test: Cover the two throws a childless inner node reaches

A childless inner node cannot be built in process, since serializing one asserts
it has a branch, but it can be parsed from a blob. `makeFromPrefix` passes
`hashValid = true` and `makeFullInner` then adopts the hash the node was fetched
under rather than recomputing it, so sixteen zero child hashes give a node whose
own hash is whatever its parent claims. Every check on the way in passes: it
carries no key, so `belongsAt` waves it through, and `canonicalize` and
`canonicalizeChild` both compare against the hash it adopted.

The map that results is well formed by every position rule and still cannot be
walked, which is the one case where `belowHelper` returns nullptr for a node it
has just pushed. Two entry points reach it, and both must refuse rather than
report an absence: an iterator increment would otherwise end the walk early and
drop the rest of the map, and `upperBound` would answer `end()`, which is the
positive claim that no greater key exists. Each throws today, and neither
statement had a test.

.cspell.config.yaml

@@ -64,6 +64,7 @@ words:
   - blindings
   - bookdir
   - Bougalis
+  - bthomee
   - Britto
   - Btrfs
   - Buildx
@@ -141,6 +142,7 @@ words:
   - hwrap
   - ifndef
   - inequation
+  - Injectivity
   - insuf
   - insuff
   - invasively
@@ -386,3 +388,4 @@ words:
   - xxhasher
   - zstdio
   - CGNAT
+  - ungated

.envrc

@@ -1,5 +1,8 @@
 watch_file nix/*.nix
 
+# Pinned Rust toolchain, read by nix/packages.nix via fromRustupToolchainFile.
+watch_file rust-toolchain.toml
+
 # The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
 # change in there has to invalidate direnv's cached environment.
 watch_dir conan

.github/actions/cargo-cache/action.yml

@@ -0,0 +1,39 @@
+name: Use cargo artifacts cache
+description: >
+  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
+  when saving the cache, rust-cache deletes all binaries that were already
+  present there, which on persistent self-hosted runners wipes the tools
+  installed by prepare-runner. Harmless on ephemeral runners, but kept
+  consistent everywhere.
+
+inputs:
+  workspaces:
+    description: "Workspaces to cache, as 'workspace -> target' lines."
+    required: false
+    default: crates
+  key:
+    description: "Additional part of the cache key."
+    required: false
+    default: ""
+  cache-directories:
+    description: "Additional non-workspace directories to cache."
+    required: false
+    default: ""
+  save-if:
+    description: >
+      Condition for saving the cache after the job. Defaults to save only from develop branch
+    required: false
+    default: ${{ github.ref == 'refs/heads/develop' }}
+
+runs:
+  using: composite
+
+  steps:
+    - name: Use cargo artifacts cache
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        cache-bin: "false"
+        cache-directories: ${{ inputs.cache-directories }}
+        key: ${{ inputs.key }}
+        save-if: ${{ inputs.save-if }}
+        workspaces: ${{ inputs.workspaces }}

.github/actions/release-info/action.yml

@@ -7,10 +7,10 @@ outputs:
     value: ${{ steps.version.outputs.version }}
   channel:
     description: "The release channel this build belongs to."
-    value: ${{ steps.channel.outputs.channel }}
+    value: ${{ steps.release_info.outputs.channel }}
   pkg_release:
-    description: "The package release number: 1 for a tag, the run number otherwise."
-    value: ${{ steps.pkg_release.outputs.pkg_release }}
+    description: "The package release number: 1 for a tag, <run number>.<commit date>git<short commit hash> otherwise."
+    value: ${{ steps.release_info.outputs.pkg_release }}
 
 runs:
   using: composite
@@ -39,52 +39,6 @@ runs:
 
         echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
 
-    # Only a tag says how mature a build is: a push is a develop build whatever
-    # its version, and a non-public codebase keeps its packages to itself.
-    - name: Determine release channel
-      id: channel
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        REF_NAME: ${{ github.ref_name }}
-        VISIBILITY: ${{ github.event.repository.visibility }}
-      run: |
-        pre_release=""
-        if [[ "${REF_NAME}" == *-* ]]; then
-            pre_release="${REF_NAME#*-}"
-        fi
-
-        if [[ "${VISIBILITY}" != "public" ]]; then
-            channel=private
-        elif [[ "${IS_TAG}" != "true" ]]; then
-            channel=develop
-        elif [[ -z "${pre_release}" ]]; then
-            channel=stable
-        elif [[ "${pre_release}" =~ ^rc[0-9]+(\+.*)?$ ]]; then
-            channel=unstable
-        elif [[ "${pre_release}" =~ ^b(0|[1-9][0-9]*)(\+.*)?$ ]]; then
-            channel=experimental
-        else
-            echo "Unsupported pre-release in tag '${REF_NAME}'. Use bN or rcN." >&2
-            exit 1
-        fi
-
-        echo "channel=${channel}" | tee -a "${GITHUB_OUTPUT}"
-
-    # A tag is packaged once, so its release number is fixed at 1. Develop builds
-    # repeat the same version, so the run number is what makes each push an
-    # upgrade rather than a reinstall.
-    - name: Determine package release
-      id: pkg_release
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        RUN_NUMBER: ${{ github.run_number }}
-      run: |
-        if [[ "${IS_TAG}" == "true" ]]; then
-            pkg_release=1
-        else
-            pkg_release="${RUN_NUMBER}"
-        fi
-
-        echo "pkg_release=${pkg_release}" | tee -a "${GITHUB_OUTPUT}"
+    - name: Determine release channel and package release
+      id: release_info
+      uses: XRPLF/actions/release-info@7cc0e4a8d9d0b838f92c48d312856b190341bbba

.github/actions/setup-nix-env/action.yml

@@ -40,10 +40,11 @@ runs:
         # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
         # own trust store, and pinning would break TLS to hosts relying on it.
 
-        # Workspace-local, so `cleanup-workspace` clears it, but not the
-        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
-        # different version, and the two would migrate each other's cache.
-        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
+        # In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
+        # prepare-runner hands the system toolchain - but under its own name:
+        # that Conan is a different version, and the two would migrate each
+        # other's cache.
+        echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
 
     # Config, profiles and remote, exactly as the dev shell sets them up on
     # entry; the `setup-conan` action is skipped for this toolchain.

.github/dependabot.yml

@@ -4,6 +4,7 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
+      - .github/actions/cargo-cache/
       - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/

.github/pull_request_template.md

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
 If there is a relevant task or issue, please link it here.
 -->
 
-### Context of Change
+## Context of Change
 
 <!--
 Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
 If there is a spec or design document for this feature, please link it here.
 -->
 
-### API Impact
+## API Impact
 
 <!--
 Please check [x] relevant options, delete irrelevant ones.

.github/scripts/levelization/results/ordering.txt

@@ -82,7 +82,6 @@ test.app > xrpl.tx
 test.basics > test.jtx
 test.basics > xrpl.basics
 test.basics > xrpl.core
-test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
 test.beast > xrpl.basics
@@ -286,10 +285,10 @@ xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
 xrpld.perflog > xrpl.core
 xrpld.perflog > xrpld.app
-xrpld.perflog > xrpld.rpc
 xrpld.perflog > xrpl.json
 xrpld.perflog > xrpl.nodestore
 xrpld.perflog > xrpl.protocol
+xrpld.perflog > xrpl.server
 xrpld.rpc > xrpl.basics
 xrpld.rpc > xrpl.config
 xrpld.rpc > xrpl.core

.github/scripts/strategy-matrix/generate.py

@@ -15,6 +15,14 @@ _BASE_CMAKE_ARGS = [
     "-Drust=ON",
 ]
 
+# The package formats a config can be packaged as, each with its own
+# install-test job in reusable-package.yml.
+PACKAGE_TYPES = ("deb", "rpm")
+
+# The package name a variant suffixes, as build_pkg.py's BASE_NAME spells it:
+# the two have to agree, or the artifact globs miss what was built.
+BASE_NAME = "xrpld"
+
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.
 _SANITIZER_SUFFIX: dict[str, str] = {
     "address": "asan",
@@ -23,6 +31,19 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 }
 
 
+def config_name(
+    distro: str,
+    compiler: str,
+    build_type: str,
+    arch: str,
+    suffix: str = "",
+    sanitizer: str = "",
+) -> str:
+    """Name a config. Its artifacts are named after it, so packaging reuses this."""
+    parts = [s for s in [suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s]
+    return "-".join([f"{distro}-{compiler}-{build_type.lower()}-{arch}", *parts])
+
+
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
@@ -37,17 +58,37 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 
 
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
-# built for pull requests by default; the full matrix adds the rest. Packaging
-# configs declare it too, but packaging is gated in the workflow, not by it.
+# built for pull requests by default; the full matrix adds the rest.
 #
-# Configs may also opt into 'benchmark' to smoke-run the benchmarks. Note that
-# the flag applies to every entry a config expands into, so only set it on
-# configs that expand to a single combination.
+# Configs may also opt into 'benchmark' to smoke-run the benchmarks, or carry a
+# 'package' map to be packaged as well. Note that either applies to every entry
+# a config expands into, so only set them on configs that expand to a single
+# combination.
+
+
+@dataclasses.dataclass
+class PackageConfig:
+    """The 'package' map of a config whose binaries are also packaged."""
+
+    type: str  # has to match what the image provides
+    # The packaging container image: a vanilla distro image, not the nix image
+    # the config itself builds in.
+    image: str
+    # A flavour of the package, named xrpld-<variant>, for a config whose
+    # binaries are not the plain release build. A variant needs no counterpart
+    # in the other format.
+    variant: str = ""
+
+    def __post_init__(self) -> None:
+        assert self.type in PACKAGE_TYPES, (
+            f"unsupported package type {self.type!r}: "
+            f"use one of {', '.join(PACKAGE_TYPES)}."
+        )
 
 
 @dataclasses.dataclass
 class LinuxConfig:
-    """One entry in linux.json's 'configs' or 'package_configs' arrays."""
+    """One entry in a linux.json 'configs' array."""
 
     compiler: list[str]
     build_type: list[str]
@@ -57,7 +98,11 @@ class LinuxConfig:
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
-    image: str = ""  # only used by package_configs entries
+    package: PackageConfig | None = None  # set to also package this config
+
+    def __post_init__(self) -> None:
+        if isinstance(self.package, dict):
+            self.package = PackageConfig(**self.package)
 
 
 @dataclasses.dataclass
@@ -66,22 +111,16 @@ class LinuxFile:
 
     image_tag: str
     configs: dict[str, list[LinuxConfig]]  # distro → configs
-    package_configs: dict[str, list[LinuxConfig]]  # distro → packaging configs
 
     @classmethod
     def load(cls, path: Path) -> "LinuxFile":
         data = json.loads(path.read_text())
-
-        def parse(section: dict) -> dict[str, list[LinuxConfig]]:
-            return {
-                distro: [LinuxConfig(**c) for c in cfgs]
-                for distro, cfgs in section.items()
-            }
-
         return cls(
             image_tag=data["image_tag"],
-            configs=parse(data["configs"]),
-            package_configs=parse(data.get("package_configs", {})),
+            configs={
+                distro: [LinuxConfig(**c) for c in cfgs]
+                for distro, cfgs in data["configs"].items()
+            },
         )
 
 
@@ -156,7 +195,9 @@ class PackagingEntry:
     xrpld_artifact_name: str
     validator_keys_artifact_name: str
     image: str
-    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps
+    package_type: str  # "deb" or "rpm"; drives the format-specific steps
+    package_variant: str  # passed to build_pkg.py --variant; empty for xrpld
+    package_name: str  # the name it builds under, which the artifact globs use
 
 
 # ---------------------------------------------------------------------------
@@ -197,13 +238,9 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                 effective_sanitizers,
                 effective_archs.items(),
             ):
-                name = f"{distro}-{compiler}-{build_type.lower()}-{arch}"
-                suffix_parts = [
-                    s for s in [cfg.suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s
-                ]
-                if suffix_parts:
-                    name += "-" + "-".join(suffix_parts)
-
+                name = config_name(
+                    distro, compiler, build_type, arch, cfg.suffix, sanitizer
+                )
                 entries.append(
                     MatrixEntry(
                         config_name=name,
@@ -223,33 +260,59 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 
 
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
-    """Generate the packaging matrix from a LinuxFile's package_configs section.
+    """Generate the packaging matrix from the configs that carry a 'package' map.
 
-    Packaging uses vanilla distro images (debian:bookworm, almalinux:9) instead of
-    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
-    is taken from the distro's archive rather than from nixpkgs. Each config
-    entry carries its own 'image'.
+    Packaging consumes the binaries that config's build job uploaded, so the
+    artifact names come from the same config name, and a packaged config is one
+    that passes -Dvalidator_keys=ON.
 
-    The artifact names must match what the build job uploads: one artifact per
-    binary, each named after the build config.
+    Packaging itself runs in vanilla distro images (debian:trixie, almalinux:10)
+    instead of the nix-based build images, because deb/rpm tooling (debhelper,
+    rpm-build) is taken from the distro's archive rather than from nixpkgs.
     """
     entries = []
-    for distro, configs in linux.package_configs.items():
+    for distro, configs in linux.configs.items():
         for cfg in configs:
-            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
-                config_name = f"{distro}-{compiler}-{build_type.lower()}-amd64"
+            if cfg.package is None:
+                continue
+            for compiler, build_type, arch in itertools.product(
+                cfg.compiler, cfg.build_type, cfg.arch
+            ):
+                # The packaging workflow hardcodes an amd64 runner.
+                assert arch == "amd64", f"cannot package {distro} on {arch}"
+                name = config_name(distro, compiler, build_type, arch, cfg.suffix)
                 entries.append(
                     PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{config_name}",
-                        validator_keys_artifact_name=f"validator-keys-{config_name}",
-                        image=cfg.image,
-                        distro=distro,
+                        xrpld_artifact_name=f"xrpld-{name}",
+                        validator_keys_artifact_name=f"validator-keys-{name}",
+                        image=cfg.package.image,
+                        package_type=cfg.package.type,
+                        package_variant=cfg.package.variant,
+                        package_name=(
+                            f"{BASE_NAME}-{cfg.package.variant}"
+                            if cfg.package.variant
+                            else BASE_NAME
+                        ),
                     )
                 )
 
     return entries
 
 
+def package_names_by_type(entries: list[PackagingEntry]) -> dict[str, list[str]]:
+    """The names of the packages in 'entries', keyed by format.
+
+    Derived from the packaging matrix rather than listed again, so the packages
+    the install-test jobs look for are the packages that were built.
+    """
+    return {
+        package_type: sorted(
+            {e.package_name for e in entries if e.package_type == package_type}
+        )
+        for package_type in PACKAGE_TYPES
+    }
+
+
 def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a PlatformFile (macOS or Windows) into matrix entries.
 
@@ -318,6 +381,10 @@ if __name__ == "__main__":
 
     if args.packaging:
         matrix = expand_linux_packaging(LinuxFile.load(THIS_DIR / "linux.json"))
+        # One list per format, so each install-test job installs the packages its
+        # own format produced.
+        for package_type, names in package_names_by_type(matrix).items():
+            print(f"{package_type}_package_names={json.dumps(names)}")
     else:
         if args.config in ("linux", None):
             matrix += expand_linux_matrix(

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-a0074f8",
+  "image_tag": "sha-060957e",
   "configs": {
     "ubuntu": [
       {
@@ -71,7 +71,24 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
+        "extra_cmake_args": "-Dvalidator_keys=ON",
+        "package": {
+          "type": "deb",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10"
+        }
+      },
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false,
+        "suffix": "assert",
+        "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
+        "package": {
+          "type": "deb",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10",
+          "variant": "assert"
+        }
       }
     ],
 
@@ -81,28 +98,11 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
-      }
-    ]
-  },
-  "package_configs": {
-    "debian": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-a6983f8"
-      }
-    ],
-
-    "rhel": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-a6983f8"
+        "extra_cmake_args": "-Dvalidator_keys=ON",
+        "package": {
+          "type": "rpm",
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-49cdc10"
+        }
       }
     ]
   }

.github/workflows/build-nix-images.yml

@@ -5,14 +5,13 @@ on:
     branches:
       - develop
     paths:
-      - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
       - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "bin/check-tools.sh"
+      - "!nix/check-tools/**"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   pull_request:
@@ -24,6 +23,7 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
+      - "!nix/check-tools/**"
       - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
@@ -58,7 +58,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -6,13 +6,13 @@ on:
       - develop
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "package/Dockerfile"
-      - "package/install-packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
+      - "package/docker/**"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "package/Dockerfile"
-      - "package/install-packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
+      - "package/docker/**"
   workflow_dispatch:
 
 concurrency:
@@ -33,15 +33,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # Newest of each distro: these images only wrap pre-built binaries, so
+        # they set no floor for consumers. build_pkg.py pins the RPM dist tag.
         distro:
           - name: debian
-            base_image: debian:bookworm
-          # AlmaLinux rather than UBI9, which does not ship rpm-sign.
+            base_image: debian:trixie
+          # AlmaLinux rather than UBI, which does not ship rpm-sign.
           - name: rhel
-            base_image: almalinux:9
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+            base_image: almalinux:10
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
-      dockerfile: package/Dockerfile
+      dockerfile: package/docker/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
       push: ${{ github.event_name == 'push' }}

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 

.github/workflows/on-pr.yml

@@ -85,6 +85,7 @@ jobs:
             .github/workflows/reusable-build-test.yml
             .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
+            .github/workflows/reusable-package-test-install.yml
             .github/workflows/reusable-package.yml
             .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
@@ -189,6 +190,12 @@ jobs:
     # matrix (i.e. not yet labeled "Ready to merge" or "Full CI build").
     if: ${{ needs.should-run.outputs.go == 'true' && (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'Ready to merge') || contains(github.event.pull_request.labels.*.name, 'Full CI build')) }}
     uses: ./.github/workflows/reusable-package.yml
+    with:
+      # A pull request builds packages to prove they still build, and publishes
+      # nothing. Stated rather than left to the input's default, so that changing
+      # that default cannot start publishing from pull requests. No secrets are
+      # passed either, which is the second reason a publish here cannot succeed.
+      publish: false
 
   upload-recipe:
     needs:

.github/workflows/on-trigger.yml

@@ -23,6 +23,7 @@ on:
       - ".github/workflows/reusable-build-test.yml"
       - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
+      - ".github/workflows/reusable-package-test-install.yml"
       - ".github/workflows/reusable-package.yml"
       - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -163,11 +163,10 @@ jobs:
           compiler: ${{ inputs.compiler }}
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: ./.github/actions/cargo-cache
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
           key: ${{ inputs.config_name }}
-          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           # two workspaces here because build artifacts are located in 2 places:
           # - crates/target when cargo is called directly
           # - build/cargo when cargo is called by cmake
@@ -440,7 +439,7 @@ jobs:
 
       - name: Upload coverage report
         if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           disable_search: true
           disable_telem: true

.github/workflows/reusable-clang-tidy.yml

@@ -27,14 +27,14 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-a0074f8"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -60,10 +60,9 @@ jobs:
           compiler: ${{ env.COMPILER }}
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: ./.github/actions/cargo-cache
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
 
       - name: Setup Conan

.github/workflows/reusable-package-test-install.yml

@@ -0,0 +1,120 @@
+# Install one package format on every distro family it targets, one job per
+# package name and image, and run the binaries there. Called once per format by
+# reusable-package.yml, which owns the names and the image lists.
+name: Install packages
+
+on:
+  workflow_call:
+    inputs:
+      package_type:
+        description: 'The package format to install ("deb" or "rpm").'
+        required: true
+        type: string
+      package_names:
+        description: "JSON array of package names built for this format."
+        required: true
+        type: string
+      images:
+        description: "JSON array of container images to install in."
+        required: true
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  PACKAGE_DIR: packages
+
+jobs:
+  install:
+    strategy:
+      fail-fast: false
+      matrix:
+        package_name: ${{ fromJson(inputs.package_names) }}
+        image: ${{ fromJson(inputs.images) }}
+    name: "${{ matrix.package_name }} on ${{ matrix.image }}"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    container: ${{ matrix.image }}
+    timeout-minutes: 5
+
+    steps:
+      # Every package lands in one directory; the step below picks its own,
+      # which keeps this independent of the artifact names.
+      - name: Download package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: "*-pkg"
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
+
+      - name: Find the package
+        id: find
+        env:
+          PACKAGE_NAME: ${{ matrix.package_name }}
+          PACKAGE_TYPE: ${{ inputs.package_type }}
+        run: |
+          # The version follows the name, separated by '_' in a DEB and '-' in an
+          # RPM. Requiring a digit after it is what keeps 'xrpld' from picking up
+          # another package, such as 'xrpld-assert'.
+          pattern="${PACKAGE_NAME}[_-][0-9]*.${PACKAGE_TYPE}"
+          package="$(find "${PACKAGE_DIR}" -type f -name "${pattern}" -print -quit)"
+          test -n "${package}" || {
+              echo "no ${pattern} found in ${PACKAGE_DIR}" >&2
+              exit 1
+          }
+          echo "package=${package}" >>"${GITHUB_OUTPUT}"
+
+      # Debian 11 went end-of-life on 2026-08-31
+      # (https://www.debian.org/News/2026/20260831) and its packages are
+      # already partly gone from deb.debian.org, so switch to the
+      # snapshot.debian.org entries the image ships commented out in its
+      # sources.list: they are pinned to the snapshot the image was built
+      # from, so they serve every version it needs and never go away.
+      # Snapshots keep their original, long-passed Valid-Until, hence the
+      # disabled check; the retries absorb snapshot.debian.org's throttling.
+      - name: Switch Debian 11 to snapshot.debian.org
+        if: ${{ matrix.image == 'debian:11' }}
+        run: |
+          sed -i 's|^deb |# deb |; s|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list
+          printf '%s\n' \
+              'Acquire::Check-Valid-Until "false";' \
+              'Acquire::Retries "3";' \
+              >/etc/apt/apt.conf.d/99snapshot
+
+      - name: Install the DEB
+        if: ${{ inputs.package_type == 'deb' }}
+        env:
+          DEBIAN_FRONTEND: noninteractive
+          PACKAGE: ${{ steps.find.outputs.package }}
+        run: |
+          # Stock Debian and Ubuntu images carry no package lists, so apt has
+          # nothing to resolve the systemd dependency from until it fetches them.
+          apt-get update -qq
+          apt-get install -y "./${PACKAGE}"
+
+      - name: Install the RPM
+        if: ${{ inputs.package_type == 'rpm' }}
+        env:
+          PACKAGE: ${{ steps.find.outputs.package }}
+        run: dnf install -y "./${PACKAGE}"
+
+      - name: Run xrpld
+        run: xrpld --version
+
+      - name: Run validator-keys
+        run: validator-keys --version
+
+      - name: Run rippled, the legacy compatibility symlink
+        run: rippled --version
+
+      - name: Check the service account
+        run: id xrpld
+
+      - name: Check the state directory
+        run: test -d /var/lib/xrpld
+
+      - name: Check the log directory
+        run: test -d /var/log/xrpld

.github/workflows/reusable-package.yml

@@ -1,11 +1,16 @@
-# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
+# Build, verify and publish Linux packages from the pre-built xrpld and
+# validator-keys artifacts, in three stages:
 #
-#   - one job per distro, taken from "package_configs" in linux.json
-#   - each job runs in that distro's container, which is what decides DEB or RPM
-#   - with 'publish: true' a job also uploads what it built
-#     (see package/publish_pkg.sh)
+#   - 'package' builds and signs one format per config that carries a "package"
+#     map in linux.json; that map names the container image and the format
+#   - 'test-install-deb' and 'test-install-rpm' call
+#     reusable-package-test-install.yml to install what was built on a range of
+#     distros and run the binaries there, so a package that cannot be installed
+#     never reaches Nexus
+#   - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
+#     unless 'publish: true'
 #
-# Only linux/amd64 is supported; the runner is hardcoded in the job below.
+# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
 name: Package
 
 on:
@@ -20,7 +25,7 @@ on:
         description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
         required: false
         type: string
-        default: https://packages.xrplf.org
+        default: https://packages-upload.xrplf.org
 
     secrets:
       remote_username:
@@ -39,12 +44,15 @@ defaults:
 
 env:
   BUILD_DIR: build
+  PACKAGE_DIR: packages
 
 jobs:
   generate-matrix:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.generate.outputs.matrix }}
+      deb_package_names: ${{ steps.generate.outputs.deb_package_names }}
+      rpm_package_names: ${{ steps.generate.outputs.rpm_package_names }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,12 +78,17 @@ jobs:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
     container: ${{ matrix.image }}
-    timeout-minutes: 30
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        with:
+          enable_ccache: false
+
       - name: Download pre-built xrpld binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -97,33 +110,135 @@ jobs:
 
       - name: Build package
         env:
+          PACKAGE_TYPE: ${{ matrix.package_type }}
+          PACKAGE_VARIANT: ${{ matrix.package_variant }}
           PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
-          PKG_CHANNEL: ${{ steps.release_info.outputs.channel }}
-        run: ./package/build_pkg.sh
+          CHANNEL: ${{ steps.release_info.outputs.channel }}
+        run: |
+          ./package/build_pkg.py \
+              --package-type "${PACKAGE_TYPE}" \
+              --build-dir "${BUILD_DIR}" \
+              --pkg-release "${PKG_RELEASE}" \
+              --variant "${PACKAGE_VARIANT}" \
+              --channel "${CHANNEL}"
 
-      # Before the upload, so the artifact and the published package are the
-      # same bytes. DEBs are not signed, so the key is never set on that job.
+      # Before the upload, so the artifact, the tested package and the published
+      # package are the same bytes.
       - name: Sign RPM
-        if: ${{ inputs.publish && matrix.distro == 'rhel' }}
+        if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
         env:
           PKG_SIGNING_KEY: ${{ secrets.signing_key }}
-        run: ./package/sign_rpm.sh "${BUILD_DIR}"
+        run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
 
+      # Split from the debug symbols, which are an order of magnitude larger, so
+      # that test-install downloads only what it installs. In the globs below the
+      # version follows the name, separated by '_' in a DEB and '-' in an RPM. A
+      # version starts with a digit and a longer name does not, so that one digit
+      # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}-pkg
           path: |
-            ${{ env.BUILD_DIR }}/debbuild/*.deb
-            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
+            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}_[0-9]*.deb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/${{ matrix.package_name }}-[0-9]*.rpm
           if-no-files-found: error
 
+      - name: Upload debug symbol artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
+          path: |
+            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}-dbgsym_[0-9]*.deb
+            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}-dbgsym_[0-9]*.ddeb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/${{ matrix.package_name }}-debuginfo-[0-9]*.rpm
+          if-no-files-found: error
+
+  # One call per format, so a variant packaged for one format is installed for
+  # that format alone. The images are every distro family that format targets,
+  # oldest release first, so both ends of the dependency range the packages
+  # declare are exercised.
+  test-install-deb:
+    needs: [generate-matrix, package]
+    name: install deb
+    uses: ./.github/workflows/reusable-package-test-install.yml
+    with:
+      package_type: deb
+      package_names: ${{ needs.generate-matrix.outputs.deb_package_names }}
+      images: |
+        [
+          "debian:11",
+          "debian:12",
+          "debian:13",
+          "ubuntu:20.04",
+          "ubuntu:22.04",
+          "ubuntu:24.04",
+          "ubuntu:26.04"
+        ]
+
+  test-install-rpm:
+    needs: [generate-matrix, package]
+    name: install rpm
+    uses: ./.github/workflows/reusable-package-test-install.yml
+    with:
+      package_type: rpm
+      package_names: ${{ needs.generate-matrix.outputs.rpm_package_names }}
+      images: |
+        [
+          "almalinux:9",
+          "almalinux:10",
+          "rockylinux/rockylinux:9",
+          "rockylinux/rockylinux:10",
+          "registry.access.redhat.com/ubi9/ubi",
+          "registry.access.redhat.com/ubi10/ubi"
+        ]
+
+  publish:
+    needs: [generate-matrix, package, test-install-deb, test-install-rpm]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+    # The name says which of the two this is, because the job runs either way:
+    # with publish false it passes --dry-run and uploads nothing, and a job
+    # called "publish ..." succeeding on a pull request reads like a release.
+    name: "publish ${{ matrix.xrpld_artifact_name }}${{ !inputs.publish && ' (dry run)' || '' }}"
+    permissions:
+      contents: read
+    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
+    container: ${{ matrix.image }}
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        with:
+          enable_ccache: false
+
+      # Both artifacts, so the debug symbols are published alongside the package.
+      - name: Download package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
+
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
+
       - name: Publish package
-        if: ${{ inputs.publish }}
         env:
           CHANNEL: ${{ steps.release_info.outputs.channel }}
+          DRY_RUN_OPTION: ${{ !inputs.publish && '--dry-run' || '' }}
           NEXUS_URL: ${{ inputs.nexus_url }}
-          NEXUS_USERNAME: ${{ secrets.remote_username }}
-          NEXUS_PASSWORD: ${{ secrets.remote_password }}
-        run: ./package/publish_pkg.sh "${CHANNEL}" "${BUILD_DIR}"
+          NEXUS_USERNAME: ${{ inputs.publish && secrets.remote_username || '' }}
+          NEXUS_PASSWORD: ${{ inputs.publish && secrets.remote_password || '' }}
+        run: |
+          publish_pkg.py \
+              --channel "${CHANNEL}" \
+              --package-dir "${PACKAGE_DIR}" \
+              --nexus-url "${NEXUS_URL}" \
+              ${DRY_RUN_OPTION}

.github/workflows/reusable-rust.yml

@@ -1,8 +1,9 @@
 # Clippy, coverage and documentation for the Rust crates in crates/. Each runs
 # as an independent job on a GitHub-hosted runner, but inside the same container
 # image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints, coverage instrumentation and the cargo cache) matches
-# what production builds use.
+# (and therefore the lints and the cargo cache) matches what production builds
+# use. Coverage is the exception: it needs the nightly rustc that honours
+# #[coverage(off)], which the image carries alongside the pinned stable.
 #
 # Rust unit tests are deliberately NOT run here. They run as part of the C++
 # build (reusable-build-test-config.yml), which already compiles the crates on a
@@ -27,37 +28,36 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Use the nightly Rust toolchain
+        run: rust-nightly path >>"${GITHUB_PATH}"
+
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
 
       - name: Upload coverage report
         if: ${{ github.repository == 'XRPLF/rippled' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           disable_search: true
           disable_telem: true
@@ -70,15 +70,13 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Build documentation
         env:

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -49,6 +49,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        with:
+          enable_ccache: false
+
       - name: Determine release info
         id: release_info
         uses: ./.github/actions/release-info

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 

.gitignore

@@ -72,11 +72,16 @@ DerivedData
 /.zed/
 
 # AI tools.
+# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
+# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
+# personal/local variants below are ignored.
 /.agent
 /.agents
 /.augment
-/.claude
-/CLAUDE.md
+/.claude/settings.local.json
+AGENTS.override.md
+CLAUDE.local.md
+GEMINI.local.md
 
 # Python
 __pycache__

.pre-commit-config.yaml

@@ -70,6 +70,11 @@ repos:
         language: system
         types: [rust]
         pass_filenames: false # rustfmt formats the whole workspace
+      - id: check-coverage-attrs
+        name: check Rust coverage attributes
+        entry: ./bin/pre-commit/check_rust_coverage_attrs.py
+        language: python
+        files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
@@ -82,11 +87,27 @@ repos:
       - id: prettier
         args: [--end-of-line=auto]
 
+  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
+  # so widening these is its own change.
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: 7c55798a78262d14b2074abf623d8a992ebb70d4 # frozen: v0.16.2
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+        files: ^package/.*\.py$
+
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
+    hooks:
+      - id: mypy
+        args: [--strict]
+        files: ^package/.*\.py$
+
   - repo: https://github.com/scop/pre-commit-shfmt
     rev: 05c1426671b9237fb5e1444dd63aa5731bec0dfb # frozen: v3.13.1-1
     hooks:

AGENTS.md

@@ -0,0 +1,42 @@
+# AGENTS.md
+
+This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
+
+## Build
+
+Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
+
+```bash
+nix develop
+```
+
+For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
+
+Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
+
+## Testing
+
+Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
+
+- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
+- `--unittest-arg` does nothing — don't use it.
+- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
+- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
+
+## Lint/Format
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
+
+## Code Style
+
+New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
+
+## Architecture
+
+Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
+
+- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
+- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
+- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
+- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
+- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

API-CHANGELOG.md

@@ -22,17 +22,48 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## Unreleased
+## XRP Ledger server version 3.4.0
 
-This section contains changes targeting a future version.
+Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
 
-### Additions
+### Additions in 3.4.0
 
-- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
-  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
+- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
+
+### Bugfixes in 3.4.0
+
+- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
+- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
+- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
+- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
+- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
+- `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
+
+## XRP Ledger server version 3.3.0
+
+[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
+
+### Additions in 3.3.0
+
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
+
+## XRP Ledger server version 3.2.1
+
+[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.2.0
+
+[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
+
+### Additions in 3.2.0
 
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
-
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
   - `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
   - `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -40,9 +71,8 @@ This section contains changes targeting a future version.
   - `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
   - `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
 
-### Bugfixes
+### Bugfixes in 3.2.0
 
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -54,8 +84,24 @@ This section contains changes targeting a future version.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
-- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
-- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
+
+## XRP Ledger server version 3.1.3
+
+[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.1.2
+
+[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.1.1
+
+[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
+
+This release contains bug fixes only and no API changes.
 
 ## XRP Ledger server version 3.1.0
 

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CONTRIBUTING.md

@@ -59,6 +59,17 @@ to an existing XLS. Neither change will be released (in an amendment's
 case, marked as `Supported::yes`) until the corresponding XLS's status
 is `Final`.
 
+## AI coding agents
+
+[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
+
+If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
+
+- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
+- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
+
+Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
+
 ## Before making a pull request
 
 (Or marking a draft pull request as ready.)
@@ -82,7 +93,7 @@ If you create new source files, they must be organized as follows:
   under `include/xrpl`, and source (`.cpp`) files must go under
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
-- All test source files must go under `src/test`.
+- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
 - All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest

bin/check-tools.sh

@@ -158,6 +158,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-nextest cargo nextest --version
     check clippy-driver
     check rust-analyzer
+    check rust-nightly rust-nightly run rustc --version
     check rustc
     check rustfmt
 fi

bin/install-packaging-tools.sh

@@ -25,34 +25,38 @@ esac
 # Packaging runs in a vanilla distro image, so the tooling comes from the distro's
 # archive rather than from nixpkgs:
 #
-#   - debhelper and dpkg-dev build the DEB
+#   - debhelper and dpkg-dev build the DEB, and lintian checks it
+#   - binutils gives debian/rules the readelf its glibc-floor check runs; it
+#     already arrives via dpkg-dev, but that tool is called directly
 #   - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
 #     supplying the systemd and find-debuginfo macros the spec uses
-#   - rpm-sign signs the built RPM
-#   - git gives build_pkg.sh a real history to read SOURCE_DATE_EPOCH from;
-#     without one the timestamp falls back to the wall clock
-#   - curl uploads the finished packages in publish_pkg.sh
-#   - ca-certificates lets curl and git verify TLS
+#   - rpm-sign and gnupg2 sign the built RPM
+#   - python3 runs the packaging scripts
+#   - git gives build_pkg.py the commit timestamp it stamps files with
+#   - ca-certificates lets git and the packaging scripts verify TLS
 function install() {
     case "${ID}" in
         debian | ubuntu)
             apt-get update -y
             apt-get install -y --no-install-recommends \
+                binutils \
                 ca-certificates \
-                curl \
                 debhelper \
                 debhelper-compat \
                 dpkg-dev \
-                git
+                git \
+                lintian \
+                python3
             ;;
 
         rhel | centos | rocky | almalinux)
             dnf install -y --setopt=install_weak_deps=False \
-                curl-minimal \
                 git \
+                gnupg2 \
+                python3 \
+                redhat-rpm-config \
                 rpm-build \
                 rpm-sign \
-                redhat-rpm-config \
                 systemd-rpm-macros
             ;;
     esac

bin/pre-commit/check_rust_coverage_attrs.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""
+Check that Rust unit tests stay out of the coverage report.
+
+cargo-llvm-cov instruments the test code along with everything else, so a test
+module that is not excluded counts its own body as covered and inflates the
+reported number. Excluding it takes two attributes:
+
+  * every `#[cfg(test)]` module carries
+    `#[cfg_attr(coverage_nightly, coverage(off))]`;
+  * every crate root (lib.rs, main.rs) carries
+    `#![cfg_attr(coverage_nightly, feature(coverage_attribute))]`, which the
+    attribute above needs in order to compile.
+
+Both are inert outside the coverage job: cargo-llvm-cov defines
+`coverage_nightly` only when it runs on a nightly toolchain.
+
+The crate-root gate is checked even in a crate that has no tests yet, because
+that is what lets the first test module added later carry the attribute without
+a build failure. Missing it is a hard error, so it cannot go unnoticed; a
+missing `coverage(off)` fails open, which is why this check exists.
+
+Matching is on exact attribute text, which works because `cargo fmt` runs over
+the whole workspace in the hook ahead of this one: rustfmt puts every attribute
+on its own line and normalizes what is inside it, turning `#[cfg( test )]`
+and `#[cfg(test,)]` alike into `#[cfg(test)]`. So there is nothing here that
+parses Rust. The price is that a cfg this file does not spell out literally --
+`all(test, ...)`, `any(test, ...)`, `not(test)` -- is reported rather than
+classified, on the grounds that guessing at coverage semantics is how a check
+like this ends up quietly wrong.
+
+Usage: ./bin/pre-commit/check_rust_coverage_attrs.py <file1> <file2> ...
+
+Exit status is non-zero if any violation is found.
+"""
+
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+CRATE_ROOTS = {"lib.rs", "main.rs"}
+
+FEATURE_ATTR = "#![cfg_attr(coverage_nightly, feature(coverage_attribute))]"
+COVERAGE_OFF_ATTR = "#[cfg_attr(coverage_nightly, coverage(off))]"
+CFG_TEST_ATTR = "#[cfg(test)]"
+
+# Any other cfg that mentions `test`. String literals are blanked before this
+# runs, so `feature = "test"` does not read as the `test` cfg.
+RE_CFG_MENTIONS_TEST = re.compile(r"^#\[cfg\(.*\btest\b.*\)\]$")
+RE_STRING = re.compile(r'"(?:[^"\\]|\\.)*"')
+RE_MOD = re.compile(r"^(?:pub(?:\([^)]*\))?\s+)?mod\s+([A-Za-z_]\w*)")
+
+
+@dataclass(frozen=True)
+class Finding:
+    line: int
+    label: str
+    message: str
+
+
+def _check_module(attrs: list[str], line: int, name: str) -> list[Finding]:
+    """Findings for one module, given the attributes attached to it."""
+    if COVERAGE_OFF_ATTR in attrs:
+        return []  # excluded from coverage; which cfg gates it does not matter
+    if CFG_TEST_ATTR in attrs:
+        return [
+            Finding(
+                line,
+                "missing-coverage-off",
+                f"`mod {name}` is #[cfg(test)] but not excluded from coverage; "
+                f"add {COVERAGE_OFF_ATTR}",
+            )
+        ]
+    unclassified = [
+        attr for attr in attrs if RE_CFG_MENTIONS_TEST.match(RE_STRING.sub('""', attr))
+    ]
+    if unclassified:
+        return [
+            Finding(
+                line,
+                "unclassified-cfg",
+                f"`mod {name}` is gated on {unclassified[0]}, which this check "
+                f"cannot tell apart from a module that ships in the library; "
+                f"add {COVERAGE_OFF_ATTR} if it is test-only, or teach this "
+                f"check the cfg if it is not",
+            )
+        ]
+    return []
+
+
+def _check_test_modules(lines: list[str]) -> list[Finding]:
+    """Findings for every test module that is not excluded from coverage."""
+    findings: list[Finding] = []
+    attrs: list[str] = []
+    attrs_line = 0
+    for number, raw in enumerate(lines, start=1):
+        stripped = raw.strip()
+        # Blank lines and comments are allowed between an attribute and its item.
+        if not stripped or stripped.startswith("//"):
+            continue
+        if stripped.startswith("#["):
+            if not attrs:
+                attrs_line = number
+            attrs.append(stripped)
+            continue
+        module = RE_MOD.match(stripped)
+        if module is not None and attrs:
+            findings += _check_module(attrs, attrs_line, module.group(1))
+        attrs = []
+    return findings
+
+
+def _check_crate_root(name: str, lines: list[str]) -> list[Finding]:
+    """A finding if a crate root is missing the coverage_attribute feature gate."""
+    if name not in CRATE_ROOTS:
+        return []
+    if any(line.strip() == FEATURE_ATTR for line in lines):
+        return []
+    return [
+        Finding(
+            1,
+            "missing-feature-gate",
+            f"crate root is missing {FEATURE_ATTR}",
+        )
+    ]
+
+
+def check_source(name: str, text: str) -> list[Finding]:
+    """Findings for one file's contents; `name` is its base name (lib.rs, ...)."""
+    lines = text.splitlines()
+    return _check_crate_root(name, lines) + _check_test_modules(lines)
+
+
+def check_file(path: Path) -> list[Finding]:
+    return check_source(path.name, path.read_text(encoding="utf-8"))
+
+
+def main() -> int:
+    total = 0
+    for path in (Path(name) for name in sys.argv[1:]):
+        for finding in check_file(path):
+            total += 1
+            print(f"{path}:{finding.line}: {finding.label}: {finding.message}")
+    return 1 if total else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

cfg/xrpld-example.cfg

@@ -1094,8 +1094,8 @@
 #                           Default is 100.
 #
 #       back_off_milliseconds
-#                           Number of milliseconds to wait between
-#                           online_delete batches to allow other functions
+#                           Number of milliseconds to wait between online_delete
+#                           SQL deletion batches to allow other functions
 #                           to catch up.
 #                           Default is 100.
 #
@@ -1109,10 +1109,22 @@
 #                           The online delete process checks periodically
 #                           that xrpld is still in sync with the network,
 #                           and that the validated ledger is less than
-#                           'age_threshold_seconds' old. If not, then continue
+#                           'age_threshold_seconds' old, and that all
+#                           recent ledgers are available. If not, then continue
 #                           sleeping for this number of seconds and
 #                           checking until healthy.
-#                           Default is 5.
+#                           Default is 2.
+#
+#       max_waiting_ledgers
+#                           The maximum number of ledgers that may be validated
+#                           while online deletion is waiting for the node to get
+#                           fully synced with the rest of the network. If more than
+#                           this number of ledgers are validated while waiting, then
+#                           online deletion gives up on the current ledger and tries
+#                           again later. Note this only affects situations that cause
+#                           rotation to wait, such as going out of sync, or missing
+#                           ledgers. Forward progress is not penalized. Minimum is 64.
+#                           Default is the online_delete value.
 #
 #   Notes:
 #       The 'node_db' entry configures the primary, persistent storage.

cmake/XrplCompiler.cmake

@@ -120,7 +120,10 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
+    target_link_libraries(
+        common
+        INTERFACE -errorreport:none -machine:X64 -ignore:4099
+    )
 else()
     target_compile_options(
         common

cmake/XrplPackaging.cmake

@@ -1,7 +1,7 @@
 #[===================================================================[
    Linux packaging support: 'package' target.
 
-   The packaging script (package/build_pkg.sh) installs to FHS-standard
+   The packaging script (package/build_pkg.py) installs to FHS-standard
    paths (/usr/bin, /etc/xrpld, etc.) regardless of CMAKE_INSTALL_PREFIX,
    so no prefix guard is needed here.
 #]===================================================================]
@@ -38,19 +38,26 @@ if(NOT TARGET validator-keys)
     return()
 endif()
 
-set(package_env
-    SRC_DIR=${CMAKE_SOURCE_DIR}
-    BUILD_DIR=${CMAKE_BINARY_DIR}
-    PKG_RELEASE=${pkg_release}
-)
+if(DPKG_BUILDPACKAGE_EXECUTABLE)
+    set(pkg_type deb)
+else()
+    set(pkg_type rpm)
+endif()
+
+# Unquoted below, so an empty value adds no argument at all.
+set(pkg_variant_option "")
+if(assert)
+    set(pkg_variant_option --variant=assert)
+endif()
 
 add_custom_target(
     package
     COMMAND
-        ${CMAKE_COMMAND} -E env ${package_env}
-        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
+        ${CMAKE_SOURCE_DIR}/package/build_pkg.py --package-type=${pkg_type}
+        --build-dir=${CMAKE_BINARY_DIR} --pkg-release=${pkg_release}
+        ${pkg_variant_option} --channel=UNRELEASED
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
     DEPENDS xrpld validator-keys
-    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
+    COMMENT "Building Linux ${pkg_type} package"
     VERBATIM
 )

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,6 +8,7 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
+import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -53,28 +54,89 @@ def create_transaction_parser():
     return macro_parser
 
 
+# Defaults for xrpl::TxSettings members, mirroring
+# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
+# the members that differ from these.
+SETTING_DEFAULTS = {
+    "delegable": "Delegation::NotDelegable",
+    "amendment": "uint256{}",
+    "privileges": "Privilege::NoPriv",
+}
+
+
+def parse_settings(settings_str):
+    """Parse a TxSettings blob into a dict, filling in defaults.
+
+    Args:
+        settings_str: A string like '({.delegable = Delegation::NotDelegable,
+                      .privileges = Privilege::CreateAcct})', or '({})'.
+
+    Returns:
+        A dict with a value for every key in SETTING_DEFAULTS.
+    """
+    body = settings_str.strip()
+    if not (body.startswith("(") and body.endswith(")")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1].strip()
+    if not (body.startswith("{") and body.endswith("}")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1]
+
+    # Strip comments, which may be interleaved with the designated initializers.
+    body = re.sub(r"//[^\n]*", "", body)
+
+    settings = dict(SETTING_DEFAULTS)
+    seen = set()
+    # Each entry runs from '.key =' up to the next '.key =' or the end.
+    for key, value in re.findall(
+        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
+    ):
+        if key not in SETTING_DEFAULTS:
+            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
+        settings[key] = " ".join(value.split()).rstrip(",")
+        seen.add(key)
+
+    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
+    # Every '.member' in the blob must have been consumed above.
+    if len(re.findall(r"\.\w+", body)) != len(seen):
+        raise ValueError(f"Could not parse every setting in {settings_str!r}")
+
+    # A blob with content but no designated initializer is positional, which
+    # would otherwise be read as "all defaults" and silently generate the
+    # wrong output.
+    if body.strip() and not seen:
+        raise ValueError(
+            "TxSettings requires designated initializers (.member = value), "
+            f"got {settings_str!r}"
+        )
+
+    return settings
+
+
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
-                    'uint256{}', 'createAcct', '({...})']
+                   ['ttPAYMENT', '0', 'Payment',
+                    '({.privileges = Privilege::CreateAcct})', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 7:
+    if len(args_list) < 5:
         raise ValueError(
-            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    delegable = args_list[3]
-    amendments = args_list[4]
-    privileges = args_list[5]
+    settings = parse_settings(args_list[3])
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -84,9 +146,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": delegable,
-        "amendments": amendments,
-        "privileges": privileges,
+        "delegable": settings["delegable"],
+        "amendments": settings["amendment"],
+        "privileges": settings["privileges"],
         "fields": fields,
     }
 

conanfile.py

@@ -149,6 +149,7 @@ class Xrpl(ConanFile):
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
+        "bin/default-loader-path.sh",
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",

crates/Cargo.lock

@@ -57,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
+checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
 dependencies = [
  "cc",
  "cxx-build",
@@ -72,9 +72,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
+checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -87,9 +87,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
+checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -101,15 +101,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
+checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
+checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
 dependencies = [
  "indexmap",
  "proc-macro2",

crates/Cargo.toml

@@ -8,6 +8,9 @@ cxx = { version = "1.0.198", features = ["c++20"] }
 [workspace.package]
 edition = "2024"
 
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage_nightly)' ] }
+
 [profile.release]
 opt-level = 3
 overflow-checks = true

crates/hello_world/Cargo.toml

@@ -8,3 +8,6 @@ crate-type = ["staticlib"]
 
 [dependencies]
 cxx.workspace = true
+
+[lints]
+workspace = true

crates/hello_world/src/lib.rs

@@ -1,3 +1,5 @@
+#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
+
 #[cxx::bridge(namespace = "rs::hello_world")]
 mod ffi {
     extern "Rust" {
@@ -8,3 +10,14 @@ mod ffi {
 pub fn hello_world() -> String {
     "hello_world".to_string()
 }
+
+#[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hello_world_returns_hello_world() {
+        assert_eq!(hello_world(), "hello_world")
+    }
+}

docs/install.md

@@ -6,16 +6,17 @@
 
 `xrpld` is published as DEB and RPM packages for 64-bit x86 Linux.
 Use APT on Debian-based distributions such as Debian and Ubuntu,
-and YUM on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux.
+and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
+where `yum` is a symlink to `dnf`.
 To build from source instead, see [BUILD.md](../BUILD.md).
 
 ## Release channels
 
 Packages are published to four channels:
 
-- `stable` - the latest production release
-- `unstable` - release candidates
-- `experimental` - beta builds
+- `stable` - production releases
+- `rc` - release candidates
+- `beta` - beta builds
 - `develop` - every push to the [`develop` branch](https://github.com/XRPLF/rippled/tree/develop)
 
 See [Publishing packages](../package/README.md#publishing-packages) for how channels are produced.
@@ -65,7 +66,7 @@ wherever it appears in the repository configuration.
 4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \
+    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
         sudo tee /etc/apt/sources.list.d/xrplf.list
     ```
 
@@ -81,7 +82,7 @@ wherever it appears in the repository configuration.
     sudo apt -y install xrpld
     ```
 
-### With the YUM package manager
+### With the DNF package manager
 
 1.  Add the XRPL Foundation package-signing key:
 
@@ -92,26 +93,40 @@ wherever it appears in the repository configuration.
 2.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    cat << REPOFILE | sudo tee /etc/yum.repos.d/xrplf.repo
+    cat << 'REPOFILE' | sudo tee /etc/yum.repos.d/xrplf.repo
     [xrplf-stable]
     name=XRP Ledger Packages
     enabled=1
-    baseurl=https://packages.xrplf.org/repository/rpm-stable/
+    baseurl=https://packages.xrplf.org/repository/rpm-stable/$basearch/
     gpgcheck=1
-    repo_gpgcheck=0
+    repo_gpgcheck=1
     gpgkey=https://packages.xrplf.org/xrplf.asc
     REPOFILE
     ```
 
     `gpgcheck=1` verifies each package against the key above.
-    `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed.
+    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
 
 3.  Install the `xrpld` package:
 
     ```bash
-    sudo yum install -y xrpld
+    sudo dnf install -y xrpld
     ```
 
+### Optional: the assert-enabled build
+
+Every channel also carries `xrpld-assert` as a DEB, the same build with assertions
+enabled, for diagnosing a problem on a non-production server.
+It installs the same files as `xrpld` and replaces it, so install one or the other:
+
+```bash
+sudo apt -y install xrpld-assert # APT removes xrpld itself
+```
+
+Switching stops the service, since it is a removal and an installation rather than an upgrade,
+and APT starts it again.
+Install `xrpld` the same way to switch back.
+
 ## The xrpld service
 
 Both package managers install a systemd unit and enable it, so `xrpld` starts on boot.
@@ -121,7 +136,7 @@ Check whether it is already running:
 systemctl status xrpld.service
 ```
 
-The APT packages start it immediately as well; the YUM packages do not, so start it yourself:
+The DEB packages start it immediately as well; the RPM packages do not, so start it yourself:
 
 ```bash
 sudo systemctl start xrpld.service

include/xrpl/basics/IntrusivePointer.h

@@ -86,12 +86,16 @@ public:
         requires std::convertible_to<TT*, T*>
     SharedIntrusive(SharedIntrusive<TT> const& rhs);
 
-    SharedIntrusive(SharedIntrusive&& rhs);
+    // noexcept so that a std::vector of these relocates by moving. Without it, move_if_noexcept
+    // copies each element instead, since this type is also copy constructible, and every copy is an
+    // atomic increment on the pointee's refcount followed by a release on the original. The body is
+    // a std::exchange on a raw pointer, so it provably cannot throw.
+    SharedIntrusive(SharedIntrusive&& rhs) noexcept;
 
     template <class TT>
         requires std::convertible_to<TT*, T*>
-    SharedIntrusive(
-        SharedIntrusive<TT>&& rhs);  // NOLINT(cppcoreguidelines-rvalue-reference-param-not-moved)
+    // NOLINTNEXTLINE(cppcoreguidelines-rvalue-reference-param-not-moved)
+    SharedIntrusive(SharedIntrusive<TT>&& rhs) noexcept;
 
     SharedIntrusive&
     operator=(SharedIntrusive const& rhs);
@@ -529,11 +533,48 @@ staticPointerCast(TT const& v)
     return SharedPtr<T>(StaticCastTagSharedIntrusive{}, v);
 }
 
+/**
+ * Statically cast an intrusive pointer the caller is giving up, moving out of
+ * it.
+ *
+ * The parameter names the wrapped type rather than taking a bare `TT&&`. A
+ * bare one would be a forwarding reference, so it would also bind to lvalues
+ * in preference to the `const&` overload above and move out of a caller's live
+ * variable on what looks like a copy call.
+ *
+ * @param v the pointer to cast, left empty afterwards.
+ * @return a pointer of the requested type to the same object.
+ */
+template <class T, class TT>
+SharedPtr<T>
+staticPointerCast(SharedIntrusive<TT>&& v)
+{
+    return SharedPtr<T>(StaticCastTagSharedIntrusive{}, std::move(v));
+}
+
 template <class T, class TT>
 SharedPtr<T>
 dynamicPointerCast(TT const& v)
 {
     return SharedPtr<T>(DynamicCastTagSharedIntrusive{}, v);
 }
+
+/**
+ * Dynamically cast an intrusive pointer the caller is giving up, moving out of
+ * it.
+ *
+ * Tied to `SharedIntrusive<TT>&&` for the reason given above.
+ *
+ * @param v the pointer to cast, left empty afterwards if the cast succeeds and
+ *          left owning the object if it does not.
+ * @return a pointer of the requested type, or an empty one if the object is
+ *         not of that type.
+ */
+template <class T, class TT>
+SharedPtr<T>
+dynamicPointerCast(SharedIntrusive<TT>&& v)
+{
+    return SharedPtr<T>(DynamicCastTagSharedIntrusive{}, std::move(v));
+}
 }  // namespace intr_ptr
 }  // namespace xrpl

include/xrpl/basics/IntrusivePointer.ipp

@@ -43,7 +43,7 @@ SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT> const& rhs)
 }
 
 template <class T>
-SharedIntrusive<T>::SharedIntrusive(SharedIntrusive&& rhs)
+SharedIntrusive<T>::SharedIntrusive(SharedIntrusive&& rhs) noexcept
     : ptr_{std::move(rhs).unsafeExchange(nullptr)}
 {
 }
@@ -51,7 +51,7 @@ SharedIntrusive<T>::SharedIntrusive(SharedIntrusive&& rhs)
 template <class T>
 template <class TT>
     requires std::convertible_to<TT*, T*>
-SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT>&& rhs)
+SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT>&& rhs) noexcept
     : ptr_{std::move(rhs).unsafeExchange(nullptr)}
 {
 }

include/xrpl/basics/StringUtilities.h

@@ -162,4 +162,89 @@ toUInt64(std::string const& s);
 bool
 isProperlyFormedTomlDomain(std::string_view domain);
 
+/**
+ * Whether a view can be passed on as a C string.
+ *
+ * A reader given only data() stops at the first null, so the view must reach the
+ * terminating null. The test rebuilds the view from data() and compares: a view
+ * that stops earlier rebuilds longer, and so compares unequal.
+ *
+ * consteval because reading the byte after the view is only defined when @p str
+ * points into storage holding a null at or after its end, such as a string
+ * literal. An unterminated view is then a compile error, not an out-of-bounds
+ * read.
+ *
+ * @param str The view to test.
+ * @return Whether @p str is null-terminated. A view with no data is not.
+ */
+consteval bool
+isNullTerminated(std::string_view str)
+{
+    if (str.data() == nullptr)
+        return false;
+
+    // Reading past the view is the point, so the usual data() warning does not
+    // apply.
+    // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+    return std::string_view{str.data()} == str;
+}
+
+/**
+ * A string that is known to reach its terminating null.
+ *
+ * Converts to std::string_view, so it compares and hashes as one. Unlike a
+ * view, asCString() may be handed to a reader that expects a C string, such
+ * as json::StaticString.
+ *
+ * The only constructor is consteval and rejects a view that stops before the
+ * null, so the property holds by construction and no caller asserts it.
+ */
+class NullTerminatedView
+{
+public:
+    /**
+     * Build a view from one that reaches its terminating null.
+     *
+     * Explicit, so that a plain view cannot become a proof of termination by
+     * accident. The conversion the other way stays implicit.
+     *
+     * @param view The string to hold. Rejected at compile time if it stops
+     *        before its terminating null, or has no data.
+     */
+    explicit consteval NullTerminatedView(std::string_view view)
+        : data_(view.data()), size_(view.size())
+    {
+        if (!isNullTerminated(view))
+            throw "xrpl::NullTerminatedView : view does not reach a null";
+    }
+
+    constexpr
+    operator std::string_view() const noexcept
+    {
+        return view();
+    }
+
+    /**
+     * @return The string as a view.
+     */
+    [[nodiscard]] constexpr std::string_view
+    view() const noexcept
+    {
+        return {data_, size_};
+    }
+
+    /**
+     * @return The string as a C string. Never null.
+     */
+    [[nodiscard]] constexpr char const*
+    asCString() const noexcept
+    {
+        return data_;
+    }
+
+private:
+    char const* data_;
+    std::size_t size_;
+};
+
 }  // namespace xrpl

include/xrpl/basics/base_uint.h

@@ -518,7 +518,7 @@ public:
      * The input must be precisely `2 * bytes` hexadecimal characters
      * long, with one exception: the value '0'.
      *
-     * @param sv A null-terminated string of hexadecimal characters
+     * @param sv A string of hexadecimal characters
      * @return true if the input was parsed properly; false otherwise.
      */
     [[nodiscard]] constexpr bool

include/xrpl/beast/net/IPAddress.h

@@ -103,7 +103,7 @@ namespace boost {
 template <>
 struct hash<::beast::ip::Address>
 {
-    explicit hash() = default;
+    hash() = default;
 
     std::size_t
     operator()(::beast::ip::Address const& addr) const

include/xrpl/config/Constants.h

@@ -125,6 +125,7 @@ struct Keys
     static constexpr auto kMaximumTxnInLedger = "maximum_txn_in_ledger";
     static constexpr auto kMaximumTxnPerAccount = "maximum_txn_per_account";
     static constexpr auto kMemoryLevel = "memory_level";
+    static constexpr auto kMaxWaitingLedgers = "max_waiting_ledgers";
     static constexpr auto kMinLedgersToComputeSizeLimit = "min_ledgers_to_compute_size_limit";
     static constexpr auto kMinimumEscalationMultiplier = "minimum_escalation_multiplier";
     static constexpr auto kMinimumLastLedgerBuffer = "minimum_last_ledger_buffer";

include/xrpl/core/HashRouter.h

@@ -34,7 +34,10 @@ enum class HashRouterFlags : std::uint16_t {
     PRIVATE4 = 0x0800,
     // Used in EscrowFinish.cpp
     PRIVATE5 = 0x1000,
-    PRIVATE6 = 0x2000
+    PRIVATE6 = 0x2000,
+    // Used in apply.cpp
+    PRIVATE7 = 0x4000,
+    PRIVATE8 = 0x8000
 };
 
 constexpr HashRouterFlags

include/xrpl/core/PerfLog.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/basics/StringUtilities.h>
 #include <xrpl/core/Job.h>
 #include <xrpl/json/json_value.h>
 
@@ -9,7 +10,8 @@
 #include <filesystem>
 #include <functional>
 #include <memory>
-#include <string>
+#include <span>
+#include <string_view>
 
 namespace beast {
 class Journal;
@@ -67,7 +69,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcStart(std::string const& method, std::uint64_t requestId) = 0;
+    rpcStart(std::string_view method, std::uint64_t requestId) = 0;
 
     /**
      * Log successful finish of RPC call
@@ -76,7 +78,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcFinish(std::string const& method, std::uint64_t requestId) = 0;
+    rpcFinish(std::string_view method, std::uint64_t requestId) = 0;
 
     /**
      * Log errored RPC call
@@ -85,7 +87,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcError(std::string const& method, std::uint64_t requestId) = 0;
+    rpcError(std::string_view method, std::uint64_t requestId) = 0;
 
     /**
      * Log queued job
@@ -150,10 +152,20 @@ public:
 PerfLog::Setup
 setupPerfLog(Section const& section, std::filesystem::path const& configDir);
 
+/**
+ * @param methodNames The RPC methods to count, one counter per name. Reported
+ *        as JSON keys that borrow each name and read it as a C string, which is
+ *        why the parameter type requires one that reaches its terminating null.
+ *        The names must outlive the returned object, which holds views of them.
+ *        The range itself need not: it is copied.
+ *        Passed in rather than looked up here, so that this layer needs no
+ *        knowledge of the dispatch table.
+ */
 std::unique_ptr<PerfLog>
 makePerfLog(
     PerfLog::Setup const& setup,
     Application& app,
+    std::span<NullTerminatedView const> methodNames,
     beast::Journal journal,
     std::function<void()>&& signalStop);
 
@@ -161,7 +173,7 @@ template <typename Func, class Rep, class Period>
 auto
 measureDurationAndLog(
     Func&& func,
-    std::string const& actionDescription,
+    std::string_view actionDescription,
     std::chrono::duration<Rep, Period> maxDelay,
     beast::Journal const& journal)
 {

include/xrpl/ledger/View.h

@@ -24,6 +24,7 @@
 #include <optional>
 #include <set>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
@@ -198,7 +199,10 @@ dirLink(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials passed in to already exist in the ledger, and
+ *      returns an internal error otherwise. Validate them beforehand with
+ *      credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -209,7 +213,8 @@ canWithdraw(
     AccountID const& to,
     SLE::const_ref toSle,
     STAmount const& amount,
-    bool hasDestinationTag);
+    bool hasDestinationTag,
+    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
@@ -222,7 +227,10 @@ canWithdraw(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials passed in to already exist in the ledger, and
+ *      returns an internal error otherwise. Validate them beforehand with
+ *      credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -232,20 +240,25 @@ canWithdraw(
     AccountID const& from,
     AccountID const& to,
     STAmount const& amount,
-    bool hasDestinationTag);
+    bool hasDestinationTag,
+    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
- * destination account (sfDestination).
+ * destination account (sfDestination). Credentials, if any, are taken from the
+ * transaction's sfCredentialIDs field.
  *
  *    - Checks that the receiver account exists.
  *    - If the receiver requires a destination tag, check that one exists, even
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials in sfCredentialIDs to already exist in the
+ *      ledger, and returns an internal error otherwise. Validate them
+ *      beforehand with credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */

include/xrpl/ledger/entries/AMMEntry.h

@@ -0,0 +1,45 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class AMMEntry : public SLEBase<ViewT, ltAMM>
+{
+public:
+    using Base = SLEBase<ViewT, ltAMM>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit AMMEntry(
+        Asset const& issue1,
+        Asset const& issue2,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::amm(issue1, issue2), view, j)
+    {
+    }
+
+    explicit AMMEntry(
+        uint256 const& ammID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::amm(ammID), view, j)
+    {
+    }
+};
+
+using AMMEntryR = AMMEntry<ReadView>;
+using AMMEntryW = AMMEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/AccountRootEntry.h

@@ -0,0 +1,35 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class AccountRootEntry : public SLEBase<ViewT, ltACCOUNT_ROOT>
+{
+public:
+    using Base = SLEBase<ViewT, ltACCOUNT_ROOT>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit AccountRootEntry(
+        AccountID const& id,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::account(id), view, j)
+    {
+    }
+};
+
+using AccountRootEntryR = AccountRootEntry<ReadView>;
+using AccountRootEntryW = AccountRootEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/AmendmentsEntry.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class AmendmentsEntry : public SLEBase<ViewT, ltAMENDMENTS>
+{
+public:
+    using Base = SLEBase<ViewT, ltAMENDMENTS>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit AmendmentsEntry(
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::amendments(), view, j)
+    {
+    }
+};
+
+using AmendmentsEntryR = AmendmentsEntry<ReadView>;
+using AmendmentsEntryW = AmendmentsEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/BridgeEntry.h

@@ -0,0 +1,36 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/STXChainBridge.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class BridgeEntry : public SLEBase<ViewT, ltBRIDGE>
+{
+public:
+    using Base = SLEBase<ViewT, ltBRIDGE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit BridgeEntry(
+        STXChainBridge const& bridge,
+        STXChainBridge::ChainType chainType,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::bridge(bridge, chainType), view, j)
+    {
+    }
+};
+
+using BridgeEntryR = BridgeEntry<ReadView>;
+using BridgeEntryW = BridgeEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/CheckEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class CheckEntry : public SLEBase<ViewT, ltCHECK>
+{
+public:
+    using Base = SLEBase<ViewT, ltCHECK>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit CheckEntry(
+        AccountID const& id,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::check(id, seq), view, j)
+    {
+    }
+
+    explicit CheckEntry(
+        uint256 const& checkID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::check(checkID), view, j)
+    {
+    }
+};
+
+using CheckEntryR = CheckEntry<ReadView>;
+using CheckEntryW = CheckEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/CredentialEntry.h

@@ -0,0 +1,47 @@
+#pragma once
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class CredentialEntry : public SLEBase<ViewT, ltCREDENTIAL>
+{
+public:
+    using Base = SLEBase<ViewT, ltCREDENTIAL>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit CredentialEntry(
+        AccountID const& subject,
+        AccountID const& issuer,
+        Slice const& credType,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::credential(subject, issuer, credType), view, j)
+    {
+    }
+
+    explicit CredentialEntry(
+        uint256 const& credentialID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::credential(credentialID), view, j)
+    {
+    }
+};
+
+using CredentialEntryR = CredentialEntry<ReadView>;
+using CredentialEntryW = CredentialEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/DIDEntry.h

@@ -0,0 +1,35 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class DIDEntry : public SLEBase<ViewT, ltDID>
+{
+public:
+    using Base = SLEBase<ViewT, ltDID>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit DIDEntry(
+        AccountID const& account,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::did(account), view, j)
+    {
+    }
+};
+
+using DIDEntryR = DIDEntry<ReadView>;
+using DIDEntryW = DIDEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/DelegateEntry.h

@@ -0,0 +1,36 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class DelegateEntry : public SLEBase<ViewT, ltDELEGATE>
+{
+public:
+    using Base = SLEBase<ViewT, ltDELEGATE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit DelegateEntry(
+        AccountID const& account,
+        AccountID const& authorizedAccount,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::delegate(account, authorizedAccount), view, j)
+    {
+    }
+};
+
+using DelegateEntryR = DelegateEntry<ReadView>;
+using DelegateEntryW = DelegateEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/DepositPreauthEntry.h

@@ -0,0 +1,58 @@
+#pragma once
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+#include <set>
+#include <utility>
+
+namespace xrpl {
+
+template <typename ViewT>
+class DepositPreauthEntry : public SLEBase<ViewT, ltDEPOSIT_PREAUTH>
+{
+public:
+    using Base = SLEBase<ViewT, ltDEPOSIT_PREAUTH>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit DepositPreauthEntry(
+        AccountID const& owner,
+        AccountID const& preauthorized,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::depositPreauth(owner, preauthorized), view, j)
+    {
+    }
+
+    explicit DepositPreauthEntry(
+        AccountID const& owner,
+        std::set<std::pair<AccountID, Slice>> const& authCreds,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::depositPreauth(owner, authCreds), view, j)
+    {
+    }
+
+    explicit DepositPreauthEntry(
+        uint256 const& preauthID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::depositPreauth(preauthID), view, j)
+    {
+    }
+};
+
+using DepositPreauthEntryR = DepositPreauthEntry<ReadView>;
+using DepositPreauthEntryW = DepositPreauthEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/DirectoryNodeEntry.h

@@ -0,0 +1,50 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+template <typename ViewT>
+class DirectoryNodeEntry : public SLEBase<ViewT, ltDIR_NODE>
+{
+public:
+    using Base = SLEBase<ViewT, ltDIR_NODE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit DirectoryNodeEntry(
+        AccountID const& id,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::ownerDir(id), view, j)
+    {
+    }
+
+    /**
+     * Resolve a specific page of the directory rooted at @p root.
+     */
+    explicit DirectoryNodeEntry(
+        uint256 const& root,
+        std::uint64_t index,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::page(root, index), view, j)
+    {
+    }
+};
+
+using DirectoryNodeEntryR = DirectoryNodeEntry<ReadView>;
+using DirectoryNodeEntryW = DirectoryNodeEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/EscrowEntry.h

@@ -0,0 +1,37 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class EscrowEntry : public SLEBase<ViewT, ltESCROW>
+{
+public:
+    using Base = SLEBase<ViewT, ltESCROW>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit EscrowEntry(
+        AccountID const& src,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::escrow(src, seq), view, j)
+    {
+    }
+};
+
+using EscrowEntryR = EscrowEntry<ReadView>;
+using EscrowEntryW = EscrowEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/FeeSettingsEntry.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class FeeSettingsEntry : public SLEBase<ViewT, ltFEE_SETTINGS>
+{
+public:
+    using Base = SLEBase<ViewT, ltFEE_SETTINGS>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit FeeSettingsEntry(
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::feeSettings(), view, j)
+    {
+    }
+};
+
+using FeeSettingsEntryR = FeeSettingsEntry<ReadView>;
+using FeeSettingsEntryW = FeeSettingsEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/LedgerHashesEntry.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class LedgerHashesEntry : public SLEBase<ViewT, ltLEDGER_HASHES>
+{
+public:
+    using Base = SLEBase<ViewT, ltLEDGER_HASHES>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit LedgerHashesEntry(
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::skip(), view, j)
+    {
+    }
+};
+
+using LedgerHashesEntryR = LedgerHashesEntry<ReadView>;
+using LedgerHashesEntryW = LedgerHashesEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/LoanBrokerEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class LoanBrokerEntry : public SLEBase<ViewT, ltLOAN_BROKER>
+{
+public:
+    using Base = SLEBase<ViewT, ltLOAN_BROKER>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit LoanBrokerEntry(
+        AccountID const& owner,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::loanBroker(owner, seq), view, j)
+    {
+    }
+
+    explicit LoanBrokerEntry(
+        uint256 const& loanBrokerID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::loanBroker(loanBrokerID), view, j)
+    {
+    }
+};
+
+using LoanBrokerEntryR = LoanBrokerEntry<ReadView>;
+using LoanBrokerEntryW = LoanBrokerEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/LoanEntry.h

@@ -0,0 +1,45 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class LoanEntry : public SLEBase<ViewT, ltLOAN>
+{
+public:
+    using Base = SLEBase<ViewT, ltLOAN>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit LoanEntry(
+        uint256 const& loanBrokerID,
+        SeqProxy const& loanSeq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::loan(loanBrokerID, loanSeq), view, j)
+    {
+    }
+
+    explicit LoanEntry(
+        uint256 const& loanID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::loan(loanID), view, j)
+    {
+    }
+};
+
+using LoanEntryR = LoanEntry<ReadView>;
+using LoanEntryW = LoanEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/MPTokenEntry.h

@@ -0,0 +1,55 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/UintTypes.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class MPTokenEntry : public SLEBase<ViewT, ltMPTOKEN>
+{
+public:
+    using Base = SLEBase<ViewT, ltMPTOKEN>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit MPTokenEntry(
+        MPTID const& issuanceID,
+        AccountID const& holder,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::mptoken(issuanceID, holder), view, j)
+    {
+    }
+
+    explicit MPTokenEntry(
+        uint256 const& issuanceKey,
+        AccountID const& holder,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::mptoken(issuanceKey, holder), view, j)
+    {
+    }
+
+    explicit MPTokenEntry(
+        uint256 const& mptokenKey,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::mptoken(mptokenKey), view, j)
+    {
+    }
+};
+
+using MPTokenEntryR = MPTokenEntry<ReadView>;
+using MPTokenEntryW = MPTokenEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/MPTokenIssuanceEntry.h

@@ -0,0 +1,56 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+template <typename ViewT>
+class MPTokenIssuanceEntry : public SLEBase<ViewT, ltMPTOKEN_ISSUANCE>
+{
+public:
+    using Base = SLEBase<ViewT, ltMPTOKEN_ISSUANCE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit MPTokenIssuanceEntry(
+        std::uint32_t seq,
+        AccountID const& issuer,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::mptokenIssuance(makeMptID(seq, issuer)), view, j)
+    {
+    }
+
+    explicit MPTokenIssuanceEntry(
+        MPTID const& issuanceID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::mptokenIssuance(issuanceID), view, j)
+    {
+    }
+
+    explicit MPTokenIssuanceEntry(
+        uint256 const& issuanceKey,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::mptokenIssuance(issuanceKey), view, j)
+    {
+    }
+};
+
+using MPTokenIssuanceEntryR = MPTokenIssuanceEntry<ReadView>;
+using MPTokenIssuanceEntryW = MPTokenIssuanceEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/NFTokenOfferEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class NFTokenOfferEntry : public SLEBase<ViewT, ltNFTOKEN_OFFER>
+{
+public:
+    using Base = SLEBase<ViewT, ltNFTOKEN_OFFER>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit NFTokenOfferEntry(
+        AccountID const& owner,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::nftokenOffer(owner, seq), view, j)
+    {
+    }
+
+    explicit NFTokenOfferEntry(
+        uint256 const& offerID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::nftokenOffer(offerID), view, j)
+    {
+    }
+};
+
+using NFTokenOfferEntryR = NFTokenOfferEntry<ReadView>;
+using NFTokenOfferEntryW = NFTokenOfferEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/NFTokenPageEntry.h

@@ -0,0 +1,37 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class NFTokenPageEntry : public SLEBase<ViewT, ltNFTOKEN_PAGE>
+{
+public:
+    using Base = SLEBase<ViewT, ltNFTOKEN_PAGE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit NFTokenPageEntry(
+        Keylet const& page,
+        uint256 const& token,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::nftokenPage(page, token), view, j)
+    {
+    }
+};
+
+using NFTokenPageEntryR = NFTokenPageEntry<ReadView>;
+using NFTokenPageEntryW = NFTokenPageEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/NegativeUNLEntry.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class NegativeUNLEntry : public SLEBase<ViewT, ltNEGATIVE_UNL>
+{
+public:
+    using Base = SLEBase<ViewT, ltNEGATIVE_UNL>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit NegativeUNLEntry(
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::negativeUNL(), view, j)
+    {
+    }
+};
+
+using NegativeUNLEntryR = NegativeUNLEntry<ReadView>;
+using NegativeUNLEntryW = NegativeUNLEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/OfferEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class OfferEntry : public SLEBase<ViewT, ltOFFER>
+{
+public:
+    using Base = SLEBase<ViewT, ltOFFER>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit OfferEntry(
+        AccountID const& id,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::offer(id, seq), view, j)
+    {
+    }
+
+    explicit OfferEntry(
+        uint256 const& offerID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::offer(offerID), view, j)
+    {
+    }
+};
+
+using OfferEntryR = OfferEntry<ReadView>;
+using OfferEntryW = OfferEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/OracleEntry.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+template <typename ViewT>
+class OracleEntry : public SLEBase<ViewT, ltORACLE>
+{
+public:
+    using Base = SLEBase<ViewT, ltORACLE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit OracleEntry(
+        AccountID const& account,
+        std::uint32_t documentID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::oracle(account, documentID), view, j)
+    {
+    }
+};
+
+using OracleEntryR = OracleEntry<ReadView>;
+using OracleEntryW = OracleEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/PayChannelEntry.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class PayChannelEntry : public SLEBase<ViewT, ltPAYCHAN>
+{
+public:
+    using Base = SLEBase<ViewT, ltPAYCHAN>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit PayChannelEntry(
+        AccountID const& src,
+        AccountID const& dst,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::payChannel(src, dst, seq), view, j)
+    {
+    }
+};
+
+using PayChannelEntryR = PayChannelEntry<ReadView>;
+using PayChannelEntryW = PayChannelEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/PermissionedDomainEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class PermissionedDomainEntry : public SLEBase<ViewT, ltPERMISSIONED_DOMAIN>
+{
+public:
+    using Base = SLEBase<ViewT, ltPERMISSIONED_DOMAIN>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit PermissionedDomainEntry(
+        AccountID const& account,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::permissionedDomain(account, seq), view, j)
+    {
+    }
+
+    explicit PermissionedDomainEntry(
+        uint256 const& domainID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::permissionedDomain(domainID), view, j)
+    {
+    }
+};
+
+using PermissionedDomainEntryR = PermissionedDomainEntry<ReadView>;
+using PermissionedDomainEntryW = PermissionedDomainEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/RippleStateEntry.h

@@ -0,0 +1,48 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/UintTypes.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class RippleStateEntry : public SLEBase<ViewT, ltRIPPLE_STATE>
+{
+public:
+    using Base = SLEBase<ViewT, ltRIPPLE_STATE>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit RippleStateEntry(
+        AccountID const& id0,
+        AccountID const& id1,
+        Currency const& currency,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::trustLine(id0, id1, currency), view, j)
+    {
+    }
+
+    explicit RippleStateEntry(
+        AccountID const& id,
+        Issue const& issue,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::trustLine(id, issue), view, j)
+    {
+    }
+};
+
+using RippleStateEntryR = RippleStateEntry<ReadView>;
+using RippleStateEntryW = RippleStateEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/SLEBase.h

@@ -0,0 +1,503 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+
+#include <concepts>
+#include <memory>
+#include <stdexcept>
+#include <type_traits>
+#include <utility>
+
+namespace xrpl {
+
+// Concept to distinguish read-only vs writable view types
+template <typename V>
+concept IsWritableView = std::derived_from<V, ApplyView>;
+
+namespace detail {
+
+/**
+ * Resolves a keylet for a read-only entry.
+ *
+ * ReadView::read() on an ApplyView returns the underlying ledger's entry
+ * whenever the view is not already tracking one, while peek() installs the
+ * view's own copy and returns that. A read-only entry built with read()
+ * would therefore hold an SLE that goes stale the moment anything peeks the
+ * same key and modifies it. Resolve through peek() whenever the view really is
+ * an ApplyView, so every entry over that view shares one SLE.
+ *
+ * @note The const_cast is what makes reaching ApplyView::peek() possible, and
+ *       it is defined behavior only when the view really is a non-const
+ *       object that the caller merely observes through a const reference.
+ *       That holds for every production view today, but it is not a
+ *       guarantee the codebase makes: the unit tests already build
+ *       genuinely const ApplyView-derived objects (`Sandbox const` in
+ *       Directory_test.cpp and View_test.cpp, `PaymentSandbox const` in
+ *       TheoreticalQuality_test.cpp and View_test.cpp). Constructing a
+ *       read-only entry over one of those would be undefined behavior, so
+ *       do not, until #8069 removes the cast -- by giving ApplyView a
+ *       const-qualified peek(), which needs no amendment because
+ *       Action::Cache is invisible to apply(), visit() and metadata.
+ *
+ * @note Consequently a "read-only" entry over an ApplyView is not free of
+ *       side effects: peek() installs an Action::Cache entry in the apply
+ *       state table. That is benign for transaction metadata -- Cache entries
+ *       are skipped in ApplyStateTable::apply(), ::visit() and in metadata
+ *       generation -- but it does cost one deep SLE copy on first touch.
+ */
+inline SLE::const_pointer
+resolveEntry(ReadView const& view, Keylet const& key)
+{
+    // Safe only for a view that is not itself a const object -- see the
+    // note above. The entry holds a const reference because it does not
+    // modify the view, not because the view is const.
+    // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
+    if (auto const applyView = dynamic_cast<ApplyView*>(const_cast<ReadView*>(&view)))
+        return applyView->peek(key);
+    return view.read(key);
+}
+
+}  // namespace detail
+
+/**
+ * View-parameterized base class for all ledger entries.
+ *
+ * SLEBase<ReadView>  — read-only:  holds shared_ptr<SLE const> + ReadView const&
+ * SLEBase<ApplyView> — writable:   holds shared_ptr<SLE> + ApplyView& + Keylet,
+ *                                   plus insert/update/erase operations
+ *
+ * Write-only members are gated by `requires` clauses, providing compile-time
+ * guarantees that read-only entries cannot mutate state.
+ *
+ * @tparam EntryType the ledger entry type this entry is statically bound to.
+ * Derived per-type entries pass their own type (e.g. ltACCOUNT_ROOT); the
+ * generic ReadOnlySLE / WritableSLE aliases leave it at ltANY, which opts out
+ * of the static type check. Binding the type here is what keeps an entry for
+ * one entry type from being constructed or converted from another -- see the
+ * converting constructor below.
+ *
+ * Derived classes should provide domain-specific accessors that hide
+ * implementation details of the underlying ledger entry format.
+ */
+template <typename ViewT, LedgerEntryType EntryType = ltANY>
+class SLEBase
+{
+public:
+    static constexpr bool kIsWritable = IsWritableView<ViewT>;
+
+    // The ledger entry type this entry is bound to, and whether that binding
+    // is meaningful (ltANY means "any type", i.e. no static check).
+    static constexpr LedgerEntryType kEntryType = EntryType;
+    static constexpr bool kIsTyped = (EntryType != ltANY);
+
+    // SLE pointer type: mutable for writable views, const for read-only
+    using SlePtrType = std::conditional_t<kIsWritable, SLE::pointer, SLE::const_pointer>;
+
+    // View reference type: ApplyView& for writable, ReadView const& for
+    // read-only
+    using ViewRefType = std::conditional_t<kIsWritable, ApplyView&, ReadView const&>;
+
+    // Non-virtual by design: these entries are parameterized on the view and
+    // entry type, never used polymorphically through a base pointer. A vptr
+    // would be 8 bytes of pure overhead on a type meant to be as cheap as the
+    // shared_ptr it wraps. See the static_assert below the class.
+    //
+    // The destructor is public because the ReadOnlySLE / WritableSLE aliases
+    // name this class directly and are used as value types. Since it is not
+    // virtual, never delete a derived entry through an SLEBase*.
+    ~SLEBase() = default;
+
+    SLEBase(SLEBase const&)
+        requires(!kIsWritable)
+    = default;
+    SLEBase(SLEBase&&) = default;
+    SLEBase&
+    operator=(SLEBase const&) = delete;
+    SLEBase&
+    operator=(SLEBase&&) = delete;
+    SLEBase() = delete;
+
+    // --- Constructors that adopt/resolve an SLE (public so the ReadOnlySLE /
+    //     WritableSLE aliases and the per-type entries can be built directly
+    //     from a keylet, or -- read-only only -- from an already-fetched
+    //     SLE). ---
+
+    /**
+     * Constructor for read-only context (adopt an already-fetched SLE).
+     *
+     * There is deliberately no writable equivalent: a writable entry needs
+     * a Keylet so that newSLE() can still build an entry when none exists,
+     * and that cannot be recovered from a null SLE.
+     */
+    explicit SLEBase(
+        SLE::const_pointer sle,
+        ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        requires(!kIsWritable)
+        : view_(view), sle_(std::move(sle)), j_(j)
+    {
+        XRPL_ASSERT(
+            !kIsTyped || !sle_ || sle_->getType() == kEntryType,
+            "xrpl::SLEBase::SLEBase : adopted SLE matches bound entry type");
+    }
+
+    /**
+     * Constructor for read-only context (read from view by keylet)
+     */
+    explicit SLEBase(
+        Keylet const& key,
+        ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        requires(!kIsWritable)
+        : view_(view), sle_(detail::resolveEntry(view, key)), j_(j)
+    {
+        XRPL_ASSERT(
+            !kIsTyped || key.type == kEntryType,
+            "xrpl::SLEBase::SLEBase : keylet matches bound entry type");
+    }
+
+    /**
+     * Converting constructor: writable → read-only.
+     *
+     * Enables implicit conversion from SLEBase<ApplyView> to
+     * SLEBase<ReadView>, so functions taking ReadOnlySLE const& can accept
+     * WritableSLE.
+     *
+     * Constrained to the same entry type (or to a ltANY target, i.e. widening
+     * a typed entry to a generic ReadOnlySLE). The constraint is load-bearing:
+     * this constructor is inherited into every per-type entry, and unconstrained
+     * it would bind any writable entry that slices to SLEBase, so an OfferEntryW
+     * would convert to an AccountRootEntryR with no cast at the call site.
+     */
+    template <typename OtherViewT, LedgerEntryType OtherType>
+    SLEBase(SLEBase<OtherViewT, OtherType> const& other)
+        requires(!kIsWritable && IsWritableView<OtherViewT> &&
+                 (OtherType == EntryType || EntryType == ltANY))
+        : view_(other.readView()), sle_(other.rawSle()), j_(other.journal())
+    {
+    }
+
+    /**
+     * Constructor for writable context (peek from view by keylet)
+     */
+    explicit SLEBase(
+        Keylet const& key,
+        ApplyView& view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        requires kIsWritable
+        : view_(view), key_(key), sle_(view_.peek(key)), j_(j)
+    {
+        XRPL_ASSERT(
+            !kIsTyped || key.type == kEntryType,
+            "xrpl::SLEBase::SLEBase : keylet matches bound entry type");
+    }
+
+    /**
+     * Constructor for writable context, for call sites that hold an
+     * ApplyViewContext (peek from ctx.view by keylet).
+     *
+     * ctx.tx is not retained: this exists purely so transactors can pass the
+     * context they already have instead of spelling out ctx.view. If an entry
+     * ever needs the applying transaction, store it here rather than adding
+     * another overload.
+     */
+    explicit SLEBase(
+        Keylet const& key,
+        ApplyViewContext const& ctx,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        requires kIsWritable
+        : SLEBase(key, ctx.view, j)
+    {
+    }
+
+    // --- Common interface (always available) ---
+
+    /**
+     * Returns true if the ledger entry exists
+     */
+    [[nodiscard]] bool
+    exists() const
+    {
+        return sle_ != nullptr;
+    }
+
+    /**
+     * Explicit conversion to bool for convenient existence checking
+     */
+    explicit
+    operator bool() const
+    {
+        return exists();
+    }
+
+    /**
+     * Returns the underlying SLE for read access.
+     *
+     * Prefer operator-> / operator* for field access; this is for the call
+     * sites that need the shared_ptr itself.
+     */
+    [[nodiscard]] SLE::const_pointer
+    rawSle() const
+    {
+        return sle_;
+    }
+
+    /**
+     * Returns the ledger entry type of this entry.
+     *
+     * For a per-type entry this is kEntryType, known at compile time and
+     * valid whether or not the entry exists. Only the generic ReadOnlySLE /
+     * WritableSLE aliases have to read it back out of the SLE.
+     *
+     * @throws std::logic_error for a generic (ltANY) entry if exists() is
+     *         false.
+     */
+    [[nodiscard]] LedgerEntryType
+    type() const
+    {
+        if constexpr (kIsTyped)
+        {
+            return kEntryType;
+        }
+        else
+        {
+            if (!exists())
+                Throw<std::logic_error>("xrpl::SLEBase::type : entry does not exist");
+            return sle_->getType();
+        }
+    }
+
+    /**
+     * Returns the keylet identifying this entry.
+     *
+     * Writable entries keep the keylet they were built from, so it is valid
+     * even before newSLE(). Read-only entries derive it from the SLE, which
+     * must therefore exist.
+     *
+     * @throws std::logic_error for a read-only entry if exists() is false.
+     */
+    [[nodiscard]] Keylet
+    keylet() const
+    {
+        if constexpr (kIsWritable)
+        {
+            return key_;
+        }
+        else
+        {
+            if (!exists())
+                Throw<std::logic_error>("xrpl::SLEBase::keylet : entry does not exist");
+            // Take the type from the SLE, not from kEntryType: the adopt-SLE
+            // constructor's type check is assert-only, so a Release build can
+            // be holding an SLE whose type disagrees with the binding, and the
+            // SLE is the one telling the truth.
+            return Keylet(sle_->getType(), sle_->key());
+        }
+    }
+
+    /**
+     * Returns the ledger key of this entry.
+     *
+     * @throws std::logic_error same as keylet(): for read-only entries,
+     *         if exists() is false.
+     */
+    [[nodiscard]] uint256
+    key() const
+    {
+        return keylet().key;
+    }
+
+    /**
+     * Returns the read view (always available; ApplyView inherits ReadView)
+     */
+    [[nodiscard]] ReadView const&
+    readView() const
+    {
+        return view_;
+    }
+
+    /**
+     * Const dereference operators (always available)
+     *
+     * @throws std::logic_error if exists() is false.
+     */
+    STLedgerEntry const*
+    operator->() const
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::operator-> : entry does not exist");
+        return sle_.get();
+    }
+
+    STLedgerEntry const&
+    operator*() const
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::operator* : entry does not exist");
+        return *sle_;
+    }
+
+    // --- Writable interface (compile-time gated) ---
+    //
+    // Everything that hands out mutable access (or mutates) is non-const, so
+    // that a `FooEntryW const&` is as inert as a `FooEntryR`. Use readView()
+    // when a const entry only needs to inspect the view.
+
+    /**
+     * Returns the underlying SLE for write access.
+     *
+     * Prefer operator-> / operator* for field access; this is for the call
+     * sites that need the shared_ptr itself.
+     */
+    [[nodiscard]] SlePtrType const&
+    mutableRawSle()
+        requires kIsWritable
+    {
+        return sle_;
+    }
+
+    /**
+     * Returns the apply view for write operations
+     */
+    [[nodiscard]] ApplyView&
+    applyView()
+        requires kIsWritable
+    {
+        return view_;
+    }
+
+    /**
+     * Mutable dereference operators
+     *
+     * @throws std::logic_error if exists() is false.
+     */
+    STLedgerEntry*
+    operator->()
+        requires kIsWritable
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::operator-> : entry does not exist");
+        return sle_.get();
+    }
+
+    STLedgerEntry&
+    operator*()
+        requires kIsWritable
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::operator* : entry does not exist");
+        return *sle_;
+    }
+
+    /**
+     * Inserts the entry into the view.
+     *
+     * @throws std::logic_error if exists() is false.
+     */
+    void
+    insert()
+        requires kIsWritable
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::insert : entry does not exist");
+        view_.insert(sle_);
+    }
+
+    /**
+     * Erases the entry from the view.
+     *
+     * Drops the SLE afterwards, so the entry reports !exists() and any
+     * further use throws here rather than either throwing from deep inside
+     * ApplyStateTable or -- worse -- silently succeeding. For an
+     * entry that already existed, ApplyStateTable::erase keeps holding this
+     * exact SLE and builds the DeletedNode's FinalFields from it, so a write
+     * through the entry after erase() would land in transaction metadata
+     * with no diagnostic at all.
+     *
+     * @throws std::logic_error if exists() is false.
+     */
+    void
+    erase()
+        requires kIsWritable
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::erase : entry does not exist");
+        view_.erase(sle_);
+        sle_ = nullptr;
+    }
+
+    /**
+     * @throws std::logic_error if exists() is false.
+     */
+    void
+    update()
+        requires kIsWritable
+    {
+        if (!exists())
+            Throw<std::logic_error>("xrpl::SLEBase::update : entry does not exist");
+        view_.update(sle_);
+    }
+
+    /**
+     * @throws std::logic_error if exists() is true: newSLE() would otherwise
+     *         silently discard the SLE already held.
+     */
+    void
+    newSLE()
+        requires kIsWritable
+    {
+        if (exists())
+            Throw<std::logic_error>("xrpl::SLEBase::newSLE : entry already exists");
+        sle_ = std::make_shared<SLE>(key_);
+    }
+
+    [[nodiscard]] beast::Journal
+    journal() const
+    {
+        return j_;
+    }
+
+protected:
+    ViewRefType view_;
+
+    // Keylet is only meaningful for writable views, which need it to build an
+    // SLE that does not exist yet; read-only entries derive it from the SLE.
+    struct Empty
+    {
+    };
+
+    // No default member initializer: Keylet is not default-constructible, so
+    // every writable constructor must initialize key_ explicitly.
+    [[no_unique_address]]
+    std::conditional_t<kIsWritable, Keylet, Empty> key_;
+
+    SlePtrType sle_{};
+    beast::Journal j_;
+};
+
+/**
+ * Generic (any-entry-type) SLE entries.
+ *
+ * Use these when the concrete ledger entry type is not known at a given site;
+ * otherwise prefer the per-type entries (e.g. AccountRootEntry.h), which
+ * additionally enforce the entry type at compile time.
+ *
+ *   SLE::const_pointer / SLE::const_ref  ->  ReadOnlySLE
+ *   SLE::pointer       / SLE::ref        ->  WritableSLE
+ */
+using ReadOnlySLE = SLEBase<ReadView>;
+using WritableSLE = SLEBase<ApplyView>;
+
+static_assert(
+    !std::is_polymorphic_v<ReadOnlySLE> && !std::is_polymorphic_v<WritableSLE>,
+    "SLEBase must stay a thin value type; it must not acquire a vtable");
+
+}  // namespace xrpl

include/xrpl/ledger/entries/SignerListEntry.h

@@ -0,0 +1,35 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class SignerListEntry : public SLEBase<ViewT, ltSIGNER_LIST>
+{
+public:
+    using Base = SLEBase<ViewT, ltSIGNER_LIST>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit SignerListEntry(
+        AccountID const& account,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::signerList(account), view, j)
+    {
+    }
+};
+
+using SignerListEntryR = SignerListEntry<ReadView>;
+using SignerListEntryW = SignerListEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/SponsorshipEntry.h

@@ -0,0 +1,36 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class SponsorshipEntry : public SLEBase<ViewT, ltSPONSORSHIP>
+{
+public:
+    using Base = SLEBase<ViewT, ltSPONSORSHIP>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit SponsorshipEntry(
+        AccountID const& sponsor,
+        AccountID const& sponsee,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::sponsorship(sponsor, sponsee), view, j)
+    {
+    }
+};
+
+using SponsorshipEntryR = SponsorshipEntry<ReadView>;
+using SponsorshipEntryW = SponsorshipEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/TicketEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class TicketEntry : public SLEBase<ViewT, ltTICKET>
+{
+public:
+    using Base = SLEBase<ViewT, ltTICKET>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit TicketEntry(
+        AccountID const& id,
+        SeqProxy const& ticketSeq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::ticket(id, ticketSeq), view, j)
+    {
+    }
+
+    explicit TicketEntry(
+        uint256 const& ticketID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::ticket(ticketID), view, j)
+    {
+    }
+};
+
+using TicketEntryR = TicketEntry<ReadView>;
+using TicketEntryW = TicketEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/VaultEntry.h

@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SeqProxy.h>
+
+namespace xrpl {
+
+template <typename ViewT>
+class VaultEntry : public SLEBase<ViewT, ltVAULT>
+{
+public:
+    using Base = SLEBase<ViewT, ltVAULT>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit VaultEntry(
+        AccountID const& owner,
+        SeqProxy const& seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::vault(owner, seq), view, j)
+    {
+    }
+
+    explicit VaultEntry(
+        uint256 const& vaultID,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::vault(vaultID), view, j)
+    {
+    }
+};
+
+using VaultEntryR = VaultEntry<ReadView>;
+using VaultEntryW = VaultEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/XChainOwnedClaimIDEntry.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/STXChainBridge.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+template <typename ViewT>
+class XChainOwnedClaimIDEntry : public SLEBase<ViewT, ltXCHAIN_OWNED_CLAIM_ID>
+{
+public:
+    using Base = SLEBase<ViewT, ltXCHAIN_OWNED_CLAIM_ID>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit XChainOwnedClaimIDEntry(
+        STXChainBridge const& bridge,
+        std::uint64_t seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::xChainClaimID(bridge, seq), view, j)
+    {
+    }
+};
+
+using XChainOwnedClaimIDEntryR = XChainOwnedClaimIDEntry<ReadView>;
+using XChainOwnedClaimIDEntryW = XChainOwnedClaimIDEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/entries/XChainOwnedCreateAccountClaimIDEntry.h

@@ -0,0 +1,39 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/entries/SLEBase.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/STXChainBridge.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+template <typename ViewT>
+class XChainOwnedCreateAccountClaimIDEntry
+    : public SLEBase<ViewT, ltXCHAIN_OWNED_CREATE_ACCOUNT_CLAIM_ID>
+{
+public:
+    using Base = SLEBase<ViewT, ltXCHAIN_OWNED_CREATE_ACCOUNT_CLAIM_ID>;
+
+    // Inherit base constructors: adopt an existing SLE, or resolve one from a
+    // Keylet against the view.
+    using Base::Base;
+
+    explicit XChainOwnedCreateAccountClaimIDEntry(
+        STXChainBridge const& bridge,
+        std::uint64_t seq,
+        Base::ViewRefType view,
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+        : Base(keylet::xChainCreateAccountClaimID(bridge, seq), view, j)
+    {
+    }
+};
+
+using XChainOwnedCreateAccountClaimIDEntryR = XChainOwnedCreateAccountClaimIDEntry<ReadView>;
+using XChainOwnedCreateAccountClaimIDEntryW = XChainOwnedCreateAccountClaimIDEntry<ApplyView>;
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/AccountRootHelpers.h

@@ -15,7 +15,6 @@
 #include <cstdint>
 #include <expected>
 #include <optional>
-#include <set>
 #include <vector>
 
 namespace xrpl {
@@ -353,14 +352,14 @@ pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
  *
  * The list is constructed during initialization and is const after that.
  * Pseudo-account designator fields MUST be maintained by including the
- * SField::sMD_PseudoAccount flag in the SField definition.
+ * SField::kSmdPseudoAccount flag in the SField definition.
  */
 [[nodiscard]] std::vector<SField const*> const&
 getPseudoAccountFields();
 
 /**
- * Returns true if and only if sleAcct is a pseudo-account or specific
- * pseudo-accounts in pseudoFieldFilter.
+ * Returns true if and only if sleAcct is a pseudo-account of any kind
+ * (i.e. carries at least one field flagged with SField::kSmdPseudoAccount).
  *
  * Returns false if sleAcct is:
  * - NOT a pseudo-account OR
@@ -368,18 +367,15 @@ getPseudoAccountFields();
  * - null pointer
  */
 [[nodiscard]] bool
-isPseudoAccount(SLE::const_pointer sleAcct, std::set<SField const*> const& pseudoFieldFilter = {});
+isPseudoAccount(SLE::const_pointer sleAcct);
 
 /**
  * Convenience overload that reads the account from the view.
  */
 [[nodiscard]] inline bool
-isPseudoAccount(
-    ReadView const& view,
-    AccountID const& accountId,
-    std::set<SField const*> const& pseudoFieldFilter = {})
+isPseudoAccount(ReadView const& view, AccountID const& accountId)
 {
-    return isPseudoAccount(view.read(keylet::account(accountId)), pseudoFieldFilter);
+    return isPseudoAccount(view.read(keylet::account(accountId)));
 }
 
 /**

include/xrpl/ledger/helpers/LendingHelpers.h

@@ -324,6 +324,12 @@ computeFullPaymentInterest(
     std::uint32_t startDate,
     TenthBips32 closeInterestRate);
 
+// Returns true if the loan's next payment is late per protocol rules. The
+// boundary is amendment-gated: with fixCleanup3_4_0 the due date must be
+// strictly in the past, otherwise the exact due-date instant counts as late.
+[[nodiscard]] bool
+isPaymentLate(ReadView const& view, SLE::const_ref loanSle);
+
 // Deltas applied to Vault.AssetsTotal and LoanBroker.DebtTotal at a single
 // accounting touch point (origination, payment, impair/unimpair/default).
 struct AccountingDeltas
@@ -332,9 +338,9 @@ struct AccountingDeltas
     Number debtTotalDelta;
 };
 
-// Whole-life (pre-LendingProtocolV1_1) recognition model: interest is
-// recognized into AssetsTotal/DebtTotal up front, at origination.
-namespace accrual {
+// Instant interest recognition (pre-LendingProtocolV1_1): interest is
+// recognized into AssetsTotal/DebtTotal immediately, at origination.
+namespace instant_recognition {
 
 // LoanSet origination: what's added to Vault.AssetsTotal and LoanBroker.DebtTotal
 AccountingDeltas
@@ -356,7 +362,7 @@ loanVaultExposure(SLE::const_ref loanSle);
 AccountingDeltas
 loanPaymentDeltas(LoanPaymentParts const& parts);
 
-}  // namespace accrual
+}  // namespace instant_recognition
 
 // Cash-basis (LendingProtocolV1_1) recognition model: AssetsTotal/DebtTotal
 // are principal-only, interest is recognized only as it's actually paid.
@@ -375,7 +381,7 @@ loanPaymentDeltas(LoanPaymentParts const& parts);
 
 // Public dispatchers: pick cash_basis:: if featureLendingProtocolV1_1 is
 // enabled AND the Vault's LEVersion (VaultHelpers::getVaultVersion) is
-// VaultVersion::CashBasis, else accrual::. These are the only entry points
+// VaultVersion::CashBasis, else instant_recognition::. These are the only entry points
 // transactors call.
 AccountingDeltas
 loanOriginationDeltas(

include/xrpl/ledger/helpers/RippleStateHelpers.h

@@ -239,8 +239,13 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
 //------------------------------------------------------------------------------
 
 /**
- * Any transactors that call addEmptyHolding() in doApply must call
- * canAddHolding() in preflight with the same View and Asset
+ * XRP and the issuer itself are always tesSUCCESS. Otherwise, after
+ * fixCleanup3_4_0, an existing trust line returns tecDUPLICATE without
+ * consulting issuer freeze or DefaultRipple; both still apply on the create
+ * path (DefaultRipple off is terNO_RIPPLE). canAddHolding() ignores existing
+ * holdings, so transactors that may create a holding in doApply should gate
+ * their preclaim call on it: after the amendment only when no holding
+ * exists, before it always.
  */
 [[nodiscard]] TER
 addEmptyHolding(

include/xrpl/ledger/helpers/TokenHelpers.h

@@ -38,6 +38,12 @@ enum class FreezeHandling { IgnoreFreeze, ZeroIfFrozen };
  */
 enum class AuthHandling { IgnoreAuth, ZeroIfUnauthorized };
 
+/**
+ * Controls whether the recipient owner-reserve check is enforced when
+ * auto-creating a trustline or MPToken during AMMWithdraw or AMMClawback.
+ */
+enum class ReserveHandling : bool { EnforceReserve, IgnoreReserve };
+
 /**
  * Controls whether to include the account's full spendable balance
  */
@@ -294,6 +300,14 @@ accountFunds(
     AuthHandling authHandling,
     beast::Journal j);
 
+/**
+ * Returns the transfer fee as Rate based on the type of token
+ * @param view The ledger view
+ * @param asset The asset being transferred
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, Asset const& asset);
+
 /**
  * Returns the transfer fee as Rate based on the type of token
  * @param view The ledger view
@@ -311,6 +325,12 @@ transferRate(ReadView const& view, STAmount const& amount);
 [[nodiscard]] TER
 canAddHolding(ReadView const& view, Asset const& asset);
 
+/**
+ * True if the account already holds this asset (or is the issuer / XRP).
+ */
+[[nodiscard]] bool
+holdingExists(ReadView const& view, AccountID const& account, Asset const& asset);
+
 [[nodiscard]] TER
 addEmptyHolding(
     ApplyViewContext ctx,

include/xrpl/ledger/helpers/VaultHelpers.h

@@ -7,8 +7,10 @@
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
 
 #include <cstdint>
+#include <expected>
 #include <optional>
 
 namespace xrpl {
@@ -43,6 +45,32 @@ assetsToSharesDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount co
 [[nodiscard]] std::optional<STAmount>
 sharesToAssetsDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount const& shares);
 
+/**
+ * Adjusts a requested asset change (`delta`) to match the decimal scale of the
+ * updated total vault assets. This ensures `sfAssetsTotal`, `sfAssetsAvailable`,
+ * and the actual asset transfer change by the exact same representable amount.
+ *
+ * Rounding strategy:
+ * - Debits (withdrawals): Rounds down `|delta|` on the new scale to prevent
+ *   paying out more than requested.
+ * - Credits (deposits): Floors the resulting total asset balance and returns the
+ *   difference from the current total. This prevents crediting the vault with
+ *   more assets than the user deposited.
+ *
+ * Key rules:
+ * - The returned magnitude never exceeds `|delta|`.
+ * - Returns `tecPRECISION_LOSS` if the change is smaller than 1 ULP of the target scale
+ *   (prevents share operations when totals cannot change).
+ * - For integer assets (XRP, MPT), rounding is a no-op.
+ *
+ * @param vault The vault ledger entry.
+ * @param delta The requested signed change to sfAssetsTotal.
+ * @return The rounded, positive magnitude, or `tecPRECISION_LOSS` if the
+ *         change is below representable precision.
+ */
+[[nodiscard]] std::expected<STAmount, TER>
+clampToAssetsTotalScale(SLE::const_ref vault, STAmount const& delta);
+
 /**
  * Controls whether to truncate shares instead of rounding.
  */
@@ -58,33 +86,30 @@ enum class TruncateShares : bool { No = false, Yes = true };
 enum class WaiveUnrealizedLoss : bool { No = false, Yes = true };
 
 /**
- * Returns the effective total of assets backing outstanding shares for the
- * purposes of a withdrawal, i.e. sfAssetsTotal, discounted by sfLossUnrealized
- * unless waived. This is the numerator used by both withdraw conversion
- * helpers (assetsToSharesWithdraw and sharesToAssetsWithdraw) to compute the
- * share/asset exchange rate.
+ * Returns the assets backing outstanding shares for a withdrawal:
+ * sfAssetsTotal minus sfLossUnrealized, or sfAssetsTotal alone when the
+ * unrealized loss is waived. Used by assetsToSharesWithdraw and
+ * sharesToAssetsWithdraw as the numerator of the share/asset exchange rate.
  *
  * @param vault The vault SLE.
- * @param waive Whether to waive (i.e. not subtract) the vault's unrealized
- *              loss.
+ * @param waive Whether to skip subtracting the unrealized loss.
  */
 [[nodiscard]] Number
 assetsTotalForWithdrawal(SLE::const_ref vault, WaiveUnrealizedLoss waive);
 
 /**
- * Returns whether debiting `amount` from `total` — the current value of a
- * vault's sfAssetsTotal or sfAssetsAvailable field — would canonicalize back
- * to the exact same STAmount value it started at. This happens when a
- * genuinely non-zero debit is dust relative to a `total` large enough to
- * exceed STAmount's significant-digit precision: the shares still move, but
- * the stored total doesn't change, which otherwise trips the ValidVault
- * invariant after the fact instead of failing cleanly upfront.
+ * Returns true if debiting `amount` from `total` (the current value of a
+ * vault's sfAssetsTotal or sfAssetsAvailable) would canonicalize to the
+ * same STAmount value. This happens when `amount` is non-zero but too small
+ * to change the stored total at STAmount's precision. Shares would still
+ * move, so the ValidVault invariant would fail after apply; callers use
+ * this to reject the transaction upfront instead.
  *
- * @param asset The vault's underlying asset, used to canonicalize both sides
- *              the same way the ledger will when the field is stored.
+ * @param asset The vault's underlying asset, used to canonicalize both
+ *              sides the same way the ledger will when the field is stored.
  * @param total The field's current value.
- * @param amount The amount to debit. A value of zero always returns false;
- *               that case is rejected separately and unconditionally.
+ * @param amount The amount to debit. Zero always returns false; that case
+ *               is rejected separately.
  */
 [[nodiscard]] bool
 debitIsNonZeroDust(Asset const& asset, Number const& total, Number const& amount);
@@ -147,8 +172,8 @@ isSoleShareholder(ReadView const& view, AccountID const& account, SLE::const_ref
 
 /**
  * Resolves a Vault's LEVersion, the single point every accounting touch
- * point should call to determine which recognition model (accrual vs.
- * cash-basis) a Vault uses. Vaults created before featureLendingProtocolV1_1
+ * point should call to determine which recognition model (instant interest
+ * recognition vs. cash-basis) a Vault uses. Vaults created before featureLendingProtocolV1_1
  * activated never have sfLEVersion set, which resolves here to
  * VaultVersion::Legacy.
  *
@@ -238,4 +263,40 @@ getVaultPhase(
     std::optional<std::uint32_t> subscriptionDate,
     std::optional<std::uint32_t> redemptionDate);
 
+/**
+ * Controls whether checkVaultDomain reports an expired credential as an
+ * error. A caller that deletes expired credentials later, in doApply, passes
+ * Yes and treats the subject as authorized; a caller with no such cleanup
+ * step must keep the error.
+ */
+enum class SuppressExpired : bool { No = false, Yes = true };
+
+/**
+ * Checks that subject belongs to the permissioned domain governing a vault's
+ * shares.
+ *
+ * The domain is read from the share issuance rather than from the vault. Vault
+ * shares are issued by the vault's pseudo-account, which cannot grant an
+ * authorization explicitly, so domain membership is the only route to being
+ * authorized: a vault with no domain set has no authorized participants at
+ * all, and every subject fails with tecNO_AUTH.
+ *
+ * Which accounts to check, and whether to check at all, is left to the caller.
+ * This says nothing about vault privacy or about the roles of the accounts.
+ *
+ * @param view The ledger view.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param subject The account whose domain membership is checked.
+ * @param suppressExpired Whether an expired credential counts as authorized.
+ *
+ * @return tesSUCCESS if the subject is a domain member, otherwise the reason
+ * it is not.
+ */
+[[nodiscard]] TER
+checkVaultDomain(
+    ReadView const& view,
+    SLE::const_ref issuance,
+    AccountID const& subject,
+    SuppressExpired suppressExpired);
+
 }  // namespace xrpl

include/xrpl/nodestore/detail/DatabaseNodeImp.h

@@ -92,7 +92,7 @@ public:
     void
     importDatabase(Database& source) override
     {
-        importInternal(*backend_.get(), source);
+        importInternal(*backend_, source);
     }
 
     void

include/xrpl/peerfinder/Config.h

@@ -26,7 +26,8 @@ struct Config
     /**
      * The largest number of public peer slots to allow.
      * This includes both inbound and outbound, but does not include
-     * fixed peers.
+     * fixed peers. A configuration built by `makeConfig` always holds
+     * `maxPeers == inPeers + outPeers`.
      */
     std::size_t maxPeers{tuning::kDefaultMaxPeers};
 

include/xrpl/protocol/AMMCore.h

@@ -91,6 +91,17 @@ getFee(std::uint16_t tfee)
     return Number{tfee} / kAuctionSlotFeeScaleFactor;
 }
 
+/**
+ * Minimum auction slot price: LPTokens * TradingFee / kAuctionSlotMinFeeFraction
+ * @param lptAMMBalance  AMM LP token balance
+ * @param tradingFee     trading fee in {0, 1000}
+ */
+inline Number
+ammAuctionMinSlotPrice(Number const& lptAMMBalance, std::uint16_t tradingFee)
+{
+    return lptAMMBalance * getFee(tradingFee) / kAuctionSlotMinFeeFraction;
+}
+
 /**
  * Get fee multiplier (1 - tfee)
  * @tfee trading fee in basis points

include/xrpl/protocol/Book.h

@@ -133,7 +133,7 @@ private:
     using id_hash_type = boost::base_from_member<std::hash<xrpl::MPTID>, 0>;
 
 public:
-    explicit hash() = default;
+    hash() = default;
 
     using value_type = std::size_t;
     using argument_type = xrpl::MPTIssue;
@@ -160,7 +160,7 @@ private:
     mptissue_hasher mMptissueHasher_;
 
 public:
-    explicit hash() = default;
+    hash() = default;
 
     value_type
     operator()(argument_type const& asset) const
@@ -227,7 +227,7 @@ struct hash<xrpl::Issue> : std::hash<xrpl::Issue>
 template <>
 struct hash<xrpl::MPTIssue> : std::hash<xrpl::MPTIssue>
 {
-    explicit hash() = default;
+    hash() = default;
 
     using Base = std::hash<xrpl::MPTIssue>;
 };
@@ -235,7 +235,7 @@ struct hash<xrpl::MPTIssue> : std::hash<xrpl::MPTIssue>
 template <>
 struct hash<xrpl::Asset> : std::hash<xrpl::Asset>
 {
-    explicit hash() = default;
+    hash() = default;
 
     using Base = std::hash<xrpl::Asset>;
 };

include/xrpl/protocol/ConfidentialTransfer.h

@@ -6,6 +6,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STInteger.h>  // IWYU pragma: keep
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
@@ -301,6 +302,63 @@ verifySchnorrProof(Slice const& pubKeySlice, Slice const& proofSlice, uint256 co
 NotTEC
 checkEncryptedAmountFormat(STObject const& object);
 
+/**
+ * @brief Checks whether a holder's issuer mirror is encrypted under the
+ * issuance's currently registered issuer key.
+ *
+ * Verifies that the holder's issuer mirror epoch matches the active issuer key
+ * epoch on the issuance. An absent mirror epoch defaults to epoch 0. A holder without an issuer
+ * mirror is considered stale, as there is no key anchor for future re-encryptions.
+ *
+ * @param issuance The MPTokenIssuance ledger object.
+ * @param mptoken  The holder's MPToken ledger object.
+ * @return true if the MPToken's issuer mirror is current. false if stale.
+ */
+[[nodiscard]] bool
+isIssuerMirrorCurrent(SLE const& issuance, SLE const& mptoken);
+
+/**
+ * @brief Checks whether a holder's auditor mirror is encrypted under the
+ * issuance's currently registered auditor key.
+ *
+ * Verifies that the holder's auditor mirror epoch matches the active auditor key
+ * epoch on the issuance. An absent mirror epoch defaults to epoch 0. An issuance
+ * without an auditor key requires no auditor mirror and is considered current.
+ *
+ * @param issuance The MPTokenIssuance ledger object.
+ * @param mptoken  The holder's MPToken ledger object.
+ * @return true if the auditor mirror is current or not required.
+ */
+[[nodiscard]] bool
+isAuditorMirrorCurrent(SLE const& issuance, SLE const& mptoken);
+
+/**
+ * @brief Checks whether each mirror a holder is required to have is encrypted
+ * under the issuance's currently registered ElGamal keys.
+ *
+ * Verifies that both the issuer mirror and the auditor mirror (if required)
+ * are current. This serves as a combined check, ensuring all necessary
+ * holder mirror epochs match the active key epochs on the issuance.
+ *
+ * @param issuance The MPTokenIssuance ledger object.
+ * @param mptoken  The holder's MPToken ledger object.
+ * @return true if the required mirrors are current.
+ */
+[[nodiscard]] bool
+areMirrorsCurrent(SLE const& issuance, SLE const& mptoken);
+
+/**
+ * @brief Set the holder's MPToken mirror epochs to match the issuance's current key epochs.
+ *
+ * Call this after writing mirror ciphertexts under the issuance's currently
+ * registered keys, so that the mirrors read as current afterwards.
+ *
+ * @param issuance The MPTokenIssuance ledger object.
+ * @param mptoken  The holder's MPToken ledger entry to update.
+ */
+void
+setMirrorEpochs(SLE const& issuance, SLE& mptoken);
+
 /**
  * @brief Verifies revealed amount encryptions for all recipients.
  *

include/xrpl/protocol/HashPrefix.h

@@ -92,6 +92,26 @@ enum class HashPrefix : std::uint32_t {
      * Batch
      */
     Batch = detail::makeHashPrefix('B', 'C', 'H'),
+
+    /**
+     * inner transaction to sign as the counterparty
+     */
+    CounterpartyTxSign = detail::makeHashPrefix('C', 'P', 'T'),
+
+    /**
+     * inner transaction to multi-sign as the counterparty
+     */
+    CounterpartyTxMultiSign = detail::makeHashPrefix('C', 'P', 'M'),
+
+    /**
+     * inner transaction to sign as the sponsor
+     */
+    SponsorTxSign = detail::makeHashPrefix('S', 'P', 'N'),
+
+    /**
+     * inner transaction to multi-sign as the sponsor
+     */
+    SponsorTxMultiSign = detail::makeHashPrefix('S', 'P', 'M'),
 };
 
 template <class Hasher>

include/xrpl/protocol/MPTAmount.h

@@ -9,6 +9,7 @@
 
 #include <cstdint>
 #include <limits>
+#include <optional>
 #include <ostream>
 #include <stdexcept>
 #include <string>
@@ -174,4 +175,17 @@ mulRatio(MPTAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundU
     return MPTAmount(r.convert_to<MPTAmount::value_type>());
 }
 
+inline std::optional<MPTAmount>
+tryMulRatio(MPTAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundUp)
+{
+    try
+    {
+        return mulRatio(amt, num, den, roundUp);
+    }
+    catch (std::overflow_error const&)
+    {
+        return std::nullopt;
+    }
+}
+
 }  // namespace xrpl

include/xrpl/protocol/MPTIssue.h

@@ -151,7 +151,7 @@ namespace std {
 template <>
 struct hash<xrpl::MPTID> : xrpl::MPTID::hasher
 {
-    explicit hash() = default;
+    hash() = default;
 };
 
 }  // namespace std

include/xrpl/protocol/NFTSyntheticSerializer.h

@@ -1,19 +0,0 @@
-#pragma once
-
-#include <xrpl/json/json_forwards.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TxMeta.h>
-
-#include <memory>
-
-namespace xrpl::rpc {
-
-/**
- * Adds common synthetic fields to transaction-related JSON responses
- */
-/** @{ */
-void
-insertNFTSyntheticInJson(json::Value&, std::shared_ptr<STTx const> const&, TxMeta const&);
-/** @} */
-
-}  // namespace xrpl::rpc