Merge branch 'develop' into tapanito/bugfix-loan-pay-fn-67

test: Improve the server status test to not race and randomly fail (#7304 )
Co-authored-by: Alex Kremer <akremer@ripple.com>
2026-07-28 09:30:34 +00:00 · 2026-07-27 15:33:23 +02:00 · 2026-07-27 11:58:15 +00:00 · 2026-07-27 09:55:01 +00:00 · 2026-07-24 17:30:20 +00:00 · 2026-07-24 15:52:45 +00:00
235 changed files with 10239 additions and 8385 deletions
--- a/.cspell.config.yaml
+++ b/.cspell.config.yaml
@@ -30,7 +30,9 @@ ignoreRegExpList:
  - ABCDEFGHIJKLMNOPQRSTUVWXYZ
  - ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
 overrides:
-  - filename: "**/*_test.cpp" # all test files
+  - filename:
+      - "**/*_test.cpp" # legacy boost.test files
+      - "src/tests/**/*.cpp" # gtest test files
    ignoreRegExpList:
      - /"[^"]*"/g # double-quoted strings
      - /'[^']*'/g # single-quoted strings
@@ -216,6 +218,7 @@ words:
  - Nyffenegger
  - onlatest
  - ostr
+  - oxalica
  - pargs
  - partitioner
  - paychan
@@ -262,6 +265,8 @@ words:
  - Rohrs
  - roundings
  - rustc
+  - rustfmt
+  - rustup
  - sahyadri
  - Satoshi
  - scons
@@ -305,6 +310,7 @@ words:
  - takerpays
  - ters
  - TMEndpointv2
+  - toolchain
  - tparam
  - trixie
  - tx
@@ -337,6 +343,7 @@ words:
  - unsquelch
  - unsquelched
  - unsquelching
+  - unsuffixed
  - unvalidated
  - unveto
  - unvetoed
--- a/.gersemi/definitions.cmake
+++ b/.gersemi/definitions.cmake
@@ -11,6 +11,9 @@ endfunction()
 function(create_symbolic_link target link)
 endfunction()

+function(xrpl_add_benchmark name)
+endfunction()
+
 macro(exclude_from_default target_)
 endmacro()

--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,10 +1,10 @@
 <!--
-This PR template helps you to write a good pull request description.
+This PR template helps you write a good pull request description.
 Please feel free to include additional useful information even beyond what is requested below.

 If your branch is on a personal fork and has a name that allows it to
 run CI build/test jobs (e.g. "ci/foo"), remember to rename it BEFORE
-opening the PR.  This avoids unnecessary redundant test runs. Renaming
+opening the PR. This avoids redundant test runs. Renaming
 the branch after opening the PR will close the PR.
 https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch
 -->
@@ -15,7 +15,7 @@ https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-
 Please include a summary of the changes.
 This may be a direct input to the release notes.
 If too broad, please consider splitting into multiple PRs.
-If a relevant task or issue, please link it here.
+If there is a relevant task or issue, please link it here.
 -->

 ### Context of Change
@@ -65,5 +65,5 @@ This section may not be needed if your change includes thoroughly commented unit

 <!--
 ## Future Tasks
-For future tasks related to PR.
+For future tasks related to this PR.
 -->
--- a/.github/scripts/levelization/README.md
+++ b/.github/scripts/levelization/README.md
@@ -40,18 +40,18 @@ listed later.
 | 04           | xrpl/protocol                       |
 | 05           | xrpl/core xrpl/resource xrpl/server |
 | 06           | xrpl/ledger xrpl/nodestore xrpl/net |
-| 07           | xrpl/shamap                         |
+| 07           | xrpl/shamap xrpl/consensus          |

 ## xrpld Modules (Application Implementation)

-| Level / Tier | Module(s)                        |
-| ------------ | -------------------------------- |
-| 05           | xrpld/conditions xrpld/consensus |
-| 06           | xrpld/core xrpld/peerfinder      |
-| 07           | xrpld/shamap xrpld/overlay       |
-| 08           | xrpld/app                        |
-| 09           | xrpld/rpc                        |
-| 10           | xrpld/perflog                    |
+| Level / Tier | Module(s)                   |
+| ------------ | --------------------------- |
+| 05           | xrpld/conditions            |
+| 06           | xrpld/core xrpld/peerfinder |
+| 07           | xrpld/shamap xrpld/overlay  |
+| 08           | xrpld/app                   |
+| 09           | xrpld/rpc                   |
+| 10           | xrpld/perflog               |

 ## Test Modules

--- a/.github/scripts/levelization/results/loops.txt
+++ b/.github/scripts/levelization/results/loops.txt
@@ -1,9 +1,6 @@
 Loop: xrpld.app xrpld.overlay
  xrpld.app > xrpld.overlay

-Loop: xrpld.app xrpld.peerfinder
-  xrpld.peerfinder ~= xrpld.app
-
 Loop: xrpld.app xrpld.rpc
  xrpld.rpc > xrpld.app

--- a/.github/scripts/levelization/results/ordering.txt
+++ b/.github/scripts/levelization/results/ordering.txt
@@ -1,8 +1,13 @@
+benchmarks.libxrpl > xrpl.basics
+benchmarks.libxrpl > xrpl.config
+benchmarks.libxrpl > xrpl.nodestore
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
 libxrpl.config > xrpl.basics
 libxrpl.config > xrpl.config
+libxrpl.consensus > xrpl.basics
+libxrpl.consensus > xrpl.consensus
 libxrpl.core > xrpl.basics
 libxrpl.core > xrpl.core
 libxrpl.core > xrpl.json
@@ -22,6 +27,9 @@ libxrpl.nodestore > xrpl.config
 libxrpl.nodestore > xrpl.json
 libxrpl.nodestore > xrpl.nodestore
 libxrpl.nodestore > xrpl.protocol
+libxrpl.peerfinder > xrpl.basics
+libxrpl.peerfinder > xrpl.peerfinder
+libxrpl.peerfinder > xrpl.protocol
 libxrpl.protocol > xrpl.basics
 libxrpl.protocol > xrpl.json
 libxrpl.protocol > xrpl.protocol
@@ -57,9 +65,9 @@ test.app > test.jtx
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
+test.app > xrpl.consensus
 test.app > xrpl.core
 test.app > xrpld.app
-test.app > xrpld.consensus
 test.app > xrpld.core
 test.app > xrpld.overlay
 test.app > xrpld.rpc
@@ -80,12 +88,9 @@ test.basics > xrpl.protocol
 test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpl.conditions
-test.consensus > test.csf
 test.consensus > test.jtx
-test.consensus > test.unit_test
 test.consensus > xrpl.basics
 test.consensus > xrpld.app
-test.consensus > xrpld.consensus
 test.consensus > xrpl.ledger
 test.consensus > xrpl.protocol
 test.consensus > xrpl.shamap
@@ -100,10 +105,6 @@ test.core > xrpl.json
 test.core > xrpl.protocol
 test.core > xrpl.rdb
 test.core > xrpl.server
-test.csf > xrpl.basics
-test.csf > xrpld.consensus
-test.csf > xrpl.json
-test.csf > xrpl.ledger
 test.json > test.jtx
 test.json > xrpl.json
 test.jtx > test.unit_test
@@ -143,19 +144,13 @@ test.overlay > xrpl.config
 test.overlay > xrpld.app
 test.overlay > xrpld.core
 test.overlay > xrpld.overlay
-test.overlay > xrpld.peerfinder
 test.overlay > xrpl.json
 test.overlay > xrpl.nodestore
+test.overlay > xrpl.peerfinder
 test.overlay > xrpl.protocol
 test.overlay > xrpl.resource
 test.overlay > xrpl.server
 test.overlay > xrpl.shamap
-test.peerfinder > test.beast
-test.peerfinder > test.unit_test
-test.peerfinder > xrpl.basics
-test.peerfinder > xrpld.core
-test.peerfinder > xrpld.peerfinder
-test.peerfinder > xrpl.protocol
 test.protocol > test.jtx
 test.protocol > test.unit_test
 test.protocol > xrpl.basics
@@ -189,11 +184,13 @@ test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
 tests.libxrpl > xrpl.basics
 tests.libxrpl > xrpl.config
+tests.libxrpl > xrpl.consensus
 tests.libxrpl > xrpl.core
 tests.libxrpl > xrpl.json
 tests.libxrpl > xrpl.ledger
 tests.libxrpl > xrpl.net
 tests.libxrpl > xrpl.nodestore
+tests.libxrpl > xrpl.peerfinder
 tests.libxrpl > xrpl.protocol
 tests.libxrpl > xrpl.protocol_autogen
 tests.libxrpl > xrpl.resource
@@ -203,6 +200,10 @@ tests.libxrpl > xrpl.tx
 xrpl.conditions > xrpl.basics
 xrpl.conditions > xrpl.protocol
 xrpl.config > xrpl.basics
+xrpl.consensus > xrpl.basics
+xrpl.consensus > xrpl.json
+xrpl.consensus > xrpl.ledger
+xrpl.consensus > xrpl.protocol
 xrpl.core > xrpl.basics
 xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
@@ -217,6 +218,8 @@ xrpl.nodestore > xrpl.basics
 xrpl.nodestore > xrpl.config
 xrpl.nodestore > xrpl.json
 xrpl.nodestore > xrpl.protocol
+xrpl.peerfinder > xrpl.basics
+xrpl.peerfinder > xrpl.protocol
 xrpl.protocol > xrpl.basics
 xrpl.protocol > xrpl.json
 xrpl.protocol_autogen > xrpl.json
@@ -243,23 +246,20 @@ xrpl.tx > xrpl.protocol
 xrpld.app > test.unit_test
 xrpld.app > xrpl.basics
 xrpld.app > xrpl.config
+xrpld.app > xrpl.consensus
 xrpld.app > xrpl.core
-xrpld.app > xrpld.consensus
 xrpld.app > xrpld.core
 xrpld.app > xrpl.json
 xrpld.app > xrpl.ledger
 xrpld.app > xrpl.net
 xrpld.app > xrpl.nodestore
+xrpld.app > xrpl.peerfinder
 xrpld.app > xrpl.protocol
 xrpld.app > xrpl.rdb
 xrpld.app > xrpl.resource
 xrpld.app > xrpl.server
 xrpld.app > xrpl.shamap
 xrpld.app > xrpl.tx
-xrpld.consensus > xrpl.basics
-xrpld.consensus > xrpl.json
-xrpld.consensus > xrpl.ledger
-xrpld.consensus > xrpl.protocol
 xrpld.core > xrpl.basics
 xrpld.core > xrpl.config
 xrpld.core > xrpl.core
@@ -268,21 +268,22 @@ xrpld.core > xrpl.protocol
 xrpld.core > xrpl.rdb
 xrpld.overlay > xrpl.basics
 xrpld.overlay > xrpl.config
+xrpld.overlay > xrpl.consensus
 xrpld.overlay > xrpl.core
-xrpld.overlay > xrpld.consensus
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.ledger
+xrpld.overlay > xrpl.peerfinder
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource
 xrpld.overlay > xrpl.server
 xrpld.overlay > xrpl.shamap
 xrpld.overlay > xrpl.tx
 xrpld.peerfinder > xrpl.basics
-xrpld.peerfinder > xrpl.config
+xrpld.peerfinder > xrpld.app
 xrpld.peerfinder > xrpld.core
-xrpld.peerfinder > xrpl.protocol
+xrpld.peerfinder > xrpl.peerfinder
 xrpld.peerfinder > xrpl.rdb
 xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
--- a/.github/scripts/strategy-matrix/linux.json
+++ b/.github/scripts/strategy-matrix/linux.json
@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-e29b523",
+  "image_tag": "sha-40cdf49",
  "configs": {
    "ubuntu": [
      {
--- a/.github/workflows/build-nix-images.yml
+++ b/.github/workflows/build-nix-images.yml
@@ -1,4 +1,4 @@
-name: Build Nix Docker images
+name: Build `nix` Docker images

 on:
  push:
@@ -8,20 +8,24 @@ on:
      - ".github/workflows/build-nix-images.yml"
      - "flake.nix"
      - "flake.lock"
+      - "rust-toolchain.toml"
      - "nix/**"
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
      - "bin/check-tools.sh"
+      - "bin/default-loader-path.sh"
      - "bin/install-sanitizer-libs.sh"
  pull_request:
    paths:
      - ".github/workflows/build-nix-images.yml"
      - "flake.nix"
      - "flake.lock"
+      - "rust-toolchain.toml"
      - "nix/**"
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
      - "bin/check-tools.sh"
+      - "bin/default-loader-path.sh"
      - "bin/install-sanitizer-libs.sh"
  workflow_dispatch:

@@ -36,7 +40,7 @@ defaults:

 jobs:
  build-merge:
-    name: Build and push nix-${{ matrix.distro.name }}
+    name: Build and push `nix-${{ matrix.distro.name }}` image
    permissions:
      contents: read
      packages: write
@@ -54,7 +58,7 @@ jobs:
            base_image: debian:bookworm
          - name: rhel
            base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
    with:
      image_name: xrpld/nix-${{ matrix.distro.name }}
      dockerfile: nix/docker/Dockerfile
--- a/.github/workflows/build-packaging-images.yml
+++ b/.github/workflows/build-packaging-images.yml
@@ -1,4 +1,4 @@
-name: Build packaging Docker images
+name: Build `packaging` Docker images

 on:
  push:
@@ -26,7 +26,7 @@ defaults:

 jobs:
  build-merge:
-    name: Build and push packaging-${{ matrix.distro.name }}
+    name: Build and push `packaging-${{ matrix.distro.name }}` image
    permissions:
      contents: read
      packages: write
@@ -38,7 +38,7 @@ jobs:
            base_image: debian:bookworm
          - name: rhel
            base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
    with:
      image_name: xrpld/packaging-${{ matrix.distro.name }}
      dockerfile: package/Dockerfile
--- a/.github/workflows/build-pre-commit-image.yml
+++ b/.github/workflows/build-pre-commit-image.yml
@@ -0,0 +1,38 @@
+name: Build `pre-commit` Docker image
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/pre-commit/Dockerfile"
+      - "rust-toolchain.toml"
+  pull_request:
+    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/pre-commit/Dockerfile"
+      - "rust-toolchain.toml"
+  workflow_dispatch:
+
+concurrency:
+  # Read `on-trigger.yml` for the rationale behind this concurrency group name.
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-merge:
+    name: Build and push `pre-commit` image
+    permissions:
+      contents: read
+      packages: write
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    with:
+      image_name: xrpld/pre-commit
+      dockerfile: bin/pre-commit/Dockerfile
+      base_image: ubuntu:26.04
+      push: ${{ github.event_name == 'push' }}
--- a/.github/workflows/check-pr-description.yml
+++ b/.github/workflows/check-pr-description.yml
@@ -23,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Write PR body to file
        env:
--- a/.github/workflows/check-pr-title.yml
+++ b/.github/workflows/check-pr-title.yml
@@ -20,4 +20,4 @@ on:
 jobs:
  check_title:
    if: ${{ github.event.pull_request.draft != true }}
-    uses: XRPLF/actions/.github/workflows/check-pr-title.yml@cba1f0891650baf1a9c88624dc2d72573be2eb81
+    uses: XRPLF/actions/.github/workflows/check-pr-title.yml@d7c65e49225a38f6d8010eacf017bb5a98d7476c
--- a/.github/workflows/check-tools.yml
+++ b/.github/workflows/check-tools.yml
@@ -0,0 +1,114 @@
+# Verifies the committed snapshots of `bin/check-tools.sh` output for each Nix
+# environment (see nix/check-tools/). If the environment changes — a new image
+# tag, an updated flake.lock, a different tool list — without the matching
+# snapshot being regenerated and committed, this workflow fails so the drift is
+# caught in review.
+#
+# To regenerate the snapshots, see nix/check-tools/README.md.
+name: Check tools
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  push:
+    branches:
+      - "develop"
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The nix-nixos image tag is pinned alongside the build matrix in linux.json,
+  # so snapshots are checked against the exact image CI builds against.
+  linux-image-tag:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Read nix image tag
+        id: tag
+        run: echo "tag=$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)" >>"${GITHUB_OUTPUT}"
+
+  # One job for all environments; they differ only in whether the tools come
+  # from the nix-nixos container (Linux) or `nix develop` (macOS).
+  check-tools:
+    needs: linux-image-tag
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            snapshot: nix/check-tools/nix-ubuntu-amd64.txt
+            nix_develop: false
+          - runner: ubuntu-24.04-arm
+            snapshot: nix/check-tools/nix-ubuntu-arm64.txt
+            nix_develop: false
+          - runner: macos-26-apple-clang-21
+            snapshot: nix/check-tools/macos.txt
+            nix_develop: true
+    runs-on: ${{ matrix.runner }}
+    # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
+    # the flake's dev shell instead (see the run step below).
+    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-ubuntu:{0}', needs.linux-image-tag.outputs.tag) || null }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        with:
+          enable_ccache: false
+
+      - name: Regenerate snapshot
+        env:
+          CHECK_TOOLS_SKIP_CLONE: "1"
+          # check-tools.sh skips some macOS tools when CI is set; the snapshots
+          # capture the full `nix develop` environment, so unset it here.
+          CI: ""
+        run: |
+          if [ "${{ matrix.nix_develop }}" = "true" ]; then
+              # `nix develop` prints the dev-shell greeting first; keep only the
+              # check-tools.sh output (from the "Detected OS:" line onward).
+              nix --extra-experimental-features "nix-command flakes" develop \
+                  -c bash bin/check-tools.sh | sed -n '/^Detected OS:/,$p' >"${{ matrix.snapshot }}"
+          else
+              bash bin/check-tools.sh >"${{ matrix.snapshot }}"
+          fi
+
+      - name: Verify snapshot is up to date
+        run: |
+          if ! git diff --exit-code -- "${{ matrix.snapshot }}"; then
+              echo "::error::${{ matrix.snapshot }} is out of date. Regenerate it (see nix/check-tools/README.md) and commit the result."
+              exit 1
+          fi
+
+      - name: Upload regenerated snapshot
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: check-tools-${{ runner.os }}-${{ runner.arch }}
+          path: ${{ matrix.snapshot }}
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -25,18 +25,11 @@ on:
      - unlabeled

 concurrency:
-  # Use a per-ref group so a newer run (a push, or a change to a label below)
-  # supersedes the in-progress one for that ref. Label events we don't act on get
-  # their own unique group (per run id) instead, keeping them out of the shared
-  # group so real builds keep running. Keep this list in sync with `should-run`.
-  group: >-
-    ${{ github.workflow }}-${{ github.ref }}${{
-      ((github.event.action == 'labeled' || github.event.action == 'unlabeled')
-      && github.event.label.name != 'Ready to merge'
-      && github.event.label.name != 'DraftRunCI'
-      && github.event.label.name != 'Full CI build')
-      && format('-{0}', github.run_id) || ''
-    }}
+  # A single per-ref group with cancel-in-progress means any newer run (a push
+  # or a label change) supersedes the in-progress one for that ref. Keeping
+  # exactly one authoritative run per ref ensures a fast do-nothing run can never
+  # mask a real build's checks.
+  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

 defaults:
@@ -44,26 +37,22 @@ defaults:
    shell: bash

 jobs:
-  # This job determines whether the rest of the workflow should run. It runs
-  # when the PR is not a draft (which should also cover merge-group) or has the
-  # 'DraftRunCI' or 'Full CI build' label. For label events it only runs when the
-  # label added or removed is one we act on ('Ready to merge', 'DraftRunCI' or
-  # 'Full CI build'), so unrelated label changes do not trigger a redundant run.
+  # This job determines whether the rest of the workflow should run at all,
+  # based on the current set of labels: it runs when the PR is not a draft
+  # (which should also cover merge-group) or has the 'DraftRunCI' or
+  # 'Full CI build' label. Whether a build then happens, and whether it is the
+  # minimal or full matrix, is decided further below and in the strategy matrix.
  should-run:
    if: >-
      ${{
-        ((github.event.action != 'labeled' && github.event.action != 'unlabeled')
-          || github.event.label.name == 'Ready to merge'
-          || github.event.label.name == 'DraftRunCI'
-          || github.event.label.name == 'Full CI build')
-        && (!github.event.pull_request.draft
-          || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
-          || contains(github.event.pull_request.labels.*.name, 'Full CI build'))
+        !github.event.pull_request.draft
+        || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
+        || contains(github.event.pull_request.labels.*.name, 'Full CI build')
      }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Determine changed files
        # This step checks whether any files have changed that should
        # cause the next jobs to run. We do it this way rather than
@@ -101,6 +90,7 @@ jobs:
            .clang-tidy
            .codecov.yml
            bin/check-tools.sh
+            bin/default-loader-path.sh
            cfg/**
            cmake/**
            conan/**
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -28,6 +28,7 @@ on:
      - ".clang-tidy"
      - ".codecov.yml"
      - "bin/check-tools.sh"
+      - "bin/default-loader-path.sh"
      - "cfg/**"
      - "cmake/**"
      - "conan/**"
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -14,7 +14,7 @@ on:
 jobs:
  # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
  run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
    with:
      runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/ci/tools-rippled-pre-commit:sha-41ec7c1" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -41,13 +41,13 @@ env:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-40cdf49
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: false

--- a/.github/workflows/reusable-build-test-config.yml
+++ b/.github/workflows/reusable-build-test-config.yml
@@ -110,10 +110,10 @@ jobs:
        uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4

      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: ${{ inputs.ccache_enabled }}

@@ -223,11 +223,13 @@ jobs:
          BUILD_TYPE: ${{ inputs.build_type }}
          CMAKE_TARGET: ${{ inputs.cmake_target }}
        run: |
+          set -o pipefail
          cmake \
              --build . \
              --config "${BUILD_TYPE}" \
              --parallel "${BUILD_NPROC}" \
-              --target "${CMAKE_TARGET}"
+              --target "${CMAKE_TARGET}" \
+              2>&1 | tee "${GITHUB_WORKSPACE}/build.log"

      - name: Show ccache statistics
        if: ${{ inputs.ccache_enabled }}
@@ -322,27 +324,46 @@ jobs:
              PRELOAD=""
          fi

-          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee unittest.log
+          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"

-      - name: Show test failure summary
-        if: ${{ failure() && !inputs.build_only }}
-        env:
-          WORKING_DIR: ${{ runner.os == 'Windows' && format('{0}\{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
+      # Smoke-run every benchmark module with a single repetition to confirm the
+      # benchmarks still build and execute. This is a correctness check, not a
+      # performance measurement, so it is skipped for instrumented builds
+      # (sanitizers/coverage/voidstar), where it would be slow and meaningless,
+      # and on Windows, where the `install` target does not build them.
+      - name: Run the benchmarks
+        if: ${{ !inputs.build_only && runner.os != 'Windows' && env.SANITIZERS_ENABLED == 'false' && env.COVERAGE_ENABLED != 'true' && env.VOIDSTAR_ENABLED != 'true' }}
+        working-directory: ${{ env.BUILD_DIR }}
        run: |
-          if [ ! -d "${WORKING_DIR}" ]; then
-              echo "Working directory '${WORKING_DIR}' does not exist."
-              exit 0
-          fi
+          rc=0
+          while IFS= read -r bench; do
+              echo "::group::${bench}"
+              "./${bench}" --benchmark_repetitions=1 || rc=1
+              echo "::endgroup::"
+          done < <(find src/benchmarks -type f -perm -u+x -name 'xrpl.bench.*')
+          exit "${rc}"

-          cd "${WORKING_DIR}"
+      - name: Show build/test failure summary
+        if: ${{ failure() }}
+        run: |
+          cd "${GITHUB_WORKSPACE}"

-          if [ ! -f unittest.log ]; then
-              echo "unittest.log not found; embedded tests may not have run."
-              exit 0
-          fi
-
-          if ! grep -E "failed" unittest.log; then
-              echo "Log present but no failure lines found in unittest.log."
+          if [ -f unittest.log ]; then
+              if ! grep -E "failed" unittest.log | grep -vE "^I[0-9]|^[0-9]+> (ERR:|FTL:)"; then
+                  echo "unittest.log present but no failure lines found."
+              fi
+          elif [ -f build.log ]; then
+              # GCC/Clang emit "error:" (covers "fatal error:"); MSVC emits
+              # "error C####:", "error LNK####:", and "fatal error LNK####:".
+              # -A6 prints the lines that follow each match (source line, caret,
+              # notes, and the "N errors generated" tally) to capture the whole
+              # diagnostic block.
+              if ! grep -E -A6 "error:|error C[0-9]{4}|error LNK[0-9]{4}|fatal error" build.log; then
+                  echo "build.log present but no compile errors found."
+              fi
+          else
+              echo "unittest.log/build.log not found; something went wrong."
+              exit 1
          fi
      - name: Debug failure (Linux)
        if: ${{ failure() && runner.os == 'Linux' && !inputs.build_only }}
--- a/.github/workflows/reusable-check-levelization.yml
+++ b/.github/workflows/reusable-check-levelization.yml
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check levelization
        run: python .github/scripts/levelization/generate.py
      - name: Check for differences
--- a/.github/workflows/reusable-check-rename.yml
+++ b/.github/workflows/reusable-check-rename.yml
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check definitions
        run: .github/scripts/rename/definitions.sh .
      - name: Check copyright notices
--- a/.github/workflows/reusable-clang-tidy.yml
+++ b/.github/workflows/reusable-clang-tidy.yml
@@ -34,16 +34,16 @@ jobs:
    needs: [determine-files]
    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-40cdf49"
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: false

--- a/.github/workflows/reusable-package.yml
+++ b/.github/workflows/reusable-package.yml
@@ -27,10 +27,10 @@ jobs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

@@ -54,7 +54,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download pre-built binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
--- a/.github/workflows/reusable-strategy-matrix.yml
+++ b/.github/workflows/reusable-strategy-matrix.yml
@@ -23,10 +23,10 @@ jobs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

--- a/.github/workflows/reusable-upload-recipe.yml
+++ b/.github/workflows/reusable-upload-recipe.yml
@@ -40,14 +40,14 @@ defaults:
 jobs:
  upload:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-40cdf49
    env:
      REMOTE_NAME: ${{ inputs.remote_name }}
      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
      CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Generate build version number
        id: version
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -65,10 +65,10 @@ jobs:
        uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4

      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: false

--- a/.gitignore
+++ b/.gitignore
@@ -81,6 +81,9 @@ DerivedData
 # Python
 __pycache__

+# Rust build artifacts.
+target/
+
 # Direnv's directory
 /.direnv

--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -55,7 +55,7 @@ repos:
        types_or: [c++, c]

  - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
+    rev: f4d7745e17a28aad7eed2f4874ca8d1568c11c4c # frozen: v22.1.8
    hooks:
      - id: clang-format
        args: [--style=file]
@@ -68,7 +68,7 @@ repos:
      - id: gersemi

  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 39e2973981e6d2f9b6c543b0086a2d2393abdc89 # frozen: v3.9.4
+    rev: 9337a74165b178ae2c766f60bee7252a0f06f3e8 # frozen: v3.9.5
    hooks:
      - id: prettier
        args: [--end-of-line=auto]
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -131,6 +131,10 @@ else()
 endif()
 target_link_libraries(xrpl_libs INTERFACE ${nudb})

+if(benchmark)
+    find_package(benchmark REQUIRED)
+endif()
+
 if(coverage)
    include(XrplCov)
 endif()
@@ -145,3 +149,7 @@ if(tests)
    include(CTest)
    add_subdirectory(src/tests/libxrpl)
 endif()
+
+if(benchmark)
+    add_subdirectory(src/benchmarks/libxrpl)
+endif()
--- a/4
+++ b/4
@@ -0,0 +1,4 @@
+# By default, anyone can review changes.
+
+# The CI tooling team should review changes to the CI configuration.
+/.github/ @XRPLF/ci-tooling
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -83,6 +83,7 @@ If you create new source files, they must be organized as follows:
  `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
 - All test source files must go under `src/test`.
+- All benchmark source files must go under `src/benchmarks`.

 The source must be formatted according to the style guide below. The easiest
 way to satisfy this is to install the [`pre-commit`](#pre-commit-hooks) hooks,
--- a/bin/check-tools.sh
+++ b/bin/check-tools.sh
@@ -30,8 +30,10 @@ missing=()
 checked=0

 # check <name> [probe-command...]
-# Runs the probe (default: "<name> --version") quietly. Records <name> as
-# missing if the command is not found or exits non-zero.
+# Runs the probe (default: "<name> --version"), capturing both stdout and
+# stderr, and prints one aligned line: the status, the name, and the first
+# non-blank line of the probe output (its version). Records <name> as missing
+# if the command is not found or exits non-zero.
 check() {
    local name="$1"
    shift
@@ -40,10 +42,11 @@ check() {
        probe=("${name}" --version)
    fi

-    echo "Checking ${name}..."
    checked=$((checked + 1))
-    if "${probe[@]}" | head -n 1; then
-        printf '  [ ok ] %s\n' "${name}"
+    local output version
+    if output="$("${probe[@]}" 2>&1)"; then
+        version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
+        printf '  [ ok ] %-20s %s\n' "${name}" "${version}"
    else
        printf '  [MISS] %s\n' "${name}"
        missing+=("${name}")
@@ -85,12 +88,14 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
    check file
    check less
    check make
-    check netstat which netstat
+    # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
+    # version flag, so fall back to a presence marker there.
+    check netstat sh -c 'command -v netstat >/dev/null && { netstat --version 2>&1 | grep -m1 -oE "net-tools [0-9.]+" || echo present; }'
    check ninja
-    check perl
+    check perl perl -e 'print "$^V\n"'
    check pkg-config
    check vim
-    check zip
+    check zip bash -c 'zip --version 2>&1 | grep -m1 -oE "Zip [0-9.]+"'

    # These tools are present in our Linux CI images and in local development
    # setups, but not in the macOS CI environment. So check them everywhere
--- a/bin/default-loader-path.sh
+++ b/bin/default-loader-path.sh
--- a/bin/pre-commit/Dockerfile
+++ b/bin/pre-commit/Dockerfile
@@ -0,0 +1,55 @@
+ARG BASE_IMAGE=ubuntu:26.04
+
+FROM ${BASE_IMAGE}
+
+SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
+ENTRYPOINT ["/bin/bash"]
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN <<EOF
+pkgs=()
+pkgs+=(curl)         # Required to install nix.
+pkgs+=(doxygen)      # Needed for Clio's check-doxygen-docs.sh.
+pkgs+=(git)          # Required for prepare-runner.
+pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
+pkgs+=(python3)      # Python 3 interpreter.
+pkgs+=(python3-pip)  # Package manager for Python applications.
+pkgs+=(xz-utils)     # Required to install nix
+
+apt-get update
+apt-get install -y --no-install-recommends "${pkgs[@]}"
+apt-get clean
+rm -rf /var/lib/apt/lists/*
+EOF
+
+ARG PRE_COMMIT_VERSION=4.6.0
+RUN pip install --no-cache --break-system-packages \
+    pre-commit==${PRE_COMMIT_VERSION}
+
+RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes
+
+# Add nix to PATH and set NIX environment variables,
+# so nix is available in all shells including non-interactive shells (e.g., GitHub Actions).
+ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
+ENV NIX_PROFILES="/nix/var/nix/profiles/default"
+ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+
+# Verify nix installation
+RUN nix --version
+
+ENV RUSTUP_HOME="/opt/rust/rustup"
+ENV CARGO_HOME="/opt/rust/cargo"
+ENV PATH="/opt/rust/cargo/bin:${PATH}"
+
+WORKDIR /tmp
+COPY rust-toolchain.toml /tmp/rust-toolchain.toml
+RUN <<EOF
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+    | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
+rustup toolchain install
+rustup show
+cargo fmt --version
+EOF
+
+WORKDIR /
--- a/cmake/CompilationEnv.cmake
+++ b/cmake/CompilationEnv.cmake
@@ -29,6 +29,27 @@ if(CMAKE_GENERATOR STREQUAL "Xcode")
    set(is_xcode TRUE)
 endif()

+# --------------------------------------------------------------------
+# Nix toolchain detection
+# --------------------------------------------------------------------
+# True when the C++ compiler resolves into the Nix store. CMAKE_CXX_COMPILER may
+# be referenced through a symlink outside the store (a Nix profile, a /usr/bin
+# alternative, ...), so resolve the real path before matching.
+set(is_nix_compiler FALSE)
+get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
+if(_cxx_real MATCHES "^/nix/store/")
+    set(is_nix_compiler TRUE)
+endif()
+unset(_cxx_real)
+
+# True inside the Nix CI Docker image, identified by the /nix/ci-env tree it
+# ships (see nix/docker/Dockerfile). The dev shell and bare systems don't have
+# it, so it distinguishes the CI image from other Nix-compiler environments.
+set(is_ci_image FALSE)
+if(EXISTS "/nix/ci-env/bin")
+    set(is_ci_image TRUE)
+endif()
+
 # --------------------------------------------------------------------
 # Operating system detection
 # --------------------------------------------------------------------
--- a/cmake/PatchNixBinary.cmake
+++ b/cmake/PatchNixBinary.cmake
@@ -1,26 +1,37 @@
 #[===================================================================[
   Patch executables to run in non-Nix environments.

-   The Nix-based CI image links binaries against an ELF interpreter (loader)
-   that lives in the Nix store, so the resulting binaries don't run elsewhere
-   (including once installed from the .deb package). `patch_nix_binary` adds a
-   POST_BUILD step that resets the interpreter to the system default loader and
-   drops the rpath.
+   The Nix toolchain links binaries against an ELF interpreter (loader)
+   that lives in the Nix store, so the resulting binaries don't run elsewhere.
+   `patch_nix_binary` adds a POST_BUILD step that resets the interpreter
+   to the system default loader and drops the rpath.

-   This is only active inside the Nix-based image, detected by the presence of
-   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
-   is skipped for sanitizer builds, whose runtime libraries are resolved through
-   the rpath. Everywhere else `patch_nix_binary` is a no-op.
+   This runs by default for Nix-toolchain builds (determined by whether the compiler resolves under /nix/store/).
+   Those builds are where binaries get a Nix-store loader.
+   It is opted out of by setting the XRPLD_NO_PATCH_NIX_BINARY environment variable —
+   the plain Nix dev shells set it, since their binaries link a newer glibc
+   and must not be retargeted to the system loader.
+
+   Non-Nix builds (a system compiler, already using the system loader) and sanitizer builds
+   (runtime libraries resolved through the rpath) are skipped too.
+   Everywhere else `patch_nix_binary` is a no-op.
+
+   The default loader is resolved by bin/default-loader-path.sh.
 #]===================================================================]

 include_guard(GLOBAL)

 include(CompilationEnv)

-# Provided by the Nix-based CI image; prints the system default ELF loader path.
-set(_loader_path_script "/tmp/loader-path.sh")
+# Resolves the system default ELF loader path for the current architecture.
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")

-if(is_linux AND NOT SANITIZERS_ENABLED AND EXISTS "${_loader_path_script}")
+if(
+    is_linux
+    AND NOT SANITIZERS_ENABLED
+    AND is_nix_compiler
+    AND NOT DEFINED ENV{XRPLD_NO_PATCH_NIX_BINARY}
+)
    execute_process(
        COMMAND "${_loader_path_script}"
        OUTPUT_VARIABLE DEFAULT_LOADER_PATH
--- a/cmake/XrplAddBenchmark.cmake
+++ b/cmake/XrplAddBenchmark.cmake
@@ -0,0 +1,36 @@
+include(isolate_headers)
+
+# Define a benchmark executable for the module `name`.
+#
+# This follows the same general pattern as other build helpers in this repo
+# (e.g. `add_module`): create a target and isolate headers, but here the target
+# is a benchmark executable and no `add_test(...)` is registered.
+#
+# `isolate_headers` exposes only `${CMAKE_CURRENT_SOURCE_DIR}/${name}` on the
+# include path, rooted at `src`, so a benchmark's own headers are reached as
+# `<benchmarks/.../${name}/...>` and nothing else in the tree leaks in.
+function(xrpl_add_benchmark name)
+    set(target ${PROJECT_NAME}.bench.${name})
+
+    file(
+        GLOB_RECURSE sources
+        CONFIGURE_DEPENDS
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}/*.cpp"
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}.cpp"
+    )
+    add_executable(${target} ${ARGN} ${sources})
+
+    # Benchmark sources register cases through Google Benchmark's static
+    # registrars (anonymous-namespace lambdas). Merging several such files into
+    # one unity translation unit collides those internal-linkage entities, so
+    # keep benchmarks out of the unity build - mirroring xrpl.libpb in
+    # XrplCore.cmake. Each file compiles fine on its own.
+    set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
+
+    isolate_headers(
+        ${target}
+        "${CMAKE_SOURCE_DIR}/src"
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}"
+        PRIVATE
+    )
+endfunction()
--- a/cmake/XrplCompiler.cmake
+++ b/cmake/XrplCompiler.cmake
@@ -171,9 +171,8 @@ else()
    # Clang wrapper supplies those paths itself (via -nostdinc++), so at compile time the
    # flag is unused -> Clang errors under our -Werror. At link time the flag IS consumed
    # (it selects the C++ runtime), so we move it there instead of dropping it entirely.
-    get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
    if(
-        _cxx_real MATCHES "^/nix/store/"
+        is_nix_compiler
        AND is_linux
        AND is_clang
        AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
--- a/cmake/XrplCore.cmake
+++ b/cmake/XrplCore.cmake
@@ -133,6 +133,12 @@ target_link_libraries(
 add_module(xrpl resource)
 target_link_libraries(xrpl.libxrpl.resource PUBLIC xrpl.libxrpl.protocol)

+add_module(xrpl peerfinder)
+target_link_libraries(
+    xrpl.libxrpl.peerfinder
+    PUBLIC xrpl.libxrpl.basics xrpl.libxrpl.protocol
+)
+
 # Level 08
 add_module(xrpl net)
 target_link_libraries(
@@ -201,6 +207,16 @@ target_link_libraries(
 add_module(xrpl tx)
 target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)

+add_module(xrpl consensus)
+target_link_libraries(
+    xrpl.libxrpl.consensus
+    PUBLIC
+        xrpl.libxrpl.basics
+        xrpl.libxrpl.json
+        xrpl.libxrpl.protocol
+        xrpl.libxrpl.ledger
+)
+
 add_library(xrpl.libxrpl)
 set_target_properties(xrpl.libxrpl PROPERTIES OUTPUT_NAME xrpl)

@@ -220,6 +236,7 @@ target_link_modules(
    beast
    conditions
    config
+    consensus
    core
    crypto
    git
@@ -227,6 +244,7 @@ target_link_modules(
    ledger
    net
    nodestore
+    peerfinder
    protocol
    protocol_autogen
    rdb
--- a/cmake/XrplSanity.cmake
+++ b/cmake/XrplSanity.cmake
@@ -36,6 +36,19 @@ elseif(is_gcc)
    endif()
 endif()

+# A Nix compiler is only meant to be used from a managed environment: the xrpld
+# dev shell (which exports XRPL_DEVSHELL) or the CI image. Using one from a bare
+# shell usually means a leaked toolchain (picked up via PATH or a Conan profile)
+# and leads to confusing breakage, so fail early with guidance.
+if(is_nix_compiler AND NOT is_ci_image AND NOT DEFINED ENV{XRPL_DEVSHELL})
+    message(
+        FATAL_ERROR
+        "A Nix compiler (${CMAKE_CXX_COMPILER}) is being used outside the xrpld "
+        "dev shell. Enter it with `nix develop` (see docs/build/nix.md) before "
+        "configuring the build."
+    )
+endif()
+
 # check for in-source build and fail
 if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
    message(
--- a/cmake/XrplSettings.cmake
+++ b/cmake/XrplSettings.cmake
@@ -30,6 +30,8 @@ if(tests)
    endif()
 endif()

+option(benchmark "Build benchmarks" ON)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are
--- a/conan.lock
+++ b/conan.lock
@@ -10,22 +10,23 @@
        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
+        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/0.4.0-rc2#a580f2f9ad0e795de696aa62d54fb9af%1782425834.488828",
+        "mpt-crypto/0.4.0-rc4#ffdba12f2332357f0d8b0ae944cfff52%1784138702.932355",
        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
        "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
+        "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "benchmark/1.9.5#b885dc73ad67b40a55d45684d1c88ad1%1782736613.864841",
+        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
    ],
    "build_requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
@@ -38,7 +39,7 @@
        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
        "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
        "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
    ],
    "python_requires": [],
    "overrides": {
--- a/conan/profiles/default
+++ b/conan/profiles/default
@@ -20,6 +20,22 @@ compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}

 [conf]
+{# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
+{# Instead it hand-rolls the compiler for user-config.jam, #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and picks the system compiler, which is mismatched with the Nix libraries #}
+{# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
+{# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
+{# resolve the same compiler. #}
+{# Not part of the package ID, so binaries stay shareable. #}
+{% if os != "Windows" %}
+{% set cc_exe  = {"gcc": "gcc",  "clang": "clang",   "apple-clang": "clang"}.get(compiler) %}
+{% set cxx_exe = {"gcc": "g++",  "clang": "clang++", "apple-clang": "clang++"}.get(compiler) %}
+tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
+{% endif %}
+
 {# By default, Conan tries to reuse binaries built with different cppstd versions. #}
 {# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
--- a/conanfile.py
+++ b/conanfile.py
@@ -15,6 +15,7 @@ class Xrpl(ConanFile):
    settings = "os", "compiler", "build_type", "arch"
    options = {
        "assertions": [True, False],
+        "benchmark": [True, False],
        "coverage": [True, False],
        "fPIC": [True, False],
        "jemalloc": [True, False],
@@ -46,6 +47,7 @@ class Xrpl(ConanFile):

    default_options = {
        "assertions": False,
+        "benchmark": True,
        "coverage": False,
        "fPIC": True,
        "jemalloc": False,
@@ -129,12 +131,14 @@ class Xrpl(ConanFile):
            self.options["boost"].without_cobalt = True

    def requirements(self):
+        if self.options.benchmark:
+            self.requires("benchmark/1.9.5")
        self.requires("boost/1.91.0", force=True, transitive_headers=True)
        self.requires("date/3.0.4", transitive_headers=True)
        if self.options.jemalloc:
            self.requires("jemalloc/5.3.1")
        self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/0.4.0-rc2", transitive_headers=True)
+        self.requires("mpt-crypto/0.4.0-rc4", transitive_headers=True)
        self.requires("protobuf/6.33.5", force=True)
        if self.options.rocksdb:
            self.requires("rocksdb/10.5.1")
@@ -162,6 +166,7 @@ class Xrpl(ConanFile):
    def generate(self):
        tc = CMakeToolchain(self)
        tc.variables["tests"] = self.options.tests
+        tc.variables["benchmark"] = self.options.benchmark
        tc.variables["assert"] = self.options.assertions
        tc.variables["coverage"] = self.options.coverage
        tc.variables["jemalloc"] = self.options.jemalloc
--- a/docs/build/nix.md
+++ b/docs/build/nix.md
@@ -38,8 +38,10 @@ The first time you run this command, it will take a few minutes to download and

 ### Platform notes

- **Linux**: `nix develop` gives you a shell with all the tooling necessary to
-  develop xrpld and with GCC 15.2 (also provided by Nix). There are no caveats.
+- **Linux**: `nix develop` gives you a shell with all the tooling necessary to develop xrpld
+  and with the same GCC/glibc toolchain that Nix builds for CI.
+  See [Choosing a different compiler](#choosing-a-different-compiler)
+  for the custom-vs-plain toolchain trade-off.
 - **macOS**: `nix develop` gives you a full environment too, with Clang (and
  every other tool, including Conan) provided by Nix. To use your system-wide
  Apple Clang instead, enter `nix develop .#apple-clang`. Conan has no binary in
@@ -63,8 +65,16 @@ The first time you run this command, it will take a few minutes to download and
 ### Choosing a different compiler

 A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#clang`.
-The `.#gcc` and `.#clang` shells provide the same GCC and Clang versions used in CI
-(pinned in [`nix/packages.nix`](../../nix/packages.nix)).
+
+On Linux, `.#gcc` and `.#clang` provide the exact toolchain CI uses:
+the compiler (pinned in [`nix/packages.nix`](../../nix/packages.nix))
+rebuilt against the pinned custom glibc (see [`nix/compilers.nix`](../../nix/compilers.nix)).
+Building that toolchain the first time is slow unless it is fetched from a Nix binary cache.
+If you don't need the custom glibc, the Linux-only `.#gcc-plain` and `.#clang-plain`
+give you the stock nixpkgs compilers of the same versions.
+On macOS there is no custom glibc, so `.#gcc` and `.#clang` are already the plain nixpkgs toolchain,
+and the `-plain` variants do not exist.
+
 Use `nix flake show` to see all the available development shells.

 Use `nix develop .#no-compiler` to use the compiler from your system.
@@ -72,14 +82,18 @@ Use `nix develop .#no-compiler` to use the compiler from your system.
 ### Example Usage

 ```bash
-# Use GCC (same version as CI)
+# Use GCC — same toolchain as CI (custom glibc on Linux)
 nix develop .#gcc

-# Use Clang (same version as CI)
+# Use Clang — same toolchain as CI (custom glibc on Linux)
 nix develop .#clang

 # Use default for your platform
 nix develop
+
+# Stock nixpkgs GCC/Clang, Linux only — skips the custom-glibc build, but does not match CI
+nix develop .#gcc-plain
+nix develop .#clang-plain
 ```

 ### Using a different shell
@@ -110,6 +124,10 @@ nix develop -c "$SHELL"

 Once inside the Nix development shell, follow the standard [build instructions](../../BUILD.md#steps). The Nix shell provides all necessary tools (CMake, Ninja, Conan, etc.).

+Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Linux):
+each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
+The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
+
 ## Automatic Activation with direnv

 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
@@ -136,6 +154,14 @@ conan install .. --output-folder . --build '*' --settings build_type=Release

 To update `flake.lock` to the latest revision use `nix flake update` command.

+## Tooling snapshots
+
+The tool versions in each Nix environment are recorded in
+[`nix/check-tools/`](../../nix/check-tools) and verified by CI. If you change the
+environment (bump the CI image tag, update `flake.lock`, or edit the tool list in
+`bin/check-tools.sh`), CI fails until you regenerate and commit the affected
+snapshot — see [`nix/check-tools/README.md`](../../nix/check-tools/README.md).
+
 ## Troubleshooting

 See [Troubleshooting Nix problems](./nix_troubleshooting.md) for common issues,
--- a/flake.lock
+++ b/flake.lock
@@ -36,7 +36,28 @@
    "root": {
      "inputs": {
        "nixpkgs": "nixpkgs",
-        "nixpkgs-custom-glibc": "nixpkgs-custom-glibc"
+        "nixpkgs-custom-glibc": "nixpkgs-custom-glibc",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784611586,
+        "narHash": "sha256-OfqgY+0hp/zseZB7uyH0U8kIDPS4scZZCyAurEplvG0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "14f58845249f3552a89b07772626b8d3c632fa86",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
      }
    }
  },
--- a/flake.nix
+++ b/flake.nix
@@ -10,12 +10,25 @@
      url = "github:NixOS/nixpkgs/9cd98386a38891d1074fc18036b842dc4416f562";
      flake = false;
    };
+    # Pinned Rust toolchains, delivered from the Nix store. Lets the Nix CI
+    # image and dev shell honour the single `rust-toolchain.toml` pin (shared
+    # with the rustup-based non-Nix runners) while staying hermetic — the
+    # toolchain lands in the image's Nix closure and is locked by flake.lock.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

  outputs =
-    { nixpkgs, nixpkgs-custom-glibc, ... }:
+    {
+      nixpkgs,
+      nixpkgs-custom-glibc,
+      rust-overlay,
+      ...
+    }:
    let
-      forEachSystem = import ./nix/utils.nix { inherit nixpkgs nixpkgs-custom-glibc; };
+      forEachSystem = import ./nix/utils.nix { inherit nixpkgs nixpkgs-custom-glibc rust-overlay; };
    in
    {
      devShells = forEachSystem (import ./nix/devshell.nix);
--- a/include/xrpl/basics/CanProcess.h
+++ b/include/xrpl/basics/CanProcess.h
@@ -1,117 +0,0 @@
-#pragma once
-
-#include <functional>
-#include <mutex>
-#include <set>
-
-/** RAII class to check if an Item is already being processed on another thread,
- * as indicated by it's presence in a Collection.
- *
- * If the Item is not in the Collection, it will be added under lock in the
- * ctor, and removed under lock in the dtor. The object will be considered
- * "usable" and evaluate to `true`.
- *
- * If the Item is in the Collection, no changes will be made to the collection,
- * and the CanProcess object will be considered "unusable".
- *
- * It's up to the caller to decide what "usable" and "unusable" mean. (e.g.
- * Process or skip a block of code, or set a flag.)
- *
- * The current use is to avoid lock contention that would be involved in
- * processing something associated with the Item.
- *
- * Examples:
- *
- * void IncomingLedgers::acquireAsync(LedgerHash const& hash, ...)
- * {
- *    if (CanProcess check{acquiresMutex_, pendingAcquires_, hash})
- *    {
- *      acquire(hash, ...);
- *    }
- * }
- *
- * bool
- * NetworkOPsImp::recvValidation(
- *   std::shared_ptr<STValidation> const& val,
- *   std::string const& source)
- *   {
- *       CanProcess check(
- *           validationsMutex_, pendingValidations_, val->getLedgerHash());
- *       BypassAccept bypassAccept =
- *           check ? BypassAccept::no : BypassAccept::yes;
- *       handleNewValidation(app_, val, source, bypassAccept, m_journal);
- *   }
- *
- */
-class CanProcess
-{
-public:
-    template <class Mutex, class Collection, class Item>
-    CanProcess(Mutex& mtx, Collection& collection, Item const& item)
-        : cleanup_(insert(mtx, collection, item))
-    {
-    }
-
-    ~CanProcess()
-    {
-        if (cleanup_)
-            cleanup_();
-    }
-
-    CanProcess(CanProcess const&) = delete;
-
-    CanProcess&
-    operator=(CanProcess const&) = delete;
-
-    explicit
-    operator bool() const
-    {
-        return static_cast<bool>(cleanup_);
-    }
-
-private:
-    template <bool useIterator, class Mutex, class Collection, class Item>
-    std::function<void()>
-    doInsert(Mutex& mtx, Collection& collection, Item const& item)
-    {
-        std::unique_lock<Mutex> lock(mtx);
-        // TODO: Use structured binding once LLVM 16 is the minimum supported
-        // version. See also: https://github.com/llvm/llvm-project/issues/48582
-        // https://github.com/llvm/llvm-project/commit/127bf44385424891eb04cff8e52d3f157fc2cb7c
-        auto const insertResult = collection.insert(item);
-        auto const it = insertResult.first;
-        if (!insertResult.second)
-            return {};
-        if constexpr (useIterator)
-            return [&, it]() {
-                std::unique_lock<Mutex> lock(mtx);
-                collection.erase(it);
-            };
-        else
-            return [&]() {
-                std::unique_lock<Mutex> lock(mtx);
-                collection.erase(item);
-            };
-    }
-
-    // Generic insert() function doesn't use iterators because they may get
-    // invalidated
-    template <class Mutex, class Collection, class Item>
-    std::function<void()>
-    insert(Mutex& mtx, Collection& collection, Item const& item)
-    {
-        return doInsert<false>(mtx, collection, item);
-    }
-
-    // Specialize insert() for std::set, which does not invalidate iterators for
-    // insert and erase
-    template <class Mutex, class Item>
-    std::function<void()>
-    insert(Mutex& mtx, std::set<Item>& collection, Item const& item)
-    {
-        return doInsert<true>(mtx, collection, item);
-    }
-
-    // If set, then the item is "usable"
-    std::function<void()> cleanup_;
-};
--- a/include/xrpl/basics/TaggedCache.ipp
+++ b/include/xrpl/basics/TaggedCache.ipp
@@ -3,6 +3,9 @@
 #include <xrpl/basics/IntrusivePointer.ipp>
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/scope.h>
+
+#include <algorithm>

 namespace xrpl {

@@ -601,8 +604,42 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    std::vector<key_type> v;

    {
-        std::scoped_lock const lock(mutex_);
-        v.reserve(cache_.size());
+        // Keep track of how many iterations are needed. Exit the loop if the number of retries gets
+        // absurd. (Note that if this somehow ever happens, one more allocation will be done under
+        // lock, which is undesirable, but really should be almost impossible.)
+        std::size_t allocationIterations = 0;
+        std::unique_lock lock(mutex_);
+        for (auto size = cache_.size(); v.capacity() < size && allocationIterations < 20;
+             size = cache_.size())
+        {
+            ScopeUnlock const unlock(lock);
+            if (allocationIterations > 0)
+            {
+                JLOG(journal_.info())
+                    << "getKeys(): Cache grew beyond allocated capacity after "
+                    << allocationIterations << " prior attempt(s). Have " << v.capacity()
+                    << ", need " << size << ". Retrying allocation";
+            }
+            // Allocate the current size plus a little extra, in case the cache grows while
+            // allocating. Each time another allocation is needed, the extra also gets bigger until
+            // it ultimately doubles the size + 1.
+            constexpr std::size_t baseShift = 5;
+            auto const bufferOffset = std::min(allocationIterations, std::size_t{baseShift});
+            auto const bufferShift = baseShift - bufferOffset;
+            size += (size >> bufferShift) + 1;
+            v.reserve(size);
+            ++allocationIterations;
+        }
+        if (v.capacity() < cache_.size())
+        {
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::TaggedCache::getKeys(): failed to allocate sufficient capacity");
+            v.reserve(cache_.size());
+            // LCOV_EXCL_STOP
+        }
+        XRPL_ASSERT(lock.owns_lock(), "xrpl::TaggedCache::getKeys(): owns lock");
+        XRPL_ASSERT(
+            v.capacity() >= cache_.size(), "xrpl::TaggedCache::getKeys(): sufficient capacity");
        for (auto const& _ : cache_)
            v.push_back(_.first);
    }
--- a/include/xrpl/beast/container/detail/aged_unordered_container.h
+++ b/include/xrpl/beast/container/detail/aged_unordered_container.h
@@ -5,6 +5,7 @@
 #include <xrpl/beast/container/detail/aged_associative_container.h>
 #include <xrpl/beast/container/detail/aged_container_iterator.h>
 #include <xrpl/beast/container/detail/empty_base_optimization.h>
+#include <xrpl/beast/utility/instrumentation.h>

 #include <boost/intrusive/list.hpp>
 #include <boost/intrusive/unordered_set.hpp>
--- a/src/xrpld/app/consensus/RCLCensorshipDetector.h
+++ b/src/xrpld/app/consensus/RCLCensorshipDetector.h
@@ -10,7 +10,7 @@
 namespace xrpl {

 template <class TxID, class Sequence>
-class RCLCensorshipDetector
+class CensorshipDetector
 {
 public:
    struct TxIDSeq
@@ -49,7 +49,7 @@ private:
    TxIDSeqVec tracker_;

 public:
-    RCLCensorshipDetector() = default;
+    CensorshipDetector() = default;

    /**
     * Add transactions being proposed for the current consensus round.
--- a/include/xrpl/consensus/Consensus.h
+++ b/include/xrpl/consensus/Consensus.h
@@ -1,15 +1,14 @@
 #pragma once

-#include <xrpld/consensus/ConsensusParms.h>
-#include <xrpld/consensus/ConsensusProposal.h>
-#include <xrpld/consensus/ConsensusTypes.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/consensus/ConsensusParms.h>
+#include <xrpl/consensus/ConsensusProposal.h>
+#include <xrpl/consensus/ConsensusTypes.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>
 #include <xrpl/ledger/LedgerTiming.h>
--- a/include/xrpl/consensus/ConsensusParms.h
+++ b/include/xrpl/consensus/ConsensusParms.h
--- a/include/xrpl/consensus/ConsensusProposal.h
+++ b/include/xrpl/consensus/ConsensusProposal.h
--- a/include/xrpl/consensus/ConsensusTypes.h
+++ b/include/xrpl/consensus/ConsensusTypes.h
@@ -1,11 +1,10 @@
 #pragma once

-#include <xrpld/consensus/ConsensusProposal.h>
-#include <xrpld/consensus/DisputedTx.h>
-
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/consensus/ConsensusProposal.h>
+#include <xrpl/consensus/DisputedTx.h>

 #include <chrono>
 #include <cstddef>
--- a/include/xrpl/consensus/DisputedTx.h
+++ b/include/xrpl/consensus/DisputedTx.h
@@ -1,9 +1,8 @@
 #pragma once

-#include <xrpld/consensus/ConsensusParms.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/consensus/ConsensusParms.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/json/json_writer.h>

--- a/include/xrpl/consensus/LedgerTrie.h
+++ b/include/xrpl/consensus/LedgerTrie.h
--- a/include/xrpl/consensus/README.md
+++ b/include/xrpl/consensus/README.md
--- a/include/xrpl/consensus/Validations.h
+++ b/include/xrpl/consensus/Validations.h
@@ -1,7 +1,5 @@
 #pragma once

-#include <xrpld/consensus/LedgerTrie.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/chrono.h>
@@ -11,6 +9,7 @@
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/consensus/LedgerTrie.h>
 #include <xrpl/json/json_value.h>

 #include <algorithm>
--- a/include/xrpl/core/HashRouter.h
+++ b/include/xrpl/core/HashRouter.h
@@ -218,7 +218,7 @@ public:
    /**
     * Add a suppression peer and get message's relay status.
     * Return pair:
-     * element 1: true if the key is added.
+     * element 1: true if the peer is added.
     * element 2: optional is seated to the relay time point or
     * is unseated if has not relayed yet.
     */
--- a/include/xrpl/ledger/helpers/LendingHelpers.h
+++ b/include/xrpl/ledger/helpers/LendingHelpers.h
@@ -263,10 +263,11 @@ constructLoanState(
    Number const& principalOutstanding,
    Number const& managementFeeOutstanding);

-// Constructs a valid LoanState object from a Loan object, which always has
-// rounded values
+// Overload of constructLoanState() that reads the three tracked fields
+// directly from a Loan ledger object, which always holds rounded values,
+// rather than taking them as separate Number arguments.
 LoanState
-constructRoundedLoanState(SLE::const_ref loan);
+constructLoanState(SLE::const_ref loan);

 Number
 computeManagementFee(
--- a/include/xrpl/nodestore/DatabaseRotating.h
+++ b/include/xrpl/nodestore/DatabaseRotating.h
@@ -41,6 +41,19 @@ public:
        std::unique_ptr<NodeStore::Backend>&& newBackend,
        std::function<void(std::string const& writableName, std::string const& archiveName)> const&
            f) = 0;
+
+    /**
+     * Marks an online-delete rotation as in progress (or completed).
+     *
+     * While in flight, a read served by the archive backend is copied
+     * forward into the writable backend even for ordinary
+     * (duplicate == false) fetches: the archive is about to be deleted,
+     * and a node body canonicalized into caches during the rotation
+     * window would otherwise survive only in RAM once the archive is
+     * dropped.
+     */
+    virtual void
+    setRotationInFlight(bool inFlight) = 0;
 };

 }  // namespace xrpl::NodeStore
--- a/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
+++ b/include/xrpl/nodestore/detail/DatabaseRotatingImp.h
@@ -9,6 +9,7 @@
 #include <xrpl/nodestore/NodeObject.h>
 #include <xrpl/nodestore/Scheduler.h>

+#include <atomic>
 #include <cstdint>
 #include <functional>
 #include <memory>
@@ -69,11 +70,22 @@ public:
    void
    sweep() override;

+    void
+    setRotationInFlight(bool inFlight) override;
+
 private:
    std::shared_ptr<Backend> writableBackend_;
    std::shared_ptr<Backend> archiveBackend_;
    mutable std::mutex mutex_;

+    // True between SHAMapStore starting the cache-freshen phase and the
+    // completion of rotate(). While true, archive hits on ordinary
+    // (duplicate == false) fetches are copied forward into the writable
+    // backend; copyForwardCount_ tallies them per rotation for the
+    // summary line logged at swap.
+    std::atomic<bool> rotationInFlight_{false};
+    std::atomic<std::uint64_t> copyForwardCount_{0};
+
    std::shared_ptr<NodeObject>
    fetchNodeObject(uint256 const& hash, std::uint32_t, FetchReport& fetchReport, bool duplicate)
        override;
--- a/include/xrpl/peerfinder/Config.h
+++ b/include/xrpl/peerfinder/Config.h
@@ -0,0 +1,163 @@
+#pragma once
+
+#include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/peerfinder/detail/Tuning.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+
+namespace xrpl::PeerFinder {
+
+struct PeerLimitConfig
+{
+    std::optional<std::size_t> maxPeers;
+    std::optional<std::size_t> inPeers;
+    std::optional<std::size_t> outPeers;
+};
+
+/**
+ * PeerFinder configuration settings.
+ */
+struct Config
+{
+    /**
+     * The largest number of public peer slots to allow.
+     * This includes both inbound and outbound, but does not include
+     * fixed peers.
+     */
+    std::size_t maxPeers{Tuning::kDefaultMaxPeers};
+
+    /**
+     * The number of automatic outbound connections to maintain.
+     * Outbound connections are only maintained if autoConnect
+     * is `true`.
+     */
+    std::size_t outPeers = calcOutPeers();  // Note: relies on `maxPeers` being initialized
+
+    /**
+     * The number of automatic inbound connections to maintain.
+     * Inbound connections are only maintained if wantIncoming
+     * is `true`.
+     */
+    std::size_t inPeers{0};
+
+    /**
+     * `true` if we want our IP address kept private.
+     */
+    bool peerPrivate = true;
+
+    /**
+     * `true` if we want to accept incoming connections.
+     */
+    bool wantIncoming{true};
+
+    /**
+     * `true` if we want to establish connections automatically
+     */
+    bool autoConnect{true};
+
+    /**
+     * The listening port number.
+     */
+    std::uint16_t listeningPort{0};
+
+    /**
+     * The set of features we advertise.
+     */
+    std::string features;
+
+    /**
+     * Limit how many incoming connections we allow per IP
+     */
+    int ipLimit{0};
+
+    /**
+     * `true` if we want to verify endpoints in TMEndpoints messages
+     */
+    bool verifyEndpoints = true;
+
+    //--------------------------------------------------------------------------
+
+    /**
+     * Returns a suitable value for outPeers according to the rules.
+     */
+    [[nodiscard]] std::size_t
+    calcOutPeers() const;
+
+    /**
+     * Adjusts the values so they follow the business rules.
+     */
+    void
+    applyTuning();
+
+    /**
+     * Write the configuration into a property stream
+     */
+    void
+    onWrite(beast::PropertyStream::Map& map) const;
+
+    /**
+     * Make PeerFinder::Config from peer limit and server mode parameters.
+     */
+    static Config
+    makeConfig(
+        bool peerPrivate,
+        bool standalone,
+        PeerLimitConfig const& limits,
+        std::uint16_t port,
+        bool validationPublicKey,
+        int ipLimit,
+        bool verifyEndpoints);
+
+    /**
+     * Compares two configurations for equality field by field.
+     */
+    friend bool
+    operator==(Config const& lhs, Config const& rhs) = default;
+};
+
+//------------------------------------------------------------------------------
+
+/**
+ * Possible results from activating a slot.
+ */
+enum class Result { InboundDisabled, DuplicatePeer, IpLimitExceeded, Full, Success };
+
+/**
+ * @brief Converts a `Result` enum value to its string representation.
+ *
+ * This function provides a human-readable string for a given `Result` enum,
+ * which is useful for logging, debugging, or displaying status messages.
+ *
+ * @param result The `Result` enum value to convert.
+ * @return A `std::string_view` representing the enum value. Returns "unknown"
+ * if the enum value is not explicitly handled.
+ *
+ * @note This function returns a `std::string_view` for performance.
+ * A `std::string` would need to allocate memory on the heap and copy the
+ * string literal into it every time the function is called.
+ */
+inline std::string_view
+to_string(Result result) noexcept
+{
+    switch (result)
+    {
+        case Result::InboundDisabled:
+            return "inbound disabled";
+        case Result::DuplicatePeer:
+            return "peer already connected";
+        case Result::IpLimitExceeded:
+            return "ip limit exceeded";
+        case Result::Full:
+            return "slots full";
+        case Result::Success:
+            return "success";
+    }
+
+    return "unknown";
+}
+
+}  // namespace xrpl::PeerFinder
--- a/include/xrpl/peerfinder/PeerfinderManager.h
+++ b/include/xrpl/peerfinder/PeerfinderManager.h
@@ -0,0 +1,179 @@
+#pragma once
+
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/peerfinder/Config.h>
+#include <xrpl/peerfinder/Slot.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/protocol/PublicKey.h>
+
+#include <boost/asio/ip/tcp.hpp>
+
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+namespace xrpl::PeerFinder {
+
+/**
+ * Maintains a set of IP addresses used for getting into the network.
+ */
+class Manager : public beast::PropertyStream::Source
+{
+protected:
+    Manager() noexcept;
+
+public:
+    /**
+     * Destroy the object.
+     * Any pending source fetch operations are aborted.
+     * There may be some listener calls made before the
+     * destructor returns.
+     */
+    ~Manager() override = default;
+
+    /**
+     * Set the configuration for the manager.
+     * The new settings will be applied asynchronously.
+     * Thread safety:
+     *     Can be called from any threads at any time.
+     */
+    virtual void
+    setConfig(Config const& config) = 0;
+
+    /**
+     * Transition to the started state, synchronously.
+     */
+    virtual void
+    start() = 0;
+
+    /**
+     * Transition to the stopped state, synchronously.
+     */
+    virtual void
+    stop() = 0;
+
+    /**
+     * Returns the configuration for the manager.
+     */
+    virtual Config
+    config() = 0;
+
+    /**
+     * Add a peer that should always be connected.
+     * This is useful for maintaining a private cluster of peers.
+     * The string is the name as specified in the configuration
+     * file, along with the set of corresponding IP addresses.
+     */
+    virtual void
+    addFixedPeer(std::string_view name, std::vector<beast::IP::Endpoint> const& addresses) = 0;
+
+    /**
+     * Add a set of strings as fallback IP::Endpoint sources.
+     * @param name A label used for diagnostics.
+     */
+    virtual void
+    addFallbackStrings(std::string const& name, std::vector<std::string> const& strings) = 0;
+
+    /**
+     * Add a URL as a fallback location to obtain IP::Endpoint sources.
+     * @param name A label used for diagnostics.
+     */
+    /* VFALCO NOTE Unimplemented
+    virtual void addFallbackURL (std::string const& name,
+        std::string const& url) = 0;
+    */
+
+    //--------------------------------------------------------------------------
+
+    /**
+     * Create a new inbound slot with the specified remote endpoint.
+     * If nullptr is returned, then the slot could not be assigned.
+     * Usually this is because of a detected self-connection.
+     */
+    virtual std::pair<std::shared_ptr<Slot>, Result>
+    newInboundSlot(
+        beast::IP::Endpoint const& localEndpoint,
+        beast::IP::Endpoint const& remoteEndpoint) = 0;
+
+    /**
+     * Create a new outbound slot with the specified remote endpoint.
+     * If nullptr is returned, then the slot could not be assigned.
+     * Usually this is because of a duplicate connection.
+     */
+    virtual std::pair<std::shared_ptr<Slot>, Result>
+    newOutboundSlot(beast::IP::Endpoint const& remoteEndpoint) = 0;
+
+    /**
+     * Called when mtENDPOINTS is received.
+     */
+    virtual void
+    onEndpoints(std::shared_ptr<Slot> const& slot, Endpoints const& endpoints) = 0;
+
+    /**
+     * Called when the slot is closed.
+     * This always happens when the socket is closed, unless the socket
+     * was canceled.
+     */
+    virtual void
+    onClosed(std::shared_ptr<Slot> const& slot) = 0;
+
+    /**
+     * Called when an outbound connection is deemed to have failed
+     */
+    virtual void
+    onFailure(std::shared_ptr<Slot> const& slot) = 0;
+
+    /**
+     * Called when we received redirect IPs from a busy peer.
+     */
+    virtual void
+    onRedirects(
+        boost::asio::ip::tcp::endpoint const& remoteAddress,
+        std::vector<boost::asio::ip::tcp::endpoint> const& eps) = 0;
+
+    //--------------------------------------------------------------------------
+
+    /**
+     * Called when an outbound connection attempt succeeds.
+     * The local endpoint must be valid. If the caller receives an error
+     * when retrieving the local endpoint from the socket, it should
+     * proceed as if the connection attempt failed by calling on_closed
+     * instead of on_connected.
+     * @return `true` if the connection should be kept
+     */
+    virtual bool
+    onConnected(std::shared_ptr<Slot> const& slot, beast::IP::Endpoint const& localEndpoint) = 0;
+
+    /**
+     * Request an active slot type.
+     */
+    virtual Result
+    activate(std::shared_ptr<Slot> const& slot, PublicKey const& key, bool reserved) = 0;
+
+    /**
+     * Returns a set of endpoints suitable for redirection.
+     */
+    virtual std::vector<Endpoint>
+    redirect(std::shared_ptr<Slot> const& slot) = 0;
+
+    /**
+     * Return a set of addresses we should connect to.
+     */
+    virtual std::vector<beast::IP::Endpoint>
+    autoconnect() = 0;
+
+    virtual std::vector<std::pair<std::shared_ptr<Slot>, std::vector<Endpoint>>>
+    buildEndpointsForPeers() = 0;
+
+    /**
+     * Perform periodic activity.
+     * This should be called once per second.
+     */
+    virtual void
+    oncePerSecond() = 0;
+};
+
+}  // namespace xrpl::PeerFinder
--- a/include/xrpl/peerfinder/Slot.h
+++ b/include/xrpl/peerfinder/Slot.h
--- a/include/xrpl/peerfinder/Types.h
+++ b/include/xrpl/peerfinder/Types.h
@@ -0,0 +1,46 @@
+#pragma once
+
+#include <xrpl/beast/clock/abstract_clock.h>
+#include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/peerfinder/detail/Tuning.h>
+
+#include <chrono>
+#include <cstdint>
+#include <vector>
+
+namespace xrpl::PeerFinder {
+
+using clock_type = beast::AbstractClock<std::chrono::steady_clock>;
+
+/**
+ * Represents a set of addresses.
+ */
+using IPAddresses = std::vector<beast::IP::Endpoint>;
+
+//------------------------------------------------------------------------------
+
+/**
+ * Describes a connectable peer address along with some metadata.
+ */
+struct Endpoint
+{
+    Endpoint() = default;
+
+    Endpoint(beast::IP::Endpoint ep, std::uint32_t hops);
+
+    std::uint32_t hops = 0;
+    beast::IP::Endpoint address;
+};
+
+inline bool
+operator<(Endpoint const& lhs, Endpoint const& rhs)
+{
+    return lhs.address < rhs.address;
+}
+
+/**
+ * A set of Endpoint used for connecting.
+ */
+using Endpoints = std::vector<Endpoint>;
+
+}  // namespace xrpl::PeerFinder
--- a/include/xrpl/peerfinder/detail/Bootcache.h
+++ b/include/xrpl/peerfinder/detail/Bootcache.h
@@ -1,11 +1,11 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/detail/Store.h>
-
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/peerfinder/detail/Store.h>
+#include <xrpl/peerfinder/detail/Tuning.h>

 #include <boost/bimap.hpp>
 #include <boost/bimap/multiset_of.hpp>
--- a/include/xrpl/peerfinder/detail/Checker.h
+++ b/include/xrpl/peerfinder/detail/Checker.h
--- a/include/xrpl/peerfinder/detail/Counts.h
+++ b/include/xrpl/peerfinder/detail/Counts.h
@@ -1,11 +1,10 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/Slot.h>
-#include <xrpld/peerfinder/detail/Tuning.h>
-
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/peerfinder/Config.h>
+#include <xrpl/peerfinder/Slot.h>
+#include <xrpl/peerfinder/detail/Tuning.h>

 #include <cstddef>
 #include <sstream>
--- a/include/xrpl/peerfinder/detail/Fixed.h
+++ b/include/xrpl/peerfinder/detail/Fixed.h
@@ -1,7 +1,7 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/detail/Tuning.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/peerfinder/detail/Tuning.h>

 #include <algorithm>
 #include <chrono>
--- a/include/xrpl/peerfinder/detail/Handouts.h
+++ b/include/xrpl/peerfinder/detail/Handouts.h
@@ -1,12 +1,11 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/detail/SlotImp.h>
-#include <xrpld/peerfinder/detail/Tuning.h>
-
 #include <xrpl/beast/container/aged_set.h>
 #include <xrpl/beast/net/IPAddress.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/peerfinder/detail/SlotImp.h>
+#include <xrpl/peerfinder/detail/Tuning.h>

 #include <algorithm>
 #include <cstddef>
--- a/include/xrpl/peerfinder/detail/Livecache.h
+++ b/include/xrpl/peerfinder/detail/Livecache.h
@@ -1,9 +1,5 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/detail/Tuning.h>
-#include <xrpld/peerfinder/detail/iosformat.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/beast/container/aged_map.h>
@@ -12,6 +8,8 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/utility/maybe_const.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/peerfinder/detail/Tuning.h>

 #include <boost/intrusive/list.hpp>
 #include <boost/iterator/transform_iterator.hpp>
@@ -22,6 +20,8 @@
 #include <cstddef>
 #include <cstdint>
 #include <functional>
+#include <iomanip>
+#include <ios>
 #include <iterator>
 #include <memory>
 #include <sstream>
@@ -411,7 +411,7 @@ Livecache<Allocator>::expire()
    }
    if (n > 0)
    {
-        JLOG(journal_.debug()) << beast::Leftw(18) << "Livecache expired " << n
+        JLOG(journal_.debug()) << std::left << std::setw(18) << "Livecache expired " << n
                               << ((n > 1) ? " entries" : " entry");
    }
 }
@@ -434,7 +434,7 @@ Livecache<Allocator>::insert(Endpoint const& ep)
    if (result.second)
    {
        hops.insert(e);
-        JLOG(journal_.debug()) << beast::Leftw(18) << "Livecache insert " << ep.address
+        JLOG(journal_.debug()) << std::left << std::setw(18) << "Livecache insert " << ep.address
                               << " at hops " << ep.hops;
        return;
    }
@@ -442,7 +442,7 @@ Livecache<Allocator>::insert(Endpoint const& ep)
    {
        // Drop duplicates at higher hops
        std::size_t const excess(ep.hops - e.endpoint.hops);
-        JLOG(journal_.trace()) << beast::Leftw(18) << "Livecache drop " << ep.address
+        JLOG(journal_.trace()) << std::left << std::setw(18) << "Livecache drop " << ep.address
                               << " at hops +" << excess;
        return;
    }
@@ -453,12 +453,12 @@ Livecache<Allocator>::insert(Endpoint const& ep)
    if (ep.hops < e.endpoint.hops)
    {
        hops.reinsert(e, ep.hops);
-        JLOG(journal_.debug()) << beast::Leftw(18) << "Livecache update " << ep.address
+        JLOG(journal_.debug()) << std::left << std::setw(18) << "Livecache update " << ep.address
                               << " at hops " << ep.hops;
    }
    else
    {
-        JLOG(journal_.trace()) << beast::Leftw(18) << "Livecache refresh " << ep.address
+        JLOG(journal_.trace()) << std::left << std::setw(18) << "Livecache refresh " << ep.address
                               << " at hops " << ep.hops;
    }
 }
--- a/include/xrpl/peerfinder/detail/Logic.h
+++ b/include/xrpl/peerfinder/detail/Logic.h
@@ -1,17 +1,5 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/Slot.h>
-#include <xrpld/peerfinder/detail/Bootcache.h>
-#include <xrpld/peerfinder/detail/Counts.h>
-#include <xrpld/peerfinder/detail/Fixed.h>
-#include <xrpld/peerfinder/detail/Handouts.h>
-#include <xrpld/peerfinder/detail/Livecache.h>
-#include <xrpld/peerfinder/detail/SlotImp.h>
-#include <xrpld/peerfinder/detail/Source.h>
-#include <xrpld/peerfinder/detail/Store.h>
-#include <xrpld/peerfinder/detail/iosformat.h>
-
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/random.h>
@@ -22,18 +10,34 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/beast/utility/WrappedSink.h>
 #include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/peerfinder/Config.h>
+#include <xrpl/peerfinder/Slot.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/peerfinder/detail/Bootcache.h>
+#include <xrpl/peerfinder/detail/Counts.h>
+#include <xrpl/peerfinder/detail/Fixed.h>
+#include <xrpl/peerfinder/detail/Handouts.h>
+#include <xrpl/peerfinder/detail/Livecache.h>
+#include <xrpl/peerfinder/detail/SlotImp.h>
+#include <xrpl/peerfinder/detail/Source.h>
+#include <xrpl/peerfinder/detail/Store.h>
 #include <xrpl/protocol/PublicKey.h>

+#include <boost/asio/error.hpp>
+
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
 #include <functional>
+#include <iomanip>
+#include <ios>
 #include <map>
 #include <memory>
 #include <mutex>
 #include <optional>
 #include <set>
 #include <stdexcept>
+#include <string>
 #include <string_view>
 #include <tuple>
 #include <utility>
@@ -197,8 +201,8 @@ public:

            if (result.second)
            {
-                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Logic add fixed '" << name << "' at " << remoteAddress;
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Logic add fixed '" << name
+                                      << "' at " << remoteAddress;
                return;
            }
        }
@@ -221,7 +225,7 @@ public:
        if (iter == slots.end())
        {
            // The slot disconnected before we finished the check
-            JLOG(journal.debug()) << beast::Leftw(18) << "Logic tested " << checkedAddress
+            JLOG(journal.debug()) << std::left << std::setw(18) << "Logic tested " << checkedAddress
                                  << " but the connection was closed";
            return;
        }
@@ -255,7 +259,7 @@ public:
        beast::IP::Endpoint const& localEndpoint,
        beast::IP::Endpoint const& remoteEndpoint)
    {
-        JLOG(journal.debug()) << beast::Leftw(18) << "Logic accept" << remoteEndpoint
+        JLOG(journal.debug()) << std::left << std::setw(18) << "Logic accept" << remoteEndpoint
                              << " on local " << localEndpoint;

        std::scoped_lock const _(lock);
@@ -266,7 +270,7 @@ public:
            auto const count = connectedAddresses.count(remoteEndpoint.address());
            if (count + 1 > config_.ipLimit)
            {
-                JLOG(journal.debug()) << beast::Leftw(18) << "Logic dropping inbound "
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Logic dropping inbound "
                                      << remoteEndpoint << " because of ip limits.";
                return {SlotImp::ptr(), Result::IpLimitExceeded};
            }
@@ -275,8 +279,8 @@ public:
        // Check for duplicate connection
        if (slots.contains(remoteEndpoint))
        {
-            JLOG(journal.debug()) << beast::Leftw(18) << "Logic dropping " << remoteEndpoint
-                                  << " as duplicate incoming";
+            JLOG(journal.debug()) << std::left << std::setw(18) << "Logic dropping "
+                                  << remoteEndpoint << " as duplicate incoming";
            return {SlotImp::ptr(), Result::DuplicatePeer};
        }

@@ -304,15 +308,15 @@ public:
    std::pair<SlotImp::ptr, Result>
    newOutboundSlot(beast::IP::Endpoint const& remoteEndpoint)
    {
-        JLOG(journal.debug()) << beast::Leftw(18) << "Logic connect " << remoteEndpoint;
+        JLOG(journal.debug()) << std::left << std::setw(18) << "Logic connect " << remoteEndpoint;

        std::scoped_lock const _(lock);

        // Check for duplicate connection
        if (slots.contains(remoteEndpoint))
        {
-            JLOG(journal.debug()) << beast::Leftw(18) << "Logic dropping " << remoteEndpoint
-                                  << " as duplicate connect";
+            JLOG(journal.debug()) << std::left << std::setw(18) << "Logic dropping "
+                                  << remoteEndpoint << " as duplicate connect";
            return {SlotImp::ptr(), Result::DuplicatePeer};
        }

@@ -506,15 +510,15 @@ public:

            if (!h.list().empty())
            {
-                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Logic connect " << h.list().size() << " fixed";
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Logic connect "
+                                      << h.list().size() << " fixed";
                return h.list();
            }

            if (counts_.attempts() > 0)
            {
-                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Logic waiting on " << counts_.attempts() << " attempts";
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Logic waiting on "
+                                      << counts_.attempts() << " attempts";
                return none;
            }
        }
@@ -535,14 +539,14 @@ public:
            if (!h.list().empty())
            {
                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Logic connect " << h.list().size() << " live "
+                    << std::left << std::setw(18) << "Logic connect " << h.list().size() << " live "
                    << ((h.list().size() > 1) ? "endpoints" : "endpoint");
                return h.list();
            }
            if (counts_.attempts() > 0)
            {
-                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Logic waiting on " << counts_.attempts() << " attempts";
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Logic waiting on "
+                                      << counts_.attempts() << " attempts";
                return none;
            }
        }
@@ -568,8 +572,9 @@ public:

        if (!h.list().empty())
        {
-            JLOG(journal.debug()) << beast::Leftw(18) << "Logic connect " << h.list().size()
-                                  << " boot " << ((h.list().size() > 1) ? "addresses" : "address");
+            JLOG(journal.debug()) << std::left << std::setw(18) << "Logic connect "
+                                  << h.list().size() << " boot "
+                                  << ((h.list().size() > 1) ? "addresses" : "address");
            return h.list();
        }

@@ -689,8 +694,8 @@ public:
            // Enforce hop limit
            if (ep.hops > Tuning::kMaxHops)
            {
-                JLOG(journal.debug()) << beast::Leftw(18) << "Endpoints drop " << ep.address
-                                      << " for excess hops " << ep.hops;
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Endpoints drop "
+                                      << ep.address << " for excess hops " << ep.hops;
                iter = list.erase(iter);
                continue;
            }
@@ -706,18 +711,18 @@ public:
                }
                else
                {
-                    JLOG(journal.debug())
-                        << beast::Leftw(18) << "Endpoints drop " << ep.address << " for extra self";
+                    JLOG(journal.debug()) << std::left << std::setw(18) << "Endpoints drop "
+                                          << ep.address << " for extra self";
                    iter = list.erase(iter);
                    continue;
                }
            }

            // Discard invalid addresses
-            if (config_.verifyEndpoints && !isValidAddress(ep.address))
+            if (!isValidAddress(ep.address))
            {
-                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Endpoints drop " << ep.address << " as invalid";
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Endpoints drop "
+                                      << ep.address << " as invalid";
                iter = list.erase(iter);
                continue;
            }
@@ -727,8 +732,8 @@ public:
                    return ep.address == other.address;
                }))
            {
-                JLOG(journal.debug())
-                    << beast::Leftw(18) << "Endpoints drop " << ep.address << " as duplicate";
+                JLOG(journal.debug()) << std::left << std::setw(18) << "Endpoints drop "
+                                      << ep.address << " as duplicate";
                iter = list.erase(iter);
                continue;
            }
@@ -1074,13 +1079,13 @@ public:
        if (!results.error)
        {
            int const count(addBootcacheAddresses(results.addresses));
-            JLOG(journal.info()) << beast::Leftw(18) << "Logic added " << count << " new "
+            JLOG(journal.info()) << std::left << std::setw(18) << "Logic added " << count << " new "
                                 << ((count == 1) ? "address" : "addresses") << " from "
                                 << source->name();
        }
        else
        {
-            JLOG(journal.error()) << beast::Leftw(18) << "Logic failed "
+            JLOG(journal.error()) << std::left << std::setw(18) << "Logic failed "
                                  << "'" << source->name() << "' fetch, "
                                  << results.error.message();
        }
@@ -1098,8 +1103,6 @@ public:
    {
        if (isUnspecified(address))
            return false;
-        if (isLoopback(address))
-            return false;
        if (!isPublic(address))
            return false;
        if (address.port() == 0)
@@ -1221,8 +1224,8 @@ Logic<Checker>::onRedirects(
        bootcache.insert(beast::IPAddressConversion::fromAsio(*first));
    if (n > 0)
    {
-        JLOG(journal.trace()) << beast::Leftw(18) << "Logic add " << n << " redirect IPs from "
-                              << remoteAddress;
+        JLOG(journal.trace()) << std::left << std::setw(18) << "Logic add " << n
+                              << " redirect IPs from " << remoteAddress;
    }
 }

--- a/include/xrpl/peerfinder/detail/SlotImp.h
+++ b/include/xrpl/peerfinder/detail/SlotImp.h
@@ -1,10 +1,9 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-#include <xrpld/peerfinder/Slot.h>
-
 #include <xrpl/beast/container/aged_unordered_map.h>
 #include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/peerfinder/Slot.h>
+#include <xrpl/peerfinder/Types.h>
 #include <xrpl/protocol/PublicKey.h>

 #include <atomic>
@@ -172,7 +171,7 @@ private:
    std::optional<beast::IP::Endpoint> localEndpoint_;
    std::optional<PublicKey> publicKey_;

-    static constexpr std::int32_t kUnknownPort = -1;
+    static std::int32_t constexpr kUnknownPort = -1;
    std::atomic<std::int32_t> listeningPort_;

 public:
--- a/include/xrpl/peerfinder/detail/Source.h
+++ b/include/xrpl/peerfinder/detail/Source.h
@@ -1,8 +1,7 @@
 #pragma once

-#include <xrpld/peerfinder/PeerfinderManager.h>
-
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/peerfinder/Types.h>

 #include <boost/system/error_code.hpp>

--- a/include/xrpl/peerfinder/detail/SourceStrings.h
+++ b/include/xrpl/peerfinder/detail/SourceStrings.h
@@ -1,6 +1,6 @@
 #pragma once

-#include <xrpld/peerfinder/detail/Source.h>
+#include <xrpl/peerfinder/detail/Source.h>

 #include <memory>
 #include <string>
--- a/include/xrpl/peerfinder/detail/Store.h
+++ b/include/xrpl/peerfinder/detail/Store.h
--- a/include/xrpl/peerfinder/detail/Tuning.h
+++ b/include/xrpl/peerfinder/detail/Tuning.h
--- a/include/xrpl/peerfinder/make_Manager.h
+++ b/include/xrpl/peerfinder/make_Manager.h
@@ -0,0 +1,36 @@
+#pragma once
+
+#include <xrpl/beast/insight/Collector.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/peerfinder/PeerfinderManager.h>
+#include <xrpl/peerfinder/Types.h>
+#include <xrpl/peerfinder/detail/Store.h>
+
+#include <boost/asio/io_context.hpp>
+
+#include <memory>
+
+namespace xrpl::PeerFinder {
+
+/**
+ * @brief Create a new Manager.
+ *
+ * @param ioContext The io_context used to schedule asynchronous work.
+ * @param clock The clock used for timekeeping.
+ * @param journal The journal used for logging.
+ * @param store The persistence backend for the bootstrap cache. The caller
+ *     retains ownership and must keep it alive (and opened) for the lifetime of
+ *     the returned Manager. This lets consumers supply their own Store
+ *     implementation (e.g. the SQLite-backed StoreSqdb in xrpld).
+ * @param collector The collector used to report metrics.
+ * @return The newly created Manager.
+ */
+std::unique_ptr<Manager>
+makeManager(
+    boost::asio::io_context& ioContext,
+    clock_type& clock,
+    beast::Journal journal,
+    Store& store,
+    beast::insight::Collector::ptr const& collector);
+
+}  // namespace xrpl::PeerFinder
--- a/include/xrpl/protocol/LedgerHeader.h
+++ b/include/xrpl/protocol/LedgerHeader.h
@@ -40,8 +40,6 @@ struct LedgerHeader

    // If validated is false, it means "not yet validated."
    // Once validated is true, it will never be set false at a later time.
-    // NOTE: If you are accessing this directly, you are probably doing it
-    //   wrong. Use LedgerMaster::isValidated().
    // VFALCO TODO Make this not mutable
    bool mutable validated = false;
    bool accepted = false;
--- a/include/xrpl/protocol/STObject.h
+++ b/include/xrpl/protocol/STObject.h
@@ -229,13 +229,6 @@ public:
    [[nodiscard]] AccountID
    getAccountID(SField const& field) const;

-    /**
-     * The account responsible for the authorization: the delegate when
-     * sfDelegate is present, otherwise the account.
-     */
-    [[nodiscard]] AccountID
-    getInitiator() const;
-
    [[nodiscard]] Blob
    getFieldVL(SField const& field) const;
    [[nodiscard]] STAmount const&
--- a/include/xrpl/protocol/STTx.h
+++ b/include/xrpl/protocol/STTx.h
@@ -142,9 +142,26 @@ public:
        TxnSql status,
        std::string const& escapedMetaData) const;

-    [[nodiscard]] std::vector<uint256> const&
+    /**
+     * The IDs of the inner transactions of a Batch.
+     */
+    [[nodiscard]] std::vector<uint256>
    getBatchTransactionIDs() const;

+    /**
+     * The inner transactions of a Batch, built and validated at construction.
+     * Always seated for Batch STTx instances (construction throws if oversized).
+     */
+    [[nodiscard]] std::vector<std::shared_ptr<STTx const>> const&
+    getBatchTransactions() const;
+
+    /**
+     * The account responsible for the authorization: the delegate when
+     * sfDelegate is present, otherwise the account.
+     */
+    [[nodiscard]] AccountID
+    getInitiator() const;
+
    [[nodiscard]] AccountID
    getFeePayerID() const;

@@ -166,13 +183,16 @@ private:
    checkMultiSign(Rules const& rules, STObject const& sigObject) const;

    [[nodiscard]] std::expected<void, std::string>
-    checkBatchSingleSign(STObject const& batchSigner) const;
+    checkBatchSingleSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;

    [[nodiscard]] std::expected<void, std::string>
-    checkBatchMultiSign(STObject const& batchSigner, Rules const& rules) const;
+    checkBatchMultiSign(
+        STObject const& batchSigner,
+        Rules const& rules,
+        std::vector<uint256> const& txIds) const;

    void
-    buildBatchTxnIds();
+    buildBatchTxns();

    STBase*
    copy(std::size_t n, void* buf) const override;
@@ -180,11 +200,11 @@ private:
    move(std::size_t n, void* buf) override;

    friend class detail::STVar;
-    std::optional<std::vector<uint256>> batchTxnIds_;
+    std::optional<std::vector<std::shared_ptr<STTx const>>> batchTxns_;
 };

 bool
-passesLocalChecks(STObject const& st, std::string&);
+passesLocalChecks(STTx const& tx, std::string&);

 /**
 * Sterilize a transaction.
--- a/include/xrpl/protocol/detail/features.macro
+++ b/include/xrpl/protocol/detail/features.macro
@@ -15,6 +15,7 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.

+XRPL_FIX    (Cleanup3_4_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)
--- a/include/xrpl/server/NetworkOPs.h
+++ b/include/xrpl/server/NetworkOPs.h
@@ -196,7 +196,7 @@ public:
    virtual bool
    isFull() = 0;
    virtual void
-    setMode(OperatingMode om, char const* reason) = 0;
+    setMode(OperatingMode om) = 0;
    virtual bool
    isBlocked() = 0;
    virtual bool
--- a/include/xrpl/tx/invariants/PermissionedDEXInvariant.h
+++ b/include/xrpl/tx/invariants/PermissionedDEXInvariant.h
@@ -17,7 +17,8 @@ class ValidPermissionedDEX
    bool regularOffers_ = false;     // post-fixCleanup3_2_0: excludes deleted offers
    bool badHybridsOld_ = false;     // pre-fixCleanup3_1_3: missing field/domain or size > 1
    bool badHybrids_ = false;        // post-fixCleanup3_1_3: also catches size == 0 (size != 1)
-    hash_set<uint256> domains_;
+    hash_set<uint256> domainsOld_;   // pre-fixCleanup3_4_0: also flags deleted domains
+    hash_set<uint256> domains_;      // post-fixCleanup3_4_0: excludes deleted domains

 public:
    void
--- a/include/xrpl/tx/transactors/system/Batch.h
+++ b/include/xrpl/tx/transactors/system/Batch.h
@@ -12,6 +12,7 @@

 #include <array>
 #include <cstdint>
+#include <optional>

 namespace xrpl {

@@ -39,6 +40,9 @@ public:
    static NotTEC
    checkSign(PreclaimContext const& ctx);

+    static TER
+    preclaim(PreclaimContext const& ctx);
+
    TER
    doApply() override;

@@ -76,6 +80,10 @@ private:
    // only be reached through Batch::checkSign.
    static NotTEC
    checkBatchSign(PreclaimContext const& ctx);
+
+    // nullopt on overflow or oversized signer arrays.
+    static std::optional<XRPAmount>
+    calculateBaseFeeImpl(ReadView const& view, STTx const& tx);
 };

 }  // namespace xrpl
--- a/nix/check-tools/README.md
+++ b/nix/check-tools/README.md
@@ -0,0 +1,49 @@
+# check-tools snapshots
+
+These files capture the output of [`bin/check-tools.sh`](../../bin/check-tools.sh)
+— the versions of the development tooling — in each Nix environment:
+
+| File                  | Environment                         |
+| --------------------- | ----------------------------------- |
+| `nix-nixos-amd64.txt` | `nix-nixos` CI image, `linux/amd64` |
+| `nix-nixos-arm64.txt` | `nix-nixos` CI image, `linux/arm64` |
+| `macos.txt`           | macOS, inside `nix develop`         |
+
+The [`check-tools`](../../.github/workflows/check-tools.yml) workflow regenerates
+each snapshot in its environment and fails if it differs from the committed file.
+So if you change the environment (bump the image tag in
+[`linux.json`](../../.github/scripts/strategy-matrix/linux.json), update
+`flake.lock`, change the tool list in `check-tools.sh`, …) you must regenerate
+and commit the affected snapshots.
+
+Each snapshot is `check-tools.sh` stdout with the git-clone connectivity check
+skipped (`CHECK_TOOLS_SKIP_CLONE=1`), so it contains only deterministic version
+data. On macOS the dev-shell greeting that `nix develop` prints first is dropped
+with `sed -n '/^Detected OS:/,$p'`.
+
+## Regenerating
+
+The two Linux snapshots come from the `nix-nixos` image (Docker or a compatible
+runtime such as Apple `container`). The image tag is pinned in `linux.json`:
+
+```bash
+img="ghcr.io/xrplf/xrpld/nix-nixos:$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)"
+
+for arch in amd64 arm64; do
+    container run --rm -i -e CHECK_TOOLS_SKIP_CLONE=1 -a "${arch}" --entrypoint bash "${img}" -s \
+        <bin/check-tools.sh >"nix/check-tools/nix-nixos-${arch}.txt"
+done
+```
+
+(With Docker, replace `container run … -a "${arch}"` with
+`docker run … --platform "linux/${arch}"`.)
+
+The macOS snapshot is generated locally. `CI=` is unset so `check-tools.sh`
+checks the full dev-shell tool set (it otherwise skips some tools when `CI` is
+set):
+
+```bash
+CI= nix develop -c bash -c 'CHECK_TOOLS_SKIP_CLONE=1 bash bin/check-tools.sh' |
+    sed -n '/^Detected OS:/,$p' \
+        >nix/check-tools/macos.txt
+```
--- a/nix/check-tools/macos.txt
+++ b/nix/check-tools/macos.txt
@@ -0,0 +1,47 @@
+Detected OS: macos (Darwin arm64)
+
+Core build tools:
+  [ ok ] cmake                cmake version 4.1.2
+  [ ok ] conan                Conan version 2.28.1
+  [ ok ] git                  git version 2.54.0
+  [ ok ] python3              Python 3.13.13
+
+Development tooling:
+  [ ok ] ccache               ccache version 4.13.6
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
+  [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
+  [ ok ] curl                 curl 8.20.0 (aarch64-apple-darwin25.3.0) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+  [ ok ] file                 file-5.47
+  [ ok ] less                 less 692 (PCRE2 regular expressions)
+  [ ok ] make                 GNU Make 4.4.1
+  [ ok ] netstat              present
+  [ ok ] ninja                1.13.2
+  [ ok ] perl                 v5.42.0
+  [ ok ] pkg-config           0.29.2
+  [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
+  [ ok ] zip                  Zip 3.0
+  [ ok ] clang-format         clang-format version 22.1.7
+  [ ok ] dot                  dot - graphviz version 12.2.1 (0)
+  [ ok ] doxygen              1.16.1
+  [ ok ] gcovr                gcovr 8.4
+  [ ok ] gh                   gh version 2.94.0 (nixpkgs)
+  [ ok ] git-cliff            git-cliff 2.13.1
+  [ ok ] git-lfs              git-lfs/3.7.1 (3.7.1; darwin arm64; go 1.26.3)
+  [ ok ] gpg                  gpg (GnuPG) 2.4.9
+  [ ok ] pre-commit           pre-commit 4.5.1
+  [ ok ] run-clang-tidy       usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
+
+Rust toolchain:
+  [ ok ] cargo                cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+  [ ok ] cargo-audit          cargo-audit-audit 0.22.1
+  [ ok ] cargo-llvm-cov       cargo-llvm-cov 0.8.5
+  [ ok ] cargo-nextest        cargo-nextest 0.9.137
+  [ ok ] clippy               clippy 0.1.95 (59807616e1 2026-04-14)
+  [ ok ] rust-analyzer        rust-analyzer 1.95.0 (59807616 2026-04-14)
+  [ ok ] rustc                rustc 1.95.0 (59807616e 2026-04-14)
+  [ ok ] rustfmt              rustfmt 1.9.0-stable (59807616e1 2026-04-14)
+
+Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
+
+All 36 checked tools are present and runnable.
--- a/nix/check-tools/nix-ubuntu-amd64.txt
+++ b/nix/check-tools/nix-ubuntu-amd64.txt
@@ -0,0 +1,55 @@
+Detected OS: linux (Linux x86_64)
+
+Core build tools:
+  [ ok ] cmake                cmake version 4.1.2
+  [ ok ] conan                Conan version 2.28.1
+  [ ok ] git                  git version 2.54.0
+  [ ok ] python3              Python 3.13.13
+
+Development tooling:
+  [ ok ] ccache               ccache version 4.13.6
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
+  [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
+  [ ok ] curl                 curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+  [ ok ] file                 file-5.47
+  [ ok ] less                 less 692 (PCRE2 regular expressions)
+  [ ok ] make                 GNU Make 4.4.1
+  [ ok ] netstat              net-tools 2.10
+  [ ok ] ninja                1.13.2
+  [ ok ] perl                 v5.42.0
+  [ ok ] pkg-config           0.29.2
+  [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
+  [ ok ] zip                  Zip 3.0
+  [ ok ] clang-format         clang-format version 22.1.7
+  [ ok ] dot                  dot - graphviz version 12.2.1 (0)
+  [ ok ] doxygen              1.16.1
+  [ ok ] gcovr                gcovr 8.4
+  [ ok ] gh                   gh version 2.94.0 (nixpkgs)
+  [ ok ] git-cliff            git-cliff 2.13.1
+  [ ok ] git-lfs              git-lfs/3.7.1 (3.7.1; linux amd64; go 1.26.3)
+  [ ok ] gpg                  gpg (GnuPG) 2.4.9
+  [ ok ] pre-commit           pre-commit 4.5.1
+  [ ok ] run-clang-tidy       usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
+
+Rust toolchain:
+  [ ok ] cargo                cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+  [ ok ] cargo-audit          cargo-audit-audit 0.22.1
+  [ ok ] cargo-llvm-cov       cargo-llvm-cov 0.8.5
+  [ ok ] cargo-nextest        cargo-nextest 0.9.137
+  [ ok ] clippy               clippy 0.1.95 (59807616e1 2026-04-14)
+  [ ok ] rust-analyzer        rust-analyzer 1.95.0 (5980761 2026-04-14)
+  [ ok ] rustc                rustc 1.95.0 (59807616e 2026-04-14)
+  [ ok ] rustfmt              rustfmt 1.9.0-stable (59807616e1 2026-04-14)
+
+GCC toolchain:
+  [ ok ] gcc                  gcc (GCC) 15.2.0
+  [ ok ] g++                  g++ (GCC) 15.2.0
+  [ ok ] gcov                 gcov (GCC) 15.2.0
+
+Mold:
+  [ ok ] mold                 mold 2.41.0 (compatible with GNU ld)
+
+Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
+
+All 40 checked tools are present and runnable.
--- a/nix/check-tools/nix-ubuntu-arm64.txt
+++ b/nix/check-tools/nix-ubuntu-arm64.txt
@@ -0,0 +1,55 @@
+Detected OS: linux (Linux aarch64)
+
+Core build tools:
+  [ ok ] cmake                cmake version 4.1.2
+  [ ok ] conan                Conan version 2.28.1
+  [ ok ] git                  git version 2.54.0
+  [ ok ] python3              Python 3.13.13
+
+Development tooling:
+  [ ok ] ccache               ccache version 4.13.6
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
+  [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
+  [ ok ] curl                 curl 8.20.0 (aarch64-unknown-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+  [ ok ] file                 file-5.47
+  [ ok ] less                 less 692 (PCRE2 regular expressions)
+  [ ok ] make                 GNU Make 4.4.1
+  [ ok ] netstat              net-tools 2.10
+  [ ok ] ninja                1.13.2
+  [ ok ] perl                 v5.42.0
+  [ ok ] pkg-config           0.29.2
+  [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
+  [ ok ] zip                  Zip 3.0
+  [ ok ] clang-format         clang-format version 22.1.7
+  [ ok ] dot                  dot - graphviz version 12.2.1 (0)
+  [ ok ] doxygen              1.16.1
+  [ ok ] gcovr                gcovr 8.4
+  [ ok ] gh                   gh version 2.94.0 (nixpkgs)
+  [ ok ] git-cliff            git-cliff 2.13.1
+  [ ok ] git-lfs              git-lfs/3.7.1 (3.7.1; linux arm64; go 1.26.3)
+  [ ok ] gpg                  gpg (GnuPG) 2.4.9
+  [ ok ] pre-commit           pre-commit 4.5.1
+  [ ok ] run-clang-tidy       usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
+
+Rust toolchain:
+  [ ok ] cargo                cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+  [ ok ] cargo-audit          cargo-audit-audit 0.22.1
+  [ ok ] cargo-llvm-cov       cargo-llvm-cov 0.8.5
+  [ ok ] cargo-nextest        cargo-nextest 0.9.137
+  [ ok ] clippy               clippy 0.1.95 (59807616e1 2026-04-14)
+  [ ok ] rust-analyzer        rust-analyzer 1.95.0 (5980761 2026-04-14)
+  [ ok ] rustc                rustc 1.95.0 (59807616e 2026-04-14)
+  [ ok ] rustfmt              rustfmt 1.9.0-stable (59807616e1 2026-04-14)
+
+GCC toolchain:
+  [ ok ] gcc                  gcc (GCC) 15.2.0
+  [ ok ] g++                  g++ (GCC) 15.2.0
+  [ ok ] gcov                 gcov (GCC) 15.2.0
+
+Mold:
+  [ ok ] mold                 mold 2.41.0 (compatible with GNU ld)
+
+Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
+
+All 40 checked tools are present and runnable.
--- a/nix/ci-env.nix
+++ b/nix/ci-env.nix
@@ -6,106 +6,18 @@
 let
  inherit (import ./packages.nix { inherit pkgs; })
    commonPackages
-    gccPackage
-    llvmPackages
+    gccVersion
    llvmVersion
+    mkVersionedToolLinks
    ;

-  # Underlying compiler toolchains to wrap (versions pinned in packages.nix).
-  customGccPackage = gccPackage;
-  customLlvmPackages = llvmPackages;
-
-  # binutils wrapped to emit binaries that reference the custom glibc
-  # (dynamic linker path, library search path, RPATH).
-  customBinutils = pkgs.wrapBintoolsWith {
-    bintools = pkgs.binutils-unwrapped;
-    libc = customGlibc;
-  };
-
-  # Rebuild gcc (specifically libstdc++ / libgcc_s) against the custom
-  # glibc. The override swaps gcc.cc's bootstrap stdenv for one that uses
-  # the existing gcc binary but links against the custom glibc, so the
-  # resulting compiler ships runtime libraries that only reference symbols
-  # available in that glibc.
-  customGccCc = customGccPackage.cc.override {
-    stdenv = pkgs.stdenvAdapters.overrideCC pkgs.stdenv (
-      pkgs.wrapCCWith {
-        cc = customGccPackage.cc;
-        libc = customGlibc;
-        bintools = customBinutils;
-      }
-    );
-  };
-
-  # cc-wrapper around the rebuilt compiler, pointing at the custom glibc
-  # headers and libraries. This is what we actually expose to users.
-  customGcc = pkgs.wrapCCWith {
-    cc = customGccCc;
-    libc = customGlibc;
-    bintools = customBinutils;
-  };
-
-  # gcov ships in gcc's `cc` output, but the cc-wrapper doesn't expose it.
-  # Surface the gcov from our rebuilt gcc (linked against the custom glibc, so
-  # it runs under the loader installed in the image) and matching the exact
-  # compiler version, so gcovr can produce coverage reports in the CI env.
-  customGcov = pkgs.runCommand "gcov-custom-for-ci-env" { } ''
-    mkdir -p "$out/bin"
-    ln -s "${customGccCc}/bin/gcov" "$out/bin/gcov"
-  '';
-
-  # stdenv built around the rebuilt gcc / custom glibc. Used to rebuild
-  # compiler-rt below so its sanitizer runtimes see the custom glibc
-  # headers.
-  customStdenv = pkgs.stdenvAdapters.overrideCC pkgs.stdenv customGcc;
-
-  # Rebuild compiler-rt against the custom glibc so the sanitizer runtimes
-  # don't use glibc symbols (or sysconf constants like _SC_SIGSTKSZ) that
-  # only exist in newer glibc versions. scudo is dropped because its CMake
-  # includes CheckAtomic with -nostdinc++ in CMAKE_REQUIRED_FLAGS, which
-  # makes std::atomic unfindable in our stdenv; we don't use scudo (only
-  # asan/ubsan/tsan etc.).
-  customCompilerRt =
-    (customLlvmPackages.compiler-rt.override {
-      stdenv = customStdenv;
-    }).overrideAttrs
-      (old: {
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace lib/CMakeLists.txt \
-            --replace-quiet 'add_subdirectory(scudo/standalone)' \
-                            '# scudo/standalone disabled in xrpld ci-env'
-        '';
-      });
-
-  # cc-wrapper around clang, pointing at the custom glibc headers and
-  # libraries. Reuses the rebuilt gcc for libstdc++ / libgcc_s so that
-  # C++ binaries produced by clang also only reference symbols available
-  # in the custom glibc. compiler-rt is wired into a resource-root so
-  # sanitizer runtimes (libclang_rt.*.a) are found at link time; this
-  # mirrors what nixpkgs does internally when building llvmPackages.clang.
-  customClang = pkgs.wrapCCWith {
-    cc = customLlvmPackages.clang-unwrapped;
-    libc = customGlibc;
-    bintools = customBinutils;
-    gccForLibs = customGccCc;
-    extraPackages = [ customCompilerRt ];
-    extraBuildCommands = ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${customLlvmPackages.clang-unwrapped.lib}/lib/clang/${toString llvmVersion}/include" "$rsrc/include"
-      ln -s "${customCompilerRt.out}/lib" "$rsrc/lib"
-      ln -s "${customCompilerRt.out}/share" "$rsrc/share" || true
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-      # compiler-rt ships the sanitizer/profile/xray interface headers (e.g.
-      # <sanitizer/lsan_interface.h>) in its `dev` output. In a normal Nix
-      # build these reach the include path because compiler-rt is propagated
-      # via depsTargetTargetPropagated and stdenv's setup hooks add its
-      # dev/include. The CI image runs clang outside a Nix stdenv (binaries
-      # on PATH, no setup hooks), so that never happens; add the headers
-      # explicitly. gcc ships its own copy, which is why this is clang-only.
-      echo "-isystem ${customCompilerRt.dev}/include" >> $out/nix-support/cc-cflags
-    '';
-  };
+  # Custom-glibc toolchain, shared with the Linux dev shell (see compilers.nix).
+  inherit (import ./compilers.nix { inherit pkgs customGlibc; })
+    customGcc
+    customClang
+    customBinutils
+    customGcov
+    ;

  # Strip the generic cc/c++/cpp symlinks from the clang wrapper so it can
  # coexist with the gcc wrapper in buildEnv. gcc remains the default
@@ -127,6 +39,25 @@ in
      customGcov
      customClangForCiEnv
      customBinutils
+      (mkVersionedToolLinks {
+        name = "gcc";
+        package = customGcc;
+        version = gccVersion;
+        tools = [
+          "gcc"
+          "g++"
+          "cpp"
+        ];
+      })
+      (mkVersionedToolLinks {
+        name = "clang";
+        package = customClang;
+        version = llvmVersion;
+        tools = [
+          "clang"
+          "clang++"
+        ];
+      })
      # CA certificate bundle so HTTPS clients (git, curl, conan) can verify
      # TLS connections without ca-certificates being installed in the system.
      pkgs.cacert
--- a/nix/compilers.nix
+++ b/nix/compilers.nix
@@ -0,0 +1,117 @@
+# Custom-glibc compiler toolchain shared by the CI environment (ci-env.nix) and
+# the Linux dev shell (devshell.nix): gcc / clang / binutils rebuilt to target
+# the pinned custom glibc. Linux only — the pinned glibc snapshot does not build
+# on darwin, so callers must not evaluate this on macOS.
+{
+  pkgs,
+  customGlibc,
+}:
+let
+  inherit (import ./packages.nix { inherit pkgs; })
+    gccPackage
+    llvmPackages
+    llvmVersion
+    mkGcov
+    ;
+
+  # binutils wrapped to emit binaries that reference the custom glibc
+  # (dynamic linker path, library search path, RPATH).
+  customBinutils = pkgs.wrapBintoolsWith {
+    bintools = pkgs.binutils-unwrapped;
+    libc = customGlibc;
+  };
+
+  # Rebuild gcc (specifically libstdc++ / libgcc_s) against the custom
+  # glibc. The override swaps gcc.cc's bootstrap stdenv for one that uses
+  # the existing gcc binary but links against the custom glibc, so the
+  # resulting compiler ships runtime libraries that only reference symbols
+  # available in that glibc.
+  customGccCc = gccPackage.cc.override {
+    stdenv = pkgs.stdenvAdapters.overrideCC pkgs.stdenv (
+      pkgs.wrapCCWith {
+        cc = gccPackage.cc;
+        libc = customGlibc;
+        bintools = customBinutils;
+      }
+    );
+  };
+
+  # cc-wrapper around the rebuilt compiler, pointing at the custom glibc
+  # headers and libraries. This is what we actually expose to users.
+  customGcc = pkgs.wrapCCWith {
+    cc = customGccCc;
+    libc = customGlibc;
+    bintools = customBinutils;
+  };
+
+  # gcov matching the rebuilt gcc (linked against the custom glibc), so gcovr
+  # can produce coverage reports both in CI and in the dev shell.
+  customGcov = mkGcov {
+    name = "custom";
+    cc = customGccCc;
+  };
+
+  # stdenv built around the rebuilt gcc / custom glibc. Exported as the dev
+  # shell's gcc stdenv, and used below to rebuild compiler-rt so its sanitizer
+  # runtimes see the custom glibc headers.
+  customStdenv = pkgs.stdenvAdapters.overrideCC pkgs.stdenv customGcc;
+
+  # Rebuild compiler-rt against the custom glibc so the sanitizer runtimes
+  # don't use glibc symbols (or sysconf constants like _SC_SIGSTKSZ) that
+  # only exist in newer glibc versions. scudo is dropped because its CMake
+  # includes CheckAtomic with -nostdinc++ in CMAKE_REQUIRED_FLAGS, which
+  # makes std::atomic unfindable in our stdenv; we don't use scudo (only
+  # asan/ubsan/tsan etc.).
+  customCompilerRt =
+    (llvmPackages.compiler-rt.override {
+      stdenv = customStdenv;
+    }).overrideAttrs
+      (old: {
+        postPatch = (old.postPatch or "") + ''
+          substituteInPlace lib/CMakeLists.txt \
+            --replace-quiet 'add_subdirectory(scudo/standalone)' \
+                            '# scudo/standalone disabled in xrpld ci-env'
+        '';
+      });
+
+  # cc-wrapper around clang, pointing at the custom glibc headers and
+  # libraries. Reuses the rebuilt gcc for libstdc++ / libgcc_s so that
+  # C++ binaries produced by clang also only reference symbols available
+  # in the custom glibc. compiler-rt is wired into a resource-root so
+  # sanitizer runtimes (libclang_rt.*.a) are found at link time; this
+  # mirrors what nixpkgs does internally when building llvmPackages.clang.
+  customClang = pkgs.wrapCCWith {
+    cc = llvmPackages.clang-unwrapped;
+    libc = customGlibc;
+    bintools = customBinutils;
+    gccForLibs = customGccCc;
+    extraPackages = [ customCompilerRt ];
+    extraBuildCommands = ''
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${llvmPackages.clang-unwrapped.lib}/lib/clang/${toString llvmVersion}/include" "$rsrc/include"
+      ln -s "${customCompilerRt.out}/lib" "$rsrc/lib"
+      ln -s "${customCompilerRt.out}/share" "$rsrc/share" || true
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      # compiler-rt ships the sanitizer/profile/xray interface headers (e.g.
+      # <sanitizer/lsan_interface.h>) in its `dev` output. In a normal Nix
+      # build these reach the include path because compiler-rt is propagated
+      # via depsTargetTargetPropagated and stdenv's setup hooks add its
+      # dev/include. The CI image runs clang outside a Nix stdenv (binaries
+      # on PATH, no setup hooks), so that never happens; add the headers
+      # explicitly. gcc ships its own copy, which is why this is clang-only.
+      echo "-isystem ${customCompilerRt.dev}/include" >> $out/nix-support/cc-cflags
+    '';
+  };
+in
+{
+  inherit
+    customGcc
+    customClang
+    customBinutils
+    customStdenv
+    customGcov
+    ;
+
+  customClangStdenv = pkgs.stdenvAdapters.overrideCC pkgs.stdenv customClang;
+}
--- a/nix/devshell.nix
+++ b/nix/devshell.nix
@@ -1,23 +1,69 @@
-{ pkgs, ... }:
+{ pkgs, customGlibc, ... }:
 let
  inherit (import ./packages.nix { inherit pkgs; })
    commonPackages
+    gccPackage
    gccVersion
+    llvmVersion
    llvmPackages
+    mkVersionedToolLinks
+    mkGcov
    ;

-  # Plain nixpkgs stdenvs — no custom glibc, unlike ci-env.nix.
-  gccStdenv = pkgs."gcc${toString gccVersion}Stdenv";
-  clangStdenv = llvmPackages.stdenv;
+  # Plain nixpkgs stdenvs — no custom glibc.
+  plainGccStdenv = pkgs."gcc${toString gccVersion}Stdenv";
+  plainClangStdenv = llvmPackages.stdenv;
+
+  # Custom-glibc stdenvs, matching the CI environment (see compilers.nix). The
+  # pinned glibc snapshot only builds on Linux, so on darwin these fall back to
+  # the plain stdenvs; the `if isLinux` guard keeps `customGlibc` from being
+  # forced (and erroring) on macOS.
+  customCompilers = import ./compilers.nix { inherit pkgs customGlibc; };
+  customGccStdenv = if pkgs.stdenv.isLinux then customCompilers.customStdenv else plainGccStdenv;
+  customClangStdenv =
+    if pkgs.stdenv.isLinux then customCompilers.customClangStdenv else plainClangStdenv;
+
+  # gcov matching each gcc shell, so `-Dcoverage=ON` builds work in the shell.
+  plainGcov = mkGcov {
+    name = "plain";
+    cc = gccPackage.cc;
+  };
+  customGccGcov = if pkgs.stdenv.isLinux then customCompilers.customGcov else plainGcov;
+
+  # Shown when entering a *-plain shell. These exist only on Linux (see below),
+  # where the stock toolchain diverges from CI.
+  plainWarningHook = ''
+    echo "⚠️  WARNING: this is the stock nixpkgs toolchain and does not match CI's glibc. Prefer 'nix develop .#gcc' / '.#clang' unless you need to skip the custom-glibc build."
+  '';
+
+  # Tools to expose under version-suffixed names (see mkVersionedToolLinks).
+  gccVersionedTools = [
+    "gcc"
+    "g++"
+    "cpp"
+  ];
+  clangVersionedTools = [
+    "clang"
+    "clang++"
+  ];

  # compilerName is the command used to print the version, or null for none.
  makeShell =
    {
+      shellName,
      stdenv,
      compilerName,
+      version ? null,
+      versionedTools ? [ ],
+      extraPackages ? [ ],
+      warningHook ? "",
+      # Opt out of PatchNixBinary.cmake retargeting binaries to the system
+      # loader. The plain toolchain links a newer glibc, so it must not be
+      # patched; the custom toolchain patches by default.
+      noPatchNixBinary ? false,
    }:
    let
-      compilerVersion =
+      compilerVersionHook =
        if compilerName == null then
          ''echo "No compiler specified - using system compiler"''
        else
@@ -25,33 +71,81 @@ let
            echo "Compiler: "
            ${compilerName} --version
          '';
+      versionedLinks = pkgs.lib.optional (version != null) (mkVersionedToolLinks {
+        name = compilerName;
+        package = stdenv.cc;
+        inherit version;
+        tools = versionedTools;
+      });
    in
-    (pkgs.mkShell.override { inherit stdenv; }) {
-      packages = commonPackages;
-      shellHook = ''
-        echo "Welcome to xrpld development shell";
-        ${compilerVersion}
-      '';
-    };
+    (pkgs.mkShell.override { inherit stdenv; }) (
+      {
+        packages = commonPackages ++ versionedLinks ++ extraPackages;
+        # Marks a managed dev shell, so the build (XrplSanity.cmake) can tell an
+        # intentional Nix toolchain from one leaked into a bare shell.
+        XRPL_DEVSHELL = shellName;
+        shellHook = ''
+          echo "Welcome to xrpld development shell";
+          ${compilerVersionHook}
+          ${warningHook}
+        '';
+      }
+      // pkgs.lib.optionalAttrs noPatchNixBinary { XRPLD_NO_PATCH_NIX_BINARY = "1"; }
+    );
 in
 rec {
  # macOS: Nix Clang. Linux: Nix GCC.
  default = if pkgs.stdenv.isDarwin then clang else gcc;

+  # gcc/clang use the custom-glibc toolchain, matching CI. On darwin there is no
+  # custom glibc, so they fall back to the plain nixpkgs toolchain.
  gcc = makeShell {
-    stdenv = gccStdenv;
+    shellName = "gcc";
+    stdenv = customGccStdenv;
    compilerName = "gcc";
+    version = gccVersion;
+    versionedTools = gccVersionedTools;
+    extraPackages = [ customGccGcov ];
  };

  clang = makeShell {
-    stdenv = clangStdenv;
+    shellName = "clang";
+    stdenv = customClangStdenv;
    compilerName = "clang";
+    version = llvmVersion;
+    versionedTools = clangVersionedTools;
  };

  # Nix provides no compiler; use the one from your system (e.g. Apple Clang).
  no-compiler = makeShell {
+    shellName = "no-compiler";
    stdenv = pkgs.stdenvNoCC;
    compilerName = null;
  };
  apple-clang = no-compiler;
 }
+# The *-plain shells (stock nixpkgs toolchain) exist only on Linux: on darwin
+# gcc/clang are already plain, so these would be redundant and are omitted, which
+# makes `nix develop .#gcc-plain` fail there rather than silently aliasing gcc.
+// pkgs.lib.optionalAttrs pkgs.stdenv.isLinux {
+  gcc-plain = makeShell {
+    shellName = "gcc-plain";
+    stdenv = plainGccStdenv;
+    compilerName = "gcc";
+    version = gccVersion;
+    versionedTools = gccVersionedTools;
+    extraPackages = [ plainGcov ];
+    warningHook = plainWarningHook;
+    noPatchNixBinary = true;
+  };
+
+  clang-plain = makeShell {
+    shellName = "clang-plain";
+    stdenv = plainClangStdenv;
+    compilerName = "clang";
+    version = llvmVersion;
+    versionedTools = clangVersionedTools;
+    warningHook = plainWarningHook;
+    noPatchNixBinary = true;
+  };
+}
--- a/nix/docker/Dockerfile
+++ b/nix/docker/Dockerfile
@@ -8,10 +8,12 @@ RUN mkdir -p ~/.config/nix && \

 # Copy our source and setup our working dir.
 COPY nix/ci-env.nix /tmp/build/nix/ci-env.nix
+COPY nix/compilers.nix /tmp/build/nix/compilers.nix
 COPY nix/packages.nix /tmp/build/nix/packages.nix
 COPY nix/utils.nix /tmp/build/nix/utils.nix
 COPY flake.nix /tmp/build/
 COPY flake.lock /tmp/build/
+COPY rust-toolchain.toml /tmp/build/
 WORKDIR /tmp/build

 FROM builder-source AS builder
@@ -56,7 +58,7 @@ ENV GIT_SSL_CAINFO="/nix/ci-env/etc/ssl/certs/ca-bundle.crt"
 # Externally-built dynamically-linked ELF binaries hard-code the loader path
 # (e.g. /lib64/ld-linux-x86-64.so.2) in their PT_INTERP header. Install it
 # from the Nix store when the base image doesn't already provide one.
-COPY nix/docker/loader-path.sh /tmp/loader-path.sh
+COPY bin/default-loader-path.sh /tmp/loader-path.sh

 RUN <<EOF
 target="$(/tmp/loader-path.sh)"
--- a/nix/docker/README.md
+++ b/nix/docker/README.md
@@ -47,7 +47,9 @@ work without `ca-certificates` being installed in the base image.
     [`test_files/cpp/sources/`](./test_files/cpp/sources) with both `g++` and
     `clang++`, and sanitizers, and
   - compiles the Rust test programs in
-     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`.
+     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`, and
+     builds the [`test_files/rust/proc_macro/`](./test_files/rust/proc_macro)
+     workspace with `cargo` to exercise proc-macro dylib loading.
 3. **`tester`** — Start again from a clean `BASE_IMAGE` (no Nix toolchain),
   install only the sanitizer runtime libraries
   ([`install-sanitizer-libs.sh`](./install-sanitizer-libs.sh)), and run the
@@ -73,23 +75,27 @@ toolchain being present at runtime. Two pieces make that work:

 - **An expected dynamic linker in the image.**
  Binaries built in Nix environments reference a dynamic linker from Nix store paths, which won't be present in the base image. However,
-  [`loader-path.sh`](./loader-path.sh) reports the expected loader path for the
-  current architecture, so we can patch the binaries to use the correct loader.
+  [`bin/default-loader-path.sh`](../../bin/default-loader-path.sh) reports the
+  expected loader path for the current architecture, so we can patch the binaries
+  to use the correct loader.

-The build then verifies all of this end to end: the C++ test programs in
-`test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan variants) and
-the Rust test programs in `test_files/rust/sources/` (a hello binary plus panic
-and overflow-check variants) are compiled in `final`, their `PT_INTERP` is
-patched to the target loader, and they are run in the clean `tester` stage to
-confirm each emits the expected diagnostic on a stock base image.
+The build then verifies all of this end to end, and the C++ and Rust programs
+go through the same pipeline: each is compiled in `final`, has its `PT_INTERP`
+patched to the target loader, and is then run in the clean `tester` stage to
+confirm it emits the expected diagnostic on a stock base image. The C++ programs
+are in `test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan
+variants); the Rust programs are in `test_files/rust/sources/` (a hello binary
+plus panic and overflow-check variants), plus the `test_files/rust/proc_macro/`
+workspace — a crate whose compilation additionally loads a proc-macro dylib, and
+whose resulting binary is patched and run like the others.

 ## Files

-| File                                                                    | Purpose                                                                       |
-| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                            |
-| [`./loader-path.sh`](./loader-path.sh)                                  | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.     |
-| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                      |
-| [`./test_files/rust/`](./test_files/rust)                               | Rust rustc smoke test: sources + compile/run scripts.                         |
-| [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                         |
-| [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images. |
+| File                                                                    | Purpose                                                                              |
+| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                                   |
+| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                             |
+| [`./test_files/rust/`](./test_files/rust)                               | Rust smoke test: rustc sources + a cargo proc-macro workspace + compile/run scripts. |
+| [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                                |
+| [`/bin/default-loader-path.sh`](../../bin/default-loader-path.sh)       | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.            |
+| [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images.        |
--- a/nix/docker/test_files/rust/compile-sources.sh
+++ b/nix/docker/test_files/rust/compile-sources.sh
@@ -40,6 +40,29 @@ compile hello
 compile panic
 compile overflow "-C overflow-checks=on"

+function compile_proc_macro() {
+    local proj="${src_dir}/../proc_macro"
+
+    echo "=== Building proc-macro workspace (cargo) ==="
+    cargo build --manifest-path "${proj}/Cargo.toml" --offline
+
+    local built="${proj}/target/debug/test_macro"
+    if [ ! -f "${built}" ]; then
+        echo "ERROR: built test_macro binary not found at ${built}" >&2
+        exit 1
+    fi
+
+    local binary="${dst_dir}/proc_macro"
+    cp "${built}" "${binary}"
+
+    echo "=== Patching ${binary} to use ${loader} as PT_INTERP ==="
+    patchelf --set-interpreter "${loader}" --remove-rpath "${binary}"
+
+    rm -rf "${proj}/target"
+}
+
+compile_proc_macro
+
 echo "=== All binaries compiled ==="

 ls -la "${dst_dir}"
--- a/nix/docker/test_files/rust/proc_macro/Cargo.lock
+++ b/nix/docker/test_files/rust/proc_macro/Cargo.lock
@@ -0,0 +1,14 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "echo_macro"
+version = "0.0.0"
+
+[[package]]
+name = "test_macro"
+version = "0.0.0"
+dependencies = [
+ "echo_macro",
+]
--- a/nix/docker/test_files/rust/proc_macro/Cargo.toml
+++ b/nix/docker/test_files/rust/proc_macro/Cargo.toml
@@ -0,0 +1,3 @@
+[workspace]
+resolver = "2"
+members = ["echo_macro", "test_macro"]
--- a/nix/docker/test_files/rust/proc_macro/echo_macro/Cargo.toml
+++ b/nix/docker/test_files/rust/proc_macro/echo_macro/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "echo_macro"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[lib]
+proc-macro = true
--- a/nix/docker/test_files/rust/proc_macro/echo_macro/src/lib.rs
+++ b/nix/docker/test_files/rust/proc_macro/echo_macro/src/lib.rs
@@ -0,0 +1,6 @@
+use proc_macro::TokenStream;
+
+#[proc_macro]
+pub fn define_echo(item: TokenStream) -> TokenStream {
+    format!("fn echo() -> u32 {{ {item} }}").parse().unwrap()
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vito Tumas	8b8cda3cc7	Merge branch 'develop' into tapanito/bugfix-loan-pay-fn-67	2026-07-27 15:33:23 +02:00
Andrzej Budzanowski	20801d98ac	test: Improve the server status test to not race and randomly fail (#7304 ) Co-authored-by: Alex Kremer <akremer@ripple.com>	2026-07-27 11:58:15 +00:00
dependabot[bot]	b878818e80	ci: [DEPENDABOT] bump actions/checkout from 7.0.0 to 7.0.1 (#7871 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-27 09:55:01 +00:00
Sergey Kuznetsov	fecfc0cf3f	chore: Fix clang version in devshell (#7860 ) Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>	2026-07-24 17:30:20 +00:00
Ayaz Salikhov	ea0a6904f0	chore: Verify tooling version for Nix-managed environments (#7862 )	2026-07-24 15:52:45 +00:00
Ayaz Salikhov	29d74142ae	build: Patсh binary in local Linux nix environment (#7859 ) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-24 14:59:24 +00:00
Kassaking7	9afa1cf4d1	fix: Update PermissionedDEX invariant domain tracking for valid offer replacement (#7387 ) Co-authored-by: Bart <bthomee@users.noreply.github.com>	2026-07-23 21:40:21 +00:00
Ed Hennis	7908aec2ec	feat: Check default fields are not default when serializing (#6267 ) Co-authored-by: Vito <5780819+Tapanito@users.noreply.github.com> Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com> Co-authored-by: Bart <bthomee@users.noreply.github.com>	2026-07-23 21:39:11 +00:00
Marek Foss	4c0180b3db	test: Migrate csf and xrpld-consensus Beast non-JTx tests to GTest (#7046 ) Co-authored-by: Alex Kremer <akremer@ripple.com>	2026-07-23 21:38:21 +00:00
Marek Foss	4acccfeda8	test: Modularize Peerfinder component and migrate Peerfinder tests from Beast to GTest and GMock (#7054 ) Co-authored-by: Alex Kremer <akremer@ripple.com>	2026-07-23 21:00:06 +00:00
Ed Hennis	b89d75a2d5	test: Add an RAII class to manage the env.parseFailureExpected flag (#7669 )	2026-07-23 20:57:00 +00:00
Ayaz Salikhov	40cdf49d15	build: Use custom libc in a devshell by default (#7852 )	2026-07-23 19:05:24 +00:00
Mayukha Vadari	38c54c3f36	feat: Add fixCleanup3_4_0 amendment (no functionality yet) (#7854 )	2026-07-23 18:50:59 +00:00
Sergey Kuznetsov	95e1ffea6e	ci: Add llvm-tools-preview to rust toolchain (#7853 )	2026-07-23 16:49:44 +00:00
Sergey Kuznetsov	74cfb3586a	ci: Update CI image (#7850 )	2026-07-23 11:21:49 +00:00
Ayaz Salikhov	0072ced94c	ci: Update XRPLF/actions (#7849 )	2026-07-23 10:22:18 +00:00
Mayukha Vadari	12ed506565	chore: Clean up grammar in PR template (#7846 )	2026-07-22 18:50:10 +00:00
Ayaz Salikhov	3122de86bf	build: Create versioned compiler/tooling symlinks in nix environments (#7844 )	2026-07-22 17:04:02 +00:00
Vito Tumas	43e98effc6	Merge branch 'develop' into tapanito/bugfix-loan-pay-fn-67	2026-07-22 18:01:50 +02:00
Vito	bad77604ed	fix: Conserve funds correctly when LoanPay fee payee is below reserve LoanPay's fund-conservation check read XRP balances via accountHolds(SpendableHandling::FullBalance), which for XRP always defers to xrpLiquid (balance minus reserve, clamped at zero). When the broker fee landed on a payee sitting below its own reserve, the payee's clamped balance stayed zero and the fee vanished from the conservation sum, tripping the "funds are conserved" assert on an otherwise valid payment.	2026-07-22 17:52:38 +02:00
Sergey Kuznetsov	7edf39e622	ci: Use rust-overlay to bring Rust into nix (#7837 )	2026-07-22 14:00:17 +00:00
dependabot[bot]	ba01b05f33	ci: [DEPENDABOT] bump actions/setup-python from 6.3.0 to 7.0.0 (#7830 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 16:04:45 +00:00
Sergey Kuznetsov	c414e1877d	ci: Update pre-commit image (#7838 )	2026-07-21 15:37:47 +00:00
Sergey Kuznetsov	f56b79f00d	ci: Add cargo to pre-commit image (#7835 )	2026-07-21 13:39:37 +00:00
Ayaz Salikhov	4918f3bb20	chore: Add doxygen in pre-commit image (#7836 )	2026-07-21 13:38:26 +00:00
Mayukha Vadari	ee0a3dfad7	ci: Improve test debuggability (#7619 ) Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>	2026-07-21 13:14:40 +00:00
Bart	042c9660cd	chore: Add CODEOWNERS for CI-related changes (#7832 ) Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com>	2026-07-20 21:06:24 +00:00
Ayaz Salikhov	60b49f3fe0	ci: Use in-house image for pre-commit (#7610 )	2026-07-20 19:11:09 +00:00
Ayaz Salikhov	4c869ee16c	ci: Build separate pre-commit docker image (#7831 )	2026-07-20 17:40:38 +00:00
Ayaz Salikhov	b2f45813e0	chore: Workaround boost compiler resolution inside Nix environment (#7826 )	2026-07-20 14:04:08 +00:00
Vito Tumas	5ce0b1c2c7	refactor: Restructure LendingHelpers to improve readability (#7807 )	2026-07-16 15:47:56 +00:00
Andrzej Budzanowski	701311f27e	test: Add google benchmark dependency and migrate `nodestore` timing test as a benchmark (#7317 ) Co-authored-by: Marek Foss <marek.foss@neti-soft.com> Co-authored-by: Alex Kremer <akremer@ripple.com>	2026-07-16 15:44:43 +00:00
Sergey Kuznetsov	b1a670c46e	ci: Add Rust to CI (#7808 ) Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>	2026-07-16 15:28:04 +00:00
Bart	18e311e1e2	chore: Bump version to 3.3.0-rc1 (#7806 ) Co-authored-by: Bart <11445373+bthomee@users.noreply.github.com> Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>	2026-07-16 13:54:12 +00:00
Denis Angell	69b70d7a0d	fix: Refactor Batch Transaction IDs (#7736 ) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Mayukha Vadari <mvadari@ripple.com>	2026-07-16 13:15:59 +00:00
Mayukha Vadari	b42cde3e85	refactor: Remove redundant enable checks in ConfidentialMPT txs (#7809 )	2026-07-16 09:51:19 +00:00
Peter Chen	cd38c0e800	chore: Update mpt-crypto-lib to 0.4.0-rc4 (#7813 )	2026-07-15 23:47:22 +00:00
Vlad	433e5f6896	fix: Reject zero CheckID in CheckCancel and CheckCash (#7685 )	2026-07-15 22:08:45 +00:00
Ayaz Salikhov	781ab723af	ci: Fix workflow launch on matrix-unrelated labels (#7812 )	2026-07-15 18:24:31 +00:00
Ed Hennis	a24e543af3	fix: Allocate TaggedCache::getKeys() memory outside of lock (#7567 ) Co-authored-by: xrplf-ai-reviewer[bot] <266832837+xrplf-ai-reviewer[bot]@users.noreply.github.com>	2026-07-15 13:30:20 +00:00
Sophia Xie	a0fd1cce54	fix: Re-store nodes missing from both backends during online_delete rotation (#7763 ) Co-authored-by: Valentin Balaschenko <13349202+vlntb@users.noreply.github.com>	2026-07-14 23:42:40 +00:00