test: Check error consistently in rpc handlers (#8604 )

Co-authored-by: Ayaz Salikhov <[email protected]>
chore: Fix an issue that breaks CLion (#8619 )
2026-10-22 03:27:08 +00:00 · 2026-10-19 16:17:30 +00:00 · 2026-10-17 22:43:53 +00:00 · 2026-10-16 20:59:53 +00:00 · 2026-10-16 17:06:19 +00:00 · 2026-10-16 16:28:05 +00:00
670 changed files with 35344 additions and 50828 deletions
@@ -69,8 +69,6 @@ words:
  - Btrfs
  - Buildx
  - canonicality
-  - cbindgen
-  - cdylib
  - canonicalised
  - cctools
  - changespq
@@ -105,10 +103,10 @@ words:
  - dearmor
  - decryptor
  - dedented
+  - dedup
  - deleteme
  - demultiplexer
  - deserializaton
-  - desugars
  - desync
  - desynced
  - determ
@@ -135,7 +133,6 @@ words:
  - gcov
  - gcovr
  - ghead
-  - gmock
  - Gnutella
  - godexsoft
  - gpgcheck
@@ -145,9 +142,7 @@ words:
  - hwaddress
  - hwrap
  - ifndef
-  - impls
  - inequation
-  - initialiser
  - Injectivity
  - insuf
  - insuff
@@ -183,7 +178,6 @@ words:
  - lsmf
  - ltype
  - mathbunnyru
-  - maxima
  - mcmodel
  - MEMORYSTATUSEX
  - MPTAMM
@@ -203,7 +197,6 @@ words:
  - mptokenissuance
  - mptokens
  - mpts
-  - mpt
  - mtgox
  - multisig
  - multisign
@@ -260,7 +253,6 @@ words:
  - pyparsing
  - qalloc
  - qbsprofile
-  - qself
  - queuable
  - Raphson
  - rcflags
@@ -319,7 +311,6 @@ words:
  - STATSDCOLLECTOR
  - stissue
  - stnum
-  - stnumber
  - stobj
  - stobject
  - stpath
@@ -354,13 +345,13 @@ words:
  - unambiguity
  - unauthorizes
  - unauthorizing
+  - undeserializable
  - unergonomic
  - unfetched
  - unfindable
  - unflatten
  - unfund
  - unimpair
-  - unmetered
  - unroutable
  - unscalable
  - unserviced
@@ -381,8 +372,6 @@ words:
  - vfalco
  - vinnie
  - wasmi
-  - wasmparser
-  - Werror
  - wextra
  - wptr
  - writeme
@@ -391,11 +380,9 @@ words:
  - xbridge
  - xchain
  - xcrun
-  - xfloat
  - ximinez
  - XMACRO
  - xored
-  - xrp
  - xrpkuwait
  - xrpl
  - xrpld
@@ -36,3 +36,18 @@ updates:
      rust-dependencies:
        patterns:
          - "*"
+
+  - package-ecosystem: uv
+    directory: /cmake/scripts/codegen
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Etc/GMT
+    commit-message:
+      prefix: "chore: [DEPENDABOT] "
+    target-branch: develop
+    groups:
+      codegen-dependencies:
+        patterns:
+          - "*"
@@ -1,9 +1,6 @@
 benchmarks.libxrpl > xrpl.basics
 benchmarks.libxrpl > xrpl.config
 benchmarks.libxrpl > xrpl.nodestore
-benchmarks.libxrpl > xrpl.protocol
-benchmarks.libxrpl > xrpl.protocol_autogen
-benchmarks.libxrpl > xrpl.tx
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
@@ -65,6 +62,7 @@ libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
+test.app > tests.libxrpl
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
@@ -12,6 +12,7 @@ _BASE_CMAKE_ARGS = [
    "-Dwerr=ON",
    "-Dxrpld=ON",
    "-Dwextra=ON",
+    "-Drust=ON",
 ]

 # The package formats a config can be packaged as, each with its own
@@ -8,6 +8,7 @@ on:
    branches:
      - "develop"
      - "release/*"
+      - "staging/*"
    paths:
      - "crates/**/Cargo.toml"
      - "crates/Cargo.lock"
@@ -243,7 +243,7 @@ jobs:
      - should-run
      - build-test
    # Only run when committing to a PR that targets a release branch.
-    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
+    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') }}
    uses: ./.github/workflows/reusable-upload-recipe.yml
    secrets:
      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
@@ -1,14 +1,16 @@
 # This workflow runs all workflows to build and test the code on various Linux
 # flavors, as well as on MacOS and Windows, on a scheduled basis, on merge into
-# the 'develop' or 'release*' branches, or when requested manually. Upon pushes
-# to the develop branch it also uploads the libxrpl recipe to the Conan remote.
+# the 'develop', 'release/*' or 'staging/*' branches, or when requested
+# manually. Upon pushes to the develop branch, it also uploads the libxrpl
+# recipe to the Conan remote.
 name: Trigger

 on:
  push:
    branches:
      - "develop"
-      - "release*"
+      - "release/*"
+      - "staging/*"
    paths:
      # These paths are unique to `on-trigger.yml`.
      - ".github/workflows/on-trigger.yml"
@@ -62,9 +64,9 @@ on:
  workflow_dispatch:

 concurrency:
-  # When a PR is merged into the develop branch it will be assigned a unique
+  # When a PR is merged into the develop branch, it will be assigned a unique
  # group identifier, so execution will continue even if another PR is merged
-  # while it is still running. In all other cases the group identifier is shared
+  # while it is still running. In all other cases, the group identifier is shared
  # per branch, so that any in-progress runs are cancelled when a new commit is
  # pushed.
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
@@ -98,7 +100,7 @@ jobs:
      # However, we do not enable ccache for events targeting a release branch,
      # to protect against the rare case that the output produced by ccache is
      # not identical to a regular compilation.
-      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release') }}
+      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release/') }}
      os: ${{ matrix.os }}
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -8,7 +8,8 @@ on:
  push:
    branches:
      - "develop"
-      - "release*"
+      - "release/*"
+      - "staging/*"
  workflow_dispatch:

 jobs:
@@ -385,10 +385,7 @@ jobs:
      - name: Run Rust tests
        if: ${{ !inputs.build_only }}
        working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn

      # Smoke-run every benchmark module with a single repetition to confirm the
      # benchmarks still build and execute. This is a correctness check, not a
@@ -85,6 +85,7 @@ jobs:
              -Dwerr=ON \
              -Dxrpld=ON \
              -Dverify_headers=ON \
+              -Drust=ON \
              ..

      - name: Build clang-tidy prerequisites
@@ -122,13 +123,19 @@ jobs:

      - name: Fix style
        if: ${{ steps.files_changed.outcome != 'success' }}
+        # pre-commit installs every hook's environment, even for hooks that match
+        # no files, and node-based hooks need libatomic, which this image lacks.
+        # Exit code 1 just means hooks modified files or found issues.
+        env:
+          SKIP: prettier,cspell
        run: |
-          pre-commit run --all-files || true
+          git add --update
+          pre-commit run || [ $? -eq 1 ]

      - name: Generate git diff
        if: ${{ steps.files_changed.outcome != 'success' }}
        run: |
-          git diff | tee "${DIFF_FILE}"
+          git diff HEAD | tee "${DIFF_FILE}"

      - name: Upload clang-tidy diff output
        if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}
@@ -95,11 +95,15 @@ jobs:
          apt-get update -qq
          apt-get install -y "./${PACKAGE}"

+      # Rocky Linux and AlmaLinux pick a mirror from a mirrorlist, and now and
+      # then get one that serves the repository metadata at a few hundred kB/s,
+      # which alone outlasts the job's timeout. dnf only abandons a mirror below
+      # 1000 B/s for 30 s, so raise that floor to fail over to the next one fast.
      - name: Install the RPM
        if: ${{ inputs.package_type == 'rpm' }}
        env:
          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y "./${PACKAGE}"
+        run: dnf install -y --setopt=minrate=1M --setopt=timeout=10 "./${PACKAGE}"

      - name: Run xrpld
        run: xrpld --version
@@ -39,4 +39,4 @@ Paths below reflect the current layout; update this section if modularization mo
 - `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
 - `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
 - `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
- `crates/` — a Rust workspace holding the WebAssembly engine that runs Smart Escrow contracts, bridged into C++ via `cxxbridge`/the `cxx` crate; see [crates/README.md](./crates/README.md) for more details.
+- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).
@@ -35,6 +35,9 @@ Version 3.5.0 is not yet released.

 - `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 - `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
+- `account_currencies`, `account_nfts`, `account_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before an invalid or missing `account`. An invalid `limit` or `marker` is reported before `lgrNotFound` or `actNotFound`, and for `account_offers` also before `actMalformed`. A request with a single problem returns the same error as before. [#8561](https://github.com/XRPLF/rippled/pull/8561)
+- `deposit_authorized`: A `credentials` entry that is all zeros (for example `"0"` or 64 `0` characters) now returns a `badCredentials` error instead of looking up a credential that can never exist.
+- `account_info`, `account_lines`, `account_channels`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `account`, or `ident` for `account_info`. For `account_lines`, a `peer` that is not a string, or an invalid `limit` or `marker`, is reported before `lgrNotFound`, `actNotFound` or a malformed `account`, and an invalid `limit` or `marker` also before a malformed `peer`. For `account_channels`, a malformed `account` is reported before `lgrNotFound`, and an invalid `destination_account`, `limit` or `marker` before `lgrNotFound` or `actNotFound`. A request with a single problem returns the same error as before. [#8573](https://github.com/XRPLF/rippled/pull/8573)

 ### Bugfixes in 3.5.0

@@ -1,34 +1,13 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |

-## Minimum Requirements
+## Supported platforms

-For the hardware needed to run a node, see
-[System Requirements](https://xrpl.org/system-requirements.html).
-
-For the software needed to build xrpld, see the
-[environment setup guide](./docs/build/environment.md).
-
-## Operating Systems
-
-### Linux
-
-The Ubuntu Linux distribution has received the highest level of quality
-assurance, testing, and support. We also support Red Hat and use Debian
-internally.
-Our Linux CI tooling is distro-independent and uses a Nix-based environment, so it should be possible to build on other Linux distributions as well, although we have not tested them.
-
-### macOS
-
-Many `xrpld` engineers use macOS for development.
-The minimum supported version is macOS 15 (Sequoia).
-CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
-
-### Windows
-
-Windows is used by some engineers for development only, and is not recommended
-for production use.
+Building and testing are supported on Linux, macOS, and (best effort) Windows;
+see [Supported development platforms](./docs/build/environment.md#supported-development-platforms).
+Running `xrpld` is officially supported on Linux only;
+see [Requirements](./docs/install.md#requirements).

 ## Steps

@@ -308,6 +287,7 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 | ---------------- | ------------- | ----------------------------------------------------------------------------- |
 | `assert`         | OFF           | Force enabling assertions.                                                    |
 | `coverage`       | OFF           | Prepare the coverage report.                                                  |
+| `rust`           | OFF           | Build the Rust crates and the C++ code that depends on them.                  |
 | `tests`          | OFF           | Build tests.                                                                  |
 | `unity`          | OFF           | Configure a unity build.                                                      |
 | `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
@@ -322,15 +302,23 @@ builds may be faster for incremental builds, and can be helpful for detecting

 ### Rust crates

-The build compiles the Rust workspace in `crates/` and generates the cxxbridge
-bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
-at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
-[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
-as described in [Rust](./docs/build/environment.md#rust).
+The Rust crates in `crates/` are only part of the build when `rust` is ON. With
+`-Drust=OFF` (the default) the `crates` directory is not added to the build, no
+cxxbridge bindings are generated, and the C++ tests that exercise the Rust
+interop are not compiled — so no Rust toolchain is needed. CI builds always pass
+`-Drust=ON`.
+
+With `-Drust=ON` you need one extra dependency: a Rust toolchain (`cargo`,
+`rustc`) matching the channel pinned in
+[`rust-toolchain.toml`](./rust-toolchain.toml), which compiles the crates and
+generates the cxxbridge bindings. It is provided by the
+[Nix development shell](./docs/build/nix.md), so `-Drust=ON` works there without
+any extra setup; otherwise install it as described in
+[Rust](./docs/build/environment.md#rust).

 The crates also have their own Rust unit tests. Those are run with `cargo` and
-need only the Rust toolchain, independently of CMake (CI runs them with
-`cargo nextest`):
+need only the Rust toolchain, independently of CMake and of the `rust` option
+(CI runs them with `cargo nextest`):

 ```bash
 cargo test --manifest-path crates/Cargo.toml --workspace
@@ -42,7 +42,7 @@ if(is_gcc)
    # GCC-specific fixes
    add_compile_options(-Wno-unknown-pragmas -Wno-subobject-linkage)
    # -Wno-subobject-linkage can be removed when we upgrade GCC version to at least 13.3
-elseif(is_clang)
+elseif(is_any_clang)
    # Clang-specific fixes
    add_compile_options(-Wno-unknown-warning-option) # Ignore unknown warning options
 elseif(is_msvc)
@@ -160,8 +160,11 @@ endif()

 add_custom_target(tidy_prerequisites)

-add_subdirectory(crates)
+if(rust)
+    add_subdirectory(crates)
+endif()
 include(XrplCore)
+
 include(XrplProtocolAutogen)
 include(XrplInstall)
 include(XrplValidatorKeys)
@@ -332,11 +332,11 @@ This ensures that configuration changes don't introduce new warnings across the

 ### Installing clang-tidy

-See the [environment setup guide](./docs/build/environment.md#clang-tidy) for how to get clang-tidy.
+The [Nix development shell](./docs/build/nix.md) provides `clang-tidy` at the [tested version](./docs/build/environment.md#tested-compiler-versions).

 ### Running clang-tidy locally

-Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
+Before running clang-tidy, you must generate the files it depends on (protobuf headers, and, when the project is configured with `-Drust=ON`, the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:

 ```bash
 cmake --build build --target tidy_prerequisites
@@ -34,7 +34,7 @@ so tools can filter them and protection rules can target `release/*` and `stagin
 - **Branches only move forward.**
  `develop`, `staging/X.Y.x`, and `release/X.Y.x` are never rewritten.
 - **Cherry-picking only goes from `develop` to a staging branch**,
-  for fixes that must get into a release after the code freeze
+  for fixes that must get into a release after the [code freeze](#release-candidates)
  (see [Emergency Fixes From `develop`](#emergency-fixes-from-develop)).
 - **Security fixes are prepared privately and published with the release that contains them**,
  so vulnerabilities are not disclosed prematurely.
@@ -49,6 +49,7 @@ develop                            staging/X.Y.x & release/X.Y.x
   │
   ├── Tag: X.Y.0-b1
   ├── Tag: X.Y.0-bN
+   │  (2 weeks before rc1: freeze on large changes starts)
   ├── Tag: X.Y.0-rc1 ───────────────┐ (branches created)
   │                                 │
   │  (development continues)        ├── Fixes
@@ -75,16 +76,20 @@ develop                            staging/X.Y.x & release/X.Y.x
 3. **Branches:** `staging/X.Y.x` and `release/X.Y.x` are created from `develop`
   at the commit tagged `X.Y.0-rc1`.
   The first RC also kicks off the QE process.
-4. **Code freeze:** No new features or unrelated changes are pulled from `develop`
-   into `staging/X.Y.x` or `release/X.Y.x`.
-   Only critical stabilization fixes go into the line.
-5. **No large changes on `develop`:** Until `X.Y.0` is [merged back](#merging-back-into-develop),
-   large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
-   are not merged into `develop`,
-   so that fixes on the line and the merge back don't run into conflicts.
+
+### Freeze on Large Changes
+
+From two weeks before `X.Y.0-rc1` until `X.Y.0` is [merged back](#merging-back-into-develop),
+large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
+are not merged into `develop`.

 ### Release Candidates

+After branching, the line is in code freeze:
+no new features or unrelated changes are pulled from `develop`
+into `staging/X.Y.x` or `release/X.Y.x`.
+Only critical stabilization fixes go into the line.
+
 1. Fixes are developed against `staging/X.Y.x`.
 2. When ready, a new RC is created on `staging/X.Y.x`,
   and `release/X.Y.x` is fast-forwarded to it.
@@ -106,7 +111,8 @@ one right after the other.
 2. `release/X.Y.x` is fast-forwarded to `staging/X.Y.x`,
   and the release is tagged on it.
 3. The release is immediately [merged back into `develop`](#merging-back-into-develop).
-   For a major-minor release, this lifts the freeze on large changes in `develop`.
+   For a major-minor release, this lifts the [freeze on large changes](#freeze-on-large-changes)
+   in `develop`.

 ### Merging Back Into `develop`

@@ -127,7 +133,7 @@ After the merge, `git log develop..<tag>` must be empty.
 ### Emergency Fixes From `develop`

 If a commit was merged to `develop`
-and needs to be included in a release after the code freeze:
+and needs to be included in a release after the [code freeze](#release-candidates):

 1. Create a PR that cherry-picks the commit onto `staging/X.Y.x`.
 2. Leave `develop` as it is, with no reverts.
@@ -9,13 +9,21 @@ include_guard(GLOBAL)
 # --------------------------------------------------------------------
 # Compiler detection (C++)
 # --------------------------------------------------------------------
-set(is_clang FALSE)
+# is_any_clang is true for both LLVM Clang and AppleClang. Their version numbers
+# and feature sets differ, so use is_llvm_clang or is_apple_clang when it matters.
+set(is_any_clang FALSE)
+set(is_llvm_clang FALSE)
+set(is_apple_clang FALSE)
 set(is_gcc FALSE)
 set(is_msvc FALSE)
 set(is_xcode FALSE)

-if(CMAKE_CXX_COMPILER_ID MATCHES ".*Clang") # Clang or AppleClang
-    set(is_clang TRUE)
+if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
+    set(is_any_clang TRUE)
+    set(is_llvm_clang TRUE)
+elseif(CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
+    set(is_any_clang TRUE)
+    set(is_apple_clang TRUE)
 elseif(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
    set(is_gcc TRUE)
 elseif(MSVC)
@@ -29,14 +29,6 @@ function(xrpl_add_benchmark name)
    # XrplCore.cmake. Each file compiles fine on its own.
    set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)

-    # Land next to `xrpl_tests` in the build root rather than buried under
-    # `src/benchmarks/libxrpl/`. A benchmark is something a person runs by hand,
-    # repeatedly, and comparing two of them should not mean typing two long paths.
-    set_target_properties(
-        ${target}
-        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-    )
-
    isolate_headers(
        ${target}
        "${CMAKE_SOURCE_DIR}/src"
@@ -130,7 +130,7 @@ else()
        INTERFACE
            -Wall
            -Wdeprecated
-            $<$<BOOL:${is_clang}>:-Wno-deprecated-declarations>
+            $<$<BOOL:${is_any_clang}>:-Wno-deprecated-declarations>
            $<$<BOOL:${wextra}>:-Wextra
            -Wno-unused-parameter>
            $<$<BOOL:${werr}>:-Werror>
@@ -177,7 +177,7 @@ else()
    if(
        is_nix_compiler
        AND is_linux
-        AND is_clang
+        AND is_any_clang
        AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
    )
        string(
@@ -204,7 +204,10 @@ if(voidstar)
            "Antithesis instrumentation requires Linux, aborting..."
        )
    elseif(
-        NOT (is_clang AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0)
+        NOT (
+            is_llvm_clang
+            AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0
+        )
    )
        message(
            FATAL_ERROR
@@ -212,11 +212,7 @@ target_link_libraries(
 )

 add_module(xrpl tx)
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
-)
-add_dependencies(xrpl.libxrpl.tx xrpl_crates)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)

 add_module(xrpl consensus)
 target_link_libraries(
@@ -300,7 +296,16 @@ if(xrpld)
        OUT_VAR rpcspec_instantiations
        VALUE_TYPE "::json::Value"
        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
-        HANDLERS book_changes ledger transaction_entry
+        HANDLERS
+            account_channels
+            account_currencies
+            account_info
+            account_lines
+            account_nfts
+            account_offers
+            book_changes
+            ledger
+            transaction_entry
    )
    target_sources(xrpld PRIVATE ${rpcspec_instantiations})

@@ -58,7 +58,7 @@ target_link_options(common INTERFACE ${sanitizers_linker_flags})
 # This module appends -fsanitize-ignorelist=<path> for Clang builds.
 # The ignorelist path contains CMAKE_SOURCE_DIR, so it must be set here, rather than in the Conan profile.
 # GCC does not support -fsanitize-ignorelist.
-if(is_clang)
+if(is_any_clang)
    set(ignorelist_path
        "${CMAKE_SOURCE_DIR}/sanitizers/suppressions/sanitizer-ignorelist.txt"
    )
@@ -23,11 +23,8 @@ if(NOT is_multiconfig)
    endif()
 endif()

-if(is_clang) # both Clang and AppleClang
-    if(
-        "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang"
-        AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0
-    )
+if(is_llvm_clang)
+    if(CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0)
        message(FATAL_ERROR "This project requires clang 16 or later")
    endif()
 elseif(is_gcc)
@@ -32,6 +32,11 @@ endif()

 option(benchmark "Build benchmarks" ON)

+# When OFF, the crates directory is not added to the build at all: no Rust
+# toolchain is required, no cxxbridge bindings are generated, and the C++ tests
+# that consume those bindings are left out of the build tree.
+option(rust "Build the Rust crates and the C++ code that depends on them" OFF)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are
@@ -57,11 +62,11 @@ if(unity)
    set(CMAKE_UNITY_BUILD ON CACHE BOOL "Do a unity build")
 endif()

-if(is_clang AND is_linux)
+if(is_llvm_clang AND is_linux)
    option(voidstar "Enable Antithesis instrumentation." OFF)
 endif()

-if(is_gcc OR is_clang)
+if(is_gcc OR is_any_clang)
    include(ProcessorCount)
    ProcessorCount(PROCESSOR_COUNT)

@@ -120,7 +125,7 @@ else()
    set(use_mold OFF CACHE BOOL "mold linker, linux only" FORCE)
 endif()

-if(is_clang)
+if(is_any_clang)
    option(use_lld "enables detection of lld linker" ON)
 else()
    set(use_lld OFF CACHE BOOL "try lld linker, clang only" FORCE)
@@ -7,7 +7,7 @@
 pcpp>=1.30

 # Parser combinator library - used to parse the macro DSL
-pyparsing>=3.0.0
+pyparsing>=3.3.3

 # Template engine - used to generate C++ code from templates
-Mako>=1.2.2
+Mako>=1.4.2
@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile requirements.in --generate-hashes --output-file requirements.txt
-mako==1.3.12 \
-    --hash=sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9 \
-    --hash=sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a
+mako==1.4.3 \
+    --hash=sha256:723296007c870bfd6b3f0c3230dba7198096e5269297ebf5e4eff9e7ffa39d4f \
+    --hash=sha256:cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a
    # via -r requirements.in
 markupsafe==3.0.3 \
    --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
@@ -99,7 +99,7 @@ pcpp==1.30 \
    --hash=sha256:05fe08292b6da57f385001c891a87f40d6aa7f46787b03e8ba326d20a3297c6e \
    --hash=sha256:5af9fbce55f136d7931ae915fae03c34030a3b36c496e72d9636cedc8e2543a1
    # via -r requirements.in
-pyparsing==3.3.2 \
-    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
-    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
+pyparsing==3.3.3 \
+    --hash=sha256:928ae7e20211f3b6f3915a72f06a0cfd29ab9d24279dd6346b6b1a7146397d36 \
+    --hash=sha256:ece8c00a69cf01b45d0b1dedabb469c90d8caf996d4fda40f147627a122849a4
    # via -r requirements.in
@@ -3,7 +3,7 @@
    "requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
+        "xrpl-rpc-spec/0.1.25#2daa763e2d86ccc4ad0a0fa4d1983e9f%1791907455.579992",
        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
        "nudb/2.0.9",
        "openssl/3.6.3",
        "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.21",
+        "xrpl-rpc-spec/0.1.25",
        "zlib/1.3.2",
    ]

@@ -158,12 +158,8 @@ class Xrpl(ConanFile):
        "CMakeLists.txt",
        "cfg/*",
        "cmake/*",
-        "crates/*",
-        "crates/.cargo/*",
-        "!crates/target/*",
        "external/*",
        "include/*",
-        "rust-toolchain.toml",
        "src/*",
    )

@@ -100,28 +100,4 @@ function(add_xrpl_crate name)
    add_dependencies(xrpl_crates ${name}_cxxbridge)
 endfunction()

-add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
-
-# The ffi crate's `build.rs` writes the ABI's enums and constants header here.
-# Linking the crate already orders every consumer after the cargo build.
-set(host_functions_bindgen_out_dir
-    "${CMAKE_CURRENT_BINARY_DIR}/cbindgen/include"
-)
-# The cxxbridge target's include dirs reach the imported crate target, which CMake
-# requires to exist at generate time.
-file(MAKE_DIRECTORY ${host_functions_bindgen_out_dir})
-corrosion_set_env_vars(
-    xrpl_wasm_vm_ffi
-    "HOST_FUNCTIONS_BINDGEN_OUT_DIR=${host_functions_bindgen_out_dir}"
-)
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PUBLIC ${host_functions_bindgen_out_dir}
-)
-
-add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
-
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PRIVATE ${CMAKE_SOURCE_DIR}/include
-)
+add_xrpl_crate(rs_hello_world CRATE rs_hello_world FILES lib.rs)
@@ -8,36 +8,6 @@ version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"

-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "cbindgen"
-version = "0.29.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ecb53484c9c167ba674026b656d8a27d7657a58e6066aa902bfb1a4aa00ae20"
-dependencies = [
- "heck",
- "indexmap",
- "log",
- "proc-macro2",
- "quote",
- "serde",
- "serde_json",
- "syn 2.0.117",
- "tempfile",
- "toml",
-]
-
 [[package]]
 name = "cc"
 version = "1.2.61"
@@ -48,12 +18,6 @@ dependencies = [
 "shlex",
 ]

-[[package]]
-name = "cfg-if"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
-
 [[package]]
 name = "clap"
 version = "4.6.1"
@@ -102,7 +66,7 @@ dependencies = [
 "cxxbridge-cmd",
 "cxxbridge-flags",
 "cxxbridge-macro",
- "foldhash 0.2.0",
+ "foldhash",
 "link-cplusplus",
 ]

@@ -159,72 +123,24 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"

-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"

-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"

-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -232,33 +148,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown",
 ]

-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
-[[package]]
-name = "libc"
-version = "0.2.190"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
 [[package]]
 name = "link-cplusplus"
 version = "1.0.12"
@@ -268,30 +160,6 @@ dependencies = [
 "cc",
 ]

-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
-name = "log"
-version = "0.4.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -311,22 +179,10 @@ dependencies = [
 ]

 [[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "rustix"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+name = "rs-hello_world"
+version = "0.1.0"
 dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys",
+ "cxx",
 ]

 [[package]]
@@ -335,12 +191,6 @@ version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"

-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -371,50 +221,12 @@ dependencies = [
 "syn 2.0.117",
 ]

-[[package]]
-name = "serde_json"
-version = "1.0.154"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
-dependencies = [
- "serde_core",
-]
-
 [[package]]
 name = "shlex"
 version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"

-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "string-interner"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
-dependencies = [
- "hashbrown 0.15.5",
- "serde",
-]
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -443,19 +255,6 @@ dependencies = [
 "unicode-ident",
 ]

-[[package]]
-name = "tempfile"
-version = "3.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
-dependencies = [
- "fastrand",
- "getrandom",
- "once_cell",
- "rustix",
- "windows-sys",
-]
-
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -465,45 +264,6 @@ dependencies = [
 "winapi-util",
 ]

-[[package]]
-name = "toml"
-version = "0.9.12+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
-dependencies = [
- "indexmap",
- "serde_core",
- "serde_spanned",
- "toml_datetime",
- "toml_parser",
- "toml_writer",
- "winnow 0.7.15",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
-dependencies = [
- "winnow 1.0.4",
-]
-
-[[package]]
-name = "toml_writer"
-version = "1.1.3+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -516,99 +276,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"

-[[package]]
-name = "wasm-encoder"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.254.0",
-]
-
-[[package]]
-name = "wasmi"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78693fcdd618e0fc34af59c6b8efa9ac5d58c68df940beff4bedddb6acfe7c27"
-dependencies = [
- "spin",
- "wasmi_collections",
- "wasmi_core",
- "wasmi_ir",
- "wasmparser 0.228.0",
-]
-
-[[package]]
-name = "wasmi_collections"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a8be2aa467cf2d29e96ff759472c36eeb44a3c81c67fc9cb76c9a24c519c557"
-dependencies = [
- "string-interner",
-]
-
-[[package]]
-name = "wasmi_core"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69372d5fda3ea3d1e0aa6603c7888110e0187e88ea17cd8fc2e2df0a0e1f37fa"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmi_ir"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f17b774caa13c618c7244f1ee51fe23c5e7b8538a471fa46d9949779758aed6"
-dependencies = [
- "wasmi_core",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.228.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4abf1132c1fdf747d56bbc1bb52152400c70f336870f968b85e89ea422198ae3"
-dependencies = [
- "bitflags",
- "indexmap",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
-dependencies = [
- "bitflags",
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wast"
-version = "254.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
-dependencies = [
- "bumpalo",
- "leb128fmt",
- "memchr",
- "unicode-width",
- "wasm-encoder",
-]
-
-[[package]]
-name = "wat"
-version = "1.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
-dependencies = [
- "wast",
-]
-
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -632,67 +299,3 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
 "windows-link",
 ]
-
-[[package]]
-name = "winnow"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-
-[[package]]
-name = "winnow"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
-
-[[package]]
-name = "xrpl-host-functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-host-functions-macros",
-]
-
-[[package]]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-dependencies = [
- "wasmi",
- "wasmparser 0.228.0",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-dependencies = [
- "cbindgen",
- "cxx",
- "xrpl-host-functions",
- "xrpl-wasm-vm",
-]
-
-[[package]]
-name = "zmij"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
@@ -1,15 +1,9 @@
 [workspace]
-members = [
-    "xrpl-wasm-vm-ffi",
-    "xrpl-wasm-vm",
-    "xrpl-wasm-testkit",
-    "xrpl-host-functions",
-    "xrpl-host-functions-macros",
-]
+members = ["hello_world"]
 resolver = "3"

 [workspace.dependencies]
-cxx = { version = "1.0.199", features = ["c++20"] }
+cxx = { version = "1.0.198", features = ["c++20"] }

 [workspace.package]
 edition = "2024"
@@ -21,5 +15,4 @@ unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage
 opt-level = 3
 overflow-checks = true
 lto = true
-codegen-units = 1
 debug = true
@@ -1,126 +0,0 @@
-# Rust crates
-
-This directory holds the WebAssembly engine that runs Smart Escrow contracts,
-bridged into C++ via `cxxbridge`/the `cxx` crate.
-
-The workspace is built unconditionally — `add_subdirectory(crates)` in the
-top-level `CMakeLists.txt` is not behind an option, and
-`xrpl_wasm_vm_ffi_cxxbridge` is a `PUBLIC` dependency of
-`xrpl.libxrpl.tx` (see `cmake/XrplCore.cmake`). The Rust toolchain pinned in
-[`rust-toolchain.toml`](../rust-toolchain.toml) is therefore required to build
-`libxrpl` at all; the Nix devshell provides it automatically.
-
-## The crates
-
-Dependencies run in one direction: the ABI crate at the bottom, the engine on
-top of it, and the two bridges at the edge.
-
-### `xrpl-host-functions`
-
-The wasm host ABI, declared exactly once. A `host_functions!` block at the
-bottom of `src/lib.rs` generates the `HostFunctions` trait a host implements and
-the `HostFunctionSpec` table a wasm engine registers from. Only the vocabulary
-the declarations are written in — `HostError`, `HostResult`, `TraceDataType`,
-`HASH_LEN` — is hand-written.
-
-**Add or change a host function here**, never in the engine or the bridge: the
-expansion names nothing this file does not, so neither side of the FFI boundary
-gets to restate a signature.
-
-`no_std`, because this crate is also what a guest contract links against.
-
-### `xrpl-host-functions-macros`
-
-The proc macro behind that block, plus the `wasmi_glue!` marshalling it
-generates. An implementation detail of the crate above — nothing else should
-depend on it.
-
-The dev-dependency back on `xrpl-host-functions` is a deliberate cycle: the
-doctests declare host functions returning `HostResult`, which the facade crate
-hand-writes. Cargo allows it because dev-dependencies sit outside the library
-build graph.
-
-### `xrpl-wasm-vm`
-
-The engine itself, on `wasmi`: preflight validation (`preflight/`), gas
-metering and execution (`vm.rs`), and host-call dispatch (`abi.rs`, `args.rs`,
-`register.rs`).
-
-Two lint decisions are load-bearing, both because this is a consensus path:
-
- `forbid(unsafe_code)`, so "every guest access reaches linear memory only
-  through wasmi's bounds-checked slice operations" is a property rather than a
-  claim.
- The truncating, wrapping and sign-losing cast lints are `deny` and each
-  remaining cast is argued for at its site — a bad cast here changes what a
-  contract is charged or told.
-
-It pins `wasmi` with `default-features = false` deliberately. wasmi's `wat`
-feature is on by default and makes `Module::new` accept text as readily as
-binary, which would turn a transaction's validity into a build flag.
-
-Not bridged to C++ directly; it reaches `xrpld` through `xrpl-wasm-vm-ffi`.
-
-### `xrpl-wasm-vm-ffi`
-
-The cxx bridge into `xrpld`. Three crossings:
-
- **In:** C++ calls `run_escrow`, once per escrow finish.
- **Back out:** that run's host calls leave through the C++ `HostContext`, which
-  `CxxHost` presents to the engine as an ordinary `HostFunctions` implementor.
- **In only:** C++ screens a module with `check_escrow`. Screening needs no
-  host, so nothing comes back out.
-
-The C++ side is `src/libxrpl/tx/wasm/WasmVM.cpp` and
-`src/libxrpl/tx/wasm/HostContext.cpp`.
-
-`build.rs` also runs cbindgen over `xrpl-host-functions`, writing the ABI's wire
-enums and integer constants to `xrpl_host_functions.h`, so C++ declares none of
-them itself. cbindgen reads the source, not the expansion, which is why
-`#[coded_enum]` requires `#[repr(i32)]` instead of supplying it. An enum reaches
-the header only if `cbindgen.toml` lists it.
-
-**Neither language may unwind into the other**, and the two halves are not
-symmetric:
-
- A **Rust panic** is caught here, by `guarded`. Letting one reach C++ is
-  undefined behaviour, and `[profile.release]` enables overflow checks, so this
-  is a live path rather than a formality.
- A **C++ exception** is stopped on the C++ side: every `HostContext` method is
-  `noexcept` and catches its own. That is what makes `guarded` sufficient.
-
-Everything hand-written here is private, so `cargo doc` needs
-`--document-private-items` to show any of it. That is also why this crate,
-unlike `xrpl-wasm-vm`, does not `deny(unreachable_pub)` — cxx's expansion is
-`pub` throughout by necessity.
-
-### `xrpl-wasm-testkit`
-
-**Test-only.** Assembles WebAssembly text for the C++ test suite, and exposes
-the gas price of each host function by its guest import name for the C++ gas
-benchmarks (read through the bridge rather than transcribed into C++, so the
-numbers cannot drift silently).
-
-A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the
-separation is the point: putting `compile_wat` on the production bridge would
-link `wat` into `xrpld` even if nothing called it. Linked only into
-`xrpl_tests`, never into `libxrpl` or `xrpld`, so "no text assembler in the
-shipped node" holds by the link graph rather than by a flag someone can flip.
-
-## Testing
-
-```bash
-cargo test --manifest-path crates/Cargo.toml --workspace
-```
-
-CI uses `cargo nextest`. This is independent of the CMake build.
-
-One gap that command does not cover: it never compiles `xrpl-host-functions`
-with its `wasmi_glue` feature **off**, because `xrpl-wasm-vm` enables the
-feature and Cargo unifies features across a workspace build. The feature-off
-configuration is the one a guest contract sees, so after touching that crate
-also run:
-
-```bash
-cargo check -p xrpl-host-functions --manifest-path crates/Cargo.toml
-```
@@ -0,0 +1,13 @@
+[package]
+name = "rs-hello_world"
+version = "0.1.0"
+edition.workspace = true
+
+[lib]
+crate-type = ["staticlib"]
+
+[dependencies]
+cxx.workspace = true
+
+[lints]
+workspace = true
@@ -0,0 +1,23 @@
+#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
+
+#[cxx::bridge(namespace = "rs::hello_world")]
+mod ffi {
+    extern "Rust" {
+        fn hello_world() -> String;
+    }
+}
+
+pub fn hello_world() -> String {
+    "hello_world".to_string()
+}
+
+#[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hello_world_returns_hello_world() {
+        assert_eq!(hello_world(), "hello_world")
+    }
+}
@@ -1,21 +0,0 @@
-[package]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { version = "3", features = ["full"] }
-quote = "1"
-proc-macro2 = "1"
-
-# The doctest declares host functions returning `HostResult`, which the facade
-# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
-# the library build graph.
-[dev-dependencies]
-xrpl-host-functions.path = "../xrpl-host-functions"
-
-[lints]
-workspace = true
@@ -1,358 +0,0 @@
-//! `#[coded_enum]`: an enum of wire codes, and the `ALL`/`code`/`from_code` set
-//! that must not fall behind its variants.
-//!
-//! Rust cannot enumerate an enum's variants — an exhaustive `match` forces an arm per
-//! variant but gives nothing to iterate — so `ALL` is trustworthy only by being
-//! generated from them, as `HostFunctionSpec::ALL` is from the `host_functions!` block.
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{Expr, ExprLit, ExprUnary, Fields, Ident, ItemEnum, Lit, UnOp, Variant};
-
-use crate::errors;
-
-/// One variant as the expansion reads it: the name `ALL` lists and the code
-/// `from_code` matches.
-struct WireVariant<'a> {
-    ident: &'a Ident,
-    code: &'a Expr,
-}
-
-pub(crate) fn expand(args: TokenStream, item: TokenStream) -> syn::Result<TokenStream> {
-    if !args.is_empty() {
-        return Err(syn::Error::new_spanned(
-            args,
-            "`#[coded_enum]` takes no arguments",
-        ));
-    }
-
-    let item: ItemEnum = syn::parse2(item)?;
-    let repr = check_repr_i32(&item);
-    let variants = wire_variants(&item);
-    let variants = match repr {
-        Ok(()) => variants?,
-        Err(mut error) => {
-            if let Err(more) = variants {
-                error.combine(more);
-            }
-            return Err(error);
-        }
-    };
-
-    let attrs = &item.attrs;
-    let vis = &item.vis;
-    let name = &item.ident;
-    let declarations = item.variants.iter();
-    let identifiers = variants.iter().map(|variant| variant.ident);
-    let arms = variants.iter().map(|variant| {
-        let (ident, code) = (variant.ident, variant.code);
-        quote! { #code => Some(Self::#ident) }
-    });
-
-    Ok(quote! {
-        #(#attrs)*
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #vis enum #name {
-            #(#declarations,)*
-        }
-
-        impl #name {
-            /// Every variant, in declaration order — the whole set, and whole by
-            /// construction.
-            pub const ALL: &'static [Self] = &[#(Self::#identifiers,)*];
-
-            /// The wire value that names this variant.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// The variant `code` names, or `None` if no variant does — what an
-            /// unnamed code means is the caller's to decide.
-            pub const fn from_code(code: i32) -> Option<Self> {
-                match code {
-                    #(#arms,)*
-                    _ => None,
-                }
-            }
-        }
-    })
-}
-
-/// The `#[repr(i32)]` that `code` casts through, required rather than supplied:
-/// cbindgen reads the source, and exports an enum only if it sees the repr there.
-fn check_repr_i32(item: &ItemEnum) -> syn::Result<()> {
-    let repr_attrs: Vec<_> = item
-        .attrs
-        .iter()
-        .filter(|attr| attr.path().is_ident("repr"))
-        .collect();
-
-    if repr_attrs.is_empty() {
-        return Err(syn::Error::new_spanned(
-            &item.ident,
-            "missing `#[repr(i32)]`: a wire enum states its representation itself",
-        ));
-    }
-
-    let wrong = repr_attrs
-        .into_iter()
-        .filter(|attr| !attr.parse_args::<Ident>().is_ok_and(|repr| repr == "i32"))
-        .map(|attr| syn::Error::new_spanned(attr, "a wire enum is `#[repr(i32)]`, and only that"));
-    errors::into_result((), wrong.collect())
-}
-
-/// Every variant, checked against what the expansion needs of it, or every
-/// mistake in the list.
-fn wire_variants(item: &ItemEnum) -> syn::Result<Vec<WireVariant<'_>>> {
-    // `#[repr(i32)]` is rejected on a variantless enum, and there is nothing for a
-    // wire enum with no codes to mean anyway.
-    if item.variants.is_empty() {
-        return Err(syn::Error::new_spanned(
-            item,
-            "`#[coded_enum]` needs at least one variant",
-        ));
-    }
-
-    let mut errors = Vec::new();
-    let variants = item
-        .variants
-        .iter()
-        .filter_map(|variant| {
-            let code = errors::record(code_of(variant), &mut errors)?;
-            Some(WireVariant {
-                ident: &variant.ident,
-                code,
-            })
-        })
-        .collect();
-
-    errors::into_result(variants, errors)
-}
-
-/// The code a variant is declared with.
-fn code_of(variant: &Variant) -> syn::Result<&Expr> {
-    if !matches!(variant.fields, Fields::Unit) {
-        return Err(syn::Error::new_spanned(
-            &variant.fields,
-            "a wire enum's variants carry no data: the code is the whole of what crosses",
-        ));
-    }
-
-    let Some((_, code)) = &variant.discriminant else {
-        return Err(syn::Error::new_spanned(
-            variant,
-            "missing `= <code>`: a wire value is declared, never implied by position",
-        ));
-    };
-
-    if !is_integer_literal(code) {
-        return Err(syn::Error::new_spanned(
-            code,
-            "a wire value must be an integer literal, since `from_code` matches it as a pattern",
-        ));
-    }
-
-    Ok(code)
-}
-
-/// `-2147483648` and `7`, but not `i32::MIN` or `1 + 1`: the discriminant is emitted
-/// into pattern position unchanged, where an expression means something else or nothing.
-fn is_integer_literal(code: &Expr) -> bool {
-    match code {
-        Expr::Lit(ExprLit {
-            lit: Lit::Int(_), ..
-        }) => true,
-        Expr::Unary(ExprUnary {
-            op: UnOp::Neg(_),
-            expr,
-            ..
-        }) => is_integer_literal(expr),
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The whole expansion for the smallest list that exercises every generated
-    /// item, negative codes included.
-    #[test]
-    fn generates_the_enum_and_the_three_items_over_it() {
-        let generated = generated(quote! {
-            /// How a trace buffer is read.
-            #[repr(i32)]
-            pub enum TraceDataType {
-                /// Eight little-endian bytes.
-                Int64 = 1,
-                Unnamed = -2,
-            }
-        });
-
-        for expected in [
-            // The declaration reaches the output as written, doc comments and repr
-            // and all, under the derives.
-            "# [doc = r\" How a trace buffer is read.\"] # [repr (i32)] \
-             # [derive (Debug , Clone , Copy , PartialEq , Eq)] \
-             pub enum TraceDataType { # [doc = r\" Eight little-endian bytes.\"] Int64 = 1 , \
-             Unnamed = - 2 , }",
-            "pub const ALL : & 'static [Self] = & [Self :: Int64 , Self :: Unnamed ,] ;",
-            "pub const fn code (self) -> i32 { self as i32 }",
-            "pub const fn from_code (code : i32) -> Option < Self > \
-             { match code { 1 => Some (Self :: Int64) , - 2 => Some (Self :: Unnamed) , \
-             _ => None , } }",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The visibility is the caller's: a `pub` the macro supplied would be one the
-    /// declaration could not take back.
-    #[test]
-    fn keeps_the_declared_visibility() {
-        assert!(
-            generated(quote! {
-                #[repr(i32)]
-                enum Private {
-                    One = 1,
-                }
-            })
-            .contains("enum Private"),
-            "the expansion should not widen a private enum"
-        );
-    }
-
-    /// A variant with no code would take one from its position, which is the
-    /// mistake that silently renumbers a wire value.
-    #[test]
-    fn rejects_a_variant_without_a_code() {
-        let messages = messages(quote! {
-            #[repr(i32)]
-            pub enum Ordering {
-                Equal = 0,
-                Greater,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("missing `= <code>`"), "{messages:?}");
-    }
-
-    /// The two shapes a code is tempting to write as and cannot be: a constant's
-    /// path, and arithmetic.
-    #[test]
-    fn rejects_a_code_that_is_not_an_integer_literal() {
-        let messages = messages(quote! {
-            #[repr(i32)]
-            pub enum Ordering {
-                Equal = i32::MIN,
-                Greater = 1 + 1,
-            }
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        for message in &messages {
-            assert!(message.contains("must be an integer literal"), "{message}");
-        }
-    }
-
-    #[test]
-    fn rejects_a_variant_carrying_data() {
-        let messages = messages(quote! {
-            #[repr(i32)]
-            pub enum Ordering {
-                Equal(u8) = 0,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("carry no data"), "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_an_enum_without_a_repr() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal = 0,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("missing `#[repr(i32)]`"),
-            "{messages:?}"
-        );
-    }
-
-    /// `code` casts through `i32`, and any other hint changes the layout C++ sees.
-    #[test]
-    fn rejects_a_repr_other_than_i32() {
-        for repr in [quote!(#[repr(u8)]), quote!(#[repr(i32, C)])] {
-            let messages = messages(quote! {
-                #repr
-                pub enum Ordering {
-                    Equal = 0,
-                }
-            });
-
-            assert_eq!(messages.len(), 1, "{messages:?}");
-            assert!(messages[0].contains("only that"), "{messages:?}");
-        }
-    }
-
-    /// `#[repr(i32)]` is rejected on a variantless enum, so the diagnostic has to
-    /// be this one rather than rustc's.
-    #[test]
-    fn rejects_an_enum_with_no_variants() {
-        let messages = messages(quote! {
-            #[repr(i32)]
-            pub enum Nothing {}
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("at least one variant"), "{messages:?}");
-    }
-
-    /// Every mistake in one build, as `host_functions!` reports a block.
-    #[test]
-    fn reports_every_mistake_in_the_list() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal,
-                Greater = 1 + 1,
-            }
-        });
-
-        assert_eq!(messages.len(), 3, "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_arguments() {
-        let error = expand(quote!(i64), quote! { pub enum Ordering { Equal = 0, } })
-            .expect_err("expected the argument to be refused");
-
-        assert!(error.to_string().contains("takes no arguments"));
-    }
-
-    #[test]
-    fn rejects_an_item_that_is_not_an_enum() {
-        expand(quote!(), quote! { pub struct Ordering; })
-            .expect_err("expected a struct to be refused");
-    }
-
-    fn generated(item: TokenStream) -> String {
-        expand(quote!(), item)
-            .expect("the enum should expand")
-            .to_string()
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(item: TokenStream) -> Vec<String> {
-        let Err(error) = expand(quote!(), item) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-}
@@ -1,33 +0,0 @@
-/// Folds accumulated diagnostics into the single error a macro can return.
-///
-/// `syn::Error` is itself a collection: `combine` appends, and
-/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
-/// instead of returning the first error means every mistake in a
-/// `host_functions!` block surfaces in one build rather than one per rebuild.
-pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
-    errors.into_iter().reduce(|mut first, next| {
-        first.combine(next);
-        first
-    })
-}
-
-/// `value`, or the folded diagnostics if any were recorded.
-pub(crate) fn into_result<T>(value: T, errors: Vec<syn::Error>) -> syn::Result<T> {
-    match combine(errors) {
-        Some(error) => Err(error),
-        None => Ok(value),
-    }
-}
-
-/// `result`'s value, or `None` with its error filed in `errors` — so a check that
-/// yields a value can be reported like one that yields nothing, and the caller
-/// keeps going.
-pub(crate) fn record<T>(result: syn::Result<T>, errors: &mut Vec<syn::Error>) -> Option<T> {
-    match result {
-        Ok(value) => Some(value),
-        Err(error) => {
-            errors.push(error);
-            None
-        }
-    }
-}
@@ -1,472 +0,0 @@
-//! The wasmi registration, generated from the declarations the ABI table is
-//! generated from — so the closure a guest links against cannot disagree with the
-//! signature preflight screens it by.
-//!
-//! Emitted as a `macro_rules!` rather than as the registration itself, because the
-//! crate the expansion lands in is `no_std`, zero-dependency and links into the
-//! guest, and a `macro_rules!` body is inert tokens until someone expands it.
-//!
-//! The body therefore resolves in two crates at once and names nothing free:
-//! `$crate` is the ABI crate, `$env` the module the caller passes in, and every
-//! other path starts at `::wasmi` or `::core`. `$env` is matched as an `ident`
-//! because `$env:path` used as `$env::Foo` is `error: missing angle brackets in
-//! associated item path`.
-//!
-//! The one file that knows an engine's calling convention: how a region arrives as
-//! two wasm parameters, where the gas charge goes, and which helper a result-less
-//! function takes. A second engine would be a second file like it.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, quote};
-
-use crate::lowering::{ResultType, WasmValType};
-use crate::parsed_host_function::{Param, ParsedHostFunction};
-
-/// The `wasmi_glue!` macro: the trait a VM implements one body per host function
-/// in, and the registration that hands each of them to a `Linker`.
-pub(crate) fn wasmi_glue(functions: &[ParsedHostFunction]) -> TokenStream {
-    let bodies = functions.iter().map(body_declaration);
-    let registrations = functions.iter().map(registration);
-    let assertions = charging_assertions();
-    let env = env();
-
-    quote! {
-        /// Expands to the wasmi glue for this ABI: the `HostFunctionBodies` trait
-        /// and `register_host_functions`, at the scope it is called in. A
-        /// declaration added to the ABI is then a missing trait item rather than a
-        /// forgotten registration.
-        ///
-        /// `$env` names a module holding everything the expansion reaches for on
-        /// the engine's side, since this crate can name none of it: the store type
-        /// `VmState`, the charging helpers `charged` and `charged_unreported` with
-        /// their `CallResult`, and the argument types `InBytes`, `InStr`, `InU32`,
-        /// `OutBytes` and `TraceCode`.
-        ///
-        /// ```ignore
-        /// mod glue_env {
-        ///     pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-        ///     pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-        ///     pub(crate) use crate::vm::VmState;
-        /// }
-        ///
-        /// xrpl_host_functions::wasmi_glue!(glue_env);
-        /// ```
-        ///
-        /// The module supplies the spellings; the shapes are pinned by the
-        /// expansion. Each argument type implements [`FromWasmRegion`] or
-        /// [`FromWasmScalar`] — which one is the ABI's decision, so a declared
-        /// `u32` is a region — and each charging helper's signature is asserted
-        /// against a `const _`.
-        #[cfg(feature = "wasmi_glue")]
-        #[macro_export]
-        macro_rules! wasmi_glue {
-            ($env:ident) => {
-                /// One body per host function: what the engine runs once the call's
-                /// gas is charged and its arguments are off the wire.
-                ///
-                /// The methods take no receiver, so a registered closure captures
-                /// nothing — which is what satisfies wasmi's
-                /// `Fn + Send + Sync + 'static` bound, and why the implementor
-                /// itself need not be `'static`. A body does not charge gas; the
-                /// generated closure does, so it cannot be forgotten or charged
-                /// twice.
-                pub(crate) trait HostFunctionBodies {
-                    #(#bodies)*
-                }
-
-                /// Register every host function on `linker`, one `func_wrap` per
-                /// declaration, at the ABI's derived wasm signature — so an import
-                /// that passes [`crate::check`] links here by construction.
-                pub(crate) fn register_host_functions<B: HostFunctionBodies>(
-                    linker: &mut ::wasmi::Linker<#env::VmState<'_>>,
-                ) -> ::core::result::Result<(), ::wasmi::errors::LinkerError> {
-                    #(#registrations)*
-                    Ok(())
-                }
-
-                #assertions
-            };
-        }
-    }
-}
-
-/// The macro argument every engine-side path is qualified by.
-fn env() -> TokenStream {
-    quote!($env)
-}
-
-/// The signature of each charging helper, pinned as a `const _` the expansion
-/// carries: the one part of the contract neither `$env` nor the argument traits
-/// state.
-///
-/// Its value is the diagnostic. A changed helper is already a type error at the
-/// call, but there it is failed inference inside a generated closure and here it
-/// is one line stating the signature that was expected.
-fn charging_assertions() -> TokenStream {
-    let env = env();
-    let assertion = |helper: TokenStream, answer: TokenStream| {
-        quote! {
-            const _: fn(
-                &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-                $crate::HostFunctionSpec,
-                fn(&mut ::wasmi::Caller<'_, #env::VmState<'_>>) -> #env::CallResult<#answer>,
-            ) -> ::core::result::Result<#answer, ::wasmi::Error> = #env::#helper;
-        }
-    };
-
-    let reported = assertion(quote!(charged), quote!(i32));
-    let unreported = assertion(quote!(charged_unreported), quote!(()));
-
-    quote! {
-        #reported
-        #unreported
-    }
-}
-
-/// `fn check_keylet(caller: &mut Caller<'_, $env::VmState<'_>>, account:
-/// $env::InBytes, seq: $env::InU32, out: $env::OutBytes) ->
-/// $env::CallResult<i32>;`
-fn body_declaration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let name = &function.signature.ident;
-    let params = function.params().iter().map(|param| {
-        let name = &param.name;
-        let ty = param.ty.argument_type(&env);
-        quote! { #name: #ty }
-    });
-    let answer = answer_type(function.result());
-
-    quote! {
-        fn #name(
-            caller: &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-            #(#params),*
-        ) -> #answer;
-    }
-}
-
-/// One `linker.func_wrap(…)?;`: the wasm signature as the closure's parameters,
-/// the gas charge around the call, and the body between them.
-fn registration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let body = &function.signature.ident;
-    let spec = spec_path(function);
-    let params = function.params().iter().flat_map(closure_params);
-    let arguments = function.params().iter().map(lift);
-    let (answer, charge) = match function.result() {
-        ResultType::BufferLength | ResultType::Value => (quote!(i32), quote!(#env::charged)),
-        ResultType::Nothing => (quote!(()), quote!(#env::charged_unreported)),
-    };
-
-    quote! {
-        linker.func_wrap(
-            $crate::HOST_MODULE,
-            #spec.wasm_name(),
-            |mut caller: ::wasmi::Caller<'_, #env::VmState<'_>>, #(#params),*|
-             -> ::core::result::Result<#answer, ::wasmi::Error> {
-                #charge(&mut caller, #spec, |caller| {
-                    B::#body(caller, #(#arguments),*)
-                })
-            },
-        )?;
-    }
-}
-
-/// `$crate::HostFunctionSpec::CheckKeylet` — the one name the expansion reaches
-/// back into the ABI crate for.
-fn spec_path(function: &ParsedHostFunction) -> TokenStream {
-    let variant = &function.variant;
-    quote! { $crate::HostFunctionSpec::#variant }
-}
-
-/// One declared parameter as the closure declares it: `account_ptr: i32,
-/// account_len: i32`, or `field: i32`.
-///
-/// Names and types both come from the lowering, so the arity a closure is
-/// registered at *is* the derived arity.
-fn closure_params(param: &Param) -> Vec<TokenStream> {
-    param
-        .ty
-        .wasm_names(&param.name)
-        .into_iter()
-        .zip(param.ty.as_wasm_params())
-        .map(|(name, val_type)| {
-            let ty = rust_type(*val_type);
-            quote! { #name: #ty }
-        })
-        .collect()
-}
-
-/// The argument a body is handed, built from the wasm parameters it arrived as:
-/// `<$env::InBytes as $crate::FromWasmRegion>::from_wasm(account_ptr,
-/// account_len)`, or the scalar itself.
-///
-/// Qualified rather than an inherent call, so the arity comes from the trait the
-/// lowering chose: an argument type implementing the other one is an unsatisfied
-/// bound named at the type, where `Ty::from_wasm(a, b)` would be an unrelated
-/// arity error named here.
-fn lift(param: &Param) -> TokenStream {
-    let Some(argument_trait) = param.ty.argument_trait() else {
-        return param.name.to_token_stream();
-    };
-    let ty = param.ty.argument_type(&env());
-    let names = param.ty.wasm_names(&param.name);
-
-    quote! { <#ty as $crate::#argument_trait>::from_wasm(#(#names),*) }
-}
-
-/// What a body answers: the value the guest is told, or nothing at all for the
-/// function whose whole effect is on the host.
-fn answer_type(result: ResultType) -> TokenStream {
-    let env = env();
-    match result {
-        ResultType::BufferLength | ResultType::Value => quote!(#env::CallResult<i32>),
-        ResultType::Nothing => quote!(#env::CallResult<()>),
-    }
-}
-
-/// A wasm value type as a closure parameter spells it — a Rust type, not
-/// [`WasmValType`]'s own `ToTokens`, which spells the ABI crate's variant.
-fn rust_type(val_type: WasmValType) -> TokenStream {
-    match val_type {
-        WasmValType::I32 => quote!(i32),
-        WasmValType::I64 => quote!(i64),
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use proc_macro2::{Delimiter, Group, TokenTree};
-    use syn::parse_quote;
-
-    fn parsed(function: syn::TraitItemFn) -> ParsedHostFunction {
-        ParsedHostFunction::parse(function).expect("the declaration should parse")
-    }
-
-    /// The declaration whose declared and wasm parameter lists differ most:
-    /// `account`, `out` and `seq` are a `(ptr, len)` pair each, so three arguments
-    /// to the body and six on the wire.
-    #[test]
-    fn lowers_a_declaration_to_a_body_and_a_registration() {
-        let keylet = parsed(parse_quote! {
-            #[gas = 350]
-            #[wasm_name = "check_id"]
-            fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&keylet).to_string(),
-            "fn check_keylet (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account : $ env :: InBytes , seq : $ env :: InU32 , out : $ env :: OutBytes) \
-             -> $ env :: CallResult < i32 > ;"
-        );
-
-        assert_eq!(
-            registration(&keylet).to_string(),
-            "linker . func_wrap ($ crate :: HOST_MODULE , \
-             $ crate :: HostFunctionSpec :: CheckKeylet . wasm_name () , \
-             | mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account_ptr : i32 , account_len : i32 , seq_ptr : i32 , seq_len : i32 , \
-             out_ptr : i32 , out_len : i32 | \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > \
-             { $ env :: charged (& mut caller , \
-             $ crate :: HostFunctionSpec :: CheckKeylet , | caller | \
-             { B :: check_keylet (caller , \
-             < $ env :: InBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (account_ptr , account_len) , \
-             < $ env :: InU32 as $ crate :: FromWasmRegion > :: from_wasm (seq_ptr , seq_len) , \
-             < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (out_ptr , out_len)) }) } ,) ? ;"
-        );
-    }
-
-    /// A wasm scalar is passed through as itself, in declaration order: no pair,
-    /// no argument type, and an `i64` that stays one.
-    #[test]
-    fn passes_the_wasm_scalars_through_untouched() {
-        let from_int = parsed(parse_quote! {
-            #[gas = 100]
-            #[wasm_name = "float_from_int"]
-            fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&from_int).to_string(),
-            "fn float_from_int (caller : & mut :: wasmi :: Caller < '_ , \
-             $ env :: VmState < '_ >> , \
-             x : i64 , out : $ env :: OutBytes , mode : i32) -> $ env :: CallResult < i32 > ;"
-        );
-
-        let registration = registration(&from_int).to_string();
-        assert!(
-            registration.contains(
-                "| mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-                 x : i64 , out_ptr : i32 , out_len : i32 , mode : i32 |"
-            ),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: float_from_int (caller , x , \
-                 < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (out_ptr , out_len) , mode)"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The function that answers nothing takes the other charging helper, derived
-    /// from its declared `HostResult<()>` rather than named as a special case.
-    /// Its `TraceCode` is also the only place `FromWasmScalar` is reached for.
-    #[test]
-    fn a_declaration_that_answers_nothing_takes_the_other_charge() {
-        let trace = parsed(trace_declaration());
-
-        assert_eq!(
-            body_declaration(&trace).to_string(),
-            "fn trace (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             msg : $ env :: InStr , data_type : $ env :: TraceCode , data : $ env :: InBytes) \
-             -> $ env :: CallResult < () > ;"
-        );
-
-        let registration = registration(&trace).to_string();
-        assert!(
-            registration.contains(":: core :: result :: Result < () , :: wasmi :: Error >"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains("$ env :: charged_unreported (& mut caller"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: trace (caller , \
-                 < $ env :: InStr as $ crate :: FromWasmRegion > :: from_wasm (msg_ptr , msg_len) , \
-                 < $ env :: TraceCode as $ crate :: FromWasmScalar > :: from_wasm (data_type) , \
-                 < $ env :: InBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (data_ptr , data_len))"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The two worlds the macro body resolves in: the ABI crate through `$crate`,
-    /// and one engine by name. `names_no_crate_of_its_own` holds the ABI half of
-    /// the expansion to naming neither.
-    #[test]
-    fn reaches_the_abi_crate_through_dollar_crate_and_the_engine_by_name() {
-        let glue = code(wasmi_glue(&[parsed(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        })]));
-
-        assert!(
-            glue.contains("$ crate :: HostFunctionSpec :: GetLedgerSqn"),
-            "{glue}"
-        );
-        assert!(glue.contains("$ crate :: HOST_MODULE"), "{glue}");
-        assert!(glue.contains(":: wasmi :: Linker"), "{glue}");
-        assert!(!glue.contains("xrpl_host_functions"), "{glue}");
-    }
-
-    /// Every engine-side item is reached through the module the macro is handed: a
-    /// bare name would resolve against whatever the call site has in scope.
-    ///
-    /// `charged` covers `charged_unreported`, being its prefix.
-    #[test]
-    fn names_the_engine_s_own_items_only_through_the_module_it_is_handed() {
-        let glue = code(wasmi_glue(&[
-            parsed(trace_declaration()),
-            parsed(parse_quote! {
-                #[gas = 350]
-                #[wasm_name = "check_id"]
-                fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8])
-                    -> HostResult<usize>;
-            }),
-        ]));
-
-        for item in [
-            "VmState",
-            "CallResult",
-            "charged",
-            "InBytes",
-            "InStr",
-            "InU32",
-            "OutBytes",
-            "TraceCode",
-        ] {
-            for (index, _) in glue.match_indices(item) {
-                assert!(
-                    glue[..index].ends_with("$ env :: "),
-                    "`{item}` named outside `$env`: {glue}"
-                );
-            }
-        }
-    }
-
-    /// The charging helpers' signatures, which nothing else in the contract
-    /// states.
-    #[test]
-    fn pins_both_charging_helpers_signatures() {
-        assert_eq!(
-            charging_assertions().to_string(),
-            "const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < i32 > ,) \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > = $ env :: charged ; \
-             const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < () > ,) \
-             -> :: core :: result :: Result < () , :: wasmi :: Error > \
-             = $ env :: charged_unreported ;"
-        );
-    }
-
-    fn trace_declaration() -> syn::TraitItemFn {
-        parse_quote! {
-            #[gas = 30]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-        }
-    }
-
-    /// The expansion's code alone. `to_string` renders a doc comment as a
-    /// `#[doc = "…"]` literal, and the macro's own documentation names the very
-    /// items the scans above look for.
-    fn code(tokens: TokenStream) -> String {
-        fn is_doc(tree: Option<&TokenTree>) -> bool {
-            let Some(TokenTree::Group(group)) = tree else {
-                return false;
-            };
-            group.delimiter() == Delimiter::Bracket
-                && matches!(group.stream().into_iter().next(),
-                            Some(TokenTree::Ident(ident)) if ident == "doc")
-        }
-
-        fn strip(tokens: TokenStream) -> TokenStream {
-            let mut trees = tokens.into_iter().peekable();
-            let mut kept = Vec::new();
-            while let Some(tree) = trees.next() {
-                match tree {
-                    TokenTree::Punct(ref punct)
-                        if punct.as_char() == '#' && is_doc(trees.peek()) =>
-                    {
-                        trees.next();
-                    }
-                    TokenTree::Group(group) => kept.push(TokenTree::Group(Group::new(
-                        group.delimiter(),
-                        strip(group.stream()),
-                    ))),
-                    other => kept.push(other),
-                }
-            }
-            kept.into_iter().collect()
-        }
-
-        strip(tokens).to_string()
-    }
-}
@@ -1,541 +0,0 @@
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-mod enums;
-mod errors;
-mod glue;
-mod lowering;
-mod parsed_host_function;
-
-use std::collections::HashSet;
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{
-    TraitItemFn,
-    parse::{Parse, ParseStream},
-    parse2,
-};
-
-use parsed_host_function::ParsedHostFunction;
-
-/// Declares the wasm host ABI once, and generates everything that follows from it.
-///
-/// The input is a block of `fn` declarations, each carrying the gas cost the host
-/// charges before the call and the name the guest imports it under. Doc comments
-/// are kept and appear on the generated items.
-///
-/// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the declarations refer to and holds the one declaration
-/// block.
-///
-/// # What it generates
-///
-/// Four items, in the scope the block is written in:
-///
-/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
-///   receiver, parameters, return type and doc comment exactly as written. An
-///   execution environment implements it; the rest of the expansion does not
-///   mention it.
-/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
-///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
-///   carrying that declaration's doc comment. Its `const fn wasm_name`, `gas`,
-///   `wasm_params` and `wasm_result` are the ABI metadata, and `ALL` is every
-///   variant in declaration order — what a wasm engine iterates to build its
-///   import table.
-/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
-///   so those accessors read from a single `match` over the declarations, and
-///   never appears in a signature a caller can name.
-/// - `macro_rules! wasmi_glue`: the registration for a wasmi engine, emitted as a
-///   macro rather than as code because it names an engine this crate must not
-///   depend on. Inert until expanded — see its own documentation.
-///
-/// The wasm signature is derived from the declared types rather than stated a
-/// second time: `i32` and `i64` are the wasm scalars spelled as themselves, every
-/// other parameter type is marshalled through a `(ptr, len)` pair or an `i32`
-/// code, and the result comes from the `HostResult<T>` success type. The glue is
-/// generated from that same derivation, so the closure a guest links against and
-/// the signature it is screened by are one statement.
-///
-/// Outside the glue's body the expansion builds only `Self::Variant` and
-/// `WasmValType` paths, so the block compiles wherever the types it names —
-/// `HostResult` and `WasmValType` — resolve.
-///
-/// ```
-/// use xrpl_host_functions::{HostResult, WasmValType};
-/// use xrpl_host_functions_macros::host_functions;
-///
-/// host_functions! {
-///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
-///     #[gas = 60]
-///     #[wasm_name = "ldgr_index"]
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-///
-///     /// Writes `msg` to the trace log.
-///     #[gas = 500]
-///     #[wasm_name = "trace_num"]
-///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-/// }
-///
-/// // The trait's methods are the declarations, down to the `&self` receiver the
-/// // VM calls the host through.
-/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
-///     host.get_ledger_sqn(out)
-/// }
-///
-/// // The metadata is a `const` table, so gas and import names are available at
-/// // compile time rather than looked up at run time.
-/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
-/// assert_eq!(TRACE_GAS, 500);
-///
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
-/// assert_eq!(
-///     HostFunctionSpec::ALL,
-///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
-/// );
-///
-/// // So is the wasm signature: `out: &mut [u8]` is the pair `(ptr, len)`, and
-/// // `HostResult<usize>` answers the length written to it.
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32],
-/// );
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_result(),
-///     Some(WasmValType::I32),
-/// );
-///
-/// // `trace_num` answers nothing at all, so its import has no result.
-/// assert_eq!(
-///     HostFunctionSpec::TraceNum.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32, WasmValType::I64],
-/// );
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_result(), None);
-/// ```
-///
-/// A declaration must be a plain `fn` taking `&self`, with no body and no
-/// generics: it maps to exactly one wasm import signature. Its parameters must be
-/// `i32`, `i64`, `u32`, `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`, and it
-/// must return `HostResult<usize>` if it writes an output region,
-/// `HostResult<i32>` or `HostResult<FloatOrdering>` if it answers a value directly,
-/// or `HostResult<()>` if it answers nothing. Two declarations may not share a
-/// `wasm_name`, nor collapse to the same PascalCase variant.
-#[proc_macro]
-pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    expand(input.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-/// Declares an enum of wire codes, together with the `ALL`, `code` and
-/// `from_code` set that must not fall behind its variants.
-///
-/// The enum is written as an ordinary one — its own doc comment, its own
-/// visibility, its own `#[repr(i32)]`, one `Variant = code,` per line — and the
-/// attribute supplies the derives. The repr is required rather than supplied because
-/// cbindgen reads the source, not the expansion. Rust cannot enumerate an enum's
-/// variants, so `ALL` is the only complete set a test can iterate.
-///
-/// A variant carries no data and states its code as an integer literal, since that
-/// literal is also the pattern `from_code` matches it by. What an unnamed code means
-/// is the caller's to decide, being a different condition per enum.
-///
-/// ```
-/// use xrpl_host_functions_macros::coded_enum;
-///
-/// /// How a trace buffer is to be read.
-/// #[coded_enum]
-/// #[repr(i32)]
-/// pub enum TraceDataType {
-///     /// 8 little-endian bytes, rendered as a signed decimal.
-///     Int64 = 1,
-///     /// A 20-byte account ID, rendered as base58.
-///     Account = 4,
-/// }
-///
-/// assert_eq!(TraceDataType::Account.code(), 4);
-/// assert_eq!(TraceDataType::from_code(4), Some(TraceDataType::Account));
-/// assert_eq!(TraceDataType::from_code(2), None);
-/// assert_eq!(
-///     TraceDataType::ALL,
-///     &[TraceDataType::Int64, TraceDataType::Account],
-/// );
-/// ```
-#[proc_macro_attribute]
-pub fn coded_enum(
-    args: proc_macro::TokenStream,
-    item: proc_macro::TokenStream,
-) -> proc_macro::TokenStream {
-    enums::expand(args.into(), item.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-fn expand(input: TokenStream) -> syn::Result<TokenStream> {
-    let functions = parse_block(input)?;
-    let abi = abi_items(&functions);
-    let glue = glue::wasmi_glue(&functions);
-
-    Ok(quote! {
-        #abi
-        #glue
-    })
-}
-
-/// Every declaration in the block, parsed and checked against each other, or
-/// every mistake in it.
-fn parse_block(input: TokenStream) -> syn::Result<Vec<ParsedHostFunction>> {
-    let HostFunctionsInput { functions } = parse2(input)?;
-
-    let mut parsed = Vec::with_capacity(functions.len());
-    let mut errors = Vec::new();
-    for function in functions {
-        match ParsedHostFunction::parse(function) {
-            Ok(function) => parsed.push(function),
-            Err(error) => errors.push(error),
-        }
-    }
-    if let Some(error) = errors::combine(errors) {
-        return Err(error);
-    }
-    if let Some(error) = errors::combine(collisions(&parsed)) {
-        return Err(error);
-    }
-
-    Ok(parsed)
-}
-
-/// Names two declarations may not share, because the generated code would then
-/// fail to compile at a span the caller cannot see.
-fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
-    let mut errors = Vec::new();
-    let mut variants = HashSet::new();
-    let mut wasm_names = HashSet::new();
-
-    for function in functions {
-        if !variants.insert(function.variant.to_string()) {
-            errors.push(syn::Error::new_spanned(
-                &function.variant,
-                format!(
-                    "another host function already becomes the `{}` variant",
-                    function.variant
-                ),
-            ));
-        }
-        if !wasm_names.insert(function.wasm_name.value()) {
-            errors.push(syn::Error::new_spanned(
-                &function.wasm_name,
-                format!(
-                    "another host function is already imported as `{}`",
-                    function.wasm_name.value()
-                ),
-            ));
-        }
-    }
-
-    errors
-}
-
-/// The ABI itself: the trait a host implements and the table everything else
-/// reads. `glue::wasmi_glue` is the other half of the expansion.
-fn abi_items(functions: &[ParsedHostFunction]) -> TokenStream {
-    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
-    let variants = functions
-        .iter()
-        .map(ParsedHostFunction::variant_declaration);
-    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
-    let all = functions.iter().map(|function| &function.variant);
-
-    quote! {
-        /// The host side of the wasm ABI: one method per function a guest may
-        /// import.
-        ///
-        /// Implement it once per execution environment — the ledger host, a test
-        /// double, a benchmark fake — and a guest module cannot tell them apart.
-        /// Each method is one declaration from the `host_functions!` block, as
-        /// written; its `&self` receiver is not part of the ABI the guest sees,
-        /// so a host that must mutate does so behind interior mutability.
-        ///
-        /// # The output contract
-        ///
-        /// A method handed an `out` buffer **writes into it only when the whole
-        /// value fits, and returns the value's true length whether it fitted or
-        /// not.**
-        ///
-        /// The length is the value's, not the number of bytes written, because it
-        /// is how a guest that asked with too small a buffer learns the size to
-        /// ask for next time. The engine turns a length past the buffer into
-        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
-        /// so a host needs to know neither.
-        ///
-        /// Writing nothing unless the value fits is the half only a host can hold
-        /// up. An engine can bound how many bytes are *writable* — and does, by
-        /// handing over a region clamped to the field cap — but it cannot take
-        /// back what a method already put there. A host that wrote a truncated
-        /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore.
-        pub trait HostFunctions {
-            #(#trait_methods)*
-        }
-
-        /// One row of the ABI table: what [`HostFunctionSpec`]'s accessors
-        /// read from.
-        ///
-        /// Private, and the only reason it exists is to keep all of them fed
-        /// from a single `match` over the declarations.
-        struct HostFnSpec {
-            name: &'static str,
-            gas: u64,
-            wasm_params: &'static [WasmValType],
-            wasm_result: Option<WasmValType>,
-        }
-
-        /// Identifies one host function, and is the compile-time source of its
-        /// ABI metadata.
-        ///
-        /// One variant per `host_functions!` declaration, named by converting the
-        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
-        /// what a wasm engine iterates to build its import table.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        pub enum HostFunctionSpec {
-            #(#variants,)*
-        }
-
-        impl HostFunctionSpec {
-            /// Every host function, in the order declared.
-            ///
-            /// This is the complete import surface a guest may link against: a
-            /// function absent here cannot be called, and one present here must
-            /// be registered for a module that imports it to instantiate.
-            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
-
-            /// This function's row of the ABI table.
-            const fn spec(self) -> HostFnSpec {
-                match self {
-                    #(#spec_arms,)*
-                }
-            }
-
-            /// The name a guest imports this function under.
-            ///
-            /// A guest's import name must match this exactly, or the module
-            /// fails to instantiate. Usable in `const` context, so import lists
-            /// can be built at compile time.
-            pub const fn wasm_name(self) -> &'static str {
-                self.spec().name
-            }
-
-            /// Gas charged before the call runs, independent of its arguments.
-            ///
-            /// Consensus-relevant: two nodes that disagree on this value
-            /// disagree on transaction outcomes. Usable in `const` context, so
-            /// gas tables can be built at compile time.
-            pub const fn gas(self) -> u64 {
-                self.spec().gas
-            }
-
-            /// The wasm parameters this function is imported with, in wire
-            /// order — the list a guest's import must match, which the
-            /// declaration's own parameter list is not: a declared parameter
-            /// marshalled through a `(ptr, len)` region is two of these.
-            ///
-            /// Usable in `const` context, so import lists can be built at
-            /// compile time.
-            pub const fn wasm_params(self) -> &'static [WasmValType] {
-                self.spec().wasm_params
-            }
-
-            /// The wasm result this function answers with, or `None` for the
-            /// one whose whole effect is on the host. An `i32` where there is
-            /// one, whether the host answered a value or the length of what it
-            /// wrote — the wire does not distinguish those.
-            pub const fn wasm_result(self) -> Option<WasmValType> {
-                self.spec().wasm_result
-            }
-        }
-    }
-}
-
-struct HostFunctionsInput {
-    functions: Vec<TraitItemFn>,
-}
-
-impl Parse for HostFunctionsInput {
-    fn parse(input: ParseStream) -> syn::Result<Self> {
-        let mut functions = Vec::new();
-        while !input.is_empty() {
-            functions.push(input.parse()?);
-        }
-        Ok(HostFunctionsInput { functions })
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_an_empty_block() {
-        expand(quote! {}).unwrap();
-    }
-
-    #[test]
-    fn reports_mistakes_from_every_function() {
-        let error = expand(quote! {
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 2000]
-            fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-        })
-        .expect_err("expected parsing to fail");
-
-        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn propagates_syntax_errors() {
-        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
-        assert!(!error.to_string().is_empty());
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(input: TokenStream) -> Vec<String> {
-        let Err(error) = expand(input) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    /// The ABI half of the expansion alone: the glue's body is written against
-    /// another crate entirely, so the tests below about what the expansion may
-    /// name are not about it.
-    fn abi_expansion(input: TokenStream) -> String {
-        abi_items(&parse_block(input).expect("the block should parse")).to_string()
-    }
-
-    #[test]
-    fn generates_the_trait_the_enum_and_the_table() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 500]
-            #[wasm_name = "trace_num"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        })
-        .unwrap()
-        .to_string();
-
-        for expected in [
-            "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self , out : & mut [u8]) -> HostResult < usize > ;",
-            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
-            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
-            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
-            // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , \
-             wasm_params : & 'static [WasmValType] , wasm_result : Option < WasmValType > , }",
-            "const fn spec (self) -> HostFnSpec",
-            // Two wasm parameters for the one declared region, and a result for
-            // the length written to it.
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32] , \
-             wasm_result : Some (WasmValType :: I32) , }",
-            "Self :: TraceNum => HostFnSpec { name : \"trace_num\" , gas : 500u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32 , WasmValType :: I64] , \
-             wasm_result : None , }",
-            "pub const fn wasm_name (self) -> & 'static str",
-            "pub const fn gas (self) -> u64",
-            "pub const fn wasm_params (self) -> & 'static [WasmValType]",
-            "pub const fn wasm_result (self) -> Option < WasmValType >",
-            // The fourth item; its contents are `glue`'s own tests.
-            "macro_rules ! wasmi_glue",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The ABI reaches for nothing outside the crate it lands in, which is what
-    /// lets that crate stay zero-dependency and link into the guest. The glue is
-    /// not held to this — its body names one engine throughout, and `glue`'s own
-    /// tests pin that instead.
-    #[test]
-    fn names_no_crate_of_its_own() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
-
-        // Two roots and no others: `Self::Variant` and `WasmValType::I32`.
-        // Doc comments spell paths without spaces (`Self::ALL`), so they do not
-        // match.
-        for (index, _) in generated.match_indices(" :: ") {
-            let prefix = &generated[..index];
-            assert!(
-                prefix.ends_with("Self") || prefix.ends_with("WasmValType"),
-                "path out of the expansion at {index}: {generated}"
-            );
-        }
-    }
-
-    /// `spec` is an implementation detail of the two accessors, so it must not
-    /// become part of the ABI crate's public surface.
-    #[test]
-    fn keeps_the_table_row_private() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
-        assert!(!generated.contains("pub const fn spec"), "{generated}");
-    }
-
-    #[test]
-    fn rejects_two_functions_that_share_a_wasm_name() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str) -> HostResult<()>;
-
-            #[gas = 70]
-            #[wasm_name = "trace"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("already imported as `trace`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Names that differ only in underscores collapse to one enum variant.
-    #[test]
-    fn rejects_two_functions_that_share_a_variant() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<i32>;
-
-            #[gas = 70]
-            #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<i32>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("`GetLedgerSqn` variant"),
-            "{messages:?}"
-        );
-    }
-}
@@ -1,492 +0,0 @@
-//! The wire shape of a declaration: everything a declared Rust type decides — the
-//! wasm value types it lowers to, the names those wasm parameters take, the type a
-//! generated body is handed for it, and which of the ABI's two argument traits
-//! builds that type. Kept as one set of `match` arms because the four must agree.
-//!
-//! The whole mapping, and the only place it is written down: a type no arm here
-//! names is a type the ABI does not have, not one that falls back to something.
-//!
-//! Two rows are worth knowing before reading a declaration:
-//!
-//! - **`u32` is not a scalar.** It is a `(ptr, len)` region holding four
-//!   little-endian bytes, which is how the guest SDK passes a sequence number.
-//! - **`usize` and `i32` results are the same on the wire and not
-//!   interchangeable**: the first is the length of what was written to an output
-//!   region, the second the answer itself — as is `FloatOrdering`, a third spelling.
-//!
-//! Matching is on types as they are spelled — a proc macro resolves nothing, so
-//! `type Bytes = u32; … x: Bytes` is unrecognizable — but on a path's last
-//! segment, so any of these types may be spelled qualified.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, format_ident, quote};
-use syn::{Ident, PathArguments, Type, TypePath, TypeReference};
-
-/// What a host function may be handed, and what each costs on the wire.
-///
-/// Declaration order is wasm parameter order, so a reader of a declaration is
-/// reading the import the guest links against.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ParamType {
-    /// `i32`, passed through as itself. Also the spelling for a raw scalar
-    /// whose signedness the ABI does not fix.
-    I32,
-    /// `i64`, passed through as itself.
-    I64,
-    /// `TraceDataType`: an `i32` code the engine resolves to the enum before a
-    /// host sees it.
-    TraceDataType,
-    /// `&[u8]`: a borrowed input region.
-    InBytes,
-    /// `&str`: an input region whose read is also the UTF-8 check.
-    InStr,
-    /// `u32`: an input region holding four little-endian bytes.
-    InU32,
-    /// `&mut [u8]`: the writable output region.
-    OutBytes,
-}
-
-/// The success type of the `HostResult<T>` every declaration returns. These three
-/// are what the ABI has; any other `T` is an error.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ResultType {
-    /// `usize`: the true length of a value written to an output region, which
-    /// the engine turns into the wire's `i32` or into `BufferTooSmall` /
-    /// `DataFieldTooLarge`. Never itself the wire type.
-    BufferLength,
-    /// `i32` or `FloatOrdering`: the answer, from a function that writes no region.
-    /// One variant for both — one wire result, and the declared type still reaches the
-    /// trait verbatim.
-    Value,
-    /// `()`: no wasm result at all — the call's whole effect is on the host, and
-    /// an `Err` reaches the guest in no form.
-    Nothing,
-}
-
-/// The wasm value types this ABI uses, mirroring `xrpl_host_functions::WasmValType`.
-///
-/// Mirrored rather than shared because the dependency runs the other way: the ABI
-/// crate depends on this one, so nothing here can name its types. The [`ToTokens`]
-/// impl below is the whole of the crossing, and emits references to that enum's
-/// variants — so falling out of sync with it is a compile error at the
-/// `host_functions!` call site rather than drift.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum WasmValType {
-    I32,
-    I64,
-}
-
-impl ParamType {
-    /// Recognizes the declared type, or refuses it against its own span.
-    pub(crate) fn parse(ty: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function's parameter must be `i32`, `i64`, `u32`, \
-                               `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`";
-
-        let recognized = match ty {
-            // A lifetime on the reference changes nothing on the wire.
-            Type::Reference(TypeReference {
-                mutability, elem, ..
-            }) => match (mutability, &**elem) {
-                (None, Type::Slice(slice)) if is_named(&slice.elem, "u8") => Some(Self::InBytes),
-                (Some(_), Type::Slice(slice)) if is_named(&slice.elem, "u8") => {
-                    Some(Self::OutBytes)
-                }
-                (None, elem) if is_named(elem, "str") => Some(Self::InStr),
-                _ => None,
-            },
-            _ => match last_path_segment(ty) {
-                Some(name) if name == "i32" => Some(Self::I32),
-                Some(name) if name == "i64" => Some(Self::I64),
-                Some(name) if name == "u32" => Some(Self::InU32),
-                Some(name) if name == "TraceDataType" => Some(Self::TraceDataType),
-                _ => None,
-            },
-        };
-
-        recognized.ok_or_else(|| syn::Error::new_spanned(ty, ALLOWED))
-    }
-
-    /// The wasm parameters this declared type lowers to, in order. `InBytes` and
-    /// `OutBytes` lower alike, so a region's direction survives only in the
-    /// variant.
-    pub(crate) fn as_wasm_params(self) -> &'static [WasmValType] {
-        match self {
-            Self::I32 | Self::TraceDataType => &[WasmValType::I32],
-            Self::I64 => &[WasmValType::I64],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                &[WasmValType::I32, WasmValType::I32]
-            }
-        }
-    }
-
-    /// What a declaration calls each of those wasm parameters: the declared name
-    /// for a scalar, and `{name}_ptr`/`{name}_len` for the pair a region lowers
-    /// to.
-    ///
-    /// **It must answer as many names as [`Self::as_wasm_params`] answers types**,
-    /// since the generated closure declares them one against the other — hence the
-    /// matching arms, and `lowers_every_declared_parameter_type`'s row-by-row
-    /// length check.
-    pub(crate) fn wasm_names(self, name: &Ident) -> Vec<Ident> {
-        match self {
-            Self::I32 | Self::I64 | Self::TraceDataType => vec![name.clone()],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                vec![format_ident!("{name}_ptr"), format_ident!("{name}_len")]
-            }
-        }
-    }
-
-    /// The type a generated body takes this parameter as: a wasm scalar spelled as
-    /// itself, everything else the argument type carrying its shape and direction —
-    /// which is what makes an input region used as an output one a compile error
-    /// naming both.
-    ///
-    /// The argument types are the engine's, so `vm` is the path they are reached
-    /// under; which types need it is decided here, a wasm scalar being `i32` under
-    /// every engine.
-    pub(crate) fn argument_type(self, vm: &TokenStream) -> TokenStream {
-        match self {
-            Self::I32 => quote!(i32),
-            Self::I64 => quote!(i64),
-            Self::TraceDataType => quote!(#vm::TraceCode),
-            Self::InBytes => quote!(#vm::InBytes),
-            Self::InStr => quote!(#vm::InStr),
-            Self::InU32 => quote!(#vm::InU32),
-            Self::OutBytes => quote!(#vm::OutBytes),
-        }
-    }
-
-    /// Which of the ABI's two argument traits builds this parameter's argument
-    /// type, or `None` for a wasm scalar, which reaches a body as itself.
-    ///
-    /// The arity is the whole of the distinction — `FromWasmRegion` takes the two
-    /// of a `(ptr, len)` pair, `FromWasmScalar` the one of a code — so this answers
-    /// alongside [`Self::as_wasm_params`] rather than from a predicate elsewhere.
-    pub(crate) fn argument_trait(self) -> Option<TokenStream> {
-        match self {
-            Self::I32 | Self::I64 => None,
-            Self::TraceDataType => Some(quote!(FromWasmScalar)),
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                Some(quote!(FromWasmRegion))
-            }
-        }
-    }
-
-    /// Whether this parameter is a region the host writes to — what
-    /// [`ResultType::BufferLength`] is the length *of*.
-    pub(crate) fn is_out_region(self) -> bool {
-        matches!(self, Self::OutBytes)
-    }
-}
-
-impl ResultType {
-    /// Recognizes the success type of a declaration's `HostResult<T>`, or
-    /// refuses it against its own span.
-    pub(crate) fn parse(success: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function must return `HostResult<usize>` for a value it \
-                               writes to an output region, `HostResult<i32>` or \
-                               `HostResult<FloatOrdering>` for one it answers directly, or \
-                               `HostResult<()>` for none at all";
-
-        if let Type::Tuple(tuple) = success
-            && tuple.elems.is_empty()
-        {
-            return Ok(Self::Nothing);
-        }
-
-        match last_path_segment(success) {
-            Some(name) if name == "usize" => Ok(Self::BufferLength),
-            Some(name) if name == "i32" || name == "FloatOrdering" => Ok(Self::Value),
-            _ => Err(syn::Error::new_spanned(success, ALLOWED)),
-        }
-    }
-
-    /// The generated table's `wasm_result` field: `Some(WasmValType::I32)`, or
-    /// `None` for the function that answers nothing.
-    ///
-    /// Spelled out here rather than left to `quote`'s `Option` impl, which emits
-    /// nothing at all for `None`.
-    pub(crate) fn wasm_result_tokens(self) -> TokenStream {
-        match self.as_wasm_result() {
-            Some(val_type) => quote! { Some(#val_type) },
-            None => quote! { None },
-        }
-    }
-
-    /// Whether the value reaches the guest as the length of what was written to
-    /// an output region.
-    pub(crate) fn is_buffer_length(self) -> bool {
-        matches!(self, Self::BufferLength)
-    }
-
-    /// The wasm result, which does not distinguish a length from a value.
-    fn as_wasm_result(self) -> Option<WasmValType> {
-        match self {
-            Self::BufferLength | Self::Value => Some(WasmValType::I32),
-            Self::Nothing => None,
-        }
-    }
-}
-
-/// `WasmValType::I32` — the ABI crate's variant, named but never defined here.
-impl ToTokens for WasmValType {
-    fn to_tokens(&self, tokens: &mut TokenStream) {
-        tokens.extend(match self {
-            Self::I32 => quote! { WasmValType::I32 },
-            Self::I64 => quote! { WasmValType::I64 },
-        });
-    }
-}
-
-/// The last segment of a plain path type, when it carries no generic arguments:
-/// `i32`, `core::primitive::i32` and `TraceDataType` all answer their own name,
-/// `Vec<u8>` and `[u8; 4]` nothing.
-fn last_path_segment(ty: &Type) -> Option<&Ident> {
-    let Type::Path(TypePath {
-        qself: None, path, ..
-    }) = ty
-    else {
-        return None;
-    };
-    let last = path.segments.last()?;
-    matches!(last.arguments, PathArguments::None).then_some(&last.ident)
-}
-
-/// Whether `ty` is the named primitive, however it is spelled.
-fn is_named(ty: &Type, name: &str) -> bool {
-    last_path_segment(ty).is_some_and(|segment| segment == name)
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use syn::parse_quote;
-
-    use WasmValType::{I32, I64};
-
-    /// Every declared parameter type and everything it decides: what it costs on
-    /// the wire, what a body is handed for it, and which trait builds that.
-    ///
-    /// The names are asserted by length rather than spelling, since a type
-    /// answering fewer names than value types is the one way these answers can
-    /// contradict each other.
-    #[test]
-    fn lowers_every_declared_parameter_type() {
-        let mapping: [(Type, &[WasmValType], &str, Option<&str>); 7] = [
-            (parse_quote!(i32), &[I32], "i32", None),
-            (parse_quote!(i64), &[I64], "i64", None),
-            (
-                parse_quote!(TraceDataType),
-                &[I32],
-                "vm :: TraceCode",
-                Some("FromWasmScalar"),
-            ),
-            (
-                parse_quote!(&[u8]),
-                &[I32, I32],
-                "vm :: InBytes",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&str),
-                &[I32, I32],
-                "vm :: InStr",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(u32),
-                &[I32, I32],
-                "vm :: InU32",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&mut [u8]),
-                &[I32, I32],
-                "vm :: OutBytes",
-                Some("FromWasmRegion"),
-            ),
-        ];
-        let declared_name = format_ident!("seq");
-        let vm = quote!(vm);
-
-        for (declared, wasm, argument, argument_trait) in mapping {
-            let param = ParamType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a parameter type", quoted(&declared)));
-
-            assert_eq!(param.as_wasm_params(), wasm, "`{}`", quoted(&declared));
-            assert_eq!(
-                param.argument_type(&vm).to_string(),
-                argument,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param
-                    .argument_trait()
-                    .map(|name| name.to_string())
-                    .as_deref(),
-                argument_trait,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param.wasm_names(&declared_name).len(),
-                wasm.len(),
-                "one name per wasm parameter: `{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A region's two wasm parameters are named off the declaration, so the
-    /// generated closure reads as the declaration does.
-    #[test]
-    fn names_a_region_s_pair_after_the_declared_parameter() {
-        let seq = format_ident!("seq");
-
-        let names = |declared: Type| {
-            ParamType::parse(&declared)
-                .expect("a parameter type")
-                .wasm_names(&seq)
-                .iter()
-                .map(Ident::to_string)
-                .collect::<Vec<_>>()
-        };
-
-        assert_eq!(names(parse_quote!(u32)), ["seq_ptr", "seq_len"]);
-        assert_eq!(names(parse_quote!(i32)), ["seq"]);
-    }
-
-    /// The two `(ptr, len)` pairs lower alike but are told apart, since only the
-    /// direction says who may write to the region.
-    #[test]
-    fn keeps_the_regions_apart() {
-        let input: Type = parse_quote!(&[u8]);
-        let output: Type = parse_quote!(&mut [u8]);
-
-        assert!(!ParamType::parse(&input).unwrap().is_out_region());
-        assert!(ParamType::parse(&output).unwrap().is_out_region());
-    }
-
-    /// A type outside the mapping is refused rather than lowered to a guess.
-    #[test]
-    fn refuses_parameter_types_outside_the_mapping() {
-        let outside: [Type; 11] = [
-            parse_quote!(u64),
-            parse_quote!(u8),
-            parse_quote!(usize),
-            parse_quote!(bool),
-            parse_quote!(Vec<u8>),
-            parse_quote!([u8; 4]),
-            parse_quote!(&mut str),
-            parse_quote!(&i32),
-            parse_quote!(&[i32]),
-            parse_quote!(&Foo),
-            parse_quote!(()),
-        ];
-
-        for declared in outside {
-            let Err(error) = ParamType::parse(&declared) else {
-                panic!("`{}` should not be a parameter type", quoted(&declared));
-            };
-            assert!(
-                error.to_string().contains("must be `i32`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The declared success types, and the wasm result each becomes. `usize` and `i32`
-    /// agree on the wire and are separate rows; `FloatOrdering` shares `i32`'s.
-    #[test]
-    fn lowers_every_success_type() {
-        let mapping: [(Type, ResultType, Option<WasmValType>); 4] = [
-            (parse_quote!(usize), ResultType::BufferLength, Some(I32)),
-            (parse_quote!(i32), ResultType::Value, Some(I32)),
-            (parse_quote!(FloatOrdering), ResultType::Value, Some(I32)),
-            (parse_quote!(()), ResultType::Nothing, None),
-        ];
-
-        for (declared, expected, wasm_result) in mapping {
-            let result = ResultType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a success type", quoted(&declared)));
-
-            assert_eq!(result, expected, "`{}`", quoted(&declared));
-            assert_eq!(
-                result.as_wasm_result(),
-                wasm_result,
-                "`{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The distinction the wasm result loses: which of the two `i32` results was
-    /// declared decides how the value reaches the guest.
-    #[test]
-    fn tells_a_length_from_a_value() {
-        assert!(ResultType::BufferLength.is_buffer_length());
-        assert!(!ResultType::Value.is_buffer_length());
-        assert!(!ResultType::Nothing.is_buffer_length());
-    }
-
-    #[test]
-    fn refuses_success_types_outside_the_mapping() {
-        let outside: [Type; 6] = [
-            parse_quote!(u32),
-            parse_quote!(i64),
-            parse_quote!(bool),
-            parse_quote!([u8; 32]),
-            parse_quote!(Vec<u8>),
-            parse_quote!((usize, i32)),
-        ];
-
-        for declared in outside {
-            let Err(error) = ResultType::parse(&declared) else {
-                panic!("`{}` should not be a success type", quoted(&declared));
-            };
-            assert!(
-                error
-                    .to_string()
-                    .contains("must return `HostResult<usize>`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A qualified spelling is the same type, matching how the return type finds
-    /// `HostResult`.
-    #[test]
-    fn accepts_qualified_spellings() {
-        let qualified: Type = parse_quote!(core::primitive::i32);
-        assert_eq!(ParamType::parse(&qualified).unwrap(), ParamType::I32);
-
-        let qualified: Type = parse_quote!(xrpl_host_functions::TraceDataType);
-        assert_eq!(
-            ParamType::parse(&qualified).unwrap(),
-            ParamType::TraceDataType
-        );
-    }
-
-    /// The emitted tokens name the ABI crate's variants, which is the whole of
-    /// what crosses out of this crate. Pinned here so a break in the mirror is a
-    /// failure with a span rather than a rustc error at the call site.
-    #[test]
-    fn emits_references_to_the_hand_written_variants() {
-        assert_eq!(I32.to_token_stream().to_string(), "WasmValType :: I32");
-        assert_eq!(I64.to_token_stream().to_string(), "WasmValType :: I64");
-
-        assert_eq!(
-            ResultType::BufferLength.wasm_result_tokens().to_string(),
-            "Some (WasmValType :: I32)"
-        );
-        assert_eq!(ResultType::Nothing.wasm_result_tokens().to_string(), "None");
-    }
-
-    fn quoted(ty: &Type) -> String {
-        ty.to_token_stream().to_string()
-    }
-}
@@ -1,23 +0,0 @@
-[package]
-name = "xrpl-host-functions"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"
-
-# `wasmi_glue!` and the two argument traits it marshals through are a host's
-# business, and this crate is what a contract links against — so the feature is
-# what keeps `cargo doc` here showing a contract developer only the ABI. It costs
-# nothing either way: a `macro_rules!` is inert and a trait with no impls emits
-# nothing.
-#
-# `xrpl-wasm-vm` enables it and features unify across the graph, so the off
-# configuration is only ever checked by `cargo check -p xrpl-host-functions`,
-# which is in the loop in `tmp/notes/wasm-vm/testing.md` for that reason.
-[features]
-default = []
-wasmi_glue = []
-
-[lints]
-workspace = true
@@ -1,588 +0,0 @@
-//! The wasm host ABI: the one place it is declared.
-//!
-//! `host_functions!` turns the declaration block at the bottom of this file into the
-//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
-//! wasm engine registers from.
-//!
-//! The split: hand-written here is the vocabulary the declarations are written in —
-//! [`HostError`], [`TraceDataType`], [`FloatOrdering`], [`HostResult`], [`HASH_LEN`] —
-//! and everything derived from the declarations is generated. The expansion names
-//! nothing this file does not, so the two sides meet only in the block below.
-//!
-//! Three items cross that split the other way, named by the expansion but by no
-//! declaration: [`WasmValType`], which the derived wasm signatures are spelled in,
-//! and `FromWasmRegion`/`FromWasmScalar`, which `wasmi_glue!` builds a marshalled
-//! argument through.
-
-#![no_std]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-// Not re-exported: the ABI is declared once, here, and this is the only call site.
-use xrpl_host_functions_macros::{coded_enum, host_functions};
-
-/// Error codes a host function may return. Every code is negative, which is what lets
-/// a failure and an answer share one `i32` on the wire.
-#[coded_enum]
-#[repr(i32)]
-pub enum HostError {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-    /// Internal fatal error.
-    /// User code will never see this error but keep it reserved to not rely on the value.
-    InternalFatal = -2147483648,
-}
-
-/// Convenience alias for the trait's fallible returns.
-pub type HostResult<T> = Result<T, HostError>;
-
-/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
-pub const HASH_LEN: usize = 32;
-
-/// How [`HostFunctions::trace`] is to read its data buffer. Wire values shared with the
-/// guest stdlib: append only, never renumber, and starting at 1 so a zeroed argument
-/// names no type. `xrpl-wasm-vm-ffi` holds the second declaration, the one C++ compiles
-/// against — this crate links into the guest too, so it cannot depend on `cxx`.
-#[coded_enum]
-#[repr(i32)]
-pub enum TraceDataType {
-    /// 8 little-endian bytes, rendered as a signed decimal.
-    Int64 = 1,
-    /// 8 little-endian bytes, rendered as an unsigned decimal.
-    Uint64 = 2,
-    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
-    Xfloat = 3,
-    /// A 20-byte account ID, rendered as base58.
-    Account = 4,
-    /// A serialized `STAmount`.
-    Amount = 5,
-    /// Raw bytes, hex-encoded.
-    AsHex = 6,
-    /// Bytes rendered verbatim as text.
-    AsText = 7,
-}
-
-/// The verdict [`HostFunctions::float_compare`] answers, read as the placing of `x`
-/// against `y`. **Not C's `memcmp` convention**: the wire's negative range belongs to
-/// [`HostError`], so every code here is non-negative — append only, never renumber.
-#[coded_enum]
-#[repr(i32)]
-pub enum FloatOrdering {
-    Equal = 0,
-    Greater = 1,
-    Less = 2,
-}
-
-/// The wasm module name a guest imports these functions under:
-/// `(import "host_lib" "ldgr_index" …)`.
-pub const HOST_MODULE: &str = "host_lib";
-
-/// A wasm value type, as many of them as this ABI uses — the vocabulary the
-/// generated wasm signatures are spelled in, which an engine maps to its own value
-/// types once.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum WasmValType {
-    I32,
-    I64,
-}
-
-/// Builds the argument an engine marshals a `(ptr, len)` region into: a declared
-/// `&[u8]`, `&str`, `u32` or `&mut [u8]`. Nothing is checked here — the pair
-/// arrives as the guest sent it, and refusing a malformed region is the engine's
-/// business.
-///
-/// **Kept apart from [`FromWasmScalar`]** rather than folded into one trait with
-/// an associated wasm type, for the diagnostic: the mistake worth catching is an
-/// arity one — a declared `u32` is a region, not a code — and as two traits that
-/// lands as an unsatisfied bound at the offending argument type rather than an
-/// `i32`-against-`(i32, i32)` mismatch at the macro call.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmRegion {
-    fn from_wasm(ptr: i32, len: i32) -> Self;
-}
-
-/// Builds the argument an engine marshals a single `i32` code into: the declared
-/// `TraceDataType`. [`FromWasmRegion`] says why the two are separate traits.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmScalar {
-    fn from_wasm(code: i32) -> Self;
-}
-
-// Two rules hold over every declaration below, and neither is visible at any one of
-// them. They are what lets the wasm signature be read off the declaration.
-//
-// **Declaration order is wasm parameter order.** So `mode` comes after `out` in the
-// float functions, and `data_type` between `trace`'s two regions: the wire's order,
-// not the one a Rust signature would choose.
-//
-// **`i32` and `i64` are the wasm scalars, spelled as themselves; every other type is
-// marshalled.** `&[u8]`/`&str` and `&mut [u8]` are `(ptr, len)` pairs, `TraceDataType`
-// is an `i32` code the engine names before a host sees it, and **`u32` is four
-// little-endian bytes in a region**, not a scalar, which is how the guest SDK passes a
-// sequence number. A result is `usize` for the length of what was written to an output
-// region, `i32` or `FloatOrdering` for the answer itself, or `()` for none.
-host_functions! {
-    /// The sequence number of the ledger being built, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "ldgr_index"]
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_time"]
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The hash of the parent (last-closed) ledger, as 32 bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_hash"]
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "base_fee"]
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its name;
-    /// the answer is `1` if enabled and `0` if not.
-    #[gas = 100]
-    #[wasm_name = "amendment_enabled"]
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
-
-    /// Load the ledger object with the given 32-byte id into a cache slot, so later
-    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Answers the slot used.
-    #[gas = 5000]
-    #[wasm_name = "cache_le"]
-    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
-
-    /// The serialized bytes of one field of the transaction being executed, selected
-    /// by its `SField` code.
-    #[gas = 70]
-    #[wasm_name = "tx_field"]
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of the current (escrow) ledger object.
-    #[gas = 70]
-    #[wasm_name = "home_le_field"]
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of a previously cached ledger object,
-    /// selected by its cache slot and the field's `SField` code.
-    #[gas = 70]
-    #[wasm_name = "le_field"]
-    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a non-zero
-    /// multiple of 4).
-    #[gas = 110]
-    #[wasm_name = "tx_inner"]
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
-    #[gas = 110]
-    #[wasm_name = "home_le_inner"]
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of a previously cached ledger object,
-    /// selected by its cache slot and reached by a `locator`.
-    #[gas = 110]
-    #[wasm_name = "le_inner"]
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly; `NoArray` if the field is not an array.
-    #[gas = 40]
-    #[wasm_name = "tx_arr_len"]
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`HostFunctions::get_tx_array_len`].
-    #[gas = 40]
-    #[wasm_name = "home_le_arr_len"]
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of a previously cached ledger object,
-    /// selected by its cache slot and `SField` code.
-    #[gas = 40]
-    #[wasm_name = "le_arr_len"]
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`.
-    #[gas = 70]
-    #[wasm_name = "tx_inner_arr_len"]
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
-    #[gas = 70]
-    #[wasm_name = "home_le_inner_arr_len"]
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of a previously cached ledger
-    /// object, selected by its cache slot and reached by a `locator`.
-    #[gas = 70]
-    #[wasm_name = "le_inner_arr_len"]
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
-
-    /// Verify `signature` over `message` under `pubkey`. Answers `1` if the signature
-    /// is valid, `0` if not, or a negative error.
-    #[gas = 35000]
-    #[wasm_name = "check_sig"]
-    fn check_signature(
-        &self,
-        message: &[u8],
-        signature: &[u8],
-        pubkey: &[u8],
-    ) -> HostResult<i32>;
-
-    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "accountroot_id"]
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a byte
-    /// slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued currency +
-    /// issuer).
-    #[gas = 450]
-    #[wasm_name = "amm_id"]
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "check_id"]
-    fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string.
-    #[gas = 350]
-    #[wasm_name = "credential_id"]
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account and
-    /// the account it authorizes.
-    #[gas = 350]
-    #[wasm_name = "delegate_id"]
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit.
-    #[gas = 350]
-    #[wasm_name = "deposit_preauth_id"]
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "did_id"]
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "escrow_id"]
-    fn escrow_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency.
-    #[gas = 400]
-    #[wasm_name = "trustline_id"]
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "mpt_issuance_id"]
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account.
-    #[gas = 500]
-    #[wasm_name = "mptoken_id"]
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
-    /// and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "nft_offer_id"]
-    fn nftoken_offer_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "offer_id"]
-    fn offer_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
-    /// its document id.
-    #[gas = 350]
-    #[wasm_name = "oracle_id"]
-    fn oracle_keylet(&self, account: &[u8], doc_id: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
-    /// the 20-byte destination account, and the channel's sequence number.
-    #[gas = 350]
-    #[wasm_name = "paychan_id"]
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "permissioned_domain_id"]
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    #[gas = 350]
-    #[wasm_name = "signers_id"]
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and
-    /// its ticket sequence number.
-    #[gas = 350]
-    #[wasm_name = "ticket_id"]
-    fn ticket_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "vault_id"]
-    fn vault_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Sponsorship`, computed from the 20-byte sponsor account
-    /// and the 20-byte sponsee account.
-    #[gas = 350]
-    #[wasm_name = "sponsorship_id"]
-    fn sponsorship_keylet(
-        &self,
-        sponsor: &[u8],
-        sponsee: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `LoanBroker`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "loan_broker_id"]
-    fn loan_broker_keylet(&self, owner: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Loan`, computed from the 32-byte id of its `LoanBroker`
-    /// and the loan's sequence number.
-    #[gas = 350]
-    #[wasm_name = "loan_id"]
-    fn loan_keylet(
-        &self,
-        loan_broker_id: &[u8],
-        loan_seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
-    #[gas = 2000]
-    #[wasm_name = "sha512_half"]
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
-    ///
-    /// The one declaration whose wasm function has **no result**: this node's own log
-    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
-    /// reaches it in no form, and only the host-fatal ones do anything at all.
-    #[gas = 30]
-    #[wasm_name = "trace"]
-    fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-
-    /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored; `DataFieldTooLarge` if it exceeds the
-    /// host's limit.
-    #[gas = 1000]
-    #[wasm_name = "set_data"]
-    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
-
-    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`.
-    #[gas = 5000]
-    #[wasm_name = "nft_uri"]
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 70]
-    #[wasm_name = "nft_issuer"]
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes), as four little-endian
-    /// bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_taxon"]
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_flags"]
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_xfer_fee"]
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes), as four
-    /// little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_serial"]
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
-    // holds opaquely and hands back to these functions. Inputs and outputs that are
-    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
-
-    /// A float built from the signed integer `x` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_int"]
-    fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`.
-    #[gas = 130]
-    #[wasm_name = "float_from_uint"]
-    fn float_from_uint(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stamount"]
-    fn float_from_stamount(&self, amount: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stnumber"]
-    fn float_from_stnumber(&self, number: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` rounded to a signed integer under rounding `mode`, as eight
-    /// little-endian bytes.
-    #[gas = 130]
-    #[wasm_name = "float_to_int"]
-    fn float_to_int(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` split into its mantissa (eight little-endian bytes) and its exponent
-    /// (four little-endian bytes), each written to its own output region.
-    #[gas = 130]
-    #[wasm_name = "float_to_mant_exp"]
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// A float built from `mantissa` and `exponent` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_mant_exp"]
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        exponent: i32,
-        out: &mut [u8],
-        mode: i32,
-    ) -> HostResult<usize>;
-
-    /// Compares floats `x` and `y`, answering the [`FloatOrdering`] that places `x`
-    /// against `y`. Reaches the guest as that variant's code, **not `memcmp`'s sign**.
-    #[gas = 80]
-    #[wasm_name = "float_cmp"]
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<FloatOrdering>;
-
-    /// The float sum `x + y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_add"]
-    fn float_add(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float difference `x - y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_sub"]
-    fn float_subtract(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float product `x * y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_mult"]
-    fn float_multiply(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float quotient `x / y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_div"]
-    fn float_divide(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`.
-    #[gas = 5500]
-    #[wasm_name = "float_pow"]
-    fn float_power(&self, x: &[u8], n: i32, out: &mut [u8], mode: i32) -> HostResult<usize>;
-}
@@ -1,41 +0,0 @@
-//! `host_functions!` must work outside the crate that declares the ABI: the only
-//! names its expansion needs are `WasmValType` and the ones the declarations
-//! themselves spell.
-//!
-//! That this crate compiles is also what shows the emitted `wasmi_glue!` costs
-//! nothing to carry: its body names an engine throughout, there is no engine
-//! here, and nobody here expands it.
-
-use xrpl_host_functions::{HostResult, WasmValType};
-use xrpl_host_functions_macros::host_functions;
-
-host_functions! {
-    /// Answers with the number it was given.
-    #[gas = 7]
-    #[wasm_name = "ping"]
-    fn ping(&self, number: i32) -> HostResult<i32>;
-}
-
-struct Host;
-
-impl HostFunctions for Host {
-    fn ping(&self, number: i32) -> HostResult<i32> {
-        Ok(number)
-    }
-}
-
-#[test]
-fn the_generated_table_stands_on_its_own() {
-    assert_eq!(HostFunctionSpec::ALL.len(), 1);
-    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
-    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
-    assert_eq!(HostFunctionSpec::Ping.wasm_params(), &[WasmValType::I32]);
-    assert_eq!(HostFunctionSpec::Ping.wasm_result(), Some(WasmValType::I32));
-}
-
-/// The generated trait is implementable from another crate, which is the point of
-/// declaring the ABI in a library at all.
-#[test]
-fn the_generated_trait_is_implementable_here() {
-    assert_eq!(Host.ping(3), Ok(3));
-}
@@ -1,95 +0,0 @@
-//! Exercises what `#[coded_enum]` generates for [`HostError`]: the wire codes, the
-//! set [`HostError::ALL`] names, and the round trip between them.
-//!
-//! The codes are consensus input — they are what a guest reads off a failed host
-//! call — so they are pinned here as literals and derived everywhere else.
-
-use xrpl_host_functions::HostError;
-
-/// The whole set, written out in the order `ALL` gives it: the one place the wire
-/// codes appear as literals, and a deliberate change-detector, since a code that
-/// moves changes what every deployed guest is told.
-#[test]
-fn the_error_table_matches_the_declarations() {
-    let table: Vec<(HostError, i32)> = HostError::ALL
-        .iter()
-        .map(|&error| (error, error.code()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            (HostError::Unimplemented, -1),
-            (HostError::FieldNotFound, -2),
-            (HostError::BufferTooSmall, -3),
-            (HostError::NoArray, -4),
-            (HostError::NotLeafField, -5),
-            (HostError::LocatorMalformed, -6),
-            (HostError::SlotOutRange, -7),
-            (HostError::SlotsFull, -8),
-            (HostError::EmptySlot, -9),
-            (HostError::LedgerObjNotFound, -10),
-            (HostError::OutOfTransferLimit, -11),
-            (HostError::DataFieldTooLarge, -12),
-            (HostError::PointerOutOfBounds, -13),
-            (HostError::NoMemExported, -14),
-            (HostError::InvalidParams, -15),
-            (HostError::InvalidAccount, -16),
-            (HostError::InvalidField, -17),
-            (HostError::IndexOutOfBounds, -18),
-            (HostError::FloatInputMalformed, -19),
-            (HostError::FloatComputationError, -20),
-            (HostError::InternalFatal, i32::MIN),
-        ]
-    );
-}
-
-/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
-/// `HostFunctionError`, and each is a code some contract may read.
-///
-/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
-/// widening the range: a condition with no number a contract can act on needs no number
-/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
-/// ever colliding with a code appended to xrpld's list.
-#[test]
-fn every_code_but_the_sentinel_is_in_the_shared_range() {
-    let shared: Vec<HostError> = HostError::ALL
-        .iter()
-        .copied()
-        .filter(|&error| error != HostError::InternalFatal)
-        .collect();
-
-    let outside: Vec<HostError> = shared
-        .iter()
-        .copied()
-        .filter(|error| !(-20..=-1).contains(&error.code()))
-        .collect();
-
-    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
-    assert_eq!(shared.len(), 20);
-    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
-    assert_eq!(HostError::ALL.len(), 21);
-}
-
-/// Every code a guest can be handed comes back as the error that produced it, so a
-/// caller reading a negative return value recovers the condition and not a
-/// neighbouring one. The table above pins the numbers; this adds only the round
-/// trip.
-#[test]
-fn every_wire_code_round_trips_back_to_its_error() {
-    for &error in HostError::ALL {
-        assert_eq!(HostError::from_code(error.code()), Some(error), "{error:?}");
-    }
-}
-
-/// A code from outside the set names no error and is not rounded to a neighbouring one;
-/// what it means instead is the crossing's to decide, in `xrpl-wasm-vm-ffi`'s `host_error`.
-///
-/// `-21` is the code xrpld would append next; `i32::MIN + 1` is next to the sentinel and
-/// unassigned, which is what makes the sentinel a value rather than a range.
-#[test]
-fn a_code_outside_the_set_names_no_error() {
-    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
-        assert_eq!(HostError::from_code(code), None, "{code}");
-    }
-}
@@ -1,15 +0,0 @@
-[package]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-wat = "1"
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-
-[lints]
-workspace = true
@@ -1,109 +0,0 @@
-//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
-//!
-//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
-//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
-//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
-//! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag. Putting `compile_wat` on the production bridge would link `wat`
-//! into xrpld even if nothing called it.
-//!
-//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
-//! shipped node" is a property of the link graph rather than a flag someone can flip.
-#![deny(rustdoc::broken_intra_doc_links)]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-#[cxx::bridge(namespace = "rs::wasm_testkit")]
-mod ffi {
-    extern "Rust" {
-        /// Assemble `wat` to a wasm module.
-        ///
-        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
-        /// fixture should fail the test that holds it, at the line that holds it.
-        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
-
-        /// The gas a host function is charged before it runs, by its guest import name.
-        ///
-        /// For the C++ gas benchmarks, which measure what a host call actually costs and
-        /// report it against what the table says it costs. Reading the declaration through
-        /// here rather than copying the numbers into C++ is the point: 61 transcribed
-        /// constants would drift from `lib.rs` the first time a price changed, and drift
-        /// silently, because a benchmark has nothing to fail.
-        ///
-        /// Throws `rust::Error` on an unknown name — a typo should fail loudly rather than
-        /// quietly compare against zero.
-        fn host_function_gas(wasm_name: &str) -> Result<u64>;
-    }
-}
-
-fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
-    wat::parse_str(wat)
-}
-
-fn host_function_gas(wasm_name: &str) -> Result<u64, UnknownHostFunction> {
-    xrpl_host_functions::HostFunctionSpec::ALL
-        .iter()
-        .find(|op| op.wasm_name() == wasm_name)
-        .map(|op| op.gas())
-        .ok_or_else(|| UnknownHostFunction(wasm_name.to_owned()))
-}
-
-#[derive(Debug)]
-struct UnknownHostFunction(String);
-
-impl std::fmt::Display for UnknownHostFunction {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "no host function is imported as `{}`", self.0)
-    }
-}
-
-impl std::error::Error for UnknownHostFunction {}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
-        let wasm = compile_wat("(module)").expect("assembles");
-
-        assert_eq!(&wasm[..4], b"\0asm");
-    }
-
-    #[test]
-    fn a_host_function_reports_the_gas_its_declaration_gives_it() {
-        // `trace` is the cheapest declaration in the table; the point is not the number but
-        // that the lookup reaches the same constant the engine charges from.
-        assert_eq!(
-            host_function_gas("trace").expect("trace is a host function"),
-            xrpl_host_functions::HostFunctionSpec::Trace.gas()
-        );
-    }
-
-    #[test]
-    fn every_host_function_is_reachable_by_its_import_name() {
-        for op in xrpl_host_functions::HostFunctionSpec::ALL {
-            assert_eq!(
-                host_function_gas(op.wasm_name()).expect("declared"),
-                op.gas(),
-                "{} must be reachable by name",
-                op.wasm_name()
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_an_error_rather_than_zero_gas() {
-        host_function_gas("not_a_host_function").expect_err("must not resolve");
-    }
-
-    #[test]
-    fn a_typo_is_an_error_rather_than_a_module() {
-        let error = compile_wat("(module (func (export").expect_err("must not assemble");
-
-        assert!(
-            !error.to_string().is_empty(),
-            "the error has to say something"
-        );
-    }
-}
@@ -1,18 +0,0 @@
-[package]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }
-
-[build-dependencies]
-cbindgen = { version = "0.29.4", default-features = false }
-
-[lints]
-workspace = true
@@ -1,30 +0,0 @@
-//! Generates the C++ header for the ABI's wire enums and constants, as `cbindgen.toml`
-//! configures it.
-
-use std::env;
-use std::path::PathBuf;
-
-const ABI_SOURCE: &str = "../xrpl-host-functions/src/lib.rs";
-const CONFIG: &str = "cbindgen.toml";
-const HEADER: &str = "xrpl_host_functions.h";
-/// Set by CMake to the directory on C++'s include path. Unset — plain `cargo`,
-/// rust-analyzer — nothing reads the header, so none is generated.
-const HEADER_OUT_DIR: &str = "HOST_FUNCTIONS_BINDGEN_OUT_DIR";
-
-fn main() {
-    println!("cargo::rerun-if-changed={ABI_SOURCE}");
-    println!("cargo::rerun-if-changed={CONFIG}");
-    println!("cargo::rerun-if-env-changed={HEADER_OUT_DIR}");
-
-    let Some(out_dir) = env::var_os(HEADER_OUT_DIR) else {
-        return;
-    };
-
-    let config = cbindgen::Config::from_file(CONFIG).unwrap_or_else(|error| panic!("{error}"));
-    cbindgen::Builder::new()
-        .with_config(config)
-        .with_src(ABI_SOURCE)
-        .generate()
-        .unwrap_or_else(|error| panic!("cbindgen could not read {ABI_SOURCE}: {error}"))
-        .write_to_file(PathBuf::from(out_dir).join(HEADER));
-}
@@ -1,19 +0,0 @@
-# The C++ header for the ABI's wire enums and constants, generated by `build.rs` from
-# `xrpl-host-functions`. cbindgen reads that crate's source, not its expansion.
-language = "C++"
-namespace = "xrpl"
-pragma_once = true
-autogen_warning = "// Generated by cbindgen from crates/xrpl-host-functions/src/lib.rs. Do not edit."
-no_includes = true
-sys_includes = ["cstdint"]
-
-[export]
-# An enum is emitted only if listed here, since no `extern fn` names one.
-# `TraceDataType` is left out: the cxx bridge already emits `xrpl::TraceDataType`.
-include = ["HostError", "FloatOrdering"]
-
-[export.rename]
-"HostError" = "HostFunctionError"
-
-[enum]
-enum_class = true
@@ -1,15 +0,0 @@
-[package]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-wasmi = { version = "2.0.0", default-features = false, features = ["std", "validate", "portable-dispatch"] }
-wasmparser = { version = "0.228", default-features = false, features = ["std"] }
-xrpl-host-functions = { path = "../xrpl-host-functions", features = ["wasmi_glue"] }
-
-[dev-dependencies]
-wat = "1"
-
-[lints]
-workspace = true
@@ -1,838 +0,0 @@
-use crate::args::OutBytes;
-use crate::vm::{MAX_FIELD_BYTES, VmState};
-use core::ops::Range;
-use wasmi::{Caller, Memory};
-use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
-
-/// A condition that stops the run. It is a property of the run rather than an answer
-/// to a call, so it reaches no guest and carries no wire code — which is why it is
-/// not a [`HostError`]: no host can report one and no contract can read one.
-///
-/// The three are the outcomes a host call can end a run with, and
-/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Fault {
-    /// This call's charge would take the meter below zero. The guest exhausting the
-    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
-    /// wasmi's `OutOfFuel` trap instead, never through here.
-    OutOfGas,
-    /// The call could not be served: either the host said so, or this engine's own
-    /// fuel meter did not answer.
-    Internal,
-    /// There is no linear memory to work in — the module exports none, or the call
-    /// came from a start section, which runs before there is an instance.
-    NoMemory,
-}
-
-/// How a host call fails: with a code the guest reads off the return value, or with a
-/// [`Fault`] that stops the run.
-///
-/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
-/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
-/// around something a guest was supposed to see.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CallError {
-    Code(HostError),
-    Fatal(Fault),
-}
-
-/// A host call's result inside the engine: [`HostResult`] plus the faults only the
-/// engine can raise.
-pub(crate) type CallResult<T> = Result<T, CallError>;
-
-/// Which channel a host's answer takes, decided once, here.
-///
-/// Three codes stop the run instead of reaching the contract that asked. Each says the
-/// call was not served at all — the host could not do it, it has not been wired, or
-/// there is nowhere to put the answer — and a contract has no business interpreting
-/// any of them, so it is told nothing and the run ends. Every other code is the
-/// contract's to read.
-impl From<HostError> for CallError {
-    fn from(error: HostError) -> CallError {
-        match error {
-            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
-            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
-            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
-            code => CallError::Code(code),
-        }
-    }
-}
-
-/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
-/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
-/// leave through this channel.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) struct FatalHostError(pub(crate) Fault);
-
-impl wasmi::errors::HostError for FatalHostError {}
-
-impl core::fmt::Display for FatalHostError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "host call refused: {:?}", self.0)
-    }
-}
-
-/// Charge the call's gas, run its body, put the result on the wire. The one path
-/// every registered closure takes, so gas cannot be forgotten.
-pub(crate) fn charged(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
-) -> Result<i32, wasmi::Error> {
-    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`charged`] for a call the guest gets no answer from: its wasm function has no
-/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
-/// and charged whatever happens after, so the cost is all such a call leaves behind.
-///
-/// Only `trace` takes this path.
-pub(crate) fn charged_unreported(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
-) -> Result<(), wasmi::Error> {
-    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`to_wire`] for a call with no result: there is no return value to encode a code
-/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
-/// run, not an answer to the call.
-fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
-    match result {
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-        _ => Ok(()),
-    }
-}
-
-fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
-    match result {
-        Ok(value) => Ok(value),
-        Err(CallError::Code(error)) => Ok(error.code()),
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-    }
-}
-
-/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
-///
-/// A meter that will not answer is this crate's own defect, not the contract's, so it
-/// is [`Fault::Internal`] rather than a number a guest could act on.
-fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
-    let remaining = caller
-        .get_fuel()
-        .map_err(|_| CallError::Fatal(Fault::Internal))?;
-    match remaining.checked_sub(cost) {
-        Some(left) => caller
-            .set_fuel(left)
-            .map_err(|_| CallError::Fatal(Fault::Internal)),
-        None => {
-            let _ = caller.set_fuel(0);
-            Err(CallError::Fatal(Fault::OutOfGas))
-        }
-    }
-}
-
-pub(crate) fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
-    let n = n as u64;
-    let remaining = state.transfer_budget.get();
-    match remaining.checked_sub(n) {
-        Some(left) => {
-            state.transfer_budget.set(left);
-            Ok(())
-        }
-        None => Err(HostError::OutOfTransferLimit),
-    }
-}
-
-fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
-    caller
-        .data()
-        .memory
-        .ok_or(CallError::Fatal(Fault::NoMemory))
-}
-
-/// The guest's memory, for a call that reads its inputs and writes nothing back.
-/// An argument read out of the slice is borrowed rather than copied.
-///
-/// A call that also writes takes both borrows at once, so [`write_buffered`] and
-/// [`write_mant_exp`] hand over the same slice themselves.
-pub(crate) fn guest_memory<'a>(caller: &'a Caller<'_, VmState<'_>>) -> CallResult<&'a [u8]> {
-    let mem = memory(caller)?;
-    Ok(mem.data(caller))
-}
-
-/// Service a call whose answer is bytes, written straight into the guest's output
-/// region.
-///
-/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
-/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region, the
-/// cap, nor the budget, and all three checks below are reachable.
-pub(crate) fn write_into(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let range = out.range()?;
-    let cap = range.len();
-    let mem = memory(caller)?;
-    let host: &dyn HostFunctions = caller.data().host;
-    let budget = usize::try_from(caller.data().transfer_budget.get()).unwrap_or(usize::MAX);
-    let buf = mem
-        .data_mut(&mut *caller)
-        .get_mut(range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES).min(budget)];
-
-    let n = fill(host, buf)?;
-
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(caller.data(), n)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// Service a call that reads guest memory and writes bytes back to it: the host
-/// fills the run's output buffer, which is copied to the guest once every rule has
-/// passed.
-///
-/// `call` gets the guest's whole memory, so it can read any number of input
-/// arguments out of it — which a `&mut` view of that memory would forbid. That is
-/// why the answer goes through a buffer instead of straight into the guest as
-/// [`write_into`]'s does.
-///
-/// **The host is never told the guest's capacity**: it is offered the whole buffer
-/// and reports the value's true length, so the fit is decided here, with nothing yet
-/// in guest memory. A refused value therefore reaches it in no part.
-///
-/// The output is judged after the inputs, so a call with both bad reports the
-/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
-/// region against.
-pub(crate) fn write_buffered(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    // One borrow split in two: the guest's bytes for the inputs, the store data for
-    // the output buffer. Taking them together is what keeps the inputs borrowed
-    // rather than copied out.
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    let n = call(host, data, &mut state.out_buffer[..])?;
-
-    // `out` is checked here rather than before the call: the inputs are judged
-    // first, so a call with both malformed reports the input's verdict.
-    let range = out.range()?;
-    let cap = range.len();
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(state, n)?;
-    buf[..n].copy_from_slice(&state.out_buffer[..n]);
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
-/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
-/// length.
-const MANTISSA_BYTES: usize = 8;
-const EXPONENT_BYTES: usize = 4;
-
-fn check_fits(data: &[u8], range: &Range<usize>, width: usize) -> HostResult<()> {
-    let region = data
-        .get(range.clone())
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if region.len() < width {
-        return Err(HostError::BufferTooSmall);
-    }
-    Ok(())
-}
-
-/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
-/// fills the run's output buffer with the mantissa followed by the exponent, and each
-/// is copied to its own guest region once every rule has passed.
-///
-/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
-/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
-/// regions are judged after the input, and the mantissa's region before the exponent's,
-/// so the first fault reported is the leftmost.
-///
-/// The two widths are the ABI's rather than the guest's, so the length the host reports
-/// is checked against their sum for equality rather than as a bound, and ahead of the
-/// output regions: a wrong total means there is no answer to place, whatever the guest
-/// declared. That is a fatal error and not a status, since the guest asked for nothing
-/// wrong.
-pub(crate) fn write_mant_exp(
-    caller: &mut Caller<'_, VmState<'_>>,
-    mantissa_out: OutBytes,
-    exponent_out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    // The scratch buffer is split at the fixed mantissa width: the host fills the first
-    // eight bytes with the mantissa and the next four with the exponent.
-    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
-    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
-    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
-
-    let total = call(host, data, mant_buf, exp_buf)?;
-
-    // Both buffers are fixed-width and were offered whole, so the only length the host
-    // can correctly report is their sum. Anything else is the host contradicting the
-    // ABI: with the widths in doubt, part of what would be copied out is whatever the
-    // previous call left in the buffer, so none of it is copied.
-    if total != MANTISSA_BYTES + EXPONENT_BYTES {
-        return Err(HostError::InternalFatal.into());
-    }
-
-    let mant_range = mantissa_out.range()?;
-    check_fits(data, &mant_range, MANTISSA_BYTES)?;
-    let exp_range = exponent_out.range()?;
-    check_fits(data, &exp_range, EXPONENT_BYTES)?;
-
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
-
-    let mant_dst = data
-        .get_mut(mant_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-    let exp_dst = data
-        .get_mut(exp_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    exp_dst[..EXPONENT_BYTES]
-        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
-
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "a total other than 12 returned above, and 12 is far inside i32"
-    )]
-    let total = total as i32;
-    Ok(total)
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use crate::vm::TRANSFER_LIMIT_BYTES;
-    use std::cell::Cell;
-    use wasmi::StoreLimitsBuilder;
-    use xrpl_host_functions::{FloatOrdering, TraceDataType};
-
-    /// `charge_transfer` takes the store data, which has to hold a host.
-    struct UncalledHost;
-
-    impl HostFunctions for UncalledHost {
-        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_field(
-            &self,
-            _cache_idx: i32,
-            _field: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_field(
-            &self,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_field(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_array_len(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_signature(
-            &self,
-            _message: &[u8],
-            _signature: &[u8],
-            _pubkey: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn credential_keylet(
-            &self,
-            _subject: &[u8],
-            _issuer: &[u8],
-            _credential_type: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn delegate_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn deposit_preauth_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn escrow_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trust_line_keylet(
-            &self,
-            _account1: &[u8],
-            _account2: &[u8],
-            _currency: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_issuance_keylet(
-            &self,
-            _issuer: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_keylet(
-            &self,
-            _mptid: &[u8],
-            _holder: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn nftoken_offer_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn offer_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn oracle_keylet(
-            &self,
-            _account: &[u8],
-            _doc_id: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn paychannel_keylet(
-            &self,
-            _account: &[u8],
-            _destination: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn permissioned_domain_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn ticket_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn vault_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sponsorship_keylet(
-            &self,
-            _sponsor: &[u8],
-            _sponsee: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn loan_broker_keylet(
-            &self,
-            _owner: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn loan_keylet(
-            &self,
-            _loan_broker_id: &[u8],
-            _loan_seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trace(&self, _msg: &str, _data_type: TraceDataType, _data: &[u8]) -> HostResult<()> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_int(&self, _x: i64, _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_uint(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stamount(
-            &self,
-            _amount: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stnumber(
-            &self,
-            _number: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_int(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_mant_exp(
-            &self,
-            _x: &[u8],
-            _mantissa_out: &mut [u8],
-            _exponent_out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_mant_exp(
-            &self,
-            _mantissa: i64,
-            _exponent: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<FloatOrdering> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_add(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_subtract(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_multiply(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_divide(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_power(
-            &self,
-            _x: &[u8],
-            _n: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-    }
-
-    fn state(budget: u64) -> VmState<'static> {
-        VmState {
-            host: &UncalledHost,
-            mem_limits: StoreLimitsBuilder::new().build(),
-            transfer_budget: Cell::new(budget),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        }
-    }
-
-    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
-    /// channel says so by going through here.
-    fn wire(result: CallResult<i32>) -> i32 {
-        to_wire(result)
-            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
-    }
-
-    #[test]
-    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
-        assert_eq!(wire(Ok(0)), 0);
-        assert_eq!(wire(Ok(32)), 32);
-        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
-    }
-
-    /// The codes a host may answer that a contract must not see, and the fault each
-    /// becomes. Written out rather than derived from `From<HostError>`, which is what
-    /// they are asserting.
-    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
-        (HostError::InternalFatal, Fault::Internal),
-        (HostError::Unimplemented, Fault::Internal),
-        (HostError::NoMemExported, Fault::NoMemory),
-    ];
-
-    /// Every fault, so the two tests below are the whole set and not a sample.
-    /// `From<Fault> for RunError` is what forces a fault added later to be
-    /// considered; this is what forces it to be tested.
-    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
-
-    #[test]
-    fn a_code_that_stops_the_run_converts_to_its_fault() {
-        for (error, fault) in STOPS_THE_RUN {
-            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
-        }
-    }
-
-    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
-    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
-    /// the run on it is then a change someone has to come and make.
-    ///
-    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
-    /// contract can be expected to handle, so it is told no rather than killed.
-    #[test]
-    fn every_other_code_reaches_the_guest_as_itself() {
-        for &error in HostError::ALL {
-            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
-                continue;
-            }
-            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
-            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
-        }
-    }
-
-    /// The trap carries the fault, so `run` can name the outcome without parsing a
-    /// message.
-    #[test]
-    fn a_fault_becomes_a_trap_carrying_it() {
-        for fault in ALL_FAULTS {
-            let trap = to_wire(Err(CallError::Fatal(fault)))
-                .expect_err("a fault must not reach the guest as a code");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    /// The result-less path splits the same two channels differently: a fault still
-    /// stops the run, and every code is dropped, since `trace` has no return value to
-    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
-    /// arrives asserted against both paths.
-    #[test]
-    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
-        assert!(dropped(Ok(())).is_ok());
-
-        for &error in HostError::ALL {
-            if let CallError::Code(code) = CallError::from(error) {
-                assert!(
-                    dropped(Err(CallError::Code(code))).is_ok(),
-                    "{error:?} has no channel to the guest and must be dropped"
-                );
-            }
-        }
-
-        for fault in ALL_FAULTS {
-            let trap =
-                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    #[test]
-    fn a_transfer_spends_the_budget() {
-        let state = state(100);
-
-        assert_eq!(charge_transfer(&state, 30), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 70);
-        assert_eq!(charge_transfer(&state, 70), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The budget bounds the total, so the transfer that would overrun it is
-    /// refused whole rather than partially charged.
-    #[test]
-    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
-        let state = state(100);
-
-        assert_eq!(
-            charge_transfer(&state, 101),
-            Err(HostError::OutOfTransferLimit)
-        );
-        assert_eq!(
-            state.transfer_budget.get(),
-            100,
-            "a refusal must not charge"
-        );
-        assert_eq!(charge_transfer(&state, 100), Ok(()));
-        assert_eq!(
-            charge_transfer(&state, 1),
-            Err(HostError::OutOfTransferLimit)
-        );
-    }
-
-    #[test]
-    fn transferring_nothing_costs_nothing() {
-        let state = state(0);
-
-        assert_eq!(charge_transfer(&state, 0), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The field cap holds one call to a small share of the run's budget, so the
-    /// budget bounds a run rather than a call. An inequality, not the two values:
-    /// those are pinned in `vm.rs`.
-    #[test]
-    fn no_single_value_can_exhaust_the_run_budget() {
-        assert!(
-            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
-            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
-        );
-    }
-}
@@ -1,244 +0,0 @@
-//! A host call's arguments as they arrive: one type per declared parameter the
-//! ABI marshals, built by `register.rs`'s generated closures and read by its
-//! bodies. A wasm scalar (`i32`, `i64`) is passed through as itself and has no
-//! type here.
-//!
-//! What the types buy is that **a body cannot mistake one argument for another**:
-//! an input region offered where an output one belongs is a compile error naming
-//! both, where two loose `i32`s would let a rounding mode be read as a buffer
-//! length. A derived signature cannot catch that, every one of these being
-//! `i32, i32` on the wire.
-//!
-//! The arguments arrive unchecked and are judged where they are read — `InU32`'s
-//! region must hold exactly four bytes, `InStr`'s must be UTF-8, a [`TraceCode`]
-//! must name a rendering — so they are refused in the order the body reads them.
-//!
-//! **The `from_wasm` impls below are half of `wasmi_glue!`'s contract** and the
-//! only construction these types have; `register.rs`'s `glue_env` is where the
-//! macro is told which type marshals which declared one. Which of the two traits
-//! a type takes is the ABI's decision, so `InU32` is a region rather than the
-//! scalar its declared `u32` reads like.
-
-use crate::vm::MAX_FIELD_BYTES;
-use core::ops::Range;
-use xrpl_host_functions::{FromWasmRegion, FromWasmScalar, HostError, HostResult, TraceDataType};
-
-/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
-/// yet checked.
-///
-/// The shared half of the four region types below, which differ in what reading
-/// one means. The fields being out of reach makes [`range`](Region::range) the
-/// only way to indices, so the check can be deferred but not skipped — and
-/// construction is infallible so that a malformed region is refused in the order
-/// the call's own helper chooses.
-#[derive(Copy, Clone)]
-struct Region {
-    ptr: i32,
-    len: i32,
-}
-
-impl Region {
-    fn new(ptr: i32, len: i32) -> Region {
-        Region { ptr, len }
-    }
-
-    /// `start..end` as indices. The conversion is the negativity check, and the
-    /// checked addition guards a 32-bit `usize`, where two `i32`s can sum past the
-    /// end.
-    fn range(self) -> HostResult<Range<usize>> {
-        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
-            return Err(HostError::InvalidParams);
-        };
-        let end = start
-            .checked_add(len)
-            .ok_or(HostError::PointerOutOfBounds)?;
-        Ok(start..end)
-    }
-
-    /// The region's bytes, refused past the field cap. The slice aliases `data`.
-    fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        let range = self.range()?;
-        if range.len() > MAX_FIELD_BYTES {
-            return Err(HostError::DataFieldTooLarge);
-        }
-        data.get(range).ok_or(HostError::PointerOutOfBounds)
-    }
-}
-
-/// A declared `&[u8]`: an input region the host borrows.
-#[derive(Copy, Clone)]
-pub(crate) struct InBytes(Region);
-
-impl FromWasmRegion for InBytes {
-    fn from_wasm(ptr: i32, len: i32) -> InBytes {
-        InBytes(Region::new(ptr, len))
-    }
-}
-
-impl InBytes {
-    /// The region's bytes, aliasing the guest's memory rather than copied out of it.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        self.0.read(data)
-    }
-}
-
-/// A declared `&str`: an input region whose bytes are text.
-#[derive(Copy, Clone)]
-pub(crate) struct InStr(Region);
-
-impl FromWasmRegion for InStr {
-    fn from_wasm(ptr: i32, len: i32) -> InStr {
-        InStr(Region::new(ptr, len))
-    }
-}
-
-impl InStr {
-    /// The region's bytes as text. The read is also the UTF-8 check, so a host is
-    /// never the one to validate them.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&str> {
-        core::str::from_utf8(self.0.read(data)?).map_err(|_| HostError::InvalidParams)
-    }
-}
-
-/// A declared `u32`: an input region holding the number as four little-endian
-/// bytes, which is how the guest SDK passes a sequence number.
-#[derive(Copy, Clone)]
-pub(crate) struct InU32(Region);
-
-impl FromWasmRegion for InU32 {
-    fn from_wasm(ptr: i32, len: i32) -> InU32 {
-        InU32(Region::new(ptr, len))
-    }
-}
-
-impl InU32 {
-    /// The number the region holds. The width is the ABI's, so any length but four
-    /// is `InvalidParams`.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<u32> {
-        let bytes: [u8; 4] = self
-            .0
-            .read(data)?
-            .try_into()
-            .map_err(|_| HostError::InvalidParams)?;
-        Ok(u32::from_le_bytes(bytes))
-    }
-}
-
-/// A declared `&mut [u8]`: the region the host's answer is written to.
-///
-/// It has no `read`: what a call may put here is decided by the `abi.rs` helper
-/// serving it, against the value's length and the run's budget, and the host is
-/// never handed the guest's capacity.
-#[derive(Copy, Clone)]
-pub(crate) struct OutBytes(Region);
-
-impl FromWasmRegion for OutBytes {
-    fn from_wasm(ptr: i32, len: i32) -> OutBytes {
-        OutBytes(Region::new(ptr, len))
-    }
-}
-
-impl OutBytes {
-    pub(crate) fn range(self) -> HostResult<Range<usize>> {
-        self.0.range()
-    }
-}
-
-/// A declared `TraceDataType`: the `i32` code naming how `trace` is to render its
-/// data. The one marshalled argument that is not a region, so reading it needs no
-/// guest memory.
-#[derive(Copy, Clone)]
-pub(crate) struct TraceCode(i32);
-
-impl FromWasmScalar for TraceCode {
-    fn from_wasm(code: i32) -> TraceCode {
-        TraceCode(code)
-    }
-}
-
-impl TraceCode {
-    /// The type the code names, or `InvalidParams`: a rendering the guest did not
-    /// ask for is not one to guess at.
-    pub(crate) fn read(self) -> HostResult<TraceDataType> {
-        TraceDataType::from_code(self.0).ok_or(HostError::InvalidParams)
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The guest memory these tests read out of: sixteen bytes at index 0.
-    const MEMORY: [u8; 16] = [
-        0x78, 0x56, 0x34, 0x12, b'h', b'i', 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-    ];
-
-    #[test]
-    fn a_u32_argument_is_four_little_endian_bytes() {
-        assert_eq!(InU32::from_wasm(0, 4).read(&MEMORY), Ok(0x1234_5678));
-    }
-
-    /// A longer region is refused too, rather than its first four bytes read as
-    /// the answer.
-    #[test]
-    fn a_u32_argument_of_any_other_width_is_refused() {
-        for len in [0, 1, 3, 5, 8] {
-            assert_eq!(
-                InU32::from_wasm(0, len).read(&MEMORY),
-                Err(HostError::InvalidParams),
-                "{len} bytes"
-            );
-        }
-    }
-
-    /// The read is the UTF-8 check, so a host implementing `trace` has nothing
-    /// left to validate.
-    #[test]
-    fn a_str_argument_is_checked_where_it_is_read() {
-        assert_eq!(InStr::from_wasm(4, 2).read(&MEMORY), Ok("hi"));
-        assert_eq!(
-            InStr::from_wasm(6, 1).read(&MEMORY),
-            Err(HostError::InvalidParams),
-            "0xff is not UTF-8"
-        );
-    }
-
-    /// A region past the end of guest memory is refused rather than clamped, and
-    /// one past the field cap is refused before the memory is consulted at all.
-    #[test]
-    fn a_region_is_held_to_the_memory_and_to_the_field_cap() {
-        assert_eq!(
-            InBytes::from_wasm(8, 16).read(&MEMORY),
-            Err(HostError::PointerOutOfBounds)
-        );
-
-        let past_the_cap = i32::try_from(MAX_FIELD_BYTES).expect("the cap is a small constant") + 1;
-        assert_eq!(
-            InBytes::from_wasm(0, past_the_cap).read(&MEMORY),
-            Err(HostError::DataFieldTooLarge)
-        );
-
-        assert_eq!(
-            InBytes::from_wasm(-1, 4).read(&MEMORY),
-            Err(HostError::InvalidParams)
-        );
-    }
-
-    /// Every code the ABI has, and nothing else: an unknown one is refused rather
-    /// than rendered some other way.
-    #[test]
-    fn a_trace_code_names_a_rendering_or_none() {
-        for &data_type in TraceDataType::ALL {
-            assert_eq!(TraceCode::from_wasm(data_type.code()).read(), Ok(data_type));
-        }
-
-        for code in [0, -1, i32::MAX] {
-            assert_eq!(
-                TraceCode::from_wasm(code).read(),
-                Err(HostError::InvalidParams),
-                "{code}"
-            );
-        }
-    }
-}
@@ -1,29 +0,0 @@
-//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
-//!
-//! Every guest access goes through `abi.rs` and reaches linear memory only by
-//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
-//! property rather than a claim. The cast lints are on for the same reason — on a
-//! consensus path a truncating or sign-losing cast changes what a contract is
-//! charged or told, so each one is argued for at its site.
-#![forbid(unsafe_code)]
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unreachable_pub)]
-#![deny(
-    clippy::cast_possible_truncation,
-    clippy::cast_possible_wrap,
-    clippy::cast_sign_loss,
-    clippy::cast_lossless
-)]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-mod abi;
-mod args;
-mod preflight;
-mod register;
-mod vm;
-
-pub use preflight::{CheckError, check, check_all};
-pub use vm::{
-    MAX_EXPORTS, MAX_FIELD_BYTES, MAX_IMPORTS, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, MAX_NAME_BYTES,
-    MAX_TABLE_ELEMENTS, MAX_TYPES, RunError, RunFailure, RunOutcome, TRANSFER_LIMIT_BYTES, run,
-};
@@ -1,518 +0,0 @@
-//! Screening a contract before it reaches the ledger.
-//!
-//! [`check`] answers whether [`crate::run`] would refuse a module before the
-//! guest's first instruction — the stages a caller maps to a malformed
-//! transaction rather than to a failed one. It needs **no host, no store and no
-//! gas**: everything it reads is a property of the compiled module. That is what
-//! makes it callable from a transaction's preflight, which has no ledger to serve
-//! host calls from.
-//!
-//! Two entry points over one pass: [`check`] stops at the first refusal, which is
-//! all a consensus path can act on, and [`check_all`] reports every one. Both draw
-//! from [`check_error_iter`], so they cannot disagree about which refusal is first.
-//!
-//! One thing it deliberately does not screen: a module exporting **no** linear
-//! memory passes, since a contract that makes no host call needs none, and one that
-//! does is refused at the call and charged for what it burned. A start section needs
-//! no rule of its own — the engine forbids one, so such a module fails to compile.
-//!
-//! Two things it screens that a run can only discover: an exported memory, or an
-//! exported table, larger than the engine grants. Both read the same export list, so
-//! [`check_exported_resources_iter`] is one pass — see it for what stays invisible,
-//! and why the table case leaves much more of it there.
-//!
-//! Every rule is here but one: [`signature`] holds the comparison of an import's
-//! type against the ABI's, which needs machinery the rest of the stage does not.
-
-mod signature;
-
-use std::fmt;
-use wasmi::{ExternType, FuncType, Module, ValType};
-use xrpl_host_functions::{HOST_MODULE, HostFunctionSpec};
-
-use crate::vm::{CompileError, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, compile, wasm_engine};
-use signature::check_signature;
-
-/// Why a module cannot be run. One variant per stage, since the caller maps the
-/// stages separately.
-#[derive(Debug)]
-pub enum CheckError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// A type, import or export section, or an import or export name, is past its
-    /// cap. Apart from [`CheckError::Compile`] because no contract reaches a cap by
-    /// accident, so a caller may want to count these as deliberate.
-    Limit(String),
-    /// An import no engine of this ABI defines: another module namespace, a name
-    /// that is not a host function, or one imported as something other than a
-    /// function.
-    Import(String),
-    /// An import of a host function typed as something other than what the engine
-    /// registers it as. Apart from [`CheckError::Import`] because the ABI does
-    /// have the function the guest asked for.
-    Signature(String),
-    /// No export named `function_name` with signature `() -> i32`.
-    EntryPoint(String),
-    /// The module asks for more linear memory than the engine grants.
-    Memory(String),
-    /// The module asks for a larger table than the engine grants.
-    Table(String),
-}
-
-impl fmt::Display for CheckError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
-            CheckError::Limit(detail) => write!(f, "limit: {detail}"),
-            CheckError::Import(detail) => write!(f, "import: {detail}"),
-            CheckError::Signature(detail) => write!(f, "signature: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
-            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
-            CheckError::Table(detail) => write!(f, "table: {detail}"),
-        }
-    }
-}
-
-impl From<CompileError> for CheckError {
-    fn from(error: CompileError) -> CheckError {
-        match error {
-            CompileError::Invalid(detail) => CheckError::Compile(detail),
-            CompileError::Limit(detail) => CheckError::Limit(detail),
-        }
-    }
-}
-
-/// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory or table than it may
-/// have.
-pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
-    let module = compile(&wasm_engine(), wasm).map_err(CheckError::from)?;
-    check_error_iter(&module, function_name)
-        .next()
-        .map_or(Ok(()), Err)
-}
-
-/// [`check`], reporting every error found rather than stopping at the first.
-pub fn check_all(wasm: &[u8], function_name: &str) -> Result<(), Vec<CheckError>> {
-    let module = compile(&wasm_engine(), wasm).map_err(|e| vec![CheckError::from(e)])?;
-    let refusals: Vec<CheckError> = check_error_iter(&module, function_name).collect();
-    if refusals.is_empty() {
-        return Ok(());
-    }
-    Err(refusals)
-}
-
-fn check_error_iter<'a>(
-    module: &'a Module,
-    function_name: &'a str,
-) -> impl Iterator<Item = CheckError> + 'a {
-    check_imports_iter(module)
-        .chain(check_entry_point_iter(module, function_name))
-        .chain(check_exported_resources_iter(module))
-}
-
-fn check_imports_iter(module: &Module) -> impl Iterator<Item = CheckError> + '_ {
-    module
-        .imports()
-        .filter_map(|import| check_import(import.module(), import.name(), import.ty()).err())
-}
-
-/// Whether the engine defines this one import, as the guest declares it.
-///
-/// Names and signatures both come from the declarations
-/// [`crate::register::register_host_functions`] registers from, so a check and a
-/// run cannot disagree about which imports exist or what they look like.
-///
-/// The rules are ordered, each presuming the ones before it held: a guest
-/// importing `env::malloc` is told about the namespace, which explains every other
-/// import it has too, and only an import that names a real host function as a
-/// function has a signature worth comparing.
-fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), CheckError> {
-    let function = host_function(module, name).map_err(CheckError::Import)?;
-    let imported = imported_function(name, ty).map_err(CheckError::Import)?;
-    check_signature(function, imported).map_err(CheckError::Signature)
-}
-
-/// Which host function this import names: its namespace must be the engine's, and
-/// its name one the ABI declares.
-fn host_function(module: &str, name: &str) -> Result<HostFunctionSpec, String> {
-    if module != HOST_MODULE {
-        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
-    }
-    HostFunctionSpec::ALL
-        .iter()
-        .find(|function| function.wasm_name() == name)
-        .copied()
-        .ok_or_else(|| format!("no host function '{name}'"))
-}
-
-/// The function type the guest declared. The engine defines these names as
-/// functions and as nothing else, so an import of any other kind does not link.
-fn imported_function<'ty>(name: &str, ty: &'ty ExternType) -> Result<&'ty FuncType, String> {
-    match ty {
-        ExternType::Func(ty) => Ok(ty),
-        _ => Err(format!("'{HOST_MODULE}::{name}' is not a function")),
-    }
-}
-
-fn check_entry_point_iter<'a>(
-    module: &'a Module,
-    name: &'a str,
-) -> impl Iterator<Item = CheckError> + 'a {
-    std::iter::once_with(move || match module.get_export(name) {
-        Some(ExternType::Func(ty)) if is_entry_point(&ty) => None,
-        found => Some(CheckError::EntryPoint(entry_point_fault(found, name))),
-    })
-    .flatten()
-}
-
-/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
-/// `get_typed_func::<(), i32>` accepts.
-fn is_entry_point(ty: &FuncType) -> bool {
-    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
-}
-
-/// A module may declare no more linear memory, and no larger a table, than the
-/// engine grants. One pass over the exports, since both rules read the same list and
-/// the export table is the only place either is visible.
-///
-/// **A memory or table the module keeps to itself is therefore not screened**: it is
-/// absent from the exports, and the store's limiter is what refuses it, at
-/// instantiation. That gap is wide for tables — Rust exports
-/// `__indirect_function_table` only under `--export-table`, so unexported is the
-/// normal shape — and narrow for memories, since a contract needs an exported one to
-/// make any host call at all.
-///
-/// A module faulting on both yields both, in export order. Neither fault explains
-/// the other, so there is no precedence to preserve — only the need for every node to
-/// reach the same verdict, which export order already gives.
-fn check_exported_resources_iter(module: &Module) -> impl Iterator<Item = CheckError> + '_ {
-    module.exports().filter_map(|export| match export.ty() {
-        ExternType::Memory(ty) => check_initial_pages(ty.minimum())
-            .err()
-            .map(CheckError::Memory),
-        ExternType::Table(ty) => check_initial_elements(ty.minimum())
-            .err()
-            .map(CheckError::Table),
-        _ => None,
-    })
-}
-
-/// Whether the engine will grant a memory of this declared initial size.
-///
-/// The *minimum* only: a declared maximum past the cap is legal and simply
-/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
-/// unreachable` pins on the run side. Refusing it here would turn a runnable
-/// contract away.
-fn check_initial_pages(pages: u64) -> Result<(), String> {
-    if pages > u64::from(MAX_MEMORY_PAGES) {
-        return Err(format!(
-            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
-        ));
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a table of this declared initial size.
-///
-/// The *minimum* is the whole question: `table.grow` belongs to the reference-types
-/// proposal, which [`crate::vm`]'s engine turns off, so a table never becomes larger
-/// than it was declared and a declared maximum past the cap is simply unreachable.
-fn check_initial_elements(elements: u64) -> Result<(), String> {
-    let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("the cap is a small constant");
-    if elements > cap {
-        return Err(format!(
-            "initial table of {elements} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-        ));
-    }
-    Ok(())
-}
-
-/// How an entry-point lookup failed, in the words both stages use: a check and a
-/// run describe the same module the same way, and "no entry point" would send a
-/// contract author looking for a function they already have.
-pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
-    match found {
-        Some(ExternType::Func(_)) => {
-            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
-        }
-        Some(_) => format!("export '{name}' is not a function"),
-        None => format!("no entry point '{name}'"),
-    }
-}
-
-/// The rules, one by one, on inputs built directly rather than parsed out of a
-/// module. `tests/preflight.rs` runs real modules through [`check`] and
-/// [`check_all`]; what is here is what a module cannot state precisely — which rule
-/// fires and in what words the caller logs it. The signature rule's derivation is
-/// tested beside it, in [`signature`].
-///
-/// `wat` is a dev-dependency, so the one test here that does need a module writes it
-/// as text like every other test in the crate. What the library must not gain is a
-/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
-/// cannot give it one.
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::signature::registered_type;
-    use super::*;
-    use wasmi::{GlobalType, MemoryType, Mutability};
-
-    /// The type an import of `function` must declare.
-    fn registered(function: HostFunctionSpec) -> ExternType {
-        ExternType::Func(registered_type(function))
-    }
-
-    /// A name every one of these tests can use, taken from the ABI rather than
-    /// spelled, so it stays a real host function as the ABI changes.
-    fn a_host_function_name() -> &'static str {
-        HostFunctionSpec::ALL[0].wasm_name()
-    }
-
-    // -----------------------------------------------------------------------
-    // Imports
-    // -----------------------------------------------------------------------
-
-    /// Every name the ABI declares is served, at the signature derived from its
-    /// declaration. Derived from `ALL` rather than listed, so a host function added
-    /// to the ABI is covered the day it lands.
-    ///
-    /// Both sides come from the table, so this pins that no declaration is refused,
-    /// not that the table is right. `tests/preflight.rs`'s
-    /// `every_declared_host_function_may_be_imported` and
-    /// `the_derived_signatures_are_what_the_linker_registers` are what compare it
-    /// against hand-written imports and against the real linker.
-    #[test]
-    fn every_declared_host_function_is_served() {
-        for &function in HostFunctionSpec::ALL {
-            let name = function.wasm_name();
-            if let Err(refusal) = check_import(HOST_MODULE, name, &registered(function)) {
-                panic!("'{name}' is declared but not served: {refusal}");
-            }
-        }
-    }
-
-    #[test]
-    fn an_import_from_another_namespace_is_refused() {
-        for namespace in ["env", "host", "host_lib2", ""] {
-            let refusal = host_function(namespace, a_host_function_name()).expect_err(namespace);
-            assert!(
-                refusal.contains("is not from 'host_lib'"),
-                "{namespace}: {refusal}"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_refused() {
-        let refusal = host_function(HOST_MODULE, "no_such_function").expect_err("unknown name");
-        assert_eq!(refusal, "no host function 'no_such_function'");
-    }
-
-    /// The engine defines these names as functions and as nothing else, so a module
-    /// importing one as a global or a memory does not link either.
-    #[test]
-    fn a_host_function_imported_as_anything_else_is_refused() {
-        for ty in [
-            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
-            ExternType::Memory(MemoryType::new(1, None)),
-        ] {
-            let name = a_host_function_name();
-            let refusal = imported_function(name, &ty).expect_err("not a function");
-            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
-        }
-    }
-
-    /// The rules are ordered. An import that breaks two of them is reported by the
-    /// first, so the message a contract author reads is the one that explains the
-    /// rest of their imports too.
-    #[test]
-    fn the_namespace_is_reported_before_the_name() {
-        let refusal = host_function("env", "no_such_function")
-            .expect_err("neither the namespace nor the name is served");
-
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-        assert!(
-            !refusal.contains("no host function"),
-            "the namespace explains it: {refusal}"
-        );
-    }
-
-    /// The signature is the last rule, so an import wrong about the namespace, the
-    /// name or the kind is not told about a signature instead, and the two kinds of
-    /// fault reach the caller as different stages.
-    #[test]
-    fn the_signature_is_the_last_rule() {
-        let name = a_host_function_name();
-        let mistyped = ExternType::Func(FuncType::new([ValType::F32], []));
-        let not_a_function = ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const));
-
-        for (rule, refusal) in [
-            ("the namespace", check_import("env", name, &mistyped)),
-            (
-                "the name",
-                check_import(HOST_MODULE, "no_such_function", &mistyped),
-            ),
-            ("the kind", check_import(HOST_MODULE, name, &not_a_function)),
-        ] {
-            assert!(
-                matches!(refusal, Err(CheckError::Import(_))),
-                "{rule} explains this import, not its signature: {refusal:?}"
-            );
-        }
-
-        assert!(
-            matches!(
-                check_import(HOST_MODULE, name, &mistyped),
-                Err(CheckError::Signature(_))
-            ),
-            "an import that breaks nothing but the signature is a signature fault"
-        );
-    }
-
-    /// Both halves of the type are load-bearing, and neither is checked anywhere
-    /// a module cannot reach.
-    #[test]
-    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
-        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
-
-        for wrong in [
-            FuncType::new([], []),
-            FuncType::new([], [ValType::I64]),
-            FuncType::new([ValType::I32], [ValType::I32]),
-            FuncType::new([], [ValType::I32, ValType::I32]),
-        ] {
-            assert!(!is_entry_point(&wrong), "{wrong:?}");
-        }
-    }
-
-    /// Three faults, three descriptions. A run reports these too, with wasmi's own
-    /// error appended, so a swapped arm would mislead at both stages at once.
-    #[test]
-    fn each_entry_point_fault_is_described_as_itself() {
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Func(FuncType::new(
-                    [ValType::I32],
-                    [ValType::I32]
-                ))),
-                "finish"
-            ),
-            "entry point 'finish' has the wrong signature, expected '() -> i32'"
-        );
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Global(GlobalType::new(
-                    ValType::I32,
-                    Mutability::Const
-                ))),
-                "finish"
-            ),
-            "export 'finish' is not a function"
-        );
-        assert_eq!(
-            entry_point_fault(None, "finish"),
-            "no entry point 'finish'",
-            "an absent export must not be reported as a wrong signature"
-        );
-    }
-
-    /// The cap itself is granted; one page past it is not. The boundary is the whole
-    /// rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
-        assert_eq!(check_initial_pages(0), Ok(()));
-        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
-
-        let past = u64::from(MAX_MEMORY_PAGES) + 1;
-        let refusal = check_initial_pages(past).expect_err("one page past the cap");
-        assert_eq!(
-            refusal,
-            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
-        );
-    }
-
-    /// The cap itself is granted; one element past it is not. The boundary is the
-    /// whole rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_table_may_reach_the_cap_but_not_pass_it() {
-        let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("fits");
-        assert_eq!(check_initial_elements(0), Ok(()));
-        assert_eq!(check_initial_elements(cap), Ok(()));
-
-        let past = cap + 1;
-        let refusal = check_initial_elements(past).expect_err("one element past the cap");
-        assert_eq!(
-            refusal,
-            format!(
-                "initial table of {past} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-            )
-        );
-    }
-
-    /// The bridge logs this string and the C++ tests match on it, so the stage's
-    /// prefix is part of the interface rather than a debugging aid.
-    #[test]
-    fn a_refusal_names_its_stage() {
-        assert_eq!(
-            CheckError::Compile("bad magic".to_string()).to_string(),
-            "compile: bad magic"
-        );
-        assert_eq!(
-            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
-            "memory: initial memory of 129 pages"
-        );
-        assert_eq!(
-            CheckError::Table("initial table of 1025 elements".to_string()).to_string(),
-            "table: initial table of 1025 elements"
-        );
-        assert_eq!(
-            CheckError::Import("no host function 'x'".to_string()).to_string(),
-            "import: no host function 'x'"
-        );
-        // The stage is the prefix, so the detail must not say "signature" again.
-        assert_eq!(
-            CheckError::Signature(
-                "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'".to_string()
-            )
-            .to_string(),
-            "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-        // The entry point's detail already says which of its three faults it is,
-        // so a prefix would only repeat it.
-        assert_eq!(
-            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
-            "no entry point 'finish'"
-        );
-    }
-
-    #[test]
-    fn the_stages_run_in_order() {
-        assert!(
-            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
-            "nothing is screened until the module compiles"
-        );
-
-        // A module that compiles and imports nothing, so it reaches the entry point.
-        let empty = wat::parse_str("(module)").expect("assembles");
-        assert!(
-            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
-            "a module that compiles and imports nothing reaches the entry point"
-        );
-    }
-
-    /// Compiling is the one stage that ends the walk for [`check_all`] too: there is
-    /// no module to read the other rules off.
-    #[test]
-    fn a_failed_compile_is_reported_alone() {
-        let refusals = check_all(b"not wasm", "finish").expect_err("not a module");
-        assert!(
-            matches!(refusals.as_slice(), [CheckError::Compile(_)]),
-            "{refusals:?}"
-        );
-    }
-}
@@ -1,154 +0,0 @@
-//! The last rule on an import: an import that names a host function must also
-//! declare the type the engine registers it as.
-//!
-//! A file of its own because it is the one import rule with machinery to carry:
-//! the ABI's derived signature, its map into wasmi's value types, and a rendering
-//! of a function type for the refusal.
-//!
-//! **Arity and value types are the whole of it** — an `i64` in an `i32`'s place, or
-//! a `u32` parameter read as one wasm parameter rather than two. **Parameter order
-//! is invisible**: nearly everything lowers to `i32`, so two swapped parameters of
-//! the same type leave the function type identical.
-
-use wasmi::{FuncType, ValType};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-
-/// Whether this import declares the type the engine registers — one that does not
-/// is what a module parts from the linker over at instantiation.
-pub(super) fn check_signature(
-    function: HostFunctionSpec,
-    imported: &FuncType,
-) -> Result<(), String> {
-    let registered = registered_type(function);
-    if *imported == registered {
-        return Ok(());
-    }
-    Err(format!(
-        "'{}' expected '{}', found '{}'",
-        function.wasm_name(),
-        signature(&registered),
-        signature(imported)
-    ))
-}
-
-/// The type the engine registers `function` as: the wasm signature derived from its
-/// declaration, in wasmi's own vocabulary.
-///
-/// Building one to compare against costs nothing — `FuncType` holds up to 21 value
-/// types inline on a 64-bit target and the ABI's widest signature is nine, so this
-/// is a stack value and the comparison above is one `==`.
-pub(super) fn registered_type(function: HostFunctionSpec) -> FuncType {
-    FuncType::new(
-        function.wasm_params().iter().copied().map(val_type),
-        function.wasm_result().map(val_type),
-    )
-}
-
-/// The one place the ABI's value types become the engine's.
-fn val_type(declared: WasmValType) -> ValType {
-    match declared {
-        WasmValType::I32 => ValType::I32,
-        WasmValType::I64 => ValType::I64,
-    }
-}
-
-/// A function type as `(i32, i32) -> i32`, and as `(i32, i32)` for a function
-/// answering nothing — the spelling [`super::entry_point_fault`] uses, so the two
-/// stages describe a signature the same way.
-fn signature(ty: &FuncType) -> String {
-    let params = to_string(ty.params());
-    match ty.results() {
-        [] => format!("({params})"),
-        results => format!("({params}) -> {}", to_string(results)),
-    }
-}
-
-/// The types of one position, as a signature lists them.
-fn to_string(types: &[ValType]) -> String {
-    types
-        .iter()
-        .copied()
-        .map(as_str)
-        .collect::<Vec<_>>()
-        .join(", ")
-}
-
-/// A wasm value type as the text format spells it. Total over [`ValType`] because a
-/// refusal renders the found side too, which is whatever the module declared.
-fn as_str(val_type: ValType) -> &'static str {
-    match val_type {
-        ValType::I32 => "i32",
-        ValType::I64 => "i64",
-        ValType::F32 => "f32",
-        ValType::F64 => "f64",
-        ValType::V128 => "v128",
-        ValType::FuncRef => "funcref",
-        ValType::ExternRef => "externref",
-    }
-}
-
-/// The rule and the derivation under it, on function types built directly. Which
-/// `CheckError` a refusal becomes and where this rule sits among the other three
-/// are the parent's tests.
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The three ways an import's type can differ from the one registered, each
-    /// against a real declaration: a wrong value type, a wrong arity, and a result
-    /// where the ABI answers nothing.
-    ///
-    /// The arity case is the one that matters in practice — a guest that reads
-    /// `check_keylet`'s `seq: u32` as a scalar writes exactly that signature.
-    #[test]
-    fn an_import_of_the_wrong_type_is_refused() {
-        let refusal = check_signature(
-            HostFunctionSpec::GetLedgerSqn,
-            &FuncType::new([ValType::I64, ValType::I64], [ValType::I32]),
-        )
-        .expect_err("i64 where i32 belongs");
-        assert_eq!(
-            refusal,
-            "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::CheckKeylet,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a u32 read as one parameter rather than two");
-        assert_eq!(
-            refusal,
-            "'check_id' expected '(i32, i32, i32, i32, i32, i32) -> i32', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::Trace,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a result from the one function that answers nothing");
-        assert_eq!(
-            refusal,
-            "'trace' expected '(i32, i32, i32, i32, i32)', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-    }
-
-    /// Both of the ABI's value types survive the map to the engine's vocabulary:
-    /// an `i64` collapsed to an `i32` would make the check accept what the linker
-    /// refuses, and a result invented for `trace` would make it refuse what the
-    /// linker accepts.
-    #[test]
-    fn the_derived_type_keeps_i64_and_the_absent_result() {
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::FloatFromInt)),
-            "(i64, i32, i32, i32) -> i32"
-        );
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::Trace)),
-            "(i32, i32, i32, i32, i32)"
-        );
-    }
-}
@@ -1,717 +0,0 @@
-//! What this engine does with each host call, once the ABI's own machinery has
-//! taken the call apart.
-//!
-//! `wasmi_glue!` expands to the [`HostFunctionBodies`] trait and
-//! [`register_host_functions`], both generated from the declarations in
-//! `xrpl-host-functions` — so the wasm signature every closure is registered at is
-//! the one [`crate::check`] screens an import by. Hand-written here is one body per
-//! declaration, and the compiler will not accept the `impl` without all of them.
-//! [`glue_env`] is this engine's side of that macro's contract.
-//!
-//! **A body charges no gas and touches no wire encoding.** The generated closure
-//! does both, around the call, so a body says only what the call *is*.
-//!
-//! Four shapes cover 59 of the 60, each decided by the declaration's own types:
-//!
-//! - a value the host answers directly — read the arguments, call the host;
-//! - [`write_into`], for a value written straight to the guest's output region:
-//!   the call reads no guest memory, so the host can be handed a `&mut` view of it;
-//! - [`write_buffered`], for one that also reads: the host fills the run's scratch
-//!   buffer, and it is copied out once every rule has passed, which is what lets
-//!   the inputs stay borrowed rather than copied;
-//! - [`write_mant_exp`], for the one call that writes two regions.
-//!
-//! `trace` is the sixtieth: its declared `HostResult<()>` gives it a
-//! `CallResult<()>` body and the `charged_unreported` helper.
-
-use crate::abi::{
-    CallResult, charge_transfer, guest_memory, write_buffered, write_into, write_mant_exp,
-};
-use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-use crate::vm::VmState;
-use wasmi::Caller;
-
-/// Everything `wasmi_glue!` names on this side, gathered where the macro can be
-/// handed it — so a rename in `abi.rs` or `args.rs` is an unresolved import here
-/// rather than a name resolved against whatever the call site has in scope.
-///
-/// The shapes are elsewhere and cannot be stated here: `args.rs` implements
-/// `FromWasmRegion`/`FromWasmScalar`, and the expansion pins each charging
-/// helper's signature itself.
-mod glue_env {
-    pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-    pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-    pub(crate) use crate::vm::VmState;
-}
-
-xrpl_host_functions::wasmi_glue!(glue_env);
-
-/// The bodies this engine registers, named as one type so
-/// [`register_host_functions`] can be given them. Never built: every body is an
-/// associated function and the host it calls comes from the store.
-pub(crate) struct Bodies {}
-
-impl HostFunctionBodies for Bodies {
-    fn get_ledger_sqn(caller: &mut Caller<'_, VmState<'_>>, out: OutBytes) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_ledger_sqn(out))
-    }
-
-    fn get_parent_ledger_time(
-        caller: &mut Caller<'_, VmState<'_>>,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_parent_ledger_time(out))
-    }
-
-    fn get_parent_ledger_hash(
-        caller: &mut Caller<'_, VmState<'_>>,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_parent_ledger_hash(out))
-    }
-
-    fn get_base_fee(caller: &mut Caller<'_, VmState<'_>>, out: OutBytes) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_base_fee(out))
-    }
-
-    fn is_amendment_enabled(
-        caller: &mut Caller<'_, VmState<'_>>,
-        amendment: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.is_amendment_enabled(amendment.read(memory)?)?)
-    }
-
-    fn cache_ledger_obj(
-        caller: &mut Caller<'_, VmState<'_>>,
-        obj_id: InBytes,
-        cache_idx: i32,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.cache_ledger_obj(obj_id.read(memory)?, cache_idx)?)
-    }
-
-    fn get_tx_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_tx_field(field, out))
-    }
-
-    fn get_current_ledger_obj_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.get_current_ledger_obj_field(field, out)
-        })
-    }
-
-    fn get_ledger_obj_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.get_ledger_obj_field(cache_idx, field, out)
-        })
-    }
-
-    fn get_tx_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_tx_nested_field(locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_current_ledger_obj_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_current_ledger_obj_nested_field(locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_ledger_obj_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_ledger_obj_nested_field(cache_idx, locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_tx_array_len(caller: &mut Caller<'_, VmState<'_>>, field: i32) -> CallResult<i32> {
-        Ok(caller.data().host.get_tx_array_len(field)?)
-    }
-
-    fn get_current_ledger_obj_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-    ) -> CallResult<i32> {
-        Ok(caller.data().host.get_current_ledger_obj_array_len(field)?)
-    }
-
-    fn get_ledger_obj_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        field: i32,
-    ) -> CallResult<i32> {
-        Ok(caller
-            .data()
-            .host
-            .get_ledger_obj_array_len(cache_idx, field)?)
-    }
-
-    fn get_tx_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_tx_nested_array_len(locator.read(memory)?)?)
-    }
-
-    fn get_current_ledger_obj_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_current_ledger_obj_nested_array_len(locator.read(memory)?)?)
-    }
-
-    fn get_ledger_obj_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_ledger_obj_nested_array_len(cache_idx, locator.read(memory)?)?)
-    }
-
-    fn check_signature(
-        caller: &mut Caller<'_, VmState<'_>>,
-        message: InBytes,
-        signature: InBytes,
-        pubkey: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.check_signature(
-            message.read(memory)?,
-            signature.read(memory)?,
-            pubkey.read(memory)?,
-        )?)
-    }
-
-    fn account_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.account_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn amm_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        asset1: InBytes,
-        asset2: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.amm_keylet(asset1.read(memory)?, asset2.read(memory)?, buf)
-        })
-    }
-
-    fn check_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.check_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn credential_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        subject: InBytes,
-        issuer: InBytes,
-        credential_type: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.credential_keylet(
-                subject.read(memory)?,
-                issuer.read(memory)?,
-                credential_type.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn delegate_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        authorize: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.delegate_keylet(account.read(memory)?, authorize.read(memory)?, buf)
-        })
-    }
-
-    fn deposit_preauth_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        authorize: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.deposit_preauth_keylet(account.read(memory)?, authorize.read(memory)?, buf)
-        })
-    }
-
-    fn did_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.did_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn escrow_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.escrow_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn trust_line_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account1: InBytes,
-        account2: InBytes,
-        currency: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.trust_line_keylet(
-                account1.read(memory)?,
-                account2.read(memory)?,
-                currency.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn mptoken_issuance_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        issuer: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.mptoken_issuance_keylet(issuer.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn mptoken_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        mptid: InBytes,
-        holder: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.mptoken_keylet(mptid.read(memory)?, holder.read(memory)?, buf)
-        })
-    }
-
-    fn nftoken_offer_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.nftoken_offer_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn offer_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.offer_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn oracle_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        doc_id: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.oracle_keylet(account.read(memory)?, doc_id.read(memory)?, buf)
-        })
-    }
-
-    fn paychannel_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        destination: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.paychannel_keylet(
-                account.read(memory)?,
-                destination.read(memory)?,
-                seq.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn permissioned_domain_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.permissioned_domain_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn signer_list_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.signer_list_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn ticket_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.ticket_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn vault_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.vault_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn sponsorship_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        sponsor: InBytes,
-        sponsee: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.sponsorship_keylet(sponsor.read(memory)?, sponsee.read(memory)?, buf)
-        })
-    }
-
-    fn loan_broker_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        owner: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.loan_broker_keylet(owner.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn loan_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        loan_broker_id: InBytes,
-        loan_seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.loan_keylet(loan_broker_id.read(memory)?, loan_seq.read(memory)?, buf)
-        })
-    }
-
-    fn sha512_half(
-        caller: &mut Caller<'_, VmState<'_>>,
-        data: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.sha512_half(data.read(memory)?, buf)
-        })
-    }
-
-    /// The one body with nothing to answer: the wasm function has no result to
-    /// carry a code, so a malformed argument leaves the guest none the wiser and
-    /// the host uncalled.
-    fn trace(
-        caller: &mut Caller<'_, VmState<'_>>,
-        msg: InStr,
-        data_type: TraceCode,
-        data: InBytes,
-    ) -> CallResult<()> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.trace(msg.read(memory)?, data_type.read()?, data.read(memory)?)?)
-    }
-
-    fn update_data(caller: &mut Caller<'_, VmState<'_>>, data: InBytes) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let bytes = data.read(memory)?;
-        charge_transfer(caller.data(), bytes.len())?;
-        Ok(caller.data().host.update_data(bytes)?)
-    }
-
-    fn get_nft(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft(account.read(memory)?, nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_issuer(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_issuer(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_taxon(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_taxon(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_flags(caller: &mut Caller<'_, VmState<'_>>, nft_id: InBytes) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_nft_flags(nft_id.read(memory)?)?)
-    }
-
-    fn get_nft_transfer_fee(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_nft_transfer_fee(nft_id.read(memory)?)?)
-    }
-
-    fn get_nft_sequence(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_sequence(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn float_from_int(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: i64,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.float_from_int(x, out, mode))
-    }
-
-    fn float_from_uint(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_uint(x.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_from_stamount(
-        caller: &mut Caller<'_, VmState<'_>>,
-        amount: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_stamount(amount.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_from_stnumber(
-        caller: &mut Caller<'_, VmState<'_>>,
-        number: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_stnumber(number.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_to_int(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_to_int(x.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_to_mant_exp(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        mantissa_out: OutBytes,
-        exponent_out: OutBytes,
-    ) -> CallResult<i32> {
-        write_mant_exp(
-            caller,
-            mantissa_out,
-            exponent_out,
-            |host, memory, mantissa, exponent| {
-                host.float_to_mant_exp(x.read(memory)?, mantissa, exponent)
-            },
-        )
-    }
-
-    fn float_from_mant_exp(
-        caller: &mut Caller<'_, VmState<'_>>,
-        mantissa: i64,
-        exponent: i32,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.float_from_mant_exp(mantissa, exponent, out, mode)
-        })
-    }
-
-    fn float_compare(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        // `FloatOrdering`'s codes are non-negative, which is what lets the verdict share
-        // this `i32` with a negative `HostError`.
-        Ok(host.float_compare(x.read(memory)?, y.read(memory)?)?.code())
-    }
-
-    fn float_add(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_add(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_subtract(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_subtract(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_multiply(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_multiply(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_divide(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_divide(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_power(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        n: i32,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_power(x.read(memory)?, n, buf, mode)
-        })
-    }
-}
@@ -1,561 +0,0 @@
-use std::cell::Cell;
-use std::fmt;
-use wasmi::{
-    CompilationMode, Config, CustomFuelCosts, EnforcedLimits, Engine, Export, Linker, Memory,
-    Module, Store, StoreLimits, StoreLimitsBuilder, TrapCode,
-};
-use xrpl_host_functions::HostFunctions;
-
-use crate::abi::{FatalHostError, Fault};
-use crate::preflight::entry_point_fault;
-use crate::register::{Bodies, register_host_functions};
-
-/// wasm linear-memory page size, fixed by the wasm spec (64 KiB).
-const WASM_PAGE_BYTES: u32 = 64 * 1024;
-
-/// Linear-memory page cap.
-pub const MAX_MEMORY_PAGES: u32 = 128;
-
-/// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
-pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
-
-/// Cap on a table's element count.
-///
-/// A table entry is 8 bytes and wasmi materializes every one of them inside
-/// `instantiate_and_start` — before the guest's first instruction, so no gas charge
-/// can reach the cost. Without this cap the ceiling is the validator's, `u32::MAX`
-/// entries, which a module asks for in five bytes of LEB128 and pays for in ~34 GiB.
-pub const MAX_TABLE_ELEMENTS: usize = 1024;
-
-/// Cap on a module's type section entries. The example contracts declare under ten.
-pub const MAX_TYPES: u32 = 2048;
-
-/// Cap on a module's import section entries. Every import must name a host
-/// function, so a module needs no more than the ABI has — well under this.
-pub const MAX_IMPORTS: u32 = 256;
-
-/// Cap on a module's export section entries. The example contracts export under ten.
-pub const MAX_EXPORTS: u32 = 256;
-
-/// Cap on the bytes in any one import's module or field name, or export's name.
-/// Host function names run to tens of bytes.
-pub const MAX_NAME_BYTES: usize = 256;
-
-/// Total bytes the host may write into guest memory in one [`run`], separate from
-/// gas.
-///
-/// One direction only. What the guest passes in is not charged: it reaches the host
-/// as a borrowed slice of guest memory, capped per value at [`MAX_FIELD_BYTES`] by
-/// `Region::read` and in number by gas, and a host that keeps a copy (`update_data`)
-/// bounds it on its own side.
-pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
-
-/// Size cap on any single value crossing the boundary, in either direction; over
-/// it is `DataFieldTooLarge`.
-///
-/// A protocol limit: `kMaxWasmDataLength` in `include/xrpl/protocol/Protocol.h`.
-pub const MAX_FIELD_BYTES: usize = 1024;
-
-/// State threaded through every host call, stored in the wasmi [`Store`].
-pub(crate) struct VmState<'h> {
-    pub(crate) host: &'h dyn HostFunctions,
-    /// Enforces [`store_limits`] via `Store::limiter`, which needs a `&mut` into it
-    /// from `&mut VmState` — hence a field rather than a local.
-    pub(crate) mem_limits: StoreLimits,
-    /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
-    ///
-    /// A `Cell` because it is decremented from a shared `&Caller`. One thread per
-    /// invocation touches the store, so the lack of `Sync` costs nothing.
-    ///
-    /// TODO: the extra charge for an unaligned field copy has nothing to attach to
-    /// until this ABI gains a `FieldLocator` host function.
-    pub(crate) transfer_budget: Cell<u64>,
-    /// The guest's linear memory, resolved once by [`run`] after instantiation so
-    /// no host call pays for an export lookup.
-    ///
-    /// Caching the handle is sound because a [`Memory`] is an arena index, not a
-    /// pointer to the bytes: it survives `memory.grow`, and `data`/`data_mut`
-    /// re-derive the slice per call.
-    ///
-    /// The handle is scoped to one store, so this assumes **one module, one
-    /// instance, one store per `run`**. Module linking or nested execution would
-    /// have to resolve per instance: a cached handle would serve a call against the
-    /// wrong instance's memory, which is a wrong answer rather than an error.
-    pub(crate) memory: Option<Memory>,
-    /// Where a host writes a value before [`crate::abi::write_buffered`] copies it
-    /// to the guest. One buffer per run, so no call zero-fills one of its own.
-    ///
-    /// Inline rather than boxed: the store's data is built once and then only
-    /// borrowed, so a kilobyte in it costs a move where a `Box` costs an
-    /// allocation. A local would cost neither, but `forbid(unsafe_code)` means a
-    /// stack buffer is zero-filled — per call, which is the cost this removes.
-    pub(crate) out_buffer: [u8; MAX_FIELD_BYTES],
-}
-
-/// Outcome of running an escrow contract to completion.
-#[derive(Debug)]
-pub struct RunOutcome {
-    /// The value returned by the exported entry point (`finish`): `> 0` means
-    /// allow the escrow to finish.
-    pub result: i32,
-    /// Fuel (gas) consumed by the whole invocation — guest instructions plus
-    /// the per-call host charges.
-    pub fuel_used: u64,
-}
-
-/// Why a run produced no result. Each variant is one outcome for the caller to
-/// map to a TER.
-#[derive(Debug)]
-pub enum RunError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// A type, import or export section, or an import or export name, is past its
-    /// cap. Refused before compiling, and apart from [`RunError::Compile`] because
-    /// no contract reaches a cap by accident.
-    Limit(String),
-    /// The module compiled but the engine would not accept it: an import the
-    /// linker does not define, or an initial memory past the page cap. Not guest
-    /// code failing — a start section that traps is [`RunError::Trap`].
-    Instantiate(String),
-    /// No export named `function_name` with signature `() -> i32`: absent, not a
-    /// function, or a function of another type — which the detail tells apart.
-    EntryPoint(String),
-    /// Gas exhausted — by the guest's own instructions or by a host call's
-    /// charge. [`RunFailure::fuel_used`] is the whole limit.
-    OutOfGas,
-    /// The host could not serve a call.
-    Internal,
-    /// A host call had no linear memory to work in: the module exports none, or
-    /// the call came from a start section, which runs before there is an instance
-    /// to resolve the memory from.
-    NoMemory,
-    /// The guest trapped: `unreachable`, division by zero, an out-of-bounds
-    /// access, or `memory.grow` past the page cap. Wherever the guest was
-    /// executing, including a start section during instantiation.
-    Trap(String),
-}
-
-impl fmt::Display for RunError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            RunError::Compile(detail) => write!(f, "compile: {detail}"),
-            RunError::Limit(detail) => write!(f, "limit: {detail}"),
-            RunError::Instantiate(detail) => write!(f, "instantiate: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            RunError::EntryPoint(detail) => write!(f, "{detail}"),
-            RunError::OutOfGas => write!(f, "out of gas"),
-            RunError::Internal => write!(f, "internal error"),
-            RunError::NoMemory => write!(f, "no exported memory"),
-            RunError::Trap(detail) => write!(f, "trap: {detail}"),
-        }
-    }
-}
-
-/// A failed run, with the gas it still owes: a contract that traps or exhausts
-/// its gas is charged for what it burned.
-#[derive(Debug)]
-pub struct RunFailure {
-    pub error: RunError,
-    /// Fuel consumed before the failure. The whole limit when gas ran out; `0`
-    /// when the module never ran.
-    pub fuel_used: u64,
-}
-
-impl fmt::Display for RunFailure {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{} (fuel used: {})", self.error, self.fuel_used)
-    }
-}
-
-impl RunFailure {
-    /// A failure with no fuel accounted: it stopped the run at or before the guest's
-    /// first instruction, or under a store with no meter to read.
-    fn owing_nothing(error: RunError) -> RunFailure {
-        RunFailure {
-            error,
-            fuel_used: 0,
-        }
-    }
-}
-
-/// Fuel spent out of `gas`: the one place a run's cost is measured, so success,
-/// trap and refusal all report it the same way.
-///
-/// `Store::get_fuel` fails only on a store without fuel metering, which
-/// [`wasm_engine`] rules out and `run`'s `set_fuel` would already have
-/// caught — so a failure here is a defect in this crate. It must not become a
-/// number: `0` forgives a run its whole cost, `gas` charges an untouched one for
-/// everything. [`RunError::Internal`] instead.
-fn fuel_used(store: &Store<VmState<'_>>, gas: u64) -> Result<u64, RunError> {
-    store
-        .get_fuel()
-        .map(|remaining| gas.saturating_sub(remaining))
-        .map_err(|_| RunError::Internal)
-}
-
-/// Report `error` with the run's cost attached. A cost that cannot be read replaces
-/// the outcome rather than being invented — see [`fuel_used`].
-fn failed(store: &Store<VmState<'_>>, gas: u64, error: RunError) -> RunFailure {
-    match fuel_used(store, gas) {
-        Ok(fuel_used) => RunFailure { error, fuel_used },
-        Err(unmetered) => RunFailure::owing_nothing(unmetered),
-    }
-}
-
-/// The outcome a `wasmi::Error` names for itself, if any, rather than leaving it to
-/// the stage that raised it.
-///
-/// Two ways a run halts mid-flight: a host call that could not be served, which
-/// carries a [`FatalHostError`] saying which condition it was, and the guest's own
-/// instructions exhausting the meter, which wasmi raises as `OutOfFuel`.
-///
-/// Both can happen anywhere the guest executes — including a start section, which
-/// is guest code running during instantiation — so every stage from there on asks
-/// this before naming a failure after itself.
-fn guest_halted(error: &wasmi::Error) -> Option<RunError> {
-    if let Some(fatal) = error.downcast_ref::<FatalHostError>() {
-        return Some(fatal.0.into());
-    }
-    (error.as_trap_code() == Some(TrapCode::OutOfFuel)).then_some(RunError::OutOfGas)
-}
-
-/// Why instantiation failed, once [`guest_halted`] has ruled out the two conditions
-/// that can arise anywhere.
-///
-/// A start section is guest code, so it can trap on its own — `unreachable`, a
-/// division by zero, an out-of-bounds access — and a trap is the guest's fault
-/// wherever it happens. Naming that after the *stage* would file it beside the
-/// module faults a caller treats as its own defect, and charge nothing for
-/// instructions the contract burned. What is left for [`RunError::Instantiate`] is a
-/// module the linker or the store would not accept at all.
-fn instantiation_failure(error: &wasmi::Error) -> RunError {
-    match error.as_trap_code() {
-        Some(_) => RunError::Trap(error.to_string()),
-        None => RunError::Instantiate(error.to_string()),
-    }
-}
-
-/// The outcome a [`Fault`] is: the one place a stopped call becomes a stopped run.
-///
-/// Total and one arm each, because a `Fault` is only ever a condition that stops the
-/// run — the guest-visible codes cannot reach here, which is what
-/// [`crate::abi::CallError`] buys. A fault added later has no arm and does not
-/// compile.
-impl From<Fault> for RunError {
-    fn from(fault: Fault) -> RunError {
-        match fault {
-            Fault::OutOfGas => RunError::OutOfGas,
-            Fault::Internal => RunError::Internal,
-            Fault::NoMemory => RunError::NoMemory,
-        }
-    }
-}
-
-/// A fresh wasmi engine for one caller's use: deterministic, minimal features,
-/// fuel metering on.
-///
-/// The configuration is consensus-fixed and identical for every invocation, so any
-/// two engines from here accept exactly the same modules. Each is nonetheless a
-/// distinct engine with its own compiled-code and type registries, and wasmi ties a
-/// [`Module`] to the engine that compiled it — a module cannot be instantiated in a
-/// [`Store`] built on another. A caller that compiles and runs must therefore hold
-/// one engine across both steps, which is why [`compile`] takes the engine rather
-/// than reaching for its own.
-pub(crate) fn wasm_engine() -> Engine {
-    let mut config = Config::default();
-    config.consume_fuel(true);
-    config.ignore_custom_sections(true);
-    config.wasm_mutable_global(false);
-    config.wasm_multi_value(false);
-    config.wasm_sign_extension(false);
-    config.wasm_saturating_float_to_int(false);
-    config.wasm_bulk_memory(false);
-    config.wasm_reference_types(false);
-    config.wasm_tail_call(false);
-    config.wasm_extended_const(false);
-    config.floats(false);
-    config.wasm_multi_memory(false);
-    config.wasm_custom_page_sizes(false);
-    // Disabled through the crate feature flag.
-    // config.wasm_memory64(false);
-    config.wasm_wide_arithmetic(false);
-    config.allow_start_fn(false);
-    config.enforced_limits(EnforcedLimits::strict());
-
-    let fuel_costs = CustomFuelCosts {
-        bytes_copied_per_fuel: 64,
-        fuel_per_bytes_translated: 7,
-        fuel_per_bytes_validated: 2,
-    };
-    config.fuel_cost(fuel_costs);
-    // config.operator_costs is already guarded by the probe_fuel test under budgets.rs
-    // in that a change to operator costs in a future version will be a loud failure.
-
-    config.compilation_mode(CompilationMode::LazyTranslation);
-    Engine::new(&config)
-}
-
-/// Every resource ceiling a run is given, in one place.
-///
-/// The two *size* caps are what a contract can reach today. The three *count* caps
-/// are set to 1 although [`wasm_engine`] already forces each: turning
-/// `wasm_reference_types` on would let a module declare up to
-/// `wasmparser::MAX_WASM_TABLES` tables, `wasm_multi_memory` likewise for memories,
-/// and both size caps are **per table and per memory, not aggregate** — so a feature
-/// flag flipped in isolation would multiply the ceiling by a hundred rather than
-/// leave it be. The counts are what keeps those two decisions independent.
-///
-/// wasmi enforces the counts by asking the limiter before it allocates
-/// (`can_create_more_instances`/`_memories`/`_tables`); they default to 10000, so
-/// leaving them unset is not the same as their being unreachable.
-fn store_limits() -> StoreLimits {
-    StoreLimitsBuilder::new()
-        .memory_size(MAX_MEMORY_BYTES)
-        .table_elements(MAX_TABLE_ELEMENTS)
-        .instances(1)
-        .tables(1)
-        .memories(1)
-        .trap_on_grow_failure(true)
-        .build()
-}
-
-/// Compile `wasm` for `engine`.
-///
-/// The one path to a [`Module`]: the configuration is what decides whether a
-/// contract is valid at all, so [`run`] and [`crate::check`] must not be able to
-/// compile against different ones. The engine is the caller's because the module it
-/// returns may only be instantiated in a [`Store`] built on that same engine.
-pub(crate) fn compile(engine: &Engine, wasm: &[u8]) -> Result<Module, CompileError> {
-    check_section_counts(wasm).map_err(CompileError::Limit)?;
-    Module::new(engine, wasm).map_err(|e| CompileError::Invalid(e.to_string()))
-}
-
-/// Why [`compile`] produced no module.
-///
-/// Two variants rather than one string because a caller counts them apart: a module
-/// the engine rejects is usually a toolchain mistake, while one past a section cap
-/// was almost certainly built to be — no contract comes near the caps by accident.
-#[derive(Debug)]
-pub(crate) enum CompileError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Invalid(String),
-    /// A section or a name is past its cap — see [`check_section_counts`].
-    Limit(String),
-}
-
-/// Refuse a module whose type, import or export section, or any import or export
-/// name, is past its cap — before [`Module::new`] reads a single entry.
-///
-/// Ahead of compiling because compiling is where the cost is: `Module::new`
-/// validates and stores every entry, and no store exists yet to charge it to. Left
-/// to wasmi, the ceilings are wasmparser's — a million entries per section and
-/// 100 000 bytes per name — and [`EnforcedLimits`] has no knob for any of them.
-///
-/// A section's count is in its header, so the counts cost nothing to read; names
-/// are read only once the count is known to be under its cap. Every section
-/// checked here precedes the code section, so the scan stops there.
-///
-/// Anything that does not parse is passed through rather than refused, so a
-/// malformed module is described by `Module::new` and not by a second parser.
-fn check_section_counts(wasm: &[u8]) -> Result<(), String> {
-    use wasmparser::{Parser, Payload};
-
-    for payload in Parser::new(0).parse_all(wasm) {
-        let Ok(payload) = payload else { break };
-        match payload {
-            Payload::TypeSection(section) => {
-                check_count("type", section.count(), MAX_TYPES)?;
-            }
-            Payload::ImportSection(section) => {
-                check_count("import", section.count(), MAX_IMPORTS)?;
-                for import in section.into_iter().map_while(Result::ok) {
-                    check_name("import module", import.module)?;
-                    check_name("import", import.name)?;
-                }
-            }
-            Payload::ExportSection(section) => {
-                check_count("export", section.count(), MAX_EXPORTS)?;
-                for export in section.into_iter().map_while(Result::ok) {
-                    check_name("export", export.name)?;
-                }
-            }
-            Payload::CodeSectionStart { .. } => break,
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
-fn check_count(section: &str, count: u32, cap: u32) -> Result<(), String> {
-    if count > cap {
-        return Err(format!(
-            "{count} {section} entries is past the {cap}-entry cap"
-        ));
-    }
-    Ok(())
-}
-
-fn check_name(kind: &str, name: &str) -> Result<(), String> {
-    if name.len() > MAX_NAME_BYTES {
-        return Err(format!(
-            "{kind} name of {} bytes is past the {MAX_NAME_BYTES}-byte cap",
-            name.len()
-        ));
-    }
-    Ok(())
-}
-
-/// Run a contract: compile `wasm`, give it `gas` fuel, service its host
-/// calls through `host`, and call the exported `function_name`.
-pub fn run<'h>(
-    wasm: &[u8],
-    gas: u64,
-    host: &'h dyn HostFunctions,
-    function_name: &str,
-) -> Result<RunOutcome, RunFailure> {
-    let engine = wasm_engine();
-    let module = compile(&engine, wasm).map_err(|e| {
-        RunFailure::owing_nothing(match e {
-            CompileError::Invalid(detail) => RunError::Compile(detail),
-            CompileError::Limit(detail) => RunError::Limit(detail),
-        })
-    })?;
-
-    let mut store = Store::new(
-        &engine,
-        VmState {
-            host,
-            mem_limits: store_limits(),
-            transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        },
-    );
-
-    store
-        .set_fuel(gas)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-    store.limiter(|state| &mut state.mem_limits);
-
-    let mut linker = Linker::<VmState<'h>>::new(&engine);
-    register_host_functions::<Bodies>(&mut linker)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-
-    let instance = match linker.instantiate_and_start(&mut store, &module) {
-        Ok(instance) => instance,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| instantiation_failure(&e));
-            return Err(failed(&store, gas, error));
-        }
-    };
-    store.data_mut().memory = instance.exports(&store).find_map(Export::into_memory);
-
-    let function = match instance.get_typed_func::<(), i32>(&store, function_name) {
-        Ok(function) => function,
-        Err(e) => {
-            let found = instance
-                .get_export(&store, function_name)
-                .map(|export| export.ty(&store));
-            let error =
-                RunError::EntryPoint(format!("{}: {e}", entry_point_fault(found, function_name)));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let result = match function.call(&mut store, ()) {
-        Ok(result) => result,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| RunError::Trap(e.to_string()));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let fuel_used = fuel_used(&store, gas).map_err(RunFailure::owing_nothing)?;
-    Ok(RunOutcome { result, fuel_used })
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// Each call is its own engine, which is what makes the engine a caller's to
-    /// hold: a module compiled through one may not be instantiated in a store built
-    /// on another, so `run` must pass the engine it made to [`compile`] rather than
-    /// let it call here a second time.
-    #[test]
-    fn each_call_is_a_new_engine() {
-        assert!(!Engine::same(&wasm_engine(), &wasm_engine()));
-    }
-
-    /// One instance, one table, one memory — asserted here rather than through a
-    /// module, because no module can reach these. `wasm_reference_types(false)` and
-    /// `wasm_multi_memory(false)` make a module declaring a second table or memory
-    /// fail *validation*, so a run never gets far enough to consult the limiter.
-    /// That is exactly why the counts are worth pinning: they are the ceiling that
-    /// survives one of those flags being turned on, and nothing else would fail if
-    /// they were silently dropped.
-    #[test]
-    fn the_store_grants_one_of_each_thing_a_module_can_own() {
-        use wasmi::ResourceLimiter;
-
-        let limits = store_limits();
-        assert_eq!(limits.instances(), 1);
-        assert_eq!(limits.tables(), 1);
-        assert_eq!(limits.memories(), 1);
-    }
-
-    /// The three size-proportional fuel rates, read back off the engine. wasmi
-    /// takes its own defaults for these unless told otherwise, so an upgrade that
-    /// changed one would retune our gas silently. `Config` keeps them
-    /// `pub(crate)` and exposes them only through `Debug`.
-    #[test]
-    fn the_dynamic_fuel_costs_are_pinned() {
-        let config = format!("{:?}", wasm_engine().config());
-        for rate in [
-            "bytes_copied_per_fuel: 64",
-            "fuel_per_bytes_translated: 7",
-            "fuel_per_bytes_validated: 2",
-        ] {
-            assert!(config.contains(rate), "expected `{rate}` in {config}");
-        }
-    }
-
-    /// [`EnforcedLimits::strict`] is the one line in [`wasm_engine`] that takes a
-    /// value rather than stating one — the fields are `pub(crate)`, so the preset is
-    /// the only way to set them.
-    #[test]
-    fn the_enforced_limits_are_pinned() {
-        const EXPECTED: &str = concat!(
-            "EnforcedLimits { ",
-            "max_globals: Some(1000), ",
-            "max_functions: Some(10000), ",
-            "max_tables: Some(100), ",
-            "max_element_segments: Some(1000), ",
-            "max_memories: Some(1), ",
-            "max_data_segments: Some(1000), ",
-            "max_params: Some(32), ",
-            "max_results: Some(32), ",
-            "min_avg_bytes_per_function: Some(AvgBytesPerFunctionLimit { ",
-            "req_funcs_bytes: 1000, min_avg_bytes_per_function: 40 }) }",
-        );
-
-        let config = format!("{:?}", wasm_engine().config());
-        assert!(
-            config.contains(EXPECTED),
-            "expected `{EXPECTED}` in {config}"
-        );
-    }
-
-    /// The only place these numbers appear as literals; every other test derives
-    /// them from the constants.
-    #[test]
-    fn the_limits_are_the_protocol_limits() {
-        assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
-        assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
-        assert_eq!(MAX_TABLE_ELEMENTS, 1024, "table-element cap");
-        assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
-        assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
-    }
-}
@@ -1,709 +0,0 @@
-//! The bounds, field-cap and buffer-fit rules `abi.rs` enforces on every region
-//! crossing the boundary. This is the policy the guest observes, so each rule is
-//! pinned to the code it answers with.
-
-mod support;
-
-use support::{
-    Answer, COMPLETED, EMPTY_REGION, FakeHost, ONE_PAGE, code, failure, import, module, status,
-    traced,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError};
-
-/// One page, so anything at or past 65536 is out of bounds.
-const PAGE: i64 = 64 * 1024;
-
-/// The per-field size cap, as a wasm operand.
-const CAP: i64 = MAX_FIELD_BYTES as i64;
-/// One byte over the cap: the smallest value the engine must refuse.
-const OVER_CAP: i64 = CAP + 1;
-
-// ---------------------------------------------------------------------------
-// Output regions (`write_into`)
-// ---------------------------------------------------------------------------
-
-/// The whole output region must be in bounds, not merely its start — the engine
-/// checks `[dst, dst + cap)` before the host is allowed to write.
-#[test]
-fn an_output_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(PAGE, 4), (PAGE - 3, 4), (PAGE + 1024, 4), (0, PAGE + 1)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// A region ending exactly at the last byte of memory is in bounds.
-#[test]
-fn an_output_region_ending_at_the_last_byte_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const {}) (i32.const 4))", PAGE - 4),
-    );
-    assert_eq!(status(&wat, &host), 4);
-}
-
-/// The wire carries `i32`, so a guest can present a negative pointer or length.
-#[test]
-fn a_negative_output_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(-1, 4), (0, -1), (-1, -1), (i32::MIN, 4)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// The host reports a value's true length whether or not it fitted; a value that
-/// did not fit is the guest's error, not the host's.
-#[test]
-fn a_value_larger_than_the_buffer_is_refused() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(64));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 64, "exactly enough room is enough");
-}
-
-/// A zero-length output region is in bounds and simply cannot hold anything.
-#[test]
-fn a_zero_length_output_region_is_in_bounds_but_too_small() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 0))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-}
-
-/// A host that reports more than the per-field cap is refused even when the
-/// guest offered room for it: the cap is the engine's rule, not the buffer's.
-#[test]
-fn a_value_past_the_field_cap_is_refused() {
-    let host = FakeHost::new()
-        .answering_field(1, Answer::claiming(OVER_CAP as usize))
-        .answering_field(2, Answer::claiming(MAX_FIELD_BYTES));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 2) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), CAP as i32, "the cap itself is allowed");
-}
-
-/// A refused over-cap value leaves nothing behind. `write_into` hands the host at
-/// most [`MAX_FIELD_BYTES`] of the guest's buffer however much room the guest
-/// declared, so a value past the cap does not fit the region it is offered and no
-/// prefix of it can reach guest memory either.
-///
-/// The host answers with a real over-cap value: [`Answer::claiming`] writes
-/// nothing whatever the engine does, so it could not tell the two apart. The
-/// second module folds the *whole* declared buffer rather than one byte, so the
-/// claim is about the region and not about its first byte.
-#[test]
-fn an_over_cap_value_is_refused_without_reaching_guest_memory() {
-    /// The buffer the guest declares: well over the cap, so the clamp bites.
-    const BUFFER: usize = 4096;
-
-    let over_cap = vec![0xff; MAX_FIELD_BYTES + 1];
-    let host = FakeHost::new().answering_field(1, Answer::bytes(over_cap));
-    let call = format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {BUFFER}))");
-
-    // The status the guest sees, from a module that returns it directly.
-    let refusing = module(&[import::HOME_LE_FIELD, ONE_PAGE], &call);
-    assert_eq!(
-        status(&refusing, &host),
-        code(HostError::DataFieldTooLarge),
-        "the value is refused"
-    );
-
-    // Every byte of the buffer, or-ed together: guest memory starts zero-filled,
-    // so any byte the host wrote shows up here.
-    let reading = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $seen i32)
-             (drop {call})
-             (loop $l
-               (local.set $seen (i32.or (local.get $seen) (i32.load8_u (local.get $i))))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
-             (local.get $seen)"
-        ),
-    );
-    assert_eq!(
-        status(&reading, &host),
-        0,
-        "and not one of its bytes is in the guest's buffer"
-    );
-}
-
-/// The field cap is checked before the buffer-fit rule, so a value that breaks both
-/// is reported as over-cap. The guest branches on the code, and the two rules
-/// answer different questions, so the order is worth pinning.
-#[test]
-fn the_field_cap_precedes_the_buffer_fit_check() {
-    let host = FakeHost::new().answering_field(1, Answer::claiming(MAX_FIELD_BYTES + 1));
-
-    // A 63-byte buffer: the value is both over the cap and far too big to fit.
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-}
-
-// ---------------------------------------------------------------------------
-// Input regions (`Region::read`, via `sha512_half`)
-//
-// `sha512_half`'s first pair is an input region like any other, and it is the
-// input the guest gets a status back from: `trace`, the other reader, answers
-// nothing at all. So the codes are pinned here and the silence below.
-// ---------------------------------------------------------------------------
-
-/// An input region is bounds-checked the same way an output region is. Every case
-/// here stays within the field cap, which on an input is checked first.
-#[test]
-fn an_input_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(PAGE, 1), (PAGE - 3, 4), (PAGE - 1, CAP)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "ptr {ptr} len {len}"
-        );
-        assert!(host.digested.borrow().is_empty(), "the host is not called");
-    }
-}
-
-#[test]
-fn a_negative_input_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(-1, 1), (0, -1), (i32::MIN, 1)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "ptr {ptr} len {len}"
-        );
-    }
-}
-
-/// The field cap bounds what the guest may hand *in*, too.
-#[test]
-fn an_input_past_the_field_cap_is_refused() {
-    let host = FakeHost::new();
-    let digest = |len: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const 0) (i32.const {len})
-                                    (i32.const 2048) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    assert_eq!(
-        status(&digest(OVER_CAP), &host),
-        code(HostError::DataFieldTooLarge)
-    );
-    assert!(host.digested.borrow().is_empty());
-
-    assert_eq!(
-        status(&digest(CAP), &host),
-        HASH_LEN as i32,
-        "the cap itself is allowed"
-    );
-}
-
-/// The two directions check in opposite orders: an input's length is known before
-/// the read, so the cap comes first, while an output's region has to be resolved
-/// before the host can produce a value, so bounds come first there.
-#[test]
-fn the_field_cap_precedes_the_bounds_check_on_an_input() {
-    let host = FakeHost::new();
-
-    let reading = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {})
-                                (i32.const 0) (i32.const {HASH_LEN}))",
-            PAGE + 1
-        ),
-    );
-    assert_eq!(status(&reading, &host), code(HostError::DataFieldTooLarge));
-
-    let writing = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const 0) (i32.const {}))", PAGE + 1),
-    );
-    assert_eq!(status(&writing, &host), code(HostError::PointerOutOfBounds));
-}
-
-// ---------------------------------------------------------------------------
-// The reader with no result (`read_borrowed`, via `trace`)
-// ---------------------------------------------------------------------------
-
-/// `trace` reads two regions and either one being bad refuses the call. The same
-/// rule as above, and the guest is told nothing: the refusal is the host not being
-/// called, and the run carries on to the constant that follows.
-#[test]
-fn both_of_traces_regions_are_checked_silently() {
-    let host = FakeHost::new();
-    let regions = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-            EMPTY_REGION.to_owned(),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const 0) (i32.const {OVER_CAP})"),
-        ),
-        (
-            "(i32.const -1) (i32.const 1)".to_owned(),
-            EMPTY_REGION.to_owned(),
-        ),
-    ];
-
-    for (msg, data) in regions {
-        let wat = module(
-            &[import::TRACE, ONE_PAGE],
-            &traced(TraceDataType::AsHex, &msg, &data),
-        );
-        assert_eq!(status(&wat, &host), COMPLETED, "msg {msg} data {data}");
-        assert!(
-            host.traces().is_empty(),
-            "msg {msg} data {data}: the host must not be called"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Both at once (`write_buffered`, via `sha512_half`)
-// ---------------------------------------------------------------------------
-
-/// A call with an input and an output region decides everything about the input
-/// before anything about the output, so a bad input is reported however the output
-/// region is wrong — out of bounds, or a pointer that is not one at all.
-///
-/// The whole output region, params included, is judged after the host has answered.
-/// Hoisting any part of that above the call would put the output's verdict first for
-/// these cases, and there is no half of it that can be hoisted on a principle the
-/// other half shares.
-#[test]
-fn a_read_write_checks_its_input_before_its_output() {
-    let host = FakeHost::new();
-    let digest = |src: i64, src_len: i64, dst: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {src}) (i32.const {src_len})
-                                    (i32.const {dst}) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    let over_cap = digest(0, OVER_CAP, 0);
-    assert_eq!(status(&over_cap, &host), code(HostError::DataFieldTooLarge));
-
-    let out_of_bounds = digest(PAGE, 4, 0);
-    assert_eq!(
-        status(&out_of_bounds, &host),
-        code(HostError::PointerOutOfBounds)
-    );
-
-    // A bad input against each way the output can be wrong: the input's verdict is
-    // the one reported, and the host is never asked for a value nobody can take.
-    for dst in [PAGE, -1] {
-        let both_bad = digest(0, OVER_CAP, dst);
-        assert_eq!(
-            status(&both_bad, &host),
-            code(HostError::DataFieldTooLarge),
-            "dst {dst}"
-        );
-    }
-    assert!(host.digested.borrow().is_empty(), "the host is not reached");
-}
-
-/// The output half of a read-write call obeys the same rules as a plain write.
-#[test]
-fn a_read_write_output_obeys_the_write_rules() {
-    let host = FakeHost::new().answering_digest(Answer::filler(32));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 31))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const {PAGE}) (i32.const 32))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// A refused value reaches guest memory in no part, however much of it the host
-/// wrote. The host answers with 32 bytes it did write and a length it did not, so
-/// the refusal happens with the value sitting in the run's output buffer — and the
-/// guest's buffer has to come back untouched.
-///
-/// Stronger than the contract asks for: a guest must not read its buffer on a
-/// negative status. It holds because the buffer is copied to the guest only after
-/// the length, the bounds, the fit and the budget have all passed, so there is no
-/// window in which a refused value is in guest memory.
-#[test]
-fn a_refused_value_leaves_nothing_in_guest_memory() {
-    const MARKER: u8 = 77;
-
-    // The two refusals a value can meet after the host has produced it: longer
-    // than the field cap, and longer than the buffer the guest offered.
-    let refusals = [
-        (MAX_FIELD_BYTES + 1, HASH_LEN, HostError::DataFieldTooLarge),
-        (HASH_LEN, HASH_LEN - 1, HostError::BufferTooSmall),
-    ];
-
-    for (claimed, cap, expected) in refusals {
-        let host =
-            FakeHost::new().answering_digest(Answer::writing_but_claiming([MARKER; 32], claimed));
-        let call = format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 64) (i32.const {cap}))"
-        );
-
-        let refused = module(&[import::SHA512_HALF, ONE_PAGE], &call);
-        assert_eq!(
-            status(&refused, &host),
-            code(expected),
-            "claiming {claimed}"
-        );
-
-        // The same call, reporting what is at the output region afterwards.
-        let inspect = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!("(drop {call}) (i32.load8_u (i32.const 64))"),
-        );
-        assert_eq!(
-            status(&inspect, &host),
-            0,
-            "claiming {claimed}: the refused value must not have been written"
-        );
-    }
-}
-
-/// An input region may overlap the output region: the host is served the input as
-/// it stands and its answer lands afterwards, so the two cannot interfere. The
-/// marker is any byte distinct from the input's first (`a`), so `finish` returning
-/// it proves the write landed.
-#[test]
-fn an_input_may_overlap_the_output() {
-    const MARKER: u8 = 99;
-
-    let host = FakeHost::new().answering_digest(Answer::bytes([MARKER; HASH_LEN]));
-
-    let wat = module(
-        &[
-            import::SHA512_HALF,
-            ONE_PAGE,
-            r#"(data (i32.const 0) "abcd")"#,
-        ],
-        &format!(
-            "(drop (call $sha512_half (i32.const 0) (i32.const 4)
-                                      (i32.const 0) (i32.const {HASH_LEN})))
-             (i32.load8_u (i32.const 0))"
-        ),
-    );
-    assert_eq!(
-        status(&wat, &host),
-        i32::from(MARKER),
-        "the output overwrote the input"
-    );
-    assert_eq!(
-        *host.digested.borrow(),
-        vec![b"abcd".to_vec()],
-        "the host saw the input as it was"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The memory export itself
-// ---------------------------------------------------------------------------
-
-/// A host call with no memory to work in ends the run instead of answering the
-/// guest: there is no buffer for a status to describe, and nothing the guest could
-/// do about the answer — which is what puts this beside out-of-gas on the fatal
-/// channel. What the guest burned getting there is still charged.
-fn assert_no_memory(wat: &str, host: &FakeHost) {
-    let failure = failure(wat, host);
-    assert!(
-        matches!(failure.error, RunError::NoMemory),
-        "expected the run to end for want of a memory export, got: {failure}"
-    );
-    assert!(failure.fuel_used > 0, "{failure}");
-}
-
-/// Every region is relative to the guest's exported memory, so a module without
-/// one cannot make a host call at all.
-#[test]
-fn a_module_that_exports_no_memory_cannot_call_the_host() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, "(memory 1)"],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// Having no memory is answered before anything about a call's arguments, so a
-/// module without one ends the run even when its arguments would have earned a
-/// guest-visible code of their own (here an input over the field cap).
-///
-/// The order is deliberate: no memory is a fact about the instance, not about this
-/// call, and a region cannot be validated against a memory that is not there. It
-/// costs the guest nothing — every call such a module makes ends the run anyway.
-#[test]
-fn no_memory_is_answered_before_a_calls_arguments_are() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::SHA512_HALF, "(memory 1)"],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {OVER_CAP})
-                                (i32.const 0) (i32.const {HASH_LEN}))"
-        ),
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// The memory's export *name* is not part of the contract: the engine takes the
-/// module's memory whatever it is called. Nothing in the wasm spec attaches meaning
-/// to `"memory"` — it is a toolchain convention, so the kind decides.
-#[test]
-fn a_memory_exported_under_any_name_is_the_guests_memory() {
-    let host = FakeHost::new();
-
-    for name in ["mem", "linear", "the memory"] {
-        let wat = module(
-            &[
-                import::LDGR_INDEX,
-                &format!(r#"(memory (export "{name}") 1)"#),
-            ],
-            "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-             (i32.load (i32.const 64))",
-        );
-        assert_eq!(
-            status(&wat, &host),
-            7,
-            "the host wrote into the memory exported as '{name}'"
-        );
-    }
-}
-
-/// One memory exported under several names is one memory. The engine resolves the
-/// first export of kind memory, and with at most one memory per module every such
-/// export is that memory, so the order the exports are walked in cannot change the
-/// answer.
-#[test]
-fn one_memory_exported_under_several_names_is_still_that_memory() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "memory") (export "mem") (export "linear") 1)"#,
-        ],
-        "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-         (i32.load (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 7);
-}
-
-/// The export has to *be* a memory: a global named `memory` is not one, and it
-/// neither serves as the guest's memory nor hides the memory the module really
-/// exports. The kind decides, so the conventional name carries no weight on
-/// either side.
-#[test]
-fn an_export_named_memory_that_is_not_a_memory_is_not_the_guests_memory() {
-    let host = FakeHost::new();
-
-    let call = "(call $ldgr_index (i32.const 0) (i32.const 4))";
-
-    let wrong_kind = module(
-        &[
-            import::LDGR_INDEX,
-            "(memory 1)",
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_no_memory(&wrong_kind, &host);
-
-    let shadowed = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "mem") 1)"#,
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_eq!(
-        status(&shadowed, &host),
-        4,
-        "the real memory is found past the global that took its name"
-    );
-}
-
-/// Bounds follow the memory the module actually declared, not a fixed page.
-#[test]
-fn bounds_follow_the_declared_memory_size() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, r#"(memory (export "memory") 2)"#],
-        &format!("(call $ldgr_index (i32.const {PAGE}) (i32.const 4))"),
-    );
-    assert_eq!(status(&wat, &host), 4, "the second page is in bounds");
-}
-
-// ---------------------------------------------------------------------------
-// Two output regions (`write_mant_exp`)
-// ---------------------------------------------------------------------------
-
-/// `float_to_mant_exp` is the only call with two output regions, so none of the
-/// single-output rules above reach it.
-#[test]
-fn either_output_region_out_of_bounds_is_refused() {
-    let host =
-        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    // Mantissa, then exponent, each as a `(ptr, len)` pair.
-    let cases = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 8)"),
-            "(i32.const 80) (i32.const 4)".to_owned(),
-            HostError::PointerOutOfBounds,
-        ),
-        (
-            "(i32.const 64) (i32.const 8)".to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 4)"),
-            HostError::PointerOutOfBounds,
-        ),
-        (
-            "(i32.const -1) (i32.const 8)".to_owned(),
-            "(i32.const 80) (i32.const 4)".to_owned(),
-            HostError::InvalidParams,
-        ),
-        (
-            "(i32.const 64) (i32.const 8)".to_owned(),
-            "(i32.const -1) (i32.const 4)".to_owned(),
-            HostError::InvalidParams,
-        ),
-        (
-            "(i32.const 64) (i32.const 8)".to_owned(),
-            "(i32.const 0) (i32.const -1)".to_owned(),
-            HostError::InvalidParams,
-        ),
-    ];
-
-    for (mantissa, exponent, expected) in cases {
-        let wat = module(
-            &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-            &format!("(call $float_to_mant_exp (i32.const 0) (i32.const 8) {mantissa} {exponent})"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(expected),
-            "mantissa {mantissa} exponent {exponent}"
-        );
-    }
-}
-
-/// The mantissa's region is judged first, so a call with both wrong reports its verdict.
-#[test]
-fn the_mantissa_region_is_judged_before_the_exponents() {
-    let host =
-        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    // The mantissa is unreachable and the exponent is not a pointer at all; the two
-    // answer differently, which is what makes the order observable here.
-    let wat = module(
-        &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-        &format!(
-            "(call $float_to_mant_exp (i32.const 0) (i32.const 8) \
-             (i32.const {PAGE}) (i32.const 8) (i32.const -1) (i32.const 4))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// The two regions are one answer, so a call that cannot place all of it places none.
-#[test]
-fn an_unreachable_exponent_region_leaves_the_mantissa_unwritten() {
-    let host =
-        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    let call = format!(
-        "(call $float_to_mant_exp (i32.const 0) (i32.const 8) \
-         (i32.const 64) (i32.const 8) (i32.const {PAGE}) (i32.const 4))"
-    );
-    let wat = module(
-        &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-        &format!("(drop {call})\n    (i32.load8_u (i32.const 64))"),
-    );
-    assert_eq!(status(&wat, &host), 0, "the mantissa region must be clean");
-}
@@ -1,931 +0,0 @@
-//! What screening refuses, and that it refuses nothing a run would have served.
-//!
-//! `check` reaches its verdict from the compiled module alone, so these tests take
-//! no host — except the ones that put the same module through `run` to compare the
-//! two.
-//!
-//! These screen with `check`, which reports the earliest refusal; the last section
-//! is what `check_all` adds.
-
-mod support;
-
-use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-use xrpl_wasm_vm::{
-    CheckError, MAX_EXPORTS, MAX_IMPORTS, MAX_MEMORY_PAGES, MAX_NAME_BYTES, MAX_TABLE_ELEMENTS,
-    MAX_TYPES, RunError,
-};
-
-/// Assert which stage screening refused a module at, because the caller maps the
-/// stages separately. The error comes back out for the tests that also read its
-/// message.
-macro_rules! assert_stage {
-    ($refusal:expr, $stage:pat) => {{
-        let refusal = $refusal;
-        assert!(
-            matches!(refusal, $stage),
-            concat!("expected a ", stringify!($stage), " refusal, got: {}"),
-            refusal
-        );
-        refusal
-    }};
-}
-
-/// Screens `wat`, which must assemble.
-fn check(wat: &str) -> Result<(), CheckError> {
-    xrpl_wasm_vm::check(&assemble(wat), ENTRY)
-}
-
-fn refusal(wat: &str) -> CheckError {
-    check(wat).expect_err(&format!("expected this module to be refused:\n{wat}"))
-}
-
-fn passes(wat: &str) {
-    if let Err(refusal) = check(wat) {
-        panic!("expected this module to pass, but: {refusal}\n{wat}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Compiling
-// ---------------------------------------------------------------------------
-
-/// A contract that imports a host function, exports its memory and exports the
-/// entry point is what screening is looking for.
-#[test]
-fn a_runnable_contract_passes() {
-    passes(&module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    ));
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_pass() {
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let refusal = xrpl_wasm_vm::check(bytes, ENTRY).expect_err("garbage must not pass");
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// Screening takes wasm binaries, and text is not one — the same rule the VM
-/// applies, from the same `wasmi` built without its `wat` feature. Turning that
-/// feature on would make this transaction blob valid at both ends.
-#[test]
-fn a_text_format_module_does_not_pass() {
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let refusal =
-        xrpl_wasm_vm::check(text.as_bytes(), ENTRY).expect_err("text must not pass as a module");
-    assert_stage!(refusal, CheckError::Compile(_));
-
-    // The same module, assembled first, passes: the text is sound and only the
-    // format was refused.
-    passes(&text);
-}
-
-/// A feature the engine disables is refused here too, because both stages compile
-/// against engines built from the same configuration. `vm_limits.rs` walks every
-/// disabled feature; this pins that screening sees that configuration.
-#[test]
-fn a_disabled_feature_does_not_pass() {
-    let refusal = refusal(&module(
-        &[ONE_PAGE],
-        "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-}
-
-// ---------------------------------------------------------------------------
-// Section counts and names
-// ---------------------------------------------------------------------------
-
-/// `n` copies of `part`, each given its index through `{i}`.
-fn repeated(part: &str, n: usize) -> String {
-    (0..n)
-        .map(|i| part.replace("{i}", &i.to_string()))
-        .collect::<Vec<_>>()
-        .join("\n  ")
-}
-
-/// A count at its cap passes and one past it is refused as a limit, not as a module
-/// that fails to compile — and by a run too, since both go through the same scan
-/// ahead of `Module::new`.
-fn assert_capped(at_cap: &str, past_cap: &str, needle: &str) {
-    passes(at_cap);
-
-    let refusal = assert_stage!(refusal(past_cap), CheckError::Limit(_)).to_string();
-    assert!(refusal.starts_with("limit: "), "{refusal}");
-    assert!(refusal.contains(needle), "{refusal}");
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(past_cap), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a module past a section cap must not run");
-    assert!(matches!(failure.error, RunError::Limit(_)), "{failure}");
-    assert_eq!(failure.fuel_used, 0, "{failure}");
-}
-
-#[test]
-fn the_type_section_is_capped() {
-    let types = |n| module(&[&repeated("(type (func))", n), ONE_PAGE], "(i32.const 0)");
-    // The entry point's own `() -> i32` is one more type.
-    let cap = MAX_TYPES as usize - 1;
-    assert_capped(&types(cap), &types(cap + 1), "type entries");
-}
-
-/// Importing one host function under many ids is legal wasm, so the count is
-/// reachable without the ABI having that many functions.
-#[test]
-fn the_import_section_is_capped() {
-    let imports = |n| {
-        let import =
-            r#"(import "host_lib" "ldgr_index" (func $f{i} (param i32 i32) (result i32)))"#;
-        module(&[&repeated(import, n), ONE_PAGE], "(i32.const 0)")
-    };
-    let cap = MAX_IMPORTS as usize;
-    assert_capped(&imports(cap), &imports(cap + 1), "import entries");
-}
-
-#[test]
-fn the_export_section_is_capped() {
-    let exports = |n| {
-        module(
-            &[
-                &repeated(r#"(global (export "g{i}") i32 (i32.const 0))"#, n),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        )
-    };
-    // The entry point and the memory are two more exports.
-    let cap = MAX_EXPORTS as usize - 2;
-    assert_capped(&exports(cap), &exports(cap + 1), "export entries");
-}
-
-#[test]
-fn an_export_name_is_capped() {
-    let named = |len| {
-        let name = "e".repeat(len);
-        module(
-            &[
-                &format!(r#"(global (export "{name}") i32 (i32.const 0))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        )
-    };
-    assert_capped(
-        &named(MAX_NAME_BYTES),
-        &named(MAX_NAME_BYTES + 1),
-        "export name",
-    );
-}
-
-/// Both halves of an import's name are capped. Past the cap is refused as a limit,
-/// ahead of the import rules that would otherwise refuse the unknown name.
-#[test]
-fn an_import_name_is_capped() {
-    let long = "i".repeat(MAX_NAME_BYTES + 1);
-    for (wat, needle) in [
-        (
-            module(
-                &[
-                    &format!(r#"(import "{long}" "ldgr_index" (func))"#),
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-            "import module name",
-        ),
-        (
-            module(
-                &[&format!(r#"(import "host_lib" "{long}" (func))"#), ONE_PAGE],
-                "(i32.const 0)",
-            ),
-            "import name",
-        ),
-    ] {
-        let refusal = assert_stage!(refusal(&wat), CheckError::Limit(_)).to_string();
-        assert!(refusal.contains(needle), "{refusal}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// Every host function the ABI declares, spelled as a guest imports it, full
-/// signatures and hand-written. The count is asserted against the ABI so a
-/// function added to it cannot be left out here.
-///
-/// Hand-written is the point: these are a statement of the wire the ABI's derived
-/// table did not produce, so putting them through `check` compares the two rather
-/// than comparing the table with itself.
-const ALL_IMPORTS: [&str; 63] = [
-    import::LDGR_INDEX,
-    import::PARENT_LDGR_TIME,
-    import::PARENT_LDGR_HASH,
-    import::BASE_FEE,
-    import::AMENDMENT_ENABLED,
-    import::CACHE_LE,
-    import::TX_FIELD,
-    import::HOME_LE_FIELD,
-    import::LE_FIELD,
-    import::TX_INNER,
-    import::HOME_LE_INNER,
-    import::LE_INNER,
-    import::TX_ARR_LEN,
-    import::HOME_LE_ARR_LEN,
-    import::LE_ARR_LEN,
-    import::TX_INNER_ARR_LEN,
-    import::HOME_LE_INNER_ARR_LEN,
-    import::LE_INNER_ARR_LEN,
-    import::CHECK_SIG,
-    import::ACCOUNTROOT_ID,
-    import::AMM_ID,
-    import::CHECK_ID,
-    import::CREDENTIAL_ID,
-    import::DELEGATE_ID,
-    import::DEPOSIT_PREAUTH_ID,
-    import::DID_ID,
-    import::ESCROW_ID,
-    import::TRUSTLINE_ID,
-    import::MPT_ISSUANCE_ID,
-    import::MPTOKEN_ID,
-    import::NFT_OFFER_ID,
-    import::OFFER_ID,
-    import::ORACLE_ID,
-    import::PAYCHAN_ID,
-    import::PERMISSIONED_DOMAIN_ID,
-    import::SIGNERS_ID,
-    import::TICKET_ID,
-    import::VAULT_ID,
-    import::SPONSORSHIP_ID,
-    import::LOAN_BROKER_ID,
-    import::LOAN_ID,
-    import::SHA512_HALF,
-    import::TRACE,
-    import::SET_DATA,
-    import::NFT_URI,
-    import::NFT_ISSUER,
-    import::NFT_TAXON,
-    import::NFT_FLAGS,
-    import::NFT_XFER_FEE,
-    import::NFT_SERIAL,
-    import::FLOAT_FROM_INT,
-    import::FLOAT_FROM_UINT,
-    import::FLOAT_FROM_STAMOUNT,
-    import::FLOAT_FROM_STNUMBER,
-    import::FLOAT_TO_INT,
-    import::FLOAT_TO_MANT_EXP,
-    import::FLOAT_FROM_MANT_EXP,
-    import::FLOAT_CMP,
-    import::FLOAT_ADD,
-    import::FLOAT_SUB,
-    import::FLOAT_MULT,
-    import::FLOAT_DIV,
-    import::FLOAT_POW,
-];
-
-#[test]
-fn every_declared_host_function_may_be_imported() {
-    assert_eq!(
-        ALL_IMPORTS.len(),
-        HostFunctionSpec::ALL.len(),
-        "the ABI gained a host function with no import declaration in this test"
-    );
-
-    let mut parts = ALL_IMPORTS.to_vec();
-    parts.push(ONE_PAGE);
-    passes(&module(&parts, "(i32.const 0)"));
-}
-
-/// A module may import fewer host functions than are registered, but not more.
-#[test]
-fn an_unknown_host_function_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("no host function 'no_such_function'"),
-        "{refusal}"
-    );
-}
-
-/// Host functions live under one module name — `host_lib` — and an import naming
-/// another is refused even when the function name is real. `env` is in the list
-/// because that is what plain clang emits.
-#[test]
-fn an_import_from_another_module_does_not_pass() {
-    for module_name in ["host", "env", ""] {
-        let refusal = refusal(&module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        ));
-        let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-    }
-}
-
-/// A host function's name imported as something other than a function. The engine
-/// defines it as a function and nothing else, so this does not link either.
-#[test]
-fn a_host_function_imported_as_a_global_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (global $g i32))"#,
-            ONE_PAGE,
-        ],
-        "(global.get $g)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("'host_lib::ldgr_index' is not a function"),
-        "{refusal}"
-    );
-}
-
-/// A module faulty at two stages is refused by the earlier one — it imports what no
-/// engine serves *and* exports no entry point. The imports are what the rest of the
-/// module depends on, so that is the message worth having.
-#[test]
-fn the_earlier_stage_is_the_one_reported() {
-    let refusal = refusal(
-        r#"(module
-             (import "host_lib" "no_such_function" (func $f (result i32)))
-             (memory (export "memory") 1)
-             (func (export "not_the_entry_point") (result i32) (call $f)))"#,
-    );
-
-    assert_stage!(refusal, CheckError::Import(_));
-}
-
-/// An import naming a real host function with the wrong type is refused, at a
-/// stage of its own since the ABI does have the function the guest asked for.
-///
-/// The run half is what the refusal is worth: without it this module reaches the
-/// engine and parts from the linker at instantiation, which is a fault a node
-/// discovers rather than one a transaction is turned away for.
-#[test]
-fn an_import_with_the_wrong_signature_does_not_pass() {
-    let wat = module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(i32.const 0)",
-    );
-
-    let refusal = assert_stage!(refusal(&wat), CheckError::Signature(_)).to_string();
-    assert_eq!(
-        refusal,
-        "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-    );
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a mistyped import must not link");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1)
-                              (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "no entry point 'finish'");
-}
-
-/// The entry point is looked up by the name the caller asks for, as a run looks it
-/// up: screening a contract for one entry point says nothing about another.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let wasm = assemble(
-        r#"(module (memory (export "memory") 1)
-             (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-
-    assert!(xrpl_wasm_vm::check(&wasm, "other").is_ok());
-    assert!(xrpl_wasm_vm::check(&wasm, ENTRY).is_err());
-}
-
-/// Both halves of the entry point's type are screened: a module returning the
-/// wrong thing, or taking anything at all, would fail the run's typed lookup.
-#[test]
-fn an_entry_point_of_the_wrong_type_does_not_pass() {
-    for (signature, body) in [
-        ("(result i64)", "(i64.const 0)"),
-        ("(param i32) (result i32)", "(i32.const 0)"),
-        ("", "(nop)"),
-    ] {
-        let refusal = refusal(&format!(
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") {signature} {body}))"#
-        ));
-        let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-        assert_eq!(
-            refusal, "entry point 'finish' has the wrong signature, expected '() -> i32'",
-            "{signature}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "export 'finish' is not a function");
-}
-
-// ---------------------------------------------------------------------------
-// Agreement with a run
-// ---------------------------------------------------------------------------
-
-/// A module with no linear memory to export passes. A contract that makes no host
-/// call needs none, and one that does is refused at the call and charged — a
-/// runtime fault, not a malformed module.
-#[test]
-fn a_module_exporting_no_memory_passes() {
-    let wat = r#"(module (func (export "finish") (result i32) (i32.const 0)))"#;
-    passes(wat);
-
-    let host = FakeHost::new();
-    assert_eq!(
-        xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY)
-            .expect("a module that calls no host function needs no memory")
-            .result,
-        0
-    );
-}
-
-/// Modules spanning what screening decides, each also put through a run.
-fn modules() -> Vec<(&'static str, String)> {
-    vec![
-        (
-            "a runnable contract",
-            module(&[import::LDGR_INDEX, ONE_PAGE], "(i32.const 0)"),
-        ),
-        (
-            "a contract that traps",
-            module(&[ONE_PAGE], "(unreachable)"),
-        ),
-        (
-            "a disabled feature",
-            module(&[ONE_PAGE], "(i32.extend8_s (i32.const 1))"),
-        ),
-        (
-            "an unknown host function",
-            module(
-                &[
-                    r#"(import "host_lib" "nope" (func $f (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(call $f)",
-            ),
-        ),
-        (
-            "an import from another module",
-            module(
-                &[
-                    r#"(import "env" "ldgr_index" (func $f (param i32 i32) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "a host function imported as a global",
-            module(
-                &[r#"(import "host_lib" "trace" (global $g i32))"#, ONE_PAGE],
-                "(global.get $g)",
-            ),
-        ),
-        (
-            "an import with the wrong signature",
-            module(
-                &[
-                    r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "no entry point",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "other") (result i32) (i32.const 0)))"#
-                .to_string(),
-        ),
-        (
-            "an entry point of the wrong type",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") (result i64) (i64.const 0)))"#
-                .to_string(),
-        ),
-    ]
-}
-
-/// Screening refuses a module exactly when a run would refuse it at one of the
-/// stages screening covers — nothing it rejects would have run, and nothing
-/// it passes stops before the entry point is called. The exceptions are the ones
-/// [`what_static_screening_cannot_see`] lists.
-#[test]
-fn screening_and_a_run_agree() {
-    let host = FakeHost::new();
-
-    for (label, wat) in modules() {
-        let wasm = assemble(&wat);
-        let refused_early = match xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => matches!(
-                failure.error,
-                RunError::Compile(_)
-                    | RunError::Limit(_)
-                    | RunError::Instantiate(_)
-                    | RunError::EntryPoint(_)
-            ),
-            Ok(_) => false,
-        };
-
-        assert_eq!(
-            xrpl_wasm_vm::check(&wasm, ENTRY).is_err(),
-            refused_early,
-            "{label}"
-        );
-    }
-}
-
-/// The signatures screening derives are the ones the linker registers: a module
-/// importing all 60 host functions at the type `HostFunctionSpec` derives must
-/// instantiate.
-///
-/// Unlike [`ALL_IMPORTS`], the other side of this is live code — the registration
-/// as it is rather than a description of it — so it is what a changed engine has to
-/// answer to. **What it cannot see is the table and the linker being wrong the same
-/// way**, the closures being generated from this very table; that is what
-/// [`ALL_IMPORTS`] and `generated_abi.rs`'s 60 literals are for.
-#[test]
-fn the_derived_signatures_are_what_the_linker_registers() {
-    let declarations: Vec<String> = HostFunctionSpec::ALL
-        .iter()
-        .copied()
-        .map(derived_import)
-        .collect();
-    let mut parts: Vec<&str> = declarations.iter().map(String::as_str).collect();
-    parts.push(ONE_PAGE);
-
-    let host = FakeHost::new();
-    let wasm = assemble(&module(&parts, "(i32.const 0)"));
-    let outcome = xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY)
-        .expect("every import built from the ABI's table must link");
-
-    assert_eq!(outcome.result, 0);
-}
-
-/// One `(import …)` declaration, spelled out of the ABI's derived signature rather
-/// than by hand — the opposite of [`ALL_IMPORTS`].
-fn derived_import(function: HostFunctionSpec) -> String {
-    let types: Vec<&str> = function
-        .wasm_params()
-        .iter()
-        .copied()
-        .map(spelled)
-        .collect();
-    let params = match types.as_slice() {
-        [] => String::new(),
-        types => format!(" (param {})", types.join(" ")),
-    };
-    let result = match function.wasm_result() {
-        Some(result) => format!(" (result {})", spelled(result)),
-        None => String::new(),
-    };
-
-    format!(
-        r#"(import "host_lib" "{}" (func{params}{result}))"#,
-        function.wasm_name()
-    )
-}
-
-fn spelled(declared: WasmValType) -> &'static str {
-    match declared {
-        WasmValType::I32 => "i32",
-        WasmValType::I64 => "i64",
-    }
-}
-
-/// A module asking for more memory than the engine grants is refused, so the
-/// contract that could never run does not reach the ledger. The cap itself passes.
-#[test]
-fn an_exported_memory_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Memory(_)).to_string();
-    assert!(refusal.contains("past the 128-page cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    ));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, so screening
-/// must not turn it away: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(memory (export "memory") 1 {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// A module asking for more table than the engine grants is refused for the same
-/// reason a memory is. The cap itself passes.
-#[test]
-fn an_exported_table_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(table (export "t") {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Table(_)).to_string();
-    assert!(refusal.contains("past the 1024-element cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") {MAX_TABLE_ELEMENTS} funcref)"#
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// Both caps are applied in one pass over the exports, so neither may end the walk
-/// early: a passing memory must not hide a failing table declared after it, and a
-/// passing table must not hide a failing memory.
-#[test]
-fn one_pass_screens_both_resources() {
-    let after_a_passing_memory = refusal(&module(
-        &[
-            ONE_PAGE,
-            &format!(r#"(table (export "t") {} funcref)"#, MAX_TABLE_ELEMENTS + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_memory, CheckError::Table(_));
-
-    let after_a_passing_table = refusal(&module(
-        &[
-            r#"(table (export "t") 1 funcref)"#,
-            &format!(r#"(memory (export "memory") {})"#, MAX_MEMORY_PAGES + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_table, CheckError::Memory(_));
-}
-
-/// As with memory, a declared *maximum* past the cap is unreachable rather than
-/// wrong: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_table_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") 1 {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// The gap, listed rather than described. A memory or a table a module keeps to
-/// itself is not in its exports, so these are the modules that pass screening and
-/// then fail to *instantiate* — which is why a run's refusal at that stage cannot be
-/// read as the node's fault.
-///
-/// The two entries are not equally remote. A contract needs an exported memory to
-/// make any host call, so the memory row can do nothing but compute and the SDK does
-/// not produce one. A table, though, is *normally* unexported — Rust exports
-/// `__indirect_function_table` only under `--export-table` — so the table row is the
-/// shape a hostile module actually takes, and the store's limiter is the only thing
-/// standing in front of it.
-#[test]
-fn what_static_screening_cannot_see() {
-    let host = FakeHost::new();
-
-    for (label, declaration) in [
-        ("memory", format!("(memory {})", MAX_MEMORY_PAGES + 1)),
-        (
-            "table",
-            format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1),
-        ),
-    ] {
-        let wat = format!(
-            r#"(module {declaration}
-                 (func (export "finish") (result i32) (i32.const 0)))"#
-        );
-
-        passes(&wat);
-
-        let failure = match xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => failure,
-            Ok(outcome) => panic!(
-                "the store's limiter must refuse the {label}, but the module returned {}",
-                outcome.result
-            ),
-        };
-        assert!(
-            matches!(failure.error, RunError::Instantiate(_)),
-            "{label}: {failure}"
-        );
-    }
-}
-
-/// A start section runs guest code at instantiation, before the entry point. The
-/// engine disallows it, so screening refuses the module outright rather than letting
-/// any code run ahead of the entry point.
-#[test]
-fn a_start_section_is_refused_by_screening() {
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    let refusal = assert_stage!(refusal(&wat), CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("start"), "{refusal}");
-}
-
-#[test]
-fn a_memory64_memory_is_refused_by_screening() {
-    let wat = r#"(module
-        (memory i64 1)
-        (func (export "finish") (result i32) (i32.const 0)))"#;
-
-    let refusal = assert_stage!(refusal(wat), CheckError::Compile(_)).to_string();
-    assert!(
-        refusal.contains("memory64") || refusal.contains("i64"),
-        "{refusal}"
-    );
-}
-
-/// The corruption fixtures below are written as hex strings, which is how the old Beast suite
-/// carried them — the bytes are deliberately malformed, so there is nothing to assemble them
-/// from.
-fn hex(s: &str) -> Vec<u8> {
-    (0..s.len())
-        .step_by(2)
-        .map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap())
-        .collect()
-}
-
-/// Malformed modules crafted to abuse the parser rather than merely be invalid — a vector
-/// length that lies about its size, a section that overruns its payload, a locals-count bomb,
-/// and a non-terminating LEB128 — are refused before they reach the ledger. These guard
-/// the parser against resource-exhaustion shapes (ported from the old Beast section-corruption
-/// fixtures); the plainer "bad magic / wrong version" shapes are covered by `garbage_does_not_pass`.
-///
-/// The lying vector length is a type section claiming `u32::MAX` entries, which the
-/// section-count scan reads from the header before anything notices the entries are not
-/// there — so it is refused as a limit, the deliberate shape it is. The rest fail to parse
-/// at all, and are refused at compile like any other garbage.
-#[test]
-fn parser_abuse_shapes_are_refused() {
-    let lying_length = xrpl_wasm_vm::check(&hex("0061736d010000000105ffffffff0f"), ENTRY)
-        .expect_err("vector length lies");
-    assert_stage!(lying_length, CheckError::Limit(_));
-
-    let cases = [
-        ("section overruns its payload", "0061736d01000000010a0160"),
-        (
-            "locals-count bomb",
-            "0061736d01000000010401600000030201000a0f010d01ffffffff0f7f0b",
-        ),
-        (
-            "non-terminating LEB128",
-            "0061736d0100000001058080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080",
-        ),
-    ];
-    for (label, h) in cases {
-        let refusal = xrpl_wasm_vm::check(&hex(h), ENTRY).expect_err(label);
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// The plain structurally-malformed modules from the old section-corruption fixtures — a
-/// corrupt magic, a wrong version, a lying section length, sections out of order, junk after
-/// the last section, an unknown section id — are all refused at compile. Belt-and-suspenders
-/// alongside `garbage_does_not_pass`: guards against a wasmi upgrade loosening the validator.
-#[test]
-fn structurally_malformed_modules_are_refused() {
-    let cases = [
-        ("corrupt magic number", "0161736d01000000"),
-        ("wrong version", "0061736d02000000"),
-        ("lying section length", "0061736d01000000018080808008"),
-        ("sections out of order", "0061736d010000000a02000b03020000"),
-        (
-            "junk after last section",
-            "0061736d01000000010a01600000000000000000",
-        ),
-        ("unknown section id", "0061736d01000000ff0100"),
-    ];
-    for (label, h) in cases {
-        let refusal = xrpl_wasm_vm::check(&hex(h), ENTRY).expect_err(label);
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Reporting every refusal
-// ---------------------------------------------------------------------------
-
-/// A module that breaks every rule past compiling, once each.
-fn a_module_faulting_at_every_stage() -> String {
-    format!(
-        r#"(module
-             (import "host_lib" "no_such_function" (func (param i32) (result i32)))
-             (import "host_lib" "ldgr_index" (func (param i64 i64) (result i32)))
-             (memory (export "memory") {pages})
-             (table (export "t") {elements} funcref)
-             (func (export "{ENTRY}") (result i64) (i64.const 0)))"#,
-        pages = MAX_MEMORY_PAGES + 1,
-        elements = MAX_TABLE_ELEMENTS + 1,
-    )
-}
-
-#[test]
-fn check_all_reports_a_refusal_from_every_stage() {
-    let refusals = xrpl_wasm_vm::check_all(&assemble(&a_module_faulting_at_every_stage()), ENTRY)
-        .expect_err("this module breaks every rule past compiling");
-
-    assert!(
-        matches!(
-            refusals.as_slice(),
-            [
-                CheckError::Import(_),
-                CheckError::Signature(_),
-                CheckError::EntryPoint(_),
-                CheckError::Memory(_),
-                CheckError::Table(_),
-            ]
-        ),
-        "{refusals:?}"
-    );
-}
-
-/// What lets the consensus path keep fail-fast without a second implementation of
-/// the stage order to drift from.
-#[test]
-fn check_reports_what_check_all_reports_first() {
-    let wasm = assemble(&a_module_faulting_at_every_stage());
-
-    let first = xrpl_wasm_vm::check(&wasm, ENTRY).expect_err("five faults");
-    let all = xrpl_wasm_vm::check_all(&wasm, ENTRY).expect_err("five faults");
-
-    assert_eq!(first.to_string(), all[0].to_string());
-}
-
-/// Nothing to report is `Ok`, never an empty `Vec`.
-#[test]
-fn check_all_passes_a_runnable_contract() {
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-
-    if let Err(refusals) = xrpl_wasm_vm::check_all(&assemble(&wat), ENTRY) {
-        panic!("expected this module to pass, but: {refusals:?}\n{wat}");
-    }
-}
@@ -1,737 +0,0 @@
-//! What the engine refuses outright: modules it will not compile, will not
-//! instantiate, or cannot find an entry point in — plus the memory and table caps.
-//!
-//! These are the sandbox's outer wall. Everything here fails the run rather than
-//! returning a code to the guest, so each test reads the failure's message.
-
-mod support;
-
-use support::{
-    FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
-};
-use xrpl_wasm_vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
-
-/// Assert which stage a run failed at, because the caller maps the stages to
-/// different outcomes. A stage is one `RunError` variant, so the expectation is a
-/// pattern; the failure comes back out for the tests that also read its message.
-macro_rules! assert_stage {
-    ($failure:expr, $stage:pat) => {{
-        let failure = $failure;
-        assert!(
-            matches!(failure.error, $stage),
-            concat!("expected a ", stringify!($stage), " failure, got: {}"),
-            failure
-        );
-        failure
-    }};
-}
-
-// ---------------------------------------------------------------------------
-// Linear memory
-// ---------------------------------------------------------------------------
-
-/// A module declaring more than the cap fails to instantiate — the limit applies
-/// to the initial memory, not only to growth.
-#[test]
-fn an_initial_memory_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_memory_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// Growth up to the cap succeeds; growth past it traps rather than answering -1 as
-/// `memory.grow` otherwise would, because the engine's limiter sets
-/// `trap_on_grow_failure(true)`.
-#[test]
-fn growth_stops_at_the_cap() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {}))", MAX_MEMORY_PAGES - 1),
-    );
-    assert_eq!(
-        run(&wat, &host).expect("should run").result,
-        1,
-        "growing to exactly the cap answers the previous size"
-    );
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// A module may declare a maximum above the cap: the cap is enforced on the initial
-/// memory and on growth, not on the memory type's declared bound.
-#[test]
-fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-    let memory = format!(r#"(memory (export "memory") 1 {})"#, MAX_MEMORY_PAGES + 1);
-
-    let wat = module(&[&memory], "(i32.const 0)");
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    let wat = module(
-        &[&memory],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-// ---------------------------------------------------------------------------
-// Tables
-// ---------------------------------------------------------------------------
-
-/// A table's whole cost is paid at instantiation: wasmi writes all 8 bytes of every
-/// element before the guest's first instruction, so a module declaring more than the
-/// cap must be refused there rather than charged for it.
-#[test]
-fn an_initial_table_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_table_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {MAX_TABLE_ELEMENTS} funcref)")],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// The cap binds a table the module keeps to itself, which is the case that matters:
-/// a contract has no reason to export its table, so screening never sees the one a
-/// hostile module declares.
-#[test]
-fn the_table_cap_binds_an_unexported_table() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", u32::from(u16::MAX) * 100)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, mirroring what
-/// linear memory allows. Nothing can reach it: `table.grow` is a reference-types
-/// instruction and the engine turns that feature off, so a table's declared minimum
-/// is also its final size.
-#[test]
-fn a_declared_table_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            "(table 1 {} funcref)",
-            u64::try_from(MAX_TABLE_ELEMENTS).expect("fits") + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Engine configuration
-// ---------------------------------------------------------------------------
-
-/// One row per feature `wasm_engine` turns off: the smallest module that uses
-/// it, and the fragment of wasmi's refusal that names the feature. A row declaring
-/// its own memory omits [`ONE_PAGE`], or it is refused for having two memories
-/// instead — except `wasm_multi_memory`, where two memories are the point and one
-/// of them has to be imported to reach the feature check at all.
-fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'static str)> {
-    vec![
-        (
-            "wasm_multi_value",
-            vec![
-                ONE_PAGE,
-                "(func $two (result i32 i32) (i32.const 1) (i32.const 2))",
-            ],
-            "(call $two) (drop) (drop) (i32.const 0)",
-            "multi-value",
-        ),
-        (
-            "wasm_sign_extension",
-            vec![ONE_PAGE],
-            "(i32.extend8_s (i32.const 1))",
-            "sign extension",
-        ),
-        (
-            "wasm_bulk_memory",
-            vec![ONE_PAGE],
-            "(memory.fill (i32.const 0) (i32.const 0) (i32.const 1)) (i32.const 0)",
-            "bulk memory",
-        ),
-        (
-            "wasm_reference_types",
-            vec![ONE_PAGE, "(table 1 externref)"],
-            "(i32.const 0)",
-            "reference types",
-        ),
-        // The proposal covers mutable globals crossing the module boundary; an
-        // internal one is core wasm and stays allowed — see the test below.
-        (
-            "wasm_mutable_global",
-            vec![ONE_PAGE, r#"(global (export "g") (mut i32) (i32.const 0))"#],
-            "(i32.const 0)",
-            "mutable global",
-        ),
-        (
-            "wasm_tail_call",
-            vec![ONE_PAGE, "(func $f (result i32) (i32.const 0))"],
-            "(return_call $f)",
-            "tail call",
-        ),
-        // Arithmetic in a constant initialiser. wasmi names the operator rather
-        // than the proposal here.
-        (
-            "wasm_extended_const",
-            vec![
-                ONE_PAGE,
-                "(global $g i32 (i32.add (i32.const 1) (i32.const 2)))",
-            ],
-            "(global.get $g)",
-            "non-constant operator",
-        ),
-        // One memory imported, one defined. `EnforcedLimits::strict()` caps memories
-        // at one and checks the memory *section* before the validator sees it
-        // (`module/parser/mod.rs`, `process_memories`), so two *defined* memories are
-        // refused for exceeding the cap and never reach the feature check. An import
-        // is not in that section, so this is the shape that names the proposal.
-        (
-            "wasm_multi_memory",
-            vec![r#"(import "host_lib" "mem" (memory 1))"#, ONE_PAGE],
-            "(i32.const 0)",
-            "multiple memories",
-        ),
-        (
-            "wasm_memory64",
-            vec![r#"(memory (export "memory") i64 1)"#],
-            "(i32.const 0)",
-            "memory64",
-        ),
-        (
-            "wasm_custom_page_sizes",
-            vec![r#"(memory (export "memory") 1 (pagesize 1))"#],
-            "(i32.const 0)",
-            "custom page sizes",
-        ),
-        (
-            "wasm_wide_arithmetic",
-            vec![ONE_PAGE],
-            "(drop (i64.add128 (i64.const 1) (i64.const 2) (i64.const 3) (i64.const 4)))
-             (i32.const 0)",
-            "wide arithmetic",
-        ),
-        // Determinism across nodes is the reason floats are off.
-        (
-            "floats",
-            vec![ONE_PAGE],
-            "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-            "floating-point",
-        ),
-    ]
-}
-
-/// Every feature the engine disables is refused, and refused for that reason.
-///
-/// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
-/// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
-/// default rather than against this engine's own config.
-#[test]
-fn every_disabled_feature_is_refused_by_name() {
-    let host = FakeHost::new();
-
-    for (knob, parts, body, expected) in disabled_features() {
-        let wat = module(&parts, body);
-        let failure = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-
-        assert!(
-            failure.contains(expected),
-            "{knob}: expected a refusal mentioning {expected:?}, got: {failure}"
-        );
-    }
-}
-
-/// The knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
-/// configuration is the same for every engine `wasm_engine` builds, so a test
-/// observes the one `wasm_engine` makes: a knob masked by another, or with no
-/// caller-visible effect, has no distinguishing module.
-#[test]
-fn the_knobs_without_a_module_of_their_own() {
-    let host = FakeHost::new();
-
-    // `wasm_saturating_float_to_int(false)`: every saturating conversion takes a
-    // float operand, so `floats(false)` refuses it first, as the message shows.
-    let wat = module(&[ONE_PAGE], "(i32.trunc_sat_f32_s (f32.const 1))");
-    let refusal = failure(&wat, &host).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-    assert!(!refusal.contains("saturating"), "{refusal}");
-
-    // `EnforcedLimits::strict()`'s `max_memories: Some(1)`, which masks
-    // `wasm_multi_memory(false)` for every module that defines its two memories
-    // rather than importing one — the case a real contract would hit. The feature
-    // flag itself is covered by name in [`disabled_features`].
-    let wat = module(&[ONE_PAGE, "(memory 1)"], "(i32.const 0)");
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(refusal.contains("limit of 1 memories"), "{refusal}");
-
-    // `ignore_custom_sections(true)`: governs whether wasmi retains custom
-    // sections, not accept/reject, so this pins only that one is harmless.
-    let wat = module(
-        &[ONE_PAGE, r#"(@custom "note" "ignored")"#],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    // `consume_fuel(true)`: with it off, `Store::set_fuel` fails and `run` returns
-    // before instantiating, so every test in the suite fails.
-    let wat = module(&[ONE_PAGE], "(i32.const 0)");
-    assert!(run(&wat, &host).expect("should run").fuel_used > 0);
-}
-
-/// A mutable global the module keeps to itself is core wasm, so the disabled
-/// proposal does not reach it: a guest can still have mutable state.
-#[test]
-fn an_internal_mutable_global_is_still_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE, "(global $g (mut i32) (i32.const 0))"],
-        "(global.set $g (i32.const 7)) (global.get $g)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 7);
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_compile() {
-    let host = FakeHost::new();
-
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let failure = xrpl_wasm_vm::run(bytes, PLENTY_OF_GAS, &host, support::ENTRY)
-            .expect_err("garbage must not compile");
-        assert_stage!(failure, RunError::Compile(_));
-    }
-}
-
-/// The VM takes wasm binaries, and text is not one. wasmi's `wat` feature is on by
-/// default and would have `Module::new` assemble text too, so the crate builds
-/// wasmi without it; turning it back on would make this transaction blob valid.
-#[test]
-fn the_vm_refuses_a_text_format_module() {
-    let host = FakeHost::new();
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let failure = xrpl_wasm_vm::run(text.as_bytes(), PLENTY_OF_GAS, &host, support::ENTRY)
-        .expect_err("text must not compile as a module");
-    assert_stage!(failure, RunError::Compile(_));
-
-    // The same module, assembled first, runs: the text is sound and only the
-    // format was refused.
-    assert_eq!(run(&text, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// A module may import fewer host functions than are registered, but not more:
-/// an import the linker does not define fails instantiation.
-#[test]
-fn an_unknown_import_fails_instantiation() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// Host functions are registered under one module name — `host_lib`, the name the
-/// guest SDK and this repo's fixtures import from — and a guest naming a different
-/// one does not link. `env` is in the list because that is what plain clang emits.
-#[test]
-fn the_import_module_name_must_match() {
-    let host = FakeHost::new();
-
-    for module_name in ["host", "env", ""] {
-        let wat = module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// An import spelled with the wrong signature does not link even under the right
-/// name, which is what makes the registered signatures load-bearing.
-#[test]
-fn an_import_with_the_wrong_signature_fails_instantiation() {
-    let host = FakeHost::new();
-
-    for signature in [
-        "(param i32) (result i32)",         // too few parameters
-        "(param i32 i32 i32) (result i32)", // too many
-        "(param i64 i64) (result i32)",     // wrong parameter types
-        "(param i32 i32) (result i64)",     // wrong result type
-        "(param i32 i32)",                  // no result
-    ] {
-        let wat = module(
-            &[
-                &format!(r#"(import "host_lib" "ldgr_index" (func $f {signature}))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// A module that imports a host function it never calls still has to link.
-#[test]
-fn an_unused_import_is_still_linked() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, import::TRACE, ONE_PAGE],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// The start section
-// ---------------------------------------------------------------------------
-
-/// The engine disallows start sections, so a module carrying one is rejected at
-/// compile and never runs. No guest code executes ahead of the entry point, whatever
-/// that code would have done — trap, loop, or call the host — so nothing is metered
-/// and no fuel is burned. Screening catches the same module up front
-/// (`preflight::a_start_section_is_refused_by_screening`); this pins that `run`
-/// refuses it the same way rather than instantiating it.
-#[test]
-fn a_start_section_module_is_rejected_at_compile() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module with a start section must not run"),
-        RunError::Compile(_)
-    );
-    assert_eq!(
-        failure.fuel_used, 0,
-        "no guest code runs, so nothing is charged: {failure}"
-    );
-}
-
-/// What `RunError::Instantiate` is left to mean: a module the linker or the store
-/// would not accept, rather than one whose guest code failed. Its two shapes, so the
-/// variant is not left standing for nothing.
-#[test]
-fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
-    let host = FakeHost::new();
-
-    // The linker defines no such import.
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-
-    // The store's limiter will not grant the memory, and does not trap to say so.
-    let wat = module(
-        &[&format!("(memory {})", MAX_MEMORY_PAGES + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_fails() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module without the entry point must not run"),
-        RunError::EntryPoint(_)
-    );
-    assert!(
-        failure.to_string().contains("no entry point 'finish'"),
-        "{failure}"
-    );
-}
-
-/// The entry point is looked up by the name the caller asks for.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 9)))"#;
-    let outcome = run_entry(wat, &host, "other").expect("should run");
-    assert_eq!(outcome.result, 9);
-}
-
-/// The entry point must take nothing and return an `i32`. A module that exports the
-/// name with another signature is told so, rather than being told the export is
-/// missing: wasmi answers both cases with one error, and "no entry point" would send
-/// a contract author looking for a function they already have.
-#[test]
-fn an_entry_point_of_the_wrong_type_fails() {
-    let host = FakeHost::new();
-
-    for signature in ["(result i64)", "(param i32) (result i32)", ""] {
-        let body = if signature.contains("result i64") {
-            "(i64.const 0)"
-        } else if signature.is_empty() {
-            "(nop)"
-        } else {
-            "(i32.const 0)"
-        };
-        let wat = format!(
-            r#"(module (memory (export "memory") 1) (func (export "finish") {signature} {body}))"#
-        );
-        let failure = assert_stage!(
-            run_with_gas(&wat, PLENTY_OF_GAS, &host)
-                .expect_err("a wrongly-typed entry point must not run"),
-            RunError::EntryPoint(_)
-        )
-        .to_string();
-        assert!(
-            failure.contains("entry point 'finish' has the wrong signature"),
-            "{signature}: {failure}"
-        );
-        assert!(
-            !failure.contains("no entry point"),
-            "a present export must not be reported as absent — {signature}: {failure}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_fails() {
-    let host = FakeHost::new();
-
-    let wat =
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host).expect_err("a non-function export must not run"),
-        RunError::EntryPoint(_)
-    )
-    .to_string();
-    assert!(
-        failure.contains("export 'finish' is not a function"),
-        "{failure}"
-    );
-}
-
-/// A guest that traps fails the run rather than returning a value.
-#[test]
-fn a_trapping_guest_fails_the_run() {
-    let host = FakeHost::new();
-
-    let wat = module(&[ONE_PAGE], "(unreachable)");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-
-    // An out-of-bounds guest access is a trap too, caught by the engine rather
-    // than anything the host is asked about.
-    let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn a_memory64_module_is_rejected_at_compile() {
-    let host = FakeHost::new();
-    let wat = r#"(module
-        (memory i64 1)
-        (func (export "finish") (result i32) (i32.const 0)))"#;
-
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module using 64-bit memory must not run"),
-        RunError::Compile(_)
-    );
-    assert_eq!(
-        failure.fuel_used, 0,
-        "rejected before instantiation, so nothing is charged: {failure}"
-    );
-}
-
-/// A function declaring more parameters than wasm allows (1000) is refused at compile, so a
-/// contract cannot smuggle an unbounded signature past screening.
-#[test]
-fn a_function_with_too_many_params_is_refused() {
-    let host = FakeHost::new();
-    let params = " i32".repeat(1001);
-    let wat = format!(
-        "(module {ONE_PAGE} (func (param{params}) (result i32) (i32.const 0)) \
-         (func (export \"finish\") (result i32) (i32.const 0)))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Compile(_));
-}
-
-/// A function declaring more locals than wasm allows (50 000) is refused at compile.
-#[test]
-fn a_function_with_too_many_locals_is_refused() {
-    let host = FakeHost::new();
-    let locals = format!("(local{})", " i32".repeat(50_001));
-    let wat = module(&[ONE_PAGE], &format!("{locals} (i32.const 0)"));
-    assert_stage!(failure(&wat, &host), RunError::Compile(_));
-}
-
-/// Below the compile cap but past the engine's register frame, a locals-heavy function is
-/// refused when the frame is built rather than at compile — still refused, just later.
-#[test]
-fn a_function_past_the_register_frame_is_refused() {
-    let host = FakeHost::new();
-    let locals = format!("(local{})", " i32".repeat(40_000));
-    let wat = module(&[ONE_PAGE], &format!("{locals} (i32.const 0)"));
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// Unbounded recursion is stopped by the engine's call-stack limit — it traps rather than
-/// running the host's native stack off the end (the portable dispatcher makes loops safe;
-/// this pins that guest *calls* are bounded too).
-#[test]
-fn unbounded_recursion_is_stopped_by_the_call_stack_limit() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} \
-          (func $rec (param i32) (result i32) \
-            (if (result i32) (i32.eqz (local.get 0)) (then (i32.const 0)) \
-              (else (call $rec (i32.sub (local.get 0) (i32.const 1)))))) \
-          (func (export \"finish\") (result i32) (call $rec (i32.const 1000000))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// The CodeMap-DoS defense, from the guest's side: a module of thousands of tiny
-/// functions is refused in `Module::new`, before anything is translated.
-///
-/// Both of `EnforcedLimits::strict()`'s function rules are load-bearing here, which
-/// is why the second half exists — dropping under the count cap does not get a
-/// module past the defense, because the bodies then fail the minimum average. The
-/// values themselves are pinned in `vm.rs`'s `the_enforced_limits_are_pinned`.
-#[test]
-fn a_module_of_too_many_functions_is_refused() {
-    let host = FakeHost::new();
-
-    let tiny_funcs = |count: usize| {
-        let funcs: String = (0..count)
-            .map(|i| format!("(func $f{i} (result i32) (i32.const {}))", i % 7))
-            .collect();
-        format!("(module {ONE_PAGE} {funcs} (func (export \"finish\") (result i32) (call $f0)))")
-    };
-
-    // `max_functions: Some(10000)`, checked before the bodies are looked at.
-    let wat = tiny_funcs(10_001);
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(refusal.contains("limit of 10000 functions"), "{refusal}");
-
-    // `min_avg_bytes_per_function: 40`, enforced once the bodies total 1 KiB. These
-    // average five bytes, so the count cap is not the only thing holding.
-    let wat = tiny_funcs(9_999);
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(
-        refusal.contains("minimum average bytes per function of 40"),
-        "{refusal}"
-    );
-}
-
-/// The trap *kinds* wasmi distinguishes all reach the caller identically — a guest trap
-/// charged as the contract's fault — so the `unreachable` representative pins the mapping.
-/// These pin the individual kinds too, guarding against a wasmi upgrade reclassifying any of
-/// them as something other than a trap.
-#[test]
-fn a_division_by_zero_traps() {
-    let host = FakeHost::new();
-    let wat = module(&[ONE_PAGE], "(i32.div_s (i32.const 1) (i32.const 0))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn a_signed_integer_overflow_traps() {
-    let host = FakeHost::new();
-    let wat = module(
-        &[ONE_PAGE],
-        "(i32.div_s (i32.const 0x80000000) (i32.const -1))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn an_indirect_call_to_a_null_table_entry_traps() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} (type $t (func (result i32))) (table 1 funcref) \
-          (func (export \"finish\") (result i32) (call_indirect (type $t) (i32.const 0))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn an_indirect_call_with_a_mismatched_signature_traps() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} (type $void (func)) (type $i32 (func (result i32))) \
-          (table 1 funcref) (elem (i32.const 0) $f) (func $f (type $void)) \
-          (func (export \"finish\") (result i32) (call_indirect (type $i32) (i32.const 0))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
@@ -1,9 +1,21 @@
 Our [build instructions][BUILD.md] assume you have a C++ development
-environment complete with Git, Python, Conan, CMake, Rust, and a C++ compiler.
+environment complete with Git, Python, Conan, CMake, and a C++ compiler.
 This document explains how to set one up.

 [BUILD.md]: ../../BUILD.md

+## Supported development platforms
+
+- **Linux**: the [Nix development shell](./nix.md),
+  which provides the same toolchain CI uses on any distribution.
+- **macOS** 15 (Sequoia) or newer: the [Nix development shell](./nix.md),
+  or the system [Apple Clang](#macos-apple-clang).
+  CI runs on macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
+- **Windows**: best effort, see [Windows](#windows).
+
+For the platforms supported for running `xrpld`,
+see [Requirements](../install.md#requirements).
+
 ## Tested compiler versions

 `xrpld` is built in the **C++23** dialect by default, so your toolchain has to
@@ -35,18 +47,16 @@ compiler building. Treat support for anything outside the table as best-effort.

 ## Required tools

-Besides a compiler, building `xrpld` requires:
-
-| Tool                                        | Minimum version          |
-| ------------------------------------------- | ------------------------ |
-| [Git](https://git-scm.com/downloads)        | any recent               |
-| [Python](https://www.python.org/downloads/) | 3.11                     |
-| [Conan](https://conan.io/downloads.html)    | 2.17                     |
-| [CMake](https://cmake.org/download/)        | 3.16                     |
-| [Rust](https://rustup.rs)                   | 1.95 (see [Rust](#rust)) |
+Besides a compiler, building `xrpld` requires
+[Git](https://git-scm.com/downloads),
+[Python](https://www.python.org/downloads/),
+[Conan](https://conan.io/downloads.html),
+and [CMake](https://cmake.org/download/).
+Building with `-Drust=ON` additionally requires a Rust toolchain,
+see [Rust](#rust).

 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
-(see below). On Windows they have to be installed manually.
+at the versions CI uses, recorded in [`nix/check-tools/`](../../nix/check-tools).

 Once they are in place, verify that everything is installed and runnable with:

@@ -56,60 +66,19 @@ Once they are in place, verify that everything is installed and runnable with:

 ## Linux and macOS

-The **recommended way** to get a development environment on Linux and macOS is
-the Nix development shell. It provides the exact tooling used in CI — `git`,
-`python`, `conan`, `cmake`, `clang-tidy`, `clang-format`, and everything else —
-with a single command and without installing anything system-wide:
+Use the [Nix development shell](./nix.md):
+it provides the compiler and every tool CI uses,
+without installing anything system-wide.

-```bash
-nix --experimental-features 'nix-command flakes' develop
-```
+### macOS: Apple Clang

-On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
-Clang. If you instead opt to use your system-wide Apple Clang (via
-`nix develop .#apple-clang`), you need to manage its version yourself (see
-below).
-
-See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler and why we recommend Nix
-over a hand-maintained environment.
-
-### macOS: managing the Apple Clang version
-
-If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
-the compiler version is whatever your installed Xcode (or Command Line Tools)
-provides. The following command should return a version greater than or equal to
-the [tested one](#tested-compiler-versions):
-
-```bash
-clang --version
-```
-
-If you develop other applications using Xcode, you might be consistently
-updating to the newest version of Apple Clang, which will likely cause issues
-building xrpld. You may want to install and pin a specific version of Xcode:
-
-1. **Download Xcode**
-   - Visit [Apple Developer Downloads](https://developer.apple.com/download/more/)
-   - Sign in with your Apple Developer account
-   - Search for an Xcode version that includes the expected Apple Clang version
-   - Download the `.xip` file
-
-2. **Install and configure Xcode**
-
-   ```bash
-   # Extract the .xip file and rename for version management
-   # Example: Xcode_16.2.app
-
-   # Move to Applications directory
-   sudo mv Xcode_16.2.app /Applications/
-
-   # Set as default toolchain (persistent)
-   sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-
-   # Set as environment variable (temporary)
-   export DEVELOPER_DIR=/Applications/Xcode_16.2.app/Contents/Developer
-   ```
+You can also build with the system Apple Clang,
+installing the other [required tools](#required-tools) any way you like
+(or getting them from `nix develop .#apple-clang`).
+Its version is whatever your installed Xcode (or Command Line Tools) provides,
+so check that `clang --version` is at least the [tested one](#tested-compiler-versions).
+If several Xcode versions are installed,
+select one with `sudo xcode-select -s <path>` or the `DEVELOPER_DIR` environment variable.

 ## Windows

@@ -121,14 +90,17 @@ manually:
  "x64 Native Tools Command Prompt". CI configures CMake with the
  `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
- Python, Conan, CMake, and Rust, at the versions listed in
-  [Required tools](#required-tools).
+- recent releases of Python, Conan, and CMake
+- a [Rust toolchain](https://rustup.rs) — only needed to build with
+  `-Drust=ON`, see [Rust](#rust)

 ## Rust

 The repository contains a Rust workspace in [`crates/`](../../crates), whose
-crates are exposed to C++ through [cxx](https://cxx.rs) bindings and compiled by
-the CMake build, so a Rust toolchain is required.
+crates are exposed to C++ through [cxx](https://cxx.rs) bindings. It is **not**
+part of a default build: the CMake `rust` option is OFF by default, and with it
+off no Rust toolchain is needed. It is only required when configuring with
+`-Drust=ON` (which is what CI does), see [Options](../../BUILD.md#options).

 The toolchain (`cargo`, `rustc`) is pinned to the channel in
 [`rust-toolchain.toml`](../../rust-toolchain.toml) at the repository root. If
@@ -139,16 +111,5 @@ version.
 Everything else the Rust build needs on the CMake side comes from Conan along
 with the rest of the dependencies, so there is nothing further to install.

-## Clang-tidy
-
-`clang-tidy` is required to run static analysis checks locally (see
-[CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. The version this project uses is listed in
-[Tested compiler versions](#tested-compiler-versions).
-
-On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
-version out of the box — run it via `run-clang-tidy`. No separate installation
-is needed.
-
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [packages.nix]: ../../nix/packages.nix
@@ -9,9 +9,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
- **Works on Linux and macOS**: Consistent experience across platforms

 ## Install Nix

@@ -27,13 +25,8 @@ From the root of the xrpld repository, enter the default development shell:
 nix --experimental-features 'nix-command flakes' develop
 ```

-This will:
-
- Download and set up all required development tools (CMake, Ninja, Conan, etc.)
- Configure the appropriate compiler for your platform:
-  - **Linux**: GCC (provided by Nix)
-  - **macOS**: Clang (provided by Nix)
-
+This downloads and sets up all required development tools (CMake, Ninja, Conan, etc.)
+and the compiler for your platform (see [Platform notes](#platform-notes)).
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.

 ### Platform notes
@@ -128,8 +121,9 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.

-The Rust toolchain the build needs is included too: every shell provides the
-channel pinned in [`rust-toolchain.toml`](../../rust-toolchain.toml) (see
+Builds of the Rust crates (`-Drust=ON`) also work out of the box: every shell
+provides the Rust toolchain pinned in
+[`rust-toolchain.toml`](../../rust-toolchain.toml) (see
 [Rust](./environment.md#rust)), plus the `cargo-audit`, `cargo-llvm-cov` and
 `cargo-nextest` plugins.

@@ -10,6 +10,19 @@ and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
 where `yum` is a symlink to `dnf`.
 To build from source instead, see [BUILD.md](../BUILD.md).

+## Requirements
+
+Linux is the only operating system officially supported for running `xrpld`;
+macOS and Windows builds are for development only.
+
+Any x86-64 Linux distribution with APT or DNF and glibc 2.31 or newer should work
+(see [How libc is handled](../nix/docker/README.md#how-libc-is-handled)).
+CI tests the packages on Debian 11–13, Ubuntu 20.04–26.04,
+RHEL (UBI) 9–10, AlmaLinux 9–10, and Rocky Linux 9–10.
+
+For the hardware needed to run a node,
+see [System Requirements](https://xrpl.org/system-requirements.html).
+
 ## Release channels

 Packages are published to four channels:
@@ -39,6 +39,31 @@ checkedSub(std::int64_t a, std::int64_t b) noexcept
    return a - b;
 }

+/**
+ * Multiply two signed 64-bit integers, returning std::nullopt when the exact
+ * mathematical product is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedMul(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if (a == 0 || b == 0)
+        return 0;
+
+    if (a > 0)
+    {
+        if (b > 0 ? a > L::max() / b : b < L::min() / a)
+            return std::nullopt;
+    }
+    else if (b > 0 ? a < L::min() / b : b < L::max() / a)
+    {
+        return std::nullopt;
+    }
+
+    return a * b;
+}
+
 static_assert(checkedAdd(0, 0) == 0);
 static_assert(checkedAdd(1, -1) == 0);
 static_assert(checkedAdd(-5, 2) == -3);
@@ -81,6 +106,53 @@ static_assert(
    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
         .has_value());

+static_assert(checkedMul(0, std::numeric_limits<std::int64_t>::min()) == 0);
+static_assert(checkedMul(std::numeric_limits<std::int64_t>::min(), 0) == 0);
+static_assert(checkedMul(-1, -1) == 1);
+// a > 0, b > 0
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::max(), 1) ==
+    std::numeric_limits<std::int64_t>::max());
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::max() / 2, 2) ==
+    std::numeric_limits<std::int64_t>::max() - 1);
+static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, 2).has_value());
+static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::max() / 2) + 1).has_value());
+// a > 0, b < 0
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::max(), -1) ==
+    -std::numeric_limits<std::int64_t>::max());
+static_assert(
+    checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, -2) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 2, -2).has_value());
+static_assert(
+    checkedMul(1, std::numeric_limits<std::int64_t>::min()) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(
+    checkedMul(2, std::numeric_limits<std::int64_t>::min() / 2) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::min() / 2) - 1).has_value());
+// a < 0, b > 0
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::min(), 1) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::min() / 2, 2) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(!checkedMul((std::numeric_limits<std::int64_t>::min() / 2) - 1, 2).has_value());
+static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), 2).has_value());
+// a < 0, b < 0
+static_assert(
+    checkedMul(-(std::numeric_limits<std::int64_t>::max() / 2), -2) ==
+    std::numeric_limits<std::int64_t>::max() - 1);
+static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min() / 2, -2).has_value());
+static_assert(
+    checkedMul(-1, -std::numeric_limits<std::int64_t>::max()) ==
+    std::numeric_limits<std::int64_t>::max());
+static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), -1).has_value());
+static_assert(!checkedMul(-1, std::numeric_limits<std::int64_t>::min()).has_value());
+
 /**
 * Calculate one number divided by another number in percentage.
 * The result is rounded up to the next integer, and capped in the range [0,100]
@@ -352,9 +352,9 @@ class Number final
    using rep = std::int64_t;
    using InternalRep = MantissaRange::rep;

-    bool negative_{false};
    InternalRep mantissa_{0};
    int exponent_{std::numeric_limits<int>::lowest()};
+    bool negative_{false};

 public:
    // The range for the exponent when normalized
@@ -543,21 +543,8 @@ public:
    setround(RoundingMode inMode);

    /**
-     * Convert an integer to a RoundingMode, validating that it is in range.
+     * Returns which mantissa scale is currently in use for normalization.
     *
-     * Returns std::nullopt if the value does not correspond to a valid
-     * RoundingMode.
-     */
-    static std::optional<RoundingMode>
-    checkedRoundingMode(int mode) noexcept
-    {
-        if (mode < static_cast<int>(RoundingMode::ToNearest) ||
-            mode > static_cast<int>(RoundingMode::Upward))
-            return std::nullopt;
-        return static_cast<RoundingMode>(mode);
-    }
-
-    /**
     * If you think you need to call this outside of unit tests, no you don't.
     */
    static MantissaRange::MantissaScale
@@ -663,8 +650,12 @@ private:
    shiftExponent(int exponentDelta) const;
 };

+// The number class currently has 3 tail padding bytes. If you are adding new
+// members, try to fit them there before expanding the size of the class.
+static_assert(sizeof(Number) == 16);
+
 constexpr Number::Number(bool negative, InternalRep mantissa, int exponent, Unchecked) noexcept
-    : negative_(negative), mantissa_{mantissa}, exponent_{exponent}
+    : mantissa_{mantissa}, exponent_{exponent}, negative_(negative)
 {
 }

@@ -153,6 +153,24 @@ private:
        Policy policy,
        Callback&& replaceCallback = nullptr);

+    /**
+     * canonicalizeImpl variant for callers that already hold `mutex_`.
+     *
+     * The unnamed `scoped_lock<MutexType> const&` parameter is proof of
+     * ownership; this overload does not acquire the lock. Use it from other
+     * methods (e.g. fetchAndModify) that need to compose canonicalize with
+     * additional work under a single critical section, without relying on
+     * recursive-mutex re-entry.
+     */
+    template <class Policy, class Callback = std::nullptr_t>
+    bool
+    canonicalizeImpl(
+        std::scoped_lock<MutexType> const&,
+        key_type const& key,
+        CanonicalizeClientPointerType<Policy> data,
+        Policy policy,
+        Callback&& replaceCallback = nullptr);
+
 public:
    /**
     * Replace aliased objects with originals.
@@ -239,9 +257,6 @@ public:
    bool
    retrieve(key_type const& key, T& data);

-    MutexType&
-    peekMutex();
-
    std::vector<key_type>
    getKeys() const;

@@ -263,6 +278,22 @@ public:
    fetch(key_type const& digest, Handler const& h);
    // End CachedSLEs functions.

+    /**
+     * Fetch or create an entry and execute a callback while holding the lock.
+     *
+     * The entry for the given key is fetched from the cache or created if it
+     * doesn't exist. The callback is then invoked with a reference to the
+     * entry while the cache mutex is still held, allowing safe modification
+     * of the cached object.
+     *
+     * @param key The key to fetch or create
+     * @param callback Function to call with the entry under lock.
+     *                 Signature: void(T&)
+     */
+    template <class Callback>
+    void
+    fetchAndModify(key_type const& key, Callback&& callback);
+
 private:
    SharedPointerType
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l);
@@ -4,6 +4,7 @@
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/scope.h>
+#include <xrpl/beast/utility/instrumentation.h>

 #include <algorithm>

@@ -335,6 +336,29 @@ template <class Policy, class Callback>
 inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    canonicalizeImpl(
+        key_type const& key,
+        CanonicalizeClientPointerType<Policy> data,
+        Policy policy,
+        Callback&& replaceCallback)
+{
+    std::scoped_lock<MutexType> const lock(mutex_);
+    return canonicalizeImpl(lock, key, data, policy, std::forward<Callback>(replaceCallback));
+}
+
+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+template <class Policy, class Callback>
+inline bool
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    canonicalizeImpl(
+        std::scoped_lock<MutexType> const&,
        key_type const& key,
        CanonicalizeClientPointerType<Policy> data,
        [[maybe_unused]] Policy policy,
@@ -354,8 +378,6 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // passing a const argument is a compile error.
    constexpr bool replaceCached = std::is_same_v<Policy, detail::ReplaceCached>;

-    std::scoped_lock const lock(mutex_);
-
    auto const cit = cache_.find(key);

    if (cit == cache_.end())
@@ -572,22 +594,6 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    return true;
 }

-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-inline auto
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    peekMutex() -> MutexType&
-{
-    return mutex_;
-}
-
 template <
    class Key,
    class T,
@@ -700,6 +706,49 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 }
 // End CachedSLEs functions.

+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+template <class Callback>
+inline void
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    fetchAndModify(key_type const& key, Callback&& callback)
+{
+    static_assert(
+        !IsKeyCache, "fetchAndModify is only supported for value caches, not key-only caches");
+    static_assert(
+        std::is_same_v<std::shared_ptr<T>, SharedPointerType> ||
+            std::is_same_v<intr_ptr::SharedPtr<T>, SharedPointerType>,
+        "fetchAndModify requires std::shared_ptr<T> or intr_ptr::SharedPtr<T>");
+
+    std::scoped_lock<MutexType> const lock(mutex_);
+
+    // Same pointer-type dispatch as insert(): the placeholder must have exactly
+    // SharedPointerType so canonicalizeImpl can write the cached pointer back.
+    SharedPointerType entry = [] {
+        if constexpr (std::is_same_v<std::shared_ptr<T>, SharedPointerType>)
+        {
+            return std::make_shared<T>();
+        }
+        else
+        {
+            return intr_ptr::makeShared<T>();
+        }
+    }();
+    canonicalizeImpl(lock, key, entry, detail::ReplaceClient{});
+
+    ALWAYS(
+        entry != nullptr, "xrpl::TaggedCache::fetchAndModify : entry present after canonicalize");
+
+    callback(*entry);
+}
+
 template <
    class Key,
    class T,
@@ -13,7 +13,6 @@
 #include <xrpl/protocol/TxMeta.h>

 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <optional>

@@ -69,18 +68,6 @@ public:
        deliver_ = amount;
    }

-    void
-    setGasUsed(std::optional<std::uint32_t> const gasUsed)
-    {
-        gasUsed_ = gasUsed;
-    }
-
-    void
-    setVMReturnCode(std::int32_t const vmReturnCode)
-    {
-        vmReturnCode_ = vmReturnCode;
-    }
-
    /**
     * Get the number of modified entries
     */
@@ -101,8 +88,6 @@ public:

 private:
    std::optional<STAmount> deliver_;
-    std::optional<std::uint32_t> gasUsed_;
-    std::optional<std::int32_t> vmReturnCode_;
 };

 }  // namespace xrpl
@@ -257,13 +257,42 @@ public:
        header_.validated = true;
    }

-    void
+    /**
+     * Mark this ledger as accepted and attempt to make it immutable.
+     *
+     * The close-time fields are recorded first, since the ledger hash covers
+     * them.
+     *
+     * @param closeTime The consensus-agreed close time.
+     * @param closeResolution The close time resolution.
+     * @param correctCloseTime Whether consensus agreed on the close time. If
+     *        false, kSLcfNoConsensusTime is recorded in closeFlags instead.
+     * @return What setImmutable() returned.
+     */
+    [[nodiscard]] bool
    setAccepted(
        NetClock::time_point closeTime,
        NetClock::duration closeResolution,
        bool correctCloseTime);

-    void
+    /**
+     * Mark this ledger as immutable, so it can no longer be modified.
+     *
+     * A ledger built or loaded locally cannot have an invalid map, since only
+     * a map syncing against hashes from outside can be proven impossible (see
+     * SHAMap::addKnownNode), so a caller on such a path may treat a false
+     * return as a broken internal invariant. A caller assembling a ledger from
+     * peer data may not: for it, false is an outcome a peer can produce.
+     *
+     * @param rehash Whether to recompute the ledger hash from the header
+     *        fields. The transaction and account hashes are recomputed from the
+     *        maps too, but only the first time.
+     * @return false if either map is Invalid, leaving the immutable flag as it
+     *         was and the header untouched. A map invalidated partway through can
+     *         still leave the other one immutable, so a false return means the
+     *         ledger must be discarded rather than retried.
+     */
+    [[nodiscard]] bool
    setImmutable(bool rehash = true);

    bool
@@ -272,23 +301,28 @@ public:
        return immutable_;
    }

-    /*  Mark this ledger as "should be full".
+    /**
+     * @return Whether both maps can still be the maps the header names. See
+     *         SHAMap::isValid().
+     */
+    [[nodiscard]] bool
+    mapsValid() const
+    {
+        return txMap_.isValid() && stateMap_.isValid();
+    }

-        "Full" is metadata property of the ledger, it indicates
-        that the local server wants all the corresponding nodes
-        in durable storage.
-
-        This is marked `const` because it reflects metadata
-        and not data that is in common with other nodes on the
-        network.
-    */
+    /**
+     * Mark this ledger as "should be full", indicating that the local server
+     * wants all the corresponding nodes in durable storage.
+     *
+     * Const because it reflects metadata, not data this ledger shares with
+     * other nodes on the network.
+     */
    void
    setFull() const
    {
-        txMap_.setFull();
-        txMap_.setLedgerSeq(header_.seq);
-        stateMap_.setFull();
-        stateMap_.setLedgerSeq(header_.seq);
+        txMap_.setFull(header_.seq);
+        stateMap_.setFull(header_.seq);
    }

    void
@@ -418,6 +452,22 @@ private:
    static std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
    deserializeTxPlusMeta(SHAMapItem const& item);

+    /**
+     * Make both maps immutable.
+     *
+     * Each map is settled on its own, so neither is left mid-sync because the
+     * other refused.
+     *
+     * @return Whether both maps are immutable.
+     */
+    [[nodiscard]] bool
+    setMapsImmutable()
+    {
+        bool const txImmutable = txMap_.setImmutable();
+        bool const stateImmutable = stateMap_.setImmutable();
+        return txImmutable && stateImmutable;
+    }
+
    bool immutable_;

    // A SHAMap containing the transactions associated with this ledger.
@@ -265,6 +265,13 @@ canWithdraw(
 [[nodiscard]] TER
 canWithdraw(ReadView const& view, STTx const& tx);

+/**
+ * Pays out a withdrawal from a vault or loan broker pseudo-account.
+ *
+ * `sourceAmount` leaves `sourceAcct` and `destinationAmount` reaches `dstAcct`.
+ * The two differ only when the withdrawal carries a transfer fee; the
+ * difference is the fee and is settled through the issuer.
+ */
 [[nodiscard]] TER
 doWithdraw(
    ApplyViewContext ctx,
@@ -272,7 +279,8 @@ doWithdraw(
    AccountID const& dstAcct,
    AccountID const& sourceAcct,
    XRPAmount priorBalance,
-    STAmount const& amount,
+    STAmount const& destinationAmount,
+    STAmount const& sourceAmount,
    beast::Journal j);

 /**
@@ -16,7 +16,6 @@
 #include <xrpl/protocol/XRPAmount.h>

 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <map>
 #include <optional>
@@ -63,8 +62,6 @@ public:
        TER ter,
        std::optional<STAmount> const& deliver,
        std::optional<UInt256 const> const& parentBatchId,
-        std::optional<std::uint32_t> const& gasUsed,
-        std::optional<std::int32_t> const& vmReturnCode,
        bool isDryRun,
        beast::Journal j);

@@ -2,7 +2,6 @@

 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Number.h>
-#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ApplyView.h>
@@ -29,7 +28,6 @@
 #include <expected>
 #include <functional>
 #include <optional>
-#include <stdexcept>
 #include <tuple>
 #include <utility>

@@ -313,11 +311,11 @@ getAMMOfferStartWithTakerPays(
 * is equal to LOB quality (in this case AMM offer quality is
 * better than LOB quality) or AMM offer is equal to LOB quality
 * (in this case SPQ is better than LOB quality).
- * Pre-amendment code calculates takerPays first. If takerGets is the
- * economically coarser integral side, it is rounded down, which results in
- * worse offer quality than LOB quality, and the offer might fail to generate.
- * Post-amendment code calculates the economically coarser integral offer side
- * first. The result is rounded down, which makes the offer quality better.
+ * The economically coarser integral offer side is calculated first. The
+ * result is rounded down, which makes the offer quality better. Calculating
+ * takerPays first instead would round down takerGets when that is the coarser
+ * side, giving worse quality than LOB quality, and the offer might fail to
+ * generate.
 *   It might not be possible to match either SPQ or AMM offer to LOB
 * quality. This generally happens at higher fees.
 * @param pool AMM pool balances
@@ -331,69 +329,8 @@ changeSpotPriceQuality(
    TAmounts<TIn, TOut> const& pool,
    Quality const& quality,
    std::uint16_t tfee,
-    Rules const& rules,
    beast::Journal j)
 {
-    if (!rules.enabled(fixAMMv1_1))
-    {
-        // Finds takerPays (i) and takerGets (o) such that given pool
-        // composition poolGets(I) and poolPays(O): (O - o) / (I + i) = quality.
-        // Where takerGets is calculated as the swapAssetIn (see below).
-        // The above equation produces the quadratic equation:
-        // i^2*(1-fee) + i*I*(2-fee) + I^2 - I*O/quality,
-        // which is solved for i, and o is found with swapAssetIn().
-        auto const f = feeMult(tfee);  // 1 - fee
-        auto const& a = f;
-        auto const b = pool.in * (1 + f);
-        Number const c = pool.in * pool.in - pool.in * pool.out * quality.rate();
-        auto const res = b * b - 4 * a * c;
-        if (res < 0)
-        {
-            return std::nullopt;  // LCOV_EXCL_LINE
-        }
-        if (auto const nTakerPaysPropose = (-b + root2(res)) / (2 * a); nTakerPaysPropose > 0)
-        {
-            auto const nTakerPays = [&] {
-                // The fee might make the AMM offer quality less than CLOB
-                // quality. Therefore, AMM offer has to satisfy this constraint:
-                // o / i >= q. Substituting o with swapAssetIn() gives: i <= O /
-                // q - I / (1 - fee).
-                auto const nTakerPaysConstraint = pool.out * quality.rate() - pool.in / f;
-                if (nTakerPaysPropose > nTakerPaysConstraint)
-                    return nTakerPaysConstraint;
-                return nTakerPaysPropose;
-            }();
-            if (nTakerPays <= 0)
-            {
-                JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in)
-                                << " " << to_string(pool.out) << " " << quality << " " << tfee;
-                return std::nullopt;
-            }
-            auto const takerPays =
-                toAmount<TIn>(getAsset(pool.in), nTakerPays, Number::RoundingMode::Upward);
-            // should not fail
-            auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
-            if (Quality{amounts} < quality &&
-                !withinRelativeDistance(Quality{amounts}, quality, Number(1, -7)))
-            {
-                JLOG(j.error()) << "changeSpotPriceQuality failed: " << to_string(pool.in) << " "
-                                << to_string(pool.out) << " "
-                                << " " << quality << " " << tfee << " " << to_string(amounts.in)
-                                << " " << to_string(amounts.out);
-                Throw<std::runtime_error>("changeSpotPriceQuality failed");
-            }
-
-            JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
-                            << to_string(pool.out) << " "
-                            << " " << quality << " " << tfee << " " << to_string(amounts.in) << " "
-                            << to_string(amounts.out);
-            return amounts;
-        }
-        JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in) << " "
-                        << to_string(pool.out) << " " << quality << " " << tfee;
-        return std::nullopt;
-    }
-
    auto amounts = [&] {
        bool const inIntegral = getAsset(pool.in).integral();
        bool const outIntegral = getAsset(pool.out).integral();
@@ -459,57 +396,49 @@ template <typename TIn, typename TOut>
 TOut
 swapAssetIn(TAmounts<TIn, TOut> const& pool, TIn const& assetIn, std::uint16_t tfee)
 {
-    if (auto const& rules = getCurrentTransactionRules(); rules && rules->enabled(fixAMMv1_1))
-    {
-        // set rounding to always favor the amm. Clip to zero.
-        // calculate:
-        // pool.out -
-        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        // and explicitly set the rounding modes
-        // Favoring the amm means we should:
-        // minimize:
-        // pool.out -
-        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        // maximize:
-        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        // (pool.in * pool.out)
-        // minimize:
-        // (pool.in + assetIn * feeMult(tfee)),
-        // minimize:
-        // assetIn * feeMult(tfee)
-        // feeMult is: (1-fee), fee is tfee/100000
-        // minimize:
-        // 1-fee
-        // maximize:
-        // fee
-        SaveNumberRoundMode const _{Number::getround()};
+    // set rounding to always favor the amm. Clip to zero.
+    // calculate:
+    // pool.out -
+    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+    // and explicitly set the rounding modes
+    // Favoring the amm means we should:
+    // minimize:
+    // pool.out -
+    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+    // maximize:
+    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+    // (pool.in * pool.out)
+    // minimize:
+    // (pool.in + assetIn * feeMult(tfee)),
+    // minimize:
+    // assetIn * feeMult(tfee)
+    // feeMult is: (1-fee), fee is tfee/100000
+    // minimize:
+    // 1-fee
+    // maximize:
+    // fee
+    SaveNumberRoundMode const _{Number::getround()};

-        Number::setround(Number::RoundingMode::Upward);
-        auto const numerator = pool.in * pool.out;
-        auto const fee = getFee(tfee);
+    Number::setround(Number::RoundingMode::Upward);
+    auto const numerator = pool.in * pool.out;
+    auto const fee = getFee(tfee);

-        Number::setround(Number::RoundingMode::Downward);
-        auto const denom = pool.in + assetIn * (1 - fee);
+    Number::setround(Number::RoundingMode::Downward);
+    auto const denom = pool.in + assetIn * (1 - fee);

-        if (denom.signum() <= 0)
-            return toAmount<TOut>(getAsset(pool.out), 0);
+    if (denom.signum() <= 0)
+        return toAmount<TOut>(getAsset(pool.out), 0);

-        Number::setround(Number::RoundingMode::Upward);
-        auto const ratio = numerator / denom;
+    Number::setround(Number::RoundingMode::Upward);
+    auto const ratio = numerator / denom;

-        Number::setround(Number::RoundingMode::Downward);
-        auto const swapOut = pool.out - ratio;
+    Number::setround(Number::RoundingMode::Downward);
+    auto const swapOut = pool.out - ratio;

-        if (swapOut.signum() < 0)
-            return toAmount<TOut>(getAsset(pool.out), 0);
+    if (swapOut.signum() < 0)
+        return toAmount<TOut>(getAsset(pool.out), 0);

-        return toAmount<TOut>(getAsset(pool.out), swapOut, Number::RoundingMode::Downward);
-    }
-
-    return toAmount<TOut>(
-        getAsset(pool.out),
-        pool.out - (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        Number::RoundingMode::Downward);
+    return toAmount<TOut>(getAsset(pool.out), swapOut, Number::RoundingMode::Downward);
 }

 /**
@@ -526,57 +455,49 @@ template <typename TIn, typename TOut>
 TIn
 swapAssetOut(TAmounts<TIn, TOut> const& pool, TOut const& assetOut, std::uint16_t tfee)
 {
-    if (auto const& rules = getCurrentTransactionRules(); rules && rules->enabled(fixAMMv1_1))
+    // set rounding to always favor the amm. Clip to zero.
+    // calculate:
+    // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) /
+    // (1-tfee/100000)
+    // maximize:
+    // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in)
+    // maximize:
+    // (pool.in * pool.out) / (pool.out - assetOut)
+    // maximize:
+    // (pool.in * pool.out)
+    // minimize
+    // (pool.out - assetOut)
+    // minimize:
+    // (1-tfee/100000)
+    // maximize:
+    // tfee/100000
+
+    SaveNumberRoundMode const _{Number::getround()};
+
+    Number::setround(Number::RoundingMode::Upward);
+    auto const numerator = pool.in * pool.out;
+
+    Number::setround(Number::RoundingMode::Downward);
+    auto const denom = pool.out - assetOut;
+    if (denom.signum() <= 0)
    {
-        // set rounding to always favor the amm. Clip to zero.
-        // calculate:
-        // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) /
-        // (1-tfee/100000)
-        // maximize:
-        // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in)
-        // maximize:
-        // (pool.in * pool.out) / (pool.out - assetOut)
-        // maximize:
-        // (pool.in * pool.out)
-        // minimize
-        // (pool.out - assetOut)
-        // minimize:
-        // (1-tfee/100000)
-        // maximize:
-        // tfee/100000
-
-        SaveNumberRoundMode const _{Number::getround()};
-
-        Number::setround(Number::RoundingMode::Upward);
-        auto const numerator = pool.in * pool.out;
-
-        Number::setround(Number::RoundingMode::Downward);
-        auto const denom = pool.out - assetOut;
-        if (denom.signum() <= 0)
-        {
-            return toMaxAmount<TIn>(getAsset(pool.in));
-        }
-
-        Number::setround(Number::RoundingMode::Upward);
-        auto const ratio = numerator / denom;
-        auto const numerator2 = ratio - pool.in;
-        auto const fee = getFee(tfee);
-
-        Number::setround(Number::RoundingMode::Downward);
-        auto const feeMult = 1 - fee;
-
-        Number::setround(Number::RoundingMode::Upward);
-        auto const swapIn = numerator2 / feeMult;
-        if (swapIn.signum() < 0)
-            return toAmount<TIn>(getAsset(pool.in), 0);
-
-        return toAmount<TIn>(getAsset(pool.in), swapIn, Number::RoundingMode::Upward);
+        return toMaxAmount<TIn>(getAsset(pool.in));
    }

-    return toAmount<TIn>(
-        getAsset(pool.in),
-        ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) / feeMult(tfee),
-        Number::RoundingMode::Upward);
+    Number::setround(Number::RoundingMode::Upward);
+    auto const ratio = numerator / denom;
+    auto const numerator2 = ratio - pool.in;
+    auto const fee = getFee(tfee);
+
+    Number::setround(Number::RoundingMode::Downward);
+    auto const feeMult = 1 - fee;
+
+    Number::setround(Number::RoundingMode::Upward);
+    auto const swapIn = numerator2 / feeMult;
+    if (swapIn.signum() < 0)
+        return toAmount<TIn>(getAsset(pool.in), 0);
+
+    return toAmount<TIn>(getAsset(pool.in), swapIn, Number::RoundingMode::Upward);
 }

 /**
@@ -584,22 +584,31 @@ isBytecodeExecutionDisabled(Fees const& fees)
 }
 /** @} */

+/**
+ * Owner count an escrow costs.
+ *
+ *  An escrow costs one increment per started 500 bytes of bytecode, and one
+ *  increment if it carries no bytecode.
+ */
 template <class T>
 int32_t
 calculateAdditionalReserve(T const& finishFunction)
 {
-    // First 500 bytes included in the normal reserve
-    // Each additional 500 bytes requires an additional reserve
    static auto constexpr kBytecodeReserveIncrement = 500;

    if (!finishFunction)
        return 1;

-    // Ceiling division answers 0 for an empty field, which would subtract less than
-    // the create added.
    auto const size = finishFunction->size();
    if (size == 0)
+    {
+        // LCOV_EXCL_START
+        // Empty Bytecode is refused at create, so no escrow carries it. Ceiling
+        // division would answer 0, which would subtract less than the create added.
+        UNREACHABLE("xrpl::calculateAdditionalReserve : empty Bytecode");
        return 1;
+        // LCOV_EXCL_STOP
+    }

    return static_cast<int32_t>((size + kBytecodeReserveIncrement - 1) / kBytecodeReserveIncrement);
 }
@@ -7,10 +7,10 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/VaultHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
-#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
@@ -31,9 +31,9 @@ namespace xrpl {
 /**
 * Broker cover preclaim precision guard (fixCleanup3_2_0).
 *
- * Prevents a "silent sub-ULP no-op" where a deposit, withdrawal, or clawback
- * amount is so small that it rounds to zero at `sfCoverAvailable`'s scale.
- * Without this guard, both the pseudo trust-line and `sfCoverAvailable` would
+ * Prevents a silent sub-ULP no-op where a deposit, withdrawal, or clawback
+ * amount is so small that it rounds to zero at sfCoverAvailable's scale.
+ * Without this guard, both the pseudo trust-line and sfCoverAvailable would
 * identically absorb the rounded zero, resulting in a successful transaction
 * (tesSUCCESS) where no funds actually moved.
 *
@@ -44,8 +44,8 @@ namespace xrpl {
 * @param j          Journal for logging.
 * @param logPrefix  Transactor name for log diagnostics.
 *
- * @return `tecPRECISION_LOSS` if the request rounds to zero at cover scale.
- * `tesSUCCESS` if the amendment is disabled or the request is safely supra-ULP.
+ * @return tecPRECISION_LOSS if the request rounds to zero at cover scale.
+ * tesSUCCESS if the amendment is disabled or the request is safely supra-ULP.
 */
 [[nodiscard]] TER
 canApplyToBrokerCover(
@@ -56,6 +56,82 @@ canApplyToBrokerCover(
    beast::Journal j,
    std::string_view logPrefix);

+namespace detail {
+
+/**
+ * Return a LoanBroker's posterior live cover exponent after applying an
+ * unrounded delta.
+ */
+[[nodiscard]] int
+getPosteriorBrokerCoverScale(SLE::ConstRef vault, SLE::ConstRef broker, Number const& delta);
+
+/**
+ * Round a cover outflow delta (cover withdraw, cover clawback, the
+ * broker-side decrease of a default's cover credit) at the LoanBroker's
+ * posterior live exponent. Safe to round the delta directly for an outflow:
+ * amount on the posterior grid of CoverAvailable always leaves CoverAvailable
+ * minus amount representable, since the posterior grid is exactly the grid
+ * CoverAvailable itself will canonicalize to after the subtraction.
+ */
+[[nodiscard]] STAmount
+roundToPosteriorBrokerCoverScale(
+    SLE::ConstRef vault,
+    SLE::ConstRef broker,
+    STAmount const& delta,
+    Number::RoundingMode roundingMode);
+
+}  // namespace detail
+
+/**
+ * Round a cover debit (cover withdraw, cover clawback, the broker-side
+ * decrease of a default's cover credit): amount is the non-negative
+ * magnitude leaving CoverAvailable. Negates so the posterior is computed for
+ * CoverAvailable minus amount, then negates the result back to a
+ * non-negative magnitude, per roundToPosteriorBrokerCoverScale's outflow
+ * rationale above. Magnitude in, magnitude out -- unlike the vault-side
+ * outflow dispatcher (clampVaultOutflow), which takes and returns a negative
+ * delta; callers on each side already hold the value in that side's native
+ * form.
+ */
+[[nodiscard]] STAmount
+debitToPosteriorBrokerCoverScale(
+    SLE::ConstRef vault,
+    SLE::ConstRef broker,
+    STAmount const& amount,
+    Number::RoundingMode roundingMode);
+
+/**
+ * Round a cover inflow (cover deposit, LoanPay's fee redirect into cover)
+ * into CoverAvailable by flooring the sum rather than the delta:
+ * credit = floor16(CoverAvailable + raw) - CoverAvailable, never finer
+ * than the Vault's base exponent (-Scale). See
+ * creditToPosteriorAvailableScale's doc for why the sum, not the delta,
+ * must be floored; the same reasoning applies to CoverAvailable.
+ */
+[[nodiscard]] STAmount
+creditToPosteriorBrokerCoverScale(
+    SLE::ConstRef vault,
+    SLE::ConstRef broker,
+    Number const& raw,
+    Number::RoundingMode roundingMode);
+
+/**
+ * Check whether amount is an admissible optional cover inflow.
+ *
+ * Legacy and CashBasis Vaults always succeed. A LoanBroker attached to a
+ * FixedPrecision Vault must remain at the Vault's base scale after applying
+ * the rounded amount, and its posterior CoverAvailable must stay within the
+ * Open zone.
+ *
+ * LoanPay's fee redirect into cover is a mandatory inflow and does not call
+ * this check, so it can push CoverAvailable past the Open zone limit this
+ * check enforces. Once that happens, every subsequent LoanBrokerCoverDeposit
+ * returns tecLIMIT_EXCEEDED until the owner withdraws cover back under the
+ * limit; LoanBrokerCoverWithdraw and LoanBrokerCoverClawback are unaffected.
+ */
+[[nodiscard]] TER
+checkOptionalBrokerCoverInflow(SLE::ConstRef vault, SLE::ConstRef broker, STAmount const& amount);
+
 // Lending protocol has dependencies, so capture them here.
 bool
 checkLendingProtocolDependencies(Rules const& rules, STTx const& tx);
@@ -64,13 +140,13 @@ checkLendingProtocolDependencies(Rules const& rules, STTx const& tx);
 * The accounts and asset that LoanManage::defaultLoan's fixCleanup3_4_0
 * freeze/lock exemption applies to.
 *
- * `defaultLoan` moves funds from the LoanBroker pseudo-account to the Vault
- * pseudo-account via `accountSend`. Since neither is the vault asset's
+ * defaultLoan moves funds from the LoanBroker pseudo-account to the Vault
+ * pseudo-account via accountSend. Since neither is the vault asset's
 * issuer, this is a third-party transfer that transits through the issuer in
 * two hops (broker -> issuer, issuer -> vault; see
- * `directSendNoLimitIOU`/`directSendNoLimitMPT`), so the exemption must cover
+ * directSendNoLimitIOU/directSendNoLimitMPT), so the exemption must cover
 * both the issuer/broker and issuer/vault pairs, not a direct broker/vault
- * pair. `asset` scopes it further to the vault's own currency/MPT issuance,
+ * pair. asset scopes it further to the vault's own currency/MPT issuance,
 * so an unrelated one the same accounts happen to hold is still protected.
 */
 struct LoanDefaultFreezeExemptAccounts
@@ -88,10 +164,10 @@ struct LoanDefaultFreezeExemptAccounts
 * @param view Ledger view used to resolve the Loan -> LoanBroker -> Vault
 * chain.
 * @param tx The transaction under invariant review.
- * @return The exempt accounts and asset if `tx` is a `ttLOAN_MANAGE`
- * transaction with the `tfLoanDefault` flag set, `fixCleanup3_4_0` is
+ * @return The exempt accounts and asset if tx is a ttLOAN_MANAGE
+ * transaction with the tfLoanDefault flag set, fixCleanup3_4_0 is
 * enabled, and the loan/broker/vault objects it references can all be
- * resolved; `std::nullopt` otherwise.
+ * resolved; std::nullopt otherwise.
 */
 [[nodiscard]] std::optional<LoanDefaultFreezeExemptAccounts>
 getLoanDefaultFreezeExemptAccounts(ReadView const& view, STTx const& tx);
@@ -254,28 +330,38 @@ adjustImpreciseNumber(
        value = 0;
 }

-inline int
-getAssetsTotalScale(SLE::ConstRef vaultSle)
-{
-    if (!vaultSle)
-        return Number::kMinExponent - 1;  // LCOV_EXCL_LINE
-    return scale(vaultSle->at(sfAssetsTotal), vaultSle->at(sfAsset));
-}
+/**
+ * Apply a signed delta to a LoanBroker's DebtTotal: on FixedPrecision Vaults,
+ * add the exact delta (DebtTotal moves by exactly the same amount as the
+ * Vault's AssetsDeployed, never re-rounded); on Legacy/CashBasis Vaults,
+ * round through adjustImpreciseNumber at vaultScale. Shared by LoanSet
+ * (origination) and LoanPay (payment, where delta is negative).
+ *
+ * @param brokerSle The LoanBroker whose DebtTotal is adjusted.
+ * @param vaultSle The LoanBroker's Vault.
+ * @param delta The signed change to DebtTotal.
+ * @param vaultScale The Vault scale the caller captured before changing
+ *        AssetsTotal. Legacy/CashBasis round DebtTotal at that scale, not at
+ *        the scale after this transaction's AssetsTotal change. Unused on
+ *        FixedPrecision Vaults.
+ */
+void
+adjustBrokerDebtTotal(
+    SLE::Ref brokerSle,
+    SLE::ConstRef vaultSle,
+    Number const& delta,
+    int vaultScale);

-// Compute the minimum required broker cover, rounded consistently.
-// DebtTotal is a broker-level aggregate maintained at vault scale, so the
-// rounding must also use vault scale — never an individual loan's scale.
-inline Number
-minimumBrokerCover(Number const& debtTotal, TenthBips32 coverRateMinimum, SLE::ConstRef vaultSle)
-{
-    XRPL_ASSERT(
-        vaultSle && vaultSle->getType() == ltVAULT, "xrpl::minimumBrokerCover : valid Vault sle");
-    NumberRoundModeGuard const mg(Number::RoundingMode::Upward);
-    return roundToAsset(
-        vaultSle->at(sfAsset),
-        tenthBipsOfValue(debtTotal, coverRateMinimum),
-        getAssetsTotalScale(vaultSle));
-}
+/**
+ * Minimum required broker cover, rounded up.
+ *
+ * DebtTotal is a broker-level aggregate, never rounded at an individual
+ * loan's scale. Legacy and CashBasis Vaults round at the live AssetsTotal
+ * exponent. FixedPrecision Vaults round at the Vault's base exponent
+ * (-Scale, or 0 for integral assets).
+ */
+Number
+minimumBrokerCover(Number const& debtTotal, TenthBips32 coverRateMinimum, SLE::ConstRef vaultSle);

 TER
 checkLoanGuards(
@@ -379,10 +465,10 @@ loanPaymentDeltas(LoanPaymentParts const& parts);

 }  // namespace cash_basis

-// Public dispatchers: pick cash_basis:: if featureLendingProtocolV1_1 is
-// enabled AND the Vault's LEVersion (VaultHelpers::getVaultVersion) is
-// VaultVersion::CashBasis, else instant_recognition::. These are the only entry points
-// transactors call.
+// Public dispatchers: pick cash_basis:: if the Vault's LEVersion
+// (VaultHelpers::getVaultVersion) is CashBasis or later (CashBasis or
+// FixedPrecision), else instant_recognition::. These are the only entry
+// points transactors call.
 AccountingDeltas
 loanOriginationDeltas(
    SLE::ConstRef vaultSle,
@@ -312,12 +312,22 @@ checkCreateMPT(
 //
 //------------------------------------------------------------------------------

-// MaximumAmount doesn't exceed 2**63-1
+/**
+ * MaximumAmount doesn't exceed 2**63-1
+ */
 std::int64_t
 maxMPTAmount(SLE const& sleIssuance);

-// OutstandingAmount may overflow and available amount might be negative.
-// But available amount is always <= |MaximumAmount - OutstandingAmount|.
+/**
+ * std::nullopt if the issuance doesn't exist.
+ */
+std::optional<std::int64_t>
+maxMPTAmount(ReadView const& view, MPTID const& mptID);
+
+/**
+ * OutstandingAmount may overflow and available amount might be negative.
+ * But available amount is always <= |MaximumAmount - OutstandingAmount|.
+ */
 std::int64_t
 availableMPTAmount(SLE const& sleIssuance);

@@ -331,7 +341,12 @@ availableMPTAmount(ReadView const& view, MPTID const& mptID);
 * directSendNoFee transactions that bypass the payment engine.
 * 2.  **accountSend & Payment Engine (Overflow: Yes):** A temporary overflow
 * check when `OutstandingAmount > UINT64_MAX`. This higher threshold is used
- * for `accountSend` and payments processed via the payment engine.
+ * for `accountSend` and payments processed via the payment engine, whose
+ * reverse pass may issue before it redeems.
+ *
+ * In both cases a single `sendAmount > MaximumAmount` is rejected. Such a send
+ * can never settle: redemptions within the transaction are bounded by the
+ * outstanding amount, so the final OutstandingAmount would exceed the cap.
 */
 bool
 isMPTOverflow(
@@ -353,6 +368,12 @@ issuerFundsToSelfIssue(ReadView const& view, MPTIssue const& issue);
 /**
 * Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
 * See ApplyView::issuerSelfDebitHookMPT().
+ *
+ * `amount` may be 0. BookStep removes an offer whose fee-adjusted funded
+ * output is 0, but other clips (for example MaximumAmount via limitStepIn)
+ * can still consume a zero slice of a funded remainder. The hook must
+ * accept 0: first call still snapshots origBalance; a zero debit adds
+ * nothing to selfDebit.
 */
 void
 issuerSelfDebitHookMPT(ApplyView& view, MPTIssue const& issue, std::uint64_t amount);
@@ -1,10 +1,17 @@
 #pragma once

+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFormats.h>

 #include <cstdint>
+#include <optional>

 namespace xrpl::proposal {

@@ -30,31 +37,22 @@ proposalOwnerCount(STObject const& proposedTx)
                                                                : kProposalOwnerCount;
 }

-/**
- * Whether the proposed transaction is itself a proposal transaction, which
- * would nest one proposal inside another.
- *
- * TODO: cover ttTRANSACTION_PROPOSAL_SIGN and ttTRANSACTION_PROPOSAL_CANCEL
- * once those transactions exist.
- */
-inline bool
-isProposalTx(STObject const& proposedTx)
-{
-    return proposedTx.getFieldU16(sfTransactionType) == ttTRANSACTION_PROPOSAL_CREATE;
-}
-
 /**
 * Whether the proposed transaction is independently submittable through the
- * ordinary multi-sign path: not a nested proposal, not a pseudo-transaction,
- * not itself flagged as someone else's inner batch transaction, and — if it
- * is a Batch — none of its own inner transactions is a nested proposal or a
- * pseudo-transaction either. A Batch inner transaction cannot itself be
- * pseudo (preflight0 rejects the pseudo/tfInnerBatchTxn combination
- * generically), but that guard lives outside this feature, so it is checked
- * again here rather than relied upon.
+ * ordinary multi-sign path: not a proposal transaction itself, not a
+ * pseudo-transaction, not itself flagged as someone else's inner batch
+ * transaction, and — if it is a Batch — every one of its own inner
+ * transactions carries a TransactionType and is neither a proposal, a
+ * pseudo-transaction, nor a nested Batch. A Batch inner transaction cannot
+ * lack a TransactionType, be pseudo, or be a nested Batch (STTx construction
+ * rejects a typeless inner and an inner Batch, and preflight0 rejects the
+ * pseudo/tfInnerBatchTxn combination), but those guards live outside this
+ * feature, so they are checked again here rather than relied upon.
+ *
+ * TODO: cover ttTRANSACTION_PROPOSAL_SIGN once that transaction exists.
 */
 bool
-isValidProposal(STObject const& proposedTx);
+isValidProposalTxnType(STObject const& proposedTx);

 /**
 * Whether the proposed transaction carries any signature field.
@@ -84,4 +82,93 @@ hasEmptySigningPubKey(STObject const& proposedTx)
        proposedTx.getFieldVL(sfSigningPubKey).empty();
 }

+/**
+ * Whether the proposal is terminal (On-Chain Cosigner spec §4.5). A terminal proposal
+ * stops accepting signatures and anyone may delete it. An already signed
+ * payload can still execute after Expiration, because the Ticket reservation
+ * compares payloads only; a passed LastLedgerSequence does stop it.
+ *
+ * A proposal is terminal when either:
+ * - its Expiration has passed (the parent ledger closed at or after it), or
+ * - the proposed transaction carries a LastLedgerSequence and the current
+ *   ledger sequence is strictly greater than it. This mirrors the ordinary
+ *   transactor's tefMAX_LEDGER rule: at view.seq() == LastLedgerSequence the
+ *   payload can still be submitted in the current ledger, so the proposal is
+ *   still live.
+ *
+ * @param view The ledger the deciding transaction is being applied to.
+ * @param expiration The proposal's Expiration field.
+ * @param proposedTx The proposal's ProposedTransaction field.
+ */
+bool
+isTerminal(
+    ReadView const& view,
+    std::optional<std::uint32_t> expiration,
+    STObject const& proposedTx);
+
+/**
+ * Delete a TransactionProposal ledger entry.
+ *
+ * Removes the entry from its Owner's directory, releases the reserve the
+ * proposal holds against the Owner, and erases the entry. Shared by every
+ * deletion path the spec defines (On-Chain Cosigner spec §4.5): automatic cleanup when the
+ * proposed transaction's TicketSequence is consumed, and the
+ * TransactionProposalCancel / TransactionProposalSign cleanup paths once
+ * those transactions exist.
+ *
+ * The release goes through decreaseOwnerCountForObject, so it follows the
+ * sfSponsor an entry created with reserve sponsorship carries: the reserve is
+ * returned to whoever was holding it, the Owner or that sponsor.
+ *
+ * @param view The apply view for making changes
+ * @param sleProposal The TransactionProposal ledger entry to delete
+ * @param j Journal for logging
+ * @return tesSUCCESS, tecINTERNAL for an invalid entry, or tefBAD_LEDGER if
+ *         the ledger contradicts the entry
+ */
+TER
+deleteProposal(ApplyView& view, SLE::pointer const& sleProposal, beast::Journal j);
+
+/**
+ * Whether tx carries the same payload as a proposal's stored
+ * ProposedTransaction (On-Chain Cosigner spec §4.2.1).
+ *
+ * The payload is the signing payload: the fields the collected signatures
+ * commit to. Compared is every field except those flagged kNotSigning
+ * (TxnSignature, Signers, BatchSigners, CounterpartySignature,
+ * SponsorSignature, Signature, MasterSignature) and SigningPubKey, which is
+ * stored empty and filled only if the target signs with its own key. So the
+ * completed transaction matches no matter which mix of collected or
+ * off-ledger signatures it carries, and any change to a non-signature field
+ * results in a false-return value.
+ *
+ * Signature (PaymentChannelClaim and the XChain attestation transactions)
+ * is deliberately not compared: it is outside the account's own TxnSignature
+ * even for an ordinary submission, so a proposal cannot bind it more tightly
+ * than the signatures it collects do, and those transactors still validate a
+ * substituted value exactly as they would for an ordinary submission.
+ * MasterSignature appears in no transaction format.
+ *
+ * @param proposedTx The proposal's ProposedTransaction field.
+ * @param tx The transaction to compare, typically an STTx.
+ */
+bool
+payloadMatches(STObject const& proposedTx, STObject const& tx);
+
+/**
+ * Whether tx may consume its Ticket.
+ *
+ * While a proposal keyed to the Ticket exists, the target's Ticket is
+ * reserved: only the proposal's own proposed transaction may spend it
+ * (On-Chain Cosigner spec §4.2.1), so that unrelated target-account activity cannot
+ * invalidate the proposal while signatures are being collected.
+ * TransactionProposalCancel is not allowed through: it deletes the
+ * reservation without consuming the ticket.
+ *
+ * @param view The ledger containing the Ticket and any reservation.
+ * @param tx The transaction attempting to consume that ticket.
+ */
+bool
+canConsumeTicket(ReadView const& view, STTx const& tx);
+
 }  // namespace xrpl::proposal
@@ -316,6 +316,20 @@ transferRate(ReadView const& view, Asset const& asset);
 [[nodiscard]] Rate
 transferRate(ReadView const& view, STAmount const& amount);

+/**
+ * Returns the amount a sender must part with for `amount` to reach the
+ * receiver once the issuer takes the transfer fee. Rounds up.
+ */
+[[nodiscard]] STAmount
+addTransferFee(STAmount const& amount, Rate const& rate);
+
+/**
+ * Returns the amount a receiver gets when `amount` leaves the sender and the
+ * issuer takes the transfer fee. Rounds down.
+ */
+[[nodiscard]] STAmount
+subtractTransferFee(STAmount const& amount, Rate const& rate);
+
 //------------------------------------------------------------------------------
 //
 // Holding operations (Asset-based dispatchers)
@@ -1,10 +1,12 @@
 #pragma once

 #include <xrpl/basics/Number.h>
+#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
@@ -12,11 +14,239 @@
 #include <cstdint>
 #include <expected>
 #include <optional>
+#include <string_view>

 namespace xrpl {

 class STTx;

+/**
+ * @brief Return the Vault's current assets total.
+ *
+ * FixedPrecision Vaults return AssetsAvailable plus AssetsDeployed, with no
+ * rounding to the asset's 16-digit precision: the sum is exact at Number's
+ * active 19-digit mantissa width (the large mantissa range, enabled by
+ * featureSingleAssetVault or featureLendingProtocol), rounds Downward regardless of the
+ * caller's ambient mode beyond that, and is not rounded to match the cached
+ * sfAssetsTotal field. Legacy and CashBasis Vaults return the stored
+ * AssetsTotal.
+ *
+ * @param vault The vault SLE.
+ * @return The current assets total.
+ */
+[[nodiscard]] Number
+getAssetsTotal(SLE::ConstRef vault);
+
+/**
+ * @brief A change to a FixedPrecision Vault's balances.
+ */
+struct VaultBalanceChange
+{
+    /**
+     * Signed change to AssetsAvailable. Must be the exact amount moved on the
+     * Vault pseudo-account in the same transaction. Absent means no cash
+     * moved; adjustVaultBalances then uses zero of the Vault's own asset.
+     */
+    std::optional<STAmount> cash = std::nullopt;
+
+    /**
+     * Signed change to AssetsDeployed: open Loan principal, exact.
+     */
+    Number deployed = 0;
+
+    /**
+     * Signed change to scheduled, unpaid interest (YieldUnrealized), exact.
+     */
+    Number yield = 0;
+
+    /**
+     * Signed change to impaired principal (LossUnrealized), exact.
+     */
+    Number loss = 0;
+};
+
+/**
+ * @brief Apply a balance change to a FixedPrecision Vault. The only writer of
+ * AssetsAvailable, AssetsDeployed, AssetsTotal, YieldUnrealized and
+ * LossUnrealized on these Vaults after creation.
+ *
+ * @param vault The vault SLE. Must be FixedPrecision.
+ * @param change The balance change to apply.
+ * @param j Journal for logging the fatal (tefBAD_LEDGER) case.
+ *
+ * @return tesSUCCESS; tecLIMIT_EXCEEDED if LossUnrealized would exceed
+ *         AssetsDeployed; tefBAD_LEDGER if AssetsAvailable, AssetsDeployed,
+ *         LossUnrealized or YieldUnrealized would become negative.
+ */
+[[nodiscard]] TER
+adjustVaultBalances(SLE::Ref vault, VaultBalanceChange const& change, beast::Journal j);
+
+/**
+ * @brief Apply a signed cash movement to a Vault of any version. FixedPrecision
+ * Vaults go through adjustVaultBalances; Legacy and CashBasis Vaults add the
+ * amount to both AssetsTotal and AssetsAvailable.
+ *
+ * @param vault The vault SLE.
+ * @param delta Signed change to AssetsAvailable; the exact amount moved on the
+ *              Vault pseudo-account.
+ * @param j Journal passed through to adjustVaultBalances.
+ *
+ * @return tesSUCCESS, or the adjustVaultBalances error for FixedPrecision Vaults.
+ */
+[[nodiscard]] TER
+adjustVaultCash(SLE::Ref vault, STAmount const& delta, beast::Journal j);
+
+/**
+ * Return the Vault's current live exponent.
+ *
+ * Legacy and CashBasis Vaults use the exponent of AssetsTotal. FixedPrecision
+ * Vaults use max(base exponent, exponent of AssetsTotal): the grid is never
+ * finer than -Scale and coarsens once AssetsTotal outgrows 16 digits there.
+ */
+[[nodiscard]] int
+getVaultScale(SLE::ConstRef vault);
+
+/**
+ * Return the Vault's base exponent.
+ *
+ * Legacy and CashBasis Vaults use their current live exponent. FixedPrecision
+ * Vaults use -Scale, or 0 for integral assets.
+ */
+[[nodiscard]] int
+getVaultBaseScale(SLE::ConstRef vault);
+
+/**
+ * Round an amount at the Vault's posterior live exponent.
+ */
+[[nodiscard]] STAmount
+roundToPosteriorVaultScale(
+    SLE::ConstRef vault,
+    STAmount const& amount,
+    Number::RoundingMode roundingMode);
+
+namespace detail {
+
+/**
+ * Return the Vault's posterior live exponent after applying an unrounded delta.
+ */
+[[nodiscard]] int
+getPosteriorVaultScale(SLE::ConstRef vault, STAmount const& delta);
+
+/**
+ * Shared grid-floor core of getVaultScale / getPosteriorVaultScale /
+ * getPosteriorBrokerCoverScale: baseScale when reference is zero, otherwise
+ * max(baseScale, scale(reference, asset)), rounded Downward regardless of
+ * the caller's ambient rounding mode.
+ */
+[[nodiscard]] int
+liveScale(Number const& reference, Asset const& asset, int baseScale);
+
+/**
+ * Shared core of getPosteriorVaultScale and getPosteriorBrokerCoverScale:
+ * the exponent reference + delta would have under version's live-scale rule
+ * (floored at baseScale for FixedPrecision, unbounded for Legacy/CashBasis).
+ *
+ * @param version The Vault's LEVersion.
+ * @param asset The Vault's underlying asset.
+ * @param baseScale The Vault's base exponent; unused outside the
+ *                   FixedPrecision case.
+ * @param reference The balance the delta is applied to (AssetsAvailable,
+ *                   AssetsTotal, or a LoanBroker's CoverAvailable).
+ * @param delta The unrounded change to reference.
+ */
+[[nodiscard]] int
+posteriorAssetScale(
+    VaultVersion version,
+    Asset const& asset,
+    int baseScale,
+    Number const& reference,
+    Number const& delta);
+
+/**
+ * Shared core of creditToPosteriorAvailableScale and
+ * creditToPosteriorBrokerCoverScale: floors reference + raw at the sum's
+ * own live scale (never finer than baseScale) and returns the difference
+ * from reference, so the delta applied is exactly what moves reference onto
+ * the floored sum. See creditToPosteriorAvailableScale's doc for why the
+ * sum, not raw alone, must be floored. raw is the exact amount; it is not
+ * rounded on its own before being added to reference. The sum and its scale
+ * are computed once, in roundingMode, so a Downward credit is always
+ * between zero and raw.
+ */
+[[nodiscard]] STAmount
+creditToPosteriorScale(
+    Asset const& asset,
+    Number const& reference,
+    int baseScale,
+    Number const& raw,
+    Number::RoundingMode roundingMode);
+
+}  // namespace detail
+
+/**
+ * Round a FixedPrecision cash inflow (LoanPay's credit, LoanManage's
+ * default cover credit) into AssetsAvailable, never AssetsTotal, which is
+ * a derived cache, by flooring the sum rather than the delta:
+ * credit equals floor16(AssetsAvailable + raw) minus AssetsAvailable, never
+ * finer than the Vault's base exponent (-Scale).
+ *
+ * Flooring only the delta at its own posterior grid is not enough: the sum
+ * can still need a 17th digit when AssetsAvailable is off the coarser grid
+ * right after crossing a power of ten. Example at Scale 6: AssetsAvailable
+ * equals 9999999999.999999 (16 digits already) and a credit of 0.000011
+ * floors to 0.00001 on its own (finer) grid, but 9999999999.999999 plus
+ * 0.00001 equals 10000000000.000009, which still needs 17 digits. Flooring
+ * the sum instead, floor16(9999999999.999999 + 0.000011) minus
+ * 9999999999.999999, is exact by construction, since STAmount's own
+ * 16-digit canonical form of the sum is what gets subtracted from.
+ *
+ * raw is taken as an exact Number: rounding it to 16 digits before adding
+ * it to AssetsAvailable could drop a tail that moves the floored sum.
+ */
+[[nodiscard]] STAmount
+creditToPosteriorAvailableScale(
+    SLE::ConstRef vault,
+    Number const& raw,
+    Number::RoundingMode roundingMode);
+
+/**
+ * Open-zone capacity ceiling: 9 * 10^(15 + baseScale).
+ *
+ * Defined only for FixedPrecision Vaults, where this is 9 * 10^(15 - P).
+ */
+[[nodiscard]] Number
+getVaultOpenLimit(SLE::ConstRef vault);
+
+/**
+ * Check whether amount is an admissible optional inflow.
+ *
+ * Legacy and CashBasis Vaults always succeed. FixedPrecision Vaults must
+ * remain at their base scale after applying the rounded amount, and the
+ * posterior capacity (AssetsTotal + YieldUnrealized + rounded amount) must
+ * stay within the Open zone.
+ *
+ * The amount is rounded toward zero at the posterior live exponent.
+ */
+[[nodiscard]] TER
+checkOptionalVaultInflow(SLE::ConstRef vault, STAmount const& amount);
+
+/**
+ * Open-zone capacity after adding roundedAmount: AssetsTotal + YieldUnrealized
+ * + roundedAmount, computed TowardsZero regardless of the caller's ambient
+ * rounding mode. Defined only for FixedPrecision Vaults.
+ *
+ * Shared by checkOptionalVaultInflow and LoanSet's loan-origination capacity
+ * check, which pair this formula with different scale checks (posterior vs.
+ * current), so only the capacity formula itself -- not the whole check -- is
+ * shared here.
+ *
+ * @param vault The vault SLE. Must be FixedPrecision.
+ * @param roundedAmount The amount to add, already rounded to the relevant
+ *                       posterior or base scale by the caller.
+ */
+[[nodiscard]] Number
+vaultOpenZoneCapacity(SLE::ConstRef vault, Number const& roundedAmount);
+
 /**
 * From the perspective of a vault, return the number of shares to give
 * depositor when they offer a fixed amount of assets. Note, since shares are
@@ -46,31 +276,93 @@ assetsToSharesDeposit(SLE::ConstRef vault, SLE::ConstRef issuance, STAmount cons
 sharesToAssetsDeposit(SLE::ConstRef vault, SLE::ConstRef issuance, STAmount const& shares);

 /**
- * Adjusts a requested asset change (`delta`) to match the decimal scale of the
- * updated total vault assets. This ensures `sfAssetsTotal`, `sfAssetsAvailable`,
+ * Adjusts a requested asset change (delta) to match the decimal scale of the
+ * updated total vault assets. This ensures sfAssetsTotal, sfAssetsAvailable,
 * and the actual asset transfer change by the exact same representable amount.
 *
 * Rounding strategy:
- * - Debits (withdrawals): Rounds down `|delta|` on the new scale to prevent
- *   paying out more than requested.
- * - Credits (deposits): Floors the resulting total asset balance and returns the
- *   difference from the current total. This prevents crediting the vault with
- *   more assets than the user deposited.
+ * - Legacy/CashBasis debits (withdrawals): rounds down the magnitude of delta
+ *   on the new scale to prevent paying out more than requested.
+ * - Legacy/CashBasis credits: floors the resulting total asset balance and
+ *   returns the difference from the current total.
+ * - FixedPrecision credits only (VaultDeposit): rounds the delta toward zero
+ *   at the scale getAssetsTotal (AssetsAvailable + AssetsDeployed, derived,
+ *   not the stored AssetsTotal cache) would have after applying delta.
+ *   FixedPrecision outflows (VaultWithdraw, VaultClawback) never call this;
+ *   they use clampVaultOutflow instead.
 *
 * Key rules:
- * - The returned magnitude never exceeds `|delta|`.
- * - Returns `tecPRECISION_LOSS` if the change is smaller than 1 ULP of the target scale
+ * - The returned magnitude never exceeds the magnitude of delta.
+ * - Returns tecPRECISION_LOSS if the change is smaller than 1 ULP of the target scale
 *   (prevents share operations when totals cannot change).
 * - For integer assets (XRP, MPT), rounding is a no-op.
 *
 * @param vault The vault ledger entry.
 * @param delta The requested signed change to sfAssetsTotal.
- * @return The rounded, positive magnitude, or `tecPRECISION_LOSS` if the
+ * @return The rounded, positive magnitude, or tecPRECISION_LOSS if the
 *         change is below representable precision.
 */
 [[nodiscard]] std::expected<STAmount, TER>
 clampToAssetsTotalScale(SLE::ConstRef vault, STAmount const& delta);

+/**
+ * Outflow clamp dispatcher for VaultWithdraw and VaultClawback: rounds a
+ * negative delta to the scale appropriate for the Vault's version -- for
+ * FixedPrecision, at AssetsAvailable's own posterior scale (the balance the
+ * cash actually leaves); for Legacy/CashBasis, clampToAssetsTotalScale --
+ * so both call sites share one dispatch point. Same tecPRECISION_LOSS and
+ * integral-asset and magnitude-never-exceeds-delta rules as
+ * clampToAssetsTotalScale.
+ *
+ * @param vault The vault ledger entry.
+ * @param delta The requested signed outflow (negative).
+ * @return The rounded, positive magnitude, or tecPRECISION_LOSS if the
+ *         change is below representable precision.
+ */
+[[nodiscard]] std::expected<STAmount, TER>
+clampVaultOutflow(SLE::ConstRef vault, STAmount const& delta);
+
+/**
+ * Returns the Vault's base exponent for asset at scale, before a Vault
+ * object exists to read it from: 0 for an integral asset, -scale otherwise.
+ * Used by VaultCreate::preclaim, which only has the proposed Scale field,
+ * not yet a Vault SLE; getVaultBaseScale is the post-creation equivalent.
+ *
+ * @param asset The (prospective) Vault's underlying asset.
+ * @param scale The (prospective) Vault's sfScale value, ignored for
+ *              integral assets.
+ */
+[[nodiscard]] int
+vaultBaseScale(Asset const& asset, std::uint8_t scale);
+
+/**
+ * Returns true iff value is exactly representable both as an STAmount of
+ * asset and on the base grid at baseScale (no precision lost rounding
+ * TowardsZero at baseScale). Returns false, rather than throwing, for a value
+ * out of range for the asset. Shared representability check for
+ * VaultCreate::preclaim, VaultSet::preclaim and LoanBrokerSet::preclaim's
+ * AssetsMaximum / DebtMaximum / cover-rate field checks.
+ *
+ * @param asset The vault's underlying asset.
+ * @param value The value to check.
+ * @param baseScale The vault's base exponent (see vaultBaseScale /
+ *                  getVaultBaseScale).
+ */
+[[nodiscard]] bool
+isOnVaultBaseGrid(Asset const& asset, Number const& value, int baseScale);
+
+/**
+ * Checks that a requested AssetsMaximum is exactly representable on the
+ * Vault's base grid, otherwise associateAsset would silently round the cap
+ * the owner asked for. Used by VaultSet::preclaim on an existing Vault.
+ *
+ * @param vault The vault ledger entry.
+ * @param amount The requested AssetsMaximum.
+ * @return tesSUCCESS, or tecPRECISION_LOSS if amount is not representable.
+ */
+[[nodiscard]] TER
+checkAssetsMaximum(SLE::ConstRef vault, Number const& amount);
+
 /**
 * Controls whether to truncate shares instead of rounding.
 */
@@ -98,21 +390,24 @@ enum class WaiveUnrealizedLoss : bool { No = false, Yes = true };
 assetsTotalForWithdrawal(SLE::ConstRef vault, WaiveUnrealizedLoss waive);

 /**
- * Returns true if debiting `amount` from `total` (the current value of a
- * vault's sfAssetsTotal or sfAssetsAvailable) would canonicalize to the
- * same STAmount value. This happens when `amount` is non-zero but too small
- * to change the stored total at STAmount's precision. Shares would still
- * move, so the ValidVault invariant would fail after apply; callers use
- * this to reject the transaction upfront instead.
+ * Reject a cash outflow that is dust (see debitIsNonZeroDust) or whose check
+ * overflows Number, which is easy to hit with a large Scale.
 *
- * @param asset The vault's underlying asset, used to canonicalize both
- *              sides the same way the ledger will when the field is stored.
- * @param total The field's current value.
- * @param amount The amount to debit. Zero always returns false; that case
- *               is rejected separately.
+ * @param vault The vault SLE.
+ * @param amount The amount to debit.
+ * @param j Journal for the debug log.
+ * @param name Transaction name used as the log prefix.
+ *
+ * @return tesSUCCESS; tecPRECISION_LOSS if amount is dust; tecPATH_DRY if the
+ *         check overflows. Overflow means the transaction cannot apply, but
+ *         ledger state is still consistent.
 */
-[[nodiscard]] bool
-debitIsNonZeroDust(Asset const& asset, Number const& total, Number const& amount);
+[[nodiscard]] TER
+checkDebitNotDust(
+    SLE::ConstRef vault,
+    Number const& amount,
+    beast::Journal j,
+    std::string_view name);

 /**
 * From the perspective of a vault, return the number of shares to demand from
@@ -158,7 +453,7 @@ sharesToAssetsWithdraw(
    WaiveUnrealizedLoss waive = WaiveUnrealizedLoss::No);

 /**
- * Returns true iff `account` holds all of the vault's outstanding shares —
+ * Returns true iff account holds all of the vault's outstanding shares,
 * i.e. is the sole remaining shareholder. Returns false if the account
 * holds no shares or fewer than the total outstanding.
 *
@@ -171,11 +466,13 @@ sharesToAssetsWithdraw(
 isSoleShareholder(ReadView const& view, AccountID const& account, SLE::ConstRef issuance);

 /**
- * Resolves a Vault's LEVersion, the single point every accounting touch
- * point should call to determine which recognition model (instant interest
- * recognition vs. cash-basis) a Vault uses. Vaults created before featureLendingProtocolV1_1
- * activated never have sfLEVersion set, which resolves here to
- * VaultVersion::Legacy.
+ * Resolves a Vault's LEVersion.
+ *
+ * LEVersion is the single point every accounting and rounding helper
+ * should call to decide which protocol a Vault follows. It is written
+ * at VaultCreate and is not updated afterwards, so a Vault created
+ * under an older amendment keeps that behaviour after later amendments
+ * activate. Absent sfLEVersion resolves to VaultVersion::Legacy.
 *
 * @param vault The vault SLE.
 *
@@ -185,6 +482,34 @@ isSoleShareholder(ReadView const& view, AccountID const& account, SLE::ConstRef
 [[nodiscard]] VaultVersion
 getVaultVersion(SLE::ConstRef vault);

+/**
+ * Decodes an already-extracted sfLEVersion value with the same range check as
+ * getVaultVersion. Usable from contexts, such as an invariant's ledger-entry
+ * snapshot, that keep the field value but not the owning SLE.
+ *
+ * @param leVersion The value of sfLEVersion, or nullopt if absent.
+ *
+ * @return The decoded LEVersion, or VaultVersion::Legacy if absent.
+ */
+[[nodiscard]] VaultVersion
+decodeVaultVersion(std::optional<std::uint8_t> leVersion);
+
+/**
+ * Resolves which LEVersion a newly-created Vault should get under the
+ * currently active amendments. This is the only place that decides Vault
+ * version policy; VaultCreate calls it instead of checking amendments
+ * directly.
+ *
+ * @param rules The active ledger rules.
+ *
+ * @return VaultVersion::FixedPrecision once featureLendingProtocolV1_1,
+ * featureLendingProtocolV1_2 and fixCleanup3_4_0 are all enabled;
+ * VaultVersion::CashBasis
+ * once featureLendingProtocolV1_1 is enabled; VaultVersion::Legacy otherwise.
+ */
+[[nodiscard]] VaultVersion
+getVaultDefaultVersion(Rules const& rules);
+
 /**
 * Resolves the VaultKind of a vault SLE. Returns VaultKind::ClosedEnded when
 * sfVaultKind is present and equal to that value; anything else (including an
@@ -348,16 +348,19 @@ isAuditorMirrorCurrent(SLE const& issuance, SLE const& mptoken);
 areMirrorsCurrent(SLE const& issuance, SLE const& mptoken);

 /**
- * @brief Set the holder's issuer mirror epoch to match the issuance's current issuer key epoch.
+ * @brief Set the holder's issuer mirror epoch, and the issuer mirror key, to match the issuance's
+ * current key.
 *
 * Call this after writing the issuer mirror ciphertext under the issuance's
 * currently registered issuer key, so that the mirror reads as current afterwards.
+ * Also records sfIssuerMirrorEncryptionKey as the issuance's current issuer key
+ * (both fields stay absent at epoch 0, where the original issuer key applies).
 *
 * @param issuance The MPTokenIssuance ledger object.
 * @param mptoken  The holder's MPToken ledger entry to update.
 */
 void
-setIssuerMirrorEpoch(SLE const& issuance, SLE& mptoken);
+setIssuerMirrorCurrent(SLE const& issuance, SLE& mptoken);

 /**
 * @brief Set the holder's auditor mirror epoch to match the issuance's current auditor key epoch.
@@ -372,16 +375,18 @@ void
 setAuditorMirrorEpoch(SLE const& issuance, SLE& mptoken);

 /**
- * @brief Set the holder's MPToken mirror epochs to match the issuance's current key epochs.
+ * @brief Set the holder's MPToken mirror epochs, and the issuer mirror key, to match the issuance's
+ * current keys.
 *
 * Call this after writing mirror ciphertexts under the issuance's currently
- * registered keys, so that the mirrors read as current afterwards.
+ * registered keys, so that the mirrors read as current afterwards. Also records
+ * sfIssuerMirrorEncryptionKey via setIssuerMirrorCurrent.
 *
 * @param issuance The MPTokenIssuance ledger object.
 * @param mptoken  The holder's MPToken ledger entry to update.
 */
 void
-setMirrorEpochs(SLE const& issuance, SLE& mptoken);
+setMirrorsCurrent(SLE const& issuance, SLE& mptoken);

 /**
 * @brief Verifies revealed amount encryptions for all recipients.
@@ -75,6 +75,11 @@ struct Fees
    Fees&
    operator=(Fees const&) = default;

+    Fees(XRPAmount base, XRPAmount reserve, XRPAmount increment)
+        : base{base}, reserve{reserve}, increment{increment}
+    {
+    }
+
    Fees(
        XRPAmount base,
        XRPAmount reserve,
@@ -251,12 +251,6 @@ page(Keylet const& root, std::uint64_t const index = 0) noexcept
 Keylet
 escrow(AccountID const& src, SeqProxy const& seq) noexcept;

-inline Keylet
-escrow(uint256 const& key) noexcept
-{
-    return {ltESCROW, key};
-}
-
 /**
 * A PaymentChannel
 */
@@ -81,7 +81,7 @@ PathAsset::holds() const
 }

 template <ValidPathAsset T>
-[[nodiscard]] T const&
+[[nodiscard]] [[nodiscard]] T const&
 PathAsset::get() const
 {
    if (!holds<T>())
@@ -311,24 +311,46 @@ constexpr std::uint8_t kVaultStrategyFirstComeFirstServe = 1;
 * Default IOU scale factor for a Vault
 */
 constexpr std::uint8_t kVaultDefaultIouScale = 6;
-/**
- * Maximum scale factor for a Vault. The number is chosen to ensure that
- * 1 IOU can be always converted to shares.
- * 10^19 > maxMPTokenAmount (2^64-1) > 10^18
- */
-constexpr std::uint8_t kVaultMaximumIouScale = 18;

 /**
- * Vault ledger-entry schema versions. Assigned to newly created
- * Vaults once featureLendingProtocolV1_1 is enabled. Vaults created before
- * activation are left without LEVersion (implicit legacy version 0,
- * instant interest recognition).
+ * Maximum Scale for a Vault created before featureLendingProtocolV1_2.
+ * Chosen so 1 IOU can always convert to shares:
+ * 10^19 > maxMPTokenAmount (2^64-1) > 10^18.
+ */
+constexpr std::uint8_t kLegacyVaultMaximumIouScale = 18;
+
+/**
+ * Maximum Scale for a Vault created under featureLendingProtocolV1_2.
+ */
+constexpr std::uint8_t kFixedPrecisionVaultMaximumIouScale = 10;
+
+/**
+ * Vault ledger-entry schema versions, persisted as sfLEVersion.
+ *
+ * LEVersion records which protocol a Vault was created under so later
+ * amendments can change the rules for new Vaults without rewriting
+ * existing ones. VaultCreate writes it from the then-active lending
+ * amendments; later transactions do not update it. A Vault created
+ * under an older amendment keeps that amendment's behaviour for its
+ * lifetime, even after a newer lending amendment activates.
+ *
+ * Absent sfLEVersion is implicit Legacy (version 0): instant interest
+ * recognition and a dynamic AssetsTotal scale. CashBasis (V1.1) uses
+ * cash-basis recognition on the same dynamic scale. FixedPrecision
+ * (V1.2) keeps cash-basis recognition and adds the lifetime base grid.
 */
 enum class VaultVersion : uint8_t {
    Legacy = 0,
    CashBasis,
+    FixedPrecision,
 };

+// Code compares VaultVersion values with < and >= (e.g. "CashBasis or later"),
+// so each later version must stay numerically larger than the one before.
+static_assert(
+    VaultVersion::Legacy < VaultVersion::CashBasis &&
+    VaultVersion::CashBasis < VaultVersion::FixedPrecision);
+
 /**
 * Vault kind. Distinguishes closed-ended vaults from the default open-ended
 * kind. Persisted as sfVaultKind (UINT8); absent means OpenEnded.
@@ -381,11 +403,6 @@ constexpr std::uint8_t kMaxAssetCheckDepth = 5;
 */
 constexpr std::size_t kMaxWasmDataLength = 1 * 1024;  // 1KB

-/**
- * Maximum amount of data transfer across hostfunction<->wasm border.
- */
-constexpr std::size_t kWasmTransferLimit = 1 << 20;  // 1MB
-
 /**
 * A ledger index.
 */
@@ -696,6 +696,16 @@ divRound(STAmount const& v1, STAmount const& v2, Asset const& asset, bool roundU
 STAmount
 divRoundStrict(STAmount const& v1, STAmount const& v2, Asset const& asset, bool roundUp);

+/**
+ * Returns amt * num / den, rounded in the requested direction.
+ *
+ * Dispatches to the XRPAmount, IOUAmount or MPTAmount overload. XRP and MPT
+ * results are exact; an IOU result is rounded to the 16-digit mantissa in the
+ * requested direction. Only Upward and Downward are supported.
+ */
+[[nodiscard]] STAmount
+mulRatio(STAmount const& amt, std::uint32_t num, std::uint32_t den, Number::RoundingMode rounding);
+
 // Someone is offering X for Y, what is the rate?
 // Rate: smaller is better, the taker wants the most out: in/out
 // VFALCO TODO Return a Quality object
@@ -133,7 +133,6 @@ enum TEMcodes : TERUnderlyingType {
    temBAD_MPT,
    temBAD_CIPHERTEXT,
    temINVALID_BYTECODE,
-    temTEMP_DISABLED,
 };

 //------------------------------------------------------------------------------
@@ -184,6 +183,8 @@ enum TEFcodes : TERUnderlyingType {
    tefBAD_PATH_COUNT,
    tefNO_BYTECODE,
    tefBYTECODE_NOT_INCLUDED,
+    tefTEMP_DISABLED,
+    tefEXCEEDS_LIMIT,
 };

 //------------------------------------------------------------------------------
@@ -231,6 +232,8 @@ enum TERcodes : TERUnderlyingType {
    terNO_DELEGATE_PERMISSION,  // Delegate does not have permission
    terLOCKED,                  // MPT is locked
    terNO_PERMISSION,           // No permission but retry
+    terTICKET_RESERVED,         // Ticket is reserved and cannot be consumed
+                                // until the reservation is released
 };

 //------------------------------------------------------------------------------
@@ -97,12 +97,6 @@ public:

        if (obj.isFieldPresent(sfParentBatchID))
            parentBatchID_ = obj.getFieldH256(sfParentBatchID);
-
-        if (obj.isFieldPresent(sfGasUsed))
-            gasUsed_ = obj.getFieldU32(sfGasUsed);
-
-        if (obj.isFieldPresent(sfVMReturnCode))
-            vmReturnCode_ = obj.getFieldI32(sfVMReturnCode);
    }

    [[nodiscard]] std::optional<STAmount> const&
@@ -123,30 +117,6 @@ public:
        parentBatchID_ = id;
    }

-    void
-    setGasUsed(std::optional<std::uint32_t> const gasUsed)
-    {
-        gasUsed_ = gasUsed;
-    }
-
-    [[nodiscard]] std::optional<std::uint32_t> const&
-    getGasUsed() const
-    {
-        return gasUsed_;
-    }
-
-    void
-    setVMReturnCode(std::optional<std::int32_t> const vmReturnCode)
-    {
-        vmReturnCode_ = vmReturnCode;
-    }
-
-    [[nodiscard]] std::optional<std::int32_t> const&
-    getVMReturnCode() const
-    {
-        return vmReturnCode_;
-    }
-
    [[nodiscard]] std::flat_set<MPTID>
    getAffectedMPTs() const;

@@ -158,8 +128,6 @@ private:

    std::optional<STAmount> deliveredAmount_;
    std::optional<UInt256> parentBatchID_;
-    std::optional<std::uint32_t> gasUsed_;
-    std::optional<std::int32_t> vmReturnCode_;

    STArray nodes_;
 };
@@ -1,5 +1,6 @@
 #pragma once

+#include <xrpl/basics/MathUtilities.h>
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Zero.h>
@@ -69,7 +70,13 @@ public:
    constexpr XRPAmount
    operator*(value_type const& rhs) const
    {
-        return XRPAmount{drops_ * rhs};
+        if (auto const result = checkedMul(drops_, rhs))
+            return XRPAmount{*result};
+        // Not reached in constant evaluation: an overflowing constant
+        // expression fails to compile instead.
+        XRPAmount product{*this};
+        product *= rhs;
+        return product;
    }

    friend constexpr XRPAmount
@@ -82,37 +89,23 @@ public:
    XRPAmount&
    operator+=(XRPAmount const& other)
    {
-        drops_ += other.drops();
-        return *this;
+        return *this += other.drops();
    }

    XRPAmount&
    operator-=(XRPAmount const& other)
    {
-        drops_ -= other.drops();
-        return *this;
+        return *this -= other.drops();
    }

    XRPAmount&
-    operator+=(value_type const& rhs)
-    {
-        drops_ += rhs;
-        return *this;
-    }
+    operator+=(value_type const& rhs);

    XRPAmount&
-    operator-=(value_type const& rhs)
-    {
-        drops_ -= rhs;
-        return *this;
-    }
+    operator-=(value_type const& rhs);

    XRPAmount&
-    operator*=(value_type const& rhs)
-    {
-        drops_ *= rhs;
-        return *this;
-    }
+    operator*=(value_type const& rhs);

    XRPAmount
    operator-() const
@@ -120,7 +113,7 @@ public:
        return XRPAmount{-drops_};
    }

-    bool constexpr
+    bool
    operator==(XRPAmount const& other) const
    {
        return drops_ == other.drops_;
@@ -17,6 +17,7 @@

 XRPL_FEATURE(Cosign,                      Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(SmartEscrow,                 Supported::No,  VoteBehavior::DefaultNo)
+// Requires LendingProtocolV1_1. New vaults take FixedPrecision plus cash-basis.
 XRPL_FEATURE(LendingProtocolV1_2,         Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_5_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ConfidentialMPTKeyRotation,  Supported::No,  VoteBehavior::DefaultNo)
@@ -60,7 +61,6 @@ XRPL_FIX    (InnerObjTemplate2,          Supported::Yes, VoteBehavior::DefaultNo
 XRPL_FIX    (EnforceNFTokenTrustline,    Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (ReducedOffersV2,            Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(NFTokenMintOffer,           Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (AMMv1_1,                    Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (PreviousTxnID,              Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (XChainRewardRounding,       Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (EmptyDID,                   Supported::Yes, VoteBehavior::DefaultNo)
@@ -106,6 +106,7 @@ XRPL_RETIRE_FIX(1623)
 XRPL_RETIRE_FIX(1781)
 XRPL_RETIRE_FIX(AmendmentMajorityCalc)
 XRPL_RETIRE_FIX(AMMOverflowOffer)
+XRPL_RETIRE_FIX(AMMv1_1)
 XRPL_RETIRE_FIX(CheckThreading)
 XRPL_RETIRE_FIX(DisallowIncomingV1)
 XRPL_RETIRE_FIX(InnerObjTemplate)
@@ -417,6 +417,7 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
    {sfAuditorEncryptionKey,     SoeOptional},
    {sfIssuerKeyEpoch,           SoeOptional},
    {sfAuditorKeyEpoch,          SoeOptional},
+    {sfInitialIssuerEncryptionKey, SoeOptional},
    {sfConfidentialOutstandingAmount, SoeDefault},
 }))

@@ -438,6 +439,7 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
    {sfAuditorEncryptedBalance,     SoeOptional},
    {sfIssuerKeyMirrorEpoch,        SoeOptional},
    {sfAuditorKeyMirrorEpoch,       SoeOptional},
+    {sfIssuerMirrorEncryptionKey,   SoeOptional},
    {sfHolderEncryptionKey,         SoeOptional},
    {sfRecoveryKey,                 SoeOptional},
 }))
@@ -514,6 +516,8 @@ LEDGER_ENTRY(ltVAULT, 0x0084, Vault, vault, ({
    {sfAssetsAvailable,      SoeDefault},
    {sfAssetsMaximum,        SoeDefault},
    {sfLossUnrealized,       SoeDefault},
+    {sfYieldUnrealized,      SoeDefault},
+    {sfAssetsDeployed,       SoeDefault},
    {sfShareMPTID,           SoeRequired},
    {sfWithdrawalPolicy,     SoeRequired},
    {sfScale,                SoeDefault},
@@ -240,6 +240,8 @@ TYPED_SFIELD(sfPrincipalRequested,       NUMBER,     14)
 TYPED_SFIELD(sfTotalValueOutstanding,    NUMBER,     15, SField::kSmdNeedsAsset | SField::kSmdDefault)
 TYPED_SFIELD(sfPeriodicPayment,          NUMBER,     16)
 TYPED_SFIELD(sfManagementFeeOutstanding, NUMBER,     17, SField::kSmdNeedsAsset | SField::kSmdDefault)
+TYPED_SFIELD(sfYieldUnrealized,          NUMBER,     18, SField::kSmdNeedsAsset | SField::kSmdDefault)
+TYPED_SFIELD(sfAssetsDeployed,           NUMBER,     19, SField::kSmdNeedsAsset | SField::kSmdDefault)

 // 32-bit signed (common)
 TYPED_SFIELD(sfLoanScale,                INT32,      1)
@@ -331,6 +333,8 @@ TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
 TYPED_SFIELD(sfBytecode,                    VL,     47)
 TYPED_SFIELD(sfRecoveryKey,                 VL,     48)
+TYPED_SFIELD(sfInitialIssuerEncryptionKey,  VL,     49)
+TYPED_SFIELD(sfIssuerMirrorEncryptionKey,   VL,     50)

 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)
@@ -1175,6 +1175,20 @@ TRANSACTION(ttTRANSACTION_PROPOSAL_CREATE, 95, TransactionProposalCreate,
    {sfExpiration, SoeRequired},
 }))

+// ttTRANSACTION_PROPOSAL_SIGN arrives in a later PR and takes the next unassigned type.
+
+/** This transaction deletes a TransactionProposal, releasing its owner's
+    reserve. While the proposal is live only its Owner or its target account
+    may cancel; once it is terminal anyone may (On-Chain Cosigner spec §7). */
+#if TRANSACTION_INCLUDE
+#   include <xrpl/tx/transactors/proposal/TransactionProposalCancel.h>
+#endif
+TRANSACTION(ttTRANSACTION_PROPOSAL_CANCEL, 94, TransactionProposalCancel,
+    ({.amendment = featureCosign}),
+    ({
+    {sfProposalID, SoeRequired},
+}))
+
 /** This system-generated transaction type is used to update the status of the various amendments.

    For details, see: https://xrpl.org/amendments.html
@@ -316,6 +316,30 @@ public:
        return this->sle_->isFieldPresent(sfAuditorKeyMirrorEpoch);
    }

+    /**
+     * @brief Get sfIssuerMirrorEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getIssuerMirrorEncryptionKey() const
+    {
+        if (hasIssuerMirrorEncryptionKey())
+            return this->sle_->at(sfIssuerMirrorEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfIssuerMirrorEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasIssuerMirrorEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfIssuerMirrorEncryptionKey);
+    }
+
    /**
     * @brief Get sfHolderEncryptionKey (SoeOptional)
     * @return The field value, or std::nullopt if not present.
@@ -565,6 +589,17 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfIssuerMirrorEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenBuilder&
+    setIssuerMirrorEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfIssuerMirrorEncryptionKey] = value;
+        return *this;
+    }
+
    /**
     * @brief Set sfHolderEncryptionKey (SoeOptional)
     * @return Reference to this builder for method chaining.
@@ -399,6 +399,30 @@ public:
        return this->sle_->isFieldPresent(sfAuditorKeyEpoch);
    }

+    /**
+     * @brief Get sfInitialIssuerEncryptionKey (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getInitialIssuerEncryptionKey() const
+    {
+        if (hasInitialIssuerEncryptionKey())
+            return this->sle_->at(sfInitialIssuerEncryptionKey);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfInitialIssuerEncryptionKey is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasInitialIssuerEncryptionKey() const
+    {
+        return this->sle_->isFieldPresent(sfInitialIssuerEncryptionKey);
+    }
+
    /**
     * @brief Get sfConfidentialOutstandingAmount (SoeDefault)
     * @return The field value, or std::nullopt if not present.
@@ -670,6 +694,17 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfInitialIssuerEncryptionKey (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setInitialIssuerEncryptionKey(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfInitialIssuerEncryptionKey] = value;
+        return *this;
+    }
+
    /**
     * @brief Set sfConfidentialOutstandingAmount (SoeDefault)
     * @return Reference to this builder for method chaining.
@@ -242,6 +242,54 @@ public:
        return this->sle_->isFieldPresent(sfLossUnrealized);
    }

+    /**
+     * @brief Get sfYieldUnrealized (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_NUMBER::type::value_type>
+    getYieldUnrealized() const
+    {
+        if (hasYieldUnrealized())
+            return this->sle_->at(sfYieldUnrealized);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfYieldUnrealized is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasYieldUnrealized() const
+    {
+        return this->sle_->isFieldPresent(sfYieldUnrealized);
+    }
+
+    /**
+     * @brief Get sfAssetsDeployed (SoeDefault)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_NUMBER::type::value_type>
+    getAssetsDeployed() const
+    {
+        if (hasAssetsDeployed())
+            return this->sle_->at(sfAssetsDeployed);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAssetsDeployed is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAssetsDeployed() const
+    {
+        return this->sle_->isFieldPresent(sfAssetsDeployed);
+    }
+
    /**
     * @brief Get sfShareMPTID (SoeRequired)
     * @return The field value.
@@ -571,6 +619,28 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfYieldUnrealized (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    VaultBuilder&
+    setYieldUnrealized(std::decay_t<typename SF_NUMBER::type::value_type> const& value)
+    {
+        object_[sfYieldUnrealized] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAssetsDeployed (SoeDefault)
+     * @return Reference to this builder for method chaining.
+     */
+    VaultBuilder&
+    setAssetsDeployed(std::decay_t<typename SF_NUMBER::type::value_type> const& value)
+    {
+        object_[sfAssetsDeployed] = value;
+        return *this;
+    }
+
    /**
     * @brief Set sfShareMPTID (SoeRequired)
     * @return Reference to this builder for method chaining.
Author	SHA1	Message	Date
Alex KremerandAyaz Salikhov	3608433514	test: Check error consistently in rpc handlers (#8604 ) Co-authored-by: Ayaz Salikhov <[email protected]>	2026-10-19 16:17:30 +00:00
Nik Bougalis	7939339a65	chore: Fix an issue that breaks CLion (#8619 )	2026-10-17 22:43:53 +00:00
Chenna Keshava B S Shawn Xie Kassaking7 Shawn Xie Zhiyuan Wang Claude Fable 5.1 Copilot Autofix powered by AI	4ea2db2eda	feat: Add TransactionProposal invariants for Cosign (#8130 ) Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Kassaking7 <[email protected]> Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Zhiyuan Wang <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>	2026-10-16 20:59:53 +00:00
Ayaz Salikhov	d4ffe32534	ci: Fix release/staging branches running conditions (#8615 )	2026-10-16 17:06:19 +00:00
Gregory Tsipenyuk	7354816f65	fix: Assorted MPT/DEX offer related fixes - 1 (#8468 )	2026-10-16 16:28:05 +00:00
Gregory Tsipenyuk	12cb3932f3	fix: Check vault share freeze at MPT strand endpoints (#8478 )	2026-10-16 15:26:00 +00:00
Gregory Tsipenyuk	dc64a8daac	fix: Allow IOU rounding in Clawback invariant balance check (#8475 )	2026-10-16 15:25:03 +00:00
Nik Bougalis	dc524e9cc6	refactor: Optimize the binary layout of Number (#8550 )	2026-10-16 15:20:01 +00:00
Alex KremerandAyaz Salikhov	4060b1bcd4	refactor: Migrate handlers to rpc-spec (D) (#8573 ) Co-authored-by: Ayaz Salikhov <[email protected]>	2026-10-16 14:06:30 +00:00
Mayukha Vadari	bfbb440fc2	feat: Handle Smart Escrow's Bytecode, Data and Gas fields (#8215 )	2026-10-16 13:03:48 +00:00
BartandBart	4087861411	fix: Refuse to walk an invalid SHAMap in getMissingNodes (#8086 ) Co-authored-by: Bart <[email protected]>	2026-10-16 05:47:08 +00:00
BartandBart	dc43faafed	fix: Refuse to make an invalid SHAMap or Ledger immutable (#8085 ) Co-authored-by: Bart <[email protected]>	2026-10-16 05:47:07 +00:00
Bart Bart Claude Fable 5.1	6af97c07d9	fix: Report a node the sync path refuses as invalid data (#8084 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>	2026-10-16 05:47:06 +00:00
Bart Bart Claude Fable 5.1	4c7d920e66	fix: Make the SHAMap sync-path state atomic (#8083 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>	2026-10-16 05:47:06 +00:00
yinyiqian1	8b59d9d307	docs: Add todo comment for key rotation zkproof (#8589 )	2026-10-16 00:11:06 +00:00
Bart Bart Claude Fable 5.1	b0fa295595	fix: Judge a header's account hash on both acquisition routes (#8476 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>	2026-10-15 21:00:21 +00:00
BartandBart	9af432cb0e	fix: Signal every InboundLedger failure found in local data (#8082 ) Co-authored-by: Bart <[email protected]>	2026-10-15 21:00:20 +00:00
BartandBart	4435ca4cbf	refactor: Add a reusable peer harness for acquisition tests (#8310 ) Co-authored-by: Bart <[email protected]>	2026-10-15 21:00:19 +00:00
Olek	cd72a11786	refactor: TxQ (#8064 )	2026-10-15 18:11:46 +00:00
Peter Chen	b398b88385	fix: Reject a zero credential ID in deposit_authorized (#8533 )	2026-10-15 18:11:18 +00:00
Olek	31f6f90206	feat: Add IssuerMirrorEncryptionKey and InitialIssuerEncryptionKey (#8325 )	2026-10-15 18:04:29 +00:00
Olek	1d8c2f9172	test: Sponsor checkSign additional tests (#8331 )	2026-10-15 18:03:48 +00:00
Vito Tumas Jingchen Alex Kremer	f105418bdb	feat: Book FixedPrecision LoanPay and LoanManage (#8271 ) Co-authored-by: Jingchen <[email protected]> Co-authored-by: Alex Kremer <[email protected]>	2026-10-15 18:02:36 +00:00
Ayaz Salikhov	4a134eb883	docs: Clarify OS and toolchain requirements (#8588 )	2026-10-15 17:58:11 +00:00
Ayaz Salikhov	ec3f251ad8	ci: Fix running pre-commit after clang-tidy (#8601 )	2026-10-15 16:15:35 +00:00
Mayukha Vadari	5faa861226	feat: Add Smart Escrow fee voting (#8214 )	2026-10-15 15:50:16 +00:00
Jingchen	88fd1222d6	build: Fix unity build by addressing name clashes (#8599 )	2026-10-15 12:59:20 +00:00
Ayaz SalikhovandEd Hennis	f1ce9449f2	fix: Skip bootstrap DNS lookups in standalone mode (#8583 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-14 21:02:45 +00:00
Timur Yalymov	7237b3321c	fix: Charge transfer fee on third-party vault withdrawals (#8267 )	2026-10-14 16:35:42 +00:00
Timur Yalymov	84d980d883	fix: Reject VaultClawback with a nonexistent holder (#8470 )	2026-10-14 14:29:05 +00:00
Timur YalymovandVito Tumas	791c96faad	fix: Enforce pseudo-account directory contents with an invariant (#8181 ) Co-authored-by: Vito Tumas <[email protected]>	2026-10-14 13:51:24 +00:00
Ayaz Salikhov	31473e7e6d	build: Unify clang variables (#8581 )	2026-10-14 13:51:05 +00:00
Timur YalymovandVito Tumas	aa70b368b5	fix: Enforce asset authorization on LoanBrokerDelete (#8204 ) Co-authored-by: Vito Tumas <[email protected]>	2026-10-14 13:51:05 +00:00
Vito TumasandJingchen	d3db569b34	feat: Book FixedPrecision LoanSet through AssetsDeployed (#8260 ) Co-authored-by: Jingchen <[email protected]>	2026-10-14 13:20:58 +00:00
Vito TumasandJingchen	94d6b7daf8	feat: Round LoanBroker cover on the FixedPrecision grid (#8258 ) Co-authored-by: Jingchen <[email protected]>	2026-10-14 12:59:39 +00:00
Vito TumasandJingchen	e089abe982	feat: Use FixedPrecision accounting in Vault transactors (#8460 ) Co-authored-by: Jingchen <[email protected]>	2026-10-14 12:52:25 +00:00
Alex Kremer	33289e882b	refactor: Migrate handlers to rpc-spec (C) (#8561 )	2026-10-14 10:15:32 +00:00
Gregory Tsipenyuk Claude Opus 5.5 Ed Hennis	1ed0bccb07	fix: Clamp invalid XRP amounts in Quality::ceilOut & getBookPage (#8480 ) Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Ed Hennis <[email protected]>	2026-10-14 07:49:27 +00:00
Gregory TsipenyukandEd Hennis	1da55e3989	fix: Waive CanTransfer on loan default and broker delete (#8231 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-14 07:49:12 +00:00
Valentin Balaschenkoandxrplf-ai-reviewer[bot]	166e97e12b	refactor: Decouple LedgerHistory from TaggedCache internals (#5874 ) Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>	2026-10-13 23:33:32 +00:00
Chenna Keshava B S Shawn Xie Kassaking7 Shawn Xie Zhiyuan Wang Claude Fable 5	33e5a6fa7c	feat: Add TransactionProposalCancel & Cosign Ticket reservation (#8538 ) Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Kassaking7 <[email protected]> Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Zhiyuan Wang <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]>	2026-10-13 19:07:45 +00:00
Ayaz Salikhov	b1f9dc6919	ci: Fix rpm installation problems (#8575 )	2026-10-13 18:46:41 +00:00
Ayaz Salikhov	38965af055	docs: Clarify freeze on large changes 2 weeks before first RC (#8574 )	2026-10-13 18:43:24 +00:00
Gregory TsipenyukandEd Hennis	b010d4a563	refactor: Retire fixAMMv1_1 amendment (#8226 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 18:03:10 +00:00
dependabot[bot]	eedd6604d1	chore: [DEPENDABOT] bump pyparsing from 3.3.2 to 3.3.3 in /cmake/scripts/codegen in the codegen-dependencies group (#8572 ) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-13 17:48:57 +00:00
Mayukha Vadari	59ff04b648	fix: Allow WASM transactions in simulate only in admin mode (#8568 )	2026-10-13 17:39:32 +00:00
Gregory TsipenyukandEd Hennis	fcb3ee6425	fix: Detect int64 overflow in XRPAmount and MPTAmount (#8453 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 17:35:35 +00:00
Gregory TsipenyukandEd Hennis	77eacbb52c	fix: Assorted MPT/DEX offer related fixes (#8211 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 17:18:47 +00:00
Vito TumasandJingchen	5ce85b2799	feat: Add FixedPrecision Vault grid and balance helpers (#8257 ) Co-authored-by: Jingchen <[email protected]>	2026-10-13 16:19:08 +00:00
Ayaz Salikhov	4538d198e1	build: Update codegen requirements (#8570 )	2026-10-13 14:29:59 +00:00