key for each
-> implemented span is defined by the `*SpanNames.h` constants, which are the
-> single source of truth where the two differ.
-
-#### Transaction Attributes
-
-| Key            | Type   | Description                           |
-| -------------- | ------ | ------------------------------------- |
-| `tx_hash`      | string | Transaction hash (hex)                |
-| `tx_type`      | string | `"Payment"`, `"OfferCreate"`, etc.    |
-| `tx_account`   | string | Source account (redacted in prod)     |
-| `tx_sequence`  | int64  | Account sequence number               |
-| `tx_fee`       | int64  | Fee in drops                          |
-| `tx_result`    | string | `"tesSUCCESS"`, `"tecPATH_DRY"`, etc. |
-| `ledger_index` | int64  | Ledger containing transaction         |
-| `relay_count`  | int64  | Peers the transaction was relayed to  |
-| `suppressed`   | bool   | `true` when HashRouter dropped a dup  |
-
-#### Consensus Attributes
-
-| Key                  | Type    | Description                         |
-| -------------------- | ------- | ----------------------------------- |
-| `consensus_round`    | int64   | Round number                        |
-| `consensus_phase`    | string  | `"open"`, `"establish"`, `"accept"` |
-| `consensus_mode`     | string  | `"proposing"`, `"observing"`, etc.  |
-| `proposers`          | int64   | Number of proposers                 |
-| `prev_ledger_prefix` | string  | Previous ledger hash prefix         |
-| `ledger_seq`         | int64   | Ledger sequence                     |
-| `tx_count`           | int64   | Transactions in consensus set       |
-| `round_time_ms`      | float64 | Round duration                      |
-
-#### RPC Attributes
-
-| Key           | Type    | Description                                                                   |
-| ------------- | ------- | ----------------------------------------------------------------------------- |
-| `command`     | string  | Command name (per-span unique on `rpc.command`)                               |
-| `version`     | int64   | API version                                                                   |
-| `rpc_role`    | string  | `"admin"` or `"user"` (qualified — `role` is generic)                         |
-| `params`      | string  | Sanitized parameters (optional)                                               |
-| `rpc_status`  | string  | Response status: `success` \| `error` (qualified — `status` is OTel-reserved) |
-| `duration_ms` | float64 | Request duration in milliseconds                                              |
-
-#### Peer & Message Attributes
-
-| Key                  | Type    | Description                |
-| -------------------- | ------- | -------------------------- |
-| `peer_id`            | string  | Peer public key (base58)   |
-| `peer_address`       | string  | IP:port                    |
-| `peer_latency_ms`    | float64 | Measured latency           |
-| `peer_cluster`       | string  | Cluster name if clustered  |
-| `message_type`       | string  | Protocol message type name |
-| `message_size_bytes` | int64   | Message size               |
-| `message_compressed` | bool    | Whether compressed         |
-
-#### Ledger & Job Attributes
-
-| Key               | Type    | Description           |
-| ----------------- | ------- | --------------------- |
-| `ledger_hash`     | string  | Ledger hash           |
-| `ledger_index`    | int64   | Ledger sequence/index |
-| `close_time`      | int64   | Close time (epoch)    |
-| `ledger_tx_count` | int64   | Transaction count     |
-| `job_type`        | string  | Job type name         |
-| `job_queue_ms`    | float64 | Time spent in queue   |
-| `job_worker`      | int64   | Worker thread ID      |
-
-#### PathFinding Attributes
-
-| Key                        | Type   | Description               |
-| -------------------------- | ------ | ------------------------- |
-| `pathfind_source_currency` | string | Source currency code      |
-| `pathfind_dest_currency`   | string | Destination currency code |
-| `pathfind_path_count`      | int64  | Number of paths found     |
-| `pathfind_cache_hit`       | bool   | RippleLineCache hit       |
-
-#### TxQ Attributes
-
-| Key                   | Type   | Description                 |
-| --------------------- | ------ | --------------------------- |
-| `txq_queue_depth`     | int64  | Current queue depth         |
-| `txq_fee_level`       | int64  | Fee level of transaction    |
-| `txq_eviction_reason` | string | Why transaction was evicted |
-
-#### Fee Attributes
-
-| Key                    | Type  | Description               |
-| ---------------------- | ----- | ------------------------- |
-| `fee_load_factor`      | int64 | Current load factor       |
-| `fee_escalation_level` | int64 | Fee escalation multiplier |
-
-#### Validator Attributes
-
-| Key                      | Type  | Description               |
-| ------------------------ | ----- | ------------------------- |
-| `validator_list_size`    | int64 | UNL size                  |
-| `validator_list_age_sec` | int64 | Seconds since last update |
-
-#### Amendment Attributes
-
-| Key                | Type   | Description                            |
-| ------------------ | ------ | -------------------------------------- |
-| `amendment_name`   | string | Amendment name                         |
-| `amendment_status` | string | `"enabled"`, `"vetoed"`, `"supported"` |
-
-#### SHAMap Attributes
-
-| Key                    | Type    | Description                                   |
-| ---------------------- | ------- | --------------------------------------------- |
-| `shamap_type`          | string  | `"transaction"`, `"state"`, `"account_state"` |
-| `shamap_missing_nodes` | int64   | Number of missing nodes during sync           |
-| `shamap_duration_ms`   | float64 | Sync duration                                 |
-
-### 2.4.3 Data Collection Summary
-
-The following table summarizes what data is collected by category:
-
-| Category        | Attributes Collected                                                                                             | Purpose                      |
-| --------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------- |
-| **Transaction** | `tx_hash`, `tx_type`, `tx_result`, `tx_fee`, `ledger_index`                                                      | Trace transaction lifecycle  |
-| **Consensus**   | `consensus_round`, `consensus_phase`, `consensus_mode`, `proposers`, `round_time_ms`                             | Analyze consensus timing     |
-| **RPC**         | `command`, `version`, `rpc_status`, `duration_ms`                                                                | Monitor RPC performance      |
-| **Peer**        | `peer_id` (public key), `peer_latency_ms`, `message_type`, `message_size_bytes`                                  | Network topology analysis    |
-| **Ledger**      | `ledger_hash`, `ledger_index`, `close_time`, `ledger_tx_count`                                                   | Ledger progression tracking  |
-| **Job**         | `job_type`, `job_queue_ms`, `job_worker`                                                                         | JobQueue performance         |
-| **PathFinding** | `pathfind_fast`, `pathfind_search_level`, `pathfind_num_paths`, `pathfind_ledger_index`, `pathfind_num_requests` | Payment path analysis        |
-| **TxQ**         | `txq_queue_depth`, `txq_fee_level`, `txq_eviction_reason`                                                        | Queue depth and fee tracking |
-| **Fee**         | `fee_load_factor`, `fee_escalation_level`                                                                        | Fee escalation monitoring    |
-| **Validator**   | `validator_list_size`, `validator_list_age_sec`                                                                  | UNL health monitoring        |
-| **Amendment**   | `amendment_name`, `amendment_status`                                                                             | Protocol upgrade tracking    |
-| **SHAMap**      | `shamap_type`, `shamap_missing_nodes`, `shamap_duration_ms`                                                      | State tree sync performance  |
-
-### 2.4.4 Privacy & Sensitive Data Policy
-
-> **PII** = Personally Identifiable Information
-
-OpenTelemetry instrumentation is designed to collect **operational metadata only**, never sensitive content.
-
-#### Data NOT Collected
-
-The following data is explicitly **excluded** from telemetry collection:
-
-| Excluded Data           | Reason                                    |
-| ----------------------- | ----------------------------------------- |
-| **Private Keys**        | Never exposed; not relevant to tracing    |
-| **Account Balances**    | Financial data; privacy sensitive         |
-| **Transaction Amounts** | Financial data; privacy sensitive         |
-| **Raw TX Payloads**     | May contain sensitive memo/data fields    |
-| **Personal Data**       | No PII collected                          |
-| **IP Addresses**        | Configurable; excluded by default in prod |
-
-#### Privacy Protection Mechanisms
-
-| Mechanism                     | Description                                                                                                                                                                                            |
-| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Account Hashing**           | Account addresses are hashed both SDK-side (`pathfind_source_account`, `pathfind_dest_account` — always hashed before emission) and again at the collector level, so raw addresses never reach storage |
-| **Configurable Redaction**    | Sensitive fields can be excluded via `[telemetry]` config section                                                                                                                                      |
-| **Collector Tail Sampling**   | xrpld head sampling is fixed at 1.0 (every span emitted); the collector retains ~10% of non-error traces, reducing stored data exposure                                                                |
-| **Sampling**                  | Only 10% of traces recorded by default, reducing data exposure                                                                                                                                         |
-| **Local Control**             | Node operators have full control over what gets exported                                                                                                                                               |
-| **No Raw Payloads**           | Transaction content is never recorded, only metadata (hash, type, result)                                                                                                                              |
-| **Collector-Level Filtering** | Additional redaction/hashing can be configured at OTel Collector                                                                                                                                       |
-
-#### Account Address Hashing
-
-Account addresses are **always** hashed before they reach the telemetry
-backend — there is no opt-out flag and therefore no insecure-by-default
-failure mode. Protection is applied in two independent layers:
-
-1. **SDK-side** (this node): the path-finding RPC handlers call
-   `redactAccount()` (`xrpl::telemetry`, `Redaction.h`) before setting the
-   `pathfind_source_account` / `pathfind_dest_account` span attributes. The
-   helper emits the first 16 characters of `sha512Half(address)` as
-   lowercase hex — deterministic (spans for one account still correlate)
-   but non-reversible.
-2. **Collector-side** (defense-in-depth): an `attributes/hash` processor in
-   the OpenTelemetry Collector re-hashes those same attributes, so any node
-   that emitted a raw value is still redacted before storage.
-
-#### Collector-Level Data Protection
-
-The OpenTelemetry Collector can be configured (via an `attributes` processor)
-to hash or redact sensitive attributes before export — for example, hashing
-`pathfind_source_account` / `pathfind_dest_account`, deleting `peer_address`
-to drop IP addresses, and deleting `params` to redact request parameters.
-
-#### Configuration Options for Privacy
-
-In `xrpld.cfg`, operators control data collection granularity through the
-`[telemetry]` section. Besides `enabled`, per-component toggles
-(`trace_transactions`, `trace_consensus`, `trace_rpc`, `trace_peer` — the last
-often disabled due to high volume) select which spans are emitted. Account
-address hashing is not configurable: addresses are hashed unconditionally by
-the SDK helper described above, with collector-level hashing as a second
-layer.
-
-> **Key Principle**: Telemetry collects **operational metadata** (timing, counts, hashes) — never **sensitive content** (keys, balances, amounts, raw payloads).
-
-> **See also**: [Securing the OTel Pipeline](./secure-OTel.md) covers transport-level protection for telemetry leaving the node — mTLS to the collector and validation of incoming peer trace context. Privacy controls in this section keep sensitive data out of spans; the security doc keeps the spans themselves out of untrusted hands.
-
----
-
-## 2.5 Context Propagation Design
-
-> **WS** = WebSocket
-
-### 2.5.0 Deterministic Trace ID Strategy
-
-Both transaction and consensus tracing use **deterministic trace IDs** derived from
-a globally known hash, so all nodes handling the same workflow independently produce
-spans under the same `trace_id`. This is combined with protobuf `span_id` propagation
-for parent-child relay ordering when available.
-
-#### Transactions — `trace_id = txHash[0:16]`
-
-Every node that handles a transaction knows its `txID` (the `uint256` transaction
-hash). The first 16 bytes of this hash are used as the OTel `trace_id`:
-
-```
-uint256 txHash:  A1B2C3D4 E5F6A7B8 C9D0E1F2 A3B4C5D6  E7F8A9B0 C1D2E3F4 A5B6C7D8 E9F0A1B2
-                 |---------- trace_id (16 bytes) ---------|  (remaining 16 bytes unused)
-```
-
-Each node generates a **random 8-byte `span_id`** so its span is unique within the
-shared trace. When protobuf `TraceContext` is present in the incoming `TMTransaction`,
-the sender's `span_id` is extracted and used as the parent — preserving the relay
-chain as a parent-child tree. When absent (older peers, first hop from client), the
-span appears as a root in the same trace — correlation is preserved, only the tree
-structure degrades.
-
-```
-Node A (submitter)        Node B (relay)          Node C (relay)
-trace_id: A1B2...         trace_id: A1B2...       trace_id: A1B2...
-span_id:  1234 (random)   span_id:  5678 (random) span_id:  9ABC (random)
-parent:   (none)          parent:   1234 (proto)   parent:   5678 (proto)
-                               ↑                        ↑
-                       protobuf propagation      protobuf propagation
-```
-
-If protobuf propagation fails at Node B (old peer):
-
-```
-Node A                    Node B (old peer)       Node C
-trace_id: A1B2...         trace_id: A1B2...       trace_id: A1B2...
-span_id:  1234            span_id:  5678          span_id:  9ABC
-parent:   (none)          parent:   (none)        parent:   5678 (proto)
-                          ↑ no parent, but same trace_id — still grouped
-```
-
-#### Consensus — `trace_id = prevLedgerHash[0:16]`
-
-All validators in the same consensus round share the same `previousLedger.id()`.
-The first 16 bytes are used as trace_id. See [Phase 4a implementation status](./06-implementation-phases.md)
-and `createDeterministicContext()` in `RCLConsensus.cpp` for the implementation.
-
-Switchable via `consensus_trace_strategy` config:
-`"deterministic"` (default) or `"attribute"` (random trace_id, correlation via attribute queries).
-
-#### Why Not Random IDs with Propagation Only?
-
-Random trace IDs require **unbroken context propagation** across every hop. In a
-mixed-version network (common during upgrades), older peers silently drop the
-`trace_context` protobuf field. The trace splits and downstream spans become
-impossible to find. Deterministic IDs make correlation **propagation-resilient** — the trace
-backend groups all spans for the same transaction/round regardless of whether
-propagation succeeded.
-
-#### Why Keep Protobuf Propagation?
-
-Deterministic trace IDs alone provide correlation (all spans grouped) but not
-**causality** (which node relayed to which). Protobuf `span_id` propagation adds
-parent-child ordering that shows the exact relay path. The two mechanisms complement
-each other:
-
-| Mechanism                    | Provides                    | Fails when                             |
-| ---------------------------- | --------------------------- | -------------------------------------- |
-| Deterministic trace_id       | Cross-node correlation      | Never (hash is always known)           |
-| Protobuf span_id propagation | Parent-child relay ordering | Older peer drops `trace_context` field |
-
-#### Implementation Reference
-
-The utility function `createDeterministicTxContext(uint256 const& txHash)` follows
-the same pattern as `createDeterministicContext(uint256 const& ledgerId)` in
-`RCLConsensus.cpp`. See [Phase 3 Task 3.9](./Phase3_taskList.md) for the full spec.
-
-### 2.5.1 Propagation Boundaries
-
-```mermaid
-flowchart TB
-    subgraph http["HTTP/WebSocket (RPC)"]
-        w3c["W3C Trace Context Headers:<br/>traceparent:<br/>00-trace_id-span_id-flags<br/>tracestate: xrpld=..."]
-    end
-
-    subgraph protobuf["Protocol Buffers (P2P)"]
-        proto["message TraceContext {<br/>  bytes trace_id = 1;  // 16 bytes<br/>  bytes span_id = 2;   // 8 bytes<br/>  uint32 trace_flags = 3;<br/>  string trace_state = 4;<br/>}"]
-    end
-
-    subgraph jobqueue["JobQueue (Internal Async)"]
-        job["Context captured at job creation,<br/>restored at execution<br/><br/>class Job {<br/>  otel::context::Context<br/>    traceContext_;<br/>};"]
-    end
-
-    style http fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style protobuf fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style jobqueue fill:#bf360c,stroke:#8c2809,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **HTTP/WebSocket - RPC (blue)**: For client-facing RPC requests, trace context is propagated using the W3C `traceparent` header. This is the standard approach and works with any OTel-compatible client.
-- **Protocol Buffers - P2P (green)**: For peer-to-peer messages between xrpld nodes, trace context is embedded as a protobuf `TraceContext` message carrying trace_id, span_id, flags, and optional trace_state.
-- **JobQueue - Internal Async (red)**: For asynchronous work within a single node, the OTel context is captured when a job is created and restored when the job executes on a worker thread. This bridges the async gap so spans remain linked.
-
----
-
-## 2.6 Integration with Existing Observability
-
-> **OTLP** = OpenTelemetry Protocol | **WS** = WebSocket
-
-### 2.6.1 Existing Frameworks Comparison
-
-xrpld already has two observability mechanisms. OpenTelemetry complements (not replaces) them:
-
-| Aspect                | PerfLog                       | Beast Insight (StatsD)       | OpenTelemetry             |
-| --------------------- | ----------------------------- | ---------------------------- | ------------------------- |
-| **Type**              | Logging                       | Metrics                      | Distributed Tracing       |
-| **Data**              | JSON log entries              | Counters, gauges, histograms | Spans with context        |
-| **Scope**             | Single node                   | Single node                  | **Cross-node**            |
-| **Output**            | `perf.log` file               | StatsD server                | OTLP Collector            |
-| **Question answered** | "What happened on this node?" | "How many? How fast?"        | "What was the journey?"   |
-| **Correlation**       | By timestamp                  | By metric name               | By `trace_id`             |
-| **Overhead**          | Low (file I/O)                | Low (UDP packets)            | Low-Medium (configurable) |
-
-### 2.6.2 What Each Framework Does Best
-
-#### PerfLog
-
-- **Purpose**: Detailed local event logging for RPC and job execution
-- **Strengths**:
-  - Rich JSON output with timing data
-  - Already integrated in RPC handlers
-  - File-based, no external dependencies
-- **Limitations**:
-  - Single-node only (no cross-node correlation)
-  - No parent-child relationships between events
-  - Manual log parsing required
-
-A PerfLog entry is a JSON object with fields such as `time`, `method`,
-`duration_us`, and `result`.
-
-#### Beast Insight (StatsD)
-
-- **Purpose**: Real-time metrics for monitoring dashboards
-- **Strengths**:
-  - Aggregated metrics (counters, gauges, histograms)
-  - Low overhead (UDP, fire-and-forget)
-  - Good for alerting thresholds
-- **Limitations**:
-  - No request-level detail
-  - No causal relationships
-  - Single-node perspective
-
-In xrpld, Beast Insight is used through `increment` (counters), `gauge`
-(point-in-time values), and `timing` (durations) calls.
-
-#### OpenTelemetry (NEW)
-
-- **Purpose**: Distributed request tracing across nodes
-- **Strengths**:
-  - **Cross-node correlation** via `trace_id`
-  - Parent-child span relationships
-  - Rich attributes per span
-  - Industry standard (CNCF)
-- **Limitations**:
-  - Requires collector infrastructure
-  - Higher complexity than logging
-
-A span is created via `startSpan` (e.g. `"tx.relay"`), annotated with
-attributes such as `tx_hash` and `peer_id`, and is automatically linked to its
-parent through the active context.
-
-### 2.6.3 When to Use Each
-
-| Scenario                                | PerfLog    | StatsD | OpenTelemetry |
-| --------------------------------------- | ---------- | ------ | ------------- |
-| "How many TXs per second?"              | ❌         | ✅     | ✅            |
-| "What's the p99 RPC latency?"           | ❌         | ✅     | ✅            |
-| "Why was this specific TX slow?"        | ⚠️ partial | ❌     | ✅            |
-| "Which node delayed consensus?"         | ❌         | ❌     | ✅            |
-| "What happened on node X at time T?"    | ✅         | ❌     | ✅            |
-| "Show me the TX journey across 5 nodes" | ❌         | ❌     | ✅            |
-
-### 2.6.4 Coexistence Strategy
-
-```mermaid
-flowchart TB
-    subgraph xrpld["xrpld Process"]
-        perflog["PerfLog<br/>(JSON to file)"]
-        insight["Beast Insight<br/>(StatsD)"]
-        otel["OpenTelemetry<br/>(Tracing)"]
-    end
-
-    perflog --> perffile["perf.log"]
-    insight --> statsd["StatsD Server"]
-    otel --> collector["OTLP Collector"]
-
-    perffile --> grafana["Grafana<br/>(Unified UI)"]
-    statsd --> grafana
-    collector --> grafana
-
-    style xrpld fill:#212121,stroke:#0a0a0a,color:#ffffff
-    style grafana fill:#bf360c,stroke:#8c2809,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **xrpld Process (dark gray)**: The single xrpld node running all three observability frameworks side by side. Each framework operates independently with no interference.
-- **PerfLog to perf.log**: PerfLog writes JSON-formatted event logs to a local file. Grafana can ingest these via Loki or a file-based datasource.
-- **Beast Insight to StatsD Server**: Insight sends aggregated metrics (counters, gauges) over UDP to a StatsD server. Grafana reads from StatsD-compatible backends like Graphite or Prometheus (via StatsD exporter).
-- **OpenTelemetry to OTLP Collector**: OTel exports spans over OTLP/HTTP to a Collector, which then forwards to a trace backend (Tempo). (OTLP/gRPC is future work — §2.2.2.)
-- **Grafana (red, unified UI)**: All three data streams converge in Grafana, enabling operators to correlate logs, metrics, and traces in a single dashboard.
-
-### 2.6.5 Correlation with PerfLog
-
-Trace IDs can be correlated with existing PerfLog entries for comprehensive
-debugging. The design is for `RPCHandler.cpp` to start an `rpc.command.<method>`
-span alongside the existing PerfLog `rpcStart`/`rpcFinish`/`rpcError` calls,
-extract the span's `trace_id` (when valid), and eventually stamp it onto the
-PerfLog entry (a planned `setTraceId` hook) so logs and traces share a key. The
-span status is set to OK on success or to error (recording the exception) on
-failure.
-
----
-
-_Previous: [Architecture Analysis](./01-architecture-analysis.md)_ | _Next: [Implementation Strategy](./03-implementation-strategy.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/03-implementation-strategy.md

@@ -1,483 +0,0 @@
-# Implementation Strategy
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Configuration Reference](./05-configuration-reference.md)
-
----
-
-## 3.1 Directory Structure
-
-The telemetry implementation follows xrpld's existing code organization pattern:
-
-```
-include/xrpl/
-├── telemetry/
-│   ├── Telemetry.h              # Main telemetry interface (global singleton)
-│   ├── TelemetryConfig.h        # Configuration structures
-│   ├── TraceContext.h           # Context propagation utilities
-│   ├── SpanGuard.h              # RAII span management with factory methods + discard()
-│   ├── DiscardFlag.h            # Thread-local discard flag
-│   └── SpanAttributes.h         # Attribute helper functions
-
-src/libxrpl/
-├── telemetry/
-│   ├── Telemetry.cpp            # Implementation + FilteringSpanProcessor
-│   ├── TelemetryConfig.cpp      # Config parsing
-│   ├── TraceContext.cpp         # Context serialization
-│   └── NullTelemetry.cpp        # No-op implementation
-```
-
----
-
-## 3.2 Implementation Approach
-
-<div align="center">
-
-```mermaid
-%%{init: {'flowchart': {'nodeSpacing': 20, 'rankSpacing': 30}}}%%
-flowchart TB
-    subgraph phase1["Phase 1: Core"]
-        direction LR
-        sdk["SDK Integration"] ~~~ interface["Telemetry Interface"] ~~~ config["Configuration"]
-    end
-
-    subgraph phase2["Phase 2: RPC"]
-        direction LR
-        http["HTTP Context"] ~~~ rpc["RPC Handlers"]
-    end
-
-    subgraph phase3["Phase 3: P2P"]
-        direction LR
-        proto["Protobuf Context"] ~~~ tx["Transaction Relay"]
-    end
-
-    subgraph phase4["Phase 4: Consensus"]
-        direction LR
-        consensus["Consensus Rounds"] ~~~ proposals["Proposals"]
-    end
-
-    phase1 --> phase2 --> phase3 --> phase4
-
-    style phase1 fill:#1565c0,stroke:#0d47a1,color:#ffffff
-    style phase2 fill:#2e7d32,stroke:#1b5e20,color:#ffffff
-    style phase3 fill:#e65100,stroke:#bf360c,color:#ffffff
-    style phase4 fill:#c2185b,stroke:#880e4f,color:#ffffff
-```
-
-</div>
-
-### Key Principles
-
-1. **Minimal Intrusion**: Instrumentation should not alter existing control flow
-2. **Zero-Cost When Disabled**: Use compile-time flags and no-op implementations
-3. **Backward Compatibility**: Protocol Buffer extensions use high field numbers
-4. **Graceful Degradation**: Tracing failures must not affect node operation
-
----
-
-## 3.3 Performance Overhead Summary
-
-> **OTLP** = OpenTelemetry Protocol
-
-| Metric        | Overhead   | Notes                                            |
-| ------------- | ---------- | ------------------------------------------------ |
-| CPU           | 1-3%       | Of per-transaction CPU cost (~200μs baseline)    |
-| Memory        | ~10 MB     | SDK statics + batch buffer + worker thread stack |
-| Network       | 10-50 KB/s | Compressed OTLP export to collector              |
-| Latency (p99) | <2%        | With proper sampling configuration               |
-
----
-
-## 3.4 Detailed CPU Overhead Analysis
-
-### 3.4.1 Per-Operation Costs
-
-> **Note on hardware assumptions**: The costs below are based on the official OTel C++ SDK CI benchmarks
-> (969 runs on GitHub Actions 2-core shared runners). On production server hardware (3+ GHz Xeon),
-> expect costs at the **lower end** of each range (~30-50% improvement over CI hardware).
-
-| Operation             | Time (ns) | Frequency              | Impact     |
-| --------------------- | --------- | ---------------------- | ---------- |
-| Span creation         | 500-1000  | Every traced operation | Low        |
-| Span end              | 100-200   | Every traced operation | Low        |
-| SetAttribute (string) | 80-120    | 3-5 per span           | Low        |
-| SetAttribute (int)    | 40-60     | 2-3 per span           | Negligible |
-| AddEvent              | 100-200   | 0-2 per span           | Low        |
-| Context injection     | 150-250   | Per outgoing message   | Low        |
-| Context extraction    | 100-180   | Per incoming message   | Low        |
-| GetCurrent context    | 10-20     | Thread-local access    | Negligible |
-
-**Source**: Span creation based on OTel C++ SDK `BM_SpanCreation` benchmark (AlwaysOnSampler +
-SimpleSpanProcessor + InMemoryExporter), median ~1,000 ns on CI hardware. AddEvent includes
-timestamp read + string copy + vector push + mutex acquisition. Context injection/extraction
-confirmed by `BM_SpanCreationWithScope` benchmark delta (~160 ns).
-
-### 3.4.2 Transaction Processing Overhead
-
-<div align="center">
-
-```mermaid
-%%{init: {'pie': {'textPosition': 0.75}}}%%
-pie showData
-    "tx.receive (1400ns)" : 1400
-    "tx.validate (1200ns)" : 1200
-    "tx.relay (1200ns)" : 1200
-    "Context inject (200ns)" : 200
-```
-
-**Transaction Tracing Overhead (~4.0μs total)**
-
-</div>
-
-**Overhead percentage**: 4.0 μs / 200 μs (avg tx processing) = **~2.0%**
-
-> **Breakdown**: Each span (tx.receive, tx.validate, tx.relay) costs ~1,000 ns for creation plus
-> ~200-400 ns for 3-5 attribute sets. Context injection is ~200 ns (confirmed by benchmarks).
-> On production hardware, expect ~2.6 μs total (~1.3% overhead) due to faster span creation (~500-600 ns).
-
-### 3.4.3 Consensus Round Overhead
-
-| Operation              | Count | Cost (ns) | Total      |
-| ---------------------- | ----- | --------- | ---------- |
-| consensus.round span   | 1     | ~1200     | ~1.2 μs    |
-| consensus.phase spans  | 3     | ~1100     | ~3.3 μs    |
-| proposal.receive spans | ~20   | ~1100     | ~22 μs     |
-| proposal.send spans    | ~3    | ~1100     | ~3.3 μs    |
-| Context operations     | ~30   | ~200      | ~6 μs      |
-| **TOTAL**              |       |           | **~36 μs** |
-
-> **Why higher**: Each span costs ~1,000 ns creation + ~100-200 ns for 1-2 attributes, totaling ~1,100-1,200 ns.
-> Context operations remain ~200 ns (confirmed by benchmarks). On production hardware, expect ~24 μs total.
-
-**Overhead percentage**: 36 μs / 3s (typical round) = **~0.001%** (negligible)
-
-### 3.4.4 RPC Request Overhead
-
-| Operation        | Cost (ns)    |
-| ---------------- | ------------ |
-| rpc.request span | ~1200        |
-| rpc.command span | ~1100        |
-| Context extract  | ~250         |
-| Context inject   | ~200         |
-| **TOTAL**        | **~2.75 μs** |
-
-> **Why higher**: Each span costs ~1,000 ns creation + ~100-200 ns for attributes (command name,
-> version, role). Context extract/inject costs are confirmed by OTel C++ benchmarks.
-
-- Fast RPC (1ms): 2.75 μs / 1ms = **~0.275%**
-- Slow RPC (100ms): 2.75 μs / 100ms = **~0.003%**
-
----
-
-## 3.5 Memory Overhead Analysis
-
-> **OTLP** = OpenTelemetry Protocol
-
-### 3.5.1 Static Memory
-
-| Component                            | Size        | Allocated  |
-| ------------------------------------ | ----------- | ---------- |
-| TracerProvider singleton             | ~64 KB      | At startup |
-| BatchSpanProcessor (circular buffer) | ~16 KB      | At startup |
-| BatchSpanProcessor (worker thread)   | ~8 MB       | At startup |
-| OTLP/HTTP exporter (client init)     | ~64 KB      | At startup |
-| Propagator registry                  | ~8 KB       | At startup |
-| **Total static**                     | **~8.1 MB** |            |
-
-> **Why higher than earlier estimate**: The BatchSpanProcessor's circular buffer itself is only ~16 KB
-> (2049 x 8-byte `AtomicUniquePtr` entries), but it spawns a dedicated worker thread whose default
-> stack size on Linux is ~8 MB. The OTLP/HTTP exporter allocates a small client and TLS
-> initialization buffer. The worker thread stack dominates the static footprint.
-
-### 3.5.2 Dynamic Memory
-
-| Component            | Size per unit  | Max units  | Peak            |
-| -------------------- | -------------- | ---------- | --------------- |
-| Active span          | ~500-800 bytes | 1000       | ~500-800 KB     |
-| Queued span (export) | ~500 bytes     | 2048       | ~1 MB           |
-| Attribute storage    | ~80 bytes      | 5 per span | Included        |
-| Context storage      | ~64 bytes      | Per thread | ~6.4 KB         |
-| **Total dynamic**    |                |            | **~1.5-1.8 MB** |
-
-> **Why active spans are larger**: An active `Span` object includes the wrapper (~88 bytes: shared_ptr,
-> mutex, unique_ptr to Recordable) plus `SpanData` (~250 bytes: SpanContext, timestamps, name, status,
-> empty containers) plus attribute storage (~200-500 bytes for 3-5 string attributes in a `std::map`).
-> Source: `sdk/src/trace/span.h` and `sdk/include/opentelemetry/sdk/trace/span_data.h`.
-> Queued spans release the wrapper, keeping only `SpanData` + attributes (~500 bytes).
-
-### 3.5.3 Memory Growth Characteristics
-
-```mermaid
----
-config:
-    xyChart:
-        width: 700
-        height: 400
----
-xychart-beta
-    title "Memory Usage vs Span Rate (bounded by queue limit)"
-    x-axis "Spans/second" [0, 200, 400, 600, 800, 1000]
-    y-axis "Memory (MB)" 0 --> 12
-    line [8.5, 9.2, 9.6, 9.9, 10.0, 10.0]
-```
-
-**Notes**:
-
-- Memory increases with span rate but **plateaus at queue capacity** (default 2048 spans)
-- Batch export prevents unbounded growth
-- At queue limit, oldest spans are dropped (not blocked)
-- Maximum memory is bounded: ~8.3 MB static (dominated by worker thread stack) + 2048 queued spans x ~500 bytes (~1 MB) + active spans (~0.8 MB) ≈ **~10 MB ceiling**
-- The worker thread stack (~8 MB) is virtual memory; actual RSS depends on stack usage (typically much less)
-
-> **Measured outcome**: A perf-iac comparison (telemetry compiled-in + enabled vs compiled-out,
-> 9 nodes — validators and client-handlers — under sustained payment load) recorded **no measurable
-> RSS increase over the telemetry-off baseline** (~15 GiB mean / ~18–19 GiB peak on both sides),
-> with no OOM, no swap, and no leak across the run. The ~10 MB ceiling above is therefore a
-> provisioning safety margin (dominated by virtual thread-stack address space), not an expected
-> resident-memory increase. Steady-state cost shows up as throughput (~3–4% at head sampling 1.0),
-> not memory.
-
-### 3.5.4 Performance Data Sources
-
-The overhead estimates in Sections 3.3-3.5 are derived from the following sources:
-
-| Source                                           | What it covers                                        | URL                                                                                                                                        |
-| ------------------------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
-| OTel C++ SDK CI benchmarks (969 runs)            | Span creation, context activation, sampler overhead   | [Benchmark Dashboard](https://open-telemetry.github.io/opentelemetry-cpp/benchmarks/)                                                      |
-| `api/test/trace/span_benchmark.cc`               | API-level span creation (~22 ns no-op)                | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/api/test/trace/span_benchmark.cc)                                   |
-| `sdk/test/trace/sampler_benchmark.cc`            | SDK span creation with samplers (~1,000 ns AlwaysOn)  | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/test/trace/sampler_benchmark.cc)                                |
-| `sdk/include/.../span_data.h`                    | SpanData memory layout (~250 bytes base)              | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/include/opentelemetry/sdk/trace/span_data.h)                    |
-| `sdk/src/trace/span.h`                           | Span wrapper memory layout (~88 bytes)                | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/src/trace/span.h)                                               |
-| `sdk/include/.../batch_span_processor_options.h` | Default queue size (2048), batch size (512)           | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/include/opentelemetry/sdk/trace/batch_span_processor_options.h) |
-| `sdk/include/.../circular_buffer.h`              | CircularBuffer implementation (AtomicUniquePtr array) | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/include/opentelemetry/sdk/common/circular_buffer.h)             |
-| OTLP proto definition                            | Serialized span size estimation                       | [Proto](https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/trace/v1/trace.proto)                          |
-
----
-
-## 3.6 Network Overhead Analysis
-
-### 3.6.1 Export Bandwidth
-
-> **Bytes per span**: Estimates use ~500 bytes/span (conservative upper bound). OTLP protobuf analysis
-> shows a typical span with 3-5 string attributes serializes to ~200-300 bytes raw; with gzip
-> compression (~60-70% of raw) and batching (amortized headers), ~350 bytes/span is more realistic.
-> The table uses the conservative estimate for capacity planning.
-
-| Sampling Rate | Spans/sec | Bandwidth | Notes            |
-| ------------- | --------- | --------- | ---------------- |
-| 100%          | ~500      | ~250 KB/s | Development only |
-| 10%           | ~50       | ~25 KB/s  | Staging          |
-| 1%            | ~5        | ~2.5 KB/s | Production       |
-| Error-only    | ~1        | ~0.5 KB/s | Minimal overhead |
-
-### 3.6.2 Trace Context Propagation
-
-| Message Type           | Context Size | Messages/sec | Overhead    |
-| ---------------------- | ------------ | ------------ | ----------- |
-| TMTransaction          | 25 bytes     | ~100         | ~2.5 KB/s   |
-| TMProposeSet           | 25 bytes     | ~10          | ~250 B/s    |
-| TMValidation           | 25 bytes     | ~50          | ~1.25 KB/s  |
-| **Total P2P overhead** |              |              | **~4 KB/s** |
-
----
-
-## 3.7 Optimization Strategies
-
-### 3.7.1 Sampling Strategies
-
-#### Tail Sampling
-
-```mermaid
-flowchart TD
-    trace["New Trace"]
-
-    trace --> errors{"Is Error?"}
-    errors -->|Yes| sample["SAMPLE"]
-    errors -->|No| consensus{"Is Consensus?"}
-
-    consensus -->|Yes| sample
-    consensus -->|No| slow{"Is Slow?"}
-
-    slow -->|Yes| sample
-    slow -->|No| prob{"Random < 10%?"}
-
-    prob -->|Yes| sample
-    prob -->|No| drop["DROP"]
-
-    style sample fill:#4caf50,stroke:#388e3c,color:#fff
-    style drop fill:#f44336,stroke:#c62828,color:#fff
-```
-
-### 3.7.2 Batch Tuning Recommendations
-
-| Environment        | Batch Size | Batch Delay | Max Queue |
-| ------------------ | ---------- | ----------- | --------- |
-| Low-latency        | 128        | 1000ms      | 512       |
-| High-throughput    | 1024       | 10000ms     | 8192      |
-| Memory-constrained | 256        | 2000ms      | 512       |
-
-### 3.7.3 Conditional Instrumentation
-
-Instrumentation is gated on two levels. A compile-time feature flag (`XRPL_ENABLE_TELEMETRY`) reduces the trace macros to no-ops when telemetry is built out, so disabled builds carry zero cost. At runtime, per-component guards (e.g. `shouldTracePeer()`) skip span creation for components whose tracing is turned off, incurring no overhead beyond a single boolean check.
-
----
-
-## 3.8 Links to Detailed Documentation
-
-- **[Configuration Reference](./05-configuration-reference.md)**: Configuration options and collector setup
-- **[Implementation Phases](./06-implementation-phases.md)**: Detailed timeline and milestones
-
----
-
-## 3.9 Code Intrusiveness Assessment
-
-> **TxQ** = Transaction Queue
-
-This section provides a detailed assessment of how intrusive the OpenTelemetry integration is to the existing xrpld codebase.
-
-### 3.9.1 Files Modified Summary
-
-| Component             | Files Modified | Architectural Impact |
-| --------------------- | -------------- | -------------------- |
-| **Core Telemetry**    | 10 new files   | None (new module)    |
-| **Application Init**  | 2 files        | Minimal              |
-| **RPC Layer**         | 3 files        | Minimal              |
-| **Transaction Relay** | 4 files        | Low                  |
-| **Consensus**         | 3 files        | Low-Medium           |
-| **Protocol Buffers**  | 1 file         | Low                  |
-| **CMake/Build**       | 3 files        | Minimal              |
-| **PathFinding**       | 2              | Minimal              |
-| **TxQ/Fee**           | 2              | Minimal              |
-| **Validator/Amend**   | 3              | Minimal              |
-| **Total**             | **~33 files**  | **Low**              |
-
-### 3.9.2 Detailed File Impact
-
-```mermaid
-pie title Code Changes by Component
-    "New Telemetry Module" : 800
-    "Transaction Relay" : 160
-    "Consensus" : 130
-    "RPC Layer" : 100
-    "PathFinding" : 80
-    "TxQ/Fee" : 60
-    "Validator/Amendment" : 40
-    "Application Init" : 35
-    "Protocol Buffers" : 25
-    "Build System" : 60
-```
-
-#### New Files (No Impact on Existing Code)
-
-| File                                        | Purpose                   |
-| ------------------------------------------- | ------------------------- |
-| `include/xrpl/telemetry/Telemetry.h`        | Main interface            |
-| `include/xrpl/telemetry/TelemetryConfig.h`  | Configuration structures  |
-| `include/xrpl/telemetry/TraceContext.h`     | Context propagation       |
-| `include/xrpl/telemetry/SpanGuard.h`        | RAII wrapper              |
-| `include/xrpl/telemetry/DiscardFlag.h`      | Thread-local discard flag |
-| `include/xrpl/telemetry/SpanAttributes.h`   | Attribute helpers         |
-| `src/libxrpl/telemetry/Telemetry.cpp`       | Implementation            |
-| `src/libxrpl/telemetry/TelemetryConfig.cpp` | Config parsing            |
-| `src/libxrpl/telemetry/TraceContext.cpp`    | Context serialization     |
-| `src/libxrpl/telemetry/NullTelemetry.cpp`   | No-op implementation      |
-
-#### Modified Files (Existing Xrpld Code)
-
-| File                                              | Risk Level |
-| ------------------------------------------------- | ---------- |
-| `src/xrpld/app/main/Application.cpp`              | Low        |
-| `include/xrpl/core/ServiceRegistry.h`             | Low        |
-| `src/xrpld/rpc/detail/ServerHandler.cpp`          | Low        |
-| `src/xrpld/rpc/handlers/*.cpp`                    | Low        |
-| `src/xrpld/overlay/detail/PeerImp.cpp`            | Medium     |
-| `src/xrpld/overlay/detail/OverlayImpl.cpp`        | Medium     |
-| `src/xrpld/app/consensus/RCLConsensus.cpp`        | Medium     |
-| `src/xrpld/app/consensus/RCLConsensusAdaptor.cpp` | Medium     |
-| `src/xrpld/core/JobQueue.cpp`                     | Low        |
-| `src/xrpld/app/paths/PathRequest.cpp`             | Low        |
-| `src/xrpld/app/paths/Pathfinder.cpp`              | Low        |
-| `src/xrpld/app/misc/TxQ.cpp`                      | Low        |
-| `src/xrpld/app/main/LoadManager.cpp`              | Low        |
-| `src/xrpld/app/misc/ValidatorList.cpp`            | Low        |
-| `src/xrpld/app/misc/AmendmentTable.cpp`           | Low        |
-| `src/xrpld/app/misc/Manifest.cpp`                 | Low        |
-| `src/xrpld/shamap/SHAMap.cpp`                     | Low        |
-| `src/xrpld/overlay/detail/ripple.proto`           | Low        |
-| `CMakeLists.txt`                                  | Low        |
-| `cmake/FindOpenTelemetry.cmake`                   | None (new) |
-
-### 3.9.3 Risk Assessment by Component
-
-<div align="center">
-
-**Do First** ↖ ↗ **Plan Carefully**
-
-```mermaid
-quadrantChart
-    title Code Intrusiveness Risk Matrix
-    x-axis Low Risk --> High Risk
-    y-axis Low Value --> High Value
-
-    RPC Tracing: [0.2, 0.55]
-    Transaction Relay: [0.55, 0.85]
-    Consensus Tracing: [0.75, 0.92]
-    Peer Message Tracing: [0.85, 0.35]
-    JobQueue Context: [0.3, 0.42]
-    Ledger Acquisition: [0.48, 0.65]
-    PathFinding: [0.38, 0.72]
-    TxQ and Fees: [0.25, 0.62]
-    Validator Mgmt: [0.15, 0.35]
-```
-
-**Optional** ↙ ↘ **Avoid**
-
-</div>
-
-#### Risk Level Definitions
-
-| Risk Level | Definition                                                       | Mitigation                         |
-| ---------- | ---------------------------------------------------------------- | ---------------------------------- |
-| **Low**    | Additive changes only; no modification to existing logic         | Standard code review               |
-| **Medium** | Minor modifications to existing functions; clear boundaries      | Comprehensive unit tests           |
-| **High**   | Changes to core logic or data structures; potential side effects | Integration tests + staged rollout |
-
-### 3.9.4 Architectural Impact Assessment
-
-| Aspect               | Impact  | Justification                                                                    |
-| -------------------- | ------- | -------------------------------------------------------------------------------- |
-| **Data Flow**        | Minimal | Read-only instrumentation; no modification to consensus or transaction data flow |
-| **Threading Model**  | Minimal | Context propagation uses thread-local storage (standard OTel pattern)            |
-| **Memory Model**     | Low     | Bounded queues prevent unbounded growth; RAII ensures cleanup                    |
-| **Network Protocol** | Low     | Optional fields in protobuf (high field numbers); backward compatible            |
-| **Configuration**    | None    | New config section; existing configs unaffected                                  |
-| **Build System**     | Low     | Optional CMake flag; builds work without OpenTelemetry                           |
-| **Dependencies**     | Low     | OpenTelemetry SDK is optional; null implementation when disabled                 |
-
-### 3.9.5 Backward Compatibility
-
-| Compatibility   | Status  | Notes                                                 |
-| --------------- | ------- | ----------------------------------------------------- |
-| **Config File** | ✅ Full | New `[telemetry]` section is optional                 |
-| **Protocol**    | ✅ Full | Optional protobuf fields with high field numbers      |
-| **Build**       | ✅ Full | `XRPL_ENABLE_TELEMETRY=OFF` produces identical binary |
-| **Runtime**     | ✅ Full | `enabled=0` produces zero overhead                    |
-| **API**         | ✅ Full | No changes to public RPC or P2P APIs                  |
-
-### 3.9.6 Rollback Strategy
-
-If issues are discovered after deployment:
-
-1. **Immediate**: Set `enabled=0` in config and restart (zero code change)
-2. **Quick**: Rebuild with `XRPL_ENABLE_TELEMETRY=OFF`
-3. **Complete**: Revert telemetry commits (clean separation makes this easy)
-
-### 3.9.7 Code Change Examples
-
-**Minimal RPC Instrumentation (Low Intrusiveness):** Instrumenting an RPC handler adds roughly 3-4 lines: one macro to start the span and one or two `setAttribute` calls (command name, status). The span ends automatically via RAII, so the existing control flow — process the request, send the result — is untouched.
-
-**Consensus Instrumentation (Medium Intrusiveness):** Consensus is slightly more intrusive because child spans in later phase transitions need the round's context. Beyond the span-start and attribute macros, this requires storing the active context in a new member variable (`currentRoundContext_`) at round start. The existing round logic itself remains unchanged.
-
----
-
-_Previous: [Design Decisions](./02-design-decisions.md)_ | _Next: [Configuration Reference](./05-configuration-reference.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/05-configuration-reference.md

@@ -1,269 +0,0 @@
-# Configuration Reference
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Implementation Phases](./06-implementation-phases.md)
-
----
-
-## 5.1 xrpld Configuration
-
-> **OTLP** = OpenTelemetry Protocol | **TxQ** = Transaction Queue
-
-### 5.1.1 Configuration File Section
-
-The authoritative `[telemetry]` example lives in `cfg/xrpld-example.cfg`. Telemetry is disabled by default (`enabled=0`); enabling it turns on distributed tracing for transaction flow, consensus, and RPC calls, with traces exported to an OpenTelemetry Collector over OTLP. Head sampling is intentionally fixed at 1.0 (sample everything) and is not configurable — per-node head-sampling would produce broken/partial distributed traces, so volume reduction is delegated to the collector's tail sampling (see Section 7.4.2). The full option reference follows.
-
-### 5.1.2 Configuration Options Summary
-
-| Option                     | Type   | Default                           | Description                                                                                                |
-| -------------------------- | ------ | --------------------------------- | ---------------------------------------------------------------------------------------------------------- |
-| `enabled`                  | bool   | `false`                           | Enable/disable telemetry                                                                                   |
-| `endpoint`                 | string | `http://localhost:4318/v1/traces` | OTLP/HTTP collector endpoint                                                                               |
-| `use_tls`                  | bool   | `false`                           | Enable TLS for exporter connection                                                                         |
-| `tls_ca_cert`              | string | `""`                              | Path to CA certificate file                                                                                |
-| `batch_size`               | uint   | `512`                             | Spans per export batch                                                                                     |
-| `batch_delay_ms`           | uint   | `5000`                            | Max delay before sending batch (ms)                                                                        |
-| `max_queue_size`           | uint   | `2048`                            | Maximum queued spans                                                                                       |
-| `trace_transactions`       | bool   | `true`                            | Enable transaction tracing                                                                                 |
-| `trace_consensus`          | bool   | `true`                            | Enable consensus tracing                                                                                   |
-| `trace_rpc`                | bool   | `true`                            | Enable RPC tracing                                                                                         |
-| `trace_peer`               | bool   | `true`                            | Enable peer message tracing (high volume)                                                                  |
-| `trace_ledger`             | bool   | `true`                            | Enable ledger tracing                                                                                      |
-| `tx_trace_strategy`        | string | `"deterministic"`                 | TX trace ID strategy: `"deterministic"` (trace_id = txHash[0:16]) or `"attribute"` (random)                |
-| `consensus_trace_strategy` | string | `"deterministic"`                 | Consensus trace ID strategy: `"deterministic"` (trace_id = prevLedgerHash[0:16]) or `"attribute"` (random) |
-| `service_name`             | string | `"xrpld"`                         | Service name (`service.name`) for traces and metrics                                                       |
-| `service_instance_id`      | string | `<node_pubkey>`                   | Instance identifier                                                                                        |
-
-**Planned (not yet implemented)**: the following options appear in the design
-documents but are not parsed by `TelemetryConfig.cpp` in Phase 1b and later
-phases. They will be added as the corresponding subsystems are instrumented:
-
-| Option                     | Planned Phase | Purpose                                                                 |
-| -------------------------- | ------------- | ----------------------------------------------------------------------- |
-| `exporter`                 | Future        | Select between OTLP/HTTP and OTLP/gRPC                                  |
-| `trace_pathfind`           | Phase 2       | Path computation tracing toggle                                         |
-| `trace_txq`                | Phase 3       | Transaction queue tracing toggle                                        |
-| `trace_validator`          | Future        | Validator list / manifest update tracing                                |
-| `trace_amendment`          | Future        | Amendment voting tracing                                                |
-| `consensus_trace_strategy` | Phase 4       | Trace ID strategy for consensus rounds (`deterministic` \| `attribute`) |
-
----
-
-## 5.2 Configuration Parser
-
-> **TxQ** = Transaction Queue
-
-The parser `setupTelemetry()` in `src/libxrpl/telemetry/TelemetryConfig.cpp` reads the `[telemetry]` `Section` and populates a `Telemetry::Setup` struct, applying the defaults listed in Section 5.1.2 via `section.value_or(...)`. It derives `serviceInstanceId` from the node public key when not overridden, selects the exporter endpoint default by exporter type, and leaves the sampling ratio at its fixed 1.0 default (not read from config — see Section 7.4.2).
-
----
-
-## 5.3 Application Integration
-
-### 5.3.1 ApplicationImp Changes
-
-> **Deferred identity**: The node public key (`nodeIdentity_`) is not
-> available during `ApplicationImp`'s member initializer list — it is
-> resolved later in `setup()`. The `Telemetry` object is therefore
-> constructed with an empty `serviceInstanceId` and patched via
-> `setServiceInstanceId()` once `setup()` has called `getNodeIdentity()`.
-
-`ApplicationImp` (in `src/xrpld/app/main/Application.cpp`) owns a `std::unique_ptr<telemetry::Telemetry> telemetry_`. It is built in the member initializer list via `makeTelemetry(setupTelemetry(...))` with an empty `serviceInstanceId`, then patched in `setup()` by calling `setServiceInstanceId()` with the Base58 node public key (unless the user supplied a custom `service_instance_id`). `start()` and `run()` forward to `telemetry_->start()` / `telemetry_->stop()`, and `getTelemetry()` returns the owned instance.
-
-### 5.3.2 ServiceRegistry Interface Addition
-
-`include/xrpl/core/ServiceRegistry.h` gains a pure-virtual `telemetry::Telemetry& getTelemetry()` (with a forward declaration of `telemetry::Telemetry`), giving every component a uniform accessor for the tracing subsystem.
-
-> **Note:** `Application` extends `ServiceRegistry`, so `getTelemetry()` is
-> available on both. Components that hold a `ServiceRegistry&` (e.g.
-> `NetworkOPsImp`) call `registry_.get().getTelemetry()`. Components that
-> still hold an `Application&` (e.g. `ServerHandler`, `PeerImp`,
-> `RCLConsensusAdaptor`) call `app_.getTelemetry()` directly.
-
----
-
-## 5.4 CMake Integration
-
-> **OTLP** = OpenTelemetry Protocol
-
-### 5.4.1 Find OpenTelemetry Module
-
-A `cmake/FindOpenTelemetry.cmake` module locates the OpenTelemetry C++ SDK. It first tries `find_package(opentelemetry-cpp CONFIG)`, aliasing the imported targets `OpenTelemetry::api`, `OpenTelemetry::sdk`, and `OpenTelemetry::otlp_grpc_exporter`, and falls back to `pkg-config` when no CMake config package is present.
-
-### 5.4.2 CMakeLists.txt Changes
-
-The top-level `CMakeLists.txt` adds an `XRPL_ENABLE_TELEMETRY` option (default `OFF`). When enabled, it runs `find_package(OpenTelemetry REQUIRED)`, defines the `XRPL_ENABLE_TELEMETRY` compile flag, and builds the `xrpl_telemetry` library from the real telemetry sources linked against the OpenTelemetry targets; when disabled, it builds the same target from a no-op `NullTelemetry.cpp` so call sites compile unchanged.
-
----
-
-## 5.5 OpenTelemetry Collector Configuration
-
-> **OTLP** = OpenTelemetry Protocol | **APM** = Application Performance Monitoring
-
-> **Production hardening**: The configurations in this section are starting points. For production deployments where xrpld ships telemetry across a network to a centrally-hosted collector, see [Securing the OTel Pipeline](./secure-OTel.md) for the required mTLS receiver config, NetworkPolicy, and peer trace-context validation.
-
-The authoritative collector config lives in the repo at `docker/telemetry/otel-collector-config.yaml` (with Tempo backend config in `docker/telemetry/tempo.yaml`). The sections below summarize the development and production shapes of that pipeline.
-
-### 5.5.1 Development Configuration
-
-The development collector enables an OTLP receiver on both gRPC (`0.0.0.0:4317`) and HTTP (`0.0.0.0:4318`), a single `batch` processor (1s timeout, batch size 100), and two exporters: a `logging` exporter for console debugging and `otlp/tempo` (insecure) for trace visualization. The single `traces` pipeline wires receiver → batch → both exporters.
-
-### 5.5.2 Production Configuration
-
-The production collector adds TLS on the OTLP gRPC receiver and a richer processor chain: a `memory_limiter` (OOM guard), `batch` (5s timeout, size 512), `tail_sampling`, and an `attributes` processor that hashes sensitive fields (e.g. `tx_account`) and stamps `deployment.environment`. Tail sampling keeps all `ERROR` traces, slow consensus rounds (>5s) and slow RPC requests (>1s), and probabilistically samples the remainder at 10%. Exporters target Grafana Tempo (TLS) and Elastic APM; `health_check` and `zpages` extensions are enabled for operability.
-
----
-
-## 5.6 Docker Compose Development Environment
-
-> **OTLP** = OpenTelemetry Protocol
-
-The authoritative development stack lives in the repo at `docker/telemetry/docker-compose.yml`. It brings up four services on a shared `xrpld-telemetry` network: an `otel-collector` (otel/opentelemetry-collector-contrib) exposing OTLP gRPC `4317`, OTLP HTTP `4318`, and health check `13133`; `tempo` for trace storage/visualization; `grafana` with provisioned datasources and dashboards (anonymous admin enabled); and an optional `prometheus` for metric correlation.
-
----
-
-## 5.7 Configuration Architecture
-
-> **OTLP** = OpenTelemetry Protocol
-
-```mermaid
-flowchart TB
-    subgraph config["Configuration Sources"]
-        cfgFile["xrpld.cfg<br/>[telemetry] section"]
-        cmake["CMake<br/>XRPL_ENABLE_TELEMETRY"]
-    end
-
-    subgraph init["Initialization"]
-        parse["setupTelemetry()"]
-        factory["makeTelemetry()"]
-    end
-
-    subgraph runtime["Runtime Components"]
-        tracer["TracerProvider"]
-        exporter["OTLP Exporter"]
-        processor["BatchProcessor"]
-    end
-
-    subgraph collector["Collector Pipeline"]
-        recv["Receivers"]
-        proc["Processors"]
-        exp["Exporters"]
-    end
-
-    cfgFile --> parse
-    cmake -->|"compile flag"| parse
-    parse --> factory
-    factory --> tracer
-    tracer --> processor
-    processor --> exporter
-    exporter -->|"OTLP"| recv
-    recv --> proc
-    proc --> exp
-
-    style config fill:#e3f2fd,stroke:#1976d2
-    style runtime fill:#e8f5e9,stroke:#388e3c
-    style collector fill:#fff3e0,stroke:#ff9800
-```
-
-**Reading the diagram:**
-
-- **Configuration Sources**: `xrpld.cfg` provides runtime settings (endpoint, per-component trace toggles) while the CMake flag controls whether telemetry is compiled in at all. Head sampling is fixed at 1.0 and is not a config option; volume reduction happens via tail sampling in the collector.
-- **Initialization**: `setupTelemetry()` parses config values, then `makeTelemetry()` constructs the provider, processor, and exporter objects.
-- **Runtime Components**: The `TracerProvider` creates spans, the `BatchProcessor` buffers them, and the `OTLP Exporter` serializes and sends them over the wire.
-- **OTLP arrow to Collector**: Trace data leaves the xrpld process via OTLP/HTTP and enters the external Collector pipeline. (OTLP/gRPC is future work — see design decisions §2.2.2.)
-- **Collector Pipeline**: `Receivers` ingest OTLP data, `Processors` apply sampling/filtering/enrichment, and `Exporters` forward traces to storage backends (Tempo, etc.).
-
----
-
-## 5.8 Grafana Integration
-
-> **APM** = Application Performance Monitoring
-
-Step-by-step instructions for integrating xrpld traces with Grafana.
-
-### 5.8.1 Data Source Configuration
-
-#### Tempo (Recommended)
-
-A Tempo datasource (`grafana/provisioning/datasources/tempo.yaml`, provisioned from `docker/telemetry/grafana/`) points at `http://tempo:3200` and enables `tracesToLogs` (linking to Loki on `service.name`/`tx_hash` and mapping `trace_id` → `traceID`), `serviceMap` against Prometheus, the node graph, and Loki search.
-
-#### Elastic APM
-
-Alternatively, an Elasticsearch datasource (`grafana/provisioning/datasources/elastic-apm.yaml`) of type `elasticsearch` points at `http://elasticsearch:9200` against the `apm-*` index, using `@timestamp` as the time field and mapping the log message/level fields.
-
-### 5.8.2 Dashboard Provisioning
-
-A dashboard provider (`grafana/provisioning/dashboards/dashboards.yaml`) loads the `xrpld` dashboard folder from disk (`/var/lib/grafana/dashboards/rippled`), polling for changes every 30s with deletion disabled.
-
-### 5.8.3 Example Dashboard: RPC Performance
-
-An example `xrpld RPC Performance` dashboard (uid `xrpld-rpc-performance`) sourced from Tempo via TraceQL provides four panels: RPC latency by command (heatmap), RPC error rate by command (timeseries), the top 10 slowest RPC commands by average duration (table), and a recent-traces table.
-
-### 5.8.4 Example Dashboard: Transaction Tracing
-
-An example `xrpld Transaction Tracing` dashboard (uid `xrpld-tx-tracing`) over Tempo provides three panels: transaction throughput (`tx.receive` rate, stat), cross-node relay count (average `span.relay_count` on `tx.relay`, timeseries), and a table of transaction validation errors (`tx.validate` with `status.code=error`).
-
-### 5.8.5 TraceQL Query Examples
-
-Common queries for xrpld traces:
-
-```
-# Find all traces for a specific transaction hash
-{resource.service.name="xrpld" && span.tx_hash="ABC123..."}
-
-# Find slow RPC commands (>100ms)
-{resource.service.name="xrpld" && name=~"rpc.command.*"} | duration > 100ms
-
-# Find consensus rounds taking >5 seconds
-{resource.service.name="xrpld" && name="consensus.round"} | duration > 5s
-
-# Find failed transactions with error details
-{resource.service.name="xrpld" && name="tx.validate" && status.code=error}
-
-# Find transactions relayed to many peers
-{resource.service.name="xrpld" && name="tx.relay"} | span.relay_count > 10
-
-# Compare latency across nodes
-{resource.service.name="xrpld" && name="rpc.command.account_info"} | avg(duration) by (resource.service.instance.id)
-```
-
-### 5.8.6 Correlation with PerfLog
-
-To correlate OpenTelemetry traces with existing PerfLog data:
-
-**Step 1: Configure Loki to ingest PerfLog**
-
-Configure a Promtail scrape job (`promtail-config.yaml`) that tails `/var/log/rippled/perf*.log`, parses each JSON line, and promotes `trace_id`, `ledger_seq`, and `tx_hash` to Loki labels.
-
-**Step 2: Add trace_id to PerfLog entries**
-
-Modify PerfLog so its JSON output includes a `trace_id` field whenever a valid span is active: fetch the current span from the OpenTelemetry runtime context, and if its context is valid, render the trace ID as a 32-character lowercase hex string into the log entry.
-
-**Step 3: Configure Grafana trace-to-logs link**
-
-In the Tempo datasource, set the `tracesToLogs` derived field to link to Loki on the `trace_id` and `tx_hash` tags, with `filterByTraceID: true`.
-
-### 5.8.7 Correlation with Insight/StatsD Metrics
-
-To correlate traces with existing Beast Insight metrics:
-
-**Step 1: Export Insight metrics to Prometheus**
-
-Add a Prometheus scrape job (`prometheus.yaml`) named `xrpld-statsd` targeting the StatsD exporter at `statsd-exporter:9102`.
-
-**Step 2: Add exemplars to metrics**
-
-The OpenTelemetry SDK automatically adds exemplars (trace IDs) to metrics when using the Prometheus exporter, linking metric spikes to specific traces.
-
-**Step 3: Configure Grafana metric-to-trace link**
-
-In the Prometheus datasource, set `exemplarTraceIdDestinations` to map the `trace_id` exemplar to the Tempo datasource.
-
-**Step 4: Dashboard panel with exemplars**
-
-Add a timeseries panel over Prometheus (e.g. `histogram_quantile(0.99, rate(xrpld_rpc_duration_seconds_bucket[5m]))`) with `exemplar: true` enabled.
-
-This allows clicking on metric data points to jump directly to the related trace.
-
----
-
-_Previous: [Implementation Strategy](./03-implementation-strategy.md)_ | _Next: [Implementation Phases](./06-implementation-phases.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/06-implementation-phases.md

@@ -1,590 +0,0 @@
-# Implementation Phases
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Configuration Reference](./05-configuration-reference.md) | [Observability Backends](./07-observability-backends.md)
-
----
-
-## 6.1 Phase Overview
-
-> **TxQ** = Transaction Queue
-
-```mermaid
-gantt
-    title OpenTelemetry Implementation Timeline
-    dateFormat  YYYY-MM-DD
-    axisFormat  Week %W
-
-    section Phase 1
-    Core Infrastructure        :p1, 2024-01-01, 2w
-    SDK Integration           :p1a, 2024-01-01, 4d
-    Telemetry Interface       :p1b, after p1a, 3d
-    Configuration & CMake     :p1c, after p1b, 3d
-    Unit Tests                :p1d, after p1c, 2d
-    Buffer & Integration      :p1e, after p1d, 2d
-
-    section Phase 2
-    RPC Tracing               :p2, after p1, 2w
-    HTTP Context Extraction   :p2a, after p1, 2d
-    RPC Handler Instrumentation :p2b, after p2a, 4d
-    PathFinding Instrumentation :p2f, after p2b, 2d
-    TxQ Instrumentation       :p2g, after p2f, 2d
-    WebSocket Support         :p2c, after p2g, 2d
-    Integration Tests         :p2d, after p2c, 2d
-    Buffer & Review           :p2e, after p2d, 4d
-
-    section Phase 3
-    Transaction Tracing       :p3, after p2, 2w
-    Protocol Buffer Extension :p3a, after p2, 2d
-    PeerImp Instrumentation   :p3b, after p3a, 3d
-    Fee Escalation Instrumentation :p3f, after p3b, 2d
-    Relay Context Propagation :p3c, after p3f, 3d
-    Multi-node Tests          :p3d, after p3c, 2d
-    Buffer & Review           :p3e, after p3d, 4d
-
-    section Phase 4
-    Consensus Tracing         :p4, after p3, 2w
-    Consensus Round Spans     :p4a, after p3, 3d
-    Proposal Handling         :p4b, after p4a, 3d
-    Validator List & Manifest Tracing :p4f, after p4b, 2d
-    Amendment Voting Tracing  :p4g, after p4f, 2d
-    SHAMap Sync Tracing       :p4h, after p4g, 2d
-    Validation Tests          :p4c, after p4h, 4d
-    Buffer & Review           :p4e, after p4c, 4d
-
-    section Phase 5
-    Documentation & Deploy    :p5, after p4, 1w
-```
-
----
-
-## 6.2 Phase 1: Core Infrastructure (Weeks 1-2)
-
-**Objective**: Establish foundational telemetry infrastructure
-
-### Tasks
-
-| Task | Description                                           |
-| ---- | ----------------------------------------------------- |
-| 1.1  | Add OpenTelemetry C++ SDK to Conan/CMake              |
-| 1.2  | Implement `Telemetry` interface and factory           |
-| 1.3  | Implement `SpanGuard` RAII wrapper                    |
-| 1.4  | Implement configuration parser                        |
-| 1.5  | Integrate into `ApplicationImp`                       |
-| 1.6  | Add conditional compilation (`XRPL_ENABLE_TELEMETRY`) |
-| 1.7  | Create `NullTelemetry` no-op implementation           |
-| 1.8  | Unit tests for core infrastructure                    |
-
-### Exit Criteria
-
-- [ ] OpenTelemetry SDK compiles and links
-- [ ] Telemetry can be enabled/disabled via config
-- [ ] Basic span creation works
-- [ ] No performance regression when disabled
-- [ ] Unit tests passing
-
----
-
-## 6.3 Phase 2: RPC Tracing (Weeks 3-4)
-
-> **TxQ** = Transaction Queue
-
-**Objective**: Complete tracing for all RPC operations
-
-### Tasks
-
-| Task | Description                                                                |
-| ---- | -------------------------------------------------------------------------- |
-| 2.1  | Implement W3C Trace Context HTTP header extraction                         |
-| 2.2  | Instrument `ServerHandler::onRequest()`                                    |
-| 2.3  | Instrument `RPCHandler::doCommand()`                                       |
-| 2.4  | Add RPC-specific attributes                                                |
-| 2.5  | Instrument WebSocket handler                                               |
-| 2.6  | PathFinding instrumentation (`pathfind.request`, `pathfind.compute` spans) |
-| 2.7  | TxQ instrumentation (`txq.enqueue`, `txq.apply` spans)                     |
-| 2.8  | Integration tests for RPC tracing                                          |
-| 2.9  | Performance benchmarks                                                     |
-| 2.10 | Documentation                                                              |
-
-### Exit Criteria
-
-- [ ] All RPC commands traced
-- [ ] Trace context propagates from HTTP headers
-- [ ] WebSocket and HTTP both instrumented
-- [ ] <1ms overhead per RPC call
-- [ ] Integration tests passing
-
----
-
-## 6.4 Phase 3: Transaction Tracing (Weeks 5-6)
-
-**Objective**: Trace transaction lifecycle across network with deterministic cross-node correlation
-
-### Tasks
-
-| Task | Description                                                    |
-| ---- | -------------------------------------------------------------- |
-| 3.1  | Define `TraceContext` Protocol Buffer message                  |
-| 3.2  | Implement protobuf context serialization                       |
-| 3.3  | Instrument `PeerImp::handleTransaction()`                      |
-| 3.4  | Instrument `NetworkOPs::submitTransaction()`                   |
-| 3.5  | Instrument HashRouter integration                              |
-| 3.6  | Fee escalation instrumentation (`fee.escalate` span)           |
-| 3.7  | Implement relay context propagation                            |
-| 3.8  | Integration tests (multi-node)                                 |
-| 3.9  | Deterministic transaction trace ID (`trace_id = txHash[0:16]`) |
-| 3.10 | Performance benchmarks                                         |
-
-### Deterministic Trace ID (Task 3.9)
-
-Transaction spans use **deterministic trace IDs** derived from the transaction hash:
-`trace_id = txHash[0:16]`. All nodes handling the same transaction independently
-produce spans under the same trace_id. Protobuf `span_id` propagation (Task 3.7)
-additionally provides parent-child relay ordering when available. See
-[02-design-decisions.md §2.5.0](./02-design-decisions.md) for the design rationale
-and [Phase3_taskList.md Task 3.9](./Phase3_taskList.md) for the full implementation spec.
-
-### Exit Criteria
-
-- [ ] Transaction traces span across nodes
-- [ ] Trace context in Protocol Buffer messages
-- [ ] HashRouter deduplication visible in traces
-- [ ] Multi-node integration tests passing
-- [ ] <5% overhead on transaction throughput
-- [ ] Deterministic trace_id: all nodes produce same trace_id for same transaction
-- [ ] Protobuf span_id propagation preserves parent-child ordering when available
-
----
-
-## 6.5 Phase 4: Consensus Tracing (Weeks 7-8)
-
-**Objective**: Full observability into consensus rounds
-
-### Tasks
-
-| Task | Description                                    |
-| ---- | ---------------------------------------------- |
-| 4.1  | Instrument `RCLConsensusAdaptor::startRound()` |
-| 4.2  | Instrument phase transitions                   |
-| 4.3  | Instrument proposal handling                   |
-| 4.4  | Instrument validation handling                 |
-| 4.5  | Add consensus-specific attributes              |
-| 4.6  | Correlate with transaction traces              |
-| 4.7  | Validator list and manifest tracing            |
-| 4.8  | Amendment voting tracing                       |
-| 4.9  | SHAMap sync tracing                            |
-| 4.10 | Multi-validator integration tests              |
-| 4.11 | Performance validation                         |
-
-### Exit Criteria
-
-- [ ] Complete consensus round traces
-- [ ] Phase transitions visible
-- [ ] Proposals and validations traced
-- [ ] No impact on consensus timing
-- [ ] Multi-validator test network validated
-
-### Implementation Status — Phase 4a Plan
-
-Phase 4a (establish-phase gap fill & cross-node correlation) will add:
-
-- **Deterministic trace ID** derived from `previousLedger.id()` so all validators
-  in the same round share the same `trace_id` (switchable via
-  `consensus_trace_strategy` config: `"deterministic"` or `"attribute"`).
-  See [Configuration Reference](./05-configuration-reference.md) for full
-  configuration options.
-- **Round lifecycle spans**: `consensus.round` with round-to-round span links.
-- **Establish phase**: `consensus.establish`, `consensus.update_positions` (with
-  `dispute.resolve` events), `consensus.check` (with threshold tracking).
-- **Mode changes**: `consensus.mode_change` spans.
-- **Validation**: `consensus.validation.send` with span link to round span
-  (thread-safe cross-thread access via `roundSpanContext_` snapshot).
-- **Separation of concerns**: telemetry extracted to private helpers
-  (`startRoundTracing`, `createValidationSpan`, `startEstablishTracing`,
-  `updateEstablishTracing`, `endEstablishTracing`).
-
-The `Phase4_taskList.md` spec document is introduced in the Phase 2 PR (#6424)
-and will contain the full task breakdown and implementation notes.
-
----
-
-## 6.6 Phase 5: Documentation & Deployment (Week 9)
-
-**Objective**: Production readiness
-
-### Tasks
-
-| Task | Description                   |
-| ---- | ----------------------------- |
-| 5.1  | Operator runbook              |
-| 5.2  | Grafana dashboards            |
-| 5.3  | Alert definitions             |
-| 5.4  | Collector deployment examples |
-| 5.5  | Developer documentation       |
-| 5.6  | Training materials            |
-| 5.7  | Final integration testing     |
-
----
-
-## 6.7 Risk Assessment
-
-```mermaid
-quadrantChart
-    title Risk Assessment Matrix
-    x-axis Low Impact --> High Impact
-    y-axis Low Likelihood --> High Likelihood
-    quadrant-1 Mitigate Immediately
-    quadrant-2 Plan Mitigation
-    quadrant-3 Accept Risk
-    quadrant-4 Monitor Closely
-
-    SDK Compat: [0.2, 0.18]
-    Protocol Chg: [0.75, 0.72]
-    Perf Overhead: [0.58, 0.42]
-    Context Prop: [0.4, 0.55]
-    Memory Leaks: [0.85, 0.25]
-```
-
-### Risk Details
-
-| Risk                                 | Likelihood | Impact | Mitigation                              |
-| ------------------------------------ | ---------- | ------ | --------------------------------------- |
-| Protocol changes break compatibility | Medium     | High   | Use high field numbers, optional fields |
-| Performance overhead unacceptable    | Medium     | Medium | Sampling, conditional compilation       |
-| Context propagation complexity       | Medium     | Medium | Phased rollout, extensive testing       |
-| SDK compatibility issues             | Low        | Medium | Pin SDK version, fallback to no-op      |
-| Memory leaks in long-running nodes   | Low        | High   | Memory profiling, bounded queues        |
-
----
-
-## 6.8 Success Metrics
-
-| Metric                   | Target                                                         | Measurement           |
-| ------------------------ | -------------------------------------------------------------- | --------------------- |
-| Trace coverage           | >95% of transaction code paths (independent of sampling ratio) | Sampling verification |
-| CPU overhead             | <3%                                                            | Benchmark tests       |
-| Memory overhead          | <10 MB                                                         | Memory profiling      |
-| Latency impact (p99)     | <2%                                                            | Performance tests     |
-| Trace completeness       | >99% spans with required attrs                                 | Validation script     |
-| Cross-node trace linkage | >90% of multi-hop transactions                                 | Integration tests     |
-
----
-
-## 6.9 Quick Wins and Crawl-Walk-Run Strategy
-
-> **TxQ** = Transaction Queue
-
-This section outlines a prioritized approach to maximize ROI with minimal initial investment.
-
-### 6.9.1 Crawl-Walk-Run Overview
-
-<div align="center">
-
-```mermaid
-flowchart TB
-    subgraph crawl["🐢 CRAWL (Week 1-2)"]
-        direction LR
-        c1[Core SDK Setup] ~~~ c2[RPC Tracing Only] ~~~ c3[PathFinding + TxQ Tracing] ~~~ c4[Single Node]
-    end
-
-    subgraph walk["🚶 WALK (Week 3-5)"]
-        direction LR
-        w1[Transaction Tracing] ~~~ w2[Fee Escalation Tracing] ~~~ w3[Cross-Node Context] ~~~ w4[Basic Dashboards]
-    end
-
-    subgraph run["🏃 RUN (Week 6-9)"]
-        direction LR
-        r1[Consensus Tracing] ~~~ r2[Validator, Amendment,<br/>SHAMap Tracing] ~~~ r3[Full Correlation] ~~~ r4[Production Deploy]
-    end
-
-    crawl --> walk --> run
-
-    style crawl fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style walk fill:#bf360c,stroke:#8c2809,color:#fff
-    style run fill:#0d47a1,stroke:#082f6a,color:#fff
-    style c1 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style c2 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style c3 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style c4 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style w1 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style w2 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style w3 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style w4 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style r1 fill:#0d47a1,stroke:#082f6a,color:#fff
-    style r2 fill:#0d47a1,stroke:#082f6a,color:#fff
-    style r3 fill:#0d47a1,stroke:#082f6a,color:#fff
-    style r4 fill:#0d47a1,stroke:#082f6a,color:#fff
-```
-
-</div>
-
-**Reading the diagram:**
-
-- **CRAWL (Weeks 1-2)**: Minimal investment -- set up the SDK, instrument RPC and PathFinding/TxQ handlers, and verify on a single node. Delivers immediate latency visibility.
-- **WALK (Weeks 3-5)**: Expand to transaction lifecycle tracing, fee escalation, cross-node context propagation, and basic Grafana dashboards. This is where distributed tracing starts working.
-- **RUN (Weeks 6-9)**: Full consensus instrumentation, validator/amendment/SHAMap tracing, end-to-end correlation, and production deployment with sampling and alerting.
-- **Arrows (crawl → walk → run)**: Each phase builds on the prior one; you cannot skip ahead because later phases depend on infrastructure established earlier.
-
-### 6.9.2 Quick Wins (Immediate Value)
-
-| Quick Win                      | Value  | When to Deploy |
-| ------------------------------ | ------ | -------------- |
-| **RPC Command Tracing**        | High   | Week 2         |
-| **RPC Latency Histograms**     | High   | Week 2         |
-| **Error Rate Dashboard**       | Medium | Week 2         |
-| **Transaction Submit Tracing** | High   | Week 3         |
-| **Consensus Round Duration**   | Medium | Week 6         |
-
-### 6.9.3 CRAWL Phase (Weeks 1-2)
-
-**Goal**: Get basic tracing working with minimal code changes.
-
-**What You Get**:
-
-- RPC request/response traces for all commands
-- Latency breakdown per RPC command
-- PathFinding and TxQ tracing (directly impacts RPC latency)
-- Error visibility with stack traces
-- Basic Grafana dashboard
-
-**Code Changes**: ~15 lines in `ServerHandler.cpp`, ~40 lines in new telemetry module
-
-**Why Start Here**:
-
-- RPC is the lowest-risk, highest-visibility component
-- PathFinding and TxQ are RPC-adjacent and directly affect latency
-- Immediate value for debugging client issues
-- No cross-node complexity
-- Single file modification to existing code
-
-### 6.9.4 WALK Phase (Weeks 3-5)
-
-**Goal**: Add transaction lifecycle tracing across nodes.
-
-**What You Get**:
-
-- End-to-end transaction traces from submit to relay
-- Fee escalation tracing within the transaction pipeline
-- Cross-node correlation (see transaction path)
-- HashRouter deduplication visibility
-- Relay latency metrics
-
-**Code Changes**: ~120 lines across 4 files, plus protobuf extension
-
-**Why Do This Second**:
-
-- Builds on RPC tracing (transactions submitted via RPC)
-- Fee escalation is integral to the transaction processing pipeline
-- Moderate complexity (requires context propagation)
-- High value for debugging transaction issues
-
-### 6.9.5 RUN Phase (Weeks 6-9)
-
-**Goal**: Full observability including consensus.
-
-**What You Get**:
-
-- Complete consensus round visibility
-- Phase transition timing
-- Validator proposal tracking
-- Validator list and manifest tracing
-- Amendment voting tracing
-- SHAMap sync tracing
-- Full end-to-end traces (client → RPC → TX → consensus → ledger)
-
-**Code Changes**: ~100 lines across 3 consensus files, plus validator/amendment/SHAMap modules
-
-**Why Do This Last**:
-
-- Highest complexity (consensus is critical path)
-- Validator, amendment, and SHAMap components are lower priority
-- Requires thorough testing
-- Lower relative value (consensus issues are rarer)
-
-### 6.9.6 ROI Prioritization Matrix
-
-```mermaid
-quadrantChart
-    title Implementation ROI Matrix
-    x-axis Low Effort --> High Effort
-    y-axis Low Value --> High Value
-    quadrant-1 Quick Wins - Do First
-    quadrant-2 Major Projects - Plan Carefully
-    quadrant-3 Nice to Have - Optional
-    quadrant-4 Time Sinks - Avoid
-
-    RPC Tracing: [0.15, 0.92]
-    TX Submit Trace: [0.3, 0.78]
-    TX Relay Trace: [0.5, 0.88]
-    Consensus Trace: [0.72, 0.72]
-    Peer Msg Trace: [0.85, 0.3]
-    Ledger Acquire: [0.55, 0.52]
-```
-
----
-
-## 6.10 Definition of Done
-
-> **TxQ** = Transaction Queue | **HA** = High Availability
-
-Clear, measurable criteria for each phase.
-
-### 6.10.1 Phase 1: Core Infrastructure
-
-| Criterion       | Measurement                                                | Target                       |
-| --------------- | ---------------------------------------------------------- | ---------------------------- |
-| SDK Integration | `cmake --build` succeeds with `-DXRPL_ENABLE_TELEMETRY=ON` | ✅ Compiles                  |
-| Runtime Toggle  | `enabled=0` produces zero overhead                         | <0.1% CPU difference         |
-| Span Creation   | Unit test creates and exports span                         | Span appears in Tempo        |
-| Configuration   | All config options parsed correctly                        | Config validation tests pass |
-| Documentation   | Developer guide exists                                     | PR approved                  |
-
-**Definition of Done**: All criteria met, PR merged, no regressions in CI.
-
-### 6.10.2 Phase 2: RPC Tracing
-
-| Criterion          | Measurement                        | Target                     |
-| ------------------ | ---------------------------------- | -------------------------- |
-| Coverage           | All RPC commands instrumented      | 100% of commands           |
-| Context Extraction | traceparent header propagates      | Integration test passes    |
-| Attributes         | Command, status, duration recorded | Validation script confirms |
-| Performance        | RPC latency overhead               | <1ms p99                   |
-| Dashboard          | Grafana dashboard deployed         | Screenshot in docs         |
-
-**Definition of Done**: RPC traces visible in Tempo for all commands, dashboard shows latency distribution.
-
-### 6.10.3 Phase 3: Transaction Tracing
-
-| Criterion             | Measurement                                       | Target                                                   |
-| --------------------- | ------------------------------------------------- | -------------------------------------------------------- |
-| Local Trace           | Submit → validate → TxQ traced                    | Single-node test passes                                  |
-| Cross-Node            | Context propagates via protobuf                   | Multi-node test passes                                   |
-| Deterministic TraceID | Same trace_id on all nodes for same tx            | Multi-node test: query by txHash[0:16] returns all spans |
-| Relay Ordering        | Protobuf span_id propagation creates parent-child | Tempo trace tree shows relay chain                       |
-| Graceful Degradation  | Old peer drops trace_context                      | Spans still grouped by deterministic trace_id            |
-| Relay Visibility      | relay_count attribute correct                     | Spot check 100 txs                                       |
-| HashRouter            | Deduplication visible in trace                    | Duplicate txs show suppressed=true                       |
-| Performance           | TX throughput overhead                            | <5% degradation                                          |
-
-**Definition of Done**: Transaction traces span 3+ nodes in test network with deterministic trace_id correlation, parent-child ordering via protobuf propagation, and performance within bounds.
-
-### 6.10.4 Phase 4: Consensus Tracing
-
-| Criterion            | Measurement                   | Target                    |
-| -------------------- | ----------------------------- | ------------------------- |
-| Round Tracing        | startRound creates root span  | Unit test passes          |
-| Phase Visibility     | All phases have child spans   | Integration test confirms |
-| Proposer Attribution | Proposer ID in attributes     | Spot check 50 rounds      |
-| Timing Accuracy      | Phase durations match PerfLog | <5% variance              |
-| No Consensus Impact  | Round timing unchanged        | Performance test passes   |
-
-**Definition of Done**: Consensus rounds fully traceable, no impact on consensus timing.
-
-### 6.10.5 Phase 5: Production Deployment
-
-| Criterion    | Measurement                  | Target                     |
-| ------------ | ---------------------------- | -------------------------- |
-| Collector HA | Multiple collectors deployed | No single point of failure |
-| Sampling     | Tail sampling configured     | 10% base + errors + slow   |
-| Retention    | Data retained per policy     | 7 days hot, 30 days warm   |
-| Alerting     | Alerts configured            | Error spike, high latency  |
-| Runbook      | Operator documentation       | Approved by ops team       |
-| Training     | Team trained                 | Session completed          |
-
-**Definition of Done**: Telemetry running in production, operators trained, alerts active.
-
-### 6.10.6 Success Metrics Summary
-
-| Phase   | Primary Metric         | Secondary Metric            | Deadline      |
-| ------- | ---------------------- | --------------------------- | ------------- |
-| Phase 1 | SDK compiles and runs  | Zero overhead when disabled | End of Week 2 |
-| Phase 2 | 100% RPC coverage      | <1ms latency overhead       | End of Week 4 |
-| Phase 3 | Cross-node traces work | <5% throughput impact       | End of Week 6 |
-| Phase 4 | Consensus fully traced | No consensus timing impact  | End of Week 8 |
-| Phase 5 | Production deployment  | Operators trained           | End of Week 9 |
-
----
-
-## 6.11 Recommended Implementation Order
-
-Based on ROI analysis, implement in this exact order:
-
-```mermaid
-flowchart TB
-    subgraph week1["Week 1"]
-        t1[1. OpenTelemetry SDK<br/>Conan/CMake integration]
-        t2[2. Telemetry interface<br/>SpanGuard, config]
-    end
-
-    subgraph week2["Week 2"]
-        t3[3. RPC ServerHandler<br/>instrumentation]
-        t4[4. Basic Tempo setup<br/>for testing]
-    end
-
-    subgraph week3["Week 3"]
-        t5[5. Transaction submit<br/>tracing]
-        t6[6. Grafana dashboard<br/>v1]
-    end
-
-    subgraph week4["Week 4"]
-        t7[7. Protobuf context<br/>extension]
-        t8[8. PeerImp tx.relay<br/>instrumentation]
-    end
-
-    subgraph week5["Week 5"]
-        t9[9. Multi-node<br/>integration tests]
-        t10[10. Performance<br/>benchmarks]
-    end
-
-    subgraph week6_8["Weeks 6-8"]
-        t11[11. Consensus<br/>instrumentation]
-        t12[12. Full integration<br/>testing]
-    end
-
-    subgraph week9["Week 9"]
-        t13[13. Production<br/>deployment]
-        t14[14. Documentation<br/>& training]
-    end
-
-    t1 --> t2 --> t3 --> t4
-    t4 --> t5 --> t6
-    t6 --> t7 --> t8
-    t8 --> t9 --> t10
-    t10 --> t11 --> t12
-    t12 --> t13 --> t14
-
-    style week1 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style week2 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style week3 fill:#bf360c,stroke:#8c2809,color:#fff
-    style week4 fill:#bf360c,stroke:#8c2809,color:#fff
-    style week5 fill:#bf360c,stroke:#8c2809,color:#fff
-    style week6_8 fill:#0d47a1,stroke:#082f6a,color:#fff
-    style week9 fill:#4a148c,stroke:#2e0d57,color:#fff
-    style t1 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style t2 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style t3 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style t4 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style t5 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style t6 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style t7 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style t8 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style t9 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style t10 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
-    style t11 fill:#0d47a1,stroke:#082f6a,color:#fff
-    style t12 fill:#0d47a1,stroke:#082f6a,color:#fff
-    style t13 fill:#4a148c,stroke:#2e0d57,color:#fff
-    style t14 fill:#4a148c,stroke:#2e0d57,color:#fff
-```
-
-**Reading the diagram:**
-
-- **Week 1 (tasks 1-2)**: Foundation work -- integrate the OpenTelemetry SDK via Conan/CMake and build the `Telemetry` interface with `SpanGuard` and config parsing.
-- **Week 2 (tasks 3-4)**: First observable output -- instrument `ServerHandler` for RPC tracing and stand up Tempo so developers can see traces immediately.
-- **Weeks 3-5 (tasks 5-10)**: Transaction lifecycle -- add submit tracing, build the first Grafana dashboard, extend protobuf for cross-node context, instrument `PeerImp` relay, then validate with multi-node integration tests and performance benchmarks.
-- **Weeks 6-8 (tasks 11-12)**: Consensus deep-dive -- instrument consensus rounds and phases, then run full integration testing across all instrumented paths.
-- **Week 9 (tasks 13-14)**: Go-live -- deploy to production with sampling/alerting configured, and deliver documentation and operator training.
-- **Arrow chain (t1 → ... → t14)**: Strict sequential dependency; each task's output is a prerequisite for the next.
-
----
-
-_Previous: [Configuration Reference](./05-configuration-reference.md)_ | _Next: [Observability Backends](./07-observability-backends.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/07-observability-backends.md

@@ -1,407 +0,0 @@
-# Observability Backend Recommendations
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Implementation Phases](./06-implementation-phases.md) | [Appendix](./08-appendix.md)
-
----
-
-## 7.1 Development/Testing Backends
-
-> **OTLP** = OpenTelemetry Protocol
-
-| Backend    | Pros                                | Cons                   | Use Case            |
-| ---------- | ----------------------------------- | ---------------------- | ------------------- |
-| **Tempo**  | Cost-effective, Grafana integration | Requires Grafana stack | Local dev, CI, Prod |
-| **Zipkin** | Simple, lightweight                 | Basic features         | Quick prototyping   |
-
-### Quick Start with Tempo
-
-```bash
-# Start Tempo with OTLP support
-docker run -d --name tempo \
-    -p 3200:3200 \
-    -p 4317:4317 \
-    -p 4318:4318 \
-    grafana/tempo:2.6.1
-```
-
----
-
-## 7.2 Production Backends
-
-> **APM** = Application Performance Monitoring
-
-| Backend           | Pros                                      | Cons                   | Use Case                    |
-| ----------------- | ----------------------------------------- | ---------------------- | --------------------------- |
-| **Grafana Tempo** | Cost-effective, Grafana integration       | Requires Grafana stack | Most production deployments |
-| **Elastic APM**   | Full observability stack, log correlation | Resource intensive     | Existing Elastic users      |
-| **Honeycomb**     | Excellent query, high cardinality         | SaaS cost              | Deep debugging needs        |
-| **Datadog APM**   | Full platform, easy setup                 | SaaS cost              | Enterprise with budget      |
-
-### Backend Selection Flowchart
-
-```mermaid
-flowchart TD
-    start[Select Backend] --> budget{Budget<br/>Constraints?}
-
-    budget -->|Yes| oss[Open Source]
-    budget -->|No| saas{Prefer<br/>SaaS?}
-
-    oss --> existing{Existing<br/>Stack?}
-    existing -->|Grafana| tempo[Grafana Tempo]
-    existing -->|Elastic| elastic[Elastic APM]
-    existing -->|None| tempo
-
-    saas -->|Yes| enterprise{Enterprise<br/>Support?}
-    saas -->|No| oss
-
-    enterprise -->|Yes| datadog[Datadog APM]
-    enterprise -->|No| honeycomb[Honeycomb]
-
-    tempo --> final[Configure Collector]
-    elastic --> final
-    honeycomb --> final
-    datadog --> final
-
-    style start fill:#0f172a,stroke:#020617,color:#fff
-    style budget fill:#334155,stroke:#1e293b,color:#fff
-    style oss fill:#1e293b,stroke:#0f172a,color:#fff
-    style existing fill:#334155,stroke:#1e293b,color:#fff
-    style saas fill:#334155,stroke:#1e293b,color:#fff
-    style enterprise fill:#334155,stroke:#1e293b,color:#fff
-    style final fill:#0f172a,stroke:#020617,color:#fff
-    style tempo fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style elastic fill:#bf360c,stroke:#8c2809,color:#fff
-    style honeycomb fill:#0d47a1,stroke:#082f6a,color:#fff
-    style datadog fill:#4a148c,stroke:#2e0d57,color:#fff
-```
-
-**Reading the diagram:**
-
-- **Budget Constraints? (Yes)**: Leads to open-source options. If you already run Grafana or Elastic, pick the matching backend; otherwise default to Grafana Tempo.
-- **Budget Constraints? (No) → Prefer SaaS?**: If you want a managed service, choose between Datadog (enterprise support) and Honeycomb (developer-focused). If not, fall back to open-source.
-- **Terminal nodes (Tempo / Elastic / Honeycomb / Datadog)**: Each represents a concrete backend choice, all of which feed into the same final step.
-- **Configure Collector**: Regardless of backend, you always finish by configuring the OTel Collector to export to your chosen destination.
-
----
-
-## 7.3 Recommended Production Architecture
-
-> **OTLP** = OpenTelemetry Protocol | **APM** = Application Performance Monitoring | **HA** = High Availability
-
-```mermaid
-flowchart TB
-    subgraph validators["Validator Nodes"]
-        v1[xrpld<br/>Validator 1]
-        v2[xrpld<br/>Validator 2]
-    end
-
-    subgraph stock["Stock Nodes"]
-        s1[xrpld<br/>Stock 1]
-        s2[xrpld<br/>Stock 2]
-    end
-
-    subgraph collector["OTel Collector Cluster"]
-        c1[Collector<br/>DC1]
-        c2[Collector<br/>DC2]
-    end
-
-    subgraph backends["Storage Backends"]
-        tempo[(Grafana<br/>Tempo)]
-        elastic[(Elastic<br/>APM)]
-        archive[(S3/GCS<br/>Archive)]
-    end
-
-    subgraph ui["Visualization"]
-        grafana[Grafana<br/>Dashboards]
-    end
-
-    v1 -->|OTLP| c1
-    v2 -->|OTLP| c1
-    s1 -->|OTLP| c2
-    s2 -->|OTLP| c2
-
-    c1 --> tempo
-    c1 --> elastic
-    c2 --> tempo
-    c2 --> archive
-
-    tempo --> grafana
-    elastic --> grafana
-
-    %% Note: simplified single-collector-per-DC topology shown for clarity
-
-    style validators fill:#b71c1c,stroke:#7f1d1d,color:#ffffff
-    style stock fill:#0d47a1,stroke:#082f6a,color:#ffffff
-    style collector fill:#bf360c,stroke:#8c2809,color:#ffffff
-    style backends fill:#1b5e20,stroke:#0d3d14,color:#ffffff
-    style ui fill:#4a148c,stroke:#2e0d57,color:#ffffff
-```
-
-**Reading the diagram:**
-
-- **Validator / Stock Nodes**: All xrpld nodes emit trace data via OTLP. Validators and stock nodes are grouped separately because they may reside in different network zones.
-- **Collector Cluster (DC1, DC2)**: Regional collectors receive OTLP from nodes in their datacenter, apply processing (sampling, enrichment), and fan out to multiple backends. Enrichment includes deployment-tier tagging: each collector stamps `deployment.environment` and (as a fallback) `xrpl.network.type` so one Grafana stack can filter data from many collectors by tier.
-- **Storage Backends**: Tempo and Elastic provide queryable trace storage; S3/GCS Archive provides long-term cold storage for compliance or post-incident analysis.
-- **Grafana Dashboards**: The single visualization layer that queries both Tempo and Elastic, giving operators a unified view of all traces.
-- **Data flow direction**: Nodes → Collectors → Storage → Grafana. Each arrow represents a network hop; minimizing collector-to-backend hops reduces latency.
-
-> **Note**: Production deployments should use multiple collector instances behind a load balancer for high availability. The diagram shows a simplified single-collector topology for clarity.
-
----
-
-## 7.4 Architecture Considerations
-
-### 7.4.1 Collector Placement
-
-| Strategy      | Description          | Pros                     | Cons                    |
-| ------------- | -------------------- | ------------------------ | ----------------------- |
-| **Sidecar**   | Collector per node   | Isolation, simple config | Resource overhead       |
-| **DaemonSet** | Collector per host   | Shared resources         | Complexity              |
-| **Gateway**   | Central collector(s) | Centralized processing   | Single point of failure |
-
-**Recommendation**: Use **Gateway** pattern with regional collectors for xrpld networks:
-
-- One collector cluster per datacenter/region
-- Tail-based sampling at collector level
-- Multiple export destinations for redundancy
-
-### 7.4.2 Sampling Strategy
-
-```mermaid
-flowchart LR
-    subgraph head["Head Sampling (Node)"]
-        hs[Node-level head sampling<br/>fixed at 100%<br/>not configurable]
-    end
-
-    subgraph tail["Tail Sampling (Collector)"]
-        ts1[Keep all errors]
-        ts2[Keep slow >5s]
-        ts3[Keep 10% rest]
-    end
-
-    head --> tail
-
-    ts1 --> final[Final Traces]
-    ts2 --> final
-    ts3 --> final
-
-    style head fill:#0d47a1,stroke:#082f6a,color:#fff
-    style tail fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style hs fill:#0d47a1,stroke:#082f6a,color:#fff
-    style ts1 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style ts2 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style ts3 fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style final fill:#bf360c,stroke:#8c2809,color:#fff
-```
-
-**Reading the diagram:**
-
-- **Head Sampling (Node)**: xrpld pins head sampling at 100% (sample everything) and does not expose a configurable ratio. This is intentional: a per-node ratio would let different nodes make divergent keep/drop decisions for the same distributed trace, producing broken/partial traces. xrpld uses a `ParentBased` sampler so spans inheriting a remote parent honor the upstream decision. Volume reduction is delegated to the collector's tail sampling.
-- **Tail Sampling (Collector)**: The second filter -- the collector inspects completed traces and applies rules: keep all errors, keep anything slower than 5 seconds, and keep 10% of the remainder.
-- **Arrow head → tail**: All head-sampled traces flow to the collector, where tail sampling further reduces volume while preserving the most valuable data.
-- **Final Traces**: The output after both sampling stages; this is what gets stored and queried. The two-stage approach balances cost with debuggability.
-
-### 7.4.3 Data Retention
-
-| Environment | Hot Storage | Warm Storage | Cold Archive |
-| ----------- | ----------- | ------------ | ------------ |
-| Development | 24 hours    | N/A          | N/A          |
-| Staging     | 7 days      | N/A          | N/A          |
-| Production  | 7 days      | 30 days      | many years   |
-
----
-
-## 7.5 Integration Checklist
-
-- [ ] Choose primary backend (Tempo recommended for cost/features)
-- [ ] Deploy collector cluster with high availability
-- [ ] Configure tail-based sampling for error/latency traces
-- [ ] Set up Grafana dashboards for trace visualization
-- [ ] Configure alerts for trace anomalies
-- [ ] Establish data retention policies
-- [ ] Test trace correlation with logs and metrics
-
----
-
-## 7.6 Grafana Dashboard Examples
-
-Pre-built dashboards for xrpld observability.
-
-### 7.6.1 Consensus Health Dashboard
-
-A Tempo-backed dashboard (uid `xrpld-consensus-health`) with four panels, all driven by TraceQL:
-
-- **Consensus Round Duration** (timeseries, ms): average `consensus.round` span duration per node instance, with yellow/red thresholds at 4s/5s.
-- **Phase Duration Breakdown** (barchart): average duration of `consensus.phase.*` spans grouped by span name.
-- **Proposers per Round** (stat): average of the `span.proposers` attribute on `consensus.round` spans.
-- **Recent Slow Rounds (>5s)** (table): `consensus.round` spans filtered to `duration > 5s`.
-
-Each panel's TraceQL query is described inline in its bullet above.
-
-### 7.6.2 Node Overview Dashboard
-
-A Tempo-backed dashboard (uid `xrpld-node-overview`) with four panels:
-
-- **Active Nodes** (stat): count of distinct `resource.service.instance.id` values seen for the `xrpld` service.
-- **Total Transactions (1h)** (stat): count of `tx.receive` spans.
-- **Error Rate** (gauge, percent): ratio of `status.code=error` spans to all spans, with yellow/red thresholds at 1%/5%.
-- **Service Map** (nodeGraph): Tempo-generated service dependency graph.
-
-### 7.6.3 Alert Rules
-
-Grafana provisions three TraceQL-based alert rules (group `xrpld-tracing-alerts`, evaluated every 1m) against the Tempo datasource:
-
-- **Consensus Round Slow** (warning, `for: 5m`): fires when average `consensus.round` duration exceeds 5s.
-
-  ```
-  {resource.service.name="xrpld" && name="consensus.round"} | avg(duration) > 5s
-  ```
-
-- **RPC Error Rate Spike** (critical, `for: 2m`): fires when the error rate across `rpc.command.*` spans exceeds 5%. Error _rate_ is a ratio, so it must divide the error-span rate by the total-span rate — a single TraceQL `rate()` returns spans/second, not a percentage, and would fire on traffic volume alone. This uses span metrics emitted by the collector's `spanmetrics` connector (Prometheus datasource), not a TraceQL query:
-
-  ```
-  sum(rate(traces_spanmetrics_calls_total{service_name="xrpld", span_name=~"rpc.command.*", status_code="STATUS_CODE_ERROR"}[5m]))
-  /
-  sum(rate(traces_spanmetrics_calls_total{service_name="xrpld", span_name=~"rpc.command.*"}[5m]))
-  > 0.05
-  ```
-
-- **Transaction Throughput Drop** (warning, `for: 10m`): fires when the `tx.receive` span rate falls below 10/s.
-
-  ```
-  {resource.service.name="xrpld" && name="tx.receive"} | rate() < 10
-  ```
-
-> **Note**: The Consensus Round Slow and Transaction Throughput Drop rules use TraceQL aggregates (`avg(duration)`, `rate()`), which require Tempo 2.3+ with TraceQL metrics enabled. Verify aggregate query support in your Tempo version before provisioning. The RPC Error Rate Spike rule instead queries Prometheus span metrics (collector `spanmetrics` connector), so it needs that connector enabled in the collector pipeline.
-
----
-
-## 7.7 PerfLog and Insight Correlation
-
-> **OTLP** = OpenTelemetry Protocol
-
-How to correlate OpenTelemetry traces with existing xrpld observability.
-
-### 7.7.1 Correlation Architecture
-
-```mermaid
-flowchart TB
-    subgraph xrpld["xrpld Node"]
-        otel[OpenTelemetry<br/>Spans]
-        perflog[PerfLog<br/>JSON Logs]
-        insight[Beast Insight<br/>StatsD Metrics]
-    end
-
-    subgraph collectors["Data Collection"]
-        otelc[OTel Collector]
-        promtail[Promtail/Fluentd]
-        statsd[StatsD Exporter]
-    end
-
-    subgraph storage["Storage"]
-        tempo[(Tempo)]
-        loki[(Loki)]
-        prom[(Prometheus)]
-    end
-
-    subgraph grafana["Grafana"]
-        traces[Trace View]
-        logs[Log View]
-        metrics[Metrics View]
-        corr[Correlation<br/>Panel]
-    end
-
-    otel -->|OTLP| otelc --> tempo
-    perflog -->|JSON| promtail --> loki
-    insight -->|StatsD| statsd --> prom
-
-    tempo --> traces
-    loki --> logs
-    prom --> metrics
-
-    traces --> corr
-    logs --> corr
-    metrics --> corr
-
-    style xrpld fill:#0d47a1,stroke:#082f6a,color:#fff
-    style collectors fill:#bf360c,stroke:#8c2809,color:#fff
-    style storage fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style grafana fill:#4a148c,stroke:#2e0d57,color:#fff
-    style otel fill:#0d47a1,stroke:#082f6a,color:#fff
-    style perflog fill:#0d47a1,stroke:#082f6a,color:#fff
-    style insight fill:#0d47a1,stroke:#082f6a,color:#fff
-    style otelc fill:#bf360c,stroke:#8c2809,color:#fff
-    style promtail fill:#bf360c,stroke:#8c2809,color:#fff
-    style statsd fill:#bf360c,stroke:#8c2809,color:#fff
-    style tempo fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style loki fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style prom fill:#1b5e20,stroke:#0d3d14,color:#fff
-    style traces fill:#4a148c,stroke:#2e0d57,color:#fff
-    style logs fill:#4a148c,stroke:#2e0d57,color:#fff
-    style metrics fill:#4a148c,stroke:#2e0d57,color:#fff
-    style corr fill:#4a148c,stroke:#2e0d57,color:#fff
-```
-
-**Reading the diagram:**
-
-- **xrpld Node (three sources)**: A single node emits three independent data streams -- OpenTelemetry spans, PerfLog JSON logs, and Beast Insight StatsD metrics.
-- **Data Collection layer**: Each stream has its own collector -- OTel Collector for spans, Promtail/Fluentd for logs, and a StatsD exporter for metrics. They operate independently.
-- **Storage layer (Tempo, Loki, Prometheus)**: Each data type lands in a purpose-built store optimized for its query patterns (trace search, log grep, metric aggregation).
-- **Grafana Correlation Panel**: The key integration point -- Grafana queries all three stores and links them via shared fields (`trace_id`, `tx_hash`, `ledger_seq`), enabling a single-pane debugging experience.
-
-### 7.7.2 Correlation Fields
-
-| Source      | Field               | Link To       | Purpose                    |
-| ----------- | ------------------- | ------------- | -------------------------- |
-| **Trace**   | `trace_id`          | Logs          | Find log entries for trace |
-| **Trace**   | `tx_hash`           | Logs, Metrics | Find TX-related data       |
-| **Trace**   | `ledger_seq`        | Logs          | Find ledger-related logs   |
-| **PerfLog** | `trace_id` (new)    | Traces        | Jump to trace from log     |
-| **PerfLog** | `ledger_seq`        | Traces        | Find consensus trace       |
-| **Insight** | `exemplar.trace_id` | Traces        | Jump from metric spike     |
-
-### 7.7.3 Example: Debugging a Slow Transaction
-
-**Step 1: Find the trace**
-
-```
-# In Grafana Explore with Tempo
-{resource.service.name="xrpld" && span.tx_hash="ABC123..."}
-```
-
-**Step 2: Get the trace_id from the trace view**
-
-```
-Trace ID: 4bf92f3577b34da6a3ce929d0e0e4736
-```
-
-**Step 3: Find related PerfLog entries**
-
-```
-# In Grafana Explore with Loki
-{job="xrpld"} |= "4bf92f3577b34da6a3ce929d0e0e4736"
-```
-
-**Step 4: Check Insight metrics for the time window**
-
-```
-# In Grafana with Prometheus
-rate(xrpld_tx_applied_total[1m])
-  @ timestamp_from_trace
-```
-
-### 7.7.4 Unified Dashboard Example
-
-A single dashboard (uid `xrpld-unified`) that ties traces, metrics, and logs together across the Tempo, Prometheus, and Loki datasources:
-
-- **Transaction Latency (Traces)** (timeseries, Tempo): `histogram_over_time(duration)` of `tx.receive` spans.
-- **Transaction Rate (Metrics)** (timeseries, Prometheus): `rate(xrpld_tx_received_total[5m])` per instance, with a data link that opens the matching `tx.receive` traces in Tempo.
-- **Recent Logs** (logs, Loki): `{job="xrpld"} | json`.
-- **Trace Search** (table, Tempo): all `xrpld` traces, with per-row data links on `traceID` that jump to the trace in Tempo and to the correlated logs in Loki (`{job="xrpld"} |= "<traceID>"`).
-
-The cross-datasource data links are what make this a single-pane debugging view; the correlation fields they rely on are listed in section 7.7.2.
-
----
-
-_Previous: [Implementation Phases](./06-implementation-phases.md)_ | _Next: [Appendix](./08-appendix.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/08-appendix.md

@@ -1,197 +0,0 @@
-# Appendix
-
-> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
-> **Related**: [Observability Backends](./07-observability-backends.md)
-
----
-
-## 8.1 Glossary
-
-> **OTLP** = OpenTelemetry Protocol | **TxQ** = Transaction Queue
-
-| Term                  | Definition                                                 |
-| --------------------- | ---------------------------------------------------------- |
-| **Span**              | A unit of work with start/end time, name, and attributes   |
-| **Trace**             | A collection of spans representing a complete request flow |
-| **Trace ID**          | 128-bit unique identifier for a trace                      |
-| **Span ID**           | 64-bit unique identifier for a span within a trace         |
-| **Context**           | Carrier for trace/span IDs across boundaries               |
-| **Propagator**        | Component that injects/extracts context                    |
-| **Sampler**           | Decides which traces to record                             |
-| **Exporter**          | Sends spans to backend                                     |
-| **Collector**         | Receives, processes, and forwards telemetry                |
-| **OTLP**              | OpenTelemetry Protocol (wire format)                       |
-| **W3C Trace Context** | Standard HTTP headers for trace propagation                |
-| **Baggage**           | Key-value pairs propagated across service boundaries       |
-| **Resource**          | Entity producing telemetry (service, host, etc.)           |
-| **Instrumentation**   | Code that creates telemetry data                           |
-
-### xrpld-Specific Terms
-
-| Term              | Definition                                                    |
-| ----------------- | ------------------------------------------------------------- |
-| **Overlay**       | P2P network layer managing peer connections                   |
-| **Consensus**     | XRP Ledger consensus algorithm (RCL)                          |
-| **Proposal**      | Validator's suggested transaction set for a ledger            |
-| **Validation**    | Validator's signature on a closed ledger                      |
-| **HashRouter**    | Component for transaction deduplication                       |
-| **JobQueue**      | Thread pool for asynchronous task execution                   |
-| **PerfLog**       | Existing performance logging system in xrpld                  |
-| **Beast Insight** | Existing metrics framework in xrpld                           |
-| **PathFinding**   | Payment path computation engine for cross-currency payments   |
-| **TxQ**           | Transaction queue managing fee-based prioritization           |
-| **LoadManager**   | Dynamic fee escalation based on network load                  |
-| **SHAMap**        | SHA-256 hash-based map (Merkle trie variant) for ledger state |
-
----
-
-## 8.2 Span Hierarchy Visualization
-
-> **TxQ** = Transaction Queue
-
-```mermaid
-flowchart TB
-    subgraph trace["Trace: Transaction Lifecycle"]
-        rpc["rpc.request<br/>(entry point)"]
-        validate["tx.validate"]
-        relay["tx.relay<br/>(parent span)"]
-
-        subgraph peers["Peer Spans"]
-            p1["peer.send<br/>Peer A"]
-            p2["peer.send<br/>Peer B"]
-            p3["peer.send<br/>Peer C"]
-        end
-
-        subgraph pathfinding["PathFinding Spans"]
-            pathfind["pathfind.request"]
-            pathcomp["pathfind.compute"]
-        end
-
-        consensus["consensus.round"]
-        apply["tx.apply"]
-
-        subgraph txqueue["TxQ Spans"]
-            txq["txq.enqueue"]
-            txqApply["txq.apply"]
-        end
-
-        feeCalc["fee.escalate"]
-    end
-
-    subgraph validators["Validator Spans"]
-        valFetch["validator.list.fetch"]
-        valManifest["validator.manifest"]
-    end
-
-    rpc --> validate
-    rpc --> pathfind
-    pathfind --> pathcomp
-    validate --> relay
-    relay --> p1
-    relay --> p2
-    relay --> p3
-    p1 -.->|"context propagation"| consensus
-    consensus --> apply
-    apply --> txq
-    txq --> txqApply
-    txq --> feeCalc
-
-    style trace fill:#0f172a,stroke:#020617,color:#fff
-    style peers fill:#1e3a8a,stroke:#172554,color:#fff
-    style pathfinding fill:#134e4a,stroke:#0f766e,color:#fff
-    style txqueue fill:#064e3b,stroke:#047857,color:#fff
-    style validators fill:#4c1d95,stroke:#6d28d9,color:#fff
-    style rpc fill:#1d4ed8,stroke:#1e40af,color:#fff
-    style validate fill:#047857,stroke:#064e3b,color:#fff
-    style relay fill:#047857,stroke:#064e3b,color:#fff
-    style p1 fill:#0e7490,stroke:#155e75,color:#fff
-    style p2 fill:#0e7490,stroke:#155e75,color:#fff
-    style p3 fill:#0e7490,stroke:#155e75,color:#fff
-    style consensus fill:#fef3c7,stroke:#fde68a,color:#1e293b
-    style apply fill:#047857,stroke:#064e3b,color:#fff
-    style pathfind fill:#0e7490,stroke:#155e75,color:#fff
-    style pathcomp fill:#0e7490,stroke:#155e75,color:#fff
-    style txq fill:#047857,stroke:#064e3b,color:#fff
-    style txqApply fill:#047857,stroke:#064e3b,color:#fff
-    style feeCalc fill:#047857,stroke:#064e3b,color:#fff
-    style valFetch fill:#6d28d9,stroke:#4c1d95,color:#fff
-    style valManifest fill:#6d28d9,stroke:#4c1d95,color:#fff
-```
-
-**Reading the diagram:**
-
-- **rpc.request (blue, top)**: The entry point — every traced transaction starts as an RPC call; this root span is the parent of all downstream work.
-- **tx.validate and pathfind.request (green/teal, first fork)**: The RPC request fans out into transaction validation and, for cross-currency payments, a PathFinding branch (`pathfind.request` -> `pathfind.compute`).
-- **tx.relay -> Peer Spans (teal, middle)**: After validation, the transaction is relayed to peers A, B, and C in parallel; each `peer.send` is a sibling child span showing fan-out across the network.
-- **context propagation (dashed arrow)**: The dotted line from `peer.send Peer A` to `consensus.round` represents the trace context crossing a node boundary — the receiving validator picks up the same `trace_id` and continues the trace.
-- **consensus.round -> tx.apply -> TxQ Spans (green, lower)**: Once consensus accepts the transaction, it is applied to the ledger; the TxQ spans (`txq.enqueue`, `txq.apply`, `fee.escalate`) capture queue depth and fee escalation behavior.
-- **Validator Spans (purple, detached)**: `validator.list.fetch` and `validator.manifest` are independent workflows for UNL management — they run on their own traces and are linked to consensus via Span Links, not parent-child relationships.
-
----
-
-## 8.3 References
-
-> **OTLP** = OpenTelemetry Protocol
-
-### OpenTelemetry Resources
-
-1. [OpenTelemetry C++ SDK](https://github.com/open-telemetry/opentelemetry-cpp)
-2. [OpenTelemetry Specification](https://opentelemetry.io/docs/specs/otel/)
-3. [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/)
-4. [OTLP Protocol Specification](https://opentelemetry.io/docs/specs/otlp/)
-
-### Standards
-
-5. [W3C Trace Context](https://www.w3.org/TR/trace-context/)
-6. [W3C Baggage](https://www.w3.org/TR/baggage/)
-7. [Protocol Buffers](https://protobuf.dev/)
-
-### xrpld Resources
-
-8. [xrpld Source Code](https://github.com/XRPLF/rippled)
-9. [XRP Ledger Documentation](https://xrpl.org/docs/)
-10. [xrpld Overlay README](https://github.com/XRPLF/rippled/blob/develop/src/xrpld/overlay/README.md)
-11. [xrpld RPC README](https://github.com/XRPLF/rippled/blob/develop/src/xrpld/rpc/README.md)
-12. [xrpld Consensus README](https://github.com/XRPLF/rippled/blob/develop/src/xrpld/app/consensus/README.md)
-
----
-
-## 8.4 Version History
-
-| Version | Date       | Author | Changes                                                        |
-| ------- | ---------- | ------ | -------------------------------------------------------------- |
-| 1.0     | 2026-02-12 | -      | Initial implementation plan                                    |
-| 1.1     | 2026-02-13 | -      | Refactored into modular documents                              |
-| 1.2     | 2026-03-24 | -      | Review fixes: accuracy corrections, cross-document consistency |
-
----
-
-## 8.5 Document Index
-
-### Plan Documents
-
-| Document                                                         | Description                                        |
-| ---------------------------------------------------------------- | -------------------------------------------------- |
-| [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)                   | Master overview and executive summary              |
-| [00-tracing-fundamentals.md](./00-tracing-fundamentals.md)       | Distributed tracing concepts and OTel primer       |
-| [01-architecture-analysis.md](./01-architecture-analysis.md)     | xrpld architecture and trace points                |
-| [02-design-decisions.md](./02-design-decisions.md)               | SDK selection, exporters, span conventions         |
-| [03-implementation-strategy.md](./03-implementation-strategy.md) | Directory structure, performance analysis          |
-| [05-configuration-reference.md](./05-configuration-reference.md) | xrpld config, CMake, Collector configs             |
-| [06-implementation-phases.md](./06-implementation-phases.md)     | Timeline, tasks, risks, success metrics            |
-| [07-observability-backends.md](./07-observability-backends.md)   | Backend selection and architecture                 |
-| [08-appendix.md](./08-appendix.md)                               | Glossary, references, version history              |
-| [secure-OTel.md](./secure-OTel.md)                               | Threat model and hardening (mTLS, peer validation) |
-
-### Task Lists
-
-| Document                                   | Description                          |
-| ------------------------------------------ | ------------------------------------ |
-| [Phase2_taskList.md](./Phase2_taskList.md) | RPC layer trace instrumentation      |
-| [Phase3_taskList.md](./Phase3_taskList.md) | Peer overlay & consensus tracing     |
-| [Phase4_taskList.md](./Phase4_taskList.md) | Transaction lifecycle tracing        |
-| [Phase5_taskList.md](./Phase5_taskList.md) | Ledger processing & advanced tracing |
-
----
-
-_Previous: [Observability Backends](./07-observability-backends.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/OpenTelemetryPlan.md

@@ -1,211 +0,0 @@
-# [OpenTelemetry](00-tracing-fundamentals.md) Distributed Tracing Implementation Plan for xrpld
-
-## Executive Summary
-
-> **OTLP** = OpenTelemetry Protocol
-
-This document provides a comprehensive implementation plan for integrating OpenTelemetry distributed tracing into the xrpld XRP Ledger node software. The plan addresses the unique challenges of a decentralized peer-to-peer system where trace context must propagate across network boundaries between independent nodes.
-
-### Key Benefits
-
-- **End-to-end transaction visibility**: Track transactions from submission through consensus to ledger inclusion
-- **Consensus round analysis**: Understand timing and behavior of consensus phases across validators
-- **RPC performance insights**: Identify slow handlers and optimize response times
-- **Network topology understanding**: Visualize message propagation patterns between peers
-- **Incident debugging**: Correlate events across distributed nodes during issues
-
-### Estimated Performance Overhead
-
-| Metric        | Overhead   | Notes                                            |
-| ------------- | ---------- | ------------------------------------------------ |
-| CPU           | 1-3%       | Span creation and attribute setting              |
-| Memory        | <10 MB     | SDK statics + batch buffer + worker thread stack |
-| Network       | 10-50 KB/s | Compressed OTLP export to collector              |
-| Latency (p99) | <2%        | With proper sampling configuration               |
-
----
-
-## Document Structure
-
-This implementation plan is organized into modular documents for easier navigation:
-
-<div align="center">
-
-```mermaid
-flowchart TB
-    overview["📋 OpenTelemetryPlan.md<br/>(This Document)"]
-
-    subgraph fundamentals["Fundamentals"]
-        fund["00-tracing-fundamentals.md"]
-    end
-
-    subgraph analysis["Analysis & Design"]
-        arch["01-architecture-analysis.md"]
-        design["02-design-decisions.md"]
-    end
-
-    subgraph impl["Implementation"]
-        strategy["03-implementation-strategy.md"]
-        config["05-configuration-reference.md"]
-    end
-
-    subgraph deploy["Deployment & Planning"]
-        phases["06-implementation-phases.md"]
-        backends["07-observability-backends.md"]
-        appendix["08-appendix.md"]
-        secure["secure-OTel.md"]
-    end
-
-    overview --> fundamentals
-    overview --> analysis
-    overview --> impl
-    overview --> deploy
-
-    fund --> arch
-    arch --> design
-    design --> strategy
-    strategy --> config
-    config --> phases
-    phases --> backends
-    backends --> appendix
-    backends --> secure
-
-    style overview fill:#1b5e20,stroke:#0d3d14,color:#fff,stroke-width:2px
-    style fundamentals fill:#00695c,stroke:#004d40,color:#fff
-    style fund fill:#00695c,stroke:#004d40,color:#fff
-    style analysis fill:#0d47a1,stroke:#082f6a,color:#fff
-    style impl fill:#bf360c,stroke:#8c2809,color:#fff
-    style deploy fill:#4a148c,stroke:#2e0d57,color:#fff
-    style arch fill:#0d47a1,stroke:#082f6a,color:#fff
-    style design fill:#0d47a1,stroke:#082f6a,color:#fff
-    style strategy fill:#bf360c,stroke:#8c2809,color:#fff
-    style config fill:#bf360c,stroke:#8c2809,color:#fff
-    style phases fill:#4a148c,stroke:#2e0d57,color:#fff
-    style backends fill:#4a148c,stroke:#2e0d57,color:#fff
-    style appendix fill:#4a148c,stroke:#2e0d57,color:#fff
-    style secure fill:#4a148c,stroke:#2e0d57,color:#fff
-```
-
-</div>
-
----
-
-## Table of Contents
-
-| Section | Document                                                   | Description                                                            |
-| ------- | ---------------------------------------------------------- | ---------------------------------------------------------------------- |
-| **0**   | [Tracing Fundamentals](./00-tracing-fundamentals.md)       | Distributed tracing concepts, span relationships, context propagation  |
-| **1**   | [Architecture Analysis](./01-architecture-analysis.md)     | xrpld component analysis, trace points, instrumentation priorities     |
-| **2**   | [Design Decisions](./02-design-decisions.md)               | SDK selection, exporters, span naming, attributes, context propagation |
-| **3**   | [Implementation Strategy](./03-implementation-strategy.md) | Directory structure, key principles, performance optimization          |
-| **5**   | [Configuration Reference](./05-configuration-reference.md) | xrpld config, CMake integration, Collector configurations              |
-| **6**   | [Implementation Phases](./06-implementation-phases.md)     | 5-phase timeline, tasks, risks, success metrics                        |
-| **7**   | [Observability Backends](./07-observability-backends.md)   | Backend selection guide and production architecture                    |
-| **8**   | [Appendix](./08-appendix.md)                               | Glossary, references, version history                                  |
-| **Sec** | [Securing the OTel Pipeline](./secure-OTel.md)             | Threat model and hardening (mTLS, peer trace-context validation)       |
-
----
-
-## 0. Tracing Fundamentals
-
-This document introduces distributed tracing concepts for readers unfamiliar with the domain. It covers what traces and spans are, how parent-child and follows-from relationships model causality, how context propagates across service boundaries, and how sampling controls data volume. It also maps these concepts to xrpld-specific scenarios like transaction relay and consensus.
-
-➡️ **[Read Tracing Fundamentals](./00-tracing-fundamentals.md)**
-
----
-
-## 1. Architecture Analysis
-
-> **WS** = WebSocket | **TxQ** = Transaction Queue
-
-The xrpld node consists of several key components that require instrumentation for comprehensive distributed tracing. The main areas include the RPC server (HTTP/WebSocket), Overlay P2P network, Consensus mechanism (RCLConsensus), JobQueue for async task execution, PathFinding, Transaction Queue (TxQ), fee escalation (LoadManager), ledger acquisition, validator management, and existing observability infrastructure (PerfLog, Insight/StatsD, Journal logging).
-
-Key trace points span across transaction submission via RPC, peer-to-peer message propagation, consensus round execution, ledger building, path computation, transaction queue behavior, fee escalation, and validator health. The implementation prioritizes high-value, low-risk components first: RPC handlers provide immediate value with minimal risk, while consensus tracing requires careful implementation to avoid timing impacts.
-
-➡️ **[Read full Architecture Analysis](./01-architecture-analysis.md)**
-
----
-
-## 2. Design Decisions
-
-> **OTLP** = OpenTelemetry Protocol | **CNCF** = Cloud Native Computing Foundation
-
-The OpenTelemetry C++ SDK is selected for its CNCF backing, active development, and native performance characteristics. Traces are exported via OTLP/HTTP to an OpenTelemetry Collector, which provides flexible routing and sampling. OTLP/gRPC is planned future work (see design decisions §2.2.2).
-
-Span naming follows a hierarchical `<component>.<operation>` convention (e.g., `rpc.submit`, `tx.relay`, `consensus.round`). Context propagation uses W3C Trace Context headers for HTTP and embedded Protocol Buffer fields for P2P messages. The implementation coexists with existing PerfLog and Insight observability systems through correlation IDs.
-
-**Data Collection & Privacy**: Telemetry collects only operational metadata (timing, counts, hashes) — never sensitive content (private keys, balances, amounts, raw payloads). Privacy protection includes account hashing, configurable redaction, sampling, and collector-level filtering. Node operators retain full control over telemetry configuration.
-
-➡️ **[Read full Design Decisions](./02-design-decisions.md)**
-
----
-
-## 3. Implementation Strategy
-
-The telemetry code is organized under `include/xrpl/telemetry/` for headers and `src/libxrpl/telemetry/` for implementation. Key principles include RAII-based span management via `SpanGuard` (with `discard()` for dropping unwanted spans), a `FilteringSpanProcessor` that intercepts `OnEnd()` to prevent discarded spans from entering the export pipeline, conditional compilation with `XRPL_ENABLE_TELEMETRY`, and minimal runtime overhead through batch processing and efficient sampling.
-
-Performance optimization strategies include head sampling fixed at 100% (intentionally not configurable, so trace keep/drop decisions stay coherent across nodes), tail-based sampling at the collector for errors and slow traces to reduce volume, batch export to reduce network overhead, and conditional instrumentation that compiles to no-ops when disabled.
-
-➡️ **[Read full Implementation Strategy](./03-implementation-strategy.md)**
-
----
-
-## 5. Configuration Reference
-
-> **OTLP** = OpenTelemetry Protocol | **APM** = Application Performance Monitoring
-
-Configuration is handled through the `[telemetry]` section in `xrpld.cfg` with options for enabling/disabling, exporter selection, endpoint configuration, and component-level filtering. Head sampling is fixed at 1.0 (not operator-configurable); volume reduction is done by tail sampling in the collector. CMake integration includes a `XRPL_ENABLE_TELEMETRY` option for compile-time control.
-
-OpenTelemetry Collector configurations are provided for development and production (with tail-based sampling, Tempo, and Elastic APM). Docker Compose examples enable quick local development environment setup.
-
-➡️ **[View full Configuration Reference](./05-configuration-reference.md)**
-
----
-
-## 6. Implementation Phases
-
-The implementation spans 9 weeks across 5 phases:
-
-| Phase | Duration  | Focus               | Key Deliverables                                    |
-| ----- | --------- | ------------------- | --------------------------------------------------- |
-| 1     | Weeks 1-2 | Core Infrastructure | SDK integration, Telemetry interface, Configuration |
-| 2     | Weeks 3-4 | RPC Tracing         | HTTP context extraction, Handler instrumentation    |
-| 3     | Weeks 5-6 | Transaction Tracing | Protocol Buffer context, Relay propagation          |
-| 4     | Weeks 7-8 | Consensus Tracing   | Round spans, Proposal/validation tracing            |
-| 5     | Week 9    | Documentation       | Runbook, Dashboards, Training                       |
-
-**Total Effort**: 47 person-days (2 developers working in parallel)
-
-➡️ **[View full Implementation Phases](./06-implementation-phases.md)**
-
----
-
-## 7. Observability Backends
-
-> **APM** = Application Performance Monitoring | **GCS** = Google Cloud Storage
-
-Grafana Tempo is recommended for all environments due to its cost-effectiveness and Grafana integration, while Elastic APM is ideal for organizations with existing Elastic infrastructure.
-
-The recommended production architecture uses a gateway collector pattern with regional collectors performing tail-based sampling, routing traces to multiple backends (Tempo for primary storage, Elastic for log correlation, S3/GCS for long-term archive).
-
-➡️ **[View Observability Backend Recommendations](./07-observability-backends.md)**
-
----
-
-## 8. Appendix
-
-The appendix contains a glossary of OpenTelemetry and xrpld-specific terms, references to external documentation and specifications, version history for this implementation plan, and a complete document index.
-
-➡️ **[View Appendix](./08-appendix.md)**
-
----
-
-## Securing the OTel Pipeline
-
-Threat model and hardening guidance for production deployments where xrpld nodes ship telemetry to a centrally-hosted collector across an untrusted network. Covers the two attack surfaces (collector ingress and peer trace-context spoofing) and the chosen defenses: mTLS as primary collector auth, NetworkPolicy as defense-in-depth, and source-side validation plus per-peer rate limiting for the `protocol::TraceContext` field on peer messages.
-
-➡️ **[View Securing the OTel Pipeline](./secure-OTel.md)**
-
----
-
-_This document provides a comprehensive implementation plan for integrating OpenTelemetry distributed tracing into the xrpld XRP Ledger node software. For detailed information on any section, follow the links to the corresponding sub-documents._

OpenTelemetryPlan/Phase2_taskList.md

@@ -1,207 +0,0 @@
-# Phase 2: RPC Tracing Completion Task List
-
-> **Goal**: Complete RPC tracing coverage with unit tests, Grafana search filters, PathFind instrumentation, and config hardening. Build on the Phase 1c SpanGuard factory foundation to achieve production-quality RPC observability.
->
-> **Scope**: Unit tests for core telemetry, Grafana Tempo search filters, PathFind RPC tracing, config validation (`std::clamp`).
->
-> **Branch**: `pratik/otel-phase2-rpc-tracing` (from `pratik/otel-phase1c-rpc-integration`)
-
-### Related Plan Documents
-
-| Document                                                     | Relevance                                                     |
-| ------------------------------------------------------------ | ------------------------------------------------------------- |
-| [04-code-samples.md](./04-code-samples.md)                   | TraceContextPropagator (§4.4.2), RPC instrumentation (§4.5.3) |
-| [02-design-decisions.md](./02-design-decisions.md)           | W3C Trace Context (§2.5), span attributes (§2.4.2)            |
-| [06-implementation-phases.md](./06-implementation-phases.md) | Phase 2 tasks (§6.3), definition of done (§6.11.2)            |
-
----
-
-## Task 2.1: W3C Trace Context HTTP Header Extraction
-
-**Status**: DEFERRED → Phase 3
-
-**Reason**: W3C context propagation (`traceparent`/`tracestate` headers) requires a consumer — in Phase 2, RPC spans are entirely local to the node. Phase 3 introduces cross-node transaction tracing via protobuf context propagation, which is the first use case for extracted trace context. Implementing it here without a consumer would be dead code.
-
-**Implemented in**: `pratik/otel-phase3-tx-tracing` — `TraceContextPropagator.h/.cpp`
-
----
-
-## Task 2.2: Per-Category Span Creation
-
-**Status**: COMPLETE (superseded by Phase 1c design)
-
-**Original plan**: Add `XRPL_TRACE_PEER` and `XRPL_TRACE_LEDGER` macros.
-
-**Actual implementation**: Phase 1c replaced all tracing macros with the `SpanGuard::span(TraceCategory, prefix, name)` factory pattern. The `TraceCategory` enum (`Rpc`, `Transactions`, `Consensus`, `Peer`, `Ledger`) serves the same conditional-creation purpose without macros. No separate task needed — the factory already supports all categories.
-
----
-
-## Task 2.3: Add shouldTraceLedger() to Telemetry Interface
-
-**Objective**: The `Setup` struct has a `traceLedger` field but there's no corresponding virtual method. Add it for interface completeness.
-
-**What to do**:
-
-- Edit `include/xrpl/telemetry/Telemetry.h`:
-  - Add `virtual bool shouldTraceLedger() const = 0;`
-
-- Update all implementations:
-  - `src/libxrpl/telemetry/Telemetry.cpp` (TelemetryImpl, NullTelemetryOtel)
-  - `src/libxrpl/telemetry/NullTelemetry.cpp` (NullTelemetry)
-
-**Key modified files**:
-
-- `include/xrpl/telemetry/Telemetry.h`
-- `src/libxrpl/telemetry/Telemetry.cpp`
-- `src/libxrpl/telemetry/NullTelemetry.cpp`
-
----
-
-## Task 2.4: Unit Tests for Core Telemetry Infrastructure
-
-**Status**: COMPLETE
-
-**Objective**: Add unit tests for the core telemetry abstractions to validate correctness and catch regressions.
-
-**Implemented**:
-
-- `src/tests/libxrpl/telemetry/TelemetryConfig.cpp`:
-  - Test Setup defaults (all fields have correct initial values)
-  - Test `setupTelemetry` config parser (empty section, full section, edge cases)
-  - Test `samplingRatio` clamping (values outside 0.0-1.0)
-
-- `src/tests/libxrpl/telemetry/SpanGuardFactory.cpp`:
-  - Test null guard methods are safe (setAttribute, setOk, setError, addEvent on null)
-  - Test category span returns null when telemetry disabled
-  - Test child/linked span null when no parent context
-  - Test move construction transfers ownership
-  - Test recordException safe on null guard
-  - Test discard() safe on null guard
-
-- `src/tests/libxrpl/telemetry/main.cpp` — GTest runner
-- `src/tests/libxrpl/CMakeLists.txt` — test target with optional OTel linking
-
----
-
-## Task 2.5: Enhance RPC Span Attributes
-
-**Status**: DEFERRED (low priority)
-
-**Reason**: The high-value attributes (`command`, `version`, `role`, `status`) are already set by Phase 1c. The remaining HTTP transport-level attributes (`http.method`, `net.peer.ip`, `http.status_code`) provide limited additional insight since:
-
-- `http.method` is always POST for JSON-RPC
-- `net.peer.ip` is debug-level info available in logs
-- `duration_ms` is redundant with span duration (OTel captures start/end time natively)
-
-These can be added later if dashboard queries specifically need them. The node health attributes (Task 2.8) provide far more operational value and were prioritized instead.
-
----
-
-## Task 2.6: Build Verification and Performance Baseline
-
-**Objective**: Verify the build succeeds with and without telemetry, and establish a performance baseline.
-
-**What to do**:
-
-1. Build with `telemetry=ON` and verify no compilation errors
-2. Build with `telemetry=OFF` and verify no regressions
-3. Run existing unit tests to verify no breakage
-4. Document any build issues in lessons.md
-
-**Verification Checklist**:
-
-- [ ] `conan install . --build=missing -o telemetry=True` succeeds
-- [ ] `cmake --preset default -Dtelemetry=ON` configures correctly
-- [ ] Build succeeds with telemetry ON
-- [ ] Build succeeds with telemetry OFF
-- [ ] Existing tests pass with telemetry ON
-- [ ] Existing tests pass with telemetry OFF
-
----
-
-## Task 2.8: RPC Span Attribute Enrichment — Node Health Context
-
-**Status**: DROPPED.
-
-Node health (`amendment_blocked`, `server_state`) is not part of the telemetry surface. Operators consume the same data via the existing `server_info` / `server_state` RPC commands, so duplicating it on traces adds storage and cardinality cost without new value. The OTel C++ SDK 1.18.0 also does not support runtime updates to the resource, ruling out resource-level emission of these dynamic-by-nature flags.
-
----
-
-## Task 2.9: PathFind RPC Instrumentation
-
-**Status**: COMPLETE
-
-**Objective**: Trace the path_find and ripple_path_find RPC handlers to capture request latency and computation cost.
-
-**Spans added**:
-
-- `pathfind.request` — wraps `doPathFind()` and `doRipplePathFind()` RPC handlers
-- `pathfind.compute` — wraps `PathRequest::doUpdate()` (`pathfind_fast` attr)
-- `pathfind.update_all` — wraps `PathRequestManager::updateAll()` on ledger close (`pathfind_ledger_index`, `pathfind_num_requests` attrs; emitted only when active subscriptions exist)
-- `pathfind.discover` — wraps the entire per-source-asset loop in `PathRequest::findPaths()` (`pathfind_search_level`, `pathfind_num_paths` attrs). One span per RPC call instead of N (one per source asset). Trade-off: per-asset breakdown is lost; storage and cardinality bounded.
-
-**Attribute namespacing**: All pathfind attributes use the `pathfind_*` underscore form per the Phase 1c naming-spec rule 5.
-
-**New file**: `src/xrpld/rpc/detail/PathFindSpanNames.h`
-
-**Modified files**:
-
-- `src/xrpld/rpc/handlers/orderbook/PathFind.cpp`
-- `src/xrpld/rpc/handlers/orderbook/RipplePathFind.cpp`
-- `src/xrpld/rpc/detail/PathRequest.cpp`
-- `src/xrpld/rpc/detail/PathRequestManager.cpp`
-- `src/xrpld/rpc/detail/Pathfinder.cpp`
-
----
-
-## Task 2.10: RPC and PathFind Span Attribute Gap Fill
-
-**Status**: COMPLETE
-
-**Objective**: Wire up workflow-identifying attributes that enable filtering and grouping traces by request characteristics without drilling into child spans.
-
-**Attributes added**:
-
-| Span                | Attribute                    | Type   | Source                            |
-| ------------------- | ---------------------------- | ------ | --------------------------------- |
-| `rpc.http_request`  | `request_payload_size`       | int64  | `request.body().size()`           |
-| `rpc.process`       | `is_batch`                   | bool   | `method == "batch"` check         |
-| `rpc.process`       | `batch_size`                 | int64  | `params.size()` (only when batch) |
-| `rpc.ws_message`    | `command`                    | string | `jv[command]` or `jv[method]`     |
-| `rpc.command.*`     | `load_type`                  | string | `context.loadType.label()`        |
-| `pathfind.compute`  | `pathfind_dest_currency`     | string | `to_string(saDstAmount_.asset())` |
-| `pathfind.discover` | `pathfind_num_source_assets` | int64  | `sourceAssets.size()`             |
-
-_Note: `pathfind_dest_amount` was removed — the destination amount is a financial value excluded by the privacy policy (design §2.4.4)._
-
-**New attr keys**: `RpcSpanNames.h` (`isBatch`, `batchSize`, `loadType`), `PathFindSpanNames.h` (`destCurrency`, `numSourceAssets`).
-
-**Modified files**:
-
-- `src/xrpld/rpc/detail/RpcSpanNames.h`
-- `src/xrpld/rpc/detail/PathFindSpanNames.h`
-- `src/xrpld/rpc/detail/ServerHandler.cpp`
-- `src/xrpld/rpc/detail/RPCHandler.cpp`
-- `src/xrpld/rpc/detail/PathRequest.cpp`
-
----
-
-## Summary
-
-| Task | Description                                 | Status              | Notes                                                     |
-| ---- | ------------------------------------------- | ------------------- | --------------------------------------------------------- |
-| 2.1  | W3C Trace Context header extraction         | Deferred → Phase 3  | No consumer in Phase 2; needs cross-node tracing          |
-| 2.2  | Per-category span creation                  | Complete (Phase 1c) | Superseded by TraceCategory enum + SpanGuard              |
-| 2.3  | Add shouldTraceLedger() interface method    | Complete (Phase 1c) | Delivered in Phase 1c base branch                         |
-| 2.4  | Unit tests for core telemetry               | Complete            | TelemetryConfig + SpanGuardFactory tests                  |
-| 2.5  | Enhanced RPC span attributes (HTTP-level)   | Deferred            | Low value; span duration covers timing natively           |
-| 2.6  | Build verification and performance baseline | Complete            | Verified in CI on Phase 1c                                |
-| 2.7  | Grafana Tempo search filters                | Complete            | rpc-command, rpc-status, rpc-role filters                 |
-| 2.8  | RPC span attribute enrichment (node health) | Dropped             | Available via `server_info`/`server_state` RPC            |
-| 2.9  | PathFind RPC instrumentation                | Complete            | request, compute, update_all, discover                    |
-| 2.10 | RPC/PathFind span attribute gap fill        | Complete            | Batch detection, payload size, load cost, pathfind params |
-
-**Delivered in this branch**: Tasks 2.4, 2.7, 2.9, 2.10.
-**Deferred with rationale**: Tasks 2.1 (→Phase 3), 2.5 (low priority).
-**Dropped**: Task 2.8 (node health not duplicated on traces).
-**Superseded**: Task 2.2 (Phase 1c SpanGuard factory covers this).

OpenTelemetryPlan/Phase3_taskList.md

@@ -1,537 +0,0 @@
-# Phase 3: Transaction Tracing Task List
-
-> **Goal**: Trace the full transaction lifecycle from RPC submission through peer relay, including cross-node context propagation via Protocol Buffer extensions. This is the WALK phase that demonstrates true distributed tracing.
->
-> **Scope**: Protocol Buffer `TraceContext` message, context serialization, PeerImp transaction instrumentation, NetworkOPs processing instrumentation, HashRouter visibility, and multi-node relay context propagation.
->
-> **Branch**: `pratik/otel-phase3-tx-tracing` (from `pratik/otel-phase2-rpc-tracing`)
-
-### Related Plan Documents
-
-| Document                                                     | Relevance                                                                                        |
-| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
-| [04-code-samples.md](./04-code-samples.md)                   | TraceContext protobuf (§4.4.1), PeerImp instrumentation (§4.5.1), context serialization (§4.4.2) |
-| [01-architecture-analysis.md](./01-architecture-analysis.md) | Transaction flow (§1.3), key trace points (§1.6)                                                 |
-| [06-implementation-phases.md](./06-implementation-phases.md) | Phase 3 tasks (§6.4), definition of done (§6.11.3)                                               |
-| [02-design-decisions.md](./02-design-decisions.md)           | Context propagation design (§2.5), attribute schema (§2.4.3)                                     |
-
----
-
-## Task 3.1: Define TraceContext Protocol Buffer Message
-
-**Objective**: Add trace context fields to the P2P protocol messages so trace IDs can propagate across nodes.
-
-**What to do**:
-
-- Edit `include/xrpl/proto/xrpl.proto` (or `src/xrpld/proto/ripple.proto`, wherever the proto is):
-  - Add `TraceContext` message definition:
-    ```protobuf
-    message TraceContext {
-        bytes trace_id = 1;      // 16-byte trace identifier
-        bytes span_id = 2;       // 8-byte span identifier
-        uint32 trace_flags = 3;  // bit 0 = sampled
-        string trace_state = 4;  // W3C tracestate value
-    }
-    ```
-  - Add `optional TraceContext trace_context = 1001;` to:
-    - `TMTransaction`
-    - `TMProposeSet` (for Phase 4 use)
-    - `TMValidation` (for Phase 4 use)
-  - Use high field numbers (1001+) to avoid conflicts with existing fields
-
-- Regenerate protobuf C++ code
-
-**Key modified files**:
-
-- `include/xrpl/proto/xrpl.proto` (or equivalent)
-
-**Reference**:
-
-- [04-code-samples.md §4.4.1](./04-code-samples.md) — TraceContext message definition
-- [02-design-decisions.md §2.5.2](./02-design-decisions.md) — Protocol buffer context propagation design
-
----
-
-## Task 3.2: Implement Protobuf Context Serialization
-
-**Objective**: Create utilities to serialize/deserialize OTel trace context to/from protobuf `TraceContext` messages.
-
-**What to do**:
-
-- Create `include/xrpl/telemetry/TraceContextPropagator.h` (extend from Phase 2 if exists, or add protobuf methods):
-  - Add protobuf-specific methods:
-    - `static Context extractFromProtobuf(protocol::TraceContext const& proto)` — reconstruct OTel context from protobuf fields
-    - `static void injectToProtobuf(Context const& ctx, protocol::TraceContext& proto)` — serialize current span context into protobuf fields
-  - Both methods guard behind `#ifdef XRPL_ENABLE_TELEMETRY`
-
-- Create/extend `src/libxrpl/telemetry/TraceContextPropagator.cpp`:
-  - Implement extraction: read trace_id (16 bytes), span_id (8 bytes), trace_flags from protobuf, construct `SpanContext`, wrap in `Context`
-  - Implement injection: get current span from context, serialize its TraceId, SpanId, and TraceFlags into protobuf fields
-
-**Key new/modified files**:
-
-- `include/xrpl/telemetry/TraceContextPropagator.h`
-- `src/libxrpl/telemetry/TraceContextPropagator.cpp`
-
-**Reference**:
-
-- [04-code-samples.md §4.4.2](./04-code-samples.md) — Full extract/inject implementation
-
----
-
-## Task 3.3: Instrument PeerImp Transaction Handling
-
-**Objective**: Add trace spans to the peer-level transaction receive and relay path.
-
-**What to do**:
-
-- Edit `src/xrpld/overlay/detail/PeerImp.cpp`:
-  - In `onMessage(TMTransaction)` / `handleTransaction()`:
-    - Extract parent trace context from incoming `TMTransaction::trace_context` field (if present)
-    - Create `tx.receive` span as child of extracted context (or new root if none)
-    - Set attributes: `tx_hash`, `peer_id`, `tx_status`
-    - On HashRouter suppression (duplicate): set `suppressed=true`, add `tx.duplicate` event
-    - Wrap validation call with child span `tx.validate`
-    - Wrap relay with `tx.relay` span
-  - When relaying to peers:
-    - Inject current trace context into outgoing `TMTransaction::trace_context`
-    - Set `relay_count` attribute
-
-- Use `SpanGuard::span(TraceCategory::Transactions, "tx", "receive")` factory
-  (Phase 1c replaced macros with the SpanGuard factory pattern)
-
-**Key modified files**:
-
-- `src/xrpld/overlay/detail/PeerImp.cpp`
-
-**Reference**:
-
-- [04-code-samples.md §4.5.1](./04-code-samples.md) — Full PeerImp instrumentation example
-- [01-architecture-analysis.md §1.3](./01-architecture-analysis.md) — Transaction flow diagram
-- [01-architecture-analysis.md §1.6](./01-architecture-analysis.md) — tx.receive trace point
-
----
-
-## Task 3.4: Instrument NetworkOPs Transaction Processing
-
-**Objective**: Trace the transaction processing pipeline in NetworkOPs, covering both sync and async paths.
-
-**What to do**:
-
-- Edit `src/xrpld/app/misc/NetworkOPs.cpp`:
-  - In `processTransaction()`:
-    - Create `tx.process` span
-    - Set attributes: `tx_hash`, `tx_type`, `local` (whether from RPC or peer)
-    - Record whether sync or async path is taken
-
-  - In `doTransactionAsync()`:
-    - Capture parent context before queuing
-    - Create `tx.queue` span with queue depth attribute
-    - Add event when transaction is dequeued for processing
-
-  - In `doTransactionSync()`:
-    - Create `tx.process_sync` span
-    - Record result (applied, queued, rejected)
-
-**Key modified files**:
-
-- `src/xrpld/app/misc/NetworkOPs.cpp`
-
-**Reference**:
-
-- [01-architecture-analysis.md §1.6](./01-architecture-analysis.md) — tx.validate and tx.process trace points
-- [02-design-decisions.md §2.4.3](./02-design-decisions.md) — Transaction attribute schema
-
----
-
-## Task 3.5: Instrument HashRouter for Dedup Visibility
-
-**Objective**: Make transaction deduplication visible in traces by recording HashRouter decisions as span attributes/events.
-
-**What to do**:
-
-- Edit `src/xrpld/overlay/detail/PeerImp.cpp` (in handleTransaction):
-  - After calling `HashRouter::shouldProcess()` or `addSuppressionPeer()`:
-    - Record `suppressed` attribute (true/false)
-    - Record `tx_flags` showing current HashRouter state (SAVED, TRUSTED, etc.)
-    - Add `tx.first_seen` or `tx.duplicate` event
-
-- This is NOT a modification to HashRouter itself — just recording its decisions as span attributes in the existing PeerImp instrumentation from Task 3.3.
-
-**Key modified files**:
-
-- `src/xrpld/overlay/detail/PeerImp.cpp` (same changes as 3.3, logically grouped)
-
----
-
-## Task 3.6: Context Propagation in Transaction Relay
-
-**Status**: COMPLETE (transaction relay). Consensus proposal/validation
-propagation is deferred to Phase 4 — see "Planned (Phase 4)" below.
-
-**Objective**: Ensure trace context flows correctly when transactions are relayed between peers, creating linked spans across nodes.
-
-**What was done**:
-
-- **TX send side**: `NetworkOPs::apply()` now injects the tx.process span's trace
-  context into the outgoing `TMTransaction` protobuf before relay, using
-  `telemetry::injectSpanContext()`. The receiving node's `txReceiveSpan()` (already
-  wired in PeerImp) extracts the parent span_id and creates the tx.receive span
-  as a child of the sender's tx.process span.
-
-- **Edge cases**: Missing trace context (older peers) degrades gracefully to
-  standalone spans. Invalid/corrupted context is treated as absent. Trace
-  flags are propagated and respected.
-
-**New infrastructure**:
-
-- `SpanGuard::getTraceBytes()` — extracts raw trace_id/span_id/trace_flags
-  from a span without exposing OTel types. Safe to call from any thread.
-- `PropagationHelpers.h` — `injectSpanContext(SpanGuard&, proto)` bridge
-  between SpanGuard and protobuf TraceContext.
-- `TraceContextPropagator.h` — `injectToProtobuf(ctx, proto)` for
-  same-thread injection via OTel RuntimeContext.
-
-**Key modified files**:
-
-- `src/xrpld/app/misc/NetworkOPs.cpp` — tx relay injection
-- `include/xrpl/telemetry/SpanGuard.h` — `TraceBytes` struct, `getTraceBytes()`
-- `src/libxrpl/telemetry/SpanGuard.cpp` — `getTraceBytes()` implementation
-- `src/xrpld/telemetry/PropagationHelpers.h` — inject helpers (new file)
-
-**Planned (Phase 4 — not in this PR)**:
-
-The consensus proposal/validation propagation below is Phase 4 scope and is
-not implemented on this branch. It is listed here only to record the intended
-design.
-
-- **Proposal send/receive**: `RCLConsensus::Adaptor::propose()` injects the
-  current thread's active span context into the `TMProposeSet` protobuf via
-  `telemetry::injectToProtobuf()`. PeerImp creates a
-  `consensus.proposal.receive` span that extracts the sender's trace context
-  as parent (via `ConsensusReceiveTracing.h`).
-
-- **Validation send/receive**: `RCLConsensus::Adaptor::validate()` injects
-  the current thread's active span context into the `TMValidation` protobuf.
-  PeerImp creates a `consensus.validation.receive` span that extracts the
-  sender's trace context as parent.
-
-- Planned files: `src/xrpld/app/consensus/RCLConsensus.cpp` (send injection),
-  `src/xrpld/overlay/detail/PeerImp.cpp` (receive spans),
-  `src/xrpld/telemetry/ConsensusReceiveTracing.h` (receive span helpers,
-  new file).
-
-**Reference**:
-
-- [02-design-decisions.md §2.5](./02-design-decisions.md) — Context propagation design
-- [04-code-samples.md §4.5.1](./04-code-samples.md) — Relay context injection pattern
-
----
-
-## Task 3.7: Build Verification and Testing
-
-**Objective**: Verify all Phase 3 changes compile and work correctly.
-
-**What to do**:
-
-1. Build with `telemetry=ON` — verify no compilation errors
-2. Build with `telemetry=OFF` — verify no regressions
-3. Run existing unit tests
-4. Verify protobuf regeneration produces correct C++ code
-5. Document any issues encountered
-
-**Verification Checklist**:
-
-- [ ] Protobuf changes generate valid C++
-- [ ] Build succeeds with telemetry ON
-- [ ] Build succeeds with telemetry OFF
-- [ ] Existing tests pass
-- [ ] No undefined symbols from new telemetry calls
-
----
-
-## Task 3.8: Transaction Span Peer Version Attribute
-
-> **Source**: [External Dashboard Parity](../docs/superpowers/specs/2026-03-30-external-dashboard-parity-design.md) — adds peer version context inspired by the community [xrpl-validator-dashboard](https://github.com/realgrapedrop/xrpl-validator-dashboard).
->
-> **Upstream**: Phase 2 (RPC span infrastructure must exist).
-> **Downstream**: Phase 10 (validation checks for this attribute).
-
-**Objective**: Add the relaying peer's xrpld version to `tx.receive` spans so operators can correlate transaction issues with peer version mismatches during network upgrades.
-
-**What to do**:
-
-- Edit `src/xrpld/overlay/detail/PeerImp.cpp`:
-  - In the `tx.receive` span block (after existing `peer_id` setAttribute call):
-    - Add `peer_version` (string) — from `this->getVersion()`
-    - Only set if `getVersion()` returns a non-empty string (avoid empty-string attributes)
-
-**New span attribute**:
-
-| Attribute      | Type   | Source               | Example         |
-| -------------- | ------ | -------------------- | --------------- |
-| `peer_version` | string | `peer->getVersion()` | `"xrpld-2.4.0"` |
-
-**Rationale**: Transaction relay is where version mismatches cause subtle serialization or validation bugs. Tracing "this tx came from a v2.3.0 peer" helps diagnose compatibility issues. The community dashboard tracks peer versions externally; this brings version awareness into the trace itself.
-
-**Key modified files**:
-
-- `src/xrpld/overlay/detail/PeerImp.cpp`
-
-**Exit Criteria**:
-
-- [ ] `tx.receive` spans carry `peer_version` attribute with a non-empty version string
-- [ ] Attribute is omitted (not set to empty string) when `getVersion()` returns empty
-- [ ] Attribute visible in Jaeger span detail view
-
----
-
-## Task 3.9: Deterministic Transaction Trace ID
-
-> **Upstream**: Task 3.2 (protobuf serialization), Task 3.3 (PeerImp span exists).
-> **Downstream**: Phase 10 (workload validation can query by tx hash directly).
-> **Pattern**: Mirrors the consensus deterministic trace ID in Phase 4a
-> (`createDeterministicContext` in `RCLConsensus.cpp`), adapted for transactions.
-
-**Objective**: Derive the trace_id for transaction spans deterministically from the
-transaction hash so that all nodes handling the same transaction independently produce
-spans under the same trace_id — regardless of whether protobuf context propagation
-succeeds.
-
-**Why**: The current approach creates spans with random trace_ids and relies entirely
-on protobuf `TraceContext` propagation to link them. If any hop in the relay chain
-drops the context (older peers, message corruption, mixed-version networks), the trace
-splits and downstream spans become impossible to find. With deterministic trace_ids,
-correlation is guaranteed because every node derives the same trace_id from the same
-`txID`.
-
-**Approach — deterministic trace_id + protobuf span_id propagation**:
-
-1. Derive `trace_id = txHash[0:16]` (first 16 bytes of the 32-byte transaction hash).
-2. Generate a random 8-byte `span_id` per node (each node's span is unique within
-   the shared trace).
-3. Create the span under this deterministic context as parent.
-4. **Additionally**, if protobuf `TraceContext` is present in the incoming
-   `TMTransaction` message, extract the sender's `span_id` and use it as the span's
-   parent — this preserves parent-child ordering in the trace tree.
-5. If protobuf context is absent (older peer, first hop), the span still has the
-   correct deterministic `trace_id` — it appears as a sibling root in the same trace
-   rather than being lost.
-
-This gives the best of both worlds: guaranteed cross-node correlation via deterministic
-`trace_id`, plus parent-child relay ordering via protobuf `span_id` when available.
-
-**What to do**:
-
-- Create `createDeterministicTxContext(uint256 const& txHash)` utility function:
-  - Location: shared header or file-local in `PeerImp.cpp` and `NetworkOPs.cpp`
-    (or a shared telemetry utility if both need it).
-  - Pattern: identical to `createDeterministicContext(uint256 const& ledgerId)` in
-    `RCLConsensus.cpp` — take `txHash[0:16]` as trace_id, random span_id via
-    `default_prng()`, sampled flag set, `remote=false`.
-  - Guard behind `#ifdef XRPL_ENABLE_TELEMETRY`.
-
-  ```cpp
-  opentelemetry::context::Context
-  createDeterministicTxContext(uint256 const& txHash)
-  {
-      namespace trace = opentelemetry::trace;
-
-      // First 16 bytes of the 32-byte tx hash as trace ID.
-      trace::TraceId traceId(
-          opentelemetry::nostd::span<uint8_t const, 16>(txHash.data(), 16));
-
-      // Random span_id so each node's span is unique within the trace.
-      uint8_t spanIdBytes[8];
-      auto const rval = default_prng()();
-      std::memcpy(spanIdBytes, &rval, sizeof(spanIdBytes));
-      trace::SpanId spanId(
-          opentelemetry::nostd::span<uint8_t const, 8>(spanIdBytes, 8));
-
-      trace::SpanContext syntheticCtx(
-          traceId, spanId, trace::TraceFlags(1), /* remote = */ false);
-
-      return opentelemetry::context::Context{}.SetValue(
-          trace::kSpanKey,
-          opentelemetry::nostd::shared_ptr<trace::Span>(
-              new trace::DefaultSpan(syntheticCtx)));
-  }
-  ```
-
-- Edit `src/xrpld/overlay/detail/PeerImp.cpp` — restructure `handleTransaction()`:
-  - **Move span creation after deserialization** (txID must be known first):
-    1. Deserialize `STTx` and get `txID` (existing code at line ~1382).
-    2. Create deterministic parent context: `auto detCtx = createDeterministicTxContext(txID)`.
-    3. If `m->has_trace_context()`: extract protobuf context via `extractFromProtobuf()`,
-       **combine** with deterministic trace_id — use the protobuf span_id as parent
-       to preserve relay ordering, but override trace_id with the deterministic one.
-    4. If no protobuf context: create span under `detCtx` directly.
-    5. Set all existing attributes (`hash`, `peerId`, `peerVersion`, `suppressed`, etc.).
-
-  - **Combining deterministic trace_id with protobuf parent span_id**:
-    When both are available, construct a synthetic `SpanContext` with:
-    - `trace_id` = `txHash[0:16]` (deterministic)
-    - `span_id` = extracted from protobuf (sender's span_id → becomes parent)
-    - `trace_flags` = from protobuf
-    - `remote` = true (came from another node)
-
-    ```cpp
-    // Pseudo-code for the combined context:
-    auto detTraceId = trace::TraceId(txHash.data(), 16);
-    auto remoteSpanId = /* from extractFromProtobuf */;
-    auto remoteFlags = /* from extractFromProtobuf */;
-
-    trace::SpanContext combinedCtx(
-        detTraceId, remoteSpanId, remoteFlags, /* remote = */ true);
-    // Use as parent context for the new span.
-    ```
-
-- Edit `src/xrpld/app/misc/NetworkOPs.cpp` — update `processTransaction()`:
-  - `transaction->getID()` is already available at the top of the function.
-  - Create deterministic parent context from `txID`.
-  - Create `tx.process` span under this context.
-  - No protobuf context to extract here (NetworkOPs is intra-node), so
-    deterministic context alone is sufficient.
-
-- Add `trace_strategy` attribute to spans:
-  - Add `inline constexpr auto traceStrategy = "trace_strategy";`
-    to `TxSpanNames.h`.
-  - Set on each tx span: `span.setAttribute(tx_span::attr::traceStrategy, "deterministic")`.
-
-**Key new/modified files**:
-
-- `src/xrpld/overlay/detail/PeerImp.cpp` — restructured span creation
-- `src/xrpld/app/misc/NetworkOPs.cpp` — deterministic context for tx.process
-- `src/xrpld/telemetry/TxSpanNames.h` — new `traceStrategy` attribute constant
-- New or shared utility for `createDeterministicTxContext()` (location TBD: could be
-  a shared header like `include/xrpl/telemetry/DeterministicContext.h`, or file-local
-  if only used in two places)
-
-**Interaction with existing tasks**:
-
-- **Task 3.3 (PeerImp instrumentation)**: The span creation in `handleTransaction()`
-  must be restructured — the span currently starts before `txID` is known. This task
-  moves it after deserialization.
-- **Task 3.6 (Relay context propagation)**: Protobuf injection at the relay site
-  remains the same — `injectToProtobuf()` serializes the current span's `span_id`.
-  The receiver extracts it and combines with the deterministic `trace_id`.
-- **Phase 4a (Consensus deterministic trace ID)**: This task follows the same pattern.
-  Consider extracting a shared utility (e.g., `createDeterministicContext(uint256)`)
-  that both consensus and transaction tracing use.
-
-**Exit Criteria**:
-
-- [ ] `tx.receive` and `tx.process` spans have deterministic trace_id = `txHash[0:16]`
-- [ ] All nodes handling the same transaction produce spans under the same trace_id
-- [x] Protobuf `span_id` propagation still works when available (parent-child ordering)
-- [ ] Missing protobuf context (old peer) degrades gracefully to sibling spans, not lost traces
-- [ ] `trace_strategy` attribute set to `"deterministic"` on all tx spans
-- [ ] Trace queryable by tx hash (truncate hash → trace_id → direct lookup in Tempo)
-
-**Deliverables implemented (not in original plan)**:
-
-- **`SpanGuard::txSpan()` factory method** (`include/xrpl/telemetry/SpanGuard.h`):
-  Two overloads for creating transaction spans with deterministic trace IDs:
-  - `txSpan(category, group, name, txHash)` — standalone span (deterministic
-    trace_id from `txHash[0:16]`, no parent span_id).
-  - `txSpan(category, group, name, txHash, parentCtx)` — child span (deterministic
-    trace_id combined with protobuf-extracted parent span_id for relay ordering).
-
-- **`TxTracing.h` helper functions** (`src/xrpld/telemetry/TxTracing.h`):
-  File-local helpers that wrap `SpanGuard::txSpan()` for the two main PeerImp call
-  sites:
-  - `txReceiveSpan(txHash, parentCtx)` — creates `tx.receive` span with
-    deterministic trace_id and optional protobuf parent context.
-  - `txProcessSpan(txHash)` — creates `tx.process` span with deterministic
-    trace_id only (no protobuf parent, used intra-node).
-  - **Note**: `TxTracing.h` includes `xrpl.pb.h` unconditionally (outside
-    `#ifdef XRPL_ENABLE_TELEMETRY`) because `protocol::TMTransaction` appears in
-    the function signatures regardless of telemetry build mode.
-
----
-
-## Task 3.10: TxQ Instrumentation
-
-**Status**: COMPLETE
-
-**Objective**: Trace the transaction queue lifecycle — enqueue decisions, direct apply, batch clear, ledger-close accept loop, per-tx apply, and cleanup.
-
-**Spans added**:
-
-- `txq.enqueue` — wraps `TxQ::apply()` with tx_hash attribute
-- `txq.apply_direct` — wraps `TxQ::tryDirectApply()` fast-path
-- `txq.batch_clear` — wraps `TxQ::tryClearAccountQueueUpThruTx()`
-- `txq.accept` — wraps `TxQ::accept()` ledger-close dequeue with queue_size attr
-- `txq.accept_tx` — per-tx span inside accept loop with tx_hash, ter_code,
-  retries_remaining attributes
-- `txq.cleanup` — wraps `TxQ::processClosedLedger()` with ledger_seq attribute
-
-**New file**: `src/xrpld/app/misc/detail/TxQSpanNames.h`
-
-**Modified file**: `src/xrpld/app/misc/detail/TxQ.cpp`
-
----
-
-## Task 3.11: TX and TxQ Span Attribute Gap Fill
-
-**Status**: COMPLETE
-
-**Objective**: Add workflow-identifying attributes to transaction spans so operators can filter by transaction type and see outcomes without off-chain correlation.
-
-**Attributes added**:
-
-| Span              | Attribute            | Type   | Source                                                              |
-| ----------------- | -------------------- | ------ | ------------------------------------------------------------------- |
-| `tx.process`      | `tx_type`            | string | `TxFormats::getInstance().findByType(stx->getTxnType())->getName()` |
-| `tx.process`      | `fee`                | int64  | `stx->getFieldAmount(sfFee).xrp().drops()`                          |
-| `tx.process`      | `sequence`           | int64  | `stx->getSeqProxy().value()`                                        |
-| `tx.process`      | `ter_result`         | string | `transToken(e.result)` (set after batch application)                |
-| `tx.process`      | `applied`            | bool   | `e.applied` (set after batch application)                           |
-| `tx.receive`      | `tx_type`            | string | `TxFormats::getInstance().findByType(stx->getTxnType())->getName()` |
-| `txq.enqueue`     | `tx_type`            | string | same pattern as above                                               |
-| `txq.enqueue`     | `txq_status`         | string | `queued` / `applied_direct` / `applied` / `rejected`                |
-| `txq.enqueue`     | `fee_level_paid`     | int64  | `getFeeLevelPaid(view, *tx).value()`                                |
-| `txq.enqueue`     | `required_fee_level` | int64  | `getRequiredFeeLevel(...).value()`                                  |
-| `txq.batch_clear` | `num_cleared`        | int64  | queued txs cleared ahead of the applying tx                         |
-| `txq.cleanup`     | `expired_count`      | int64  | entries dropped for passed `LastLedgerSequence`                     |
-| `txq.accept_tx`   | `txq_status`         | string | `applied` / `failed` / `retried`                                    |
-| `txq.accept`      | `ledger_changed`     | bool   | set at end of accept loop                                           |
-
-**New attr keys**: `TxSpanNames.h` (`txType`, `fee`, `sequence`, `terResult`, `applied`), `TxQSpanNames.h` (`txType`).
-
-**Modified files**:
-
-- `src/xrpld/telemetry/TxSpanNames.h`
-- `src/xrpld/app/misc/detail/TxQSpanNames.h`
-- `src/xrpld/app/misc/NetworkOPs.cpp`
-- `src/xrpld/overlay/detail/PeerImp.cpp`
-- `src/xrpld/app/misc/detail/TxQ.cpp`
-
----
-
-## Summary
-
-| Task | Description                         | New Files | Modified Files | Depends On |
-| ---- | ----------------------------------- | --------- | -------------- | ---------- |
-| 3.1  | TraceContext protobuf message       | 0         | 1              | Phase 2    |
-| 3.2  | Protobuf context serialization      | 1-2       | 0              | 3.1        |
-| 3.3  | PeerImp transaction instrumentation | 0         | 1              | 3.2        |
-| 3.4  | NetworkOPs transaction processing   | 0         | 1              | Phase 2    |
-| 3.5  | HashRouter dedup visibility         | 0         | 1              | 3.3        |
-| 3.6  | Relay context propagation           | 0         | 1-2            | 3.3, 3.5   |
-| 3.7  | Build verification and testing      | 0         | 0              | 3.1-3.6    |
-| 3.8  | TX span peer version attribute      | 0         | 1              | 3.3        |
-| 3.9  | Deterministic transaction trace ID  | 0-1       | 3              | 3.2, 3.3   |
-| 3.10 | TxQ instrumentation (6 spans)       | 1         | 1              | 3.4        |
-| 3.11 | TX/TxQ span attribute gap fill      | 0         | 5              | 3.3, 3.10  |
-
-**Parallel work**: Tasks 3.1 and 3.4 can start in parallel. Task 3.2 depends on 3.1. Tasks 3.3 and 3.5 depend on 3.2. Task 3.6 depends on 3.3 and 3.5. Task 3.8 depends on 3.3 (span must exist). Task 3.9 depends on 3.2 and 3.3. Task 3.10 depends on 3.4 (tx.process span must exist).
-
-**Exit Criteria** (from [06-implementation-phases.md §6.11.3](./06-implementation-phases.md)):
-
-- [x] Transaction traces span across nodes
-- [x] Trace context in Protocol Buffer messages
-- [ ] HashRouter deduplication visible in traces
-- [ ] <5% overhead on transaction throughput
-- [x] Deterministic trace_id: same trace_id for same tx across all nodes
-- [x] Protobuf span_id propagation preserves parent-child ordering when available

OpenTelemetryPlan/Phase4_taskList.md

@@ -1,228 +0,0 @@
-# Phase 4: Consensus Tracing Task List
-
-> **Goal**: Full observability into consensus rounds — track round lifecycle, phase transitions, proposal handling, and validation. This is the RUN phase that completes the distributed tracing story.
->
-> **Scope**: RCLConsensus instrumentation for round starts, phase transitions (open/establish/accept), proposal send/receive, validation handling, and correlation with transaction traces from Phase 3.
->
-> **Branch**: `pratik/otel-phase4-consensus-tracing` (from `pratik/otel-phase3-tx-tracing`)
-
-> **Note on attribute names**: the `xrpl.<domain>.<field>` keys shown below are
-> written in the older dotted form for readability — it mirrors how the fully
-> qualified attribute reads in a Tempo trace view. The implemented keys follow
-> the convention in [CONTRIBUTING.md](../CONTRIBUTING.md#telemetry-span-attribute-naming)
-> (underscore form, e.g. `consensus_round`, `consensus_mode`); the
-> `*SpanNames.h` constants are the single source of truth.
-
-### Related Plan Documents
-
-| Document                                                     | Relevance                                                   |
-| ------------------------------------------------------------ | ----------------------------------------------------------- |
-| [04-code-samples.md](./04-code-samples.md)                   | Consensus instrumentation (§4.5.2), consensus span patterns |
-| [01-architecture-analysis.md](./01-architecture-analysis.md) | Consensus round flow (§1.4), key trace points (§1.6)        |
-| [06-implementation-phases.md](./06-implementation-phases.md) | Phase 4 tasks (§6.5), definition of done (§6.11.4)          |
-| [02-design-decisions.md](./02-design-decisions.md)           | Consensus attribute schema (§2.4.4)                         |
-
----
-
-## Task 4.1: Instrument Consensus Round Start
-
-**Objective**: Create a root span for each consensus round that captures the round's key parameters.
-
-**What to do**:
-
-- Edit `src/xrpld/app/consensus/RCLConsensus.cpp`:
-  - In `RCLConsensus::startRound()` (or the Adaptor's startRound):
-    - Create `consensus.round` span using `SpanGuard::span(TraceCategory::Consensus, ...)`
-    - Set attributes:
-      - `xrpl.consensus.ledger.prev` — previous ledger hash
-      - `xrpl.consensus.ledger.seq` — target ledger sequence
-      - `xrpl.consensus.proposers` — number of trusted proposers
-      - `xrpl.consensus.mode` — "proposing" or "observing"
-    - Store the span context for use by child spans in phase transitions
-
-- Add a member to hold current round trace context:
-  - `opentelemetry::context::Context currentRoundContext_` (guarded by `#ifdef`)
-  - Updated at round start, used by phase transition spans
-
-**Key modified files**:
-
-- `src/xrpld/app/consensus/RCLConsensus.cpp`
-- `src/xrpld/app/consensus/RCLConsensus.h` (add context member)
-
-**Reference**:
-
-- [04-code-samples.md §4.5.2](./04-code-samples.md) — startRound instrumentation example
-- [01-architecture-analysis.md §1.4](./01-architecture-analysis.md) — Consensus round flow
-
----
-
-## Task 4.2: Instrument Phase Transitions
-
-**Objective**: Create child spans for each consensus phase (open, establish, accept) to show timing breakdown.
-
-**What to do**:
-
-- Edit `src/xrpld/app/consensus/RCLConsensus.cpp`:
-  - Identify where phase transitions occur (the `Consensus<Adaptor>` template drives this)
-  - For each phase entry:
-    - Create span as child of `currentRoundContext_`: `consensus.phase.open`, `consensus.phase.establish`, `consensus.phase.accept`
-    - Set `xrpl.consensus.phase` attribute
-    - Add `phase.enter` event at start, `phase.exit` event at end
-    - Record phase duration in milliseconds
-
-  - In the `onClose` adaptor method:
-    - Create `consensus.ledger_close` span
-    - Set attributes: close_time, mode, transaction count in initial position
-
-  - Note: The Consensus template class in `include/xrpl/consensus/Consensus.h` drives phase transitions — check if instrumentation goes there or in the Adaptor
-
-**Key modified files**:
-
-- `src/xrpld/app/consensus/RCLConsensus.cpp`
-- Possibly `include/xrpl/consensus/Consensus.h` (for template-level phase tracking)
-
-**Reference**:
-
-- [04-code-samples.md §4.5.2](./04-code-samples.md) — phaseTransition instrumentation
-
----
-
-## Task 4.3: Instrument Proposal Handling
-
-**Objective**: Trace proposal send and receive to show validator coordination.
-
-**What to do**:
-
-- Edit `src/xrpld/app/consensus/RCLConsensus.cpp`:
-  - In `Adaptor::propose()`:
-    - Create `consensus.proposal.send` span
-    - Set attributes: `xrpl.consensus.round` (proposal sequence), proposal hash
-    - Inject trace context into outgoing `TMProposeSet::trace_context` (from Phase 3 protobuf)
-
-  - In `Adaptor::peerProposal()` (or wherever peer proposals are received):
-    - Extract trace context from incoming `TMProposeSet::trace_context`
-    - Create `consensus.proposal.receive` span as child of extracted context
-    - Set attributes: `xrpl.consensus.proposer` (node ID), `xrpl.consensus.round`
-
-  - In `Adaptor::share(RCLCxPeerPos)`:
-    - Create `consensus.proposal.relay` span for relaying peer proposals
-
-**Key modified files**:
-
-- `src/xrpld/app/consensus/RCLConsensus.cpp`
-
-**Reference**:
-
-- [04-code-samples.md §4.5.2](./04-code-samples.md) — peerProposal instrumentation
-- [02-design-decisions.md §2.4.4](./02-design-decisions.md) — Consensus attribute schema
-
----
-
-## Task 4.4: Instrument Validation Handling
-
-**Objective**: Trace validation send and receive to show ledger validation flow.
-
-**What to do**:
-
-- Edit `src/xrpld/app/consensus/RCLConsensus.cpp` (or the validation handler):
-  - When sending our validation:
-    - Create `consensus.validation.send` span
-    - Set attributes: validated ledger hash, sequence, signing time
-
-  - When receiving a peer validation:
-    - Extract trace context from `TMValidation::trace_context` (if present)
-    - Create `consensus.validation.receive` span
-    - Set attributes: `xrpl.consensus.validator` (node ID), ledger hash
-
-**Key modified files**:
-
-- `src/xrpld/app/consensus/RCLConsensus.cpp`
-- `src/xrpld/app/misc/NetworkOPs.cpp` (if validation handling is here)
-
----
-
-## Task 4.5: Add Consensus-Specific Attributes
-
-**Objective**: Enrich consensus spans with detailed attributes for debugging and analysis.
-
-**What to do**:
-
-- Review all consensus spans and ensure they include:
-  - `xrpl.consensus.ledger.seq` — target ledger sequence number
-  - `xrpl.consensus.round` — consensus round number
-  - `xrpl.consensus.mode` — proposing/observing/wrongLedger
-  - `xrpl.consensus.phase` — current phase name
-  - `xrpl.consensus.phase_duration_ms` — time spent in phase
-  - `xrpl.consensus.proposers` — number of trusted proposers
-  - `xrpl.consensus.tx_count` — transactions in proposed set
-  - `xrpl.consensus.disputes` — number of disputed transactions
-  - `xrpl.consensus.converge_percent` — convergence percentage
-
-**Key modified files**:
-
-- `src/xrpld/app/consensus/RCLConsensus.cpp`
-
----
-
-## Task 4.6: Correlate Transaction and Consensus Traces
-
-**Objective**: Link transaction traces from Phase 3 with consensus traces so you can follow a transaction from submission through consensus into the ledger.
-
-**What to do**:
-
-- In `onClose()` or `onAccept()`:
-  - When building the consensus position, link the round span to individual transaction spans using span links (if OTel SDK supports it) or events
-  - At minimum, record the transaction hashes included in the consensus set as span events: `tx.included` with `xrpl.tx.hash` attribute
-
-- In `processTransactionSet()` (NetworkOPs):
-  - If the consensus round span context is available, create child spans for each transaction applied to the ledger
-
-**Key modified files**:
-
-- `src/xrpld/app/consensus/RCLConsensus.cpp`
-- `src/xrpld/app/misc/NetworkOPs.cpp`
-
----
-
-## Task 4.7: Build Verification and Testing
-
-**Objective**: Verify all Phase 4 changes compile and don't affect consensus timing.
-
-**What to do**:
-
-1. Build with `telemetry=ON` — verify no compilation errors
-2. Build with `telemetry=OFF` — verify no regressions (critical for consensus code)
-3. Run existing consensus-related unit tests
-4. Verify that all macros expand to no-ops when disabled
-5. Check that no consensus-critical code paths are affected by instrumentation overhead
-
-**Verification Checklist**:
-
-- [ ] Build succeeds with telemetry ON
-- [ ] Build succeeds with telemetry OFF
-- [ ] Existing consensus tests pass
-- [ ] No new includes in consensus headers when telemetry is OFF
-- [ ] Phase timing instrumentation doesn't use blocking operations
-
----
-
-## Summary
-
-| Task | Description                           | New Files | Modified Files | Depends On    |
-| ---- | ------------------------------------- | --------- | -------------- | ------------- |
-| 4.1  | Consensus round start instrumentation | 0         | 2              | Phase 3       |
-| 4.2  | Phase transition instrumentation      | 0         | 1-2            | 4.1           |
-| 4.3  | Proposal handling instrumentation     | 0         | 1              | 4.1           |
-| 4.4  | Validation handling instrumentation   | 0         | 1-2            | 4.1           |
-| 4.5  | Consensus-specific attributes         | 0         | 1              | 4.2, 4.3, 4.4 |
-| 4.6  | Transaction-consensus correlation     | 0         | 2              | 4.2, Phase 3  |
-| 4.7  | Build verification and testing        | 0         | 0              | 4.1-4.6       |
-
-**Parallel work**: Tasks 4.2, 4.3, and 4.4 can run in parallel after 4.1 is complete. Task 4.5 depends on all three. Task 4.6 depends on 4.2 and Phase 3.
-
-**Exit Criteria** (from [06-implementation-phases.md §6.11.4](./06-implementation-phases.md)):
-
-- [ ] Complete consensus round traces
-- [ ] Phase transitions visible
-- [ ] Proposals and validations traced
-- [ ] No impact on consensus timing

OpenTelemetryPlan/Phase5_taskList.md

@@ -1,250 +0,0 @@
-# Phase 5: Documentation & Deployment Task List
-
-> **Goal**: Production readiness — Grafana dashboards, spanmetrics pipeline, operator runbook, alert definitions, and final integration testing. This phase ensures the telemetry system is useful and maintainable in production.
->
-> **Scope**: Grafana dashboard definitions, OTel Collector spanmetrics connector, Prometheus integration, alert rules, operator documentation, and production-ready Docker Compose stack.
->
-> **Branch**: `pratik/otel-phase5-docs-deployment` (from `pratik/otel-phase4-consensus-tracing`)
-
-> **Note on attribute names**: the `xrpl.<domain>.<field>` keys shown below
-> (including the collector spanmetrics dimension examples) are written in the
-> older dotted form for readability — it mirrors how the fully qualified
-> attribute reads in a Tempo trace view. The implemented keys follow the
-> convention in [CONTRIBUTING.md](../CONTRIBUTING.md#telemetry-span-attribute-naming)
-> (underscore form, e.g. `command`, `rpc_status`); the `*SpanNames.h` constants
-> are the single source of truth, and the real collector dimensions must use
-> those exact underscore keys (the CI naming check enforces this).
-
-### Related Plan Documents
-
-| Document                                                         | Relevance                                                                  |
-| ---------------------------------------------------------------- | -------------------------------------------------------------------------- |
-| [07-observability-backends.md](./07-observability-backends.md)   | Tempo setup (§7.1), Grafana dashboards (§7.6), alerts (§7.6.3)             |
-| [05-configuration-reference.md](./05-configuration-reference.md) | Collector config (§5.5), production config (§5.5.2), Docker Compose (§5.6) |
-| [06-implementation-phases.md](./06-implementation-phases.md)     | Phase 5 tasks (§6.6), definition of done (§6.11.5)                         |
-
----
-
-## Task 5.1: Add Spanmetrics Connector to OTel Collector
-
-**Objective**: Derive RED metrics (Rate, Errors, Duration) from trace spans automatically, enabling Grafana time-series dashboards.
-
-**What to do**:
-
-- Edit `docker/telemetry/otel-collector-config.yaml`:
-  - Add `spanmetrics` connector:
-    ```yaml
-    connectors:
-      spanmetrics:
-        histogram:
-          explicit:
-            buckets: [1ms, 5ms, 10ms, 25ms, 50ms, 100ms, 250ms, 500ms, 1s, 5s]
-        dimensions:
-          - name: xrpl.rpc.command
-          - name: xrpl.rpc.status
-          - name: xrpl.consensus.phase
-          - name: xrpl.tx.type
-    ```
-  - Add `prometheus` exporter:
-    ```yaml
-    exporters:
-      prometheus:
-        endpoint: 0.0.0.0:8889
-    ```
-  - Wire the pipeline:
-    ```yaml
-    service:
-      pipelines:
-        traces:
-          receivers: [otlp]
-          processors: [batch]
-          exporters: [debug, otlp/tempo, spanmetrics]
-        metrics:
-          receivers: [spanmetrics]
-          exporters: [prometheus]
-    ```
-
-- Edit `docker/telemetry/docker-compose.yml`:
-  - Expose port `8889` on the collector for Prometheus scraping
-  - Add Prometheus service
-  - Add Prometheus as Grafana datasource
-
-**Key modified files**:
-
-- `docker/telemetry/otel-collector-config.yaml`
-- `docker/telemetry/docker-compose.yml`
-
-**Key new files**:
-
-- `docker/telemetry/prometheus.yml` (Prometheus scrape config)
-- `docker/telemetry/grafana/provisioning/datasources/prometheus.yaml`
-
-**Reference**:
-
-- [POC_taskList.md §Next Steps](./POC_taskList.md) — Metrics pipeline for Grafana dashboards
-
----
-
-## Task 5.2: Create Grafana Dashboards
-
-**Objective**: Provide pre-built Grafana dashboards for RPC performance, transaction lifecycle, and consensus health.
-
-**What to do**:
-
-- Create `docker/telemetry/grafana/provisioning/dashboards/dashboards.yaml` (provisioning config)
-- Create dashboard JSON files:
-  1. **RPC Performance Dashboard** (`rpc-performance.json`):
-     - RPC request latency (p50/p95/p99) by command — histogram panel
-     - RPC throughput (requests/sec) by command — time series
-     - RPC error rate by command — bar gauge
-     - Top slowest RPC commands — table
-
-  2. **Transaction Overview Dashboard** (`transaction-overview.json`):
-     - Transaction processing rate — time series
-     - Transaction latency distribution — histogram
-     - Suppression rate (duplicates) — stat panel
-     - Transaction processing path (sync vs async) — pie chart
-
-  3. **Consensus Health Dashboard** (`consensus-health.json`):
-     - Consensus round duration — time series
-     - Phase duration breakdown (open/establish/accept) — stacked bar
-     - Proposals sent/received per round — stat panel
-     - Consensus mode distribution (proposing/observing) — pie chart
-
-- Store dashboards in `docker/telemetry/grafana/dashboards/`
-
-**Key new files**:
-
-- `docker/telemetry/grafana/provisioning/dashboards/dashboards.yaml`
-- `docker/telemetry/grafana/dashboards/rpc-performance.json`
-- `docker/telemetry/grafana/dashboards/transaction-overview.json`
-- `docker/telemetry/grafana/dashboards/consensus-health.json`
-
-**Reference**:
-
-- [07-observability-backends.md §7.6](./07-observability-backends.md) — Grafana dashboard specifications
-- [01-architecture-analysis.md §1.8.3](./01-architecture-analysis.md) — Dashboard panel examples
-
----
-
-## Task 5.3: Define Alert Rules
-
-**Objective**: Create alert definitions for key telemetry anomalies.
-
-**What to do**:
-
-- Create `docker/telemetry/grafana/provisioning/alerting/alerts.yaml`:
-  - **RPC Latency Alert**: p99 latency > 1s for any command over 5 minutes
-  - **RPC Error Rate Alert**: Error rate > 5% for any command over 5 minutes
-  - **Consensus Duration Alert**: Round duration > 10s (warn), > 30s (critical)
-  - **Transaction Processing Alert**: Processing rate drops below threshold
-  - **Telemetry Pipeline Health**: No spans received for > 2 minutes
-
-**Key new files**:
-
-- `docker/telemetry/grafana/provisioning/alerting/alerts.yaml`
-
-**Reference**:
-
-- [07-observability-backends.md §7.6.3](./07-observability-backends.md) — Alert rule definitions
-
----
-
-## Task 5.4: Production Collector Configuration
-
-**Objective**: Create a production-ready OTel Collector configuration with tail-based sampling and resource limits.
-
-**What to do**:
-
-- Create `docker/telemetry/otel-collector-config-production.yaml`:
-  - Tail-based sampling policy:
-    - Always sample errors and slow traces
-    - 10% base sampling rate for normal traces
-    - Always sample first trace for each unique RPC command
-  - Resource limits:
-    - Memory limiter processor (80% of available memory)
-    - Queued retry for export failures
-  - TLS configuration for production endpoints
-  - Health check endpoint
-
-**Key new files**:
-
-- `docker/telemetry/otel-collector-config-production.yaml`
-
-**Reference**:
-
-- [05-configuration-reference.md §5.5.2](./05-configuration-reference.md) — Production collector config
-
----
-
-## Task 5.5: Operator Runbook
-
-**Objective**: Create operator documentation for managing the telemetry system in production.
-
-**What to do**:
-
-- Create `docs/telemetry-runbook.md`:
-  - **Setup**: How to enable telemetry in xrpld
-  - **Configuration**: All config options with descriptions
-  - **Collector Deployment**: Docker Compose vs. Kubernetes vs. bare metal
-  - **Troubleshooting**: Common issues and resolutions
-    - No traces appearing
-    - High memory usage from telemetry
-    - Collector connection failures
-    - Sampling configuration tuning
-  - **Performance Tuning**: Batch size, queue size, sampling ratio guidelines
-  - **Upgrading**: How to upgrade OTel SDK and Collector versions
-
-**Key new files**:
-
-- `docs/telemetry-runbook.md`
-
----
-
-## Task 5.6: Final Integration Testing
-
-**Objective**: Validate the complete telemetry stack end-to-end.
-
-**What to do**:
-
-1. Start full Docker stack (Collector, Tempo, Grafana, Prometheus)
-2. Build xrpld with `telemetry=ON`
-3. Run in standalone mode with telemetry enabled
-4. Generate RPC traffic and verify traces in Tempo
-5. Verify dashboards populate in Grafana
-6. Verify alerts trigger correctly
-7. Test telemetry OFF path (no regressions)
-8. Run full test suite
-
-**Verification Checklist**:
-
-- [ ] Docker stack starts without errors
-- [ ] Traces appear in Tempo with correct hierarchy
-- [ ] Grafana dashboards show metrics derived from spans
-- [ ] Prometheus scrapes spanmetrics successfully
-- [ ] Alerts can be triggered by simulated conditions
-- [ ] Build succeeds with telemetry ON and OFF
-- [ ] Full test suite passes
-
----
-
-## Summary
-
-| Task | Description                        | New Files | Modified Files | Depends On |
-| ---- | ---------------------------------- | --------- | -------------- | ---------- |
-| 5.1  | Spanmetrics connector + Prometheus | 2         | 2              | Phase 4    |
-| 5.2  | Grafana dashboards                 | 4         | 0              | 5.1        |
-| 5.3  | Alert definitions                  | 1         | 0              | 5.1        |
-| 5.4  | Production collector config        | 1         | 0              | Phase 4    |
-| 5.5  | Operator runbook                   | 1         | 0              | Phase 4    |
-| 5.6  | Final integration testing          | 0         | 0              | 5.1-5.5    |
-
-**Parallel work**: Tasks 5.1, 5.4, and 5.5 can run in parallel. Tasks 5.2 and 5.3 depend on 5.1. Task 5.6 depends on all others.
-
-**Exit Criteria** (from [06-implementation-phases.md §6.11.5](./06-implementation-phases.md)):
-
-- [ ] Dashboards deployed and showing data
-- [ ] Alerts configured and tested
-- [ ] Operator documentation complete
-- [ ] Production collector config ready
-- [ ] Full test suite passes

OpenTelemetryPlan/secure-OTel.md

@@ -1,240 +0,0 @@
-# Securing OpenTelemetry Against Trace Context Spoofing
-
-> **Part of**: [OpenTelemetry Implementation Plan](./OpenTelemetryPlan.md) — see also [Design Decisions § Privacy](./02-design-decisions.md#244-privacy--sensitive-data-policy) (what we don't collect) and [Configuration Reference § 5.5](./05-configuration-reference.md#55-opentelemetry-collector-configuration) (collector base config).
-
-Trace context spoofing (or poisoning) occurs when untrusted actors inject tampered or stale trace IDs into your system. If these requests are processed, the spans are appended to historical trace buckets, stretching trace durations, ruining p99 latency metrics, and breaking Grafana dashboards.
-
-This guide outlines two categories of defense: mitigating tampered contexts and locking down the OpenTelemetry (OTel) Collector to trusted clients only.
-
----
-
-## Part 1: Mitigating Tampered Trace Contexts
-
-### 1. Perimeter Defense: Strip Headers at the API Gateway
-
-The most effective way to prevent spoofing from external sources is to treat your API Gateway (Envoy, NGINX, AWS ALB) as a hard boundary. Strip incoming W3C tracing headers (`traceparent`, `tracestate`) from public traffic so the gateway is forced to generate a fresh, legitimate `trace_id`.
-
-**NGINX Example (Stripping Headers):**
-
-```nginx
-server {
-    listen 80;
-
-    location / {
-        # Clear out untrusted incoming trace headers
-        proxy_set_header traceparent "";
-        proxy_set_header tracestate "";
-
-        proxy_pass http://backend_service;
-    }
-}
-```
-
-### **2. Timestamp-Anchored Trace IDs and OTTL Filtering**
-
-If you use a custom trace ID generator that embeds a timestamp in the first few bytes (like AWS X-Ray or UUIDv7), you can use the OTel Collector's OpenTelemetry Transform Language (OTTL) to detect anomalies.
-**Collector Configuration (Conceptual OTTL Filter):**
-
-```yaml
-processors:
-  filter/stale_traces:
-    error_mode: ignore
-    traces:
-      span:
-        # Example: Drop spans where the start time is significantly different
-        # from an expected parameter or embedded timestamp logic.
-        # Note: Standard W3C trace IDs do not contain timestamps by default.
-        - 'Keep out-of-bounds spans: time.sub(start_time, now()) > duration("1h")'
-```
-
-## **Part 2: Restricting Access to the OTel Collector**
-
-Locking down the Collector ensures that only authenticated, trusted clients can submit telemetry data.
-
-### **Approach A: Network Layer Security (Kubernetes Network Policies)**
-
-Ensure your Collector is not exposed to the public internet. If running in Kubernetes, use a NetworkPolicy to restrict ingress traffic to specific namespaces.
-**Kubernetes NetworkPolicy Example:**
-
-```yaml
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-internal-otel
-  namespace: observability
-spec:
-  podSelector:
-    matchLabels:
-      app: opentelemetry-collector
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              environment: production
-      ports:
-        - protocol: TCP
-          port: 4317 # gRPC
-        - protocol: TCP
-          port: 4318 # HTTP
-```
-
-### **Approach B: Transport Layer Security (Mutual TLS / mTLS)**
-
-Require clients to present a valid cryptographic certificate to connect to the Collector.
-**Collector Configuration (mTLS):**
-
-```yaml
-receivers:
-  otlp:
-    protocols:
-      grpc:
-        endpoint: 0.0.0.0:4317
-        tls:
-          # Setting client_ca_file makes the collector require and verify a
-          # client cert, rejecting connections without a trusted one.
-          client_ca_file: /certs/client_ca.pem # CA that signs trusted client certs
-          cert_file: /certs/collector.pem
-          key_file: /certs/collector.key
-```
-
-### **Approach C: Application Layer Authentication (Basic Auth Extension)**
-
-Use the Collector's extension system to require an API key or Basic Auth credentials.
-**Collector Configuration (Basic Auth):**
-
-```yaml
-extensions:
-  basicauth/collector:
-    htpasswd:
-      inline: |
-        # username:trusted-client, password:SecurePassword123
-        trusted-client:$apr1$4v8p76o6$DMTX5Wv6uOmrFAZp2X1N1.
-
-receivers:
-  otlp:
-    protocols:
-      grpc:
-        endpoint: 0.0.0.0:4317
-        auth:
-          authenticator: basicauth/collector
-
-processors:
-  batch:
-
-exporters:
-  otlp:
-    endpoint: my-backend-storage:4317
-
-service:
-  extensions: [basicauth/collector]
-  pipelines:
-    traces:
-      receivers: [otlp]
-      processors: [batch]
-      exporters: [otlp]
-```
-
-**Client Setup (Environment Variables):**
-Developers must pass the authentication header using the standard OTel SDK environment variables:
-
-```bash
-# Base64 encoded "trusted-client:SecurePassword123"
-export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic dHJ1c3RlZC1jbGllbnQ6U2VjdXJlUGFzc3dvcmQxMjM="
-```
-
----
-
-Available routes to build on top of: https://github.com/XRPLF/rippled/pull/6425#discussion_r3234751995
-
----
-
-# Analysis: Applying the Guide to xrpld
-
-The guide above is written for HTTP-fronted web services. xrpld is a P2P node daemon, so the threat model and the applicable defenses differ. This section captures how each approach maps to xrpld and the chosen direction.
-
-## Threat Model
-
-xrpld has **two distinct attack surfaces**, not one. The original guide conflates them under "trace context spoofing"; for xrpld they need separate defenses.
-
-| Surface                                   | Attacker                                                 | Vector                                                                                                                                                                                     | Defense                                       |
-| ----------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------- |
-| **Collector ingress** (xrpld → collector) | Anyone who can reach `4317`/`4318` on the collector host | Forged OTLP traffic, telemetry exfiltration, DoS on collector                                                                                                                              | mTLS + network policy                         |
-| **Peer trace context** (peer → xrpld)     | Malicious peer in the XRPL overlay                       | Crafted `protocol::TraceContext` field inside peer protobuf messages (TMTransaction, consensus, etc.) — used to forge `trace_id`/`span_id`, pollute p99, attach spans to historical traces | Validate + rate-limit at the receive boundary |
-
-**Deployment context:** Across-network. xrpld nodes (potentially run by external operators or in different DCs) ship telemetry to a centrally-hosted collector across an untrusted network. The collector is NOT on the same host or private VPC as every node.
-
-```
-                ┌── peer (untrusted) ── TMTransaction{trace_context} ──▶ xrpld
-                │                                                            │
-                │                                              [validate + rate-limit]
-                │                                                            │
-                │                                                            ▼
-                │                                                     SpanGuard (clean)
-                │                                                            │
-                │                                                            │ OTLP/gRPC
-                │                                                            │ + mTLS
-                │                                                            ▼
-                └─────────────────────────────────────────  [client_ca_file: verify client cert]
-                                                                  OTel Collector
-                                                              (in private subnet, NetPol)
-```
-
-## Part 1 Applicability — Peer Trace-Context Validation
-
-The guide's NGINX header stripping and OTTL stale-span filtering target HTTP gateways and post-hoc cleanup. Neither fits xrpld directly:
-
-- **NGINX header stripping** — N/A. There is no HTTP gateway between peers and xrpld; trace context arrives inside protobuf peer messages (`protocol::TraceContext`), not as W3C `traceparent` headers. See [src/xrpld/telemetry/PropagationHelpers.h](../src/xrpld/telemetry/PropagationHelpers.h).
-- **OTTL stale-span filtering** — Weak fit. Post-hoc cleanup at the collector loses peer identity (you can't tell _which_ peer poisoned the trace). Validation at the receive site is stronger.
-
-**xrpld-specific Part 1 mitigations:**
-
-1. **Validate extracted context at the boundary** in [src/xrpld/telemetry/ConsensusReceiveTracing.h](../src/xrpld/telemetry/ConsensusReceiveTracing.h) and any other peer-message receive site. Reject if `trace_id` is all-zero, wrong length, or fails W3C format checks. Treat invalid context as "no propagated context" — start a fresh span — rather than dropping the message.
-2. **Per-peer sample rate limiting** so a hostile peer cannot flood the collector with spans bearing a fabricated `trace_id`. Use probabilistic sampling on the receive path keyed by peer identity.
-
-## Part 2 — Comparison of Collector Hardening Approaches
-
-Evaluated for the across-network deployment shape:
-
-| Approach                        | Across-network fit                                                                                                                                                                                                                                                                                                | Cost                                                                 | Verdict                            |
-| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | ---------------------------------- |
-| **A. NetworkPolicy / firewall** | Necessary baseline (don't expose `4317`/`4318` to the internet), but insufficient on its own when traffic genuinely crosses networks — you cannot NetworkPolicy the public internet.                                                                                                                              | Cheap.                                                               | **Defense-in-depth, not primary.** |
-| **B. mTLS**                     | Strongest fit. Every xrpld node holds a client cert; the collector verifies it via `client_ca_file` in the receiver's `tls` block. Encrypts in transit (raw OTLP over the internet leaks transaction patterns and validator identity). Compromised node = revoke one cert, no shared secret to rotate everywhere. | Cert issuance + rotation pipeline.                                   | **Primary.**                       |
-| **C. Basic Auth**               | Worst shape for this topology. Single shared password across all xrpld nodes — one leaked node config compromises the whole fleet. Doesn't encrypt; you'd need TLS underneath anyway, at which point you're 80% of the way to mTLS.                                                                               | Cheap to set up, expensive to operate (rotation across N operators). | **Skip.**                          |
-
-## Decision
-
-**Primary defense:** mTLS (Approach B) on the collector's OTLP receivers. The collector requires and verifies each client certificate when `client_ca_file` is set in the receiver's `tls` block (there is no `auth_type` field — setting `client_ca_file` is what enforces client-cert verification).
-
-**Defense-in-depth:** NetworkPolicy / firewall rules (Approach A) so `4317`/`4318` are never reachable from outside the expected operator subnets even if mTLS were misconfigured.
-
-**Skipped:** Basic Auth (Approach C) — wrong shape for an across-network, multi-operator topology.
-
-**Plus xrpld-specific Part 1 work:** trace-context validation and per-peer rate limiting at peer-message receive sites.
-
-## Decisions Made
-
-| Decision             | Choice                           | Rationale                                                                                                                                                                                                                                                     |
-| -------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Cert source for mTLS | **Reuse XRPL node identity key** | One identity per node, no separate PKI to operate. Fits XRPL's existing trust model; requires small CA tooling step to derive/sign the OTel client cert from the node key.                                                                                    |
-| Part 1 scope         | **Include in this spec**         | Collector hardening and peer trace-context validation share one threat model. Coherent design doc; can still be split into multiple PRs at implementation.                                                                                                    |
-| Dev impact           | **Production-only**              | Local `docker/telemetry/docker-compose.yml` keeps `insecure: true` and no auth for fast iteration. Only production deployment manifests gain mTLS. Accepted risk: minor dev/prod drift, mitigated by integration tests against a TLS-enabled collector in CI. |
-
-## Out of Scope
-
-- NGINX/Envoy header stripping (no HTTP gateway in front of xrpld-to-collector traffic).
-- OTTL stale-span filtering at the collector (weaker than source validation; loses peer identity).
-- Local development docker-compose hardening.
-- Telemetry backend (Tempo) hardening — separate concern, downstream of the collector.
-
-## Next Step
-
-Write this up as a design doc with full sections covering:
-
-1. Threat model & architecture (this section, expanded)
-2. Collector hardening — mTLS config, NetworkPolicy
-3. Cert pipeline — deriving OTel client cert from XRPL node key
-4. Peer trace-context validation — receive-site checks in `ConsensusReceiveTracing.h`
-5. Per-peer span rate limiting
-6. Testing & rollout

bin/check-tools.sh

@@ -110,6 +110,23 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     fi
 fi
 
+# Rust toolchain. Part of the Nix commonPackages, so available on both Linux
+# and macOS. The cargo plugins are invoked through cargo (`cargo <sub>`), which
+# resolves the matching `cargo-<sub>` binary on PATH; `--version` is offline and
+# does not need a Cargo project.
+if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
+    echo
+    echo "Rust toolchain:"
+    check cargo
+    check cargo-audit cargo audit --version
+    check cargo-llvm-cov cargo llvm-cov --version
+    check cargo-nextest cargo nextest --version
+    check clippy clippy-driver --version
+    check rust-analyzer
+    check rustc
+    check rustfmt
+fi
+
 # GCC is the default compiler on Linux. macOS uses the system Apple Clang
 # instead, so GCC/g++/gcov are not expected there.
 if [ "${os}" = "linux" ]; then

bin/pre-commit/check_doxygen_style.py

@@ -0,0 +1,440 @@
+#!/usr/bin/env python3
+"""
+Check C++ Doxygen comment style.
+
+Enforces the house convention for documentation comments:
+
+  * Use ``/** ... */`` blocks, not ``///``, ``//!`` or ``/*! ... */``; a plain
+    ``/* ... */`` that contains Doxygen commands is a doc comment missing its
+    second star. Trailing member-after comments use ``///<`` (not ``//!<``,
+    ``/*!< ... */`` or ``/**< ... */`` -- the block forms get reflowed and
+    mis-attached by clang-format on packed enum values, the line form does not).
+  * ``/**`` sits alone on its line; the closing ``*/`` sits alone on its line.
+  * Every content line is prefixed with `` * `` (no bare-indented continuation).
+  * The first content line is flush (not over-indented).
+  * Doxygen commands use the ``@cmd`` form, not ``\\cmd``.
+  * Use ``@return`` / ``@throws`` rather than prose ``Returns:`` / ``Throws:``.
+  * A plain ``//`` comment carrying a block-level ``@command`` (``@param``,
+    ``@return``, ``@see``, ...) is documentation and must be a ``/** ... */``
+    block (Doxygen ignores ``//``).
+  * Use canonical command spellings: ``@return`` (not ``@returns``),
+    ``@throws`` (not ``@throw``), ``@see`` (not ``@sa``).
+  * Order block tags ``@tparam`` -> ``@param`` -> ``@return``. (Whether
+    ``@param`` order matches the signature is not checked here -- too fragile to
+    parse; Doxygen's WARN_IF_DOC_ERROR covers name mismatches.)
+  * One-liners are expanded to three lines, EXCEPT bare markers ``@{`` / ``@}``
+    / ``@cond [label]`` / ``@endcond`` / ``@file [name]`` which stay on one line.
+
+Left intentionally alone (recognized, valid Doxygen that is not this style's
+concern):
+
+  * ``///<`` trailing "member-after" comments (the house form).
+  * Divider lines made only of slashes (``//////////``).
+  * Plain ``/* ... */`` (non-Doxygen) comments.
+
+Usage:
+    check_doxygen_style.py [FILE ...]      # explicit files
+    check_doxygen_style.py                 # default: src/ and include/ trees
+
+Exit status is non-zero if any violation is found.
+"""
+
+import argparse
+import re
+import sys
+from collections.abc import Iterable, Iterator
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+
+
+class Category(Enum):
+    """A kind of style violation: a printed ``label`` and its ``description``.
+
+    The description is the default message; a few categories whose wording
+    depends on the offending text (see ``Finding.detail``) override it.
+    """
+
+    def __init__(self, label: str, description: str) -> None:
+        self.label = label
+        self.description = description
+
+    BACKSLASH_COMMAND = ("backslash-command", "use the @cmd form, not \\cmd")
+    WRONG_COMMAND = ("wrong-command", "use the canonical command spelling")
+    TRIPLE_SLASH = ("triple-slash", "use a /** ... */ block instead of ///")
+    QT_MEMBER = ("qt-member", "use ///< instead of //!<")
+    QT_LINE = ("qt-line", "use a /** ... */ block instead of //!")
+    BLOCK_MEMBER = ("block-member", "use ///< instead of /**<")
+    QT_BLOCK_MEMBER = ("qt-block-member", "use ///< instead of /*!<")
+    DOC_IN_LINE_COMMENT = (
+        "doc-in-line-comment",
+        "use a /** ... */ block for documentation, not //",
+    )
+    QT_COMMENT = ("qt-comment", "use /** instead of /*!")
+    SINGLE_LINE_BLOCK = (
+        "single-line-block",
+        "expand one-line /** ... */ to a multi-line block "
+        "(markers @{ @} @cond @endcond @file may stay)",
+    )
+    TEXT_ON_OPENER = ("text-on-opener", "move text off the /** opener line")
+    BARE_CONTINUATION = ("bare-continuation", 'prefix continuation lines with " * "')
+    OVER_INDENTED = ("over-indented", "first content line is over-indented")
+    OVER_INDENTED_TAG = (
+        "over-indented-tag",
+        'Doxygen tag over-indented; use a single space after "*"',
+    )
+    COMBINED_MARKER = (
+        "combined-marker",
+        "scope marker @{ / @} should be its own single-line /** @{ */ block",
+    )
+    PROSE_LABEL = ("prose-label", "use a Doxygen tag instead of a prose label")
+    CONTENT_ON_CLOSER = ("content-on-closer", "move content off the closing */ line")
+    PLAIN_BLOCK_DOC = (
+        "plain-block-doc",
+        "documentation comment must open with /** not /*",
+    )
+    TAG_ORDER = (
+        "tag-order",
+        "block tags out of order; expected @tparam, then @param, then @return",
+    )
+
+
+@dataclass(frozen=True)
+class Finding:
+    """A single style violation at a 1-based line number.
+
+    ``detail`` overrides the category's default description when the message
+    depends on the offending text (e.g. which command was misspelled).
+    """
+
+    line: int
+    category: Category
+    detail: str | None = None
+
+    @property
+    def message(self) -> str:
+        return self.detail if self.detail is not None else self.category.description
+
+
+DEFAULT_ROOTS = ("src", "include")
+EXTS = {".h", ".hpp", ".cpp", ".ipp", ".cxx", ".cc"}
+
+# Every Doxygen command we recognize when written with a backslash (\cmd).
+_ALL_COMMANDS = (
+    "brief|param|tparam|return|returns|retval|note|warning|pre|post|see|sa|ref|"
+    "throw|throws|exception|deprecated|details|code|endcode|verbatim|endverbatim|"
+    "li|arg|c|internal|since|todo|attention|remark|remarks|ingroup|defgroup"
+)
+# Block-level tags whose over-indentation we flag inside a block body.
+_BLOCK_TAGS = (
+    "param|tparam|returns?|retval|brief|throws?|note|warning|"
+    "pre|post|see|sa|details|deprecated"
+)
+# Tags that, appearing anywhere in a comment, mark it as documentation.
+_ANY_DOC_TAGS = (
+    "param|tparam|returns?|retval|brief|throws?|note|warning|pre|post|see|sa"
+)
+# Tags that make a plain // comment a mis-styled doc comment.
+_LINE_DOC_TAGS = "brief|param|tparam|returns?|retval|throws?|note|see|pre|post"
+
+# \cmd that should be @cmd.
+RE_BACKSLASH_CMD = re.compile(r"\\(" + _ALL_COMMANDS + r")\b")
+# Bare markers that may legitimately stay on a single line.
+RE_MARKER = re.compile(r"^@(\{|\}|cond(\s.*)?|endcond|file(\s.*)?)$")
+# Prose section labels that should be Doxygen tags.
+RE_PROSE_LABEL = re.compile(r"^\*\s(Returns|Throws|Exceptions):\s*$")
+# An over-indented block tag: "*" followed by 2+ spaces then the tag.
+RE_OVERINDENTED_TAG = re.compile(r"^\*\s{2,}@(" + _BLOCK_TAGS + r")\b")
+# Any documentation tag (used to spot a doc comment hiding in a plain /* */).
+RE_ANY_DOC_TAG = re.compile(r"@(" + _ANY_DOC_TAGS + r")\b")
+# A documentation tag inside a // comment.
+RE_LINE_DOC_TAG = re.compile(r"@(" + _LINE_DOC_TAGS + r")\b")
+# Order-relevant tags, for the @tparam -> @param -> @return ordering check.
+RE_ORDER_TAG = re.compile(r"^\*\s*@(param|tparam|returns?|retval)\b")
+# First content line indented by 2+ spaces after the "*".
+RE_FIRST_OVERINDENT = re.compile(r"^\s*\*\s{2,}\S")
+# A scope marker @{ / @} sharing a comment with other text.
+RE_COMBINED_MARKER = re.compile(r"^\*\s*@[{}]\s*$")
+
+# Non-canonical command spellings -> the house spelling (bare command names).
+# Used both to flag a wrong @form and to suggest the right @form for a \wrong.
+CANONICAL_COMMAND = {"returns": "return", "throw": "throws", "sa": "see"}
+WRONG_SPELLINGS = [
+    (re.compile(rf"@{wrong}\b"), f"@{right}")
+    for wrong, right in CANONICAL_COMMAND.items()
+]
+
+# Order block tags should appear in; a body out of this order is a violation.
+EXPECTED_TAG_ORDER = ("tparam", "param", "return")
+
+
+def is_doxy_open(stripped: str) -> bool:
+    """True for a line-start Doxygen block opener we should normalize."""
+    if stripped.startswith("/*!"):  # Qt-style Doxygen
+        return not stripped.startswith("/*!<")  # member-after, leave inline
+    return (
+        stripped.startswith("/**")
+        and not stripped.startswith("/***")
+        and not stripped.startswith("/**/")
+        and not stripped.startswith("/**<")
+    )
+
+
+def _flag_commands(raw_line: str, stripped: str, index: int) -> list[Finding]:
+    """Flag \\cmd and misspelled @cmd on a comment line (opener, body, or closer)."""
+    if not stripped.startswith(("*", "//", "/*")):
+        return []
+    findings: list[Finding] = []
+    backslash = RE_BACKSLASH_CMD.search(raw_line)
+    if backslash:
+        command = backslash.group(1)
+        canonical = CANONICAL_COMMAND.get(command, command)
+        findings.append(
+            Finding(
+                index + 1,
+                Category.BACKSLASH_COMMAND,
+                f"use @{canonical} instead of \\{command}",
+            )
+        )
+    for pattern, replacement in WRONG_SPELLINGS:
+        wrong = pattern.search(raw_line)
+        if wrong:
+            findings.append(
+                Finding(
+                    index + 1,
+                    Category.WRONG_COMMAND,
+                    f"use {replacement} instead of {wrong.group(0)}",
+                )
+            )
+    return findings
+
+
+def _flag_line_comment(raw_line: str, stripped: str, index: int) -> Finding | None:
+    """Return the finding for a single-line comment form (///, //!, /**<, ...), else None."""
+    if stripped.startswith("///") and not stripped.startswith(("////", "///<")):
+        return Finding(index + 1, Category.TRIPLE_SLASH)
+    if "//!<" in raw_line:
+        return Finding(index + 1, Category.QT_MEMBER)
+    if stripped.startswith("//!"):
+        return Finding(index + 1, Category.QT_LINE)
+    if "/**<" in raw_line:
+        return Finding(index + 1, Category.BLOCK_MEMBER)
+    if "/*!<" in raw_line:
+        return Finding(index + 1, Category.QT_BLOCK_MEMBER)
+    if stripped.startswith("//") and RE_LINE_DOC_TAG.search(stripped):
+        return Finding(index + 1, Category.DOC_IN_LINE_COMMENT)
+    return None
+
+
+def _flag_single_line_block(stripped: str, line_no: int, is_qt: bool) -> list[Finding]:
+    """Findings for a whole /** ... */ or /*! ... */ block on one line."""
+    inner = re.sub(r"^/\*[*!]", "", stripped)
+    inner = re.sub(r"\*/\s*$", "", inner).strip()
+    findings: list[Finding] = []
+    if is_qt:
+        findings.append(Finding(line_no, Category.QT_COMMENT))
+    if inner and not RE_MARKER.match(inner):
+        findings.append(Finding(line_no, Category.SINGLE_LINE_BLOCK))
+    return findings
+
+
+def _canonical_order_tag(body: str) -> str | None:
+    """The order-relevant tag (tparam/param/return) a body line opens with, if any."""
+    match = RE_ORDER_TAG.match(body)
+    if match is None:
+        return None
+    command = match.group(1)
+    return "return" if command in ("return", "returns", "retval") else command
+
+
+def _flag_body_line(
+    body_line: str, line_no: int, is_first_content: bool
+) -> list[Finding]:
+    """Findings for one interior line of a multi-line block."""
+    body = body_line.strip()
+    findings: list[Finding] = []
+    if body and not body.startswith("*"):
+        findings.append(Finding(line_no, Category.BARE_CONTINUATION))
+    if body.startswith("*"):
+        if is_first_content and RE_FIRST_OVERINDENT.match(body_line):
+            findings.append(Finding(line_no, Category.OVER_INDENTED))
+        if RE_OVERINDENTED_TAG.match(body):
+            findings.append(Finding(line_no, Category.OVER_INDENTED_TAG))
+        if RE_COMBINED_MARKER.match(body):
+            findings.append(Finding(line_no, Category.COMBINED_MARKER))
+        label = RE_PROSE_LABEL.match(body)
+        if label:
+            suggested_tag = "@return" if label.group(1) == "Returns" else "@throws"
+            findings.append(
+                Finding(
+                    line_no,
+                    Category.PROSE_LABEL,
+                    f'use {suggested_tag} instead of prose "{label.group(1)}:"',
+                )
+            )
+    return findings
+
+
+def _flag_closer(closer_line: str, line_no: int) -> list[Finding]:
+    """Findings for content sharing the closing */ line."""
+    before = closer_line[: closer_line.index("*/")].strip()
+    if before and before != "*":
+        return [Finding(line_no, Category.CONTENT_ON_CLOSER)]
+    return []
+
+
+def _flag_tag_order(first_tag_line: dict[str, int]) -> list[Finding]:
+    """One finding if the present block tags are not in EXPECTED_TAG_ORDER."""
+    tag_lines = [
+        first_tag_line[tag] for tag in EXPECTED_TAG_ORDER if tag in first_tag_line
+    ]
+    if tag_lines != sorted(tag_lines):
+        return [Finding(min(tag_lines), Category.TAG_ORDER)]
+    return []
+
+
+def _flag_doxy_block(lines: list[str], start: int) -> tuple[int, list[Finding]]:
+    """Handle a /** or /*! block opening at ``start``; return (next index, findings)."""
+    raw_line = lines[start]
+    stripped = raw_line.lstrip()
+    open_pos = raw_line.index("/*")
+    is_qt = stripped.startswith("/*!")
+
+    # A whole block on one line: /** ... */.
+    if "*/" in raw_line[open_pos + 2 :]:
+        return start + 1, _flag_single_line_block(stripped, start + 1, is_qt)
+
+    # Multi-line block: opener, then scan the body to the closer.
+    findings: list[Finding] = []
+    if is_qt:
+        findings.append(Finding(start + 1, Category.QT_COMMENT))
+    if raw_line[open_pos + 3 :].strip():
+        findings.append(Finding(start + 1, Category.TEXT_ON_OPENER))
+
+    line_count = len(lines)
+    cursor = start + 1
+    is_first_content = True
+    first_tag_line: dict[str, int] = {}  # canonical tag -> 1-based first line
+    while cursor < line_count and "*/" not in lines[cursor]:
+        body_line = lines[cursor]
+        body = body_line.strip()
+        findings.extend(_flag_commands(body_line, body, cursor))
+        tag = _canonical_order_tag(body)
+        if tag is not None:
+            first_tag_line.setdefault(tag, cursor + 1)
+        findings.extend(_flag_body_line(body_line, cursor + 1, is_first_content))
+        if body.startswith("*"):
+            is_first_content = False
+        cursor += 1
+
+    if cursor < line_count:
+        closer_line = lines[cursor]
+        findings.extend(_flag_commands(closer_line, closer_line.strip(), cursor))
+        findings.extend(_flag_closer(closer_line, cursor + 1))
+    findings.extend(_flag_tag_order(first_tag_line))
+
+    return cursor + 1, findings
+
+
+def _flag_plain_block(lines: list[str], start: int) -> tuple[int, list[Finding]]:
+    """Handle a line-start plain /* ... */ block; return (next index, findings).
+
+    Only flagged when it hides a documentation command (a missing second star).
+    """
+    line_count = len(lines)
+    cursor = start
+    while cursor < line_count and "*/" not in lines[cursor]:
+        cursor += 1
+    findings: list[Finding] = []
+    # The opener (start) is command-checked by check_file; check the rest here.
+    for i in range(start + 1, min(cursor + 1, line_count)):
+        findings.extend(_flag_commands(lines[i], lines[i].strip(), i))
+    block_text = "\n".join(
+        lines[start : cursor + 1] if cursor < line_count else lines[start:]
+    )
+    if RE_ANY_DOC_TAG.search(block_text):
+        findings.append(Finding(start + 1, Category.PLAIN_BLOCK_DOC))
+    next_index = cursor + 1 if cursor < line_count else line_count
+    return next_index, findings
+
+
+def check_source(text: str) -> list[Finding]:
+    """Return all style violations found in the given source text."""
+    lines = text.split("\n")
+    findings: list[Finding] = []
+    line_count = len(lines)
+    index = 0
+    in_plain_block = False  # inside a mid-line, non-Doxygen /* ... */
+    while index < line_count:
+        raw_line = lines[index]
+        stripped = raw_line.lstrip()
+
+        # Skip the interior of a plain block opened on an earlier line.
+        if in_plain_block:
+            in_plain_block = "*/" not in raw_line
+            index += 1
+            continue
+
+        findings.extend(_flag_commands(raw_line, stripped, index))
+
+        line_finding = _flag_line_comment(raw_line, stripped, index)
+        if line_finding is not None:
+            findings.append(line_finding)
+            index += 1
+        elif is_doxy_open(stripped):
+            index, block_findings = _flag_doxy_block(lines, index)
+            findings.extend(block_findings)
+        elif stripped.startswith("/*"):
+            index, block_findings = _flag_plain_block(lines, index)
+            findings.extend(block_findings)
+        else:
+            # A /* that opens mid-line without closing starts a plain block.
+            if "/*" in raw_line and not stripped.startswith("//"):
+                if "*/" not in raw_line[raw_line.index("/*") + 2 :]:
+                    in_plain_block = True
+            index += 1
+    return findings
+
+
+def check_file(path: Path) -> list[Finding]:
+    """Return all style violations found in one file."""
+    return check_source(path.read_text(encoding="utf-8"))
+
+
+def iter_files(paths: Iterable[str]) -> Iterator[Path]:
+    """Yield every C++ source file among the given files and directories."""
+    for raw_path in paths:
+        path = Path(raw_path)
+        if path.is_dir():
+            for candidate in path.rglob("*"):
+                if candidate.is_file() and candidate.suffix in EXTS:
+                    yield candidate
+        elif path.suffix in EXTS:
+            yield path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Check Doxygen comment style.")
+    parser.add_argument(
+        "files", nargs="*", help="files or directories (default: src/ include/)"
+    )
+    parser.add_argument(
+        "-q", "--quiet", action="store_true", help="only print the summary count"
+    )
+    args = parser.parse_args()
+    roots = args.files or [root for root in DEFAULT_ROOTS if Path(root).is_dir()]
+
+    total = 0
+    for path in sorted(set(iter_files(roots)), key=str):
+        for finding in check_file(path):
+            total += 1
+            if not args.quiet:
+                print(
+                    f"{path}:{finding.line}: {finding.category.label}: {finding.message}"
+                )
+    print(f"\n{total} doxygen-style violation(s)", file=sys.stderr)
+    return 1 if total else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/pre-commit/clang_tidy_check.py

@@ -1,27 +1,46 @@
 #!/usr/bin/env python3
-"""Pre-commit hook that runs clang-tidy on changed files using run-clang-tidy.
+"""Pre-commit hook that runs clang-tidy on staged files using run-clang-tidy.
 
-The set of files is chosen by pre-commit (see .pre-commit-config.yaml), which
-filters to C/C++ sources and excludes `.ipp` fragments. Headers are linted
-directly: the `verify_headers` build option (ON by default) compiles every
-`.h`/`.hpp` on its own, so each header is the main file of its own
-compile_commands.json entry and run-clang-tidy can analyse it just like a
-`.cpp`.
+The script determines the staged files itself (see `pass_filenames: false` in
+.pre-commit-config.yaml) so run-clang-tidy is run once and handles parallelism
+internally: pre-commit would otherwise split the files across parallel hook
+invocations that race when fixes edit a shared header.
+
+Fixes are collected with `-export-fixes` and applied by clang-apply-replacements
+in a separate step rather than with run-clang-tidy's `-fix`. The `add_module`
+build isolates each module's headers behind a per-module symlink directory
+(build/modules/<module>/...), so a header reachable from several translation
+units is referenced through different paths that all resolve to the same source
+file. clang-apply-replacements deduplicates identical replacements by their
+literal path, so those paths must be canonicalised to the real source path
+first; otherwise the same fix is applied once per path and corrupts the header.
 """
 
 from __future__ import annotations
 
 import os
+import re
 import shutil
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 CLANG_TIDY_VERSION = 22
 
+# Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
+# the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
+# compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
+TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}
 
-def find_run_clang_tidy() -> str | None:
-    for candidate in (f"run-clang-tidy-{CLANG_TIDY_VERSION}", "run-clang-tidy"):
+# A single-quoted `FilePath:` entry in an -export-fixes YAML file, allowing the
+# `- ` marker that precedes it inside a `Replacements:` sequence. clang-tidy
+# emits paths single-quoted and doubles any embedded quote per YAML rules.
+FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
+
+
+def find_tool(name: str) -> str | None:
+    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
         if path := shutil.which(candidate):
             return path
     return None
@@ -35,23 +54,43 @@ def find_build_dir(repo_root: Path) -> Path | None:
     return None
 
 
+def staged_files(repo_root: Path) -> list[Path]:
+    """Return absolute paths of staged, lint-able C/C++ files.
+
+    `--diff-filter=d` excludes deletions so we never lint a removed file.
+    """
+    output = subprocess.check_output(
+        ["git", "diff", "--staged", "--name-only", "--diff-filter=d", "--"]
+        + [f"*{ext}" for ext in TIDY_EXTENSIONS],
+        text=True,
+        cwd=repo_root,
+    )
+    return [repo_root / rel for rel in output.splitlines() if rel]
+
+
+def canonicalize_fix_paths(fixes_dir: Path) -> None:
+    """Rewrite every `FilePath` in the exported fixes to its real source path.
+
+    A header included through a module's isolation symlink is recorded under that
+    symlink's path; collapsing all paths to the same real file lets
+    clang-apply-replacements recognise the per-translation-unit duplicates and
+    apply each fix once.
+    """
+    for yaml in fixes_dir.glob("*.yaml"):
+        lines = []
+        for line in yaml.read_text().splitlines():
+            if m := FILEPATH_RE.match(line):
+                path = m.group(2).replace("''", "'")
+                real = os.path.realpath(path).replace("'", "''")
+                line = f"{m.group(1)}'{real}'"
+            lines.append(line)
+        yaml.write_text("\n".join(lines) + "\n")
+
+
 def main():
     if not os.environ.get("TIDY"):
         return 0
 
-    files = sys.argv[1:]
-    if not files:
-        return 0
-
-    run_clang_tidy = find_run_clang_tidy()
-    if not run_clang_tidy:
-        print(
-            f"clang-tidy check failed: TIDY is enabled but neither "
-            f"'run-clang-tidy-{CLANG_TIDY_VERSION}' nor 'run-clang-tidy' was found in PATH.",
-            file=sys.stderr,
-        )
-        return 1
-
     repo_root = Path(
         subprocess.check_output(
             ["git", "rev-parse", "--show-toplevel"],
@@ -59,6 +98,29 @@ def main():
             text=True,
         ).strip()
     )
+
+    files = staged_files(repo_root)
+    if not files:
+        return 0
+
+    run_clang_tidy = find_tool("run-clang-tidy")
+    clang_apply_replacements = find_tool("clang-apply-replacements")
+    missing = [
+        name
+        for name, path in (
+            ("run-clang-tidy", run_clang_tidy),
+            ("clang-apply-replacements", clang_apply_replacements),
+        )
+        if not path
+    ]
+    if missing:
+        print(
+            f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
+            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
+            file=sys.stderr,
+        )
+        return 1
+
     build_dir = find_build_dir(repo_root)
     if not build_dir:
         print(
@@ -68,11 +130,23 @@ def main():
         )
         return 1
 
-    result = subprocess.run(
-        [run_clang_tidy, "-quiet", "-p", str(build_dir), "-fix", "-allow-no-checks"]
-        + files
-    )
-    return result.returncode
+    with tempfile.TemporaryDirectory() as fixes_dir:
+        result = subprocess.run(
+            [
+                run_clang_tidy,
+                "-quiet",
+                "-p",
+                build_dir,
+                "-export-fixes",
+                fixes_dir,
+                "-allow-no-checks",
+            ]
+            + files
+        )
+        canonicalize_fix_paths(Path(fixes_dir))
+        applied = subprocess.run([clang_apply_replacements, fixes_dir])
+
+    return result.returncode or applied.returncode
 
 
 if __name__ == "__main__":

bin/pre-commit/test_check_doxygen_style.py

@@ -0,0 +1,406 @@
+#!/usr/bin/env python3
+"""
+Tests for check_doxygen_style.py.
+
+Run directly (no test framework needed):
+    ./bin/pre-commit/test_check_doxygen_style.py
+or under pytest:
+    pytest bin/pre-commit/test_check_doxygen_style.py
+"""
+
+import sys
+import textwrap
+
+from check_doxygen_style import Finding, check_source
+
+
+def findings_for(text: str) -> list[Finding]:
+    """Return the style violations for the given source text.
+
+    The text is dedented and its leading newline stripped, so fixtures can be
+    written as indented triple-quoted here-docs while keeping honest 1-based
+    line numbers.
+    """
+    text = textwrap.dedent(text).lstrip("\n")
+    return check_source(text)
+
+
+def labels_for(text: str) -> list[str]:
+    return [f.category.label for f in findings_for(text)]
+
+
+def messages_for(text: str) -> list[str]:
+    return [f.message for f in findings_for(text)]
+
+
+# --- well-formed input produces nothing -------------------------------------
+
+
+def test_clean_block_ok() -> None:
+    code = """
+    /**
+     * Brief.
+     *
+     * @tparam T a type
+     * @param x the x
+     * @return the result
+     */
+    """
+    assert findings_for(code) == []
+
+
+def test_blank_lines_inside_block_ok() -> None:
+    code = """
+    /**
+     * a
+     *
+     * b
+     */
+    """
+    assert findings_for(code) == []
+
+
+def test_member_and_divider_allowed() -> None:
+    assert findings_for("int x;  ///< ok member\n") == []
+    assert findings_for("//////////\n") == []
+    assert findings_for("//// text\n") == []
+
+
+# --- line-comment forms ------------------------------------------------------
+
+
+def test_triple_slash() -> None:
+    code = "/// doc\n"
+    assert labels_for(code) == ["triple-slash"]
+
+
+def test_qt_line() -> None:
+    code = "//! doc\n"
+    assert labels_for(code) == ["qt-line"]
+
+
+def test_qt_member() -> None:
+    code = "int x;  //!< doc\n"
+    assert labels_for(code) == ["qt-member"]
+
+
+def test_block_member() -> None:
+    code = "int x;  /**< doc */\n"
+    assert labels_for(code) == ["block-member"]
+
+
+def test_qt_block_member() -> None:
+    code = "int x;  /*!< doc */\n"
+    assert labels_for(code) == ["qt-block-member"]
+
+
+def test_doc_in_line_comment() -> None:
+    code = "// @param x\n"
+    assert labels_for(code) == ["doc-in-line-comment"]
+
+
+# --- block forms -------------------------------------------------------------
+
+
+def test_qt_comment() -> None:
+    code = """
+    /*!
+     * brief
+     */
+    """
+    assert labels_for(code) == ["qt-comment"]
+
+
+def test_qt_comment_single_line() -> None:
+    # /*! ... */ on one line -> qt-comment (plus single-line-block)
+    code = "/*! brief */\n"
+    assert labels_for(code) == ["qt-comment", "single-line-block"]
+
+
+def test_single_line_block() -> None:
+    code = "/** brief */\n"
+    assert labels_for(code) == ["single-line-block"]
+
+
+def test_single_line_markers_allowed() -> None:
+    for marker in ("@{", "@}", "@cond LABEL", "@endcond", "@file foo.h"):
+        code = f"/** {marker} */\n"
+        assert findings_for(code) == [], marker
+
+
+def test_text_on_opener() -> None:
+    code = """
+    /** text here
+     * more
+     */
+    """
+    assert labels_for(code) == ["text-on-opener"]
+
+
+def test_bare_continuation() -> None:
+    code = """
+    /**
+     * a
+       bare line
+     */
+    """
+    assert labels_for(code) == ["bare-continuation"]
+
+
+def test_over_indented_first_line() -> None:
+    code = """
+    /**
+     *   over
+     */
+    """
+    assert labels_for(code) == ["over-indented"]
+
+
+def test_over_indented_tag() -> None:
+    # a flush first line consumes "first content", isolating the tag check
+    code = """
+    /**
+     * brief
+     *   @param x
+     */
+    """
+    assert labels_for(code) == ["over-indented-tag"]
+
+
+def test_combined_marker() -> None:
+    code = """
+    /**
+     * @{
+     */
+    """
+    assert labels_for(code) == ["combined-marker"]
+
+
+def test_prose_label() -> None:
+    for word in ("Returns", "Throws", "Exceptions"):
+        code = f"""
+        /**
+         * {word}:
+         */
+        """
+        assert labels_for(code) == ["prose-label"], word
+
+
+def test_content_on_closer() -> None:
+    code = """
+    /**
+     * a
+     * b */
+    """
+    assert labels_for(code) == ["content-on-closer"]
+
+
+def test_plain_block_doc() -> None:
+    assert labels_for("/* @param x */\n") == ["plain-block-doc"]
+    assert findings_for("/* just an ordinary note */\n") == []
+
+
+def test_tag_order() -> None:
+    out_of_order = """
+    /**
+     * @param x
+     * @tparam T
+     */
+    """
+    assert labels_for(out_of_order) == ["tag-order"]
+
+    correct = """
+    /**
+     * @tparam T
+     * @param x
+     * @return r
+     */
+    """
+    assert findings_for(correct) == []
+
+    single = """
+    /**
+     * @param x
+     */
+    """
+    assert findings_for(single) == []  # single tag: never out of order
+
+
+# --- command spelling (must work on body/closer lines, not just the opener) --
+
+
+def test_backslash_command_on_body_line() -> None:
+    code = r"""
+    /**
+     * \brief x
+     */
+    """
+    assert labels_for(code) == ["backslash-command"]
+
+
+def test_backslash_command_suggests_canonical_spelling() -> None:
+    # a backslash + non-canonical spelling is fixed in one pass, not two:
+    # \sa -> @see (not @sa), \returns -> @return (not @returns)
+    sa = r"""
+    /**
+     * \sa other
+     */
+    """
+    assert messages_for(sa) == [r"use @see instead of \sa"]
+
+    returns = r"""
+    /**
+     * \returns x
+     */
+    """
+    assert messages_for(returns) == [r"use @return instead of \returns"]
+
+
+def test_wrong_command_on_body_line() -> None:
+    code = """
+    /**
+     * @returns x
+     */
+    """
+    assert labels_for(code) == ["wrong-command"]
+
+
+def test_body_line_commands_regression() -> None:
+    # regression: these live on body lines of a multi-line block
+    code = r"""
+    /**
+     * @returns bad
+     * @throw ex
+     * @sa other
+     * \param y
+     */
+    """
+    assert labels_for(code) == [
+        "wrong-command",
+        "wrong-command",
+        "wrong-command",
+        "backslash-command",
+    ]
+
+
+def test_command_on_closer_line() -> None:
+    code = """
+    /**
+     * a
+     * @sa b */
+    """
+    assert labels_for(code) == ["wrong-command", "content-on-closer"]
+
+
+def test_no_double_count_across_opener_body_closer() -> None:
+    code = """
+    /** @returns opener
+     * @throw body
+     * @sa closer */
+    """
+    assert labels_for(code).count("wrong-command") == 3
+
+
+def test_code_with_word_allowed() -> None:
+    # @code{.cpp} is valid Doxygen and must not be flagged
+    code = """
+    /**
+     * @code{.cpp}
+     * int x;
+     * @endcode
+     */
+    """
+    assert findings_for(code) == []
+
+
+# --- rendered message text ---------------------------------------------------
+
+
+def test_message_uses_category_description() -> None:
+    # a static category renders its default description
+    code = "/// doc\n"
+    assert messages_for(code) == ["use a /** ... */ block instead of ///"]
+
+
+def test_message_detail_overrides() -> None:
+    # dynamic categories render the offending text via Finding.detail
+    backslash = r"""
+    /**
+     * \param y
+     */
+    """
+    assert messages_for(backslash) == [r"use @param instead of \param"]
+
+    wrong = """
+    /**
+     * @returns x
+     */
+    """
+    assert messages_for(wrong) == ["use @return instead of @returns"]
+
+    prose = """
+    /**
+     * Throws:
+     */
+    """
+    assert messages_for(prose) == ['use @throws instead of prose "Throws:"']
+
+
+# --- robustness --------------------------------------------------------------
+
+
+def test_empty_file_no_crash() -> None:
+    assert findings_for("") == []
+
+
+def test_mid_line_plain_block_skipped() -> None:
+    # a /* opened mid-line (after code) and spanning lines is skipped, so its
+    # comment-like contents are not analyzed
+    code = """
+    int x = 0;  /* note: @returns is not a real tag here
+     * @param also not real
+     */
+    int y = 0;
+    """
+    assert findings_for(code) == []
+
+
+def test_unclosed_block_scanned_to_eof() -> None:
+    # an unterminated /** block is still scanned to EOF (no crash, body checked)
+    code = """
+    /**
+     * @returns x
+    """
+    assert labels_for(code) == ["wrong-command"]
+
+
+def test_banner_and_empty_comment_not_flagged() -> None:
+    code = """
+    /***
+     * banner
+     ***/
+    """
+    assert findings_for(code) == []
+    assert findings_for("/**/\n") == []
+
+
+def main() -> int:
+    tests = sorted(
+        (name, fn)
+        for name, fn in globals().items()
+        if name.startswith("test_") and callable(fn)
+    )
+    failed = 0
+    for name, fn in tests:
+        try:
+            fn()
+            print(f"PASS {name}")
+        except AssertionError as exc:
+            failed += 1
+            print(f"FAIL {name}: {exc!r}")
+    print(f"\n{len(tests) - failed}/{len(tests)} passed")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

cfg/xrpld-example.cfg

@@ -1621,96 +1621,3 @@ validators.txt
 # set to ssl_verify to 0.
 [ssl_verify]
 1
-#-------------------------------------------------------------------------------
-#
-# 11. Telemetry (OpenTelemetry Tracing)
-#
-#-------------------------------------------------------------------------------
-#
-# Enables distributed tracing via OpenTelemetry. Requires building with
-# -DXRPL_ENABLE_TELEMETRY=ON (telemetry Conan option).
-#
-# [telemetry]
-#
-# enabled=0
-#
-#   Enable or disable telemetry at runtime. Default: 0 (disabled).
-#
-# service_name=xrpld
-#
-#   OTel resource attribute `service.name`. Default: xrpld.
-#   The node's network ID (from [network_id]) is automatically added
-#   as the `xrpl.network.id` and `xrpl.network.type` resource attributes.
-#
-# service_instance_id=<node_public_key>
-#
-#   OTel resource attribute `service.instance.id`. Uniquely identifies
-#   this node. Default: the node's public key (auto-detected).
-#
-# endpoint=http://localhost:4318/v1/traces
-#
-#   The OTLP/HTTP exporter endpoint. The server sends trace data as
-#   protobuf-encoded HTTP POST requests to this URL.
-#   Default: http://localhost:4318/v1/traces.
-#
-# --- TLS settings for the OTLP exporter connection ---
-#
-# use_tls=0
-#
-#   Enable TLS for the OTLP/HTTP exporter connection. Default: 0 (off).
-#
-# tls_ca_cert=
-#
-#   Path to a PEM-encoded CA certificate bundle for TLS verification.
-#   Only used when use_tls=1. Default: empty (system CA store).
-#
-#   Head sampling is intentionally fixed at 1.0 (sample everything) and is
-#   not configurable. A per-node sampling ratio would let nodes make
-#   divergent keep/drop decisions for the same distributed trace, producing
-#   broken/partial traces. A ParentBasedSampler ensures spans inheriting a
-#   remote parent honor the upstream decision. Reduce volume at the collector
-#   via tail sampling instead; for node-local post-hoc dropping use
-#   SpanGuard::discard() in code.
-#
-# trace_rpc=1
-#
-#   Enable tracing for JSON-RPC and WebSocket API request handling —
-#   command parsing, execution, and response serialization. Default: 1.
-#
-# trace_transactions=1
-#
-#   Enable tracing for the transaction lifecycle — submission, validation,
-#   application to ledgers, and final disposition. Default: 1.
-#
-# trace_consensus=1
-#
-#   Enable tracing for the consensus round lifecycle — proposals,
-#   validations, mode changes, and ledger acceptance. Default: 1.
-#
-# trace_peer=1
-#
-#   Enable tracing for peer-to-peer protocol messages — overlay message
-#   send/receive, peer handshakes, and routing. High volume; enabled
-#   by default. Default: 1.
-#
-# trace_ledger=1
-#
-#   Enable tracing for ledger close and accept operations — ledger
-#   building, state hashing, and write-back to the node store. Default: 1.
-#
-# --- Batch processor tuning ---
-#
-# batch_size=512
-#
-#   Maximum number of spans exported in a single batch. Default: 512.
-#
-# batch_delay_ms=5000
-#
-#   Maximum delay (milliseconds) before a partial batch is flushed.
-#   Default: 5000 (5 seconds).
-#
-# max_queue_size=2048
-#
-#   Maximum number of spans queued in memory before drops occur.
-#   Default: 2048.
-#

cmake/XrplCore.cmake

@@ -198,31 +198,8 @@ target_link_libraries(
         xrpl.libxrpl.conditions
 )
 
-# Telemetry module — OpenTelemetry distributed tracing support.
-# Sources: include/xrpl/telemetry/ (headers), src/libxrpl/telemetry/ (impl).
-# When telemetry=ON, links the Conan-provided umbrella target
-# opentelemetry-cpp::opentelemetry-cpp (individual component targets like
-# ::api, ::sdk are not available in the Conan package).
-#
-# Links xrpl.libxrpl.protocol PRIVATELY for sha512Half (digest.h)
-add_module(xrpl telemetry)
-target_link_libraries(
-    xrpl.libxrpl.telemetry
-    PUBLIC xrpl.libxrpl.basics xrpl.libxrpl.beast xrpl.libxrpl.config
-    PRIVATE xrpl.libxrpl.protocol
-)
-if(telemetry)
-    target_link_libraries(
-        xrpl.libxrpl.telemetry
-        PUBLIC opentelemetry-cpp::opentelemetry-cpp
-    )
-endif()
-
 add_module(xrpl tx)
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl.libxrpl.telemetry
-)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
 
 add_library(xrpl.libxrpl)
 set_target_properties(xrpl.libxrpl PROPERTIES OUTPUT_NAME xrpl)
@@ -256,7 +233,6 @@ target_link_modules(
     resource
     server
     shamap
-    telemetry
     tx
 )
 

cmake/scripts/codegen/templates/LedgerEntry.h.mako

@@ -177,7 +177,9 @@ ${field['typeData']['setter_type']} ${field['paramName']}${',' if i < len(requir
         object_ = *sle;
     }
 
-    /** @brief Ledger entry-specific field setters */
+    /**
+     * @brief Ledger entry-specific field setters
+     */
 % for field in fields:
 
     /**

cmake/scripts/codegen/templates/Transaction.h.mako

@@ -185,7 +185,9 @@ public:
         object_ = *tx;
     }
 
-    /** @brief Transaction-specific field setters */
+    /**
+     * @brief Transaction-specific field setters
+     */
 % for field in fields:
 
     /**

conan.lock

@@ -10,44 +10,35 @@
         "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
         "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "opentelemetry-cpp/1.26.0#9d81768342c78cb897345fd419b358d2%1776934712.672",
-        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
+        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "nlohmann_json/3.11.3#45828be26eb619a2e04ca517bb7b828d%1701220705.259",
-        "mpt-crypto/0.4.0-rc2#a580f2f9ad0e795de696aa62d54fb9af%1782425834.488828",
+        "mpt-crypto/0.4.0-rc4#ffdba12f2332357f0d8b0ae944cfff52%1784138702.932355",
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
         "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
-        "libcurl/8.20.0#c90b0c91a33d9a79b519c1c70bafc823%1780907438.587",
         "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
+        "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
     ],
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "pkgconf/2.5.1#93c2051284cba1279494a43a4fcfeae2%1757684701.089",
-        "opentelemetry-proto/1.7.0#ed6d5bd761bef0afb0ba09676420b9ea%1749461220.268",
-        "ninja/1.13.2#c8c5dc2a52ed6e4e42a66d75b4717ceb%1764096931.974",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "meson/1.10.2#9d2d10681fe7fe61c788c58626c89b25%1775558003.754",
         "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
-        "libtool/2.4.7#14e7739cc128bc1623d2ed318008e47e%1755679003.847",
-        "gnu-config/cci.20210814#466e9d4d7779e1c142443f7ea44b4284%1762363589.329",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
     ],
     "python_requires": [],
     "overrides": {
@@ -68,9 +59,6 @@
         ],
         "lz4/[>=1.9.4 <2]": [
             "lz4/1.10.0#982d9b673900f665a1da109e09c17cab"
-        ],
-        "protobuf/[>=4.25.3 <7]": [
-            "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81"
         ]
     },
     "config_requires": []

conan/profiles/default

@@ -25,18 +25,3 @@ compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
-{% if compiler == "gcc" and compiler_version < 13 %}
-tools.build:cxxflags+=['-Wno-restrict']
-{% endif %}
-{% if os == "Windows" %}
-# opentelemetry-cpp's recipe removes the `shared` option on Windows and never
-# sets BUILD_SHARED_LIBS, so its upstream CMake defaults the protobuf-generated
-# `opentelemetry_proto` target to a DLL (opentelemetry_proto.dll). The rest of
-# the project links statically and nothing deploys that DLL next to the
-# executables, so the telemetry unit test fails to start with
-# STATUS_DLL_NOT_FOUND (0xC0000135). Force the dependency to build fully static
-# so no runtime DLL is produced. The conf is folded into the package id so a
-# fresh static binary is built instead of reusing a previously cached one.
-opentelemetry-cpp/*:tools.cmake.cmaketoolchain:extra_variables={"BUILD_SHARED_LIBS": "OFF"}
-opentelemetry-cpp/*:tools.info.package_id:confs+=["tools.cmake.cmaketoolchain:extra_variables"]
-{% endif %}

conanfile.py

@@ -21,7 +21,6 @@ class Xrpl(ConanFile):
         "rocksdb": [True, False],
         "shared": [True, False],
         "static": [True, False],
-        "telemetry": [True, False],
         "tests": [True, False],
         "unity": [True, False],
         "xrpld": [True, False],
@@ -53,7 +52,6 @@ class Xrpl(ConanFile):
         "rocksdb": True,
         "shared": False,
         "static": True,
-        "telemetry": True,
         "tests": False,
         "unity": False,
         "xrpld": False,
@@ -136,16 +134,12 @@ class Xrpl(ConanFile):
         if self.options.jemalloc:
             self.requires("jemalloc/5.3.1")
         self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/0.4.0-rc2", transitive_headers=True)
+        self.requires("mpt-crypto/0.4.0-rc4", transitive_headers=True)
         self.requires("protobuf/6.33.5", force=True)
         if self.options.rocksdb:
             self.requires("rocksdb/10.5.1")
         self.requires("secp256k1/0.7.1", transitive_headers=True)
         self.requires("sqlite3/3.53.0", force=True)
-        # OpenTelemetry C++ SDK for distributed tracing (optional).
-        # Provides OTLP/HTTP exporter, batch span processor, and trace API.
-        if self.options.telemetry:
-            self.requires("opentelemetry-cpp/1.26.0")
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
@@ -174,7 +168,6 @@ class Xrpl(ConanFile):
         tc.variables["rocksdb"] = self.options.rocksdb
         tc.variables["BUILD_SHARED_LIBS"] = self.options.shared
         tc.variables["static"] = self.options.static
-        tc.variables["telemetry"] = self.options.telemetry
         tc.variables["unity"] = self.options.unity
         tc.variables["xrpld"] = self.options.xrpld
         tc.generate()
@@ -228,5 +221,3 @@ class Xrpl(ConanFile):
         ]
         if self.options.rocksdb:
             libxrpl.requires.append("rocksdb::librocksdb")
-        if self.options.telemetry:
-            libxrpl.requires.append("opentelemetry-cpp::opentelemetry-cpp")

docker/telemetry/docker-compose.yml

@@ -1,80 +0,0 @@
-# Docker Compose stack for xrpld OpenTelemetry observability.
-#
-# Provides services for local development:
-#   - otel-collector: receives OTLP traces from xrpld, batches and
-#     forwards them to Tempo. Listens on ports 4317 (gRPC)
-#     and 4318 (HTTP).
-#   - tempo: Grafana Tempo tracing backend, queryable via Grafana Explore
-#     on port 3000. Recommended for production (S3/GCS storage, TraceQL).
-#   - grafana: dashboards on port 3000, pre-configured with Tempo
-#     datasource.
-#
-# Usage:
-#   docker compose -f docker/telemetry/docker-compose.yml up -d
-#
-# Configure xrpld to export traces by adding to xrpld.cfg:
-#   [telemetry]
-#   enabled=1
-#   endpoint=http://localhost:4318/v1/traces
-
-services:
-  # OpenTelemetry Collector: receives spans from xrpld via OTLP protocol,
-  # batches them for efficiency, and forwards to Tempo for storage.
-  otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.121.0
-    command: ["--config=/etc/otel-collector-config.yaml"]
-    ports:
-      - "4317:4317" # OTLP gRPC receiver
-      - "4318:4318" # OTLP HTTP receiver (xrpld sends traces here)
-      - "13133:13133" # Health check endpoint
-    volumes:
-      # Mount collector pipeline config (receivers → processors → exporters)
-      - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
-    depends_on:
-      - tempo
-    networks:
-      - xrpld-telemetry
-
-  # Grafana Tempo: distributed tracing backend that stores and indexes
-  # spans. Queryable via TraceQL in Grafana Explore.
-  tempo:
-    image: grafana/tempo:2.7.2
-    command: ["-config.file=/etc/tempo.yaml"]
-    ports:
-      - "3200:3200" # Tempo HTTP API (health check, query)
-    volumes:
-      # Mount Tempo storage and ingestion config
-      - ./tempo.yaml:/etc/tempo.yaml:ro
-      # Persistent volume for trace data (WAL + blocks)
-      - tempo-data:/var/tempo
-    networks:
-      - xrpld-telemetry
-
-  # Grafana: visualization UI with Tempo pre-configured as a datasource.
-  # Anonymous admin access enabled for local development convenience.
-  grafana:
-    image: grafana/grafana:11.5.2
-    environment:
-      - GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev
-      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth
-    ports:
-      - "3000:3000" # Grafana web UI
-    volumes:
-      # Auto-provision Tempo datasource and search filters on startup
-      - ./grafana/provisioning:/etc/grafana/provisioning:ro
-    depends_on:
-      - tempo
-    networks:
-      - xrpld-telemetry
-
-# Named volume for Tempo trace storage (WAL and compacted blocks).
-# Data persists across container restarts. Remove with:
-#   docker compose -f docker/telemetry/docker-compose.yml down -v
-volumes:
-  tempo-data:
-
-# Isolated bridge network so services communicate by container name
-# (e.g., the collector reaches Tempo at http://tempo:4317).
-networks:
-  xrpld-telemetry:
-    driver: bridge

docker/telemetry/grafana/provisioning/datasources/tempo.yaml

@@ -1,125 +0,0 @@
-# Grafana datasource provisioning for Grafana Tempo.
-# Auto-configures Tempo as a trace data source on Grafana startup.
-# Access Grafana at http://localhost:3000, then use Explore -> Tempo
-# to browse xrpld traces using TraceQL.
-#
-# Search filters provide pre-configured dropdowns in the Explore UI.
-# Each phase adds filters for the span attributes it introduces.
-# Base filters — node identity, service, span name, status.
-# RPC command, status, role filters.
-# Transaction hash, local/peer origin, status.
-
-apiVersion: 1
-
-datasources:
-  - name: Tempo
-    type: tempo
-    access: proxy
-    url: http://tempo:3200
-    uid: tempo
-    jsonData:
-      nodeGraph:
-        enabled: true
-      # Service map and traces-to-metrics require a Prometheus datasource
-      # (not included in this stack). These features are inactive until a
-      # Prometheus service is added to docker-compose.yml.
-      serviceMap:
-        datasourceUid: prometheus
-      tracesToMetrics:
-        datasourceUid: prometheus
-        spanStartTimeShift: "-1h"
-        spanEndTimeShift: "1h"
-      search:
-        filters:
-          # --- Node identification filters ---
-          # service.name: logical service name (default: "xrpld").
-          #   Useful when running multiple service types in the same collector.
-          - id: service-name
-            tag: service.name
-            operator: "="
-            scope: resource
-            type: dynamic
-          # service.instance.id: unique node identifier — defaults to the
-          #   node's public key (e.g., nHB1X37...). Distinguishes individual
-          #   nodes in a multi-node cluster or network.
-          - id: node-id
-            tag: service.instance.id
-            operator: "="
-            scope: resource
-            type: dynamic
-          # service.version: xrpld build version (e.g., "2.4.0-b1").
-          #   Filter traces from specific software releases.
-          - id: node-version
-            tag: service.version
-            operator: "="
-            scope: resource
-            type: dynamic
-          # xrpl.network.id: numeric network identifier
-          #   (0 = mainnet, 1 = testnet, 2 = devnet, etc.).
-          #   Derived from the [network_id] config section.
-          - id: network-id
-            tag: xrpl.network.id
-            operator: "="
-            scope: resource
-            type: dynamic
-          # xrpl.network.type: human-readable network name derived from
-          #   network ID ("mainnet", "testnet", "devnet", "unknown").
-          - id: network-type
-            tag: xrpl.network.type
-            operator: "="
-            scope: resource
-            type: dynamic
-          # --- Span intrinsic filters ---
-          # name: the span operation name (e.g., "rpc.command.server_info").
-          #   Use to find traces for a specific RPC command or subsystem.
-          - id: span-name
-            tag: name
-            operator: "="
-            scope: intrinsic
-            type: dynamic
-          # status: span completion status ("ok", "error", "unset").
-          #   Filter for failed operations to diagnose errors.
-          - id: span-status
-            tag: status
-            operator: "="
-            scope: intrinsic
-            type: dynamic
-          # duration: span wall-clock duration. Use with ">" operator
-          #   to find slow operations (e.g., duration > 500ms).
-          - id: span-duration
-            tag: duration
-            operator: ">"
-            scope: intrinsic
-            type: dynamic
-          # RPC tracing filters
-          - id: rpc-command
-            tag: command
-            operator: "="
-            scope: span
-            type: dynamic
-          - id: rpc-status
-            tag: rpc_status
-            operator: "="
-            scope: span
-            type: dynamic
-          - id: rpc-role
-            tag: rpc_role
-            operator: "="
-            scope: span
-            type: dynamic
-          # Transaction tracing filters
-          - id: tx-hash
-            tag: tx_hash
-            operator: "="
-            scope: span
-            type: static
-          - id: tx-origin
-            tag: local
-            operator: "="
-            scope: span
-            type: dynamic
-          - id: tx-status
-            tag: tx_status
-            operator: "="
-            scope: span
-            type: dynamic

docker/telemetry/otel-collector-config.yaml

@@ -1,79 +0,0 @@
-# OpenTelemetry Collector configuration for xrpld development.
-#
-# Pipeline: OTLP receiver -> batch processor -> debug + Tempo.
-# xrpld sends traces via OTLP/HTTP to port 4318. The collector batches
-# them and forwards to Tempo via OTLP/gRPC on the Docker network. Tempo
-# is queryable via Grafana Explore using TraceQL.
-
-receivers:
-  otlp:
-    protocols:
-      grpc:
-        endpoint: 0.0.0.0:4317
-      http:
-        endpoint: 0.0.0.0:4318
-
-processors:
-  batch:
-    timeout: 1s
-    send_batch_size: 100
-  # Deployment-tier tagging. Each collector serves ONE environment and ONE
-  # network, so it stamps both onto every signal it forwards. This lets a
-  # single Grafana stack hold data from many collectors and filter by tier.
-  #   - deployment.environment: the collector IS the environment (local, ci,
-  #     test, prod), so it is authoritative -> upsert (overwrite).
-  #   - xrpl.network.type: the xrpld node knows its own chain and already
-  #     stamps this, so the collector only fills it when absent -> insert.
-  #     This keeps a node's real network (e.g. a local node on mainnet)
-  #     from being overwritten by a collector's default.
-  # Replace the placeholder values per collector; see docker/telemetry
-  # tier examples.
-  resource/tier:
-    attributes:
-      - key: deployment.environment
-        value: local
-        action: upsert
-      - key: xrpl.network.type
-        value: mainnet
-        action: insert
-  # Strip SDK-injected resource attributes (telemetry.sdk.language/name/version).
-  # The OpenTelemetry SDK auto-adds these to every Resource; they carry no
-  # operational value and clutter the attribute set on every backend, so drop
-  # them here for all signals.
-  resource/stripsdk:
-    attributes:
-      - key: telemetry.sdk.language
-        action: delete
-      - key: telemetry.sdk.name
-        action: delete
-      - key: telemetry.sdk.version
-        action: delete
-  # Defense-in-depth: hash path-finding account attributes. The xrpld SDK
-  # already hashes these before export, but a node that emitted raw values
-  # is caught here so raw addresses never reach the backend.
-  attributes/hash:
-    actions:
-      - key: pathfind_source_account
-        action: hash
-      - key: pathfind_dest_account
-        action: hash
-
-exporters:
-  debug:
-    verbosity: detailed
-  otlp/tempo:
-    endpoint: tempo:4317
-    tls:
-      insecure: true
-
-extensions:
-  health_check:
-    endpoint: 0.0.0.0:13133
-
-service:
-  extensions: [health_check]
-  pipelines:
-    traces:
-      receivers: [otlp]
-      processors: [resource/tier, resource/stripsdk, attributes/hash, batch]
-      exporters: [debug, otlp/tempo]

docker/telemetry/tempo.yaml

@@ -1,61 +0,0 @@
-# Grafana Tempo configuration for xrpld telemetry stack.
-#
-# Runs in single-binary mode for local development.
-# Receives traces via OTLP/gRPC from the OTel Collector and stores
-# them locally. Queryable via Grafana Explore using the Tempo datasource.
-#
-# Search filters are configured on the Grafana datasource side
-# (grafana/provisioning/datasources/tempo.yaml). Tempo auto-indexes
-# all span attributes for search in single-binary mode.
-#
-# For production, replace local storage with S3/GCS backend and adjust
-# retention via the compactor settings. See:
-# https://grafana.com/docs/tempo/latest/configuration/
-
-stream_over_http_enabled: true
-
-server:
-  http_listen_port: 3200
-
-distributor:
-  receivers:
-    otlp:
-      protocols:
-        grpc:
-          endpoint: 0.0.0.0:4317
-
-ingester:
-  max_block_duration: 5m
-
-compactor:
-  compaction:
-    block_retention: 1h
-
-# Enable metrics generator for service graph and span metrics.
-# Produces RED metrics (rate, errors, duration) per service/span,
-# feeding Grafana's service map visualization.
-metrics_generator:
-  registry:
-    external_labels:
-      source: tempo
-  storage:
-    path: /var/tempo/generator/wal
-    # Uncomment and add a Prometheus service to docker-compose.yml
-    # to enable remote_write for service graph metrics:
-    # remote_write:
-    #   - url: http://prometheus:9090/api/v1/write
-
-overrides:
-  defaults:
-    metrics_generator:
-      processors:
-        - service-graphs
-        - span-metrics
-
-storage:
-  trace:
-    backend: local
-    wal:
-      path: /var/tempo/wal
-    local:
-      path: /var/tempo/blocks

docs/build/environment.md

@@ -33,9 +33,10 @@ with a single command and without installing anything system-wide:
 nix --experimental-features 'nix-command flakes' develop
 ```
 
-On **Linux**, Nix also provides the compiler (GCC). On **macOS**, the shell uses
-your **system-wide Apple Clang** as the compiler, so you still need to manage
-its version (see below).
+On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
+Clang. If you instead opt to use your system-wide Apple Clang (via
+`nix develop .#apple-clang`), you need to manage its version yourself (see
+below).
 
 See [Using the Nix development shell](./nix.md) for installation and usage
 details, including how to select a different compiler.
@@ -48,10 +49,10 @@ details, including how to select a different compiler.
 
 ### macOS: managing the Apple Clang version
 
-Because the Nix shell uses the system-wide Apple Clang on macOS, the compiler
-version is whatever your installed Xcode (or Command Line Tools) provides. The
-following command should return a version greater than or equal to the
-[minimum required](#tested-compiler-versions):
+If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
+the compiler version is whatever your installed Xcode (or Command Line Tools)
+provides. The following command should return a version greater than or equal to
+the [minimum required](#tested-compiler-versions):
 
 ```bash
 clang --version

docs/build/nix.md

@@ -9,7 +9,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
-- **Multiple compiler versions**: Easily switch between different GCC and Clang versions
+- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
 - **Works on Linux and macOS**: Consistent experience across platforms
 
@@ -31,8 +31,8 @@ This will:
 
 - Download and set up all required development tools (CMake, Ninja, Conan, etc.)
 - Configure the appropriate compiler for your platform:
-  - **Linux**: GCC 15.2 (provided by Nix)
-  - **macOS**: Apple Clang (your system compiler)
+  - **Linux**: GCC (provided by Nix)
+  - **macOS**: Clang (provided by Nix)
 
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.
 
@@ -40,12 +40,12 @@ The first time you run this command, it will take a few minutes to download and
 
 - **Linux**: `nix develop` gives you a shell with all the tooling necessary to
   develop xrpld and with GCC 15.2 (also provided by Nix). There are no caveats.
-- **macOS**: `nix develop` gives you a full environment too. The compiler is
-  your system-wide Apple Clang, while every other tool — including Conan — is
-  provided by Nix. Conan has no binary in the Nix cache for macOS, so it is
-  built from source the first time you enter the shell, which makes the initial
-  setup slower (this is handled automatically; see
-  [`nix/devshell.nix`](../../nix/devshell.nix)).
+- **macOS**: `nix develop` gives you a full environment too, with Clang (and
+  every other tool, including Conan) provided by Nix. To use your system-wide
+  Apple Clang instead, enter `nix develop .#apple-clang`. Conan has no binary in
+  the Nix cache for macOS, so it is built from source the first time you enter
+  the shell, which makes the initial setup slower (this is handled
+  automatically; see [`nix/devshell.nix`](../../nix/devshell.nix)).
 
 > [!TIP]
 > To avoid typing `--experimental-features 'nix-command flakes'` every time, you can permanently enable flakes by creating `~/.config/nix/nix.conf`:
@@ -62,7 +62,9 @@ The first time you run this command, it will take a few minutes to download and
 
 ### Choosing a different compiler
 
-A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#gcc15`.
+A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#clang`.
+The `.#gcc` and `.#clang` shells provide the same GCC and Clang versions used in CI
+(pinned in [`nix/packages.nix`](../../nix/packages.nix)).
 Use `nix flake show` to see all the available development shells.
 
 Use `nix develop .#no-compiler` to use the compiler from your system.
@@ -70,11 +72,11 @@ Use `nix develop .#no-compiler` to use the compiler from your system.
 ### Example Usage
 
 ```bash
-# Use GCC 14
-nix develop .#gcc14
+# Use GCC (same version as CI)
+nix develop .#gcc
 
-# Use Clang 19
-nix develop .#clang19
+# Use Clang (same version as CI)
+nix develop .#clang
 
 # Use default for your platform
 nix develop
@@ -112,7 +114,15 @@ Once inside the Nix development shell, follow the standard [build instructions](
 
 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
 
-This is also the most robust way to use the environment from **any shell** (bash, zsh, fish, …): direnv stays in your current shell and loads the environment _after_ your shell's startup files have run, so the Nix-provided tools take precedence over anything your shell configuration adds to `$PATH`. To use it, install direnv for your shell, then add an `.envrc` containing `use flake` at the repository root and run `direnv allow`.
+This is also the most robust way to use the environment from **any shell** (bash, zsh, fish, …): direnv stays in your current shell and loads the environment _after_ your shell's startup files have run, so the Nix-provided tools take precedence over anything your shell configuration adds to `$PATH`.
+
+The repository already ships an `.envrc` at its root that activates the Nix flake development shell, so you don't need to create one. To use it:
+
+1. [Install direnv](https://direnv.net/docs/installation.html) and [hook it into your shell](https://direnv.net/docs/hook.html) (bash, zsh, fish, …). Installing [nix-direnv](https://github.com/nix-community/nix-direnv) as well is recommended: it caches the shell so that activation is near-instant after the first run.
+2. Run `direnv allow` once in the repository root. direnv will then load (and reload) the Nix development shell automatically whenever you enter the directory.
+
+> [!NOTE]
+> direnv only caches the `.direnv` directory (already listed in `.gitignore`); no other repository files are affected.
 
 ## Conan and Prebuilt Packages
 

docs/build/telemetry.md

@@ -1,129 +0,0 @@
-# OpenTelemetry Tracing for xrpld
-
-This document explains how to build xrpld with OpenTelemetry distributed tracing support, configure the runtime telemetry options, and set up the observability backend to view traces.
-
-- [OpenTelemetry Tracing for xrpld](#opentelemetry-tracing-for-xrpld)
-  - [Overview](#overview)
-  - [Building with Telemetry](#building-with-telemetry)
-    - [Summary](#summary)
-    - [Build steps](#build-steps)
-      - [Install dependencies](#install-dependencies)
-      - [Call CMake](#call-cmake)
-      - [Build](#build)
-  - [Building without telemetry](#building-without-telemetry)
-  - [Troubleshooting](#troubleshooting)
-    - [Conan lockfile error](#conan-lockfile-error)
-    - [CMake target not found](#cmake-target-not-found)
-  - [Conditional compilation](#conditional-compilation)
-
-## Overview
-
-xrpld supports optional [OpenTelemetry](https://opentelemetry.io/) distributed tracing.
-When enabled, it instruments RPC requests with trace spans that are exported via
-OTLP/HTTP to an OpenTelemetry Collector, which forwards them to a tracing backend
-such as Grafana Tempo.
-
-Telemetry is **off by default** at both compile time and runtime:
-
-- **Compile time**: The Conan option `telemetry` and CMake option `telemetry` must be set to `True`/`ON`.
-  When disabled, all `SpanGuard` calls compile to inline no-ops (defined in `SpanGuard.h`)
-  with zero overhead — no OTel SDK dependency required.
-- **Runtime**: The `[telemetry]` config section must set `enabled=1`.
-  When disabled at runtime, a no-op implementation is used.
-
-## Building with Telemetry
-
-### Summary
-
-Follow the same instructions as mentioned in [BUILD.md](../../BUILD.md) but with the following changes:
-
-1. Pass `-o telemetry=True` to `conan install` to pull the `opentelemetry-cpp` dependency.
-2. CMake will automatically pick up `telemetry=ON` from the Conan-generated toolchain.
-3. Build as usual.
-
----
-
-### Build steps
-
-```bash
-cd /path/to/xrpld
-rm -rf .build
-mkdir .build
-cd .build
-```
-
-#### Install dependencies
-
-The `telemetry` option adds `opentelemetry-cpp/1.26.0` as a dependency.
-If the Conan lockfile does not yet include this package, bypass it with `--lockfile=""`.
-
-```bash
-conan install .. \
-    --output-folder . \
-    --build missing \
-    --settings build_type=Debug \
-    -o telemetry=True \
-    -o tests=True \
-    -o xrpld=True \
-    --lockfile=""
-```
-
-> **Note**: The first build with telemetry may take longer as `opentelemetry-cpp`
-> and its transitive dependencies are compiled from source.
-
-#### Call CMake
-
-The Conan-generated toolchain file sets `telemetry=ON` automatically.
-No additional CMake flags are needed beyond the standard ones.
-
-```bash
-cmake .. -G Ninja \
-    -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake \
-    -DCMAKE_BUILD_TYPE=Debug \
-    -Dtests=ON -Dxrpld=ON
-```
-
-You should see in the CMake output:
-
-```
--- OpenTelemetry tracing enabled
-```
-
-#### Build
-
-```bash
-cmake --build . --parallel $(nproc)
-```
-
-## Building without telemetry
-
-Omit the `-o telemetry=True` option (or pass `-o telemetry=False`).
-The `opentelemetry-cpp` dependency will not be downloaded,
-the `XRPL_ENABLE_TELEMETRY` preprocessor define will not be set,
-and all tracing macros will compile to no-ops.
-The resulting binary is identical to one built before telemetry support was added.
-
-## Troubleshooting
-
-### Conan lockfile error
-
-If you see `ERROR: Requirement 'opentelemetry-cpp/1.26.0' not in lockfile 'requires'`,
-the lockfile was generated without the telemetry dependency.
-Pass `--lockfile=""` to bypass the lockfile, or regenerate it with telemetry enabled.
-
-### CMake target not found
-
-If CMake reports that `opentelemetry-cpp` targets are not found,
-ensure you ran `conan install` with `-o telemetry=True` and that the
-Conan-generated toolchain file is being used.
-The Conan package provides a single umbrella target
-`opentelemetry-cpp::opentelemetry-cpp` (not individual component targets).
-
-## Conditional compilation
-
-All OpenTelemetry SDK types are hidden behind the pimpl idiom in `SpanGuard.cpp`.
-When `XRPL_ENABLE_TELEMETRY` is not defined, `SpanGuard.h` provides an all-inline
-no-op stub class with zero overhead and zero OTel dependencies.
-At runtime, if `enabled=0` is set in config (or the section is omitted), a
-`NullTelemetry` implementation is used that returns no-op spans.
-This two-layer approach ensures zero overhead when telemetry is not wanted.

include/xrpl/basics/Archive.h

@@ -4,13 +4,14 @@
 
 namespace xrpl {
 
-/** Extract a tar archive compressed with lz4
-
-    @param src the path of the archive to be extracted
-    @param dst the directory to extract to
-
-    @throws runtime_error
-*/
+/**
+ * Extract a tar archive compressed with lz4
+ *
+ * @param src the path of the archive to be extracted
+ * @param dst the directory to extract to
+ *
+ * @throws runtime_error
+ */
 void
 extractTarLz4(boost::filesystem::path const& src, boost::filesystem::path const& dst);
 

include/xrpl/basics/Blob.h

@@ -4,9 +4,10 @@
 
 namespace xrpl {
 
-/** Storage for linear binary data.
-    Blocks of binary data appear often in various idioms and structures.
-*/
+/**
+ * Storage for linear binary data.
+ * Blocks of binary data appear often in various idioms and structures.
+ */
 using Blob = std::vector<unsigned char>;
 
 }  // namespace xrpl

include/xrpl/basics/Buffer.h

@@ -10,9 +10,10 @@
 
 namespace xrpl {
 
-/** Like std::vector<char> but better.
-    Meets the requirements of BufferFactory.
-*/
+/**
+ * Like std::vector<char> but better.
+ * Meets the requirements of BufferFactory.
+ */
 class Buffer
 {
 private:
@@ -24,30 +25,37 @@ public:
 
     Buffer() = default;
 
-    /** Create an uninitialized buffer with the given size. */
+    /**
+     * Create an uninitialized buffer with the given size.
+     */
     explicit Buffer(std::size_t size)
         : p_((size != 0u) ? new std::uint8_t[size] : nullptr), size_(size)
     {
     }
 
-    /** Create a buffer as a copy of existing memory.
-
-        @param data a pointer to the existing memory. If
-                    size is non-zero, it must not be null.
-        @param size size of the existing memory block.
-    */
+    /**
+     * Create a buffer as a copy of existing memory.
+     *
+     * @param data a pointer to the existing memory. If
+     *             size is non-zero, it must not be null.
+     * @param size size of the existing memory block.
+     */
     Buffer(void const* data, std::size_t size) : Buffer(size)
     {
         if (size != 0u)
             std::memcpy(p_.get(), data, size);
     }
 
-    /** Copy-construct */
+    /**
+     * Copy-construct
+     */
     Buffer(Buffer const& other) : Buffer(other.p_.get(), other.size_)
     {
     }
 
-    /** Copy assign */
+    /**
+     * Copy assign
+     */
     Buffer&
     operator=(Buffer const& other)
     {
@@ -59,17 +67,19 @@ public:
         return *this;
     }
 
-    /** Move-construct.
-        The other buffer is reset.
-    */
+    /**
+     * Move-construct.
+     * The other buffer is reset.
+     */
     Buffer(Buffer&& other) noexcept : p_(std::move(other.p_)), size_(other.size_)
     {
         other.size_ = 0;
     }
 
-    /** Move-assign.
-        The other buffer is reset.
-    */
+    /**
+     * Move-assign.
+     * The other buffer is reset.
+     */
     Buffer&
     operator=(Buffer&& other) noexcept
     {
@@ -82,12 +92,16 @@ public:
         return *this;
     }
 
-    /** Construct from a slice */
+    /**
+     * Construct from a slice
+     */
     explicit Buffer(Slice s) : Buffer(s.data(), s.size())
     {
     }
 
-    /** Assign from slice */
+    /**
+     * Assign from slice
+     */
     Buffer&
     operator=(Slice s)
     {
@@ -101,7 +115,9 @@ public:
         return *this;
     }
 
-    /** Returns the number of bytes in the buffer. */
+    /**
+     * Returns the number of bytes in the buffer.
+     */
     [[nodiscard]] std::size_t
     size() const noexcept
     {
@@ -121,10 +137,11 @@ public:
         return Slice{p_.get(), size_};
     }
 
-    /** Return a pointer to beginning of the storage.
-        @note The return type is guaranteed to be a pointer
-              to a single byte, to facilitate pointer arithmetic.
-    */
+    /**
+     * Return a pointer to beginning of the storage.
+     * @note The return type is guaranteed to be a pointer
+     *       to a single byte, to facilitate pointer arithmetic.
+     */
     /** @{ */
     [[nodiscard]] std::uint8_t const*
     data() const noexcept
@@ -139,9 +156,10 @@ public:
     }
     /** @} */
 
-    /** Reset the buffer.
-        All memory is deallocated. The resulting size is 0.
-    */
+    /**
+     * Reset the buffer.
+     * All memory is deallocated. The resulting size is 0.
+     */
     void
     clear() noexcept
     {
@@ -149,9 +167,10 @@ public:
         size_ = 0;
     }
 
-    /** Reallocate the storage.
-        Existing data, if any, is discarded.
-    */
+    /**
+     * Reallocate the storage.
+     * Existing data, if any, is discarded.
+     */
     std::uint8_t*
     alloc(std::size_t n)
     {

include/xrpl/basics/CompressionAlgorithms.h

@@ -12,7 +12,8 @@
 
 namespace xrpl::compression_algorithms {
 
-/** LZ4 block compression.
+/**
+ * LZ4 block compression.
  * @tparam BufferFactory Callable object or lambda.
  *     Takes the requested buffer size and returns allocated buffer pointer.
  * @param in Data to compress
@@ -80,7 +81,8 @@ lz4Decompress(
     return decompressedSize;
 }
 
-/** LZ4 block decompression.
+/**
+ * LZ4 block decompression.
  * @tparam InputStream ZeroCopyInputStream
  * @param in Input source stream
  * @param inSize Size of compressed data

include/xrpl/basics/CountedObject.h

@@ -9,7 +9,9 @@
 
 namespace xrpl {
 
-/** Manages all counted object types. */
+/**
+ * Manages all counted object types.
+ */
 class CountedObjects
 {
 public:
@@ -23,10 +25,11 @@ public:
     getCounts(int minimumThreshold) const;
 
 public:
-    /** Implementation for @ref CountedObject.
-
-        @internal
-    */
+    /**
+     * Implementation for @ref CountedObject.
+     *
+     * @internal
+     */
     class Counter
     {
     public:
@@ -94,13 +97,14 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** Tracks the number of instances of an object.
-
-    Derived classes have their instances counted automatically. This is used
-    for reporting purposes.
-
-    @ingroup basics
-*/
+/**
+ * Tracks the number of instances of an object.
+ *
+ * Derived classes have their instances counted automatically. This is used
+ * for reporting purposes.
+ *
+ * @ingroup basics
+ */
 template <class Object>
 class CountedObject
 {

include/xrpl/basics/DecayingSample.h

@@ -6,9 +6,10 @@
 
 namespace xrpl {
 
-/** Sampling function using exponential decay to provide a continuous value.
-    @tparam The number of seconds in the decay window.
-*/
+/**
+ * Sampling function using exponential decay to provide a continuous value.
+ * @tparam The number of seconds in the decay window.
+ */
 template <int Window, typename Clock>
 class DecayingSample
 {
@@ -19,15 +20,16 @@ public:
     DecayingSample() = delete;
 
     /**
-        @param now Start time of DecayingSample.
-    */
+     * @param now Start time of DecayingSample.
+     */
     explicit DecayingSample(time_point now) : value_(value_type()), when_(now)
     {
     }
 
-    /** Add a new sample.
-        The value is first aged according to the specified time.
-    */
+    /**
+     * Add a new sample.
+     * The value is first aged according to the specified time.
+     */
     value_type
     add(value_type value, time_point now)
     {
@@ -36,9 +38,10 @@ public:
         return value_ / Window;
     }
 
-    /** Retrieve the current value in normalized units.
-        The samples are first aged according to the specified time.
-    */
+    /**
+     * Retrieve the current value in normalized units.
+     * The samples are first aged according to the specified time.
+     */
     value_type
     value(time_point now)
     {
@@ -87,9 +90,10 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** Sampling function using exponential decay to provide a continuous value.
-    @tparam HalfLife The half life of a sample, in seconds.
-*/
+/**
+ * Sampling function using exponential decay to provide a continuous value.
+ * @tparam HalfLife The half life of a sample, in seconds.
+ */
 template <int HalfLife, class Clock>
 class DecayWindow
 {

include/xrpl/basics/IntrusivePointer.h

@@ -10,33 +10,37 @@ namespace xrpl {
 
 //------------------------------------------------------------------------------
 
-/** Tag to create an intrusive pointer from another intrusive pointer by using a
-    static cast. This is useful to create an intrusive pointer to a derived
-    class from an intrusive pointer to a base class.
-*/
+/**
+ * Tag to create an intrusive pointer from another intrusive pointer by using a
+ * static cast. This is useful to create an intrusive pointer to a derived
+ * class from an intrusive pointer to a base class.
+ */
 struct StaticCastTagSharedIntrusive
 {
 };
 
-/** Tag to create an intrusive pointer from another intrusive pointer by using a
-    dynamic cast. This is useful to create an intrusive pointer to a derived
-    class from an intrusive pointer to a base class. If the cast fails an empty
-    (null) intrusive pointer is created.
-*/
+/**
+ * Tag to create an intrusive pointer from another intrusive pointer by using a
+ * dynamic cast. This is useful to create an intrusive pointer to a derived
+ * class from an intrusive pointer to a base class. If the cast fails an empty
+ * (null) intrusive pointer is created.
+ */
 struct DynamicCastTagSharedIntrusive
 {
 };
 
-/** When creating or adopting a raw pointer, controls whether the strong count
-    is incremented or not. Use this tag to increment the strong count.
-*/
+/**
+ * When creating or adopting a raw pointer, controls whether the strong count
+ * is incremented or not. Use this tag to increment the strong count.
+ */
 struct SharedIntrusiveAdoptIncrementStrongTag
 {
 };
 
-/** When creating or adopting a raw pointer, controls whether the strong count
-    is incremented or not. Use this tag to leave the strong count unchanged.
-*/
+/**
+ * When creating or adopting a raw pointer, controls whether the strong count
+ * is incremented or not. Use this tag to leave the strong count unchanged.
+ */
 struct SharedIntrusiveAdoptNoIncrementTag
 {
 };
@@ -50,20 +54,21 @@ concept CAdoptTag = std::is_same_v<T, SharedIntrusiveAdoptIncrementStrongTag> ||
 
 //------------------------------------------------------------------------------
 
-/** A shared intrusive pointer class that supports weak pointers.
-
-    This is meant to be used for SHAMapInnerNodes, but may be useful for other
-    cases. Since the reference counts are stored on the pointee, the pointee is
-    not destroyed until both the strong _and_ weak pointer counts go to zero.
-    When the strong pointer count goes to zero, the "partialDestructor" is
-    called. This can be used to destroy as much of the object as possible while
-    still retaining the reference counts. For example, for SHAMapInnerNodes the
-    children may be reset in that function. Note that std::shared_pointer WILL
-    run the destructor when the strong count reaches zero, but may not free the
-    memory used by the object until the weak count reaches zero. In xrpld, we
-    typically allocate shared pointers with the `make_shared` function. When
-    that is used, the memory is not reclaimed until the weak count reaches zero.
-*/
+/**
+ * A shared intrusive pointer class that supports weak pointers.
+ *
+ * This is meant to be used for SHAMapInnerNodes, but may be useful for other
+ * cases. Since the reference counts are stored on the pointee, the pointee is
+ * not destroyed until both the strong _and_ weak pointer counts go to zero.
+ * When the strong pointer count goes to zero, the "partialDestructor" is
+ * called. This can be used to destroy as much of the object as possible while
+ * still retaining the reference counts. For example, for SHAMapInnerNodes the
+ * children may be reset in that function. Note that std::shared_pointer WILL
+ * run the destructor when the strong count reaches zero, but may not free the
+ * memory used by the object until the weak count reaches zero. In xrpld, we
+ * typically allocate shared pointers with the `make_shared` function. When
+ * that is used, the memory is not reclaimed until the weak count reaches zero.
+ */
 template <class T>
 class SharedIntrusive
 {
@@ -111,8 +116,9 @@ public:
     operator=(
         SharedIntrusive<TT>&& rhs);  // NOLINT(cppcoreguidelines-rvalue-reference-param-not-moved)
 
-    /** Adopt the raw pointer. The strong reference may or may not be
-        incremented, depending on the TAdoptTag
+    /**
+     * Adopt the raw pointer. The strong reference may or may not be
+     * incremented, depending on the TAdoptTag
      */
     template <CAdoptTag TAdoptTag = SharedIntrusiveAdoptIncrementStrongTag>
     void
@@ -120,27 +126,31 @@ public:
 
     ~SharedIntrusive();
 
-    /** Create a new SharedIntrusive by statically casting the pointer
-        controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by statically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs);
 
-    /** Create a new SharedIntrusive by statically casting the pointer
-       controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by statically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT>&& rhs);
 
-    /** Create a new SharedIntrusive by dynamically casting the pointer
-       controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by dynamically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs);
 
-    /** Create a new SharedIntrusive by dynamically casting the pointer
-       controlled by the rhs param.
-    */
+    /**
+     * Create a new SharedIntrusive by dynamically casting the pointer
+     * controlled by the rhs param.
+     */
     template <class TT>
     SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT>&& rhs);
 
@@ -153,17 +163,22 @@ public:
     explicit
     operator bool() const noexcept;
 
-    /** Set the pointer to null, decrement the strong count, and run the
-        appropriate release action.
-      */
+    /**
+     * Set the pointer to null, decrement the strong count, and run the
+     * appropriate release action.
+     */
     void
     reset();
 
-    /** Get the raw pointer */
+    /**
+     * Get the raw pointer
+     */
     [[nodiscard]] T*
     get() const;
 
-    /** Return the strong count */
+    /**
+     * Return the strong count
+     */
     [[nodiscard]] std::size_t
     useCount() const;
 
@@ -181,43 +196,51 @@ public:
     friend class WeakIntrusive;
 
 private:
-    /** Return the raw pointer held by this object. */
+    /**
+     * Return the raw pointer held by this object.
+     */
     [[nodiscard]] T*
     unsafeGetRawPtr() const;
 
-    /** Exchange the current raw pointer held by this object with the given
-        pointer. Decrement the strong count of the raw pointer previously held
-        by this object and run the appropriate release action.
+    /**
+     * Exchange the current raw pointer held by this object with the given
+     * pointer. Decrement the strong count of the raw pointer previously held
+     * by this object and run the appropriate release action.
      */
     void
     unsafeReleaseAndStore(T* next);
 
-    /** Set the raw pointer directly. This is wrapped in a function so the class
-        can support both atomic and non-atomic pointers in a future patch.
+    /**
+     * Set the raw pointer directly. This is wrapped in a function so the class
+     * can support both atomic and non-atomic pointers in a future patch.
      */
     void
     unsafeSetRawPtr(T* p);
 
-    /** Exchange the raw pointer directly.
-        This sets the raw pointer to the given value and returns the previous
-        value. This is wrapped in a function so the class can support both
-        atomic and non-atomic pointers in a future patch.
+    /**
+     * Exchange the raw pointer directly.
+     * This sets the raw pointer to the given value and returns the previous
+     * value. This is wrapped in a function so the class can support both
+     * atomic and non-atomic pointers in a future patch.
      */
     T*
     unsafeExchange(T* p);
 
-    /** pointer to the type with an intrusive count */
+    /**
+     * pointer to the type with an intrusive count
+     */
     T* ptr_{nullptr};
 };
 
 //------------------------------------------------------------------------------
 
-/** A weak intrusive pointer class for the SharedIntrusive pointer class.
-
-Note that this weak pointer class asks differently from normal weak pointer
-classes. When the strong pointer count goes to zero, the "partialDestructor"
-is called. See the comment on SharedIntrusive for a fuller explanation.
-*/
+/**
+ * A weak intrusive pointer class for the SharedIntrusive pointer class.
+ *
+ * Note that this weak pointer class asks differently from normal weak pointer
+ * classes. When the strong pointer count goes to zero, the "partialDestructor"
+ * is called. See the comment on SharedIntrusive for a fuller explanation.
+ */
 template <class T>
 class WeakIntrusive
 {
@@ -247,54 +270,62 @@ public:
     WeakIntrusive&
     operator=(SharedIntrusive<TT> const& rhs);
 
-    /** Adopt the raw pointer and increment the weak count. */
+    /**
+     * Adopt the raw pointer and increment the weak count.
+     */
     void
     adopt(T* ptr);
 
     ~WeakIntrusive();
 
-    /** Get a strong pointer from the weak pointer, if possible. This will
-       only return a seated pointer if the strong count on the raw pointer
-       is non-zero before locking.
+    /**
+     * Get a strong pointer from the weak pointer, if possible. This will
+     * only return a seated pointer if the strong count on the raw pointer
+     * is non-zero before locking.
      */
     SharedIntrusive<T>
     lock() const;
 
-    /** Return true if the strong count is zero. */
+    /**
+     * Return true if the strong count is zero.
+     */
     [[nodiscard]] bool
     expired() const;
 
-    /** Set the pointer to null and decrement the weak count.
-
-    Note: This may run the destructor if the strong count is zero.
-    */
+    /**
+     * Set the pointer to null and decrement the weak count.
+     *
+     * Note: This may run the destructor if the strong count is zero.
+     */
     void
     reset();
 
 private:
     T* ptr_ = nullptr;
 
-    /** Decrement the weak count. This does _not_ set the raw pointer to
-    null.
-
-    Note: This may run the destructor if the strong count is zero.
-    */
+    /**
+     * Decrement the weak count. This does _not_ set the raw pointer to
+     * null.
+     *
+     * Note: This may run the destructor if the strong count is zero.
+     */
     void
     unsafeReleaseNoStore();
 };
 
 //------------------------------------------------------------------------------
 
-/** A combination of a strong and a weak intrusive pointer stored in the
-    space of a single pointer.
-
-    This class is similar to a `std::variant<SharedIntrusive,WeakIntrusive>`
-    with some optimizations. In particular, it uses a low-order bit to
-    determine if the raw pointer represents a strong pointer or a weak
-    pointer. It can also be quickly switched between its strong pointer and
-    weak pointer representations. This class is useful for storing intrusive
-    pointers in tagged caches.
-  */
+/**
+ * A combination of a strong and a weak intrusive pointer stored in the
+ * space of a single pointer.
+ *
+ * This class is similar to a `std::variant<SharedIntrusive,WeakIntrusive>`
+ * with some optimizations. In particular, it uses a low-order bit to
+ * determine if the raw pointer represents a strong pointer or a weak
+ * pointer. It can also be quickly switched between its strong pointer and
+ * weak pointer representations. This class is useful for storing intrusive
+ * pointers in tagged caches.
+ */
 
 template <class T>
 class SharedWeakUnion
@@ -336,69 +367,83 @@ public:
 
     ~SharedWeakUnion();
 
-    /** Return a strong pointer if this is already a strong pointer (i.e.
-       don't lock the weak pointer. Use the `lock` method if that's what's
-       needed)
+    /**
+     * Return a strong pointer if this is already a strong pointer (i.e.
+     * don't lock the weak pointer. Use the `lock` method if that's what's
+     * needed)
      */
     [[nodiscard]] SharedIntrusive<T>
     getStrong() const;
 
-    /** Return true if this is a strong pointer and the strong pointer is
-        seated.
+    /**
+     * Return true if this is a strong pointer and the strong pointer is
+     * seated.
      */
     explicit
     operator bool() const noexcept;
 
-    /** Set the pointer to null, decrement the appropriate ref count, and
-       run the appropriate release action.
+    /**
+     * Set the pointer to null, decrement the appropriate ref count, and
+     * run the appropriate release action.
      */
     void
     reset();
 
-    /** If this is a strong pointer, return the raw pointer. Otherwise
-       return null.
+    /**
+     * If this is a strong pointer, return the raw pointer. Otherwise
+     * return null.
      */
     [[nodiscard]] T*
     get() const;
 
-    /** If this is a strong pointer, return the strong count. Otherwise
+    /**
+     * If this is a strong pointer, return the strong count. Otherwise
      * return 0
      */
     [[nodiscard]] std::size_t
     useCount() const;
 
-    /** Return true if there is a non-zero strong count. */
+    /**
+     * Return true if there is a non-zero strong count.
+     */
     [[nodiscard]] bool
     expired() const;
 
-    /** If this is a strong pointer, return the strong pointer. Otherwise
-        attempt to lock the weak pointer.
+    /**
+     * If this is a strong pointer, return the strong pointer. Otherwise
+     * attempt to lock the weak pointer.
      */
     [[nodiscard]] SharedIntrusive<T>
     lock() const;
 
-    /** Return true is this represents a strong pointer. */
+    /**
+     * Return true is this represents a strong pointer.
+     */
     [[nodiscard]] bool
     isStrong() const;
 
-    /** Return true is this represents a weak pointer. */
+    /**
+     * Return true is this represents a weak pointer.
+     */
     [[nodiscard]] bool
     isWeak() const;
 
-    /** If this is a weak pointer, attempt to convert it to a strong
-       pointer.
-
-        @return true if successfully converted to a strong pointer (or was
-                already a strong pointer). Otherwise false.
-      */
+    /**
+     * If this is a weak pointer, attempt to convert it to a strong
+     * pointer.
+     *
+     * @return true if successfully converted to a strong pointer (or was
+     *         already a strong pointer). Otherwise false.
+     */
     bool
     convertToStrong();
 
-    /** If this is a strong pointer, attempt to convert it to a weak
-       pointer.
-
-        @return false if the pointer is null. Otherwise return true.
-      */
+    /**
+     * If this is a strong pointer, attempt to convert it to a weak
+     * pointer.
+     *
+     * @return false if the pointer is null. Otherwise return true.
+     */
     bool
     convertToWeak();
 
@@ -411,23 +456,27 @@ private:
     static constexpr std::uintptr_t kPtrMask = ~kTagMask;
 
 private:
-    /** Return the raw pointer held by this object.
+    /**
+     * Return the raw pointer held by this object.
      */
     [[nodiscard]] T*
     unsafeGetRawPtr() const;
 
     enum class RefStrength { Strong, Weak };
-    /** Set the raw pointer and tag bit directly.
+    /**
+     * Set the raw pointer and tag bit directly.
      */
     void
     unsafeSetRawPtr(T* p, RefStrength rs);
 
-    /** Set the raw pointer and tag bit to all zeros (strong null pointer).
+    /**
+     * Set the raw pointer and tag bit to all zeros (strong null pointer).
      */
     void unsafeSetRawPtr(std::nullptr_t);
 
-    /** Decrement the appropriate ref count, and run the appropriate release
-        action. Note: this does _not_ set the raw pointer to null.
+    /**
+     * Decrement the appropriate ref count, and run the appropriate release
+     * action. Note: this does _not_ set the raw pointer to null.
      */
     void
     unsafeReleaseNoStore();
@@ -435,12 +484,13 @@ private:
 
 //------------------------------------------------------------------------------
 
-/** Create a shared intrusive pointer.
-
-    Note: unlike std::shared_ptr, where there is an advantage of allocating
-    the pointer and control block together, there is no benefit for intrusive
-    pointers.
-*/
+/**
+ * Create a shared intrusive pointer.
+ *
+ * Note: unlike std::shared_ptr, where there is an advantage of allocating
+ * the pointer and control block together, there is no benefit for intrusive
+ * pointers.
+ */
 template <class TT, class... Args>
 SharedIntrusive<TT>
 makeSharedIntrusive(Args&&... args)

include/xrpl/basics/IntrusiveRefCounts.h

@@ -8,35 +8,38 @@
 
 namespace xrpl {
 
-/** Action to perform when releasing a strong pointer.
-
-    noop: Do nothing. For example, a `noop` action will occur when a count is
-    decremented to a non-zero value.
-
-    partialDestroy: Run the `partialDestructor`. This action will happen when a
-    strong count is decremented to zero and the weak count is non-zero.
-
-    destroy: Run the destructor. This action will occur when either the strong
-    count or weak count is decremented and the other count is also zero.
+/**
+ * Action to perform when releasing a strong pointer.
+ *
+ * noop: Do nothing. For example, a `noop` action will occur when a count is
+ * decremented to a non-zero value.
+ *
+ * partialDestroy: Run the `partialDestructor`. This action will happen when a
+ * strong count is decremented to zero and the weak count is non-zero.
+ *
+ * destroy: Run the destructor. This action will occur when either the strong
+ * count or weak count is decremented and the other count is also zero.
  */
 enum class ReleaseStrongRefAction { NoOp, PartialDestroy, Destroy };
 
-/** Action to perform when releasing a weak pointer.
-
-    noop: Do nothing. For example, a `noop` action will occur when a count is
-    decremented to a non-zero value.
-
-    destroy: Run the destructor. This action will occur when either the strong
-    count or weak count is decremented and the other count is also zero.
+/**
+ * Action to perform when releasing a weak pointer.
+ *
+ * noop: Do nothing. For example, a `noop` action will occur when a count is
+ * decremented to a non-zero value.
+ *
+ * destroy: Run the destructor. This action will occur when either the strong
+ * count or weak count is decremented and the other count is also zero.
  */
 enum class ReleaseWeakRefAction { NoOp, Destroy };
 
-/** Implement the strong count, weak count, and bit flags for an intrusive
-    pointer.
-
-    A class can satisfy the requirements of an xrpl::IntrusivePointer by
-    inheriting from this class.
-  */
+/**
+ * Implement the strong count, weak count, and bit flags for an intrusive
+ * pointer.
+ *
+ * A class can satisfy the requirements of an xrpl::IntrusivePointer by
+ * inheriting from this class.
+ */
 struct IntrusiveRefCounts
 {
     virtual ~IntrusiveRefCounts() noexcept;
@@ -105,109 +108,123 @@ private:
     static constexpr size_t kFieldTypeBits = sizeof(FieldType) * 8;
     static constexpr FieldType kOne = 1;
 
-    /** `refCounts` consists of four fields that are treated atomically:
-
-         1. Strong count. This is a count of the number of shared pointers that
-         hold a reference to this object. When the strong counts goes to zero,
-         if the weak count is zero, the destructor is run. If the weak count is
-         non-zero when the strong count goes to zero then the partialDestructor
-         is run.
-
-         2. Weak count. This is a count of the number of weak pointer that hold
-         a reference to this object. When the weak count goes to zero and the
-         strong count is also zero, then the destructor is run.
-
-         3. Partial destroy started bit. This bit is set if the
-         `partialDestructor` function has been started (or is about to be
-         started). This is used to prevent the destructor from running
-         concurrently with the partial destructor. This can easily happen when
-         the last strong pointer release its reference in one thread and starts
-         the partialDestructor, while in another thread the last weak pointer
-         goes out of scope and starts the destructor while the partialDestructor
-         is still running. Both a start and finished bit is needed to handle a
-         corner-case where the last strong pointer goes out of scope, then then
-         last `weakPointer` goes out of scope, but this happens before the
-         `partialDestructor` bit is set. It would be possible to use a single
-         bit if it could also be set atomically when the strong count goes to
-         zero and the weak count is non-zero, but that would add complexity (and
-         likely slow down common cases as well).
-
-         4. Partial destroy finished bit. This bit is set when the
-         `partialDestructor` has finished running. See (3) above for more
-         information.
-
-         */
+    /**
+     * `refCounts` consists of four fields that are treated atomically:
+     *
+     * 1. Strong count. This is a count of the number of shared pointers that
+     * hold a reference to this object. When the strong counts goes to zero,
+     * if the weak count is zero, the destructor is run. If the weak count is
+     * non-zero when the strong count goes to zero then the partialDestructor
+     * is run.
+     *
+     * 2. Weak count. This is a count of the number of weak pointer that hold
+     * a reference to this object. When the weak count goes to zero and the
+     * strong count is also zero, then the destructor is run.
+     *
+     * 3. Partial destroy started bit. This bit is set if the
+     * `partialDestructor` function has been started (or is about to be
+     * started). This is used to prevent the destructor from running
+     * concurrently with the partial destructor. This can easily happen when
+     * the last strong pointer release its reference in one thread and starts
+     * the partialDestructor, while in another thread the last weak pointer
+     * goes out of scope and starts the destructor while the partialDestructor
+     * is still running. Both a start and finished bit is needed to handle a
+     * corner-case where the last strong pointer goes out of scope, then then
+     * last `weakPointer` goes out of scope, but this happens before the
+     * `partialDestructor` bit is set. It would be possible to use a single
+     * bit if it could also be set atomically when the strong count goes to
+     * zero and the weak count is non-zero, but that would add complexity (and
+     * likely slow down common cases as well).
+     *
+     * 4. Partial destroy finished bit. This bit is set when the
+     * `partialDestructor` has finished running. See (3) above for more
+     * information.
+     */
 
     mutable std::atomic<FieldType> refCounts_{kStrongDelta};
 
-    /**  Amount to change the strong count when adding or releasing a reference
-
-         Note: The strong count is stored in the low `StrongCountNumBits` bits
-       of refCounts
-      */
+    /**
+     * Amount to change the strong count when adding or releasing a reference
+     *
+     *   Note: The strong count is stored in the low `StrongCountNumBits` bits
+     * of refCounts
+     */
     static constexpr FieldType kStrongDelta = 1;
 
-    /**  Amount to change the weak count when adding or releasing a reference
-
-         Note: The weak count is stored in the high `WeakCountNumBits` bits of
-         refCounts
-      */
+    /**
+     * Amount to change the weak count when adding or releasing a reference
+     *
+     * Note: The weak count is stored in the high `WeakCountNumBits` bits of
+     * refCounts
+     */
     static constexpr FieldType kWeakDelta = (kOne << kStrongCountNumBits);
 
-    /**  Flag that is set when the partialDestroy function has started running
-         (or is about to start running).
-
-         See description of the `refCounts` field for a fuller description of
-         this field.
-      */
+    /**
+     * Flag that is set when the partialDestroy function has started running
+     * (or is about to start running).
+     *
+     * See description of the `refCounts` field for a fuller description of
+     * this field.
+     */
     static constexpr FieldType kPartialDestroyStartedMask = (kOne << (kFieldTypeBits - 1));
 
-    /**  Flag that is set when the partialDestroy function has finished running
-
-         See description of the `refCounts` field for a fuller description of
-         this field.
-      */
+    /**
+     * Flag that is set when the partialDestroy function has finished running
+     *
+     * See description of the `refCounts` field for a fuller description of
+     * this field.
+     */
     static constexpr FieldType kPartialDestroyFinishedMask = (kOne << (kFieldTypeBits - 2));
 
-    /** Mask that will zero out all the `count` bits and leave the tag bits
-        unchanged.
-      */
+    /**
+     * Mask that will zero out all the `count` bits and leave the tag bits
+     * unchanged.
+     */
     static constexpr FieldType kTagMask = kPartialDestroyStartedMask | kPartialDestroyFinishedMask;
 
-    /** Mask that will zero out the `tag` bits and leave the count bits
-        unchanged.
-      */
+    /**
+     * Mask that will zero out the `tag` bits and leave the count bits
+     * unchanged.
+     */
     static constexpr FieldType kValueMask = ~kTagMask;
 
-    /** Mask that will zero out everything except the strong count.
+    /**
+     * Mask that will zero out everything except the strong count.
      */
     static constexpr FieldType kStrongMask = ((kOne << kStrongCountNumBits) - 1) & kValueMask;
 
-    /** Mask that will zero out everything except the weak count.
+    /**
+     * Mask that will zero out everything except the weak count.
      */
     static constexpr FieldType kWeakMask =
         (((kOne << kWeakCountNumBits) - 1) << kStrongCountNumBits) & kValueMask;
 
-    /** Unpack the count and tag fields from the packed atomic integer form. */
+    /**
+     * Unpack the count and tag fields from the packed atomic integer form.
+     */
     struct RefCountPair
     {
         CountType strong;
         CountType weak;
-        /**  The `partialDestroyStartedBit` is set to on when the partial
-             destroy function is started. It is not a boolean; it is a uint32
-             with all bits zero with the possible exception of the
-             `partialDestroyStartedMask` bit. This is done so it can be directly
-             masked into the `combinedValue`.
+        /**
+         * The `partialDestroyStartedBit` is set to on when the partial
+         * destroy function is started. It is not a boolean; it is a uint32
+         * with all bits zero with the possible exception of the
+         * `partialDestroyStartedMask` bit. This is done so it can be directly
+         * masked into the `combinedValue`.
          */
         FieldType partialDestroyStartedBit{0};
-        /**  The `partialDestroyFinishedBit` is set to on when the partial
-             destroy function has finished.
+        /**
+         * The `partialDestroyFinishedBit` is set to on when the partial
+         * destroy function has finished.
          */
         FieldType partialDestroyFinishedBit{0};
         RefCountPair(FieldType v) noexcept;
         RefCountPair(CountType s, CountType w) noexcept;
 
-        /** Convert back to the packed integer form. */
+        /**
+         * Convert back to the packed integer form.
+         */
         [[nodiscard]] FieldType
         combinedValue() const noexcept;
 
@@ -215,9 +232,10 @@ private:
             static_cast<CountType>((kOne << kStrongCountNumBits) - 1);
         static constexpr CountType kMaxWeakValue =
             static_cast<CountType>((kOne << kWeakCountNumBits) - 1);
-        /**  Put an extra margin to detect when running up against limits.
-             This is only used in debug code, and is useful if we reduce the
-             number of bits in the strong and weak counts (to 16 and 14 bits).
+        /**
+         * Put an extra margin to detect when running up against limits.
+         * This is only used in debug code, and is useful if we reduce the
+         * number of bits in the strong and weak counts (to 16 and 14 bits).
          */
         static constexpr CountType kCheckStrongMaxValue = kMaxStrongValue - 32;
         static constexpr CountType kCheckWeakMaxValue = kMaxWeakValue - 32;

include/xrpl/basics/LocalValue.h

@@ -70,11 +70,15 @@ public:
     {
     }
 
-    /** Stores instance of T specific to the calling coroutine or thread. */
+    /**
+     * Stores instance of T specific to the calling coroutine or thread.
+     */
     T&
     operator*();
 
-    /** Stores instance of T specific to the calling coroutine or thread. */
+    /**
+     * Stores instance of T specific to the calling coroutine or thread.
+     */
     T*
     operator->()
     {

include/xrpl/basics/Log.h

@@ -16,7 +16,9 @@
 
 namespace xrpl {
 
-/** Manages partitions for logging. */
+/**
+ * Manages partitions for logging.
+ */
 class Logs
 {
 private:
@@ -40,69 +42,81 @@ private:
         writeAlways(beast::Severity level, std::string const& text) override;
     };
 
-    /** Manages a system file containing logged output.
-        The system file remains open during program execution. Interfaces
-        are provided for interoperating with standard log management
-        tools like logrotate(8):
-            http://linuxcommand.org/man_pages/logrotate8.html
-        @note None of the listed interfaces are thread-safe.
-    */
+    /**
+     * Manages a system file containing logged output.
+     * The system file remains open during program execution. Interfaces
+     * are provided for interoperating with standard log management
+     * tools like logrotate(8):
+     *     http://linuxcommand.org/man_pages/logrotate8.html
+     * @note None of the listed interfaces are thread-safe.
+     */
     class File
     {
     public:
-        /** Construct with no associated system file.
-            A system file may be associated later with @ref open.
-            @see open
-        */
+        /**
+         * Construct with no associated system file.
+         * A system file may be associated later with @ref open.
+         * @see open
+         */
         File();
 
-        /** Destroy the object.
-            If a system file is associated, it will be flushed and closed.
-        */
+        /**
+         * Destroy the object.
+         * If a system file is associated, it will be flushed and closed.
+         */
         ~File() = default;
 
-        /** Determine if a system file is associated with the log.
-            @return `true` if a system file is associated and opened for
-            writing.
-        */
+        /**
+         * Determine if a system file is associated with the log.
+         * @return `true` if a system file is associated and opened for
+         * writing.
+         */
         [[nodiscard]] bool
         isOpen() const noexcept;
 
-        /** Associate a system file with the log.
-            If the file does not exist an attempt is made to create it
-            and open it for writing. If the file already exists an attempt is
-            made to open it for appending.
-            If a system file is already associated with the log, it is closed
-            first.
-            @return `true` if the file was opened.
-        */
+        /**
+         * Associate a system file with the log.
+         * If the file does not exist an attempt is made to create it
+         * and open it for writing. If the file already exists an attempt is
+         * made to open it for appending.
+         * If a system file is already associated with the log, it is closed
+         * first.
+         * @return `true` if the file was opened.
+         */
         bool
         open(boost::filesystem::path const& path);
 
-        /** Close and re-open the system file associated with the log
-            This assists in interoperating with external log management tools.
-            @return `true` if the file was opened.
-        */
+        /**
+         * Close and re-open the system file associated with the log
+         * This assists in interoperating with external log management tools.
+         * @return `true` if the file was opened.
+         */
         bool
         closeAndReopen();
 
-        /** Close the system file if it is open. */
+        /**
+         * Close the system file if it is open.
+         */
         void
         close();
 
-        /** write to the log file.
-            Does nothing if there is no associated system file.
-        */
+        /**
+         * write to the log file.
+         * Does nothing if there is no associated system file.
+         */
         void
         write(char const* text);
 
-        /** write to the log file and append an end of line marker.
-            Does nothing if there is no associated system file.
-        */
+        /**
+         * write to the log file and append an end of line marker.
+         * Does nothing if there is no associated system file.
+         */
         void
         writeln(char const* text);
 
-        /** Write to the log file using std::string. */
+        /**
+         * Write to the log file using std::string.
+         */
         /** @{ */
         void
         write(std::string const& str)
@@ -223,19 +237,21 @@ private:
 //------------------------------------------------------------------------------
 // Debug logging:
 
-/** Set the sink for the debug journal.
-
-    @param sink unique_ptr to new debug Sink.
-    @return unique_ptr to the previous Sink.  nullptr if there was no Sink.
-*/
+/**
+ * Set the sink for the debug journal.
+ *
+ * @param sink unique_ptr to new debug Sink.
+ * @return unique_ptr to the previous Sink.  nullptr if there was no Sink.
+ */
 std::unique_ptr<beast::Journal::Sink>
 setDebugLogSink(std::unique_ptr<beast::Journal::Sink> sink);
 
-/** Returns a debug journal.
-    The journal may drain to a null sink, so its output
-    may never be seen. Never use it for critical
-    information.
-*/
+/**
+ * Returns a debug journal.
+ * The journal may drain to a null sink, so its output
+ * may never be seen. Never use it for critical
+ * information.
+ */
 beast::Journal
 debugLog();
 

include/xrpl/basics/MathUtilities.h

@@ -6,7 +6,8 @@
 
 namespace xrpl {
 
-/** Calculate one number divided by another number in percentage.
+/**
+ * Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]
  * E.g. calculatePercent(1, 100) = 1 because 1/100 = 0.010000
  *      calculatePercent(1, 99) = 2 because 1/99 = 0.010101
@@ -19,7 +20,7 @@ namespace xrpl {
  * @return the percentage, in [0, 100]
  *
  * @note total cannot be zero.
- * */
+ */
 constexpr std::size_t
 calculatePercent(std::size_t count, std::size_t total)
 {

include/xrpl/basics/Number.h

@@ -14,7 +14,6 @@
 #include <stdexcept>
 #include <string>
 #include <type_traits>
-#include <unordered_map>
 #include <utility>
 
 namespace xrpl {
@@ -48,46 +47,54 @@ isPowerOfTen(T value)
 
 namespace detail {
 
-/** Builds a table of the powers of 10
+/**
+ * Builds a table of the powers of 10
  *
  * This function is marked consteval, so it can only be run in
  * a constexpr context. This assures that it is and can only be run at
  * compile time. Doing it at runtime would be pretty wasteful and
  * inefficient.
  */
-constexpr std::size_t kInt64Digits = 20;
-consteval std::array<std::uint64_t, kInt64Digits>
+constexpr std::size_t kUint64Digits = 20;
+[[maybe_unused]] constexpr std::size_t kUint128Digits = 39;
+
+template <typename T, std::size_t Digits>
+consteval std::array<T, Digits>
 buildPowersOfTen()
 {
-    std::array<std::uint64_t, kInt64Digits> result{};
+    std::array<T, Digits> result{};
 
-    std::uint64_t power = 1;
+    T power = 1;
     std::size_t exponent = 0;
     // end the loop early so it doesn't overflow;
     for (; exponent < result.size() - 1; ++exponent, power *= 10)
     {
         result[exponent] = power;
-        if (power > std::numeric_limits<std::uint64_t>::max() / 10)
+        if (power > std::numeric_limits<T>::max() / 10)
             throw std::logic_error("Power of 10 table is too big");
     }
     result[exponent] = power;
-    if (power < std::numeric_limits<std::uint64_t>::max() / 10)
-        throw std::logic_error("Power of 10 table is not big enough for the uint64_t type");
+    if (power < std::numeric_limits<T>::max() / 10)
+        throw std::logic_error("Power of 10 table is not big enough for the given type");
 
     return result;
 }
 
 }  // namespace detail
 
-constexpr std::array<std::uint64_t, detail::kInt64Digits> kPowerOfTen = detail::buildPowersOfTen();
+template <typename T = std::uint64_t, std::size_t Digits = detail::kUint64Digits>
+constexpr std::array<T, Digits> kPowerOfTenImpl = detail::buildPowersOfTen<T, Digits>();
+
+constexpr auto kPowerOfTen = kPowerOfTenImpl<std::uint64_t, detail::kUint64Digits>;
 
 static_assert(kPowerOfTen[0] == 1);
 static_assert(kPowerOfTen[1] == 10);
 static_assert(kPowerOfTen[10] == 10'000'000'000);
 static_assert(
-    isPowerOfTen(kPowerOfTen.back()) && *logTen(kPowerOfTen.back()) == detail::kInt64Digits - 1);
+    isPowerOfTen(kPowerOfTen.back()) && *logTen(kPowerOfTen.back()) == detail::kUint64Digits - 1);
 
-/** MantissaRange defines a range for the mantissa of a normalized Number.
+/**
+ * MantissaRange defines a range for the mantissa of a normalized Number.
  *
  * The mantissa is in the range [min, max], where
  * * min is a power of 10, and
@@ -124,17 +131,37 @@ struct MantissaRange final
 {
     using rep = std::uint64_t;
 
+    // NOLINTBEGIN(readability-enum-initial-value)
+    // The values don't matter, except for Large
     enum class MantissaScale {
+        // Small can be removed when either featureSingleAssetVault or featureLendingProtocol are
+        // retired
         Small,
         // LargeLegacy can be removed when fixCleanup3_2_0 is retired
         LargeLegacy,
-        Large,
+        // Large320 can be removed when fixCleanup3_3_0 is retired
+        Large320,
+        // If Large330 is ever the only remaining "Large*" entry, it can be renamed to just "Large".
+        Large330,
+        // Large is a de-facto alias for "the latest", and is only here for backward compatibility
+        // in the extremely unlikely case that a downstream project made use of it. Note that
+        // because the behavior changed, this may still be a breaking change.
+        Large = Large330,
     };
+    // NOLINTEND(readability-enum-initial-value)
 
-    // This entire enum can be removed when fixCleanup3_2_0 is retired
-    enum class CuspRoundingFix : bool {
-        Disabled = false,
-        Enabled = true,
+    // This entire enum can be removed when the last relevant amendment is retired
+    enum class CuspRoundingFix : std::uint8_t {
+        // Disabled can be removed when fixCleanup3_2_0 is retired
+        Disabled = 0,
+        // Enabled320 can be removed when fixCleanup3_3_0 is retired
+        Enabled320 = 1,
+        // If we ever get to the point that there's only one entry, remove the entire enum
+        Enabled330 = 2,
+        // Enabled is a de-facto alias for "the latest", and is only here for backward compatibility
+        // in the extremely unlikely case that a downstream project made use of it. Note that
+        // because the behavior changed, this may still be a breaking change.
+        Enabled = Enabled330,
     };
 
     explicit constexpr MantissaRange(MantissaScale sc) : scale(sc)
@@ -145,13 +172,27 @@ struct MantissaRange final
     int const log{getExponent(scale)};
     rep const min{getMin(scale, log)};
     rep const max{(min * 10) - 1};
-    CuspRoundingFix const cuspRoundingFixEnabled{isCuspFixEnabled(scale)};
-
-    static MantissaRange const&
-    getMantissaRange(MantissaScale scale);
+    CuspRoundingFix const cuspRoundingFix{isCuspFixEnabled(scale)};
 
     static std::set<MantissaScale> const&
-    getAllScales();
+    getAllScales()
+    {
+        static std::set<MantissaRange::MantissaScale> const kScales = {
+            MantissaRange::MantissaScale::Small,
+            MantissaRange::MantissaScale::LargeLegacy,
+            MantissaRange::MantissaScale::Large320,
+            MantissaRange::MantissaScale::Large330,
+        };
+        return kScales;
+    }
+
+    class Access
+    {
+        static constexpr MantissaRange const&
+        mantissaRange(MantissaScale scale);
+
+        friend Number;
+    };
 
 private:
     static constexpr int
@@ -162,7 +203,8 @@ private:
             case MantissaScale::Small:
                 return 15;
             case MantissaScale::LargeLegacy:
-            case MantissaScale::Large:
+            case MantissaScale::Large320:
+            case MantissaScale::Large330:
                 return 18;
             // LCOV_EXCL_START
             default:
@@ -191,24 +233,24 @@ private:
             case MantissaScale::Small:
             case MantissaScale::LargeLegacy:
                 return CuspRoundingFix::Disabled;
-            case MantissaScale::Large:
-                return CuspRoundingFix::Enabled;
+            case MantissaScale::Large320:
+                return CuspRoundingFix::Enabled320;
+            case MantissaScale::Large330:
+                return CuspRoundingFix::Enabled330;
             default:
                 // If called in a constexpr context, this throw assures that the build fails if an
                 // invalid scale is used.
                 throw std::runtime_error("Unknown mantissa scale");  // LCOV_EXCL_LINE
         }
     }
-
-    static std::unordered_map<MantissaScale, MantissaRange> const&
-    getRanges();
 };
 
 // Like std::integral, but only 64-bit integral types.
 template <class T>
 concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::uint64_t>;
 
-/** Number is a floating point type that can represent a wide range of values.
+/**
+ * Number is a floating point type that can represent a wide range of values.
  *
  * It can represent all values that can be represented by an STAmount -
  * regardless of asset type - XRPAmount, MPTAmount, and IOUAmount, with at least
@@ -304,7 +346,6 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  * disable the amendments that control the mantissa range choice
  * (SingleAssetVault and LendingProtocol), and/or check if either of those
  * amendments are enabled to determine which result to expect.
- *
  */
 class Number final
 {
@@ -323,6 +364,8 @@ public:
     static constexpr internalrep kMaxRep = std::numeric_limits<rep>::max();
     static_assert(kMaxRep == 9'223'372'036'854'775'807);
     static_assert(-kMaxRep == std::numeric_limits<rep>::min() + 1);
+    static constexpr internalrep kMaxRepUp = ((kMaxRep / 10) + 1) * 10;
+    static_assert(kMaxRepUp == 9'223'372'036'854'775'810ULL);
 
     // May need to make unchecked private
     struct Unchecked
@@ -390,10 +433,11 @@ public:
     static Number
     lowest() noexcept;
 
-    /** Conversions to Number are implicit and conversions away from Number
-     *  are explicit. This design encourages and facilitates the use of Number
-     *  as the preferred type for floating point arithmetic as it makes
-     *  "mixed mode" more convenient, e.g. MPTAmount + Number.
+    /**
+     * Conversions to Number are implicit and conversions away from Number
+     * are explicit. This design encourages and facilitates the use of Number
+     * as the preferred type for floating point arithmetic as it makes
+     * "mixed mode" more convenient, e.g. MPTAmount + Number.
      */
     explicit
     operator rep() const;  // round to nearest, even on tie
@@ -448,7 +492,9 @@ public:
         return l.mantissa_ < r.mantissa_;
     }
 
-    /** Return the sign of the amount */
+    /**
+     * Return the sign of the amount
+     */
     [[nodiscard]] constexpr int
     signum() const noexcept
     {
@@ -502,14 +548,16 @@ public:
     static RoundingMode
     setround(RoundingMode inMode);
 
-    /** Returns which mantissa scale is currently in use for normalization.
+    /**
+     * Returns which mantissa scale is currently in use for normalization.
      *
      * If you think you need to call this outside of unit tests, no you don't.
      */
     static MantissaRange::MantissaScale
     getMantissaScale();
 
-    /** Changes which mantissa scale is used for normalization.
+    /**
+     * Changes which mantissa scale is used for normalization.
      *
      * If you think you need to call this outside of unit tests, no you don't.
      */
@@ -545,6 +593,13 @@ public:
     std::pair<T, int>
     normalizeToRange() const;
 
+    // Safely convert rep (int64) mantissa to internalrep (uint64). If the rep
+    // is negative, returns the positive value. This takes a little extra work
+    // because converting std::numeric_limits<std::int64_t>::min() flirts with
+    // UB, and can vary across compilers.
+    static internalrep
+    externalToInternal(rep mantissa);
+
 private:
     static thread_local RoundingMode mode;
     // The available ranges for mantissa
@@ -554,10 +609,17 @@ private:
     // changing the values inside the range.
     static thread_local std::reference_wrapper<MantissaRange const> kRange;
 
+    class Guard;
+
     void
     normalize(MantissaRange const& range);
 
-    /** Normalize Number components to an arbitrary range.
+    // Guard has the fields that we need, as well as MantissaRange, so if we have a guard, use that
+    void
+    normalize(Guard const& guard);
+
+    /**
+     * Normalize Number components to an arbitrary range.
      *
      * min/maxMantissa are parameters because this function is used by both
      * normalize(), which reads from kRange, and by normalizeToRange,
@@ -571,7 +633,7 @@ private:
         int& exponent,
         internalrep const& minMantissa,
         internalrep const& maxMantissa,
-        MantissaRange::CuspRoundingFix cuspRoundingFixEnabled);
+        MantissaRange::CuspRoundingFix cuspRoundingFix);
 
     template <class T>
     friend void
@@ -581,7 +643,7 @@ private:
         int& exponent,
         MantissaRange::rep const& minMantissa,
         MantissaRange::rep const& maxMantissa,
-        MantissaRange::CuspRoundingFix cuspRoundingFixEnabled,
+        MantissaRange::CuspRoundingFix cuspRoundingFix,
         bool dropped);
 
     [[nodiscard]] bool
@@ -592,15 +654,6 @@ private:
     // exponent could go out of range, so it will be checked.
     [[nodiscard]] Number
     shiftExponent(int exponentDelta) const;
-
-    // Safely convert rep (int64) mantissa to internalrep (uint64). If the rep
-    // is negative, returns the positive value. This takes a little extra work
-    // because converting std::numeric_limits<std::int64_t>::min() flirts with
-    // UB, and can vary across compilers.
-    static internalrep
-    externalToInternal(rep mantissa);
-
-    class Guard;
 };
 
 constexpr Number::Number(bool negative, internalrep mantissa, int exponent, Unchecked) noexcept
@@ -635,7 +688,8 @@ inline Number::Number(rep mantissa) : Number{mantissa, 0}
 {
 }
 
-/** Returns the mantissa of the external view of the Number.
+/**
+ * Returns the mantissa of the external view of the Number.
  *
  * Please see the "---- External Interface ----" section of the class
  * documentation for an explanation of why the internal value may be modified.
@@ -656,7 +710,8 @@ Number::mantissa() const noexcept
     return sign * static_cast<Number::rep>(m);
 }
 
-/** Returns the exponent of the external view of the Number.
+/**
+ * Returns the exponent of the external view of the Number.
  *
  * Please see the "---- External Interface ----" section of the class
  * documentation for an explanation of why the internal value may be modified.
@@ -862,21 +917,11 @@ squelch(Number const& x, Number const& limit) noexcept
     return x;
 }
 
-inline std::string
-to_string(MantissaRange::MantissaScale const& scale)
-{
-    switch (scale)
-    {
-        case MantissaRange::MantissaScale::Small:
-            return "small";
-        case MantissaRange::MantissaScale::LargeLegacy:
-            return "largeLegacy";
-        case MantissaRange::MantissaScale::Large:
-            return "large";
-        default:
-            throw std::runtime_error("Bad scale");
-    }
-}
+std::string
+to_string(MantissaRange::MantissaScale const& scale);
+
+std::string
+to_string(Number::RoundingMode const& round);
 
 class SaveNumberRoundMode
 {
@@ -915,10 +960,10 @@ public:
     operator=(NumberRoundModeGuard const&) = delete;
 };
 
-/** Sets the new scale and restores the old scale when it leaves scope.
+/**
+ * Sets the new scale and restores the old scale when it leaves scope.
  *
  * If you think you need to use this class outside of unit tests, no you don't.
- *
  */
 class NumberMantissaScaleGuard
 {

include/xrpl/basics/RangeSet.h

@@ -13,23 +13,25 @@
 
 namespace xrpl {
 
-/** A closed interval over the domain T.
-
-    For an instance ClosedInterval c, this represents the closed interval
-    (c.first(), c.last()).  A single element interval has c.first() == c.last().
-
-    This is simply a type-alias for boost interval container library interval
-    set, so users should consult that documentation for available supporting
-    member and free functions.
-*/
+/**
+ * A closed interval over the domain T.
+ *
+ * For an instance ClosedInterval c, this represents the closed interval
+ * (c.first(), c.last()).  A single element interval has c.first() == c.last().
+ *
+ * This is simply a type-alias for boost interval container library interval
+ * set, so users should consult that documentation for available supporting
+ * member and free functions.
+ */
 template <class T>
 using ClosedInterval = boost::icl::closed_interval<T>;
 
-/** Create a closed range interval
-
-    Helper function to create a closed range interval without having to qualify
-    the template argument.
-*/
+/**
+ * Create a closed range interval
+ *
+ * Helper function to create a closed range interval without having to qualify
+ * the template argument.
+ */
 template <class T>
 ClosedInterval<T>
 range(T low, T high)
@@ -37,28 +39,30 @@ range(T low, T high)
     return ClosedInterval<T>(low, high);
 }
 
-/** A set of closed intervals over the domain T.
-
-    Represents a set of values of the domain T using the minimum number
-    of disjoint ClosedInterval<T>.  This is useful to represent ranges of
-    T where a few instances are missing, e.g. the set 1-5,8-9,11-14.
-
-    This is simply a type-alias for boost interval container library interval
-    set, so users should consult that documentation for available supporting
-    member and free functions.
-*/
+/**
+ * A set of closed intervals over the domain T.
+ *
+ * Represents a set of values of the domain T using the minimum number
+ * of disjoint ClosedInterval<T>.  This is useful to represent ranges of
+ * T where a few instances are missing, e.g. the set 1-5,8-9,11-14.
+ *
+ * This is simply a type-alias for boost interval container library interval
+ * set, so users should consult that documentation for available supporting
+ * member and free functions.
+ */
 template <class T>
 using RangeSet = boost::icl::interval_set<T, std::less, ClosedInterval<T>>;
 
-/** Convert a ClosedInterval to a styled string
-
-    The styled string is
-        "c.first()-c.last()"  if c.first() != c.last()
-        "c.first()" if c.first() == c.last()
-
-    @param ci The closed interval to convert
-    @return The style string
-*/
+/**
+ * Convert a ClosedInterval to a styled string
+ *
+ * The styled string is
+ *     "c.first()-c.last()"  if c.first() != c.last()
+ *     "c.first()" if c.first() == c.last()
+ *
+ * @param ci The closed interval to convert
+ * @return The style string
+ */
 template <class T>
 std::string
 to_string(ClosedInterval<T> const& ci)
@@ -68,14 +72,15 @@ to_string(ClosedInterval<T> const& ci)
     return std::to_string(ci.first()) + "-" + std::to_string(ci.last());
 }
 
-/** Convert the given RangeSet to a styled string.
-
-    The styled string representation is the set of disjoint intervals joined
-    by commas.  The string "empty" is returned if the set is empty.
-
-    @param rs The rangeset to convert
-    @return The styled string
-*/
+/**
+ * Convert the given RangeSet to a styled string.
+ *
+ * The styled string representation is the set of disjoint intervals joined
+ * by commas.  The string "empty" is returned if the set is empty.
+ *
+ * @param rs The rangeset to convert
+ * @return The styled string
+ */
 template <class T>
 std::string
 to_string(RangeSet<T> const& rs)
@@ -91,15 +96,16 @@ to_string(RangeSet<T> const& rs)
     return s;
 }
 
-/** Convert the given styled string to a RangeSet.
-
-    The styled string representation is the set
-    of disjoint intervals joined by commas.
-
-    @param rs The set to be populated
-    @param s The styled string to convert
-    @return True on successfully converting styled string
-*/
+/**
+ * Convert the given styled string to a RangeSet.
+ *
+ * The styled string representation is the set
+ * of disjoint intervals joined by commas.
+ *
+ * @param rs The set to be populated
+ * @param s The styled string to convert
+ * @return True on successfully converting styled string
+ */
 template <class T>
 [[nodiscard]] bool
 fromString(RangeSet<T>& rs, std::string const& s)
@@ -161,14 +167,15 @@ fromString(RangeSet<T>& rs, std::string const& s)
     return result;
 }
 
-/** Find the largest value not in the set that is less than a given value.
-
-    @param rs The set of interest
-    @param t The value that must be larger than the result
-    @param minVal (Default is 0) The smallest allowed value
-    @return The largest v such that minV <= v < t and !contains(rs, v) or
-            std::nullopt if no such v exists.
-*/
+/**
+ * Find the largest value not in the set that is less than a given value.
+ *
+ * @param rs The set of interest
+ * @param t The value that must be larger than the result
+ * @param minVal (Default is 0) The smallest allowed value
+ * @return The largest v such that minV <= v < t and !contains(rs, v) or
+ *         std::nullopt if no such v exists.
+ */
 template <class T>
 std::optional<T>
 prevMissing(RangeSet<T> const& rs, T t, T minVal = 0)

include/xrpl/basics/Resolver.h

@@ -15,22 +15,29 @@ public:
 
     virtual ~Resolver() = 0;
 
-    /** Issue an asynchronous stop request. */
+    /**
+     * Issue an asynchronous stop request.
+     */
     virtual void
     stopAsync() = 0;
 
-    /** Issue a synchronous stop request. */
+    /**
+     * Issue a synchronous stop request.
+     */
     virtual void
     stop() = 0;
 
-    /** Issue a synchronous start request. */
+    /**
+     * Issue a synchronous start request.
+     */
     virtual void
     start() = 0;
 
-    /** resolve all hostnames on the list
-        @param names the names to be resolved
-        @param handler the handler to call
-    */
+    /**
+     * resolve all hostnames on the list
+     * @param names the names to be resolved
+     * @param handler the handler to call
+     */
     /** @{ */
     template <class Handler>
     void

include/xrpl/basics/SharedWeakCachePointer.h

@@ -7,13 +7,14 @@
 
 namespace xrpl {
 
-/** A combination of a std::shared_ptr and a std::weak_pointer.
-
-
-This class is a wrapper to a `std::variant<std::shared_ptr,std::weak_ptr>`
-This class is useful for storing intrusive pointers in tagged caches using less
-memory than storing both pointers directly.
-*/
+/**
+ * A combination of a std::shared_ptr and a std::weak_pointer.
+ *
+ *
+ * This class is a wrapper to a `std::variant<std::shared_ptr,std::weak_ptr>`
+ * This class is useful for storing intrusive pointers in tagged caches using less
+ * memory than storing both pointers directly.
+ */
 
 template <class T>
 class SharedWeakCachePointer
@@ -48,65 +49,79 @@ public:
 
     ~SharedWeakCachePointer();
 
-    /** Return a strong pointer if this is already a strong pointer (i.e. don't
-        lock the weak pointer. Use the `lock` method if that's what's needed)
+    /**
+     * Return a strong pointer if this is already a strong pointer (i.e. don't
+     * lock the weak pointer. Use the `lock` method if that's what's needed)
      */
     [[nodiscard]] std::shared_ptr<T> const&
     getStrong() const;
 
-    /** Return true if this is a strong pointer and the strong pointer is
-        seated.
+    /**
+     * Return true if this is a strong pointer and the strong pointer is
+     * seated.
      */
     explicit
     operator bool() const noexcept;
 
-    /** Set the pointer to null, decrement the appropriate ref count, and run
-        the appropriate release action.
+    /**
+     * Set the pointer to null, decrement the appropriate ref count, and run
+     * the appropriate release action.
      */
     void
     reset();
 
-    /** If this is a strong pointer, return the raw pointer. Otherwise return
-        null.
+    /**
+     * If this is a strong pointer, return the raw pointer. Otherwise return
+     * null.
      */
     [[nodiscard]] T*
     get() const;
 
-    /** If this is a strong pointer, return the strong count. Otherwise return 0
+    /**
+     * If this is a strong pointer, return the strong count. Otherwise return 0
      */
     [[nodiscard]] std::size_t
     useCount() const;
 
-    /** Return true if there is a non-zero strong count. */
+    /**
+     * Return true if there is a non-zero strong count.
+     */
     [[nodiscard]] bool
     expired() const;
 
-    /** If this is a strong pointer, return the strong pointer. Otherwise
-        attempt to lock the weak pointer.
+    /**
+     * If this is a strong pointer, return the strong pointer. Otherwise
+     * attempt to lock the weak pointer.
      */
     [[nodiscard]] std::shared_ptr<T>
     lock() const;
 
-    /** Return true is this represents a strong pointer. */
+    /**
+     * Return true is this represents a strong pointer.
+     */
     [[nodiscard]] bool
     isStrong() const;
 
-    /** Return true is this represents a weak pointer. */
+    /**
+     * Return true is this represents a weak pointer.
+     */
     [[nodiscard]] bool
     isWeak() const;
 
-    /** If this is a weak pointer, attempt to convert it to a strong pointer.
-
-        @return true if successfully converted to a strong pointer (or was
-                already a strong pointer). Otherwise false.
-      */
+    /**
+     * If this is a weak pointer, attempt to convert it to a strong pointer.
+     *
+     * @return true if successfully converted to a strong pointer (or was
+     *         already a strong pointer). Otherwise false.
+     */
     bool
     convertToStrong();
 
-    /** If this is a strong pointer, attempt to convert it to a weak pointer.
-
-        @return false if the pointer is null. Otherwise return true.
-      */
+    /**
+     * If this is a strong pointer, attempt to convert it to a weak pointer.
+     *
+     * @return false if the pointer is null. Otherwise return true.
+     */
     bool
     convertToWeak();
 

include/xrpl/basics/SlabAllocator.h

@@ -33,7 +33,9 @@ class SlabAllocator
 
     static_assert(alignof(Type) == 8 || alignof(Type) == 4);
 
-    /** A block of memory that is owned by a slab allocator */
+    /**
+     * A block of memory that is owned by a slab allocator
+     */
     struct SlabBlock
     {
         // A mutex to protect the freelist for this block:
@@ -80,7 +82,9 @@ class SlabAllocator
         SlabBlock&
         operator=(SlabBlock&& other) = delete;
 
-        /** Determines whether the given pointer belongs to this allocator */
+        /**
+         * Determines whether the given pointer belongs to this allocator
+         */
         bool
         own(std::uint8_t const* pIn) const noexcept
         {
@@ -107,14 +111,15 @@ class SlabAllocator
             return ret;
         }
 
-        /** Return an item to this allocator's freelist.
-
-            @param ptr The pointer to the chunk of memory being deallocated.
-
-            @note This is a dangerous, private interface; the item being
-                  returned should belong to this allocator. Debug builds
-                  will check and assert if this is not the case. Release
-                  builds will not.
+        /**
+         * Return an item to this allocator's freelist.
+         *
+         * @param ptr The pointer to the chunk of memory being deallocated.
+         *
+         * @note This is a dangerous, private interface; the item being
+         *       returned should belong to this allocator. Debug builds
+         *       will check and assert if this is not the case. Release
+         *       builds will not.
          */
         void
         deallocate(std::uint8_t* ptr) noexcept
@@ -145,13 +150,14 @@ private:
     std::size_t const slabSize_;
 
 public:
-    /** Constructs a slab allocator able to allocate objects of a fixed size
-
-        @param count the number of items the slab allocator can allocate; note
-                     that a count of 0 is valid and means that the allocator
-                     is, effectively, disabled. This can be very useful in some
-                     contexts (e.g. when minimal memory usage is needed) and
-                     allows for graceful failure.
+    /**
+     * Constructs a slab allocator able to allocate objects of a fixed size
+     *
+     * @param count the number of items the slab allocator can allocate; note
+     *              that a count of 0 is valid and means that the allocator
+     *              is, effectively, disabled. This can be very useful in some
+     *              contexts (e.g. when minimal memory usage is needed) and
+     *              allows for graceful failure.
      */
     constexpr explicit SlabAllocator(
         std::size_t extra,
@@ -179,17 +185,20 @@ public:
     //        shutdown process up could make this possible.
     ~SlabAllocator() = default;
 
-    /** Returns the size of the memory block this allocator returns. */
+    /**
+     * Returns the size of the memory block this allocator returns.
+     */
     [[nodiscard]] constexpr std::size_t
     size() const noexcept
     {
         return itemSize_;
     }
 
-    /** Returns a suitably aligned pointer, if one is available.
-
-        @return a pointer to a block of memory from the allocator, or
-                nullptr if the allocator can't satisfy this request.
+    /**
+     * Returns a suitably aligned pointer, if one is available.
+     *
+     * @return a pointer to a block of memory from the allocator, or
+     *         nullptr if the allocator can't satisfy this request.
      */
     std::uint8_t*
     allocate() noexcept
@@ -250,12 +259,13 @@ public:
         return slab->allocate();
     }
 
-    /** Returns the memory block to the allocator.
-
-        @param ptr A pointer to a memory block.
-        @param size If non-zero, a hint as to the size of the block.
-        @return true if this memory block belonged to the allocator and has
-                     been released; false otherwise.
+    /**
+     * Returns the memory block to the allocator.
+     *
+     * @param ptr A pointer to a memory block.
+     * @param size If non-zero, a hint as to the size of the block.
+     * @return true if this memory block belonged to the allocator and has
+     *              been released; false otherwise.
      */
     bool
     deallocate(std::uint8_t* ptr) noexcept
@@ -278,7 +288,9 @@ public:
     }
 };
 
-/** A collection of slab allocators of various sizes for a given type. */
+/**
+ * A collection of slab allocators of various sizes for a given type.
+ */
 template <typename Type>
 class SlabAllocatorSet
 {
@@ -345,13 +357,14 @@ public:
 
     ~SlabAllocatorSet() = default;
 
-    /** Returns a suitably aligned pointer, if one is available.
-
-        @param extra The number of extra bytes, above and beyond the size of
-                     the object, that should be returned by the allocator.
-
-        @return a pointer to a block of memory, or nullptr if the allocator
-                can't satisfy this request.
+    /**
+     * Returns a suitably aligned pointer, if one is available.
+     *
+     * @param extra The number of extra bytes, above and beyond the size of
+     *              the object, that should be returned by the allocator.
+     *
+     * @return a pointer to a block of memory, or nullptr if the allocator
+     *         can't satisfy this request.
      */
     std::uint8_t*
     allocate(std::size_t extra) noexcept
@@ -368,12 +381,13 @@ public:
         return nullptr;
     }
 
-    /** Returns the memory block to the allocator.
-
-        @param ptr A pointer to a memory block.
-
-        @return true if this memory block belonged to one of the allocators
-                     in this set and has been released; false otherwise.
+    /**
+     * Returns the memory block to the allocator.
+     *
+     * @param ptr A pointer to a memory block.
+     *
+     * @return true if this memory block belonged to one of the allocators
+     *              in this set and has been released; false otherwise.
      */
     bool
     deallocate(std::uint8_t* ptr) noexcept

include/xrpl/basics/Slice.h

@@ -16,12 +16,13 @@
 
 namespace xrpl {
 
-/** An immutable linear range of bytes.
-
-    A fully constructed Slice is guaranteed to be in a valid state.
-    A Slice is lightweight and copyable, it retains no ownership
-    of the underlying memory.
-*/
+/**
+ * An immutable linear range of bytes.
+ *
+ * A fully constructed Slice is guaranteed to be in a valid state.
+ * A Slice is lightweight and copyable, it retains no ownership
+ * of the underlying memory.
+ */
 class Slice
 {
 private:
@@ -32,30 +33,37 @@ public:
     using value_type = std::uint8_t;
     using const_iterator = value_type const*;
 
-    /** Default constructed Slice has length 0. */
+    /**
+     * Default constructed Slice has length 0.
+     */
     Slice() noexcept = default;
 
     Slice(Slice const&) noexcept = default;
     Slice&
     operator=(Slice const&) noexcept = default;
 
-    /** Create a slice pointing to existing memory. */
+    /**
+     * Create a slice pointing to existing memory.
+     */
     Slice(void const* data, std::size_t size) noexcept
         : data_(reinterpret_cast<std::uint8_t const*>(data)), size_(size)
     {
     }
 
-    /** Return `true` if the byte range is empty. */
+    /**
+     * Return `true` if the byte range is empty.
+     */
     [[nodiscard]] bool
     empty() const noexcept
     {
         return size_ == 0;
     }
 
-    /** Returns the number of bytes in the storage.
-
-        This may be zero for an empty range.
-    */
+    /**
+     * Returns the number of bytes in the storage.
+     *
+     * This may be zero for an empty range.
+     */
     /** @{ */
     [[nodiscard]] std::size_t
     size() const noexcept
@@ -70,17 +78,20 @@ public:
     }
     /** @} */
 
-    /** Return a pointer to beginning of the storage.
-        @note The return type is guaranteed to be a pointer
-              to a single byte, to facilitate pointer arithmetic.
-    */
+    /**
+     * Return a pointer to beginning of the storage.
+     * @note The return type is guaranteed to be a pointer
+     *       to a single byte, to facilitate pointer arithmetic.
+     */
     [[nodiscard]] std::uint8_t const*
     data() const noexcept
     {
         return data_;
     }
 
-    /** Access raw bytes. */
+    /**
+     * Access raw bytes.
+     */
     std::uint8_t
     operator[](std::size_t i) const noexcept
     {
@@ -88,7 +99,9 @@ public:
         return data_[i];
     }
 
-    /** Advance the buffer. */
+    /**
+     * Advance the buffer.
+     */
     /** @{ */
     Slice&
     operator+=(std::size_t n)
@@ -108,7 +121,9 @@ public:
     }
     /** @} */
 
-    /** Shrinks the slice by moving its start forward by n characters. */
+    /**
+     * Shrinks the slice by moving its start forward by n characters.
+     */
     void
     removePrefix(std::size_t n)
     {
@@ -116,7 +131,9 @@ public:
         size_ -= n;
     }
 
-    /** Shrinks the slice by moving its end backward by n characters. */
+    /**
+     * Shrinks the slice by moving its end backward by n characters.
+     */
     void
     removeSuffix(std::size_t n)
     {
@@ -147,16 +164,17 @@ public:
         return data_ + size_;
     }
 
-    /** Return a "sub slice" of given length starting at the given position
-
-        Note that the subslice encompasses the range [pos, pos + rCount),
-        where rCount is the smaller of count and size() - pos.
-
-        @param pos position of the first character
-        @count requested length
-
-        @returns The requested subslice, if the request is valid.
-        @throws std::out_of_range if pos > size()
+    /**
+     * Return a "sub slice" of given length starting at the given position
+     *
+     * Note that the subslice encompasses the range [pos, pos + rCount),
+     * where rCount is the smaller of count and size() - pos.
+     *
+     * @param pos position of the first character
+     * @count requested length
+     *
+     * @return The requested subslice, if the request is valid.
+     * @throws std::out_of_range if pos > size()
      */
     [[nodiscard]] Slice
     substr(std::size_t pos, std::size_t count = std::numeric_limits<std::size_t>::max()) const

include/xrpl/basics/StringUtilities.h

@@ -17,15 +17,16 @@
 
 namespace xrpl {
 
-/** Format arbitrary binary data as an SQLite "blob literal".
-
-    In SQLite, blob literals must be encoded when used in a query. Per
-    https://sqlite.org/lang_expr.html#literal_values_constants_ they are
-    encoded as string literals containing hexadecimal data and preceded
-    by a single 'X' character.
-
-    @param blob An arbitrary blob of binary data
-    @return The input, encoded as a blob literal.
+/**
+ * Format arbitrary binary data as an SQLite "blob literal".
+ *
+ * In SQLite, blob literals must be encoded when used in a query. Per
+ * https://sqlite.org/lang_expr.html#literal_values_constants_ they are
+ * encoded as string literals containing hexadecimal data and preceded
+ * by a single 'X' character.
+ *
+ * @param blob An arbitrary blob of binary data
+ * @return The input, encoded as a blob literal.
  */
 std::string
 sqlBlobLiteral(Blob const& blob);
@@ -130,11 +131,12 @@ trimWhitespace(std::string str);
 std::optional<std::uint64_t>
 toUInt64(std::string const& s);
 
-/** Determines if the given string looks like a TOML-file hosting domain.
-
-    Do not use this function to determine if a particular string is a valid
-    domain, as this function may reject domains that are otherwise valid and
-    doesn't check whether the TLD is valid.
+/**
+ * Determines if the given string looks like a TOML-file hosting domain.
+ *
+ * Do not use this function to determine if a particular string is a valid
+ * domain, as this function may reject domains that are otherwise valid and
+ * doesn't check whether the TLD is valid.
  */
 bool
 isProperlyFormedTomlDomain(std::string_view domain);

include/xrpl/basics/TaggedCache.h

@@ -41,18 +41,19 @@ struct ReplaceDynamically;
 
 }  // namespace detail
 
-/** Map/cache combination.
-    This class implements a cache and a map. The cache keeps objects alive
-    in the map. The map allows multiple code paths that reference objects
-    with the same tag to get the same actual object.
-
-    So long as data is in the cache, it will stay in memory.
-    If it stays in memory even after it is ejected from the cache,
-    the map will track it.
-
-    @note Callers must not modify data objects that are stored in the cache
-          unless they hold their own lock over all cache operations.
-*/
+/**
+ * Map/cache combination.
+ * This class implements a cache and a map. The cache keeps objects alive
+ * in the map. The map allows multiple code paths that reference objects
+ * with the same tag to get the same actual object.
+ *
+ * So long as data is in the cache, it will stay in memory.
+ * If it stays in memory even after it is ejected from the cache,
+ * the map will track it.
+ *
+ * @note Callers must not modify data objects that are stored in the cache
+ *       unless they hold their own lock over all cache operations.
+ */
 template <
     class Key,
     class T,
@@ -82,11 +83,15 @@ public:
         beast::insight::Collector::ptr const& collector = beast::insight::NullCollector::make());
 
 public:
-    /** Return the clock associated with the cache. */
+    /**
+     * Return the clock associated with the cache.
+     */
     clock_type&
     clock();
 
-    /** Returns the number of items in the container. */
+    /**
+     * Returns the number of items in the container.
+     */
     std::size_t
     size() const;
 
@@ -105,9 +110,10 @@ public:
     void
     reset();
 
-    /** Refresh the last access time on a key if present.
-        @return `true` If the key was found.
-    */
+    /**
+     * Refresh the last access time on a key if present.
+     * @return `true` If the key was found.
+     */
     template <class KeyComparable>
     bool
     touchIfExists(KeyComparable const& key);
@@ -130,14 +136,15 @@ private:
         SharedPointerType const&,
         SharedPointerType&>;
 
-    /** Shared implementation of the canonicalize family.
-
-        `policy` selects how a collision is resolved when `key` already exists:
-        detail::ReplaceCached, detail::ReplaceClient or
-        detail::ReplaceDynamically. For ReplaceDynamically `replaceCallback` is
-        invoked with the existing strong pointer and returns whether to replace
-        the cached value with `data`; for the tag policies it is unused.
-    */
+    /**
+     * Shared implementation of the canonicalize family.
+     *
+     * `policy` selects how a collision is resolved when `key` already exists:
+     * detail::ReplaceCached, detail::ReplaceClient or
+     * detail::ReplaceDynamically. For ReplaceDynamically `replaceCallback` is
+     * invoked with the existing strong pointer and returns whether to replace
+     * the cached value with `data`; for the tag policies it is unused.
+     */
     template <class Policy, class Callback = std::nullptr_t>
     bool
     canonicalizeImpl(
@@ -147,69 +154,73 @@ private:
         Callback&& replaceCallback = nullptr);
 
 public:
-    /** Replace aliased objects with originals.
-
-        Due to concurrency it is possible for two separate objects with
-        the same content and referring to the same unique "thing" to exist.
-        This routine eliminates the duplicate and performs a replacement
-        on the callers shared pointer if needed.
-
-        `replaceCallback` is a callable taking the existing strong pointer and
-        returning whether to replace the cached value with `data` (true) or to
-        keep the cached value and write it back into `data` (false). Because the
-        write-back case mutates `data`, `data` must be writable.
-
-        @param key The key corresponding to the object
-        @param data A shared pointer to the data corresponding to the object.
-        @param replaceCallback A callable (existing strong pointer -> bool).
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
+    /**
+     * Replace aliased objects with originals.
+     *
+     * Due to concurrency it is possible for two separate objects with
+     * the same content and referring to the same unique "thing" to exist.
+     * This routine eliminates the duplicate and performs a replacement
+     * on the callers shared pointer if needed.
+     *
+     * `replaceCallback` is a callable taking the existing strong pointer and
+     * returning whether to replace the cached value with `data` (true) or to
+     * keep the cached value and write it back into `data` (false). Because the
+     * write-back case mutates `data`, `data` must be writable.
+     *
+     * @param key The key corresponding to the object
+     * @param data A shared pointer to the data corresponding to the object.
+     * @param replaceCallback A callable (existing strong pointer -> bool).
+     *
+     * @return `true` if an existing live entry was found and used; `false` if a new entry was
+     *         inserted or an expired tracked entry was re-cached.
+     */
     template <class Callback>
     bool
     canonicalize(key_type const& key, SharedPointerType& data, Callback&& replaceCallback);
 
-    /** Insert/update the canonical entry for `key`, always replacing the
-        cached value with `data`.
-
-        If an entry already exists for `key`, the cached value is unconditionally
-        replaced with `data`; otherwise `data` is inserted. `data` is never
-        written back, so it may be const.
-
-        @param key The key corresponding to the object.
-        @param data A shared pointer to the data corresponding to the object.
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
+    /**
+     * Insert/update the canonical entry for `key`, always replacing the
+     * cached value with `data`.
+     *
+     * If an entry already exists for `key`, the cached value is unconditionally
+     * replaced with `data`; otherwise `data` is inserted. `data` is never
+     * written back, so it may be const.
+     *
+     * @param key The key corresponding to the object.
+     * @param data A shared pointer to the data corresponding to the object.
+     *
+     * @return `true` if an existing live entry was found and used; `false` if a new entry was
+     *         inserted or an expired tracked entry was re-cached.
+     */
     bool
     canonicalizeReplaceCache(key_type const& key, SharedPointerType const& data);
 
-    /** Insert the canonical entry for `key`, keeping any existing cached value.
-
-        If an entry already exists for `key`, the cached value is kept and
-        written back into `data` so the caller ends up with the canonical
-        object; otherwise `data` is inserted. Because `data` may be overwritten
-        it must be writable.
-
-        @param key The key corresponding to the object.
-        @param data A shared pointer to the data corresponding to the object;
-                    updated to the canonical value when one already exists.
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
+    /**
+     * Insert the canonical entry for `key`, keeping any existing cached value.
+     *
+     * If an entry already exists for `key`, the cached value is kept and
+     * written back into `data` so the caller ends up with the canonical
+     * object; otherwise `data` is inserted. Because `data` may be overwritten
+     * it must be writable.
+     *
+     * @param key The key corresponding to the object.
+     * @param data A shared pointer to the data corresponding to the object;
+     *             updated to the canonical value when one already exists.
+     *
+     * @return `true` if an existing live entry was found and used; `false` if a new entry was
+     *         inserted or an expired tracked entry was re-cached.
+     */
     bool
     canonicalizeReplaceClient(key_type const& key, SharedPointerType& data);
 
     SharedPointerType
     fetch(key_type const& key);
 
-    /** Insert the element into the container.
-        If the key already exists, nothing happens.
-        @return `true` If the element was inserted
-    */
+    /**
+     * Insert the element into the container.
+     * If the key already exists, nothing happens.
+     * @return `true` If the element was inserted
+     */
     template <class ReturnType = bool>
     auto
     insert(key_type const& key, T const& value) -> ReturnType
@@ -235,15 +246,18 @@ public:
     getKeys() const;
 
     // CachedSLEs functions.
-    /** Returns the fraction of cache hits. */
+    /**
+     * Returns the fraction of cache hits.
+     */
     double
     rate() const;
 
-    /** Fetch an item from the cache.
-        If the digest was not found, Handler
-        will be called with this signature:
-            SLE::const_pointer(void)
-    */
+    /**
+     * Fetch an item from the cache.
+     * If the digest was not found, Handler
+     * will be called with this signature:
+     *     SLE::const_pointer(void)
+     */
     template <class Handler>
     SharedPointerType
     fetch(key_type const& digest, Handler const& h);

include/xrpl/basics/TaggedCache.ipp

@@ -3,6 +3,9 @@
 #include <xrpl/basics/IntrusivePointer.ipp>
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/scope.h>
+
+#include <algorithm>
 
 namespace xrpl {
 
@@ -601,8 +604,42 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     std::vector<key_type> v;
 
     {
-        std::scoped_lock const lock(mutex_);
-        v.reserve(cache_.size());
+        // Keep track of how many iterations are needed. Exit the loop if the number of retries gets
+        // absurd. (Note that if this somehow ever happens, one more allocation will be done under
+        // lock, which is undesirable, but really should be almost impossible.)
+        std::size_t allocationIterations = 0;
+        std::unique_lock lock(mutex_);
+        for (auto size = cache_.size(); v.capacity() < size && allocationIterations < 20;
+             size = cache_.size())
+        {
+            ScopeUnlock const unlock(lock);
+            if (allocationIterations > 0)
+            {
+                JLOG(journal_.info())
+                    << "getKeys(): Cache grew beyond allocated capacity after "
+                    << allocationIterations << " prior attempt(s). Have " << v.capacity()
+                    << ", need " << size << ". Retrying allocation";
+            }
+            // Allocate the current size plus a little extra, in case the cache grows while
+            // allocating. Each time another allocation is needed, the extra also gets bigger until
+            // it ultimately doubles the size + 1.
+            constexpr std::size_t baseShift = 5;
+            auto const bufferOffset = std::min(allocationIterations, std::size_t{baseShift});
+            auto const bufferShift = baseShift - bufferOffset;
+            size += (size >> bufferShift) + 1;
+            v.reserve(size);
+            ++allocationIterations;
+        }
+        if (v.capacity() < cache_.size())
+        {
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::TaggedCache::getKeys(): failed to allocate sufficient capacity");
+            v.reserve(cache_.size());
+            // LCOV_EXCL_STOP
+        }
+        XRPL_ASSERT(lock.owns_lock(), "xrpl::TaggedCache::getKeys(): owns lock");
+        XRPL_ASSERT(
+            v.capacity() >= cache_.size(), "xrpl::TaggedCache::getKeys(): sufficient capacity");
         for (auto const& _ : cache_)
             v.push_back(_.first);
     }

include/xrpl/basics/ToString.h

@@ -5,10 +5,11 @@
 
 namespace xrpl {
 
-/** to_string() generalizes std::to_string to handle bools, chars, and strings.
-
-    It's also possible to provide implementation of to_string for a class
-    which needs a string implementation.
+/**
+ * to_string() generalizes std::to_string to handle bools, chars, and strings.
+ *
+ * It's also possible to provide implementation of to_string for a class
+ * which needs a string implementation.
  */
 
 template <class T>

include/xrpl/basics/UptimeClock.h

@@ -7,12 +7,13 @@
 
 namespace xrpl {
 
-/** Tracks program uptime to seconds precision.
-
-    The timer caches the current time as a performance optimization.
-    This allows clients to query the current time thousands of times
-    per second.
-*/
+/**
+ * Tracks program uptime to seconds precision.
+ *
+ * The timer caches the current time as a performance optimization.
+ * This allows clients to query the current time thousands of times
+ * per second.
+ */
 
 class UptimeClock
 {

include/xrpl/basics/base_uint.h

@@ -63,18 +63,19 @@ struct AlwaysFalseT : std::bool_constant<false>
 
 }  // namespace detail
 
-/** Integers of any length that is a multiple of 32-bits
-
-    @note This class stores its values internally in big-endian
-          form and that internal representation is part of the
-          binary protocol of the XRP Ledger and cannot be changed
-          arbitrarily without causing breakage.
-
-          @tparam Bits The number of bits this integer should have; must
-                       be at least 64 and a multiple of 32.
-          @tparam Tag An arbitrary type that functions as a tag and allows
-                      the instantiation of "distinct" types that the same
-                      number of bits.
+/**
+ * Integers of any length that is a multiple of 32-bits
+ *
+ * @note This class stores its values internally in big-endian
+ *       form and that internal representation is part of the
+ *       binary protocol of the XRP Ledger and cannot be changed
+ *       arbitrarily without causing breakage.
+ *
+ * @tparam Bits The number of bits this integer should have; must
+ *              be at least 64 and a multiple of 32.
+ * @tparam Tag An arbitrary type that functions as a tag and allows
+ *             the instantiation of "distinct" types that the same
+ *             number of bits.
  */
 template <std::size_t Bits, class Tag = void>
 class BaseUInt
@@ -154,21 +155,23 @@ public:
         return data() + kBytes;
     }
 
-    /** Value hashing function.
-        The seed prevents crafted inputs from causing degenerate parent
-       containers.
-    */
+    /**
+     * Value hashing function.
+     *  The seed prevents crafted inputs from causing degenerate parent
+     * containers.
+     */
     using hasher = HardenedHash<>;
 
     //--------------------------------------------------------------------------
 
 private:
-    /** Construct from a raw pointer.
-        The buffer pointed to by `data` must be at least Bits/8 bytes.
-
-        @note the structure is used to disambiguate this from the std::uint64_t
-              constructor: something like base_uint(0) is ambiguous.
-    */
+    /**
+     * Construct from a raw pointer.
+     * The buffer pointed to by `data` must be at least Bits/8 bytes.
+     *
+     * @note the structure is used to disambiguate this from the std::uint64_t
+     *       constructor: something like base_uint(0) is ambiguous.
+     */
     // NIKB TODO Remove the need for this constructor.
     struct VoidHelper
     {
@@ -305,7 +308,9 @@ public:
         XRPL_ASSERT(
             c.size() * sizeof(typename Container::value_type) == size(),
             "xrpl::BaseUInt::fromRaw(Container auto) : input size match");
-        std::memcpy(result.data_.data(), c.data(), size());
+        std::size_t const canCopy =
+            std::min(size(), c.size() * sizeof(typename Container::value_type));
+        std::memcpy(result.data_.data(), c.data(), canCopy);
         return result;
     }
 
@@ -319,7 +324,11 @@ public:
         XRPL_ASSERT(
             c.size() * sizeof(typename Container::value_type) == size(),
             "xrpl::BaseUInt::operator=(Container auto) : input size match");
-        std::memcpy(data_.data(), c.data(), size());
+        std::size_t const canCopy =
+            std::min(size(), c.size() * sizeof(typename Container::value_type));
+        if (canCopy < size())
+            *this = beast::kZero;
+        std::memcpy(data_.data(), c.data(), canCopy);
         return *this;
     }
 
@@ -503,13 +512,14 @@ public:
         h(a.data_.data(), sizeof(a.data_));
     }
 
-    /** Parse a hex string into a base_uint
-
-        The input must be precisely `2 * bytes` hexadecimal characters
-        long, with one exception: the value '0'.
-
-        @param sv A null-terminated string of hexadecimal characters
-        @return true if the input was parsed properly; false otherwise.
+    /**
+     * Parse a hex string into a base_uint
+     *
+     * The input must be precisely `2 * bytes` hexadecimal characters
+     * long, with one exception: the value '0'.
+     *
+     * @param sv A null-terminated string of hexadecimal characters
+     * @return true if the input was parsed properly; false otherwise.
      */
     [[nodiscard]] constexpr bool
     parseHex(std::string_view sv)
@@ -595,7 +605,7 @@ template <std::size_t Bits, typename Tag>
 [[nodiscard]] constexpr bool
 operator==(BaseUInt<Bits, Tag> const& lhs, BaseUInt<Bits, Tag> const& rhs)
 {
-    return (lhs <=> rhs) == 0;
+    return (lhs <=> rhs) == 0;  // NOLINT(modernize-use-nullptr)
 }
 
 //------------------------------------------------------------------------------

include/xrpl/basics/chrono.h

@@ -21,15 +21,16 @@ using days =
 
 using weeks = std::chrono::duration<int, std::ratio_multiply<days::period, std::ratio<7>>>;
 
-/** Clock for measuring the network time.
-
-    The epoch is January 1, 2000
-
-    epoch_offset
-    = date(2000-01-01) - date(1970-0-01)
-    = days(10957)
-    = seconds(946684800)
-*/
+/**
+ * Clock for measuring the network time.
+ *
+ * The epoch is January 1, 2000
+ *
+ * epoch_offset
+ * = date(2000-01-01) - date(1970-0-01)
+ * = days(10957)
+ * = seconds(946684800)
+ */
 
 static constexpr std::chrono::seconds kEpochOffset =
     date::sys_days{date::year{2000} / 1 / 1} - date::sys_days{date::year{1970} / 1 / 1};
@@ -81,16 +82,21 @@ toStringIso(NetClock::time_point tp)
     return toStringIso(date::sys_time<NetClock::duration>{tp.time_since_epoch() + kEpochOffset});
 }
 
-/** A clock for measuring elapsed time.
-
-    The epoch is unspecified.
-*/
+/**
+ * A clock for measuring elapsed time.
+ *
+ * The epoch is unspecified.
+ */
 using Stopwatch = beast::AbstractClock<std::chrono::steady_clock>;
 
-/** A manual Stopwatch for unit tests. */
+/**
+ * A manual Stopwatch for unit tests.
+ */
 using TestStopwatch = beast::ManualClock<std::chrono::steady_clock>;
 
-/** Returns an instance of a wall clock. */
+/**
+ * Returns an instance of a wall clock.
+ */
 inline Stopwatch&
 stopwatch()
 {

include/xrpl/basics/contract.h

@@ -15,20 +15,23 @@ namespace xrpl {
     preconditions, postconditions, and invariants.
 */
 
-/** Generates and logs a call stack */
+/**
+ * Generates and logs a call stack
+ */
 void
 logThrow(std::string const& title);
 
-/** Rethrow the exception currently being handled.
-
-    When called from within a catch block, it will pass
-    control to the next matching exception handler, if any.
-    Otherwise, std::terminate will be called.
-
-    ASAN can't handle sudden jumps in control flow very well. This
-    function is marked as XRPL_NO_SANITIZE_ADDRESS to prevent it from
-    triggering false positives, since it throws.
-*/
+/**
+ * Rethrow the exception currently being handled.
+ *
+ * When called from within a catch block, it will pass
+ * control to the next matching exception handler, if any.
+ * Otherwise, std::terminate will be called.
+ *
+ * ASAN can't handle sudden jumps in control flow very well. This
+ * function is marked as XRPL_NO_SANITIZE_ADDRESS to prevent it from
+ * triggering false positives, since it throws.
+ */
 [[noreturn]] XRPL_NO_SANITIZE_ADDRESS inline void
 rethrow()
 {
@@ -56,7 +59,9 @@ Throw(Args&&... args)
     throw std::move(e);
 }
 
-/** Called when faulty logic causes a broken invariant. */
+/**
+ * Called when faulty logic causes a broken invariant.
+ */
 [[noreturn]] void
 logicError(std::string const& how) noexcept;
 

include/xrpl/basics/hardened_hash.h

@@ -39,33 +39,33 @@ makeSeedPair() noexcept
 
 /**
  * Seed functor once per construction
-
-   A std compatible hash adapter that resists adversarial inputs.
-   For this to work, T must implement in its own namespace:
-
-   @code
-
-   template <class Hasher>
-   void
-   hash_append (Hasher& h, T const& t) noexcept
-   {
-       // hash_append each base and member that should
-       //  participate in forming the hash
-       using beast::hash_append;
-       hash_append (h, static_cast<T::base1 const&>(t));
-       hash_append (h, static_cast<T::base2 const&>(t));
-       // ...
-       hash_append (h, t.member1);
-       hash_append (h, t.member2);
-       // ...
-   }
-
-   @endcode
-
-   Do not use any version of Murmur or CityHash for the Hasher
-   template parameter (the hashing algorithm).  For details
-   see https://131002.net/siphash/#at
-*/
+ *
+ * A std compatible hash adapter that resists adversarial inputs.
+ * For this to work, T must implement in its own namespace:
+ *
+ * @code
+ *
+ * template <class Hasher>
+ * void
+ * hash_append (Hasher& h, T const& t) noexcept
+ * {
+ *     // hash_append each base and member that should
+ *     //  participate in forming the hash
+ *     using beast::hash_append;
+ *     hash_append (h, static_cast<T::base1 const&>(t));
+ *     hash_append (h, static_cast<T::base2 const&>(t));
+ *     // ...
+ *     hash_append (h, t.member1);
+ *     hash_append (h, t.member2);
+ *     // ...
+ * }
+ *
+ * @endcode
+ *
+ * Do not use any version of Murmur or CityHash for the Hasher
+ * template parameter (the hashing algorithm).  For details
+ * see https://131002.net/siphash/#at
+ */
 
 template <class HashAlgorithm = beast::Xxhasher>
 class HardenedHash

include/xrpl/basics/make_SSLContext.h

@@ -7,11 +7,15 @@
 
 namespace xrpl {
 
-/** Create a self-signed SSL context that allows anonymous Diffie Hellman. */
+/**
+ * Create a self-signed SSL context that allows anonymous Diffie Hellman.
+ */
 std::shared_ptr<boost::asio::ssl::context>
 makeSslContext(std::string const& cipherList);
 
-/** Create an authenticated SSL context using the specified files. */
+/**
+ * Create an authenticated SSL context using the specified files.
+ */
 std::shared_ptr<boost::asio::ssl::context>
 makeSslContextAuthed(
     std::string const& keyFile,

include/xrpl/basics/mulDiv.h

@@ -7,16 +7,16 @@
 namespace xrpl {
 constexpr auto kMuldivMax = std::numeric_limits<std::uint64_t>::max();
 
-/** Return value*mul/div accurately.
-    Computes the result of the multiplication and division in
-    a single step, avoiding overflow and retaining precision.
-    Throws:
-        None
-    Returns:
-        `std::optional`:
-            `std::nullopt` if the calculation overflows. Otherwise, `value * mul
-   / div`.
-*/
+/**
+ * Return value*mul/div accurately.
+ *
+ * Computes the result of the multiplication and division in
+ * a single step, avoiding overflow and retaining precision.
+ *
+ * @throws None
+ * @return `std::nullopt` if the calculation overflows. Otherwise,
+ *         `value * mul / div`.
+ */
 std::optional<std::uint64_t>
 mulDiv(std::uint64_t value, std::uint64_t mul, std::uint64_t div);
 

include/xrpl/basics/random.h

@@ -33,16 +33,17 @@ template <class Engine, class Result = typename Engine::result_type>
 using is_engine = std::is_invocable_r<Result, Engine>;
 }  // namespace detail
 
-/** Return the default random engine.
-
-    This engine is guaranteed to be deterministic, but by
-    default will be randomly seeded. It is NOT cryptographically
-    secure and MUST NOT be used to generate randomness that
-    will be used for keys, secure cookies, IVs, padding, etc.
-
-    Each thread gets its own instance of the engine which
-    will be randomly seeded.
-*/
+/**
+ * Return the default random engine.
+ *
+ * This engine is guaranteed to be deterministic, but by
+ * default will be randomly seeded. It is NOT cryptographically
+ * secure and MUST NOT be used to generate randomness that
+ * will be used for keys, secure cookies, IVs, padding, etc.
+ *
+ * Each thread gets its own instance of the engine which
+ * will be randomly seeded.
+ */
 inline beast::xor_shift_engine&
 defaultPrng()
 {
@@ -70,25 +71,26 @@ defaultPrng()
     return kEngine;
 }
 
-/** Return a uniformly distributed random integer.
-
-    @param min The smallest value to return. If not specified
-               the value defaults to 0.
-    @param max The largest value to return. If not specified
-               the value defaults to the largest value that
-               can be represented.
-
-    The randomness is generated by the specified engine (or
-    the default engine if one is not specified). The result
-    is cryptographically secure only when the engine passed
-    into the function is cryptographically secure.
-
-    @note The range is always a closed interval, so calling
-          rand_int(-5, 15) can return any integer in the
-          closed interval [-5, 15]; similarly, calling
-          rand_int(7) can return any integer in the closed
-          interval [0, 7].
-*/
+/**
+ * Return a uniformly distributed random integer.
+ *
+ * @param min The smallest value to return. If not specified
+ *            the value defaults to 0.
+ * @param max The largest value to return. If not specified
+ *            the value defaults to the largest value that
+ *            can be represented.
+ *
+ * The randomness is generated by the specified engine (or
+ * the default engine if one is not specified). The result
+ * is cryptographically secure only when the engine passed
+ * into the function is cryptographically secure.
+ *
+ * @note The range is always a closed interval, so calling
+ *       rand_int(-5, 15) can return any integer in the
+ *       closed interval [-5, 15]; similarly, calling
+ *       rand_int(7) can return any integer in the closed
+ *       interval [0, 7].
+ */
 /** @{ */
 template <class Engine, class Integral>
 Integral
@@ -144,7 +146,9 @@ randInt()
 }
 /** @} */
 
-/** Return a random byte */
+/**
+ * Return a random byte
+ */
 /** @{ */
 template <class Byte, class Engine>
 Byte
@@ -166,7 +170,9 @@ randByte()
 }
 /** @} */
 
-/** Return a random boolean value */
+/**
+ * Return a random boolean value
+ */
 /** @{ */
 template <class Engine>
 inline bool

include/xrpl/basics/scope.h

@@ -156,41 +156,41 @@ template <class EF>
 ScopeSuccess(EF) -> ScopeSuccess<EF>;
 
 /**
-    Automatically unlocks and re-locks a unique_lock object.
-
-    This is the reverse of a std::unique_lock object - instead of locking the
-   mutex for the lifetime of this object, it unlocks it.
-
-    Make sure you don't try to unlock mutexes that aren't actually locked!
-
-    This is essentially a less-versatile boost::reverse_lock.
-
-    e.g. @code
-
-    std::mutex mut;
-
-    for (;;)
-    {
-        std::unique_lock myScopedLock{mut};
-        // mut is now locked
-
-        ... do some stuff with it locked ..
-
-        while (xyz)
-        {
-            ... do some stuff with it locked ..
-
-            scope_unlock unlocker{myScopedLock};
-
-            // mut is now unlocked for the remainder of this block,
-            // and re-locked at the end.
-
-            ...do some stuff with it unlocked ...
-        }  // mut gets locked here.
-
-    }  // mut gets unlocked here
-    @endcode
-*/
+ * Automatically unlocks and re-locks a unique_lock object.
+ *
+ * This is the reverse of a std::unique_lock object - instead of locking the
+ * mutex for the lifetime of this object, it unlocks it.
+ *
+ * Make sure you don't try to unlock mutexes that aren't actually locked!
+ *
+ * This is essentially a less-versatile boost::reverse_lock.
+ *
+ * e.g. @code
+ *
+ * std::mutex mut;
+ *
+ * for (;;)
+ * {
+ *     std::unique_lock myScopedLock{mut};
+ *     // mut is now locked
+ *
+ *     ... do some stuff with it locked ..
+ *
+ *     while (xyz)
+ *     {
+ *         ... do some stuff with it locked ..
+ *
+ *         scope_unlock unlocker{myScopedLock};
+ *
+ *         // mut is now unlocked for the remainder of this block,
+ *         // and re-locked at the end.
+ *
+ *         ...do some stuff with it unlocked ...
+ *     }  // mut gets locked here.
+ *
+ * }  // mut gets unlocked here
+ * @endcode
+ */
 
 template <class Mutex>
 class ScopeUnlock

include/xrpl/basics/spinlock.h

@@ -15,15 +15,16 @@
 namespace xrpl {
 
 namespace detail {
-/** Inform the processor that we are in a tight spin-wait loop.
-
-    Spinlocks caught in tight loops can result in the processor's pipeline
-    filling up with comparison operations, resulting in a misprediction at
-    the time the lock is finally acquired, necessitating pipeline flushing
-    which is ridiculously expensive and results in very high latency.
-
-    This function instructs the processor to "pause" for some architecture
-    specific amount of time, to prevent this.
+/**
+ * Inform the processor that we are in a tight spin-wait loop.
+ *
+ * Spinlocks caught in tight loops can result in the processor's pipeline
+ * filling up with comparison operations, resulting in a misprediction at
+ * the time the lock is finally acquired, necessitating pipeline flushing
+ * which is ridiculously expensive and results in very high latency.
+ *
+ * This function instructs the processor to "pause" for some architecture
+ * specific amount of time, to prevent this.
  */
 inline void
 spinPause() noexcept
@@ -38,37 +39,39 @@ spinPause() noexcept
 }  // namespace detail
 
 /** @{ */
-/** Classes to handle arrays of spinlocks packed into a single atomic integer:
-
-    Packed spinlocks allow for tremendously space-efficient lock-sharding
-    but they come at a cost.
-
-    First, the implementation is necessarily low-level and uses advanced
-    features like memory ordering and highly platform-specific tricks to
-    maximize performance. This imposes a significant and ongoing cost to
-    developers.
-
-    Second, and perhaps most important, is that the packing of multiple
-    locks into a single integer which, albeit space-efficient, also has
-    performance implications stemming from data dependencies, increased
-    cache-coherency traffic between processors and heavier loads on the
-    processor's load/store units.
-
-    To be sure, these locks can have advantages but they are definitely
-    not general purpose locks and should not be thought of or used that
-    way. The use cases for them are likely few and far between; without
-    a compelling reason to use them, backed by profiling data, it might
-    be best to use one of the standard locking primitives instead. Note
-    that in most common platforms, `std::mutex` is so heavily optimized
-    that it can, usually, outperform spinlocks.
-
-    @tparam T An unsigned integral type (e.g. std::uint16_t)
+/**
+ * Classes to handle arrays of spinlocks packed into a single atomic integer:
+ *
+ * Packed spinlocks allow for tremendously space-efficient lock-sharding
+ * but they come at a cost.
+ *
+ * First, the implementation is necessarily low-level and uses advanced
+ * features like memory ordering and highly platform-specific tricks to
+ * maximize performance. This imposes a significant and ongoing cost to
+ * developers.
+ *
+ * Second, and perhaps most important, is that the packing of multiple
+ * locks into a single integer which, albeit space-efficient, also has
+ * performance implications stemming from data dependencies, increased
+ * cache-coherency traffic between processors and heavier loads on the
+ * processor's load/store units.
+ *
+ * To be sure, these locks can have advantages but they are definitely
+ * not general purpose locks and should not be thought of or used that
+ * way. The use cases for them are likely few and far between; without
+ * a compelling reason to use them, backed by profiling data, it might
+ * be best to use one of the standard locking primitives instead. Note
+ * that in most common platforms, `std::mutex` is so heavily optimized
+ * that it can, usually, outperform spinlocks.
+ *
+ * @tparam T An unsigned integral type (e.g. std::uint16_t)
  */
 
-/** A class that grabs a single packed spinlock from an atomic integer.
-
-    This class meets the requirements of Lockable:
-        https://en.cppreference.com/w/cpp/named_req/Lockable
+/**
+ * A class that grabs a single packed spinlock from an atomic integer.
+ *
+ * This class meets the requirements of Lockable:
+ *     https://en.cppreference.com/w/cpp/named_req/Lockable
  */
 template <class T>
 class PackedSpinlock
@@ -91,13 +94,14 @@ public:
     PackedSpinlock&
     operator=(PackedSpinlock const&) = delete;
 
-    /** A single spinlock packed inside the specified atomic
-
-        @param lock The atomic integer inside which the spinlock is packed.
-        @param index The index of the spinlock this object acquires.
-
-        @note For performance reasons, you should strive to have `lock` be
-              on a cacheline by itself.
+    /**
+     * A single spinlock packed inside the specified atomic
+     *
+     * @param lock The atomic integer inside which the spinlock is packed.
+     * @param index The index of the spinlock this object acquires.
+     *
+     * @note For performance reasons, you should strive to have `lock` be
+     *       on a cacheline by itself.
      */
     PackedSpinlock(std::atomic<T>& lock, int index) : bits_(lock), mask_(static_cast<T>(1) << index)
     {
@@ -133,17 +137,18 @@ public:
     }
 };
 
-/** A spinlock implemented on top of an atomic integer.
-
-    @note Using `packed_spinlock` and `spinlock` against the same underlying
-          atomic integer can result in `spinlock` not being able to actually
-          acquire the lock during periods of high contention, because of how
-          the two locks operate: `spinlock` will spin trying to grab all the
-          bits at once, whereas any given `packed_spinlock` will only try to
-          grab one bit at a time. Caveat emptor.
-
-    This class meets the requirements of Lockable:
-        https://en.cppreference.com/w/cpp/named_req/Lockable
+/**
+ * A spinlock implemented on top of an atomic integer.
+ *
+ * @note Using `packed_spinlock` and `spinlock` against the same underlying
+ *       atomic integer can result in `spinlock` not being able to actually
+ *       acquire the lock during periods of high contention, because of how
+ *       the two locks operate: `spinlock` will spin trying to grab all the
+ *       bits at once, whereas any given `packed_spinlock` will only try to
+ *       grab one bit at a time. Caveat emptor.
+ *
+ * This class meets the requirements of Lockable:
+ *     https://en.cppreference.com/w/cpp/named_req/Lockable
  */
 template <class T>
 class Spinlock
@@ -159,12 +164,13 @@ public:
     Spinlock&
     operator=(Spinlock const&) = delete;
 
-    /** Grabs the
-
-        @param lock The atomic integer to spin against.
-
-        @note For performance reasons, you should strive to have `lock` be
-              on a cacheline by itself.
+    /**
+     * Grabs the
+     *
+     * @param lock The atomic integer to spin against.
+     *
+     * @note For performance reasons, you should strive to have `lock` be
+     *       on a cacheline by itself.
      */
     Spinlock(std::atomic<T>& lock) : lock_(lock)
     {

include/xrpl/basics/tagged_integer.h

@@ -12,17 +12,18 @@
 
 namespace xrpl {
 
-/** A type-safe wrap around standard integral types
-
-    The tag is used to implement type safety, catching mismatched types at
-    compile time. Multiple instantiations wrapping the same underlying integral
-    type are distinct types (distinguished by tag) and will not interoperate. A
-    tagged_integer supports all the usual assignment, arithmetic, comparison and
-    shifting operations defined for the underlying type
-
-    The tag is not meant as a unit, which would require restricting the set of
-    allowed arithmetic operations.
-*/
+/**
+ * A type-safe wrap around standard integral types
+ *
+ * The tag is used to implement type safety, catching mismatched types at
+ * compile time. Multiple instantiations wrapping the same underlying integral
+ * type are distinct types (distinguished by tag) and will not interoperate. A
+ * tagged_integer supports all the usual assignment, arithmetic, comparison and
+ * shifting operations defined for the underlying type
+ *
+ * The tag is not meant as a unit, which would require restricting the set of
+ * allowed arithmetic operations.
+ */
 template <class Int, class Tag>
 class TaggedInteger : boost::totally_ordered<
                           TaggedInteger<Int, Tag>,

include/xrpl/beast/asio/io_latency_probe.h

@@ -14,7 +14,9 @@
 
 namespace beast {
 
-/** Measures handler latency on an io_context queue. */
+/**
+ * Measures handler latency on an io_context queue.
+ */
 template <class Clock>
 class IOLatencyProbe
 {
@@ -42,7 +44,9 @@ public:
         cancel(lock, true);
     }
 
-    /** Return the io_context associated with the latency probe. */
+    /**
+     * Return the io_context associated with the latency probe.
+     */
     /** @{ */
     boost::asio::io_context&
     getIoContext()
@@ -57,9 +61,10 @@ public:
     }
     /** @} */
 
-    /** Cancel all pending i/o.
-        Any handlers which have already been queued will still be called.
-    */
+    /**
+     * Cancel all pending i/o.
+     * Any handlers which have already been queued will still be called.
+     */
     /** @{ */
     void
     cancel()
@@ -76,10 +81,11 @@ public:
     }
     /** @} */
 
-    /** Measure one sample of i/o latency.
-        Handler will be called with this signature:
-            void Handler (Duration d);
-    */
+    /**
+     * Measure one sample of i/o latency.
+     * Handler will be called with this signature:
+     *     void Handler (Duration d);
+     */
     template <class Handler>
     void
     sampleOne(Handler&& handler)
@@ -91,10 +97,11 @@ public:
             ios_, SampleOp<Handler>(std::forward<Handler>(handler), Clock::now(), false, this));
     }
 
-    /** Initiate continuous i/o latency sampling.
-        Handler will be called with this signature:
-            void Handler (std::chrono::milliseconds);
-    */
+    /**
+     * Initiate continuous i/o latency sampling.
+     * Handler will be called with this signature:
+     *     void Handler (std::chrono::milliseconds);
+     */
     template <class Handler>
     void
     sample(Handler&& handler)

include/xrpl/beast/clock/abstract_clock.h

@@ -2,34 +2,35 @@
 
 namespace beast {
 
-/** Abstract interface to a clock.
-
-    This makes now() a member function instead of a static member, so
-    an instance of the class can be dependency injected, facilitating
-    unit tests where time may be controlled.
-
-    An abstract_clock inherits all the nested types of the Clock
-    template parameter.
-
-    Example:
-
-    @code
-
-    struct Implementation
-    {
-        using clock_type = abstract_clock <std::chrono::steady_clock>;
-        clock_type& clock_;
-        explicit Implementation (clock_type& clock)
-            : clock_(clock)
-        {
-        }
-    };
-
-    @endcode
-
-    @tparam Clock A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-*/
+/**
+ * Abstract interface to a clock.
+ *
+ * This makes now() a member function instead of a static member, so
+ * an instance of the class can be dependency injected, facilitating
+ * unit tests where time may be controlled.
+ *
+ * An abstract_clock inherits all the nested types of the Clock
+ * template parameter.
+ *
+ * Example:
+ *
+ * @code
+ *
+ * struct Implementation
+ * {
+ *     using clock_type = abstract_clock <std::chrono::steady_clock>;
+ *     clock_type& clock_;
+ *     explicit Implementation (clock_type& clock)
+ *         : clock_(clock)
+ *     {
+ *     }
+ * };
+ *
+ * @endcode
+ *
+ * @tparam Clock A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ */
 template <class Clock>
 class AbstractClock
 {
@@ -46,7 +47,9 @@ public:
     AbstractClock() = default;
     AbstractClock(AbstractClock const&) = default;
 
-    /** Returns the current time. */
+    /**
+     * Returns the current time.
+     */
     [[nodiscard]] virtual time_point
     now() const = 0;
 };
@@ -74,11 +77,12 @@ struct AbstractClockWrapper : public AbstractClock<Facade>
 
 //------------------------------------------------------------------------------
 
-/** Returns a global instance of an abstract clock.
-    @tparam Facade A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-    @tparam Clock The actual concrete clock to use.
-*/
+/**
+ * Returns a global instance of an abstract clock.
+ * @tparam Facade A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ * @tparam Clock The actual concrete clock to use.
+ */
 template <class Facade, class Clock = Facade>
 AbstractClock<Facade>&
 getAbstractClock()

include/xrpl/beast/clock/basic_seconds_clock.h

@@ -4,15 +4,16 @@
 
 namespace beast {
 
-/** A clock whose minimum resolution is one second.
-
-    The purpose of this class is to optimize the performance of the now()
-    member function call. It uses a dedicated thread that wakes up at least
-    once per second to sample the requested trivial clock.
-
-    @tparam Clock A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-*/
+/**
+ * A clock whose minimum resolution is one second.
+ *
+ * The purpose of this class is to optimize the performance of the now()
+ * member function call. It uses a dedicated thread that wakes up at least
+ * once per second to sample the requested trivial clock.
+ *
+ * @tparam Clock A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ */
 class BasicSecondsClock
 {
 public:

include/xrpl/beast/clock/manual_clock.h

@@ -7,15 +7,16 @@
 
 namespace beast {
 
-/** Manual clock implementation.
-
-    This concrete class implements the @ref abstract_clock interface and
-    allows the time to be advanced manually, mainly for the purpose of
-    providing a clock in unit tests.
-
-    @tparam Clock A type meeting these requirements:
-        http://en.cppreference.com/w/cpp/concept/Clock
-*/
+/**
+ * Manual clock implementation.
+ *
+ * This concrete class implements the @ref abstract_clock interface and
+ * allows the time to be advanced manually, mainly for the purpose of
+ * providing a clock in unit tests.
+ *
+ * @tparam Clock A type meeting these requirements:
+ *     http://en.cppreference.com/w/cpp/concept/Clock
+ */
 template <class Clock>
 class ManualClock : public AbstractClock<Clock>
 {
@@ -38,7 +39,9 @@ public:
         return now_;
     }
 
-    /** Set the current time of the manual clock. */
+    /**
+     * Set the current time of the manual clock.
+     */
     void
     set(time_point const& when)
     {
@@ -48,7 +51,9 @@ public:
         now_ = when;
     }
 
-    /** Convenience for setting the time in seconds from epoch. */
+    /**
+     * Convenience for setting the time in seconds from epoch.
+     */
     template <class Integer>
     void
     set(Integer secondsFromEpoch)
@@ -56,7 +61,9 @@ public:
         set(time_point(duration(std::chrono::seconds(secondsFromEpoch))));
     }
 
-    /** Advance the clock by a duration. */
+    /**
+     * Advance the clock by a duration.
+     */
     template <class Rep, class Period>
     void
     advance(std::chrono::duration<Rep, Period> const& elapsed)
@@ -67,7 +74,9 @@ public:
         now_ += elapsed;
     }
 
-    /** Convenience for advancing the clock by one second. */
+    /**
+     * Convenience for advancing the clock by one second.
+     */
     ManualClock&
     operator++()
     {

include/xrpl/beast/container/aged_container_utility.h

@@ -7,7 +7,9 @@
 
 namespace beast {
 
-/** Expire aged container items past the specified age. */
+/**
+ * Expire aged container items past the specified age.
+ */
 template <class AgedContainer, class Rep, class Period>
 std::size_t
 expire(AgedContainer& c, std::chrono::duration<Rep, Period> const& age)

include/xrpl/beast/container/detail/aged_ordered_container.h

@@ -39,22 +39,23 @@ struct IsBoostReverseIterator<boost::intrusive::reverse_iterator<It>> : std::tru
     explicit IsBoostReverseIterator() = default;
 };
 
-/** Associative container where each element is also indexed by time.
-
-    This container mirrors the interface of the standard library ordered
-    associative containers, with the addition that each element is associated
-    with a `when` `time_point` which is obtained from the value of the clock's
-    `now`. The function `touch` updates the time for an element to the current
-    time as reported by the clock.
-
-    An extra set of iterator types and member functions are provided in the
-    `chronological` memberspace that allow traversal in temporal or reverse
-    temporal order. This container is useful as a building block for caches
-    whose items expire after a certain amount of time. The chronological
-    iterators allow for fully customizable expiration strategies.
-
-    @see aged_set, aged_multiset, aged_map, aged_multimap
-*/
+/**
+ * Associative container where each element is also indexed by time.
+ *
+ * This container mirrors the interface of the standard library ordered
+ * associative containers, with the addition that each element is associated
+ * with a `when` `time_point` which is obtained from the value of the clock's
+ * `now`. The function `touch` updates the time for an element to the current
+ * time as reported by the clock.
+ *
+ * An extra set of iterator types and member functions are provided in the
+ * `chronological` memberspace that allow traversal in temporal or reverse
+ * temporal order. This container is useful as a building block for caches
+ * whose items expire after a certain amount of time. The chronological
+ * iterators allow for fully customizable expiration strategies.
+ *
+ * @see aged_set, aged_multiset, aged_map, aged_multimap
+ */
 template <
     bool IsMulti,
     bool IsMap,
@@ -1795,7 +1796,9 @@ swap(
     lhs.swap(rhs);
 }
 
-/** Expire aged container items past the specified age. */
+/**
+ * Expire aged container items past the specified age.
+ */
 template <
     bool IsMulti,
     bool IsMap,

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -43,23 +43,24 @@ TODO
 namespace beast {
 namespace detail {
 
-/** Associative container where each element is also indexed by time.
-
-    This container mirrors the interface of the standard library unordered
-    associative containers, with the addition that each element is associated
-    with a `when` `time_point` which is obtained from the value of the clock's
-    `now`. The function `touch` updates the time for an element to the current
-    time as reported by the clock.
-
-    An extra set of iterator types and member functions are provided in the
-    `chronological` memberspace that allow traversal in temporal or reverse
-    temporal order. This container is useful as a building block for caches
-    whose items expire after a certain amount of time. The chronological
-    iterators allow for fully customizable expiration strategies.
-
-    @see aged_unordered_set, aged_unordered_multiset
-    @see aged_unordered_map, aged_unordered_multimap
-*/
+/**
+ * Associative container where each element is also indexed by time.
+ *
+ * This container mirrors the interface of the standard library unordered
+ * associative containers, with the addition that each element is associated
+ * with a `when` `time_point` which is obtained from the value of the clock's
+ * `now`. The function `touch` updates the time for an element to the current
+ * time as reported by the clock.
+ *
+ * An extra set of iterator types and member functions are provided in the
+ * `chronological` memberspace that allow traversal in temporal or reverse
+ * temporal order. This container is useful as a building block for caches
+ * whose items expire after a certain amount of time. The chronological
+ * iterators allow for fully customizable expiration strategies.
+ *
+ * @see aged_unordered_set, aged_unordered_multiset
+ * @see aged_unordered_map, aged_unordered_multimap
+ */
 template <
     bool IsMulti,
     bool IsMap,
@@ -2709,7 +2710,9 @@ swap(
     lhs.swap(rhs);
 }
 
-/** Expire aged container items past the specified age. */
+/**
+ * Expire aged container items past the specified age.
+ */
 template <
     bool IsMulti,
     bool IsMap,

include/xrpl/beast/core/CurrentThreadName.h

@@ -12,9 +12,10 @@
 
 namespace beast {
 
-/** Changes the name of the caller thread.
-    Different OSes may place different length or content limits on this name.
-*/
+/**
+ * Changes the name of the caller thread.
+ * Different OSes may place different length or content limits on this name.
+ */
 void
 setCurrentThreadName(std::string_view newThreadName);
 
@@ -24,13 +25,14 @@ setCurrentThreadName(std::string_view newThreadName);
 // Maximum number of characters is therefore 15.
 constexpr std::size_t kMaxThreadNameLength = 15;
 
-/** Sets the name of the caller thread with compile-time size checking.
-    @tparam N The size of the string literal including null terminator
-    @param newThreadName A string literal to set as the thread name
-
-    This template overload enforces that thread names are at most 16 characters
-    (including null terminator) at compile time, matching Linux's limit.
-*/
+/**
+ * Sets the name of the caller thread with compile-time size checking.
+ * @tparam N The size of the string literal including null terminator
+ * @param newThreadName A string literal to set as the thread name
+ *
+ * This template overload enforces that thread names are at most 16 characters
+ * (including null terminator) at compile time, matching Linux's limit.
+ */
 template <std::size_t N>
 void
 setCurrentThreadName(char const (&newThreadName)[N])
@@ -41,14 +43,15 @@ setCurrentThreadName(char const (&newThreadName)[N])
 }
 #endif
 
-/** Returns the name of the caller thread.
-
-    The name returned is the name as set by a call to setCurrentThreadName().
-    If the thread name is set by an external force, then that name change
-    will not be reported.
-
-    If no name has ever been set, then the empty string is returned.
-*/
+/**
+ * Returns the name of the caller thread.
+ *
+ * The name returned is the name as set by a call to setCurrentThreadName().
+ * If the thread name is set by an external force, then that name change
+ * will not be reported.
+ *
+ * If no name has ever been set, then the empty string is returned.
+ */
 std::string
 getCurrentThreadName();
 

include/xrpl/beast/core/LexicalCast.h

@@ -163,17 +163,19 @@ struct LexicalCast<Out, char*>
 
 //------------------------------------------------------------------------------
 
-/** Thrown when a conversion is not possible with LexicalCast.
-    Only used in the throw variants of lexicalCast.
-*/
+/**
+ * Thrown when a conversion is not possible with LexicalCast.
+ * Only used in the throw variants of lexicalCast.
+ */
 struct BadLexicalCast : public std::bad_cast
 {
     explicit BadLexicalCast() = default;
 };
 
-/** Intelligently convert from one type to another.
-    @return `false` if there was a parsing or range error
-*/
+/**
+ * Intelligently convert from one type to another.
+ * @return `false` if there was a parsing or range error
+ */
 template <class Out, class In>
 bool
 lexicalCastChecked(Out& out, In in)
@@ -181,12 +183,13 @@ lexicalCastChecked(Out& out, In in)
     return detail::LexicalCast<Out, In>()(out, in);
 }
 
-/** Convert from one type to another, throw on error
-
-    An exception of type BadLexicalCast is thrown if the conversion fails.
-
-    @return The new type.
-*/
+/**
+ * Convert from one type to another, throw on error
+ *
+ * An exception of type BadLexicalCast is thrown if the conversion fails.
+ *
+ * @return The new type.
+ */
 template <class Out, class In>
 Out
 lexicalCastThrow(In in)
@@ -197,11 +200,12 @@ lexicalCastThrow(In in)
     throw BadLexicalCast();
 }
 
-/** Convert from one type to another.
-
-    @param defaultValue The value returned if parsing fails
-    @return The new type.
-*/
+/**
+ * Convert from one type to another.
+ *
+ * @param defaultValue The value returned if parsing fails
+ * @return The new type.
+ */
 template <class Out, class In>
 Out
 lexicalCast(In in, Out defaultValue = Out())

include/xrpl/beast/core/List.h

@@ -11,7 +11,9 @@ class List;
 
 namespace detail {
 
-/** Copy `const` attribute from T to U if present. */
+/**
+ * Copy `const` attribute from T to U if present.
+ */
 /** @{ */
 template <typename T, typename U>
 struct CopyConst
@@ -153,110 +155,111 @@ private:
 
 }  // namespace detail
 
-/** Intrusive doubly linked list.
-
-    This intrusive List is a container similar in operation to std::list in the
-    Standard Template Library (STL). Like all @ref intrusive containers, List
-    requires you to first derive your class from List<>::Node:
-
-    @code
-
-    struct Object : List <Object>::Node
-    {
-        explicit Object (int value) : value_ (value)
-        {
-        }
-
-        int value_;
-    };
-
-    @endcode
-
-    Now we define the list, and add a couple of items.
-
-    @code
-
-    List <Object> list;
-
-    list.push_back (* (new Object (1)));
-    list.push_back (* (new Object (2)));
-
-    @endcode
-
-    For compatibility with the standard containers, push_back() expects a
-    reference to the object. Unlike the standard container, however, push_back()
-    places the actual object in the list and not a copy-constructed duplicate.
-
-    Iterating over the list follows the same idiom as the STL:
-
-    @code
-
-    for (List <Object>::iterator iter = list.begin(); iter != list.end; ++iter)
-        std::cout << iter->value_;
-
-    @endcode
-
-    You can even use BOOST_FOREACH, or range based for loops:
-
-    @code
-
-    BOOST_FOREACH (Object& object, list)  // boost only
-        std::cout << object.value_;
-
-    for (Object& object : list)           // C++11 only
-        std::cout << object.value_;
-
-    @endcode
-
-    Because List is mostly STL compliant, it can be passed into STL algorithms:
-    e.g. `std::for_each()` or `std::find_first_of()`.
-
-    In general, objects placed into a List should be dynamically allocated
-    although this cannot be enforced at compile time. Since the caller provides
-    the storage for the object, the caller is also responsible for deleting the
-    object. An object still exists after being removed from a List, until the
-    caller deletes it. This means an element can be moved from one List to
-    another with practically no overhead.
-
-    Unlike the standard containers, an object may only exist in one list at a
-    time, unless special preparations are made. The Tag template parameter is
-    used to distinguish between different list types for the same object,
-    allowing the object to exist in more than one list simultaneously.
-
-    For example, consider an actor system where a global list of actors is
-    maintained, so that they can each be periodically receive processing
-    time. We wish to also maintain a list of the subset of actors that require
-    a domain-dependent update. To achieve this, we declare two tags, the
-    associated list types, and the list element thusly:
-
-    @code
-
-    struct Actor;         // Forward declaration required
-
-    struct ProcessTag { };
-    struct UpdateTag { };
-
-    using ProcessList = List <Actor, ProcessTag>;
-    using UpdateList = List <Actor, UpdateTag>;
-
-    // Derive from both node types so we can be in each list at once.
-    //
-    struct Actor : ProcessList::Node, UpdateList::Node
-    {
-        bool process ();    // returns true if we need an update
-        void update ();
-    };
-
-    @endcode
-
-    @tparam T The base type of element which the list will store
-                    pointers to.
-
-    @tparam Tag An optional unique type name used to distinguish lists and
-   nodes, when the object can exist in multiple lists simultaneously.
-
-    @ingroup beast_core intrusive
-*/
+/**
+ * Intrusive doubly linked list.
+ *
+ * This intrusive List is a container similar in operation to std::list in the
+ * Standard Template Library (STL). Like all @ref intrusive containers, List
+ * requires you to first derive your class from List<>::Node:
+ *
+ * @code
+ *
+ * struct Object : List <Object>::Node
+ * {
+ *     explicit Object (int value) : value_ (value)
+ *     {
+ *     }
+ *
+ *     int value_;
+ * };
+ *
+ * @endcode
+ *
+ * Now we define the list, and add a couple of items.
+ *
+ * @code
+ *
+ * List <Object> list;
+ *
+ * list.push_back (* (new Object (1)));
+ * list.push_back (* (new Object (2)));
+ *
+ * @endcode
+ *
+ * For compatibility with the standard containers, push_back() expects a
+ * reference to the object. Unlike the standard container, however, push_back()
+ * places the actual object in the list and not a copy-constructed duplicate.
+ *
+ * Iterating over the list follows the same idiom as the STL:
+ *
+ * @code
+ *
+ * for (List <Object>::iterator iter = list.begin(); iter != list.end; ++iter)
+ *     std::cout << iter->value_;
+ *
+ * @endcode
+ *
+ * You can even use BOOST_FOREACH, or range based for loops:
+ *
+ * @code
+ *
+ * BOOST_FOREACH (Object& object, list)  // boost only
+ *     std::cout << object.value_;
+ *
+ * for (Object& object : list)           // C++11 only
+ *     std::cout << object.value_;
+ *
+ * @endcode
+ *
+ * Because List is mostly STL compliant, it can be passed into STL algorithms:
+ * e.g. `std::for_each()` or `std::find_first_of()`.
+ *
+ * In general, objects placed into a List should be dynamically allocated
+ * although this cannot be enforced at compile time. Since the caller provides
+ * the storage for the object, the caller is also responsible for deleting the
+ * object. An object still exists after being removed from a List, until the
+ * caller deletes it. This means an element can be moved from one List to
+ * another with practically no overhead.
+ *
+ * Unlike the standard containers, an object may only exist in one list at a
+ * time, unless special preparations are made. The Tag template parameter is
+ * used to distinguish between different list types for the same object,
+ * allowing the object to exist in more than one list simultaneously.
+ *
+ * For example, consider an actor system where a global list of actors is
+ * maintained, so that they can each be periodically receive processing
+ * time. We wish to also maintain a list of the subset of actors that require
+ * a domain-dependent update. To achieve this, we declare two tags, the
+ * associated list types, and the list element thusly:
+ *
+ * @code
+ *
+ * struct Actor;         // Forward declaration required
+ *
+ * struct ProcessTag { };
+ * struct UpdateTag { };
+ *
+ * using ProcessList = List <Actor, ProcessTag>;
+ * using UpdateList = List <Actor, UpdateTag>;
+ *
+ * // Derive from both node types so we can be in each list at once.
+ * //
+ * struct Actor : ProcessList::Node, UpdateList::Node
+ * {
+ *     bool process ();    // returns true if we need an update
+ *     void update ();
+ * };
+ *
+ * @endcode
+ *
+ * @tparam T The base type of element which the list will store
+ *                 pointers to.
+ *
+ * @tparam Tag An optional unique type name used to distinguish lists and
+ * nodes, when the object can exist in multiple lists simultaneously.
+ *
+ * @ingroup beast_core intrusive
+ */
 template <typename T, typename Tag = void>
 class List
 {
@@ -274,7 +277,9 @@ public:
     using iterator = detail::ListIterator<Node>;
     using const_iterator = detail::ListIterator<Node const>;
 
-    /** Create an empty list. */
+    /**
+     * Create an empty list.
+     */
     List()
     {
         head_.prev_ = nullptr;  // identifies the head
@@ -286,119 +291,133 @@ public:
     List&
     operator=(List const&) = delete;
 
-    /** Determine if the list is empty.
-        @return `true` if the list is empty.
-    */
+    /**
+     * Determine if the list is empty.
+     * @return `true` if the list is empty.
+     */
     [[nodiscard]] bool
     empty() const noexcept
     {
         return size() == 0;
     }
 
-    /** Returns the number of elements in the list. */
+    /**
+     * Returns the number of elements in the list.
+     */
     [[nodiscard]] size_type
     size() const noexcept
     {
         return size_;
     }
 
-    /** Obtain a reference to the first element.
-        @invariant The list may not be empty.
-        @return A reference to the first element.
-    */
+    /**
+     * Obtain a reference to the first element.
+     * @invariant The list may not be empty.
+     * @return A reference to the first element.
+     */
     reference
     front() noexcept
     {
         return element_from(head_.next_);
     }
 
-    /** Obtain a const reference to the first element.
-        @invariant The list may not be empty.
-        @return A const reference to the first element.
-    */
+    /**
+     * Obtain a const reference to the first element.
+     * @invariant The list may not be empty.
+     * @return A const reference to the first element.
+     */
     [[nodiscard]] const_reference
     front() const noexcept
     {
         return element_from(head_.next_);
     }
 
-    /** Obtain a reference to the last element.
-        @invariant The list may not be empty.
-        @return A reference to the last element.
-    */
+    /**
+     * Obtain a reference to the last element.
+     * @invariant The list may not be empty.
+     * @return A reference to the last element.
+     */
     reference
     back() noexcept
     {
         return element_from(tail_.prev_);
     }
 
-    /** Obtain a const reference to the last element.
-        @invariant The list may not be empty.
-        @return A const reference to the last element.
-    */
+    /**
+     * Obtain a const reference to the last element.
+     * @invariant The list may not be empty.
+     * @return A const reference to the last element.
+     */
     [[nodiscard]] const_reference
     back() const noexcept
     {
         return element_from(tail_.prev_);
     }
 
-    /** Obtain an iterator to the beginning of the list.
-        @return An iterator pointing to the beginning of the list.
-    */
+    /**
+     * Obtain an iterator to the beginning of the list.
+     * @return An iterator pointing to the beginning of the list.
+     */
     iterator
     begin() noexcept
     {
         return iterator(head_.next_);
     }
 
-    /** Obtain a const iterator to the beginning of the list.
-        @return A const iterator pointing to the beginning of the list.
-    */
+    /**
+     * Obtain a const iterator to the beginning of the list.
+     * @return A const iterator pointing to the beginning of the list.
+     */
     [[nodiscard]] const_iterator
     begin() const noexcept
     {
         return const_iterator(head_.next_);
     }
 
-    /** Obtain a const iterator to the beginning of the list.
-        @return A const iterator pointing to the beginning of the list.
-    */
+    /**
+     * Obtain a const iterator to the beginning of the list.
+     * @return A const iterator pointing to the beginning of the list.
+     */
     [[nodiscard]] const_iterator
     cbegin() const noexcept
     {
         return const_iterator(head_.next_);
     }
 
-    /** Obtain a iterator to the end of the list.
-        @return An iterator pointing to the end of the list.
-    */
+    /**
+     * Obtain a iterator to the end of the list.
+     * @return An iterator pointing to the end of the list.
+     */
     iterator
     end() noexcept
     {
         return iterator(&tail_);
     }
 
-    /** Obtain a const iterator to the end of the list.
-        @return A constiterator pointing to the end of the list.
-    */
+    /**
+     * Obtain a const iterator to the end of the list.
+     * @return A constiterator pointing to the end of the list.
+     */
     [[nodiscard]] const_iterator
     end() const noexcept
     {
         return const_iterator(&tail_);
     }
 
-    /** Obtain a const iterator to the end of the list
-        @return A constiterator pointing to the end of the list.
-    */
+    /**
+     * Obtain a const iterator to the end of the list
+     * @return A constiterator pointing to the end of the list.
+     */
     [[nodiscard]] const_iterator
     cend() const noexcept
     {
         return const_iterator(&tail_);
     }
 
-    /** Clear the list.
-        @note This does not free the elements.
-    */
+    /**
+     * Clear the list.
+     * @note This does not free the elements.
+     */
     void
     clear() noexcept
     {
@@ -407,12 +426,13 @@ public:
         size_ = 0;
     }
 
-    /** Insert an element.
-        @invariant The element must not already be in the list.
-        @param pos The location to insert after.
-        @param element The element to insert.
-        @return An iterator pointing to the newly inserted element.
-    */
+    /**
+     * Insert an element.
+     * @invariant The element must not already be in the list.
+     * @param pos The location to insert after.
+     * @param element The element to insert.
+     * @return An iterator pointing to the newly inserted element.
+     */
     iterator
     insert(iterator pos, T& element) noexcept
     {
@@ -425,11 +445,12 @@ public:
         return iterator(node);
     }
 
-    /** Insert another list into this one.
-        The other list is cleared.
-        @param pos The location to insert after.
-        @param other The list to insert.
-    */
+    /**
+     * Insert another list into this one.
+     * The other list is cleared.
+     * @param pos The location to insert after.
+     * @param other The list to insert.
+     */
     void
     insert(iterator pos, List& other) noexcept
     {
@@ -445,11 +466,12 @@ public:
         }
     }
 
-    /** Remove an element.
-        @invariant The element must exist in the list.
-        @param pos An iterator pointing to the element to remove.
-        @return An iterator pointing to the next element after the one removed.
-    */
+    /**
+     * Remove an element.
+     * @invariant The element must exist in the list.
+     * @param pos An iterator pointing to the element to remove.
+     * @return An iterator pointing to the next element after the one removed.
+     */
     iterator
     erase(iterator pos) noexcept
     {
@@ -461,20 +483,22 @@ public:
         return pos;
     }
 
-    /** Insert an element at the beginning of the list.
-        @invariant The element must not exist in the list.
-        @param element The element to insert.
-    */
+    /**
+     * Insert an element at the beginning of the list.
+     * @invariant The element must not exist in the list.
+     * @param element The element to insert.
+     */
     iterator
     pushFront(T& element) noexcept
     {
         return insert(begin(), element);
     }
 
-    /** Remove the element at the beginning of the list.
-        @invariant The list must not be empty.
-        @return A reference to the popped element.
-    */
+    /**
+     * Remove the element at the beginning of the list.
+     * @invariant The list must not be empty.
+     * @return A reference to the popped element.
+     */
     T&
     popFront() noexcept
     {
@@ -483,20 +507,22 @@ public:
         return element;
     }
 
-    /** Append an element at the end of the list.
-        @invariant The element must not exist in the list.
-        @param element The element to append.
-    */
+    /**
+     * Append an element at the end of the list.
+     * @invariant The element must not exist in the list.
+     * @param element The element to append.
+     */
     iterator
     pushBack(T& element) noexcept
     {
         return insert(end(), element);
     }
 
-    /** Remove the element at the end of the list.
-        @invariant The list must not be empty.
-        @return A reference to the popped element.
-    */
+    /**
+     * Remove the element at the end of the list.
+     * @invariant The list must not be empty.
+     * @return A reference to the popped element.
+     */
     T&
     popBack() noexcept
     {
@@ -505,7 +531,9 @@ public:
         return element;
     }
 
-    /** Swap contents with another list. */
+    /**
+     * Swap contents with another list.
+     */
     void
     swap(List& other) noexcept
     {
@@ -515,42 +543,46 @@ public:
         append(temp);
     }
 
-    /** Insert another list at the beginning of this list.
-        The other list is cleared.
-        @param list The other list to insert.
-    */
+    /**
+     * Insert another list at the beginning of this list.
+     * The other list is cleared.
+     * @param list The other list to insert.
+     */
     iterator
     prepend(List& list) noexcept
     {
         return insert(begin(), list);
     }
 
-    /** Append another list at the end of this list.
-        The other list is cleared.
-        @param list the other list to append.
-    */
+    /**
+     * Append another list at the end of this list.
+     * The other list is cleared.
+     * @param list the other list to append.
+     */
     iterator
     append(List& list) noexcept
     {
         return insert(end(), list);
     }
 
-    /** Obtain an iterator from an element.
-        @invariant The element must exist in the list.
-        @param element The element to obtain an iterator for.
-        @return An iterator to the element.
-    */
+    /**
+     * Obtain an iterator from an element.
+     * @invariant The element must exist in the list.
+     * @param element The element to obtain an iterator for.
+     * @return An iterator to the element.
+     */
     iterator
     iteratorTo(T& element) const noexcept
     {
         return iterator(static_cast<Node*>(&element));
     }
 
-    /** Obtain a const iterator from an element.
-        @invariant The element must exist in the list.
-        @param element The element to obtain an iterator for.
-        @return A const iterator to the element.
-    */
+    /**
+     * Obtain a const iterator from an element.
+     * @invariant The element must exist in the list.
+     * @param element The element to obtain an iterator for.
+     * @return A const iterator to the element.
+     */
     [[nodiscard]] const_iterator
     constIteratorTo(T const& element) const noexcept
     {

include/xrpl/beast/core/LockFreeStack.h

@@ -103,18 +103,19 @@ operator!=(
 
 //------------------------------------------------------------------------------
 
-/** Multiple Producer, Multiple Consumer (MPMC) intrusive stack.
-
-    This stack is implemented using the same intrusive interface as List.
-    All mutations are lock-free.
-
-    The caller is responsible for preventing the "ABA" problem:
-        http://en.wikipedia.org/wiki/ABA_problem
-
-    @param Tag  A type name used to distinguish lists and nodes, for
-                putting objects in multiple lists. If this parameter is
-                omitted, the default tag is used.
-*/
+/**
+ * Multiple Producer, Multiple Consumer (MPMC) intrusive stack.
+ *
+ * This stack is implemented using the same intrusive interface as List.
+ * All mutations are lock-free.
+ *
+ * The caller is responsible for preventing the "ABA" problem:
+ *     http://en.wikipedia.org/wiki/ABA_problem
+ *
+ * @param Tag  A type name used to distinguish lists and nodes, for
+ *             putting objects in multiple lists. If this parameter is
+ *             omitted, the default tag is used.
+ */
 template <class Element, class Tag = void>
 class LockFreeStack
 {
@@ -162,24 +163,27 @@ public:
     LockFreeStack&
     operator=(LockFreeStack const&) = delete;
 
-    /** Returns true if the stack is empty. */
+    /**
+     * Returns true if the stack is empty.
+     */
     [[nodiscard]] bool
     empty() const
     {
         return head_.load() == &end_;
     }
 
-    /** Push a node onto the stack.
-        The caller is responsible for preventing the ABA problem.
-        This operation is lock-free.
-        Thread safety:
-            Safe to call from any thread.
-
-        @param node The node to push.
-
-        @return `true` if the stack was previously empty. If multiple threads
-                are attempting to push, only one will receive `true`.
-    */
+    /**
+     * Push a node onto the stack.
+     * The caller is responsible for preventing the ABA problem.
+     * This operation is lock-free.
+     * Thread safety:
+     *     Safe to call from any thread.
+     *
+     * @param node The node to push.
+     *
+     * @return `true` if the stack was previously empty. If multiple threads
+     *         are attempting to push, only one will receive `true`.
+     */
     // VFALCO NOTE Fix this, shouldn't it be a reference like intrusive list?
     bool
     pushFront(Node* node)
@@ -195,15 +199,16 @@ public:
         return first;
     }
 
-    /** Pop an element off the stack.
-        The caller is responsible for preventing the ABA problem.
-        This operation is lock-free.
-        Thread safety:
-            Safe to call from any thread.
-
-        @return The element that was popped, or `nullptr` if the stack
-                was empty.
-    */
+    /**
+     * Pop an element off the stack.
+     * The caller is responsible for preventing the ABA problem.
+     * This operation is lock-free.
+     * Thread safety:
+     *     Safe to call from any thread.
+     *
+     * @return The element that was popped, or `nullptr` if the stack
+     *         was empty.
+     */
     Element*
     popFront()
     {
@@ -219,12 +224,13 @@ public:
         return static_cast<Element*>(node);
     }
 
-    /** Return a forward iterator to the beginning or end of the stack.
-        Undefined behavior results if push_front or pop_front is called
-        while an iteration is in progress.
-        Thread safety:
-            Caller is responsible for synchronization.
-    */
+    /**
+     * Return a forward iterator to the beginning or end of the stack.
+     * Undefined behavior results if push_front or pop_front is called
+     * while an iteration is in progress.
+     * Thread safety:
+     *     Caller is responsible for synchronization.
+     */
     /** @{ */
     iterator
     begin()

include/xrpl/beast/core/SemanticVersion.h

@@ -6,13 +6,14 @@
 
 namespace beast {
 
-/** A Semantic Version number.
-
-    Identifies the build of a particular version of software using
-    the Semantic Versioning Specification described here:
-
-    http://semver.org/
-*/
+/**
+ * A Semantic Version number.
+ *
+ * Identifies the build of a particular version of software using
+ * the Semantic Versioning Specification described here:
+ *
+ * http://semver.org/
+ */
 class SemanticVersion
 {
 public:
@@ -29,14 +30,17 @@ public:
 
     SemanticVersion(std::string_view version);
 
-    /** Parse a semantic version string.
-        The parsing is as strict as possible.
-        @return `true` if the string was parsed.
-    */
+    /**
+     * Parse a semantic version string.
+     * The parsing is as strict as possible.
+     * @return `true` if the string was parsed.
+     */
     bool
     parse(std::string_view input);
 
-    /** Produce a string from semantic version components. */
+    /**
+     * Produce a string from semantic version components.
+     */
     [[nodiscard]] std::string
     print() const;
 
@@ -52,9 +56,10 @@ public:
     }
 };
 
-/** Compare two SemanticVersions against each other.
-    The comparison follows the rules as per the specification.
-*/
+/**
+ * Compare two SemanticVersions against each other.
+ * The comparison follows the rules as per the specification.
+ */
 int
 compare(SemanticVersion const& lhs, SemanticVersion const& rhs);
 

include/xrpl/beast/hash/hash_append.h

@@ -135,19 +135,20 @@ struct IsUniquelyRepresented<std::array<T, N>>
     explicit IsUniquelyRepresented() = default;
 };
 
-/** Metafunction returning `true` if the type can be hashed in one call.
-
-    For `IsContiguouslyHashable<T>::value` to be true, then for every
-    combination of possible values of `T` held in `x` and `y`,
-    if `x == y`, then it must be true that `memcmp(&x, &y, sizeof(T))`
-    return 0; i.e. that `x` and `y` are represented by the same bit pattern.
-
-    For example:  A two's complement `int` should be contiguously hashable.
-    Every bit pattern produces a unique value that does not compare equal to
-    any other bit pattern's value.  A IEEE floating point should not be
-    contiguously hashable because -0. and 0. have different bit patterns,
-    though they compare equal.
-*/
+/**
+ * Metafunction returning `true` if the type can be hashed in one call.
+ *
+ * For `IsContiguouslyHashable<T>::value` to be true, then for every
+ * combination of possible values of `T` held in `x` and `y`,
+ * if `x == y`, then it must be true that `memcmp(&x, &y, sizeof(T))`
+ * return 0; i.e. that `x` and `y` are represented by the same bit pattern.
+ *
+ * For example:  A two's complement `int` should be contiguously hashable.
+ * Every bit pattern produces a unique value that does not compare equal to
+ * any other bit pattern's value.  A IEEE floating point should not be
+ * contiguously hashable because -0. and 0. have different bit patterns,
+ * though they compare equal.
+ */
 /** @{ */
 template <class T, class HashAlgorithm>
 struct IsContiguouslyHashable
@@ -172,29 +173,30 @@ struct IsContiguouslyHashable<T[N], HashAlgorithm>
 
 //------------------------------------------------------------------------------
 
-/** Logically concatenate input data to a `Hasher`.
-
-    Hasher requirements:
-
-        `X` is the type `Hasher`
-        `h` is a value of type `x`
-        `p` is a value convertible to `void const*`
-        `n` is a value of type `std::size_t`, greater than zero
-
-        Expression:
-            `h.append (p, n);`
-        Throws:
-            Never
-        Effect:
-            Adds the input data to the hasher state.
-
-        Expression:
-            `static_cast<std::size_t>(j)`
-        Throws:
-            Never
-        Effect:
-            Returns the resulting hash of all the input data.
-*/
+/**
+ * Logically concatenate input data to a `Hasher`.
+ *
+ * Hasher requirements:
+ *
+ *     `X` is the type `Hasher`
+ *     `h` is a value of type `x`
+ *     `p` is a value convertible to `void const*`
+ *     `n` is a value of type `std::size_t`, greater than zero
+ *
+ *     Expression:
+ *         `h.append (p, n);`
+ *     Throws:
+ *         Never
+ *     Effect:
+ *         Adds the input data to the hasher state.
+ *
+ *     Expression:
+ *         `static_cast<std::size_t>(j)`
+ *     Throws:
+ *         Never
+ *     Effect:
+ *         Returns the resulting hash of all the input data.
+ */
 /** @{ */
 
 // scalars

include/xrpl/beast/insight/Collector.h

@@ -12,16 +12,17 @@
 
 namespace beast::insight {
 
-/** Interface for a manager that allows collection of metrics.
-
-    To export metrics from a class, pass and save a shared_ptr to this
-    interface in the class constructor. Create the metric objects
-    as desired (counters, events, gauges, meters, and an optional hook)
-    using the interface.
-
-    @see Counter, Event, Gauge, Hook, Meter
-    @see NullCollector, StatsDCollector
-*/
+/**
+ * Interface for a manager that allows collection of metrics.
+ *
+ * To export metrics from a class, pass and save a shared_ptr to this
+ * interface in the class constructor. Create the metric objects
+ * as desired (counters, events, gauges, meters, and an optional hook)
+ * using the interface.
+ *
+ * @see Counter, Event, Gauge, Hook, Meter
+ * @see NullCollector, StatsDCollector
+ */
 class Collector
 {
 public:
@@ -29,18 +30,19 @@ public:
 
     virtual ~Collector() = 0;
 
-    /** Create a hook.
-
-        A hook is called at each collection interval, on an implementation
-        defined thread. This is a convenience facility for gathering metrics
-        in the polling style. The typical usage is to update all the metrics
-        of interest in the handler.
-
-        Handler will be called with this signature:
-            void handler (void)
-
-        @see Hook
-    */
+    /**
+     * Create a hook.
+     *
+     * A hook is called at each collection interval, on an implementation
+     * defined thread. This is a convenience facility for gathering metrics
+     * in the polling style. The typical usage is to update all the metrics
+     * of interest in the handler.
+     *
+     * Handler will be called with this signature:
+     *     void handler (void)
+     *
+     * @see Hook
+     */
     /** @{ */
     template <class Handler>
     Hook
@@ -53,9 +55,10 @@ public:
     makeHook(HookImpl::HandlerType const& handler) = 0;
     /** @} */
 
-    /** Create a counter with the specified name.
-        @see Counter
-    */
+    /**
+     * Create a counter with the specified name.
+     * @see Counter
+     */
     /** @{ */
     virtual Counter
     makeCounter(std::string const& name) = 0;
@@ -69,9 +72,10 @@ public:
     }
     /** @} */
 
-    /** Create an event with the specified name.
-        @see Event
-    */
+    /**
+     * Create an event with the specified name.
+     * @see Event
+     */
     /** @{ */
     virtual Event
     makeEvent(std::string const& name) = 0;
@@ -85,9 +89,10 @@ public:
     }
     /** @} */
 
-    /** Create a gauge with the specified name.
-        @see Gauge
-    */
+    /**
+     * Create a gauge with the specified name.
+     * @see Gauge
+     */
     /** @{ */
     virtual Gauge
     makeGauge(std::string const& name) = 0;
@@ -101,9 +106,10 @@ public:
     }
     /** @} */
 
-    /** Create a meter with the specified name.
-        @see Meter
-    */
+    /**
+     * Create a meter with the specified name.
+     * @see Meter
+     */
     /** @{ */
     virtual Meter
     makeMeter(std::string const& name) = 0;