Make ApplyFlags a scoped enumeration

Convert ApplyFlags to a scoped enum, drop the now-redundant `Tap` prefix from its enumerators and replace the hand-written bitwise operators by opting in to enum_bitops. No functional change.
Make the path element type a scoped enumeration
2026-10-26 21:47:06 +00:00 · 2026-10-26 07:00:19 -07:00 · 2026-10-26 07:00:19 -07:00 · 2026-10-26 07:00:18 -07:00 · 2026-10-26 12:12:39 +00:00 · 2026-10-23 19:28:52 +00:00
846 changed files with 57892 additions and 39407 deletions
@@ -76,7 +76,6 @@ Checks: "-*,
  -readability-redundant-nested-if,
  -readability-redundant-qualified-alias,
  -readability-static-accessed-through-instance,
-  -readability-trailing-comma,
  -readability-trivial-switch,
  -readability-uppercase-literal-suffix
  "
@@ -93,10 +92,6 @@ CheckOptions:
  bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
  bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc

-  # New in clang-tidy 23; disabled until the code is updated
-  misc-const-correctness.AnalyzeAutoVariables: false
-  misc-const-correctness.AnalyzeLambdas: false
-  misc-const-correctness.AnalyzeParameters: false
  misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/.*;openssl/obj_mac\\.h"

  readability-braces-around-statements.ShortStatementLines: 2
@@ -145,5 +140,9 @@ CheckOptions:
  readability-identifier-naming.GlobalFunctionIgnoredRegexp: "^(to_string|hash_append|tuple_hash)$"

 HeaderFilterRegex: '^.*/(tests?|xrpl|xrpld)/.*\.(h|hpp|ipp)$'
-ExcludeHeaderFilterRegex: '^.*/protocol_autogen/.*\.(h|hpp)$|^.*\.pb\.h$'
+# Skip headers reached via add_module's symlinks (<build-dir>/modules/xrpl.lib*/...).
+# verify_headers already checks each one under its real path,
+# so reporting it twice would also apply its fixes twice.
+# .ipp files are kept: they are only ever reached via the symlink.
+ExcludeHeaderFilterRegex: '^.*/protocol_autogen/.*\.(h|hpp)$|^.*\.pb\.h$|^.*/modules/xrpl\.lib[^/]+/.*\.(h|hpp)$'
 WarningsAsErrors: "*"
@@ -103,6 +103,7 @@ words:
  - dearmor
  - decryptor
  - dedented
+  - dedup
  - deleteme
  - demultiplexer
  - deserializaton
@@ -197,6 +198,7 @@ words:
  - mptokens
  - mpts
  - mtgox
+  - mudhra
  - multisig
  - multisign
  - multisigned
@@ -317,7 +319,6 @@ words:
  - sttx
  - stvar
  - stvector
-  - stxchainattestations
  - summands
  - superpeer
  - superpeers
@@ -344,6 +345,7 @@ words:
  - unambiguity
  - unauthorizes
  - unauthorizing
+  - undeserializable
  - unergonomic
  - unfetched
  - unfindable
@@ -375,7 +377,6 @@ words:
  - writeme
  - wsrch
  - wthread
-  - xbridge
  - xchain
  - xcrun
  - ximinez
@@ -30,7 +30,7 @@ runs:

  steps:
    - name: Use cargo artifacts cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
      with:
        cache-bin: "false"
        cache-directories: ${{ inputs.cache-directories }}
@@ -36,3 +36,18 @@ updates:
      rust-dependencies:
        patterns:
          - "*"
+
+  - package-ecosystem: uv
+    directory: /cmake/scripts/codegen
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Etc/GMT
+    commit-message:
+      prefix: "chore: [DEPENDABOT] "
+    target-branch: develop
+    groups:
+      codegen-dependencies:
+        patterns:
+          - "*"
@@ -62,6 +62,7 @@ libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
+test.app > tests.libxrpl
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-3d526d4",
+  "image_tag": "sha-d3a71b2",
  "configs": {
    "ubuntu": [
      {
@@ -74,7 +74,7 @@
        "extra_cmake_args": "-Dvalidator_keys=ON",
        "package": {
          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-d3a71b2"
        }
      },
      {
@@ -86,7 +86,7 @@
        "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
        "package": {
          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-d3a71b2",
          "variant": "assert"
        }
      }
@@ -101,7 +101,7 @@
        "extra_cmake_args": "-Dvalidator_keys=ON",
        "package": {
          "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-d3a71b2"
        }
      }
    ]
@@ -24,6 +24,7 @@ on:
      - "!nix/devshell.nix"
      - "!nix/check-tools/**"
      - "bin/check-tools.sh"
+      - "bin/check-distrusted-roots.sh"
      - "bin/nix/default-loader-path.sh"
      - "bin/install/sanitizer-libs.sh"
  workflow_dispatch:
@@ -10,6 +10,7 @@ on:
  pull_request:
    paths:
      - ".github/workflows/build-packaging-images.yml"
+      - "bin/check-distrusted-roots.sh"
      - "bin/install/packaging-tools.sh"
      - "package/images/packaging/**"
  workflow_dispatch:
@@ -10,6 +10,7 @@ on:
  pull_request:
    paths:
      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/check-distrusted-roots.sh"
      - "bin/pre-commit/Dockerfile"
      - "rust-toolchain.toml"
  workflow_dispatch:
@@ -8,6 +8,7 @@ on:
    branches:
      - "develop"
      - "release/*"
+      - "staging/*"
    paths:
      - "crates/**/Cargo.toml"
      - "crates/Cargo.lock"
@@ -34,7 +35,7 @@ permissions:
 jobs:
  audit:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
    permissions:
      contents: read
      # Needed to open an issue on scheduled failures.
@@ -66,7 +67,7 @@ jobs:

      - name: Create issue
        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
+        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
        with:
          title: "cargo audit found vulnerabilities"
          body_file: /tmp/cargo-audit-issue.md
@@ -53,7 +53,7 @@ jobs:

      - name: Create issue
        if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'XRPLF/rippled' }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
+        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
        with:
          title: "Releases not merged back into develop"
          body_file: ${{ env.ISSUE_FILE }}
@@ -79,7 +79,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

@@ -108,7 +108,7 @@ jobs:

      - name: Upload regenerated snapshot
        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: check-tools-${{ runner.os }}-${{ runner.arch }}
          path: ${{ matrix.snapshot }}
@@ -243,7 +243,7 @@ jobs:
      - should-run
      - build-test
    # Only run when committing to a PR that targets a release branch.
-    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
+    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') }}
    uses: ./.github/workflows/reusable-upload-recipe.yml
    secrets:
      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
@@ -1,14 +1,16 @@
 # This workflow runs all workflows to build and test the code on various Linux
 # flavors, as well as on MacOS and Windows, on a scheduled basis, on merge into
-# the 'develop' or 'release*' branches, or when requested manually. Upon pushes
-# to the develop branch it also uploads the libxrpl recipe to the Conan remote.
+# the 'develop', 'release/*' or 'staging/*' branches, or when requested
+# manually. Upon pushes to the develop branch, it also uploads the libxrpl
+# recipe to the Conan remote.
 name: Trigger

 on:
  push:
    branches:
      - "develop"
-      - "release*"
+      - "release/*"
+      - "staging/*"
    paths:
      # These paths are unique to `on-trigger.yml`.
      - ".github/workflows/on-trigger.yml"
@@ -62,9 +64,9 @@ on:
  workflow_dispatch:

 concurrency:
-  # When a PR is merged into the develop branch it will be assigned a unique
+  # When a PR is merged into the develop branch, it will be assigned a unique
  # group identifier, so execution will continue even if another PR is merged
-  # while it is still running. In all other cases the group identifier is shared
+  # while it is still running. In all other cases, the group identifier is shared
  # per branch, so that any in-progress runs are cancelled when a new commit is
  # pushed.
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
@@ -98,7 +100,7 @@ jobs:
      # However, we do not enable ccache for events targeting a release branch,
      # to protect against the rare case that the output produced by ccache is
      # not identical to a regular compilation.
-      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release') }}
+      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release/') }}
      os: ${{ matrix.os }}
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -8,13 +8,14 @@ on:
  push:
    branches:
      - "develop"
-      - "release*"
+      - "release/*"
+      - "staging/*"
  workflow_dispatch:

 jobs:
  # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
  run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@6a52459a658649a0aeaab4ebd6a8f25173f6f16f
    with:
      runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-70b8fd3" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-d3a71b2" }'
@@ -41,13 +41,13 @@ env:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

@@ -129,7 +129,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: ${{ inputs.ccache_enabled }}

@@ -280,7 +280,7 @@ jobs:

      - name: Upload the binary (Linux)
        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: xrpld-${{ inputs.config_name }}
          path: ${{ env.BUILD_DIR }}/xrpld
@@ -294,7 +294,7 @@ jobs:

      - name: Upload the validator-keys binary
        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: validator-keys-${{ inputs.config_name }}
          path: |
@@ -305,7 +305,7 @@ jobs:

      - name: Upload the test binary (Linux)
        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: xrpl_tests-${{ inputs.config_name }}
          path: ${{ env.BUILD_DIR }}/xrpl_tests
@@ -321,7 +321,7 @@ jobs:

      - name: Upload server definitions
        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: server-definitions
          path: ${{ env.BUILD_DIR }}/server_definitions.json
@@ -25,7 +25,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.13"

@@ -34,7 +34,7 @@ jobs:
    needs: [determine-files]
    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3d526d4"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-d3a71b2"
    permissions:
      contents: read
      issues: write
@@ -43,7 +43,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

@@ -109,7 +109,7 @@ jobs:

      - name: Upload clang-tidy output
        if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          path: ${{ env.OUTPUT_FILE }}
          archive: false
@@ -123,17 +123,23 @@ jobs:

      - name: Fix style
        if: ${{ steps.files_changed.outcome != 'success' }}
+        # pre-commit installs every hook's environment, even for hooks that match
+        # no files, and node-based hooks need libatomic, which this image lacks.
+        # Exit code 1 just means hooks modified files or found issues.
+        env:
+          SKIP: prettier,cspell
        run: |
-          pre-commit run --all-files || true
+          git add --update
+          pre-commit run || [ $? -eq 1 ]

      - name: Generate git diff
        if: ${{ steps.files_changed.outcome != 'success' }}
        run: |
-          git diff | tee "${DIFF_FILE}"
+          git diff HEAD | tee "${DIFF_FILE}"

      - name: Upload clang-tidy diff output
        if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          path: ${{ env.DIFF_FILE }}
          archive: false
@@ -185,7 +191,7 @@ jobs:

      - name: Create issue
        if: ${{ steps.run_clang_tidy.outcome != 'success' && inputs.create_issue_on_failure }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
+        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
        with:
          title: "Clang-tidy check failed"
          body_file: ${{ env.ISSUE_FILE }}
@@ -44,7 +44,7 @@ jobs:
      # Every package lands in one directory; the step below picks its own,
      # which keeps this independent of the artifact names.
      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: "*-pkg"
          merge-multiple: true
@@ -95,11 +95,15 @@ jobs:
          apt-get update -qq
          apt-get install -y "./${PACKAGE}"

+      # Rocky Linux and AlmaLinux pick a mirror from a mirrorlist, and now and
+      # then get one that serves the repository metadata at a few hundred kB/s,
+      # which alone outlasts the job's timeout. dnf only abandons a mirror below
+      # 1000 B/s for 30 s, so raise that floor to fail over to the next one fast.
      - name: Install the RPM
        if: ${{ inputs.package_type == 'rpm' }}
        env:
          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y "./${PACKAGE}"
+        run: dnf install -y --setopt=minrate=1M --setopt=timeout=10 "./${PACKAGE}"

      - name: Run xrpld
        run: xrpld --version
@@ -73,7 +73,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.13"

@@ -100,18 +100,18 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

      - name: Download pre-built xrpld binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ matrix.xrpld_artifact_name }}
          path: ${{ env.BUILD_DIR }}

      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ matrix.validator_keys_artifact_name }}
          path: ${{ env.BUILD_DIR }}
@@ -151,7 +151,7 @@ jobs:
      # version starts with a digit and a longer name does not, so that one digit
      # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
      - name: Upload package artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg
          path: |
@@ -160,7 +160,7 @@ jobs:
          if-no-files-found: error

      - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
          path: |
@@ -225,13 +225,13 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

      # Both artifacts, so the debug symbols are published alongside the package.
      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
          merge-multiple: true
@@ -287,7 +287,7 @@ jobs:
        run: echo "PUSH=${PUSH}" | tee -a "${GITHUB_ENV}"

      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: "*-pkg"
          merge-multiple: true
@@ -295,7 +295,7 @@ jobs:

      - name: Download voidstar binary
        if: ${{ matrix.target == 'voidstar' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: xrpld-ubuntu-clang-debug-amd64-voidstar
          path: ${{ env.CONTEXT }}
@@ -326,14 +326,14 @@ jobs:

      - name: Log in to Docker Hub
        if: ${{ env.PUSH == 'true' && matrix.target == 'xrpld' }}
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: xrplf
          password: ${{ secrets.dockerhub_token }}

      - name: Log in to the Antithesis registry
        if: ${{ env.PUSH == 'true' && matrix.target == 'voidstar' }}
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ${{ secrets.antithesis_docker_host }}
          username: _json_key
@@ -28,7 +28,7 @@ permissions:
 jobs:
  clippy:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:

  coverage:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +70,7 @@ jobs:

  doc:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -26,7 +26,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.13"

@@ -40,7 +40,7 @@ defaults:
 jobs:
  upload:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-d3a71b2
    env:
      REMOTE_NAME: ${{ inputs.remote_name }}
      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -50,7 +50,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

@@ -68,7 +68,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@6645b8721d3810be1c59f4180315249e59bf1312
        with:
          enable_ccache: false

@@ -26,6 +26,11 @@ This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-R

 Version 3.5.0 is not yet released.

+### Breaking changes in 3.5.0
+
+- The `XChainBridge` amendment and its ledger entries and transactions are removed. `XChainBridge` and `fixXChainRewardRounding` are now obsolete and can no longer be voted for; neither was ever enabled on Mainnet. `ledger_entry` no longer accepts `bridge`, `xchain_owned_claim_id`, or `xchain_owned_create_account_claim_id`; `account_objects` no longer accepts those values in `type`; and `server_definitions` no longer lists the removed ledger entry types, transaction types, fields, and the `XChainBridge` serialized type.
+- `subscribe` (`ledger` stream): The deprecated `fee_ref` field has been removed unconditionally from both the `subscribe` response and the `ledgerClosed` stream messages. It was previously only omitted when the `XRPFees` amendment was enabled; that amendment has now been retired, so the field is never returned. This applies to all API versions.
+
 ### Additions in 3.5.0

 - `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive the same `transaction` message as the `transactions` stream for each validated transaction whose metadata affects a subscribed issuance. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
@@ -35,6 +40,11 @@ Version 3.5.0 is not yet released.

 - `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 - `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
+- `account_currencies`, `account_nfts`, `account_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before an invalid or missing `account`. An invalid `limit` or `marker` is reported before `lgrNotFound` or `actNotFound`, and for `account_offers` also before `actMalformed`. A request with a single problem returns the same error as before. [#8561](https://github.com/XRPLF/rippled/pull/8561)
+- `deposit_authorized`: A `credentials` entry that is all zeros (for example `"0"` or 64 `0` characters) now returns a `badCredentials` error instead of looking up a credential that can never exist.
+- `account_info`, `account_lines`, `account_channels`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `account`, or `ident` for `account_info`. For `account_lines`, a `peer` that is not a string, or an invalid `limit` or `marker`, is reported before `lgrNotFound`, `actNotFound` or a malformed `account`, and an invalid `limit` or `marker` also before a malformed `peer`. For `account_channels`, a malformed `account` is reported before `lgrNotFound`, and an invalid `destination_account`, `limit` or `marker` before `lgrNotFound` or `actNotFound`. A request with a single problem returns the same error as before. [#8573](https://github.com/XRPLF/rippled/pull/8573)
+- `deposit_authorized`, `nft_buy_offers`, `nft_sell_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `source_account`, `destination_account` or `nft_id`, and for `nft_buy_offers` / `nft_sell_offers` also before an invalid `limit`. For `deposit_authorized`, an invalid `credentials` array is reported before `lgrNotFound`, `srcActNotFound`, `dstActNotFound` or `badCredentials`. For `nft_buy_offers` and `nft_sell_offers`, an invalid `marker` is reported before `lgrNotFound` or `objectNotFound`. A request with a single problem returns the same error as before. [#8613](https://github.com/XRPLF/rippled/pull/8613)
+- `nft_buy_offers`, `nft_sell_offers`: An `nft_id` that is an array or an object now returns an `invalidParams` error instead of an `internal` error. [#8613](https://github.com/XRPLF/rippled/pull/8613)

 ### Bugfixes in 3.5.0

@@ -2,33 +2,12 @@
 | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |

-## Minimum Requirements
+## Supported platforms

-For the hardware needed to run a node, see
-[System Requirements](https://xrpl.org/system-requirements.html).
-
-For the software needed to build xrpld, see the
-[environment setup guide](./docs/build/environment.md).
-
-## Operating Systems
-
-### Linux
-
-The Ubuntu Linux distribution has received the highest level of quality
-assurance, testing, and support. We also support Red Hat and use Debian
-internally.
-Our Linux CI tooling is distro-independent and uses a Nix-based environment, so it should be possible to build on other Linux distributions as well, although we have not tested them.
-
-### macOS
-
-Many `xrpld` engineers use macOS for development.
-The minimum supported version is macOS 15 (Sequoia).
-CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
-
-### Windows
-
-Windows is used by some engineers for development only, and is not recommended
-for production use.
+Building and testing are supported on Linux, macOS, and (best effort) Windows;
+see [Supported development platforms](./docs/build/environment.md#supported-development-platforms).
+Running `xrpld` is officially supported on Linux only;
+see [Requirements](./docs/install.md#requirements).

 ## Steps

@@ -42,7 +42,7 @@ if(is_gcc)
    # GCC-specific fixes
    add_compile_options(-Wno-unknown-pragmas -Wno-subobject-linkage)
    # -Wno-subobject-linkage can be removed when we upgrade GCC version to at least 13.3
-elseif(is_clang)
+elseif(is_any_clang)
    # Clang-specific fixes
    add_compile_options(-Wno-unknown-warning-option) # Ignore unknown warning options
 elseif(is_msvc)
@@ -332,7 +332,7 @@ This ensures that configuration changes don't introduce new warnings across the

 ### Installing clang-tidy

-See the [environment setup guide](./docs/build/environment.md#clang-tidy) for how to get clang-tidy.
+The [Nix development shell](./docs/build/nix.md) provides `clang-tidy` at the [tested version](./docs/build/environment.md#tested-compiler-versions).

 ### Running clang-tidy locally

@@ -365,14 +365,15 @@ With this set, the hook will run as part of `git commit` alongside the other pre
 Then run clang-tidy on your local changes:

 ```
-run-clang-tidy -p build -allow-no-checks src tests
+run-clang-tidy -p build -allow-no-checks include src tests
 ```

-This will check all source files in the `src`, `include` and `tests` directories using the compile commands from your `build` directory.
+This will check all source files in the `include`, `src` and `tests` directories using the compile commands from your `build` directory.
+Headers are checked on their own, which requires the `verify_headers` CMake option (ON by default).
 If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix -format` to the above command:

 ```
-run-clang-tidy -p build -quiet -fix -format -allow-no-checks src tests
+run-clang-tidy -p build -quiet -fix -format -allow-no-checks include src tests
 ```

 `-format` reformats the fixed code with [`.clang-format`](./.clang-format); without it the fixes are inserted in LLVM style and the `clang-format` hook rewrites them afterwards.
@@ -34,7 +34,7 @@ so tools can filter them and protection rules can target `release/*` and `stagin
 - **Branches only move forward.**
  `develop`, `staging/X.Y.x`, and `release/X.Y.x` are never rewritten.
 - **Cherry-picking only goes from `develop` to a staging branch**,
-  for fixes that must get into a release after the code freeze
+  for fixes that must get into a release after the [code freeze](#release-candidates)
  (see [Emergency Fixes From `develop`](#emergency-fixes-from-develop)).
 - **Security fixes are prepared privately and published with the release that contains them**,
  so vulnerabilities are not disclosed prematurely.
@@ -49,6 +49,7 @@ develop                            staging/X.Y.x & release/X.Y.x
   │
   ├── Tag: X.Y.0-b1
   ├── Tag: X.Y.0-bN
+   │  (2 weeks before rc1: freeze on large changes starts)
   ├── Tag: X.Y.0-rc1 ───────────────┐ (branches created)
   │                                 │
   │  (development continues)        ├── Fixes
@@ -75,16 +76,20 @@ develop                            staging/X.Y.x & release/X.Y.x
 3. **Branches:** `staging/X.Y.x` and `release/X.Y.x` are created from `develop`
   at the commit tagged `X.Y.0-rc1`.
   The first RC also kicks off the QE process.
-4. **Code freeze:** No new features or unrelated changes are pulled from `develop`
-   into `staging/X.Y.x` or `release/X.Y.x`.
-   Only critical stabilization fixes go into the line.
-5. **No large changes on `develop`:** Until `X.Y.0` is [merged back](#merging-back-into-develop),
-   large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
-   are not merged into `develop`,
-   so that fixes on the line and the merge back don't run into conflicts.
+
+### Freeze on Large Changes
+
+From two weeks before `X.Y.0-rc1` until `X.Y.0` is [merged back](#merging-back-into-develop),
+large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
+are not merged into `develop`.

 ### Release Candidates

+After branching, the line is in code freeze:
+no new features or unrelated changes are pulled from `develop`
+into `staging/X.Y.x` or `release/X.Y.x`.
+Only critical stabilization fixes go into the line.
+
 1. Fixes are developed against `staging/X.Y.x`.
 2. When ready, a new RC is created on `staging/X.Y.x`,
   and `release/X.Y.x` is fast-forwarded to it.
@@ -106,7 +111,8 @@ one right after the other.
 2. `release/X.Y.x` is fast-forwarded to `staging/X.Y.x`,
   and the release is tagged on it.
 3. The release is immediately [merged back into `develop`](#merging-back-into-develop).
-   For a major-minor release, this lifts the freeze on large changes in `develop`.
+   For a major-minor release, this lifts the [freeze on large changes](#freeze-on-large-changes)
+   in `develop`.

 ### Merging Back Into `develop`

@@ -127,7 +133,7 @@ After the merge, `git log develop..<tag>` must be empty.
 ### Emergency Fixes From `develop`

 If a commit was merged to `develop`
-and needs to be included in a release after the code freeze:
+and needs to be included in a release after the [code freeze](#release-candidates):

 1. Create a PR that cherry-picks the commit onto `staging/X.Y.x`.
 2. Leave `develop` as it is, with no reverts.
@@ -0,0 +1,60 @@
+#!/bin/bash
+#
+# check-distrusted-roots.sh — fail if a CA bundle trusts a root of the
+# compromised eMudhra intermediates; see https://emudhra.we-have-a-problem.com/.
+#
+# Usage: check-distrusted-roots.sh [ca-bundle]
+# Defaults to the system bundle (Debian or RHEL path).
+#
+# Roots are matched by SHA-256 fingerprint, needing only bash, base64 and
+# sha256sum (nixos/nix has no awk). Only plain CERTIFICATE blocks are checked:
+# OpenSSL's TRUSTED CERTIFICATE blocks carry their own trust settings, which is
+# how nixpkgs' cacert marks a blacklisted root as rejected.
+
+set -euo pipefail
+
+declare -A ROOTS=(
+    [d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4]="AAA Certificate Services"
+    [86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b]="emSign ECC Root CA - G3"
+)
+
+BUNDLE="${1:-}"
+if [ -z "${BUNDLE}" ]; then
+    for CANDIDATE in /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt; do
+        if [ -f "${CANDIDATE}" ]; then
+            BUNDLE="${CANDIDATE}"
+            break
+        fi
+    done
+fi
+
+STATUS=0
+COUNT=0
+PEM=""
+while IFS= read -r LINE || [ -n "${LINE}" ]; do
+    case "${LINE}" in
+        "-----BEGIN CERTIFICATE-----") PEM="" ;;
+        "-----END CERTIFICATE-----")
+            COUNT=$((COUNT + 1))
+            FINGERPRINT="$(base64 -d <<<"${PEM}" | sha256sum)" || {
+                echo "ERROR: certificate ${COUNT} in ${BUNDLE} is not valid base64" >&2
+                exit 1
+            }
+            ROOT="${ROOTS[${FINGERPRINT%% *}]:-}"
+            if [ -n "${ROOT}" ]; then
+                echo "ERROR: ${BUNDLE} trusts '${ROOT}'" >&2
+                STATUS=1
+            fi
+            ;;
+        # Lines outside a CERTIFICATE block only collect until the next BEGIN.
+        *) PEM+="${LINE}" ;;
+    esac
+done <"${BUNDLE:?no system CA bundle found}"
+
+# An empty or unparsable bundle would otherwise pass.
+if [ "${COUNT}" -eq 0 ]; then
+    echo "ERROR: ${BUNDLE} has no certificates" >&2
+    exit 1
+fi
+echo "${BUNDLE}: checked ${COUNT} certificates"
+exit "${STATUS}"
@@ -58,6 +58,14 @@ function install() {
                rpm-build \
                rpm-sign \
                systemd-rpm-macros
+
+            # AlmaLinux's ca-certificates still trusts the root of the compromised
+            # eMudhra intermediates; see https://emudhra.we-have-a-problem.com/.
+            # TODO: drop once it ships a fix.
+            trust extract --format=pem-bundle \
+                --filter="pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert" \
+                /etc/pki/ca-trust/source/blocklist/emSign_ECC_Root_CA_-_G3.pem
+            update-ca-trust
            ;;
    esac
 }
@@ -9,13 +9,14 @@ ARG DEBIAN_FRONTEND=noninteractive

 RUN <<EOF
 pkgs=()
-pkgs+=(curl)         # Required to install nix.
-pkgs+=(doxygen)      # Needed for Clio's check-doxygen-docs.sh.
-pkgs+=(git)          # Required for prepare-runner.
-pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
-pkgs+=(python3)      # Python 3 interpreter.
-pkgs+=(python3-pip)  # Package manager for Python applications.
-pkgs+=(xz-utils)     # Required to install nix
+pkgs+=(ca-certificates)  # Trust store for curl, git, pip and nix.
+pkgs+=(curl)             # Required to install nix.
+pkgs+=(doxygen)          # Needed for Clio's check-doxygen-docs.sh.
+pkgs+=(git)              # Required for prepare-runner.
+pkgs+=(libatomic1)       # Required to run pre-commit provided `node`.
+pkgs+=(python3)          # Python 3 interpreter.
+pkgs+=(python3-venv)     # Virtual environment for Python applications.
+pkgs+=(xz-utils)         # Required to install nix

 apt-get update
 apt-get install -y --no-install-recommends "${pkgs[@]}"
@@ -23,9 +24,21 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF

+# Sanity-check that the system CA bundle distrusts the compromised eMudhra roots,
+# before pip and the nix installer download anything with it.
+RUN --mount=type=bind,source=bin/check-distrusted-roots.sh,target=/check-distrusted-roots.sh \
+    /check-distrusted-roots.sh
+
+# Ahead of the system Python on PATH,
+# so `python3` and `pip` resolve to the venv and installs stay out of the system Python.
+ENV VIRTUAL_ENV="/opt/venv"
+ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
+
 ARG PRE_COMMIT_VERSION=4.6.2
-RUN pip install --no-cache --break-system-packages \
-    pre-commit==${PRE_COMMIT_VERSION}
+RUN <<EOF
+python3 -m venv "${VIRTUAL_ENV}"
+pip install --no-cache pre-commit==${PRE_COMMIT_VERSION}
+EOF

 RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes

@@ -33,7 +46,9 @@ RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --dae
 # so nix is available in all shells including non-interactive shells (e.g., GitHub Actions).
 ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
 ENV NIX_PROFILES="/nix/var/nix/profiles/default"
-ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+# The system bundle gets security updates through apt;
+# the one in the Nix profile is frozen at the installer's nixpkgs.
+ENV NIX_SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt"

 # Verify nix installation
 RUN nix --version
@@ -5,15 +5,6 @@ The script determines the staged files itself (see `pass_filenames: false` in
 .pre-commit-config.yaml) so run-clang-tidy is run once and handles parallelism
 internally: pre-commit would otherwise split the files across parallel hook
 invocations that race when fixes edit a shared header.
-
-Fixes are collected with `-export-fixes` and applied by clang-apply-replacements
-in a separate step rather than with run-clang-tidy's `-fix`. The `add_module`
-build isolates each module's headers behind a per-module symlink directory
-(build/modules/<module>/...), so a header reachable from several translation
-units is referenced through different paths that all resolve to the same source
-file. clang-apply-replacements deduplicates identical replacements by their
-literal path, so those paths must be canonicalised to the real source path
-first; otherwise the same fix is applied once per path and corrupts the header.
 """

 from __future__ import annotations
@@ -23,7 +14,6 @@ import re
 import shutil
 import subprocess
 import sys
-import tempfile
 from pathlib import Path

 # Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
@@ -31,11 +21,6 @@ from pathlib import Path
 # compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
 TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}

-# A single-quoted `FilePath:` entry in an -export-fixes YAML file, allowing the
-# `- ` marker that precedes it inside a `Replacements:` sequence. clang-tidy
-# emits paths single-quoted and doubles any embedded quote per YAML rules.
-FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
-

 def clang_tidy_major() -> str | None:
    """Major version of the `clang-tidy` on PATH, which run-clang-tidy invokes."""
@@ -79,25 +64,6 @@ def staged_files(repo_root: Path) -> list[Path]:
    return [repo_root / rel for rel in output.splitlines() if rel]


-def canonicalize_fix_paths(fixes_dir: Path) -> None:
-    """Rewrite every `FilePath` in the exported fixes to its real source path.
-
-    A header included through a module's isolation symlink is recorded under that
-    symlink's path; collapsing all paths to the same real file lets
-    clang-apply-replacements recognise the per-translation-unit duplicates and
-    apply each fix once.
-    """
-    for yaml in fixes_dir.glob("*.yaml"):
-        lines = []
-        for line in yaml.read_text().splitlines():
-            if m := FILEPATH_RE.match(line):
-                path = m.group(2).replace("''", "'")
-                real = os.path.realpath(path).replace("'", "''")
-                line = f"{m.group(1)}'{real}'"
-            lines.append(line)
-        yaml.write_text("\n".join(lines) + "\n")
-
-
 def main():
    if not os.environ.get("TIDY"):
        return 0
@@ -116,19 +82,10 @@ def main():

    version = clang_tidy_major()
    run_clang_tidy = find_tool("run-clang-tidy", version)
-    clang_apply_replacements = find_tool("clang-apply-replacements", version)
-    missing = [
-        name
-        for name, path in (
-            ("run-clang-tidy", run_clang_tidy),
-            ("clang-apply-replacements", clang_apply_replacements),
-        )
-        if not path
-    ]
-    if missing:
+    if not run_clang_tidy:
        tried = f" (tried the '-{version}' suffix too)" if version else ""
        print(
-            f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
+            f"clang-tidy check failed: TIDY is enabled but run-clang-tidy "
            f"was not found in PATH{tried}.",
            file=sys.stderr,
        )
@@ -143,27 +100,19 @@ def main():
        )
        return 1

-    with tempfile.TemporaryDirectory() as fixes_dir:
-        result = subprocess.run(
-            [
-                run_clang_tidy,
-                "-quiet",
-                "-p",
-                build_dir,
-                "-export-fixes",
-                fixes_dir,
-                "-allow-no-checks",
-            ]
-            + files
-        )
-        canonicalize_fix_paths(Path(fixes_dir))
-        # `FormatStyle` in .clang-tidy does not reach this path,
-        # so ask for the repository style here.
-        applied = subprocess.run(
-            [clang_apply_replacements, "--format", "--style=file", fixes_dir]
-        )
-
-    return result.returncode or applied.returncode
+    result = subprocess.run(
+        [
+            run_clang_tidy,
+            "-quiet",
+            "-p",
+            build_dir,
+            "-fix",
+            "-format",
+            "-allow-no-checks",
+        ]
+        + files
+    )
+    return result.returncode


 if __name__ == "__main__":
@@ -1360,6 +1360,39 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
+#   gas_limit = <gas>
+#
+#       The gas limit is the maximum amount of gas that can be
+#       consumed by a single transaction. The gas limit is used to prevent
+#       transactions from consuming too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_limit = 1000000      # 1 million gas
+#
+#   bytecode_size_limit = <bytes>
+#
+#       The bytecode size limit is the maximum size of a WASM extension in
+#       bytes. The size limit is used to prevent extensions from consuming
+#       too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           bytecode_size_limit = 100000      # 100 kb
+#
+#   gas_price = <micro-drops>
+#
+#       The gas price is the conversion between WASM gas and its price in drops.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings
@@ -9,13 +9,21 @@ include_guard(GLOBAL)
 # --------------------------------------------------------------------
 # Compiler detection (C++)
 # --------------------------------------------------------------------
-set(is_clang FALSE)
+# is_any_clang is true for both LLVM Clang and AppleClang. Their version numbers
+# and feature sets differ, so use is_llvm_clang or is_apple_clang when it matters.
+set(is_any_clang FALSE)
+set(is_llvm_clang FALSE)
+set(is_apple_clang FALSE)
 set(is_gcc FALSE)
 set(is_msvc FALSE)
 set(is_xcode FALSE)

-if(CMAKE_CXX_COMPILER_ID MATCHES ".*Clang") # Clang or AppleClang
-    set(is_clang TRUE)
+if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
+    set(is_any_clang TRUE)
+    set(is_llvm_clang TRUE)
+elseif(CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
+    set(is_any_clang TRUE)
+    set(is_apple_clang TRUE)
 elseif(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
    set(is_gcc TRUE)
 elseif(MSVC)
@@ -130,7 +130,7 @@ else()
        INTERFACE
            -Wall
            -Wdeprecated
-            $<$<BOOL:${is_clang}>:-Wno-deprecated-declarations>
+            $<$<BOOL:${is_any_clang}>:-Wno-deprecated-declarations>
            $<$<BOOL:${wextra}>:-Wextra
            -Wno-unused-parameter>
            $<$<BOOL:${werr}>:-Werror>
@@ -177,7 +177,7 @@ else()
    if(
        is_nix_compiler
        AND is_linux
-        AND is_clang
+        AND is_any_clang
        AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
    )
        string(
@@ -204,7 +204,10 @@ if(voidstar)
            "Antithesis instrumentation requires Linux, aborting..."
        )
    elseif(
-        NOT (is_clang AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0)
+        NOT (
+            is_llvm_clang
+            AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0
+        )
    )
        message(
            FATAL_ERROR
@@ -296,7 +296,18 @@ if(xrpld)
        OUT_VAR rpcspec_instantiations
        VALUE_TYPE "::json::Value"
        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
-        HANDLERS book_changes ledger transaction_entry
+        HANDLERS
+            account_channels
+            account_currencies
+            account_info
+            account_lines
+            account_nfts
+            account_offers
+            book_changes
+            deposit_authorized
+            ledger
+            nft_offers_common
+            transaction_entry
    )
    target_sources(xrpld PRIVATE ${rpcspec_instantiations})

@@ -58,7 +58,7 @@ target_link_options(common INTERFACE ${sanitizers_linker_flags})
 # This module appends -fsanitize-ignorelist=<path> for Clang builds.
 # The ignorelist path contains CMAKE_SOURCE_DIR, so it must be set here, rather than in the Conan profile.
 # GCC does not support -fsanitize-ignorelist.
-if(is_clang)
+if(is_any_clang)
    set(ignorelist_path
        "${CMAKE_SOURCE_DIR}/sanitizers/suppressions/sanitizer-ignorelist.txt"
    )
@@ -23,11 +23,8 @@ if(NOT is_multiconfig)
    endif()
 endif()

-if(is_clang) # both Clang and AppleClang
-    if(
-        "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang"
-        AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0
-    )
+if(is_llvm_clang)
+    if(CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0)
        message(FATAL_ERROR "This project requires clang 16 or later")
    endif()
 elseif(is_gcc)
@@ -62,11 +62,11 @@ if(unity)
    set(CMAKE_UNITY_BUILD ON CACHE BOOL "Do a unity build")
 endif()

-if(is_clang AND is_linux)
+if(is_llvm_clang AND is_linux)
    option(voidstar "Enable Antithesis instrumentation." OFF)
 endif()

-if(is_gcc OR is_clang)
+if(is_gcc OR is_any_clang)
    include(ProcessorCount)
    ProcessorCount(PROCESSOR_COUNT)

@@ -125,7 +125,7 @@ else()
    set(use_mold OFF CACHE BOOL "mold linker, linux only" FORCE)
 endif()

-if(is_clang)
+if(is_any_clang)
    option(use_lld "enables detection of lld linker" ON)
 else()
    set(use_lld OFF CACHE BOOL "try lld linker, clang only" FORCE)
@@ -34,11 +34,12 @@ include(create_symbolic_link)
 # sometimes `PUBLIC` and sometimes `PRIVATE`.
 # The Cs are all guaranteed to be unique.
 # We can guarantee a unique X per target by using
-# `${CMAKE_CURRENT_BINARY_DIR}/include/${target}`.
+# `${CMAKE_CURRENT_BINARY_DIR}/modules/${target}`.
 #
 # isolate_headers(target A B scope)
 function(isolate_headers target A B scope)
    file(RELATIVE_PATH C "${A}" "${B}")
+    # Keep in sync with ExcludeHeaderFilterRegex in .clang-tidy.
    set(X "${CMAKE_CURRENT_BINARY_DIR}/modules/${target}")
    set(Y "${X}/${C}")
    cmake_path(GET Y PARENT_PATH parent)
@@ -7,7 +7,7 @@
 pcpp>=1.30

 # Parser combinator library - used to parse the macro DSL
-pyparsing>=3.0.0
+pyparsing>=3.3.3

 # Template engine - used to generate C++ code from templates
-Mako>=1.2.2
+Mako>=1.4.2
@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile requirements.in --generate-hashes --output-file requirements.txt
-mako==1.3.12 \
-    --hash=sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9 \
-    --hash=sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a
+mako==1.4.3 \
+    --hash=sha256:723296007c870bfd6b3f0c3230dba7198096e5269297ebf5e4eff9e7ffa39d4f \
+    --hash=sha256:cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a
    # via -r requirements.in
 markupsafe==3.0.3 \
    --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
@@ -99,7 +99,7 @@ pcpp==1.30 \
    --hash=sha256:05fe08292b6da57f385001c891a87f40d6aa7f46787b03e8ba326d20a3297c6e \
    --hash=sha256:5af9fbce55f136d7931ae915fae03c34030a3b36c496e72d9636cedc8e2543a1
    # via -r requirements.in
-pyparsing==3.3.2 \
-    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
-    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
+pyparsing==3.3.3 \
+    --hash=sha256:928ae7e20211f3b6f3915a72f06a0cfd29ab9d24279dd6346b6b1a7146397d36 \
+    --hash=sha256:ece8c00a69cf01b45d0b1dedabb469c90d8caf996d4fda40f147627a122849a4
    # via -r requirements.in
@@ -3,11 +3,11 @@
    "requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
+        "xrpl-rpc-spec/0.1.29#852afc87cac32aca93cc50a985d73fe0%1792359643.19817",
        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
-        "secp256k1/0.7.1#b1f450b7f78a36fff75bb6934a356f3a%1782338841.3729",
+        "secp256k1/0.7.1#f4d16a4d907dd057598954476ca6f88c%1792234329.790275",
        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
        "nudb/2.0.9",
        "openssl/3.6.3",
        "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.21",
+        "xrpl-rpc-spec/0.1.29",
        "zlib/1.3.2",
    ]

@@ -57,9 +57,9 @@ dependencies = [

 [[package]]
 name = "cxx"
-version = "1.0.202"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13f6de320895f42e6e081abb5c7983bedcf0b6d0ff9323de0d33f620c8ac1199"
+checksum = "c8a02bfeba9074b2bbb39492c9b0908ec854f455a3cccdcde7a1de55e2315e40"
 dependencies = [
 "cc",
 "cxx-build",
@@ -72,9 +72,9 @@ dependencies = [

 [[package]]
 name = "cxx-build"
-version = "1.0.202"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fde53ca86b9704a943fef0f1e1d836239a6aedca5de3c65fa9f97ec0bd46d39"
+checksum = "bbc2ac76997619d2d888b58ad79488f1c835de41ca4dd3dd7082acf4ecb0a50f"
 dependencies = [
 "cc",
 "codespan-reporting",
@@ -87,9 +87,9 @@ dependencies = [

 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.202"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bae89236c811fd4d08ed3441759ac4ac98d752cbfd3de341315ba16ad20ec3"
+checksum = "54a486ed16a3f2a053fe7f5b98db4c1a59846a23e8cb9e49f9d1bd48830d51a2"
 dependencies = [
 "clap",
 "codespan-reporting",
@@ -101,15 +101,15 @@ dependencies = [

 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.202"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49045042e5fced01b80742aba5508de82aa4f13677ed3fa2b4cda709c40c5918"
+checksum = "c72569be94e2283764d334cd285980b747dbe221e27e315484eb6bcd93fa808a"

 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.202"
+version = "1.0.205"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b181252e2e3d3b5d183afbdc033a3958b445eb3e1a0ae65fc3d4f5259f5da6fd"
+checksum = "423e795284a7f7b3f843c956a5322c4bc497b60c2dd1a6339da10313cb18d575"
 dependencies = [
 "indexmap",
 "proc-macro2",
@@ -4,6 +4,18 @@ This document explains how to set one up.

 [BUILD.md]: ../../BUILD.md

+## Supported development platforms
+
+- **Linux**: the [Nix development shell](./nix.md),
+  which provides the same toolchain CI uses on any distribution.
+- **macOS** 15 (Sequoia) or newer: the [Nix development shell](./nix.md),
+  or the system [Apple Clang](#macos-apple-clang).
+  CI runs on macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
+- **Windows**: best effort, see [Windows](#windows).
+
+For the platforms supported for running `xrpld`,
+see [Requirements](../install.md#requirements).
+
 ## Tested compiler versions

 `xrpld` is built in the **C++23** dialect by default, so your toolchain has to
@@ -35,20 +47,16 @@ compiler building. Treat support for anything outside the table as best-effort.

 ## Required tools

-Besides a compiler, building `xrpld` requires:
-
-| Tool                                        | Minimum version |
-| ------------------------------------------- | --------------- |
-| [Git](https://git-scm.com/downloads)        | any recent      |
-| [Python](https://www.python.org/downloads/) | 3.11            |
-| [Conan](https://conan.io/downloads.html)    | 2.17            |
-| [CMake](https://cmake.org/download/)        | 3.16            |
+Besides a compiler, building `xrpld` requires
+[Git](https://git-scm.com/downloads),
+[Python](https://www.python.org/downloads/),
+[Conan](https://conan.io/downloads.html),
+and [CMake](https://cmake.org/download/).
+Building with `-Drust=ON` additionally requires a Rust toolchain,
+see [Rust](#rust).

 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
-(see below). On Windows they have to be installed manually.
-
-Building with `-Drust=ON` additionally requires a Rust toolchain, see
-[Rust](#rust). A default build does not, so it is not in the table above.
+at the versions CI uses, recorded in [`nix/check-tools/`](../../nix/check-tools).

 Once they are in place, verify that everything is installed and runnable with:

@@ -58,60 +66,19 @@ Once they are in place, verify that everything is installed and runnable with:

 ## Linux and macOS

-The **recommended way** to get a development environment on Linux and macOS is
-the Nix development shell. It provides the exact tooling used in CI — `git`,
-`python`, `conan`, `cmake`, `clang-tidy`, `clang-format`, and everything else —
-with a single command and without installing anything system-wide:
+Use the [Nix development shell](./nix.md):
+it provides the compiler and every tool CI uses,
+without installing anything system-wide.

-```bash
-nix --experimental-features 'nix-command flakes' develop
-```
+### macOS: Apple Clang

-On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
-Clang. If you instead opt to use your system-wide Apple Clang (via
-`nix develop .#apple-clang`), you need to manage its version yourself (see
-below).
-
-See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler and why we recommend Nix
-over a hand-maintained environment.
-
-### macOS: managing the Apple Clang version
-
-If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
-the compiler version is whatever your installed Xcode (or Command Line Tools)
-provides. The following command should return a version greater than or equal to
-the [tested one](#tested-compiler-versions):
-
-```bash
-clang --version
-```
-
-If you develop other applications using Xcode, you might be consistently
-updating to the newest version of Apple Clang, which will likely cause issues
-building xrpld. You may want to install and pin a specific version of Xcode:
-
-1. **Download Xcode**
-   - Visit [Apple Developer Downloads](https://developer.apple.com/download/more/)
-   - Sign in with your Apple Developer account
-   - Search for an Xcode version that includes the expected Apple Clang version
-   - Download the `.xip` file
-
-2. **Install and configure Xcode**
-
-   ```bash
-   # Extract the .xip file and rename for version management
-   # Example: Xcode_16.2.app
-
-   # Move to Applications directory
-   sudo mv Xcode_16.2.app /Applications/
-
-   # Set as default toolchain (persistent)
-   sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-
-   # Set as environment variable (temporary)
-   export DEVELOPER_DIR=/Applications/Xcode_16.2.app/Contents/Developer
-   ```
+You can also build with the system Apple Clang,
+installing the other [required tools](#required-tools) any way you like
+(or getting them from `nix develop .#apple-clang`).
+Its version is whatever your installed Xcode (or Command Line Tools) provides,
+so check that `clang --version` is at least the [tested one](#tested-compiler-versions).
+If several Xcode versions are installed,
+select one with `sudo xcode-select -s <path>` or the `DEVELOPER_DIR` environment variable.

 ## Windows

@@ -123,8 +90,7 @@ manually:
  "x64 Native Tools Command Prompt". CI configures CMake with the
  `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
- Python, Conan, and CMake, at the versions listed in
-  [Required tools](#required-tools).
+- recent releases of Python, Conan, and CMake
 - a [Rust toolchain](https://rustup.rs) — only needed to build with
  `-Drust=ON`, see [Rust](#rust)

@@ -145,16 +111,5 @@ version.
 Everything else the Rust build needs on the CMake side comes from Conan along
 with the rest of the dependencies, so there is nothing further to install.

-## Clang-tidy
-
-`clang-tidy` is required to run static analysis checks locally (see
-[CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. The version this project uses is listed in
-[Tested compiler versions](#tested-compiler-versions).
-
-On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
-version out of the box — run it via `run-clang-tidy`. No separate installation
-is needed.
-
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [packages.nix]: ../../nix/packages.nix
@@ -9,9 +9,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
- **Works on Linux and macOS**: Consistent experience across platforms

 ## Install Nix

@@ -27,13 +25,8 @@ From the root of the xrpld repository, enter the default development shell:
 nix --experimental-features 'nix-command flakes' develop
 ```

-This will:
-
- Download and set up all required development tools (CMake, Ninja, Conan, etc.)
- Configure the appropriate compiler for your platform:
-  - **Linux**: GCC (provided by Nix)
-  - **macOS**: Clang (provided by Nix)
-
+This downloads and sets up all required development tools (CMake, Ninja, Conan, etc.)
+and the compiler for your platform (see [Platform notes](#platform-notes)).
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.

 ### Platform notes
@@ -10,6 +10,19 @@ and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
 where `yum` is a symlink to `dnf`.
 To build from source instead, see [BUILD.md](../BUILD.md).

+## Requirements
+
+Linux is the only operating system officially supported for running `xrpld`;
+macOS and Windows builds are for development only.
+
+Any x86-64 Linux distribution with APT or DNF and glibc 2.31 or newer should work
+(see [How libc is handled](../nix/docker/README.md#how-libc-is-handled)).
+CI tests the packages on Debian 11–13, Ubuntu 20.04–26.04,
+RHEL (UBI) 9–10, AlmaLinux 9–10, and Rocky Linux 9–10.
+
+For the hardware needed to run a node,
+see [System Requirements](https://xrpl.org/system-requirements.html).
+
 ## Release channels

 Packages are published to four channels:
@@ -1,118 +0,0 @@
-#pragma once
-
-#include <functional>
-#include <mutex>
-#include <set>
-
-/**
- * RAII class to check if an Item is already being processed on another thread,
- * as indicated by it's presence in a Collection.
- *
- * If the Item is not in the Collection, it will be added under lock in the
- * ctor, and removed under lock in the dtor. The object will be considered
- * "usable" and evaluate to `true`.
- *
- * If the Item is in the Collection, no changes will be made to the collection,
- * and the CanProcess object will be considered "unusable".
- *
- * It's up to the caller to decide what "usable" and "unusable" mean. (e.g.
- * Process or skip a block of code, or set a flag.)
- *
- * The current use is to avoid lock contention that would be involved in
- * processing something associated with the Item.
- *
- * Examples:
- *
- * void IncomingLedgers::acquireAsync(LedgerHash const& hash, ...)
- * {
- *    if (CanProcess check{acquiresMutex_, pendingAcquires_, hash})
- *    {
- *      acquire(hash, ...);
- *    }
- * }
- *
- * bool
- * NetworkOPsImp::recvValidation(
- *   std::shared_ptr<STValidation> const& val,
- *   std::string const& source)
- *   {
- *       CanProcess check(
- *           validationsMutex_, pendingValidations_, val->getLedgerHash());
- *       BypassAccept bypassAccept =
- *           check ? BypassAccept::no : BypassAccept::yes;
- *       handleNewValidation(app_, val, source, bypassAccept, m_journal);
- *   }
- *
- */
-class CanProcess
-{
-public:
-    template <class Mutex, class Collection, class Item>
-    CanProcess(Mutex& mtx, Collection& collection, Item const& item)
-        : cleanup_(insert(mtx, collection, item))
-    {
-    }
-
-    ~CanProcess()
-    {
-        if (cleanup_)
-            cleanup_();
-    }
-
-    CanProcess(CanProcess const&) = delete;
-
-    CanProcess&
-    operator=(CanProcess const&) = delete;
-
-    explicit
-    operator bool() const
-    {
-        return static_cast<bool>(cleanup_);
-    }
-
-private:
-    template <bool useIterator, class Mutex, class Collection, class Item>
-    std::function<void()>
-    doInsert(Mutex& mtx, Collection& collection, Item const& item)
-    {
-        std::unique_lock<Mutex> lock(mtx);
-        // TODO: Use structured binding once LLVM 16 is the minimum supported
-        // version. See also: https://github.com/llvm/llvm-project/issues/48582
-        // https://github.com/llvm/llvm-project/commit/127bf44385424891eb04cff8e52d3f157fc2cb7c
-        auto const insertResult = collection.insert(item);
-        auto const it = insertResult.first;
-        if (!insertResult.second)
-            return {};
-        if constexpr (useIterator)
-            return [&, it]() {
-                std::unique_lock<Mutex> lock(mtx);
-                collection.erase(it);
-            };
-        else
-            return [&]() {
-                std::unique_lock<Mutex> lock(mtx);
-                collection.erase(item);
-            };
-    }
-
-    // Generic insert() function doesn't use iterators because they may get
-    // invalidated
-    template <class Mutex, class Collection, class Item>
-    std::function<void()>
-    insert(Mutex& mtx, Collection& collection, Item const& item)
-    {
-        return doInsert<false>(mtx, collection, item);
-    }
-
-    // Specialize insert() for std::set, which does not invalidate iterators for
-    // insert and erase
-    template <class Mutex, class Item>
-    std::function<void()>
-    insert(Mutex& mtx, std::set<Item>& collection, Item const& item)
-    {
-        return doInsert<true>(mtx, collection, item);
-    }
-
-    // If set, then the item is "usable"
-    std::function<void()> cleanup_;
-};
@@ -34,7 +34,7 @@ lz4Compress(void const* in, std::size_t inSize, BufferFactory&& bf)
    // data
    auto compressed = bf(outCapacity);

-    auto compressedSize = LZ4_compress_default(
+    auto const compressedSize = LZ4_compress_default(
        reinterpret_cast<char const*>(in),
        reinterpret_cast<char*>(compressed),
        inSize,
@@ -20,12 +20,14 @@ SharedIntrusive<T>::SharedIntrusive(T* p, TAdoptTag) noexcept : ptr_{p}

 template <class T>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive const& rhs)
-    : ptr_{[&] {
-        auto p = rhs.unsafeGetRawPtr();
-        if (p)
-            p->addStrongRef();
-        return p;
-    }()}
+    : ptr_{
+          [&] {
+              auto p = rhs.unsafeGetRawPtr();
+              if (p)
+                  p->addStrongRef();
+              return p;
+          }(),
+      }
 {
 }

@@ -33,12 +35,14 @@ template <class T>
 template <class TT>
    requires std::convertible_to<TT*, T*>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT> const& rhs)
-    : ptr_{[&] {
-        auto p = rhs.unsafeGetRawPtr();
-        if (p)
-            p->addStrongRef();
-        return p;
-    }()}
+    : ptr_{
+          [&] {
+              auto p = rhs.unsafeGetRawPtr();
+              if (p)
+                  p->addStrongRef();
+              return p;
+          }(),
+      }
 {
 }

@@ -140,12 +144,14 @@ SharedIntrusive<T>::~SharedIntrusive()
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{[&] {
-        auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
-        if (p)
-            p->addStrongRef();
-        return p;
-    }()}
+    : ptr_{
+          [&] {
+              auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
+              if (p)
+                  p->addStrongRef();
+              return p;
+          }(),
+      }
 {
 }

@@ -159,12 +165,14 @@ SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusiv
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{[&] {
-        auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
-        if (p)
-            p->addStrongRef();
-        return p;
-    }()}
+    : ptr_{
+          [&] {
+              auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
+              if (p)
+                  p->addStrongRef();
+              return p;
+          }(),
+      }
 {
 }

@@ -260,7 +268,7 @@ SharedIntrusive<T>::unsafeReleaseAndStore(T* next)
        return;

    using enum ReleaseStrongRefAction;
-    auto action = prev->releaseStrongRef();
+    auto const action = prev->releaseStrongRef();
    switch (action)
    {
        case NoOp:
@@ -361,7 +369,7 @@ WeakIntrusive<T>::unsafeReleaseNoStore()
        return;

    using enum ReleaseWeakRefAction;
-    auto action = ptr_->releaseWeakRef();
+    auto const action = ptr_->releaseWeakRef();
    switch (action)
    {
        case NoOp:
@@ -580,7 +588,7 @@ SharedWeakUnion<T>::convertToStrong()
    auto p = unsafeGetRawPtr();
    if (p && p->checkoutStrongRefFromWeak())
    {
-        [[maybe_unused]] auto action = p->releaseWeakRef();
+        [[maybe_unused]] auto const action = p->releaseWeakRef();
        XRPL_ASSERT(
            (action == ReleaseWeakRefAction::NoOp),
            "xrpl::SharedWeakUnion::convertToStrong : "
@@ -603,7 +611,7 @@ SharedWeakUnion<T>::convertToWeak()
        return false;

    using enum ReleaseStrongRefAction;
-    auto action = p->addWeakReleaseStrongRef();
+    auto const action = p->addWeakReleaseStrongRef();
    switch (action)
    {
        case NoOp:
@@ -670,7 +678,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
    if (isStrong())
    {
        using enum ReleaseStrongRefAction;
-        auto strongAction = p->releaseStrongRef();
+        auto const strongAction = p->releaseStrongRef();
        switch (strongAction)
        {
            case NoOp:
@@ -688,7 +696,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
    else
    {
        using enum ReleaseWeakRefAction;
-        auto weakAction = p->releaseWeakRef();
+        auto const weakAction = p->releaseWeakRef();
        switch (weakAction)
        {
            case NoOp:
@@ -406,10 +406,10 @@ IntrusiveRefCounts::useCount() const noexcept
 inline IntrusiveRefCounts::~IntrusiveRefCounts() noexcept
 {
 #ifndef NDEBUG
-    auto v = refCounts_.load(std::memory_order_acquire);
+    auto const v = refCounts_.load(std::memory_order_acquire);
    XRPL_ASSERT(
        (!(v & kValueMask)), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : count must be zero");
-    auto t = v & kTagMask;
+    auto const t = v & kTagMask;
    XRPL_ASSERT((!t || t == kTagMask), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : valid tag");
 #endif
 }
@@ -39,6 +39,31 @@ checkedSub(std::int64_t a, std::int64_t b) noexcept
    return a - b;
 }

+/**
+ * Multiply two signed 64-bit integers, returning std::nullopt when the exact
+ * mathematical product is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedMul(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if (a == 0 || b == 0)
+        return 0;
+
+    if (a > 0)
+    {
+        if (b > 0 ? a > L::max() / b : b < L::min() / a)
+            return std::nullopt;
+    }
+    else if (b > 0 ? a < L::min() / b : b < L::max() / a)
+    {
+        return std::nullopt;
+    }
+
+    return a * b;
+}
+
 static_assert(checkedAdd(0, 0) == 0);
 static_assert(checkedAdd(1, -1) == 0);
 static_assert(checkedAdd(-5, 2) == -3);
@@ -81,6 +106,53 @@ static_assert(
    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
         .has_value());

+static_assert(checkedMul(0, std::numeric_limits<std::int64_t>::min()) == 0);
+static_assert(checkedMul(std::numeric_limits<std::int64_t>::min(), 0) == 0);
+static_assert(checkedMul(-1, -1) == 1);
+// a > 0, b > 0
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::max(), 1) ==
+    std::numeric_limits<std::int64_t>::max());
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::max() / 2, 2) ==
+    std::numeric_limits<std::int64_t>::max() - 1);
+static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, 2).has_value());
+static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::max() / 2) + 1).has_value());
+// a > 0, b < 0
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::max(), -1) ==
+    -std::numeric_limits<std::int64_t>::max());
+static_assert(
+    checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, -2) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 2, -2).has_value());
+static_assert(
+    checkedMul(1, std::numeric_limits<std::int64_t>::min()) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(
+    checkedMul(2, std::numeric_limits<std::int64_t>::min() / 2) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::min() / 2) - 1).has_value());
+// a < 0, b > 0
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::min(), 1) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(
+    checkedMul(std::numeric_limits<std::int64_t>::min() / 2, 2) ==
+    std::numeric_limits<std::int64_t>::min());
+static_assert(!checkedMul((std::numeric_limits<std::int64_t>::min() / 2) - 1, 2).has_value());
+static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), 2).has_value());
+// a < 0, b < 0
+static_assert(
+    checkedMul(-(std::numeric_limits<std::int64_t>::max() / 2), -2) ==
+    std::numeric_limits<std::int64_t>::max() - 1);
+static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min() / 2, -2).has_value());
+static_assert(
+    checkedMul(-1, -std::numeric_limits<std::int64_t>::max()) ==
+    std::numeric_limits<std::int64_t>::max());
+static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), -1).has_value());
+static_assert(!checkedMul(-1, std::numeric_limits<std::int64_t>::min()).has_value());
+
 /**
 * Calculate one number divided by another number in percentage.
 * The result is rounded up to the next integer, and capped in the range [0,100]
@@ -352,9 +352,9 @@ class Number final
    using rep = std::int64_t;
    using InternalRep = MantissaRange::rep;

-    bool negative_{false};
    InternalRep mantissa_{0};
    int exponent_{std::numeric_limits<int>::lowest()};
+    bool negative_{false};

 public:
    // The range for the exponent when normalized
@@ -650,8 +650,12 @@ private:
    shiftExponent(int exponentDelta) const;
 };

+// The number class currently has 3 tail padding bytes. If you are adding new
+// members, try to fit them there before expanding the size of the class.
+static_assert(sizeof(Number) == 16);
+
 constexpr Number::Number(bool negative, InternalRep mantissa, int exponent, Unchecked) noexcept
-    : negative_(negative), mantissa_{mantissa}, exponent_{exponent}
+    : mantissa_{mantissa}, exponent_{exponent}, negative_(negative)
 {
 }

@@ -340,7 +340,7 @@ public:

        for (auto const& c : cfg)
        {
-            auto& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);
+            auto const& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);

            if (a.size() > maxSize_)
                maxSize_ = a.size();
@@ -153,6 +153,24 @@ private:
        Policy policy,
        Callback&& replaceCallback = nullptr);

+    /**
+     * canonicalizeImpl variant for callers that already hold `mutex_`.
+     *
+     * The unnamed `scoped_lock<MutexType> const&` parameter is proof of
+     * ownership; this overload does not acquire the lock. Use it from other
+     * methods (e.g. fetchAndModify) that need to compose canonicalize with
+     * additional work under a single critical section, without relying on
+     * recursive-mutex re-entry.
+     */
+    template <class Policy, class Callback = std::nullptr_t>
+    bool
+    canonicalizeImpl(
+        std::scoped_lock<MutexType> const&,
+        key_type const& key,
+        CanonicalizeClientPointerType<Policy> data,
+        Policy policy,
+        Callback&& replaceCallback = nullptr);
+
 public:
    /**
     * Replace aliased objects with originals.
@@ -239,9 +257,6 @@ public:
    bool
    retrieve(key_type const& key, T& data);

-    MutexType&
-    peekMutex();
-
    std::vector<key_type>
    getKeys() const;

@@ -263,6 +278,22 @@ public:
    fetch(key_type const& digest, Handler const& h);
    // End CachedSLEs functions.

+    /**
+     * Fetch or create an entry and execute a callback while holding the lock.
+     *
+     * The entry for the given key is fetched from the cache or created if it
+     * doesn't exist. The callback is then invoked with a reference to the
+     * entry while the cache mutex is still held, allowing safe modification
+     * of the cached object.
+     *
+     * @param key The key to fetch or create
+     * @param callback Function to call with the entry under lock.
+     *                 Signature: void(T&)
+     */
+    template <class Callback>
+    void
+    fetchAndModify(key_type const& key, Callback&& callback);
+
 private:
    SharedPointerType
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l);
@@ -4,6 +4,7 @@
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/scope.h>
+#include <xrpl/beast/utility/instrumentation.h>

 #include <algorithm>

@@ -300,7 +301,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // Remove from cache, if !valid, remove from map too. Returns true if removed from cache
    std::scoped_lock const lock(mutex_);

-    auto cit = cache_.find(key);
+    auto const cit = cache_.find(key);

    if (cit == cache_.end())
        return false;
@@ -335,6 +336,29 @@ template <class Policy, class Callback>
 inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    canonicalizeImpl(
+        key_type const& key,
+        CanonicalizeClientPointerType<Policy> data,
+        Policy policy,
+        Callback&& replaceCallback)
+{
+    std::scoped_lock<MutexType> const lock(mutex_);
+    return canonicalizeImpl(lock, key, data, policy, std::forward<Callback>(replaceCallback));
+}
+
+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+template <class Policy, class Callback>
+inline bool
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    canonicalizeImpl(
+        std::scoped_lock<MutexType> const&,
        key_type const& key,
        CanonicalizeClientPointerType<Policy> data,
        [[maybe_unused]] Policy policy,
@@ -354,9 +378,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // passing a const argument is a compile error.
    constexpr bool replaceCached = std::is_same_v<Policy, detail::ReplaceCached>;

-    std::scoped_lock const lock(mutex_);
-
-    auto cit = cache_.find(key);
+    auto const cit = cache_.find(key);

    if (cit == cache_.end())
    {
@@ -371,7 +393,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    Entry& entry = cit->second;
    entry.touch(clock_.now());

-    auto shouldReplaceCached = [&] {
+    auto const shouldReplaceCached = [&] {
        if constexpr (replaceCached)
        {
            return true;
@@ -400,7 +422,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
        return true;
    }

-    auto cachedData = entry.lock();
+    auto const cachedData = entry.lock();

    if (cachedData)
    {
@@ -563,7 +585,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    retrieve(key_type const& key, T& data)
 {
    // retrieve the value of the stored data
-    auto entry = fetch(key);
+    auto const entry = fetch(key);

    if (!entry)
        return false;
@@ -572,22 +594,6 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    return true;
 }

-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-inline auto
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    peekMutex() -> MutexType&
-{
-    return mutex_;
-}
-
 template <
    class Key,
    class T,
@@ -687,7 +693,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
            return ret;
    }

-    auto sle = h();
+    auto const sle = h();
    if (!sle)
        return {};

@@ -700,6 +706,49 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 }
 // End CachedSLEs functions.

+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+template <class Callback>
+inline void
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    fetchAndModify(key_type const& key, Callback&& callback)
+{
+    static_assert(
+        !IsKeyCache, "fetchAndModify is only supported for value caches, not key-only caches");
+    static_assert(
+        std::is_same_v<std::shared_ptr<T>, SharedPointerType> ||
+            std::is_same_v<intr_ptr::SharedPtr<T>, SharedPointerType>,
+        "fetchAndModify requires std::shared_ptr<T> or intr_ptr::SharedPtr<T>");
+
+    std::scoped_lock<MutexType> const lock(mutex_);
+
+    // Same pointer-type dispatch as insert(): the placeholder must have exactly
+    // SharedPointerType so canonicalizeImpl can write the cached pointer back.
+    SharedPointerType entry = [] {
+        if constexpr (std::is_same_v<std::shared_ptr<T>, SharedPointerType>)
+        {
+            return std::make_shared<T>();
+        }
+        else
+        {
+            return intr_ptr::makeShared<T>();
+        }
+    }();
+    canonicalizeImpl(lock, key, entry, detail::ReplaceClient{});
+
+    ALWAYS(
+        entry != nullptr, "xrpl::TaggedCache::fetchAndModify : entry present after canonicalize");
+
+    callback(*entry);
+}
+
 template <
    class Key,
    class T,
@@ -713,7 +762,7 @@ inline SharedPointerType
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l)
 {
-    auto cit = cache_.find(key);
+    auto const cit = cache_.find(key);
    if (cit == cache_.end())
        return {};

@@ -195,7 +195,8 @@ private:
    {
        // Local lambda that converts a single hex char to four bits and
        // ORs those bits into a uint32_t.
-        auto hexCharToUInt = [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
+        auto const hexCharToUInt =
+            [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
            std::uint32_t nibble = 0xFFu;
            if (c < '0' || c > 'f')
                return ParseResult::BadChar;
@@ -453,7 +454,7 @@ public:
    {
        for (int i = kWidth - 1; i >= 0; --i)
        {
-            auto prev = data_[i];
+            auto const prev = data_[i];
            data_[i] = boost::endian::native_to_big(boost::endian::big_to_native(data_[i]) - 1);

            if (prev != 0)
@@ -0,0 +1,200 @@
+#pragma once
+
+#include <concepts>
+#include <type_traits>
+#include <utility>
+
+namespace xrpl {
+
+/**
+ * Opt-in bitwise operators for scoped enumerations.
+ *
+ * Provides `&`, `|`, `^`, `~` and the corresponding compound assignment forms
+ * for any scoped enumeration with an unsigned underlying type that opts in by
+ * specializing @ref OptIn:
+ *
+ * @code
+ * namespace xrpl {
+ *
+ * enum class MyFlags : std::uint32_t { a = 1, b = 2, c = 4 };
+ *
+ * template <>
+ * struct enum_bitops::OptIn<MyFlags> : std::true_type {};
+ *
+ * }  // namespace xrpl
+ * @endcode
+ *
+ * The operators are constexpr and noexcept, and return the enumeration type.
+ *
+ * @par Where the specialization may be declared
+ *   In namespace xrpl, or at global scope with full qualification, and after
+ *   the enumeration is defined but before the operators are first used. This
+ *   cannot be done in a nested namespace or at class scope; for enumerations
+ *   nested in a class this means after the class definition.
+ *
+ * @par Where the operators are found
+ *   The operators are declared in namespace xrpl, so argument-dependent lookup
+ *   will find them only for enumerations declared in xrpl or nested in a class
+ *   declared directly in xrpl. Enumerations in a nested namespace will only be
+ *   found from code inside xrpl, and only if no enclosing scope declares an
+ *   operator of the same name; elsewhere they require using-declarations.
+ */
+namespace enum_bitops {
+
+/**
+ * Types that may be opted in to the bitwise operators.
+ *
+ * Satisfied by a scoped enumeration whose underlying type is an unsigned
+ * integer type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Eligible = std::is_scoped_enum_v<T> && std::unsigned_integral<std::underlying_type_t<T>>;
+
+/**
+ * Opt-in switch for the bitwise operators.
+ *
+ * The primary template derives from std::false_type. Specialize it to derive
+ * from std::true_type to enable the operators for an @ref Eligible enumeration.
+ *
+ * @tparam T The scoped enumeration to opt in.
+ */
+template <Eligible T>
+struct OptIn : std::false_type
+{
+};
+
+/**
+ * Enumerations for which the bitwise operators are enabled.
+ *
+ * Satisfied when @p T satisfies @ref Eligible and @ref OptIn has been
+ * specialized for it to derive from std::true_type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Candidate = Eligible<T> && OptIn<T>::value;
+
+}  // namespace enum_bitops
+
+// These are declared in xrpl, not in enum_bitops, so that argument-dependent
+// lookup finds them for enumerations whose associated namespace is xrpl.
+
+/**
+ * @name Bitwise operators for opted-in scoped enumerations
+ *
+ * Each operator applies the corresponding built-in operator to the
+ * underlying values and converts the result back to the enumeration type.
+ * Both operands must have the same enumeration type; there is no implicit
+ * conversion to or from the underlying type.
+ */
+/** @{ */
+
+/**
+ * Bitwise AND.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in both @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator&(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) & std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in @p lhs, in @p rhs, or in both.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator|(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) | std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise exclusive OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in exactly one of @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator^(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) ^ std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise complement.
+ *
+ * The result has every bit of the underlying type that is clear in
+ * @p val, including bits that no enumerator names. It is intended for
+ * clearing flags, as in `flags & ~flag`.
+ *
+ * @param val The operand.
+ * @return The complement of @p val.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator~(T val) noexcept
+{
+    return static_cast<T>(~std::to_underlying(val));
+}
+
+/**
+ * Bitwise AND assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator&=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs & rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator|=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs | rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise exclusive OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator^=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs ^ rhs;
+    return lhs;
+}
+
+/** @} */
+
+}  // namespace xrpl
@@ -365,7 +365,7 @@ public:
    size() const
    {
        std::size_t ret = 0;
-        for (auto& p : map_)
+        for (auto const& p : map_)
            ret += p.size();
        return ret;
    }
@@ -2536,7 +2536,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
        return false;
    for (auto iter(cbegin()), last(cend()), otherLast(other.cend()); iter != last; ++iter)
    {
-        auto otherIter(other.find(extract(*iter)));
+        auto const otherIter(other.find(extract(*iter)));
        if (otherIter == otherLast)
            return false;
    }
@@ -68,7 +68,7 @@ struct LexicalCast<Out, std::string_view>
        if (first != last && *first == '+')
            ++first;

-        auto ret = std::from_chars(first, last, out);
+        auto const ret = std::from_chars(first, last, out);

        return ret.ec == std::errc() && ret.ptr == last;
    }
@@ -83,7 +83,7 @@ trimRight(String const& s)
 {
    using std::begin;
    using std::end;
-    auto first(begin(s));
+    auto const first(begin(s));
    auto last(end(s));
    last = trimRight(first, last);
    return {first, last};
@@ -32,7 +32,7 @@ public:
        Module,

        // Match nothing (used internally)
-        None
+        None,
    };

 private:
@@ -24,7 +24,7 @@ enum class Severity : std::uint8_t {
    Fatal = 5,

    Disabled = 6,
-    None = Disabled
+    None = Disabled,
 };

 /**
@@ -18,7 +18,7 @@ enum class Type : std::uint8_t {
    PrefixSha256 = 1,
    ThresholdSha256 = 2,
    RsaSha256 = 3,
-    Ed25519Sha256 = 4
+    Ed25519Sha256 = 4,
 };

 class Condition
@@ -49,7 +49,7 @@ public:

        using namespace der;

-        auto p = parsePreamble(s, ec);
+        auto const p = parsePreamble(s, ec);
        if (ec)
            return nullptr;

@@ -21,7 +21,7 @@ enum class Error {
    UnexpectedTag,
    LongTag,
    LargeSize,
-    PreimageTooLong
+    PreimageTooLong,
 };

 std::error_code
@@ -396,7 +396,7 @@ inline bool
 getIfExists<bool>(Section const& section, std::string const& name, bool& v)
 {
    int intVal = 0;
-    auto stat = getIfExists(section, name, intVal);
+    auto const stat = getIfExists(section, name, intVal);
    if (stat)
        v = bool(intVal);
    return stat;
@@ -94,6 +94,7 @@ struct Keys
    static constexpr auto kBbtOptions = "bbt_options";
    static constexpr auto kBgThreads = "bg_threads";
    static constexpr auto kBlockSize = "block_size";
+    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
    static constexpr auto kCacheAge = "cache_age";
    static constexpr auto kCacheMb = "cache_mb";
    static constexpr auto kCacheSize = "cache_size";
@@ -108,6 +109,8 @@ struct Keys
    static constexpr auto kFileSizeMult = "file_size_mult";
    static constexpr auto kFilterBits = "filter_bits";
    static constexpr auto kFilterFull = "filter_full";
+    static constexpr auto kGasLimit = "gas_limit";
+    static constexpr auto kGasPrice = "gas_price";
    static constexpr auto kHardSet = "hard_set";
    static constexpr auto kHighThreads = "high_threads";
    static constexpr auto kHoldTime = "hold_time";
@@ -93,14 +93,14 @@ public:
    void
    check(std::vector<TxID> accepted, Predicate&& pred)
    {
-        auto acceptTxid = accepted.begin();
+        auto const acceptTxid = accepted.begin();
        auto const ae = accepted.end();
        std::sort(acceptTxid, ae);

        // We want to remove all tracking entries for transactions that were
        // accepted as well as those which match the predicate.

-        auto i = removeIfIntersectOrMatch(
+        auto const i = removeIfIntersectOrMatch(
            tracker_.begin(),
            tracker_.end(),
            accepted.begin(),
@@ -779,7 +779,7 @@ Consensus<Adaptor>::peerProposalInternal(

    {
        // update current position
-        auto peerPosIt = currPeerPositions_.find(peerID);
+        auto const peerPosIt = currPeerPositions_.find(peerID);

        if (peerPosIt != currPeerPositions_.end())
        {
@@ -1110,7 +1110,7 @@ Consensus<Adaptor>::checkLedger(std::unique_ptr<std::stringstream> const& clog)
 {
    CLOG(clog) << "checkLedger. ";

-    auto netLgr = adaptor_.getPrevLedger(prevLedgerID_, previousLedger_, mode_.get());
+    auto const netLgr = adaptor_.getPrevLedger(prevLedgerID_, previousLedger_, mode_.get());
    CLOG(clog) << "network ledgerid " << netLgr << ",  "
               << "previous ledger " << prevLedgerID_ << ". ";

@@ -1159,8 +1159,8 @@ Consensus<Adaptor>::phaseOpen(std::unique_ptr<std::stringstream> const& clog)

    // it is shortly before ledger close time
    bool const anyTransactions = adaptor_.hasOpenTransactions();
-    auto proposersClosed = currPeerPositions_.size();
-    auto proposersValidated = adaptor_.proposersValidated(prevLedgerID_);
+    auto const proposersClosed = currPeerPositions_.size();
+    auto const proposersValidated = adaptor_.proposersValidated(prevLedgerID_);

    openTime_.tick(clock_.now());

@@ -1669,7 +1669,7 @@ Consensus<Adaptor>::haveConsensus(std::unique_ptr<std::stringstream> const& clog
    // CHECKME: should possibly count unacquired TX sets as disagreeing
    int agree = 0, disagree = 0;

-    auto ourPosition = result_->position.position();
+    auto const ourPosition = result_->position.position();

    // Count number of agreements/disagreements with our position
    for (auto const& [nodeId, peerPos] : currPeerPositions_)
@@ -1686,7 +1686,7 @@ Consensus<Adaptor>::haveConsensus(std::unique_ptr<std::stringstream> const& clog
            ++disagree;
        }
    }
-    auto currentFinished = adaptor_.proposersFinished(previousLedger_, prevLedgerID_);
+    auto const currentFinished = adaptor_.proposersFinished(previousLedger_, prevLedgerID_);

    JLOG(j_.debug()) << "Checking for TX consensus: agree=" << agree << ", disagree=" << disagree;

@@ -1812,7 +1812,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
               << ". ";
    JLOG(j_.debug()) << "createDisputes " << result_->txns.id() << " to " << o.id();

-    auto differences = result_->txns.compare(o);
+    auto const differences = result_->txns.compare(o);

    int dc = 0;

@@ -1826,7 +1826,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
            "xrpl::Consensus::createDisputes : has disputed transactions");

        TxT const tx = inThisSet ? result_->txns.find(txId) : o.find(txId);
-        auto txID = tx.id();
+        auto const txID = tx.id();

        if (result_->disputes.find(txID) != result_->disputes.end())
            continue;
@@ -1837,7 +1837,8 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
            tx,
            result_->txns.exists(txID),
            std::max(prevProposers_, currPeerPositions_.size()),
-            j_};
+            j_,
+        };

        // Update all of the available peer's votes on the disputed transaction
        for (auto const& [nodeId, peerPos] : currPeerPositions_)
@@ -145,18 +145,26 @@ struct ConsensusParms
    std::map<AvalancheState, AvalancheCutoff> const avalancheCutoffs{
        // {state, {time, percent, nextState}},
        // Initial state: 50% of nodes must vote yes
-        {AvalancheState::Init,
-         {.consensusTime = 0, .consensusPct = 50, .next = AvalancheState::Mid}},
+        {
+            AvalancheState::Init,
+            {.consensusTime = 0, .consensusPct = 50, .next = AvalancheState::Mid},
+        },
        // mid-consensus starts after 50% of the previous round time, and
        // requires 65% yes
-        {AvalancheState::Mid,
-         {.consensusTime = 50, .consensusPct = 65, .next = AvalancheState::Late}},
+        {
+            AvalancheState::Mid,
+            {.consensusTime = 50, .consensusPct = 65, .next = AvalancheState::Late},
+        },
        // late consensus starts after 85% time, and requires 70% yes
-        {AvalancheState::Late,
-         {.consensusTime = 85, .consensusPct = 70, .next = AvalancheState::Stuck}},
+        {
+            AvalancheState::Late,
+            {.consensusTime = 85, .consensusPct = 70, .next = AvalancheState::Stuck},
+        },
        // we're stuck after 2x time, requires 95% yes votes
-        {AvalancheState::Stuck,
-         {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck}},
+        {
+            AvalancheState::Stuck,
+            {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck},
+        },
    };

    /**
@@ -59,7 +59,7 @@ enum class ConsensusMode {
     * if we entered the round observing, but is used to indicate we did
     * have the wrongLedger at some point.
     */
-    SwitchedLedger
+    SwitchedLedger,
 };

 inline std::string
@@ -222,7 +222,7 @@ medianCloseOffset(ConsensusCloseTimes const& times)

    // Accumulate weight in time order; the first bin to reach halfWeight is
    // the (lower) weighted median. Returns true once that bin is found.
-    auto step = [&](time_point t, std::int64_t w) {
+    auto const step = [&](time_point t, std::int64_t w) {
        XRPL_ASSERT(tally < halfWeight, "xrpl::medianCloseOffset::step : median not yet found");
        tally += w;
        if (tally >= halfWeight)
@@ -267,7 +267,7 @@ enum class ConsensusState {
    No,       ///< We do not have consensus
    MovedOn,  ///< The network has consensus without us
    Expired,  ///< Consensus time limit has hard-expired
-    Yes       ///< We have consensus along with the network
+    Yes,      ///< We have consensus along with the network
 };

 /**
@@ -266,7 +266,7 @@ template <class Tx, class NodeId>
 void
 DisputedTx<Tx, NodeId>::unVote(NodeId const& peer)
 {
-    auto it = votes_.find(peer);
+    auto const it = votes_.find(peer);

    if (it != votes_.end())
    {
@@ -211,7 +211,7 @@ struct Node
    void
    erase(Node const* child)
    {
-        auto it = std::ranges::find_if(
+        auto const it = std::ranges::find_if(
            children, [child](std::unique_ptr<Node> const& curr) { return curr.get() == child; });
        XRPL_ASSERT(it != children.end(), "xrpl::Node::erase : valid input");
        std::swap(*it, children.back());
@@ -184,7 +184,7 @@ enum class ValStatus {
    /**
     * Multiple validations by a validator for different ledgers
     */
-    Conflicting
+    Conflicting,
 };

 inline std::string
@@ -366,7 +366,7 @@ private:
    removeTrie(std::scoped_lock<Mutex> const&, NodeID const& nodeID, Validation const& val)
    {
        {
-            auto it = acquiring_.find(std::make_pair(val.seq(), val.ledgerID()));
+            auto const it = acquiring_.find(std::make_pair(val.seq(), val.ledgerID()));
            if (it != acquiring_.end())
            {
                it->second.erase(nodeID);
@@ -375,7 +375,7 @@ private:
            }
        }
        {
-            auto it = lastLedger_.find(nodeID);
+            auto const it = lastLedger_.find(nodeID);
            if (it != lastLedger_.end() && it->second.id() == val.ledgerID())
            {
                trie_.remove(it->second);
@@ -443,7 +443,7 @@ private:
        // Clear any prior acquiring ledger for this node
        if (prior)
        {
-            auto it = acquiring_.find(*prior);
+            auto const it = acquiring_.find(*prior);
            if (it != acquiring_.end())
            {
                it->second.erase(nodeID);
@@ -455,7 +455,7 @@ private:
        checkAcquired(lock);

        std::pair<Seq, ID> const valPair{val.seq(), val.ledgerID()};
-        auto it = acquiring_.find(valPair);
+        auto const it = acquiring_.find(valPair);
        if (it != acquiring_.end())
        {
            it->second.insert(nodeID);
@@ -529,7 +529,7 @@ private:
            }
            else
            {
-                auto cit = typename decltype(current_)::const_iterator{it};
+                auto const cit = typename decltype(current_)::const_iterator{it};
                // contains a live record
                f(cit->first, cit->second);
                ++it;
@@ -554,7 +554,7 @@ private:
    void
    byLedger(std::scoped_lock<Mutex> const&, ID const& ledgerID, Pre&& pre, F&& f)
    {
-        auto it = byLedger_.find(ledgerID);
+        auto const it = byLedger_.find(ledgerID);
        if (it != byLedger_.end())
        {
            // Update set time since it is being used
@@ -857,7 +857,7 @@ public:
        if (!preferred)
        {
            // fall back to majority over acquiring ledgers
-            auto it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
+            auto const it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
                std::pair<Seq, ID> const& aKey = a.first;
                typename HashSet<NodeID>::size_type const& aSize = a.second.size();
                std::pair<Seq, ID> const& bKey = b.first;
@@ -937,7 +937,7 @@ public:
            return (preferred->first >= minSeq) ? preferred->second : lcl.id();

        // Otherwise, rely on peer ledgers
-        auto it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
+        auto const it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
            // Prefer larger counts, then larger ids on ties
            // (max_element expects this to return true if a < b)
            return std::tie(a.second, a.first) < std::tie(b.second, b.first);
@@ -156,7 +156,7 @@ public:
        {
            if (!allClosuresDoneCond_.wait_for(lock, wait, [this] { return closureCount_ == 0; }))
            {
-                if (auto stream = j.error())
+                if (auto const stream = j.error())
                    stream << name << " waiting for ClosureCounter::join().";
                allClosuresDoneCond_.wait(lock, [this] { return closureCount_ == 0; });
            }
@@ -37,7 +37,7 @@ enum class HashRouterFlags : std::uint16_t {
    PRIVATE6 = 0x2000,
    // Used in apply.cpp
    PRIVATE7 = 0x4000,
-    PRIVATE8 = 0x8000
+    PRIVATE8 = 0x8000,
 };

 constexpr HashRouterFlags
@@ -221,7 +221,7 @@ public:
    /**
     * Add a suppression peer and get message's relay status.
     * Return pair:
-     * element 1: true if the key is added.
+     * element 1: true if the peer is added.
     * element 2: optional is seated to the relay time point or
     * is unseated if has not relayed yet.
     */
@@ -30,12 +30,12 @@ private:
        using namespace std::chrono_literals;
        int const maxLimit = std::numeric_limits<int>::max();

-        auto add = [this](
-                       JobType jt,
-                       std::string name,
-                       int limit,
-                       std::chrono::milliseconds avgLatency,
-                       std::chrono::milliseconds peakLatency) {
+        auto const add = [this](
+                             JobType jt,
+                             std::string name,
+                             int limit,
+                             std::chrono::milliseconds avgLatency,
+                             std::chrono::milliseconds peakLatency) {
            XRPL_ASSERT(!map.contains(jt), "xrpl::JobTypes::JobTypes::add : unique job type input");

            [[maybe_unused]] auto const inserted =
@@ -177,12 +177,13 @@ measureDurationAndLog(
    std::chrono::duration<Rep, Period> maxDelay,
    beast::Journal const& journal)
 {
-    auto startTime = std::chrono::high_resolution_clock::now();
+    auto const startTime = std::chrono::high_resolution_clock::now();

    auto result = func();

-    auto endTime = std::chrono::high_resolution_clock::now();
-    auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(endTime - startTime);
+    auto const endTime = std::chrono::high_resolution_clock::now();
+    auto const duration =
+        std::chrono::duration_cast<std::chrono::milliseconds>(endTime - startTime);
    if (duration > maxDelay)
    {
        JLOG(journal.warn()) << actionDescription << " took " << duration.count() << " ms";
@@ -95,7 +95,7 @@ private:
        ArraySeparator,
        MemberSeparator,
        Comment,
-        Error
+        Error,
    };

    class Token
@@ -26,7 +26,7 @@ enum class ValueType {
    String,    ///< UTF-8 string value
    Boolean,   ///< bool value
    Array,     ///< array value (ordered list)
-    Object     ///< object value (collection of name/value pairs).
+    Object,    ///< object value (collection of name/value pairs).
 };

 /**
@@ -165,7 +165,7 @@ public:
        beast::Journal j)
    {
        // Ask implementation what to do
-        auto actions = doVoting(
+        auto const actions = doVoting(
            lastClosedLedger->rules(),
            lastClosedLedger->parentCloseTime(),
            getEnabledAmendments(*lastClosedLedger),
@@ -1,7 +1,7 @@
 #pragma once

 #include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/safe_cast.h>
+#include <xrpl/basics/enum_bitops.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/OwnerCounts.h>
 #include <xrpl/ledger/ReadView.h>
@@ -22,80 +22,39 @@

 namespace xrpl {

-// Bitwise flag enum with existing operator overloads
-// NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-enum ApplyFlags : std::uint32_t {
-    TapNone = 0x00,
+enum class ApplyFlags : std::uint32_t {
+    None = 0x00,

    // This is a local transaction with the
    // fail_hard flag set.
-    TapFailHard = 0x10,
+    FailHard = 0x10,

    // This is not the transaction's last pass
    // Transaction can be retried, soft failures allowed
-    TapRetry = 0x20,
+    Retry = 0x20,

    // Transaction came from a privileged source
-    TapUnlimited = 0x400,
+    Unlimited = 0x400,

    // Transaction is executing as part of a batch
-    TapBatch = 0x800,
+    Batch = 0x800,

    // Transaction shouldn't be applied
    // Signatures shouldn't be checked
-    TapDryRun = 0x1000,
+    DryRun = 0x1000,

    // Transaction is being preflighted as the payload of a
    // TransactionProposalCreate. Its signatures are collected on-ledger
    // afterward, so signature-presence checks (e.g. Batch signer matching)
    // are skipped at proposal-creation time (On-Chain Cosigner spec
    // §5.3.1.2).
-    TapProposal = 0x2000
+    Proposal = 0x2000,
 };

-constexpr ApplyFlags
-operator|(ApplyFlags const& lhs, ApplyFlags const& rhs)
+template <>
+struct enum_bitops::OptIn<ApplyFlags> : std::true_type
 {
-    return safeCast<ApplyFlags>(
-        safeCast<std::underlying_type_t<ApplyFlags>>(lhs) |
-        safeCast<std::underlying_type_t<ApplyFlags>>(rhs));
-}
-
-static_assert((TapFailHard | TapRetry) == safeCast<ApplyFlags>(0x30u), "ApplyFlags operator |");
-static_assert((TapRetry | TapFailHard) == safeCast<ApplyFlags>(0x30u), "ApplyFlags operator |");
-
-constexpr ApplyFlags
-operator&(ApplyFlags const& lhs, ApplyFlags const& rhs)
-{
-    return safeCast<ApplyFlags>(
-        safeCast<std::underlying_type_t<ApplyFlags>>(lhs) &
-        safeCast<std::underlying_type_t<ApplyFlags>>(rhs));
-}
-
-static_assert((TapFailHard & TapRetry) == TapNone, "ApplyFlags operator &");
-static_assert((TapRetry & TapFailHard) == TapNone, "ApplyFlags operator &");
-
-constexpr ApplyFlags
-operator~(ApplyFlags const& flags)
-{
-    return safeCast<ApplyFlags>(~safeCast<std::underlying_type_t<ApplyFlags>>(flags));
-}
-
-static_assert(~TapRetry == safeCast<ApplyFlags>(0xFFFFFFDFu), "ApplyFlags operator ~");
-
-inline ApplyFlags
-operator|=(ApplyFlags& lhs, ApplyFlags const& rhs)
-{
-    lhs = lhs | rhs;
-    return lhs;
-}
-
-inline ApplyFlags
-operator&=(ApplyFlags& lhs, ApplyFlags const& rhs)
-{
-    lhs = lhs & rhs;
-    return lhs;
-}
+};

 //------------------------------------------------------------------------------

@@ -257,13 +257,42 @@ public:
        header_.validated = true;
    }

-    void
+    /**
+     * Mark this ledger as accepted and attempt to make it immutable.
+     *
+     * The close-time fields are recorded first, since the ledger hash covers
+     * them.
+     *
+     * @param closeTime The consensus-agreed close time.
+     * @param closeResolution The close time resolution.
+     * @param correctCloseTime Whether consensus agreed on the close time. If
+     *        false, kSLcfNoConsensusTime is recorded in closeFlags instead.
+     * @return What setImmutable() returned.
+     */
+    [[nodiscard]] bool
    setAccepted(
        NetClock::time_point closeTime,
        NetClock::duration closeResolution,
        bool correctCloseTime);

-    void
+    /**
+     * Mark this ledger as immutable, so it can no longer be modified.
+     *
+     * A ledger built or loaded locally cannot have an invalid map, since only
+     * a map syncing against hashes from outside can be proven impossible (see
+     * SHAMap::addKnownNode), so a caller on such a path may treat a false
+     * return as a broken internal invariant. A caller assembling a ledger from
+     * peer data may not: for it, false is an outcome a peer can produce.
+     *
+     * @param rehash Whether to recompute the ledger hash from the header
+     *        fields. The transaction and account hashes are recomputed from the
+     *        maps too, but only the first time.
+     * @return false if either map is Invalid, leaving the immutable flag as it
+     *         was and the header untouched. A map invalidated partway through can
+     *         still leave the other one immutable, so a false return means the
+     *         ledger must be discarded rather than retried.
+     */
+    [[nodiscard]] bool
    setImmutable(bool rehash = true);

    bool
@@ -272,23 +301,28 @@ public:
        return immutable_;
    }

-    /*  Mark this ledger as "should be full".
+    /**
+     * @return Whether both maps can still be the maps the header names. See
+     *         SHAMap::isValid().
+     */
+    [[nodiscard]] bool
+    mapsValid() const
+    {
+        return txMap_.isValid() && stateMap_.isValid();
+    }

-        "Full" is metadata property of the ledger, it indicates
-        that the local server wants all the corresponding nodes
-        in durable storage.
-
-        This is marked `const` because it reflects metadata
-        and not data that is in common with other nodes on the
-        network.
-    */
+    /**
+     * Mark this ledger as "should be full", indicating that the local server
+     * wants all the corresponding nodes in durable storage.
+     *
+     * Const because it reflects metadata, not data this ledger shares with
+     * other nodes on the network.
+     */
    void
    setFull() const
    {
-        txMap_.setFull();
-        txMap_.setLedgerSeq(header_.seq);
-        stateMap_.setFull();
-        stateMap_.setLedgerSeq(header_.seq);
+        txMap_.setFull(header_.seq);
+        stateMap_.setFull(header_.seq);
    }

    void
@@ -418,6 +452,22 @@ private:
    static std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
    deserializeTxPlusMeta(SHAMapItem const& item);

+    /**
+     * Make both maps immutable.
+     *
+     * Each map is settled on its own, so neither is left mid-sync because the
+     * other refused.
+     *
+     * @return Whether both maps are immutable.
+     */
+    [[nodiscard]] bool
+    setMapsImmutable()
+    {
+        bool const txImmutable = txMap_.setImmutable();
+        bool const stateImmutable = stateMap_.setImmutable();
+        return txImmutable && stateImmutable;
+    }
+
    bool immutable_;

    // A SHAMap containing the transactions associated with this ledger.
@@ -20,7 +20,8 @@ constexpr std::chrono::seconds kLedgerPossibleTimeResolutions[] = {
    std::chrono::seconds{30},
    std::chrono::seconds{60},
    std::chrono::seconds{90},
-    std::chrono::seconds{120}};
+    std::chrono::seconds{120},
+};

 /**
 * Initial resolution of ledger close time.
@@ -35,7 +35,7 @@ public:
    {
        std::scoped_lock const lock(mutex_);

-        auto it = map_.find(seq);
+        auto const it = map_.find(seq);

        if ((it == map_.end()) || it->second)
        {
@@ -88,7 +88,7 @@ public:
        std::unique_lock<std::mutex> lock(mutex_);
        do
        {
-            auto it = map_.find(seq);
+            auto const it = map_.find(seq);

            if (it == map_.end())
            {
@@ -164,7 +164,7 @@ getCandidateLedger(LedgerIndex requested)
 areCompatible(
    ReadView const& validLedger,
    ReadView const& testLedger,
-    beast::Journal::Stream& s,
+    beast::Journal::Stream const& s,
    char const* reason);

 [[nodiscard]] bool
@@ -172,7 +172,7 @@ areCompatible(
    UInt256 const& validHash,
    LedgerIndex validIndex,
    ReadView const& testLedger,
-    beast::Journal::Stream& s,
+    beast::Journal::Stream const& s,
    char const* reason);

 //------------------------------------------------------------------------------
@@ -185,7 +185,7 @@ areCompatible(
 dirLink(
    ApplyView& view,
    AccountID const& owner,
-    SLE::pointer& object,
+    SLE::pointer const& object,
    SF_UINT64 const& node = sfOwnerNode);

 /**
@@ -265,6 +265,13 @@ canWithdraw(
 [[nodiscard]] TER
 canWithdraw(ReadView const& view, STTx const& tx);

+/**
+ * Pays out a withdrawal from a vault or loan broker pseudo-account.
+ *
+ * `sourceAmount` leaves `sourceAcct` and `destinationAmount` reaches `dstAcct`.
+ * The two differ only when the withdrawal carries a transfer fee; the
+ * difference is the fee and is settled through the issuer.
+ */
 [[nodiscard]] TER
 doWithdraw(
    ApplyViewContext ctx,
@@ -272,7 +279,8 @@ doWithdraw(
    AccountID const& dstAcct,
    AccountID const& sourceAcct,
    XRPAmount priorBalance,
-    STAmount const& amount,
+    STAmount const& destinationAmount,
+    STAmount const& sourceAmount,
    beast::Journal j);

 /**
@@ -30,13 +30,17 @@ public:
    static constexpr size_t kInitialBufferSize = kilobytes(256);

    RawStateTable()
-        : monotonicResource_{std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
-              kInitialBufferSize)}
+        : monotonicResource_{
+              std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
+                  kInitialBufferSize),
+          }
        , items_{monotonicResource_.get()} {};

    RawStateTable(RawStateTable const& rhs)
-        : monotonicResource_{std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
-              kInitialBufferSize)}
+        : monotonicResource_{
+              std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
+                  kInitialBufferSize),
+          }
        , items_{rhs.items_, monotonicResource_.get()}
        , dropsDestroyed_{rhs.dropsDestroyed_} {};

@@ -1,36 +0,0 @@
-#pragma once
-
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/entries/SLEBase.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
-#include <xrpl/protocol/STXChainBridge.h>
-
-namespace xrpl {
-
-template <typename ViewT>
-class BridgeEntry : public SLEBase<ViewT, ltBRIDGE>
-{
-public:
-    using Base = SLEBase<ViewT, ltBRIDGE>;
-
-    // Inherit base constructors: adopt an existing SLE, or resolve one from a
-    // Keylet against the view.
-    using Base::Base;
-
-    explicit BridgeEntry(
-        STXChainBridge const& bridge,
-        STXChainBridge::ChainType chainType,
-        Base::ViewRefType view,
-        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
-        : Base(keylet::bridge(bridge, chainType), view, j)
-    {
-    }
-};
-
-using BridgeEntryR = BridgeEntry<ReadView>;
-using BridgeEntryW = BridgeEntry<ApplyView>;
-
-}  // namespace xrpl
@@ -1,38 +0,0 @@
-#pragma once
-
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/entries/SLEBase.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
-#include <xrpl/protocol/STXChainBridge.h>
-
-#include <cstdint>
-
-namespace xrpl {
-
-template <typename ViewT>
-class XChainOwnedClaimIDEntry : public SLEBase<ViewT, ltXCHAIN_OWNED_CLAIM_ID>
-{
-public:
-    using Base = SLEBase<ViewT, ltXCHAIN_OWNED_CLAIM_ID>;
-
-    // Inherit base constructors: adopt an existing SLE, or resolve one from a
-    // Keylet against the view.
-    using Base::Base;
-
-    explicit XChainOwnedClaimIDEntry(
-        STXChainBridge const& bridge,
-        std::uint64_t seq,
-        Base::ViewRefType view,
-        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
-        : Base(keylet::xChainClaimID(bridge, seq), view, j)
-    {
-    }
-};
-
-using XChainOwnedClaimIDEntryR = XChainOwnedClaimIDEntry<ReadView>;
-using XChainOwnedClaimIDEntryW = XChainOwnedClaimIDEntry<ApplyView>;
-
-}  // namespace xrpl
@@ -1,39 +0,0 @@
-#pragma once
-
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/entries/SLEBase.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/LedgerFormats.h>
-#include <xrpl/protocol/STXChainBridge.h>
-
-#include <cstdint>
-
-namespace xrpl {
-
-template <typename ViewT>
-class XChainOwnedCreateAccountClaimIDEntry
-    : public SLEBase<ViewT, ltXCHAIN_OWNED_CREATE_ACCOUNT_CLAIM_ID>
-{
-public:
-    using Base = SLEBase<ViewT, ltXCHAIN_OWNED_CREATE_ACCOUNT_CLAIM_ID>;
-
-    // Inherit base constructors: adopt an existing SLE, or resolve one from a
-    // Keylet against the view.
-    using Base::Base;
-
-    explicit XChainOwnedCreateAccountClaimIDEntry(
-        STXChainBridge const& bridge,
-        std::uint64_t seq,
-        Base::ViewRefType view,
-        beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
-        : Base(keylet::xChainCreateAccountClaimID(bridge, seq), view, j)
-    {
-    }
-};
-
-using XChainOwnedCreateAccountClaimIDEntryR = XChainOwnedCreateAccountClaimIDEntry<ReadView>;
-using XChainOwnedCreateAccountClaimIDEntryW = XChainOwnedCreateAccountClaimIDEntry<ApplyView>;
-
-}  // namespace xrpl
@@ -2,7 +2,6 @@

 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Number.h>
-#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ApplyView.h>
@@ -29,7 +28,6 @@
 #include <expected>
 #include <functional>
 #include <optional>
-#include <stdexcept>
 #include <tuple>
 #include <utility>

@@ -224,7 +222,7 @@ getAMMOfferStartWithTakerGets(
    if (nTakerGetsConstraint < *nTakerGets)
        nTakerGets = nTakerGetsConstraint;

-    auto getAmounts = [&pool, &tfee](Number const& nTakerGetsProposed) {
+    auto const getAmounts = [&pool, &tfee](Number const& nTakerGetsProposed) {
        // Round downward to minimize the offer and to maximize the quality.
        // This has the most impact when takerGets is integral.
        auto const takerGets =
@@ -292,7 +290,7 @@ getAMMOfferStartWithTakerPays(
    if (nTakerPaysConstraint < *nTakerPays)
        nTakerPays = nTakerPaysConstraint;

-    auto getAmounts = [&pool, &tfee](Number const& nTakerPaysProposed) {
+    auto const getAmounts = [&pool, &tfee](Number const& nTakerPaysProposed) {
        // Round downward to minimize the offer and to maximize the quality.
        // This has the most impact when takerPays is integral.
        auto const takerPays =
@@ -313,11 +311,11 @@ getAMMOfferStartWithTakerPays(
 * is equal to LOB quality (in this case AMM offer quality is
 * better than LOB quality) or AMM offer is equal to LOB quality
 * (in this case SPQ is better than LOB quality).
- * Pre-amendment code calculates takerPays first. If takerGets is the
- * economically coarser integral side, it is rounded down, which results in
- * worse offer quality than LOB quality, and the offer might fail to generate.
- * Post-amendment code calculates the economically coarser integral offer side
- * first. The result is rounded down, which makes the offer quality better.
+ * The economically coarser integral offer side is calculated first. The
+ * result is rounded down, which makes the offer quality better. Calculating
+ * takerPays first instead would round down takerGets when that is the coarser
+ * side, giving worse quality than LOB quality, and the offer might fail to
+ * generate.
 *   It might not be possible to match either SPQ or AMM offer to LOB
 * quality. This generally happens at higher fees.
 * @param pool AMM pool balances
@@ -331,69 +329,8 @@ changeSpotPriceQuality(
    TAmounts<TIn, TOut> const& pool,
    Quality const& quality,
    std::uint16_t tfee,
-    Rules const& rules,
    beast::Journal j)
 {
-    if (!rules.enabled(fixAMMv1_1))
-    {
-        // Finds takerPays (i) and takerGets (o) such that given pool
-        // composition poolGets(I) and poolPays(O): (O - o) / (I + i) = quality.
-        // Where takerGets is calculated as the swapAssetIn (see below).
-        // The above equation produces the quadratic equation:
-        // i^2*(1-fee) + i*I*(2-fee) + I^2 - I*O/quality,
-        // which is solved for i, and o is found with swapAssetIn().
-        auto const f = feeMult(tfee);  // 1 - fee
-        auto const& a = f;
-        auto const b = pool.in * (1 + f);
-        Number const c = pool.in * pool.in - pool.in * pool.out * quality.rate();
-        auto const res = b * b - 4 * a * c;
-        if (res < 0)
-        {
-            return std::nullopt;  // LCOV_EXCL_LINE
-        }
-        if (auto const nTakerPaysPropose = (-b + root2(res)) / (2 * a); nTakerPaysPropose > 0)
-        {
-            auto const nTakerPays = [&] {
-                // The fee might make the AMM offer quality less than CLOB
-                // quality. Therefore, AMM offer has to satisfy this constraint:
-                // o / i >= q. Substituting o with swapAssetIn() gives: i <= O /
-                // q - I / (1 - fee).
-                auto const nTakerPaysConstraint = pool.out * quality.rate() - pool.in / f;
-                if (nTakerPaysPropose > nTakerPaysConstraint)
-                    return nTakerPaysConstraint;
-                return nTakerPaysPropose;
-            }();
-            if (nTakerPays <= 0)
-            {
-                JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in)
-                                << " " << to_string(pool.out) << " " << quality << " " << tfee;
-                return std::nullopt;
-            }
-            auto const takerPays =
-                toAmount<TIn>(getAsset(pool.in), nTakerPays, Number::RoundingMode::Upward);
-            // should not fail
-            auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
-            if (Quality{amounts} < quality &&
-                !withinRelativeDistance(Quality{amounts}, quality, Number(1, -7)))
-            {
-                JLOG(j.error()) << "changeSpotPriceQuality failed: " << to_string(pool.in) << " "
-                                << to_string(pool.out) << " "
-                                << " " << quality << " " << tfee << " " << to_string(amounts.in)
-                                << " " << to_string(amounts.out);
-                Throw<std::runtime_error>("changeSpotPriceQuality failed");
-            }
-
-            JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
-                            << to_string(pool.out) << " "
-                            << " " << quality << " " << tfee << " " << to_string(amounts.in) << " "
-                            << to_string(amounts.out);
-            return amounts;
-        }
-        JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in) << " "
-                        << to_string(pool.out) << " " << quality << " " << tfee;
-        return std::nullopt;
-    }
-
    auto amounts = [&] {
        bool const inIntegral = getAsset(pool.in).integral();
        bool const outIntegral = getAsset(pool.out).integral();
@@ -459,57 +396,49 @@ template <typename TIn, typename TOut>
 TOut
 swapAssetIn(TAmounts<TIn, TOut> const& pool, TIn const& assetIn, std::uint16_t tfee)
 {
-    if (auto const& rules = getCurrentTransactionRules(); rules && rules->enabled(fixAMMv1_1))
-    {
-        // set rounding to always favor the amm. Clip to zero.
-        // calculate:
-        // pool.out -
-        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        // and explicitly set the rounding modes
-        // Favoring the amm means we should:
-        // minimize:
-        // pool.out -
-        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        // maximize:
-        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        // (pool.in * pool.out)
-        // minimize:
-        // (pool.in + assetIn * feeMult(tfee)),
-        // minimize:
-        // assetIn * feeMult(tfee)
-        // feeMult is: (1-fee), fee is tfee/100000
-        // minimize:
-        // 1-fee
-        // maximize:
-        // fee
-        SaveNumberRoundMode const _{Number::getround()};
+    // set rounding to always favor the amm. Clip to zero.
+    // calculate:
+    // pool.out -
+    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+    // and explicitly set the rounding modes
+    // Favoring the amm means we should:
+    // minimize:
+    // pool.out -
+    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+    // maximize:
+    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+    // (pool.in * pool.out)
+    // minimize:
+    // (pool.in + assetIn * feeMult(tfee)),
+    // minimize:
+    // assetIn * feeMult(tfee)
+    // feeMult is: (1-fee), fee is tfee/100000
+    // minimize:
+    // 1-fee
+    // maximize:
+    // fee
+    SaveNumberRoundMode const _{Number::getround()};

-        Number::setround(Number::RoundingMode::Upward);
-        auto const numerator = pool.in * pool.out;
-        auto const fee = getFee(tfee);
+    Number::setround(Number::RoundingMode::Upward);
+    auto const numerator = pool.in * pool.out;
+    auto const fee = getFee(tfee);

-        Number::setround(Number::RoundingMode::Downward);
-        auto const denom = pool.in + assetIn * (1 - fee);
+    Number::setround(Number::RoundingMode::Downward);
+    auto const denom = pool.in + assetIn * (1 - fee);

-        if (denom.signum() <= 0)
-            return toAmount<TOut>(getAsset(pool.out), 0);
+    if (denom.signum() <= 0)
+        return toAmount<TOut>(getAsset(pool.out), 0);

-        Number::setround(Number::RoundingMode::Upward);
-        auto const ratio = numerator / denom;
+    Number::setround(Number::RoundingMode::Upward);
+    auto const ratio = numerator / denom;

-        Number::setround(Number::RoundingMode::Downward);
-        auto const swapOut = pool.out - ratio;
+    Number::setround(Number::RoundingMode::Downward);
+    auto const swapOut = pool.out - ratio;

-        if (swapOut.signum() < 0)
-            return toAmount<TOut>(getAsset(pool.out), 0);
+    if (swapOut.signum() < 0)
+        return toAmount<TOut>(getAsset(pool.out), 0);

-        return toAmount<TOut>(getAsset(pool.out), swapOut, Number::RoundingMode::Downward);
-    }
-
-    return toAmount<TOut>(
-        getAsset(pool.out),
-        pool.out - (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-        Number::RoundingMode::Downward);
+    return toAmount<TOut>(getAsset(pool.out), swapOut, Number::RoundingMode::Downward);
 }

 /**
@@ -526,57 +455,49 @@ template <typename TIn, typename TOut>
 TIn
 swapAssetOut(TAmounts<TIn, TOut> const& pool, TOut const& assetOut, std::uint16_t tfee)
 {
-    if (auto const& rules = getCurrentTransactionRules(); rules && rules->enabled(fixAMMv1_1))
+    // set rounding to always favor the amm. Clip to zero.
+    // calculate:
+    // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) /
+    // (1-tfee/100000)
+    // maximize:
+    // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in)
+    // maximize:
+    // (pool.in * pool.out) / (pool.out - assetOut)
+    // maximize:
+    // (pool.in * pool.out)
+    // minimize
+    // (pool.out - assetOut)
+    // minimize:
+    // (1-tfee/100000)
+    // maximize:
+    // tfee/100000
+
+    SaveNumberRoundMode const _{Number::getround()};
+
+    Number::setround(Number::RoundingMode::Upward);
+    auto const numerator = pool.in * pool.out;
+
+    Number::setround(Number::RoundingMode::Downward);
+    auto const denom = pool.out - assetOut;
+    if (denom.signum() <= 0)
    {
-        // set rounding to always favor the amm. Clip to zero.
-        // calculate:
-        // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) /
-        // (1-tfee/100000)
-        // maximize:
-        // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in)
-        // maximize:
-        // (pool.in * pool.out) / (pool.out - assetOut)
-        // maximize:
-        // (pool.in * pool.out)
-        // minimize
-        // (pool.out - assetOut)
-        // minimize:
-        // (1-tfee/100000)
-        // maximize:
-        // tfee/100000
-
-        SaveNumberRoundMode const _{Number::getround()};
-
-        Number::setround(Number::RoundingMode::Upward);
-        auto const numerator = pool.in * pool.out;
-
-        Number::setround(Number::RoundingMode::Downward);
-        auto const denom = pool.out - assetOut;
-        if (denom.signum() <= 0)
-        {
-            return toMaxAmount<TIn>(getAsset(pool.in));
-        }
-
-        Number::setround(Number::RoundingMode::Upward);
-        auto const ratio = numerator / denom;
-        auto const numerator2 = ratio - pool.in;
-        auto const fee = getFee(tfee);
-
-        Number::setround(Number::RoundingMode::Downward);
-        auto const feeMult = 1 - fee;
-
-        Number::setround(Number::RoundingMode::Upward);
-        auto const swapIn = numerator2 / feeMult;
-        if (swapIn.signum() < 0)
-            return toAmount<TIn>(getAsset(pool.in), 0);
-
-        return toAmount<TIn>(getAsset(pool.in), swapIn, Number::RoundingMode::Upward);
+        return toMaxAmount<TIn>(getAsset(pool.in));
    }

-    return toAmount<TIn>(
-        getAsset(pool.in),
-        ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) / feeMult(tfee),
-        Number::RoundingMode::Upward);
+    Number::setround(Number::RoundingMode::Upward);
+    auto const ratio = numerator / denom;
+    auto const numerator2 = ratio - pool.in;
+    auto const fee = getFee(tfee);
+
+    Number::setround(Number::RoundingMode::Downward);
+    auto const feeMult = 1 - fee;
+
+    Number::setround(Number::RoundingMode::Upward);
+    auto const swapIn = numerator2 / feeMult;
+    if (swapIn.signum() < 0)
+        return toAmount<TIn>(getAsset(pool.in), 0);
+
+    return toAmount<TIn>(getAsset(pool.in), swapIn, Number::RoundingMode::Upward);
 }

 /**
@@ -870,8 +791,8 @@ deleteAMMAccount(Sandbox& view, Asset const& asset, Asset const& asset2, beast::
 */
 void
 initializeFeeAuctionVote(
-    ApplyView& view,
-    SLE::pointer& ammSle,
+    ApplyView const& view,
+    SLE::pointer const& ammSle,
    AccountID const& account,
    Asset const& lptAsset,
    std::uint16_t tfee);
@@ -893,7 +814,7 @@ std::expected<bool, TER>
 verifyAndAdjustLPTokenBalance(
    Sandbox& sb,
    STAmount const& lpTokens,
-    SLE::pointer& ammSle,
+    SLE::pointer const& ammSle,
    AccountID const& account);

 }  // namespace xrpl
@@ -14,6 +14,7 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
@@ -27,6 +28,8 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>

+#include <cstdint>
+
 namespace xrpl {

 /**
@@ -560,4 +563,54 @@ escrowUnlockApplyHelper<MPTIssue>(
        journal);
 }

+/**
+ * Smart escrow kill switches, driven by the voted FeeSettings.
+ *
+ * Zeroing `bytecodeSizeLimit` stops new uploads while leaving existing escrows
+ * finishable without forcing holders to wait for `CancelAfter`.
+ * Zeroing `gasLimit` stops both.
+ */
+/** @{ */
+inline bool
+isBytecodeUploadDisabled(Fees const& fees)
+{
+    return fees.bytecodeSizeLimit == 0 || fees.gasLimit == 0;
+}
+
+inline bool
+isBytecodeExecutionDisabled(Fees const& fees)
+{
+    return fees.gasLimit == 0;
+}
+/** @} */
+
+/**
+ * Owner count an escrow costs.
+ *
+ *  An escrow costs one increment per started 500 bytes of bytecode, and one
+ *  increment if it carries no bytecode.
+ */
+template <class T>
+int32_t
+calculateAdditionalReserve(T const& finishFunction)
+{
+    static auto constexpr kBytecodeReserveIncrement = 500;
+
+    if (!finishFunction)
+        return 1;
+
+    auto const size = finishFunction->size();
+    if (size == 0)
+    {
+        // LCOV_EXCL_START
+        // Empty Bytecode is refused at create, so no escrow carries it. Ceiling
+        // division would answer 0, which would subtract less than the create added.
+        UNREACHABLE("xrpl::calculateAdditionalReserve : empty Bytecode");
+        return 1;
+        // LCOV_EXCL_STOP
+    }
+
+    return static_cast<int32_t>((size + kBytecodeReserveIncrement - 1) / kBytecodeReserveIncrement);
+}
+
 }  // namespace xrpl
@@ -7,10 +7,10 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/VaultHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
-#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
@@ -31,9 +31,9 @@ namespace xrpl {
 /**
 * Broker cover preclaim precision guard (fixCleanup3_2_0).
 *
- * Prevents a "silent sub-ULP no-op" where a deposit, withdrawal, or clawback
- * amount is so small that it rounds to zero at `sfCoverAvailable`'s scale.
- * Without this guard, both the pseudo trust-line and `sfCoverAvailable` would
+ * Prevents a silent sub-ULP no-op where a deposit, withdrawal, or clawback
+ * amount is so small that it rounds to zero at sfCoverAvailable's scale.
+ * Without this guard, both the pseudo trust-line and sfCoverAvailable would
 * identically absorb the rounded zero, resulting in a successful transaction
 * (tesSUCCESS) where no funds actually moved.
 *
@@ -44,8 +44,8 @@ namespace xrpl {
 * @param j          Journal for logging.
 * @param logPrefix  Transactor name for log diagnostics.
 *
- * @return `tecPRECISION_LOSS` if the request rounds to zero at cover scale.
- * `tesSUCCESS` if the amendment is disabled or the request is safely supra-ULP.
+ * @return tecPRECISION_LOSS if the request rounds to zero at cover scale.
+ * tesSUCCESS if the amendment is disabled or the request is safely supra-ULP.
 */
 [[nodiscard]] TER
 canApplyToBrokerCover(
@@ -56,6 +56,82 @@ canApplyToBrokerCover(
    beast::Journal j,
    std::string_view logPrefix);

+namespace detail {
+
+/**
+ * Return a LoanBroker's posterior live cover exponent after applying an
+ * unrounded delta.
+ */
+[[nodiscard]] int
+getPosteriorBrokerCoverScale(SLE::ConstRef vault, SLE::ConstRef broker, Number const& delta);
+
+/**
+ * Round a cover outflow delta (cover withdraw, cover clawback, the
+ * broker-side decrease of a default's cover credit) at the LoanBroker's
+ * posterior live exponent. Safe to round the delta directly for an outflow:
+ * amount on the posterior grid of CoverAvailable always leaves CoverAvailable
+ * minus amount representable, since the posterior grid is exactly the grid
+ * CoverAvailable itself will canonicalize to after the subtraction.
+ */
+[[nodiscard]] STAmount
+roundToPosteriorBrokerCoverScale(
+    SLE::ConstRef vault,
+    SLE::ConstRef broker,
+    STAmount const& delta,
+    Number::RoundingMode roundingMode);
+
+}  // namespace detail
+
+/**
+ * Round a cover debit (cover withdraw, cover clawback, the broker-side
+ * decrease of a default's cover credit): amount is the non-negative
+ * magnitude leaving CoverAvailable. Negates so the posterior is computed for
+ * CoverAvailable minus amount, then negates the result back to a
+ * non-negative magnitude, per roundToPosteriorBrokerCoverScale's outflow
+ * rationale above. Magnitude in, magnitude out -- unlike the vault-side
+ * outflow dispatcher (clampVaultOutflow), which takes and returns a negative
+ * delta; callers on each side already hold the value in that side's native
+ * form.
+ */
+[[nodiscard]] STAmount
+debitToPosteriorBrokerCoverScale(
+    SLE::ConstRef vault,
+    SLE::ConstRef broker,
+    STAmount const& amount,
+    Number::RoundingMode roundingMode);
+
+/**
+ * Round a cover inflow (cover deposit, LoanPay's fee redirect into cover)
+ * into CoverAvailable by flooring the sum rather than the delta:
+ * credit = floor16(CoverAvailable + raw) - CoverAvailable, never finer
+ * than the Vault's base exponent (-Scale). See
+ * creditToPosteriorAvailableScale's doc for why the sum, not the delta,
+ * must be floored; the same reasoning applies to CoverAvailable.
+ */
+[[nodiscard]] STAmount
+creditToPosteriorBrokerCoverScale(
+    SLE::ConstRef vault,
+    SLE::ConstRef broker,
+    Number const& raw,
+    Number::RoundingMode roundingMode);
+
+/**
+ * Check whether amount is an admissible optional cover inflow.
+ *
+ * Legacy and CashBasis Vaults always succeed. A LoanBroker attached to a
+ * FixedPrecision Vault must remain at the Vault's base scale after applying
+ * the rounded amount, and its posterior CoverAvailable must stay within the
+ * Open zone.
+ *
+ * LoanPay's fee redirect into cover is a mandatory inflow and does not call
+ * this check, so it can push CoverAvailable past the Open zone limit this
+ * check enforces. Once that happens, every subsequent LoanBrokerCoverDeposit
+ * returns tecLIMIT_EXCEEDED until the owner withdraws cover back under the
+ * limit; LoanBrokerCoverWithdraw and LoanBrokerCoverClawback are unaffected.
+ */
+[[nodiscard]] TER
+checkOptionalBrokerCoverInflow(SLE::ConstRef vault, SLE::ConstRef broker, STAmount const& amount);
+
 // Lending protocol has dependencies, so capture them here.
 bool
 checkLendingProtocolDependencies(Rules const& rules, STTx const& tx);
@@ -64,13 +140,13 @@ checkLendingProtocolDependencies(Rules const& rules, STTx const& tx);
 * The accounts and asset that LoanManage::defaultLoan's fixCleanup3_4_0
 * freeze/lock exemption applies to.
 *
- * `defaultLoan` moves funds from the LoanBroker pseudo-account to the Vault
- * pseudo-account via `accountSend`. Since neither is the vault asset's
+ * defaultLoan moves funds from the LoanBroker pseudo-account to the Vault
+ * pseudo-account via accountSend. Since neither is the vault asset's
 * issuer, this is a third-party transfer that transits through the issuer in
 * two hops (broker -> issuer, issuer -> vault; see
- * `directSendNoLimitIOU`/`directSendNoLimitMPT`), so the exemption must cover
+ * directSendNoLimitIOU/directSendNoLimitMPT), so the exemption must cover
 * both the issuer/broker and issuer/vault pairs, not a direct broker/vault
- * pair. `asset` scopes it further to the vault's own currency/MPT issuance,
+ * pair. asset scopes it further to the vault's own currency/MPT issuance,
 * so an unrelated one the same accounts happen to hold is still protected.
 */
 struct LoanDefaultFreezeExemptAccounts
@@ -88,10 +164,10 @@ struct LoanDefaultFreezeExemptAccounts
 * @param view Ledger view used to resolve the Loan -> LoanBroker -> Vault
 * chain.
 * @param tx The transaction under invariant review.
- * @return The exempt accounts and asset if `tx` is a `ttLOAN_MANAGE`
- * transaction with the `tfLoanDefault` flag set, `fixCleanup3_4_0` is
+ * @return The exempt accounts and asset if tx is a ttLOAN_MANAGE
+ * transaction with the tfLoanDefault flag set, fixCleanup3_4_0 is
 * enabled, and the loan/broker/vault objects it references can all be
- * resolved; `std::nullopt` otherwise.
+ * resolved; std::nullopt otherwise.
 */
 [[nodiscard]] std::optional<LoanDefaultFreezeExemptAccounts>
 getLoanDefaultFreezeExemptAccounts(ReadView const& view, STTx const& tx);
@@ -254,28 +330,38 @@ adjustImpreciseNumber(
        value = 0;
 }

-inline int
-getAssetsTotalScale(SLE::ConstRef vaultSle)
-{
-    if (!vaultSle)
-        return Number::kMinExponent - 1;  // LCOV_EXCL_LINE
-    return scale(vaultSle->at(sfAssetsTotal), vaultSle->at(sfAsset));
-}
+/**
+ * Apply a signed delta to a LoanBroker's DebtTotal: on FixedPrecision Vaults,
+ * add the exact delta (DebtTotal moves by exactly the same amount as the
+ * Vault's AssetsDeployed, never re-rounded); on Legacy/CashBasis Vaults,
+ * round through adjustImpreciseNumber at vaultScale. Shared by LoanSet
+ * (origination) and LoanPay (payment, where delta is negative).
+ *
+ * @param brokerSle The LoanBroker whose DebtTotal is adjusted.
+ * @param vaultSle The LoanBroker's Vault.
+ * @param delta The signed change to DebtTotal.
+ * @param vaultScale The Vault scale the caller captured before changing
+ *        AssetsTotal. Legacy/CashBasis round DebtTotal at that scale, not at
+ *        the scale after this transaction's AssetsTotal change. Unused on
+ *        FixedPrecision Vaults.
+ */
+void
+adjustBrokerDebtTotal(
+    SLE::Ref brokerSle,
+    SLE::ConstRef vaultSle,
+    Number const& delta,
+    int vaultScale);

-// Compute the minimum required broker cover, rounded consistently.
-// DebtTotal is a broker-level aggregate maintained at vault scale, so the
-// rounding must also use vault scale — never an individual loan's scale.
-inline Number
-minimumBrokerCover(Number const& debtTotal, TenthBips32 coverRateMinimum, SLE::ConstRef vaultSle)
-{
-    XRPL_ASSERT(
-        vaultSle && vaultSle->getType() == ltVAULT, "xrpl::minimumBrokerCover : valid Vault sle");
-    NumberRoundModeGuard const mg(Number::RoundingMode::Upward);
-    return roundToAsset(
-        vaultSle->at(sfAsset),
-        tenthBipsOfValue(debtTotal, coverRateMinimum),
-        getAssetsTotalScale(vaultSle));
-}
+/**
+ * Minimum required broker cover, rounded up.
+ *
+ * DebtTotal is a broker-level aggregate, never rounded at an individual
+ * loan's scale. Legacy and CashBasis Vaults round at the live AssetsTotal
+ * exponent. FixedPrecision Vaults round at the Vault's base exponent
+ * (-Scale, or 0 for integral assets).
+ */
+Number
+minimumBrokerCover(Number const& debtTotal, TenthBips32 coverRateMinimum, SLE::ConstRef vaultSle);

 TER
 checkLoanGuards(
@@ -379,10 +465,10 @@ loanPaymentDeltas(LoanPaymentParts const& parts);

 }  // namespace cash_basis

-// Public dispatchers: pick cash_basis:: if featureLendingProtocolV1_1 is
-// enabled AND the Vault's LEVersion (VaultHelpers::getVaultVersion) is
-// VaultVersion::CashBasis, else instant_recognition::. These are the only entry points
-// transactors call.
+// Public dispatchers: pick cash_basis:: if the Vault's LEVersion
+// (VaultHelpers::getVaultVersion) is CashBasis or later (CashBasis or
+// FixedPrecision), else instant_recognition::. These are the only entry
+// points transactors call.
 AccountingDeltas
 loanOriginationDeltas(
    SLE::ConstRef vaultSle,
@@ -312,12 +312,22 @@ checkCreateMPT(
 //
 //------------------------------------------------------------------------------

-// MaximumAmount doesn't exceed 2**63-1
+/**
+ * MaximumAmount doesn't exceed 2**63-1
+ */
 std::int64_t
 maxMPTAmount(SLE const& sleIssuance);

-// OutstandingAmount may overflow and available amount might be negative.
-// But available amount is always <= |MaximumAmount - OutstandingAmount|.
+/**
+ * std::nullopt if the issuance doesn't exist.
+ */
+std::optional<std::int64_t>
+maxMPTAmount(ReadView const& view, MPTID const& mptID);
+
+/**
+ * OutstandingAmount may overflow and available amount might be negative.
+ * But available amount is always <= |MaximumAmount - OutstandingAmount|.
+ */
 std::int64_t
 availableMPTAmount(SLE const& sleIssuance);

@@ -331,7 +341,12 @@ availableMPTAmount(ReadView const& view, MPTID const& mptID);
 * directSendNoFee transactions that bypass the payment engine.
 * 2.  **accountSend & Payment Engine (Overflow: Yes):** A temporary overflow
 * check when `OutstandingAmount > UINT64_MAX`. This higher threshold is used
- * for `accountSend` and payments processed via the payment engine.
+ * for `accountSend` and payments processed via the payment engine, whose
+ * reverse pass may issue before it redeems.
+ *
+ * In both cases a single `sendAmount > MaximumAmount` is rejected. Such a send
+ * can never settle: redemptions within the transaction are bounded by the
+ * outstanding amount, so the final OutstandingAmount would exceed the cap.
 */
 bool
 isMPTOverflow(
@@ -353,6 +368,12 @@ issuerFundsToSelfIssue(ReadView const& view, MPTIssue const& issue);
 /**
 * Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
 * See ApplyView::issuerSelfDebitHookMPT().
+ *
+ * `amount` may be 0. BookStep removes an offer whose fee-adjusted funded
+ * output is 0, but other clips (for example MaximumAmount via limitStepIn)
+ * can still consume a zero slice of a funded remainder. The hook must
+ * accept 0: first call still snapshots origBalance; a zero debit adds
+ * nothing to selfDebit.
 */
 void
 issuerSelfDebitHookMPT(ApplyView& view, MPTIssue const& issue, std::uint64_t amount);
@@ -1,10 +1,17 @@
 #pragma once

+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFormats.h>

 #include <cstdint>
+#include <optional>

 namespace xrpl::proposal {

@@ -30,31 +37,22 @@ proposalOwnerCount(STObject const& proposedTx)
                                                                : kProposalOwnerCount;
 }

-/**
- * Whether the proposed transaction is itself a proposal transaction, which
- * would nest one proposal inside another.
- *
- * TODO: cover ttTRANSACTION_PROPOSAL_SIGN and ttTRANSACTION_PROPOSAL_CANCEL
- * once those transactions exist.
- */
-inline bool
-isProposalTx(STObject const& proposedTx)
-{
-    return proposedTx.getFieldU16(sfTransactionType) == ttTRANSACTION_PROPOSAL_CREATE;
-}
-
 /**
 * Whether the proposed transaction is independently submittable through the
- * ordinary multi-sign path: not a nested proposal, not a pseudo-transaction,
- * not itself flagged as someone else's inner batch transaction, and — if it
- * is a Batch — none of its own inner transactions is a nested proposal or a
- * pseudo-transaction either. A Batch inner transaction cannot itself be
- * pseudo (preflight0 rejects the pseudo/tfInnerBatchTxn combination
- * generically), but that guard lives outside this feature, so it is checked
- * again here rather than relied upon.
+ * ordinary multi-sign path: not a proposal transaction itself, not a
+ * pseudo-transaction, not itself flagged as someone else's inner batch
+ * transaction, and — if it is a Batch — every one of its own inner
+ * transactions carries a TransactionType and is neither a proposal, a
+ * pseudo-transaction, nor a nested Batch. A Batch inner transaction cannot
+ * lack a TransactionType, be pseudo, or be a nested Batch (STTx construction
+ * rejects a typeless inner and an inner Batch, and preflight0 rejects the
+ * pseudo/tfInnerBatchTxn combination), but those guards live outside this
+ * feature, so they are checked again here rather than relied upon.
+ *
+ * TODO: cover ttTRANSACTION_PROPOSAL_SIGN once that transaction exists.
 */
 bool
-isValidProposal(STObject const& proposedTx);
+isValidProposalTxnType(STObject const& proposedTx);

 /**
 * Whether the proposed transaction carries any signature field.
@@ -84,4 +82,93 @@ hasEmptySigningPubKey(STObject const& proposedTx)
        proposedTx.getFieldVL(sfSigningPubKey).empty();
 }

+/**
+ * Whether the proposal is terminal (On-Chain Cosigner spec §4.5). A terminal proposal
+ * stops accepting signatures and anyone may delete it. An already signed
+ * payload can still execute after Expiration, because the Ticket reservation
+ * compares payloads only; a passed LastLedgerSequence does stop it.
+ *
+ * A proposal is terminal when either:
+ * - its Expiration has passed (the parent ledger closed at or after it), or
+ * - the proposed transaction carries a LastLedgerSequence and the current
+ *   ledger sequence is strictly greater than it. This mirrors the ordinary
+ *   transactor's tefMAX_LEDGER rule: at view.seq() == LastLedgerSequence the
+ *   payload can still be submitted in the current ledger, so the proposal is
+ *   still live.
+ *
+ * @param view The ledger the deciding transaction is being applied to.
+ * @param expiration The proposal's Expiration field.
+ * @param proposedTx The proposal's ProposedTransaction field.
+ */
+bool
+isTerminal(
+    ReadView const& view,
+    std::optional<std::uint32_t> expiration,
+    STObject const& proposedTx);
+
+/**
+ * Delete a TransactionProposal ledger entry.
+ *
+ * Removes the entry from its Owner's directory, releases the reserve the
+ * proposal holds against the Owner, and erases the entry. Shared by every
+ * deletion path the spec defines (On-Chain Cosigner spec §4.5): automatic cleanup when the
+ * proposed transaction's TicketSequence is consumed, and the
+ * TransactionProposalCancel / TransactionProposalSign cleanup paths once
+ * those transactions exist.
+ *
+ * The release goes through decreaseOwnerCountForObject, so it follows the
+ * sfSponsor an entry created with reserve sponsorship carries: the reserve is
+ * returned to whoever was holding it, the Owner or that sponsor.
+ *
+ * @param view The apply view for making changes
+ * @param sleProposal The TransactionProposal ledger entry to delete
+ * @param j Journal for logging
+ * @return tesSUCCESS, tecINTERNAL for an invalid entry, or tefBAD_LEDGER if
+ *         the ledger contradicts the entry
+ */
+TER
+deleteProposal(ApplyView& view, SLE::pointer const& sleProposal, beast::Journal j);
+
+/**
+ * Whether tx carries the same payload as a proposal's stored
+ * ProposedTransaction (On-Chain Cosigner spec §4.2.1).
+ *
+ * The payload is the signing payload: the fields the collected signatures
+ * commit to. Compared is every field except those flagged kNotSigning
+ * (TxnSignature, Signers, BatchSigners, CounterpartySignature,
+ * SponsorSignature, Signature, MasterSignature) and SigningPubKey, which is
+ * stored empty and filled only if the target signs with its own key. So the
+ * completed transaction matches no matter which mix of collected or
+ * off-ledger signatures it carries, and any change to a non-signature field
+ * results in a false-return value.
+ *
+ * Signature (PaymentChannelClaim) is deliberately not compared: it is
+ * outside the account's own TxnSignature even for an ordinary submission, so
+ * a proposal cannot bind it more tightly than the signatures it collects do,
+ * and that transactor still validates a substituted value exactly as it would
+ * for an ordinary submission.
+ * MasterSignature appears in no transaction format.
+ *
+ * @param proposedTx The proposal's ProposedTransaction field.
+ * @param tx The transaction to compare, typically an STTx.
+ */
+bool
+payloadMatches(STObject const& proposedTx, STObject const& tx);
+
+/**
+ * Whether tx may consume its Ticket.
+ *
+ * While a proposal keyed to the Ticket exists, the target's Ticket is
+ * reserved: only the proposal's own proposed transaction may spend it
+ * (On-Chain Cosigner spec §4.2.1), so that unrelated target-account activity cannot
+ * invalidate the proposal while signatures are being collected.
+ * TransactionProposalCancel is not allowed through: it deletes the
+ * reservation without consuming the ticket.
+ *
+ * @param view The ledger containing the Ticket and any reservation.
+ * @param tx The transaction attempting to consume that ticket.
+ */
+bool
+canConsumeTicket(ReadView const& view, STTx const& tx);
+
 }  // namespace xrpl::proposal
Author	SHA1	Message	Date
Nik Bougalis	af9153ac58	Make ApplyFlags a scoped enumeration Convert ApplyFlags to a scoped enum, drop the now-redundant `Tap` prefix from its enumerators and replace the hand-written bitwise operators by opting in to enum_bitops. No functional change.	2026-10-26 07:00:19 -07:00
Nik Bougalis	7aa679de54	Make the path element type a scoped enumeration STPathElement stored its type as an unsigned int, returned it as a std::uint32_t, and defined the flags as an unscoped enum. The type has always been serialized as a single byte. Introduce STPathElementType, a scoped enum with std::uint8_t as its fixed underlying type, opted into the bitwise operators from enum_bitops.h: - Store the type as STPathElementType, and use it for the constructor parameter and the return type of getNodeType(). - Rename call sites from STPathElement::TypeAccount and friends to STPathElementType::Account and friends. - Replace raw mask tests in the serializer, JSON output, strand construction and pathfinder with the existing predicates. - Validate the type byte once when deserializing, before any field is read, and restructure the loop around that. - Remove the cached hashValue_ and getHash(). Their only consumer was a fast-reject prefilter in operator==, whose operands are equal in practice (hash-set lookups after a hash match, serdes self-checks), so the hash was computed on every construction and never rejected anything. operator== keeps the same semantics (TypeAccount bit plus the three fields) as a hidden friend. - Give type_ and isOffer_ default member initializers, default the default constructor, and move isOffer_ next to type_ so the two one-byte members share a word. - Mark the trivial accessors noexcept. sizeof(STPathElement) drops from 88 to 72 bytes and its alignment from 8 to 4. Every parsed path and every pathfinder candidate is a vector of these. No functional changes are intended. Observable differences are confined to malformed input: - The deserializer no longer logs rejected elements at error level through debugLog() before throwing. The exception carries the reason, and logging peer-supplied garbage at error level was a log-spam vector. - The exception text changed: "empty path" is now "bad path element: empty path", and an element with undefined type bits reports the byte in hex. - If the currency and MPT bits are both set and the input is truncated within the account field, the invalid bit combination is now detected before the short read; previously the short read was detected first. Such elements are rejected either way.	2026-10-26 07:00:19 -07:00
Nik Bougalis	4695f001ed	Introduce opt-in bitwise operators for scoped enumerations Scoped enumerations do not support bitwise operators, so using an `enum class` as a set of flags requires extensive casting at call sites or a hand-written set of operators for each type. Add `enum_bitops.h`, which provides `&`, `\|`, `^`, `~` along with the compound assignment forms for any scoped enumeration that has an unsigned underlying type and is opted in: enum class Flags : std::uint8_t { a = 1, b = 2 }; // Opt into bitwise operations template <> struct enum_bitops::OptIn<Flags> : std::true_type {}; All synthesized operators are constexpr and noexcept, and preserve the enumeration type.	2026-10-26 07:00:18 -07:00
dependabot[bot]	b7d6b2c610	ci: [DEPENDABOT] bump the github-actions group across 2 directories with 3 updates (#8642 ) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-26 12:12:39 +00:00
Ayaz Salikhov	1f46f75318	build: Don't apply clang-tidy fixes twice via header symlinks (#8636 )	2026-10-23 19:28:52 +00:00
Ayaz Salikhov	097cb5e89b	fix: Update images/prepare-runner to not trust eMudhra certs (#8631 )	2026-10-22 18:05:38 +00:00
Timothy Banks Mayukha Vadari Valentin Balaschenko Ayaz Salikhov Claude Opus 5.5	a818f25203	refactor: Retire XRPFees amendment (#7349 ) Co-authored-by: Mayukha Vadari <[email protected]> Co-authored-by: Valentin Balaschenko <[email protected]> Co-authored-by: Ayaz Salikhov <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-10-22 17:11:24 +00:00
Timothy Banks Bart Copilot Autofix powered by AI	3fa2accfdf	refactor: Retire AMM amendment and AMMOverflowOffer fix (#7357 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>	2026-10-22 15:27:46 +00:00
Ayaz Salikhov	d3a71b2b42	fix: Don't trust eMudhra certificates (#8629 )	2026-10-22 15:01:37 +00:00
Timothy Banks	025aa71930	refactor: Retire FillOrKill fix (#7366 )	2026-10-21 16:12:29 +00:00
Mayukha Vadari	ef5064eeb9	feat: Remove XChainBridge feature (#8255 )	2026-10-20 20:37:02 +00:00
Alex KremerandAyaz Salikhov	c2e739f670	refactor: Migrate handlers to rpc-spec (E) (#8613 ) Co-authored-by: Ayaz Salikhov <[email protected]>	2026-10-20 15:39:27 +00:00
Alex Kremer	15fac6250d	chore: Simplify `account` and `ident` checks via rpc-spec (#8620 )	2026-10-20 13:25:47 +00:00
Alex KremerandAyaz Salikhov	3608433514	test: Check error consistently in rpc handlers (#8604 ) Co-authored-by: Ayaz Salikhov <[email protected]>	2026-10-19 16:17:30 +00:00
Nik Bougalis	7939339a65	chore: Fix an issue that breaks CLion (#8619 )	2026-10-17 22:43:53 +00:00
Chenna Keshava B S Shawn Xie Kassaking7 Shawn Xie Zhiyuan Wang Claude Fable 5.1 Copilot Autofix powered by AI	4ea2db2eda	feat: Add TransactionProposal invariants for Cosign (#8130 ) Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Kassaking7 <[email protected]> Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Zhiyuan Wang <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>	2026-10-16 20:59:53 +00:00
Ayaz Salikhov	d4ffe32534	ci: Fix release/staging branches running conditions (#8615 )	2026-10-16 17:06:19 +00:00
Gregory Tsipenyuk	7354816f65	fix: Assorted MPT/DEX offer related fixes - 1 (#8468 )	2026-10-16 16:28:05 +00:00
Gregory Tsipenyuk	12cb3932f3	fix: Check vault share freeze at MPT strand endpoints (#8478 )	2026-10-16 15:26:00 +00:00
Gregory Tsipenyuk	dc64a8daac	fix: Allow IOU rounding in Clawback invariant balance check (#8475 )	2026-10-16 15:25:03 +00:00
Nik Bougalis	dc524e9cc6	refactor: Optimize the binary layout of Number (#8550 )	2026-10-16 15:20:01 +00:00
Alex KremerandAyaz Salikhov	4060b1bcd4	refactor: Migrate handlers to rpc-spec (D) (#8573 ) Co-authored-by: Ayaz Salikhov <[email protected]>	2026-10-16 14:06:30 +00:00
Mayukha Vadari	bfbb440fc2	feat: Handle Smart Escrow's Bytecode, Data and Gas fields (#8215 )	2026-10-16 13:03:48 +00:00
BartandBart	4087861411	fix: Refuse to walk an invalid SHAMap in getMissingNodes (#8086 ) Co-authored-by: Bart <[email protected]>	2026-10-16 05:47:08 +00:00
BartandBart	dc43faafed	fix: Refuse to make an invalid SHAMap or Ledger immutable (#8085 ) Co-authored-by: Bart <[email protected]>	2026-10-16 05:47:07 +00:00
Bart Bart Claude Fable 5.1	6af97c07d9	fix: Report a node the sync path refuses as invalid data (#8084 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>	2026-10-16 05:47:06 +00:00
Bart Bart Claude Fable 5.1	4c7d920e66	fix: Make the SHAMap sync-path state atomic (#8083 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>	2026-10-16 05:47:06 +00:00
yinyiqian1	8b59d9d307	docs: Add todo comment for key rotation zkproof (#8589 )	2026-10-16 00:11:06 +00:00
Bart Bart Claude Fable 5.1	b0fa295595	fix: Judge a header's account hash on both acquisition routes (#8476 ) Co-authored-by: Bart <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>	2026-10-15 21:00:21 +00:00
BartandBart	9af432cb0e	fix: Signal every InboundLedger failure found in local data (#8082 ) Co-authored-by: Bart <[email protected]>	2026-10-15 21:00:20 +00:00
BartandBart	4435ca4cbf	refactor: Add a reusable peer harness for acquisition tests (#8310 ) Co-authored-by: Bart <[email protected]>	2026-10-15 21:00:19 +00:00
Olek	cd72a11786	refactor: TxQ (#8064 )	2026-10-15 18:11:46 +00:00
Peter Chen	b398b88385	fix: Reject a zero credential ID in deposit_authorized (#8533 )	2026-10-15 18:11:18 +00:00
Olek	31f6f90206	feat: Add IssuerMirrorEncryptionKey and InitialIssuerEncryptionKey (#8325 )	2026-10-15 18:04:29 +00:00
Olek	1d8c2f9172	test: Sponsor checkSign additional tests (#8331 )	2026-10-15 18:03:48 +00:00
Vito Tumas Jingchen Alex Kremer	f105418bdb	feat: Book FixedPrecision LoanPay and LoanManage (#8271 ) Co-authored-by: Jingchen <[email protected]> Co-authored-by: Alex Kremer <[email protected]>	2026-10-15 18:02:36 +00:00
Ayaz Salikhov	4a134eb883	docs: Clarify OS and toolchain requirements (#8588 )	2026-10-15 17:58:11 +00:00
Ayaz Salikhov	ec3f251ad8	ci: Fix running pre-commit after clang-tidy (#8601 )	2026-10-15 16:15:35 +00:00
Mayukha Vadari	5faa861226	feat: Add Smart Escrow fee voting (#8214 )	2026-10-15 15:50:16 +00:00
Jingchen	88fd1222d6	build: Fix unity build by addressing name clashes (#8599 )	2026-10-15 12:59:20 +00:00
Ayaz SalikhovandEd Hennis	f1ce9449f2	fix: Skip bootstrap DNS lookups in standalone mode (#8583 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-14 21:02:45 +00:00
Timur Yalymov	7237b3321c	fix: Charge transfer fee on third-party vault withdrawals (#8267 )	2026-10-14 16:35:42 +00:00
Timur Yalymov	84d980d883	fix: Reject VaultClawback with a nonexistent holder (#8470 )	2026-10-14 14:29:05 +00:00
Timur YalymovandVito Tumas	791c96faad	fix: Enforce pseudo-account directory contents with an invariant (#8181 ) Co-authored-by: Vito Tumas <[email protected]>	2026-10-14 13:51:24 +00:00
Ayaz Salikhov	31473e7e6d	build: Unify clang variables (#8581 )	2026-10-14 13:51:05 +00:00
Timur YalymovandVito Tumas	aa70b368b5	fix: Enforce asset authorization on LoanBrokerDelete (#8204 ) Co-authored-by: Vito Tumas <[email protected]>	2026-10-14 13:51:05 +00:00
Vito TumasandJingchen	d3db569b34	feat: Book FixedPrecision LoanSet through AssetsDeployed (#8260 ) Co-authored-by: Jingchen <[email protected]>	2026-10-14 13:20:58 +00:00
Vito TumasandJingchen	94d6b7daf8	feat: Round LoanBroker cover on the FixedPrecision grid (#8258 ) Co-authored-by: Jingchen <[email protected]>	2026-10-14 12:59:39 +00:00
Vito TumasandJingchen	e089abe982	feat: Use FixedPrecision accounting in Vault transactors (#8460 ) Co-authored-by: Jingchen <[email protected]>	2026-10-14 12:52:25 +00:00
Alex Kremer	33289e882b	refactor: Migrate handlers to rpc-spec (C) (#8561 )	2026-10-14 10:15:32 +00:00
Gregory Tsipenyuk Claude Opus 5.5 Ed Hennis	1ed0bccb07	fix: Clamp invalid XRP amounts in Quality::ceilOut & getBookPage (#8480 ) Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Ed Hennis <[email protected]>	2026-10-14 07:49:27 +00:00
Gregory TsipenyukandEd Hennis	1da55e3989	fix: Waive CanTransfer on loan default and broker delete (#8231 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-14 07:49:12 +00:00
Valentin Balaschenkoandxrplf-ai-reviewer[bot]	166e97e12b	refactor: Decouple LedgerHistory from TaggedCache internals (#5874 ) Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>	2026-10-13 23:33:32 +00:00
Chenna Keshava B S Shawn Xie Kassaking7 Shawn Xie Zhiyuan Wang Claude Fable 5	33e5a6fa7c	feat: Add TransactionProposalCancel & Cosign Ticket reservation (#8538 ) Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Kassaking7 <[email protected]> Co-authored-by: Shawn Xie <[email protected]> Co-authored-by: Zhiyuan Wang <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]>	2026-10-13 19:07:45 +00:00
Ayaz Salikhov	b1f9dc6919	ci: Fix rpm installation problems (#8575 )	2026-10-13 18:46:41 +00:00
Ayaz Salikhov	38965af055	docs: Clarify freeze on large changes 2 weeks before first RC (#8574 )	2026-10-13 18:43:24 +00:00
Gregory TsipenyukandEd Hennis	b010d4a563	refactor: Retire fixAMMv1_1 amendment (#8226 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 18:03:10 +00:00
dependabot[bot]	eedd6604d1	chore: [DEPENDABOT] bump pyparsing from 3.3.2 to 3.3.3 in /cmake/scripts/codegen in the codegen-dependencies group (#8572 ) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-13 17:48:57 +00:00
Mayukha Vadari	59ff04b648	fix: Allow WASM transactions in simulate only in admin mode (#8568 )	2026-10-13 17:39:32 +00:00
Gregory TsipenyukandEd Hennis	fcb3ee6425	fix: Detect int64 overflow in XRPAmount and MPTAmount (#8453 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 17:35:35 +00:00
Gregory TsipenyukandEd Hennis	77eacbb52c	fix: Assorted MPT/DEX offer related fixes (#8211 ) Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 17:18:47 +00:00
Vito TumasandJingchen	5ce85b2799	feat: Add FixedPrecision Vault grid and balance helpers (#8257 ) Co-authored-by: Jingchen <[email protected]>	2026-10-13 16:19:08 +00:00
Ayaz Salikhov	4538d198e1	build: Update codegen requirements (#8570 )	2026-10-13 14:29:59 +00:00
Gregory Tsipenyuk Vito Tumas Ayaz Salikhov Ed Hennis	4c39b05f94	fix: Reject vault and lending amounts out of range for the asset (#8527 ) Co-authored-by: Vito Tumas <[email protected]> Co-authored-by: Ayaz Salikhov <[email protected]> Co-authored-by: Ed Hennis <[email protected]>	2026-10-13 08:46:55 +00:00
BartandBart	c2478f509c	refactor: Open the acquisition seams its tests need (#8081 ) Co-authored-by: Bart <[email protected]>	2026-10-13 03:51:12 +00:00
Mayukha Vadari	c908ed7839	fix: Reject malformed conditions in EscrowFinish preflight (#8523 )	2026-10-12 20:48:55 +00:00
BartandBart	fc57311c81	refactor: Expose a SHAMapAddNode verdict as counts (#8080 ) Co-authored-by: Bart <[email protected]>	2026-10-12 20:02:36 +00:00
Mayukha Vadari	818de49264	refactor: Use DepositPreauthEntry everywhere (#8364 )	2026-10-12 18:56:14 +00:00
dependabot[bot]	1318b1e58b	chore: [DEPENDABOT] bump cxx from 1.0.202 to 1.0.203 in /crates in the rust-dependencies group (#8564 ) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-12 17:23:41 +00:00
Ayaz Salikhov	617c816ec8	chore: Fix readability-trailing-comma (#8545 )	2026-10-12 13:57:24 +00:00
dependabot[bot]	34fc86f585	ci: [DEPENDABOT] bump the github-actions group across 1 directory with 2 updates (#8562 ) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-12 12:59:39 +00:00
Ayaz Salikhov	e071f0a28d	chore: Fix misc-const-correctness (#8546 )	2026-10-12 11:44:06 +00:00
Ayaz Salikhov	8faa624ade	chore: Update XRPLF/actions to use pip from python3.14 explicitly (#8560 )	2026-10-12 10:06:06 +00:00