docs: Link #8558 and name every transaction stream in the API changelog

fix: Apply DeliverMax to inner Batch Payments, simulate and submit
2026-10-22 11:37:07 +00:00 · 2026-10-10 09:01:55 -04:00 · 2026-10-10 08:50:12 -04:00
763 changed files with 21289 additions and 56619 deletions
@@ -76,6 +76,7 @@ Checks: "-*,
  -readability-redundant-nested-if,
  -readability-redundant-qualified-alias,
  -readability-static-accessed-through-instance,
+  -readability-trailing-comma,
  -readability-trivial-switch,
  -readability-uppercase-literal-suffix
  "
@@ -92,6 +93,10 @@ CheckOptions:
  bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
  bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc

+  # New in clang-tidy 23; disabled until the code is updated
+  misc-const-correctness.AnalyzeAutoVariables: false
+  misc-const-correctness.AnalyzeLambdas: false
+  misc-const-correctness.AnalyzeParameters: false
  misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/.*;openssl/obj_mac\\.h"

  readability-braces-around-statements.ShortStatementLines: 2
@@ -103,7 +103,6 @@ words:
  - dearmor
  - decryptor
  - dedented
-  - dedup
  - deleteme
  - demultiplexer
  - deserializaton
@@ -345,7 +344,6 @@ words:
  - unambiguity
  - unauthorizes
  - unauthorizing
-  - undeserializable
  - unergonomic
  - unfetched
  - unfindable
@@ -36,18 +36,3 @@ updates:
      rust-dependencies:
        patterns:
          - "*"
-
-  - package-ecosystem: uv
-    directory: /cmake/scripts/codegen
-    schedule:
-      interval: weekly
-      day: monday
-      time: "04:00"
-      timezone: Etc/GMT
-    commit-message:
-      prefix: "chore: [DEPENDABOT] "
-    target-branch: develop
-    groups:
-      codegen-dependencies:
-        patterns:
-          - "*"
@@ -62,7 +62,6 @@ libxrpl.tx > xrpl.protocol
 libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
-test.app > tests.libxrpl
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
@@ -8,7 +8,6 @@ on:
    branches:
      - "develop"
      - "release/*"
-      - "staging/*"
    paths:
      - "crates/**/Cargo.toml"
      - "crates/Cargo.lock"
@@ -67,7 +66,7 @@ jobs:

      - name: Create issue
        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "cargo audit found vulnerabilities"
          body_file: /tmp/cargo-audit-issue.md
@@ -53,7 +53,7 @@ jobs:

      - name: Create issue
        if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'XRPLF/rippled' }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "Releases not merged back into develop"
          body_file: ${{ env.ISSUE_FILE }}
@@ -79,7 +79,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -108,7 +108,7 @@ jobs:

      - name: Upload regenerated snapshot
        if: failure()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: check-tools-${{ runner.os }}-${{ runner.arch }}
          path: ${{ matrix.snapshot }}
@@ -243,7 +243,7 @@ jobs:
      - should-run
      - build-test
    # Only run when committing to a PR that targets a release branch.
-    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') }}
+    if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
    uses: ./.github/workflows/reusable-upload-recipe.yml
    secrets:
      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
@@ -1,16 +1,14 @@
 # This workflow runs all workflows to build and test the code on various Linux
 # flavors, as well as on MacOS and Windows, on a scheduled basis, on merge into
-# the 'develop', 'release/*' or 'staging/*' branches, or when requested
-# manually. Upon pushes to the develop branch, it also uploads the libxrpl
-# recipe to the Conan remote.
+# the 'develop' or 'release*' branches, or when requested manually. Upon pushes
+# to the develop branch it also uploads the libxrpl recipe to the Conan remote.
 name: Trigger

 on:
  push:
    branches:
      - "develop"
-      - "release/*"
-      - "staging/*"
+      - "release*"
    paths:
      # These paths are unique to `on-trigger.yml`.
      - ".github/workflows/on-trigger.yml"
@@ -64,9 +62,9 @@ on:
  workflow_dispatch:

 concurrency:
-  # When a PR is merged into the develop branch, it will be assigned a unique
+  # When a PR is merged into the develop branch it will be assigned a unique
  # group identifier, so execution will continue even if another PR is merged
-  # while it is still running. In all other cases, the group identifier is shared
+  # while it is still running. In all other cases the group identifier is shared
  # per branch, so that any in-progress runs are cancelled when a new commit is
  # pushed.
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
@@ -100,7 +98,7 @@ jobs:
      # However, we do not enable ccache for events targeting a release branch,
      # to protect against the rare case that the output produced by ccache is
      # not identical to a regular compilation.
-      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release/') }}
+      ccache_enabled: ${{ github.repository_owner == 'XRPLF' && !startsWith(github.ref, 'refs/heads/release') }}
      os: ${{ matrix.os }}
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -8,14 +8,13 @@ on:
  push:
    branches:
      - "develop"
-      - "release/*"
-      - "staging/*"
+      - "release*"
  workflow_dispatch:

 jobs:
  # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
  run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@d7f2acb47d9662e1e2f8b1f5feffa6d21cc3290a
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
    with:
      runs_on: ubuntu-latest
      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-70b8fd3" }'
@@ -47,7 +47,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -31,12 +31,6 @@ on:
        type: string
        default: ""

-      unittest_args:
-        description: "Additional arguments to pass to rippled when running tests"
-        required: false
-        type: string
-        default: ""
-
      cmake_target:
        description: "The CMake target to build."
        required: true
@@ -135,7 +129,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: ${{ inputs.ccache_enabled }}

@@ -286,7 +280,7 @@ jobs:

      - name: Upload the binary (Linux)
        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: xrpld-${{ inputs.config_name }}
          path: ${{ env.BUILD_DIR }}/xrpld
@@ -300,7 +294,7 @@ jobs:

      - name: Upload the validator-keys binary
        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: validator-keys-${{ inputs.config_name }}
          path: |
@@ -311,7 +305,7 @@ jobs:

      - name: Upload the test binary (Linux)
        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: xrpl_tests-${{ inputs.config_name }}
          path: ${{ env.BUILD_DIR }}/xrpl_tests
@@ -327,7 +321,7 @@ jobs:

      - name: Upload server definitions
        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-definitions
          path: ${{ env.BUILD_DIR }}/server_definitions.json
@@ -364,7 +358,6 @@ jobs:
        working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
        env:
          BUILD_NPROC: ${{ steps.nproc.outputs.nproc }}
-          UNITTEST_ARGS: ${{ inputs.unittest_args }}
        run: |
          set -o pipefail
          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness
@@ -45,7 +45,6 @@ jobs:
      build_type: ${{ matrix.build_type }}
      ccache_enabled: ${{ inputs.ccache_enabled }}
      cmake_args: ${{ matrix.cmake_args }}
-      unittest_args: ${{ matrix.unittest_args }}
      cmake_target: ${{ matrix.cmake_target }}
      runs_on: ${{ toJSON(matrix.architecture.runner) }}
      image: ${{ matrix.image || '' }}
@@ -43,7 +43,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -109,7 +109,7 @@ jobs:

      - name: Upload clang-tidy output
        if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: ${{ env.OUTPUT_FILE }}
          archive: false
@@ -123,23 +123,17 @@ jobs:

      - name: Fix style
        if: ${{ steps.files_changed.outcome != 'success' }}
-        # pre-commit installs every hook's environment, even for hooks that match
-        # no files, and node-based hooks need libatomic, which this image lacks.
-        # Exit code 1 just means hooks modified files or found issues.
-        env:
-          SKIP: prettier,cspell
        run: |
-          git add --update
-          pre-commit run || [ $? -eq 1 ]
+          pre-commit run --all-files || true

      - name: Generate git diff
        if: ${{ steps.files_changed.outcome != 'success' }}
        run: |
-          git diff HEAD | tee "${DIFF_FILE}"
+          git diff | tee "${DIFF_FILE}"

      - name: Upload clang-tidy diff output
        if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: ${{ env.DIFF_FILE }}
          archive: false
@@ -191,7 +185,7 @@ jobs:

      - name: Create issue
        if: ${{ steps.run_clang_tidy.outcome != 'success' && inputs.create_issue_on_failure }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "Clang-tidy check failed"
          body_file: ${{ env.ISSUE_FILE }}
@@ -44,7 +44,7 @@ jobs:
      # Every package lands in one directory; the step below picks its own,
      # which keeps this independent of the artifact names.
      - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "*-pkg"
          merge-multiple: true
@@ -95,15 +95,11 @@ jobs:
          apt-get update -qq
          apt-get install -y "./${PACKAGE}"

-      # Rocky Linux and AlmaLinux pick a mirror from a mirrorlist, and now and
-      # then get one that serves the repository metadata at a few hundred kB/s,
-      # which alone outlasts the job's timeout. dnf only abandons a mirror below
-      # 1000 B/s for 30 s, so raise that floor to fail over to the next one fast.
      - name: Install the RPM
        if: ${{ inputs.package_type == 'rpm' }}
        env:
          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y --setopt=minrate=1M --setopt=timeout=10 "./${PACKAGE}"
+        run: dnf install -y "./${PACKAGE}"

      - name: Run xrpld
        run: xrpld --version
@@ -100,18 +100,18 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

      - name: Download pre-built xrpld binary
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}
          path: ${{ env.BUILD_DIR }}

      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.validator_keys_artifact_name }}
          path: ${{ env.BUILD_DIR }}
@@ -151,7 +151,7 @@ jobs:
      # version starts with a digit and a longer name does not, so that one digit
      # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
      - name: Upload package artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg
          path: |
@@ -160,7 +160,7 @@ jobs:
          if-no-files-found: error

      - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
          path: |
@@ -225,13 +225,13 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

      # Both artifacts, so the debug symbols are published alongside the package.
      - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
          merge-multiple: true
@@ -287,7 +287,7 @@ jobs:
        run: echo "PUSH=${PUSH}" | tee -a "${GITHUB_ENV}"

      - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "*-pkg"
          merge-multiple: true
@@ -295,7 +295,7 @@ jobs:

      - name: Download voidstar binary
        if: ${{ matrix.target == 'voidstar' }}
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: xrpld-ubuntu-clang-debug-amd64-voidstar
          path: ${{ env.CONTEXT }}
@@ -50,7 +50,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -68,7 +68,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -33,11 +33,12 @@ Version 3.5.0 is not yet released.

 ### Bugfixes in 3.5.0

+- `account_tx`, `ledger`, `sign`, `sign_for`, `submit`, `submit_multisigned`, `subscribe` (transaction streams), `transaction_entry`, `tx`, `tx_history`: A Payment inside the `RawTransactions` of a Batch now follows the same `DeliverMax` rule as any other Payment: `Amount` and `DeliverMax` in API version 1, and only `DeliverMax` in API version 2 and later. Previously an inner Payment showed only `Amount` in every API version. [#8558](https://github.com/XRPLF/rippled/pull/8558)
+- `sign`, `sign_for`, `submit`, `submit_multisigned`: An inner Payment of a Batch now accepts `DeliverMax` in place of `Amount`, as a top-level Payment already did; differing `Amount` and `DeliverMax` return `invalidParams`. Previously `DeliverMax` in an inner Payment was rejected as an unknown field. [#8558](https://github.com/XRPLF/rippled/pull/8558)
+- `simulate`: A Payment now accepts `DeliverMax` in place of `Amount`, and the returned `tx_json` follows the `DeliverMax` rule. Previously `DeliverMax` was rejected as an unknown field and the returned `tx_json` showed only `Amount`. [#8558](https://github.com/XRPLF/rippled/pull/8558)
+- `submit`: With `tx_blob`, the returned `tx_json` now follows the `DeliverMax` rule. Previously it showed only `Amount`. [#8558](https://github.com/XRPLF/rippled/pull/8558)
 - `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 - `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
- `account_currencies`, `account_nfts`, `account_offers`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before an invalid or missing `account`. An invalid `limit` or `marker` is reported before `lgrNotFound` or `actNotFound`, and for `account_offers` also before `actMalformed`. A request with a single problem returns the same error as before. [#8561](https://github.com/XRPLF/rippled/pull/8561)
- `deposit_authorized`: A `credentials` entry that is all zeros (for example `"0"` or 64 `0` characters) now returns a `badCredentials` error instead of looking up a credential that can never exist.
- `account_info`, `account_lines`, `account_channels`: A request with more than one problem may now report a different one of them. An invalid `ledger_hash` or `ledger_index` is reported before a missing or invalid `account`, or `ident` for `account_info`. For `account_lines`, a `peer` that is not a string, or an invalid `limit` or `marker`, is reported before `lgrNotFound`, `actNotFound` or a malformed `account`, and an invalid `limit` or `marker` also before a malformed `peer`. For `account_channels`, a malformed `account` is reported before `lgrNotFound`, and an invalid `destination_account`, `limit` or `marker` before `lgrNotFound` or `actNotFound`. A request with a single problem returns the same error as before. [#8573](https://github.com/XRPLF/rippled/pull/8573)

 ### Bugfixes in 3.5.0

@@ -2,12 +2,33 @@
 | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |

-## Supported platforms
+## Minimum Requirements

-Building and testing are supported on Linux, macOS, and (best effort) Windows;
-see [Supported development platforms](./docs/build/environment.md#supported-development-platforms).
-Running `xrpld` is officially supported on Linux only;
-see [Requirements](./docs/install.md#requirements).
+For the hardware needed to run a node, see
+[System Requirements](https://xrpl.org/system-requirements.html).
+
+For the software needed to build xrpld, see the
+[environment setup guide](./docs/build/environment.md).
+
+## Operating Systems
+
+### Linux
+
+The Ubuntu Linux distribution has received the highest level of quality
+assurance, testing, and support. We also support Red Hat and use Debian
+internally.
+Our Linux CI tooling is distro-independent and uses a Nix-based environment, so it should be possible to build on other Linux distributions as well, although we have not tested them.
+
+### macOS
+
+Many `xrpld` engineers use macOS for development.
+The minimum supported version is macOS 15 (Sequoia).
+CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
+
+### Windows
+
+Windows is used by some engineers for development only, and is not recommended
+for production use.

 ## Steps

@@ -42,7 +42,7 @@ if(is_gcc)
    # GCC-specific fixes
    add_compile_options(-Wno-unknown-pragmas -Wno-subobject-linkage)
    # -Wno-subobject-linkage can be removed when we upgrade GCC version to at least 13.3
-elseif(is_any_clang)
+elseif(is_clang)
    # Clang-specific fixes
    add_compile_options(-Wno-unknown-warning-option) # Ignore unknown warning options
 elseif(is_msvc)
@@ -332,7 +332,7 @@ This ensures that configuration changes don't introduce new warnings across the

 ### Installing clang-tidy

-The [Nix development shell](./docs/build/nix.md) provides `clang-tidy` at the [tested version](./docs/build/environment.md#tested-compiler-versions).
+See the [environment setup guide](./docs/build/environment.md#clang-tidy) for how to get clang-tidy.

 ### Running clang-tidy locally

@@ -34,7 +34,7 @@ so tools can filter them and protection rules can target `release/*` and `stagin
 - **Branches only move forward.**
  `develop`, `staging/X.Y.x`, and `release/X.Y.x` are never rewritten.
 - **Cherry-picking only goes from `develop` to a staging branch**,
-  for fixes that must get into a release after the [code freeze](#release-candidates)
+  for fixes that must get into a release after the code freeze
  (see [Emergency Fixes From `develop`](#emergency-fixes-from-develop)).
 - **Security fixes are prepared privately and published with the release that contains them**,
  so vulnerabilities are not disclosed prematurely.
@@ -49,7 +49,6 @@ develop                            staging/X.Y.x & release/X.Y.x
   │
   ├── Tag: X.Y.0-b1
   ├── Tag: X.Y.0-bN
-   │  (2 weeks before rc1: freeze on large changes starts)
   ├── Tag: X.Y.0-rc1 ───────────────┐ (branches created)
   │                                 │
   │  (development continues)        ├── Fixes
@@ -76,20 +75,16 @@ develop                            staging/X.Y.x & release/X.Y.x
 3. **Branches:** `staging/X.Y.x` and `release/X.Y.x` are created from `develop`
   at the commit tagged `X.Y.0-rc1`.
   The first RC also kicks off the QE process.
-
-### Freeze on Large Changes
-
-From two weeks before `X.Y.0-rc1` until `X.Y.0` is [merged back](#merging-back-into-develop),
-large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
-are not merged into `develop`.
+4. **Code freeze:** No new features or unrelated changes are pulled from `develop`
+   into `staging/X.Y.x` or `release/X.Y.x`.
+   Only critical stabilization fixes go into the line.
+5. **No large changes on `develop`:** Until `X.Y.0` is [merged back](#merging-back-into-develop),
+   large changes (e.g., big refactors, moving or renaming many files, mass reformatting)
+   are not merged into `develop`,
+   so that fixes on the line and the merge back don't run into conflicts.

 ### Release Candidates

-After branching, the line is in code freeze:
-no new features or unrelated changes are pulled from `develop`
-into `staging/X.Y.x` or `release/X.Y.x`.
-Only critical stabilization fixes go into the line.
-
 1. Fixes are developed against `staging/X.Y.x`.
 2. When ready, a new RC is created on `staging/X.Y.x`,
   and `release/X.Y.x` is fast-forwarded to it.
@@ -111,8 +106,7 @@ one right after the other.
 2. `release/X.Y.x` is fast-forwarded to `staging/X.Y.x`,
   and the release is tagged on it.
 3. The release is immediately [merged back into `develop`](#merging-back-into-develop).
-   For a major-minor release, this lifts the [freeze on large changes](#freeze-on-large-changes)
-   in `develop`.
+   For a major-minor release, this lifts the freeze on large changes in `develop`.

 ### Merging Back Into `develop`

@@ -133,7 +127,7 @@ After the merge, `git log develop..<tag>` must be empty.
 ### Emergency Fixes From `develop`

 If a commit was merged to `develop`
-and needs to be included in a release after the [code freeze](#release-candidates):
+and needs to be included in a release after the code freeze:

 1. Create a PR that cherry-picks the commit onto `staging/X.Y.x`.
 2. Leave `develop` as it is, with no reverts.
@@ -1360,39 +1360,6 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
-#   gas_limit = <gas>
-#
-#       The gas limit is the maximum amount of gas that can be
-#       consumed by a single transaction. The gas limit is used to prevent
-#       transactions from consuming too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_limit = 1000000      # 1 million gas
-#
-#   bytecode_size_limit = <bytes>
-#
-#       The bytecode size limit is the maximum size of a WASM extension in
-#       bytes. The size limit is used to prevent extensions from consuming
-#       too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           bytecode_size_limit = 100000      # 100 kb
-#
-#   gas_price = <micro-drops>
-#
-#       The gas price is the conversion between WASM gas and its price in drops.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings
@@ -9,21 +9,13 @@ include_guard(GLOBAL)
 # --------------------------------------------------------------------
 # Compiler detection (C++)
 # --------------------------------------------------------------------
-# is_any_clang is true for both LLVM Clang and AppleClang. Their version numbers
-# and feature sets differ, so use is_llvm_clang or is_apple_clang when it matters.
-set(is_any_clang FALSE)
-set(is_llvm_clang FALSE)
-set(is_apple_clang FALSE)
+set(is_clang FALSE)
 set(is_gcc FALSE)
 set(is_msvc FALSE)
 set(is_xcode FALSE)

-if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
-    set(is_any_clang TRUE)
-    set(is_llvm_clang TRUE)
-elseif(CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
-    set(is_any_clang TRUE)
-    set(is_apple_clang TRUE)
+if(CMAKE_CXX_COMPILER_ID MATCHES ".*Clang") # Clang or AppleClang
+    set(is_clang TRUE)
 elseif(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
    set(is_gcc TRUE)
 elseif(MSVC)
@@ -130,7 +130,7 @@ else()
        INTERFACE
            -Wall
            -Wdeprecated
-            $<$<BOOL:${is_any_clang}>:-Wno-deprecated-declarations>
+            $<$<BOOL:${is_clang}>:-Wno-deprecated-declarations>
            $<$<BOOL:${wextra}>:-Wextra
            -Wno-unused-parameter>
            $<$<BOOL:${werr}>:-Werror>
@@ -177,7 +177,7 @@ else()
    if(
        is_nix_compiler
        AND is_linux
-        AND is_any_clang
+        AND is_clang
        AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
    )
        string(
@@ -204,10 +204,7 @@ if(voidstar)
            "Antithesis instrumentation requires Linux, aborting..."
        )
    elseif(
-        NOT (
-            is_llvm_clang
-            AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0
-        )
+        NOT (is_clang AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 16.0)
    )
        message(
            FATAL_ERROR
@@ -275,6 +275,10 @@ if(xrpld)
    patch_nix_binary(xrpld)
    if(tests)
        target_compile_definitions(xrpld PUBLIC ENABLE_TESTS)
+        target_compile_definitions(
+            xrpld
+            PRIVATE UNIT_TEST_REFERENCE_FEE=${UNIT_TEST_REFERENCE_FEE}
+        )
    endif()
    target_include_directories(
        xrpld
@@ -292,16 +296,7 @@ if(xrpld)
        OUT_VAR rpcspec_instantiations
        VALUE_TYPE "::json::Value"
        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
-        HANDLERS
-            account_channels
-            account_currencies
-            account_info
-            account_lines
-            account_nfts
-            account_offers
-            book_changes
-            ledger
-            transaction_entry
+        HANDLERS book_changes ledger transaction_entry
    )
    target_sources(xrpld PRIVATE ${rpcspec_instantiations})

@@ -58,7 +58,7 @@ target_link_options(common INTERFACE ${sanitizers_linker_flags})
 # This module appends -fsanitize-ignorelist=<path> for Clang builds.
 # The ignorelist path contains CMAKE_SOURCE_DIR, so it must be set here, rather than in the Conan profile.
 # GCC does not support -fsanitize-ignorelist.
-if(is_any_clang)
+if(is_clang)
    set(ignorelist_path
        "${CMAKE_SOURCE_DIR}/sanitizers/suppressions/sanitizer-ignorelist.txt"
    )
@@ -23,8 +23,11 @@ if(NOT is_multiconfig)
    endif()
 endif()

-if(is_llvm_clang)
-    if(CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0)
+if(is_clang) # both Clang and AppleClang
+    if(
+        "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang"
+        AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 16.0
+    )
        message(FATAL_ERROR "This project requires clang 16 or later")
    endif()
 elseif(is_gcc)
@@ -23,6 +23,12 @@ option(assert "Enables asserts, even in release builds" OFF)
 option(xrpld "Build xrpld" ON)

 option(tests "Build tests" ON)
+if(tests)
+    # This setting allows making a separate workflow to test fees other than default 10
+    if(NOT UNIT_TEST_REFERENCE_FEE)
+        set(UNIT_TEST_REFERENCE_FEE "10" CACHE STRING "")
+    endif()
+endif()

 option(benchmark "Build benchmarks" ON)

@@ -56,11 +62,11 @@ if(unity)
    set(CMAKE_UNITY_BUILD ON CACHE BOOL "Do a unity build")
 endif()

-if(is_llvm_clang AND is_linux)
+if(is_clang AND is_linux)
    option(voidstar "Enable Antithesis instrumentation." OFF)
 endif()

-if(is_gcc OR is_any_clang)
+if(is_gcc OR is_clang)
    include(ProcessorCount)
    ProcessorCount(PROCESSOR_COUNT)

@@ -119,7 +125,7 @@ else()
    set(use_mold OFF CACHE BOOL "mold linker, linux only" FORCE)
 endif()

-if(is_any_clang)
+if(is_clang)
    option(use_lld "enables detection of lld linker" ON)
 else()
    set(use_lld OFF CACHE BOOL "try lld linker, clang only" FORCE)
@@ -7,7 +7,7 @@
 pcpp>=1.30

 # Parser combinator library - used to parse the macro DSL
-pyparsing>=3.3.3
+pyparsing>=3.0.0

 # Template engine - used to generate C++ code from templates
-Mako>=1.4.2
+Mako>=1.2.2
@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile requirements.in --generate-hashes --output-file requirements.txt
-mako==1.4.3 \
-    --hash=sha256:723296007c870bfd6b3f0c3230dba7198096e5269297ebf5e4eff9e7ffa39d4f \
-    --hash=sha256:cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a
+mako==1.3.12 \
+    --hash=sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9 \
+    --hash=sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a
    # via -r requirements.in
 markupsafe==3.0.3 \
    --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
@@ -99,7 +99,7 @@ pcpp==1.30 \
    --hash=sha256:05fe08292b6da57f385001c891a87f40d6aa7f46787b03e8ba326d20a3297c6e \
    --hash=sha256:5af9fbce55f136d7931ae915fae03c34030a3b36c496e72d9636cedc8e2543a1
    # via -r requirements.in
-pyparsing==3.3.3 \
-    --hash=sha256:928ae7e20211f3b6f3915a72f06a0cfd29ab9d24279dd6346b6b1a7146397d36 \
-    --hash=sha256:ece8c00a69cf01b45d0b1dedabb469c90d8caf996d4fda40f147627a122849a4
+pyparsing==3.3.2 \
+    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
+    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
    # via -r requirements.in
@@ -3,7 +3,7 @@
    "requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.25#2daa763e2d86ccc4ad0a0fa4d1983e9f%1791907455.579992",
+        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
        "nudb/2.0.9",
        "openssl/3.6.3",
        "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.25",
+        "xrpl-rpc-spec/0.1.21",
        "zlib/1.3.2",
    ]

@@ -57,9 +57,9 @@ dependencies = [

 [[package]]
 name = "cxx"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8a02bfeba9074b2bbb39492c9b0908ec854f455a3cccdcde7a1de55e2315e40"
+checksum = "13f6de320895f42e6e081abb5c7983bedcf0b6d0ff9323de0d33f620c8ac1199"
 dependencies = [
 "cc",
 "cxx-build",
@@ -72,9 +72,9 @@ dependencies = [

 [[package]]
 name = "cxx-build"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbc2ac76997619d2d888b58ad79488f1c835de41ca4dd3dd7082acf4ecb0a50f"
+checksum = "4fde53ca86b9704a943fef0f1e1d836239a6aedca5de3c65fa9f97ec0bd46d39"
 dependencies = [
 "cc",
 "codespan-reporting",
@@ -87,9 +87,9 @@ dependencies = [

 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a486ed16a3f2a053fe7f5b98db4c1a59846a23e8cb9e49f9d1bd48830d51a2"
+checksum = "07bae89236c811fd4d08ed3441759ac4ac98d752cbfd3de341315ba16ad20ec3"
 dependencies = [
 "clap",
 "codespan-reporting",
@@ -101,15 +101,15 @@ dependencies = [

 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c72569be94e2283764d334cd285980b747dbe221e27e315484eb6bcd93fa808a"
+checksum = "49045042e5fced01b80742aba5508de82aa4f13677ed3fa2b4cda709c40c5918"

 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "423e795284a7f7b3f843c956a5322c4bc497b60c2dd1a6339da10313cb18d575"
+checksum = "b181252e2e3d3b5d183afbdc033a3958b445eb3e1a0ae65fc3d4f5259f5da6fd"
 dependencies = [
 "indexmap",
 "proc-macro2",
@@ -4,18 +4,6 @@ This document explains how to set one up.

 [BUILD.md]: ../../BUILD.md

-## Supported development platforms
-
- **Linux**: the [Nix development shell](./nix.md),
-  which provides the same toolchain CI uses on any distribution.
- **macOS** 15 (Sequoia) or newer: the [Nix development shell](./nix.md),
-  or the system [Apple Clang](#macos-apple-clang).
-  CI runs on macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
- **Windows**: best effort, see [Windows](#windows).
-
-For the platforms supported for running `xrpld`,
-see [Requirements](../install.md#requirements).
-
 ## Tested compiler versions

 `xrpld` is built in the **C++23** dialect by default, so your toolchain has to
@@ -47,16 +35,20 @@ compiler building. Treat support for anything outside the table as best-effort.

 ## Required tools

-Besides a compiler, building `xrpld` requires
-[Git](https://git-scm.com/downloads),
-[Python](https://www.python.org/downloads/),
-[Conan](https://conan.io/downloads.html),
-and [CMake](https://cmake.org/download/).
-Building with `-Drust=ON` additionally requires a Rust toolchain,
-see [Rust](#rust).
+Besides a compiler, building `xrpld` requires:
+
+| Tool                                        | Minimum version |
+| ------------------------------------------- | --------------- |
+| [Git](https://git-scm.com/downloads)        | any recent      |
+| [Python](https://www.python.org/downloads/) | 3.11            |
+| [Conan](https://conan.io/downloads.html)    | 2.17            |
+| [CMake](https://cmake.org/download/)        | 3.16            |

 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
-at the versions CI uses, recorded in [`nix/check-tools/`](../../nix/check-tools).
+(see below). On Windows they have to be installed manually.
+
+Building with `-Drust=ON` additionally requires a Rust toolchain, see
+[Rust](#rust). A default build does not, so it is not in the table above.

 Once they are in place, verify that everything is installed and runnable with:

@@ -66,19 +58,60 @@ Once they are in place, verify that everything is installed and runnable with:

 ## Linux and macOS

-Use the [Nix development shell](./nix.md):
-it provides the compiler and every tool CI uses,
-without installing anything system-wide.
+The **recommended way** to get a development environment on Linux and macOS is
+the Nix development shell. It provides the exact tooling used in CI — `git`,
+`python`, `conan`, `cmake`, `clang-tidy`, `clang-format`, and everything else —
+with a single command and without installing anything system-wide:

-### macOS: Apple Clang
+```bash
+nix --experimental-features 'nix-command flakes' develop
+```

-You can also build with the system Apple Clang,
-installing the other [required tools](#required-tools) any way you like
-(or getting them from `nix develop .#apple-clang`).
-Its version is whatever your installed Xcode (or Command Line Tools) provides,
-so check that `clang --version` is at least the [tested one](#tested-compiler-versions).
-If several Xcode versions are installed,
-select one with `sudo xcode-select -s <path>` or the `DEVELOPER_DIR` environment variable.
+On **Linux**, Nix also provides the compiler (GCC); on **macOS**, it provides
+Clang. If you instead opt to use your system-wide Apple Clang (via
+`nix develop .#apple-clang`), you need to manage its version yourself (see
+below).
+
+See [Using the Nix development shell](./nix.md) for installation and usage
+details, including how to select a different compiler and why we recommend Nix
+over a hand-maintained environment.
+
+### macOS: managing the Apple Clang version
+
+If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
+the compiler version is whatever your installed Xcode (or Command Line Tools)
+provides. The following command should return a version greater than or equal to
+the [tested one](#tested-compiler-versions):
+
+```bash
+clang --version
+```
+
+If you develop other applications using Xcode, you might be consistently
+updating to the newest version of Apple Clang, which will likely cause issues
+building xrpld. You may want to install and pin a specific version of Xcode:
+
+1. **Download Xcode**
+   - Visit [Apple Developer Downloads](https://developer.apple.com/download/more/)
+   - Sign in with your Apple Developer account
+   - Search for an Xcode version that includes the expected Apple Clang version
+   - Download the `.xip` file
+
+2. **Install and configure Xcode**
+
+   ```bash
+   # Extract the .xip file and rename for version management
+   # Example: Xcode_16.2.app
+
+   # Move to Applications directory
+   sudo mv Xcode_16.2.app /Applications/
+
+   # Set as default toolchain (persistent)
+   sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+
+   # Set as environment variable (temporary)
+   export DEVELOPER_DIR=/Applications/Xcode_16.2.app/Contents/Developer
+   ```

 ## Windows

@@ -90,7 +123,8 @@ manually:
  "x64 Native Tools Command Prompt". CI configures CMake with the
  `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
- recent releases of Python, Conan, and CMake
+- Python, Conan, and CMake, at the versions listed in
+  [Required tools](#required-tools).
 - a [Rust toolchain](https://rustup.rs) — only needed to build with
  `-Drust=ON`, see [Rust](#rust)

@@ -111,5 +145,16 @@ version.
 Everything else the Rust build needs on the CMake side comes from Conan along
 with the rest of the dependencies, so there is nothing further to install.

+## Clang-tidy
+
+`clang-tidy` is required to run static analysis checks locally (see
+[CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
+project. The version this project uses is listed in
+[Tested compiler versions](#tested-compiler-versions).
+
+On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
+version out of the box — run it via `run-clang-tidy`. No separate installation
+is needed.
+
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [packages.nix]: ../../nix/packages.nix
@@ -9,7 +9,9 @@ This guide explains how to use Nix to set up a reproducible development environm
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
 - **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
+- **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
+- **Works on Linux and macOS**: Consistent experience across platforms

 ## Install Nix

@@ -25,8 +27,13 @@ From the root of the xrpld repository, enter the default development shell:
 nix --experimental-features 'nix-command flakes' develop
 ```

-This downloads and sets up all required development tools (CMake, Ninja, Conan, etc.)
-and the compiler for your platform (see [Platform notes](#platform-notes)).
+This will:
+
+- Download and set up all required development tools (CMake, Ninja, Conan, etc.)
+- Configure the appropriate compiler for your platform:
+  - **Linux**: GCC (provided by Nix)
+  - **macOS**: Clang (provided by Nix)
+
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.

 ### Platform notes
@@ -10,19 +10,6 @@ and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
 where `yum` is a symlink to `dnf`.
 To build from source instead, see [BUILD.md](../BUILD.md).

-## Requirements
-
-Linux is the only operating system officially supported for running `xrpld`;
-macOS and Windows builds are for development only.
-
-Any x86-64 Linux distribution with APT or DNF and glibc 2.31 or newer should work
-(see [How libc is handled](../nix/docker/README.md#how-libc-is-handled)).
-CI tests the packages on Debian 11–13, Ubuntu 20.04–26.04,
-RHEL (UBI) 9–10, AlmaLinux 9–10, and Rocky Linux 9–10.
-
-For the hardware needed to run a node,
-see [System Requirements](https://xrpl.org/system-requirements.html).
-
 ## Release channels

 Packages are published to four channels:
@@ -34,7 +34,7 @@ lz4Compress(void const* in, std::size_t inSize, BufferFactory&& bf)
    // data
    auto compressed = bf(outCapacity);

-    auto const compressedSize = LZ4_compress_default(
+    auto compressedSize = LZ4_compress_default(
        reinterpret_cast<char const*>(in),
        reinterpret_cast<char*>(compressed),
        inSize,
@@ -20,14 +20,12 @@ SharedIntrusive<T>::SharedIntrusive(T* p, TAdoptTag) noexcept : ptr_{p}

 template <class T>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive const& rhs)
-    : ptr_{
-          [&] {
-              auto p = rhs.unsafeGetRawPtr();
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = rhs.unsafeGetRawPtr();
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -35,14 +33,12 @@ template <class T>
 template <class TT>
    requires std::convertible_to<TT*, T*>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = rhs.unsafeGetRawPtr();
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = rhs.unsafeGetRawPtr();
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -144,14 +140,12 @@ SharedIntrusive<T>::~SharedIntrusive()
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -165,14 +159,12 @@ SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusiv
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }

@@ -268,7 +260,7 @@ SharedIntrusive<T>::unsafeReleaseAndStore(T* next)
        return;

    using enum ReleaseStrongRefAction;
-    auto const action = prev->releaseStrongRef();
+    auto action = prev->releaseStrongRef();
    switch (action)
    {
        case NoOp:
@@ -369,7 +361,7 @@ WeakIntrusive<T>::unsafeReleaseNoStore()
        return;

    using enum ReleaseWeakRefAction;
-    auto const action = ptr_->releaseWeakRef();
+    auto action = ptr_->releaseWeakRef();
    switch (action)
    {
        case NoOp:
@@ -588,7 +580,7 @@ SharedWeakUnion<T>::convertToStrong()
    auto p = unsafeGetRawPtr();
    if (p && p->checkoutStrongRefFromWeak())
    {
-        [[maybe_unused]] auto const action = p->releaseWeakRef();
+        [[maybe_unused]] auto action = p->releaseWeakRef();
        XRPL_ASSERT(
            (action == ReleaseWeakRefAction::NoOp),
            "xrpl::SharedWeakUnion::convertToStrong : "
@@ -611,7 +603,7 @@ SharedWeakUnion<T>::convertToWeak()
        return false;

    using enum ReleaseStrongRefAction;
-    auto const action = p->addWeakReleaseStrongRef();
+    auto action = p->addWeakReleaseStrongRef();
    switch (action)
    {
        case NoOp:
@@ -678,7 +670,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
    if (isStrong())
    {
        using enum ReleaseStrongRefAction;
-        auto const strongAction = p->releaseStrongRef();
+        auto strongAction = p->releaseStrongRef();
        switch (strongAction)
        {
            case NoOp:
@@ -696,7 +688,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
    else
    {
        using enum ReleaseWeakRefAction;
-        auto const weakAction = p->releaseWeakRef();
+        auto weakAction = p->releaseWeakRef();
        switch (weakAction)
        {
            case NoOp:
@@ -406,10 +406,10 @@ IntrusiveRefCounts::useCount() const noexcept
 inline IntrusiveRefCounts::~IntrusiveRefCounts() noexcept
 {
 #ifndef NDEBUG
-    auto const v = refCounts_.load(std::memory_order_acquire);
+    auto v = refCounts_.load(std::memory_order_acquire);
    XRPL_ASSERT(
        (!(v & kValueMask)), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : count must be zero");
-    auto const t = v & kTagMask;
+    auto t = v & kTagMask;
    XRPL_ASSERT((!t || t == kTagMask), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : valid tag");
 #endif
 }
@@ -39,31 +39,6 @@ checkedSub(std::int64_t a, std::int64_t b) noexcept
    return a - b;
 }

-/**
- * Multiply two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical product is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedMul(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if (a == 0 || b == 0)
-        return 0;
-
-    if (a > 0)
-    {
-        if (b > 0 ? a > L::max() / b : b < L::min() / a)
-            return std::nullopt;
-    }
-    else if (b > 0 ? a < L::min() / b : b < L::max() / a)
-    {
-        return std::nullopt;
-    }
-
-    return a * b;
-}
-
 static_assert(checkedAdd(0, 0) == 0);
 static_assert(checkedAdd(1, -1) == 0);
 static_assert(checkedAdd(-5, 2) == -3);
@@ -106,53 +81,6 @@ static_assert(
    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
         .has_value());

-static_assert(checkedMul(0, std::numeric_limits<std::int64_t>::min()) == 0);
-static_assert(checkedMul(std::numeric_limits<std::int64_t>::min(), 0) == 0);
-static_assert(checkedMul(-1, -1) == 1);
-// a > 0, b > 0
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::max(), 1) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::max() / 2, 2) ==
-    std::numeric_limits<std::int64_t>::max() - 1);
-static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, 2).has_value());
-static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::max() / 2) + 1).has_value());
-// a > 0, b < 0
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::max(), -1) ==
-    -std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 1, -2) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(!checkedMul((std::numeric_limits<std::int64_t>::max() / 2) + 2, -2).has_value());
-static_assert(
-    checkedMul(1, std::numeric_limits<std::int64_t>::min()) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedMul(2, std::numeric_limits<std::int64_t>::min() / 2) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(!checkedMul(2, (std::numeric_limits<std::int64_t>::min() / 2) - 1).has_value());
-// a < 0, b > 0
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::min(), 1) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedMul(std::numeric_limits<std::int64_t>::min() / 2, 2) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(!checkedMul((std::numeric_limits<std::int64_t>::min() / 2) - 1, 2).has_value());
-static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), 2).has_value());
-// a < 0, b < 0
-static_assert(
-    checkedMul(-(std::numeric_limits<std::int64_t>::max() / 2), -2) ==
-    std::numeric_limits<std::int64_t>::max() - 1);
-static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min() / 2, -2).has_value());
-static_assert(
-    checkedMul(-1, -std::numeric_limits<std::int64_t>::max()) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(!checkedMul(std::numeric_limits<std::int64_t>::min(), -1).has_value());
-static_assert(!checkedMul(-1, std::numeric_limits<std::int64_t>::min()).has_value());
-
 /**
 * Calculate one number divided by another number in percentage.
 * The result is rounded up to the next integer, and capped in the range [0,100]
@@ -352,9 +352,9 @@ class Number final
    using rep = std::int64_t;
    using InternalRep = MantissaRange::rep;

+    bool negative_{false};
    InternalRep mantissa_{0};
    int exponent_{std::numeric_limits<int>::lowest()};
-    bool negative_{false};

 public:
    // The range for the exponent when normalized
@@ -650,12 +650,8 @@ private:
    shiftExponent(int exponentDelta) const;
 };

-// The number class currently has 3 tail padding bytes. If you are adding new
-// members, try to fit them there before expanding the size of the class.
-static_assert(sizeof(Number) == 16);
-
 constexpr Number::Number(bool negative, InternalRep mantissa, int exponent, Unchecked) noexcept
-    : mantissa_{mantissa}, exponent_{exponent}, negative_(negative)
+    : negative_(negative), mantissa_{mantissa}, exponent_{exponent}
 {
 }

@@ -340,7 +340,7 @@ public:

        for (auto const& c : cfg)
        {
-            auto const& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);
+            auto& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);

            if (a.size() > maxSize_)
                maxSize_ = a.size();
@@ -153,24 +153,6 @@ private:
        Policy policy,
        Callback&& replaceCallback = nullptr);

-    /**
-     * canonicalizeImpl variant for callers that already hold `mutex_`.
-     *
-     * The unnamed `scoped_lock<MutexType> const&` parameter is proof of
-     * ownership; this overload does not acquire the lock. Use it from other
-     * methods (e.g. fetchAndModify) that need to compose canonicalize with
-     * additional work under a single critical section, without relying on
-     * recursive-mutex re-entry.
-     */
-    template <class Policy, class Callback = std::nullptr_t>
-    bool
-    canonicalizeImpl(
-        std::scoped_lock<MutexType> const&,
-        key_type const& key,
-        CanonicalizeClientPointerType<Policy> data,
-        Policy policy,
-        Callback&& replaceCallback = nullptr);
-
 public:
    /**
     * Replace aliased objects with originals.
@@ -257,6 +239,9 @@ public:
    bool
    retrieve(key_type const& key, T& data);

+    MutexType&
+    peekMutex();
+
    std::vector<key_type>
    getKeys() const;

@@ -278,22 +263,6 @@ public:
    fetch(key_type const& digest, Handler const& h);
    // End CachedSLEs functions.

-    /**
-     * Fetch or create an entry and execute a callback while holding the lock.
-     *
-     * The entry for the given key is fetched from the cache or created if it
-     * doesn't exist. The callback is then invoked with a reference to the
-     * entry while the cache mutex is still held, allowing safe modification
-     * of the cached object.
-     *
-     * @param key The key to fetch or create
-     * @param callback Function to call with the entry under lock.
-     *                 Signature: void(T&)
-     */
-    template <class Callback>
-    void
-    fetchAndModify(key_type const& key, Callback&& callback);
-
 private:
    SharedPointerType
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l);
@@ -4,7 +4,6 @@
 #include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/scope.h>
-#include <xrpl/beast/utility/instrumentation.h>

 #include <algorithm>

@@ -301,7 +300,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // Remove from cache, if !valid, remove from map too. Returns true if removed from cache
    std::scoped_lock const lock(mutex_);

-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);

    if (cit == cache_.end())
        return false;
@@ -336,29 +335,6 @@ template <class Policy, class Callback>
 inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    canonicalizeImpl(
-        key_type const& key,
-        CanonicalizeClientPointerType<Policy> data,
-        Policy policy,
-        Callback&& replaceCallback)
-{
-    std::scoped_lock<MutexType> const lock(mutex_);
-    return canonicalizeImpl(lock, key, data, policy, std::forward<Callback>(replaceCallback));
-}
-
-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-template <class Policy, class Callback>
-inline bool
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    canonicalizeImpl(
-        std::scoped_lock<MutexType> const&,
        key_type const& key,
        CanonicalizeClientPointerType<Policy> data,
        [[maybe_unused]] Policy policy,
@@ -378,7 +354,9 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    // passing a const argument is a compile error.
    constexpr bool replaceCached = std::is_same_v<Policy, detail::ReplaceCached>;

-    auto const cit = cache_.find(key);
+    std::scoped_lock const lock(mutex_);
+
+    auto cit = cache_.find(key);

    if (cit == cache_.end())
    {
@@ -393,7 +371,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    Entry& entry = cit->second;
    entry.touch(clock_.now());

-    auto const shouldReplaceCached = [&] {
+    auto shouldReplaceCached = [&] {
        if constexpr (replaceCached)
        {
            return true;
@@ -422,7 +400,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
        return true;
    }

-    auto const cachedData = entry.lock();
+    auto cachedData = entry.lock();

    if (cachedData)
    {
@@ -585,7 +563,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    retrieve(key_type const& key, T& data)
 {
    // retrieve the value of the stored data
-    auto const entry = fetch(key);
+    auto entry = fetch(key);

    if (!entry)
        return false;
@@ -594,6 +572,22 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
    return true;
 }

+template <
+    class Key,
+    class T,
+    bool IsKeyCache,
+    class SharedWeakUnionPointer,
+    class SharedPointerType,
+    class Hash,
+    class KeyEqual,
+    class Mutex>
+inline auto
+TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
+    peekMutex() -> MutexType&
+{
+    return mutex_;
+}
+
 template <
    class Key,
    class T,
@@ -693,7 +687,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
            return ret;
    }

-    auto const sle = h();
+    auto sle = h();
    if (!sle)
        return {};

@@ -706,49 +700,6 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 }
 // End CachedSLEs functions.

-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-template <class Callback>
-inline void
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    fetchAndModify(key_type const& key, Callback&& callback)
-{
-    static_assert(
-        !IsKeyCache, "fetchAndModify is only supported for value caches, not key-only caches");
-    static_assert(
-        std::is_same_v<std::shared_ptr<T>, SharedPointerType> ||
-            std::is_same_v<intr_ptr::SharedPtr<T>, SharedPointerType>,
-        "fetchAndModify requires std::shared_ptr<T> or intr_ptr::SharedPtr<T>");
-
-    std::scoped_lock<MutexType> const lock(mutex_);
-
-    // Same pointer-type dispatch as insert(): the placeholder must have exactly
-    // SharedPointerType so canonicalizeImpl can write the cached pointer back.
-    SharedPointerType entry = [] {
-        if constexpr (std::is_same_v<std::shared_ptr<T>, SharedPointerType>)
-        {
-            return std::make_shared<T>();
-        }
-        else
-        {
-            return intr_ptr::makeShared<T>();
-        }
-    }();
-    canonicalizeImpl(lock, key, entry, detail::ReplaceClient{});
-
-    ALWAYS(
-        entry != nullptr, "xrpl::TaggedCache::fetchAndModify : entry present after canonicalize");
-
-    callback(*entry);
-}
-
 template <
    class Key,
    class T,
@@ -762,7 +713,7 @@ inline SharedPointerType
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
    initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l)
 {
-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);
    if (cit == cache_.end())
        return {};

@@ -195,8 +195,7 @@ private:
    {
        // Local lambda that converts a single hex char to four bits and
        // ORs those bits into a uint32_t.
-        auto const hexCharToUInt =
-            [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
+        auto hexCharToUInt = [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
            std::uint32_t nibble = 0xFFu;
            if (c < '0' || c > 'f')
                return ParseResult::BadChar;
@@ -454,7 +453,7 @@ public:
    {
        for (int i = kWidth - 1; i >= 0; --i)
        {
-            auto const prev = data_[i];
+            auto prev = data_[i];
            data_[i] = boost::endian::native_to_big(boost::endian::big_to_native(data_[i]) - 1);

            if (prev != 0)
@@ -365,7 +365,7 @@ public:
    size() const
    {
        std::size_t ret = 0;
-        for (auto const& p : map_)
+        for (auto& p : map_)
            ret += p.size();
        return ret;
    }
@@ -2536,7 +2536,7 @@ AgedUnorderedContainer<IsMulti, IsMap, Key, T, Clock, Hash, KeyEqual, Allocator>
        return false;
    for (auto iter(cbegin()), last(cend()), otherLast(other.cend()); iter != last; ++iter)
    {
-        auto const otherIter(other.find(extract(*iter)));
+        auto otherIter(other.find(extract(*iter)));
        if (otherIter == otherLast)
            return false;
    }
@@ -68,7 +68,7 @@ struct LexicalCast<Out, std::string_view>
        if (first != last && *first == '+')
            ++first;

-        auto const ret = std::from_chars(first, last, out);
+        auto ret = std::from_chars(first, last, out);

        return ret.ec == std::errc() && ret.ptr == last;
    }
@@ -83,7 +83,7 @@ trimRight(String const& s)
 {
    using std::begin;
    using std::end;
-    auto const first(begin(s));
+    auto first(begin(s));
    auto last(end(s));
    last = trimRight(first, last);
    return {first, last};
@@ -32,7 +32,7 @@ public:
        Module,

        // Match nothing (used internally)
-        None,
+        None
    };

 private:
@@ -9,7 +9,6 @@
 #include <boost/assert.hpp>

 #include <mutex>
-#include <optional>
 #include <string>

 namespace beast::unit_test {
@@ -23,7 +22,6 @@ namespace beast::unit_test {
 class Runner
 {
    std::string arg_;
-    std::optional<std::int64_t> referenceFee_;
    bool default_ = false;
    bool failed_ = false;
    bool cond_ = false;
@@ -59,26 +57,6 @@ public:
        return arg_;
    }

-    /**
-     * Set the reference fee (in drops) for tests.
-     *
-     * If provided, this value is used in every suite that does not override it.
-     */
-    void
-    referenceFee(std::int64_t fee)
-    {
-        referenceFee_ = fee;
-    }
-
-    /**
-     * Returns the reference fee, if any.
-     */
-    [[nodiscard]] std::optional<std::int64_t> const&
-    referenceFee() const
-    {
-        return referenceFee_;
-    }
-
    /**
     * Run the specified suite.
     * @return `true` if any conditions failed.
@@ -308,18 +308,6 @@ protected:
    }

 public:
-    /**
-     * Return the reference fee associated with the runner.
-     */
-    std::optional<std::int64_t>
-    referenceFee() const
-    {
-        assert(runner_);
-        if (runner_ == nullptr)
-            return {};
-        return runner_->referenceFee();
-    }
-
    /**
     * DEPRECATED
     * @return `true` if the test condition indicates success(a false value)
@@ -24,7 +24,7 @@ enum class Severity : std::uint8_t {
    Fatal = 5,

    Disabled = 6,
-    None = Disabled,
+    None = Disabled
 };

 /**
@@ -18,7 +18,7 @@ enum class Type : std::uint8_t {
    PrefixSha256 = 1,
    ThresholdSha256 = 2,
    RsaSha256 = 3,
-    Ed25519Sha256 = 4,
+    Ed25519Sha256 = 4
 };

 class Condition
@@ -49,7 +49,7 @@ public:

        using namespace der;

-        auto const p = parsePreamble(s, ec);
+        auto p = parsePreamble(s, ec);
        if (ec)
            return nullptr;

@@ -21,7 +21,7 @@ enum class Error {
    UnexpectedTag,
    LongTag,
    LargeSize,
-    PreimageTooLong,
+    PreimageTooLong
 };

 std::error_code
@@ -396,7 +396,7 @@ inline bool
 getIfExists<bool>(Section const& section, std::string const& name, bool& v)
 {
    int intVal = 0;
-    auto const stat = getIfExists(section, name, intVal);
+    auto stat = getIfExists(section, name, intVal);
    if (stat)
        v = bool(intVal);
    return stat;
@@ -94,7 +94,6 @@ struct Keys
    static constexpr auto kBbtOptions = "bbt_options";
    static constexpr auto kBgThreads = "bg_threads";
    static constexpr auto kBlockSize = "block_size";
-    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
    static constexpr auto kCacheAge = "cache_age";
    static constexpr auto kCacheMb = "cache_mb";
    static constexpr auto kCacheSize = "cache_size";
@@ -109,8 +108,6 @@ struct Keys
    static constexpr auto kFileSizeMult = "file_size_mult";
    static constexpr auto kFilterBits = "filter_bits";
    static constexpr auto kFilterFull = "filter_full";
-    static constexpr auto kGasLimit = "gas_limit";
-    static constexpr auto kGasPrice = "gas_price";
    static constexpr auto kHardSet = "hard_set";
    static constexpr auto kHighThreads = "high_threads";
    static constexpr auto kHoldTime = "hold_time";
@@ -93,14 +93,14 @@ public:
    void
    check(std::vector<TxID> accepted, Predicate&& pred)
    {
-        auto const acceptTxid = accepted.begin();
+        auto acceptTxid = accepted.begin();
        auto const ae = accepted.end();
        std::sort(acceptTxid, ae);

        // We want to remove all tracking entries for transactions that were
        // accepted as well as those which match the predicate.

-        auto const i = removeIfIntersectOrMatch(
+        auto i = removeIfIntersectOrMatch(
            tracker_.begin(),
            tracker_.end(),
            accepted.begin(),
@@ -779,7 +779,7 @@ Consensus<Adaptor>::peerProposalInternal(

    {
        // update current position
-        auto const peerPosIt = currPeerPositions_.find(peerID);
+        auto peerPosIt = currPeerPositions_.find(peerID);

        if (peerPosIt != currPeerPositions_.end())
        {
@@ -1110,7 +1110,7 @@ Consensus<Adaptor>::checkLedger(std::unique_ptr<std::stringstream> const& clog)
 {
    CLOG(clog) << "checkLedger. ";

-    auto const netLgr = adaptor_.getPrevLedger(prevLedgerID_, previousLedger_, mode_.get());
+    auto netLgr = adaptor_.getPrevLedger(prevLedgerID_, previousLedger_, mode_.get());
    CLOG(clog) << "network ledgerid " << netLgr << ",  "
               << "previous ledger " << prevLedgerID_ << ". ";

@@ -1159,8 +1159,8 @@ Consensus<Adaptor>::phaseOpen(std::unique_ptr<std::stringstream> const& clog)

    // it is shortly before ledger close time
    bool const anyTransactions = adaptor_.hasOpenTransactions();
-    auto const proposersClosed = currPeerPositions_.size();
-    auto const proposersValidated = adaptor_.proposersValidated(prevLedgerID_);
+    auto proposersClosed = currPeerPositions_.size();
+    auto proposersValidated = adaptor_.proposersValidated(prevLedgerID_);

    openTime_.tick(clock_.now());

@@ -1669,7 +1669,7 @@ Consensus<Adaptor>::haveConsensus(std::unique_ptr<std::stringstream> const& clog
    // CHECKME: should possibly count unacquired TX sets as disagreeing
    int agree = 0, disagree = 0;

-    auto const ourPosition = result_->position.position();
+    auto ourPosition = result_->position.position();

    // Count number of agreements/disagreements with our position
    for (auto const& [nodeId, peerPos] : currPeerPositions_)
@@ -1686,7 +1686,7 @@ Consensus<Adaptor>::haveConsensus(std::unique_ptr<std::stringstream> const& clog
            ++disagree;
        }
    }
-    auto const currentFinished = adaptor_.proposersFinished(previousLedger_, prevLedgerID_);
+    auto currentFinished = adaptor_.proposersFinished(previousLedger_, prevLedgerID_);

    JLOG(j_.debug()) << "Checking for TX consensus: agree=" << agree << ", disagree=" << disagree;

@@ -1812,7 +1812,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
               << ". ";
    JLOG(j_.debug()) << "createDisputes " << result_->txns.id() << " to " << o.id();

-    auto const differences = result_->txns.compare(o);
+    auto differences = result_->txns.compare(o);

    int dc = 0;

@@ -1826,7 +1826,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
            "xrpl::Consensus::createDisputes : has disputed transactions");

        TxT const tx = inThisSet ? result_->txns.find(txId) : o.find(txId);
-        auto const txID = tx.id();
+        auto txID = tx.id();

        if (result_->disputes.find(txID) != result_->disputes.end())
            continue;
@@ -1837,8 +1837,7 @@ Consensus<Adaptor>::createDisputes(TxSetT const& o, std::unique_ptr<std::strings
            tx,
            result_->txns.exists(txID),
            std::max(prevProposers_, currPeerPositions_.size()),
-            j_,
-        };
+            j_};

        // Update all of the available peer's votes on the disputed transaction
        for (auto const& [nodeId, peerPos] : currPeerPositions_)
@@ -145,26 +145,18 @@ struct ConsensusParms
    std::map<AvalancheState, AvalancheCutoff> const avalancheCutoffs{
        // {state, {time, percent, nextState}},
        // Initial state: 50% of nodes must vote yes
-        {
-            AvalancheState::Init,
-            {.consensusTime = 0, .consensusPct = 50, .next = AvalancheState::Mid},
-        },
+        {AvalancheState::Init,
+         {.consensusTime = 0, .consensusPct = 50, .next = AvalancheState::Mid}},
        // mid-consensus starts after 50% of the previous round time, and
        // requires 65% yes
-        {
-            AvalancheState::Mid,
-            {.consensusTime = 50, .consensusPct = 65, .next = AvalancheState::Late},
-        },
+        {AvalancheState::Mid,
+         {.consensusTime = 50, .consensusPct = 65, .next = AvalancheState::Late}},
        // late consensus starts after 85% time, and requires 70% yes
-        {
-            AvalancheState::Late,
-            {.consensusTime = 85, .consensusPct = 70, .next = AvalancheState::Stuck},
-        },
+        {AvalancheState::Late,
+         {.consensusTime = 85, .consensusPct = 70, .next = AvalancheState::Stuck}},
        // we're stuck after 2x time, requires 95% yes votes
-        {
-            AvalancheState::Stuck,
-            {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck},
-        },
+        {AvalancheState::Stuck,
+         {.consensusTime = 200, .consensusPct = 95, .next = AvalancheState::Stuck}},
    };

    /**
@@ -59,7 +59,7 @@ enum class ConsensusMode {
     * if we entered the round observing, but is used to indicate we did
     * have the wrongLedger at some point.
     */
-    SwitchedLedger,
+    SwitchedLedger
 };

 inline std::string
@@ -222,7 +222,7 @@ medianCloseOffset(ConsensusCloseTimes const& times)

    // Accumulate weight in time order; the first bin to reach halfWeight is
    // the (lower) weighted median. Returns true once that bin is found.
-    auto const step = [&](time_point t, std::int64_t w) {
+    auto step = [&](time_point t, std::int64_t w) {
        XRPL_ASSERT(tally < halfWeight, "xrpl::medianCloseOffset::step : median not yet found");
        tally += w;
        if (tally >= halfWeight)
@@ -267,7 +267,7 @@ enum class ConsensusState {
    No,       ///< We do not have consensus
    MovedOn,  ///< The network has consensus without us
    Expired,  ///< Consensus time limit has hard-expired
-    Yes,      ///< We have consensus along with the network
+    Yes       ///< We have consensus along with the network
 };

 /**
@@ -266,7 +266,7 @@ template <class Tx, class NodeId>
 void
 DisputedTx<Tx, NodeId>::unVote(NodeId const& peer)
 {
-    auto const it = votes_.find(peer);
+    auto it = votes_.find(peer);

    if (it != votes_.end())
    {
@@ -211,7 +211,7 @@ struct Node
    void
    erase(Node const* child)
    {
-        auto const it = std::ranges::find_if(
+        auto it = std::ranges::find_if(
            children, [child](std::unique_ptr<Node> const& curr) { return curr.get() == child; });
        XRPL_ASSERT(it != children.end(), "xrpl::Node::erase : valid input");
        std::swap(*it, children.back());
@@ -184,7 +184,7 @@ enum class ValStatus {
    /**
     * Multiple validations by a validator for different ledgers
     */
-    Conflicting,
+    Conflicting
 };

 inline std::string
@@ -366,7 +366,7 @@ private:
    removeTrie(std::scoped_lock<Mutex> const&, NodeID const& nodeID, Validation const& val)
    {
        {
-            auto const it = acquiring_.find(std::make_pair(val.seq(), val.ledgerID()));
+            auto it = acquiring_.find(std::make_pair(val.seq(), val.ledgerID()));
            if (it != acquiring_.end())
            {
                it->second.erase(nodeID);
@@ -375,7 +375,7 @@ private:
            }
        }
        {
-            auto const it = lastLedger_.find(nodeID);
+            auto it = lastLedger_.find(nodeID);
            if (it != lastLedger_.end() && it->second.id() == val.ledgerID())
            {
                trie_.remove(it->second);
@@ -443,7 +443,7 @@ private:
        // Clear any prior acquiring ledger for this node
        if (prior)
        {
-            auto const it = acquiring_.find(*prior);
+            auto it = acquiring_.find(*prior);
            if (it != acquiring_.end())
            {
                it->second.erase(nodeID);
@@ -455,7 +455,7 @@ private:
        checkAcquired(lock);

        std::pair<Seq, ID> const valPair{val.seq(), val.ledgerID()};
-        auto const it = acquiring_.find(valPair);
+        auto it = acquiring_.find(valPair);
        if (it != acquiring_.end())
        {
            it->second.insert(nodeID);
@@ -529,7 +529,7 @@ private:
            }
            else
            {
-                auto const cit = typename decltype(current_)::const_iterator{it};
+                auto cit = typename decltype(current_)::const_iterator{it};
                // contains a live record
                f(cit->first, cit->second);
                ++it;
@@ -554,7 +554,7 @@ private:
    void
    byLedger(std::scoped_lock<Mutex> const&, ID const& ledgerID, Pre&& pre, F&& f)
    {
-        auto const it = byLedger_.find(ledgerID);
+        auto it = byLedger_.find(ledgerID);
        if (it != byLedger_.end())
        {
            // Update set time since it is being used
@@ -857,7 +857,7 @@ public:
        if (!preferred)
        {
            // fall back to majority over acquiring ledgers
-            auto const it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
+            auto it = std::ranges::max_element(acquiring_, [](auto const& a, auto const& b) {
                std::pair<Seq, ID> const& aKey = a.first;
                typename HashSet<NodeID>::size_type const& aSize = a.second.size();
                std::pair<Seq, ID> const& bKey = b.first;
@@ -937,7 +937,7 @@ public:
            return (preferred->first >= minSeq) ? preferred->second : lcl.id();

        // Otherwise, rely on peer ledgers
-        auto const it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
+        auto it = std::ranges::max_element(peerCounts, [](auto const& a, auto const& b) {
            // Prefer larger counts, then larger ids on ties
            // (max_element expects this to return true if a < b)
            return std::tie(a.second, a.first) < std::tie(b.second, b.first);
@@ -156,7 +156,7 @@ public:
        {
            if (!allClosuresDoneCond_.wait_for(lock, wait, [this] { return closureCount_ == 0; }))
            {
-                if (auto const stream = j.error())
+                if (auto stream = j.error())
                    stream << name << " waiting for ClosureCounter::join().";
                allClosuresDoneCond_.wait(lock, [this] { return closureCount_ == 0; });
            }
@@ -37,7 +37,7 @@ enum class HashRouterFlags : std::uint16_t {
    PRIVATE6 = 0x2000,
    // Used in apply.cpp
    PRIVATE7 = 0x4000,
-    PRIVATE8 = 0x8000,
+    PRIVATE8 = 0x8000
 };

 constexpr HashRouterFlags
@@ -30,12 +30,12 @@ private:
        using namespace std::chrono_literals;
        int const maxLimit = std::numeric_limits<int>::max();

-        auto const add = [this](
-                             JobType jt,
-                             std::string name,
-                             int limit,
-                             std::chrono::milliseconds avgLatency,
-                             std::chrono::milliseconds peakLatency) {
+        auto add = [this](
+                       JobType jt,
+                       std::string name,
+                       int limit,
+                       std::chrono::milliseconds avgLatency,
+                       std::chrono::milliseconds peakLatency) {
            XRPL_ASSERT(!map.contains(jt), "xrpl::JobTypes::JobTypes::add : unique job type input");

            [[maybe_unused]] auto const inserted =
@@ -177,13 +177,12 @@ measureDurationAndLog(
    std::chrono::duration<Rep, Period> maxDelay,
    beast::Journal const& journal)
 {
-    auto const startTime = std::chrono::high_resolution_clock::now();
+    auto startTime = std::chrono::high_resolution_clock::now();

    auto result = func();

-    auto const endTime = std::chrono::high_resolution_clock::now();
-    auto const duration =
-        std::chrono::duration_cast<std::chrono::milliseconds>(endTime - startTime);
+    auto endTime = std::chrono::high_resolution_clock::now();
+    auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(endTime - startTime);
    if (duration > maxDelay)
    {
        JLOG(journal.warn()) << actionDescription << " took " << duration.count() << " ms";
@@ -95,7 +95,7 @@ private:
        ArraySeparator,
        MemberSeparator,
        Comment,
-        Error,
+        Error
    };

    class Token
@@ -26,7 +26,7 @@ enum class ValueType {
    String,    ///< UTF-8 string value
    Boolean,   ///< bool value
    Array,     ///< array value (ordered list)
-    Object,    ///< object value (collection of name/value pairs).
+    Object     ///< object value (collection of name/value pairs).
 };

 /**
@@ -165,7 +165,7 @@ public:
        beast::Journal j)
    {
        // Ask implementation what to do
-        auto const actions = doVoting(
+        auto actions = doVoting(
            lastClosedLedger->rules(),
            lastClosedLedger->parentCloseTime(),
            getEnabledAmendments(*lastClosedLedger),
@@ -50,7 +50,7 @@ enum ApplyFlags : std::uint32_t {
    // afterward, so signature-presence checks (e.g. Batch signer matching)
    // are skipped at proposal-creation time (On-Chain Cosigner spec
    // §5.3.1.2).
-    TapProposal = 0x2000,
+    TapProposal = 0x2000
 };

 constexpr ApplyFlags
@@ -257,42 +257,13 @@ public:
        header_.validated = true;
    }

-    /**
-     * Mark this ledger as accepted and attempt to make it immutable.
-     *
-     * The close-time fields are recorded first, since the ledger hash covers
-     * them.
-     *
-     * @param closeTime The consensus-agreed close time.
-     * @param closeResolution The close time resolution.
-     * @param correctCloseTime Whether consensus agreed on the close time. If
-     *        false, kSLcfNoConsensusTime is recorded in closeFlags instead.
-     * @return What setImmutable() returned.
-     */
-    [[nodiscard]] bool
+    void
    setAccepted(
        NetClock::time_point closeTime,
        NetClock::duration closeResolution,
        bool correctCloseTime);

-    /**
-     * Mark this ledger as immutable, so it can no longer be modified.
-     *
-     * A ledger built or loaded locally cannot have an invalid map, since only
-     * a map syncing against hashes from outside can be proven impossible (see
-     * SHAMap::addKnownNode), so a caller on such a path may treat a false
-     * return as a broken internal invariant. A caller assembling a ledger from
-     * peer data may not: for it, false is an outcome a peer can produce.
-     *
-     * @param rehash Whether to recompute the ledger hash from the header
-     *        fields. The transaction and account hashes are recomputed from the
-     *        maps too, but only the first time.
-     * @return false if either map is Invalid, leaving the immutable flag as it
-     *         was and the header untouched. A map invalidated partway through can
-     *         still leave the other one immutable, so a false return means the
-     *         ledger must be discarded rather than retried.
-     */
-    [[nodiscard]] bool
+    void
    setImmutable(bool rehash = true);

    bool
@@ -301,28 +272,23 @@ public:
        return immutable_;
    }

-    /**
-     * @return Whether both maps can still be the maps the header names. See
-     *         SHAMap::isValid().
-     */
-    [[nodiscard]] bool
-    mapsValid() const
-    {
-        return txMap_.isValid() && stateMap_.isValid();
-    }
+    /*  Mark this ledger as "should be full".

-    /**
-     * Mark this ledger as "should be full", indicating that the local server
-     * wants all the corresponding nodes in durable storage.
-     *
-     * Const because it reflects metadata, not data this ledger shares with
-     * other nodes on the network.
-     */
+        "Full" is metadata property of the ledger, it indicates
+        that the local server wants all the corresponding nodes
+        in durable storage.
+
+        This is marked `const` because it reflects metadata
+        and not data that is in common with other nodes on the
+        network.
+    */
    void
    setFull() const
    {
-        txMap_.setFull(header_.seq);
-        stateMap_.setFull(header_.seq);
+        txMap_.setFull();
+        txMap_.setLedgerSeq(header_.seq);
+        stateMap_.setFull();
+        stateMap_.setLedgerSeq(header_.seq);
    }

    void
@@ -452,22 +418,6 @@ private:
    static std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>
    deserializeTxPlusMeta(SHAMapItem const& item);

-    /**
-     * Make both maps immutable.
-     *
-     * Each map is settled on its own, so neither is left mid-sync because the
-     * other refused.
-     *
-     * @return Whether both maps are immutable.
-     */
-    [[nodiscard]] bool
-    setMapsImmutable()
-    {
-        bool const txImmutable = txMap_.setImmutable();
-        bool const stateImmutable = stateMap_.setImmutable();
-        return txImmutable && stateImmutable;
-    }
-
    bool immutable_;

    // A SHAMap containing the transactions associated with this ledger.
@@ -20,8 +20,7 @@ constexpr std::chrono::seconds kLedgerPossibleTimeResolutions[] = {
    std::chrono::seconds{30},
    std::chrono::seconds{60},
    std::chrono::seconds{90},
-    std::chrono::seconds{120},
-};
+    std::chrono::seconds{120}};

 /**
 * Initial resolution of ledger close time.
@@ -35,7 +35,7 @@ public:
    {
        std::scoped_lock const lock(mutex_);

-        auto const it = map_.find(seq);
+        auto it = map_.find(seq);

        if ((it == map_.end()) || it->second)
        {
@@ -88,7 +88,7 @@ public:
        std::unique_lock<std::mutex> lock(mutex_);
        do
        {
-            auto const it = map_.find(seq);
+            auto it = map_.find(seq);

            if (it == map_.end())
            {
@@ -164,7 +164,7 @@ getCandidateLedger(LedgerIndex requested)
 areCompatible(
    ReadView const& validLedger,
    ReadView const& testLedger,
-    beast::Journal::Stream const& s,
+    beast::Journal::Stream& s,
    char const* reason);

 [[nodiscard]] bool
@@ -172,7 +172,7 @@ areCompatible(
    UInt256 const& validHash,
    LedgerIndex validIndex,
    ReadView const& testLedger,
-    beast::Journal::Stream const& s,
+    beast::Journal::Stream& s,
    char const* reason);

 //------------------------------------------------------------------------------
@@ -185,7 +185,7 @@ areCompatible(
 dirLink(
    ApplyView& view,
    AccountID const& owner,
-    SLE::pointer const& object,
+    SLE::pointer& object,
    SF_UINT64 const& node = sfOwnerNode);

 /**
@@ -265,13 +265,6 @@ canWithdraw(
 [[nodiscard]] TER
 canWithdraw(ReadView const& view, STTx const& tx);

-/**
- * Pays out a withdrawal from a vault or loan broker pseudo-account.
- *
- * `sourceAmount` leaves `sourceAcct` and `destinationAmount` reaches `dstAcct`.
- * The two differ only when the withdrawal carries a transfer fee; the
- * difference is the fee and is settled through the issuer.
- */
 [[nodiscard]] TER
 doWithdraw(
    ApplyViewContext ctx,
@@ -279,8 +272,7 @@ doWithdraw(
    AccountID const& dstAcct,
    AccountID const& sourceAcct,
    XRPAmount priorBalance,
-    STAmount const& destinationAmount,
-    STAmount const& sourceAmount,
+    STAmount const& amount,
    beast::Journal j);

 /**
@@ -30,17 +30,13 @@ public:
    static constexpr size_t kInitialBufferSize = kilobytes(256);

    RawStateTable()
-        : monotonicResource_{
-              std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
-                  kInitialBufferSize),
-          }
+        : monotonicResource_{std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
+              kInitialBufferSize)}
        , items_{monotonicResource_.get()} {};

    RawStateTable(RawStateTable const& rhs)
-        : monotonicResource_{
-              std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
-                  kInitialBufferSize),
-          }
+        : monotonicResource_{std::make_unique<boost::container::pmr::monotonic_buffer_resource>(
+              kInitialBufferSize)}
        , items_{rhs.items_, monotonicResource_.get()}
        , dropsDestroyed_{rhs.dropsDestroyed_} {};

@@ -2,6 +2,7 @@

 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/Number.h>
+#include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/ledger/ApplyView.h>
@@ -28,6 +29,7 @@
 #include <expected>
 #include <functional>
 #include <optional>
+#include <stdexcept>
 #include <tuple>
 #include <utility>

@@ -222,7 +224,7 @@ getAMMOfferStartWithTakerGets(
    if (nTakerGetsConstraint < *nTakerGets)
        nTakerGets = nTakerGetsConstraint;

-    auto const getAmounts = [&pool, &tfee](Number const& nTakerGetsProposed) {
+    auto getAmounts = [&pool, &tfee](Number const& nTakerGetsProposed) {
        // Round downward to minimize the offer and to maximize the quality.
        // This has the most impact when takerGets is integral.
        auto const takerGets =
@@ -290,7 +292,7 @@ getAMMOfferStartWithTakerPays(
    if (nTakerPaysConstraint < *nTakerPays)
        nTakerPays = nTakerPaysConstraint;

-    auto const getAmounts = [&pool, &tfee](Number const& nTakerPaysProposed) {
+    auto getAmounts = [&pool, &tfee](Number const& nTakerPaysProposed) {
        // Round downward to minimize the offer and to maximize the quality.
        // This has the most impact when takerPays is integral.
        auto const takerPays =
@@ -311,11 +313,11 @@ getAMMOfferStartWithTakerPays(
 * is equal to LOB quality (in this case AMM offer quality is
 * better than LOB quality) or AMM offer is equal to LOB quality
 * (in this case SPQ is better than LOB quality).
- * The economically coarser integral offer side is calculated first. The
- * result is rounded down, which makes the offer quality better. Calculating
- * takerPays first instead would round down takerGets when that is the coarser
- * side, giving worse quality than LOB quality, and the offer might fail to
- * generate.
+ * Pre-amendment code calculates takerPays first. If takerGets is the
+ * economically coarser integral side, it is rounded down, which results in
+ * worse offer quality than LOB quality, and the offer might fail to generate.
+ * Post-amendment code calculates the economically coarser integral offer side
+ * first. The result is rounded down, which makes the offer quality better.
 *   It might not be possible to match either SPQ or AMM offer to LOB
 * quality. This generally happens at higher fees.
 * @param pool AMM pool balances
@@ -329,8 +331,69 @@ changeSpotPriceQuality(
    TAmounts<TIn, TOut> const& pool,
    Quality const& quality,
    std::uint16_t tfee,
+    Rules const& rules,
    beast::Journal j)
 {
+    if (!rules.enabled(fixAMMv1_1))
+    {
+        // Finds takerPays (i) and takerGets (o) such that given pool
+        // composition poolGets(I) and poolPays(O): (O - o) / (I + i) = quality.
+        // Where takerGets is calculated as the swapAssetIn (see below).
+        // The above equation produces the quadratic equation:
+        // i^2*(1-fee) + i*I*(2-fee) + I^2 - I*O/quality,
+        // which is solved for i, and o is found with swapAssetIn().
+        auto const f = feeMult(tfee);  // 1 - fee
+        auto const& a = f;
+        auto const b = pool.in * (1 + f);
+        Number const c = pool.in * pool.in - pool.in * pool.out * quality.rate();
+        auto const res = b * b - 4 * a * c;
+        if (res < 0)
+        {
+            return std::nullopt;  // LCOV_EXCL_LINE
+        }
+        if (auto const nTakerPaysPropose = (-b + root2(res)) / (2 * a); nTakerPaysPropose > 0)
+        {
+            auto const nTakerPays = [&] {
+                // The fee might make the AMM offer quality less than CLOB
+                // quality. Therefore, AMM offer has to satisfy this constraint:
+                // o / i >= q. Substituting o with swapAssetIn() gives: i <= O /
+                // q - I / (1 - fee).
+                auto const nTakerPaysConstraint = pool.out * quality.rate() - pool.in / f;
+                if (nTakerPaysPropose > nTakerPaysConstraint)
+                    return nTakerPaysConstraint;
+                return nTakerPaysPropose;
+            }();
+            if (nTakerPays <= 0)
+            {
+                JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in)
+                                << " " << to_string(pool.out) << " " << quality << " " << tfee;
+                return std::nullopt;
+            }
+            auto const takerPays =
+                toAmount<TIn>(getAsset(pool.in), nTakerPays, Number::RoundingMode::Upward);
+            // should not fail
+            auto amounts = TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
+            if (Quality{amounts} < quality &&
+                !withinRelativeDistance(Quality{amounts}, quality, Number(1, -7)))
+            {
+                JLOG(j.error()) << "changeSpotPriceQuality failed: " << to_string(pool.in) << " "
+                                << to_string(pool.out) << " "
+                                << " " << quality << " " << tfee << " " << to_string(amounts.in)
+                                << " " << to_string(amounts.out);
+                Throw<std::runtime_error>("changeSpotPriceQuality failed");
+            }
+
+            JLOG(j.trace()) << "changeSpotPriceQuality succeeded: " << to_string(pool.in) << " "
+                            << to_string(pool.out) << " "
+                            << " " << quality << " " << tfee << " " << to_string(amounts.in) << " "
+                            << to_string(amounts.out);
+            return amounts;
+        }
+        JLOG(j.trace()) << "changeSpotPriceQuality calc failed: " << to_string(pool.in) << " "
+                        << to_string(pool.out) << " " << quality << " " << tfee;
+        return std::nullopt;
+    }
+
    auto amounts = [&] {
        bool const inIntegral = getAsset(pool.in).integral();
        bool const outIntegral = getAsset(pool.out).integral();
@@ -396,49 +459,57 @@ template <typename TIn, typename TOut>
 TOut
 swapAssetIn(TAmounts<TIn, TOut> const& pool, TIn const& assetIn, std::uint16_t tfee)
 {
-    // set rounding to always favor the amm. Clip to zero.
-    // calculate:
-    // pool.out -
-    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-    // and explicitly set the rounding modes
-    // Favoring the amm means we should:
-    // minimize:
-    // pool.out -
-    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-    // maximize:
-    // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
-    // (pool.in * pool.out)
-    // minimize:
-    // (pool.in + assetIn * feeMult(tfee)),
-    // minimize:
-    // assetIn * feeMult(tfee)
-    // feeMult is: (1-fee), fee is tfee/100000
-    // minimize:
-    // 1-fee
-    // maximize:
-    // fee
-    SaveNumberRoundMode const _{Number::getround()};
+    if (auto const& rules = getCurrentTransactionRules(); rules && rules->enabled(fixAMMv1_1))
+    {
+        // set rounding to always favor the amm. Clip to zero.
+        // calculate:
+        // pool.out -
+        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+        // and explicitly set the rounding modes
+        // Favoring the amm means we should:
+        // minimize:
+        // pool.out -
+        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+        // maximize:
+        // (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+        // (pool.in * pool.out)
+        // minimize:
+        // (pool.in + assetIn * feeMult(tfee)),
+        // minimize:
+        // assetIn * feeMult(tfee)
+        // feeMult is: (1-fee), fee is tfee/100000
+        // minimize:
+        // 1-fee
+        // maximize:
+        // fee
+        SaveNumberRoundMode const _{Number::getround()};

-    Number::setround(Number::RoundingMode::Upward);
-    auto const numerator = pool.in * pool.out;
-    auto const fee = getFee(tfee);
+        Number::setround(Number::RoundingMode::Upward);
+        auto const numerator = pool.in * pool.out;
+        auto const fee = getFee(tfee);

-    Number::setround(Number::RoundingMode::Downward);
-    auto const denom = pool.in + assetIn * (1 - fee);
+        Number::setround(Number::RoundingMode::Downward);
+        auto const denom = pool.in + assetIn * (1 - fee);

-    if (denom.signum() <= 0)
-        return toAmount<TOut>(getAsset(pool.out), 0);
+        if (denom.signum() <= 0)
+            return toAmount<TOut>(getAsset(pool.out), 0);

-    Number::setround(Number::RoundingMode::Upward);
-    auto const ratio = numerator / denom;
+        Number::setround(Number::RoundingMode::Upward);
+        auto const ratio = numerator / denom;

-    Number::setround(Number::RoundingMode::Downward);
-    auto const swapOut = pool.out - ratio;
+        Number::setround(Number::RoundingMode::Downward);
+        auto const swapOut = pool.out - ratio;

-    if (swapOut.signum() < 0)
-        return toAmount<TOut>(getAsset(pool.out), 0);
+        if (swapOut.signum() < 0)
+            return toAmount<TOut>(getAsset(pool.out), 0);

-    return toAmount<TOut>(getAsset(pool.out), swapOut, Number::RoundingMode::Downward);
+        return toAmount<TOut>(getAsset(pool.out), swapOut, Number::RoundingMode::Downward);
+    }
+
+    return toAmount<TOut>(
+        getAsset(pool.out),
+        pool.out - (pool.in * pool.out) / (pool.in + assetIn * feeMult(tfee)),
+        Number::RoundingMode::Downward);
 }

 /**
@@ -455,49 +526,57 @@ template <typename TIn, typename TOut>
 TIn
 swapAssetOut(TAmounts<TIn, TOut> const& pool, TOut const& assetOut, std::uint16_t tfee)
 {
-    // set rounding to always favor the amm. Clip to zero.
-    // calculate:
-    // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) /
-    // (1-tfee/100000)
-    // maximize:
-    // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in)
-    // maximize:
-    // (pool.in * pool.out) / (pool.out - assetOut)
-    // maximize:
-    // (pool.in * pool.out)
-    // minimize
-    // (pool.out - assetOut)
-    // minimize:
-    // (1-tfee/100000)
-    // maximize:
-    // tfee/100000
-
-    SaveNumberRoundMode const _{Number::getround()};
-
-    Number::setround(Number::RoundingMode::Upward);
-    auto const numerator = pool.in * pool.out;
-
-    Number::setround(Number::RoundingMode::Downward);
-    auto const denom = pool.out - assetOut;
-    if (denom.signum() <= 0)
+    if (auto const& rules = getCurrentTransactionRules(); rules && rules->enabled(fixAMMv1_1))
    {
-        return toMaxAmount<TIn>(getAsset(pool.in));
+        // set rounding to always favor the amm. Clip to zero.
+        // calculate:
+        // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) /
+        // (1-tfee/100000)
+        // maximize:
+        // ((pool.in * pool.out) / (pool.out - assetOut) - pool.in)
+        // maximize:
+        // (pool.in * pool.out) / (pool.out - assetOut)
+        // maximize:
+        // (pool.in * pool.out)
+        // minimize
+        // (pool.out - assetOut)
+        // minimize:
+        // (1-tfee/100000)
+        // maximize:
+        // tfee/100000
+
+        SaveNumberRoundMode const _{Number::getround()};
+
+        Number::setround(Number::RoundingMode::Upward);
+        auto const numerator = pool.in * pool.out;
+
+        Number::setround(Number::RoundingMode::Downward);
+        auto const denom = pool.out - assetOut;
+        if (denom.signum() <= 0)
+        {
+            return toMaxAmount<TIn>(getAsset(pool.in));
+        }
+
+        Number::setround(Number::RoundingMode::Upward);
+        auto const ratio = numerator / denom;
+        auto const numerator2 = ratio - pool.in;
+        auto const fee = getFee(tfee);
+
+        Number::setround(Number::RoundingMode::Downward);
+        auto const feeMult = 1 - fee;
+
+        Number::setround(Number::RoundingMode::Upward);
+        auto const swapIn = numerator2 / feeMult;
+        if (swapIn.signum() < 0)
+            return toAmount<TIn>(getAsset(pool.in), 0);
+
+        return toAmount<TIn>(getAsset(pool.in), swapIn, Number::RoundingMode::Upward);
    }

-    Number::setround(Number::RoundingMode::Upward);
-    auto const ratio = numerator / denom;
-    auto const numerator2 = ratio - pool.in;
-    auto const fee = getFee(tfee);
-
-    Number::setround(Number::RoundingMode::Downward);
-    auto const feeMult = 1 - fee;
-
-    Number::setround(Number::RoundingMode::Upward);
-    auto const swapIn = numerator2 / feeMult;
-    if (swapIn.signum() < 0)
-        return toAmount<TIn>(getAsset(pool.in), 0);
-
-    return toAmount<TIn>(getAsset(pool.in), swapIn, Number::RoundingMode::Upward);
+    return toAmount<TIn>(
+        getAsset(pool.in),
+        ((pool.in * pool.out) / (pool.out - assetOut) - pool.in) / feeMult(tfee),
+        Number::RoundingMode::Upward);
 }

 /**
@@ -791,8 +870,8 @@ deleteAMMAccount(Sandbox& view, Asset const& asset, Asset const& asset2, beast::
 */
 void
 initializeFeeAuctionVote(
-    ApplyView const& view,
-    SLE::pointer const& ammSle,
+    ApplyView& view,
+    SLE::pointer& ammSle,
    AccountID const& account,
    Asset const& lptAsset,
    std::uint16_t tfee);
@@ -814,7 +893,7 @@ std::expected<bool, TER>
 verifyAndAdjustLPTokenBalance(
    Sandbox& sb,
    STAmount const& lpTokens,
-    SLE::pointer const& ammSle,
+    SLE::pointer& ammSle,
    AccountID const& account);

 }  // namespace xrpl
@@ -14,7 +14,6 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
-#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
@@ -28,8 +27,6 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>

-#include <cstdint>
-
 namespace xrpl {

 /**
@@ -563,54 +560,4 @@ escrowUnlockApplyHelper<MPTIssue>(
        journal);
 }

-/**
- * Smart escrow kill switches, driven by the voted FeeSettings.
- *
- * Zeroing `bytecodeSizeLimit` stops new uploads while leaving existing escrows
- * finishable without forcing holders to wait for `CancelAfter`.
- * Zeroing `gasLimit` stops both.
- */
-/** @{ */
-inline bool
-isBytecodeUploadDisabled(Fees const& fees)
-{
-    return fees.bytecodeSizeLimit == 0 || fees.gasLimit == 0;
-}
-
-inline bool
-isBytecodeExecutionDisabled(Fees const& fees)
-{
-    return fees.gasLimit == 0;
-}
-/** @} */
-
-/**
- * Owner count an escrow costs.
- *
- *  An escrow costs one increment per started 500 bytes of bytecode, and one
- *  increment if it carries no bytecode.
- */
-template <class T>
-int32_t
-calculateAdditionalReserve(T const& finishFunction)
-{
-    static auto constexpr kBytecodeReserveIncrement = 500;
-
-    if (!finishFunction)
-        return 1;
-
-    auto const size = finishFunction->size();
-    if (size == 0)
-    {
-        // LCOV_EXCL_START
-        // Empty Bytecode is refused at create, so no escrow carries it. Ceiling
-        // division would answer 0, which would subtract less than the create added.
-        UNREACHABLE("xrpl::calculateAdditionalReserve : empty Bytecode");
-        return 1;
-        // LCOV_EXCL_STOP
-    }
-
-    return static_cast<int32_t>((size + kBytecodeReserveIncrement - 1) / kBytecodeReserveIncrement);
-}
-
 }  // namespace xrpl
@@ -7,10 +7,10 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/helpers/VaultHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/LedgerFormats.h>  // IWYU pragma: keep
+#include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STAmount.h>
@@ -31,9 +31,9 @@ namespace xrpl {
 /**
 * Broker cover preclaim precision guard (fixCleanup3_2_0).
 *
- * Prevents a silent sub-ULP no-op where a deposit, withdrawal, or clawback
- * amount is so small that it rounds to zero at sfCoverAvailable's scale.
- * Without this guard, both the pseudo trust-line and sfCoverAvailable would
+ * Prevents a "silent sub-ULP no-op" where a deposit, withdrawal, or clawback
+ * amount is so small that it rounds to zero at `sfCoverAvailable`'s scale.
+ * Without this guard, both the pseudo trust-line and `sfCoverAvailable` would
 * identically absorb the rounded zero, resulting in a successful transaction
 * (tesSUCCESS) where no funds actually moved.
 *
@@ -44,8 +44,8 @@ namespace xrpl {
 * @param j          Journal for logging.
 * @param logPrefix  Transactor name for log diagnostics.
 *
- * @return tecPRECISION_LOSS if the request rounds to zero at cover scale.
- * tesSUCCESS if the amendment is disabled or the request is safely supra-ULP.
+ * @return `tecPRECISION_LOSS` if the request rounds to zero at cover scale.
+ * `tesSUCCESS` if the amendment is disabled or the request is safely supra-ULP.
 */
 [[nodiscard]] TER
 canApplyToBrokerCover(
@@ -56,82 +56,6 @@ canApplyToBrokerCover(
    beast::Journal j,
    std::string_view logPrefix);

-namespace detail {
-
-/**
- * Return a LoanBroker's posterior live cover exponent after applying an
- * unrounded delta.
- */
-[[nodiscard]] int
-getPosteriorBrokerCoverScale(SLE::ConstRef vault, SLE::ConstRef broker, Number const& delta);
-
-/**
- * Round a cover outflow delta (cover withdraw, cover clawback, the
- * broker-side decrease of a default's cover credit) at the LoanBroker's
- * posterior live exponent. Safe to round the delta directly for an outflow:
- * amount on the posterior grid of CoverAvailable always leaves CoverAvailable
- * minus amount representable, since the posterior grid is exactly the grid
- * CoverAvailable itself will canonicalize to after the subtraction.
- */
-[[nodiscard]] STAmount
-roundToPosteriorBrokerCoverScale(
-    SLE::ConstRef vault,
-    SLE::ConstRef broker,
-    STAmount const& delta,
-    Number::RoundingMode roundingMode);
-
-}  // namespace detail
-
-/**
- * Round a cover debit (cover withdraw, cover clawback, the broker-side
- * decrease of a default's cover credit): amount is the non-negative
- * magnitude leaving CoverAvailable. Negates so the posterior is computed for
- * CoverAvailable minus amount, then negates the result back to a
- * non-negative magnitude, per roundToPosteriorBrokerCoverScale's outflow
- * rationale above. Magnitude in, magnitude out -- unlike the vault-side
- * outflow dispatcher (clampVaultOutflow), which takes and returns a negative
- * delta; callers on each side already hold the value in that side's native
- * form.
- */
-[[nodiscard]] STAmount
-debitToPosteriorBrokerCoverScale(
-    SLE::ConstRef vault,
-    SLE::ConstRef broker,
-    STAmount const& amount,
-    Number::RoundingMode roundingMode);
-
-/**
- * Round a cover inflow (cover deposit, LoanPay's fee redirect into cover)
- * into CoverAvailable by flooring the sum rather than the delta:
- * credit = floor16(CoverAvailable + raw) - CoverAvailable, never finer
- * than the Vault's base exponent (-Scale). See
- * creditToPosteriorAvailableScale's doc for why the sum, not the delta,
- * must be floored; the same reasoning applies to CoverAvailable.
- */
-[[nodiscard]] STAmount
-creditToPosteriorBrokerCoverScale(
-    SLE::ConstRef vault,
-    SLE::ConstRef broker,
-    Number const& raw,
-    Number::RoundingMode roundingMode);
-
-/**
- * Check whether amount is an admissible optional cover inflow.
- *
- * Legacy and CashBasis Vaults always succeed. A LoanBroker attached to a
- * FixedPrecision Vault must remain at the Vault's base scale after applying
- * the rounded amount, and its posterior CoverAvailable must stay within the
- * Open zone.
- *
- * LoanPay's fee redirect into cover is a mandatory inflow and does not call
- * this check, so it can push CoverAvailable past the Open zone limit this
- * check enforces. Once that happens, every subsequent LoanBrokerCoverDeposit
- * returns tecLIMIT_EXCEEDED until the owner withdraws cover back under the
- * limit; LoanBrokerCoverWithdraw and LoanBrokerCoverClawback are unaffected.
- */
-[[nodiscard]] TER
-checkOptionalBrokerCoverInflow(SLE::ConstRef vault, SLE::ConstRef broker, STAmount const& amount);
-
 // Lending protocol has dependencies, so capture them here.
 bool
 checkLendingProtocolDependencies(Rules const& rules, STTx const& tx);
@@ -140,13 +64,13 @@ checkLendingProtocolDependencies(Rules const& rules, STTx const& tx);
 * The accounts and asset that LoanManage::defaultLoan's fixCleanup3_4_0
 * freeze/lock exemption applies to.
 *
- * defaultLoan moves funds from the LoanBroker pseudo-account to the Vault
- * pseudo-account via accountSend. Since neither is the vault asset's
+ * `defaultLoan` moves funds from the LoanBroker pseudo-account to the Vault
+ * pseudo-account via `accountSend`. Since neither is the vault asset's
 * issuer, this is a third-party transfer that transits through the issuer in
 * two hops (broker -> issuer, issuer -> vault; see
- * directSendNoLimitIOU/directSendNoLimitMPT), so the exemption must cover
+ * `directSendNoLimitIOU`/`directSendNoLimitMPT`), so the exemption must cover
 * both the issuer/broker and issuer/vault pairs, not a direct broker/vault
- * pair. asset scopes it further to the vault's own currency/MPT issuance,
+ * pair. `asset` scopes it further to the vault's own currency/MPT issuance,
 * so an unrelated one the same accounts happen to hold is still protected.
 */
 struct LoanDefaultFreezeExemptAccounts
@@ -164,10 +88,10 @@ struct LoanDefaultFreezeExemptAccounts
 * @param view Ledger view used to resolve the Loan -> LoanBroker -> Vault
 * chain.
 * @param tx The transaction under invariant review.
- * @return The exempt accounts and asset if tx is a ttLOAN_MANAGE
- * transaction with the tfLoanDefault flag set, fixCleanup3_4_0 is
+ * @return The exempt accounts and asset if `tx` is a `ttLOAN_MANAGE`
+ * transaction with the `tfLoanDefault` flag set, `fixCleanup3_4_0` is
 * enabled, and the loan/broker/vault objects it references can all be
- * resolved; std::nullopt otherwise.
+ * resolved; `std::nullopt` otherwise.
 */
 [[nodiscard]] std::optional<LoanDefaultFreezeExemptAccounts>
 getLoanDefaultFreezeExemptAccounts(ReadView const& view, STTx const& tx);
@@ -330,38 +254,28 @@ adjustImpreciseNumber(
        value = 0;
 }

-/**
- * Apply a signed delta to a LoanBroker's DebtTotal: on FixedPrecision Vaults,
- * add the exact delta (DebtTotal moves by exactly the same amount as the
- * Vault's AssetsDeployed, never re-rounded); on Legacy/CashBasis Vaults,
- * round through adjustImpreciseNumber at vaultScale. Shared by LoanSet
- * (origination) and LoanPay (payment, where delta is negative).
- *
- * @param brokerSle The LoanBroker whose DebtTotal is adjusted.
- * @param vaultSle The LoanBroker's Vault.
- * @param delta The signed change to DebtTotal.
- * @param vaultScale The Vault scale the caller captured before changing
- *        AssetsTotal. Legacy/CashBasis round DebtTotal at that scale, not at
- *        the scale after this transaction's AssetsTotal change. Unused on
- *        FixedPrecision Vaults.
- */
-void
-adjustBrokerDebtTotal(
-    SLE::Ref brokerSle,
-    SLE::ConstRef vaultSle,
-    Number const& delta,
-    int vaultScale);
+inline int
+getAssetsTotalScale(SLE::ConstRef vaultSle)
+{
+    if (!vaultSle)
+        return Number::kMinExponent - 1;  // LCOV_EXCL_LINE
+    return scale(vaultSle->at(sfAssetsTotal), vaultSle->at(sfAsset));
+}

-/**
- * Minimum required broker cover, rounded up.
- *
- * DebtTotal is a broker-level aggregate, never rounded at an individual
- * loan's scale. Legacy and CashBasis Vaults round at the live AssetsTotal
- * exponent. FixedPrecision Vaults round at the Vault's base exponent
- * (-Scale, or 0 for integral assets).
- */
-Number
-minimumBrokerCover(Number const& debtTotal, TenthBips32 coverRateMinimum, SLE::ConstRef vaultSle);
+// Compute the minimum required broker cover, rounded consistently.
+// DebtTotal is a broker-level aggregate maintained at vault scale, so the
+// rounding must also use vault scale — never an individual loan's scale.
+inline Number
+minimumBrokerCover(Number const& debtTotal, TenthBips32 coverRateMinimum, SLE::ConstRef vaultSle)
+{
+    XRPL_ASSERT(
+        vaultSle && vaultSle->getType() == ltVAULT, "xrpl::minimumBrokerCover : valid Vault sle");
+    NumberRoundModeGuard const mg(Number::RoundingMode::Upward);
+    return roundToAsset(
+        vaultSle->at(sfAsset),
+        tenthBipsOfValue(debtTotal, coverRateMinimum),
+        getAssetsTotalScale(vaultSle));
+}

 TER
 checkLoanGuards(
@@ -465,10 +379,10 @@ loanPaymentDeltas(LoanPaymentParts const& parts);

 }  // namespace cash_basis

-// Public dispatchers: pick cash_basis:: if the Vault's LEVersion
-// (VaultHelpers::getVaultVersion) is CashBasis or later (CashBasis or
-// FixedPrecision), else instant_recognition::. These are the only entry
-// points transactors call.
+// Public dispatchers: pick cash_basis:: if featureLendingProtocolV1_1 is
+// enabled AND the Vault's LEVersion (VaultHelpers::getVaultVersion) is
+// VaultVersion::CashBasis, else instant_recognition::. These are the only entry points
+// transactors call.
 AccountingDeltas
 loanOriginationDeltas(
    SLE::ConstRef vaultSle,
@@ -312,22 +312,12 @@ checkCreateMPT(
 //
 //------------------------------------------------------------------------------

-/**
- * MaximumAmount doesn't exceed 2**63-1
- */
+// MaximumAmount doesn't exceed 2**63-1
 std::int64_t
 maxMPTAmount(SLE const& sleIssuance);

-/**
- * std::nullopt if the issuance doesn't exist.
- */
-std::optional<std::int64_t>
-maxMPTAmount(ReadView const& view, MPTID const& mptID);
-
-/**
- * OutstandingAmount may overflow and available amount might be negative.
- * But available amount is always <= |MaximumAmount - OutstandingAmount|.
- */
+// OutstandingAmount may overflow and available amount might be negative.
+// But available amount is always <= |MaximumAmount - OutstandingAmount|.
 std::int64_t
 availableMPTAmount(SLE const& sleIssuance);

@@ -341,12 +331,7 @@ availableMPTAmount(ReadView const& view, MPTID const& mptID);
 * directSendNoFee transactions that bypass the payment engine.
 * 2.  **accountSend & Payment Engine (Overflow: Yes):** A temporary overflow
 * check when `OutstandingAmount > UINT64_MAX`. This higher threshold is used
- * for `accountSend` and payments processed via the payment engine, whose
- * reverse pass may issue before it redeems.
- *
- * In both cases a single `sendAmount > MaximumAmount` is rejected. Such a send
- * can never settle: redemptions within the transaction are bounded by the
- * outstanding amount, so the final OutstandingAmount would exceed the cap.
+ * for `accountSend` and payments processed via the payment engine.
 */
 bool
 isMPTOverflow(
@@ -368,12 +353,6 @@ issuerFundsToSelfIssue(ReadView const& view, MPTIssue const& issue);
 /**
 * Facilitate tracking of MPT sold by an issuer owning MPT sell offer.
 * See ApplyView::issuerSelfDebitHookMPT().
- *
- * `amount` may be 0. BookStep removes an offer whose fee-adjusted funded
- * output is 0, but other clips (for example MaximumAmount via limitStepIn)
- * can still consume a zero slice of a funded remainder. The hook must
- * accept 0: first call still snapshots origBalance; a zero debit adds
- * nothing to selfDebit.
 */
 void
 issuerSelfDebitHookMPT(ApplyView& view, MPTIssue const& issue, std::uint64_t amount);
@@ -1,17 +1,10 @@
 #pragma once

-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STObject.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFormats.h>

 #include <cstdint>
-#include <optional>

 namespace xrpl::proposal {

@@ -38,21 +31,30 @@ proposalOwnerCount(STObject const& proposedTx)
 }

 /**
- * Whether the proposed transaction is independently submittable through the
- * ordinary multi-sign path: not a proposal transaction itself, not a
- * pseudo-transaction, not itself flagged as someone else's inner batch
- * transaction, and — if it is a Batch — every one of its own inner
- * transactions carries a TransactionType and is neither a proposal, a
- * pseudo-transaction, nor a nested Batch. A Batch inner transaction cannot
- * lack a TransactionType, be pseudo, or be a nested Batch (STTx construction
- * rejects a typeless inner and an inner Batch, and preflight0 rejects the
- * pseudo/tfInnerBatchTxn combination), but those guards live outside this
- * feature, so they are checked again here rather than relied upon.
+ * Whether the proposed transaction is itself a proposal transaction, which
+ * would nest one proposal inside another.
 *
- * TODO: cover ttTRANSACTION_PROPOSAL_SIGN once that transaction exists.
+ * TODO: cover ttTRANSACTION_PROPOSAL_SIGN and ttTRANSACTION_PROPOSAL_CANCEL
+ * once those transactions exist.
+ */
+inline bool
+isProposalTx(STObject const& proposedTx)
+{
+    return proposedTx.getFieldU16(sfTransactionType) == ttTRANSACTION_PROPOSAL_CREATE;
+}
+
+/**
+ * Whether the proposed transaction is independently submittable through the
+ * ordinary multi-sign path: not a nested proposal, not a pseudo-transaction,
+ * not itself flagged as someone else's inner batch transaction, and — if it
+ * is a Batch — none of its own inner transactions is a nested proposal or a
+ * pseudo-transaction either. A Batch inner transaction cannot itself be
+ * pseudo (preflight0 rejects the pseudo/tfInnerBatchTxn combination
+ * generically), but that guard lives outside this feature, so it is checked
+ * again here rather than relied upon.
 */
 bool
-isValidProposalTxnType(STObject const& proposedTx);
+isValidProposal(STObject const& proposedTx);

 /**
 * Whether the proposed transaction carries any signature field.
@@ -82,93 +84,4 @@ hasEmptySigningPubKey(STObject const& proposedTx)
        proposedTx.getFieldVL(sfSigningPubKey).empty();
 }

-/**
- * Whether the proposal is terminal (On-Chain Cosigner spec §4.5). A terminal proposal
- * stops accepting signatures and anyone may delete it. An already signed
- * payload can still execute after Expiration, because the Ticket reservation
- * compares payloads only; a passed LastLedgerSequence does stop it.
- *
- * A proposal is terminal when either:
- * - its Expiration has passed (the parent ledger closed at or after it), or
- * - the proposed transaction carries a LastLedgerSequence and the current
- *   ledger sequence is strictly greater than it. This mirrors the ordinary
- *   transactor's tefMAX_LEDGER rule: at view.seq() == LastLedgerSequence the
- *   payload can still be submitted in the current ledger, so the proposal is
- *   still live.
- *
- * @param view The ledger the deciding transaction is being applied to.
- * @param expiration The proposal's Expiration field.
- * @param proposedTx The proposal's ProposedTransaction field.
- */
-bool
-isTerminal(
-    ReadView const& view,
-    std::optional<std::uint32_t> expiration,
-    STObject const& proposedTx);
-
-/**
- * Delete a TransactionProposal ledger entry.
- *
- * Removes the entry from its Owner's directory, releases the reserve the
- * proposal holds against the Owner, and erases the entry. Shared by every
- * deletion path the spec defines (On-Chain Cosigner spec §4.5): automatic cleanup when the
- * proposed transaction's TicketSequence is consumed, and the
- * TransactionProposalCancel / TransactionProposalSign cleanup paths once
- * those transactions exist.
- *
- * The release goes through decreaseOwnerCountForObject, so it follows the
- * sfSponsor an entry created with reserve sponsorship carries: the reserve is
- * returned to whoever was holding it, the Owner or that sponsor.
- *
- * @param view The apply view for making changes
- * @param sleProposal The TransactionProposal ledger entry to delete
- * @param j Journal for logging
- * @return tesSUCCESS, tecINTERNAL for an invalid entry, or tefBAD_LEDGER if
- *         the ledger contradicts the entry
- */
-TER
-deleteProposal(ApplyView& view, SLE::pointer const& sleProposal, beast::Journal j);
-
-/**
- * Whether tx carries the same payload as a proposal's stored
- * ProposedTransaction (On-Chain Cosigner spec §4.2.1).
- *
- * The payload is the signing payload: the fields the collected signatures
- * commit to. Compared is every field except those flagged kNotSigning
- * (TxnSignature, Signers, BatchSigners, CounterpartySignature,
- * SponsorSignature, Signature, MasterSignature) and SigningPubKey, which is
- * stored empty and filled only if the target signs with its own key. So the
- * completed transaction matches no matter which mix of collected or
- * off-ledger signatures it carries, and any change to a non-signature field
- * results in a false-return value.
- *
- * Signature (PaymentChannelClaim and the XChain attestation transactions)
- * is deliberately not compared: it is outside the account's own TxnSignature
- * even for an ordinary submission, so a proposal cannot bind it more tightly
- * than the signatures it collects do, and those transactors still validate a
- * substituted value exactly as they would for an ordinary submission.
- * MasterSignature appears in no transaction format.
- *
- * @param proposedTx The proposal's ProposedTransaction field.
- * @param tx The transaction to compare, typically an STTx.
- */
-bool
-payloadMatches(STObject const& proposedTx, STObject const& tx);
-
-/**
- * Whether tx may consume its Ticket.
- *
- * While a proposal keyed to the Ticket exists, the target's Ticket is
- * reserved: only the proposal's own proposed transaction may spend it
- * (On-Chain Cosigner spec §4.2.1), so that unrelated target-account activity cannot
- * invalidate the proposal while signatures are being collected.
- * TransactionProposalCancel is not allowed through: it deletes the
- * reservation without consuming the ticket.
- *
- * @param view The ledger containing the Ticket and any reservation.
- * @param tx The transaction attempting to consume that ticket.
- */
-bool
-canConsumeTicket(ReadView const& view, STTx const& tx);
-
 }  // namespace xrpl::proposal
@@ -316,20 +316,6 @@ transferRate(ReadView const& view, Asset const& asset);
 [[nodiscard]] Rate
 transferRate(ReadView const& view, STAmount const& amount);

-/**
- * Returns the amount a sender must part with for `amount` to reach the
- * receiver once the issuer takes the transfer fee. Rounds up.
- */
-[[nodiscard]] STAmount
-addTransferFee(STAmount const& amount, Rate const& rate);
-
-/**
- * Returns the amount a receiver gets when `amount` leaves the sender and the
- * issuer takes the transfer fee. Rounds down.
- */
-[[nodiscard]] STAmount
-subtractTransferFee(STAmount const& amount, Rate const& rate);
-
 //------------------------------------------------------------------------------
 //
 // Holding operations (Asset-based dispatchers)
@@ -1,12 +1,10 @@
 #pragma once

 #include <xrpl/basics/Number.h>
-#include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>
@@ -14,239 +12,11 @@
 #include <cstdint>
 #include <expected>
 #include <optional>
-#include <string_view>

 namespace xrpl {

 class STTx;

-/**
- * @brief Return the Vault's current assets total.
- *
- * FixedPrecision Vaults return AssetsAvailable plus AssetsDeployed, with no
- * rounding to the asset's 16-digit precision: the sum is exact at Number's
- * active 19-digit mantissa width (the large mantissa range, enabled by
- * featureSingleAssetVault or featureLendingProtocol), rounds Downward regardless of the
- * caller's ambient mode beyond that, and is not rounded to match the cached
- * sfAssetsTotal field. Legacy and CashBasis Vaults return the stored
- * AssetsTotal.
- *
- * @param vault The vault SLE.
- * @return The current assets total.
- */
-[[nodiscard]] Number
-getAssetsTotal(SLE::ConstRef vault);
-
-/**
- * @brief A change to a FixedPrecision Vault's balances.
- */
-struct VaultBalanceChange
-{
-    /**
-     * Signed change to AssetsAvailable. Must be the exact amount moved on the
-     * Vault pseudo-account in the same transaction. Absent means no cash
-     * moved; adjustVaultBalances then uses zero of the Vault's own asset.
-     */
-    std::optional<STAmount> cash = std::nullopt;
-
-    /**
-     * Signed change to AssetsDeployed: open Loan principal, exact.
-     */
-    Number deployed = 0;
-
-    /**
-     * Signed change to scheduled, unpaid interest (YieldUnrealized), exact.
-     */
-    Number yield = 0;
-
-    /**
-     * Signed change to impaired principal (LossUnrealized), exact.
-     */
-    Number loss = 0;
-};
-
-/**
- * @brief Apply a balance change to a FixedPrecision Vault. The only writer of
- * AssetsAvailable, AssetsDeployed, AssetsTotal, YieldUnrealized and
- * LossUnrealized on these Vaults after creation.
- *
- * @param vault The vault SLE. Must be FixedPrecision.
- * @param change The balance change to apply.
- * @param j Journal for logging the fatal (tefBAD_LEDGER) case.
- *
- * @return tesSUCCESS; tecLIMIT_EXCEEDED if LossUnrealized would exceed
- *         AssetsDeployed; tefBAD_LEDGER if AssetsAvailable, AssetsDeployed,
- *         LossUnrealized or YieldUnrealized would become negative.
- */
-[[nodiscard]] TER
-adjustVaultBalances(SLE::Ref vault, VaultBalanceChange const& change, beast::Journal j);
-
-/**
- * @brief Apply a signed cash movement to a Vault of any version. FixedPrecision
- * Vaults go through adjustVaultBalances; Legacy and CashBasis Vaults add the
- * amount to both AssetsTotal and AssetsAvailable.
- *
- * @param vault The vault SLE.
- * @param delta Signed change to AssetsAvailable; the exact amount moved on the
- *              Vault pseudo-account.
- * @param j Journal passed through to adjustVaultBalances.
- *
- * @return tesSUCCESS, or the adjustVaultBalances error for FixedPrecision Vaults.
- */
-[[nodiscard]] TER
-adjustVaultCash(SLE::Ref vault, STAmount const& delta, beast::Journal j);
-
-/**
- * Return the Vault's current live exponent.
- *
- * Legacy and CashBasis Vaults use the exponent of AssetsTotal. FixedPrecision
- * Vaults use max(base exponent, exponent of AssetsTotal): the grid is never
- * finer than -Scale and coarsens once AssetsTotal outgrows 16 digits there.
- */
-[[nodiscard]] int
-getVaultScale(SLE::ConstRef vault);
-
-/**
- * Return the Vault's base exponent.
- *
- * Legacy and CashBasis Vaults use their current live exponent. FixedPrecision
- * Vaults use -Scale, or 0 for integral assets.
- */
-[[nodiscard]] int
-getVaultBaseScale(SLE::ConstRef vault);
-
-/**
- * Round an amount at the Vault's posterior live exponent.
- */
-[[nodiscard]] STAmount
-roundToPosteriorVaultScale(
-    SLE::ConstRef vault,
-    STAmount const& amount,
-    Number::RoundingMode roundingMode);
-
-namespace detail {
-
-/**
- * Return the Vault's posterior live exponent after applying an unrounded delta.
- */
-[[nodiscard]] int
-getPosteriorVaultScale(SLE::ConstRef vault, STAmount const& delta);
-
-/**
- * Shared grid-floor core of getVaultScale / getPosteriorVaultScale /
- * getPosteriorBrokerCoverScale: baseScale when reference is zero, otherwise
- * max(baseScale, scale(reference, asset)), rounded Downward regardless of
- * the caller's ambient rounding mode.
- */
-[[nodiscard]] int
-liveScale(Number const& reference, Asset const& asset, int baseScale);
-
-/**
- * Shared core of getPosteriorVaultScale and getPosteriorBrokerCoverScale:
- * the exponent reference + delta would have under version's live-scale rule
- * (floored at baseScale for FixedPrecision, unbounded for Legacy/CashBasis).
- *
- * @param version The Vault's LEVersion.
- * @param asset The Vault's underlying asset.
- * @param baseScale The Vault's base exponent; unused outside the
- *                   FixedPrecision case.
- * @param reference The balance the delta is applied to (AssetsAvailable,
- *                   AssetsTotal, or a LoanBroker's CoverAvailable).
- * @param delta The unrounded change to reference.
- */
-[[nodiscard]] int
-posteriorAssetScale(
-    VaultVersion version,
-    Asset const& asset,
-    int baseScale,
-    Number const& reference,
-    Number const& delta);
-
-/**
- * Shared core of creditToPosteriorAvailableScale and
- * creditToPosteriorBrokerCoverScale: floors reference + raw at the sum's
- * own live scale (never finer than baseScale) and returns the difference
- * from reference, so the delta applied is exactly what moves reference onto
- * the floored sum. See creditToPosteriorAvailableScale's doc for why the
- * sum, not raw alone, must be floored. raw is the exact amount; it is not
- * rounded on its own before being added to reference. The sum and its scale
- * are computed once, in roundingMode, so a Downward credit is always
- * between zero and raw.
- */
-[[nodiscard]] STAmount
-creditToPosteriorScale(
-    Asset const& asset,
-    Number const& reference,
-    int baseScale,
-    Number const& raw,
-    Number::RoundingMode roundingMode);
-
-}  // namespace detail
-
-/**
- * Round a FixedPrecision cash inflow (LoanPay's credit, LoanManage's
- * default cover credit) into AssetsAvailable, never AssetsTotal, which is
- * a derived cache, by flooring the sum rather than the delta:
- * credit equals floor16(AssetsAvailable + raw) minus AssetsAvailable, never
- * finer than the Vault's base exponent (-Scale).
- *
- * Flooring only the delta at its own posterior grid is not enough: the sum
- * can still need a 17th digit when AssetsAvailable is off the coarser grid
- * right after crossing a power of ten. Example at Scale 6: AssetsAvailable
- * equals 9999999999.999999 (16 digits already) and a credit of 0.000011
- * floors to 0.00001 on its own (finer) grid, but 9999999999.999999 plus
- * 0.00001 equals 10000000000.000009, which still needs 17 digits. Flooring
- * the sum instead, floor16(9999999999.999999 + 0.000011) minus
- * 9999999999.999999, is exact by construction, since STAmount's own
- * 16-digit canonical form of the sum is what gets subtracted from.
- *
- * raw is taken as an exact Number: rounding it to 16 digits before adding
- * it to AssetsAvailable could drop a tail that moves the floored sum.
- */
-[[nodiscard]] STAmount
-creditToPosteriorAvailableScale(
-    SLE::ConstRef vault,
-    Number const& raw,
-    Number::RoundingMode roundingMode);
-
-/**
- * Open-zone capacity ceiling: 9 * 10^(15 + baseScale).
- *
- * Defined only for FixedPrecision Vaults, where this is 9 * 10^(15 - P).
- */
-[[nodiscard]] Number
-getVaultOpenLimit(SLE::ConstRef vault);
-
-/**
- * Check whether amount is an admissible optional inflow.
- *
- * Legacy and CashBasis Vaults always succeed. FixedPrecision Vaults must
- * remain at their base scale after applying the rounded amount, and the
- * posterior capacity (AssetsTotal + YieldUnrealized + rounded amount) must
- * stay within the Open zone.
- *
- * The amount is rounded toward zero at the posterior live exponent.
- */
-[[nodiscard]] TER
-checkOptionalVaultInflow(SLE::ConstRef vault, STAmount const& amount);
-
-/**
- * Open-zone capacity after adding roundedAmount: AssetsTotal + YieldUnrealized
- * + roundedAmount, computed TowardsZero regardless of the caller's ambient
- * rounding mode. Defined only for FixedPrecision Vaults.
- *
- * Shared by checkOptionalVaultInflow and LoanSet's loan-origination capacity
- * check, which pair this formula with different scale checks (posterior vs.
- * current), so only the capacity formula itself -- not the whole check -- is
- * shared here.
- *
- * @param vault The vault SLE. Must be FixedPrecision.
- * @param roundedAmount The amount to add, already rounded to the relevant
- *                       posterior or base scale by the caller.
- */
-[[nodiscard]] Number
-vaultOpenZoneCapacity(SLE::ConstRef vault, Number const& roundedAmount);
-
 /**
 * From the perspective of a vault, return the number of shares to give
 * depositor when they offer a fixed amount of assets. Note, since shares are
@@ -276,93 +46,31 @@ assetsToSharesDeposit(SLE::ConstRef vault, SLE::ConstRef issuance, STAmount cons
 sharesToAssetsDeposit(SLE::ConstRef vault, SLE::ConstRef issuance, STAmount const& shares);

 /**
- * Adjusts a requested asset change (delta) to match the decimal scale of the
- * updated total vault assets. This ensures sfAssetsTotal, sfAssetsAvailable,
+ * Adjusts a requested asset change (`delta`) to match the decimal scale of the
+ * updated total vault assets. This ensures `sfAssetsTotal`, `sfAssetsAvailable`,
 * and the actual asset transfer change by the exact same representable amount.
 *
 * Rounding strategy:
- * - Legacy/CashBasis debits (withdrawals): rounds down the magnitude of delta
- *   on the new scale to prevent paying out more than requested.
- * - Legacy/CashBasis credits: floors the resulting total asset balance and
- *   returns the difference from the current total.
- * - FixedPrecision credits only (VaultDeposit): rounds the delta toward zero
- *   at the scale getAssetsTotal (AssetsAvailable + AssetsDeployed, derived,
- *   not the stored AssetsTotal cache) would have after applying delta.
- *   FixedPrecision outflows (VaultWithdraw, VaultClawback) never call this;
- *   they use clampVaultOutflow instead.
+ * - Debits (withdrawals): Rounds down `|delta|` on the new scale to prevent
+ *   paying out more than requested.
+ * - Credits (deposits): Floors the resulting total asset balance and returns the
+ *   difference from the current total. This prevents crediting the vault with
+ *   more assets than the user deposited.
 *
 * Key rules:
- * - The returned magnitude never exceeds the magnitude of delta.
- * - Returns tecPRECISION_LOSS if the change is smaller than 1 ULP of the target scale
+ * - The returned magnitude never exceeds `|delta|`.
+ * - Returns `tecPRECISION_LOSS` if the change is smaller than 1 ULP of the target scale
 *   (prevents share operations when totals cannot change).
 * - For integer assets (XRP, MPT), rounding is a no-op.
 *
 * @param vault The vault ledger entry.
 * @param delta The requested signed change to sfAssetsTotal.
- * @return The rounded, positive magnitude, or tecPRECISION_LOSS if the
+ * @return The rounded, positive magnitude, or `tecPRECISION_LOSS` if the
 *         change is below representable precision.
 */
 [[nodiscard]] std::expected<STAmount, TER>
 clampToAssetsTotalScale(SLE::ConstRef vault, STAmount const& delta);

-/**
- * Outflow clamp dispatcher for VaultWithdraw and VaultClawback: rounds a
- * negative delta to the scale appropriate for the Vault's version -- for
- * FixedPrecision, at AssetsAvailable's own posterior scale (the balance the
- * cash actually leaves); for Legacy/CashBasis, clampToAssetsTotalScale --
- * so both call sites share one dispatch point. Same tecPRECISION_LOSS and
- * integral-asset and magnitude-never-exceeds-delta rules as
- * clampToAssetsTotalScale.
- *
- * @param vault The vault ledger entry.
- * @param delta The requested signed outflow (negative).
- * @return The rounded, positive magnitude, or tecPRECISION_LOSS if the
- *         change is below representable precision.
- */
-[[nodiscard]] std::expected<STAmount, TER>
-clampVaultOutflow(SLE::ConstRef vault, STAmount const& delta);
-
-/**
- * Returns the Vault's base exponent for asset at scale, before a Vault
- * object exists to read it from: 0 for an integral asset, -scale otherwise.
- * Used by VaultCreate::preclaim, which only has the proposed Scale field,
- * not yet a Vault SLE; getVaultBaseScale is the post-creation equivalent.
- *
- * @param asset The (prospective) Vault's underlying asset.
- * @param scale The (prospective) Vault's sfScale value, ignored for
- *              integral assets.
- */
-[[nodiscard]] int
-vaultBaseScale(Asset const& asset, std::uint8_t scale);
-
-/**
- * Returns true iff value is exactly representable both as an STAmount of
- * asset and on the base grid at baseScale (no precision lost rounding
- * TowardsZero at baseScale). Returns false, rather than throwing, for a value
- * out of range for the asset. Shared representability check for
- * VaultCreate::preclaim, VaultSet::preclaim and LoanBrokerSet::preclaim's
- * AssetsMaximum / DebtMaximum / cover-rate field checks.
- *
- * @param asset The vault's underlying asset.
- * @param value The value to check.
- * @param baseScale The vault's base exponent (see vaultBaseScale /
- *                  getVaultBaseScale).
- */
-[[nodiscard]] bool
-isOnVaultBaseGrid(Asset const& asset, Number const& value, int baseScale);
-
-/**
- * Checks that a requested AssetsMaximum is exactly representable on the
- * Vault's base grid, otherwise associateAsset would silently round the cap
- * the owner asked for. Used by VaultSet::preclaim on an existing Vault.
- *
- * @param vault The vault ledger entry.
- * @param amount The requested AssetsMaximum.
- * @return tesSUCCESS, or tecPRECISION_LOSS if amount is not representable.
- */
-[[nodiscard]] TER
-checkAssetsMaximum(SLE::ConstRef vault, Number const& amount);
-
 /**
 * Controls whether to truncate shares instead of rounding.
 */
@@ -390,24 +98,21 @@ enum class WaiveUnrealizedLoss : bool { No = false, Yes = true };
 assetsTotalForWithdrawal(SLE::ConstRef vault, WaiveUnrealizedLoss waive);

 /**
- * Reject a cash outflow that is dust (see debitIsNonZeroDust) or whose check
- * overflows Number, which is easy to hit with a large Scale.
+ * Returns true if debiting `amount` from `total` (the current value of a
+ * vault's sfAssetsTotal or sfAssetsAvailable) would canonicalize to the
+ * same STAmount value. This happens when `amount` is non-zero but too small
+ * to change the stored total at STAmount's precision. Shares would still
+ * move, so the ValidVault invariant would fail after apply; callers use
+ * this to reject the transaction upfront instead.
 *
- * @param vault The vault SLE.
- * @param amount The amount to debit.
- * @param j Journal for the debug log.
- * @param name Transaction name used as the log prefix.
- *
- * @return tesSUCCESS; tecPRECISION_LOSS if amount is dust; tecPATH_DRY if the
- *         check overflows. Overflow means the transaction cannot apply, but
- *         ledger state is still consistent.
+ * @param asset The vault's underlying asset, used to canonicalize both
+ *              sides the same way the ledger will when the field is stored.
+ * @param total The field's current value.
+ * @param amount The amount to debit. Zero always returns false; that case
+ *               is rejected separately.
 */
-[[nodiscard]] TER
-checkDebitNotDust(
-    SLE::ConstRef vault,
-    Number const& amount,
-    beast::Journal j,
-    std::string_view name);
+[[nodiscard]] bool
+debitIsNonZeroDust(Asset const& asset, Number const& total, Number const& amount);

 /**
 * From the perspective of a vault, return the number of shares to demand from
@@ -453,7 +158,7 @@ sharesToAssetsWithdraw(
    WaiveUnrealizedLoss waive = WaiveUnrealizedLoss::No);

 /**
- * Returns true iff account holds all of the vault's outstanding shares,
+ * Returns true iff `account` holds all of the vault's outstanding shares —
 * i.e. is the sole remaining shareholder. Returns false if the account
 * holds no shares or fewer than the total outstanding.
 *
@@ -466,13 +171,11 @@ sharesToAssetsWithdraw(
 isSoleShareholder(ReadView const& view, AccountID const& account, SLE::ConstRef issuance);

 /**
- * Resolves a Vault's LEVersion.
- *
- * LEVersion is the single point every accounting and rounding helper
- * should call to decide which protocol a Vault follows. It is written
- * at VaultCreate and is not updated afterwards, so a Vault created
- * under an older amendment keeps that behaviour after later amendments
- * activate. Absent sfLEVersion resolves to VaultVersion::Legacy.
+ * Resolves a Vault's LEVersion, the single point every accounting touch
+ * point should call to determine which recognition model (instant interest
+ * recognition vs. cash-basis) a Vault uses. Vaults created before featureLendingProtocolV1_1
+ * activated never have sfLEVersion set, which resolves here to
+ * VaultVersion::Legacy.
 *
 * @param vault The vault SLE.
 *
@@ -482,34 +185,6 @@ isSoleShareholder(ReadView const& view, AccountID const& account, SLE::ConstRef
 [[nodiscard]] VaultVersion
 getVaultVersion(SLE::ConstRef vault);

-/**
- * Decodes an already-extracted sfLEVersion value with the same range check as
- * getVaultVersion. Usable from contexts, such as an invariant's ledger-entry
- * snapshot, that keep the field value but not the owning SLE.
- *
- * @param leVersion The value of sfLEVersion, or nullopt if absent.
- *
- * @return The decoded LEVersion, or VaultVersion::Legacy if absent.
- */
-[[nodiscard]] VaultVersion
-decodeVaultVersion(std::optional<std::uint8_t> leVersion);
-
-/**
- * Resolves which LEVersion a newly-created Vault should get under the
- * currently active amendments. This is the only place that decides Vault
- * version policy; VaultCreate calls it instead of checking amendments
- * directly.
- *
- * @param rules The active ledger rules.
- *
- * @return VaultVersion::FixedPrecision once featureLendingProtocolV1_1,
- * featureLendingProtocolV1_2 and fixCleanup3_4_0 are all enabled;
- * VaultVersion::CashBasis
- * once featureLendingProtocolV1_1 is enabled; VaultVersion::Legacy otherwise.
- */
-[[nodiscard]] VaultVersion
-getVaultDefaultVersion(Rules const& rules);
-
 /**
 * Resolves the VaultKind of a vault SLE. Returns VaultKind::ClosedEnded when
 * sfVaultKind is present and equal to that value; anything else (including an
@@ -20,7 +20,7 @@ enum class NodeObjectType : std::uint32_t {
    Ledger = 1,
    AccountNode = 3,
    TransactionNode = 4,
-    Dummy = 512,  // an invalid or missing object
+    Dummy = 512  // an invalid or missing object
 };

 /**
@@ -28,7 +28,7 @@ enum class Status {
    Unknown = 3,
    BackendError = 4,

-    CustomCode = 100,
+    CustomCode = 100
 };

 /**
@@ -429,7 +429,7 @@ Livecache<Allocator>::insert(Endpoint const& ep)
    XRPL_ASSERT(
        ep.hops <= (tuning::kMaxHops + 1),
        "xrpl::peer_finder::Livecache::insert : maximum input hops");
-    auto const result = cache_.emplace(ep.address, ep);
+    auto result = cache_.emplace(ep.address, ep);
    Element& e(result.first->second);
    if (result.second)
    {
@@ -497,7 +497,7 @@ Livecache<Allocator>::HopsT::shuffle()
        std::ranges::copy(list, std::back_inserter(v));
        std::shuffle(v.begin(), v.end(), defaultPrng());
        list.clear();
-        for (auto const& e : v)
+        for (auto& e : v)
            list.push_back(e);
    }
 }
@@ -194,7 +194,7 @@ public:
                    "Port not specified for address:" + remoteAddress.toString());
            }

-            auto const result(fixed_.emplace(
+            auto result(fixed_.emplace(
                std::piecewise_construct,
                std::forward_as_tuple(remoteAddress),
                std::make_tuple(std::ref(clock))));
@@ -439,7 +439,7 @@ public:
        // Mark fixed slot success
        if (slot->fixed() && !slot->inbound())
        {
-            auto const iter(fixed_.find(slot->remoteEndpoint()));
+            auto iter(fixed_.find(slot->remoteEndpoint()));
            if (iter == fixed_.end())
            {
                logicError(
@@ -485,7 +485,7 @@ public:

        // Count how many more outbound attempts to make
        //
-        auto const needed(counts_.attemptsNeeded());
+        auto needed(counts_.attemptsNeeded());
        if (needed == 0)
            return none;

@@ -903,7 +903,7 @@ public:
        // Mark fixed slot failure
        if (slot->fixed() && !slot->inbound() && slot->state() != Slot::State::Active)
        {
-            auto const iter(fixed_.find(slot->remoteEndpoint()));
+            auto iter(fixed_.find(slot->remoteEndpoint()));
            if (iter == fixed_.end())
            {
                logicError(
@@ -348,19 +348,16 @@ isAuditorMirrorCurrent(SLE const& issuance, SLE const& mptoken);
 areMirrorsCurrent(SLE const& issuance, SLE const& mptoken);

 /**
- * @brief Set the holder's issuer mirror epoch, and the issuer mirror key, to match the issuance's
- * current key.
+ * @brief Set the holder's issuer mirror epoch to match the issuance's current issuer key epoch.
 *
 * Call this after writing the issuer mirror ciphertext under the issuance's
 * currently registered issuer key, so that the mirror reads as current afterwards.
- * Also records sfIssuerMirrorEncryptionKey as the issuance's current issuer key
- * (both fields stay absent at epoch 0, where the original issuer key applies).
 *
 * @param issuance The MPTokenIssuance ledger object.
 * @param mptoken  The holder's MPToken ledger entry to update.
 */
 void
-setIssuerMirrorCurrent(SLE const& issuance, SLE& mptoken);
+setIssuerMirrorEpoch(SLE const& issuance, SLE& mptoken);

 /**
 * @brief Set the holder's auditor mirror epoch to match the issuance's current auditor key epoch.
@@ -375,18 +372,16 @@ void
 setAuditorMirrorEpoch(SLE const& issuance, SLE& mptoken);

 /**
- * @brief Set the holder's MPToken mirror epochs, and the issuer mirror key, to match the issuance's
- * current keys.
+ * @brief Set the holder's MPToken mirror epochs to match the issuance's current key epochs.
 *
 * Call this after writing mirror ciphertexts under the issuance's currently
- * registered keys, so that the mirrors read as current afterwards. Also records
- * sfIssuerMirrorEncryptionKey via setIssuerMirrorCurrent.
+ * registered keys, so that the mirrors read as current afterwards.
 *
 * @param issuance The MPTokenIssuance ledger object.
 * @param mptoken  The holder's MPToken ledger entry to update.
 */
 void
-setMirrorsCurrent(SLE const& issuance, SLE& mptoken);
+setMirrorEpochs(SLE const& issuance, SLE& mptoken);

 /**
 * @brief Verifies revealed amount encryptions for all recipients.
@@ -144,7 +144,7 @@ enum ErrorCodeI {
    RpcEntryNotFound = 98,
    RpcUnexpectedLedgerType = 99,

-    RpcLast = RpcUnexpectedLedgerType,  // rpcLAST should always equal the last code.
+    RpcLast = RpcUnexpectedLedgerType  // rpcLAST should always equal the last code.
 };

 /**
@@ -10,25 +10,6 @@ namespace xrpl {
 // This was the reference fee units used in the old fee calculation.
 inline constexpr std::uint32_t kFeeUnitsDeprecated = 10;

-// Number of micro-drops in one drop.
-inline constexpr std::uint32_t microDropsPerDrop{1'000'000};
-
-/**
- * Hard protocol bounds on the Feature Extension fee settings. A voted value
- * can never fall outside these, so `preflight`, which has no view, may bound
- * against them. Gas and bytecode limits are capped; gas price has a floor
- * (zero would make WASM execution effectively free).
- */
-inline constexpr std::uint32_t kMaxGasLimit{2'000'000};
-inline constexpr std::uint32_t kMaxBytecodeSizeLimit{200'000};
-inline constexpr std::uint32_t kMinGasPrice{1};
-
-// The following default values of fee settings will seed into FeeSettings
-// and write to the ledger on featureSmartEscrow activation.
-inline constexpr std::uint32_t kDefaultGasLimit{1'000'000};
-inline constexpr std::uint32_t kDefaultBytecodeSizeLimit{100'000};
-inline constexpr std::uint32_t kDefaultGasPrice{1'000'000};
-
 /**
 * Reflects the fee settings for a particular ledger.
 *
@@ -52,47 +33,13 @@ struct Fees
     */
    XRPAmount increment{0};

-    /**
-     * @brief Gas limit for Feature Extensions (instructions).
-     *
-     * This and the one below default to the protocol values rather than 0,
-     * because an explicit 0 is the voted kill switch.
-     */
-    std::uint32_t gasLimit{kDefaultGasLimit};
-
-    /**
-     * @brief Bytecode size limit for Feature Extensions (bytes).
-     */
-    std::uint32_t bytecodeSizeLimit{kDefaultBytecodeSizeLimit};
-
-    /**
-     * @brief Price of WASM gas (micro-drops).
-     */
-    std::uint32_t gasPrice{kDefaultGasPrice};
-
    explicit Fees() = default;
    Fees(Fees const&) = default;
    Fees&
    operator=(Fees const&) = default;

    Fees(XRPAmount base, XRPAmount reserve, XRPAmount increment)
-        : base{base}, reserve{reserve}, increment{increment}
-    {
-    }
-
-    Fees(
-        XRPAmount base,
-        XRPAmount reserve,
-        XRPAmount increment,
-        std::uint32_t gasLimit,
-        std::uint32_t bytecodeSizeLimit,
-        std::uint32_t gasPrice)
-        : base{base}
-        , reserve{reserve}
-        , increment{increment}
-        , gasLimit{gasLimit}
-        , bytecodeSizeLimit{bytecodeSizeLimit}
-        , gasPrice{gasPrice}
+        : base(base), reserve(reserve), increment(increment)
    {
    }

@@ -26,7 +26,6 @@ class STTx;
 * greater than the maximum value of uint16.
 */
 // Macro-generated, complex
-// NOLINTBEGIN(readability-trailing-comma) the macro supplies the trailing comma
 // NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
 enum GranularPermissionType : std::uint32_t {
 #pragma push_macro("GRANULAR_PERMISSION")
@@ -39,7 +38,6 @@ enum GranularPermissionType : std::uint32_t {
 #undef GRANULAR_PERMISSION
 #pragma pop_macro("GRANULAR_PERMISSION")
 };
-// NOLINTEND(readability-trailing-comma)

 class Permission
 {
@@ -311,46 +311,24 @@ constexpr std::uint8_t kVaultStrategyFirstComeFirstServe = 1;
 * Default IOU scale factor for a Vault
 */
 constexpr std::uint8_t kVaultDefaultIouScale = 6;
-
 /**
- * Maximum Scale for a Vault created before featureLendingProtocolV1_2.
- * Chosen so 1 IOU can always convert to shares:
- * 10^19 > maxMPTokenAmount (2^64-1) > 10^18.
+ * Maximum scale factor for a Vault. The number is chosen to ensure that
+ * 1 IOU can be always converted to shares.
+ * 10^19 > maxMPTokenAmount (2^64-1) > 10^18
 */
-constexpr std::uint8_t kLegacyVaultMaximumIouScale = 18;
+constexpr std::uint8_t kVaultMaximumIouScale = 18;

 /**
- * Maximum Scale for a Vault created under featureLendingProtocolV1_2.
- */
-constexpr std::uint8_t kFixedPrecisionVaultMaximumIouScale = 10;
-
-/**
- * Vault ledger-entry schema versions, persisted as sfLEVersion.
- *
- * LEVersion records which protocol a Vault was created under so later
- * amendments can change the rules for new Vaults without rewriting
- * existing ones. VaultCreate writes it from the then-active lending
- * amendments; later transactions do not update it. A Vault created
- * under an older amendment keeps that amendment's behaviour for its
- * lifetime, even after a newer lending amendment activates.
- *
- * Absent sfLEVersion is implicit Legacy (version 0): instant interest
- * recognition and a dynamic AssetsTotal scale. CashBasis (V1.1) uses
- * cash-basis recognition on the same dynamic scale. FixedPrecision
- * (V1.2) keeps cash-basis recognition and adds the lifetime base grid.
+ * Vault ledger-entry schema versions. Assigned to newly created
+ * Vaults once featureLendingProtocolV1_1 is enabled. Vaults created before
+ * activation are left without LEVersion (implicit legacy version 0,
+ * instant interest recognition).
 */
 enum class VaultVersion : uint8_t {
    Legacy = 0,
    CashBasis,
-    FixedPrecision,
 };

-// Code compares VaultVersion values with < and >= (e.g. "CashBasis or later"),
-// so each later version must stay numerically larger than the one before.
-static_assert(
-    VaultVersion::Legacy < VaultVersion::CashBasis &&
-    VaultVersion::CashBasis < VaultVersion::FixedPrecision);
-
 /**
 * Vault kind. Distinguishes closed-ended vaults from the default open-ended
 * kind. Persisted as sfVaultKind (UINT8); absent means OpenEnded.
@@ -398,11 +376,6 @@ constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono:
 */
 constexpr std::uint8_t kMaxAssetCheckDepth = 5;

-/**
- * Maximum length of a Data field in Escrow object that can be updated by WASM code.
- */
-constexpr std::size_t kMaxWasmDataLength = 1 * 1024;  // 1KB
-
 /**
 * A ledger index.
 */
@@ -284,10 +284,8 @@ public:

        auto const [minV, maxV] = std::minmax(q1.value_, q2.value_);

-        auto const mantissa = [](std::uint64_t rate) { return rate & ~(255ull << (64 - 8)); };
-        auto const exponent = [](std::uint64_t rate) {
-            return static_cast<int>(rate >> (64 - 8)) - 100;
-        };
+        auto mantissa = [](std::uint64_t rate) { return rate & ~(255ull << (64 - 8)); };
+        auto exponent = [](std::uint64_t rate) { return static_cast<int>(rate >> (64 - 8)) - 100; };

        auto const minVMantissa = mantissa(minV);
        auto const maxVMantissa = mantissa(maxV);
@@ -696,16 +696,6 @@ divRound(STAmount const& v1, STAmount const& v2, Asset const& asset, bool roundU
 STAmount
 divRoundStrict(STAmount const& v1, STAmount const& v2, Asset const& asset, bool roundUp);

-/**
- * Returns amt * num / den, rounded in the requested direction.
- *
- * Dispatches to the XRPAmount, IOUAmount or MPTAmount overload. XRP and MPT
- * results are exact; an IOU result is rounded to the 16-digit mantissa in the
- * requested direction. Only Upward and Downward are supported.
- */
-[[nodiscard]] STAmount
-mulRatio(STAmount const& amt, std::uint32_t num, std::uint32_t den, Number::RoundingMode rounding);
-
 // Someone is offering X for Y, what is the rate?
 // Rate: smaller is better, the taker wants the most out: in/out
 // VFALCO TODO Return a Quality object
@@ -776,21 +766,6 @@ roundToAsset(
    return roundToScale(ret, scale);
 }

-/**
- * Check whether an arbitrary precision Number can be converted to an STAmount
- * of a given Asset without exceeding the asset's range.
- *
- * Use this before `roundToAsset` or `STAmount{asset, value}` on unchecked
- * input, since those throw for out-of-range values, e.g. XRP above
- * `STAmount::kMaxNativeN`.
- *
- * @param asset The relevant asset
- * @param value The value to be checked
- * @return true if the value is in range for the asset; false otherwise.
- */
-[[nodiscard]] bool
-isRepresentable(Asset const& asset, Number const& value);
-
 //------------------------------------------------------------------------------

 inline bool
@@ -29,7 +29,7 @@ struct JsonOptions
        DisableApiPriorV2 = 0b0000'0010,

        // IMPORTANT `All` must be union of all of the above; see also operator~
-        All = IncludeDate | DisableApiPriorV2,  // 0b0000'0011
+        All = IncludeDate | DisableApiPriorV2  // 0b0000'0011
    };

    constexpr JsonOptions(UnderlyingT v) noexcept : value(v)
@@ -440,7 +440,7 @@ private:
        // These values are carefully chosen to do the right thing if passed
        // to SField::shouldInclude (bool)
        OmitSigningFields = false,
-        WithAllFields = true,
+        WithAllFields = true
    };

    void
Author	SHA1	Message	Date
Denis Angell	36421003d4	docs: Link #8558 and name every transaction stream in the API changelog	2026-10-10 09:01:55 -04:00
Denis Angell	4be265c514	fix: Apply DeliverMax to inner Batch Payments, simulate and submit	2026-10-10 08:50:12 -04:00