Merge branch 'dev' into feature-export-rng

Add a capable/legacy OverlayImpl TMExportShares relay assertion so the
new cutoff cannot be deleted while handshake tests stay green. Rename
the stale CE-only disconnect heading.

.ai-docs/reviews/2026-07-14/9febb4957/export-stream-terminal-review/followup-tests.md

@@ -0,0 +1,40 @@
+# Export stream terminal follow-up tests
+
+## Scope
+
+Added regression coverage in `src/test/consensus/ConsensusExtensions_test.cpp`
+for the LOW test-gap finding in `synthesis.md`:
+
+- A tracked pending-latch origin that is absent from the next validated ledger
+  emits one empty `terminal: true` replacement snapshot. The test verifies the
+  retained owner/origin identity, validated-ledger cursor, empty share set,
+  internal retirement, and suppression of a duplicate terminal snapshot.
+- A validated-ledger callback queued behind `exportStreamMutex_` is fenced by
+  `stopExportShareService()`. The test verifies that stop cannot return while
+  the stream lock is held and that the queued callback emits no snapshot after
+  the service flag is cleared.
+
+No production files were changed. Deterministic accepted-edge/terminal lock
+winner coverage was not added because there is no test seam between collector
+admission and stream-lock acquisition; adding one would require production
+instrumentation, while timing-only assertions would be flaky.
+
+## Verification
+
+- `x-format-changed`: passed.
+- `x-quick-check`: passed for `ConsensusExtensions_test.cpp`.
+- Narrow object build: passed for
+  `CMakeFiles/rippled.dir/src/test/consensus/ConsensusExtensions_test.cpp.o`.
+- `/tmp/rippled-export-stream-tests --unittest=ripple.consensus.ConsensusExtensions`:
+  passed, 1 suite, 66 cases, 9,628 assertions, 0 failures.
+
+The normal incremental `rippled` target was stopped after Ninja scheduled 321
+steps from a stale build tree. A temporary binary was linked from existing
+objects plus the newly compiled test object to execute the narrow suite without
+a broad rebuild.
+
+## Repository state
+
+Work began at requested HEAD `018719fda`. A concurrent commit advanced the
+shared branch to `572365baf` (`fix(export): enforce global live latch cap`)
+before this follow-up was committed; that unrelated change was preserved.

.codecov.yml

@@ -1,6 +1,37 @@
+codecov:
+  require_ci_to_pass: true
+
+comment:
+  behavior: default
+  layout: reach,diff,flags,tree,reach
+  show_carryforward_flags: false
+
 coverage:
+  range: "60..80"
+  precision: 1
+  round: nearest
   status:
     project:
       default:
         target: 60%
         threshold: 2%
+    patch:
+      default:
+        target: auto
+        threshold: 2%
+    changes: false
+
+github_checks:
+  annotations: true
+
+parsers:
+  cobertura:
+    partials_as_hits: true
+    handle_missing_conditions : true
+
+slack_app: false
+
+ignore:
+  - "src/test/"
+  - "include/xrpl/beast/test/"
+  - "include/xrpl/beast/unit_test/"

.git-blame-ignore-revs

@@ -1,8 +1,25 @@
 # This feature requires Git >= 2.24
 # To use it by default in git blame:
 # git config blame.ignoreRevsFile .git-blame-ignore-revs
+# Format first-party source according to .clang-format
 50760c693510894ca368e90369b0cc2dabfd07f3
-e2384885f5f630c8f0ffe4bf21a169b433a16858
-241b9ddde9e11beb7480600fd5ed90e1ef109b21
-760f16f56835663d9286bd29294d074de26a7ba6
-0eebe6a5f4246fced516d52b83ec4e7f47373edd
+# Reintroduce Clang-Format & Levelization
+da1d20d6d5d862716125d60899b80fab5302954a
+# Consolidate external libraries
+da1d20d6d5d862716125d60899b80fab5302954a
+# Rename .hpp to .h
+0345a2645d0f5ad900f4fbbcaff96040d3a887fc
+# Format formerly .hpp files
+5a227dc719016e10045e17c9396ad401118044f1
+# Rewrite includes
+e61880699997398f5a746e6c4034edc7632661f5
+# Move CMake directory (#4997)
+e47b1c1b3b97c3f6d11858ee02f463596e29e7f0
+# Rearrange sources (#4997)
+bfafa2bb39e562901736d656806bd700c3699a2f
+# Rewrite includes (#4997)
+e61880699997398f5a746e6c4034edc7632661f5
+# Recompute loops (#4997)
+d25b5dcd568bb96c18e347d55fac10fe901a1bfb
+# Reformat code with clang-format-18
+02749feea88ce61c1f7eeb2d61a57d8ecf07ab11

.github/workflows/check-genesis-hooks.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           # Download install.sh
           curl -o /tmp/wasienv-install.sh https://raw.githubusercontent.com/wasienv/wasienv/master/install.sh
-          
+
           # Replace /bin to /local/bin
           sed -i 's|/bin|/local/bin|g' /tmp/wasienv-install.sh
 

.github/workflows/clang-format.yml

@@ -20,7 +20,7 @@ jobs:
         sudo apt-get update
         sudo apt-get install clang-format-${CLANG_VERSION}
     - name: Format first-party sources
-      run: find include src -type f \( -name '*.cpp' -o -name '*.hpp' -o -name '*.h' -o -name '*.ipp' \) -not -path "src/magic/magic_enum.h" -exec clang-format-${CLANG_VERSION} -i {} +
+      run: find include src -type f \( -name '*.cpp' -o -name '*.hpp' -o -name '*.h' -o -name '*.ipp' \) -exec clang-format-${CLANG_VERSION} -i {} +
     - name: Check for differences
       id: assert
       run: |

.github/workflows/verify-generated-headers.yml

@@ -16,8 +16,14 @@ jobs:
             generator: ./hook/generate_extern.sh
           - target: hook/sfcodes.h
             generator: bash ./hook/generate_sfcodes.sh
+          - target: hook/genesis/headers/sfcodes.h
+            generator: bash ./hook/generate_sfcodes.sh
           - target: hook/tts.h
             generator: ./hook/generate_tts.sh
+          - target: hook/ls_flags.h
+            generator: ./hook/generate_lsflags.sh
+          - target: hook/tx_flags.h
+            generator: ./hook/generate_txflags.sh
     runs-on: ubuntu-24.04
     env:
       CLANG_VERSION: 18

.github/workflows/xahau-ga-nix.yml

@@ -230,6 +230,9 @@ jobs:
   build:
     needs: matrix-setup
     runs-on: ${{ fromJSON(matrix.runs_on) }}
+    permissions:
+      id-token: write
+      contents: read
     container:
       image: ubuntu:24.04
       volumes:
@@ -332,7 +335,7 @@ jobs:
           # Install gcovr for coverage jobs
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
             pipx install "gcovr>=7,<9"
-            apt-get install -y lcov
+            apt-get install -y curl lcov
           fi
 
       - name: Check environment
@@ -407,7 +410,8 @@ jobs:
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
           stdlib: ${{ matrix.stdlib }}
-          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
+          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness
+          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
           cmake-target: 'coverage'
           ccache_max_size: '100G'
 
@@ -452,15 +456,24 @@ jobs:
 
       - name: Upload coverage report
         if: matrix.job_type == 'coverage'
-        uses: wandalen/wretry.action/main@v3
+        uses: codecov/codecov-action@v5
         with:
-          action: codecov/codecov-action@v4.3.0
-          with: |
-            files: coverage.xml
-            fail_ci_if_error: true
-            disable_search: true
-            verbose: true
-            plugin: noop
-            token: ${{ secrets.CODECOV_TOKEN }}
-          attempt_limit: 5
-          attempt_delay: 210000 # in milliseconds
+          files: coverage.xml
+          fail_ci_if_error: true
+          disable_search: true
+          verbose: true
+          plugins: noop
+          use_oidc: true
+
+      - name: Export server definitions
+        if: matrix.job_type == 'build' && matrix.compiler_id == 'gcc-13-libstdcxx'
+        run: |
+          ${{ env.build_dir }}/rippled --definitions | python3 -m json.tool > server_definitions.json
+
+      - name: Upload server definitions
+        if: matrix.job_type == 'build' && matrix.compiler_id == 'gcc-13-libstdcxx'
+        uses: actions/upload-artifact@v7
+        with:
+          name: server-definitions
+          path: server_definitions.json
+          archive: false

.gitignore

@@ -127,5 +127,12 @@ bld.rippled/
 generated
 .vscode
 
+# AI docs (local working documents)
+.ai-docs/
+
+# Local formal-methods workspace; kept as a separate repository and optionally
+# symlinked here for navigation.
+formal/lean/xahau_consensus
+
 # Suggested in-tree build directory
 /.build/

.testnet/.gitignore

@@ -0,0 +1,4 @@
+output/
+__pycache__/
+scenarios/odd-cases/
+scenarios/suite-experiments.yml

.testnet/scenarios/entropy/consensus_entropy_crash.py

@@ -0,0 +1,29 @@
+"""Scenario: ConsensusEntropy amendment crashes non-supporting node.
+
+Votes ConsensusEntropy accept on all nodes except n4, then waits for n4
+to crash as the amendment activates without its support.
+
+    x-testnet run --scenario-script consensus_entropy_crash.py
+"""
+
+from helpers import CONSENSUS_ENTROPY_FEATURE
+
+
+async def scenario(ctx, log):
+    await ctx.wait_for_ledger_close()
+    ctx.feature(CONSENSUS_ENTROPY_FEATURE, vetoed=False, exclude_nodes=[4])
+
+    log("Waiting for ConsensusEntropy to be voted for...")
+    await ctx.wait_for_feature(
+        CONSENSUS_ENTROPY_FEATURE,
+        check=lambda s: not s.get("vetoed"),
+        exclude_nodes=[4],
+        timeout=60,
+    )
+
+    log("Waiting for n4 to crash...")
+    op = await ctx.wait_for_nodes_down(nodes=[4], timeout=600)
+
+    ctx.assert_log("unsupported amendments activated", since=op.started, nodes=[4])
+    ctx.assert_exit_status(0, nodes=[4])
+    log("PASS: n4 shut down due to unsupported amendment")

.testnet/scenarios/entropy/entropy_with_transactions.py

@@ -0,0 +1,52 @@
+""":descr: entropy stays valid under transaction load"""
+
+from __future__ import annotations
+
+from helpers import require_entropy, get_entropy_tx, assert_valid_entropy
+
+variants = [
+    {"label": "light", "min_txns": 5, "max_txns": 10},
+    {"label": "heavy", "min_txns": 50, "max_txns": 60},
+    {"label": "super_heavy", "min_txns": 90, "max_txns": 120},
+]
+
+
+async def scenario(ctx, log, *, min_txns=5, max_txns=10, **_):
+    await require_entropy(ctx, log)
+
+    gen = ctx.txn_generator(min_txns=min_txns, max_txns=max_txns)
+    await gen.start()
+    await gen.wait_until_ready()
+    log(f"Transaction generator ready ({min_txns}-{max_txns} txns/ledger)")
+
+    # Wait for pipeline warmup + a few txn-bearing ledgers.
+    await ctx.wait_for_ledgers(3, node_id=0, timeout=60)
+
+    start_seq = ctx.validated_ledger_index(0)
+    await ctx.wait_for_ledgers(10, node_id=0, timeout=120)
+    end_seq = ctx.validated_ledger_index(0)
+    log(f"Inspecting ledgers {start_seq + 1} → {end_seq}")
+
+    digests = set()
+    total_user_txns = 0
+
+    for seq in range(start_seq + 1, end_seq + 1):
+        ce, user_txns = get_entropy_tx(ctx, seq)
+        digest, count = assert_valid_entropy(ce, seq, seen_digests=digests)
+        total_user_txns += len(user_txns)
+        log(
+            f"  Ledger {seq}: EntropyCount={count} "
+            f"user_txns={len(user_txns)} Digest={digest[:16]}..."
+        )
+
+    await gen.stop()
+
+    log(
+        f"Verified {end_seq - start_seq} ledgers: {total_user_txns} user txns, "
+        f"all entropy valid and unique"
+    )
+
+    if total_user_txns == 0:
+        raise AssertionError("No user transactions were included in any ledger")
+
+    log("PASS")

.testnet/scenarios/entropy/fallback_without_unl_report.py

@@ -0,0 +1,28 @@
+""":descr: healthy non-standalone testnet without UNLReport mints Tier 1 fallback"""
+
+from __future__ import annotations
+
+from helpers import require_entropy, get_entropy_tx, assert_consensus_fallback
+
+
+async def scenario(ctx, log):
+    await require_entropy(ctx, log)
+
+    # Non-standalone nodes require a ledger-anchored UNLReport before assigning
+    # validator_quorum / participant_aligned labels. Without it, the RNG pipeline
+    # may still collect commits/reveals, but injection must remain Tier 1.
+    await ctx.wait_for_ledgers(3, node_id=0, timeout=60)
+    log("Pipeline warmed up without UNLReport")
+
+    start_seq = ctx.validated_ledger_index(0)
+    await ctx.wait_for_ledgers(5, node_id=0, timeout=90)
+    end_seq = ctx.validated_ledger_index(0)
+    log(f"Inspecting ledgers {start_seq + 1} -> {end_seq}")
+
+    for seq in range(start_seq + 1, end_seq + 1):
+        ce, _ = get_entropy_tx(ctx, seq)
+        digest, count = assert_consensus_fallback(ce, seq)
+        log(f"  Ledger {seq}: EntropyCount={count} Digest={digest[:16]}...")
+
+    log(f"Verified {end_seq - start_seq} ledgers: all consensus_fallback")
+    log("PASS")

.testnet/scenarios/entropy/hook_entropy_api.py

@@ -0,0 +1,123 @@
+""":descr: compile, install, and invoke a Hook using the entropy_cr_* API"""
+
+from __future__ import annotations
+
+from helpers import require_entropy
+
+
+ENTROPY_HOOK_C = r"""
+#include <stdint.h>
+
+extern int32_t _g(uint32_t id, uint32_t maxiter);
+extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
+extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
+extern int64_t entropy_cr_random(
+    uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
+extern int64_t entropy_cr_status(void);
+
+#define GUARD(maxiter) _g((1ULL << 31U) + __LINE__, (maxiter) + 1)
+#define ENTROPY_TIER(x) (((uint64_t)(x) >> 32U) & 0xFFU)
+#define ENTROPY_COUNT(x) (((uint64_t)(x) >> 16U) & 0xFFFFU)
+#define ENTROPY_DENOMINATOR(x) ((uint64_t)(x) & 0xFFFFU)
+
+int64_t
+hook(uint32_t reserved)
+{
+    _g(1, 1);
+
+    int64_t status = entropy_cr_status();
+    if (status < 0)
+        return accept(0, 0, 10);
+
+    uint32_t tier = ENTROPY_TIER(status);
+    uint32_t count = ENTROPY_COUNT(status);
+    uint32_t denominator = ENTROPY_DENOMINATOR(status);
+    if (tier < 3 || count < 4 || denominator < count)
+        return accept(0, 0, 11);
+
+    int64_t die = entropy_cr_dice(6, 3);
+    if (die < 0 || die >= 6)
+        return accept(0, 0, 12);
+
+    uint8_t random_bytes[32];
+    for (int i = 0; GUARD(32), i < 32; ++i)
+        random_bytes[i] = 0;
+
+    if (entropy_cr_random((uint32_t)random_bytes, 32, 3) != 32)
+        return accept(0, 0, 13);
+
+    int nonzero = 0;
+    for (int i = 0; GUARD(32), i < 32; ++i)
+        if (random_bytes[i] != 0)
+            nonzero = 1;
+    if (!nonzero)
+        return accept(0, 0, 14);
+
+    return accept(0, 0, 0);
+}
+"""
+
+
+def assert_success(result, operation):
+    meta = result.get("meta", result.get("metaData", {}))
+    tx_result = meta.get("TransactionResult", result.get("engine_result", ""))
+    if tx_result != "tesSUCCESS":
+        raise AssertionError(f"{operation} failed: {result}")
+    return meta
+
+
+async def scenario(ctx, log):
+    await require_entropy(ctx, log)
+    await ctx.wait_for_ledgers(3, node_id=0, timeout=60)
+
+    await ctx.fund_accounts({"entropy_api": 1000})
+    account = ctx.account("entropy_api")
+
+    wasm = ctx.compile_hook(ENTROPY_HOOK_C, label="entropy-cr-api")
+    install = await ctx.submit_and_wait(
+        {
+            "TransactionType": "SetHook",
+            "Hooks": [
+                {
+                    "Hook": {
+                        "CreateCode": wasm.hex().upper(),
+                        "HookOn": "0" * 64,
+                        "HookNamespace": "0" * 64,
+                        "HookApiVersion": 0,
+                        "Flags": 1,
+                    }
+                }
+            ],
+            "Fee": "100000000",
+        },
+        account.wallet,
+    )
+    assert_success(install, "SetHook")
+    log("entropy_cr_* Hook installed")
+
+    invoke = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Invoke",
+            "Fee": "1000000",
+        },
+        account.wallet,
+    )
+    meta = assert_success(invoke, "Invoke")
+
+    executions = meta.get("HookExecutions", [])
+    if len(executions) != 1:
+        raise AssertionError(f"Expected one HookExecution, got: {executions}")
+
+    execution = executions[0].get("HookExecution", {})
+    if execution.get("HookResult") != 3:
+        raise AssertionError(f"Hook did not ACCEPT: {execution}")
+
+    if "HookReturnCode" not in execution:
+        raise AssertionError(f"HookReturnCode missing from execution: {execution}")
+
+    return_code = execution["HookReturnCode"]
+    if str(return_code) != "0":
+        raise AssertionError(f"entropy_cr_* Hook check failed: {execution}")
+
+    log("entropy_cr_status, entropy_cr_dice, and entropy_cr_random passed")
+    log("PASS")

.testnet/scenarios/entropy/participant_aligned_smoke.py

@@ -0,0 +1,162 @@
+""":descr: 5/6 validator_quorum, 4/6 participant_aligned (tier 2), recovery
+
+Requires node_count: 6 (see suite.yml) — the smallest NON-degenerate Tier 2
+size. At n=6: tier2 floor = 4, validator quorum = 5, validation quorum = 5. So
+  6/6, 5/6 present -> validator_quorum  (EntropyTier=3)
+  4/6 present      -> participant_aligned (EntropyTier=2, count 4)   <-- the band
+  3/6 present      -> consensus_fallback (EntropyTier=1)
+n=5 has NO tier-2 band (tier2 == quorum == 4), which is why the existing
+degradation smoke at 5 nodes only ever sees tier 3 / fallback.
+
+KEY: the 4/6 window is BELOW the 80% validation quorum (5). The 4 survivors
+keep CLOSING ledgers that carry tier-2 entropy, but those ledgers do NOT
+validate until the network recovers — exactly the transition window Tier 2
+serves. So validated_ledger_index() stalls; we instead inspect a surviving
+node's CLOSED ledger (its LCL) directly, and cross-check the injection from the
+cohort's logs.
+"""
+
+from __future__ import annotations
+
+from helpers import (
+    require_entropy,
+    get_entropy_tx,
+    assert_participant_aligned,
+    assert_validator_quorum,
+)
+
+
+def _closed_entropy(result):
+    """(seq, ConsensusEntropy tx) from a ctx.ledger('closed', transactions=True)
+    result, or (None, None) if the fetch returned no usable ledger.
+
+    Enforces the per-ledger invariant that an entropy-enabled closed ledger
+    carries EXACTLY ONE ConsensusEntropy pseudo-tx (mirroring get_entropy_tx):
+    a duplicate or missing injection raises here with a clear error instead of
+    being silently skipped and resurfacing later as a generic 'no tier-2 ledger'.
+    """
+    if not result or not isinstance(result.get("ledger"), dict):
+        return None, None
+    led = result["ledger"]
+    try:
+        seq = int(led.get("ledger_index"))
+    except (TypeError, ValueError):
+        return None, None
+    ce = [
+        t
+        for t in led.get("transactions", [])
+        if isinstance(t, dict) and t.get("TransactionType") == "ConsensusEntropy"
+    ]
+    if len(ce) != 1:
+        raise AssertionError(
+            f"Closed ledger {seq}: expected 1 ConsensusEntropy txn, got {len(ce)}"
+        )
+    return seq, ce[0]
+
+
+async def scenario(ctx, log):
+    await require_entropy(ctx, log)
+
+    # Baseline: healthy 6/6 produces validator_quorum entropy.
+    await ctx.wait_for_ledgers(1, node_id=0, timeout=30)
+
+    # --- 5/6: settles back to validator_quorum (5 present >= quorum 5) ---
+    val_before_drop = ctx.validated_ledger_index(0)
+    ctx.stop_node(5)
+    await ctx.wait_for_nodes_down(nodes=[5], timeout=30)
+    # Settle a few ledgers past the membership change. The ledger right at a
+    # validator drop can carry a transient consensus_fallback (tier 1, count 0,
+    # deterministic and by design) before the commit/reveal pipeline re-primes,
+    # so we do NOT assume any single post-drop ledger is already tier 3.
+    await ctx.wait_for_ledgers(4, node_id=0, timeout=90)
+
+    # 5/6 is at/above the 80% quorum (5), so steady state is validator_quorum.
+    # Scan the post-drop validated ledgers (all carry the 5-node cohort, so a
+    # tier-3 here has count == 5) and require at least one clean validator_quorum
+    # — EntropyTier=3, count >= quorum, non-zero digest — tolerating the
+    # transition fallback instead of depending on where the tip happened to land.
+    val_5of6 = ctx.validated_ledger_index(0)
+    t3_seq = None
+    for seq in range(val_5of6, val_before_drop, -1):
+        ce, _ = get_entropy_tx(ctx, seq)
+        tier = ce.get("EntropyTier")
+        log(f"  5/6 ledger {seq}: tier={tier} count={ce.get('EntropyCount')}")
+        if tier == 3:
+            assert_validator_quorum(ce, seq, min_count=5)
+            t3_seq = seq
+            break
+    if t3_seq is None:
+        raise AssertionError(
+            f"5/6: no validator_quorum (tier 3) entropy in post-drop validated "
+            f"ledgers {val_before_drop + 1}..{val_5of6}"
+        )
+    log(f"5/6: validator_quorum at validated seq {t3_seq}")
+
+    #@@start test-participant-aligned-window
+    # --- 4/6: participant_aligned (Tier 2) degraded window ---
+    ctx.stop_node(4)
+    await ctx.wait_for_nodes_down(nodes=[4], timeout=30)
+
+    # ~12s window: confirm tier-2 INJECTION from the cohort's logs, and that the
+    # round is NOT the below-quorum fallback path (which is what distinguishes
+    # the tier-2 band from the tier-1 fallback regime).
+    op = await ctx.sleep(12, name="tier2_window")
+    selected_t2 = ctx.search_logs(
+        r"RNG: entropy selected seq=\d+ tier=2 count=4",
+        within=op.window,
+        nodes=[0, 1, 2, 3],
+    )
+    log(f"4/6: 'entropy selected tier=2 count=4' logs: {selected_t2.count}")
+    if selected_t2.count == 0:
+        raise AssertionError(
+            "4/6 window injected no participant_aligned (tier 2) entropy: no "
+            "'RNG: entropy selected ... tier=2 count=4' on the surviving cohort"
+        )
+    ctx.assert_not_log(
+        r"STALLDIAG: rng-commit-timeout-below-quorum",
+        within=op.window,
+        nodes=[0, 1, 2, 3],
+    )
+
+    # Verify the on-ledger EntropyTier=2 DIRECTLY: validation is stalled (4 < 5),
+    # so sample the surviving cohort's CLOSED ledger (its LCL — built but not yet
+    # validated). At least one must be participant_aligned with EntropyCount=4.
+    tier2_on_ledger = 0
+    last_seq = None
+    for _ in range(5):
+        seq, ce = _closed_entropy(
+            ctx.ledger("closed", transactions=True, node_id=0)
+        )
+        if ce is not None and seq is not None and seq != last_seq:
+            last_seq = seq
+            tier = ce.get("EntropyTier")
+            count = ce.get("EntropyCount", -1)
+            log(f"  closed ledger {seq}: tier={tier} count={count}")
+            if tier == 2:
+                assert_participant_aligned(ce, seq, expected_count=4)
+                tier2_on_ledger += 1
+        await ctx.sleep(3)
+
+    if tier2_on_ledger == 0:
+        raise AssertionError(
+            "no closed participant_aligned (tier 2) ledger observed during the "
+            "4/6 window (tier 2 was injected per logs, but not seen on a closed "
+            "ledger)"
+        )
+    log(f"4/6: {tier2_on_ledger} participant_aligned closed ledger(s) verified")
+    #@@end test-participant-aligned-window
+
+    # --- Recovery: liveness — validation resumes once quorum is restored ---
+    ctx.start_node(4)
+    ctx.start_node(5)
+    await ctx.wait_for_ledgers(1, node_id=0, timeout=120)
+
+    val_recovered = ctx.validated_ledger_index(0)
+    if not val_recovered or val_recovered <= val_5of6:
+        raise AssertionError(
+            f"Validated ledger did not advance after recovery "
+            f"({val_5of6} -> {val_recovered})"
+        )
+    log(f"Recovered: validated seq {val_5of6} -> {val_recovered}")
+
+    log("PASS")

.testnet/scenarios/entropy/quorum_degradation_smoke.py

@@ -0,0 +1,164 @@
+""":descr: 4/5 liveness, 3/5 fail-closed sub-quorum window, recovery"""
+
+from __future__ import annotations
+
+from helpers import (
+    require_entropy,
+    get_entropy_tx,
+    entropy_fields,
+    assert_consensus_fallback,
+)
+
+
+def _closed_entropy(result):
+    """Return (seq, ConsensusEntropy tx) from a closed-ledger RPC result.
+
+    The 3/5 window is below validation quorum, so validated-ledger history is
+    expected to stall. Sampling a surviving node's closed ledger catches any
+    local LCL that advanced despite the sub-quorum condition.
+    """
+    if not result or not isinstance(result.get("ledger"), dict):
+        return None, None
+    ledger = result["ledger"]
+    try:
+        seq = int(ledger.get("ledger_index"))
+    except (TypeError, ValueError):
+        return None, None
+    ce = [
+        tx
+        for tx in ledger.get("transactions", [])
+        if isinstance(tx, dict) and tx.get("TransactionType") == "ConsensusEntropy"
+    ]
+    if len(ce) != 1:
+        raise AssertionError(
+            f"Closed ledger {seq}: expected 1 ConsensusEntropy txn, got {len(ce)}"
+        )
+    return seq, ce[0]
+
+
+async def scenario(ctx, log):
+    await require_entropy(ctx, log)
+
+    # Baseline: wait 1 ledger to confirm network is healthy.
+    await ctx.wait_for_ledgers(1, node_id=0, timeout=30)
+
+    # --- 4/5 liveness ---
+    ctx.stop_node(4)
+    await ctx.wait_for_nodes_down(nodes=[4], timeout=30)
+    await ctx.wait_for_ledgers(1, node_id=0, timeout=30)
+    log("4/5: liveness OK")
+
+    # Snapshot validated seq before dropping to 3/5.
+    val_before = ctx.validated_ledger_index(0)
+
+    # --- 3/5 degraded window ---
+    ctx.stop_node(3)
+    await ctx.wait_for_nodes_down(nodes=[3], timeout=30)
+
+    # 10s ≈ 3 rounds at 3s cadence.
+    await ctx.sleep(10)
+
+    val_after = ctx.validated_ledger_index(0)
+    log(f"3/5: validated ledger {val_before} → {val_after}")
+
+    if val_after and val_before and val_after > val_before:
+        raise AssertionError(
+            f"3/5 sub-quorum window unexpectedly validated ledgers "
+            f"({val_before} -> {val_after})"
+        )
+
+    # If the surviving cohort exposes an advanced closed ledger despite being
+    # below validation quorum, it must fail closed to consensus_fallback. This
+    # keeps the entropy assertion live without pretending validated history
+    # should advance at 3/5.
+    degraded_fallback = 0
+    last_closed = None
+    for _ in range(5):
+        seq, ce = _closed_entropy(ctx.ledger("closed", transactions=True, node_id=0))
+        if seq and val_before and seq > val_before and seq != last_closed:
+            last_closed = seq
+            digest, count = assert_consensus_fallback(ce, seq)
+            degraded_fallback += 1
+            log(
+                f"  3/5 closed ledger {seq}: EntropyCount={count} "
+                f"Digest={digest[:16]}... FALLBACK"
+            )
+        await ctx.sleep(2)
+
+    log(f"3/5 closed-ledger fallback samples: {degraded_fallback}")
+
+    # Log checks tied to current transition mechanics:
+    # - commit-set SHAMap publication is the observable output of entering the
+    #   commit sidecar phase
+    # - ConvergingCommit transition is the gateway out of seq=0-only behavior
+    # - rng-commit-timeout-below-quorum is the degraded-window fallback path
+    ctx.log_level("LedgerConsensus", "trace")
+    ctx.log_level("ConsensusExtensions", "trace")
+    op = await ctx.sleep(6, name="stall_window")
+
+    ctx.assert_not_log(
+        r"RNG: transitioned to ConvergingCommit", within=op.window, nodes=[0, 1, 2]
+    )
+    ctx.assert_not_log(
+        r"RNG: built commitSet SHAMap", within=op.window, nodes=[0, 1, 2]
+    )
+
+    gate_blocked = ctx.search_logs(
+        r"STALLDIAG: establish gate blocked reason=(pause|no-tx-consensus)",
+        within=op.window,
+        nodes=[0, 1, 2],
+    )
+    log(f"3/5: establish gate-blocked logs in 6s: {gate_blocked.count}")
+
+    below_quorum = ctx.search_logs(
+        r"STALLDIAG: rng-commit-timeout-below-quorum",
+        within=op.window,
+        nodes=[0, 1, 2],
+    )
+    log(f"3/5: RNG commit timeout below quorum logs in 6s: {below_quorum.count}")
+
+    # --- Recovery: restart nodes, verify ledger advancement ---
+    ctx.start_node(3)
+    ctx.start_node(4)
+    await ctx.wait_for_ledgers(1, node_id=0, timeout=120)
+
+    val_recovered = ctx.validated_ledger_index(0)
+    pre_recovery = max(v for v in [val_before, val_after] if v is not None)
+    log(f"Recovered: validated seq {pre_recovery} → {val_recovered}")
+
+    if not val_recovered or val_recovered <= pre_recovery:
+        raise AssertionError(
+            f"Validated ledger did not advance after recovery "
+            f"({pre_recovery} → {val_recovered})"
+        )
+
+    # Inspect post-recovery ledgers separately from the degraded window above.
+    # Once the network is back at quorum, validator-tier entropy is expected
+    # again (transitional fallback ledgers are fine) and must be quorum-met.
+    fallback_count = 0
+    validator_count = 0
+    for seq in range(pre_recovery + 1, val_recovered + 1):
+        ce, _ = get_entropy_tx(ctx, seq)
+        digest, entropy_count, is_fallback = entropy_fields(ce)
+
+        if is_fallback:
+            fallback_count += 1
+        else:
+            validator_count += 1
+            if entropy_count < 4:
+                raise AssertionError(
+                    f"Ledger {seq}: validator entropy with sub-quorum "
+                    f"EntropyCount={entropy_count} (need >= 4)"
+                )
+
+        log(
+            f"  Ledger {seq}: EntropyCount={entropy_count} "
+            f"{'FALLBACK' if is_fallback else 'VALIDATOR'}"
+        )
+
+    log(
+        f"Entropy summary: {fallback_count} fallback, "
+        f"{validator_count} validator"
+    )
+
+    log("PASS")

.testnet/scenarios/entropy/quorum_recovery_smoke.py

@@ -0,0 +1,44 @@
+""":descr: drop 2 nodes (3/5 stall), restart both, verify recovery"""
+
+from __future__ import annotations
+
+from helpers import require_entropy
+
+
+async def scenario(ctx, log):
+    await require_entropy(ctx, log)
+
+    await ctx.wait_for_ledgers(1, node_id=0, timeout=60)
+    log("Baseline OK")
+
+    # Drop 2 nodes → validation stall.
+    ctx.stop_node(3)
+    ctx.stop_node(4)
+    await ctx.wait_for_nodes_down(nodes=[3, 4], timeout=30)
+
+    info = ctx.rpc.server_info(node_id=0)
+    val_before = info.get("info", {}).get("validated_ledger", {}).get("seq", 0)
+    log(f"Stalled at validated seq {val_before}")
+
+    # Let it sit for a few rounds in degraded state.
+    await ctx.sleep(6)
+
+    # Bring both nodes back.
+    ctx.start_node(3)
+    ctx.start_node(4)
+    log("Restarted n3 and n4, waiting for recovery...")
+
+    # Recovery: wait for ANY validated ledger advance on n0.
+    await ctx.wait_for_ledger_close(node_id=0, timeout=60)
+
+    info = ctx.rpc.server_info(node_id=0)
+    val_after = info.get("info", {}).get("validated_ledger", {}).get("seq", 0)
+    log(f"Recovered: validated seq {val_before} → {val_after}")
+
+    if val_after <= val_before:
+        raise AssertionError(
+            f"Validated ledger did not advance after recovery "
+            f"({val_before} → {val_after})"
+        )
+
+    log("PASS")

.testnet/scenarios/entropy/steady_state_entropy.py

@@ -0,0 +1,27 @@
+""":descr: all 5 nodes healthy, every ledger has valid unique quorum-met entropy"""
+
+from __future__ import annotations
+
+from helpers import require_entropy, get_entropy_tx, assert_valid_entropy
+
+
+async def scenario(ctx, log):
+    await require_entropy(ctx, log)
+
+    # Wait for the RNG pipeline to warm up past initial proposal/sidecar gossip.
+    await ctx.wait_for_ledgers(3, node_id=0, timeout=60)
+    log("Pipeline warmed up")
+
+    start_seq = ctx.validated_ledger_index(0)
+    await ctx.wait_for_ledgers(10, node_id=0, timeout=120)
+    end_seq = ctx.validated_ledger_index(0)
+    log(f"Inspecting ledgers {start_seq + 1} → {end_seq}")
+
+    digests = set()
+    for seq in range(start_seq + 1, end_seq + 1):
+        ce, _ = get_entropy_tx(ctx, seq)
+        digest, count = assert_valid_entropy(ce, seq, seen_digests=digests)
+        log(f"  Ledger {seq}: EntropyCount={count} Digest={digest[:16]}...")
+
+    log(f"Verified {end_seq - start_seq} ledgers: all quorum entropy, all unique")
+    log("PASS")

.testnet/scenarios/export-suite.yml

@@ -0,0 +1,108 @@
+defaults:
+  network:
+    node_count: 5
+    launcher: tmux
+    find_ports: true
+    slave_delay: 0.2
+    features:
+      - ConsensusEntropy
+      - Export
+    track_features:
+      - ConsensusEntropy
+      - Export
+    unl_report: true
+    log_levels:
+      TxQ: info
+      Protocol: debug
+      Peer: debug
+      LedgerConsensus: debug
+      ConsensusExtensions: debug
+      NetworkOPs: info
+    rc:
+      - rng_poll_ms=333
+
+tests:
+  # --- CE + Export (post-validation shares, sidecar root convergence) ---
+  - name: steady_state_export_ce
+    script: .testnet/scenarios/export/steady_state_export.py
+
+  - name: retriable_export_ce
+    script: .testnet/scenarios/export/retriable_export.py
+
+  - name: export_degradation_ce
+    script: .testnet/scenarios/export/export_degradation.py
+    network:
+      rc:
+        - rng_poll_ms=333
+        - n3:no_export_sig=true
+        - n4:no_export_sig=true
+
+  - name: export_without_unl_report
+    script: .testnet/scenarios/export/export_without_unl_report.py
+    network:
+      features:
+        - Export
+      track_features:
+        - Export
+      unl_report: false
+
+  - name: export_no_veto_missing_observation
+    script: .testnet/scenarios/export/export_no_veto_missing_observation.py
+    network:
+      rc:
+        - rng_poll_ms=333
+        - n4:no_export_sig_hash=true
+
+  - name: export_share_subscription
+    script: .testnet/scenarios/export/export_share_subscription.py
+
+  - name: export_two_member_committee_recovery
+    script: .testnet/scenarios/export/export_committee_recovery.py
+
+  # CE + Export: 1 node suppressed, 4/5 = 80% quorum, should succeed
+  - name: export_ce_one_node_down
+    script: .testnet/scenarios/export/export_quorum.py
+    params:
+      expect_success: true
+    network:
+      rc:
+        - rng_poll_ms=333
+        - n4:no_export_sig=true
+
+  # --- Export only, no CE (80% active-view quorum) ---
+  - name: export_only_all_up
+    script: .testnet/scenarios/export/export_quorum.py
+    params:
+      expect_success: true
+    network:
+      features:
+        - Export
+      track_features:
+        - Export
+
+  - name: export_only_one_node_down
+    script: .testnet/scenarios/export/export_quorum.py
+    params:
+      expect_success: true
+    network:
+      features:
+        - Export
+      track_features:
+        - Export
+      rc:
+        - rng_poll_ms=333
+        - n4:no_export_sig=true
+
+  - name: export_only_two_nodes_down
+    script: .testnet/scenarios/export/export_quorum.py
+    params:
+      expect_success: false
+    network:
+      features:
+        - Export
+      track_features:
+        - Export
+      rc:
+        - rng_poll_ms=333
+        - n3:no_export_sig=true
+        - n4:no_export_sig=true

.testnet/scenarios/export/export_committee_recovery.py

@@ -0,0 +1,126 @@
+""":descr: a 2-of-5 Export committee recovers without a new intent
+
+The intent selects only validators n0 and n4, so qC is 2. Validator n4 is
+stopped before admission: the network still validates the intent with 4/5, but
+one selected share cannot form a witness. Restarting n4 must republish its share
+for the same live latch and complete the witness without resubmitting Export.
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    bitmap_positions,
+    find_export_signature_witness,
+    find_export_txns,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+
+
+async def scenario(ctx, log):
+    await require_export(ctx, log)
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+
+    if not ctx.stop_node(4):
+        raise AssertionError("Failed to stop selected validator n4")
+    await ctx.wait_for_nodes_down(nodes=[4], timeout=30)
+    log("Stopped selected validator n4; selected committee is n0+n4")
+
+    current = ctx.validated_ledger_index(0)
+    result = await submit_direct_export(
+        ctx,
+        log,
+        {
+            "TransactionType": "Export",
+            "Fee": "1000000",
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current + 1,
+                "LastLedgerSequence": current + EXPORT_RETRY_LEDGER_WINDOW,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        committee_node_ids=[0, 4],
+    )
+    if result.get("engine_result") != "tesSUCCESS":
+        raise AssertionError(f"Export intent failed: {result}")
+
+    origin = result.get("hash")
+    origin_seq = int(result.get("ledger_index"))
+    if not origin:
+        raise AssertionError(f"Validated Export missing hash: {result}")
+
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        origin_hash=origin,
+        expect_witness=False,
+    )
+    selected = {0, 1}
+
+    await ctx.wait_for_ledger(origin_seq + 1, node_id=0, timeout=30)
+    if find_export_signature_witness(ctx, origin_seq + 1, origin):
+        raise AssertionError(
+            "Witness formed while one of two selected signers was down"
+        )
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        origin_hash=origin,
+        expect_witness=False,
+    )
+    log("No witness with only one selected signer; original latch remains pending")
+
+    if not ctx.start_node(4):
+        raise AssertionError("Failed to restart selected validator n4")
+    await ctx.wait_for_nodes(
+        lambda node_id: ctx.rpc.server_info(node_id) is not None,
+        nodes=[4],
+        timeout=30,
+        poll_interval=0.5,
+        name="selected-export-validator-up",
+    )
+    log("Restarted selected validator n4")
+
+    witness = await wait_for_export_signature_witness(
+        ctx, log, origin, after_ledger=origin_seq
+    )
+    contributors = bitmap_positions(witness["EntropyContributors"])
+    if contributors != selected:
+        raise AssertionError(
+            f"Recovered witness contributors {contributors} != selected {selected}"
+        )
+    if len(witness["_WitnessSigners"]) != 2:
+        raise AssertionError(
+            f"Recovered witness has {len(witness['_WitnessSigners'])} signers, need 2"
+        )
+    witness_seq = int(witness["LedgerSequence"])
+    for seq in range(origin_seq + 1, witness_seq + 1):
+        if any(tx.get("Account") == alice.address for tx in find_export_txns(ctx, seq)):
+            raise AssertionError(
+                f"A second Export was submitted before recovery in ledger {seq}"
+            )
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        origin_hash=origin,
+        expect_witness=True,
+    )
+    log(f"Same Export {origin} completed after selected validator recovery")
+    log("PASS")

.testnet/scenarios/export/export_degradation.py

@@ -0,0 +1,118 @@
+""":descr: Submit ttEXPORT with 2 nodes suppressing export signatures and
+verify the admitted intent remains unwitnessed through its publication window.
+
+Nodes 3 and 4 have runtime_config no_export_sig=true, so only 3/5 nodes
+provide export signatures. With 80% quorum = ceil(5*0.8) = 4 required,
+the export cannot reach quorum and no ExportSignatures witness may be recorded.
+
+Flow:
+  1. Fund alice and bob
+  2. alice submits ttEXPORT with an explicit authority declaration
+  3. Only 3/5 post-validation shares become available (need 4)
+  4. Verify the publication window closes without a witness
+  5. Verify subsequent payment still works (sequence not permanently blocked)
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+
+
+async def scenario(ctx, log):
+    await require_export(ctx, log)
+
+    # --- Setup ---
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    log("Accounts funded")
+
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+    current_seq = ctx.validated_ledger_index(0)
+
+    log(f"Current ledger: {current_seq}")
+    log("Nodes 3,4 have runtime_config no_export_sig=true (3/5 sigs, need 4)")
+
+    #@@start test-export-below-quorum-expiry
+    # --- Submit intent; only 3/5 validators release shares. ---
+    result = await submit_direct_export(
+        ctx,
+        log,
+        {
+            "TransactionType": "Export",
+            "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+            "Fee": "1000000",
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current_seq + 1,
+                "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        timeout=60,
+    )
+
+    final_seq = result.get("ledger_index", ctx.validated_ledger_index(0))
+    origin_hash = result.get("hash")
+    engine_result = result.get("engine_result", "")
+    log(f"Export intent admitted at ledger {final_seq}, result: {engine_result}")
+
+    if engine_result != "tesSUCCESS":
+        raise AssertionError(f"Expected admitted intent, got {engine_result}")
+    if not origin_hash:
+        raise AssertionError(f"Validated Export missing hash: {result}")
+
+    await wait_for_export_signature_witness(
+        ctx,
+        log,
+        origin_hash,
+        after_ledger=final_seq,
+        expect_witness=False,
+    )
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        expect_exists=True,
+        origin_hash=origin_hash,
+        expect_witness=False,
+    )
+    #@@end test-export-below-quorum-expiry
+
+    # --- Verify subsequent payment works regardless ---
+    log("Submitting payment from alice to bob...")
+    pay_result = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Payment",
+            "Destination": bob.address,
+            "Amount": "1000000",
+            "Fee": "12",
+        },
+        alice.wallet,
+        timeout=30,
+    )
+
+    pay_engine = pay_result.get("engine_result", "")
+    log(f"Payment result: {pay_engine}")
+
+    if pay_engine != "tesSUCCESS":
+        raise AssertionError(
+            f"Payment failed after unwitnessed export: {pay_engine} "
+            f"-- sequence may be blocked"
+        )
+
+    log("Payment succeeded -- account not permanently blocked")
+    log("PASS")

.testnet/scenarios/export/export_helpers.py

@@ -0,0 +1,458 @@
+"""Shared helpers for Export scenario tests."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+
+from xahaud_scripts.testnet.config import (
+    _decode_node_public_key,
+    _unl_report_index,
+    feature_name_to_hash,
+)
+
+EXPORT_RETRY_LEDGER_WINDOW = 5
+EXPORT_PUBLICATION_LEDGER_WINDOW = 5
+
+
+async def require_export(
+    ctx, log, *, require_unl_report=True, require_runtime_config=True
+):
+    """Wait for first ledger and assert Export is enabled.
+
+    Network-mode Export success requires a parent-ledger UNLReport-backed
+    active validator view. Most export scenarios seed that report in genesis;
+    assert it here so a success-path test cannot accidentally pass setup
+    without the condition Export::doApply requires. The no-UNLReport retry
+    scenario opts out deliberately.
+
+    The tracked export suite also uses XAHAUD_RUNTIME_TEST_CONFIG for polling
+    and fault-injection knobs. Default binaries reject the runtime_config RPC,
+    so check it up front rather than silently running without those knobs.
+    """
+    await ctx.wait_for_ledger_close(timeout=120)
+
+    if require_runtime_config:
+        result = ctx.rpc.runtime_config(0)
+        if not result or result.get("error"):
+            raise AssertionError(
+                "Export suite requires a binary built with "
+                "xahaud_runtime_test_config=ON; runtime_config RPC returned "
+                f"{result}"
+            )
+        log("RuntimeConfig RPC active")
+
+    feature = ctx.feature_check(feature_name_to_hash("Export"), node_id=0)
+    if not feature or not feature.get("enabled", False):
+        raise AssertionError(f"Export not enabled: {feature}")
+    log("Export enabled")
+
+    if require_unl_report:
+        result = ctx.rpc.ledger_entry(0, _unl_report_index())
+        node = (result or {}).get("node", {})
+        active = node.get("ActiveValidators", [])
+        if node.get("LedgerEntryType") != "UNLReport" or not active:
+            raise AssertionError(
+                "Export success scenario requires a ledger UNLReport with "
+                f"ActiveValidators, got: {result}"
+            )
+        log(f"UNLReport active validators: {len(active)}")
+
+
+def find_export_txns(ctx, seq):
+    """Find Export transactions in a ledger.
+
+    Returns list of Export transaction dicts.
+    """
+    result = ctx.ledger(seq, transactions=True)
+    if not result:
+        return []
+
+    txns = result.get("ledger", {}).get("transactions", [])
+    return [tx for tx in txns if tx.get("TransactionType") == "Export"]
+
+
+def _validator_master_keys_by_node(ctx):
+    """Return generated validator master keys keyed by testnet node id."""
+    network = json.loads((ctx.base_dir / "network.json").read_text())
+    return {
+        int(node["id"]): _decode_node_public_key(node["public_key"])
+        for node in network["nodes"]
+    }
+
+
+def _export_committee_fields(master_keys):
+    """Return the canonical roster and its protocol content digest."""
+    encoded = [bytes.fromhex(key) for key in master_keys]
+    if not encoded or len(encoded) > 32 or len(set(encoded)) != len(encoded):
+        raise AssertionError("Export committee requires 1..32 unique masters")
+    encoded.sort()
+    roster = b"".join(encoded)
+    preimage = b"ECM\0" + len(encoded).to_bytes(4, "big") + roster
+    digest = hashlib.sha512(preimage).digest()[:32]
+    return {
+        "ExportCommitteeHash": digest.hex().upper(),
+        "ExportCommittee": roster.hex().upper(),
+    }
+
+
+def bitmap_positions(bitmap):
+    """Return set positions from a witness contributor bitmap."""
+    raw = bytes.fromhex(bitmap) if isinstance(bitmap, str) else bytes(bitmap)
+    return {
+        byte_index * 8 + bit_index
+        for byte_index, byte in enumerate(raw)
+        for bit_index in range(8)
+        if byte & (1 << bit_index)
+    }
+
+
+def export_authority(ctx, *, require_unl_report=True, committee_node_ids=None):
+    """Build an account-owned committee declaration for a direct Export."""
+    ledger_result = ctx.ledger("validated") or {}
+    ledger = ledger_result.get("ledger", {})
+    ledger_hash = ledger_result.get("ledger_hash") or ledger.get("hash")
+    if not ledger_hash:
+        raise AssertionError(f"Validated ledger hash unavailable: {ledger_result}")
+
+    report = (
+        ctx.rpc.request(
+            0,
+            "ledger_entry",
+            {"index": _unl_report_index(), "ledger_hash": ledger_hash},
+        )
+        or {}
+    )
+    active = report.get("node", {}).get("ActiveValidators", [])
+    if not active:
+        if require_unl_report:
+            raise AssertionError(f"UNLReport active validators unavailable: {report}")
+        # The negative scenario still submits a structurally valid roster so
+        # source eligibility, rather than client construction, rejects it.
+        masters = _validator_master_keys_by_node(ctx)
+        selected_ids = (
+            sorted(masters) if committee_node_ids is None else committee_node_ids
+        )
+        return _export_committee_fields([masters[node_id] for node_id in selected_ids])
+
+    active_keys = set()
+    for entry in active:
+        validator = entry.get("ActiveValidator", entry)
+        key = validator.get("PublicKey")
+        if not key:
+            raise AssertionError(f"Malformed UNLReport validator entry: {entry}")
+        active_keys.add(key.upper())
+    active_keys = sorted(active_keys, key=bytes.fromhex)
+
+    if committee_node_ids is None:
+        selected_keys = active_keys
+    else:
+        masters = _validator_master_keys_by_node(ctx)
+        selected_keys = []
+        for node_id in committee_node_ids:
+            if node_id not in masters:
+                raise AssertionError(f"Unknown testnet validator node n{node_id}")
+            if masters[node_id] not in active_keys:
+                raise AssertionError(
+                    f"Validator n{node_id} is absent from the active UNLReport"
+                )
+            selected_keys.append(masters[node_id])
+        if not selected_keys:
+            raise AssertionError("Export committee must select at least one validator")
+
+    return _export_committee_fields(selected_keys)
+
+
+async def create_export_committee(
+    ctx, log, wallet, *, committee_node_ids=None
+):
+    """Create one immutable account-owned committee and return its fields."""
+    authority = export_authority(ctx, committee_node_ids=committee_node_ids)
+    result = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Export",
+            "ExportCommittee": authority["ExportCommittee"],
+            "Fee": "1000000",
+        },
+        wallet,
+    )
+    meta = result.get("meta", result.get("metaData", {}))
+    if meta.get("TransactionResult") != "tesSUCCESS":
+        raise AssertionError(f"Export committee setup failed: {result}")
+    log(f"Export committee created: {authority['ExportCommitteeHash']}")
+    return authority
+
+
+def find_export_signature_witness(ctx, seq, origin_hash):
+    """Find a later-ledger ExportSignatures witness for an Export origin."""
+    result = ctx.ledger(seq, transactions=True)
+    txns = (result or {}).get("ledger", {}).get("transactions", [])
+    for tx in txns:
+        if not isinstance(tx, dict):
+            continue
+        if tx.get("TransactionType") != "ExportSignatures":
+            continue
+        if tx.get("TransactionHash") == origin_hash:
+            return tx
+    return None
+
+
+async def wait_for_export_signature_witness(
+    ctx,
+    log,
+    origin_hash,
+    *,
+    after_ledger,
+    max_ledgers=EXPORT_PUBLICATION_LEDGER_WINDOW,
+    expect_witness=True,
+):
+    """Wait through the publication window for an origin-keyed witness."""
+    scanned = after_ledger
+    target = after_ledger + max_ledgers
+    while scanned < target:
+        current = ctx.validated_ledger_index(0)
+        if current is None or current <= scanned:
+            await ctx.wait_for_ledger(scanned + 1, node_id=0, timeout=30)
+            current = ctx.validated_ledger_index(0)
+        if current is None or current <= scanned:
+            continue
+
+        scan_through = min(current, target)
+        for seq in range(scanned + 1, scan_through + 1):
+            witness = find_export_signature_witness(ctx, seq, origin_hash)
+            if witness:
+                if not expect_witness:
+                    raise AssertionError(
+                        f"Unexpected ExportSignatures witness in ledger {seq}"
+                    )
+                log(f"  ExportSignatures witness found in ledger {seq}")
+                return assert_export_witness(witness, origin_hash, seq, log)
+        scanned = scan_through
+
+    if expect_witness:
+        raise AssertionError(
+            f"No ExportSignatures witness for {origin_hash} within "
+            f"{max_ledgers} validated ledgers"
+        )
+    log(f"  No witness observed through ledger {scanned}")
+    return None
+
+
+async def wait_for_validated_transaction(
+    ctx, tx_hash, *, after_ledger, max_ledgers=EXPORT_RETRY_LEDGER_WINDOW
+):
+    """Resolve a raw non-tes submit result to validated transaction evidence."""
+    checked = after_ledger
+    target = after_ledger + max_ledgers
+    while True:
+        result = ctx.rpc.request(0, "tx", {"transaction": tx_hash}) or {}
+        if result.get("validated"):
+            return result
+        if checked >= target:
+            break
+        await ctx.wait_for_ledger(checked + 1, node_id=0, timeout=30)
+        current = ctx.validated_ledger_index(0)
+        checked = min(target, max(checked + 1, current or checked + 1))
+    raise AssertionError(f"Transaction {tx_hash} did not validate by ledger {target}")
+
+
+async def submit_direct_export(
+    ctx,
+    log,
+    tx,
+    wallet,
+    *,
+    timeout=60,
+    max_rebases=2,
+    committee_node_ids=None,
+):
+    """Submit a direct Export, rebasing after a validated parent mismatch."""
+    for attempt in range(max_rebases + 1):
+        current = ctx.validated_ledger_index(0)
+        if current is None:
+            raise AssertionError("Validated ledger unavailable before Export")
+
+        candidate = dict(tx)
+        candidate.update(export_authority(ctx, committee_node_ids=committee_node_ids))
+        candidate["LastLedgerSequence"] = current + EXPORT_RETRY_LEDGER_WINDOW
+        result = await ctx.submit_and_wait(candidate, wallet, timeout=timeout)
+        if result.get("engine_result") != "tecEXPORT_COMMITTEE_UNAVAILABLE":
+            return result
+
+        tx_hash = result.get("hash") or result.get("tx_json", {}).get("hash")
+        if not tx_hash:
+            raise AssertionError(f"Committee eligibility failure missing tx hash: {result}")
+        validated = result
+        if not result.get("validated"):
+            validated = await wait_for_validated_transaction(
+                ctx, tx_hash, after_ledger=current
+            )
+        meta = validated.get("meta", {})
+        if meta.get("TransactionResult") != "tecEXPORT_COMMITTEE_UNAVAILABLE":
+            raise AssertionError(
+                f"Unexpected validated rebase result for {tx_hash}: {validated}"
+            )
+        log(f"  Direct Export parent changed; rebasing attempt {attempt + 1}")
+
+    raise AssertionError(f"Direct Export parent changed more than {max_rebases} times")
+
+
+def dst_param(address):
+    """Encode an address as a HookParameter entry for the DST param."""
+    from xrpl.core.addresscodec import decode_classic_address
+
+    dst_hex = decode_classic_address(address).hex().upper()
+    return {
+        "HookParameter": {
+            "HookParameterName": "445354",  # "DST"
+            "HookParameterValue": dst_hex,
+        }
+    }
+
+
+def assert_hook_accepted(meta, log, *, expected_emits=1, expected_exports=None):
+    """Assert hook executed with ACCEPT and expected emission counts.
+
+    Checks sfHookExecutions in transaction metadata.
+    Returns the hook execution entry for further inspection.
+    """
+    hook_execs = meta.get("HookExecutions", [])
+    if not hook_execs:
+        raise AssertionError("No HookExecutions in metadata")
+
+    exec_entry = hook_execs[0].get("HookExecution", {})
+    hook_result = exec_entry.get("HookResult", -1)
+    emit_count = exec_entry.get("HookEmitCount", -1)
+    export_count = exec_entry.get("HookExportCount")
+    return_code = exec_entry.get("HookReturnCode", "")
+
+    log(
+        f"  HookResult={hook_result} EmitCount={emit_count} "
+        f"ExportCount={export_count} ReturnCode={return_code}"
+    )
+
+    # HookResult 3 = ExitType::ACCEPT
+    if hook_result != 3:
+        raise AssertionError(
+            f"Hook did not ACCEPT: HookResult={hook_result} ReturnCode={return_code}"
+        )
+
+    if emit_count != expected_emits:
+        raise AssertionError(f"Expected {expected_emits} emits, got {emit_count}")
+
+    if expected_exports is not None and export_count != expected_exports:
+        raise AssertionError(f"Expected {expected_exports} exports, got {export_count}")
+
+    # ReturnCode 0 = success; non-zero = ASSERT line number in hook
+    if return_code and str(return_code) != "0":
+        raise AssertionError(
+            f"Hook returned error code {return_code} "
+            f"(likely ASSERT failure at that line)"
+        )
+
+    return exec_entry
+
+
+def _signer_entries(witness):
+    entries = []
+    for entry in witness.get("ExportSigners", []):
+        signer = entry.get("ExportSigner", entry)
+        entries.append(signer)
+    return entries
+
+
+def assert_export_witness(witness, origin_hash, ledger_seq, log):
+    """Assert a later-ledger witness contains one ordered signature record."""
+    if witness.get("TransactionType") != "ExportSignatures":
+        raise AssertionError("Expected ExportSignatures witness")
+    if witness.get("TransactionHash") != origin_hash:
+        raise AssertionError("ExportSignatures origin binding mismatch")
+    if witness.get("LedgerSequence") != ledger_seq:
+        raise AssertionError("ExportSignatures ledger binding mismatch")
+    if witness.get("Signers"):
+        raise AssertionError("Witness must not contain ordinary Signers")
+    if witness.get("ExportedTxn", {}).get("Signers"):
+        raise AssertionError("Witness ExportedTxn must be unsigned")
+    contributors = witness.get("EntropyContributors")
+    if not contributors:
+        raise AssertionError("ExportSignatures missing contributor bitmap")
+
+    signers = _signer_entries(witness)
+    if not signers:
+        raise AssertionError("ExportSignatures has no ExportSigners")
+    if any(
+        not signer.get("SigningPubKey") or not signer.get("TxnSignature")
+        for signer in signers
+    ):
+        raise AssertionError("ExportSignatures has a malformed ExportSigner")
+    contributor_count = sum(byte.bit_count() for byte in bytes.fromhex(contributors))
+    if contributor_count != len(signers):
+        raise AssertionError(
+            "ExportSignatures contributor bitmap and ordered signer count differ"
+        )
+    log(f"  Witness signers: {len(signers)} validator(s)")
+    witness["_WitnessSigners"] = signers
+    return witness
+
+
+def assert_export_latch(
+    ctx,
+    account_address,
+    log,
+    *,
+    expect_exists=True,
+    origin_hash=None,
+    expect_witness=None,
+    ledger_hash=None,
+):
+    """Assert Export latch exists (or doesn't) for the account."""
+    params = {"account": account_address, "ledger_index": "validated"}
+    if ledger_hash is not None:
+        del params["ledger_index"]
+        params["ledger_hash"] = ledger_hash
+    obj_result = ctx.rpc.request(0, "account_objects", params)
+    if not obj_result or obj_result.get("error"):
+        raise AssertionError(f"account_objects RPC failed: {obj_result}")
+    if obj_result.get("validated") is not True:
+        raise AssertionError(f"account_objects result is not validated: {obj_result}")
+    if ledger_hash is not None and obj_result.get("ledger_hash") != ledger_hash:
+        raise AssertionError(
+            "account_objects returned wrong ledger: "
+            f"expected {ledger_hash}, got {obj_result.get('ledger_hash')}"
+        )
+
+    all_objects = obj_result.get("account_objects", [])
+    export_latches = [
+        obj for obj in all_objects if obj.get("LedgerEntryType") == "ExportLatch"
+    ]
+    log(f"  Export latches: {len(export_latches)}")
+
+    if origin_hash is not None:
+        export_latches = [
+            latch
+            for latch in export_latches
+            if latch.get("TransactionHash") == origin_hash
+        ]
+
+    if expect_exists and not export_latches:
+        raise AssertionError("Expected Export latch but none found")
+    if not expect_exists and export_latches:
+        raise AssertionError(
+            f"Expected no Export latches but found {len(export_latches)}"
+        )
+
+    for latch in export_latches:
+        if "Digest" not in latch:
+            raise AssertionError(
+                "ExportLatch missing signature-independent intent Digest"
+            )
+        if "TransactionHash" not in latch:
+            raise AssertionError("ExportLatch missing Export origin TransactionHash")
+        if "ExportCommitteeHash" not in latch:
+            raise AssertionError("ExportLatch missing ExportCommitteeHash")
+        if expect_witness is True and "ExportSignatureHash" not in latch:
+            raise AssertionError("ExportLatch missing ExportSignatureHash")
+        if expect_witness is False and "ExportSignatureHash" in latch:
+            raise AssertionError("Pending ExportLatch unexpectedly witnessed")
+
+    return export_latches

.testnet/scenarios/export/export_no_veto_missing_observation.py

@@ -0,0 +1,96 @@
+""":descr: Export succeeds when quorum sidecar material exists but one active
+validator withholds exportSigSetHash observation.
+
+Node 4 has runtime_config no_export_sig_hash=true. It still attaches export
+signatures, but it does not publish its exportSigSetHash in proposals. The
+remaining 4/5 active validators can still align on the same export sidecar
+hash, so the round must not retry/expire just because fullObservation is false.
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+
+
+async def scenario(ctx, log):
+    await require_export(ctx, log)
+
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    log("Accounts funded")
+
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+    current_seq = ctx.validated_ledger_index(0)
+
+    log(f"Current ledger: {current_seq}")
+    log("Node 4 withholds exportSigSetHash but still attaches export signatures")
+
+    export_start = ctx.mark("export-no-veto-submit-start")
+    result = await submit_direct_export(
+        ctx,
+        log,
+        {
+            "TransactionType": "Export",
+            "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+            "Fee": "1000000",
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current_seq + 1,
+                "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        timeout=60,
+    )
+
+    final_seq = result.get("ledger_index", ctx.validated_ledger_index(0))
+    origin_hash = result.get("hash")
+    engine_result = result.get("engine_result", "")
+
+    log(f"Export completed at ledger {final_seq}, result: {engine_result}")
+    if engine_result != "tesSUCCESS":
+        raise AssertionError(f"Expected tesSUCCESS, got {engine_result}")
+    if not origin_hash:
+        raise AssertionError(f"Validated Export missing hash: {result}")
+
+    witness = await wait_for_export_signature_witness(
+        ctx, log, origin_hash, after_ledger=final_seq
+    )
+    signers = witness.get("_WitnessSigners", [])
+    if len(signers) < 4:
+        raise AssertionError(f"Expected at least 4 signers, got {len(signers)}")
+    log(f"Export signer count: {len(signers)}")
+
+    # The validated witness proves the missing observation did not veto the
+    # round. Pin the injected fault separately; the internal no-veto diagnostic
+    # may be flushed after witness observation and is not part of the contract.
+    withhold_logs = ctx.assert_log(
+        r"Export: withholding exportSigSetHash",
+        since=export_start,
+    )
+    log(f"Export sidecar hash withholding logs: {withhold_logs.count}")
+
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        expect_exists=True,
+        origin_hash=origin_hash,
+        expect_witness=True,
+    )
+
+    log("PASS")

.testnet/scenarios/export/export_quorum.py

@@ -0,0 +1,129 @@
+""":descr: Test Export witness quorum behavior. Every valid intent is admitted;
+enough selected validators produce a later witness, while a below-quorum intent
+remains unwitnessed through its bounded publication window.
+
+Parameterized via `expect_success` kwarg from suite.yml.
+
+Flow:
+  1. Fund alice and bob
+  2. alice submits ttEXPORT
+  3. Verify the intent validates with tesSUCCESS
+  4. Verify a later witness exists only when the committee reaches quorum
+  5. Verify subsequent payment works regardless
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+
+
+async def scenario(ctx, log, expect_success=True):
+    await require_export(ctx, log)
+
+    # --- Setup ---
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    log("Accounts funded")
+
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+    current_seq = ctx.validated_ledger_index(0)
+
+    log(f"Current ledger: {current_seq}")
+    outcome = "success" if expect_success else "failure (below quorum)"
+    log(f"Expecting export {outcome}")
+
+    # --- Submit ttEXPORT ---
+    result = await submit_direct_export(
+        ctx,
+        log,
+        {
+            "TransactionType": "Export",
+            "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+            "Fee": "1000000",
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current_seq + 1,
+                "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        timeout=60,
+    )
+
+    final_seq = result.get("ledger_index", ctx.validated_ledger_index(0))
+    origin_hash = result.get("hash")
+    engine_result = result.get("engine_result", "")
+
+    log(f"Export at ledger {final_seq}, result: {engine_result}")
+    if engine_result != "tesSUCCESS":
+        raise AssertionError(f"Expected intent tesSUCCESS, got {engine_result}")
+    if not origin_hash:
+        raise AssertionError(f"Validated Export missing hash: {result}")
+
+    if expect_success:
+        await wait_for_export_signature_witness(
+            ctx, log, origin_hash, after_ledger=final_seq
+        )
+        assert_export_latch(
+            ctx,
+            alice.address,
+            log,
+            expect_exists=True,
+            origin_hash=origin_hash,
+            expect_witness=True,
+        )
+
+        log("Export succeeded as expected (active-view quorum reached)")
+    else:
+        await wait_for_export_signature_witness(
+            ctx,
+            log,
+            origin_hash,
+            after_ledger=final_seq,
+            expect_witness=False,
+        )
+        assert_export_latch(
+            ctx,
+            alice.address,
+            log,
+            expect_exists=True,
+            origin_hash=origin_hash,
+            expect_witness=False,
+        )
+        log("Intent remained unwitnessed as expected (below committee quorum)")
+
+    # --- Verify subsequent payment works ---
+    log("Submitting payment from alice to bob...")
+    pay_result = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Payment",
+            "Destination": bob.address,
+            "Amount": "1000000",
+            "Fee": "12",
+        },
+        alice.wallet,
+        timeout=30,
+    )
+
+    pay_engine = pay_result.get("engine_result", "")
+    log(f"Payment result: {pay_engine}")
+
+    if pay_engine != "tesSUCCESS":
+        raise AssertionError(f"Payment failed: {pay_engine}")
+
+    log("Payment succeeded -- account not blocked")
+    log("PASS")

.testnet/scenarios/export/export_share_subscription.py

@@ -0,0 +1,226 @@
+""":descr: subscribe over a real WebSocket to post-validation Export shares
+
+The subscriber opens before the Export is submitted. It proves the stream
+publishes a quorum of independently attributable shares for the exact validated
+origin and that those same signature records form the later ledger witness.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import json
+
+import websockets
+from xahaud_scripts.testnet.config import _decode_node_public_key
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    bitmap_positions,
+    export_authority,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+
+
+def _witness_records(witness):
+    positions = sorted(bitmap_positions(witness["EntropyContributors"]))
+    signers = witness["_WitnessSigners"]
+    if len(positions) != len(signers):
+        raise AssertionError("Witness bitmap and signer count differ")
+    return {
+        (
+            position,
+            signer["SigningPubKey"].upper(),
+            signer["TxnSignature"].upper(),
+        )
+        for position, signer in zip(positions, signers, strict=True)
+    }
+
+
+async def scenario(ctx, log):
+    await require_export(ctx, log)
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+
+    network = json.loads((ctx.base_dir / "network.json").read_text())
+    node0 = next(node for node in network["nodes"] if int(node["id"]) == 0)
+    ws_url = f"ws://127.0.0.1:{node0['port_ws']}"
+    events = []
+
+    async with websockets.connect(ws_url, open_timeout=10) as websocket:
+        await websocket.send(
+            json.dumps(
+                {
+                    "id": 1,
+                    "command": "subscribe",
+                    "streams": ["export_signatures"],
+                }
+            )
+        )
+        ack = json.loads(await asyncio.wait_for(websocket.recv(), timeout=10))
+        if ack.get("status") != "success":
+            raise AssertionError(f"export_signatures subscription failed: {ack}")
+        log("Subscribed to export_signatures over WebSocket")
+
+        async def receive_events():
+            while True:
+                event = json.loads(await websocket.recv())
+                if event.get("stream") == "export_signatures":
+                    events.append(event)
+
+        reader = asyncio.create_task(receive_events())
+        try:
+            current = ctx.validated_ledger_index(0)
+            committee_size = (
+                len(bytes.fromhex(export_authority(ctx)["ExportCommittee"])) // 33
+            )
+            result = await submit_direct_export(
+                ctx,
+                log,
+                {
+                    "TransactionType": "Export",
+                    "Fee": "1000000",
+                    "ExportedTxn": {
+                        "TransactionType": "Payment",
+                        "Account": alice.address,
+                        "Destination": bob.address,
+                        "Amount": "1000000",
+                        "Fee": "10",
+                        "Sequence": 0,
+                        "TicketSequence": 1,
+                        "FirstLedgerSequence": current + 1,
+                        "LastLedgerSequence": current + EXPORT_RETRY_LEDGER_WINDOW,
+                        "Flags": 2147483648,
+                        "SigningPubKey": "",
+                    },
+                },
+                alice.wallet,
+            )
+            if result.get("engine_result") != "tesSUCCESS":
+                raise AssertionError(f"Export failed: {result}")
+
+            origin = result.get("hash")
+            origin_seq = int(result.get("ledger_index"))
+            if not origin:
+                raise AssertionError(f"Validated Export missing hash: {result}")
+            origin_ledger = ctx.ledger(origin_seq) or {}
+            origin_hash = origin_ledger.get("ledger_hash") or origin_ledger.get(
+                "ledger", {}
+            ).get("hash")
+            if not origin_hash:
+                raise AssertionError(
+                    f"Validated origin ledger {origin_seq} missing hash"
+                )
+
+            assert_export_latch(
+                ctx,
+                alice.address,
+                log,
+                origin_hash=origin,
+                expect_witness=False,
+            )
+            selected = set(range(committee_size))
+            quorum = (4 * committee_size + 4) // 5
+
+            witness = await wait_for_export_signature_witness(
+                ctx, log, origin, after_ledger=origin_seq
+            )
+            expected_records = _witness_records(witness)
+            if len(expected_records) < quorum:
+                raise AssertionError(
+                    f"Witness contains only {len(expected_records)} distinct records; "
+                    f"need quorum {quorum}"
+                )
+
+            deadline = asyncio.get_running_loop().time() + 10
+            while asyncio.get_running_loop().time() < deadline:
+                matching = [
+                    event for event in events if event.get("origin_txid") == origin
+                ]
+                events_by_record = {}
+                for event in matching:
+                    record = (
+                        int(event["committee_position"]),
+                        _decode_node_public_key(event["signing_key"]),
+                        event["signature"].upper(),
+                    )
+                    events_by_record.setdefault(record, []).append(event)
+                if expected_records <= events_by_record.keys():
+                    break
+                await asyncio.sleep(0.1)
+            else:
+                raise AssertionError(
+                    "WebSocket stream did not publish every signature used by "
+                    f"the witness: expected={expected_records}, "
+                    f"observed={set(events_by_record)}"
+                )
+
+            unique_positions = set()
+            validated_hashes = {}
+            for event in matching:
+                if event.get("type") != "exportSignatureReceived":
+                    raise AssertionError(f"Unexpected Export stream event: {event}")
+                if event.get("version") != 1:
+                    raise AssertionError(f"Unexpected Export share version: {event}")
+                if event.get("owner") != alice.address:
+                    raise AssertionError(f"Export stream owner mismatch: {event}")
+                if int(event.get("origin_ledger_seq", 0)) != origin_seq:
+                    raise AssertionError(
+                        f"Export stream origin sequence mismatch: {event}"
+                    )
+                if event.get("origin_ledger_hash") != origin_hash:
+                    raise AssertionError(f"Export stream origin hash mismatch: {event}")
+                position = int(event.get("committee_position", -1))
+                if position not in selected:
+                    raise AssertionError(
+                        f"Unselected validator streamed a share: {event}"
+                    )
+                unique_positions.add(position)
+
+            witness_seq = int(witness["LedgerSequence"])
+            for event in matching:
+                ledger_index = event.get("ledger_index")
+                ledger_hash = event.get("ledger_hash")
+                if isinstance(ledger_index, bool) or not isinstance(ledger_index, int):
+                    raise AssertionError(
+                        f"Export stream event missing numeric ledger_index: {event}"
+                    )
+                if not isinstance(ledger_hash, str) or not ledger_hash:
+                    raise AssertionError(
+                        f"Export stream event missing ledger_hash: {event}"
+                    )
+                if ledger_index not in validated_hashes:
+                    observed_ledger = ctx.ledger(ledger_index) or {}
+                    validated_hashes[ledger_index] = observed_ledger.get(
+                        "ledger_hash"
+                    ) or observed_ledger.get("ledger", {}).get("hash")
+                if ledger_hash != validated_hashes[ledger_index]:
+                    raise AssertionError(
+                        "Export stream cursor does not name the validated ledger: "
+                        f"event={event}, expected_hash={validated_hashes[ledger_index]}"
+                    )
+
+            for record in expected_records:
+                if not any(
+                    origin_seq <= event["ledger_index"] < witness_seq
+                    for event in events_by_record[record]
+                ):
+                    raise AssertionError(
+                        "Witness signature lacked a pre-witness stream event with a "
+                        f"validated cursor: record={record}, "
+                        f"events={events_by_record[record]}"
+                    )
+            log(
+                f"WebSocket exposed {len(unique_positions)} selected shares; "
+                f"witness used {len(expected_records)}"
+            )
+        finally:
+            reader.cancel()
+            with contextlib.suppress(asyncio.CancelledError):
+                await reader
+
+    log("PASS")

.testnet/scenarios/export/export_without_unl_report.py

@@ -0,0 +1,97 @@
+""":descr: Export fails closed without a ledger-anchored UNLReport view.
+
+Network-mode Export must not derive authority from a node-local trusted-config
+view. An explicit parent binding still fails if that parent has no UNLReport,
+and no Export latch is created.
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    export_authority,
+    require_export,
+    wait_for_validated_transaction,
+)
+
+
+async def scenario(ctx, log):
+    await require_export(ctx, log, require_unl_report=False)
+
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    log("Accounts funded")
+
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+    current_seq = ctx.validated_ledger_index(0)
+
+    log(f"Current ledger: {current_seq}")
+    log("UNLReport intentionally absent; export must not use local config view")
+
+    result = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Export",
+            "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+            "Fee": "1000000",
+            **export_authority(ctx, require_unl_report=False),
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current_seq + 1,
+                "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        timeout=60,
+    )
+
+    engine_result = result.get("engine_result", "")
+    log(f"Export submit result: {engine_result}")
+
+    if engine_result == "tesSUCCESS":
+        raise AssertionError(
+            "Export should not succeed without a ledger-anchored UNLReport view"
+        )
+
+    if engine_result != "tecEXPORT_COMMITTEE_UNAVAILABLE":
+        raise AssertionError(
+            "Expected tecEXPORT_COMMITTEE_UNAVAILABLE without UNLReport view, "
+            f"got {engine_result}"
+        )
+
+    tx_hash = result.get("tx_json", {}).get("hash")
+    if not tx_hash:
+        raise AssertionError(f"Rejected Export missing tx hash: {result}")
+    validated = await wait_for_validated_transaction(
+        ctx, tx_hash, after_ledger=current_seq
+    )
+    meta = validated.get("meta", validated.get("metaData", {}))
+    if meta.get("TransactionResult") != "tecEXPORT_COMMITTEE_UNAVAILABLE":
+        raise AssertionError(f"Unexpected validated result: {validated}")
+
+    final_seq = validated.get("ledger_index")
+    final_ledger = ctx.ledger(final_seq) or {}
+    ledger_hash = final_ledger.get("ledger_hash") or final_ledger.get("ledger", {}).get(
+        "hash"
+    )
+    if not ledger_hash:
+        raise AssertionError(f"Validated failure ledger unavailable: {final_ledger}")
+    log(f"Export failure validated in ledger {final_seq}")
+
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        expect_exists=False,
+        ledger_hash=ledger_hash,
+    )
+
+    log("PASS")

.testnet/scenarios/export/retriable_export.py

@@ -0,0 +1,110 @@
+""":descr: Submit ttEXPORT directly (no hook), verify the intent is admitted
+and a later validated ledger records its signature witness. Then submit a
+payment from the same account to verify sequence handling remains independent.
+
+Flow:
+  1. Fund alice and bob
+  2. alice submits ttEXPORT with an explicit parent-universe declaration
+  3. Validation releases shares; a later ledger records ExportSignatures
+  4. alice submits a Payment to bob -> should succeed (sequence not blocked)
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    assert_export_latch,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+
+
+async def scenario(ctx, log):
+    await require_export(ctx, log)
+
+    # --- Setup ---
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    log("Accounts funded")
+
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+    current_seq = ctx.validated_ledger_index(0)
+
+    log(f"Current ledger: {current_seq}")
+
+    # --- 1. Submit ttEXPORT ---
+    result = await submit_direct_export(
+        ctx,
+        log,
+        {
+            "TransactionType": "Export",
+            "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+            "Fee": "1000000",
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current_seq + 1,
+                "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        timeout=60,
+    )
+
+    export_seq = result.get("ledger_index", ctx.validated_ledger_index(0))
+    origin_hash = result.get("hash")
+    engine_result = result.get("engine_result", "")
+    log(f"Export completed at ledger {export_seq}, result: {engine_result}")
+
+    if engine_result != "tesSUCCESS":
+        raise AssertionError(f"Expected tesSUCCESS for export, got {engine_result}")
+
+    if not origin_hash:
+        raise AssertionError(f"Validated Export missing hash: {result}")
+
+    await wait_for_export_signature_witness(
+        ctx, log, origin_hash, after_ledger=export_seq
+    )
+
+    assert_export_latch(
+        ctx,
+        alice.address,
+        log,
+        expect_exists=True,
+        origin_hash=origin_hash,
+        expect_witness=True,
+    )
+
+    # --- 2. Submit Payment from same account ---
+    log("Submitting payment from alice to bob...")
+    pay_result = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Payment",
+            "Destination": bob.address,
+            "Amount": "1000000",
+            "Fee": "12",
+        },
+        alice.wallet,
+        timeout=30,
+    )
+
+    pay_engine = pay_result.get("engine_result", "")
+    log(f"Payment result: {pay_engine}")
+
+    if pay_engine != "tesSUCCESS":
+        raise AssertionError(f"Payment failed: {pay_engine}")
+
+    log(
+        f"Both transactions succeeded: "
+        f"Export at ledger {export_seq}, Payment at ledger {ctx.validated_ledger_index(0)}"
+    )
+    log("Sequence handling OK - export didn't block subsequent txns")
+    log("PASS")

.testnet/scenarios/export/steady_state_export.py

@@ -0,0 +1,230 @@
+""":descr: install xport hook, trigger export, verify emitted ttEXPORT lifecycle
+
+1. Fund alice (hook holder), bob (trigger), carol (export destination)
+2. Install xport hook on alice
+3. bob pays alice with DST=carol → hook calls xport() → emits ttEXPORT
+4. Emitted ttEXPORT enters a validated ledger and releases signatures
+5. Verify a later ledger records its ExportSignatures witness
+"""
+
+from __future__ import annotations
+
+from export_helpers import (
+    require_export,
+    find_export_txns,
+    dst_param,
+    assert_hook_accepted,
+    assert_export_latch,
+    create_export_committee,
+    wait_for_export_signature_witness,
+)
+
+# C source for the xport hook — verbatim from src/test/app/Export_test_hooks.h
+# On Payment to the hook account, exports a 1 XAH payment to the DST param.
+XPORT_HOOK_C = r"""
+#include <stdint.h>
+extern int32_t _g(uint32_t id, uint32_t maxiter);
+extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
+extern int64_t rollback(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
+extern int64_t xport(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t committee_hash_ptr, uint32_t committee_hash_len);
+extern int64_t xport_reserve(uint32_t count);
+extern int64_t hook_account(uint32_t write_ptr, uint32_t write_len);
+extern int64_t otxn_param(uint32_t write_ptr, uint32_t write_len, uint32_t name_ptr, uint32_t name_len);
+extern int64_t otxn_type(void);
+extern int64_t ledger_seq(void);
+
+#define SBUF(x) (uint32_t)(x), sizeof(x)
+#define ASSERT(x) if (!(x)) rollback((uint32_t)#x, sizeof(#x), __LINE__)
+
+#define ttPAYMENT 0
+#define tfCANONICAL 0x80000000UL
+#define amAMOUNT 1
+#define amFEE 8
+#define atACCOUNT 1
+#define atDESTINATION 3
+
+#define ENCODE_TT(buf_out, tt) \
+    buf_out[0] = 0x12U; buf_out[1] = (tt >> 8) & 0xFFU; buf_out[2] = tt & 0xFFU; buf_out += 3;
+
+#define ENCODE_FLAGS(buf_out, flags) \
+    buf_out[0] = 0x22U; buf_out[1] = (flags >> 24) & 0xFFU; buf_out[2] = (flags >> 16) & 0xFFU; \
+    buf_out[3] = (flags >> 8) & 0xFFU; buf_out[4] = flags & 0xFFU; buf_out += 5;
+
+#define ENCODE_SEQUENCE(buf_out, seq) \
+    buf_out[0] = 0x24U; buf_out[1] = (seq >> 24) & 0xFFU; buf_out[2] = (seq >> 16) & 0xFFU; \
+    buf_out[3] = (seq >> 8) & 0xFFU; buf_out[4] = seq & 0xFFU; buf_out += 5;
+
+#define ENCODE_FLS(buf_out, fls) \
+    buf_out[0] = 0x20U; buf_out[1] = 0x1AU; buf_out[2] = (fls >> 24) & 0xFFU; \
+    buf_out[3] = (fls >> 16) & 0xFFU; buf_out[4] = (fls >> 8) & 0xFFU; \
+    buf_out[5] = fls & 0xFFU; buf_out += 6;
+
+#define ENCODE_LLS(buf_out, lls) \
+    buf_out[0] = 0x20U; buf_out[1] = 0x1BU; buf_out[2] = (lls >> 24) & 0xFFU; \
+    buf_out[3] = (lls >> 16) & 0xFFU; buf_out[4] = (lls >> 8) & 0xFFU; \
+    buf_out[5] = lls & 0xFFU; buf_out += 6;
+
+#define ENCODE_DROPS(buf_out, drops, amt_type) \
+    buf_out[0] = 0x60U + amt_type; buf_out[1] = 0x40U + ((drops >> 56) & 0x3FU); \
+    buf_out[2] = (drops >> 48) & 0xFFU; buf_out[3] = (drops >> 40) & 0xFFU; \
+    buf_out[4] = (drops >> 32) & 0xFFU; buf_out[5] = (drops >> 24) & 0xFFU; \
+    buf_out[6] = (drops >> 16) & 0xFFU; buf_out[7] = (drops >> 8) & 0xFFU; \
+    buf_out[8] = drops & 0xFFU; buf_out += 9;
+
+#define ENCODE_SIGNING_PUBKEY_EMPTY(buf_out) \
+    buf_out[0] = 0x73U; buf_out[1] = 0x00U; buf_out += 2;
+
+#define ENCODE_ACCOUNT(buf_out, acc, acc_type) \
+    buf_out[0] = 0x80U + acc_type; buf_out[1] = 0x14U; \
+    for (int i = 0; i < 20; ++i) buf_out[2+i] = acc[i]; buf_out += 22;
+
+#define PREPARE_PAYMENT_SIMPLE_SIZE 270U
+
+int64_t hook(uint32_t reserved) {
+    _g(1, 1);
+
+    if (otxn_type() != ttPAYMENT)
+        return accept(0, 0, 0);
+
+    ASSERT(xport_reserve(1) == 1);
+
+    uint8_t dst[20];
+    int64_t dst_len = otxn_param(SBUF(dst), "DST", 3);
+    ASSERT(dst_len == 20);
+
+    uint8_t acc[20];
+    ASSERT(hook_account(SBUF(acc)) == 20);
+
+    uint32_t cls = (uint32_t)ledger_seq();
+
+    uint8_t tx[PREPARE_PAYMENT_SIMPLE_SIZE];
+    uint8_t* buf = tx;
+
+    ENCODE_TT(buf, ttPAYMENT);
+    ENCODE_FLAGS(buf, tfCANONICAL);
+    ENCODE_SEQUENCE(buf, 0);
+    ENCODE_FLS(buf, cls + 1);
+    ENCODE_LLS(buf, cls + 5);
+    // sfTicketSequence = UINT32 field 41 = 0x20 0x29
+    buf[0] = 0x20U; buf[1] = 0x29U;
+    buf[2] = 0; buf[3] = 0; buf[4] = 0; buf[5] = 1;
+    buf += 6;
+
+    uint64_t drops = 1000000;
+    ENCODE_DROPS(buf, drops, amAMOUNT);
+    ENCODE_DROPS(buf, 10, amFEE);
+
+    ENCODE_SIGNING_PUBKEY_EMPTY(buf);
+    ENCODE_ACCOUNT(buf, acc, atACCOUNT);
+    ENCODE_ACCOUNT(buf, dst, atDESTINATION);
+
+    uint8_t hash[32];
+    static const uint8_t committee_hash[32] = { COMMITTEE_HASH_BYTES };
+    int64_t xport_result = xport(
+        SBUF(hash), (uint32_t)tx, buf - tx, SBUF(committee_hash));
+    ASSERT(xport_result == 32);
+
+    return accept(0, 0, 0);
+}
+"""
+
+
+async def scenario(ctx, log):
+    # Wait for network to start and amendments to activate
+    await require_export(ctx, log)
+
+    # --- Setup ---
+    await ctx.fund_accounts({"alice": 10000, "bob": 10000, "carol": 1000})
+    log("Accounts funded")
+
+    alice = ctx.account("alice")
+    carol = ctx.account("carol")
+
+    authority = await create_export_committee(ctx, log, alice.wallet)
+    committee_bytes = bytes.fromhex(authority["ExportCommitteeHash"])
+    committee_initializer = ", ".join(f"0x{byte:02X}" for byte in committee_bytes)
+    hook_source = XPORT_HOOK_C.replace("COMMITTEE_HASH_BYTES", committee_initializer)
+
+    # Compile and install xport hook on alice
+    wasm = ctx.compile_hook(hook_source, label="xport")
+    await ctx.submit_and_wait(
+        {
+            "TransactionType": "SetHook",
+            "Hooks": [
+                {
+                    "Hook": {
+                        "CreateCode": wasm.hex().upper(),
+                        "HookOn": "0" * 64,
+                        "HookNamespace": "0" * 64,
+                        "HookApiVersion": 0,
+                        "Flags": 1,  # hsfOVERRIDE
+                    }
+                }
+            ],
+            "Fee": "100000000",
+        },
+        alice.wallet,
+    )
+    log(
+        f"Hook installed on alice ({alice.address[:12]}...) "
+        f"ledger {ctx.validated_ledger_index(0)}"
+    )
+
+    # --- Trigger ---
+    # bob pays alice → hook calls xport() → emits ttEXPORT
+    trigger_result = await ctx.submit_and_wait(
+        {
+            "TransactionType": "Payment",
+            "Destination": alice.address,
+            "Amount": "100000000",
+            "Fee": "1000000",
+            "HookParameters": [dst_param(carol.address)],
+        },
+        ctx.account("bob").wallet,
+    )
+    trigger_seq = ctx.validated_ledger_index(0)
+    log(f"Export triggered at ledger {trigger_seq}")
+
+    # xport() schedules a ttEXPORT through the emitted directory, but hook
+    # metadata reports it separately from ordinary HookEmissions.
+    trigger_meta = trigger_result.get("meta", {})
+    assert_hook_accepted(trigger_meta, log, expected_emits=0, expected_exports=1)
+
+    # --- Verify: check each ledger close for the Export transaction ---
+    max_ledgers = 10
+    for i in range(max_ledgers):
+        await ctx.wait_for_ledgers(1, node_id=0, timeout=30)
+        seq = ctx.validated_ledger_index(0)
+        exports = find_export_txns(ctx, seq)
+        if exports:
+            export_tx = exports[0]
+            meta = export_tx.get("meta", export_tx.get("metaData", {}))
+            result = meta.get("TransactionResult", "")
+            log(f"Ledger {seq}: Export txn found, result={result}")
+
+            if result != "tesSUCCESS":
+                raise AssertionError(f"Export did not succeed: {result}")
+
+            origin_hash = export_tx.get("hash")
+            if not origin_hash:
+                raise AssertionError(f"Export missing transaction hash: {export_tx}")
+            await wait_for_export_signature_witness(
+                ctx, log, origin_hash, after_ledger=seq
+            )
+
+            assert_export_latch(
+                ctx,
+                alice.address,
+                log,
+                expect_exists=True,
+                origin_hash=origin_hash,
+                expect_witness=True,
+            )
+
+            log("PASS")
+            return
+        log(f"Ledger {seq}: no Export txn yet")
+
+    raise AssertionError(
+        f"No Export transaction found after {max_ledgers} ledger closes"
+    )

.testnet/scenarios/helpers.py

@@ -0,0 +1,180 @@
+"""Shared helpers for ConsensusEntropy scenario tests."""
+
+from __future__ import annotations
+
+from xahaud_scripts.testnet.config import feature_name_to_hash
+
+ZERO_DIGEST = "0" * 64
+CONSENSUS_ENTROPY_FEATURE = feature_name_to_hash("ConsensusEntropy")
+
+
+def feature_hash(name: str) -> str:
+    """Return the amendment hash accepted by feature RPC."""
+    return feature_name_to_hash(name)
+
+
+def feature_status(ctx, name: str, node_id=0):
+    """Query a feature by amendment hash; feature RPC names are ambiguous."""
+    return ctx.feature_check(feature_hash(name), node_id=node_id)
+
+
+def consensus_entropy_feature(ctx, node_id=0):
+    """Query ConsensusEntropy by amendment hash."""
+    return feature_status(ctx, "ConsensusEntropy", node_id=node_id)
+
+
+async def require_entropy(ctx, log):
+    """Wait for first ledger and assert ConsensusEntropy is enabled."""
+    await ctx.wait_for_ledger_close(timeout=120)
+    feature = consensus_entropy_feature(ctx, node_id=0)
+    if not feature or not feature.get("enabled", False):
+        raise AssertionError(f"ConsensusEntropy not enabled: {feature}")
+    log("ConsensusEntropy enabled")
+
+
+def get_entropy_tx(ctx, seq):
+    """Fetch ledger and return (ce_tx, user_txns) or raise."""
+    result = ctx.ledger(seq, transactions=True)
+    if not result:
+        raise AssertionError(f"Ledger {seq}: fetch failed")
+
+    ledger = result.get("ledger")
+    if not isinstance(ledger, dict):
+        raise AssertionError(f"Ledger {seq}: fetch returned no ledger: {result}")
+
+    txns = ledger.get("transactions", [])
+    ce = [tx for tx in txns if tx.get("TransactionType") == "ConsensusEntropy"]
+    user = [tx for tx in txns if tx.get("TransactionType") != "ConsensusEntropy"]
+
+    if len(ce) != 1:
+        raise AssertionError(
+            f"Ledger {seq}: expected 1 ConsensusEntropy txn, got {len(ce)}"
+        )
+
+    return ce[0], user
+
+
+def entropy_fields(ce_tx):
+    """Return (digest, entropy_count, is_fallback) from a ConsensusEntropy tx.
+
+    consensus_fallback rounds carry a deterministic non-zero consensus-bound
+    digest with EntropyCount=0 and EntropyTier=1 (consensus_fallback).
+    Validator entropy has EntropyTier=3 (validator_quorum).
+
+    WARNING: is_fallback is ``tier != 3``, so it lumps participant_aligned
+    (Tier 2) in with fallback. It is only safe where no Tier 2 band exists
+    (e.g. 5-node networks, where tier2 == quorum). For band-aware scenarios use
+    the explicit assert_consensus_fallback / assert_participant_aligned /
+    assert_validator_quorum helpers, which check EntropyTier directly.
+    """
+    digest = ce_tx.get("Digest", "")
+    entropy_count = ce_tx.get("EntropyCount", -1)
+    tier = ce_tx.get("EntropyTier", None)
+    if tier is not None:
+        is_fallback = tier != 3
+    else:
+        is_fallback = entropy_count == 0
+    return digest, entropy_count, is_fallback
+
+
+def assert_participant_aligned(ce_tx, seq, expected_count=None):
+    """Assert participant_aligned (Tier 2) entropy on a ConsensusEntropy tx.
+
+    Tier 2 is the sub-quorum band: the agreed reveal cohort is >= the
+    participant floor but < the 80% validator quorum, so it carries
+    EntropyTier=2 with a deterministic non-zero digest. NOTE entropy_fields()'s
+    is_fallback lumps tier 2 in with fallback (is_fallback = tier != 3), so the
+    tier must be checked EXPLICITLY here.
+    """
+    digest = ce_tx.get("Digest", "")
+    count = ce_tx.get("EntropyCount", -1)
+    tier = ce_tx.get("EntropyTier", None)
+    if tier != 2:
+        raise AssertionError(
+            f"Ledger {seq}: expected EntropyTier==2 (participant_aligned), "
+            f"got {tier} (EntropyCount={count})"
+        )
+    if not digest or digest == ZERO_DIGEST:
+        raise AssertionError(
+            f"Ledger {seq}: participant_aligned digest must be non-zero, got "
+            f"{digest[:16]}..."
+        )
+    if expected_count is not None and count != expected_count:
+        raise AssertionError(
+            f"Ledger {seq}: participant_aligned EntropyCount must be "
+            f"{expected_count} (the surviving cohort), got {count}"
+        )
+    return digest, count
+
+
+def assert_validator_quorum(ce_tx, seq, min_count=None):
+    """Assert validator_quorum (Tier 3) entropy on a ConsensusEntropy tx:
+    EntropyTier=3, a deterministic non-zero digest, and (optionally)
+    EntropyCount >= min_count (the active quorum). The count can EXCEED the
+    quorum (e.g. a still-full 6/6 ledger caught at a 6->5 transition), so check
+    >=, not ==.
+    """
+    digest = ce_tx.get("Digest", "")
+    count = ce_tx.get("EntropyCount", -1)
+    tier = ce_tx.get("EntropyTier", None)
+    if tier != 3:
+        raise AssertionError(
+            f"Ledger {seq}: expected EntropyTier==3 (validator_quorum), got "
+            f"{tier} (EntropyCount={count})"
+        )
+    if not digest or digest == ZERO_DIGEST:
+        raise AssertionError(
+            f"Ledger {seq}: validator_quorum digest must be non-zero, got "
+            f"{digest[:16]}..."
+        )
+    if min_count is not None and count < min_count:
+        raise AssertionError(
+            f"Ledger {seq}: validator_quorum EntropyCount={count} < quorum "
+            f"{min_count}"
+        )
+    return digest, count
+
+
+def assert_consensus_fallback(ce_tx, seq):
+    """Assert consensus_fallback (Tier 1) entropy on a ConsensusEntropy tx:
+    EntropyTier=1, EntropyCount=0, and a deterministic NON-zero digest.
+    """
+    digest = ce_tx.get("Digest", "")
+    count = ce_tx.get("EntropyCount", -1)
+    tier = ce_tx.get("EntropyTier", None)
+    if tier != 1:
+        raise AssertionError(
+            f"Ledger {seq}: expected EntropyTier==1 (consensus_fallback), got "
+            f"{tier} (EntropyCount={count})"
+        )
+    if count != 0:
+        raise AssertionError(
+            f"Ledger {seq}: consensus_fallback EntropyCount must be 0, got "
+            f"{count}"
+        )
+    if not digest or digest == ZERO_DIGEST:
+        raise AssertionError(
+            f"Ledger {seq}: consensus_fallback digest must be non-zero, got "
+            f"{digest[:16]}..."
+        )
+    return digest, count
+
+
+def assert_valid_entropy(ce_tx, seq, seen_digests=None):
+    """Assert quorum-met validator entropy. Optionally check uniqueness."""
+    digest, entropy_count, is_fallback = entropy_fields(ce_tx)
+
+    if is_fallback or not digest or digest == ZERO_DIGEST:
+        raise AssertionError(f"Ledger {seq}: fallback/empty Digest")
+
+    if entropy_count < 4:
+        raise AssertionError(
+            f"Ledger {seq}: EntropyCount={entropy_count} < 4 (sub-quorum)"
+        )
+
+    if seen_digests is not None:
+        if digest in seen_digests:
+            raise AssertionError(f"Ledger {seq}: duplicate Digest {digest[:16]}...")
+        seen_digests.add(digest)
+
+    return digest, entropy_count

.testnet/scenarios/latency-suite.yml

@@ -0,0 +1,90 @@
+defaults:
+  network:
+    node_count: 5
+    launcher: tmux
+    find_ports: true
+    slave_delay: 0.2
+    features:
+      - ConsensusEntropy
+      - Export
+    track_features:
+      - ConsensusEntropy
+      - Export
+    unl_report: true
+    log_levels:
+      TxQ: info
+      Protocol: debug
+      Peer: debug
+      LedgerConsensus: debug
+      ConsensusExtensions: debug
+      NetworkOPs: info
+    rc:
+      - rng_poll_ms=250
+tests:
+  - name: latency_baseline_ce
+    script: .testnet/scenarios/perf/ce_export_latency_probe.py
+    params:
+      warmup_ledgers: 3
+      ledgers: 8
+      submit_export: false
+
+  - name: latency_baseline_export
+    script: .testnet/scenarios/perf/ce_export_latency_probe.py
+    params:
+      warmup_ledgers: 3
+      ledgers: 8
+      submit_export: true
+
+  - name: latency_proposal_delay_export
+    script: .testnet/scenarios/perf/ce_export_latency_probe.py
+    params:
+      warmup_ledgers: 3
+      ledgers: 8
+      submit_export: true
+    network:
+      rc:
+        - rng_poll_ms=250
+        - delay=100,jitter=25,msg=proposal
+
+  - name: latency_directed_pair_delay_export
+    script: .testnet/scenarios/perf/ce_export_latency_probe.py
+    params:
+      warmup_ledgers: 3
+      ledgers: 8
+      submit_export: true
+    network:
+      rc:
+        - rng_poll_ms=250
+        - n0->n2:delay=750,jitter=100,msg=proposal
+        - n2->n0:delay=750,jitter=100,msg=proposal
+
+  - name: latency_slow_minority_export
+    script: .testnet/scenarios/perf/ce_export_latency_probe.py
+    params:
+      warmup_ledgers: 3
+      ledgers: 8
+      submit_export: true
+      export_timeout: 120
+    network:
+      rc:
+        - rng_poll_ms=250
+        - n3->n0:delay=500,jitter=100,msg=proposal
+        - n3->n1:delay=500,jitter=100,msg=proposal
+        - n3->n2:delay=500,jitter=100,msg=proposal
+        - n4->n0:delay=500,jitter=100,msg=proposal
+        - n4->n1:delay=500,jitter=100,msg=proposal
+        - n4->n2:delay=500,jitter=100,msg=proposal
+        - n0->n3:delay=500,jitter=100,msg=proposal
+        - n1->n3:delay=500,jitter=100,msg=proposal
+        - n2->n3:delay=500,jitter=100,msg=proposal
+        - n0->n4:delay=500,jitter=100,msg=proposal
+        - n1->n4:delay=500,jitter=100,msg=proposal
+        - n2->n4:delay=500,jitter=100,msg=proposal
+
+  - name: latency_export_no_veto_with_delay
+    script: .testnet/scenarios/export/export_no_veto_missing_observation.py
+    network:
+      rc:
+        - rng_poll_ms=250
+        - delay=300,jitter=100,msg=proposal
+        - n4:no_export_sig_hash=true

.testnet/scenarios/perf/ce_export_latency_probe.py

@@ -0,0 +1,205 @@
+""":descr: measure CE/export behavior while RuntimeConfig injects latency/drop.
+
+The suite supplies runtime fault injection through network.rc. This scenario
+does not mutate RuntimeConfig itself; it observes what the launched network does
+under that condition and logs enough counters to compare variants.
+"""
+
+from __future__ import annotations
+
+from collections import Counter
+import json
+
+from export.export_helpers import (
+    EXPORT_RETRY_LEDGER_WINDOW,
+    require_export,
+    submit_direct_export,
+    wait_for_export_signature_witness,
+)
+from helpers import consensus_entropy_feature, get_entropy_tx
+
+
+async def _require_runtime_config(ctx, log):
+    result = ctx.rpc.runtime_config(0)
+    if not result or result.get("error"):
+        raise AssertionError(
+            "Latency probe requires a binary built with "
+            "xahaud_runtime_test_config=ON; runtime_config RPC returned "
+            f"{result}"
+        )
+    log("RuntimeConfig RPC active")
+
+
+async def _require_consensus_entropy(ctx, log):
+    feature = consensus_entropy_feature(ctx, node_id=0)
+    if not feature or not feature.get("enabled", False):
+        raise AssertionError(f"ConsensusEntropy not enabled: {feature}")
+    log("ConsensusEntropy enabled")
+
+
+def _log_runtime_config(ctx, log):
+    for node_id in range(ctx.node_count):
+        cfg = ctx.rpc.runtime_config(node_id)
+        if cfg is None:
+            raise AssertionError(f"runtime_config RPC failed on node {node_id}")
+        log(
+            f"runtime_config n{node_id}: "
+            f"{json.dumps(cfg, sort_keys=True, separators=(',', ':'))}"
+        )
+
+
+async def _submit_direct_export(ctx, log, *, timeout):
+    await ctx.fund_accounts({"alice": 10000, "bob": 1000})
+    alice = ctx.account("alice")
+    bob = ctx.account("bob")
+    current_seq = ctx.validated_ledger_index(0)
+
+    if current_seq is None:
+        raise AssertionError("validated ledger is not available before Export")
+
+    log(f"Submitting direct Export at validated ledger {current_seq}")
+    started = ctx.mark("latency-export-submit-start")
+    result = await submit_direct_export(
+        ctx,
+        log,
+        {
+            "TransactionType": "Export",
+            "LastLedgerSequence": current_seq + EXPORT_RETRY_LEDGER_WINDOW,
+            "Fee": "1000000",
+            "ExportedTxn": {
+                "TransactionType": "Payment",
+                "Account": alice.address,
+                "Destination": bob.address,
+                "Amount": "1000000",
+                "Fee": "10",
+                "Sequence": 0,
+                "TicketSequence": 1,
+                "FirstLedgerSequence": current_seq + 1,
+                "LastLedgerSequence": current_seq + 10,
+                "Flags": 2147483648,
+                "SigningPubKey": "",
+            },
+        },
+        alice.wallet,
+        timeout=timeout,
+    )
+    engine_result = result.get("engine_result", "")
+    if engine_result != "tesSUCCESS":
+        raise AssertionError(f"Expected Export tesSUCCESS, got {engine_result}")
+
+    origin_hash = result.get("hash")
+    origin_seq = result.get("ledger_index", ctx.validated_ledger_index(0))
+    if not origin_hash:
+        raise AssertionError(f"Validated Export missing hash: {result}")
+    witness = await wait_for_export_signature_witness(
+        ctx, log, origin_hash, after_ledger=origin_seq
+    )
+    ended = ctx.mark("latency-export-submit-end")
+    elapsed = (ended.monotonic_ns - started.monotonic_ns) / 1_000_000_000
+    log(f"Export intent+witness result={engine_result} elapsed={elapsed:.3f}s")
+
+    signers = witness.get("_WitnessSigners", [])
+    log(f"Export signer count={len(signers)}")
+    return started, ended
+
+
+def _summarize_logs(ctx, log, *, label, started, ended):
+    patterns = {
+        "rng_selected": r"RNG: entropy selected",
+        "rng_fallback": r"tier=1",
+        "rng_participant_aligned": r"tier=2",
+        "rng_validator_quorum": r"tier=3",
+        "export_quorum_timeout": r"Export: exportSigSet quorum alignment timeout",
+        "export_missing_observation_ignored": (
+            r"Export: missing exportSigSetHash observation ignored"
+        ),
+    }
+    for name, pattern in patterns.items():
+        result = ctx.search_logs(pattern, since=started, until=ended, limit=500)
+        log(f"log_count {label}.{name}={result.count}")
+
+
+async def scenario(
+    ctx,
+    log,
+    *,
+    warmup_ledgers=3,
+    ledgers=8,
+    submit_export=False,
+    export_timeout=90,
+):
+    await ctx.wait_for_ledger_close(timeout=120)
+    await _require_runtime_config(ctx, log)
+    _log_runtime_config(ctx, log)
+    await _require_consensus_entropy(ctx, log)
+
+    if submit_export:
+        # require_export also asserts the UNLReport precondition for successful
+        # network-mode Export. Keep that explicit in perf runs so a missing
+        # report does not masquerade as a latency failure.
+        await require_export(ctx, log, require_runtime_config=False)
+
+    await ctx.wait_for_ledgers(warmup_ledgers, node_id=0, timeout=120)
+    warm_seq = ctx.validated_ledger_index(0)
+    log(f"Warmup complete at validated ledger {warm_seq}")
+
+    export_window = None
+    if submit_export:
+        export_window = await _submit_direct_export(ctx, log, timeout=export_timeout)
+
+    started = ctx.mark("latency-probe-start")
+    start_seq = ctx.validated_ledger_index(0)
+    await ctx.wait_for_ledgers(ledgers, node_id=0, timeout=max(120, ledgers * 30))
+    ended = ctx.mark("latency-probe-end")
+    end_seq = ctx.validated_ledger_index(0)
+
+    if start_seq is None or end_seq is None:
+        raise AssertionError("validated ledger index unavailable during probe")
+
+    elapsed = (ended.monotonic_ns - started.monotonic_ns) / 1_000_000_000
+    closed = max(0, end_seq - start_seq)
+    cadence = elapsed / closed if closed else 0.0
+    log(
+        f"Observed validated ledgers {start_seq + 1}..{end_seq} "
+        f"closed={closed} elapsed={elapsed:.3f}s cadence={cadence:.3f}s/ledger"
+    )
+
+    tiers: Counter[int] = Counter()
+    counts: Counter[int] = Counter()
+    missing_entropy = 0
+    for seq in range(start_seq + 1, end_seq + 1):
+        try:
+            ce, user_txns = get_entropy_tx(ctx, seq)
+        except AssertionError as exc:
+            missing_entropy += 1
+            log(f"  Ledger {seq}: no ConsensusEntropy tx ({exc})")
+            continue
+
+        tier = ce.get("EntropyTier", -1)
+        count = ce.get("EntropyCount", -1)
+        tiers[tier] += 1
+        counts[count] += 1
+        log(
+            f"  Ledger {seq}: tier={tier} count={count} "
+            f"user_txns={len(user_txns)} digest={ce.get('Digest', '')[:16]}..."
+        )
+
+    log(
+        "SUMMARY "
+        f"closed={closed} elapsed_s={elapsed:.3f} cadence_s={cadence:.3f} "
+        f"tiers={dict(sorted(tiers.items()))} "
+        f"counts={dict(sorted(counts.items()))} "
+        f"missing_entropy={missing_entropy}"
+    )
+
+    _summarize_logs(ctx, log, label="probe", started=started, ended=ended)
+    if export_window is not None:
+        _summarize_logs(
+            ctx,
+            log,
+            label="export",
+            started=export_window[0],
+            ended=export_window[1],
+        )
+
+    log("PASS")

.testnet/scenarios/rollout/mixed_binary_boundary.py

@@ -0,0 +1,82 @@
+"""Mixed-binary rollout boundary for ConsensusEntropy.
+
+Topology (launch with per-node binaries):
+  n0-n2  @export-rng   feature-export-rng build, supports Export + ConsensusEntropy, UNL validators
+  n3-n5  @release       2026.6.21 mainnet release build, NO CE support, non-UNL trackers
+
+What this proves:
+  Phase 1  CE inactive -> heterogeneous net is healthy. New validators emit
+           legacy 32-byte proposal positions, so old nodes parse them and track
+           validated ledgers.
+  Phase 2  CE activates -> the old @release nodes hit the upgrade boundary. Per
+           this branch's setAmendmentBlocked() (Change.cpp / LedgerMaster.cpp ->
+           NetworkOPs) they become amendment-blocked and DROP to CONNECTED, but
+           KEEP RUNNING (RPC stays up) -- they do NOT crash. This is the
+           "upgrade validators before activating" rollout invariant, observed.
+
+Launch (fast dev check, CE enabled at genesis):
+  x-testnet run -n 6 \
+    --node-binary n0:@export-rng --node-binary n1:@export-rng --node-binary n2:@export-rng \
+    --node-binary n3:@release    --node-binary n4:@release    --node-binary n5:@release \
+    --feature @ConsensusEntropy \
+    --scenario-script .testnet/scenarios/rollout/mixed_binary_boundary.py --teardown
+
+Launch (real transition, activates at the next flag ledger ~256; seed pre-satisfies the 1-min hold):
+  x-testnet run -n 6 <same --node-binary set> \
+    --seed-majority @ConsensusEntropy \
+    --scenario-script .testnet/scenarios/rollout/mixed_binary_boundary.py --teardown
+"""
+
+from helpers import CONSENSUS_ENTROPY_FEATURE
+
+VALIDATORS = [0, 1, 2]
+OLD_NODES = [3, 4, 5]
+
+
+def _ce_enabled(ctx, node_id=0):
+    s = ctx.feature_check(CONSENSUS_ENTROPY_FEATURE, node_id=node_id)
+    return bool(s and s.get("enabled"))
+
+
+def _blocked(ctx, nid):
+    info = ctx.rpc.server_info(nid) or {}
+    return bool(info.get("info", {}).get("amendment_blocked"))
+
+
+async def scenario(ctx, log):
+    await ctx.wait_for_ledger_close(timeout=90)
+
+    if not _ce_enabled(ctx):
+        # Phase 1: with CE inactive the old @release trackers must stay in sync.
+        target = (await ctx.wait_for_ledgers(3, timeout=180)).result
+        for nid in OLD_NODES:
+            await ctx.wait_for_ledger(target, node_id=nid, timeout=120)
+        log(f"phase1 OK: old @release nodes tracked to ledger {target} (CE inactive)")
+
+        # Trigger phase 2: vote CE up on the new validators only.
+        ctx.feature(CONSENSUS_ENTROPY_FEATURE, vetoed=False, nodes=VALIDATORS)
+        log("voted ConsensusEntropy accept on n0-n2; awaiting activation...")
+    else:
+        log("CE enabled at genesis; skipping phase 1, checking the boundary directly")
+
+    await ctx.wait_for_feature(
+        CONSENSUS_ENTROPY_FEATURE,
+        check=lambda s: s.get("enabled"),
+        nodes=VALIDATORS,
+        timeout=1200,
+    )
+    log("ConsensusEntropy ENABLED on validators n0-n2")
+
+    # The upgrade boundary: old non-UNL nodes must become amendment-blocked...
+    await ctx.wait_for_nodes(
+        lambda nid: _blocked(ctx, nid), nodes=OLD_NODES, timeout=180
+    )
+    # ...report it in the log...
+    ctx.assert_log("server blocked", nodes=OLD_NODES)
+    # ...and still be alive (RPC responsive) -> blocked, not crashed.
+    for nid in OLD_NODES:
+        assert ctx.rpc.server_info(nid), f"n{nid} RPC unreachable (crashed?)"
+
+    log(
+        "PASS: n3-n5 (@release) amendment-blocked and STILL RUNNING -- upgrade boundary confirmed"
+    )

.testnet/scenarios/rollout/rolling_upgrade.py

@@ -0,0 +1,369 @@
+"""Realistic rolling binary upgrade, then ConsensusEntropy activation.
+
+Topology (ALL start on @release, a build with NO CE support):
+  n0-n4  5 UNL validators   (quorum 4)
+  n5     tracker (non-UNL)  -> WILL be upgraded; keeps working after activation
+  n6     tracker (non-UNL)  -> NOT upgraded (the straggler); becomes
+                               amendment-blocked, then protocol-isolated
+
+TOPOLOGY-AWARE RESTARTS: the suite starts without fixed peers and this scenario
+forms a directed ring over 127.0.0.1. A seven-node ring remains connected while
+one node restarts and avoids macOS loopback-alias setup. After each restart we
+restore the affected links and require every node to see both ring neighbours
+before touching the next node.
+
+Why --seed-majority is used (NOT a magic vote): the validators still VOTE the
+amendment up (ctx.feature below). Seeding only pre-writes the sfMajorities record
+with CloseTime=0 so the hold is already satisfied, collapsing activation to ONE
+flag ledger. If the validators don't vote yes it is cleared (tfLostMajority). See
+prepare_genesis_file() in testnet/config.py.
+
+Arc: all-old healthy + mesh formed -> rolling-upgrade 5 validators + 1 tracker
+(mesh re-forms between each) -> vote CE -> activation at the flag ledger ->
+n5 (upgraded) keeps tracking, while every upgraded peer drops/rejects n6.
+
+Run: x-testnet --rippled-path @release suite \\
+       .testnet/scenarios/rollout/rollout-suite.yml --stop-on-fail
+
+The upgrade target is the immutable saved-binary alias `@export-rng-gate`.
+"""
+
+import asyncio
+
+from helpers import CONSENSUS_ENTROPY_FEATURE
+
+VALIDATORS = [0, 1, 2, 3, 4]
+UPGRADED_TRACKER = 5
+STRAGGLER_TRACKER = 6
+ALL_NODES = VALIDATORS + [UPGRADED_TRACKER, STRAGGLER_TRACKER]
+# Every node has its predecessor and successor in the ring.
+MESH_MIN = 2
+PROTOCOL = "XRPL/2.2"
+CONSENSUS_ENTROPY_CAPABILITY = "xahau-consensus-entropy"
+UPGRADE_BINARY = "@export-rng-gate"
+RING_EDGES = {(nid, (nid + 1) % len(ALL_NODES)) for nid in ALL_NODES}
+
+
+def _info(ctx, nid):
+    return (ctx.rpc.server_info(nid) or {}).get("info", {})
+
+
+def _blocked(ctx, nid):
+    return bool(_info(ctx, nid).get("amendment_blocked"))
+
+
+def _peers(ctx, nid):
+    return int(_info(ctx, nid).get("peers") or 0)
+
+
+def _peer_public_keys(ctx, nid):
+    result = ctx.rpc.peers(nid) or []
+    return {peer.get("public_key") for peer in result if peer.get("public_key")}
+
+
+def _assert_capability_matrix(ctx, log, *, upgraded, phase):
+    """Assert per-edge handshake results from upgraded nodes.
+
+    Capable peers negotiate the CE token without changing the overlay protocol.
+    Old peers remain connected on XRPL/2.2 but cannot echo the token.
+    """
+    upgraded = set(upgraded)
+    old = set(ALL_NODES) - upgraded
+    key_to_node = {}
+    for nid in ALL_NODES:
+        public_key = _info(ctx, nid).get("pubkey_node")
+        assert public_key, f"n{nid} server_info missing pubkey_node"
+        key_to_node[public_key] = nid
+
+    capable_edges = []
+    legacy_edges = []
+    for source in sorted(upgraded):
+        peers = ctx.rpc.peers(source)
+        assert peers is not None, f"n{source} peers RPC failed"
+        for peer in peers:
+            target = key_to_node.get(peer.get("public_key"))
+            if target is None:
+                continue
+            protocol = peer.get("protocol")
+            assert protocol == PROTOCOL, (
+                f"{phase}: n{source}->n{target} negotiated {protocol!r}, "
+                f"expected {PROTOCOL}"
+            )
+            capabilities = peer.get("capabilities") or {}
+            negotiated = bool(capabilities.get(CONSENSUS_ENTROPY_CAPABILITY))
+            expected = target in upgraded
+            assert negotiated == expected, (
+                f"{phase}: n{source}->n{target} capability "
+                f"{CONSENSUS_ENTROPY_CAPABILITY}={negotiated}, expected {expected}; "
+                f"peer={peer}"
+            )
+            (capable_edges if negotiated else legacy_edges).append(
+                f"n{source}->n{target}"
+            )
+
+    if len(upgraded) > 1:
+        assert capable_edges, f"{phase}: no upgraded-upgraded edge observed"
+    if old:
+        assert legacy_edges, f"{phase}: no upgraded-old edge observed"
+    log(
+        f"{phase}: {PROTOCOL} throughout; CE capability on "
+        f"{len(capable_edges)} upgraded-upgraded directed edges and off on "
+        f"{len(legacy_edges)} upgraded-old directed edges"
+    )
+
+
+def _straggler_is_isolated(ctx):
+    """The old process is alive, but no upgraded node has an active session to it."""
+    old_key = _info(ctx, STRAGGLER_TRACKER).get("pubkey_node")
+    if not old_key or _peers(ctx, STRAGGLER_TRACKER) != 0:
+        return False
+    return all(old_key not in _peer_public_keys(ctx, nid) for nid in ALL_NODES[:-1])
+
+
+async def _wait_for_stable_straggler_isolation(ctx, log, *, timeout=180):
+    await ctx.wait_for(
+        lambda: _straggler_is_isolated(ctx),
+        timeout=timeout,
+        poll_interval=1,
+        name="legacy-straggler-isolated",
+    )
+    # Make the assertion survive PeerFinder's immediate reconnect cycle rather
+    # than observing only the instant between two attempts.
+    for _ in range(5):
+        await asyncio.sleep(1)
+        assert _straggler_is_isolated(ctx), (
+            f"n{STRAGGLER_TRACKER} regained an incompatible active session"
+        )
+    log(
+        f"n{STRAGGLER_TRACKER} remains RPC-alive but protocol-isolated: "
+        f"peers={_peers(ctx, STRAGGLER_TRACKER)}"
+    )
+
+
+async def _wait_mesh(ctx, log, *, timeout=180):
+    """Wait until every node sees both ring neighbours."""
+    await ctx.wait_for_nodes(
+        lambda x: _peers(ctx, x) >= MESH_MIN, nodes=ALL_NODES, timeout=timeout
+    )
+    peers = {nid: _peers(ctx, nid) for nid in ALL_NODES}
+    log(f"peer mesh healthy (>= {MESH_MIN} peers each): {peers}")
+
+
+async def _restore_ring(ctx, log, *, timeout=90):
+    """Restore missing ring links using localhost plus each node's peer port."""
+    await ctx.wait_for_nodes(
+        lambda nid: ctx.rpc.server_info(nid) is not None,
+        nodes=ALL_NODES,
+        timeout=min(timeout, 30),
+    )
+    current = ctx.topology_snapshot(nodes=ALL_NODES).outbound_edges
+    missing = RING_EDGES - current
+    for source, target in sorted(missing):
+        target_node = ctx._node_info(target)
+        result = ctx.rpc.connect(source, "127.0.0.1", target_node.port_peer)
+        assert result and result.get("status") == "success", (
+            f"failed to connect ring edge n{source}->n{target}: {result}"
+        )
+    await ctx.wait_for_topology(
+        RING_EDGES,
+        nodes=ALL_NODES,
+        exact=False,
+        timeout=timeout,
+        stable_for=1,
+    )
+    log(f"ring topology restored ({len(RING_EDGES)} directed edges)")
+
+
+def _ledger_transactions(result):
+    """Return the transactions array from a ledger RPC result."""
+    if not result:
+        return []
+    ledger = result.get("ledger") or {}
+    return ledger.get("transactions") or result.get("transactions") or []
+
+
+def _tx_types(result):
+    """Return TransactionType (or 'hash') for each tx in a ledger RPC result."""
+    types = []
+    for tx in _ledger_transactions(result):
+        if isinstance(tx, dict):
+            types.append(str(tx.get("TransactionType", "<unnamed>")))
+        else:
+            types.append("hash")
+    return types
+
+
+def _rpc_summary(result):
+    """Return a compact, log-safe summary of an RPC result."""
+    if result is None:
+        return "no response"
+    if result.get("error"):
+        return f"error={result.get('error')} message={result.get('error_message')}"
+
+    ledger = result.get("ledger") or {}
+    transactions = _ledger_transactions(result)
+    tx_types = _tx_types(result)
+    state = result.get("state") or []
+    entry_types = sorted(
+        {
+            str(entry.get("LedgerEntryType", "<unnamed>"))
+            for entry in state
+            if isinstance(entry, dict)
+        }
+    )
+    details = ["success"]
+    if ledger:
+        details.append(f"ledger={ledger.get('ledger_index')}")
+    details.append(f"txs={len(transactions)} types={tx_types}")
+    if state:
+        details.append(f"state={len(state)} types={entry_types}")
+    if result.get("account_data"):
+        details.append(f"account_seq={result['account_data'].get('Sequence')}")
+    if result.get("marker"):
+        details.append("marker=yes")
+    if not ledger and not transactions and not state and not result.get("account_data"):
+        details.append(f"keys={sorted(result)}")
+    return "; ".join(details)
+
+
+async def _wait_for_entropy_ledger(ctx, log, *, node_id, timeout=180):
+    """Wait until node_id's closed ledger expands with a ConsensusEntropy tx."""
+    deadline = asyncio.get_event_loop().time() + timeout
+    last = None
+    while asyncio.get_event_loop().time() < deadline:
+        info = _info(ctx, node_id)
+        seq = info.get("validated_ledger", {}).get("seq") or info.get("ledger_index")
+        if seq and seq != last:
+            last = seq
+            result = ctx.rpc.request(
+                node_id,
+                "ledger",
+                {
+                    "ledger_index": seq,
+                    "transactions": True,
+                    "expand": True,
+                },
+            )
+            types = _tx_types(result)
+            log(
+                f"n{node_id} closed/validated ledger {seq} expanded: "
+                f"{_rpc_summary(result)}"
+            )
+            if "ConsensusEntropy" in types:
+                return seq, types
+        await asyncio.sleep(1)
+    raise TimeoutError(
+        f"n{node_id} did not close a ledger containing ConsensusEntropy "
+        f"within {timeout}s (last={last})"
+    )
+
+
+async def scenario(ctx, log):
+    # 1. all-old net healthy AND the ring has formed before we touch it
+    await _restore_ring(ctx, log)
+    await ctx.wait_for_ledger_close(timeout=90)
+    base = (await ctx.wait_for_ledgers(2, timeout=120)).result
+    for nid in ALL_NODES:
+        await ctx.wait_for_ledger(base, node_id=nid, timeout=120)
+    await _wait_mesh(ctx, log, timeout=180)
+    log(f"all-old net healthy at ledger {base} (CE inactive)")
+
+    # 2. rolling-upgrade validators (then one tracker), one at a time. After each
+    #    restart, restore and settle the ring BEFORE rolling the next, so we never
+    #    leave a broken path in place while taking out another node.
+    upgraded = set()
+    for nid in [*VALIDATORS, UPGRADED_TRACKER]:
+        ref = next(v for v in VALIDATORS if v != nid)
+        role = "validator" if nid in VALIDATORS else "tracker"
+        log(f"rolling upgrade: n{nid} ({role}) -> {UPGRADE_BINARY}")
+        await ctx.restart_node_with_binary(nid, UPGRADE_BINARY, delay=3)
+        upgraded.add(nid)
+        await _restore_ring(ctx, log)
+        await _wait_mesh(ctx, log, timeout=180)  # mesh re-formed before next roll
+        target = (await ctx.wait_for_ledgers(2, node_id=ref, timeout=180)).result
+        await ctx.wait_for_ledger(target, node_id=nid, timeout=180)
+        _assert_capability_matrix(
+            ctx,
+            log,
+            upgraded=upgraded,
+            phase=f"after upgrading n{nid}",
+        )
+        log(f"n{nid} rejoined; mesh re-formed; quorum advanced to {target}")
+    log(
+        f"validators + n{UPGRADED_TRACKER} on {UPGRADE_BINARY}; "
+        f"n{STRAGGLER_TRACKER} left on @release; CE still inactive"
+    )
+
+    # 3. vote CE up on the validators (real vote; the seed only pre-satisfied the hold)
+    gate_start = ctx.mark("ce-protocol-gate")
+    ctx.feature(CONSENSUS_ENTROPY_FEATURE, vetoed=False, nodes=VALIDATORS)
+    log("voted ConsensusEntropy accept on n0-n4; crossing the flag ledger...")
+
+    # 4. activation at the flag ledger
+    await ctx.wait_for_feature(
+        CONSENSUS_ENTROPY_FEATURE,
+        check=lambda s: s.get("enabled"),
+        nodes=VALIDATORS,
+        timeout=900,
+    )
+    log("ConsensusEntropy ENABLED on the upgraded quorum")
+
+    # 5. The amendment-blocked behavior remains visible on the old process, but
+    #    the upgraded overlay now makes the incompatibility fail fast.
+    await ctx.wait_for_nodes(
+        lambda x: _blocked(ctx, x), nodes=[STRAGGLER_TRACKER], timeout=180
+    )
+    ctx.assert_log("server blocked", nodes=[STRAGGLER_TRACKER])
+    for nid in sorted(upgraded):
+        ctx.assert_log(
+            r"Peer protocol feature now required: xahau-consensus-entropy",
+            since=gate_start,
+            nodes=[nid],
+        )
+    for nid in (VALIDATORS[0], UPGRADED_TRACKER):
+        ctx.assert_log(
+            r"Missing required protocol feature xahau-consensus-entropy",
+            since=gate_start,
+            nodes=[nid],
+        )
+    await _wait_for_stable_straggler_isolation(ctx, log)
+
+    # Exercise both admission directions after the initial eviction. The RPC
+    # only schedules a connection attempt; the invariant is that neither
+    # attempt becomes an active peer session.
+    old_node = ctx._node_info(STRAGGLER_TRACKER)
+    new_node = ctx._node_info(VALIDATORS[0])
+    new_to_old = ctx.rpc.connect(UPGRADED_TRACKER, "127.0.0.1", old_node.port_peer)
+    old_to_new = ctx.rpc.connect(STRAGGLER_TRACKER, "127.0.0.1", new_node.port_peer)
+    log(
+        "forced reconnect attempts in both directions: "
+        f"new->old={new_to_old}; old->new={old_to_new}"
+    )
+    await _wait_for_stable_straggler_isolation(ctx, log, timeout=60)
+
+    assert not _blocked(ctx, UPGRADED_TRACKER), (
+        f"n{UPGRADED_TRACKER} (upgraded tracker) should NOT be amendment-blocked"
+    )
+    probe_ledger, ce_types = await _wait_for_entropy_ledger(
+        ctx, log, node_id=UPGRADED_TRACKER, timeout=180
+    )
+    log(
+        f"n{UPGRADED_TRACKER} has ConsensusEntropy at ledger {probe_ledger}: "
+        f"types={ce_types}"
+    )
+
+    target = (await ctx.wait_for_ledgers(2, node_id=VALIDATORS[0], timeout=180)).result
+    for nid in sorted(upgraded):
+        await ctx.wait_for_ledger(target, node_id=nid, timeout=180)
+    log(f"capable six-node component continued through ledger {target}")
+
+    snapshot = ctx._network.snapshot("ce-required-protocol-gate", keep_db=False)
+    log(f"captured protocol-gate and reconnect evidence at {snapshot}")
+    for nid in (UPGRADED_TRACKER, STRAGGLER_TRACKER):
+        assert ctx.rpc.server_info(nid), f"n{nid} RPC down (crashed?)"
+    log(
+        f"PASS: rolling upgrade preserved quorum 4 (mesh-gated); CE activated; "
+        f"n{UPGRADED_TRACKER} (upgraded tracker) still tracking; "
+        f"n{STRAGGLER_TRACKER} (@release straggler) amendment-blocked, still "
+        "running for RPC observation, and rejected from the peer protocol"
+    )

.testnet/scenarios/rollout/rollout-suite.yml

@@ -0,0 +1,43 @@
+# Rolling binary upgrade -> ConsensusEntropy activation.
+#
+# All nodes start on @release (set via `--rippled-path @release` on the CLI); the
+# scenario rolling-restarts them to the immutable @export-rng-gate snapshot,
+# then casts a REAL vote. The
+# --seed-majority (majority_features) only pre-satisfies the amendment hold time
+# so activation lands at ONE flag ledger instead of two -- it is NOT a vote, and
+# is cleared (tfLostMajority) if the validators don't vote yes before the flag
+# ledger. start_ledger gives runway for the 6 restarts + vote to finish before
+# the first flag ledger (256), so the seed survives to a real vote.
+#
+# Run:
+#   x-testnet --rippled-path @release suite \
+#     .testnet/scenarios/rollout/rollout-suite.yml --stop-on-fail
+#
+# Suite runs auto-snapshot to .testnet/output/runs/ on failure (survives
+# teardown), so `x-testnet logs-search --run latest/rolling_upgrade_ce ...` works.
+
+defaults:
+  network:
+    node_count: 7        # n0-n4 validators, n5/n6 non-UNL trackers
+    validators: 5
+    quorum: 4            # 80%: a restart leaves exactly quorum on the peers up
+    fixed_peers: false   # scenario forms a restart-safe ring on 127.0.0.1
+    find_ports: true
+    start_ledger: 210    # measured: the mesh-gated upgrade+vote is ~23 ledgers, so
+                         # the vote lands ~233 with a ~23-ledger margin before flag
+                         # ledger 256 (activation). Miss -> vote after 256 -> next
+                         # flag is 512 (~13 min) or tfLostMajority clears the seed.
+    majority_features:
+      - ConsensusEntropy # pre-satisfy the hold ONLY (still needs a real vote)
+    track_features:
+      - ConsensusEntropy
+    log_levels:
+      LedgerConsensus: debug
+      NetworkOPs: info
+    # The scenario connects a seven-node ring through each node's distinct peer
+    # port. This remains connected while one node rolls and works on macOS without
+    # privileged 127.0.0.2+ aliases.
+
+tests:
+  - name: rolling_upgrade_ce
+    script: .testnet/scenarios/rollout/rolling_upgrade.py

.testnet/scenarios/suite.yml

@@ -0,0 +1,63 @@
+defaults:
+  network:
+    node_count: 5
+    launcher: tmux
+    find_ports: true
+    slave_delay: 0.2
+    features:
+      - ConsensusEntropy
+    track_features:
+      - ConsensusEntropy
+    unl_report: true
+    log_levels:
+      TxQ: info
+      Protocol: debug
+      Peer: debug
+      LedgerConsensus: debug
+      ConsensusExtensions: debug
+      NetworkOPs: info
+    rc:
+      - rng_poll_ms=333
+
+tests:
+  - name: steady_state_entropy
+    script: .testnet/scenarios/entropy/steady_state_entropy.py
+
+  - name: fallback_without_unl_report
+    script: .testnet/scenarios/entropy/fallback_without_unl_report.py
+    network:
+      unl_report: false
+
+  - name: steady_state_entropy_fast_start
+    script: .testnet/scenarios/entropy/steady_state_entropy.py
+    network:
+      env:
+        XAHAUD_RUNTIME_TEST_CONFIG: '{"set":{"global":{"rng_poll_ms":333,"bootstrap_fast_start":true}}}'
+
+  - name: entropy_with_transactions
+    script: .testnet/scenarios/entropy/entropy_with_transactions.py
+
+  - name: hook_entropy_api
+    script: .testnet/scenarios/entropy/hook_entropy_api.py
+
+  - name: quorum_recovery_smoke
+    script: .testnet/scenarios/entropy/quorum_recovery_smoke.py
+
+  - name: quorum_degradation_smoke
+    script: .testnet/scenarios/entropy/quorum_degradation_smoke.py
+    network:
+      log_levels:
+        LedgerConsensus: trace
+        ConsensusExtensions: trace
+
+  # Tier 2 (participant_aligned) needs 6 nodes: n=5 has no band (tier2 ==
+  # quorum). At 6, the 4/6 window is the participant_aligned band.
+  - name: participant_aligned_smoke
+    script: .testnet/scenarios/entropy/participant_aligned_smoke.py
+    network:
+      node_count: 6
+      log_levels:
+        LedgerConsensus: trace
+        ConsensusExtensions: trace
+
+  # Export scenarios: see export-suite.yml

Builds/levelization/results/ordering.txt

@@ -12,6 +12,7 @@ libxrpl.server > xrpl.basics
 libxrpl.server > xrpl.json
 libxrpl.server > xrpl.protocol
 libxrpl.server > xrpl.server
+test.app > test.shamap
 test.app > test.toplevel
 test.app > test.unit_test
 test.app > xrpl.basics
@@ -21,6 +22,7 @@ test.app > xrpld.ledger
 test.app > xrpld.nodestore
 test.app > xrpld.overlay
 test.app > xrpld.rpc
+test.app > xrpld.shamap
 test.app > xrpl.hook
 test.app > xrpl.json
 test.app > xrpl.protocol
@@ -36,6 +38,7 @@ test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpld.conditions
 test.consensus > test.csf
+test.consensus > test.jtx
 test.consensus > test.toplevel
 test.consensus > test.unit_test
 test.consensus > xrpl.basics
@@ -43,6 +46,9 @@ test.consensus > xrpld.app
 test.consensus > xrpld.consensus
 test.consensus > xrpld.core
 test.consensus > xrpld.ledger
+test.consensus > xrpld.overlay
+test.consensus > xrpld.shamap
+test.consensus > xrpl.json
 test.consensus > xrpl.protocol
 test.core > test.jtx
 test.core > test.toplevel
@@ -77,6 +83,11 @@ test.ledger > xrpld.app
 test.ledger > xrpld.core
 test.ledger > xrpld.ledger
 test.ledger > xrpl.protocol
+test.net > test.toplevel
+test.net > xrpl.basics
+test.net > xrpld.core
+test.net > xrpld.net
+test.net > xrpl.json
 test.nodestore > test.jtx
 test.nodestore > test.toplevel
 test.nodestore > test.unit_test
@@ -84,6 +95,7 @@ test.nodestore > xrpl.basics
 test.nodestore > xrpld.core
 test.nodestore > xrpld.nodestore
 test.nodestore > xrpld.unity
+test.nodestore > xrpl.protocol
 test.overlay > test.jtx
 test.overlay > test.toplevel
 test.overlay > test.unit_test
@@ -118,6 +130,7 @@ test.rpc > xrpld.core
 test.rpc > xrpld.net
 test.rpc > xrpld.overlay
 test.rpc > xrpld.rpc
+test.rpc > xrpld.shamap
 test.rpc > xrpl.hook
 test.rpc > xrpl.json
 test.rpc > xrpl.protocol
@@ -198,6 +211,7 @@ xrpld.rpc > xrpld.core
 xrpld.rpc > xrpld.ledger
 xrpld.rpc > xrpld.nodestore
 xrpld.rpc > xrpld.shamap
+xrpld.rpc > xrpl.hook
 xrpld.rpc > xrpl.json
 xrpld.rpc > xrpl.protocol
 xrpld.rpc > xrpl.resource

CMakeLists.txt

@@ -21,7 +21,11 @@ endif()
 project (xrpl)
 set(Boost_NO_BOOST_CMAKE ON)
 
-# make GIT_COMMIT_HASH define available to all sources
+# Only sources that expose Git metadata should rebuild when HEAD changes.
+set(git_info_sources
+    "${CMAKE_CURRENT_SOURCE_DIR}/src/xrpld/app/main/Main.cpp"
+    "${CMAKE_CURRENT_SOURCE_DIR}/src/xrpld/app/misc/NetworkOPs.cpp")
+
 find_package(Git)
 if(Git_FOUND)
     execute_process(COMMAND ${GIT_EXECUTABLE} --git-dir=${CMAKE_CURRENT_SOURCE_DIR}/.git rev-parse HEAD
@@ -29,7 +33,8 @@ if(Git_FOUND)
     if(gch)
         set(GIT_COMMIT_HASH "${gch}")
         message(STATUS gch: ${GIT_COMMIT_HASH})
-        add_definitions(-DGIT_COMMIT_HASH="${GIT_COMMIT_HASH}")
+        set_property(SOURCE ${git_info_sources} APPEND PROPERTY
+            COMPILE_DEFINITIONS "GIT_COMMIT_HASH=\"${GIT_COMMIT_HASH}\"")
     endif()
 
     execute_process(COMMAND ${GIT_EXECUTABLE} --git-dir=${CMAKE_CURRENT_SOURCE_DIR}/.git rev-parse --abbrev-ref HEAD
@@ -37,7 +42,8 @@ if(Git_FOUND)
     if(gb)
         set(GIT_BRANCH "${gb}")
         message(STATUS gb: ${GIT_BRANCH})
-        add_definitions(-DGIT_BRANCH="${GIT_BRANCH}")
+        set_property(SOURCE ${git_info_sources} APPEND PROPERTY
+            COMPILE_DEFINITIONS "GIT_BRANCH=\"${GIT_BRANCH}\"")
     endif()
 endif() #git
 
@@ -122,6 +128,7 @@ endif()
 find_package(nudb REQUIRED)
 find_package(date REQUIRED)
 find_package(xxHash REQUIRED)
+find_package(magic_enum REQUIRED)
 
 include(deps/WasmEdge) 
   if(TARGET nudb::core)

README.md

@@ -2,7 +2,7 @@
 
 **Note:** Throughout this README, references to "we" or "our" pertain to the community and contributors involved in the Xahau network. It does not imply a legal entity or a specific collection of individuals.
 
-[Xahau](https://xahau.network/) is a decentralized cryptographic ledger that builds upon the robust foundation of the XRP Ledger. It inherits the XRP Ledger's Byzantine Fault Tolerant consensus algorithm and enhances it with additional features and functionalities. Developers and users familiar with the XRP Ledger will find that most documentation and tutorials available on [xrpl.org](https://xrpl.org) are relevant and applicable to Xahau, including those related to running validators and managing validator keys. For Xahau specific documentation you can visit our [documentation](https://xahau.network/)
+[Xahau](https://xahau.network/) is a decentralized cryptographic ledger that builds upon the robust foundation of the XRP Ledger. It inherits the XRP Ledger's Byzantine Fault Tolerant consensus algorithm under the normal XRPL assumptions about configured validator-list overlap, timing, and fault bounds, and enhances it with additional features and functionalities. Developers and users familiar with the XRP Ledger will find that most documentation and tutorials available on [xrpl.org](https://xrpl.org) are relevant and applicable to Xahau, including those related to running validators and managing validator keys. For Xahau specific documentation you can visit our [documentation](https://xahau.network/)
 
 ## XAH
 XAH is the public, counterparty-free asset native to Xahau and functions primarily as network gas. Transactions submitted to the Xahau network must supply an appropriate amount of XAH, to be burnt by the network as a fee, in order to be successfully included in a validated ledger. In addition, XAH also acts as a bridge currency within the Xahau DEX. XAH is traded on the open-market and is available for anyone to access. Xahau was created in 2023 with a supply of 600 million units of XAH.

build-core.sh

@@ -95,8 +95,16 @@ if [[ "$4" == "" ]]; then
   echo "Non GH, local building, no Action runner magic"
 else
   # GH Action, runner
-  cp /io/release-build/xahaud /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
-  cp /io/release-build/release.info /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4.releaseinfo
+    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "release" ]]; then
+        echo "building on the release branch... placing it in builds/candidate"
+        mkdir /data/builds/candidate
+        cp /io/release-build/xahaud /data/builds/candidate/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
+        cp /io/release-build/release.info /data/builds/candidate/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4.releaseinfo
+    else
+        echo "building non-release branch, placing it in builds root"
+        cp /io/release-build/xahaud /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
+        cp /io/release-build/release.info /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4.releaseinfo
+    fi  
   echo "Published build to: http://build.xahau.tech/"
   echo $(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
 fi

build-full.sh

@@ -12,17 +12,16 @@ echo "-- GITHUB_REPOSITORY: $1"
 echo "-- GITHUB_SHA:        $2"
 echo "-- GITHUB_RUN_NUMBER: $4"
 
-umask 0000;
+umask 0000
 
 ####
 
-cd /io;
-mkdir -p src/certs;
-curl --silent -k https://raw.githubusercontent.com/RichardAH/rippled-release-builder/main/ca-bundle/certbundle.h -o src/certs/certbundle.h;
-if [ "`grep certbundle.h src/xrpld/net/detail/RegisterSSLCerts.cpp | wc -l`" -eq "0" ]
-then
-    cp src/xrpld/net/detail/RegisterSSLCerts.cpp src/xrpld/net/detail/RegisterSSLCerts.cpp.old
-    perl -i -pe "s/^{/{
+cd /io
+mkdir -p src/certs
+curl --silent -k https://raw.githubusercontent.com/RichardAH/rippled-release-builder/main/ca-bundle/certbundle.h -o src/certs/certbundle.h
+if [ "$(grep certbundle.h src/xrpld/net/detail/RegisterSSLCerts.cpp | wc -l)" -eq "0" ]; then
+  cp src/xrpld/net/detail/RegisterSSLCerts.cpp src/xrpld/net/detail/RegisterSSLCerts.cpp.old
+  perl -i -pe "s/^{/{
     #ifdef EMBEDDED_CA_BUNDLE
     BIO *cbio = BIO_new_mem_buf(ca_bundle.data(), ca_bundle.size());
     X509_STORE  *cts = SSL_CTX_get_cert_store(ctx.native_handle());
@@ -68,15 +67,14 @@ fi
 source /opt/rh/gcc-toolset-11/enable
 export PATH=/usr/local/bin:$PATH
 export CC='/usr/lib64/ccache/gcc' &&
-export CXX='/usr/lib64/ccache/g++' &&
-echo "-- Build Rippled --" &&
-pwd &&
+  export CXX='/usr/lib64/ccache/g++' &&
+  echo "-- Build Rippled --" &&
+  pwd &&
+  echo "MOVING TO [ build-core.sh ]"
 
-echo "MOVING TO [ build-core.sh ]";
-
-printenv > .env.temp;
-cat .env.temp | grep '=' | sed s/\\\(^[^=]\\+=\\\)/\\1\\\"/g|sed s/\$/\\\"/g > .env;
-rm .env.temp;
+printenv >.env.temp
+cat .env.temp | grep '=' | sed s/\\\(^[^=]\\+=\\\)/\\1\\\"/g | sed s/\$/\\\"/g >.env
+rm .env.temp
 
 echo "Persisting ENV:"
 cat .env

cfg/xahaud-example.cfg

@@ -494,7 +494,7 @@
 #
 #   Configure the maximum number of transactions to have in the job queue
 #
-#   Must be a number between 100 and 1000, defaults to 250
+#   Must be a number between 100 and 1000, defaults to 1000
 #
 #
 # [overlay]
@@ -593,7 +593,7 @@
 #       reaches or exceeds this number. After that the limit may still
 #       change, but will stay above the target. If consensus is not
 #       healthy, the limit will be clamped to this value or lower.
-#       Default: 50.
+#       Default: 1000.
 #
 #   maximum_txn_in_ledger = <number>
 #

cfg/xahaud-standalone.cfg

@@ -146,8 +146,6 @@ D686F2538F410C9D0D856788E98E3579595DAF7B38D38887F81ECAC934B06040 HooksUpdate1
 3C43D9A973AA4443EF3FC38E42DD306160FBFFDAB901CD8BAA15D09F2597EB87 NonFungibleTokensV1
 0285B7E5E08E1A8E4C15636F0591D87F73CB6A7B6452A932AD72BBC8E5D1CBE3 fixNFTokenDirV1
 36799EA497B1369B170805C078AEFE6188345F9B3E324C21E9CA3FF574E3C3D6 fixNFTokenNegOffer
-4C499D17719BB365B69010A436B64FD1A82AAB199FC1CEB06962EBD01059FB09 fixXahauV1
-215181D23BF5C173314B5FDB9C872C92DE6CC918483727DE037C0C13E7E6EE9D fixXahauV2
 0D8BF22FF7570D58598D1EF19EBB6E142AD46E59A223FD3816262FBB69345BEA Remit
 7CA0426E7F411D39BB014E57CD9E08F61DE1750F0D41FCD428D9FB80BB7596B0 ZeroB2M
 4B8466415FAB32FFA89D9DCBE166A42340115771DF611A7160F8D7439C87ECD8 fixNSDelete

cmake/CodeCoverage.cmake

@@ -95,6 +95,9 @@
 #     - replace both functions setup_target_for_coverage_gcovr_* with a single setup_target_for_coverage_gcovr
 #     - add support for all gcovr output formats
 #
+# 2024-04-03, Bronek Kozicki
+#     - add support for output formats: jacoco, clover, lcov
+#
 # USAGE:
 #
 # 1. Copy this file into your cmake modules path.
@@ -256,10 +259,10 @@ endif()
 #     BASE_DIRECTORY "../"                   # Base directory for report
 #                                            #  (defaults to PROJECT_SOURCE_DIR)
 #     FORMAT "cobertura"                     # Output format, one of:
-#                                            #  xml cobertura sonarqube json-summary
-#                                            #  json-details coveralls csv txt
-#                                            #  html-single html-nested html-details
-#                                            #  (xml is an alias to cobertura;
+#                                            #  xml cobertura sonarqube jacoco clover
+#                                            #  json-summary json-details coveralls csv
+#                                            #  txt html-single html-nested html-details
+#                                            #  lcov (xml is an alias to cobertura;
 #                                            #  if no format is set, defaults to xml)
 #     EXCLUDE "src/dir1/*" "src/dir2/*"      # Patterns to exclude (can be relative
 #                                            #  to BASE_DIRECTORY, with CMake 3.4+)
@@ -308,6 +311,8 @@ function(setup_target_for_coverage_gcovr)
             set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.txt)
         elseif(Coverage_FORMAT STREQUAL "csv")
             set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.csv)
+        elseif(Coverage_FORMAT STREQUAL "lcov")
+            set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.lcov)
         else()
             set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.xml)
         endif()
@@ -320,6 +325,14 @@ function(setup_target_for_coverage_gcovr)
         set(Coverage_FORMAT cobertura) # overwrite xml
     elseif(Coverage_FORMAT STREQUAL "sonarqube")
         list(APPEND GCOVR_ADDITIONAL_ARGS --sonarqube "${GCOVR_OUTPUT_FILE}" )
+    elseif(Coverage_FORMAT STREQUAL "jacoco")
+        list(APPEND GCOVR_ADDITIONAL_ARGS --jacoco "${GCOVR_OUTPUT_FILE}" )
+        list(APPEND GCOVR_ADDITIONAL_ARGS --jacoco-pretty )
+    elseif(Coverage_FORMAT STREQUAL "clover")
+        list(APPEND GCOVR_ADDITIONAL_ARGS --clover "${GCOVR_OUTPUT_FILE}" )
+        list(APPEND GCOVR_ADDITIONAL_ARGS --clover-pretty )
+    elseif(Coverage_FORMAT STREQUAL "lcov")
+        list(APPEND GCOVR_ADDITIONAL_ARGS --lcov "${GCOVR_OUTPUT_FILE}" )
     elseif(Coverage_FORMAT STREQUAL "json-summary")
         list(APPEND GCOVR_ADDITIONAL_ARGS --json-summary "${GCOVR_OUTPUT_FILE}" )
         list(APPEND GCOVR_ADDITIONAL_ARGS --json-summary-pretty)
@@ -380,6 +393,7 @@ function(setup_target_for_coverage_gcovr)
         ${GCOVR_PATH}
         --gcov-executable ${GCOV_TOOL}
         --gcov-ignore-parse-errors=negative_hits.warn_once_per_file
+        --gcov-ignore-parse-errors=suspicious_hits.warn_once_per_file
         -r ${BASEDIR}
         ${GCOVR_ADDITIONAL_ARGS}
         ${GCOVR_EXCLUDE_ARGS}

cmake/RippledCore.cmake

@@ -54,6 +54,7 @@ add_library(xrpl.imports.main INTERFACE)
 target_link_libraries(xrpl.imports.main
   INTERFACE
     LibArchive::LibArchive
+    magic_enum::magic_enum
     OpenSSL::Crypto
     Ripple::boost
     wasmedge::wasmedge
@@ -164,6 +165,9 @@ if(xrpld)
   if(tests)
     target_compile_definitions(rippled PUBLIC ENABLE_TESTS)
   endif()
+  if(xahaud_runtime_test_config)
+    target_compile_definitions(rippled PUBLIC XAHAUD_ENABLE_RUNTIME_TEST_CONFIG=1)
+  endif()
   target_include_directories(rippled
     PRIVATE
       $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/src>
@@ -179,6 +183,21 @@ if(xrpld)
       "${CMAKE_CURRENT_SOURCE_DIR}/src/test/*.cpp"
     )
     target_sources(rippled PRIVATE ${sources})
+
+    set(HOOKS_TEST_DIR "" CACHE PATH "External hook Env-test directory")
+    if(NOT HOOKS_TEST_DIR AND DEFINED ENV{HOOKS_TEST_DIR})
+      set(HOOKS_TEST_DIR "$ENV{HOOKS_TEST_DIR}")
+    endif()
+    if(HOOKS_TEST_DIR)
+      file(GLOB_RECURSE hook_test_sources CONFIGURE_DEPENDS
+        "${HOOKS_TEST_DIR}/*_test.cpp"
+      )
+      if(hook_test_sources)
+        message(STATUS "Including external hook Env tests from ${HOOKS_TEST_DIR}")
+        target_sources(rippled PRIVATE ${hook_test_sources})
+        target_include_directories(rippled PRIVATE "${HOOKS_TEST_DIR}")
+      endif()
+    endif()
   endif()
 
   target_link_libraries(rippled

cmake/RippledInterface.cmake

@@ -22,6 +22,9 @@ target_compile_definitions (opts
     $<$<BOOL:${beast_no_unit_test_inline}>:BEAST_NO_UNIT_TEST_INLINE=1>
     $<$<BOOL:${beast_disable_autolink}>:BEAST_DONT_AUTOLINK_TO_WIN32_LIBRARIES=1>
     $<$<BOOL:${single_io_service_thread}>:RIPPLE_SINGLE_IO_SERVICE_THREAD=1>
+    # Enhanced logging is enabled for Debug builds, or explicitly via
+    # -DBEAST_ENHANCED_LOGGING=ON for other build types.
+    $<$<OR:$<CONFIG:Debug>,$<BOOL:${BEAST_ENHANCED_LOGGING}>>:BEAST_ENHANCED_LOGGING=1>
     $<$<BOOL:${voidstar}>:ENABLE_VOIDSTAR>)
 target_compile_options (opts
   INTERFACE

cmake/RippledSettings.cmake

@@ -12,6 +12,13 @@ option(xrpld "Build xrpld" ON)
 
 option(tests "Build tests" ON)
 
+option(xahaud_runtime_test_config
+  "Enable XAHAUD_RUNTIME_TEST_CONFIG env and runtime_config RPC fault-injection controls"
+  OFF)
+# Conan 2 local opt-in:
+# [conf]
+# tools.cmake.cmaketoolchain:extra_variables={"xahaud_runtime_test_config":"ON"}
+
 option(unity "Creates a build using UNITY support in cmake. This is the default" ON)
 if(unity)
   if(NOT is_ci)

conanfile.py

@@ -29,6 +29,7 @@ class Xrpl(ConanFile):
         'date/3.0.3',
         'grpc/1.50.1',
         'libarchive/3.7.6',
+        'magic_enum/0.9.5',
         'nudb/2.0.8',
         'openssl/3.6.0',
         'soci/4.0.3@xahaud/stable',

hook/error.h

@@ -47,5 +47,8 @@
 #define MEM_OVERLAP -43
 #define TOO_MANY_STATE_MODIFICATIONS -44
 #define TOO_MANY_NAMESPACES -45
+#define EXPORT_FAILURE -46
+#define TOO_MANY_EXPORTED_TXN -47
+#define TOO_LITTLE_ENTROPY -48
 #define HOOK_ERROR_CODES
 #endif //HOOK_ERROR_CODES

hook/extern.h

@@ -2,6 +2,9 @@
 // Generated using generate_extern.sh
 #include <stdint.h>
 #ifndef HOOK_EXTERN
+#ifdef __cplusplus
+extern "C" {
+#endif
 
 extern int32_t __attribute__((noduplicate))
 _g(uint32_t guard_id, uint32_t maxiter);
@@ -336,5 +339,52 @@ prepare(
     uint32_t read_ptr,
     uint32_t read_len);
 
+extern int64_t
+xport_reserve(uint32_t count);
+
+extern int64_t
+xport(
+    uint32_t write_ptr,
+    uint32_t write_len,
+    uint32_t read_ptr,
+    uint32_t read_len,
+    uint32_t committee_hash_ptr,
+    uint32_t committee_hash_len);
+
+extern int64_t
+xport_cancel(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
+
+/*
+    Consensus entropy APIs.
+
+    min_tier is a required fail-closed floor:
+      1 = consensus_fallback, 2 = participant_aligned,
+      3 = validator_quorum, 4 = validator_full.
+
+    entropy_cr_status returns a packed non-negative value:
+      bits 32..39 tier, 16..31 count, 0..15 denominator.
+    Check for a negative error before using the ENTROPY_* macros.
+
+    Classify tier before count/denominator arithmetic: fallback is tier 1
+    with count=denominator=0. Common policies are denominator-count <= 1,
+    5*count >= 4*denominator (use widened arithmetic), or count >= floor.
+
+    entropy_cr_dice/entropy_cr_random return TOO_LITTLE_ENTROPY if fresh
+    visible entropy is below
+    min_tier. Open-ledger and simulate execution are provisional previews;
+    final ordered execution may see a different entropy object.
+*/
+extern int64_t
+entropy_cr_dice(uint32_t sides, uint32_t min_tier);
+
+extern int64_t
+entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
+
+extern int64_t
+entropy_cr_status(void);
+
+#ifdef __cplusplus
+}
+#endif
 #define HOOK_EXTERN
 #endif  // HOOK_EXTERN

hook/generate_error.sh

@@ -9,7 +9,7 @@ ENUM_FILE="$SCRIPT_DIR/../include/xrpl/hook/Enum.h"
 echo '// For documentation please see: https://xrpl-hooks.readme.io/reference/'
 echo '// Generated using generate_error.sh'
 echo '#ifndef HOOK_ERROR_CODES'
-sed -n '/enum hook_return_code/,/};/p' "$ENUM_FILE" |
+sed -n '/enum class hook_return_code/,/};/p' "$ENUM_FILE" |
     awk '
         function ltrim(s) { sub(/^[[:space:]]+/, "", s); return s }
         function rtrim(s) { sub(/[[:space:]]+$/, "", s); return s }
@@ -31,7 +31,7 @@ sed -n '/enum hook_return_code/,/};/p' "$ENUM_FILE" |
 
         {
             line = $0
-            if (line ~ /enum[[:space:]]+hook_return_code/)
+            if (line ~ /enum[[:space:]]+class[[:space:]]+hook_return_code/)
                 next
             if (line ~ /^[[:space:]]*\{/)
                 next

hook/generate_extern.sh

@@ -11,6 +11,9 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
     echo '// Generated using generate_extern.sh'
     echo '#include <stdint.h>'
     echo '#ifndef HOOK_EXTERN'
+    echo '#ifdef __cplusplus'
+    echo 'extern "C" {'
+    echo '#endif'
     echo
     awk '
         function trim(s) {
@@ -38,6 +41,29 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
                     # Insert __attribute__((noduplicate)) before _g
                     sub(/[[:space:]]+_g/, " __attribute__((noduplicate)) _g", line);
                 }
+
+                if (line ~ /[[:space:]]+entropy_cr_dice[[:space:]]*\(/) {
+                    print "/*";
+                    print "    Consensus entropy APIs.";
+                    print "";
+                    print "    min_tier is a required fail-closed floor:";
+                    print "      1 = consensus_fallback, 2 = participant_aligned,";
+                    print "      3 = validator_quorum, 4 = validator_full.";
+                    print "";
+                    print "    entropy_cr_status returns a packed non-negative value:";
+                    print "      bits 32..39 tier, 16..31 count, 0..15 denominator.";
+                    print "    Check for a negative error before using the ENTROPY_* macros.";
+                    print "";
+                    print "    Classify tier before count/denominator arithmetic: fallback is tier 1";
+                    print "    with count=denominator=0. Common policies are denominator-count <= 1,";
+                    print "    5*count >= 4*denominator (use widened arithmetic), or count >= floor.";
+                    print "";
+                    print "    entropy_cr_dice/entropy_cr_random return TOO_LITTLE_ENTROPY if fresh";
+                    print "    visible entropy is below";
+                    print "    min_tier. Open-ledger and simulate execution are provisional previews;";
+                    print "    final ordered execution may see a different entropy object.";
+                    print "*/";
+                }
                 
                 # printf("\n");
                 
@@ -46,6 +72,9 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
         }
     ' "$APPLY_HOOK"
 
+    echo '#ifdef __cplusplus'
+    echo '}'
+    echo '#endif'
     echo '#define HOOK_EXTERN'
     echo '#endif  // HOOK_EXTERN'
 } | (

hook/generate_lsflags.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+set -eu
+
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_DIR=$(cd "$SCRIPT_DIR" && pwd)
+
+RIPPLED_ROOT="$SCRIPT_DIR/../include/xrpl"
+LEDGER_FORMATS="$RIPPLED_ROOT/protocol/LedgerFormats.h"
+
+echo '// Generated using generate_lsflags.sh'
+echo ''
+echo '#ifndef HOOKLSFLAGS_INCLUDED'
+echo '#define HOOKLSFLAGS_INCLUDED 1'
+echo ''
+awk '
+    function ltrim(s) { sub(/^[[:space:]]+/, "", s); return s }
+    function rtrim(s) { sub(/[[:space:]]+$/, "", s); return s }
+    function trim(s) { return rtrim(ltrim(s)) }
+
+    function flush_group() {
+        if (entry_count > 0 && group != "") {
+            printf "enum %s {\n", group
+            for (i = 1; i <= entry_count; i++) {
+                printf "    %s,\n", entries[i]
+            }
+            printf "};\n"
+        }
+        delete entries
+        entry_count = 0
+    }
+
+    /enum LedgerSpecificFlags \{/ { inside = 1; next }
+    inside && /^\};/ { inside = 0; flush_group(); next }
+    !inside { next }
+
+    # Group header comments: // ltFOO or // remarks
+    /^[[:space:]]*\/\/[[:space:]]*(lt[A-Z_]+|remarks)[[:space:]]*$/ {
+        flush_group()
+        line = $0
+        sub(/.*\/\/[[:space:]]*/, "", line)
+        group = trim(line)
+        next
+    }
+
+    # Skip pure comment lines (not group headers)
+    /^[[:space:]]*\/\// { next }
+
+    # Skip blank lines
+    /^[[:space:]]*$/ { next }
+
+    # Accumulate flag lines (handle multi-line values)
+    {
+        line = $0
+        # Strip inline comments
+        sub(/\/\/.*/, "", line)
+        line = trim(line)
+        if (line == "") next
+
+        if (pending != "") {
+            pending = pending " " line
+        } else {
+            pending = line
+        }
+
+        # If line ends with comma, the entry is complete
+        if (pending ~ /,$/) {
+            # Remove trailing comma
+            sub(/,$/, "", pending)
+            entries[++entry_count] = pending
+            pending = ""
+        }
+    }
+
+    BEGIN {
+        inside = 0
+        group = ""
+        pending = ""
+        entry_count = 0
+    }
+' "$LEDGER_FORMATS"
+echo ''
+echo '#endif // HOOKLSFLAGS_INCLUDED'

hook/generate_txflags.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -eu
+
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_DIR=$(cd "$SCRIPT_DIR" && pwd)
+
+RIPPLED_ROOT="$SCRIPT_DIR/../include/xrpl"
+TX_FLAGS="$RIPPLED_ROOT/protocol/TxFlags.h"
+
+echo '// Generated using generate_txflags.sh'
+echo '#include "ls_flags.h"'
+echo '#include <stdint.h>'
+echo ''
+cat "$TX_FLAGS" |
+    awk '
+        /^[[:space:]]*enum / {
+            if (count > 0) print ""
+            inside = 1
+            count++
+        }
+        inside {
+            print
+            if (/};/) inside = 0
+        }
+    '

hook/genesis/headers/extern.h

@@ -348,5 +348,21 @@ util_verify(
     uint32_t kread_len);
 
 extern int64_t xpop_slot(uint32_t, uint32_t);
+
+extern int64_t
+xport_reserve(uint32_t count);
+
+extern int64_t
+xport(
+    uint32_t write_ptr,
+    uint32_t write_len,
+    uint32_t read_ptr,
+    uint32_t read_len,
+    uint32_t committee_hash_ptr,
+    uint32_t committee_hash_len);
+
+extern int64_t
+xport_cancel(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
+
 #define HOOK_EXTERN
-#endif  // HOOK_EXTERN
+#endif  // HOOK_EXTERN

hook/genesis/headers/hookapi.h

@@ -47,4 +47,4 @@
 #include "macro.h"
 #include "types.h"
 
-#endif
+#endif

hook/genesis/headers/macro.h

@@ -607,31 +607,37 @@ int out_len = 0;\
 #define PREPARE_PAYMENT_SIMPLE_SIZE 248U
 #endif
 
-#define PREPARE_PAYMENT_SIMPLE(buf_out_master, drops_amount_raw, to_address, dest_tag_raw, src_tag_raw)\
-    {\
-        uint8_t* buf_out = buf_out_master;\
-        uint8_t acc[20];\
-        uint64_t drops_amount = (drops_amount_raw);\
-        uint32_t dest_tag = (dest_tag_raw);\
-        uint32_t src_tag = (src_tag_raw);\
-        uint32_t cls = (uint32_t)ledger_seq();\
-        hook_account(SBUF(acc));\
-        _01_02_ENCODE_TT                   (buf_out, ttPAYMENT                      );      /* uint16  | size   3 */ \
-        _02_02_ENCODE_FLAGS                (buf_out, tfCANONICAL                    );      /* uint32  | size   5 */ \
-        _02_03_ENCODE_TAG_SRC              (buf_out, src_tag                        );      /* uint32  | size   5 */ \
-        _02_04_ENCODE_SEQUENCE             (buf_out, 0                              );      /* uint32  | size   5 */ \
-        _02_14_ENCODE_TAG_DST              (buf_out, dest_tag                       );      /* uint32  | size   5 */ \
-        _02_26_ENCODE_FLS                  (buf_out, cls + 1                        );      /* uint32  | size   6 */ \
-        _02_27_ENCODE_LLS                  (buf_out, cls + 5                        );      /* uint32  | size   6 */ \
-        _06_01_ENCODE_DROPS_AMOUNT         (buf_out, drops_amount                   );      /* amount  | size   9 */ \
-        uint8_t* fee_ptr = buf_out;\
-        _06_08_ENCODE_DROPS_FEE            (buf_out, 0                              );      /* amount  | size   9 */ \
-        _07_03_ENCODE_SIGNING_PUBKEY_NULL  (buf_out                                 );      /* pk      | size  35 */ \
-        _08_01_ENCODE_ACCOUNT_SRC          (buf_out, acc                            );      /* account | size  22 */ \
-        _08_03_ENCODE_ACCOUNT_DST          (buf_out, to_address                     );      /* account | size  22 */ \
-        int64_t edlen = etxn_details((uint32_t)buf_out, PREPARE_PAYMENT_SIMPLE_SIZE);       /* emitdet | size 1?? */ \
-        int64_t fee = etxn_fee_base(buf_out_master, PREPARE_PAYMENT_SIMPLE_SIZE);                                    \ 
-        _06_08_ENCODE_DROPS_FEE            (fee_ptr, fee                            );                               \
+#define PREPARE_PAYMENT_SIMPLE(                                              \
+    buf_out_master, drops_amount_raw, to_address, dest_tag_raw, src_tag_raw) \
+    {                                                                        \
+        uint8_t* buf_out = buf_out_master;                                   \
+        uint8_t acc[20];                                                     \
+        uint64_t drops_amount = (drops_amount_raw);                          \
+        uint32_t dest_tag = (dest_tag_raw);                                  \
+        uint32_t src_tag = (src_tag_raw);                                    \
+        uint32_t cls = (uint32_t)ledger_seq();                               \
+        hook_account(SBUF(acc));                                             \
+        _01_02_ENCODE_TT(buf_out, ttPAYMENT);      /* uint16  | size   3 */  \
+        _02_02_ENCODE_FLAGS(buf_out, tfCANONICAL); /* uint32  | size   5 */  \
+        _02_03_ENCODE_TAG_SRC(buf_out, src_tag);   /* uint32  | size   5 */  \
+        _02_04_ENCODE_SEQUENCE(buf_out, 0);        /* uint32  | size   5 */  \
+        _02_14_ENCODE_TAG_DST(buf_out, dest_tag);  /* uint32  | size   5 */  \
+        _02_26_ENCODE_FLS(buf_out, cls + 1);       /* uint32  | size   6 */  \
+        _02_27_ENCODE_LLS(buf_out, cls + 5);       /* uint32  | size   6 */  \
+        _06_01_ENCODE_DROPS_AMOUNT(                                          \
+            buf_out, drops_amount); /* amount  | size   9 */                 \
+        uint8_t* fee_ptr = buf_out;                                          \
+        _06_08_ENCODE_DROPS_FEE(buf_out, 0);        /* amount  | size   9 */ \
+        _07_03_ENCODE_SIGNING_PUBKEY_NULL(buf_out); /* pk      | size  35 */ \
+        _08_01_ENCODE_ACCOUNT_SRC(buf_out, acc);    /* account | size  22 */ \
+        _08_03_ENCODE_ACCOUNT_DST(                                           \
+            buf_out, to_address); /* account | size  22 */                   \
+        int64_t edlen = etxn_details(                                        \
+            (uint32_t)buf_out,                                               \
+            PREPARE_PAYMENT_SIMPLE_SIZE); /* emitdet | size 1?? */           \
+        int64_t fee =                                                        \
+            etxn_fee_base(buf_out_master, PREPARE_PAYMENT_SIMPLE_SIZE);      \
+        _06_08_ENCODE_DROPS_FEE(fee_ptr, fee);                               \
     }
 
 #ifdef HAS_CALLBACK
@@ -639,33 +645,35 @@ int out_len = 0;\
 #else
 #define PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE 287
 #endif
-#define PREPARE_PAYMENT_SIMPLE_TRUSTLINE(buf_out_master, tlamt, to_address, dest_tag_raw, src_tag_raw)\
-    {\
-        uint8_t* buf_out = buf_out_master;\
-        uint8_t acc[20];\
-        uint32_t dest_tag = (dest_tag_raw);\
-        uint32_t src_tag = (src_tag_raw);\
-        uint32_t cls = (uint32_t)ledger_seq();\
-        hook_account(SBUF(acc));\
-        _01_02_ENCODE_TT                   (buf_out, ttPAYMENT                      );      /* uint16  | size   3 */ \
-        _02_02_ENCODE_FLAGS                (buf_out, tfCANONICAL                    );      /* uint32  | size   5 */ \
-        _02_03_ENCODE_TAG_SRC              (buf_out, src_tag                        );      /* uint32  | size   5 */ \
-        _02_04_ENCODE_SEQUENCE             (buf_out, 0                              );      /* uint32  | size   5 */ \
-        _02_14_ENCODE_TAG_DST              (buf_out, dest_tag                       );      /* uint32  | size   5 */ \
-        _02_26_ENCODE_FLS                  (buf_out, cls + 1                        );      /* uint32  | size   6 */ \
-        _02_27_ENCODE_LLS                  (buf_out, cls + 5                        );      /* uint32  | size   6 */ \
-        _06_01_ENCODE_TL_AMOUNT            (buf_out, tlamt                          );      /* amount  | size  48 */ \
-        uint8_t* fee_ptr = buf_out;\
-        _06_08_ENCODE_DROPS_FEE            (buf_out, 0                              );      /* amount  | size   9 */ \
-        _07_03_ENCODE_SIGNING_PUBKEY_NULL  (buf_out                                 );      /* pk      | size  35 */ \
-        _08_01_ENCODE_ACCOUNT_SRC          (buf_out, acc                            );      /* account | size  22 */ \
-        _08_03_ENCODE_ACCOUNT_DST          (buf_out, to_address                     );      /* account | size  22 */ \
-        etxn_details((uint32_t)buf_out, PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE);             /* emitdet | size 1?? */  \
-        int64_t fee = etxn_fee_base(buf_out_master, PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE);                          \ 
-        _06_08_ENCODE_DROPS_FEE            (fee_ptr, fee                            );                               \
+#define PREPARE_PAYMENT_SIMPLE_TRUSTLINE(                                    \
+    buf_out_master, tlamt, to_address, dest_tag_raw, src_tag_raw)            \
+    {                                                                        \
+        uint8_t* buf_out = buf_out_master;                                   \
+        uint8_t acc[20];                                                     \
+        uint32_t dest_tag = (dest_tag_raw);                                  \
+        uint32_t src_tag = (src_tag_raw);                                    \
+        uint32_t cls = (uint32_t)ledger_seq();                               \
+        hook_account(SBUF(acc));                                             \
+        _01_02_ENCODE_TT(buf_out, ttPAYMENT);      /* uint16  | size   3 */  \
+        _02_02_ENCODE_FLAGS(buf_out, tfCANONICAL); /* uint32  | size   5 */  \
+        _02_03_ENCODE_TAG_SRC(buf_out, src_tag);   /* uint32  | size   5 */  \
+        _02_04_ENCODE_SEQUENCE(buf_out, 0);        /* uint32  | size   5 */  \
+        _02_14_ENCODE_TAG_DST(buf_out, dest_tag);  /* uint32  | size   5 */  \
+        _02_26_ENCODE_FLS(buf_out, cls + 1);       /* uint32  | size   6 */  \
+        _02_27_ENCODE_LLS(buf_out, cls + 5);       /* uint32  | size   6 */  \
+        _06_01_ENCODE_TL_AMOUNT(buf_out, tlamt);   /* amount  | size  48 */  \
+        uint8_t* fee_ptr = buf_out;                                          \
+        _06_08_ENCODE_DROPS_FEE(buf_out, 0);        /* amount  | size   9 */ \
+        _07_03_ENCODE_SIGNING_PUBKEY_NULL(buf_out); /* pk      | size  35 */ \
+        _08_01_ENCODE_ACCOUNT_SRC(buf_out, acc);    /* account | size  22 */ \
+        _08_03_ENCODE_ACCOUNT_DST(                                           \
+            buf_out, to_address); /* account | size  22 */                   \
+        etxn_details(                                                        \
+            (uint32_t)buf_out,                                               \
+            PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE); /* emitdet | size 1?? */ \
+        int64_t fee = etxn_fee_base(                                         \
+            buf_out_master, PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE);          \
+        _06_08_ENCODE_DROPS_FEE(fee_ptr, fee);                               \
     }
 
-
-
 #endif
-

hook/genesis/headers/sfcodes.h

@@ -3,18 +3,31 @@
 #define sfCloseResolution ((16U << 16U) + 1U)
 #define sfMethod ((16U << 16U) + 2U)
 #define sfTransactionResult ((16U << 16U) + 3U)
+#define sfScale ((16U << 16U) + 4U)
+#define sfAssetScale ((16U << 16U) + 5U)
 #define sfTickSize ((16U << 16U) + 16U)
 #define sfUNLModifyDisabling ((16U << 16U) + 17U)
 #define sfHookResult ((16U << 16U) + 18U)
+#define sfWasLockingChainSend ((16U << 16U) + 19U)
+#define sfSidecarType ((16U << 16U) + 20U)
+#define sfEntropyTier ((16U << 16U) + 21U)
 #define sfLedgerEntryType ((1U << 16U) + 1U)
 #define sfTransactionType ((1U << 16U) + 2U)
 #define sfSignerWeight ((1U << 16U) + 3U)
 #define sfTransferFee ((1U << 16U) + 4U)
+#define sfTradingFee ((1U << 16U) + 5U)
+#define sfDiscountedFee ((1U << 16U) + 6U)
 #define sfVersion ((1U << 16U) + 16U)
 #define sfHookStateChangeCount ((1U << 16U) + 17U)
 #define sfHookEmitCount ((1U << 16U) + 18U)
 #define sfHookExecutionIndex ((1U << 16U) + 19U)
 #define sfHookApiVersion ((1U << 16U) + 20U)
+#define sfHookStateScale ((1U << 16U) + 21U)
+#define sfLedgerFixType ((1U << 16U) + 22U)
+#define sfHookExportCount ((1U << 16U) + 98U)
+#define sfEntropyCount ((1U << 16U) + 99U)
+#define sfEntropyDenominator ((1U << 16U) + 100U)
+#define sfExportCount ((1U << 16U) + 101U)
 #define sfNetworkID ((2U << 16U) + 1U)
 #define sfFlags ((2U << 16U) + 2U)
 #define sfSourceTag ((2U << 16U) + 3U)
@@ -29,6 +42,7 @@
 #define sfWalletSize ((2U << 16U) + 12U)
 #define sfOwnerCount ((2U << 16U) + 13U)
 #define sfDestinationTag ((2U << 16U) + 14U)
+#define sfLastUpdateTime ((2U << 16U) + 15U)
 #define sfHighQualityIn ((2U << 16U) + 16U)
 #define sfHighQualityOut ((2U << 16U) + 17U)
 #define sfLowQualityIn ((2U << 16U) + 18U)
@@ -60,7 +74,15 @@
 #define sfBurnedNFTokens ((2U << 16U) + 44U)
 #define sfHookStateCount ((2U << 16U) + 45U)
 #define sfEmitGeneration ((2U << 16U) + 46U)
-#define sfLockCount ((2U << 16U) + 47U)
+#define sfVoteWeight ((2U << 16U) + 48U)
+#define sfLockCount ((2U << 16U) + 49U)
+#define sfFirstNFTokenSequence ((2U << 16U) + 50U)
+#define sfOracleDocumentID ((2U << 16U) + 51U)
+#define sfStartTime ((2U << 16U) + 93U)
+#define sfRepeatCount ((2U << 16U) + 94U)
+#define sfDelaySeconds ((2U << 16U) + 95U)
+#define sfXahauActivationLgrSeq ((2U << 16U) + 96U)
+#define sfImportSequence ((2U << 16U) + 97U)
 #define sfRewardTime ((2U << 16U) + 98U)
 #define sfRewardLgrFirst ((2U << 16U) + 99U)
 #define sfRewardLgrLast ((2U << 16U) + 100U)
@@ -80,12 +102,26 @@
 #define sfHookInstructionCount ((3U << 16U) + 17U)
 #define sfHookReturnCode ((3U << 16U) + 18U)
 #define sfReferenceCount ((3U << 16U) + 19U)
+#define sfXChainClaimID ((3U << 16U) + 20U)
+#define sfXChainAccountCreateCount ((3U << 16U) + 21U)
+#define sfXChainAccountClaimCount ((3U << 16U) + 22U)
+#define sfAssetPrice ((3U << 16U) + 23U)
+#define sfMaximumAmount ((3U << 16U) + 24U)
+#define sfOutstandingAmount ((3U << 16U) + 25U)
+#define sfMPTAmount ((3U << 16U) + 26U)
+#define sfIssuerNode ((3U << 16U) + 27U)
+#define sfSubjectNode ((3U << 16U) + 28U)
+#define sfExportNode ((3U << 16U) + 29U)
+#define sfTouchCount ((3U << 16U) + 97U)
+#define sfAccountIndex ((3U << 16U) + 98U)
+#define sfAccountCount ((3U << 16U) + 99U)
 #define sfRewardAccumulator ((3U << 16U) + 100U)
 #define sfEmailHash ((4U << 16U) + 1U)
-#define sfTakerPaysCurrency ((10U << 16U) + 1U)
-#define sfTakerPaysIssuer ((10U << 16U) + 2U)
-#define sfTakerGetsCurrency ((10U << 16U) + 3U)
-#define sfTakerGetsIssuer ((10U << 16U) + 4U)
+#define sfTakerPaysCurrency ((17U << 16U) + 1U)
+#define sfTakerPaysIssuer ((17U << 16U) + 2U)
+#define sfTakerGetsCurrency ((17U << 16U) + 3U)
+#define sfTakerGetsIssuer ((17U << 16U) + 4U)
+#define sfMPTokenIssuanceID ((21U << 16U) + 1U)
 #define sfLedgerHash ((5U << 16U) + 1U)
 #define sfParentHash ((5U << 16U) + 2U)
 #define sfTransactionHash ((5U << 16U) + 3U)
@@ -99,6 +135,8 @@
 #define sfEmitParentTxnID ((5U << 16U) + 11U)
 #define sfEmitNonce ((5U << 16U) + 12U)
 #define sfEmitHookHash ((5U << 16U) + 13U)
+#define sfObjectID ((5U << 16U) + 14U)
+#define sfAMMID ((5U << 16U) + 15U)
 #define sfBookDirectory ((5U << 16U) + 16U)
 #define sfInvoiceID ((5U << 16U) + 17U)
 #define sfNickname ((5U << 16U) + 18U)
@@ -120,6 +158,17 @@
 #define sfOfferID ((5U << 16U) + 34U)
 #define sfEscrowID ((5U << 16U) + 35U)
 #define sfURITokenID ((5U << 16U) + 36U)
+#define sfDomainID ((5U << 16U) + 37U)
+#define sfExportSignatureHash ((5U << 16U) + 38U)
+#define sfExportCommitteeHash ((5U << 16U) + 39U)
+#define sfHookOnOutgoing ((5U << 16U) + 93U)
+#define sfHookOnIncoming ((5U << 16U) + 94U)
+#define sfCron ((5U << 16U) + 95U)
+#define sfHookCanEmit ((5U << 16U) + 96U)
+#define sfEmittedTxnID ((5U << 16U) + 97U)
+#define sfGovernanceMarks ((5U << 16U) + 98U)
+#define sfGovernanceFlags ((5U << 16U) + 99U)
+#define sfNumber ((9U << 16U) + 1U)
 #define sfAmount ((6U << 16U) + 1U)
 #define sfBalance ((6U << 16U) + 2U)
 #define sfLimitAmount ((6U << 16U) + 3U)
@@ -130,12 +179,26 @@
 #define sfFee ((6U << 16U) + 8U)
 #define sfSendMax ((6U << 16U) + 9U)
 #define sfDeliverMin ((6U << 16U) + 10U)
+#define sfAmount2 ((6U << 16U) + 11U)
+#define sfBidMin ((6U << 16U) + 12U)
+#define sfBidMax ((6U << 16U) + 13U)
 #define sfMinimumOffer ((6U << 16U) + 16U)
 #define sfRippleEscrow ((6U << 16U) + 17U)
 #define sfDeliveredAmount ((6U << 16U) + 18U)
 #define sfNFTokenBrokerFee ((6U << 16U) + 19U)
 #define sfHookCallbackFee ((6U << 16U) + 20U)
 #define sfLockedBalance ((6U << 16U) + 21U)
+#define sfBaseFeeDrops ((6U << 16U) + 22U)
+#define sfReserveBaseDrops ((6U << 16U) + 23U)
+#define sfReserveIncrementDrops ((6U << 16U) + 24U)
+#define sfLPTokenOut ((6U << 16U) + 25U)
+#define sfLPTokenIn ((6U << 16U) + 26U)
+#define sfEPrice ((6U << 16U) + 27U)
+#define sfPrice ((6U << 16U) + 28U)
+#define sfSignatureReward ((6U << 16U) + 29U)
+#define sfMinAccountCreateAmount ((6U << 16U) + 30U)
+#define sfLPTokenBalance ((6U << 16U) + 31U)
+#define sfTrustLineRewardAccumulator ((6U << 16U) + 99U)
 #define sfPublicKey ((7U << 16U) + 1U)
 #define sfMessageKey ((7U << 16U) + 2U)
 #define sfSigningPubKey ((7U << 16U) + 3U)
@@ -161,6 +224,18 @@
 #define sfHookParameterName ((7U << 16U) + 24U)
 #define sfHookParameterValue ((7U << 16U) + 25U)
 #define sfBlob ((7U << 16U) + 26U)
+#define sfDIDDocument ((7U << 16U) + 27U)
+#define sfData ((7U << 16U) + 28U)
+#define sfAssetClass ((7U << 16U) + 29U)
+#define sfProvider ((7U << 16U) + 30U)
+#define sfMPTokenMetadata ((7U << 16U) + 31U)
+#define sfCredentialType ((7U << 16U) + 32U)
+#define sfEntropyContributors ((7U << 16U) + 33U)
+#define sfExportCommittee ((7U << 16U) + 34U)
+#define sfExportContributors ((7U << 16U) + 35U)
+#define sfHookName ((7U << 16U) + 97U)
+#define sfRemarkValue ((7U << 16U) + 98U)
+#define sfRemarkName ((7U << 16U) + 99U)
 #define sfAccount ((8U << 16U) + 1U)
 #define sfOwner ((8U << 16U) + 2U)
 #define sfDestination ((8U << 16U) + 3U)
@@ -170,13 +245,32 @@
 #define sfRegularKey ((8U << 16U) + 8U)
 #define sfNFTokenMinter ((8U << 16U) + 9U)
 #define sfEmitCallback ((8U << 16U) + 10U)
+#define sfHolder ((8U << 16U) + 11U)
 #define sfHookAccount ((8U << 16U) + 16U)
+#define sfOtherChainSource ((8U << 16U) + 18U)
+#define sfOtherChainDestination ((8U << 16U) + 19U)
+#define sfAttestationSignerAccount ((8U << 16U) + 20U)
+#define sfAttestationRewardAccount ((8U << 16U) + 21U)
+#define sfLockingChainDoor ((8U << 16U) + 22U)
+#define sfIssuingChainDoor ((8U << 16U) + 23U)
+#define sfSubject ((8U << 16U) + 24U)
+#define sfInform ((8U << 16U) + 99U)
 #define sfIndexes ((19U << 16U) + 1U)
 #define sfHashes ((19U << 16U) + 2U)
 #define sfAmendments ((19U << 16U) + 3U)
 #define sfNFTokenOffers ((19U << 16U) + 4U)
 #define sfHookNamespaces ((19U << 16U) + 5U)
+#define sfCredentialIDs ((19U << 16U) + 6U)
+#define sfURITokenIDs ((19U << 16U) + 99U)
 #define sfPaths ((18U << 16U) + 1U)
+#define sfBaseAsset ((26U << 16U) + 1U)
+#define sfQuoteAsset ((26U << 16U) + 2U)
+#define sfLockingChainIssue ((24U << 16U) + 1U)
+#define sfIssuingChainIssue ((24U << 16U) + 2U)
+#define sfAsset ((24U << 16U) + 3U)
+#define sfAsset2 ((24U << 16U) + 4U)
+#define sfClaimCurrency ((24U << 16U) + 5U)
+#define sfXChainBridge ((25U << 16U) + 1U)
 #define sfTransactionMetaData ((14U << 16U) + 2U)
 #define sfCreatedNode ((14U << 16U) + 3U)
 #define sfDeletedNode ((14U << 16U) + 4U)
@@ -191,13 +285,32 @@
 #define sfEmitDetails ((14U << 16U) + 13U)
 #define sfHook ((14U << 16U) + 14U)
 #define sfSigner ((14U << 16U) + 16U)
+#define sfExportSigner ((14U << 16U) + 17U)
 #define sfMajority ((14U << 16U) + 18U)
 #define sfDisabledValidator ((14U << 16U) + 19U)
 #define sfEmittedTxn ((14U << 16U) + 20U)
 #define sfHookExecution ((14U << 16U) + 21U)
-#define sfHookDefinition ((14U << 16U) + 22U)
 #define sfHookParameter ((14U << 16U) + 23U)
 #define sfHookGrant ((14U << 16U) + 24U)
+#define sfVoteEntry ((14U << 16U) + 25U)
+#define sfAuctionSlot ((14U << 16U) + 26U)
+#define sfAuthAccount ((14U << 16U) + 27U)
+#define sfXChainClaimProofSig ((14U << 16U) + 28U)
+#define sfXChainCreateAccountProofSig ((14U << 16U) + 29U)
+#define sfXChainClaimAttestationCollectionElement ((14U << 16U) + 30U)
+#define sfXChainCreateAccountAttestationCollectionElement ((14U << 16U) + 31U)
+#define sfPriceData ((14U << 16U) + 32U)
+#define sfCredential ((14U << 16U) + 33U)
+#define sfExportedTxn ((14U << 16U) + 90U)
+#define sfAmountEntry ((14U << 16U) + 91U)
+#define sfMintURIToken ((14U << 16U) + 92U)
+#define sfHookEmission ((14U << 16U) + 93U)
+#define sfImportVLKey ((14U << 16U) + 94U)
+#define sfActiveValidator ((14U << 16U) + 95U)
+#define sfGenesisMint ((14U << 16U) + 96U)
+#define sfRemark ((14U << 16U) + 97U)
+#define sfHighReward ((14U << 16U) + 98U)
+#define sfLowReward ((14U << 16U) + 99U)
 #define sfSigners ((15U << 16U) + 3U)
 #define sfSignerEntries ((15U << 16U) + 4U)
 #define sfTemplate ((15U << 16U) + 5U)
@@ -207,9 +320,23 @@
 #define sfMemos ((15U << 16U) + 9U)
 #define sfNFTokens ((15U << 16U) + 10U)
 #define sfHooks ((15U << 16U) + 11U)
+#define sfVoteSlots ((15U << 16U) + 12U)
 #define sfMajorities ((15U << 16U) + 16U)
 #define sfDisabledValidators ((15U << 16U) + 17U)
 #define sfHookExecutions ((15U << 16U) + 18U)
 #define sfHookParameters ((15U << 16U) + 19U)
 #define sfHookGrants ((15U << 16U) + 20U)
-#define sfActiveValidators ((15U << 16U) + 95U)
+#define sfXChainClaimAttestations ((15U << 16U) + 21U)
+#define sfXChainCreateAccountAttestations ((15U << 16U) + 22U)
+#define sfExportSigners ((15U << 16U) + 23U)
+#define sfPriceDataSeries ((15U << 16U) + 24U)
+#define sfAuthAccounts ((15U << 16U) + 25U)
+#define sfAuthorizeCredentials ((15U << 16U) + 26U)
+#define sfUnauthorizeCredentials ((15U << 16U) + 27U)
+#define sfAcceptedCredentials ((15U << 16U) + 28U)
+#define sfAmounts ((15U << 16U) + 92U)
+#define sfHookEmissions ((15U << 16U) + 93U)
+#define sfImportVLKeys ((15U << 16U) + 94U)
+#define sfActiveValidators ((15U << 16U) + 95U)
+#define sfGenesisMints ((15U << 16U) + 96U)
+#define sfRemarks ((15U << 16U) + 97U)

hook/hookapi.h

@@ -49,4 +49,7 @@
 #include "macro.h"
 #include "tts.h"
 
+#include "ls_flags.h"
+#include "tx_flags.h"
+
 #endif

hook/ls_flags.h

@@ -0,0 +1,79 @@
+// Generated using generate_lsflags.sh
+
+#ifndef HOOKLSFLAGS_INCLUDED
+#define HOOKLSFLAGS_INCLUDED 1
+
+enum ltACCOUNT_ROOT {
+    lsfPasswordSpent = 0x00010000,
+    lsfRequireDestTag = 0x00020000,
+    lsfRequireAuth = 0x00040000,
+    lsfDisallowXRP = 0x00080000,
+    lsfDisableMaster = 0x00100000,
+    lsfNoFreeze = 0x00200000,
+    lsfGlobalFreeze = 0x00400000,
+    lsfDefaultRipple = 0x00800000,
+    lsfDepositAuth = 0x01000000,
+    lsfTshCollect = 0x02000000,
+    lsfDisallowIncomingNFTokenOffer = 0x04000000,
+    lsfDisallowIncomingCheck = 0x08000000,
+    lsfDisallowIncomingPayChan = 0x10000000,
+    lsfDisallowIncomingTrustline = 0x20000000,
+    lsfURITokenIssuer = 0x40000000,
+    lsfDisallowIncomingRemit = 0x80000000,
+    lsfAllowTrustLineClawback = 0x00001000,
+};
+enum ltOFFER {
+    lsfPassive = 0x00010000,
+    lsfSell = 0x00020000,
+};
+enum ltRIPPLE_STATE {
+    lsfLowReserve = 0x00010000,
+    lsfHighReserve = 0x00020000,
+    lsfLowAuth = 0x00040000,
+    lsfHighAuth = 0x00080000,
+    lsfLowNoRipple = 0x00100000,
+    lsfHighNoRipple = 0x00200000,
+    lsfLowFreeze = 0x00400000,
+    lsfHighFreeze = 0x00800000,
+    lsfLowDeepFreeze = 0x02000000,
+    lsfHighDeepFreeze = 0x04000000,
+    lsfAMMNode = 0x01000000,
+};
+enum ltSIGNER_LIST {
+    lsfOneOwnerCount = 0x00010000,
+};
+enum ltDIR_NODE {
+    lsfNFTokenBuyOffers = 0x00000001,
+    lsfNFTokenSellOffers = 0x00000002,
+    lsfEmittedDir = 0x00000004,
+};
+enum ltNFTOKEN_OFFER {
+    lsfSellNFToken = 0x00000001,
+};
+enum ltURI_TOKEN {
+    lsfBurnable = 0x00000001,
+};
+enum remarks {
+    lsfImmutable = 1,
+};
+enum ltEXPORT_LATCH {
+    lsfExportXpopSeen = 0x00000001,
+    lsfExportCanceled = 0x00000002,
+};
+enum ltMPTOKEN_ISSUANCE {
+    lsfMPTLocked = 0x00000001,
+    lsfMPTCanLock = 0x00000002,
+    lsfMPTRequireAuth = 0x00000004,
+    lsfMPTCanEscrow = 0x00000008,
+    lsfMPTCanTrade = 0x00000010,
+    lsfMPTCanTransfer = 0x00000020,
+    lsfMPTCanClawback = 0x00000040,
+};
+enum ltMPTOKEN {
+    lsfMPTAuthorized = 0x00000002,
+};
+enum ltCREDENTIAL {
+    lsfAccepted = 0x00010000,
+};
+
+#endif // HOOKLSFLAGS_INCLUDED

hook/macro.h

@@ -145,6 +145,10 @@ int out_len = 0;\
 #define SUB_OFFSET(x) ((int32_t)(x >> 32))
 #define SUB_LENGTH(x) ((int32_t)(x & 0xFFFFFFFFULL))
 
+#define ENTROPY_TIER(x) (((uint64_t)(x) >> 32U) & 0xFFU)
+#define ENTROPY_COUNT(x) (((uint64_t)(x) >> 16U) & 0xFFFFU)
+#define ENTROPY_DENOMINATOR(x) ((uint64_t)(x) & 0xFFFFU)
+
 #define BUFFER_EQUAL_20(buf1, buf2)\
     (\
         *(((uint64_t*)(buf1)) + 0) == *(((uint64_t*)(buf2)) + 0) &&\
@@ -378,4 +382,3 @@ int out_len = 0;\
 
 #endif
 
-

hook/sfcodes.h

@@ -9,6 +9,8 @@
 #define sfUNLModifyDisabling ((16U << 16U) + 17U)
 #define sfHookResult ((16U << 16U) + 18U)
 #define sfWasLockingChainSend ((16U << 16U) + 19U)
+#define sfSidecarType ((16U << 16U) + 20U)
+#define sfEntropyTier ((16U << 16U) + 21U)
 #define sfLedgerEntryType ((1U << 16U) + 1U)
 #define sfTransactionType ((1U << 16U) + 2U)
 #define sfSignerWeight ((1U << 16U) + 3U)
@@ -22,6 +24,10 @@
 #define sfHookApiVersion ((1U << 16U) + 20U)
 #define sfHookStateScale ((1U << 16U) + 21U)
 #define sfLedgerFixType ((1U << 16U) + 22U)
+#define sfHookExportCount ((1U << 16U) + 98U)
+#define sfEntropyCount ((1U << 16U) + 99U)
+#define sfEntropyDenominator ((1U << 16U) + 100U)
+#define sfExportCount ((1U << 16U) + 101U)
 #define sfNetworkID ((2U << 16U) + 1U)
 #define sfFlags ((2U << 16U) + 2U)
 #define sfSourceTag ((2U << 16U) + 3U)
@@ -105,6 +111,7 @@
 #define sfMPTAmount ((3U << 16U) + 26U)
 #define sfIssuerNode ((3U << 16U) + 27U)
 #define sfSubjectNode ((3U << 16U) + 28U)
+#define sfExportNode ((3U << 16U) + 29U)
 #define sfTouchCount ((3U << 16U) + 97U)
 #define sfAccountIndex ((3U << 16U) + 98U)
 #define sfAccountCount ((3U << 16U) + 99U)
@@ -152,6 +159,9 @@
 #define sfEscrowID ((5U << 16U) + 35U)
 #define sfURITokenID ((5U << 16U) + 36U)
 #define sfDomainID ((5U << 16U) + 37U)
+#define sfExportSignatureHash ((5U << 16U) + 38U)
+#define sfExportCommitteeHash ((5U << 16U) + 39U)
+#define sfManifestID ((5U << 16U) + 91U)
 #define sfHookOnOutgoing ((5U << 16U) + 93U)
 #define sfHookOnIncoming ((5U << 16U) + 94U)
 #define sfCron ((5U << 16U) + 95U)
@@ -189,6 +199,7 @@
 #define sfSignatureReward ((6U << 16U) + 29U)
 #define sfMinAccountCreateAmount ((6U << 16U) + 30U)
 #define sfLPTokenBalance ((6U << 16U) + 31U)
+#define sfTrustLineRewardAccumulator ((6U << 16U) + 99U)
 #define sfPublicKey ((7U << 16U) + 1U)
 #define sfMessageKey ((7U << 16U) + 2U)
 #define sfSigningPubKey ((7U << 16U) + 3U)
@@ -220,6 +231,10 @@
 #define sfProvider ((7U << 16U) + 30U)
 #define sfMPTokenMetadata ((7U << 16U) + 31U)
 #define sfCredentialType ((7U << 16U) + 32U)
+#define sfEntropyContributors ((7U << 16U) + 33U)
+#define sfExportCommittee ((7U << 16U) + 34U)
+#define sfExportContributors ((7U << 16U) + 35U)
+#define sfHookName ((7U << 16U) + 97U)
 #define sfRemarkValue ((7U << 16U) + 98U)
 #define sfRemarkName ((7U << 16U) + 99U)
 #define sfAccount ((8U << 16U) + 1U)
@@ -255,6 +270,7 @@
 #define sfIssuingChainIssue ((24U << 16U) + 2U)
 #define sfAsset ((24U << 16U) + 3U)
 #define sfAsset2 ((24U << 16U) + 4U)
+#define sfClaimCurrency ((24U << 16U) + 5U)
 #define sfXChainBridge ((25U << 16U) + 1U)
 #define sfTransactionMetaData ((14U << 16U) + 2U)
 #define sfCreatedNode ((14U << 16U) + 3U)
@@ -270,11 +286,11 @@
 #define sfEmitDetails ((14U << 16U) + 13U)
 #define sfHook ((14U << 16U) + 14U)
 #define sfSigner ((14U << 16U) + 16U)
+#define sfExportSigner ((14U << 16U) + 17U)
 #define sfMajority ((14U << 16U) + 18U)
 #define sfDisabledValidator ((14U << 16U) + 19U)
 #define sfEmittedTxn ((14U << 16U) + 20U)
 #define sfHookExecution ((14U << 16U) + 21U)
-#define sfHookDefinition ((14U << 16U) + 22U)
 #define sfHookParameter ((14U << 16U) + 23U)
 #define sfHookGrant ((14U << 16U) + 24U)
 #define sfVoteEntry ((14U << 16U) + 25U)
@@ -286,6 +302,8 @@
 #define sfXChainCreateAccountAttestationCollectionElement ((14U << 16U) + 31U)
 #define sfPriceData ((14U << 16U) + 32U)
 #define sfCredential ((14U << 16U) + 33U)
+#define sfExportedTxn ((14U << 16U) + 89U)
+#define sfManifest ((14U << 16U) + 90U)
 #define sfAmountEntry ((14U << 16U) + 91U)
 #define sfMintURIToken ((14U << 16U) + 92U)
 #define sfHookEmission ((14U << 16U) + 93U)
@@ -293,6 +311,8 @@
 #define sfActiveValidator ((14U << 16U) + 95U)
 #define sfGenesisMint ((14U << 16U) + 96U)
 #define sfRemark ((14U << 16U) + 97U)
+#define sfHighReward ((14U << 16U) + 98U)
+#define sfLowReward ((14U << 16U) + 99U)
 #define sfSigners ((15U << 16U) + 3U)
 #define sfSignerEntries ((15U << 16U) + 4U)
 #define sfTemplate ((15U << 16U) + 5U)
@@ -310,6 +330,7 @@
 #define sfHookGrants ((15U << 16U) + 20U)
 #define sfXChainClaimAttestations ((15U << 16U) + 21U)
 #define sfXChainCreateAccountAttestations ((15U << 16U) + 22U)
+#define sfExportSigners ((15U << 16U) + 23U)
 #define sfPriceDataSeries ((15U << 16U) + 24U)
 #define sfAuthAccounts ((15U << 16U) + 25U)
 #define sfAuthorizeCredentials ((15U << 16U) + 26U)

hook/tts.h

@@ -61,6 +61,8 @@
 #define ttNFTOKEN_MODIFY 70
 #define ttPERMISSIONED_DOMAIN_SET 71
 #define ttPERMISSIONED_DOMAIN_DELETE 72
+#define ttEXPORT 90
+#define ttMANIFEST_SET 91
 #define ttCRON 92
 #define ttCRON_SET 93
 #define ttREMARKS_SET 94
@@ -74,3 +76,5 @@
 #define ttUNL_MODIFY 102
 #define ttEMIT_FAILURE 103
 #define ttUNL_REPORT 104
+#define ttCONSENSUS_ENTROPY 105
+#define ttEXPORT_SIGNATURES 106

hook/tx_flags.h

@@ -0,0 +1,124 @@
+// Generated using generate_txflags.sh
+#include "ls_flags.h"
+#include <stdint.h>
+
+enum UniversalFlags : uint32_t {
+    tfFullyCanonicalSig = 0x80000000,
+};
+
+enum AccountSetFlags : uint32_t {
+    tfRequireDestTag = 0x00010000,
+    tfOptionalDestTag = 0x00020000,
+    tfRequireAuth = 0x00040000,
+    tfOptionalAuth = 0x00080000,
+    tfDisallowXRP = 0x00100000,
+    tfAllowXRP = 0x00200000,
+};
+
+enum AccountFlags : uint32_t {
+    asfRequireDest = 1,
+    asfRequireAuth = 2,
+    asfDisallowXRP = 3,
+    asfDisableMaster = 4,
+    asfAccountTxnID = 5,
+    asfNoFreeze = 6,
+    asfGlobalFreeze = 7,
+    asfDefaultRipple = 8,
+    asfDepositAuth = 9,
+    asfAuthorizedNFTokenMinter = 10,
+    asfTshCollect = 11,
+    asfDisallowIncomingNFTokenOffer = 12,
+    asfDisallowIncomingCheck = 13,
+    asfDisallowIncomingPayChan = 14,
+    asfDisallowIncomingTrustline = 15,
+    asfDisallowIncomingRemit = 16,
+    asfAllowTrustLineClawback = 17,
+};
+
+enum OfferCreateFlags : uint32_t {
+    tfPassive = 0x00010000,
+    tfImmediateOrCancel = 0x00020000,
+    tfFillOrKill = 0x00040000,
+    tfSell = 0x00080000,
+};
+
+enum PaymentFlags : uint32_t {
+    tfNoRippleDirect = 0x00010000,
+    tfPartialPayment = 0x00020000,
+    tfLimitQuality = 0x00040000,
+};
+
+enum TrustSetFlags : uint32_t {
+    tfSetfAuth = 0x00010000,
+    tfSetNoRipple = 0x00020000,
+    tfClearNoRipple = 0x00040000,
+    tfSetFreeze = 0x00100000,
+    tfClearFreeze = 0x00200000,
+    tfSetDeepFreeze = 0x00400000,
+    tfClearDeepFreeze = 0x00800000
+};
+
+enum EnableAmendmentFlags : uint32_t {
+    tfGotMajority = 0x00010000,
+    tfLostMajority = 0x00020000,
+    tfTestSuite = 0x80000000,
+};
+
+enum PaymentChannelClaimFlags : uint32_t {
+    tfRenew = 0x00010000,
+    tfClose = 0x00020000,
+};
+
+enum NFTokenMintFlags : uint32_t {
+    tfBurnable = 0x00000001,
+    tfOnlyXRP = 0x00000002,
+    tfTrustLine = 0x00000004,
+    tfTransferable = 0x00000008,
+    tfMutable = 0x00000010,
+    tfStrongTSH = 0x00008000,
+};
+
+enum MPTokenIssuanceCreateFlags : uint32_t {
+    tfMPTCanLock = lsfMPTCanLock,
+    tfMPTRequireAuth = lsfMPTRequireAuth,
+    tfMPTCanEscrow = lsfMPTCanEscrow,
+    tfMPTCanTrade = lsfMPTCanTrade,
+    tfMPTCanTransfer = lsfMPTCanTransfer,
+    tfMPTCanClawback = lsfMPTCanClawback,
+};
+
+enum MPTokenAuthorizeFlags : uint32_t {
+    tfMPTUnauthorize = 0x00000001,
+};
+
+enum MPTokenIssuanceSetFlags : uint32_t {
+    tfMPTLock = 0x00000001,
+    tfMPTUnlock = 0x00000002,
+};
+
+enum NFTokenCreateOfferFlags : uint32_t {
+    tfSellNFToken = 0x00000001,
+};
+
+enum ClaimRewardFlags : uint32_t {
+    tfOptOut = 0x00000001,
+};
+
+enum CronSetFlags : uint32_t {
+    tfCronUnset = 0x00000001,
+};
+
+enum AMMClawbackFlags : uint32_t {
+    tfClawTwoAssets = 0x00000001,
+};
+
+enum BridgeModifyFlags : uint32_t {
+    tfClearAccountCreateAmount = 0x00010000,
+};
+
+enum ExportFlags : uint32_t {
+    // Lifecycle control: erase the named latch and forfeit any later callback.
+    tfExportEraseLatch = 0x00010000,
+    // Committee control: erase the named immutable committee object.
+    tfExportEraseCommittee = 0x00020000,
+};

include/xrpl/hook/Enum.h

@@ -15,7 +15,10 @@
 #define uint256 std::string
 #define featureHooksUpdate1 "1"
 #define featureHooksUpdate2 "1"
+#define featureExport "1"
+#define featureConsensusEntropy "1"
 #define fix20250131 "1"
+#define fixGuardDepth32 "1"
 namespace hook_api {
 struct Rules
 {
@@ -319,7 +322,7 @@ namespace compare_mode {
 enum compare_mode : uint32_t { EQUAL = 1, LESS = 2, GREATER = 4 };
 }
 
-enum hook_return_code : int64_t {
+enum class hook_return_code : int64_t {
     SUCCESS =
         0,  // return codes > 0 are reserved for hook apis to return "success"
     OUT_OF_BOUNDS =
@@ -381,12 +384,15 @@ enum hook_return_code : int64_t {
     INVALID_KEY = -41,   // user supplied key was not valid
     NOT_A_STRING = -42,  // nul terminator missing from a string argument
     MEM_OVERLAP = -43,   // one or more specified buffers are the same memory
-    TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 5000 modified state
+    TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 256 modified state
                                          // entires in the combined hook chains
-    TOO_MANY_NAMESPACES = -45
+    TOO_MANY_NAMESPACES = -45,
+    EXPORT_FAILURE = -46,
+    TOO_MANY_EXPORTED_TXN = -47,
+    TOO_LITTLE_ENTROPY = -48,
 };
 
-enum ExitType : uint8_t {
+enum class ExitType : uint8_t {
     UNSET = 0,
     WASM_ERROR = 1,
     ROLLBACK = 2,
@@ -397,6 +403,7 @@ const uint16_t max_state_modifications = 256;
 const uint8_t max_slots = 255;
 const uint8_t max_nonce = 255;
 const uint8_t max_emit = 255;
+const uint8_t max_export = 2;
 const uint8_t max_params = 16;
 const double fee_base_multiplier = 1.1f;
 
@@ -437,12 +444,9 @@ getImportWhitelist(Rules const& rules)
     return whitelist;
 }
 
-#undef HOOK_API_DEFINITION
-#undef I32
-#undef I64
-
 enum GuardRulesVersion : uint64_t {
     GuardRuleFix20250131 = 0x00000001,
+    GuardRuleDepth32 = 0x00000002,
 };
 
 inline uint64_t
@@ -451,6 +455,8 @@ getGuardRulesVersion(Rules const& rules)
     uint64_t version = 0;
     if (rules.enabled(fix20250131))
         version |= GuardRuleFix20250131;
+    if (rules.enabled(fixGuardDepth32))
+        version |= GuardRuleDepth32;
     return version;
 }
 

include/xrpl/hook/Guard.h

@@ -204,9 +204,13 @@ struct WasmBlkInf
     }
 // compute worst case execution time
 inline uint64_t
-compute_wce(const WasmBlkInf* blk, int level, bool* recursion_limit_reached)
+compute_wce(
+    const WasmBlkInf* blk,
+    int level,
+    int max_level,
+    bool* recursion_limit_reached)
 {
-    if (level > 16)
+    if (level > max_level)
     {
         *recursion_limit_reached = true;
         return 0;
@@ -233,8 +237,8 @@ compute_wce(const WasmBlkInf* blk, int level, bool* recursion_limit_reached)
 
     if (blk->children.size() > 0)
         for (auto const& child : blk->children)
-            worst_case_execution +=
-                compute_wce(child, level + 1, recursion_limit_reached);
+            worst_case_execution += compute_wce(
+                child, level + 1, max_level, recursion_limit_reached);
 
     if (parent == 0 ||
         parent->iteration_bound ==
@@ -788,12 +792,17 @@ check_guard(
     }
 
     bool recursion_limit_reached = false;
-    uint64_t wce = compute_wce(&(*root), 0, &recursion_limit_reached);
+    int max_level = 16;
+    if (rulesVersion & hook_api::GuardRuleDepth32)
+        max_level = 32;
+    uint64_t wce =
+        compute_wce(&(*root), 0, max_level, &recursion_limit_reached);
     if (recursion_limit_reached)
     {
         GUARDLOG(hook::log::NESTING_LIMIT)
             << "GuardCheck "
-            << "Maximum allowable depth of blocks reached (16 levels). Flatten "
+            << "Maximum allowable depth of blocks reached (" << max_level
+            << " levels). Flatten "
                "your loops and conditions!.\n";
         return {};
     }

include/xrpl/hook/Macro.h

@@ -89,58 +89,69 @@
 
 #define WASM_VAL_TYPE(T, b) CAT2(TYP_, T)
 
-#define DECLARE_HOOK_FUNCTION(R, F, ...)                         \
-    R F(hook::HookContext& hookCtx,                              \
-        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__( \
-            COMMA __VA_ARGS__));                                 \
-    extern WasmEdge_Result WasmFunction##F(                      \
-        void* data_ptr,                                          \
-        const WasmEdge_CallingFrameContext* frameCtx,            \
-        const WasmEdge_Value* in,                                \
-        WasmEdge_Value* out);                                    \
-    extern WasmEdge_ValType WasmFunctionParams##F[];             \
-    extern WasmEdge_ValType WasmFunctionResult##F[];             \
-    extern WasmEdge_FunctionTypeContext* WasmFunctionType##F;    \
+#define UNSIGNED_TYPE(T) std::make_unsigned_t<T>
+
+#define DECLARE_HOOK_FUNCTION(R, F, ...)                          \
+    std::variant<UNSIGNED_TYPE(R), hook_api::hook_return_code> F( \
+        hook::HookContext& hookCtx,                               \
+        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__(  \
+            COMMA __VA_ARGS__));                                  \
+    extern WasmEdge_Result WasmFunction##F(                       \
+        void* data_ptr,                                           \
+        const WasmEdge_CallingFrameContext* frameCtx,             \
+        const WasmEdge_Value* in,                                 \
+        WasmEdge_Value* out);                                     \
+    extern WasmEdge_ValType WasmFunctionParams##F[];              \
+    extern WasmEdge_ValType WasmFunctionResult##F[];              \
+    extern WasmEdge_FunctionTypeContext* WasmFunctionType##F;     \
     extern WasmEdge_String WasmFunctionName##F;
 
-#define DEFINE_HOOK_FUNCTION(R, F, ...)                             \
-    WasmEdge_Result hook_api::WasmFunction##F(                      \
-        void* data_ptr,                                             \
-        const WasmEdge_CallingFrameContext* frameCtx,               \
-        const WasmEdge_Value* in,                                   \
-        WasmEdge_Value* out)                                        \
-    {                                                               \
-        __VA_OPT__(int _stack = 0;)                                 \
-        __VA_OPT__(FOR_VARS(VAR_ASSIGN, 2, __VA_ARGS__);)           \
-        hook::HookContext* hookCtx =                                \
-            reinterpret_cast<hook::HookContext*>(data_ptr);         \
-        R return_code = hook_api::F(                                \
-            *hookCtx,                                               \
-            *const_cast<WasmEdge_CallingFrameContext*>(frameCtx)    \
-                __VA_OPT__(COMMA STRIP_TYPES(__VA_ARGS__)));        \
-        if (return_code == RC_ROLLBACK || return_code == RC_ACCEPT) \
-            return WasmEdge_Result_Terminate;                       \
-        out[0] = RET_ASSIGN(R, return_code);                        \
-        return WasmEdge_Result_Success;                             \
-    };                                                              \
-    WasmEdge_ValType hook_api::WasmFunctionParams##F[] = {          \
-        __VA_OPT__(FOR_VARS(WASM_VAL_TYPE, 0, __VA_ARGS__))};       \
-    WasmEdge_ValType hook_api::WasmFunctionResult##F[1] = {         \
-        WASM_VAL_TYPE(R, dummy)};                                   \
-    WasmEdge_FunctionTypeContext* hook_api::WasmFunctionType##F =   \
-        WasmEdge_FunctionTypeCreate(                                \
-            WasmFunctionParams##F,                                  \
-            VA_NARGS(NULL __VA_OPT__(, __VA_ARGS__)),               \
-            WasmFunctionResult##F,                                  \
-            1);                                                     \
-    WasmEdge_String hook_api::WasmFunctionName##F =                 \
-        WasmEdge_StringCreateByCString(#F);                         \
-    R hook_api::F(                                                  \
-        hook::HookContext& hookCtx,                                 \
-        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__(    \
+#define DEFINE_HOOK_FUNCTION(R, F, ...)                                        \
+    WasmEdge_Result hook_api::WasmFunction##F(                                 \
+        void* data_ptr,                                                        \
+        const WasmEdge_CallingFrameContext* frameCtx,                          \
+        const WasmEdge_Value* in,                                              \
+        WasmEdge_Value* out)                                                   \
+    {                                                                          \
+        __VA_OPT__(int _stack = 0;)                                            \
+        __VA_OPT__(FOR_VARS(VAR_ASSIGN, 2, __VA_ARGS__);)                      \
+        hook::HookContext* hookCtx =                                           \
+            reinterpret_cast<hook::HookContext*>(data_ptr);                    \
+        auto const& return_code = hook_api::F(                                 \
+            *hookCtx,                                                          \
+            *const_cast<WasmEdge_CallingFrameContext*>(frameCtx)               \
+                __VA_OPT__(COMMA STRIP_TYPES(__VA_ARGS__)));                   \
+        if (std::holds_alternative<hook_api::hook_return_code>(return_code) && \
+            (std::get<hook_api::hook_return_code>(return_code) ==              \
+                 RC_ROLLBACK ||                                                \
+             std::get<hook_api::hook_return_code>(return_code) == RC_ACCEPT))  \
+            return WasmEdge_Result_Terminate;                                  \
+        out[0] = RET_ASSIGN(                                                   \
+            R,                                                                 \
+            std::holds_alternative<UNSIGNED_TYPE(R)>(return_code)              \
+                ? std::get<UNSIGNED_TYPE(R)>(return_code)                      \
+                : R(std::get<hook_api::hook_return_code>(return_code)));       \
+        return WasmEdge_Result_Success;                                        \
+    };                                                                         \
+    WasmEdge_ValType hook_api::WasmFunctionParams##F[] = {                     \
+        __VA_OPT__(FOR_VARS(WASM_VAL_TYPE, 0, __VA_ARGS__))};                  \
+    WasmEdge_ValType hook_api::WasmFunctionResult##F[1] = {                    \
+        WASM_VAL_TYPE(R, dummy)};                                              \
+    WasmEdge_FunctionTypeContext* hook_api::WasmFunctionType##F =              \
+        WasmEdge_FunctionTypeCreate(                                           \
+            WasmFunctionParams##F,                                             \
+            VA_NARGS(NULL __VA_OPT__(, __VA_ARGS__)),                          \
+            WasmFunctionResult##F,                                             \
+            1);                                                                \
+    WasmEdge_String hook_api::WasmFunctionName##F =                            \
+        WasmEdge_StringCreateByCString(#F);                                    \
+    std::variant<UNSIGNED_TYPE(R), hook_api::hook_return_code> hook_api::F(    \
+        hook::HookContext& hookCtx,                                            \
+        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__(               \
             COMMA __VA_ARGS__))
 
 #define HOOK_SETUP()                                                 \
+    using enum hook_api::hook_return_code;                           \
     try                                                              \
     {                                                                \
         [[maybe_unused]] ApplyContext& applyCtx = hookCtx.applyCtx;  \
@@ -203,7 +214,7 @@
     host_memory_ptr,                  \
     guest_memory_length)              \
     {                                 \
-        int64_t bytes_written = 0;    \
+        uint64_t bytes_written = 0;   \
         WRITE_WASM_MEMORY(            \
             bytes_written,            \
             guest_dst_ptr,            \
@@ -272,7 +283,7 @@
             data_ptr < (data_ptr_in))                                    \
             return INTERNAL_ERROR;                                       \
         if (data_len == 0)                                               \
-            return 0;                                                    \
+            return 0ULL;                                                 \
         if ((write_ptr_in) == 0)                                         \
             return data_as_int64(data_ptr, data_len);                    \
         if (data_len > (write_len_in))                                   \

include/xrpl/hook/hook_api.macro

@@ -372,3 +372,33 @@ HOOK_API_DEFINITION(
 HOOK_API_DEFINITION(
   int64_t, prepare, (uint32_t, uint32_t, uint32_t, uint32_t),
   featureHooksUpdate2)
+
+// int64_t xport_reserve(uint32_t count);
+HOOK_API_DEFINITION(
+  int64_t, xport_reserve, (uint32_t),
+  featureExport)
+
+// int64_t xport(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t committee_hash_ptr, uint32_t committee_hash_len);
+HOOK_API_DEFINITION(
+  int64_t, xport, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  featureExport)
+
+// int64_t xport_cancel(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
+HOOK_API_DEFINITION(
+  int64_t, xport_cancel, (uint32_t, uint32_t, uint32_t),
+  featureExport)
+
+// int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
+HOOK_API_DEFINITION(
+  int64_t, entropy_cr_dice, (uint32_t, uint32_t),
+  featureConsensusEntropy)
+
+// int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
+HOOK_API_DEFINITION(
+  int64_t, entropy_cr_random, (uint32_t, uint32_t, uint32_t),
+  featureConsensusEntropy)
+
+// int64_t entropy_cr_status(void);
+HOOK_API_DEFINITION(
+  int64_t, entropy_cr_status, (),
+  featureConsensusEntropy)

include/xrpl/proto/.clang-format

@@ -0,0 +1,2 @@
+---
+DisableFormat: true

include/xrpl/proto/ripple.proto

@@ -27,6 +27,7 @@ enum MessageType
     mtREPLAY_DELTA_RESPONSE     = 60;
     mtHAVE_TRANSACTIONS         = 63;
     mtTRANSACTIONS              = 64;
+    mtEXPORT_SHARES             = 65;
 }
 
 // token, iterations, target, challenge = issue demand for proof of work
@@ -36,6 +37,7 @@ enum MessageType
 //------------------------------------------------------------------------------
 
 /* Provides the current ephemeral key for a validator. */
+//@@start opaque-self-verifying-overlay-artifact-precedent
 message TMManifest
 {
     // A Manifest object in the Ripple serialization format.
@@ -49,6 +51,7 @@ message TMManifests
     // The manifests sent when a peer first connects to another peer are `history`.
     optional bool history = 2 [deprecated=true];
 }
+//@@end opaque-self-verifying-overlay-artifact-precedent
 
 //------------------------------------------------------------------------------
 
@@ -118,6 +121,15 @@ message TMTransactions
     repeated TMTransaction transactions = 1;
 }
 
+// Canonical post-validation Export signature contributions. Receivers enforce
+// ExportLimits caps for entry count, each frame, aggregate frame payload, and
+// encoded protobuf size. The encoded-size cap includes protobuf tags and
+// length prefixes but excludes the overlay message header.
+message TMExportShares
+{
+    repeated bytes shares = 1;
+}
+
 
 enum NodeStatus
 {
@@ -153,7 +165,11 @@ message TMStatusChange
 message TMProposeSet
 {
     required uint32 proposeSeq          = 1;
-    required bytes currentTxHash        = 2;    // the hash of the ledger we are proposing
+    // Proposed transaction-set identity. Legacy/plain proposals carry the
+    // tx-set hash directly; ConsensusExtensions proposals carry a serialized
+    // ExtendedPosition whose first field is that tx-set hash, followed by
+    // signed RNG/Export sidecar fields.
+    required bytes currentTxHash        = 2;
     required bytes nodePubKey           = 3;
     required uint32 closeTime           = 4;
     required bytes signature            = 5;    // signature of above fields
@@ -166,6 +182,16 @@ message TMProposeSet
 
     // Number of hops traveled
     optional uint32 hops                = 12    [deprecated=true];
+
+    //@@start proposal-export-share-container-binding
+    // Canonical post-validation ExportShare frames authored by the proposing
+    // validator and re-advertised for anti-entropy. The proposal's
+    // ExtendedPosition includes a digest of this repeated field, so the exact
+    // frames are covered by the proposal signature. Each frame carries its
+    // version, owner, origin transaction, origin ledger sequence and hash,
+    // committee position, signing key, and multisign signature.
+    repeated bytes exportSignatures     = 13;
+    //@@end proposal-export-share-container-binding
 }
 
 enum TxSetStatus
@@ -384,4 +410,3 @@ message TMHaveTransactions
 {
     repeated bytes hashes = 1;
 }
-

include/xrpl/protocol/EntropyTier.h

@@ -0,0 +1,62 @@
+#ifndef RIPPLE_PROTOCOL_ENTROPY_TIER_H_INCLUDED
+#define RIPPLE_PROTOCOL_ENTROPY_TIER_H_INCLUDED
+
+#include <cstdint>
+
+namespace ripple {
+
+/// Which gate the ledger's entropy passed. Stored in sfEntropyTier (UINT8)
+/// on the ttCONSENSUS_ENTROPY pseudo-transaction and the ConsensusEntropy
+/// ledger entry.
+///
+/// EntropyCount says how many validators contributed; EntropyDenominator says
+/// how many active validators were in the ledger-anchored view for that
+/// non-fallback result; EntropyTier says which gate the result passed. Fallback
+/// entropy carries count=0/denominator=0 because no validator-derived
+/// denominator was accepted. Tier values are strength-ordered so consumers can
+/// gate with a numeric comparison (tier >= required).
+///
+/// RESIDUAL BIAS — applies to fallback, participant_aligned, and
+/// validator_quorum. This is a commit/reveal scheme: a validator can withhold
+/// its reveal until after observing peers' reveals, choosing between two
+/// outcomes (its contribution in vs. out) — up to one bit of influence per
+/// withholder, and colluding withholders near a threshold can instead force a
+/// downgrade to a lower tier. These tiers bound and *label* manipulation (it is
+/// observable and limited); they are NOT bias-resistant against a colluding
+/// validator minority. A hook that requires validator_full fails closed if any
+/// active validator withholds, trading availability for no selective-
+/// withholding slack.
+enum EntropyTier : std::uint8_t {
+    /// No usable entropy (reserved; a fresh ConsensusEntropy entry should
+    /// always carry one of the tiers below).
+    entropyTierNone = 0,
+
+    /// Consensus-bound deterministic fallback: derived from already-agreed
+    /// round inputs (parent ledger hash, base tx set hash, sequence) under
+    /// HashPrefix::entropyFallback when no agreed reveal set reaches either
+    /// participant_aligned or validator_quorum. Unpredictable in practice but
+    /// user-influenceable via transaction submission — never suitable for
+    /// value-bearing outcomes.
+    entropyTierConsensusFallback = 1,
+
+    /// Participant-aligned sub-quorum entropy: the agreed reveal set aligned at
+    /// the tier-2 participant threshold — below the 80% validator quorum but at
+    /// or above the equivocation-intersection floor over the original
+    /// (pre-nUNL)
+    /// view. Weaker than validator_quorum; opt-in for hooks via min_tier.
+    entropyTierParticipantAligned = 2,
+
+    /// Validator commit/reveal entropy whose sidecar set passed the
+    /// active-validator-view quorum alignment gate.
+    entropyTierValidatorQuorum = 3,
+
+    /// Validator commit/reveal entropy with reveals from every validator in
+    /// the ledger-anchored active view. Any missing active validator downgrades
+    /// the tier, so hooks can require this to fail closed on selective
+    /// withholding.
+    entropyTierValidatorFull = 4,
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/ExportCommittee.h

@@ -0,0 +1,131 @@
+#ifndef RIPPLE_PROTOCOL_EXPORTCOMMITTEE_H_INCLUDED
+#define RIPPLE_PROTOCOL_EXPORTCOMMITTEE_H_INCLUDED
+
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Slice.h>
+#include <xrpl/protocol/ExportLimits.h>
+#include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <vector>
+
+namespace ripple {
+
+/** One canonical, network-neutral Export validator committee. */
+struct ExportCommitteeProfile
+{
+    std::vector<PublicKey> members;
+    std::size_t quorum;
+
+    std::optional<std::uint16_t>
+    position(PublicKey const& master) const
+    {
+        auto const it =
+            std::lower_bound(members.begin(), members.end(), master);
+        if (it == members.end() || *it != master)
+            return std::nullopt;
+        return static_cast<std::uint16_t>(std::distance(members.begin(), it));
+    }
+};
+
+/** Parse a strictly sorted sequence of compressed validator master keys. */
+inline std::optional<ExportCommitteeProfile>
+resolveExportCommittee(Slice roster)
+{
+    constexpr std::size_t publicKeyBytes = 33;
+    if (roster.empty() || roster.size() % publicKeyBytes != 0)
+        return std::nullopt;
+
+    auto const count = roster.size() / publicKeyBytes;
+    if (count == 0 || count > ExportLimits::maxCommitteeMembers)
+        return std::nullopt;
+
+    std::vector<PublicKey> members;
+    members.reserve(count);
+    for (std::size_t offset = 0; offset < roster.size();
+         offset += publicKeyBytes)
+    {
+        Slice const encoded{roster.data() + offset, publicKeyBytes};
+        if (!publicKeyType(encoded))
+            return std::nullopt;
+
+        PublicKey member{encoded};
+        if (!members.empty() && !(members.back() < member))
+            return std::nullopt;
+        members.push_back(std::move(member));
+    }
+
+    return ExportCommitteeProfile{
+        std::move(members), ExportLimits::committeeQuorumThreshold(count)};
+}
+
+inline Blob
+serializeExportCommittee(std::vector<PublicKey> members)
+{
+    if (members.empty() || members.size() > ExportLimits::maxCommitteeMembers)
+        return {};
+
+    std::sort(members.begin(), members.end());
+    if (std::adjacent_find(members.begin(), members.end()) != members.end())
+        return {};
+
+    Blob roster;
+    roster.reserve(members.size() * 33);
+    for (auto const& member : members)
+        roster.insert(roster.end(), member.begin(), member.end());
+    return roster;
+}
+
+/** Canonicalize an unordered transaction roster into strict stored form. */
+inline std::optional<Blob>
+canonicalizeExportCommittee(Slice roster)
+{
+    constexpr std::size_t publicKeyBytes = 33;
+    if (roster.empty() || roster.size() % publicKeyBytes != 0)
+        return std::nullopt;
+
+    auto const count = roster.size() / publicKeyBytes;
+    if (count == 0 || count > ExportLimits::maxCommitteeMembers)
+        return std::nullopt;
+
+    std::vector<PublicKey> members;
+    members.reserve(count);
+    for (std::size_t offset = 0; offset < roster.size();
+         offset += publicKeyBytes)
+    {
+        Slice const encoded{roster.data() + offset, publicKeyBytes};
+        if (!publicKeyType(encoded))
+            return std::nullopt;
+        members.emplace_back(encoded);
+    }
+
+    auto canonical = serializeExportCommittee(std::move(members));
+    if (canonical.empty())
+        return std::nullopt;
+    return canonical;
+}
+
+/** Content identity of one already-validated canonical roster. */
+inline uint256
+exportCommitteeHash(Slice roster)
+{
+    auto const profile = resolveExportCommittee(roster);
+    if (!profile)
+        return {};
+
+    Serializer serialized;
+    serialized.add32(HashPrefix::exportCommittee);
+    serialized.add32(static_cast<std::uint32_t>(profile->members.size()));
+    serialized.addRaw(roster);
+    return serialized.getSHA512Half();
+}
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/ExportLimits.h

@@ -0,0 +1,119 @@
+#ifndef RIPPLE_PROTOCOL_EXPORT_LIMITS_H_INCLUDED
+#define RIPPLE_PROTOCOL_EXPORT_LIMITS_H_INCLUDED
+
+#include <xrpl/protocol/ValidatorBitset.h>
+
+#include <cstddef>
+#include <cstdint>
+
+namespace ripple {
+
+// Export system caps.
+//
+// These limits bound the DoS surface of the export signature system:
+// - Each selected validator signs once after exact source validation
+// - Pending shares are re-advertised through bounded proposal/relay batches
+// - Inbound signature processing involves crypto verification per sig
+// - Durable and per-message caps bound scans, crypto, and sidecar leaves
+struct ExportLimits
+{
+    // Ordinary XRPL multisigning accepts at most 32 signers. An account that
+    // reserves a separate operator signer must select fewer validators.
+    static constexpr std::size_t maxCommitteeMembers = 32;
+    static constexpr std::size_t maxCommitteeRosterBytes =
+        maxCommitteeMembers * 33;
+    static constexpr std::size_t maxCommitteeContributorBytes =
+        validatorBitsetBytes(maxCommitteeMembers);
+
+    // Export-specific serialized payload bounds. The release target includes
+    // the canonical origin Memo appended after validation; the witness wraps
+    // that target plus the accepted committee signatures.
+    static constexpr std::size_t maxExportReleaseTargetBytes = 2'048;
+    static constexpr std::size_t maxExportWitnessBytes = 8'192;
+
+    // V1 witnesses require the standard 80% quorum of the intent-selected
+    // committee, rounded up. The intent selects members but cannot lower this
+    // threshold. Split quotient/remainder arithmetic avoids overflow while
+    // preserving ceil(memberCount * 0.8).
+    static constexpr std::size_t
+    committeeQuorumThreshold(std::size_t memberCount)
+    {
+        auto const quotient = memberCount / 5;
+        auto const remainder = memberCount % 5;
+        return quotient * 4 + (remainder * 4 + 4) / 5;
+    }
+
+    // Maximum exports a single hook execution may produce. Hook API ABI
+    // constant hook_api::max_export must stay equal.
+    static constexpr std::uint8_t maxExportsPerHook = 2;
+
+    // Maximum Export intents admitted in one ledger and maximum live latches
+    // owned by one account.
+    static constexpr std::uint8_t maxPendingExports = 8;
+
+    // Global pending-latch and per-validation scan bound. Witnessed or canceled
+    // latches release this signing-work slot while their account owner count
+    // and reserve continue to bound retained state. This is a provisional
+    // activation tuning value.
+    static constexpr std::uint16_t maxLiveExportLatches = 64;
+
+    // Maximum admission window requested through the mandatory outer
+    // LastLedgerSequence. This bounds how long an Export may remain queued
+    // before entering a ledger; it does not bound post-validation release.
+    static constexpr std::uint32_t maxAdmissionWindowLedgers = 5;
+
+    // Fixed source-ledger window for post-validation share publication and
+    // witness materialization, measured from the ledger that admits the
+    // intent. This is a provisional activation tuning value. Keeping it
+    // separate from the outer LastLedgerSequence prevents queue delay from
+    // consuming the publication window.
+    static constexpr std::uint32_t maxPublicationLedgers = 5;
+
+    // A fully-canonical secp256k1 signature is at most 72 bytes; Ed25519 is 64.
+    static constexpr std::size_t maxCanonicalExportSignatureBytes = 72;
+
+    // Export-signature sidecar leaves encode an origin, committee position,
+    // signing key, and signature in an STObject envelope. Keep this comfortably
+    // above the canonical encoding while bounding peer-supplied leaf bytes
+    // before parse/hash work.
+    static constexpr std::size_t maxExportSignatureSidecarBytes = 256;
+
+    // Post-validation relay framing. Values are deliberately conservative
+    // local tuning knobs and require measurement before activation; changing
+    // them does not change the canonical per-share format.
+    // version + AccountID + 2 hashes + ledger sequence + committee position +
+    // compressed public key + one-byte VL prefix + maximum signature.
+    static constexpr std::size_t maxSerializedExportShareBytes =
+        1 + 20 + 32 + 4 + 32 + 2 + 33 + 1 + maxCanonicalExportSignatureBytes;
+    static constexpr std::size_t maxExportSharesPerRelay = 32;
+    static constexpr std::size_t maxExportShareRelayPayloadBytes =
+        maxSerializedExportShareBytes * maxExportSharesPerRelay;
+    // Protobuf repeated-bytes framing is one tag byte plus a two-byte varint
+    // length for every maximum-size frame. This excludes the overlay header.
+    static constexpr std::size_t maxExportShareRelayMessageBytes =
+        maxExportShareRelayPayloadBytes + 3 * maxExportSharesPerRelay;
+
+    // Provisional activation fee schedule. These values intentionally price
+    // Export intents above ordinary transactions until production measurements
+    // can replace the conservative work and storage estimates.
+    //
+    // Witness bytes are estimated from the exact serialized target size, a
+    // fixed allowance for the witness envelope/origin stamp/contributor mask,
+    // and one bounded signer entry for every selected member. The accepted
+    // sidecar witness retains every valid committee contribution, not merely
+    // the minimum quorum subset.
+    static constexpr std::uint64_t feeWitnessFixedAllowanceBytes = 384;
+    static constexpr std::uint64_t feeWitnessSignerAllowanceBytes = 128;
+    static constexpr std::uint64_t feeSharePublicationRounds =
+        maxPublicationLedgers + 1;
+    static constexpr std::uint64_t feeWorkUnitsPerSharePublication = 1;
+    static constexpr std::uint64_t feeWorkUnitsPerWitnessSignature = 2;
+    static constexpr std::uint64_t feeWitnessChunkBytes = 256;
+    static constexpr std::uint64_t feeWorkUnitsPerWitnessChunk = 1;
+    static constexpr std::uint64_t feePermanentWitnessByteDrops = 1;
+    static constexpr std::uint64_t feeSurchargeRoundDrops = 1'000;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/ExportOriginMemo.h

@@ -0,0 +1,104 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose with or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_PROTOCOL_EXPORTORIGINMEMO_H_INCLUDED
+#define RIPPLE_PROTOCOL_EXPORTORIGINMEMO_H_INCLUDED
+
+#include <xrpl/basics/Expected.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/UintTypes.h>
+
+#include <cstdint>
+#include <optional>
+#include <string_view>
+
+namespace ripple::ExportOriginMemo {
+
+inline constexpr std::string_view memoType = "xahau/export";
+inline constexpr std::uint8_t version = 1;
+inline constexpr std::uint8_t allowedFlags = 0;
+inline constexpr std::size_t identityBytes = 42;
+inline constexpr std::size_t releaseBytes = 78;
+
+struct Origin
+{
+    std::uint32_t sourceDomain;
+    std::uint32_t targetDomain;
+    uint256 transactionHash;
+
+    bool
+    operator==(Origin const&) const = default;
+};
+
+struct Anchor
+{
+    LedgerIndex ledgerSequence;
+    uint256 ledgerHash;
+
+    bool
+    operator==(Anchor const&) const = default;
+};
+
+struct Stamp
+{
+    Origin origin;
+    std::optional<Anchor> anchor;
+
+    bool
+    operator==(Stamp const&) const = default;
+};
+
+enum class Error {
+    reservedMemoPresent,
+    reservedMemoMissing,
+    reservedMemoPosition,
+    malformedMemo,
+    unsupportedVersion,
+    unsupportedFlags,
+    localChecks
+};
+
+/** Return true when any Memo reserves the Export protocol MemoType. */
+bool
+hasReservedMemo(STTx const& tx);
+
+/** Append the canonical identity projection as the final Memo.
+
+    Existing Memos remain byte-identical and in their original order. This
+    function does not normalize transaction authorization fields; callers must
+    supply the canonical unsigned multisign base.
+*/
+Expected<STTx, Error>
+identityForm(STTx const& base, Origin const& origin);
+
+/** Append the canonical release projection as the final Memo. */
+Expected<STTx, Error>
+releaseForm(STTx const& base, Origin const& origin, Anchor const& anchor);
+
+/** Parse one canonical final Export Memo. */
+Expected<Stamp, Error>
+parse(STTx const& tx);
+
+/** Replace a canonical release projection with its identity projection. */
+Expected<STTx, Error>
+projectIdentity(STTx const& stamped);
+
+}  // namespace ripple::ExportOriginMemo
+
+#endif

include/xrpl/protocol/ExportShare.h

@@ -0,0 +1,142 @@
+#ifndef RIPPLE_PROTOCOL_EXPORTSHARE_H_INCLUDED
+#define RIPPLE_PROTOCOL_EXPORTSHARE_H_INCLUDED
+
+#include <xrpl/basics/Buffer.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/ExportLimits.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/digest.h>
+
+#include <cstdint>
+#include <cstring>
+#include <optional>
+#include <stdexcept>
+
+namespace ripple {
+
+/** Canonical post-validation Export signature contribution.
+
+    The multisign signature authenticates the derived destination transaction.
+    The remaining fields are bounded lookup and release context which live
+    admission checks against the origin latch and local validated chain.
+*/
+struct ExportShare
+{
+    static constexpr std::uint8_t currentVersion = 1;
+
+    std::uint8_t version{currentVersion};
+    AccountID owner;
+    uint256 originTxn;
+    LedgerIndex originLedgerSeq{0};
+    uint256 originLedgerHash;
+    std::uint16_t committeePosition{0};
+    PublicKey signingKey;
+    Buffer signature;
+
+    bool
+    hasCanonicalSignature() const
+    {
+        auto const keyType = publicKeyType(signingKey);
+        if (!keyType)
+            return false;
+
+        auto const sig = Slice{signature.data(), signature.size()};
+        if (*keyType == KeyType::secp256k1)
+        {
+            auto const canonicality = ecdsaCanonicality(sig);
+            return canonicality &&
+                *canonicality == ECDSACanonicality::fullyCanonical;
+        }
+
+        // Full Ed25519 canonicality is enforced by cryptographic admission.
+        // The framing layer can still reject every impossible wire length.
+        return *keyType == KeyType::ed25519 && signature.size() == 64;
+    }
+
+    bool
+    validShape() const
+    {
+        return version == currentVersion && owner != beast::zero &&
+            !originTxn.isZero() && originLedgerSeq != 0 &&
+            !originLedgerHash.isZero() &&
+            committeePosition < ExportLimits::maxCommitteeMembers &&
+            hasCanonicalSignature();
+    }
+
+    Serializer
+    serialize() const
+    {
+        if (!validShape())
+            throw std::invalid_argument("invalid ExportShare shape");
+
+        Serializer result;
+        result.add8(version);
+        result.addBitString(owner);
+        result.addBitString(originTxn);
+        result.add32(originLedgerSeq);
+        result.addBitString(originLedgerHash);
+        result.add16(committeePosition);
+        result.addRaw(signingKey.slice());
+        result.addVL(signature);
+        return result;
+    }
+
+    uint256
+    wireHash() const
+    {
+        // Raw-wire suppression only. Routing context such as committeePosition
+        // is checked against validated state before relay and is not
+        // authenticated by the destination multisignature.
+        auto const bytes = serialize();
+        return sha512Half(bytes.slice());
+    }
+
+    static std::optional<ExportShare>
+    parse(Slice bytes)
+    {
+        if (bytes.empty() ||
+            bytes.size() > ExportLimits::maxSerializedExportShareBytes)
+            return std::nullopt;
+
+        try
+        {
+            SerialIter sit{bytes};
+            auto const version = sit.get8();
+            auto const owner = sit.getBitString<160, detail::AccountIDTag>();
+            auto const originTxn = sit.get256();
+            auto const originLedgerSeq = sit.get32();
+            auto const originLedgerHash = sit.get256();
+            auto const committeePosition = sit.get16();
+            auto const keySlice = sit.getSlice(33);
+            if (!publicKeyType(keySlice))
+                return std::nullopt;
+            PublicKey const signingKey{keySlice};
+            auto signature = sit.getVLBuffer();
+            if (!sit.empty())
+                return std::nullopt;
+
+            ExportShare result{
+                version,
+                owner,
+                originTxn,
+                originLedgerSeq,
+                originLedgerHash,
+                committeePosition,
+                signingKey,
+                std::move(signature)};
+            if (!result.validShape())
+                return std::nullopt;
+            return result;
+        }
+        catch (std::exception const&)
+        {
+            return std::nullopt;
+        }
+    }
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/Feature.h

@@ -33,35 +33,39 @@
  *
  * Steps required to add new features to the code:
  *
- * 1) In this file, increment `numFeatures` and add a uint256 declaration
- *    for the feature at the bottom
- * 2) Add a uint256 definition for the feature to the corresponding source
- *    file (Feature.cpp). Use `registerFeature` to create the feature with
- *    the feature's name, `Supported::no`, and `VoteBehavior::DefaultNo`. This
- *    should be the only place the feature's name appears in code as a string.
- * 3) Use the uint256 as the parameter to `view.rules.enabled()` to
- *    control flow into new code that this feature limits.
- * 4) If the feature development is COMPLETE, and the feature is ready to be
- *    SUPPORTED, change the `registerFeature` parameter to Supported::yes.
- * 5) When the feature is ready to be ENABLED, change the `registerFeature`
- *    parameter to `VoteBehavior::DefaultYes`.
- * In general, any newly supported amendments (`Supported::yes`) should have
- * a `VoteBehavior::DefaultNo` for at least one full release cycle. High
- * priority bug fixes can be an exception to this rule of thumb.
+ * 1) Add the appropriate XRPL_FEATURE or XRPL_FIX macro definition for the
+ *    feature to features.macro with the feature's name, `Supported::no`, and
+ *    `VoteBehavior::DefaultNo`.
+ *
+ * 2) Use the generated variable name as the parameter to `view.rules.enabled()`
+ *    to control flow into new code that this feature limits. (featureName or
+ *    fixName)
+ *
+ * 3) If the feature development is COMPLETE, and the feature is ready to be
+ *    SUPPORTED, change the macro parameter in features.macro to Supported::yes.
+ *
+ * 4) In general, any newly supported amendments (`Supported::yes`) should have
+ *    a `VoteBehavior::DefaultNo` indefinitely so that external governance can
+ *    make the decision on when to activate it. High priority bug fixes can be
+ *    an exception to this rule. In such cases, ensure the fix has been
+ *    clearly communicated to the community using appropriate channels,
+ *    then change the macro parameter in features.macro to
+ *    `VoteBehavior::DefaultYes`. The communication process is beyond
+ *    the scope of these instructions.
+ *
  *
  * When a feature has been enabled for several years, the conditional code
  * may be removed, and the feature "retired". To retire a feature:
- * 1) Remove the uint256 declaration from this file.
- * 2) MOVE the uint256 definition in Feature.cpp to the "retired features"
- *    section at the end of the file.
- * 3) CHANGE the name of the variable to start with "retired".
- * 4) CHANGE the parameters of the `registerFeature` call to `Supported::yes`
- *    and `VoteBehavior::DefaultNo`.
+ *
+ * 1) MOVE the macro definition in features.macro to the "retired features"
+ *    section at the end of the file, and change the macro to XRPL_RETIRE.
+ *
  * The feature must remain registered and supported indefinitely because it
- * still exists in the ledger, but there is no need to vote for it because
- * there's nothing to vote for. If it is removed completely from the code, any
- * instances running that code will get amendment blocked. Removing the
- * feature from the ledger is beyond the scope of these instructions.
+ * may exist in the Amendments object on ledger. There is no need to vote
+ * for it because there's nothing to vote for. If the feature definition is
+ * removed completely from the code, any instances running that code will get
+ * amendment blocked. Removing the feature from the ledger is beyond the scope
+ * of these instructions.
  *
  */
 
@@ -76,11 +80,32 @@ allAmendments();
 
 namespace detail {
 
+#pragma push_macro("XRPL_FEATURE")
+#undef XRPL_FEATURE
+#pragma push_macro("XRPL_FIX")
+#undef XRPL_FIX
+#pragma push_macro("XRPL_RETIRE")
+#undef XRPL_RETIRE
+
+#define XRPL_FEATURE(name, supported, vote) +1
+#define XRPL_FIX(name, supported, vote) +1
+#define XRPL_RETIRE(name) +1
+
 // This value SHOULD be equal to the number of amendments registered in
 // Feature.cpp. Because it's only used to reserve storage, and determine how
 // large to make the FeatureBitset, it MAY be larger. It MUST NOT be less than
 // the actual number of amendments. A LogicError on startup will verify this.
-static constexpr std::size_t numFeatures = 113;
+static constexpr std::size_t numFeatures =
+    (0 +
+#include <xrpl/protocol/detail/features.macro>
+    );
+
+#undef XRPL_RETIRE
+#pragma pop_macro("XRPL_RETIRE")
+#undef XRPL_FIX
+#pragma pop_macro("XRPL_FIX")
+#undef XRPL_FEATURE
+#pragma pop_macro("XRPL_FEATURE")
 
 /** Amendments that this server supports and the default voting behavior.
    Whether they are enabled depends on the Rules defined in the validated
@@ -320,12 +345,17 @@ foreachFeature(FeatureBitset bs, F&& f)
 #undef XRPL_FEATURE
 #pragma push_macro("XRPL_FIX")
 #undef XRPL_FIX
+#pragma push_macro("XRPL_RETIRE")
+#undef XRPL_RETIRE
 
 #define XRPL_FEATURE(name, supported, vote) extern uint256 const feature##name;
 #define XRPL_FIX(name, supported, vote) extern uint256 const fix##name;
+#define XRPL_RETIRE(name)
 
 #include <xrpl/protocol/detail/features.macro>
 
+#undef XRPL_RETIRE
+#pragma pop_macro("XRPL_RETIRE")
 #undef XRPL_FIX
 #pragma pop_macro("XRPL_FIX")
 #undef XRPL_FEATURE

include/xrpl/protocol/HashPrefix.h

@@ -96,6 +96,24 @@ enum class HashPrefix : std::uint32_t {
 
     /** Credentials signature */
     credential = detail::make_hash_prefix('C', 'R', 'D'),
+
+    /** consensus extension sidecar object */
+    sidecar = detail::make_hash_prefix('S', 'C', 'R'),
+
+    /** consensus diagnostic observed participant set */
+    observedParticipants = detail::make_hash_prefix('O', 'B', 'P'),
+
+    /** consensus-bound fallback entropy digest (Tier 1: derived from
+        already-agreed round inputs when no agreed reveal set reaches an
+        accepted validator-participant tier; never to be confused with
+        validator entropy) */
+    entropyFallback = detail::make_hash_prefix('E', 'F', 'B'),
+
+    /** consensus entropy transaction-ordering salt */
+    entropyTxnOrder = detail::make_hash_prefix('E', 'T', 'O'),
+
+    /** immutable Export committee roster */
+    exportCommittee = detail::make_hash_prefix('E', 'C', 'M'),
 };
 
 template <class Hasher>

include/xrpl/protocol/Import.h

@@ -454,6 +454,15 @@ getVLInfo(Json::Value const& xpop, beast::Journal const& j)
             << "Import: unl blob was not valid json (after base64 decoding)";
         return {};
     }
+    auto const isNonNegativeUInt = [](Json::Value const& value) {
+        return value.isUInt() || (value.isInt() && value.asInt() >= 0);
+    };
+    if (!list.isMember(jss::sequence) ||
+        !isNonNegativeUInt(list[jss::sequence]))
+    {
+        JLOG(j.warn()) << "Import: unl blob sequence was missing or negative";
+        return {};
+    }
     auto const sequence = list[jss::sequence].asUInt();
     auto const m = deserializeManifest(base64_decode(
         xpop[jss::validation][jss::unl][jss::manifest].asString()));

include/xrpl/protocol/Indexes.h

@@ -62,6 +62,22 @@ emittedDir() noexcept;
 Keylet
 emittedTxn(uint256 const& id) noexcept;
 
+/** Locate an Export latch by its permanent source issuance identity.
+
+    The source Export transaction ID is content-addressed and cannot be reused,
+    including after AccountDelete.
+*/
+Keylet
+exportLatch(AccountID const& account, uint256 const& originTxnHash) noexcept;
+
+/** Locate an immutable Export committee owned by an account. */
+Keylet
+exportCommittee(AccountID const& account, uint256 const& digest) noexcept;
+
+/** The fixed global directory of Export latches awaiting witness work. */
+Keylet const&
+pendingExports() noexcept;
+
 Keylet
 hookDefinition(uint256 const& hash) noexcept;
 
@@ -118,6 +134,10 @@ negativeUNL() noexcept;
 Keylet const&
 UNLReport() noexcept;
 
+/** The (fixed) index of the object containing consensus-derived entropy. */
+Keylet const&
+consensusEntropy() noexcept;
+
 /** The beginning of an order book */
 struct book_t
 {
@@ -372,6 +392,10 @@ permissionedDomain(AccountID const& account, std::uint32_t seq) noexcept;
 
 Keylet
 permissionedDomain(uint256 const& domainID) noexcept;
+
+Keylet
+manifest(PublicKey const& pk) noexcept;
+
 }  // namespace keylet
 
 // Everything below is deprecated and should be removed in favor of keylets:

include/xrpl/protocol/LedgerFormats.h

@@ -186,6 +186,10 @@ enum LedgerSpecificFlags {
     // remarks
     lsfImmutable = 1,
 
+    // ltEXPORT_LATCH
+    lsfExportXpopSeen = 0x00000001,
+    lsfExportCanceled = 0x00000002,
+
     // ltMPTOKEN_ISSUANCE
     lsfMPTLocked = 0x00000001, // Also used in ltMPTOKEN
     lsfMPTCanLock = 0x00000002,

include/xrpl/protocol/Protocol.h

@@ -43,6 +43,19 @@ std::size_t constexpr txMinSizeBytes = 10;
 /** Largest legal byte size of a transaction. */
 std::size_t constexpr txMaxSizeBytes = megabytes(1);
 
+/** Largest network ID whose transactions retain the legacy canonical form.
+
+    Transactions on these networks must omit sfNetworkID. Transactions on
+    networks with larger IDs must include sfNetworkID matching the network.
+ */
+std::uint32_t constexpr maxNetworkIDWithoutTxField = 1024;
+
+constexpr bool
+requiresTxNetworkID(std::uint32_t networkID)
+{
+    return networkID > maxNetworkIDWithoutTxField;
+}
+
 /** The maximum number of unfunded offers to delete at once */
 std::size_t constexpr unfundedOfferRemoveLimit = 1000;
 

include/xrpl/protocol/SidecarType.h

@@ -0,0 +1,21 @@
+#ifndef RIPPLE_PROTOCOL_SIDECAR_TYPE_H_INCLUDED
+#define RIPPLE_PROTOCOL_SIDECAR_TYPE_H_INCLUDED
+
+#include <cstdint>
+
+namespace ripple {
+
+/// Discriminator for sidecar set entries (SHAMap leaves used for
+/// consensus extension data: RNG commit/reveal, export signatures).
+///
+/// Stored in sfSidecarType (UINT8) on each STObject entry.
+/// Makes sidecar sets self-describing — no content-sniffing needed.
+enum SidecarType : std::uint8_t {
+    sidecarRngCommit = 1,
+    sidecarRngReveal = 2,
+    sidecarExportSig = 3,
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/TER.h

@@ -68,7 +68,10 @@ enum TELcodes : TERUnderlyingType {
     telNON_LOCAL_EMITTED_TXN,
     telIMPORT_VL_KEY_NOT_RECOGNISED,
     telCAN_NOT_QUEUE_IMPORT,
+    // Keep test-only sentinels before appended branch-local TEL codes so their
+    // numeric values do not move.
     telENV_RPC_FAILED,
+    telEXPORT_LATCH_REQUIRED,
 };
 
 //------------------------------------------------------------------------------
@@ -137,6 +140,7 @@ enum TEMcodes : TERUnderlyingType {
     temXCHAIN_BRIDGE_NONDOOR_OWNER,
     temXCHAIN_BRIDGE_BAD_MIN_ACCOUNT_CREATE_AMOUNT,
     temXCHAIN_BRIDGE_BAD_REWARD_AMOUNT,
+    temXCHAIN_TOO_MANY_ATTESTATIONS,  // RESERVED - not used
 
     temHOOK_DATA_TOO_LARGE,
     temEMPTY_DID,
@@ -193,6 +197,8 @@ enum TEFcodes : TERUnderlyingType {
     tefNONDIR_EMIT,
     tefIMPORT_BLACKHOLED,
     tefINVALID_LEDGER_FIX_TYPE,
+    tefPAST_MANIFEST_SEQ,
+    tefREVOKED_MANIFEST,
 };
 
 //------------------------------------------------------------------------------
@@ -362,6 +368,7 @@ enum TECcodes : TERUnderlyingType {
     tecARRAY_TOO_LARGE = 197,
     tecLOCKED = 198,
     tecBAD_CREDENTIALS = 199,
+    tecEXPORT_COMMITTEE_UNAVAILABLE = 201,
     tecLAST_POSSIBLE_ENTRY = 255,
 };
 

include/xrpl/protocol/TxFlags.h

@@ -132,7 +132,7 @@ constexpr std::uint32_t tfTrustSetMask =
       tfClearFreeze | tfSetDeepFreeze | tfClearDeepFreeze);
 
 // EnableAmendment flags:
-enum EnableAmendmentFlags : std::uint32_t {
+enum EnableAmendmentFlags : uint32_t {
     tfGotMajority = 0x00010000,
     tfLostMajority = 0x00020000,
     tfTestSuite = 0x80000000,
@@ -274,6 +274,17 @@ enum BridgeModifyFlags : uint32_t {
     tfClearAccountCreateAmount = 0x00010000,
 };
 constexpr std::uint32_t tfBridgeModifyMask = ~(tfUniversal | tfClearAccountCreateAmount);
+
+// Export flags:
+enum ExportFlags : uint32_t {
+    // Lifecycle control: erase the named latch and forfeit any later callback.
+    tfExportEraseLatch = 0x00010000,
+    // Committee control: erase the named immutable committee object.
+    tfExportEraseCommittee = 0x00020000,
+};
+constexpr std::uint32_t tfExportMask =
+    ~(tfUniversal | tfExportEraseLatch | tfExportEraseCommittee);
+
 // clang-format on
 
 }  // namespace ripple

include/xrpl/protocol/TxMeta.h

@@ -176,7 +176,6 @@ private:
     std::optional<STAmount> mDelivered;
     std::optional<STArray> mHookExecutions;
     std::optional<STArray> mHookEmissions;
-
     STArray mNodes;
 };
 

include/xrpl/protocol/ValidatorBitset.h

@@ -0,0 +1,158 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright 2026 Xahau
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_PROTOCOL_VALIDATORBITSET_H_INCLUDED
+#define RIPPLE_PROTOCOL_VALIDATORBITSET_H_INCLUDED
+
+#include <xrpl/basics/Blob.h>
+#include <xrpl/basics/Slice.h>
+
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <utility>
+
+namespace ripple {
+
+class ValidatedValidatorBitset
+{
+    Blob bitset_;
+    std::size_t memberCount_ = 0;
+    std::size_t selected_ = 0;
+
+    ValidatedValidatorBitset(
+        Slice bitset,
+        std::size_t memberCount,
+        std::size_t selected)
+        : bitset_(bitset.begin(), bitset.end())
+        , memberCount_(memberCount)
+        , selected_(selected)
+    {
+    }
+
+public:
+    ValidatedValidatorBitset(ValidatedValidatorBitset const&) = default;
+    ValidatedValidatorBitset&
+    operator=(ValidatedValidatorBitset const&) = default;
+
+    ValidatedValidatorBitset(ValidatedValidatorBitset&& other) noexcept
+        : bitset_(std::move(other.bitset_))
+        , memberCount_(other.memberCount_)
+        , selected_(other.selected_)
+    {
+        other.bitset_.clear();
+        other.memberCount_ = 0;
+        other.selected_ = 0;
+    }
+
+    ValidatedValidatorBitset&
+    operator=(ValidatedValidatorBitset&& other) noexcept
+    {
+        if (this != &other)
+        {
+            bitset_ = std::move(other.bitset_);
+            memberCount_ = other.memberCount_;
+            selected_ = other.selected_;
+
+            other.bitset_.clear();
+            other.memberCount_ = 0;
+            other.selected_ = 0;
+        }
+        return *this;
+    }
+
+    /** Construct an owning, validated validator bitset. */
+    static std::optional<ValidatedValidatorBitset>
+    make(Slice bitset, std::size_t memberCount);
+
+    std::size_t
+    selected() const
+    {
+        return selected_;
+    }
+
+    bool
+    contains(std::size_t position) const
+    {
+        if (position >= memberCount_)
+            return false;
+
+        auto const byte = position / 8;
+        return (bitset_[byte] &
+                static_cast<std::uint8_t>(1u << (position % 8))) != 0;
+    }
+};
+
+constexpr std::size_t
+validatorBitsetBytes(std::size_t memberCount)
+{
+    return memberCount / 8 + (memberCount % 8 != 0);
+}
+
+/** Validate an LSB-first bitset over a fixed canonical validator universe.
+
+    A valid bitset has exactly enough bytes for the universe and leaves every
+    unused high bit in the final byte clear. The returned population can be
+    used by a caller's profile-specific admission and quorum rules.
+*/
+inline std::optional<ValidatedValidatorBitset>
+validateValidatorBitset(Slice bitset, std::size_t memberCount)
+{
+    return ValidatedValidatorBitset::make(bitset, memberCount);
+}
+
+inline std::optional<ValidatedValidatorBitset>
+ValidatedValidatorBitset::make(Slice bitset, std::size_t memberCount)
+{
+    if (bitset.size() != validatorBitsetBytes(memberCount))
+        return std::nullopt;
+
+    auto const remainder = memberCount % 8;
+    if (remainder != 0)
+    {
+        auto const allowed = static_cast<std::uint8_t>((1u << remainder) - 1u);
+        if ((bitset[bitset.size() - 1] & static_cast<std::uint8_t>(~allowed)) !=
+            0)
+            return std::nullopt;
+    }
+
+    std::size_t selected = 0;
+    for (auto const byte : bitset)
+        selected += std::popcount(byte);
+
+    return ValidatedValidatorBitset{bitset, memberCount, selected};
+}
+
+template <class Predicate>
+Blob
+makeValidatorBitset(std::size_t memberCount, Predicate&& selected)
+{
+    Blob bitset(validatorBitsetBytes(memberCount), 0);
+    for (std::size_t i = 0; i < memberCount; ++i)
+    {
+        if (selected(i))
+            bitset[i / 8] |= static_cast<std::uint8_t>(1u << (i % 8));
+    }
+    return bitset;
+}
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/detail/features.macro

@@ -23,6 +23,9 @@
 #if !defined(XRPL_FIX)
 #error "undefined macro: XRPL_FIX"
 #endif
+#if !defined(XRPL_RETIRE)
+#error "undefined macro: XRPL_RETIRE"
+#endif
 
 // clang-format off
 
@@ -31,6 +34,13 @@
 // If you add an amendment here, then do not forget to increment `numFeatures`
 // in include/xrpl/protocol/Feature.h.
 
+XRPL_FEATURE(OnChainManifests,           Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (HookMap,                    Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FIX    (GuardDepth32,               Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(NamedHooks,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(IOURewardClaim,             Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (IOULockedBalanceInvariant,  Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (ImportIssuer,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(HookAPISerializedType240,   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(PermissionedDomains,        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(DynamicNFT,                 Supported::no,  VoteBehavior::DefaultNo)
@@ -52,18 +62,21 @@ XRPL_FIX    (FillOrKill,                 Supported::yes, VoteBehavior::DefaultYe
 XRPL_FEATURE(DID,                        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (DisallowIncomingV1,         Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(XChainBridge,               Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(AMM,                        Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(AMM,                        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (ReducedOffersV1,            Supported::yes, VoteBehavior::DefaultYes)
-XRPL_FEATURE(HooksUpdate2,               Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FEATURE(HookOnV2,                   Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FIX    (HookAPI20251128,            Supported::yes, VoteBehavior::DefaultYes);
-XRPL_FIX    (CronStacking,               Supported::yes, VoteBehavior::DefaultYes);
-XRPL_FEATURE(ExtendedHookState,          Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FIX    (InvalidTxFlags,             Supported::yes, VoteBehavior::DefaultYes);
-XRPL_FEATURE(Cron,                       Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FEATURE(IOUIssuerWeakTSH,           Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FEATURE(DeepFreeze,                 Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FIX    (ProvisionalDoubleThreading, Supported::yes, VoteBehavior::DefaultYes);
+XRPL_FEATURE(HooksUpdate2,               Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(HookOnV2,                   Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(NegativeUNLActiveViewCap,   Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(Export,                     Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(ConsensusEntropy,           Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (HookAPI20251128,            Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FIX    (CronStacking,               Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(ExtendedHookState,          Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (InvalidTxFlags,             Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(Cron,                       Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(IOUIssuerWeakTSH,           Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(DeepFreeze,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (ProvisionalDoubleThreading, Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(Clawback,                   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (RewardClaimFlags,           Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(HookCanEmit,                Supported::yes, VoteBehavior::DefaultNo)
@@ -79,8 +92,6 @@ XRPL_FIX    (240819,                     Supported::yes, VoteBehavior::DefaultYe
 XRPL_FIX    (NSDelete,                   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ZeroB2M,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Remit,                      Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (XahauV2,                    Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (XahauV1,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(HooksUpdate1,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(XahauGenesis,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(Import,                     Supported::yes, VoteBehavior::DefaultYes)
@@ -147,4 +158,26 @@ XRPL_FIX    (NFTokenDirV1,          Supported::yes, VoteBehavior::Obsolete)
 XRPL_FEATURE(NonFungibleTokensV1,   Supported::yes, VoteBehavior::Obsolete)
 XRPL_FEATURE(CryptoConditionsSuite, Supported::yes, VoteBehavior::Obsolete)
 
+// The following amendments have been active for at least two years. Their
+// pre-amendment code has been removed and the identifiers are deprecated.
+// All known amendments and amendments that may appear in a validated
+// ledger must be registered either here or above with the "active" amendments
+XRPL_RETIRE(fixXahauV2)
+XRPL_RETIRE(fixXahauV1)
+XRPL_RETIRE(MultiSign)
+XRPL_RETIRE(TrustSetAuth)
+XRPL_RETIRE(FeeEscalation)
+XRPL_RETIRE(PayChan)
+XRPL_RETIRE(CryptoConditions)
+XRPL_RETIRE(TickSize)
+XRPL_RETIRE(fix1368)
+XRPL_RETIRE(Escrow)
+XRPL_RETIRE(fix1373)
+XRPL_RETIRE(EnforceInvariants)
+XRPL_RETIRE(SortedDirectories)
+XRPL_RETIRE(fix1201)
+XRPL_RETIRE(fix1512)
+XRPL_RETIRE(fix1523)
+XRPL_RETIRE(fix1528)
+
 // clang-format on

include/xrpl/protocol/detail/ledger_entries.macro

@@ -93,7 +93,7 @@ LEDGER_ENTRY(ltCHECK, 0x0043, Check, check, ({
 */
 LEDGER_ENTRY(ltHOOK_DEFINITION, 'D', HookDefinition, hook_definition, ({
     {sfHookHash,             soeREQUIRED},
-    {sfHookOn,               soeREQUIRED},
+    {sfHookOn,               soeOPTIONAL},
     {sfHookOnIncoming,       soeOPTIONAL},
     {sfHookOnOutgoing,       soeOPTIONAL},
     {sfHookCanEmit,          soeOPTIONAL},
@@ -223,6 +223,23 @@ LEDGER_ENTRY(ltURI_TOKEN, 0x0055, URIToken, uri_token, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
+/** The ledger object which stores consensus-derived entropy.
+
+    \note This is a singleton: only one such object exists in the ledger.
+
+    \sa keylet::consensusEntropy
+ */
+LEDGER_ENTRY_DUPLICATE(ltCONSENSUS_ENTROPY, 0x0058, ConsensusEntropy, consensus_entropy, ({
+    {sfDigest,               soeREQUIRED},
+    {sfEntropyCount,         soeREQUIRED},
+    {sfEntropyDenominator,   soeREQUIRED},
+    {sfEntropyContributors,  soeREQUIRED},
+    {sfEntropyTier,          soeREQUIRED},
+    {sfLedgerSequence,       soeREQUIRED},
+    {sfPreviousTxnID,        soeREQUIRED},
+    {sfPreviousTxnLgrSeq,    soeREQUIRED},
+}))
+
 /** A ledger object which describes an account.
 
     \sa keylet::account
@@ -257,11 +274,15 @@ LEDGER_ENTRY(ltACCOUNT_ROOT, 0x0061, AccountRoot, account, ({
     {sfImportSequence,       soeOPTIONAL},
     {sfGovernanceFlags,      soeOPTIONAL},
     {sfGovernanceMarks,      soeOPTIONAL},
+    //@@start account-index-optional-accountroot-field
     {sfAccountIndex,         soeOPTIONAL},
+    //@@end account-index-optional-accountroot-field
     {sfTouchCount,           soeOPTIONAL},
     {sfHookStateScale,       soeOPTIONAL},
     {sfCron,                 soeOPTIONAL},
     {sfAMMID,                soeOPTIONAL},
+    {sfExportCount,          soeOPTIONAL},
+    {sfManifestID,           soeOPTIONAL},
 }))
 
 /** A ledger object which contains a list of object identifiers.
@@ -277,6 +298,7 @@ LEDGER_ENTRY(ltDIR_NODE, 0x0064, DirectoryNode, directory, ({
     {sfTakerGetsIssuer,      soeOPTIONAL},  // order book directories
     {sfExchangeRate,         soeOPTIONAL},  // order book directories
     {sfReferenceCount,       soeOPTIONAL},  // for hook state directories
+    {sfExportCount,          soeOPTIONAL},  // live latches on Export root
     {sfIndexes,              soeREQUIRED},
     {sfRootIndex,            soeREQUIRED},
     {sfIndexNext,            soeOPTIONAL},
@@ -396,6 +418,8 @@ LEDGER_ENTRY(ltRIPPLE_STATE, 0x0072, RippleState, state, ({
     {sfHighQualityOut,       soeOPTIONAL},
     {sfLockedBalance,        soeOPTIONAL},
     {sfLockCount,            soeOPTIONAL},
+    {sfHighReward,           soeOPTIONAL},
+    {sfLowReward,            soeOPTIONAL},
 }))
 
 /** The ledger object which lists the network's fee settings.
@@ -415,7 +439,9 @@ LEDGER_ENTRY(ltFEE_SETTINGS, 0x0073, FeeSettings, fee, ({
     {sfReserveBaseDrops,       soeOPTIONAL},
     {sfReserveIncrementDrops,  soeOPTIONAL},
     {sfXahauActivationLgrSeq,  soeOPTIONAL},
+    //@@start account-count-optional-fees-field
     {sfAccountCount,           soeOPTIONAL},
+    //@@end account-count-optional-fees-field
     {sfNetworkID,              soeOPTIONAL},
     {sfPreviousTxnID,          soeOPTIONAL},
     {sfPreviousTxnLgrSeq,      soeOPTIONAL},
@@ -590,6 +616,55 @@ LEDGER_ENTRY(ltDID, 0x008D, DID, did, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
+//@@start export-latch-ledger-entry
+/** A live lifecycle latch for an Export intent.
+
+    Created when an Export intent is admitted. It records witness and
+    proof-of-execution arrival in either order and is erased once both facts
+    exist. Account-owned (pays reserve).
+    sfDigest stores the canonical target signing-intent hash.
+
+    \sa keylet::exportLatch
+ */
+LEDGER_ENTRY(ltEXPORT_LATCH, 0x5374, ExportLatch, export_latch, ({
+    {sfAccount,              soeREQUIRED},
+    {sfTicketSequence,       soeREQUIRED},
+    {sfTransactionHash,      soeOPTIONAL},
+    {sfDigest,               soeREQUIRED},
+    {sfLedgerSequence,       soeREQUIRED},
+    {sfExportCommitteeHash,  soeREQUIRED},
+    {sfExportSignatureHash,  soeOPTIONAL},
+    {sfLastLedgerSequence,   soeOPTIONAL},
+    {sfOwnerNode,            soeREQUIRED},
+    {sfExportNode,           soeOPTIONAL},
+}))
+//@@end export-latch-ledger-entry
+
+/** An immutable, account-owned Export validator committee. */
+LEDGER_ENTRY(ltEXPORT_COMMITTEE, 0x4563, ExportCommittee, export_committee, ({
+    {sfAccount,              soeREQUIRED},
+    {sfExportCommitteeHash,  soeREQUIRED},
+    {sfExportCommittee,      soeREQUIRED},
+    {sfOwnerNode,            soeREQUIRED},
+LEDGER_ENTRY(ltMANIFEST, 0x004D, Manifest, manifest_entry, ({
+    {sfAccount,             soeREQUIRED},
+    {sfPublicKey,           soeREQUIRED},
+    {sfSigningPubKey,       soeOPTIONAL}, /* may be absent if the master is revoked */
+    {sfSequence,            soeREQUIRED},
+    /* sfVersion defaults to 0 and is omitted from the signed payload when
+       absent. Storing it unconditionally would change the bytes and break
+       signature verification when the manifest is reconstructed. */
+    {sfVersion,             soeOPTIONAL},
+    {sfDomain,              soeOPTIONAL},
+    /* The signatures are mirrored so the object is a lossless copy of the
+       manifest and can be independently verified, and re-served to peers,
+       by any node reading it (see ManifestCache::applyLedger). */
+    {sfMasterSignature,     soeREQUIRED},
+    {sfSignature,           soeOPTIONAL}, /* absent if the master is revoked */
+    {sfManifestID,          soeOPTIONAL}, /* pointer to the identical other copy on the other key */
+    {sfPreviousTxnID,       soeREQUIRED},
+    {sfPreviousTxnLgrSeq,   soeREQUIRED},
+}))
+
 #undef EXPAND
 #undef LEDGER_ENTRY_DUPLICATE
-

include/xrpl/protocol/detail/sfields.macro

@@ -42,6 +42,8 @@ TYPED_SFIELD(sfTickSize,                 UINT8,     16)
 TYPED_SFIELD(sfUNLModifyDisabling,       UINT8,     17)
 TYPED_SFIELD(sfHookResult,               UINT8,     18)
 TYPED_SFIELD(sfWasLockingChainSend,      UINT8,     19)
+TYPED_SFIELD(sfSidecarType,              UINT8,     20)
+TYPED_SFIELD(sfEntropyTier,              UINT8,     21)
 
 // 16-bit integers (common)
 TYPED_SFIELD(sfLedgerEntryType,          UINT16,     1, SField::sMD_Never)
@@ -59,6 +61,10 @@ TYPED_SFIELD(sfHookExecutionIndex,       UINT16,    19)
 TYPED_SFIELD(sfHookApiVersion,           UINT16,    20)
 TYPED_SFIELD(sfHookStateScale,           UINT16,    21)
 TYPED_SFIELD(sfLedgerFixType,            UINT16,    22)
+TYPED_SFIELD(sfHookExportCount,          UINT16,    98)
+TYPED_SFIELD(sfEntropyCount,             UINT16,    99)
+TYPED_SFIELD(sfEntropyDenominator,       UINT16,   100)
+TYPED_SFIELD(sfExportCount,              UINT16,   101)
 
 // 32-bit integers (common)
 TYPED_SFIELD(sfNetworkID,                UINT32,     1)
@@ -153,6 +159,7 @@ TYPED_SFIELD(sfOutstandingAmount,        UINT64,    25, SField::sMD_BaseTen|SFie
 TYPED_SFIELD(sfMPTAmount,                UINT64,    26, SField::sMD_BaseTen|SField::sMD_Default)
 TYPED_SFIELD(sfIssuerNode,               UINT64,    27)
 TYPED_SFIELD(sfSubjectNode,              UINT64,    28)
+TYPED_SFIELD(sfExportNode,               UINT64,    29)
 TYPED_SFIELD(sfTouchCount,               UINT64,    97)
 TYPED_SFIELD(sfAccountIndex,             UINT64,    98)
 TYPED_SFIELD(sfAccountCount,             UINT64,    99)
@@ -210,6 +217,9 @@ TYPED_SFIELD(sfOfferID,                  UINT256,   34)
 TYPED_SFIELD(sfEscrowID,                 UINT256,   35)
 TYPED_SFIELD(sfURITokenID,               UINT256,   36)
 TYPED_SFIELD(sfDomainID,                 UINT256,   37)
+TYPED_SFIELD(sfExportSignatureHash,      UINT256,   38)
+TYPED_SFIELD(sfExportCommitteeHash,      UINT256,   39)
+TYPED_SFIELD(sfManifestID,               UINT256,   91)
 TYPED_SFIELD(sfHookOnOutgoing,           UINT256,   93)
 TYPED_SFIELD(sfHookOnIncoming,           UINT256,   94)
 TYPED_SFIELD(sfCron,                     UINT256,   95)
@@ -257,6 +267,7 @@ TYPED_SFIELD(sfPrice,                    AMOUNT,    28)
 TYPED_SFIELD(sfSignatureReward,          AMOUNT,    29)
 TYPED_SFIELD(sfMinAccountCreateAmount,   AMOUNT,    30)
 TYPED_SFIELD(sfLPTokenBalance,           AMOUNT,    31)
+TYPED_SFIELD(sfTrustLineRewardAccumulator,AMOUNT,   99)
 
 // variable length (common)
 TYPED_SFIELD(sfPublicKey,                VL,         1)
@@ -292,6 +303,10 @@ TYPED_SFIELD(sfAssetClass,               VL,        29)
 TYPED_SFIELD(sfProvider,                 VL,        30)
 TYPED_SFIELD(sfMPTokenMetadata,          VL,        31)
 TYPED_SFIELD(sfCredentialType,           VL,        32)
+TYPED_SFIELD(sfEntropyContributors,      VL,        33)
+TYPED_SFIELD(sfExportCommittee,          VL,        34)
+TYPED_SFIELD(sfExportContributors,       VL,        35)
+TYPED_SFIELD(sfHookName,                 VL,        97)
 TYPED_SFIELD(sfRemarkValue,              VL,        98)
 TYPED_SFIELD(sfRemarkName,               VL,        99)
 
@@ -340,6 +355,7 @@ TYPED_SFIELD(sfLockingChainIssue,        ISSUE,      1)
 TYPED_SFIELD(sfIssuingChainIssue,        ISSUE,      2)
 TYPED_SFIELD(sfAsset,                    ISSUE,      3)
 TYPED_SFIELD(sfAsset2,                   ISSUE,      4)
+TYPED_SFIELD(sfClaimCurrency,            ISSUE,      5)
 
 // bridge
 TYPED_SFIELD(sfXChainBridge,             XCHAIN_BRIDGE, 1)
@@ -362,12 +378,12 @@ UNTYPED_SFIELD(sfHook,                   OBJECT,    14)
 
 // inner object (uncommon)
 UNTYPED_SFIELD(sfSigner,                 OBJECT,    16)
-//                                                  17 unused
+UNTYPED_SFIELD(sfExportSigner,           OBJECT,    17)
 UNTYPED_SFIELD(sfMajority,               OBJECT,    18)
 UNTYPED_SFIELD(sfDisabledValidator,      OBJECT,    19)
 UNTYPED_SFIELD(sfEmittedTxn,             OBJECT,    20)
 UNTYPED_SFIELD(sfHookExecution,          OBJECT,    21)
-UNTYPED_SFIELD(sfHookDefinition,         OBJECT,    22)
+                                                 // 22 unused
 UNTYPED_SFIELD(sfHookParameter,          OBJECT,    23)
 UNTYPED_SFIELD(sfHookGrant,              OBJECT,    24)
 UNTYPED_SFIELD(sfVoteEntry,              OBJECT,    25)
@@ -379,6 +395,8 @@ UNTYPED_SFIELD(sfXChainClaimAttestationCollectionElement, OBJECT, 30)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestationCollectionElement, OBJECT, 31)
 UNTYPED_SFIELD(sfPriceData,              OBJECT,    32)
 UNTYPED_SFIELD(sfCredential,             OBJECT,    33)
+UNTYPED_SFIELD(sfExportedTxn,            OBJECT,    89)
+UNTYPED_SFIELD(sfManifest,               OBJECT,    90)
 UNTYPED_SFIELD(sfAmountEntry,            OBJECT,    91)
 UNTYPED_SFIELD(sfMintURIToken,           OBJECT,    92)
 UNTYPED_SFIELD(sfHookEmission,           OBJECT,    93)
@@ -386,6 +404,8 @@ UNTYPED_SFIELD(sfImportVLKey,            OBJECT,    94)
 UNTYPED_SFIELD(sfActiveValidator,        OBJECT,    95)
 UNTYPED_SFIELD(sfGenesisMint,            OBJECT,    96)
 UNTYPED_SFIELD(sfRemark,                 OBJECT,    97)
+UNTYPED_SFIELD(sfHighReward,             OBJECT,    98)
+UNTYPED_SFIELD(sfLowReward,              OBJECT,    99)
 
 // array of objects (common)
 // ARRAY/1 is reserved for end of array
@@ -410,7 +430,7 @@ UNTYPED_SFIELD(sfHookParameters,         ARRAY,     19)
 UNTYPED_SFIELD(sfHookGrants,             ARRAY,     20)
 UNTYPED_SFIELD(sfXChainClaimAttestations, ARRAY,    21)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestations, ARRAY, 22)
-//                                                  23 unused
+UNTYPED_SFIELD(sfExportSigners,          ARRAY,     23)
 UNTYPED_SFIELD(sfPriceDataSeries,        ARRAY,     24)
 UNTYPED_SFIELD(sfAuthAccounts,           ARRAY,     25)
 UNTYPED_SFIELD(sfAuthorizeCredentials,   ARRAY,     26)

include/xrpl/protocol/detail/transactions.macro

@@ -500,6 +500,22 @@ TRANSACTION(ttPERMISSIONED_DOMAIN_DELETE, 72, PermissionedDomainDelete, ({
     {sfDomainID, soeREQUIRED},
 }))
 
+//@@start export-transaction-types
+/* User-submittable Export. Its mutually exclusive forms create an intent,
+   control an existing latch, or manage an immutable committee object. */
+TRANSACTION(ttEXPORT, 90, Export, ({
+    {sfExportedTxn, soeOPTIONAL},
+    {sfTransactionHash, soeOPTIONAL},
+    {sfExportCommitteeHash, soeOPTIONAL},
+    {sfExportCommittee, soeOPTIONAL},
+}))
+//@@end export-transaction-types
+/* sfAccount is supplied by TxFormats::commonFields; listing it here as well
+   makes the SOTemplate reject the format at construction. */
+TRANSACTION(ttMANIFEST_SET, 91, SetManifest, ({
+    {sfManifest, soeREQUIRED},
+}))
+
 /* A pseudo-txn alarm signal for invoking a hook, emitted by validators after alarm set conditions are met */
 TRANSACTION(ttCRON, 92, Cron, ({
     {sfOwner, soeREQUIRED},
@@ -550,6 +566,7 @@ TRANSACTION(ttIMPORT, 97, Import, ({
   * from a specified hook */
 TRANSACTION(ttCLAIM_REWARD, 98, ClaimReward, ({
     {sfIssuer, soeOPTIONAL},
+    {sfClaimCurrency, soeOPTIONAL},
 }))
 
 /** This transaction invokes a hook, providing arbitrary data. Essentially as a 0 drop payment. **/
@@ -605,3 +622,20 @@ TRANSACTION(ttUNL_REPORT, 104, UNLReport, ({
     {sfActiveValidator, soeOPTIONAL},
     {sfImportVLKey, soeOPTIONAL},
 }))
+
+TRANSACTION(ttCONSENSUS_ENTROPY, 105, ConsensusEntropy, ({
+    {sfLedgerSequence, soeREQUIRED},
+    {sfDigest, soeREQUIRED},
+    {sfEntropyCount, soeREQUIRED},
+    {sfEntropyDenominator, soeREQUIRED},
+    {sfEntropyContributors, soeREQUIRED},
+    {sfEntropyTier, soeREQUIRED},
+}))
+
+TRANSACTION(ttEXPORT_SIGNATURES, 106, ExportSignatures, ({
+    {sfLedgerSequence, soeREQUIRED},
+    {sfTransactionHash, soeREQUIRED},
+    {sfExportedTxn, soeREQUIRED},
+    {sfExportContributors, soeREQUIRED},
+    {sfExportSigners, soeREQUIRED},
+}))

include/xrpl/protocol/jss.h

@@ -76,6 +76,7 @@ JSS(Holder);              // field.
 JSS(HookApiVersion);      // field
 JSS(HookCanEmit);         // field
 JSS(HookHash);            // field
+JSS(HookName);            // field
 JSS(HookNamespace);       // field
 JSS(HookOn);              // field
 JSS(HookOnIncoming);      // field
@@ -349,6 +350,7 @@ JSS(hash_mismatches);       // out: catalogue
 JSS(have_header);           // out: InboundLedger
 JSS(have_state);            // out: InboundLedger
 JSS(have_transactions);     // out: InboundLedger
+JSS(hooks);                 // in/out: AccountInfo
 JSS(high);                  // out: BookChanges
 JSS(highest_sequence);      // out: AccountInfo
 JSS(highest_ticket);        // out: AccountInfo
@@ -530,6 +532,9 @@ JSS(open_ledger_fee);         // out: TxQ
 JSS(open_ledger_level);       // out: TxQ
 JSS(oracles);                 // in: get_aggregate_price
 JSS(oracle_document_id);      // in: get_aggregate_price
+JSS(origin_ledger_hash);      // out: NetworkOPs
+JSS(origin_ledger_seq);       // out: NetworkOPs
+JSS(origin_txid);             // out: NetworkOPs
 JSS(owner);                   // in: LedgerEntry, out: NetworkOPs
 JSS(owner_funds);             // in/out: Ledger, NetworkOPs, AcceptedLedgerTx
 JSS(page_index);
@@ -651,6 +656,7 @@ JSS(state_now);               // in: Subscribe
 JSS(status);                  // error
 JSS(stop);                    // in: LedgerCleaner
 JSS(stop_history_tx_only);    // in: Unsubscribe, stop history tx stream
+JSS(stream);                  // out: NetworkOPs
 JSS(streams);                 // in: Subscribe, Unsubscribe
 JSS(strict);                  // in: AccountCurrencies, AccountInfo
 JSS(sub_index);               // in: LedgerEntry
@@ -732,6 +738,7 @@ JSS(TRANSACTION_FLAGS);     // out: RPC server_definitions
 JSS(TRANSACTION_FLAGS_INDICES);  // out: RPC server_definitions
 JSS(type_hex);                   // out: STPathSet
 JSS(unl);                        // out: UnlList
+JSS(committee_position);          // out: NetworkOPs
 JSS(unlimited);                  // out: Connection.h
 JSS(uptime);                     // out: GetCounts
 JSS(uri);                        // out: ValidatorSites

release-builder.sh

@@ -11,11 +11,11 @@ echo "START BUILDING (HOST)"
 echo "Cleaning previously built binary"
 rm -f release-build/xahaud
 
-BUILD_CORES=$(echo "scale=0 ; `nproc` / 1.337" | bc)
+BUILD_CORES=$(echo "scale=0 ; $(nproc) / 1.337" | bc)
 
 if [[ "$GITHUB_REPOSITORY" == "" ]]; then
   #Default
-  BUILD_CORES=${BUILD_CORES:-8} 
+  BUILD_CORES=${BUILD_CORES:-8}
 fi
 
 # Ensure still works outside of GH Actions by setting these to /dev/null
@@ -31,21 +31,19 @@ echo "-- GITHUB_SHA:        $GITHUB_SHA"
 echo "-- GITHUB_RUN_NUMBER: $GITHUB_RUN_NUMBER"
 echo "-- CONTAINER_NAME:    $CONTAINER_NAME"
 
-which docker 2> /dev/null 2> /dev/null
-if [ "$?" -eq "1" ]
-then
+which docker 2>/dev/null 2>/dev/null
+if [ "$?" -eq "1" ]; then
   echo 'Docker not found. Install it first.'
   exit 1
 fi
 
-stat .git 2> /dev/null 2> /dev/null
-if [ "$?" -eq "1" ]
-then
+stat .git 2>/dev/null 2>/dev/null
+if [ "$?" -eq "1" ]; then
   echo 'Run this inside the source directory. (.git dir not found).'
   exit 1
 fi
 
-STATIC_CONTAINER=$(docker ps -a | grep $CONTAINER_NAME |wc -l)
+STATIC_CONTAINER=$(docker ps -a | grep $CONTAINER_NAME | wc -l)
 
 CACHE_VOLUME_NAME="xahau-release-builder-cache"
 
@@ -57,13 +55,14 @@ if false; then
   docker stop $CONTAINER_NAME
 else
   echo "No static container, build on temp container"
-  rm -rf release-build;
-  mkdir -p release-build;
+  rm -rf release-build
+  mkdir -p release-build
 
   docker volume create $CACHE_VOLUME_NAME
 
   # Create inline Dockerfile with environment setup for build-full.sh
-  DOCKERFILE_CONTENT=$(cat <<'DOCKERFILE_EOF'
+  DOCKERFILE_CONTENT=$(
+    cat <<'DOCKERFILE_EOF'
 FROM ghcr.io/phusion/holy-build-box:4.0.1-amd64
 
 ARG BUILD_CORES=8
@@ -218,7 +217,7 @@ RUN /hbb_exe/activate-exec bash -c "ccache -M 100G && \
     ln -s ../../bin/ccache /usr/lib64/ccache/c++"
 
 DOCKERFILE_EOF
-)
+  )
 
   # Build custom Docker image
   IMAGE_NAME="xahaud-builder:latest"
@@ -228,14 +227,14 @@ DOCKERFILE_EOF
   if [[ "$GITHUB_REPOSITORY" == "" ]]; then
     # Non GH, local building
     echo "Non-GH runner, local building, temp container"
-    docker run -i --user 0:$(id -g) --rm -v /data/builds:/data/builds -v `pwd`:/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash -c "source /opt/rh/gcc-toolset-11/enable && bash -x /io/build-full.sh '$GITHUB_REPOSITORY' '$GITHUB_SHA' '$BUILD_CORES' '$GITHUB_RUN_NUMBER'"
+    docker run -i --user 0:$(id -g) --rm -v /data/builds:/data/builds -v $(pwd):/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash -c "source /opt/rh/gcc-toolset-11/enable && bash -x /io/build-full.sh '$GITHUB_REPOSITORY' '$GITHUB_SHA' '$BUILD_CORES' '$GITHUB_RUN_NUMBER'"
   else
     # GH Action, runner
     echo "GH Action, runner, clean & re-create create persistent container"
     docker rm -f $CONTAINER_NAME
-    echo "echo 'Stopping container: $CONTAINER_NAME'" >> "$JOB_CLEANUP_SCRIPT"
-    echo "docker stop --time=15 \"$CONTAINER_NAME\" || echo 'Failed to stop container or container not running'" >> "$JOB_CLEANUP_SCRIPT"
-    docker run -di --user 0:$(id -g) --name $CONTAINER_NAME -v /data/builds:/data/builds -v `pwd`:/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash
+    echo "echo 'Stopping container: $CONTAINER_NAME'" >>"$JOB_CLEANUP_SCRIPT"
+    echo "docker stop --time=15 \"$CONTAINER_NAME\" || echo 'Failed to stop container or container not running'" >>"$JOB_CLEANUP_SCRIPT"
+    docker run -di --user 0:$(id -g) --name $CONTAINER_NAME -v /data/builds:/data/builds -v $(pwd):/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash
     docker exec -i $CONTAINER_NAME /hbb_exe/activate-exec bash -c "source /opt/rh/gcc-toolset-11/enable && bash -x /io/build-full.sh '$GITHUB_REPOSITORY' '$GITHUB_SHA' '$BUILD_CORES' '$GITHUB_RUN_NUMBER'"
     docker stop $CONTAINER_NAME
   fi

src/libxrpl/basics/Log.cpp

@@ -31,6 +31,7 @@
 #include <cassert>
 #include <cstring>
 #include <ctime>
+#include <exception>
 #include <fstream>
 #include <functional>
 #include <iostream>
@@ -351,9 +352,18 @@ Logs::format(
 
     if (useLocalTime)
     {
-        auto now = std::chrono::system_clock::now();
-        auto local = date::make_zoned(date::current_zone(), now);
-        output = date::format(fmt, local);
+        try
+        {
+            auto now = std::chrono::system_clock::now();
+            auto local = date::make_zoned(date::current_zone(), now);
+            output = date::format(fmt, local);
+        }
+        catch (std::exception const&)
+        {
+            // Enhanced logging should not make startup fatal if tzdb lookup is
+            // unavailable or misconfigured. Fall back to UTC formatting.
+            output = date::format(fmt, std::chrono::system_clock::now());
+        }
     }
     else
     {

src/libxrpl/protocol/AMMCore.cpp

@@ -66,7 +66,7 @@ invalidAMMAsset(
     Issue const& issue,
     std::optional<std::pair<Issue, Issue>> const& pair)
 {
-    if (badCurrency() == issue.currency)
+    if (isBadCurrency(issue.currency))
         return temBAD_CURRENCY;
     if (isXRP(issue) && issue.account.isNonZero())
         return temBAD_ISSUER;

src/libxrpl/protocol/BuildInfo.cpp

@@ -56,9 +56,9 @@ getVersionString()
         (versionString == std::string("0.") + std::string("0.0") ||
          versionString == std::string("0.0.0+DEBUG")))
     {
-        std::string y = std::string(__DATE__ + 7);
+        std::string y = std::string(&__DATE__[7]);
         std::string d = std::string(
-            __DATE__ + 4 + (__DATE__[4] == ' ' ? 1 : 0),
+            &__DATE__[4 + (__DATE__[4] == ' ' ? 1 : 0)],
             __DATE__[4] == ' ' ? 1 : 2);
         std::string m;
         switch (__DATE__[0])

src/libxrpl/protocol/ExportOriginMemo.cpp

@@ -0,0 +1,211 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose with or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/protocol/ExportOriginMemo.h>
+#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/Serializer.h>
+
+#include <algorithm>
+#include <exception>
+#include <iterator>
+#include <string>
+
+namespace ripple::ExportOriginMemo {
+namespace {
+
+Blob const&
+memoTypeBytes()
+{
+    static Blob const value(memoType.begin(), memoType.end());
+    return value;
+}
+
+bool
+isReserved(STObject const& memo)
+{
+    return memo.getFName() == sfMemo && memo.isFieldPresent(sfMemoType) &&
+        memo.getFieldVL(sfMemoType) == memoTypeBytes();
+}
+
+STObject
+cloneObject(STTx const& tx)
+{
+    Serializer serializer;
+    tx.add(serializer);
+    SerialIter sit{serializer.slice()};
+    STObject result{sfGeneric};
+    result.set(sit);
+    return result;
+}
+
+Blob
+serialize(Origin const& origin, std::optional<Anchor> const& anchor)
+{
+    //@@start export-origin-memo-wire-format
+    Serializer serializer;
+    serializer.add8(version);
+    serializer.add8(allowedFlags);
+    serializer.add32(origin.sourceDomain);
+    serializer.add32(origin.targetDomain);
+    serializer.addBitString(origin.transactionHash);
+    if (anchor)
+    {
+        serializer.add32(anchor->ledgerSequence);
+        serializer.addBitString(anchor->ledgerHash);
+    }
+    return serializer.getData();
+    //@@end export-origin-memo-wire-format
+}
+
+Expected<STTx, Error>
+append(
+    STTx const& base,
+    Origin const& origin,
+    std::optional<Anchor> const& anchor)
+{
+    if (hasReservedMemo(base))
+        return Unexpected(Error::reservedMemoPresent);
+
+    //@@start export-origin-memo-canonical-append
+    auto object = cloneObject(base);
+    STArray memos = object.isFieldPresent(sfMemos)
+        ? object.getFieldArray(sfMemos)
+        : STArray{sfMemos};
+
+    STObject memo{sfMemo};
+    memo.setFieldVL(sfMemoType, memoTypeBytes());
+    memo.setFieldVL(sfMemoData, serialize(origin, anchor));
+    memos.emplace_back(std::move(memo));
+    object.setFieldArray(sfMemos, memos);
+
+    STTx result{std::move(object)};
+    std::string reason;
+    if (!passesLocalChecks(result, reason))
+        return Unexpected(Error::localChecks);
+    return result;
+    //@@end export-origin-memo-canonical-append
+}
+
+Expected<Stamp, Error>
+parseData(Blob const& data)
+{
+    if (data.size() != identityBytes && data.size() != releaseBytes)
+        return Unexpected(Error::malformedMemo);
+
+    try
+    {
+        SerialIter sit{makeSlice(data)};
+        if (sit.get8() != version)
+            return Unexpected(Error::unsupportedVersion);
+        if (sit.get8() != allowedFlags)
+            return Unexpected(Error::unsupportedFlags);
+
+        Stamp stamp{
+            .origin =
+                Origin{
+                    .sourceDomain = sit.get32(),
+                    .targetDomain = sit.get32(),
+                    .transactionHash = sit.get256()},
+            .anchor = std::nullopt};
+
+        if (data.size() == releaseBytes)
+            stamp.anchor = Anchor{sit.get32(), sit.get256()};
+        if (!sit.empty())
+            return Unexpected(Error::malformedMemo);
+        return stamp;
+    }
+    catch (std::exception const&)
+    {
+        return Unexpected(Error::malformedMemo);
+    }
+}
+
+}  // namespace
+
+bool
+hasReservedMemo(STTx const& tx)
+{
+    if (!tx.isFieldPresent(sfMemos))
+        return false;
+
+    auto const& memos = tx.getFieldArray(sfMemos);
+    return std::any_of(memos.begin(), memos.end(), isReserved);
+}
+
+Expected<STTx, Error>
+identityForm(STTx const& base, Origin const& origin)
+{
+    return append(base, origin, std::nullopt);
+}
+
+Expected<STTx, Error>
+releaseForm(STTx const& base, Origin const& origin, Anchor const& anchor)
+{
+    return append(base, origin, anchor);
+}
+
+Expected<Stamp, Error>
+parse(STTx const& tx)
+{
+    std::string reason;
+    if (!passesLocalChecks(tx, reason))
+        return Unexpected(Error::localChecks);
+    if (!tx.isFieldPresent(sfMemos))
+        return Unexpected(Error::reservedMemoMissing);
+
+    auto const& memos = tx.getFieldArray(sfMemos);
+    auto found = memos.end();
+    for (auto it = memos.begin(); it != memos.end(); ++it)
+    {
+        if (!isReserved(*it))
+            continue;
+        if (found != memos.end())
+            return Unexpected(Error::reservedMemoPosition);
+        found = it;
+    }
+
+    if (found == memos.end())
+        return Unexpected(Error::reservedMemoMissing);
+    if (found != std::prev(memos.end()))
+        return Unexpected(Error::reservedMemoPosition);
+    if (found->isFieldPresent(sfMemoFormat) ||
+        !found->isFieldPresent(sfMemoData))
+        return Unexpected(Error::malformedMemo);
+
+    return parseData(found->getFieldVL(sfMemoData));
+}
+
+Expected<STTx, Error>
+projectIdentity(STTx const& stamped)
+{
+    auto parsed = parse(stamped);
+    if (!parsed)
+        return Unexpected(parsed.error());
+
+    auto object = cloneObject(stamped);
+    auto memos = object.getFieldArray(sfMemos);
+    memos.erase(std::prev(memos.end()));
+    if (memos.empty())
+        object.delField(sfMemos);
+    else
+        object.setFieldArray(sfMemos, memos);
+
+    return identityForm(STTx{std::move(object)}, parsed.value().origin);
+}
+
+}  // namespace ripple::ExportOriginMemo

src/libxrpl/protocol/Feature.cpp

@@ -250,12 +250,9 @@ FeatureCollections::registerFeature(
     Feature const* i = getByName(name);
     if (!i)
     {
-        // If this check fails, and you just added a feature, increase the
-        // numFeatures value in Feature.h
         check(
             features.size() < detail::numFeatures,
-            "More features defined than allocated. Adjust numFeatures in "
-            "Feature.h.");
+            "More features defined than allocated.");
 
         auto const f = sha512Half(Slice(name.data(), name.size()));
 
@@ -424,45 +421,26 @@ featureToName(uint256 const& f)
 #undef XRPL_FEATURE
 #pragma push_macro("XRPL_FIX")
 #undef XRPL_FIX
+#pragma push_macro("XRPL_RETIRE")
+#undef XRPL_RETIRE
 
 #define XRPL_FEATURE(name, supported, vote) \
     uint256 const feature##name = registerFeature(#name, supported, vote);
 #define XRPL_FIX(name, supported, vote) \
     uint256 const fix##name = registerFeature("fix" #name, supported, vote);
+#define XRPL_RETIRE(name)                                                     \
+    [[deprecated("The referenced amendment has been retired"), maybe_unused]] \
+    uint256 const retired##name = retireFeature(#name);
 
 #include <xrpl/protocol/detail/features.macro>
 
+#undef XRPL_RETIRE
+#pragma pop_macro("XRPL_RETIRE")
 #undef XRPL_FIX
 #pragma pop_macro("XRPL_FIX")
 #undef XRPL_FEATURE
 #pragma pop_macro("XRPL_FEATURE")
 
-// clang-format off
-
-// The following amendments have been active for at least two years. Their
-// pre-amendment code has been removed and the identifiers are deprecated.
-// All known amendments and amendments that may appear in a validated
-// ledger must be registered either here or above with the "active" amendments
-[[deprecated("The referenced amendment has been retired"), maybe_unused]]
-uint256 const
-    retiredMultiSign         = retireFeature("MultiSign"),
-    retiredTrustSetAuth      = retireFeature("TrustSetAuth"),
-    retiredFeeEscalation     = retireFeature("FeeEscalation"),
-    retiredPayChan           = retireFeature("PayChan"),
-    retiredCryptoConditions  = retireFeature("CryptoConditions"),
-    retiredTickSize          = retireFeature("TickSize"),
-    retiredFix1368           = retireFeature("fix1368"),
-    retiredEscrow            = retireFeature("Escrow"),
-    retiredFix1373           = retireFeature("fix1373"),
-    retiredEnforceInvariants = retireFeature("EnforceInvariants"),
-    retiredSortedDirectories = retireFeature("SortedDirectories"),
-    retiredFix1201           = retireFeature("fix1201"),
-    retiredFix1512           = retireFeature("fix1512"),
-    retiredFix1523           = retireFeature("fix1523"),
-    retiredFix1528           = retireFeature("fix1528");
-
-// clang-format on
-
 // All of the features should now be registered, since variables in a cpp file
 // are initialized from top to bottom.
 //

src/libxrpl/protocol/Indexes.cpp

@@ -31,6 +31,8 @@
 
 namespace ripple {
 
+#define LEDGER_NAMESPACE2(value1, value2) (uint16_t(value1) << 8) | value2
+
 /** Type-specific prefix for calculating ledger indices.
 
     The identifier for a given object within the ledger is calculated based
@@ -72,6 +74,9 @@ enum class LedgerNameSpace : std::uint16_t {
     HOOK_DEFINITION = 'D',
     EMITTED_TXN = 'E',
     EMITTED_DIR = 'F',
+    EXPORT_LATCH = 0x5374,        // St
+    EXPORT_COMMITTEE = 0x4563,    // Ec
+    EXPORT_PENDING_DIR = 0x4570,  // Ep
     NFTOKEN_OFFER = 'q',
     NFTOKEN_BUY_OFFERS = 'h',
     NFTOKEN_SELL_OFFERS = 'i',
@@ -79,15 +84,17 @@ enum class LedgerNameSpace : std::uint16_t {
     IMPORT_VLSEQ = 'I',
     UNL_REPORT = 'R',
     CRON = 'L',
+    CONSENSUS_ENTROPY = 'X',
     AMM = 'A',
-    BRIDGE = 'H',
+    BRIDGE = LEDGER_NAMESPACE2(0x01, 'H'),
     XCHAIN_CLAIM_ID = 'Q',
     XCHAIN_CREATE_ACCOUNT_CLAIM_ID = 'K',
-    DID = 'I',
-    ORACLE = 'R',
+    DID = LEDGER_NAMESPACE2(0x01, 'I'),
+    ORACLE = LEDGER_NAMESPACE2(0x01, 'R'),
     MPTOKEN_ISSUANCE = '~',
     MPTOKEN = 't',
-    CREDENTIAL = 'D',
+    MANIFEST = 'M',
+    CREDENTIAL = LEDGER_NAMESPACE2(0x01, 'D'),
     PERMISSIONED_DOMAIN = 'm',
 
     // No longer used or supported. Left here to reserve the space
@@ -186,6 +193,34 @@ emittedTxn(uint256 const& id) noexcept
     return {ltEMITTED_TXN, indexHash(LedgerNameSpace::EMITTED_TXN, id)};
 }
 
+//@@start export-origin-keylet
+Keylet
+exportLatch(AccountID const& account, uint256 const& originTxnHash) noexcept
+{
+    return {
+        ltEXPORT_LATCH,
+        indexHash(LedgerNameSpace::EXPORT_LATCH, account, originTxnHash)};
+}
+//@@end export-origin-keylet
+
+Keylet
+exportCommittee(AccountID const& account, uint256 const& digest) noexcept
+{
+    return {
+        ltEXPORT_COMMITTEE,
+        indexHash(LedgerNameSpace::EXPORT_COMMITTEE, account, digest)};
+}
+
+//@@start export-pending-directory-keylet
+Keylet const&
+pendingExports() noexcept
+{
+    static Keylet const ret{
+        ltDIR_NODE, indexHash(LedgerNameSpace::EXPORT_PENDING_DIR)};
+    return ret;
+}
+//@@end export-pending-directory-keylet
+
 Keylet
 hook(AccountID const& id) noexcept
 {
@@ -544,6 +579,14 @@ cron(uint32_t timestamp, std::optional<AccountID> const& id)
     return {ltCRON, uint256::fromVoid(h)};
 }
 
+Keylet const&
+consensusEntropy() noexcept
+{
+    static Keylet const ret{
+        ltCONSENSUS_ENTROPY, indexHash(LedgerNameSpace::CONSENSUS_ENTROPY)};
+    return ret;
+}
+
 Keylet
 amm(Asset const& issue1, Asset const& issue2) noexcept
 {
@@ -668,6 +711,12 @@ permissionedDomain(uint256 const& domainID) noexcept
     return {ltPERMISSIONED_DOMAIN, domainID};
 }
 
+Keylet
+manifest(PublicKey const& pk) noexcept
+{
+    return {ltMANIFEST, indexHash(LedgerNameSpace::MANIFEST, pk.slice())};
+}
+
 }  // namespace keylet
 
 }  // namespace ripple

src/libxrpl/protocol/InnerObjectFormats.cpp

@@ -53,6 +53,13 @@ InnerObjectFormats::InnerObjectFormats()
             {sfTxnSignature, soeREQUIRED},
         });
 
+    add(sfExportSigner.jsonName,
+        sfExportSigner.getCode(),
+        {
+            {sfSigningPubKey, soeREQUIRED},
+            {sfTxnSignature, soeREQUIRED},
+        });
+
     add(sfMajority.jsonName,
         sfMajority.getCode(),
         {
@@ -78,6 +85,7 @@ InnerObjectFormats::InnerObjectFormats()
          {sfHookExecutionIndex, soeREQUIRED},
          {sfHookStateChangeCount, soeREQUIRED},
          {sfHookEmitCount, soeREQUIRED},
+         {sfHookExportCount, soeOPTIONAL},
          {sfFlags, soeOPTIONAL}});
 
     add(sfHookEmission.jsonName,
@@ -87,19 +95,6 @@ InnerObjectFormats::InnerObjectFormats()
          {sfEmittedTxnID, soeREQUIRED},
          {sfEmitNonce, soeOPTIONAL}});
 
-    add(sfHookDefinition.jsonName,
-        sfHookDefinition.getCode(),
-        {{sfCreateCode, soeREQUIRED},
-         {sfHookNamespace, soeREQUIRED},
-         {sfHookParameters, soeREQUIRED},
-         {sfHookOn, soeOPTIONAL},
-         {sfHookOnIncoming, soeOPTIONAL},
-         {sfHookOnOutgoing, soeOPTIONAL},
-         {sfHookCanEmit, soeOPTIONAL},
-         {sfHookApiVersion, soeREQUIRED},
-         {sfFlags, soeREQUIRED},
-         {sfFee, soeREQUIRED}});
-
     add(sfHook.jsonName,
         sfHook.getCode(),
         {{sfHookHash, soeOPTIONAL},
@@ -112,6 +107,7 @@ InnerObjectFormats::InnerObjectFormats()
          {sfHookOnOutgoing, soeOPTIONAL},
          {sfHookCanEmit, soeOPTIONAL},
          {sfHookApiVersion, soeOPTIONAL},
+         {sfHookName, soeOPTIONAL},
          {sfFlags, soeOPTIONAL}});
 
     add(sfHookGrant.jsonName,
@@ -266,6 +262,24 @@ InnerObjectFormats::InnerObjectFormats()
             {sfIssuer, soeREQUIRED},
             {sfCredentialType, soeREQUIRED},
         });
+
+    add(sfHighReward.jsonName,
+        sfHighReward.getCode(),
+        {
+            {sfRewardLgrFirst, soeREQUIRED},
+            {sfRewardLgrLast, soeREQUIRED},
+            {sfRewardTime, soeREQUIRED},
+            {sfTrustLineRewardAccumulator, soeREQUIRED},
+        });
+
+    add(sfLowReward.jsonName,
+        sfLowReward.getCode(),
+        {
+            {sfRewardLgrFirst, soeREQUIRED},
+            {sfRewardLgrLast, soeREQUIRED},
+            {sfRewardTime, soeREQUIRED},
+            {sfTrustLineRewardAccumulator, soeREQUIRED},
+        });
 }
 
 InnerObjectFormats const&

src/libxrpl/protocol/Issue.cpp

@@ -111,7 +111,7 @@ issueFromJson(Json::Value const& v)
     }
 
     auto const currency = to_currency(curStr.asString());
-    if (currency == badCurrency() || currency == noCurrency())
+    if (isBadCurrency(currency) || currency == noCurrency())
     {
         Throw<Json::error>("issueFromJson currency must be a valid currency");
     }

src/libxrpl/protocol/STCurrency.cpp

@@ -103,7 +103,7 @@ currencyFromJson(SField const& name, Json::Value const& v)
     }
 
     auto const currency = to_currency(v.asString());
-    if (currency == badCurrency() || currency == noCurrency())
+    if (isBadCurrency(currency) || currency == noCurrency())
     {
         Throw<std::runtime_error>(
             "currencyFromJson currency must be a valid currency");

src/libxrpl/protocol/STTx.cpp

@@ -684,7 +684,8 @@ isPseudoTx(STObject const& tx)
 
     auto tt = safe_cast<TxType>(*t);
     return tt == ttAMENDMENT || tt == ttFEE || tt == ttUNL_MODIFY ||
-        tt == ttEMIT_FAILURE || tt == ttUNL_REPORT || tt == ttCRON;
+        tt == ttEMIT_FAILURE || tt == ttUNL_REPORT || tt == ttCRON ||
+        tt == ttCONSENSUS_ENTROPY || tt == ttEXPORT_SIGNATURES;
 }
 
 }  // namespace ripple