fix: take stoppingMutex_ in ApplicationImp::signalStop so the stop notify cannot be lost

Co-authored-by: Niq Dudfield <[email protected]>

.codecov.yml

@@ -19,6 +19,15 @@ coverage:
       default:
         target: auto
         threshold: 2%
+        paths:
+          # PeerImp is historically hard to exercise in the current unit-test
+          # harness. Keep this list narrow; new testable code should remain
+          # covered by the default patch gate.
+          - "!src/xrpld/overlay/detail/PeerImp.cpp"
+      historically-untested:
+        target: 0%
+        paths:
+          - "src/xrpld/overlay/detail/PeerImp.cpp"
     changes: false
 
 github_checks:

.github/actions/xahau-ga-dependencies/action.yml

@@ -50,6 +50,10 @@ inputs:
     options:
       - libstdcxx
       - libcxx
+  conan_deps_cxxflags:
+    description: 'Extra cxxflags applied to Conan dependency package builds only (NOT the rippled build). JSON object keyed by Conan package pattern, e.g. {"grpc/*":["-Wno-foo"]}. Maps to <pattern>:tools.build:cxxflags.'
+    required: false
+    default: '{}'
 
 outputs:
   cache-hit:
@@ -81,6 +85,8 @@ runs:
 
     - name: Configure Conan
       shell: bash
+      env:
+        CONAN_DEPS_CXXFLAGS: ${{ inputs.conan_deps_cxxflags }}
       run: |
         # Create the default profile directory if it doesn't exist
         mkdir -p ~/.conan2/profiles
@@ -105,7 +111,14 @@ runs:
         os=${{ inputs.os }}
         EOF
 
-        # Add buildenv and conf sections for Linux (not needed for macOS)
+        # [buildenv] + [conf] sections.
+        # Linux pins compiler executables; macOS uses the system toolchain.
+        # conan_deps_cxxflags (matrix-driven) optionally adds package-pattern
+        # scoped tools.build:cxxflags for Conan dependency builds only - typically
+        # grpc workarounds for newer clang's stricter diagnostics. Because these
+        # are profile-pattern scoped (e.g. grpc/*:...), they do NOT affect the
+        # consumer/rippled toolchain generated for the main build.
+        NEED_CONF=0
         if [ "${{ inputs.os }}" = "Linux" ] && [ -n "${{ inputs.cc }}" ]; then
           cat >> ~/.conan2/profiles/default <<EOF
 
@@ -116,16 +129,38 @@ runs:
         [conf]
         tools.build:compiler_executables={"c": "/usr/bin/${{ inputs.cc }}", "cpp": "/usr/bin/${{ inputs.cxx }}"}
         EOF
+          NEED_CONF=1
         fi
 
-        # Add macOS-specific conf if needed
-        if [ "${{ inputs.os }}" = "Macos" ]; then
-          cat >> ~/.conan2/profiles/default <<EOF
+        if [ -n "${CONAN_DEPS_CXXFLAGS}" ] && [ "${CONAN_DEPS_CXXFLAGS}" != "{}" ]; then
+          CONAN_DEPS_CXXFLAGS_LINES="$(python3 - <<'PY'
+        import json
+        import os
+        import sys
 
-        [conf]
-        # Workaround for gRPC with newer Apple Clang
-        tools.build:cxxflags=["-Wno-missing-template-arg-list-after-template-kw"]
-        EOF
+        raw = os.environ["CONAN_DEPS_CXXFLAGS"]
+        data = json.loads(raw)
+        if not isinstance(data, dict):
+            sys.exit("conan_deps_cxxflags must be a JSON object like {\"grpc/*\": [\"-Wno-...\"]}")
+
+        for pattern, flags in data.items():
+            if not isinstance(pattern, str) or not pattern:
+                sys.exit("conan_deps_cxxflags keys must be non-empty Conan package patterns")
+            if pattern == "&":
+                sys.exit("conan_deps_cxxflags must target dependency package patterns, not the consumer (&)")
+            if not isinstance(flags, list) or not all(isinstance(flag, str) for flag in flags):
+                sys.exit(f"{pattern}: cxxflags must be a JSON string list")
+            if flags:
+                print(f"{pattern}:tools.build:cxxflags={json.dumps(flags, separators=(',', ':'))}")
+        PY
+          )"
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ] && [ "$NEED_CONF" = "0" ]; then
+            echo "" >> ~/.conan2/profiles/default
+            echo "[conf]" >> ~/.conan2/profiles/default
+          fi
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ]; then
+            printf '%s\n' "${CONAN_DEPS_CXXFLAGS_LINES}" >> ~/.conan2/profiles/default
+          fi
         fi
 
         # Display profile for verification

.github/workflows/build-in-docker.yml

@@ -15,6 +15,9 @@ env:
 
 jobs:
   checkout:
+    # build publishes to build.xahau.tech, so this workflow only runs from
+    # Xahau/xahaud. build and tests are skipped along with this job.
+    if: github.repository == 'Xahau/xahaud'
     runs-on: [self-hosted, vanity]
     outputs:
       checkout_path: ${{ steps.vars.outputs.checkout_path }}
@@ -86,10 +89,16 @@ jobs:
   cleanup:
     runs-on: [self-hosted, xahaud-build]
     needs: [tests, checkout]
-    if: always()
+    if: always() && github.repository == 'Xahau/xahaud'
     steps:
       - name: Cleanup workspace
         run: |
           CHECKOUT_PATH="${{ needs.checkout.outputs.checkout_path }}"
+          # A run cancelled before checkout has no path; an empty one would
+          # make the rm below delete every run's checkout on the runner.
+          if [[ -z "${CHECKOUT_PATH}" ]]; then
+            echo "No checkout path (cancelled before checkout); nothing to clean"
+            exit 0
+          fi
           echo "Cleaning workspace for ${CHECKOUT_PATH}"
           rm -rf "${{ github.workspace }}/${CHECKOUT_PATH}"

.github/workflows/xahau-ga-macos.yml

@@ -107,6 +107,9 @@ jobs:
           compiler: apple-clang
           compiler_version: ${{ steps.detect-compiler.outputs.compiler_version }}
           stdlib: libcxx
+          # grpc 1.50.1 trips clang-19+ -Werror=missing-template-arg-list-after-template-kw
+          # on Apple Clang. Drop when grpc is bumped past the fix.
+          conan_deps_cxxflags: '{"grpc/*":["-Wno-missing-template-arg-list-after-template-kw"]}'
 
       - name: Build
         uses: ./.github/actions/xahau-ga-build

.github/workflows/xahau-ga-nix.yml

@@ -8,12 +8,6 @@ on:
     types: [opened, synchronize, reopened, labeled, unlabeled]
   schedule:
     - cron: '0 0 * * *'
-  workflow_dispatch:
-    inputs:
-      full_matrix:
-        description: "Force full matrix (6 configs)"
-        required: false
-        default: "false"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,37 +24,14 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - name: escape double quotes
-        id: escape
-        shell: bash
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          ESCAPED_PR_TITLE="${PR_TITLE//\"/\\\"}"
-          echo "title=${ESCAPED_PR_TITLE}" >> "$GITHUB_OUTPUT"
       - name: Generate build matrix
         id: set-matrix
         shell: python
-        env:
-          GH_TOKEN: ${{ github.token }}
         run: |
           import json
           import os
-          import urllib.request
 
-          # Full matrix with all 6 compiler configurations
-          # Each configuration includes all parameters needed by the build job
-          full_matrix = [
-              {
-                  "compiler_id": "gcc-11-libstdcxx",
-                  "compiler": "gcc",
-                  "cc": "gcc-11",
-                  "cxx": "g++-11",
-                  "compiler_version": 11,
-                  "stdlib": "default",
-                  "configuration": "Debug",
-                  "job_type": "build"
-              },
+          matrix = [
               {
                   "compiler_id": "gcc-13-libstdcxx",
                   "compiler": "gcc",
@@ -72,26 +43,26 @@ jobs:
                   "job_type": "build"
               },
               {
-                  "compiler_id": "gcc-13-libstdcxx",
-                  "compiler": "gcc",
-                  "cc": "gcc-13",
-                  "cxx": "g++-13",
-                  "gcov": "gcov-13",
-                  "compiler_version": 13,
-                  "stdlib": "default",
-                  "configuration": "Debug",
-                  "job_type": "coverage"
-              },
-              {
-                  "compiler_id": "clang-14-libstdcxx-gcc11",
+                  # Latest stable Clang for the most accurate source-based
+                  # coverage mapping (newer language features, fewer bugs in
+                  # llvm-cov region inference). Pulled from apt.llvm.org since
+                  # Ubuntu 24.04 default repos cap at clang-18.
+                  "compiler_id": "clang-20-libcxx",
                   "compiler": "clang",
-                  "cc": "clang-14",
-                  "cxx": "clang++-14",
-                  "compiler_version": 14,
-                  "stdlib": "libstdcxx",
-                  "clang_gcc_toolchain": 11,
+                  "cc": "clang-20",
+                  "cxx": "clang++-20",
+                  "compiler_version": 20,
+                  "stdlib": "libcxx",
                   "configuration": "Debug",
-                  "job_type": "build"
+                  "job_type": "coverage",
+                  "coverage_tool": "llvm",
+                  "coverage_format": "lcov",
+                  # grpc 1.50.1 uses `Foo::template Bar(...)` without an
+                  # angle-bracket arg list; clang-19+ promoted that to
+                  # -Werror. Drop when grpc is bumped past the fix.
+                  "conan_deps_cxxflags": {
+                      "grpc/*": ["-Wno-missing-template-arg-list-after-template-kw"]
+                  }
               },
               {
                   "compiler_id": "clang-16-libstdcxx-gcc13",
@@ -103,117 +74,8 @@ jobs:
                   "clang_gcc_toolchain": 13,
                   "configuration": "Debug",
                   "job_type": "build"
-              },
-              {
-                  "compiler_id": "clang-17-libcxx",
-                  "compiler": "clang",
-                  "cc": "clang-17",
-                  "cxx": "clang++-17",
-                  "compiler_version": 17,
-                  "stdlib": "libcxx",
-                  "configuration": "Debug",
-                  "job_type": "build"
-              },
-              {
-                  # Clang 18 - testing if it's faster than Clang 17 with libc++
-                  # Requires patching Conan v1 settings.yml to add version 18
-                  "compiler_id": "clang-18-libcxx",
-                  "compiler": "clang",
-                  "cc": "clang-18",
-                  "cxx": "clang++-18",
-                  "compiler_version": 18,
-                  "stdlib": "libcxx",
-                  "configuration": "Debug",
-                  "job_type": "build"
               }
           ]
-          
-          # Minimal matrix for PRs and feature branches
-          minimal_matrix = [
-              full_matrix[1],  # gcc-13 (middle-ground gcc)
-              full_matrix[2],  # gcc-13 coverage
-              full_matrix[3]   # clang-14 (mature, stable clang)
-          ]
-          
-          # Determine which matrix to use based on the target branch
-          ref = "${{ github.ref }}"
-          base_ref = "${{ github.base_ref }}"  # For PRs, this is the target branch
-          event_name = "${{ github.event_name }}"
-          pr_title = """${{ steps.escape.outputs.title }}"""
-          pr_labels = """${{ join(github.event.pull_request.labels.*.name, ',') }}"""
-          pr_head_sha = "${{ github.event.pull_request.head.sha }}"
-
-          # Get commit message - for PRs, fetch via API since head_commit.message is empty
-          if event_name == "pull_request" and pr_head_sha:
-              try:
-                  url = f"https://api.github.com/repos/${{ github.repository }}/commits/{pr_head_sha}"
-                  req = urllib.request.Request(url, headers={
-                      "Accept": "application/vnd.github.v3+json",
-                      "Authorization": f"Bearer {os.environ.get('GH_TOKEN', '')}"
-                  })
-                  with urllib.request.urlopen(req) as response:
-                      data = json.load(response)
-                      commit_message = data["commit"]["message"]
-              except Exception as e:
-                  print(f"Failed to fetch commit message: {e}")
-                  commit_message = ""
-          else:
-              commit_message = """${{ github.event.head_commit.message }}"""
-
-          # Debug logging
-          print(f"Event: {event_name}")
-          print(f"Ref: {ref}")
-          print(f"Base ref: {base_ref}")
-          print(f"PR head SHA: {pr_head_sha}")
-          print(f"PR title: {pr_title}")
-          print(f"PR labels: {pr_labels}")
-          print(f"Commit message: {commit_message}")
-          
-          # Manual trigger input to force full matrix.
-          manual_full = "${{ github.event.inputs.full_matrix || 'false' }}" == "true"
-
-          # Label/manual overrides, while preserving existing title/commit behavior.
-          force_full = (
-              manual_full
-              or "[ci-nix-full-matrix]" in commit_message
-              or "[ci-nix-full-matrix]" in pr_title
-              or ("ci-full-build" in pr_labels and "ci-nix-full-matrix" in pr_labels)
-          )
-          force_min = (
-              "ci-full-build" in pr_labels
-          )
-          print(f"Force full matrix: {force_full}")
-          print(f"Force min matrix: {force_min}")
-          
-          # Check if this is targeting a main branch
-          # For PRs: check base_ref (target branch)
-          # For pushes: check ref (current branch)
-          main_branches = ["refs/heads/dev", "refs/heads/release", "refs/heads/candidate"]
-          
-          if force_full:
-              # Override: always use full matrix if forced by manual input or label.
-              use_full = True
-          elif force_min:
-              # Override: always use minimal matrix if ci-full-build label is present.
-              use_full = False
-          elif event_name == "pull_request":
-              # For PRs, base_ref is just the branch name (e.g., "dev", not "refs/heads/dev")
-              # Check if the PR targets release or candidate (more critical branches)
-              use_full = base_ref in ["release", "candidate"]
-          else:
-              # For pushes, ref is the full reference (e.g., "refs/heads/dev")
-              use_full = ref in main_branches
-          
-          # Select the appropriate matrix
-          if use_full:
-              if force_full:
-                  print(f"Using FULL matrix (7 configs) - forced by [ci-nix-full-matrix] tag")
-              else:
-                  print(f"Using FULL matrix (7 configs) - targeting main branch")
-              matrix = full_matrix
-          else:
-              print(f"Using MINIMAL matrix (3 configs) - feature branch/PR")
-              matrix = minimal_matrix
 
           # Add runs_on based on job_type
           for entry in matrix:
@@ -235,6 +97,8 @@ jobs:
       contents: read
     container:
       image: ubuntu:24.04
+      # [DO NOT MERGE] diagnostic: allow gdb/eu-stack to attach to hung test children
+      options: --cap-add=SYS_PTRACE
       volumes:
         - /home/runner/.conan-cache:/.conan-cache
         - /home/runner/.ccache-cache:/github/home/.ccache-cache
@@ -257,9 +121,25 @@ jobs:
 
       - name: Install build dependencies
         run: |
+          # Bump apt's default 3 retries; papers over short upstream blips
+          # like the recurring ppa.launchpadcontent.net outages.
+          echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
           apt-get update
           apt-get install -y software-properties-common
           add-apt-repository ppa:ubuntu-toolchain-r/test -y
+
+          # apt.llvm.org for Clang versions newer than what Ubuntu 24.04 ships
+          # (24.04 default repos cap at clang-18). The bootstrap script adds
+          # the LLVM apt source for the requested version and runs apt-get update.
+          if [ "${{ matrix.compiler }}" = "clang" ] && [ "${{ matrix.compiler_version }}" -ge 19 ]; then
+            apt-get install -y wget gnupg lsb-release
+            wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+            chmod +x /tmp/llvm.sh
+            # `all` installs clang + libllvm + lldb + lld + the llvm-N package
+            # (which provides llvm-profdata-N / llvm-cov-N for coverage runs).
+            /tmp/llvm.sh ${{ matrix.compiler_version }} all
+          fi
+
           apt-get update
           apt-get install -y git python3 python-is-python3 pipx
           pipx ensurepath
@@ -332,10 +212,16 @@ jobs:
           pipx install "conan>=2.0,<3"
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
-          # Install gcovr for coverage jobs
+          # Install coverage tooling
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
-            pipx install "gcovr>=7,<9"
             apt-get install -y curl lcov
+            if [ "${{ matrix.coverage_tool }}" = "llvm" ]; then
+              # Native LLVM source-based coverage: llvm-profdata + llvm-cov.
+              # The clang-N package doesn't pull these in; the llvm-N package does.
+              apt-get install -y "llvm-${{ matrix.compiler_version }}"
+            else
+              pipx install "gcovr>=7,<9"
+            fi
           fi
 
       - name: Check environment
@@ -348,10 +234,15 @@ jobs:
           which ${{ matrix.cxx }} && ${{ matrix.cxx }} --version || echo "${{ matrix.cxx }} not found"
           which ccache && ccache --version || echo "ccache not found"
 
-          # Check gcovr for coverage jobs
+          # Check coverage tooling
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
-            which gcov && gcov --version || echo "gcov not found"
-            which gcovr && gcovr --version || echo "gcovr not found"
+            if [ "${{ matrix.coverage_tool }}" = "llvm" ]; then
+              which "llvm-profdata-${{ matrix.compiler_version }}" && "llvm-profdata-${{ matrix.compiler_version }}" --version || echo "llvm-profdata not found"
+              which "llvm-cov-${{ matrix.compiler_version }}" && "llvm-cov-${{ matrix.compiler_version }}" --version || echo "llvm-cov not found"
+            else
+              which gcov && gcov --version || echo "gcov not found"
+              which gcovr && gcovr --version || echo "gcovr not found"
+            fi
           fi
 
           echo "---- Full Environment ----"
@@ -378,6 +269,7 @@ jobs:
           cc: ${{ matrix.cc }}
           cxx: ${{ matrix.cxx }}
           stdlib: ${{ matrix.stdlib }}
+          conan_deps_cxxflags: ${{ matrix.conan_deps_cxxflags && toJson(matrix.conan_deps_cxxflags) || '{}' }}
           gha_cache_enabled: 'false' # Disable caching for self hosted runner
 
       - name: Build
@@ -410,11 +302,101 @@ jobs:
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
           stdlib: ${{ matrix.stdlib }}
-          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness
-          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
-          cmake-target: 'coverage'
+          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness.
+          # Use *_FLAGS_DEBUG so the build action's stdlib flag (e.g. -stdlib=libc++) in CMAKE_CXX_FLAGS isn't clobbered.
+          cmake-args: '-Dcoverage=ON -Dcoverage_tool=${{ matrix.coverage_tool }} -Dcoverage_format=${{ matrix.coverage_format }} -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS_DEBUG="-g -O0" -DCMAKE_C_FLAGS_DEBUG="-g -O0"'
+          cmake-target: 'rippled'
           ccache_max_size: '100G'
 
+      # [DO NOT MERGE] Diagnostic: run the coverage test pass directly (not via
+      # the ninja `coverage` target, which buffers all output until exit) so
+      # every line gets a live timestamp, sample host/process state every 60s,
+      # and dump thread stacks of every rippled process at 12/25 min and on a
+      # 90 min deadline instead of sitting for the 6h job timeout.
+      - name: Run tests (coverage, diagnostic)
+        if: matrix.job_type == 'coverage'
+        shell: bash
+        run: |
+          apt-get install -y procps elfutils gdb > /dev/null
+          cd ${{ env.build_dir }}
+          rm -rf coverage-profraw && mkdir coverage-profraw
+          JOBS=$(($(nproc)/2))
+          echo "nproc=$(nproc) jobs=$JOBS loadavg=$(cat /proc/loadavg)"
+          free -m; df -h . /dev/shm /tmp; ulimit -a; cat /proc/pressure/cpu /proc/pressure/memory /proc/pressure/io 2>/dev/null || true
+
+          cat > /tmp/flag.py <<'EOF'
+          import gdb
+          for t in gdb.selected_inferior().threads():
+              t.switch()
+              f = gdb.newest_frame()
+              while f:
+                  if f.name() and 'ApplicationImp::run' in f.name():
+                      f.select()
+                      print("thread", t.num, "in ApplicationImp::run, isTimeToStop =", gdb.parse_and_eval("this->isTimeToStop"))
+                      break
+                  f = f.older()
+          EOF
+          dump_stacks() {
+            echo "===== STACK DUMP ($1) $(date -u +%T)"
+            for p in $(pgrep -x rippled); do
+              echo "--- pid $p state=$(awk '/^State/{print $2}' /proc/$p/status) wchan=$(cat /proc/$p/wchan 2>/dev/null) cmd=$(tr '\0' ' ' < /proc/$p/cmdline | cut -c1-100)"
+              timeout 120 eu-stack -p $p 2>&1 | head -300 || true
+              st=$(awk '/^State/{print $2}' /proc/$p/status 2>/dev/null)
+              if [ "$st" = "S" ] && [ "$p" != "$RP" ]; then
+                timeout 900 gdb -p $p -batch -ex 'set pagination off' -ex 'source /tmp/flag.py' -ex 'thread apply all bt 30' 2>&1 \
+                  | grep -vE '^\[New LWP|^\[Thread debugging|^Using host|^warning:|^Reading symbols|^Download' | head -800 || true
+              fi
+            done
+          }
+
+          # Stress the suite whose Env lifetimes are shortest: the hang sits in
+          # Env::~AppBundle (thread.join on ApplicationImp::run) and shows up
+          # within a few iterations when it is present.
+          for i in 1 2 3 4 5 6; do
+            st=$SECONDS
+            if LLVM_PROFILE_FILE=/tmp/stress-%p.profraw timeout -s KILL 240 ./rippled --unittest=ripple.app.HookAPI --unittest-jobs 1 > /tmp/stress_$i.log 2>&1; then
+              echo "stress iter $i ok $((SECONDS-st))s: $(grep -oE '[0-9]+ cases, [0-9]+ tests total, [0-9]+ failures' /tmp/stress_$i.log)"
+            else
+              echo "stress iter $i FAILED/HUNG rc=$? after $((SECONDS-st))s; last lines:"; tail -3 /tmp/stress_$i.log
+            fi
+          done
+          rm -f /tmp/stress-*.profraw
+
+          ( while true; do
+              echo "===== sample $(date -u +%T) loadavg=$(cut -d' ' -f1-3 /proc/loadavg) psi_cpu=$(grep -o 'avg60=[0-9.]*' /proc/pressure/cpu 2>/dev/null | head -1) psi_mem=$(grep -o 'avg60=[0-9.]*' /proc/pressure/memory 2>/dev/null | head -1) psi_io=$(grep -o 'avg60=[0-9.]*' /proc/pressure/io 2>/dev/null | head -1)"
+              free -m | sed -n 2,3p
+              ps -eo pid,ppid,stat,etimes,pcpu,rss,wchan:28,args --sort=-pcpu | grep -E 'PID|rippled' | grep -v grep | head -14 | cut -c1-150
+              sleep 60
+            done ) &
+          MON=$!
+
+          LLVM_PROFILE_FILE="$PWD/coverage-profraw/rippled-%m-%p.profraw" \
+            stdbuf -oL -eL ./rippled --unittest --unittest-jobs $JOBS --unittest-log &
+          RP=$!
+          START=$SECONDS; D20=0; D40=0; rc=0
+          while kill -0 $RP 2>/dev/null; do
+            el=$((SECONDS-START))
+            if [ $D20 = 0 ] && [ $el -ge 720 ]; then D20=1; dump_stacks "12min"; fi
+            if [ $D40 = 0 ] && [ $el -ge 1500 ]; then D40=1; dump_stacks "25min"; fi
+            if [ $el -ge 3600 ]; then
+              dump_stacks "60min deadline"
+              echo "===== DEADLINE: killing rippled processes"
+              pkill -KILL -x rippled || true
+              break
+            fi
+            sleep 10
+          done
+          wait $RP || rc=$?
+          kill $MON 2>/dev/null || true
+          echo "rippled unittest exit code: $rc after $((SECONDS-START))s"
+          ls -la coverage-profraw | head -20
+
+          llvm-profdata-${{ matrix.compiler_version }} merge -sparse -o coverage.profdata coverage-profraw/*.profraw
+          llvm-cov-${{ matrix.compiler_version }} export -instr-profile=coverage.profdata -format=lcov \
+            -ignore-filename-regex="src/test|include/xrpl/beast/test|include/xrpl/beast/unit_test|$PWD/pb-xrpl.libpb" \
+            ./rippled > coverage.lcov
+          exit $rc
+
       - name: Set artifact name
         if: matrix.job_type == 'build'
         id: set-artifact-name
@@ -443,22 +425,26 @@ jobs:
       - name: Move coverage report
         if: matrix.job_type == 'coverage'
         shell: bash
+        env:
+          COVERAGE_FILE: ${{ matrix.coverage_tool == 'llvm' && 'coverage.lcov' || 'coverage.xml' }}
         run: |
-          mv "${{ env.build_dir }}/coverage.xml" ./
+          mv "${{ env.build_dir }}/${COVERAGE_FILE}" ./
+          echo "COVERAGE_FILE=${COVERAGE_FILE}" >> "$GITHUB_ENV"
 
       - name: Archive coverage report
         if: matrix.job_type == 'coverage'
         uses: actions/upload-artifact@v4
         with:
-          name: coverage.xml
-          path: coverage.xml
+          name: ${{ env.COVERAGE_FILE }}-${{ matrix.compiler_id }}
+          path: ${{ env.COVERAGE_FILE }}
           retention-days: 30
 
       - name: Upload coverage report
-        if: matrix.job_type == 'coverage'
+        if: matrix.job_type == 'coverage' && github.repository == 'Xahau/xahaud'
         uses: codecov/codecov-action@v5
         with:
-          files: coverage.xml
+          files: ${{ env.COVERAGE_FILE }}
+          flags: ${{ matrix.coverage_tool }}
           fail_ci_if_error: true
           disable_search: true
           verbose: true

Builds/levelization/results/ordering.txt

@@ -32,6 +32,7 @@ test.basics > xrpld.perflog
 test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
+test.beast > test.unit_test
 test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpld.conditions
@@ -77,6 +78,11 @@ test.ledger > xrpld.app
 test.ledger > xrpld.core
 test.ledger > xrpld.ledger
 test.ledger > xrpl.protocol
+test.net > test.toplevel
+test.net > xrpl.basics
+test.net > xrpld.core
+test.net > xrpld.net
+test.net > xrpl.json
 test.nodestore > test.jtx
 test.nodestore > test.toplevel
 test.nodestore > test.unit_test
@@ -90,6 +96,7 @@ test.overlay > test.toplevel
 test.overlay > test.unit_test
 test.overlay > xrpl.basics
 test.overlay > xrpld.app
+test.overlay > xrpld.core
 test.overlay > xrpld.overlay
 test.overlay > xrpld.peerfinder
 test.overlay > xrpld.shamap
@@ -185,6 +192,7 @@ xrpld.overlay > xrpl.basics
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
 xrpld.overlay > xrpld.perflog
+xrpld.overlay > xrpld.shamap
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource
@@ -200,6 +208,7 @@ xrpld.rpc > xrpld.core
 xrpld.rpc > xrpld.ledger
 xrpld.rpc > xrpld.nodestore
 xrpld.rpc > xrpld.shamap
+xrpld.rpc > xrpl.hook
 xrpld.rpc > xrpl.json
 xrpld.rpc > xrpl.protocol
 xrpld.rpc > xrpl.resource

cfg/xahaud-example.cfg

@@ -494,7 +494,7 @@
 #
 #   Configure the maximum number of transactions to have in the job queue
 #
-#   Must be a number between 100 and 1000, defaults to 250
+#   Must be a number between 100 and 1000, defaults to 1000
 #
 #
 # [overlay]
@@ -593,7 +593,7 @@
 #       reaches or exceeds this number. After that the limit may still
 #       change, but will stay above the target. If consensus is not
 #       healthy, the limit will be clamped to this value or lower.
-#       Default: 50.
+#       Default: 1000.
 #
 #   maximum_txn_in_ledger = <number>
 #

cfg/xahaud-standalone.cfg

@@ -146,8 +146,6 @@ D686F2538F410C9D0D856788E98E3579595DAF7B38D38887F81ECAC934B06040 HooksUpdate1
 3C43D9A973AA4443EF3FC38E42DD306160FBFFDAB901CD8BAA15D09F2597EB87 NonFungibleTokensV1
 0285B7E5E08E1A8E4C15636F0591D87F73CB6A7B6452A932AD72BBC8E5D1CBE3 fixNFTokenDirV1
 36799EA497B1369B170805C078AEFE6188345F9B3E324C21E9CA3FF574E3C3D6 fixNFTokenNegOffer
-4C499D17719BB365B69010A436B64FD1A82AAB199FC1CEB06962EBD01059FB09 fixXahauV1
-215181D23BF5C173314B5FDB9C872C92DE6CC918483727DE037C0C13E7E6EE9D fixXahauV2
 0D8BF22FF7570D58598D1EF19EBB6E142AD46E59A223FD3816262FBB69345BEA Remit
 7CA0426E7F411D39BB014E57CD9E08F61DE1750F0D41FCD428D9FB80BB7596B0 ZeroB2M
 4B8466415FAB32FFA89D9DCBE166A42340115771DF611A7160F8D7439C87ECD8 fixNSDelete

cmake/CodeCoverageLLVM.cmake

@@ -0,0 +1,156 @@
+#[===================================================================[
+  Native LLVM source-based code coverage helper.
+
+  Drives the -fprofile-instr-generate / -fcoverage-mapping pipeline:
+    1. Run instrumented binary with LLVM_PROFILE_FILE=...%m-%p.profraw
+    2. llvm-profdata merge -sparse  -> coverage.profdata
+    3. llvm-cov export/show/report  -> final report
+
+  Output filename per coverage_format:
+    lcov              -> coverage.lcov
+    json              -> coverage.json
+    txt | text        -> coverage.txt
+    html | html-details -> <NAME>/index.html
+#]===================================================================]
+
+include(CMakeParseArguments)
+
+# Locate llvm-profdata / llvm-cov, preferring versioned variants matching the
+# Clang we're building with so we don't accidentally pair clang-20 with
+# llvm-cov-14 (profile format mismatch -> hard failure).
+function(_find_llvm_cov_tools)
+  if(LLVM_PROFDATA_PATH AND LLVM_COV_PATH)
+    return()
+  endif()
+
+  string(REGEX MATCH "^[0-9]+" _major "${CMAKE_CXX_COMPILER_VERSION}")
+
+  set(_pd_names llvm-profdata)
+  set(_cov_names llvm-cov)
+  if(_major)
+    list(PREPEND _pd_names "llvm-profdata-${_major}")
+    list(PREPEND _cov_names "llvm-cov-${_major}")
+  endif()
+
+  # Only delegate to xcrun when the *compiler* is AppleClang. On macOS with
+  # Homebrew/system clang-N, xcrun would resolve to Xcode's llvm tools which
+  # could be a different version - exactly the mismatch we want to avoid.
+  if(APPLE AND CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
+    execute_process(COMMAND xcrun -f llvm-profdata
+      OUTPUT_VARIABLE _pd_xcrun OUTPUT_STRIP_TRAILING_WHITESPACE
+      ERROR_QUIET RESULT_VARIABLE _pd_rc)
+    if(_pd_rc EQUAL 0 AND _pd_xcrun)
+      set(LLVM_PROFDATA_PATH "${_pd_xcrun}" CACHE FILEPATH "llvm-profdata" FORCE)
+    endif()
+    execute_process(COMMAND xcrun -f llvm-cov
+      OUTPUT_VARIABLE _cov_xcrun OUTPUT_STRIP_TRAILING_WHITESPACE
+      ERROR_QUIET RESULT_VARIABLE _cov_rc)
+    if(_cov_rc EQUAL 0 AND _cov_xcrun)
+      set(LLVM_COV_PATH "${_cov_xcrun}" CACHE FILEPATH "llvm-cov" FORCE)
+    endif()
+  endif()
+
+  if(NOT LLVM_PROFDATA_PATH)
+    find_program(LLVM_PROFDATA_PATH NAMES ${_pd_names})
+  endif()
+  if(NOT LLVM_COV_PATH)
+    find_program(LLVM_COV_PATH NAMES ${_cov_names})
+  endif()
+endfunction()
+
+function(setup_target_for_coverage_llvm)
+  set(oneValueArgs NAME FORMAT)
+  set(multiValueArgs EXCLUDE EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+  cmake_parse_arguments(Cov "" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
+
+  _find_llvm_cov_tools()
+  if(NOT LLVM_PROFDATA_PATH)
+    message(FATAL_ERROR "llvm-profdata not found (needed for coverage_tool=llvm)")
+  endif()
+  if(NOT LLVM_COV_PATH)
+    message(FATAL_ERROR "llvm-cov not found (needed for coverage_tool=llvm)")
+  endif()
+
+  if(NOT Cov_FORMAT)
+    set(Cov_FORMAT lcov)
+  endif()
+
+  set(_profraw_dir "${PROJECT_BINARY_DIR}/${Cov_NAME}-profraw")
+  set(_profdata    "${PROJECT_BINARY_DIR}/${Cov_NAME}.profdata")
+
+  # Resolve binary path: accept either an absolute path or a bare target name
+  # (resolved against PROJECT_BINARY_DIR). Splice the resolved path back into
+  # Cov_EXECUTABLE so the run command invokes it via absolute path - bare
+  # names aren't on PATH and the build dir isn't `.` either.
+  list(GET Cov_EXECUTABLE 0 _exec_name)
+  if(IS_ABSOLUTE "${_exec_name}")
+    set(_binary "${_exec_name}")
+  else()
+    set(_binary "${PROJECT_BINARY_DIR}/${_exec_name}")
+    list(REMOVE_AT Cov_EXECUTABLE 0)
+    list(PREPEND Cov_EXECUTABLE "${_binary}")
+  endif()
+
+  # llvm-cov takes a single -ignore-filename-regex; OR our excludes together.
+  set(_ignore_regex "")
+  foreach(EXC IN LISTS Cov_EXCLUDE)
+    if(_ignore_regex)
+      string(APPEND _ignore_regex "|")
+    endif()
+    string(APPEND _ignore_regex "${EXC}")
+  endforeach()
+  set(_filter "")
+  if(_ignore_regex)
+    set(_filter "-ignore-filename-regex='${_ignore_regex}'")
+  endif()
+
+  # Pick llvm-cov subcommand + output file for the requested format. Each
+  # branch builds a single shell command string that we'll hand to bash -c.
+  if(Cov_FORMAT STREQUAL "lcov")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.lcov")
+    set(_report_sh "${LLVM_COV_PATH} export -instr-profile='${_profdata}' -format=lcov ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "json")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.json")
+    set(_report_sh "${LLVM_COV_PATH} export -instr-profile='${_profdata}' -format=text ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "txt" OR Cov_FORMAT STREQUAL "text")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.txt")
+    set(_report_sh "${LLVM_COV_PATH} report -instr-profile='${_profdata}' ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "html" OR Cov_FORMAT STREQUAL "html-details")
+    set(_output "${PROJECT_BINARY_DIR}/${Cov_NAME}/index.html")
+    set(_report_sh "${LLVM_COV_PATH} show -instr-profile='${_profdata}' -format=html -output-dir='${PROJECT_BINARY_DIR}/${Cov_NAME}' ${_filter} '${_binary}'")
+  else()
+    message(FATAL_ERROR "coverage_tool=llvm: unsupported coverage_format '${Cov_FORMAT}' (use lcov|json|txt|html)")
+  endif()
+
+  set(_merge_sh "${LLVM_PROFDATA_PATH} merge -sparse -o '${_profdata}' '${_profraw_dir}'/*.profraw")
+
+  if(CODE_COVERAGE_VERBOSE)
+    message(STATUS "[coverage:llvm] binary:   ${_binary}")
+    message(STATUS "[coverage:llvm] profraw:  ${_profraw_dir}")
+    message(STATUS "[coverage:llvm] profdata: ${_profdata}")
+    message(STATUS "[coverage:llvm] format:   ${Cov_FORMAT}")
+    message(STATUS "[coverage:llvm] output:   ${_output}")
+    if(_ignore_regex)
+      message(STATUS "[coverage:llvm] ignore:   ${_ignore_regex}")
+    endif()
+    message(STATUS "[coverage:llvm] merge:    ${_merge_sh}")
+    message(STATUS "[coverage:llvm] report:   ${_report_sh}")
+  endif()
+
+  # %m: hash of the binary, %p: pid. Wipe the dir up front so stale profraw
+  # files can't leak into a fresh merge.
+  add_custom_target(${Cov_NAME}
+    COMMAND ${CMAKE_COMMAND} -E rm -rf "${_profraw_dir}"
+    COMMAND ${CMAKE_COMMAND} -E make_directory "${_profraw_dir}"
+    COMMAND ${CMAKE_COMMAND} -E env
+        "LLVM_PROFILE_FILE=${_profraw_dir}/rippled-%m-%p.profraw"
+        ${Cov_EXECUTABLE} ${Cov_EXECUTABLE_ARGS}
+    COMMAND bash -c "${_merge_sh}"
+    COMMAND bash -c "${_report_sh}"
+    BYPRODUCTS ${_output}
+    WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+    DEPENDS ${Cov_DEPENDENCIES}
+    VERBATIM
+    COMMENT "Running llvm-cov (${Cov_FORMAT}) -> ${_output}"
+  )
+endfunction()

cmake/RippledCov.cmake

@@ -11,6 +11,21 @@ if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
   return()
 endif()
 
+if(coverage_tool STREQUAL "llvm")
+  include(CodeCoverageLLVM)
+
+  setup_target_for_coverage_llvm(
+    NAME coverage
+    FORMAT ${coverage_format}
+    EXECUTABLE rippled
+    EXECUTABLE_ARGS --unittest$<$<BOOL:${coverage_test}>:=${coverage_test}> --unittest-jobs ${coverage_test_parallelism} --quiet --unittest-log
+    EXCLUDE "src/test" "include/xrpl/beast/test" "include/xrpl/beast/unit_test" "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"
+    DEPENDENCIES rippled
+  )
+  return()
+endif()
+
+# coverage_tool == "gcov" (default): existing gcovr-driven pipeline.
 include(CodeCoverage)
 
 # The instructions for these commands come from the `CodeCoverage` module,

cmake/RippledInterface.cmake

@@ -28,15 +28,17 @@ target_compile_options (opts
     $<$<AND:$<BOOL:${is_gcc}>,$<COMPILE_LANGUAGE:CXX>>:-Wsuggest-override>
     $<$<BOOL:${is_gcc}>:-Wno-maybe-uninitialized>
     $<$<BOOL:${perf}>:-fno-omit-frame-pointer>
-    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>>:-g --coverage -fprofile-abs-path>
-    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage -fprofile-abs-path>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},llvm>>:-g -fprofile-instr-generate -fcoverage-mapping>
     $<$<BOOL:${profile}>:-pg>
     $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${profile}>>:-p>)
 
 target_link_libraries (opts
   INTERFACE
-    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>>:-g --coverage -fprofile-abs-path>
-    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage -fprofile-abs-path>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},llvm>>:-g -fprofile-instr-generate -fcoverage-mapping>
     $<$<BOOL:${profile}>:-pg>
     $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${profile}>>:-p>)
 

cmake/RippledSettings.cmake

@@ -29,13 +29,25 @@ if(is_gcc OR is_clang)
     "Unit tests parallelism for the purpose of coverage report.")
   set(coverage_format "html-details" CACHE STRING
     "Output format of the coverage report.")
+  set(coverage_tool "gcov" CACHE STRING
+    "Coverage instrumentation tool: 'gcov' (default, gcc/clang via --coverage + gcovr) or 'llvm' (clang only, native source-based coverage via -fprofile-instr-generate).")
+  set_property(CACHE coverage_tool PROPERTY STRINGS "gcov" "llvm")
+  if(NOT coverage_tool MATCHES "^(gcov|llvm)$")
+    message(FATAL_ERROR "coverage_tool must be 'gcov' or 'llvm', got '${coverage_tool}'")
+  endif()
   set(coverage_extra_args "" CACHE STRING
-    "Additional arguments to pass to gcovr.")
+    "Additional arguments to pass to gcovr (gcov tool only).")
   set(coverage_test "" CACHE STRING
     "On gcc & clang, the specific unit test(s) to run for coverage. Default is all tests.")
   if(coverage_test AND NOT coverage)
     set(coverage ON CACHE BOOL "gcc/clang only" FORCE)
   endif()
+  # Validate after coverage_test may have flipped coverage on, otherwise
+  # `-Dcoverage_tool=llvm -Dcoverage_test=Foo` on gcc would silently slip
+  # past the Clang guard and produce a broken instrumentation combo.
+  if(coverage AND coverage_tool STREQUAL "llvm" AND NOT is_clang)
+    message(FATAL_ERROR "coverage_tool=llvm requires Clang (got ${CMAKE_CXX_COMPILER_ID})")
+  endif()
   option(wextra "compile with extra gcc/clang warnings enabled" ON)
 else()
   set(profile OFF CACHE BOOL "gcc/clang only" FORCE)
@@ -112,7 +124,7 @@ option(beast_no_unit_test_inline
   "Prevents unit test definitions from being inserted into global table"
   OFF)
 option(single_io_service_thread
-  "Restricts the number of threads calling io_service::run to one. \
+  "Restricts the number of threads calling io_context::run to one. \
   This can be useful when debugging."
   OFF)
 option(boost_show_deprecated

cmake/deps/Boost.cmake

@@ -32,9 +32,9 @@ target_link_libraries(ripple_boost
     Boost::date_time
     Boost::filesystem
     Boost::json
+    Boost::process
     Boost::program_options
     Boost::regex
-    Boost::system
     Boost::iostreams
     Boost::thread)
 if(Boost_COMPILER)

conanfile.py

@@ -2,158 +2,160 @@ from conan import ConanFile
 from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 import re
 
-class Xrpl(ConanFile):
-    name = 'xrpl'
 
-    license = 'ISC'
-    author = 'John Freeman <[email protected]>'
-    url = 'https://github.com/xrplf/rippled'
-    description = 'The XRP Ledger'
-    settings = 'os', 'compiler', 'build_type', 'arch'
+class Xrpl(ConanFile):
+    name = "xrpl"
+
+    license = "ISC"
+    author = "John Freeman <[email protected]>"
+    url = "https://github.com/xrplf/rippled"
+    description = "The XRP Ledger"
+    settings = "os", "compiler", "build_type", "arch"
     options = {
-        'assertions': [True, False],
-        'coverage': [True, False],
-        'fPIC': [True, False],
-        'jemalloc': [True, False],
-        'rocksdb': [True, False],
-        'shared': [True, False],
-        'static': [True, False],
-        'tests': [True, False],
-        'unity': [True, False],
-        'xrpld': [True, False],
-        'with_wasmedge': [True, False],
-        'tool_requires_b2': [True, False],
+        "assertions": [True, False],
+        "coverage": [True, False],
+        "fPIC": [True, False],
+        "jemalloc": [True, False],
+        "rocksdb": [True, False],
+        "shared": [True, False],
+        "static": [True, False],
+        "tests": [True, False],
+        "unity": [True, False],
+        "xrpld": [True, False],
+        "with_wasmedge": [True, False],
+        "tool_requires_b2": [True, False],
     }
 
     requires = [
-        'date/3.0.3',
-        'grpc/1.50.1',
-        'libarchive/3.7.6',
-        'magic_enum/0.9.5',
-        'nudb/2.0.8',
-        'openssl/3.6.0',
-        'soci/4.0.3@xahaud/stable',
-        'xxhash/0.8.2',
-        'zlib/1.3.1',
+        "date/3.0.3",
+        "grpc/1.50.1",
+        "libarchive/3.7.6",
+        "magic_enum/0.9.5",
+        "nudb/2.0.9",
+        "openssl/3.6.0",
+        "soci/4.0.3@xahaud/stable",
+        "xxhash/0.8.2",
+        "zlib/1.3.1",
     ]
 
     tool_requires = [
-        'protobuf/3.21.12',
+        "protobuf/3.21.12",
     ]
 
     default_options = {
-        'assertions': False,
-        'coverage': False,
-        'fPIC': True,
-        'jemalloc': False,
-        'rocksdb': True,
-        'shared': False,
-        'static': True,
-        'tests': False,
-        'unity': False,
-        'xrpld': False,
-        'with_wasmedge': True,
-        'tool_requires_b2': False,
-
-        'date/*:header_only': False,
-        'grpc/*:shared': False,
-        'grpc/*:secure': True,
-        'libarchive/*:shared': False,
-        'libarchive/*:with_acl': False,
-        'libarchive/*:with_bzip2': False,
-        'libarchive/*:with_cng': False,
-        'libarchive/*:with_expat': False,
-        'libarchive/*:with_iconv': False,
-        'libarchive/*:with_libxml2': False,
-        'libarchive/*:with_lz4': True,
-        'libarchive/*:with_lzma': False,
-        'libarchive/*:with_lzo': False,
-        'libarchive/*:with_nettle': False,
-        'libarchive/*:with_openssl': False,
-        'libarchive/*:with_pcreposix': False,
-        'libarchive/*:with_xattr': False,
-        'libarchive/*:with_zlib': False,
-        'lz4/*:shared': False,
-        'openssl/*:shared': False,
-        'protobuf/*:shared': False,
-        'protobuf/*:with_zlib': True,
-        'rocksdb/*:enable_sse': False,
-        'rocksdb/*:lite': False,
-        'rocksdb/*:shared': False,
-        'rocksdb/*:use_rtti': True,
-        'rocksdb/*:with_jemalloc': False,
-        'rocksdb/*:with_lz4': True,
-        'rocksdb/*:with_snappy': True,
-        'snappy/*:shared': False,
-        'soci/*:shared': False,
-        'soci/*:with_sqlite3': True,
-        'soci/*:with_boost': True,
-        'xxhash/*:shared': False,
+        "assertions": False,
+        "coverage": False,
+        "fPIC": True,
+        "jemalloc": False,
+        "rocksdb": True,
+        "shared": False,
+        "static": True,
+        "tests": False,
+        "unity": False,
+        "xrpld": False,
+        "with_wasmedge": True,
+        "tool_requires_b2": False,
+        "boost/*:without_cobalt": True,
+        "date/*:header_only": False,
+        "grpc/*:shared": False,
+        "grpc/*:secure": True,
+        "libarchive/*:shared": False,
+        "libarchive/*:with_acl": False,
+        "libarchive/*:with_bzip2": False,
+        "libarchive/*:with_cng": False,
+        "libarchive/*:with_expat": False,
+        "libarchive/*:with_iconv": False,
+        "libarchive/*:with_libxml2": False,
+        "libarchive/*:with_lz4": True,
+        "libarchive/*:with_lzma": False,
+        "libarchive/*:with_lzo": False,
+        "libarchive/*:with_nettle": False,
+        "libarchive/*:with_openssl": False,
+        "libarchive/*:with_pcreposix": False,
+        "libarchive/*:with_xattr": False,
+        "libarchive/*:with_zlib": False,
+        "lz4/*:shared": False,
+        "openssl/*:shared": False,
+        "protobuf/*:shared": False,
+        "protobuf/*:with_zlib": True,
+        "rocksdb/*:enable_sse": False,
+        "rocksdb/*:lite": False,
+        "rocksdb/*:shared": False,
+        "rocksdb/*:use_rtti": True,
+        "rocksdb/*:with_jemalloc": False,
+        "rocksdb/*:with_lz4": True,
+        "rocksdb/*:with_snappy": True,
+        "snappy/*:shared": False,
+        "soci/*:shared": False,
+        "soci/*:with_sqlite3": True,
+        "soci/*:with_boost": True,
+        "xxhash/*:shared": False,
     }
 
     def set_version(self):
-        path = f'{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp'
-        regex = r'versionString\s?=\s?\"(.*)\"'
-        with open(path, 'r') as file:
+        path = f"{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp"
+        regex = r"versionString\s?=\s?\"(.*)\""
+        with open(path, "r") as file:
             matches = (re.search(regex, line) for line in file)
             match = next(m for m in matches if m)
             self.version = match.group(1)
 
     def build_requirements(self):
         # These provide build tools (protoc, grpc plugins) that run during build
-        self.tool_requires('grpc/1.50.1')
+        self.tool_requires("grpc/1.50.1")
         # Explicitly require b2 (e.g. for building from source for glibc compatibility)
         if self.options.tool_requires_b2:
-            self.tool_requires('b2/5.3.2')
+            self.tool_requires("b2/5.3.2")
 
     def configure(self):
-        if self.settings.compiler == 'apple-clang':
-            self.options['boost/*'].visibility = 'global'
+        if self.settings.compiler == "apple-clang":
+            self.options["boost/*"].visibility = "global"
 
     def requirements(self):
         # Force sqlite3 version to avoid conflicts with soci
-        self.requires('sqlite3/3.47.0', override=True)
+        self.requires("sqlite3/3.47.0", override=True)
         # Force our custom snappy build for all dependencies
-        self.requires('snappy/1.1.10@xahaud/stable', override=True)
+        self.requires("snappy/1.1.10@xahaud/stable", override=True)
         # Force boost version for all dependencies to avoid conflicts
-        self.requires('boost/1.86.0', override=True)
-        self.requires('lz4/1.10.0', force=True)
+        self.requires("boost/1.91.0", override=True)
+        self.requires("lz4/1.10.0", force=True)
 
         if self.options.with_wasmedge:
-            self.requires('wasmedge/0.11.2@xahaud/stable')
+            self.requires("wasmedge/0.11.2@xahaud/stable")
         if self.options.jemalloc:
-            self.requires('jemalloc/5.3.0')
+            self.requires("jemalloc/5.3.0")
         if self.options.rocksdb:
-            self.requires('rocksdb/6.29.5')
+            self.requires("rocksdb/6.29.5")
 
     exports_sources = (
-        'CMakeLists.txt',
-        'bin/getRippledInfo',
-        'cfg/*',
-        'cmake/*',
-        'external/*',
-        'include/*',
-        'src/*',
+        "CMakeLists.txt",
+        "bin/getRippledInfo",
+        "cfg/*",
+        "cmake/*",
+        "external/*",
+        "include/*",
+        "src/*",
     )
 
     def layout(self):
         cmake_layout(self)
         # Fix this setting to follow the default introduced in Conan 1.48
         # to align with our build instructions.
-        self.folders.generators = 'build/generators'
+        self.folders.generators = "build/generators"
+
+    generators = "CMakeDeps"
 
-    generators = 'CMakeDeps'
     def generate(self):
         tc = CMakeToolchain(self)
-        tc.variables['tests'] = self.options.tests
-        tc.variables['assert'] = self.options.assertions
-        tc.variables['coverage'] = self.options.coverage
-        tc.variables['jemalloc'] = self.options.jemalloc
-        tc.variables['rocksdb'] = self.options.rocksdb
-        tc.variables['BUILD_SHARED_LIBS'] = self.options.shared
-        tc.variables['static'] = self.options.static
-        tc.variables['unity'] = self.options.unity
-        tc.variables['xrpld'] = self.options.xrpld
+        tc.variables["tests"] = self.options.tests
+        tc.variables["assert"] = self.options.assertions
+        tc.variables["coverage"] = self.options.coverage
+        tc.variables["jemalloc"] = self.options.jemalloc
+        tc.variables["rocksdb"] = self.options.rocksdb
+        tc.variables["BUILD_SHARED_LIBS"] = self.options.shared
+        tc.variables["static"] = self.options.static
+        tc.variables["unity"] = self.options.unity
+        tc.variables["xrpld"] = self.options.xrpld
         tc.generate()
 
     def build(self):
@@ -168,29 +170,29 @@ class Xrpl(ConanFile):
         cmake.install()
 
     def package_info(self):
-        libxrpl = self.cpp_info.components['libxrpl']
+        libxrpl = self.cpp_info.components["libxrpl"]
         libxrpl.libs = [
-            'xrpl',
-            'xrpl.libpb',
-            'ed25519',
-            'secp256k1',
+            "xrpl",
+            "xrpl.libpb",
+            "ed25519",
+            "secp256k1",
         ]
         # TODO: Fix the protobufs to include each other relative to
         # `include/`, not `include/ripple/proto/`.
-        libxrpl.includedirs = ['include', 'include/ripple/proto']
+        libxrpl.includedirs = ["include", "include/ripple/proto"]
         libxrpl.requires = [
-            'boost::boost',
-            'date::date',
-            'grpc::grpc++',
-            'libarchive::libarchive',
-            'lz4::lz4',
-            'nudb::nudb',
-            'openssl::crypto',
-            'protobuf::libprotobuf',
-            'soci::soci',
-            'sqlite3::sqlite',
-            'xxhash::xxhash',
-            'zlib::zlib',
+            "boost::boost",
+            "date::date",
+            "grpc::grpc++",
+            "libarchive::libarchive",
+            "lz4::lz4",
+            "nudb::nudb",
+            "openssl::crypto",
+            "protobuf::libprotobuf",
+            "soci::soci",
+            "sqlite3::sqlite",
+            "xxhash::xxhash",
+            "zlib::zlib",
         ]
         if self.options.rocksdb:
-            libxrpl.requires.append('rocksdb::librocksdb')
+            libxrpl.requires.append("rocksdb::librocksdb")

hook/generate_extern.sh

@@ -22,29 +22,29 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
             return s;
         }
 
-        {
-            line = $0;
-            
-            # Skip block comments
-            if (line ~ /\/\*/) {
-                next;
-            }
-            
-            # Look for comment lines that start with // and contain function signature
-            if (line ~ /^[[:space:]]*\/\/[[:space:]]*[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]+[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]*\(/) {
-                # Remove leading // and trim
-                sub(/^[[:space:]]*\/\/[[:space:]]*/, "", line);
-                line = trim(line);
-                
-                # Check if function name is "_g" to add attribute
-                if (line ~ /[[:space:]]+_g[[:space:]]*\(/) {
-                    # Insert __attribute__((noduplicate)) before _g
-                    sub(/[[:space:]]+_g/, " __attribute__((noduplicate)) _g", line);
-                }
-                
-                # printf("\n");
-                
-                printf("extern %s\n\n", line);
+        # Each entry is HOOK_API_DEFINITION(RET, NAME, (PARAMS), AMENDMENT),
+        # possibly spread over several lines. Collect until the parentheses
+        # balance, then split on the first two commas; the parameter tuple
+        # is the first parenthesised group.
+        function emit(s,    i, ret, name, p, q, params) {
+            sub(/^[[:space:]]*HOOK_API_DEFINITION[[:space:]]*\(/, "", s);
+            gsub(/[[:space:]]+/, " ", s);
+            i = index(s, ","); ret = trim(substr(s, 1, i - 1)); s = substr(s, i + 1);
+            i = index(s, ","); name = trim(substr(s, 1, i - 1)); s = substr(s, i + 1);
+            p = index(s, "("); q = index(s, ")");
+            params = trim(substr(s, p + 1, q - p - 1));
+            if (name == "_g")
+                name = "__attribute__((noduplicate)) _g";
+            printf("extern %s %s(%s);\n\n", ret, name, params);
+        }
+
+        /^[[:space:]]*HOOK_API_DEFINITION[[:space:]]*\(/ { buf = ""; collecting = 1; }
+
+        collecting {
+            buf = buf " " $0;
+            if (gsub(/\(/, "(", buf) == gsub(/\)/, ")", buf)) {
+                collecting = 0;
+                emit(buf);
             }
         }
     ' "$APPLY_HOOK"

hook/hookapi.h

@@ -38,6 +38,7 @@
 #define KEYLET_HOOK_DEFINITION 24
 #define KEYLET_HOOK_STATE_DIR 25
 #define KEYLET_CRON 26
+#define KEYLET_MANIFEST 37
 
 #define COMPARE_EQUAL 1U
 #define COMPARE_LESS 2U

hook/sfcodes.h

@@ -152,6 +152,7 @@
 #define sfEscrowID ((5U << 16U) + 35U)
 #define sfURITokenID ((5U << 16U) + 36U)
 #define sfDomainID ((5U << 16U) + 37U)
+#define sfManifestID ((5U << 16U) + 91U)
 #define sfHookOnOutgoing ((5U << 16U) + 93U)
 #define sfHookOnIncoming ((5U << 16U) + 94U)
 #define sfCron ((5U << 16U) + 95U)
@@ -288,6 +289,7 @@
 #define sfXChainCreateAccountAttestationCollectionElement ((14U << 16U) + 31U)
 #define sfPriceData ((14U << 16U) + 32U)
 #define sfCredential ((14U << 16U) + 33U)
+#define sfManifest ((14U << 16U) + 90U)
 #define sfAmountEntry ((14U << 16U) + 91U)
 #define sfMintURIToken ((14U << 16U) + 92U)
 #define sfHookEmission ((14U << 16U) + 93U)

hook/tts.h

@@ -61,6 +61,7 @@
 #define ttNFTOKEN_MODIFY 70
 #define ttPERMISSIONED_DOMAIN_SET 71
 #define ttPERMISSIONED_DOMAIN_DELETE 72
+#define ttMANIFEST_SET 91
 #define ttCRON 92
 #define ttCRON_SET 93
 #define ttREMARKS_SET 94

include/xrpl/basics/MathUtilities.h

@@ -23,9 +23,66 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
 
 namespace ripple {
 
+/** Add two signed 64-bit integers, returning std::nullopt when the exact
+ *  mathematical sum is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedAdd(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
+        return std::nullopt;
+
+    return a + b;
+}
+
+/** Subtract two signed 64-bit integers, returning std::nullopt when the exact
+ *  mathematical difference is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedSub(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
+        return std::nullopt;
+
+    return a - b;
+}
+
+namespace detail {
+using i64_limits = std::numeric_limits<std::int64_t>;
+
+static_assert(checkedAdd(0, 0) == 0);
+static_assert(checkedAdd(1, -1) == 0);
+static_assert(checkedAdd(-5, 2) == -3);
+static_assert(!checkedAdd(i64_limits::max(), 1).has_value());
+static_assert(!checkedAdd(i64_limits::min(), -1).has_value());
+static_assert(checkedAdd(i64_limits::max() - 1, 1) == i64_limits::max());
+static_assert(checkedAdd(i64_limits::min(), i64_limits::max()) == -1);
+static_assert(checkedAdd(i64_limits::max(), i64_limits::min()) == -1);
+static_assert(!checkedAdd(i64_limits::max(), i64_limits::max()).has_value());
+static_assert(!checkedAdd(i64_limits::min(), i64_limits::min()).has_value());
+
+static_assert(checkedSub(0, 0) == 0);
+static_assert(checkedSub(1, 1) == 0);
+static_assert(checkedSub(-5, 2) == -7);
+static_assert(checkedSub(-5, -2) == -3);
+static_assert(!checkedSub(i64_limits::min(), 1).has_value());
+static_assert(!checkedSub(i64_limits::max(), -1).has_value());
+static_assert(checkedSub(i64_limits::min() + 1, 1) == i64_limits::min());
+static_assert(checkedSub(-1, i64_limits::max()) == i64_limits::min());
+static_assert(!checkedSub(i64_limits::max(), i64_limits::min()).has_value());
+static_assert(!checkedSub(i64_limits::min(), i64_limits::max()).has_value());
+}  // namespace detail
+
 /** Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]
  * E.g. calculatePercent(1, 100) = 1 because 1/100 = 0.010000

include/xrpl/basics/ReaderPreferringSharedMutex.h

@@ -0,0 +1,105 @@
+#pragma once
+
+#include <shared_mutex>
+
+// On Linux (glibc), std::shared_mutex wraps pthread_rwlock_t initialised
+// with PTHREAD_RWLOCK_PREFER_WRITER_NONRECURSIVE_NP.  This means a
+// pending exclusive lock() blocks new shared (reader) acquisitions,
+// causing reader starvation when writers contend frequently.
+//
+// On macOS / ARM (libc++), std::shared_mutex is already reader-preferring,
+// so the same code behaves differently across platforms.
+//
+// This header provides ReaderPreferringSharedMutex:
+//   - On Linux it wraps pthread_rwlock_t initialised with
+//     PTHREAD_RWLOCK_PREFER_READER_NP, matching macOS semantics.
+//   - On all other platforms it is a type alias for std::shared_mutex.
+//
+// The interface is identical to std::shared_mutex, so it works with
+// std::shared_lock and std::unique_lock.
+
+#if defined(__linux__)
+
+#include <cerrno>
+#include <pthread.h>
+#include <system_error>
+
+namespace ripple {
+
+class ReaderPreferringSharedMutex
+{
+    pthread_rwlock_t rwlock_;
+
+public:
+    ReaderPreferringSharedMutex()
+    {
+        pthread_rwlockattr_t attr;
+        pthread_rwlockattr_init(&attr);
+        pthread_rwlockattr_setkind_np(&attr, PTHREAD_RWLOCK_PREFER_READER_NP);
+        int rc = pthread_rwlock_init(&rwlock_, &attr);
+        pthread_rwlockattr_destroy(&attr);
+        if (rc != 0)
+            throw std::system_error(
+                rc, std::system_category(), "pthread_rwlock_init");
+    }
+
+    ~ReaderPreferringSharedMutex()
+    {
+        pthread_rwlock_destroy(&rwlock_);
+    }
+
+    ReaderPreferringSharedMutex(ReaderPreferringSharedMutex const&) = delete;
+    ReaderPreferringSharedMutex&
+    operator=(ReaderPreferringSharedMutex const&) = delete;
+
+    // Exclusive (writer) locking
+    void
+    lock()
+    {
+        pthread_rwlock_wrlock(&rwlock_);
+    }
+
+    bool
+    try_lock()
+    {
+        return pthread_rwlock_trywrlock(&rwlock_) == 0;
+    }
+
+    void
+    unlock()
+    {
+        pthread_rwlock_unlock(&rwlock_);
+    }
+
+    // Shared (reader) locking
+    void
+    lock_shared()
+    {
+        pthread_rwlock_rdlock(&rwlock_);
+    }
+
+    bool
+    try_lock_shared()
+    {
+        return pthread_rwlock_tryrdlock(&rwlock_) == 0;
+    }
+
+    void
+    unlock_shared()
+    {
+        pthread_rwlock_unlock(&rwlock_);
+    }
+};
+
+}  // namespace ripple
+
+#else  // !__linux__
+
+namespace ripple {
+
+// macOS, Windows, etc. — std::shared_mutex is already reader-preferring.
+using ReaderPreferringSharedMutex = std::shared_mutex;
+
+}  // namespace ripple
+
+#endif

include/xrpl/basics/ResolverAsio.h

@@ -22,7 +22,8 @@
 
 #include <xrpl/basics/Resolver.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <boost/asio/io_service.hpp>
+
+#include <boost/asio/io_context.hpp>
 
 namespace ripple {
 
@@ -32,7 +33,7 @@ public:
     explicit ResolverAsio() = default;
 
     static std::unique_ptr<ResolverAsio>
-    New(boost::asio::io_service&, beast::Journal);
+    New(boost::asio::io_context&, beast::Journal);
 };
 
 }  // namespace ripple

include/xrpl/basics/StringUtilities.h

@@ -77,7 +77,7 @@ strUnHex(std::size_t strSize, Iterator begin, Iterator end)
 
     if (strSize & 1)
     {
-        int c = unxtab[*iter++];
+        int c = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (c < 0)
             return {};
@@ -87,12 +87,12 @@ strUnHex(std::size_t strSize, Iterator begin, Iterator end)
 
     while (iter != end)
     {
-        int cHigh = unxtab[*iter++];
+        int cHigh = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (cHigh < 0)
             return {};
 
-        int cLow = unxtab[*iter++];
+        int cLow = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (cLow < 0)
             return {};

include/xrpl/basics/UTF8.h

@@ -0,0 +1,60 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_BASICS_UTF8_H_INCLUDED
+#define RIPPLE_BASICS_UTF8_H_INCLUDED
+
+#include <xrpl/basics/Slice.h>
+
+namespace ripple {
+
+/** Check that a byte sequence is well-formed UTF-8, excluding the two
+    noncharacters U+FFFE and U+FFFF.
+
+    Rejects:
+      - overlong encodings;
+      - UTF-16 surrogate halves (U+D800..U+DFFF);
+      - scalar values above U+10FFFF, and 0xF5..0xFF lead bytes;
+      - stray continuation bytes;
+      - multi-byte sequences truncated by the end of the buffer;
+      - U+FFFE and U+FFFF (EF BF BE, EF BF BF).
+
+    U+FFFE and U+FFFF are well-formed, but have no use in a URI or a name
+    and exist to be misread: U+FFFE is a byte-swapped BOM, so a client that
+    transcodes to UTF-16/32 and sniffs the byte order can be pushed into
+    decoding the rest of the string with the wrong endianness, and both are
+    commonly used as in-band sentinels. They have always been rejected by
+    URIToken and HookName validation, and this function preserves that.
+
+    This is consensus-critical. For every input the previous decoder could
+    evaluate without reading past the end of the buffer, the result is
+    identical to it. The only difference is that truncated trailing
+    sequences, where the previous decoder read out of bounds, are now always
+    rejected. Any further change to what this accepts needs an amendment.
+
+    @param s The bytes to check.
+
+    @note Total: every byte read is within s.
+*/
+bool
+isValidUTF8(Slice const& s) noexcept;
+
+}  // namespace ripple
+
+#endif

include/xrpl/beast/asio/io_latency_probe.h

@@ -22,7 +22,8 @@
 
 #include <xrpl/beast/utility/instrumentation.h>
 #include <boost/asio/basic_waitable_timer.hpp>
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/post.hpp>
 
 #include <chrono>
 #include <condition_variable>
@@ -31,7 +32,7 @@
 
 namespace beast {
 
-/** Measures handler latency on an io_service queue. */
+/** Measures handler latency on an io_context queue. */
 template <class Clock>
 class io_latency_probe
 {
@@ -43,12 +44,12 @@ private:
     std::condition_variable_any m_cond;
     std::size_t m_count;
     duration const m_period;
-    boost::asio::io_service& m_ios;
+    boost::asio::io_context& m_ios;
     boost::asio::basic_waitable_timer<std::chrono::steady_clock> m_timer;
     bool m_cancel;
 
 public:
-    io_latency_probe(duration const& period, boost::asio::io_service& ios)
+    io_latency_probe(duration const& period, boost::asio::io_context& ios)
         : m_count(1)
         , m_period(period)
         , m_ios(ios)
@@ -63,16 +64,16 @@ public:
         cancel(lock, true);
     }
 
-    /** Return the io_service associated with the latency probe. */
+    /** Return the io_context associated with the latency probe. */
     /** @{ */
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
         return m_ios;
     }
 
-    boost::asio::io_service const&
-    get_io_service() const
+    boost::asio::io_context const&
+    get_io_context() const
     {
         return m_ios;
     }
@@ -108,8 +109,10 @@ public:
         std::lock_guard lock(m_mutex);
         if (m_cancel)
             throw std::logic_error("io_latency_probe is canceled");
-        m_ios.post(sample_op<Handler>(
-            std::forward<Handler>(handler), Clock::now(), false, this));
+        boost::asio::post(
+            m_ios,
+            sample_op<Handler>(
+                std::forward<Handler>(handler), Clock::now(), false, this));
     }
 
     /** Initiate continuous i/o latency sampling.
@@ -123,8 +126,10 @@ public:
         std::lock_guard lock(m_mutex);
         if (m_cancel)
             throw std::logic_error("io_latency_probe is canceled");
-        m_ios.post(sample_op<Handler>(
-            std::forward<Handler>(handler), Clock::now(), true, this));
+        boost::asio::post(
+            m_ios,
+            sample_op<Handler>(
+                std::forward<Handler>(handler), Clock::now(), true, this));
     }
 
 private:
@@ -235,12 +240,13 @@ private:
                     // The latency is too high to maintain the desired
                     // period so don't bother with a timer.
                     //
-                    m_probe->m_ios.post(
+                    boost::asio::post(
+                        m_probe->m_ios,
                         sample_op<Handler>(m_handler, now, m_repeat, m_probe));
                 }
                 else
                 {
-                    m_probe->m_timer.expires_from_now(when - now);
+                    m_probe->m_timer.expires_after(when - now);
                     m_probe->m_timer.async_wait(
                         sample_op<Handler>(m_handler, now, m_repeat, m_probe));
                 }
@@ -253,7 +259,8 @@ private:
             if (!m_probe)
                 return;
             typename Clock::time_point const now(Clock::now());
-            m_probe->m_ios.post(
+            boost::asio::post(
+                m_probe->m_ios,
                 sample_op<Handler>(m_handler, now, m_repeat, m_probe));
         }
     };

include/xrpl/beast/test/yield_to.h

@@ -8,9 +8,12 @@
 #ifndef BEAST_TEST_YIELD_TO_HPP
 #define BEAST_TEST_YIELD_TO_HPP
 
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 #include <boost/asio/spawn.hpp>
 #include <boost/optional.hpp>
+#include <boost/thread/csbl/memory/allocator_arg.hpp>
+
 #include <condition_variable>
 #include <functional>
 #include <mutex>
@@ -29,10 +32,12 @@ namespace test {
 class enable_yield_to
 {
 protected:
-    boost::asio::io_service ios_;
+    boost::asio::io_context ios_;
 
 private:
-    boost::optional<boost::asio::io_service::work> work_;
+    boost::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        work_;
     std::vector<std::thread> threads_;
     std::mutex m_;
     std::condition_variable cv_;
@@ -42,7 +47,8 @@ public:
     /// The type of yield context passed to functions.
     using yield_context = boost::asio::yield_context;
 
-    explicit enable_yield_to(std::size_t concurrency = 1) : work_(ios_)
+    explicit enable_yield_to(std::size_t concurrency = 1)
+        : work_(boost::asio::make_work_guard(ios_))
     {
         threads_.reserve(concurrency);
         while (concurrency--)
@@ -56,9 +62,9 @@ public:
             t.join();
     }
 
-    /// Return the `io_service` associated with the object
-    boost::asio::io_service&
-    get_io_service()
+    /// Return the `io_context` associated with the object
+    boost::asio::io_context&
+    get_io_context()
     {
         return ios_;
     }
@@ -111,13 +117,18 @@ enable_yield_to::spawn(F0&& f, FN&&... fn)
 {
     boost::asio::spawn(
         ios_,
+        boost::allocator_arg,
+        boost::context::fixedsize_stack(2 * 1024 * 1024),
         [&](yield_context yield) {
             f(yield);
             std::lock_guard lock{m_};
             if (--running_ == 0)
                 cv_.notify_all();
         },
-        boost::coroutines::attributes(2 * 1024 * 1024));
+        [](std::exception_ptr e) {
+            if (e)
+                std::rethrow_exception(e);
+        });
     spawn(fn...);
 }
 

include/xrpl/hook/Enum.h

@@ -313,6 +313,7 @@ enum keylet_code : uint32_t {
     MPTOKEN = 34,
     CREDENTIAL = 35,
     PERMISSIONED_DOMAIN = 36,
+    MANIFEST = 37,
 };
 }
 
@@ -382,7 +383,7 @@ enum class hook_return_code : int64_t {
     INVALID_KEY = -41,   // user supplied key was not valid
     NOT_A_STRING = -42,  // nul terminator missing from a string argument
     MEM_OVERLAP = -43,   // one or more specified buffers are the same memory
-    TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 5000 modified state
+    TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 256 modified state
                                          // entires in the combined hook chains
     TOO_MANY_NAMESPACES = -45
 };
@@ -403,6 +404,18 @@ const double fee_base_multiplier = 1.1f;
 
 using APIWhitelist = std::map<std::string, std::vector<uint8_t>>;
 
+namespace detail {
+template <class T>
+constexpr uint8_t wasmTypeCode = sizeof(T) == 8 ? 0x7EU : 0x7FU;
+
+template <class R, class... Args>
+std::vector<uint8_t>
+wasmSignature(R (*)(Args...))
+{
+    return {wasmTypeCode<R>, wasmTypeCode<Args>...};
+}
+}  // namespace detail
+
 // RH NOTE: Find descriptions of api functions in ./impl/applyHook.cpp and
 // hookapi.h (include for hooks) this is a map of the api name to its return
 // code (vec[0] and its parameters vec[>0]) as wasm type codes
@@ -414,25 +427,15 @@ getImportWhitelist(Rules const& rules)
 #pragma push_macro("HOOK_API_DEFINITION")
 #undef HOOK_API_DEFINITION
 
-#define int64_t 0x7EU
-#define int32_t 0x7FU
-#define uint32_t 0x7FU
-
-#define HOOK_WRAP_PARAMS(...) __VA_ARGS__
-
 #define HOOK_API_DEFINITION(                                \
     RETURN_TYPE, FUNCTION_NAME, PARAMS_TUPLE, AMENDMENT)    \
     if (AMENDMENT == uint256{} || rules.enabled(AMENDMENT)) \
-        whitelist[#FUNCTION_NAME] = {                       \
-            RETURN_TYPE, HOOK_WRAP_PARAMS PARAMS_TUPLE};
+        whitelist[#FUNCTION_NAME] =                         \
+            detail::wasmSignature((RETURN_TYPE(*) PARAMS_TUPLE) nullptr);
 
 #include "hook_api.macro"
 
 #undef HOOK_API_DEFINITION
-#undef HOOK_WRAP_PARAMS
-#undef int64_t
-#undef int32_t
-#undef uint32_t
 #pragma pop_macro("HOOK_API_DEFINITION")
 
     return whitelist;

include/xrpl/hook/Guard.h

@@ -87,7 +87,7 @@ parseSignedLeb128(
         }
         *end_offset = i;
         if (shift < 64 && (b & 0x40U))
-            val |= (~0 << shift);
+            val |= (~int64_t{0} << shift);
 
         return val;
     }

include/xrpl/hook/Macro.h

@@ -244,7 +244,13 @@
                                << "Tried to accept/rollback but specified "    \
                                   "memory outside of the wasm instance "       \
                                << "limit when specifying a reason string";     \
-                return OUT_OF_BOUNDS;                                          \
+                if (!view.rules().enabled(fix20260929))                        \
+                    return OUT_OF_BOUNDS;                                      \
+                /* fix20260929: terminate as a rollback so the                 \
+                   failure is visible in HookExecution metadata */             \
+                hookCtx.result.exitType = hook_api::ExitType::ROLLBACK;        \
+                hookCtx.result.exitCode = (int64_t)OUT_OF_BOUNDS;              \
+                return RC_ROLLBACK;                                            \
             }                                                                  \
             /* assembly script and some other languages use utf16 for strings  \
              */                                                                \

include/xrpl/hook/hook_api.macro

@@ -1,374 +1,301 @@
-// int32_t _g(uint32_t guard_id, uint32_t maxiter);
+// clang-format off
 HOOK_API_DEFINITION(
-  int32_t, _g, (uint32_t, uint32_t),
+  int32_t, _g, (uint32_t guard_id, uint32_t maxiter),
   uint256{})
 
-// int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
 HOOK_API_DEFINITION(
-  int64_t, accept, (uint32_t, uint32_t, int64_t),
+  int64_t, accept, (uint32_t read_ptr, uint32_t read_len, int64_t error_code),
   uint256{})
 
-// int64_t rollback(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
 HOOK_API_DEFINITION(
-  int64_t, rollback, (uint32_t, uint32_t, int64_t),
+  int64_t, rollback, (uint32_t read_ptr, uint32_t read_len, int64_t error_code),
   uint256{})
 
-// int64_t util_raddr(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, util_raddr, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_raddr, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t util_accid(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, util_accid, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_accid, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t util_verify(uint32_t dread_ptr, uint32_t dread_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t kread_ptr, uint32_t kread_len);
 HOOK_API_DEFINITION(
-  int64_t, util_verify, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_verify, (uint32_t dread_ptr, uint32_t dread_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t kread_ptr, uint32_t kread_len),
   uint256{})
 
-// int64_t util_sha512h(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, util_sha512h, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_sha512h, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t util_keylet(uint32_t write_ptr, uint32_t write_len, uint32_t keylet_type, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f);
 HOOK_API_DEFINITION(
-  int64_t, util_keylet, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_keylet, (uint32_t write_ptr, uint32_t write_len, uint32_t keylet_type, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f),
   uint256{})
 
-// int64_t sto_validate(uint32_t tread_ptr, uint32_t tread_len);
 HOOK_API_DEFINITION(
-  int64_t, sto_validate, (uint32_t, uint32_t),
+  int64_t, sto_validate, (uint32_t tread_ptr, uint32_t tread_len),
   uint256{})
 
-// int64_t sto_subfield(uint32_t read_ptr, uint32_t read_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_subfield, (uint32_t, uint32_t, uint32_t),
+  int64_t, sto_subfield, (uint32_t read_ptr, uint32_t read_len, uint32_t field_id),
   uint256{})
 
-// int64_t sto_subarray(uint32_t read_ptr, uint32_t read_len, uint32_t array_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_subarray, (uint32_t, uint32_t, uint32_t),
+  int64_t, sto_subarray, (uint32_t read_ptr, uint32_t read_len, uint32_t array_id),
   uint256{})
 
-// int64_t sto_emplace(uint32_t write_ptr, uint32_t write_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t fread_ptr, uint32_t fread_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_emplace, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, sto_emplace, (uint32_t write_ptr, uint32_t write_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t fread_ptr, uint32_t fread_len, uint32_t field_id),
   uint256{})
 
-// int64_t sto_erase(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_erase, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, sto_erase, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t field_id),
   uint256{})
 
-// int64_t etxn_burden();
 HOOK_API_DEFINITION(
   int64_t, etxn_burden, (),
   uint256{})
 
-// int64_t etxn_details(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, etxn_details, (uint32_t, uint32_t),
+  int64_t, etxn_details, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t etxn_fee_base(uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, etxn_fee_base, (uint32_t, uint32_t),
+  int64_t, etxn_fee_base, (uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t etxn_reserve(uint32_t count);
 HOOK_API_DEFINITION(
-  int64_t, etxn_reserve, (uint32_t),
+  int64_t, etxn_reserve, (uint32_t count),
   uint256{})
 
-// int64_t etxn_generation();
 HOOK_API_DEFINITION(
   int64_t, etxn_generation, (),
   uint256{})
 
-// int64_t etxn_nonce(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, etxn_nonce, (uint32_t, uint32_t),
+  int64_t, etxn_nonce, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t emit(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, emit, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, emit, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t float_set(int32_t exponent, int64_t mantissa);
 HOOK_API_DEFINITION(
-  int64_t, float_set, (int32_t, int64_t),
+  int64_t, float_set, (int32_t exponent, int64_t mantissa),
   uint256{})
 
-// int64_t float_multiply(int64_t float1, int64_t float2);
 HOOK_API_DEFINITION(
-  int64_t, float_multiply, (int64_t, int64_t),
+  int64_t, float_multiply, (int64_t float1, int64_t float2),
   uint256{})
 
-// int64_t float_mulratio(int64_t float1, uint32_t round_up, uint32_t numerator, uint32_t denominator);
 HOOK_API_DEFINITION(
-  int64_t, float_mulratio, (int64_t, uint32_t, uint32_t, uint32_t),
+  int64_t, float_mulratio, (int64_t float1, uint32_t round_up, uint32_t numerator, uint32_t denominator),
   uint256{})
 
-// int64_t float_negate(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_negate, (int64_t),
+  int64_t, float_negate, (int64_t float1),
   uint256{})
 
-// int64_t float_compare(int64_t float1, int64_t float2, uint32_t mode);
 HOOK_API_DEFINITION(
-  int64_t, float_compare, (int64_t, int64_t, uint32_t),
+  int64_t, float_compare, (int64_t float1, int64_t float2, uint32_t mode),
   uint256{})
 
-// int64_t float_sum(int64_t float1, int64_t float2);
 HOOK_API_DEFINITION(
-  int64_t, float_sum, (int64_t, int64_t),
+  int64_t, float_sum, (int64_t float1, int64_t float2),
   uint256{})
 
-// int64_t float_sto(uint32_t write_ptr, uint32_t write_len, uint32_t cread_ptr, uint32_t cread_len, uint32_t iread_ptr, uint32_t iread_len, int64_t float1, uint32_t field_code);
 HOOK_API_DEFINITION(
-  int64_t, float_sto, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, int64_t, uint32_t),
+  int64_t, float_sto, (uint32_t write_ptr, uint32_t write_len, uint32_t cread_ptr, uint32_t cread_len, uint32_t iread_ptr, uint32_t iread_len, int64_t float1, uint32_t field_code),
   uint256{})
 
-// int64_t float_sto_set(uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, float_sto_set, (uint32_t, uint32_t),
+  int64_t, float_sto_set, (uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t float_invert(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_invert, (int64_t),
+  int64_t, float_invert, (int64_t float1),
   uint256{})
 
-// int64_t float_divide(int64_t float1, int64_t float2);
 HOOK_API_DEFINITION(
-  int64_t, float_divide, (int64_t, int64_t),
+  int64_t, float_divide, (int64_t float1, int64_t float2),
   uint256{})
 
-// int64_t float_one();
 HOOK_API_DEFINITION(
   int64_t, float_one, (),
   uint256{})
 
-// int64_t float_mantissa(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_mantissa, (int64_t),
+  int64_t, float_mantissa, (int64_t float1),
   uint256{})
 
-// int64_t float_sign(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_sign, (int64_t),
+  int64_t, float_sign, (int64_t float1),
   uint256{})
 
-// int64_t float_int(int64_t float1, uint32_t decimal_places, uint32_t abs);
 HOOK_API_DEFINITION(
-  int64_t, float_int, (int64_t, uint32_t, uint32_t),
+  int64_t, float_int, (int64_t float1, uint32_t decimal_places, uint32_t abs),
   uint256{})
 
-// int64_t float_log(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_log, (int64_t),
+  int64_t, float_log, (int64_t float1),
   uint256{})
 
-// int64_t float_root(int64_t float1, uint32_t n);
 HOOK_API_DEFINITION(
-  int64_t, float_root, (int64_t, uint32_t),
+  int64_t, float_root, (int64_t float1, uint32_t n),
   uint256{})
 
-// int64_t fee_base();
 HOOK_API_DEFINITION(
   int64_t, fee_base, (),
   uint256{})
 
-// int64_t ledger_seq();
 HOOK_API_DEFINITION(
   int64_t, ledger_seq, (),
   uint256{})
 
-// int64_t ledger_last_time();
 HOOK_API_DEFINITION(
   int64_t, ledger_last_time, (),
   uint256{})
 
-// int64_t ledger_last_hash(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, ledger_last_hash, (uint32_t, uint32_t),
+  int64_t, ledger_last_hash, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t ledger_nonce(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, ledger_nonce, (uint32_t, uint32_t),
+  int64_t, ledger_nonce, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t ledger_keylet(uint32_t write_ptr, uint32_t write_len, uint32_t lread_ptr, uint32_t lread_len, uint32_t hread_ptr, uint32_t hread_len);
 HOOK_API_DEFINITION(
-  int64_t, ledger_keylet, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, ledger_keylet, (uint32_t write_ptr, uint32_t write_len, uint32_t lread_ptr, uint32_t lread_len, uint32_t hread_ptr, uint32_t hread_len),
   uint256{})
 
-// int64_t hook_account(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, hook_account, (uint32_t, uint32_t),
+  int64_t, hook_account, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t hook_hash(uint32_t write_ptr, uint32_t write_len, int32_t hook_no);
 HOOK_API_DEFINITION(
-  int64_t, hook_hash, (uint32_t, uint32_t, int32_t),
+  int64_t, hook_hash, (uint32_t write_ptr, uint32_t write_len, int32_t hook_no),
   uint256{})
 
-// int64_t hook_param_set(uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t hread_ptr, uint32_t hread_len);
 HOOK_API_DEFINITION(
-  int64_t, hook_param_set, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, hook_param_set, (uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t hread_ptr, uint32_t hread_len),
   uint256{})
 
-// int64_t hook_param(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, hook_param, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, hook_param, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t hook_again();
 HOOK_API_DEFINITION(
   int64_t, hook_again, (),
   uint256{})
 
-// int64_t hook_skip(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
 HOOK_API_DEFINITION(
-  int64_t, hook_skip, (uint32_t, uint32_t, uint32_t),
+  int64_t, hook_skip, (uint32_t read_ptr, uint32_t read_len, uint32_t flags),
   uint256{})
 
-// int64_t hook_pos();
 HOOK_API_DEFINITION(
   int64_t, hook_pos, (),
   uint256{})
 
-// int64_t slot(uint32_t write_ptr, uint32_t write_len, uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot, (uint32_t write_ptr, uint32_t write_len, uint32_t slot),
   uint256{})
 
-// int64_t slot_clear(uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_clear, (uint32_t),
+  int64_t, slot_clear, (uint32_t slot),
   uint256{})
 
-// int64_t slot_count(uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_count, (uint32_t),
+  int64_t, slot_count, (uint32_t slot),
   uint256{})
 
-// int64_t slot_set(uint32_t read_ptr, uint32_t read_len, uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_set, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot_set, (uint32_t read_ptr, uint32_t read_len, uint32_t slot),
   uint256{})
 
-// int64_t slot_size(uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_size, (uint32_t),
+  int64_t, slot_size, (uint32_t slot),
   uint256{})
 
-// int64_t slot_subarray(uint32_t parent_slot, uint32_t array_id, uint32_t new_slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_subarray, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot_subarray, (uint32_t parent_slot, uint32_t array_id, uint32_t new_slot),
   uint256{})
 
-// int64_t slot_subfield(uint32_t parent_slot, uint32_t field_id, uint32_t new_slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_subfield, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot_subfield, (uint32_t parent_slot, uint32_t field_id, uint32_t new_slot),
   uint256{})
 
-// int64_t slot_type(uint32_t slot_no, uint32_t flags);
 HOOK_API_DEFINITION(
-  int64_t, slot_type, (uint32_t, uint32_t),
+  int64_t, slot_type, (uint32_t slot_no, uint32_t flags),
   uint256{})
 
-// int64_t slot_float(uint32_t slot_no);
 HOOK_API_DEFINITION(
-  int64_t, slot_float, (uint32_t),
+  int64_t, slot_float, (uint32_t slot_no),
   uint256{})
 
-// int64_t state_set(uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len);
 HOOK_API_DEFINITION(
-  int64_t, state_set, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state_set, (uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len),
   uint256{})
 
-// int64_t state_foreign_set(uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len);
 HOOK_API_DEFINITION(
-  int64_t, state_foreign_set, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state_foreign_set, (uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len),
   uint256{})
 
-// int64_t state(uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len);
 HOOK_API_DEFINITION(
-  int64_t, state, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state, (uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len),
   uint256{})
 
-// int64_t state_foreign(uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len);
 HOOK_API_DEFINITION(
-  int64_t, state_foreign, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state_foreign, (uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len),
   uint256{})
 
-// int64_t trace(uint32_t mread_ptr, uint32_t mread_len, uint32_t dread_ptr, uint32_t dread_len, uint32_t as_hex);
 HOOK_API_DEFINITION(
-  int64_t, trace, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, trace, (uint32_t mread_ptr, uint32_t mread_len, uint32_t dread_ptr, uint32_t dread_len, uint32_t as_hex),
   uint256{})
 
-// int64_t trace_num(uint32_t read_ptr, uint32_t read_len, int64_t number);
 HOOK_API_DEFINITION(
-  int64_t, trace_num, (uint32_t, uint32_t, int64_t),
+  int64_t, trace_num, (uint32_t read_ptr, uint32_t read_len, int64_t number),
   uint256{})
 
-// int64_t trace_float(uint32_t read_ptr, uint32_t read_len, int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, trace_float, (uint32_t, uint32_t, int64_t),
+  int64_t, trace_float, (uint32_t read_ptr, uint32_t read_len, int64_t float1),
   uint256{})
 
-// int64_t otxn_burden();
 HOOK_API_DEFINITION(
   int64_t, otxn_burden, (),
   uint256{})
 
-// int64_t otxn_field(uint32_t write_ptr, uint32_t write_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, otxn_field, (uint32_t, uint32_t, uint32_t),
+  int64_t, otxn_field, (uint32_t write_ptr, uint32_t write_len, uint32_t field_id),
   uint256{})
 
-// int64_t otxn_generation();
 HOOK_API_DEFINITION(
   int64_t, otxn_generation, (),
   uint256{})
 
-// int64_t otxn_id(uint32_t write_ptr, uint32_t write_len, uint32_t flags);
 HOOK_API_DEFINITION(
-  int64_t, otxn_id, (uint32_t, uint32_t, uint32_t),
+  int64_t, otxn_id, (uint32_t write_ptr, uint32_t write_len, uint32_t flags),
   uint256{})
 
-// int64_t otxn_type();
 HOOK_API_DEFINITION(
   int64_t, otxn_type, (),
   uint256{})
 
-// int64_t otxn_slot(uint32_t slot_no);
 HOOK_API_DEFINITION(
-  int64_t, otxn_slot, (uint32_t),
+  int64_t, otxn_slot, (uint32_t slot_no),
   uint256{})
 
-// int64_t otxn_param(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, otxn_param, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, otxn_param, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t meta_slot(uint32_t slot_no);
 HOOK_API_DEFINITION(
-  int64_t, meta_slot, (uint32_t),
+  int64_t, meta_slot, (uint32_t slot_no),
   uint256{})
 
-// int64_t xpop_slot(uint32_t slot_no_tx, uint32_t slot_no_meta);
 HOOK_API_DEFINITION(
-  int64_t, xpop_slot, (uint32_t, uint32_t),
+  int64_t, xpop_slot, (uint32_t slot_no_tx, uint32_t slot_no_meta),
   featureHooksUpdate1)
 
-// int64_t prepare(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, prepare, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, prepare, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   featureHooksUpdate2)
+// clang-format on

include/xrpl/json/json_reader.h

@@ -215,7 +215,7 @@ Reader::parse(Value& root, BufferSequence const& bs)
     std::string s;
     s.reserve(buffer_size(bs));
     for (auto const& b : bs)
-        s.append(buffer_cast<char const*>(b), buffer_size(b));
+        s.append(static_cast<char const*>(b.data()), buffer_size(b));
     return parse(s, root);
 }
 

include/xrpl/protocol/Import.h

@@ -24,6 +24,7 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/basics/base64.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/json/json_reader.h>
 #include <charconv>
 
@@ -118,8 +119,9 @@ syntaxCheckProof(
         {
             if (!proof["hash"].isString() ||
                 proof["hash"].asString().size() != 64 ||
-                !proof["key"].isString() ||
+                !isHex(proof["hash"].asString()) || !proof["key"].isString() ||
                 proof["key"].asString().size() != 64 ||
+                !isHex(proof["key"].asString()) ||
                 !proof["children"].isObject())
             {
                 JLOG(j.warn()) << "XPOP.transaction.proof tree node has wrong "
@@ -132,7 +134,11 @@ syntaxCheckProof(
 
         for (const auto& branch : proof.getMemberNames())
         {
-            if (branch.size() != 1 || !isHex(branch))
+            // Upper case only: the txroot computation only looks up "0"-"F",
+            // so any other key would be silently ignored.
+            if (branch.size() != 1 ||
+                branch.find_first_not_of("0123456789ABCDEF") !=
+                    std::string::npos)
             {
                 JLOG(j.warn())
                     << "XPOP.transaction.proof child node was not 0-F "
@@ -143,9 +149,9 @@ syntaxCheckProof(
             const auto& node = proof[branch];
             if (!node.isObject() || !node["hash"].isString() ||
                 node["hash"].asString().size() != 64 ||
-                !node["key"].isString() ||
+                !isHex(node["hash"].asString()) || !node["key"].isString() ||
                 node["key"].asString().size() != 64 ||
-                !node["children"].isObject())
+                !isHex(node["key"].asString()) || !node["children"].isObject())
             {
                 JLOG(j.warn())
                     << "XPOP.transaction.proof tree node has wrong format";
@@ -465,6 +471,45 @@ getVLInfo(Json::Value const& xpop, beast::Journal const& j)
     return {{sequence, m->masterKey}};
 }
 
+// <effective, expiration> of the unl blob, effective defaulting to the epoch
+inline std::optional<std::pair<NetClock::time_point, NetClock::time_point>>
+getVLWindow(Json::Value const& xpop, beast::Journal const& j)
+{
+    auto const data =
+        base64_decode(xpop[jss::validation][jss::unl][jss::blob].asString());
+    Json::Reader r;
+    Json::Value parsed;
+    if (!r.parse(data, parsed) || !parsed.isObject())
+    {
+        JLOG(j.warn()) << "Import: unl blob was not a json object (after "
+                          "base64 decoding)";
+        return {};
+    }
+
+    // const, so that operator[] does not insert missing members
+    Json::Value const& list = parsed;
+    auto const time = [&list](Json::StaticString const& field)
+        -> std::optional<NetClock::time_point> {
+        auto const& v = list[field];
+        if (!v.isInt() || v.asInt() < 0)
+            return {};
+        return NetClock::time_point{NetClock::duration{v.asUInt()}};
+    };
+
+    auto const validUntil = time(jss::expiration);
+    auto const validFrom = list.isMember(jss::effective)
+        ? time(jss::effective)
+        : std::optional<NetClock::time_point>{NetClock::time_point{}};
+    if (!validUntil || !validFrom)
+    {
+        JLOG(j.warn()) << "Import: unl blob json (after base64 decoding) "
+                          "had missing or invalid effective/expiration";
+        return {};
+    }
+
+    return {{*validFrom, *validUntil}};
+}
+
 }  // namespace ripple
 
 #endif

include/xrpl/protocol/Indexes.h

@@ -372,6 +372,10 @@ permissionedDomain(AccountID const& account, std::uint32_t seq) noexcept;
 
 Keylet
 permissionedDomain(uint256 const& domainID) noexcept;
+
+Keylet
+manifest(PublicKey const& pk) noexcept;
+
 }  // namespace keylet
 
 // Everything below is deprecated and should be removed in favor of keylets:

include/xrpl/protocol/TER.h

@@ -69,6 +69,7 @@ enum TELcodes : TERUnderlyingType {
     telIMPORT_VL_KEY_NOT_RECOGNISED,
     telCAN_NOT_QUEUE_IMPORT,
     telENV_RPC_FAILED,
+    telMANIFEST_FEE_MISMATCH,
 };
 
 //------------------------------------------------------------------------------
@@ -194,6 +195,8 @@ enum TEFcodes : TERUnderlyingType {
     tefNONDIR_EMIT,
     tefIMPORT_BLACKHOLED,
     tefINVALID_LEDGER_FIX_TYPE,
+    tefPAST_MANIFEST_SEQ,
+    tefREVOKED_MANIFEST,
 };
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/detail/features.macro

@@ -34,6 +34,11 @@
 // If you add an amendment here, then do not forget to increment `numFeatures`
 // in include/xrpl/protocol/Feature.h.
 
+XRPL_FIX    (20261005,                   Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(EscrowDestinationCancel,    Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (20260929,                   Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(HookOnV2_1,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(OnChainManifests,           Supported::yes,  VoteBehavior::DefaultNo)
 XRPL_FIX    (HookMap,                    Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (GuardDepth32,               Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(NamedHooks,                 Supported::yes, VoteBehavior::DefaultNo)
@@ -44,7 +49,7 @@ XRPL_FEATURE(HookAPISerializedType240,   Supported::yes, VoteBehavior::DefaultNo
 XRPL_FEATURE(PermissionedDomains,        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(DynamicNFT,                 Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(Credentials,                Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(AMMClawback,                Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(AMMClawback,                Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(MPTokensV1,                 Supported::no,  VoteBehavior::DefaultNo)
 // InvariantsV1_1 will be changes to Supported::yes when all the
 // invariants expected to be included under it are complete.
@@ -64,7 +69,8 @@ XRPL_FEATURE(XChainBridge,               Supported::no,  VoteBehavior::DefaultNo
 XRPL_FEATURE(AMM,                        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (ReducedOffersV1,            Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(HooksUpdate2,               Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(HookOnV2,                   Supported::yes, VoteBehavior::DefaultNo)
+// replaced to HookOnV2_1
+XRPL_FEATURE(HookOnV2,                   Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (HookAPI20251128,            Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (CronStacking,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(ExtendedHookState,          Supported::yes, VoteBehavior::DefaultNo)
@@ -88,8 +94,6 @@ XRPL_FIX    (240819,                     Supported::yes, VoteBehavior::DefaultYe
 XRPL_FIX    (NSDelete,                   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ZeroB2M,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Remit,                      Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (XahauV2,                    Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (XahauV1,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(HooksUpdate1,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(XahauGenesis,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(Import,                     Supported::yes, VoteBehavior::DefaultYes)
@@ -160,6 +164,8 @@ XRPL_FEATURE(CryptoConditionsSuite, Supported::yes, VoteBehavior::Obsolete)
 // pre-amendment code has been removed and the identifiers are deprecated.
 // All known amendments and amendments that may appear in a validated
 // ledger must be registered either here or above with the "active" amendments
+XRPL_RETIRE(fixXahauV2)
+XRPL_RETIRE(fixXahauV1)
 XRPL_RETIRE(MultiSign)
 XRPL_RETIRE(TrustSetAuth)
 XRPL_RETIRE(FeeEscalation)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -22,14 +22,14 @@
 #endif
 
 #ifndef LEDGER_ENTRY_DUPLICATE
-// The EXPAND macro is needed for Windows
+// The LEDGER_ENTRY_EXPAND macro is needed for Windows
 // https://stackoverflow.com/questions/5134523/msvc-doesnt-expand-va-args-correctly
-#define EXPAND(x) x
+#define LEDGER_ENTRY_EXPAND(x) x
 
 // The `LEDGER_ENTRY_DUPLICATE macro is needed to avoid JSS conflicts
 // Since some transactions and ledger entries have the same name (like `DepositPreauth`)
 // The compiler won't accept two instances of `JSS(DepositPreauth)`
-#define LEDGER_ENTRY_DUPLICATE(...) EXPAND(LEDGER_ENTRY(__VA_ARGS__))
+#define LEDGER_ENTRY_DUPLICATE(...) LEDGER_ENTRY_EXPAND(LEDGER_ENTRY(__VA_ARGS__))
 #endif
 
 /**
@@ -262,6 +262,7 @@ LEDGER_ENTRY(ltACCOUNT_ROOT, 0x0061, AccountRoot, account, ({
     {sfHookStateScale,       soeOPTIONAL},
     {sfCron,                 soeOPTIONAL},
     {sfAMMID,                soeOPTIONAL},
+    {sfManifestID,           soeOPTIONAL},
 }))
 
 /** A ledger object which contains a list of object identifiers.
@@ -592,6 +593,26 @@ LEDGER_ENTRY(ltDID, 0x008D, DID, did, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
-#undef EXPAND
+LEDGER_ENTRY(ltMANIFEST, 0x004D, Manifest, manifest_entry, ({
+    {sfAccount,             soeREQUIRED},
+    {sfPublicKey,           soeREQUIRED},
+    {sfSigningPubKey,       soeOPTIONAL}, /* may be absent if the master is revoked */
+    {sfSequence,            soeREQUIRED},
+    /* sfVersion defaults to 0 and is omitted from the signed payload when
+       absent. Storing it unconditionally would change the bytes and break
+       signature verification when the manifest is reconstructed. */
+    {sfVersion,             soeOPTIONAL},
+    {sfDomain,              soeOPTIONAL},
+    /* The signatures are mirrored so the object is a lossless copy of the
+       manifest and can be independently verified, and re-served to peers,
+       by any node reading it (see ManifestCache::applyLedger). */
+    {sfMasterSignature,     soeREQUIRED},
+    {sfSignature,           soeOPTIONAL}, /* absent if the master is revoked */
+    {sfManifestID,          soeOPTIONAL}, /* pointer to the identical other copy on the other key */
+    {sfPreviousTxnID,       soeREQUIRED},
+    {sfPreviousTxnLgrSeq,   soeREQUIRED},
+}))
+
+#undef LEDGER_ENTRY_EXPAND
 #undef LEDGER_ENTRY_DUPLICATE
 

include/xrpl/protocol/detail/sfields.macro

@@ -210,6 +210,7 @@ TYPED_SFIELD(sfOfferID,                  UINT256,   34)
 TYPED_SFIELD(sfEscrowID,                 UINT256,   35)
 TYPED_SFIELD(sfURITokenID,               UINT256,   36)
 TYPED_SFIELD(sfDomainID,                 UINT256,   37)
+TYPED_SFIELD(sfManifestID,               UINT256,   91)
 TYPED_SFIELD(sfHookOnOutgoing,           UINT256,   93)
 TYPED_SFIELD(sfHookOnIncoming,           UINT256,   94)
 TYPED_SFIELD(sfCron,                     UINT256,   95)
@@ -382,6 +383,7 @@ UNTYPED_SFIELD(sfXChainClaimAttestationCollectionElement, OBJECT, 30)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestationCollectionElement, OBJECT, 31)
 UNTYPED_SFIELD(sfPriceData,              OBJECT,    32)
 UNTYPED_SFIELD(sfCredential,             OBJECT,    33)
+UNTYPED_SFIELD(sfManifest,               OBJECT,    90)
 UNTYPED_SFIELD(sfAmountEntry,            OBJECT,    91)
 UNTYPED_SFIELD(sfMintURIToken,           OBJECT,    92)
 UNTYPED_SFIELD(sfHookEmission,           OBJECT,    93)

include/xrpl/protocol/detail/transactions.macro

@@ -500,6 +500,12 @@ TRANSACTION(ttPERMISSIONED_DOMAIN_DELETE, 72, PermissionedDomainDelete, ({
     {sfDomainID, soeREQUIRED},
 }))
 
+/* sfAccount is supplied by TxFormats::commonFields; listing it here as well
+   makes the SOTemplate reject the format at construction. */
+TRANSACTION(ttMANIFEST_SET, 91, SetManifest, ({
+    {sfManifest, soeREQUIRED},
+}))
+
 /* A pseudo-txn alarm signal for invoking a hook, emitted by validators after alarm set conditions are met */
 TRANSACTION(ttCRON, 92, Cron, ({
     {sfOwner, soeREQUIRED},

include/xrpl/protocol/jss.h

@@ -47,6 +47,7 @@ JSS(AL_hit_rate);    // out: GetCounts
 JSS(AcceptedCredentials);  // out: AccountObjects
 JSS(Account);        // in: TransactionSign; field.
 JSS(AMMID);          // field
+JSS(API);            // out: RPC server_definitions (HOOK)
 JSS(Amount);         // in: TransactionSign; field.
 JSS(Authorize);      // field
 JSS(Amount2);        // in/out: AMM IOU/XRP pool, deposit, withdraw amount
@@ -68,6 +69,9 @@ JSS(Destination);      // in: TransactionSign; field.
 JSS(EPrice);           // in: AMM Deposit option
 JSS(Fee);              // in/out: TransactionSign; field.
 JSS(FIELDS);           // out: RPC server_definitions
+JSS(HOOK);             // out: RPC server_definitions
+JSS(KEYLET_TYPES);     // out: RPC server_definitions (HOOK)
+JSS(RETURN_CODES);     // out: RPC server_definitions (HOOK)
 JSS(Flags);            // in/out: TransactionSign; field.
 JSS(GenesisMints);
 JSS(GovernanceMarks);
@@ -292,7 +296,9 @@ JSS(duration_us);             // out: NetworkOPs
 JSS(effective);               // out: ValidatorList
                               // in: UNL
 JSS(elapsed_seconds);
-JSS(enabled);                // out: AmendmentTable
+JSS(enabled);                // out: AmendmentTable (on-ledger);
+                             //      ServerDefinitions (this server)
+JSS(ledger_enabled);         // out: ServerDefinitions (on-ledger)
 JSS(engine_result);          // out: NetworkOPs, TransactionSign, Submit
 JSS(engine_result_code);     // out: NetworkOPs, TransactionSign, Submit
 JSS(engine_result_message);  // out: NetworkOPs, TransactionSign, Submit
@@ -350,6 +356,7 @@ JSS(hash_mismatches);       // out: catalogue
 JSS(have_header);           // out: InboundLedger
 JSS(have_state);            // out: InboundLedger
 JSS(have_transactions);     // out: InboundLedger
+JSS(hooks);                 // in/out: AccountInfo
 JSS(high);                  // out: BookChanges
 JSS(highest_sequence);      // out: AccountInfo
 JSS(highest_ticket);        // out: AccountInfo

include/xrpl/server/Server.h

@@ -24,7 +24,8 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/server/Port.h>
 #include <xrpl/server/detail/ServerImpl.h>
-#include <boost/asio/io_service.hpp>
+
+#include <boost/asio/io_context.hpp>
 
 namespace ripple {
 
@@ -33,10 +34,10 @@ template <class Handler>
 std::unique_ptr<Server>
 make_Server(
     Handler& handler,
-    boost::asio::io_service& io_service,
+    boost::asio::io_context& io_context,
     beast::Journal journal)
 {
-    return std::make_unique<ServerImpl<Handler>>(handler, io_service, journal);
+    return std::make_unique<ServerImpl<Handler>>(handler, io_context, journal);
 }
 
 }  // namespace ripple

include/xrpl/server/Session.h

@@ -86,9 +86,7 @@ public:
              ++iter)
         {
             typename BufferSequence::value_type const& buffer(*iter);
-            write(
-                boost::asio::buffer_cast<void const*>(buffer),
-                boost::asio::buffer_size(buffer));
+            write(buffer.data(), boost::asio::buffer_size(buffer));
         }
     }
 
@@ -102,7 +100,7 @@ public:
 
     /** Detach the session.
         This holds the session open so that the response can be sent
-        asynchronously. Calls to io_service::run made by the server
+        asynchronously. Calls to io_context::run made by the server
         will not return until all detached sessions are closed.
     */
     virtual std::shared_ptr<Session>

include/xrpl/server/detail/BaseHTTPPeer.h

@@ -24,10 +24,12 @@
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/server/Session.h>
+#include <xrpl/server/detail/Spawn.h>
 #include <xrpl/server/detail/io_list.h>
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/asio/spawn.hpp>
 #include <boost/asio/ssl/stream.hpp>
+#include <boost/asio/strand.hpp>
 #include <boost/asio/streambuf.hpp>
 #include <boost/beast/core/stream_traits.hpp>
 #include <boost/beast/http/dynamic_body.hpp>
@@ -214,8 +216,8 @@ BaseHTTPPeer<Handler, Impl>::BaseHTTPPeer(
     ConstBufferSequence const& buffers)
     : port_(port)
     , handler_(handler)
-    , work_(executor)
-    , strand_(executor)
+    , work_(boost::asio::make_work_guard(executor))
+    , strand_(boost::asio::make_strand(executor))
     , remote_address_(remote_address)
     , journal_(journal)
 {
@@ -300,7 +302,13 @@ BaseHTTPPeer<Handler, Impl>::do_read(yield_context do_yield)
 {
     complete_ = false;
     error_code ec;
-    start_timer();
+    // Do not treat an established keep-alive waiting for its next request as
+    // an unfinished loopback request.
+    if (request_count_ == 0)
+        start_timer();
+    else
+        boost::beast::get_lowest_layer(impl().stream_)
+            .expires_after(std::chrono::seconds(timeoutSeconds));
     boost::beast::http::async_read(
         impl().stream_, read_buf_, message_, do_yield[ec]);
     cancel_timer();
@@ -355,7 +363,7 @@ BaseHTTPPeer<Handler, Impl>::on_write(
         return;
     if (graceful_)
         return do_close();
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
@@ -374,7 +382,7 @@ BaseHTTPPeer<Handler, Impl>::do_writer(
     {
         auto const p = impl().shared_from_this();
         resume = std::function<void(void)>([this, p, writer, keep_alive]() {
-            boost::asio::spawn(
+            util::spawn(
                 strand_,
                 std::bind(
                     &BaseHTTPPeer<Handler, Impl>::do_writer,
@@ -405,7 +413,7 @@ BaseHTTPPeer<Handler, Impl>::do_writer(
     if (!keep_alive)
         return do_close();
 
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
@@ -447,14 +455,14 @@ BaseHTTPPeer<Handler, Impl>::write(
     std::shared_ptr<Writer> const& writer,
     bool keep_alive)
 {
-    boost::asio::spawn(bind_executor(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_writer,
             impl().shared_from_this(),
             writer,
             keep_alive,
-            std::placeholders::_1)));
+            std::placeholders::_1));
 }
 
 // DEPRECATED
@@ -489,12 +497,12 @@ BaseHTTPPeer<Handler, Impl>::complete()
     }
 
     // keep-alive
-    boost::asio::spawn(bind_executor(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
             impl().shared_from_this(),
-            std::placeholders::_1)));
+            std::placeholders::_1));
 }
 
 // DEPRECATED

include/xrpl/server/detail/BasePeer.h

@@ -89,8 +89,8 @@ BasePeer<Handler, Impl>::BasePeer(
               return "##" + std::to_string(++id) + " ";
           }())
     , j_(sink_)
-    , work_(executor)
-    , strand_(executor)
+    , work_(boost::asio::make_work_guard(executor))
+    , strand_(boost::asio::make_strand(executor))
 {
 }
 

include/xrpl/server/detail/BaseWSPeer.h

@@ -29,6 +29,7 @@
 #include <xrpl/server/detail/BasePeer.h>
 #include <xrpl/server/detail/LowestLayer.h>
 
+#include <boost/asio/error.hpp>
 #include <boost/beast/core/multi_buffer.hpp>
 #include <boost/beast/http/message.hpp>
 #include <boost/beast/websocket.hpp>
@@ -420,11 +421,17 @@ BaseWSPeer<Handler, Impl>::start_timer()
     // Max seconds without completing a message
     static constexpr std::chrono::seconds timeout{30};
     static constexpr std::chrono::seconds timeoutLocal{3};
-    error_code ec;
-    timer_.expires_from_now(
-        remote_endpoint().address().is_loopback() ? timeoutLocal : timeout, ec);
-    if (ec)
-        return fail(ec, "start_timer");
+
+    try
+    {
+        timer_.expires_after(
+            remote_endpoint().address().is_loopback() ? timeoutLocal : timeout);
+    }
+    catch (boost::system::system_error const& e)
+    {
+        return fail(e.code(), "start_timer");
+    }
+
     timer_.async_wait(bind_executor(
         strand_,
         std::bind(
@@ -438,8 +445,14 @@ template <class Handler, class Impl>
 void
 BaseWSPeer<Handler, Impl>::cancel_timer()
 {
-    error_code ec;
-    timer_.cancel(ec);
+    try
+    {
+        timer_.cancel();
+    }
+    catch (boost::system::system_error const&)
+    {
+        // ignored
+    }
 }
 
 template <class Handler, class Impl>

include/xrpl/server/detail/Door.h

@@ -69,7 +69,7 @@ private:
         stream_type stream_;
         socket_type& socket_;
         endpoint_type remote_address_;
-        boost::asio::io_context::strand strand_;
+        boost::asio::strand<boost::asio::io_context::executor_type> strand_;
         beast::Journal const j_;
 
     public:
@@ -95,7 +95,7 @@ private:
     Handler& handler_;
     boost::asio::io_context& ioc_;
     acceptor_type acceptor_;
-    boost::asio::io_context::strand strand_;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand_;
     bool ssl_;
     bool plain_;
 
@@ -155,7 +155,7 @@ Door<Handler>::Detector::Detector(
     , stream_(std::move(stream))
     , socket_(stream_.socket())
     , remote_address_(remote_address)
-    , strand_(ioc_)
+    , strand_(boost::asio::make_strand(ioc_))
     , j_(j)
 {
 }
@@ -164,7 +164,7 @@ template <class Handler>
 void
 Door<Handler>::Detector::run()
 {
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &Detector::do_detect,
@@ -269,7 +269,7 @@ Door<Handler>::reOpen()
         Throw<std::exception>();
     }
 
-    acceptor_.listen(boost::asio::socket_base::max_connections, ec);
+    acceptor_.listen(boost::asio::socket_base::max_listen_connections, ec);
     if (ec)
     {
         JLOG(j_.error()) << "Listen on port '" << port_.name
@@ -291,7 +291,7 @@ Door<Handler>::Door(
     , handler_(handler)
     , ioc_(io_context)
     , acceptor_(io_context)
-    , strand_(io_context)
+    , strand_(boost::asio::make_strand(io_context))
     , ssl_(
           port_.protocol.count("https") > 0 ||
           port_.protocol.count("wss") > 0 || port_.protocol.count("wss2") > 0 ||
@@ -307,7 +307,7 @@ template <class Handler>
 void
 Door<Handler>::run()
 {
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &Door<Handler>::do_accept,
@@ -320,7 +320,8 @@ void
 Door<Handler>::close()
 {
     if (!strand_.running_in_this_thread())
-        return strand_.post(
+        return boost::asio::post(
+            strand_,
             std::bind(&Door<Handler>::close, this->shared_from_this()));
     error_code ec;
     acceptor_.close(ec);
@@ -400,7 +401,7 @@ Door<Handler>::do_accept(boost::asio::yield_context do_yield)
         {
             create(
                 ssl_,
-                boost::asio::null_buffers{},
+                boost::asio::const_buffer{},
                 std::move(stream),
                 remote_address);
         }

include/xrpl/server/detail/PlainHTTPPeer.h

@@ -103,7 +103,7 @@ PlainHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remote_address_))
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(&PlainHTTPPeer::do_close, this->shared_from_this()));
         return;
@@ -112,7 +112,7 @@ PlainHTTPPeer<Handler>::run()
     if (!socket_.is_open())
         return;
 
-    boost::asio::spawn(
+    util::spawn(
         this->strand_,
         std::bind(
             &PlainHTTPPeer::do_read,

include/xrpl/server/detail/SSLHTTPPeer.h

@@ -113,14 +113,14 @@ SSLHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remote_address_))
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(&SSLHTTPPeer::do_close, this->shared_from_this()));
         return;
     }
     if (!socket_.is_open())
         return;
-    boost::asio::spawn(
+    util::spawn(
         this->strand_,
         std::bind(
             &SSLHTTPPeer::do_handshake,
@@ -162,7 +162,7 @@ SSLHTTPPeer<Handler>::do_handshake(yield_context do_yield)
         this->port().protocol.count("https") > 0;
     if (http)
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(
                 &SSLHTTPPeer::do_read,

include/xrpl/server/detail/ServerImpl.h

@@ -27,6 +27,8 @@
 #include <xrpl/server/detail/io_list.h>
 
 #include <boost/asio.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 
 #include <array>
 #include <chrono>
@@ -86,9 +88,11 @@ private:
 
     Handler& handler_;
     beast::Journal const j_;
-    boost::asio::io_service& io_service_;
-    boost::asio::io_service::strand strand_;
-    std::optional<boost::asio::io_service::work> work_;
+    boost::asio::io_context& io_context_;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand_;
+    std::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        work_;
 
     std::mutex m_;
     std::vector<Port> ports_;
@@ -101,7 +105,7 @@ private:
 public:
     ServerImpl(
         Handler& handler,
-        boost::asio::io_service& io_service,
+        boost::asio::io_context& io_context,
         beast::Journal journal);
 
     ~ServerImpl();
@@ -124,10 +128,10 @@ public:
         return ios_;
     }
 
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
-        return io_service_;
+        return io_context_;
     }
 
     bool
@@ -141,13 +145,13 @@ private:
 template <class Handler>
 ServerImpl<Handler>::ServerImpl(
     Handler& handler,
-    boost::asio::io_service& io_service,
+    boost::asio::io_context& io_context,
     beast::Journal journal)
     : handler_(handler)
     , j_(journal)
-    , io_service_(io_service)
-    , strand_(io_service_)
-    , work_(io_service_)
+    , io_context_(io_context)
+    , strand_(boost::asio::make_strand(io_context_))
+    , work_(std::in_place, boost::asio::make_work_guard(io_context_))
 {
 }
 
@@ -179,7 +183,7 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
         {
             // UDP-RPC door
             if (auto sp = ios_.emplace<UDPDoor<Handler>>(
-                    handler_, io_service_, internalPort, j_))
+                    handler_, io_context_, internalPort, j_))
             {
                 auto ep = sp->get_endpoint();
                 if (!internalPort.port)
@@ -193,7 +197,7 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
         {
             // Standard TCP door
             if (auto sp = ios_.emplace<Door<Handler>>(
-                    handler_, io_service_, internalPort, j_))
+                    handler_, io_context_, internalPort, j_))
             {
                 list_.push_back(sp);
 

include/xrpl/server/detail/Spawn.h

@@ -0,0 +1,111 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright(c) 2025 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_SERVER_SPAWN_H_INCLUDED
+#define RIPPLE_SERVER_SPAWN_H_INCLUDED
+
+#include <xrpl/basics/Log.h>
+
+#include <boost/asio/spawn.hpp>
+#include <boost/asio/strand.hpp>
+
+#include <concepts>
+#include <type_traits>
+
+namespace ripple::util {
+namespace impl {
+
+template <typename T>
+concept IsStrand = std::same_as<
+    std::decay_t<T>,
+    boost::asio::strand<typename std::decay_t<T>::inner_executor_type>>;
+
+/**
+ * @brief A completion handler that restores `boost::asio::spawn`'s behaviour
+ * from Boost 1.83
+ *
+ * This is intended to be passed as the third argument to `boost::asio::spawn`
+ * so that exceptions are not ignored but propagated to `io_context.run()` call
+ * site.
+ *
+ * @param ePtr The exception that was caught on the coroutine
+ */
+inline constexpr auto kPROPAGATE_EXCEPTIONS = [](std::exception_ptr ePtr) {
+    if (ePtr)
+    {
+        try
+        {
+            std::rethrow_exception(ePtr);
+        }
+        catch (std::exception const& e)
+        {
+            JLOG(debugLog().warn()) << "Spawn exception: " << e.what();
+            throw;
+        }
+        catch (...)
+        {
+            JLOG(debugLog().warn()) << "Spawn exception: Unknown";
+            throw;
+        }
+    }
+};
+
+}  // namespace impl
+
+/**
+ * @brief Spawns a coroutine using `boost::asio::spawn`
+ *
+ * @note This uses kPROPAGATE_EXCEPTIONS to force asio to propagate exceptions
+ * through `io_context`
+ * @note Since implicit strand was removed from boost::asio::spawn this helper
+ * function adds the strand back
+ *
+ * @tparam Ctx The type of the context/strand
+ * @tparam F The type of the function to execute
+ * @param ctx The execution context
+ * @param func The function to execute. Must return `void`
+ */
+template <typename Ctx, typename F>
+    requires std::is_invocable_r_v<void, F, boost::asio::yield_context>
+void
+spawn(Ctx&& ctx, F&& func)
+{
+    if constexpr (impl::IsStrand<Ctx>)
+    {
+        boost::asio::spawn(
+            std::forward<Ctx>(ctx),
+            std::forward<F>(func),
+            impl::kPROPAGATE_EXCEPTIONS);
+    }
+    else
+    {
+        // make_strand accepts an executor or an execution context directly.
+        // Going through get_associated_executor here resolved a plain
+        // executor to asio's inline executor, which cannot be stranded and
+        // did not compile; nothing in the tree had instantiated this branch.
+        boost::asio::spawn(
+            boost::asio::make_strand(std::forward<Ctx>(ctx)),
+            std::forward<F>(func),
+            impl::kPROPAGATE_EXCEPTIONS);
+    }
+}
+
+}  // namespace ripple::util
+
+#endif

include/xrpl/server/detail/io_list.h

@@ -166,7 +166,7 @@ public:
             May be called concurrently.
 
         Preconditions:
-            No call to io_service::run on any io_service
+            No call to io_context::run on any io_context
             used by work objects associated with this io_list
             exists in the caller's call stack.
     */

src/libxrpl/basics/ResolverAsio.cpp

@@ -22,7 +22,14 @@
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <boost/asio.hpp>
+
+#include <boost/asio/bind_executor.hpp>
+#include <boost/asio/error.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/system/detail/error_code.hpp>
+
+#include <algorithm>
 #include <atomic>
 #include <condition_variable>
 #include <deque>
@@ -110,8 +117,8 @@ public:
 
     beast::Journal m_journal;
 
-    boost::asio::io_service& m_io_service;
-    boost::asio::io_service::strand m_strand;
+    boost::asio::io_context& m_io_context;
+    boost::asio::strand<boost::asio::io_context::executor_type> m_strand;
     boost::asio::ip::tcp::resolver m_resolver;
 
     std::condition_variable m_cv;
@@ -141,12 +148,12 @@ public:
     std::deque<Work> m_work;
 
     ResolverAsioImpl(
-        boost::asio::io_service& io_service,
+        boost::asio::io_context& io_context,
         beast::Journal journal)
         : m_journal(journal)
-        , m_io_service(io_service)
-        , m_strand(io_service)
-        , m_resolver(io_service)
+        , m_io_context(io_context)
+        , m_strand(boost::asio::make_strand(io_context))
+        , m_resolver(io_context)
         , m_asyncHandlersCompleted(true)
         , m_stop_called(false)
         , m_stopped(true)
@@ -202,8 +209,14 @@ public:
     {
         if (m_stop_called.exchange(true) == false)
         {
-            m_io_service.dispatch(m_strand.wrap(std::bind(
-                &ResolverAsioImpl::do_stop, this, CompletionCounter(this))));
+            boost::asio::dispatch(
+                m_io_context,
+                boost::asio::bind_executor(
+                    m_strand,
+                    std::bind(
+                        &ResolverAsioImpl::do_stop,
+                        this,
+                        CompletionCounter(this))));
 
             JLOG(m_journal.debug()) << "Queued a stop request";
         }
@@ -234,12 +247,16 @@ public:
 
         // TODO NIKB use rvalue references to construct and move
         //           reducing cost.
-        m_io_service.dispatch(m_strand.wrap(std::bind(
-            &ResolverAsioImpl::do_resolve,
-            this,
-            names,
-            handler,
-            CompletionCounter(this))));
+        boost::asio::dispatch(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &ResolverAsioImpl::do_resolve,
+                    this,
+                    names,
+                    handler,
+                    CompletionCounter(this))));
     }
 
     //-------------------------------------------------------------------------
@@ -265,19 +282,20 @@ public:
         std::string name,
         boost::system::error_code const& ec,
         HandlerType handler,
-        boost::asio::ip::tcp::resolver::iterator iter,
+        boost::asio::ip::tcp::resolver::results_type results,
         CompletionCounter)
     {
         if (ec == boost::asio::error::operation_aborted)
             return;
 
         std::vector<beast::IP::Endpoint> addresses;
+        auto iter = results.begin();
 
         // If we get an error message back, we don't return any
         // results that we may have gotten.
         if (!ec)
         {
-            while (iter != boost::asio::ip::tcp::resolver::iterator())
+            while (iter != results.end())
             {
                 addresses.push_back(
                     beast::IPAddressConversion::from_asio(*iter));
@@ -287,8 +305,14 @@ public:
 
         handler(name, addresses);
 
-        m_io_service.post(m_strand.wrap(std::bind(
-            &ResolverAsioImpl::do_work, this, CompletionCounter(this))));
+        boost::asio::post(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &ResolverAsioImpl::do_work,
+                    this,
+                    CompletionCounter(this))));
     }
 
     HostAndPort
@@ -369,16 +393,21 @@ public:
         {
             JLOG(m_journal.error()) << "Unable to parse '" << name << "'";
 
-            m_io_service.post(m_strand.wrap(std::bind(
-                &ResolverAsioImpl::do_work, this, CompletionCounter(this))));
+            boost::asio::post(
+                m_io_context,
+                boost::asio::bind_executor(
+                    m_strand,
+                    std::bind(
+                        &ResolverAsioImpl::do_work,
+                        this,
+                        CompletionCounter(this))));
 
             return;
         }
 
-        boost::asio::ip::tcp::resolver::query query(host, port);
-
         m_resolver.async_resolve(
-            query,
+            host,
+            port,
             std::bind(
                 &ResolverAsioImpl::do_finish,
                 this,
@@ -409,10 +438,14 @@ public:
 
             if (m_work.size() > 0)
             {
-                m_io_service.post(m_strand.wrap(std::bind(
-                    &ResolverAsioImpl::do_work,
-                    this,
-                    CompletionCounter(this))));
+                boost::asio::post(
+                    m_io_context,
+                    boost::asio::bind_executor(
+                        m_strand,
+                        std::bind(
+                            &ResolverAsioImpl::do_work,
+                            this,
+                            CompletionCounter(this))));
             }
         }
     }
@@ -421,9 +454,9 @@ public:
 //-----------------------------------------------------------------------------
 
 std::unique_ptr<ResolverAsio>
-ResolverAsio::New(boost::asio::io_service& io_service, beast::Journal journal)
+ResolverAsio::New(boost::asio::io_context& io_context, beast::Journal journal)
 {
-    return std::make_unique<ResolverAsioImpl>(io_service, journal);
+    return std::make_unique<ResolverAsioImpl>(io_context, journal);
 }
 
 //-----------------------------------------------------------------------------

src/libxrpl/basics/UTF8.cpp

@@ -0,0 +1,101 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/basics/UTF8.h>
+
+namespace ripple {
+
+bool
+isValidUTF8(Slice const& s) noexcept
+{
+    std::size_t const size = s.size();
+
+    // Markus Kuhn's utf8_check.c
+    // (https://www.cl.cam.ac.uk/~mgk25/ucs/utf8_check.c), the decoder
+    // URIToken has always used, with one change: each branch establishes
+    // that the whole sequence is present before reading any continuation
+    // byte, so a truncated tail is invalid rather than an out-of-bounds read.
+    std::size_t i = 0;
+    while (i < size)
+    {
+        std::uint8_t const c0 = s[i];
+
+        if (c0 < 0x80)
+        {
+            // 0xxxxxxx
+            ++i;
+            continue;
+        }
+
+        if ((c0 & 0xE0) == 0xC0)
+        {
+            // 110xxxxx 10xxxxxx
+            if (size - i < 2)
+                return false;
+            if ((s[i + 1] & 0xC0) != 0x80)
+                return false;
+            if ((c0 & 0xFE) == 0xC0)  // overlong
+                return false;
+            i += 2;
+            continue;
+        }
+
+        if ((c0 & 0xF0) == 0xE0)
+        {
+            // 1110xxxx 10xxxxxx 10xxxxxx
+            if (size - i < 3)
+                return false;
+            std::uint8_t const c1 = s[i + 1];
+            if ((c1 & 0xC0) != 0x80 || (s[i + 2] & 0xC0) != 0x80)
+                return false;
+            if (c0 == 0xE0 && (c1 & 0xE0) == 0x80)  // overlong
+                return false;
+            if (c0 == 0xED && (c1 & 0xE0) == 0xA0)  // UTF-16 surrogate
+                return false;
+            if (c0 == 0xEF && c1 == 0xBF &&
+                (s[i + 2] & 0xFE) == 0xBE)  // U+FFFE or U+FFFF
+                return false;
+            i += 3;
+            continue;
+        }
+
+        if ((c0 & 0xF8) == 0xF0)
+        {
+            // 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
+            if (size - i < 4)
+                return false;
+            std::uint8_t const c1 = s[i + 1];
+            if ((c1 & 0xC0) != 0x80 || (s[i + 2] & 0xC0) != 0x80 ||
+                (s[i + 3] & 0xC0) != 0x80)
+                return false;
+            if (c0 == 0xF0 && (c1 & 0xF0) == 0x80)  // overlong
+                return false;
+            if (c0 > 0xF4 || (c0 == 0xF4 && c1 > 0x8F))  // > U+10FFFF
+                return false;
+            i += 4;
+            continue;
+        }
+
+        // Stray continuation byte or 0xF8..0xFF.
+        return false;
+    }
+    return true;
+}
+
+}  // namespace ripple

src/libxrpl/beast/insight/StatsDCollector.cpp

@@ -26,10 +26,24 @@
 #include <xrpl/beast/insight/StatsDCollector.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/utility/instrumentation.h>
+
+#include <boost/asio/basic_waitable_timer.hpp>
+#include <boost/asio/bind_executor.hpp>
+#include <boost/asio/buffer.hpp>
+#include <boost/asio/error.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/udp.hpp>
+#include <boost/asio/strand.hpp>
+#include <boost/system/detail/error_code.hpp>
+
 #include <boost/asio/ip/tcp.hpp>
+#include <chrono>
 #include <climits>
+#include <cstddef>
 #include <deque>
 #include <functional>
+#include <iostream>
 #include <mutex>
 #include <optional>
 #include <set>
@@ -223,9 +237,11 @@ private:
     Journal m_journal;
     IP::Endpoint m_address;
     std::string m_prefix;
-    boost::asio::io_service m_io_service;
-    std::optional<boost::asio::io_service::work> m_work;
-    boost::asio::io_service::strand m_strand;
+    boost::asio::io_context m_io_context;
+    std::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        m_work;
+    boost::asio::strand<boost::asio::io_context::executor_type> m_strand;
     boost::asio::basic_waitable_timer<std::chrono::steady_clock> m_timer;
     boost::asio::ip::udp::socket m_socket;
     std::deque<std::string> m_data;
@@ -249,18 +265,24 @@ public:
         : m_journal(journal)
         , m_address(address)
         , m_prefix(prefix)
-        , m_work(std::ref(m_io_service))
-        , m_strand(m_io_service)
-        , m_timer(m_io_service)
-        , m_socket(m_io_service)
+        , m_work(boost::asio::make_work_guard(m_io_context))
+        , m_strand(boost::asio::make_strand(m_io_context))
+        , m_timer(m_io_context)
+        , m_socket(m_io_context)
         , m_thread(&StatsDCollectorImp::run, this)
     {
     }
 
     ~StatsDCollectorImp() override
     {
-        boost::system::error_code ec;
-        m_timer.cancel(ec);
+        try
+        {
+            m_timer.cancel();
+        }
+        catch (boost::system::system_error const&)
+        {
+            // ignored
+        }
 
         m_work.reset();
         m_thread.join();
@@ -319,10 +341,10 @@ public:
 
     //--------------------------------------------------------------------------
 
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
-        return m_io_service;
+        return m_io_context;
     }
 
     std::string const&
@@ -340,8 +362,14 @@ public:
     void
     post_buffer(std::string&& buffer)
     {
-        m_io_service.dispatch(m_strand.wrap(std::bind(
-            &StatsDCollectorImp::do_post_buffer, this, std::move(buffer))));
+        boost::asio::dispatch(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &StatsDCollectorImp::do_post_buffer,
+                    this,
+                    std::move(buffer))));
     }
 
     // The keepAlive parameter makes sure the buffers sent to
@@ -371,7 +399,7 @@ public:
         for (auto const& buffer : buffers)
         {
             std::string const s(
-                boost::asio::buffer_cast<char const*>(buffer),
+                static_cast<char const*>(buffer.data()),
                 boost::asio::buffer_size(buffer));
             std::cerr << s;
         }
@@ -441,7 +469,7 @@ public:
     set_timer()
     {
         using namespace std::chrono_literals;
-        m_timer.expires_from_now(1s);
+        m_timer.expires_after(1s);
         m_timer.async_wait(std::bind(
             &StatsDCollectorImp::on_timer, this, std::placeholders::_1));
     }
@@ -483,13 +511,13 @@ public:
 
         set_timer();
 
-        m_io_service.run();
+        m_io_context.run();
 
         m_socket.shutdown(boost::asio::ip::udp::socket::shutdown_send, ec);
 
         m_socket.close();
 
-        m_io_service.poll();
+        m_io_context.poll();
     }
 };
 
@@ -532,10 +560,12 @@ StatsDCounterImpl::~StatsDCounterImpl()
 void
 StatsDCounterImpl::increment(CounterImpl::value_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDCounterImpl::do_increment,
-        std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDCounterImpl::do_increment,
+            std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
+            amount));
 }
 
 void
@@ -577,10 +607,12 @@ StatsDEventImpl::StatsDEventImpl(
 void
 StatsDEventImpl::notify(EventImpl::value_type const& value)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDEventImpl::do_notify,
-        std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
-        value));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDEventImpl::do_notify,
+            std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
+            value));
 }
 
 void
@@ -610,19 +642,23 @@ StatsDGaugeImpl::~StatsDGaugeImpl()
 void
 StatsDGaugeImpl::set(GaugeImpl::value_type value)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDGaugeImpl::do_set,
-        std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-        value));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDGaugeImpl::do_set,
+            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
+            value));
 }
 
 void
 StatsDGaugeImpl::increment(GaugeImpl::difference_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDGaugeImpl::do_increment,
-        std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDGaugeImpl::do_increment,
+            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
+            amount));
 }
 
 void
@@ -698,10 +734,12 @@ StatsDMeterImpl::~StatsDMeterImpl()
 void
 StatsDMeterImpl::increment(MeterImpl::value_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDMeterImpl::do_increment,
-        std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDMeterImpl::do_increment,
+            std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
+            amount));
 }
 
 void

src/libxrpl/beast/net/IPAddressV4.cpp

@@ -28,11 +28,11 @@ namespace IP {
 bool
 is_private(AddressV4 const& addr)
 {
-    return ((addr.to_ulong() & 0xff000000) ==
+    return ((addr.to_uint() & 0xff000000) ==
             0x0a000000) ||  // Prefix /8,    10.  #.#.#
-        ((addr.to_ulong() & 0xfff00000) ==
+        ((addr.to_uint() & 0xfff00000) ==
          0xac100000) ||  // Prefix /12   172. 16.#.# - 172.31.#.#
-        ((addr.to_ulong() & 0xffff0000) ==
+        ((addr.to_uint() & 0xffff0000) ==
          0xc0a80000) ||  // Prefix /16   192.168.#.#
         addr.is_loopback();
 }
@@ -47,7 +47,7 @@ char
 get_class(AddressV4 const& addr)
 {
     static char const* table = "AAAABBCD";
-    return table[(addr.to_ulong() & 0xE0000000) >> 29];
+    return table[(addr.to_uint() & 0xE0000000) >> 29];
 }
 
 }  // namespace IP

src/libxrpl/beast/net/IPAddressV6.cpp

@@ -20,6 +20,8 @@
 #include <xrpl/beast/net/IPAddressV4.h>
 #include <xrpl/beast/net/IPAddressV6.h>
 
+#include <boost/asio/ip/address_v4.hpp>
+
 namespace beast {
 namespace IP {
 
@@ -28,7 +30,9 @@ is_private(AddressV6 const& addr)
 {
     return (
         (addr.to_bytes()[0] & 0xfd) ||  // TODO  fc00::/8 too ?
-        (addr.is_v4_mapped() && is_private(addr.to_v4())));
+        (addr.is_v4_mapped() &&
+         is_private(boost::asio::ip::make_address_v4(
+             boost::asio::ip::v4_mapped, addr))));
 }
 
 bool

src/libxrpl/beast/net/IPEndpoint.cpp

@@ -18,7 +18,19 @@
 //==============================================================================
 
 #include <xrpl/beast/net/IPEndpoint.h>
+
+#include <boost/algorithm/string/trim.hpp>
+#include <boost/asio/ip/address.hpp>
+#include <boost/asio/ip/address_v4.hpp>
+#include <boost/system/detail/error_code.hpp>
+
 #include <boost/algorithm/string.hpp>
+#include <cctype>
+#include <ios>
+#include <istream>
+#include <optional>
+#include <sstream>
+#include <string>
 
 namespace beast {
 namespace IP {
@@ -157,7 +169,7 @@ operator>>(std::istream& is, Endpoint& endpoint)
     }
 
     boost::system::error_code ec;
-    auto addr = Address::from_string(addrStr, ec);
+    auto addr = boost::asio::ip::make_address(addrStr, ec);
     if (ec)
     {
         is.setstate(std::ios_base::failbit);

src/libxrpl/protocol/BuildInfo.cpp

@@ -56,9 +56,9 @@ getVersionString()
         (versionString == std::string("0.") + std::string("0.0") ||
          versionString == std::string("0.0.0+DEBUG")))
     {
-        std::string y = std::string(__DATE__ + 7);
+        std::string y = std::string(&__DATE__[7]);
         std::string d = std::string(
-            __DATE__ + 4 + (__DATE__[4] == ' ' ? 1 : 0),
+            &__DATE__[4 + (__DATE__[4] == ' ' ? 1 : 0)],
             __DATE__[4] == ' ' ? 1 : 2);
         std::string m;
         switch (__DATE__[0])

src/libxrpl/protocol/Indexes.cpp

@@ -89,6 +89,7 @@ enum class LedgerNameSpace : std::uint16_t {
     ORACLE = LEDGER_NAMESPACE2(0x01, 'R'),
     MPTOKEN_ISSUANCE = '~',
     MPTOKEN = 't',
+    MANIFEST = 'M',
     CREDENTIAL = LEDGER_NAMESPACE2(0x01, 'D'),
     PERMISSIONED_DOMAIN = 'm',
 
@@ -670,6 +671,12 @@ permissionedDomain(uint256 const& domainID) noexcept
     return {ltPERMISSIONED_DOMAIN, domainID};
 }
 
+Keylet
+manifest(PublicKey const& pk) noexcept
+{
+    return {ltMANIFEST, indexHash(LedgerNameSpace::MANIFEST, pk.slice())};
+}
+
 }  // namespace keylet
 
 }  // namespace ripple

src/libxrpl/protocol/TER.cpp

@@ -151,6 +151,8 @@ transResults()
         MAKE_ERROR(tefNONDIR_EMIT,                 "An emitted txn was injected into the ledger without a corresponding directory entry."),
         MAKE_ERROR(tefIMPORT_BLACKHOLED,           "Cannot import keying because target account is blackholed."),
         MAKE_ERROR(tefINVALID_LEDGER_FIX_TYPE,     "The LedgerFixType field has an invalid value."),
+        MAKE_ERROR(tefPAST_MANIFEST_SEQ,           "The submitted manifest's sequence is not newer than the current."),
+        MAKE_ERROR(tefREVOKED_MANIFEST,            "The submitted manifest is for a revoked master key."),
 
         MAKE_ERROR(telLOCAL_ERROR,            "Local failure."),
         MAKE_ERROR(telBAD_DOMAIN,             "Domain too long."),
@@ -172,6 +174,7 @@ transResults()
         MAKE_ERROR(telIMPORT_VL_KEY_NOT_RECOGNISED, "Import vl key was not recognized."),
         MAKE_ERROR(telCAN_NOT_QUEUE_IMPORT,   "Import transaction was not able to be directly applied and cannot be queued."),
         MAKE_ERROR(telENV_RPC_FAILED,         "Unit test RPC failure."),
+        MAKE_ERROR(telMANIFEST_FEE_MISMATCH,  "Unsigned SetManifest fee is not, or cannot be confirmed as, canonical for this server's ledger fee settings."),
 
         MAKE_ERROR(temMALFORMED,                 "Malformed transaction."),
         MAKE_ERROR(temBAD_AMM_TOKENS,            "Malformed: Invalid LPTokens."),

src/libxrpl/protocol/tokens.cpp

@@ -545,7 +545,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     XRPL_ASSERT(
         num_b_58_10_coeffs <= b_58_10_coeff.size(),
         "ripple::b58_fast::detail::b58_to_b256_be : maximum coeff");
-    for (auto c : input.substr(0, partial_coeff_len))
+    for (unsigned char const c : input.substr(0, partial_coeff_len))
     {
         auto cur_val = ::ripple::alphabetReverse[c];
         if (cur_val < 0)
@@ -559,7 +559,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         for (int j = 0; j < num_full_coeffs; ++j)
         {
-            auto c = input[partial_coeff_len + j * 10 + i];
+            unsigned char const c = input[partial_coeff_len + j * 10 + i];
             auto cur_val = ::ripple::alphabetReverse[c];
             if (cur_val < 0)
             {
@@ -580,6 +580,12 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         std::uint64_t const c = b_58_10_coeff[i];
 
+        // Each digit is < 58, so at most 4 words are in use here and the
+        // span below always fits `result`. Guard the invariant anyway rather
+        // than letting a violation index past the end of the stack array.
+        if (cur_result_size >= result.size())
+            return Unexpected(TokenCodecErrc::inputTooLarge);
+
         {
             auto code = ripple::b58_fast::detail::inplace_bigint_mul(
                 std::span(&result[0], cur_result_size + 1), B_58_10);

src/libxrpl/server/Port.cpp

@@ -24,6 +24,9 @@
 #include <boost/algorithm/string/predicate.hpp>
 #include <boost/algorithm/string/trim.hpp>
 #include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
 
 namespace ripple {
 
@@ -205,7 +208,7 @@ parse_Port(ParsedPort& port, Section const& section, std::ostream& log)
         {
             try
             {
-                port.ip = boost::asio::ip::address::from_string(*optResult);
+                port.ip = boost::asio::ip::make_address(*optResult);
             }
             catch (std::exception const&)
             {

src/test/app/AMMExtended_test.cpp

@@ -150,12 +150,15 @@ private:
 
             env.fund(XRP(20'000), alice, bob, carol, gw1, gw2);
             env.fund(XRP(20'000), dan);
+            env.close();
             env.trust(USD1(20'000), alice, bob, carol, dan);
             env.trust(USD2(1'000), alice, bob, carol, dan);
+            env.close();
 
             env(pay(gw1, dan, USD1(10'050)));
             env(pay(gw1, bob, USD1(50)));
             env(pay(gw2, bob, USD2(50)));
+            env.close();
 
             AMM ammDan(env, dan, XRP(10'000), USD1(10'050));
 
@@ -1990,6 +1993,7 @@ private:
 
             env.fund(XRP(10'000), alice, carol, gw);
             env.fund(XRP(10'000), bob);
+            env.close();
             env.trust(USD(1'000), alice, bob, carol);
             env.trust(BTC(1'000), alice, bob, carol);
             env.trust(EUR(1'000), alice, bob, carol);
@@ -3641,7 +3645,7 @@ private:
             USD(10'000),
             false,
             0,
-            ammCrtFee(env).drops(),
+            ammCrtFee(env).drops() + 2 * env.current()->fees().base.drops(),
             std::nullopt,
             std::nullopt,
             ms,

src/test/app/AMM_test.cpp

@@ -5004,8 +5004,8 @@ private:
                     alice,
                     STAmount{USD, UINT64_C(30'000'0000000003), -10}));
                 // alice XRP balance is 30,000initial - 50 ammcreate fee -
-                // 10drops fee
-                BEAST_EXPECT(accountBalance(env, alice) == "29949999990");
+                // 10drops ammcreate base fee - 10drops fee
+                BEAST_EXPECT(accountBalance(env, alice) == "29949999980");
             },
             std::nullopt,
             0,
@@ -5081,7 +5081,7 @@ private:
                     (xrpBalance + drops(5)).getText());
                 BEAST_EXPECT(
                     accountBalance(env, alice) ==
-                    std::to_string(29'950'000'000 - baseFee + 80));
+                    std::to_string(29'950'000'000 - 2 * baseFee + 80));
             },
             std::nullopt,
             0,

src/test/app/BaseFee_test.cpp

@@ -88,9 +88,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = fset(account, asfTshCollect);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -112,9 +110,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = acctdelete(account, bene);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "200000" : "200000";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "200000");
     }
 
     static uint256
@@ -142,9 +138,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = check::cancel(account, checkId);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -167,9 +161,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = check::cash(dest, checkId, XRP(100));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -191,9 +183,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = check::create(account, dest, XRP(100));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -214,9 +204,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = reward::claim(account);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -238,9 +226,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = deposit::auth(account, authed);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -262,9 +248,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = cancel(account, account, seq1);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -286,8 +270,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = escrow(account, dest, XRP(10));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
+        std::string const feeResult = "16";
         testRPCCall(env, tx, feeResult);
     }
 
@@ -310,9 +293,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = finish(account, account, seq1);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -334,9 +315,7 @@ class BaseFee_test : public beast::unit_test::suite
             account, import::loadXpop(ImportTCAccountSet::w_seed));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "106" : "100";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "106");
     }
 
     void
@@ -357,9 +336,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = invoke::invoke(account);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "16";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -381,9 +358,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = offer_cancel(account, offerSeq);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -406,9 +381,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = offer(account, USD(1000), XRP(1000));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -430,9 +403,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = pay(account, dest, XRP(1));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     static uint256
@@ -468,9 +439,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = paychan::claim(account, chan, reqBal, authAmt);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -494,9 +463,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = paychan::create(account, dest, XRP(10), settleDelay, pk);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -519,9 +486,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = paychan::fund(account, chan, XRP(1));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -552,9 +517,7 @@ class BaseFee_test : public beast::unit_test::suite
         hookParams[jss::HookParameter][jss::HookParameterValue] = "DEADBEEF";
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "73022" : "73016";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "73022");
     }
 
     void
@@ -576,9 +539,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = regkey(account, dest);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "0" : "0";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "0");
     }
 
     void
@@ -601,9 +562,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = signers(account, 2, {{signer1, 1}, {signer2, 1}});
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -624,9 +583,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = ticket::create(account, 2);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -649,9 +606,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = trust(account, USD(1000));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -675,9 +630,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = uritoken::burn(issuer, hexid);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -702,9 +655,7 @@ class BaseFee_test : public beast::unit_test::suite
         tx[jss::Amount] = "1000000";
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -728,9 +679,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = uritoken::cancel(issuer, hexid);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -757,8 +706,7 @@ class BaseFee_test : public beast::unit_test::suite
         tx[jss::Amount] = "1000000";
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
+        std::string const feeResult = "16";
         testRPCCall(env, tx, feeResult);
     }
 
@@ -781,9 +729,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = uritoken::mint(account, uri);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -827,7 +773,6 @@ public:
         using namespace test::jtx;
         auto const sa = supported_amendments();
         testWithFeats(sa);
-        testWithFeats(sa - fixXahauV1);
     }
 };
 

src/test/app/ClaimReward_test.cpp

@@ -563,6 +563,20 @@ public:
                 env(reward::claim(alice),
                     reward::issuer(issuer),
                     ter(tecNO_TARGET));
+                env.close();
+            }
+            // Invalid HookName
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                hookObj[jss::HookName] = "4142434445";
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    ter(tecNO_TARGET));
+                env.close();
             }
             // Vaild HookOn
             {

src/test/app/DNS_test.cpp

@@ -61,7 +61,7 @@ public:
             pUrl_.domain,
             pUrl_.path,
             port_,
-            env_.app().getIOService(),
+            env_.app().getIOContext(),
             env_.journal,
             env_.app().config(),
             lastEndpoint,
@@ -78,10 +78,11 @@ public:
     isMultipleEndpoints()
     {
         using boost::asio::ip::tcp;
-        tcp::resolver resolver(env_.app().getIOService());
+        tcp::resolver resolver(env_.app().getIOContext());
         std::string port = pUrl_.port ? std::to_string(*pUrl_.port) : "443";
-        tcp::resolver::iterator it = resolver.resolve(pUrl_.domain, port);
-        tcp::resolver::iterator end;
+        auto results = resolver.resolve(pUrl_.domain, port);
+        auto it = results.begin();
+        auto end = results.end();
         int n = 0;
         for (; it != end; ++it)
             ++n;

src/test/app/DepositAuth_test.cpp

@@ -301,8 +301,14 @@ struct DepositAuth_test : public beast::unit_test::suite
             Env env(*this, features);
 
             env.fund(XRP(10000), gw1, alice, bob);
-            env(trust(gw1, alice["USD"](10), noRipplePrev ? tfSetNoRipple : 0));
-            env(trust(gw1, bob["USD"](10), noRippleNext ? tfSetNoRipple : 0));
+            env(trust(
+                gw1,
+                alice["USD"](10),
+                noRipplePrev ? std::uint32_t(tfSetNoRipple) : 0));
+            env(trust(
+                gw1,
+                bob["USD"](10),
+                noRippleNext ? std::uint32_t(tfSetNoRipple) : 0));
             env.trust(USD1(10), alice, bob);
 
             env(pay(gw1, alice, USD1(10)));
@@ -324,8 +330,14 @@ struct DepositAuth_test : public beast::unit_test::suite
             Env env(*this, features);
 
             env.fund(XRP(10000), gw1, gw2, alice);
-            env(trust(alice, USD1(10), noRipplePrev ? tfSetNoRipple : 0));
-            env(trust(alice, USD2(10), noRippleNext ? tfSetNoRipple : 0));
+            env(trust(
+                alice,
+                USD1(10),
+                noRipplePrev ? std::uint32_t(tfSetNoRipple) : 0));
+            env(trust(
+                alice,
+                USD2(10),
+                noRippleNext ? std::uint32_t(tfSetNoRipple) : 0));
             env(pay(gw2, alice, USD2(10)));
 
             if (withDepositAuth)

src/test/app/Escrow_test.cpp

@@ -4422,216 +4422,160 @@ struct Escrow_test : public beast::unit_test::suite
         auto const gw = Account{"gateway"};
         auto const USD = gw["USD"];
 
-        for (bool const withXahauV1 : {true, false})
+        Env env{*this, features};
+        env.fund(XRP(10000), alice, bob, gw);
+        env.close();
+        env.trust(USD(1000000), alice);
+        env.trust(USD(1000000), bob);
+        env.close();
+        env(pay(gw, alice, USD(10000)));
+        env(pay(gw, bob, USD(10000)));
+        env.close();
+
+        // EscrowCancel - EscrowID
         {
-            auto const amend = withXahauV1 ? features : features - fixXahauV1;
-            Env env{*this, amend};
-            env.fund(XRP(10000), alice, bob, gw);
-            env.close();
-            env.trust(USD(1000000), alice);
-            env.trust(USD(1000000), bob);
-            env.close();
-            env(pay(gw, alice, USD(10000)));
-            env(pay(gw, bob, USD(10000)));
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s),
+                fee(1500));
             env.close();
 
-            // EscrowCancel - EscrowID
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    cancel_time(env.now() + 2s),
-                    fee(1500));
-                env.close();
+            // withXahauV1 - no OfferSequence
+            env(cancel(bob, alice),
+                escrow_id(escrowId),
+                fee(1500),
+                ter(tesSUCCESS));
+            env.close();
 
-                if (withXahauV1)
-                {
-                    // withXahauV1 - no OfferSequence
-                    env(cancel(bob, alice),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(tesSUCCESS));
-                    env.close();
-                }
-                else
-                {
-                    // !withXahauV1 - OfferSequence == 0
-                    env(cancel(bob, alice, 0),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(tesSUCCESS));
-                    env.close();
-                }
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(!escrowLE);
+        }
 
-                auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                BEAST_EXPECT(!escrowLE);
-            }
+        // EscrowCancel - no EscrowID or OfferSequence
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s),
+                fee(1500));
+            env.close();
 
-            // EscrowCancel - no EscrowID or OfferSequence
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    cancel_time(env.now() + 2s),
-                    fee(1500));
-                env.close();
+            env(cancel(bob, alice), fee(1500), ter(temMALFORMED));
+            env.close();
 
-                env(cancel(bob, alice), fee(1500), ter(temMALFORMED));
-                env.close();
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(escrowLE);
+        }
 
-                auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                BEAST_EXPECT(escrowLE);
-            }
+        // EscrowCancel - EscrowID & OfferSequence
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s),
+                fee(1500));
+            env.close();
 
-            // EscrowCancel - EscrowID & OfferSequence
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                auto const seq = env.seq(alice);
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    cancel_time(env.now() + 2s),
-                    fee(1500));
-                env.close();
+            env(cancel(bob, alice, seq),
+                escrow_id(escrowId),
+                fee(1500),
+                ter(temMALFORMED));
+            env.close();
 
-                env(cancel(bob, alice, seq),
-                    escrow_id(escrowId),
-                    fee(1500),
-                    ter(temMALFORMED));
-                env.close();
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(escrowLE);
+        }
 
-                auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                BEAST_EXPECT(escrowLE);
-            }
+        // EscrowCancel - EscrowID & OfferSequence 0
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s),
+                fee(1500));
+            env.close();
 
-            // EscrowCancel - EscrowID & OfferSequence 0
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    cancel_time(env.now() + 2s),
-                    fee(1500));
-                env.close();
+            // withXahauV1 - OfferSequence 0 == temMALFORMED
+            env(cancel(bob, alice, 0),
+                escrow_id(escrowId),
+                fee(1500),
+                ter(temMALFORMED));
+            env.close();
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(escrowLE);
+        }
 
-                if (withXahauV1)
-                {
-                    // withXahauV1 - OfferSequence 0 == temMALFORMED
-                    env(cancel(bob, alice, 0),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(temMALFORMED));
-                    env.close();
-                    auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                    BEAST_EXPECT(escrowLE);
-                }
-                else
-                {
-                    // withXahauV1 - OfferSequence 0 == tesSUCCESS
-                    env(cancel(bob, alice, 0),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(tesSUCCESS));
-                    env.close();
-                    auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                    BEAST_EXPECT(!escrowLE);
-                }
-            }
+        // EscrowFinish - EscrowID
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                fee(1500));
+            env.close(5s);
 
-            // EscrowFinish - EscrowID
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    fee(1500));
-                env.close(5s);
+            // withXahauV1 - no OfferSequence
+            env(finish(bob, alice),
+                escrow_id(escrowId),
+                fee(1500),
+                ter(tesSUCCESS));
+            env.close();
 
-                if (withXahauV1)
-                {
-                    // withXahauV1 - no OfferSequence
-                    env(finish(bob, alice),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(tesSUCCESS));
-                    env.close();
-                }
-                else
-                {
-                    // !withXahauV1 - OfferSequence == 0
-                    env(finish(bob, alice, 0),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(tesSUCCESS));
-                    env.close();
-                }
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(!escrowLE);
+        }
 
-                auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                BEAST_EXPECT(!escrowLE);
-            }
+        // EscrowFinish - no EscrowID or OfferSequence
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                fee(1500));
+            env.close();
 
-            // EscrowFinish - no EscrowID or OfferSequence
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    fee(1500));
-                env.close();
+            env(finish(bob, alice), fee(1500), ter(temMALFORMED));
+            env.close();
 
-                env(finish(bob, alice), fee(1500), ter(temMALFORMED));
-                env.close();
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(escrowLE);
+        }
 
-                auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                BEAST_EXPECT(escrowLE);
-            }
+        // EscrowFinish- EscrowID & OfferSequence
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                fee(1500));
+            env.close(5s);
 
-            // EscrowFinish- EscrowID & OfferSequence
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                auto const seq = env.seq(alice);
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    fee(1500));
-                env.close(5s);
+            env(finish(bob, alice, seq),
+                escrow_id(escrowId),
+                fee(1500),
+                ter(temMALFORMED));
+            env.close();
 
-                env(finish(bob, alice, seq),
-                    escrow_id(escrowId),
-                    fee(1500),
-                    ter(temMALFORMED));
-                env.close();
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(escrowLE);
+        }
 
-                auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                BEAST_EXPECT(escrowLE);
-            }
+        // EscrowFinish- EscrowID & OfferSequence 0
+        {
+            uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 1s),
+                fee(1500));
+            env.close(5s);
 
-            // EscrowFinish- EscrowID & OfferSequence 0
-            {
-                uint256 const escrowId{getEscrowIndex(alice, env.seq(alice))};
-                env(escrow(alice, bob, USD(1000)),
-                    finish_time(env.now() + 1s),
-                    fee(1500));
-                env.close(5s);
-
-                if (withXahauV1)
-                {
-                    // withXahauV1 - OfferSequence 0 == temMALFORMED
-                    env(finish(bob, alice, 0),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(temMALFORMED));
-                    env.close();
-                    auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                    BEAST_EXPECT(escrowLE);
-                }
-                else
-                {
-                    // !withXahauV1 - OfferSequence 0 == tesSUCCESS
-                    env(finish(bob, alice, 0),
-                        escrow_id(escrowId),
-                        fee(1500),
-                        ter(tesSUCCESS));
-                    env.close();
-                    auto const escrowLE = env.le(keylet::unchecked(escrowId));
-                    BEAST_EXPECT(!escrowLE);
-                }
-            }
+            // withXahauV1 - OfferSequence 0 == temMALFORMED
+            env(finish(bob, alice, 0),
+                escrow_id(escrowId),
+                fee(1500),
+                ter(temMALFORMED));
+            env.close();
+            auto const escrowLE = env.le(keylet::unchecked(escrowId));
+            BEAST_EXPECT(escrowLE);
         }
     }
 
@@ -4778,6 +4722,359 @@ struct Escrow_test : public beast::unit_test::suite
         }
     }
 
+    void
+    testDestinationCancel(FeatureBitset features)
+    {
+        using namespace jtx;
+        using namespace std::chrono;
+
+        bool const enabled = features[featureEscrowDestinationCancel];
+        TER const destResult =
+            enabled ? TER{tesSUCCESS} : TER{tecNO_PERMISSION};
+
+        auto const alice = Account("alice");
+        auto const bob = Account("bob");
+        auto const carol = Account("carol");
+        auto const gw = Account{"gateway"};
+        auto const USD = gw["USD"];
+
+        auto const ownerDirEmpty = [](Env& env, Account const& acct) {
+            ripple::Dir dir(*env.current(), keylet::ownerDir(acct.id()));
+            return std::distance(dir.begin(), dir.end()) == 0;
+        };
+
+        {
+            testcase("Destination Cancel: before CancelAfter");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob, carol);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)),
+                finish_time(env.now() + 100s),
+                cancel_time(env.now() + 200s));
+            env.close();
+
+            // Neither the owner nor a third party may cancel early.
+            env(cancel(alice, alice, seq), ter(tecNO_PERMISSION));
+            env(cancel(carol, alice, seq), ter(tecNO_PERMISSION));
+            env.close();
+
+            STAmount const preAlice = env.balance(alice);
+            env(cancel(bob, alice, seq), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq)));
+                // Funds go back to the owner, not the destination.
+                env.require(balance(alice, preAlice + XRP(1000)));
+                BEAST_EXPECT(env.ownerCount(alice) == 0);
+                BEAST_EXPECT(ownerDirEmpty(env, alice));
+                BEAST_EXPECT(ownerDirEmpty(env, bob));
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq)));
+                // Rejected outright: nothing moves.
+                env.require(balance(alice, preAlice));
+                BEAST_EXPECT(env.ownerCount(alice) == 1);
+                BEAST_EXPECT(!ownerDirEmpty(env, bob));
+            }
+        }
+
+        {
+            testcase("Destination Cancel: after FinishAfter");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob);
+            env.close();
+
+            // Finishable, and with no CancelAfter, otherwise never cancellable.
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)), finish_time(env.now() + 1s));
+            env.close(5s);
+
+            env(cancel(alice, alice, seq), ter(tecNO_PERMISSION));
+            env(cancel(bob, alice, seq), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq)));
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq)));
+                env(finish(bob, alice, seq));
+                env.close();
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq)));
+            }
+        }
+
+        {
+            testcase("Destination Cancel: conditional");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob);
+            env.close();
+
+            // The destination does not need the fulfillment to decline.
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)),
+                condition(cb1),
+                cancel_time(env.now() + 200s));
+            env.close();
+
+            env(cancel(bob, alice, seq), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq)));
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq)));
+            }
+        }
+
+        {
+            testcase("Destination Cancel: self-escrow stays locked");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(escrow(alice, alice, XRP(1000)),
+                finish_time(env.now() + 100s),
+                cancel_time(env.now() + 200s));
+            env.close();
+
+            env(cancel(alice, alice, seq), ter(tecNO_PERMISSION));
+            env.close();
+
+            BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq)));
+        }
+
+        {
+            testcase("Destination Cancel: EscrowID");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob);
+            env.close();
+
+            uint256 const escrowId{keylet::escrow(alice, env.seq(alice)).key};
+            env(escrow(alice, bob, XRP(1000)),
+                finish_time(env.now() + 100s),
+                cancel_time(env.now() + 200s));
+            env.close();
+
+            env(cancel(bob, alice), escrow_id(escrowId), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::unchecked(escrowId)));
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::unchecked(escrowId)));
+            }
+        }
+
+        {
+            testcase("Destination Cancel: owner hook cannot block");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob, carol);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s));
+            env.close();
+            env.close();
+
+            // Past CancelAfter, so only the owner's hook stands in the way.
+            env(jtx::hook(alice, {{hso(jtx::genesis::RollbackHook)}}, 0),
+                fee(XRP(2)));
+            env.close();
+
+            // The owner stays a strong tsh when a third party cancels.
+            env(cancel(carol, alice, seq), fee(XRP(1)), ter(tecHOOK_REJECTED));
+            env.close();
+
+            if (enabled)
+            {
+                env(cancel(bob, alice, seq), fee(XRP(1)));
+                env.close();
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq)));
+            }
+            else
+            {
+                env(cancel(bob, alice, seq),
+                    fee(XRP(1)),
+                    ter(tecHOOK_REJECTED));
+                env.close();
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq)));
+            }
+        }
+
+        {
+            testcase("Destination Cancel: IOU");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob, gw);
+            env.close();
+            env.trust(USD(10000), alice, bob);
+            env.close();
+            env(pay(gw, alice, USD(5000)));
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, USD(1000)),
+                finish_time(env.now() + 100s),
+                cancel_time(env.now() + 200s));
+            env.close();
+            BEAST_EXPECT(-lockedAmount(env, alice, gw, USD) == USD(1000));
+
+            env(cancel(bob, alice, seq), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq)));
+                BEAST_EXPECT(-lockedAmount(env, alice, gw, USD) == USD(0));
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq)));
+                BEAST_EXPECT(-lockedAmount(env, alice, gw, USD) == USD(1000));
+            }
+            env.require(balance(alice, USD(5000)));
+            env.require(balance(bob, USD(0)));
+        }
+
+        {
+            testcase("Destination Cancel: issuer-owned IOU");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, gw);
+            env.close();
+            env.trust(USD(10000), alice);
+            env.close();
+
+            // An issuer escrowing its own IOU locks nothing, so the cancel
+            // only has to unwind the escrow itself.
+            auto const seq = env.seq(gw);
+            env(escrow(gw, alice, USD(1000)),
+                finish_time(env.now() + 100s),
+                cancel_time(env.now() + 200s));
+            env.close();
+            BEAST_EXPECT(env.ownerCount(gw) == 1);
+
+            env(cancel(gw, gw, seq), ter(tecNO_PERMISSION));
+            env(cancel(alice, gw, seq), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(gw.id(), seq)));
+                BEAST_EXPECT(env.ownerCount(gw) == 0);
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(gw.id(), seq)));
+                BEAST_EXPECT(env.ownerCount(gw) == 1);
+            }
+            env.require(balance(alice, USD(0)));
+        }
+
+        {
+            testcase("Destination Cancel: owner hook chain not charged");
+            Env env{*this, features};
+            env.fund(XRP(5000), alice, bob, carol);
+            env.close();
+
+            auto const seq = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s));
+            env.close();
+            env.close();
+
+            auto const feeFor = [&](Account const& acct) {
+                return calculateBaseFee(
+                    *env.current(), *env.jt(cancel(acct, alice, seq)).stx);
+            };
+
+            XRPAmount const bobBefore = feeFor(bob);
+            XRPAmount const carolBefore = feeFor(carol);
+
+            env(jtx::hook(alice, {{hso(jtx::genesis::RollbackHook)}}, 0),
+                fee(XRP(2)));
+            env.close();
+
+            // A third party still pays for the owner's (strong) hook chain.
+            BEAST_EXPECT(feeFor(carol) > carolBefore);
+
+            // The destination does too, but only without the amendment.
+            if (enabled)
+            {
+                BEAST_EXPECT(feeFor(bob) == bobBefore);
+            }
+            else
+            {
+                BEAST_EXPECT(feeFor(bob) > bobBefore);
+            }
+        }
+
+        {
+            // fix1571 is still a live (DefaultYes) amendment on Xahau, so the
+            // legacy CancelAfter check in EscrowCancel remains reachable.
+            testcase("Destination Cancel: without fix1571");
+            Env env{*this, features - fix1571};
+            env.fund(XRP(5000), alice, bob, carol);
+            env.close();
+
+            // No CancelAfter.
+            auto const seq1 = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)), finish_time(env.now() + 100s));
+
+            // CancelAfter in the future.
+            auto const seq2 = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)),
+                finish_time(env.now() + 100s),
+                cancel_time(env.now() + 200s));
+
+            // CancelAfter about to pass.
+            auto const seq3 = env.seq(alice);
+            env(escrow(alice, bob, XRP(1000)),
+                finish_time(env.now() + 1s),
+                cancel_time(env.now() + 2s));
+            env.close();
+
+            env(cancel(alice, alice, seq1), ter(tecNO_PERMISSION));
+            env(cancel(carol, alice, seq2), ter(tecNO_PERMISSION));
+            env(cancel(bob, alice, seq1), ter(destResult));
+            env(cancel(bob, alice, seq2), ter(destResult));
+            env.close();
+
+            if (enabled)
+            {
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq1)));
+                BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq2)));
+            }
+            else
+            {
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq1)));
+                BEAST_EXPECT(env.le(keylet::escrow(alice.id(), seq2)));
+            }
+
+            // Past CancelAfter anyone may cancel, with or without the
+            // amendment.
+            env(cancel(carol, alice, seq3));
+            env.close();
+            BEAST_EXPECT(!env.le(keylet::escrow(alice.id(), seq3)));
+        }
+    }
+
     void
     testWithFeats(FeatureBitset features)
     {
@@ -4826,12 +5123,17 @@ public:
     {
         using namespace test::jtx;
         FeatureBitset const all{supported_amendments() | featureCredentials};
-        testWithFeats(all - featurePaychanAndEscrowForTokens);
-        testWithFeats(all);
-        testIOUWithFeats(all - featureClawback);
-        testIOUWithFeats(all);
+        // The pre-existing suites assert that the destination cannot cancel
+        // early, so they run without featureEscrowDestinationCancel.
+        FeatureBitset const legacy{all - featureEscrowDestinationCancel};
+        testWithFeats(legacy - featurePaychanAndEscrowForTokens);
+        testWithFeats(legacy);
+        testIOUWithFeats(legacy - featureClawback);
+        testIOUWithFeats(legacy);
         testEscrowID(all);
         testCredentials(all);
+        testDestinationCancel(legacy);
+        testDestinationCancel(all);
     }
 };
 

src/test/app/GenesisMint_test.cpp

@@ -336,10 +336,7 @@ struct GenesisMint_test : public beast::unit_test::suite
             env.close();
 
             // validate emitted txn
-            auto const txResult = env.current()->rules().enabled(fixXahauV1)
-                ? "tesSUCCESS"
-                : "tecINTERNAL";
-            validateEmittedTxn(env, txResult, __LINE__);
+            validateEmittedTxn(env, "tesSUCCESS", __LINE__);
         }
 
         // missing an amount
@@ -569,39 +566,25 @@ struct GenesisMint_test : public beast::unit_test::suite
             validateEmittedTxn(env, "tesSUCCESS", __LINE__);
         }
 
-        auto const amtResult = env.current()->rules().enabled(fixXahauV1)
-            ? 30000000ULL
-            : 10000000ULL;
         // try to include the same destination twice
-        {
-            auto const txResult = env.current()->rules().enabled(fixXahauV1)
-                ? ter(tesSUCCESS)
-                : ter(tecHOOK_REJECTED);
-            env(invoke::invoke(
-                    invoker,
-                    env.master,
-                    genesis::makeBlob({
-                        {greg.id(),
-                         XRP(10).value(),
-                         std::nullopt,
-                         std::nullopt},
-                        {greg.id(),
-                         XRP(10).value(),
-                         std::nullopt,
-                         std::nullopt},
-                    })),
-                fee(XRP(1)),
-                txResult);
-            env.close();
-            env.close();
-        }
+        env(invoke::invoke(
+                invoker,
+                env.master,
+                genesis::makeBlob({
+                    {greg.id(), XRP(10).value(), std::nullopt, std::nullopt},
+                    {greg.id(), XRP(10).value(), std::nullopt, std::nullopt},
+                })),
+            fee(XRP(1)),
+            ter(tesSUCCESS));
+        env.close();
+        env.close();
 
         // check
         {
             auto const le = env.le(keylet::account(greg.id()));
             BEAST_EXPECT(
                 !!le &&
-                le->getFieldAmount(sfBalance).xrp().drops() == amtResult);
+                le->getFieldAmount(sfBalance).xrp().drops() == 30000000ULL);
         }
 
         // trip the supply cap invariant
@@ -626,7 +609,7 @@ struct GenesisMint_test : public beast::unit_test::suite
             auto const le = env.le(keylet::account(greg.id()));
             BEAST_EXPECT(
                 !!le &&
-                le->getFieldAmount(sfBalance).xrp().drops() == amtResult);
+                le->getFieldAmount(sfBalance).xrp().drops() == 30000000ULL);
 
             auto const postCoins = env.current()->info().drops;
             auto const txnFee =
@@ -698,7 +681,6 @@ public:
         using namespace test::jtx;
         auto const sa = supported_amendments();
         testWithFeats(sa);
-        testWithFeats(sa - fixXahauV1);
         testWithFeats(sa - fixHookAPI20251128);
     }
 };

src/test/app/HookAPI_test.cpp

@@ -590,6 +590,134 @@ public:
         }
     }
 
+    void
+    test_emitted_txn_entry(FeatureBitset features)
+    {
+        testcase("Test emitted txn ledger entry");
+
+        using namespace jtx;
+        using namespace hook;
+        using namespace hook_api;
+
+        auto const alice = Account{"alice"};
+
+        for (bool const withFix : {true, false})
+        {
+            Env env{*this, withFix ? features : features - fix20261005};
+
+            // emissions are only written into non-open views, so apply on
+            // top of the last closed ledger the way consensus does
+            auto const closed = env.closed();
+            OpenView ov{&*closed};
+            BEAST_EXPECT(!ov.open());
+
+            STTx const invokeTx = STTx(ttINVOKE, [&](STObject& obj) {});
+            ApplyContext applyCtx{
+                env.app(),
+                ov,
+                invokeTx,
+                tesSUCCESS,
+                env.current()->fees().base,
+                tapNONE,
+                env.journal};
+
+            STTx const emitTx = STTx(ttINVOKE, [&](STObject& obj) {
+                obj[sfAccount] = alice.id();
+                obj[sfSequence] = 0;
+                obj[sfSigningPubKey] = Slice{};
+                obj[sfFirstLedgerSequence] = closed->seq() + 1;
+                obj[sfLastLedgerSequence] = closed->seq() + 5;
+                obj[sfFee] = closed->fees().base;
+
+                auto& emitDetails = obj.peekFieldObject(sfEmitDetails);
+                emitDetails[sfEmitGeneration] = 1;
+                emitDetails[sfEmitBurden] = 1;
+                emitDetails[sfEmitParentTxnID] = invokeTx.getTransactionID();
+                emitDetails[sfEmitNonce] = uint256();
+                emitDetails[sfEmitHookHash] = uint256();
+            });
+
+            std::string reason;
+            auto const emitted = std::make_shared<ripple::Transaction>(
+                std::make_shared<STTx const>(emitTx), reason, env.app());
+            std::queue<std::shared_ptr<ripple::Transaction>> emittedTxn;
+            emittedTxn.push(emitted);
+
+            auto hookCtx = makeStubHookContext(
+                applyCtx,
+                alice.id(),
+                alice.id(),
+                {.result = {.emittedTxn = emittedTxn}});
+
+            BEAST_EXPECT(
+                hook::finalizeHookResult(hookCtx.result, applyCtx, true) ==
+                tesSUCCESS);
+
+            auto const kl = keylet::emittedTxn(emitted->getID());
+            auto const sle = applyCtx.view().peek(kl);
+            if (!BEAST_EXPECT(sle))
+                continue;
+
+            Serializer expected;
+            emitTx.add(expected);
+
+            // in memory: with the fix sfEmittedTxn occupies its template
+            // slot exactly once, without it a duplicate is appended behind
+            // the (non-present) template slot and the field reads absent
+            auto const entries =
+                std::count_if(sle->begin(), sle->end(), [](STBase const& f) {
+                    return f.getFName() == sfEmittedTxn;
+                });
+            BEAST_EXPECT(entries == (withFix ? 1 : 2));
+            BEAST_EXPECT(sle->isFieldPresent(sfEmittedTxn) == withFix);
+
+            // serialized: identical either way, re-reading the entry always
+            // yields exactly the emitted transaction
+            {
+                Serializer s;
+                sle->add(s);
+                SerialIter sit(s.slice());
+                STLedgerEntry const reread(sit, kl.key);
+                BEAST_EXPECT(reread.isFieldPresent(sfEmittedTxn));
+                Serializer txn;
+                reread.peekAtField(sfEmittedTxn).add(txn);
+                BEAST_EXPECT(txn.peekData() == expected.peekData());
+            }
+
+            // a hook running later in the same ledger can tell them apart:
+            // slot_subfield only finds sfEmittedTxn with the fix
+            auto readerCtx =
+                makeStubHookContext(applyCtx, alice.id(), alice.id(), {});
+            auto& api = readerCtx.api();
+
+            Bytes klBytes{
+                static_cast<uint8_t>((kl.type >> 8) & 0xFFU),
+                static_cast<uint8_t>(kl.type & 0xFFU)};
+            klBytes.insert(klBytes.end(), kl.key.begin(), kl.key.end());
+
+            auto const slotNo = api.slot_set(klBytes, 0);
+            if (!BEAST_EXPECT(slotNo.has_value()))
+                continue;
+
+            auto const sub =
+                api.slot_subfield(slotNo.value(), sfEmittedTxn.getCode(), 0);
+            if (!withFix)
+            {
+                BEAST_EXPECT(!sub.has_value() && sub.error() == DOESNT_EXIST);
+                continue;
+            }
+
+            if (!BEAST_EXPECT(sub.has_value()))
+                continue;
+            auto const field = api.slot(sub.value());
+            if (!BEAST_EXPECT(field.has_value()))
+                continue;
+            Serializer s;
+            field.value()->add(s);
+            BEAST_EXPECT(s.peekData() == expected.peekData());
+        }
+    }
+
     void
     test_etxn_details(FeatureBitset features)
     {
@@ -732,6 +860,56 @@ public:
             else
                 BEAST_EXPECT(result.value() == baseFee + memoSize);
         }
+        {
+            // fix20260929: the minimum fee is computed against the view
+            // being applied, not the node-local open ledger. Simulate that
+            // by inserting a hook definition (with a callback fee) into
+            // applyCtx.view() only -- it is never inserted into the open
+            // ledger the node otherwise reads.
+            uint256 const hookHash{1};
+
+            STTx const emittedTx = STTx(ttINVOKE, [&](STObject& obj) {
+                obj[sfAccount] = alice.id();
+                obj[sfSequence] = 0;
+                obj[sfSigningPubKey] = Slice{};
+                obj[sfFirstLedgerSequence] = ov.seq() + 1;
+                obj[sfLastLedgerSequence] = ov.seq() + 5;
+                obj[sfFee] = env.closed()->fees().base;
+
+                auto& emitDetails = obj.peekFieldObject(sfEmitDetails);
+                emitDetails[sfEmitGeneration] = 1;
+                emitDetails[sfEmitBurden] = 1;
+                emitDetails[sfEmitParentTxnID] = invokeTx.getTransactionID();
+                emitDetails[sfEmitNonce] = uint256();
+                emitDetails[sfEmitHookHash] = hookHash;
+            });
+            Serializer const emittedTxSerializer = emittedTx.getSerializer();
+
+            auto const baseline =
+                api.etxn_fee_base(emittedTxSerializer.slice());
+            BEAST_EXPECT(baseline.has_value());
+
+            auto hookDef =
+                std::make_shared<SLE>(keylet::hookDefinition(hookHash));
+            hookDef->setFieldH256(sfHookHash, hookHash);
+            hookDef->setFieldH256(sfHookNamespace, uint256());
+            hookDef->setFieldArray(sfHookParameters, STArray{});
+            hookDef->setFieldU16(sfHookApiVersion, 0);
+            hookDef->setFieldVL(sfCreateCode, std::vector<uint8_t>{});
+            hookDef->setFieldH256(sfHookSetTxnID, invokeTx.getTransactionID());
+            hookDef->setFieldU64(sfReferenceCount, 1);
+            hookDef->setFieldAmount(sfFee, XRPAmount{0});
+            hookDef->setFieldAmount(sfHookCallbackFee, XRPAmount{12345});
+            applyCtx.view().insert(hookDef);
+
+            auto const result = api.etxn_fee_base(emittedTxSerializer.slice());
+            BEAST_EXPECT(result.has_value());
+
+            if (env.closed()->rules().enabled(fix20260929))
+                BEAST_EXPECT(result.value() == baseline.value() + 12345);
+            else
+                BEAST_EXPECT(result.value() == baseline.value());
+        }
     }
 
     void
@@ -1778,11 +1956,31 @@ public:
         BEAST_EXPECT(api.float_set(-50, 0).value() == 0);
         BEAST_EXPECT(api.float_set(0, 0).value() == 0);
 
-        // an exponent lower than -96 should produce an invalid float error
-        BEAST_EXPECT(api.float_set(-97, 1).error() == INVALID_FLOAT);
+        // fix20261005: exponent out of range is reported as
+        // EXPONENT_UNDERSIZED / EXPONENT_OVERSIZED; before the fix both
+        // cases were reported as INVALID_FLOAT
+        bool const fixExpCodes = env.current()->rules().enabled(fix20261005);
+        auto const undersized =
+            fixExpCodes ? EXPONENT_UNDERSIZED : INVALID_FLOAT;
+        auto const oversized = fixExpCodes ? EXPONENT_OVERSIZED : INVALID_FLOAT;
 
-        // an exponent larger than +96 should produce an invalid float error
-        BEAST_EXPECT(api.float_set(+97, 1).error() == INVALID_FLOAT);
+        // an exponent lower than -96 should produce an underflow error
+        BEAST_EXPECT(api.float_set(-97, 1).error() == undersized);
+
+        // an exponent larger than +96 should produce an overflow error
+        BEAST_EXPECT(api.float_set(+97, 1).error() == oversized);
+
+        // the -96..80 range applies to the exponent after the mantissa has
+        // been normalized to 16 digits (1 -> 1e15, exponent - 15)
+        auto const oneE15 = [](int32_t exp) {
+            return hook::hook_float::make_float(1000000000000000ULL, exp, false)
+                .value();
+        };
+        BEAST_EXPECT(api.float_set(81, 1).value() == oneE15(66));
+        BEAST_EXPECT(api.float_set(95, 1).value() == oneE15(80));
+        BEAST_EXPECT(api.float_set(96, 1).error() == oversized);
+        BEAST_EXPECT(api.float_set(-81, 1).value() == oneE15(-96));
+        BEAST_EXPECT(api.float_set(-82, 1).error() == undersized);
 
         // clang-format off
         std::vector<std::tuple<int32_t, int64_t, uint64_t>> tests = {
@@ -2172,22 +2370,19 @@ public:
             BEAST_EXPECT(api.hook_param(Bytes(33, 1)).error() == TOO_BIG);
         }
 
-        // {
-        //     // Hook params map
-        //     Bytes const name{'k'};
-        //     Bytes const value{1, 2, 3};
-        //     StubHookContext stubCtx{
-        //         .result = {
-        //             .hookParams = {{{name, value}}},
-        //         }};
-        //     auto hookCtx =
-        //         makeStubHookContext(applyCtx, alice.id(), alice.id(),
-        //         stubCtx);
-        //     hook::HookAPI api(hookCtx);
-        //     auto const result = api.hook_param(name);
-        //     BEAST_EXPECT(result.has_value());
-        //     BEAST_EXPECT(result.value() == value);
-        // }
+        {
+            // Hook params map
+            Bytes const name{'k'};
+            Bytes const value{1, 2, 3};
+            StubHookContext stubCtx{};
+            stubCtx.result.hookParams = std::map<Bytes, Bytes>{{name, value}};
+            auto hookCtx =
+                makeStubHookContext(applyCtx, alice.id(), alice.id(), stubCtx);
+            auto& api = hookCtx.api();
+            auto const result = api.hook_param(name);
+            BEAST_EXPECT(result.has_value());
+            BEAST_EXPECT(result.value() == value);
+        }
 
         {
             // Override deletion wins
@@ -3234,21 +3429,30 @@ public:
         using namespace hook_api;
 
         auto const alice = Account{"alice"};
-        Env env{*this, features};
-        STTx invokeTx = STTx(ttINVOKE, [&](STObject& obj) {});
-        OpenView ov{*env.current()};
-        ApplyContext applyCtx = createApplyContext(env, ov, invokeTx);
-        auto hookCtx =
-            makeStubHookContext(applyCtx, alice.id(), alice.id(), {});
-        auto& api = hookCtx.api();
+        for (bool const withFix : {true, false})
+        {
+            Env env{*this, withFix ? features : features - fix20261005};
+            STTx invokeTx = STTx(ttINVOKE, [&](STObject& obj) {});
+            OpenView ov{*env.current()};
+            ApplyContext applyCtx = createApplyContext(env, ov, invokeTx);
+            auto hookCtx =
+                makeStubHookContext(applyCtx, alice.id(), alice.id(), {});
+            auto& api = hookCtx.api();
 
-        // Invalid argument (wrong size)
-        BEAST_EXPECT(
-            api.slot_set(Bytes{1, 2, 3}, 0).error() == INVALID_ARGUMENT);
-        // Invalid argument (slot_no beyond max)
-        BEAST_EXPECT(
-            api.slot_set(Bytes(32, 0), hook_api::max_slots + 1).error() ==
-            INVALID_ARGUMENT);
+            // Invalid argument (wrong size)
+            BEAST_EXPECT(
+                api.slot_set(Bytes{1, 2, 3}, 0).error() == INVALID_ARGUMENT);
+            // Invalid argument (slot_no beyond max)
+            BEAST_EXPECT(
+                api.slot_set(Bytes(32, 0), hook_api::max_slots + 1).error() ==
+                INVALID_ARGUMENT);
+
+            // 32-byte txn hash: rejected with fix20261005, looked up (and
+            // not found here) without it
+            BEAST_EXPECT(
+                api.slot_set(Bytes(32, 0), 1).error() ==
+                (withFix ? INVALID_ARGUMENT : DOESNT_EXIST));
+        }
     }
 
     void
@@ -3941,310 +4145,142 @@ public:
 
         auto const _source_object =
             *strUnHex("81140000000000000000000000000000000000000000");
+
+        std::vector<std::pair<uint32_t, std::string>> data_list = {
+            {// UINT16 Version
+             sfVersion.getCode(),
+             "10100001"},
+            {// UINT32 Sequence
+             sfSequence.getCode(),
+             "2400000001"},
+            // UINT64
+            {// Uint64 ExchangeRate
+             sfExchangeRate.getCode(),
+             "360000000000000001"},
+            {// UINT256 EmailHash
+             sfEmailHash.getCode(),
+             "4100000000000000000000000000000000"},
+            {// UINT256 ObjectID
+             sfObjectID.getCode(),
+             "5E000000000000000000000000000000000000000000000000000000000000000"
+             "0"},
+            {// Amount NativeAmount
+             sfAmount.getCode(),
+             "61999999999999999999999999999999999999999999999999999999999999999"
+             "999999999999999999999999999999999"},
+            {// Amount IOUAmount
+             sfAmount.getCode(),
+             "614999999999999999"},
+            {// Object AmountEntry
+             sfAmountEntry.getCode(),
+             "E05B614000000000000064E1"},
+            {// Array Memos
+             sfMemos.getCode(),
+             "F9EA7D04DEADBEEFE1F1"},
+            {// UINT8 TickSize
+             sfTickSize.getCode(),
+             "00101001"},
+            {// UINT160 TakerPaysCurrency
+             sfTakerPaysCurrency.getCode(),
+             "01110000000000000000000000005553440000000000"},
+            {// PathSet Paths
+             sfPaths.getCode(),
+             "0112300000000000000000000000005553440000000000054F6F784A58F9EFB0A"
+             "9EB90B83464F9D166461900"},
+            {// Vector256 Amendments
+             sfAmendments.getCode(),
+             "03132042426C4D4F1009EE67080A9B7965B44656D7714D104A72F9B4369F97ABF"
+             "044EE"},
+            {// Issue ClaimCurrency
+             sfClaimCurrency.getCode(),
+             "05180000000000000000000000005553440000000000054F6F784A58F9EFB0A9E"
+             "B90B83464F9D1664619"},
+            {// XChainBridge Native-Native
+             sfXChainBridge.getCode(),
+             "011914AE123A8556F3CF91154711376AFB0F894F832B3D000000000000"
+             "000000000000000000000000000014AE123A8556F3CF91154711376AFB"
+             "0F894F832B3D0000000000000000000000000000000000000000"},
+            {// Currency BaseAsset
+             sfBaseAsset.getCode(),
+             "011A0000000000000000000000005553440000000000"},
+        };
+        if (env.closed()->rules().enabled(fix20260929))
+        {
+            // encodings the legacy parser measures incorrectly
+            data_list.insert(
+                data_list.end(),
+                {
+                    // MPT is not supported yet
+                    // {// Issue ClaimCurrency MPT
+                    //  sfClaimCurrency.getCode(),
+                    //  "0518AE123A8556F3CF91154711376AFB0F894F832B3D0000000000"
+                    //  "00000000000000000000000000000100000001"},
+                    {// XChainBridge default door + IOU, Native
+                     sfXChainBridge.getCode(),
+                     "0119000000000000000000000000005553440000000000AE123A85"
+                     "56F3CF91154711376AFB0F894F832B3D14AE123A8556F3CF911547"
+                     "11376AFB0F894F832B3D00000000000000000000000000000000000"
+                     "00000"},
+                });
+        }
+        bool const fixEnabled = env.closed()->rules().enabled(fix20260929);
+        for (auto const& data : data_list)
         {
-            // use UINT16
             auto source_object = _source_object;
-            auto field_object = *strUnHex("10100001");
-            // Version: 1
+            auto field_object = *strUnHex(data.second);
+            auto field_id = data.first;
 
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfVersion.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            field_object.insert(
-                field_object.end(), source_object.begin(), source_object.end());
-            BEAST_EXPECT(result.value() == field_object);
+            // test invalid insert: trailing byte after the field
+            auto ft = field_object;
+            ft.push_back(0);
+            auto const result3 = api.sto_emplace(source_object, ft, field_id);
+            // legacy parser ignores trailing bytes in the field
+            if (fixEnabled)
+                BEAST_EXPECTS(!result3.has_value(), data.second);
+            else
+                BEAST_EXPECTS(result3.has_value(), data.second);
 
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfVersion.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
+            // truncated field / source are only exercised after the fix;
+            // the legacy parser may read past the end of these buffers
+            if (!fixEnabled)
+                continue;
+
+            auto const fo = Blob{field_object.begin(), field_object.end() - 1};
+            auto const result1 = api.sto_emplace(source_object, fo, field_id);
+            BEAST_EXPECTS(!result1.has_value(), data.second);
+
+            auto const so =
+                Blob{source_object.begin(), source_object.end() - 1};
+            auto const result2 = api.sto_emplace(so, field_object, field_id);
+            BEAST_EXPECTS(!result2.has_value(), data.second);
         }
 
+        for (auto const& data : data_list)
         {
-            // use UINT32
             auto source_object = _source_object;
-            auto field_object = *strUnHex("2400000001");
-            // Sequence: 1
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfSequence.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            field_object.insert(
-                field_object.end(), source_object.begin(), source_object.end());
-            BEAST_EXPECT(result.value() == field_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfSequence.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // use UINT64
-            auto source_object = _source_object;
-            auto field_object = *strUnHex("360000000000000001");
-            // ExchangeRate: 1
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfExchangeRate.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            field_object.insert(
-                field_object.end(), source_object.begin(), source_object.end());
-            BEAST_EXPECT(result.value() == field_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfExchangeRate.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // use UINT128
-            auto source_object = _source_object;
-            auto field_object = *strUnHex("4100000000000000000000000000000000");
-            // EmailHash: 1
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfEmailHash.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            field_object.insert(
-                field_object.end(), source_object.begin(), source_object.end());
-            BEAST_EXPECT(result.value() == field_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfEmailHash.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // use UINT256
-            auto source_object = _source_object;
-            auto field_object = *strUnHex(
-                "5E000000000000000000000000000000000000000000000000000000000000"
-                "0000");
-            // ObjectID:
-            // "0000000000000000000000000000000000000000000000000000000000000000"
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfObjectID.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            field_object.insert(
-                field_object.end(), source_object.begin(), source_object.end());
-            BEAST_EXPECT(result.value() == field_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfObjectID.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // use AMOUNT
-            auto source_object = _source_object;
-
-            auto nativeamount = *strUnHex(
-                "61999999999999999999999999999999999999999999999999999999999999"
-                "999999999999999999999999999999999999");
-            auto iouamount = *strUnHex("614999999999999999");
-
-            for (auto field_object : {nativeamount, iouamount})
-            {
-                auto const result = api.sto_emplace(
-                    source_object, field_object, sfAmount.getCode());
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(
-                    result.value().size() ==
-                    source_object.size() + field_object.size());
-                field_object.insert(
-                    field_object.end(),
-                    source_object.begin(),
-                    source_object.end());
-                BEAST_EXPECT(result.value() == field_object);
-
-                auto const erase_result = api.sto_emplace(
-                    result.value(), std::nullopt, sfAmount.getCode());
-                BEAST_EXPECT(erase_result.has_value());
-                BEAST_EXPECT(
-                    erase_result.value().size() == _source_object.size());
-                BEAST_EXPECT(erase_result.value() == _source_object);
-            }
-        }
-
-        {
-            // OBJECT
-            auto source_object = _source_object;
-            auto field_object = *strUnHex("E05B614000000000000064E1");
-            // {"AmountEntry": {"Amount": "100"}}
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfAmountEntry.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            source_object.insert(
-                source_object.end(), field_object.begin(), field_object.end());
-            BEAST_EXPECT(result.value() == source_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfAmountEntry.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // ARRAY
-            auto source_object = _source_object;
-            auto field_object = *strUnHex("F9EA7D04DEADBEEFE1F1");
-            // {"Memos": [{"Memo":{ "MemoData": "DEADBEEF" }}]}
+            auto field_object = *strUnHex(data.second);
+            auto field_id = data.first;
 
             auto const result =
-                api.sto_emplace(source_object, field_object, sfMemos.getCode());
-            BEAST_EXPECT(result.has_value());
+                api.sto_emplace(source_object, field_object, field_id);
+            BEAST_EXPECTS(result.has_value(), data.second);
+            auto const r = result.value();
             BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            source_object.insert(
-                source_object.end(), field_object.begin(), field_object.end());
-            BEAST_EXPECT(result.value() == source_object);
+                r.size() == source_object.size() + field_object.size());
+            field_object.insert(
+                field_id < sfAccount.getCode() ? field_object.end()
+                                               : field_object.begin(),
+                source_object.begin(),
+                source_object.end());
+            BEAST_EXPECT(r == field_object);
 
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfMemos.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // UINT8
-            auto source_object = _source_object;
-            auto field_object = *strUnHex("00101001");
-            // {"TickSize": 1}
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfTickSize.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            source_object.insert(
-                source_object.end(), field_object.begin(), field_object.end());
-            BEAST_EXPECT(result.value() == source_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfTickSize.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // UINT160
-            auto source_object = _source_object;
-            auto field_object =
-                *strUnHex("01110000000000000000000000005553440000000000");
-            // {"TakerPaysCurrency": "0000000000000000000000005553440000000000"}
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfTakerPaysCurrency.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            source_object.insert(
-                source_object.end(), field_object.begin(), field_object.end());
-            BEAST_EXPECT(result.value() == source_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfTakerPaysCurrency.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // PATHSET
-            auto source_object = _source_object;
-            auto field_object = *strUnHex(
-                "0112300000000000000000000000005553440000000000054F6F784A58F9EF"
-                "B0A9EB90B83464F9D166461900");
-            // {"Paths": [[{ "currency": "USD", "issuer":
-            // "rVnYNK9yuxBz4uP8zC8LEFokM2nqH3poc" }]]}
-
-            auto const result =
-                api.sto_emplace(source_object, field_object, sfPaths.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            source_object.insert(
-                source_object.end(), field_object.begin(), field_object.end());
-            BEAST_EXPECT(result.value() == source_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfPaths.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // VECTOR256
-            auto source_object = _source_object;
-            auto field_object = *strUnHex(
-                "03132042426C4D4F1009EE67080A9B7965B44656D7714D104A72F9B4369F97"
-                "ABF044EE");
-            // {"Amendments":["42426C4D4F1009EE67080A9B7965B44656D7714D104A72F9B4369F97ABF044EE"]}
-
-            auto const result = api.sto_emplace(
-                source_object, field_object, sfAmendments.getCode());
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT(
-                result.value().size() ==
-                source_object.size() + field_object.size());
-            source_object.insert(
-                source_object.end(), field_object.begin(), field_object.end());
-            BEAST_EXPECT(result.value() == source_object);
-
-            auto const erase_result = api.sto_emplace(
-                result.value(), std::nullopt, sfAmendments.getCode());
-            BEAST_EXPECT(erase_result.has_value());
-            BEAST_EXPECT(erase_result.value().size() == _source_object.size());
-            BEAST_EXPECT(erase_result.value() == _source_object);
-        }
-
-        {
-            // UINT96
-        }
-
-        {
-            // UINT384
-        }
-
-        {
-            // UINT512
+            // test erase
+            auto const erase_result =
+                api.sto_emplace(result.value(), std::nullopt, field_id);
+            BEAST_EXPECTS(erase_result.has_value(), data.second);
+            auto const er = erase_result.value();
+            BEAST_EXPECT(er.size() == _source_object.size());
+            BEAST_EXPECT(er == _source_object);
         }
     }
 
@@ -4283,6 +4319,38 @@ public:
                 PARSE_ERROR);
         }
 
+        {
+            // Invalid: wrapped array has an invalid end marker.
+            // should be "F9EA7D02BEEFE1F1" {Memos:[{Memo:{MemoData:"BEEF"}}]}
+            auto const invalid_end_marker = *strUnHex("F9EA7D02BEEFE100");
+            auto const result = api.sto_subarray(invalid_end_marker, 0);
+            if (env.closed()->rules().enabled(fix20260929))
+            {
+                BEAST_EXPECT(!result.has_value());
+                BEAST_EXPECT(result.error() == PARSE_ERROR);
+            }
+            else
+            {
+                BEAST_EXPECT(result.value() == std::make_pair(1u, 6u));
+            }
+        }
+
+        {
+            // Invalid: the first element is valid but a following element is
+            // truncated.
+            auto const invalid_tail = *strUnHex("F9EA7D02BEEFE1EA7D02BEEFF1");
+            auto const result = api.sto_subarray(invalid_tail, 0);
+            if (env.closed()->rules().enabled(fix20260929))
+            {
+                BEAST_EXPECT(!result.has_value());
+                BEAST_EXPECT(result.error() == PARSE_ERROR);
+            }
+            else
+            {
+                BEAST_EXPECT(result.value() == std::make_pair(1u, 6u));
+            }
+        }
+
         {
             // doesn't found
             // { Memos: [{Memo: {MemoData: "BEEF"}}] }
@@ -4338,6 +4406,25 @@ public:
                 PARSE_ERROR);
         }
 
+        {
+            // Invalid: the requested field is valid but a later field is
+            // truncated.
+            auto const data = *strUnHex(
+                "240000000181140000000000000000000000000000000000000000");
+            auto const invalid_tail = Blob{data.begin(), data.end() - 1};
+            auto const result =
+                api.sto_subfield(invalid_tail, sfSequence.getCode());
+            if (env.closed()->rules().enabled(fix20260929))
+            {
+                BEAST_EXPECT(!result.has_value());
+                BEAST_EXPECT(result.error() == PARSE_ERROR);
+            }
+            else
+            {
+                BEAST_EXPECT(result.value() == std::make_pair(1u, 4u));
+            }
+        }
+
         {
             // doesn't found
             // { Memo: {MemoData: "BEEF"} }
@@ -4385,8 +4472,20 @@ public:
             makeStubHookContext(applyCtx, alice.id(), alice.id(), {});
         auto& api = hookCtx.api();
 
-        BEAST_EXPECT(api.sto_validate(Bytes{}).error() == TOO_SMALL);
-        BEAST_EXPECT(api.sto_validate(Bytes{0x00}).error() == TOO_SMALL);
+        // a buffer shorter than two bytes can't be a valid STObject:
+        // fix20261005 reports it as invalid rather than as TOO_SMALL
+        if (env.closed()->rules().enabled(fix20261005))
+        {
+            BEAST_EXPECT(api.sto_validate(Bytes{}).value() == false);
+            BEAST_EXPECT(api.sto_validate(Bytes{0x00}).value() == false);
+            BEAST_EXPECT(api.sto_validate(Bytes{0xE1}).value() == false);
+        }
+        else
+        {
+            BEAST_EXPECT(api.sto_validate(Bytes{}).error() == TOO_SMALL);
+            BEAST_EXPECT(api.sto_validate(Bytes{0x00}).error() == TOO_SMALL);
+            BEAST_EXPECT(api.sto_validate(Bytes{0xE1}).error() == TOO_SMALL);
+        }
 
         // { Memo: {MemoData: "BEEF"} }
         auto const memos = *strUnHex("EA7D02BEEFE1");
@@ -4397,34 +4496,17 @@ public:
         // { AmountEntry: {Amount: "100"} }
         auto const amountEntry = *strUnHex("E05B614000000000000064E1");
 
-        BEAST_EXPECT(api.sto_validate(memos).value() == true);
-        BEAST_EXPECT(api.sto_validate(amounts).value() == true);
-        BEAST_EXPECT(api.sto_validate(memo).value() == true);
-        BEAST_EXPECT(api.sto_validate(amountEntry).value() == true);
+        for (auto const& data : {memos, amounts, memo, amountEntry})
+        {
+            // Valid data
+            BEAST_EXPECT(api.sto_validate(data).value() == true);
 
-        // Invalid data
-        BEAST_EXPECT(
-            api.sto_validate(Bytes{0xFF, 0xFF, 0xFF, 0xFF}).value() == false);
-
-        Bytes const i_memos(&memos[0], &memos[memos.size() - 1]);
-        Bytes const i_amounts(&amounts[0], &amounts[amounts.size() - 1]);
-        Bytes const i_memo(&memo[0], &memo[memo.size() - 1]);
-        Bytes const i_amountEntry(
-            &amountEntry[0], &amountEntry[amountEntry.size() - 1]);
-        BEAST_EXPECT(api.sto_validate(i_memos).value() == false);
-        BEAST_EXPECT(api.sto_validate(i_amounts).value() == false);
-        BEAST_EXPECT(api.sto_validate(i_memo).value() == false);
-        BEAST_EXPECT(api.sto_validate(i_amountEntry).value() == false);
-
-        Bytes const i2_memos(&memos[1], &memos[memos.size()]);
-        Bytes const i2_amounts(&amounts[1], &amounts[amounts.size()]);
-        Bytes const i2_memo(&memo[1], &memo[memo.size()]);
-        Bytes const i2_amountEntry(
-            &amountEntry[1], &amountEntry[amountEntry.size()]);
-        BEAST_EXPECT(api.sto_validate(i_memos).value() == false);
-        BEAST_EXPECT(api.sto_validate(i_amounts).value() == false);
-        BEAST_EXPECT(api.sto_validate(i_memo).value() == false);
-        BEAST_EXPECT(api.sto_validate(i_amountEntry).value() == false);
+            // Invalid data
+            auto const partial_data = Blob{data.begin(), data.end() - 1};
+            BEAST_EXPECT(api.sto_validate(partial_data).value() == false);
+            auto const partial_data2 = Blob{data.begin() + 1, data.end()};
+            BEAST_EXPECT(api.sto_validate(partial_data2).value() == false);
+        }
     }
 
     void
@@ -4477,6 +4559,22 @@ public:
         BEAST_EXPECT(accid.has_value());
         auto aliceid = alice.id();
         BEAST_EXPECT(accid.value() == Bytes(aliceid.begin(), aliceid.end()));
+
+        // Bytes outside the base58 alphabet, including >= 0x80, must be
+        // rejected wherever they appear (signed-char lookup regression)
+        {
+            std::string const addr = alice.human();
+            for (std::size_t pos = 0; pos < addr.size(); ++pos)
+            {
+                for (int const b : {0x00, 0x7f, 0x80, 0xc2, 0xff})
+                {
+                    std::string bad = addr;
+                    bad[pos] = static_cast<char>(b);
+                    auto const r = api.util_accid(bad);
+                    BEAST_EXPECT(!r && r.error() == INVALID_ARGUMENT);
+                }
+            }
+        }
     }
 
     void
@@ -4846,12 +4944,14 @@ public:
 
         test_prepare(features);
         test_emit(features);
+        test_emitted_txn_entry(features);
         test_etxn_burden(features);
         test_etxn_generation(features);
         test_otxn_burden(features);
         test_otxn_generation(features);
         test_etxn_details(features);
         test_etxn_fee_base(features - fixHookAPI20251128);
+        test_etxn_fee_base(features - fix20260929);
         test_etxn_fee_base(features);
         test_etxn_nonce(features);
         test_etxn_reserve(features);
@@ -4873,6 +4973,7 @@ public:
         test_float_one(features);
         test_float_root(features);
         test_float_set(features);
+        test_float_set(features - fix20261005);
         test_float_sign(features);
         test_float_sto(features);
         test_float_sto_set(features);
@@ -4917,10 +5018,14 @@ public:
         test_state_set(features);
 
         test_sto_emplace(features);
+        test_sto_emplace(features - fix20260929);
         // test_sto_erase(features); // tested in test_sto_emplace
         test_sto_subarray(features);
+        test_sto_subarray(features - fix20260929);
         test_sto_subfield(features);
+        test_sto_subfield(features - fix20260929);
         test_sto_validate(features);
+        test_sto_validate(features - fix20261005);
 
         test_trace(features);
         test_trace_float(features);

src/test/app/Import_test.cpp

@@ -20,6 +20,7 @@
 #include <test/app/Import_json.h>
 #include <test/jtx.h>
 #include <test/jtx/AMM.h>
+#include <test/jtx/CaptureLogs.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/misc/AmendmentTable.h>
 #include <xrpld/app/misc/HashRouter.h>
@@ -29,7 +30,9 @@
 #include <xrpl/json/json_reader.h>
 #include <xrpl/json/json_writer.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/Import.h>
+#include <xrpl/protocol/digest.h>
 #include <xrpl/protocol/jss.h>
 
 #define BEAST_REQUIRE(x)     \
@@ -194,6 +197,35 @@ class Import_test : public beast::unit_test::suite
             env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
 
+        auto const upperHash =
+            "E000CC0736630D66DAB573A2642E1BD0646DFB13A871B2CCFA6E4226F477D88C";
+        auto const makeList = [](std::string const& hash) {
+            Json::Value proof{Json::arrayValue};
+            for (int i = 0; i < 16; ++i)
+                proof.append(hash);
+            return proof;
+        };
+
+        // XPOP.transaction.proof list should be exactly 16 entries
+        {
+            Json::Value proof = makeList(upperHash);
+            proof.append(upperHash);
+            BEAST_EXPECT(syntaxCheckProof(proof, env.journal) == false);
+        }
+        // XPOP.transaction.proof list entry missing or wrong format
+        // (should be hex string with 64 characters)
+        {
+            Json::Value proof = makeList(upperHash);
+            proof[Json::Value::ArrayIndex{0}] = "wrong format";
+            BEAST_EXPECT(syntaxCheckProof(proof, env.journal) == false);
+        }
+        // XPOP.transaction.proof list entry has wrong format
+        {
+            Json::Value proof = makeList(upperHash);
+            proof[Json::Value::ArrayIndex{0}] = 1234;
+            BEAST_EXPECT(syntaxCheckProof(proof, env.journal) == false);
+        }
+
         // // XPOP.transaction.proof list should be exactly 16 entries
         //  {
         //     Json::Value tmpXpop =
@@ -334,6 +366,58 @@ class Import_test : public beast::unit_test::suite
                 tmpProof[jss::children]["3"];
             BEAST_EXPECT(syntaxCheckProof(tmpProof, env.journal) == false);
         }
+        // XPOP.transaction.proof tree node has wrong format
+        // invalid hash (must be hex)
+        {
+            Json::Value tmpProof = proof;
+            tmpProof[jss::children]["3"][jss::hash] =
+                "ZZ126BA0486ADAE575BBC5335E42E236275A452037CA9A876D1A8CDACA1AE5"
+                "42";
+            BEAST_EXPECT(syntaxCheckProof(tmpProof, env.journal) == false);
+        }
+        // XPOP.transaction.proof tree node has wrong format
+        // invalid key (must be hex)
+        {
+            Json::Value tmpProof = proof;
+            tmpProof[jss::children]["3"][jss::key] =
+                "ZZD6F6AB7D0A827DD1502B7B9571626A2B601DBE5BC786EF8ADD00E0CB7FCE"
+                "B3";
+            BEAST_EXPECT(syntaxCheckProof(tmpProof, env.journal) == false);
+        }
+        // XPOP.transaction.proof tree node has wrong format (root)
+        // invalid root hash (must be hex)
+        {
+            Json::Value tmpProof = proof;
+            tmpProof[jss::hash] =
+                "ZZ9C8D073DDB5AB07FD2CD4F14467A8F3BC8FFBA16A0032D12D823D8511C12"
+                "F4";
+            BEAST_EXPECT(syntaxCheckProof(tmpProof, env.journal) == false);
+        }
+        // XPOP.transaction.proof child node was not 0-F hex nibble
+        // lower case nibble
+        {
+            Json::Value tmpProof = proof;
+            tmpProof[jss::children]["a"] = tmpProof[jss::children]["3"];
+            BEAST_EXPECT(syntaxCheckProof(tmpProof, env.journal) == false);
+        }
+        // success: hash and key values may be upper or lower case hex. Only
+        // child branch keys are constrained to upper case 0-F.
+        {
+            Json::Value tmpProof = proof;
+            tmpProof[jss::hash] =
+                "409c8d073ddb5ab07fd2cd4f14467a8f3bc8ffba16a0032d12d823d8511c12"
+                "f4";
+            tmpProof[jss::key] =
+                "00000000000000000000000000000000000000000000000000000000000000"
+                "00";
+            tmpProof[jss::children]["3"][jss::hash] =
+                "aa126ba0486adae575bbc5335e42e236275a452037ca9a876d1a8cdaca1ae5"
+                "42";
+            tmpProof[jss::children]["3"][jss::key] =
+                "39d6f6ab7d0a827dd1502b7b9571626a2b601dbe5bc786ef8add00e0cb7fce"
+                "b3";
+            BEAST_EXPECT(syntaxCheckProof(tmpProof, env.journal) == true);
+        }
         // success
         {
             BEAST_EXPECT(syntaxCheckProof(proof, env.journal) == true);
@@ -1484,6 +1568,117 @@ class Import_test : public beast::unit_test::suite
         }
     }
 
+    // Returns the XPOP with its blob/meta pair optionally tampered with
+    // (tamperMeta bumps the metadata's TransactionIndex, so the pair no longer
+    // hashes to any leaf in the proof) and, if plant is set, that pair's leaf
+    // hash written over the declared hash of the proof's nibble 0 child. In
+    // the w_seed fixture that child is an inner node, whose declared hash the
+    // txroot computation ignores.
+    static Json::Value
+    spoofInnerNode(Json::Value xpop, bool tamperMeta, bool plant)
+    {
+        auto& txn = xpop[jss::transaction];
+        auto const rawTx = *strUnHex(txn[jss::blob].asString());
+        auto rawMeta = *strUnHex(txn[jss::meta].asString());
+
+        if (tamperMeta)
+        {
+            STObject meta(
+                SerialIter(rawMeta.data(), rawMeta.size()), sfMetadata);
+            meta.setFieldU32(
+                sfTransactionIndex, meta.getFieldU32(sfTransactionIndex) + 1);
+            Serializer ms;
+            meta.add(ms);
+            rawMeta = ms.peekData();
+            txn[jss::meta] = strHex(rawMeta);
+        }
+
+        if (plant)
+        {
+            // leaf hash exactly as Import::preflight computes it
+            STTx const stx(SerialIter(rawTx.data(), rawTx.size()));
+            Serializer s(rawTx.size() + rawMeta.size() + 40);
+            s.addVL(rawTx);
+            s.addVL(rawMeta);
+            s.addBitString(stx.getTransactionID());
+            txn[jss::proof][jss::children]["0"][jss::hash] =
+                strHex(sha512Half(HashPrefix::txNode, s.slice()));
+        }
+
+        return xpop;
+    }
+
+    void
+    testProofInnerNodeSpoof(FeatureBitset features)
+    {
+        testcase("import proof inner node spoof");
+
+        using namespace test::jtx;
+        using namespace std::literals;
+
+        // the spoof relies on nibble 0 being an inner node in this fixture
+        auto const fixture = import::loadXpop(ImportTCAccountSet::w_seed);
+        auto const& nibble0 =
+            fixture[jss::transaction][jss::proof][jss::children]["0"];
+        BEAST_EXPECT(nibble0[jss::children].size() != 0);
+
+        std::string const notContained =
+            "xpop proof did not contain the specified txn hash";
+
+        // import the (possibly spoofed) w_seed XPOP into a fresh account and
+        // return the captured log
+        auto const runImport =
+            [&](bool tamperMeta, bool plant, TER expected) -> std::string {
+            std::string logs;
+            {
+                test::jtx::Env env{
+                    *this,
+                    network::makeNetworkVLConfig(21337, keys),
+                    features,
+                    std::make_unique<CaptureLogs>(&logs),
+                    beast::severities::kWarning};
+
+                // burn 10'000 xrp
+                auto const master = Account("masterpassphrase");
+                env(noop(master), fee(10'000'000'000), ter(tesSUCCESS));
+                env.close();
+
+                auto const alice = Account("alice");
+                env.memoize(alice);
+
+                Json::Value tx = import::import(
+                    alice, spoofInnerNode(fixture, tamperMeta, plant));
+                tx[jss::Sequence] = 0;
+                tx[jss::Fee] = 0;
+                env(tx, alice, ter(expected));
+                env.close();
+
+                auto const [acct, acctSle] =
+                    accountKeyAndSle(*env.current(), alice);
+                BEAST_EXPECT((acctSle != nullptr) == isTesSuccess(expected));
+            }
+            return logs;
+        };
+
+        // control: overwriting the inner node's declared hash alone leaves the
+        // computed txroot unchanged, so the genuine pair still imports
+        BEAST_EXPECT(
+            runImport(false, true, tesSUCCESS).find(notContained) ==
+            std::string::npos);
+
+        // a tampered blob/meta pair is not in the proof
+        BEAST_EXPECT(
+            runImport(true, false, temMALFORMED).find(notContained) !=
+            std::string::npos);
+
+        // spoof: the tampered pair's hash planted on the inner node. The
+        // txroot still verifies (see control), so the containment check is
+        // the only thing that can reject it
+        BEAST_EXPECT(
+            runImport(true, true, temMALFORMED).find(notContained) !=
+            std::string::npos);
+    }
+
     void
     testGetVLInfo(FeatureBitset features)
     {
@@ -1663,11 +1858,9 @@ class Import_test : public beast::unit_test::suite
 
         // temMALFORMED - Import: xpop did not contain an 80% quorum for the txn
         // it purports to prove.
-        for (bool const withXahauV1 : {true, false})
         {
-            auto const amend = withXahauV1 ? features : features - fixXahauV1;
             test::jtx::Env env{
-                *this, network::makeNetworkVLConfig(21337, keys), amend};
+                *this, network::makeNetworkVLConfig(21337, keys), features};
 
             auto const alice = Account("alice");
             env.fund(XRP(1000), alice);
@@ -1679,16 +1872,10 @@ class Import_test : public beast::unit_test::suite
                 "";
             valData["n9MTTavZe6EPqqyQ27pJbNWpfHw8ZNspVgznrwx5HWm7cdTjKQie"] =
                 "";
-            if (withXahauV1)
-            {
-                valData
-                    ["n94J5LCRu9bBWrJiwRWujvuVECVPWbXFcQ2VN38qLD378F5pDSDM"] =
-                        "";
-            }
+            valData["n94J5LCRu9bBWrJiwRWujvuVECVPWbXFcQ2VN38qLD378F5pDSDM"] =
+                "";
             tmpXpop[jss::validation][jss::data] = valData;
-            auto const txResult =
-                withXahauV1 ? ter(temMALFORMED) : ter(temMALFORMED);
-            env(import::import(alice, tmpXpop), txResult);
+            env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
 
         test::jtx::Env env{*this, network::makeNetworkVLConfig(21337, keys)};
@@ -1708,6 +1895,12 @@ class Import_test : public beast::unit_test::suite
         env.fund(XRP(1000), alice, bob, carol, dave);
         env.close();
 
+        auto const importWithUnlBlob = [&](std::string const& json) {
+            Json::Value tmpXpop = import::loadXpop(ImportTCAccountSet::w_seed);
+            tmpXpop[jss::validation][jss::unl][jss::blob] = base64_encode(json);
+            env(import::import(alice, tmpXpop), ter(temMALFORMED));
+        };
+
         // temMALFORMED
         // Issuer cannot be the source account.
         {
@@ -1721,7 +1914,7 @@ class Import_test : public beast::unit_test::suite
         {
             Json::Value tx = import::import(
                 alice, import::loadXpop(ImportTCAccountSet::w_seed));
-            STAmount const& fee = XRP(0);
+            STAmount const fee = XRP(0);
             tx[jss::Fee] = fee.getJson(JsonOptions::none);
             env(tx, ter(telINSUF_FEE_P));
         }
@@ -1740,7 +1933,7 @@ class Import_test : public beast::unit_test::suite
         {
             Json::Value tx = import::import(
                 alice, import::loadXpop(ImportTCAccountSet::w_seed));
-            STAmount const& amount = XRP(-1);
+            STAmount const amount = XRP(-1);
             tx[jss::Amount] = amount.getJson(JsonOptions::none);
             env(tx, ter(temMALFORMED));
         }
@@ -2084,6 +2277,12 @@ class Import_test : public beast::unit_test::suite
                 "WFo3VFFFPSJ9XX0=";
             env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
+        // temMALFORMED - Import: unl blob json (after base64 decoding) wrong
+        // required field (sequence) and/or types: negative int
+        {
+            importWithUnlBlob(
+                R"({"sequence":-1,"expiration":741398400,"validators":[]})");
+        }
         // temMALFORMED - Import: unl blob json (after base64 decoding)
         // lacked required field (expiration) and/or types
         {
@@ -2135,6 +2334,12 @@ class Import_test : public beast::unit_test::suite
                 "WFo3VFFFPSJ9XX0=";
             env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
+        // temMALFORMED - Import: unl blob json (after base64 decoding) wrong
+        // required field (expiration) and/or types: negative int
+        {
+            importWithUnlBlob(
+                R"({"sequence":2,"expiration":-1,"validators":[]})");
+        }
         // temMALFORMED - Import: unl blob json (after base64 decoding)
         // lacked required field (effective) and/or types
         {
@@ -2161,6 +2366,13 @@ class Import_test : public beast::unit_test::suite
                 "WGJuS1dqVmhxTmFHbTU3N0s2SjY5N1haN1RRRT0ifV19";
             env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
+        // temMALFORMED - Import: unl blob json (after base64 decoding) wrong
+        // required field (effective) and/or types: negative int
+        {
+            importWithUnlBlob(
+                R"({"sequence":2,"effective":-1,"expiration":741398400,)"
+                R"("validators":[]})");
+        }
         // temMALFORMED - Import: unl blob json (after base64 decoding)
         // lacked required field (validators) and/or types
         {
@@ -2209,7 +2421,10 @@ class Import_test : public beast::unit_test::suite
             env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
 
-        // temMALFORMED - Import: unl blob expired
+        // temMALFORMED - unl blob expired. The window is now checked in
+        // preclaim (see testVLWindowClock). This blob's validator list
+        // does not match the xpop's validations, so preflight rejects it
+        // first.
         {
             Json::Value tmpXpop = import::loadXpop(ImportTCAccountSet::w_seed);
             tmpXpop[jss::validation][jss::unl][jss::blob] =
@@ -2239,7 +2454,10 @@ class Import_test : public beast::unit_test::suite
             env(import::import(alice, tmpXpop), ter(temMALFORMED));
         }
 
-        // temMALFORMED - Import: unl blob not yet valid
+        // temMALFORMED - unl blob not yet valid. The window is now checked in
+        // preclaim (see testVLWindowClock). This blob's validator list
+        // does not match the xpop's validations, so preflight rejects it
+        // first.
         {
             Json::Value tmpXpop = import::loadXpop(ImportTCAccountSet::w_seed);
             tmpXpop[jss::validation][jss::unl][jss::blob] =
@@ -5238,7 +5456,6 @@ class Import_test : public beast::unit_test::suite
                 *this, network::makeNetworkVLConfig(21337, keys)};
 
             auto const feeDrops = env.current()->fees().base;
-            bool const fixV2 = env.current()->rules().enabled(fixXahauV2);
 
             // confirm total coins header
             auto const initCoins = env.current()->info().drops;
@@ -5288,18 +5505,17 @@ class Import_test : public beast::unit_test::suite
             auto const preAlice = env.balance(alice);
             auto const preCoins = env.current()->info().drops;
 
-            auto const result = fixV2 ? ter(tesSUCCESS) : ter(tecHOOK_REJECTED);
             env(import::import(
                     alice, import::loadXpop(ImportTCAccountSet::w_seed)),
                 import::issuer(issuer),
                 fee(1'000'000),
-                result);
+                ter(tesSUCCESS));
             env.close();
 
             // fixXahauV2
             bool const zeroBurn =
                 env.current()->rules().enabled(featureZeroB2M);
-            auto const mintXAH = fixV2 ? XRP(zeroBurn ? 0 : 1000) : XRP(0);
+            auto const mintXAH = XRP(zeroBurn ? 0 : 1000);
             // confirm fee was burned mint / no mint
             auto const postAlice = env.balance(alice);
             BEAST_EXPECT(postAlice == preAlice - XRP(1) + mintXAH);
@@ -5309,17 +5525,14 @@ class Import_test : public beast::unit_test::suite
             BEAST_EXPECT(postCoins == preCoins - XRP(1) + mintXAH);
 
             // resubmit import without issuer
-            auto const result2 =
-                fixV2 ? ter(tefPAST_IMPORT_SEQ) : ter(tesSUCCESS);
             env(import::import(
                     alice, import::loadXpop(ImportTCAccountSet::w_seed)),
                 fee(feeDrops * 10),
-                result2);
+                ter(tefPAST_IMPORT_SEQ));
             env.close();
 
             // total burn
-            auto const totalBurn =
-                fixV2 ? XRP(0) : XRP(zeroBurn ? 0 : 1000) - (feeDrops * 10);
+            auto const totalBurn = XRP(0);
 
             // confirm fee was minted / not minted
             auto const postAlice2 = env.balance(alice);
@@ -6270,13 +6483,168 @@ class Import_test : public beast::unit_test::suite
         }
     }
 
+    void
+    testGetVLWindow(FeatureBitset features)
+    {
+        testcase("import utils - getVLWindow");
+
+        using namespace test::jtx;
+
+        beast::Journal const j{beast::Journal::getNullSink()};
+
+        auto const at = [](std::uint32_t s) {
+            return NetClock::time_point{NetClock::duration{s}};
+        };
+        auto const withBlob = [](std::string const& json) {
+            Json::Value xpop;
+            xpop[jss::validation][jss::unl][jss::blob] = base64_encode(json);
+            return xpop;
+        };
+
+        // effective absent: valid from the epoch
+        {
+            auto const window =
+                getVLWindow(import::loadXpop(ImportTCAccountSet::w_seed), j);
+            BEAST_REQUIRE(window);
+            BEAST_EXPECT(window->first == at(0));
+            BEAST_EXPECT(window->second == at(757349624));
+        }
+
+        // effective present
+        {
+            auto const window = getVLWindow(
+                withBlob(R"({"sequence":1,"effective":3600,)"
+                         R"("expiration":86400,"validators":[]})"),
+                j);
+            BEAST_REQUIRE(window);
+            BEAST_EXPECT(window->first == at(3600));
+            BEAST_EXPECT(window->second == at(86400));
+        }
+
+        // not json, not an object, or missing / ill-typed fields
+        for (std::string const bad :
+             {"badJson",
+              "[1,2,3]",
+              R"({"sequence":1})",
+              R"({"expiration":"86400"})",
+              R"({"expiration":-1})",
+              R"({"effective":"0","expiration":86400})",
+              R"({"effective":-1,"expiration":86400})"})
+            BEAST_EXPECT(!getVLWindow(withBlob(bad), j));
+    }
+
+    void
+    testVLWindowClock(FeatureBitset features)
+    {
+        testcase("import vl window clock");
+
+        using namespace test::jtx;
+
+        auto const at = [](std::uint32_t s) {
+            return NetClock::time_point{NetClock::duration{s}};
+        };
+
+        // expiration of the w_seed unl blob
+        std::uint32_t const expiry = 757349624;
+        auto const before = at(expiry - 1000);
+        auto const after = at(expiry + 1000);
+        auto const closeParentAt = [&](Env& env,
+                                       NetClock::time_point closeTime) {
+            using namespace std::chrono_literals;
+
+            auto const resolution = env.closed()->info().closeTimeResolution;
+            env.close(closeTime - resolution + 1s);
+        };
+
+        auto const alice = Account("alice");
+        auto const importTx = [&alice]() {
+            Json::Value tx = import::import(
+                alice, import::loadXpop(ImportTCAccountSet::w_seed));
+            tx[jss::Sequence] = 0;
+            tx[jss::Fee] = 0;
+            return tx;
+        };
+        // Keep this test focused on the VL clock, not max-supply accounting.
+        // w_seed creates an account and, without ZeroB2M, credits its 1000 XRP
+        // inner fee as valid legacy burn-to-mint.
+        auto const burnMintHeadroom = [&](Env& env) {
+            auto const initCoins = env.current()->info().drops;
+            auto headroom = Import::computeStartingBonus(*env.current());
+            if (!env.current()->rules().enabled(featureZeroB2M))
+                headroom += XRP(1000).value().xrp();
+            auto const master = Account("masterpassphrase");
+            env(noop(master),
+                fee(static_cast<std::uint64_t>(headroom.drops())),
+                ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(env.current()->info().drops == initCoins - headroom);
+        };
+
+        // parent ledger inside the window, node clock past it
+        {
+            Env env{*this, network::makeNetworkVLConfig(21337, keys), features};
+            burnMintHeadroom(env);
+            env.memoize(alice);
+            env.close(before);
+            BEAST_EXPECT(env.current()->parentCloseTime() < at(expiry));
+
+            env.timeKeeper().set(after);
+            env(importTx(), alice, ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(env.le(alice) != nullptr);
+        }
+
+        // parent ledger past the window, node clock inside it
+        {
+            Env env{*this, network::makeNetworkVLConfig(21337, keys), features};
+            burnMintHeadroom(env);
+            env.memoize(alice);
+            env.close(after);
+            BEAST_EXPECT(env.current()->parentCloseTime() >= at(expiry));
+
+            env.timeKeeper().set(before);
+            env(importTx(), alice, ter(temMALFORMED));
+            BEAST_EXPECT(env.le(alice) == nullptr);
+        }
+
+        // Env::close uses close-time resolution, so the requested expiration
+        // time lands on the closest representable parent close before
+        // expiration for this blob.
+        {
+            Env env{*this, network::makeNetworkVLConfig(21337, keys), features};
+            burnMintHeadroom(env);
+            env.memoize(alice);
+            closeParentAt(env, at(expiry));
+            BEAST_EXPECT(env.current()->parentCloseTime() < at(expiry));
+
+            env(importTx(), alice, ter(tesSUCCESS));
+            env.close();
+            BEAST_EXPECT(env.le(alice) != nullptr);
+        }
+
+        // accepted into the open ledger, which then closes after the window.
+        // Env::close() sets the node clock to the close time before the
+        // ledger is built, so this also covers the rebuild
+        {
+            Env env{*this, network::makeNetworkVLConfig(21337, keys), features};
+            burnMintHeadroom(env);
+            env.memoize(alice);
+            env.close(before);
+            env(importTx(), alice, ter(tesSUCCESS));
+            BEAST_EXPECT(env.le(alice) != nullptr);
+
+            env.close(after);
+            BEAST_EXPECT(env.closed()->info().parentCloseTime < at(expiry));
+            BEAST_EXPECT(env.le(alice) != nullptr);
+        }
+    }
+
 public:
     void
     run() override
     {
         using namespace test::jtx;
         FeatureBitset const all{supported_amendments()};
-        testWithFeats(all - fixXahauV2);
         testWithFeats(all - featureZeroB2M);
         testWithFeats(all);
     }
@@ -6292,6 +6660,7 @@ public:
         testSyntaxCheckProofArray(features);
         testSyntaxCheckProofObject(features);
         testSyntaxCheckXPOP(features);
+        testProofInnerNodeSpoof(features);
         testGetVLInfo(features);
         testEnabled(features);
         testInvalidPreflight(features);
@@ -6311,6 +6680,8 @@ public:
         testMinMax(features);
         testHalving(features - featureOwnerPaysFee);
         testBlackhole(features);
+        testGetVLWindow(features);
+        testVLWindowClock(features);
     }
 };
 

src/test/app/LedgerMaster_test.cpp

@@ -104,8 +104,8 @@ class LedgerMaster_test : public beast::unit_test::suite
                 startLegSeq, txnIndex);
             BEAST_EXPECT(
                 *result ==
-                uint256("0CC11AD1AD89661689F6B6148D82CB6A7101DA4D66EC843670262D"
-                        "0B618F5745"));
+                uint256("DCAECE52F028B9D0F7CA43CBE15AB4EF7B84A8EF5D455238992E1E"
+                        "DF2BDA1637"));
         }
         // success (second tx)
         {
@@ -114,8 +114,8 @@ class LedgerMaster_test : public beast::unit_test::suite
                 startLegSeq + 1, txnIndex);
             BEAST_EXPECT(
                 *result ==
-                uint256("DCAECE52F028B9D0F7CA43CBE15AB4EF7B84A8EF5D455238992E1E"
-                        "DF2BDA1637"));
+                uint256("722BD5EC9E4AE36E724B6223F5A5887927AADFD0B18A3053AAE57F"
+                        "434F8C9FE8"));
         }
     }
 

src/test/app/LedgerReplay_test.cpp

@@ -1111,7 +1111,7 @@ struct LedgerReplayer_test : public beast::unit_test::suite
                 return false;
 
             beast::IP::Address addr =
-                boost::asio::ip::address::from_string("172.1.1.100");
+                boost::asio::ip::make_address("172.1.1.100");
             jtx::Env serverEnv(*this);
             serverEnv.app().config().LEDGER_REPLAY = server;
             auto http_resp = ripple::makeResponse(

src/test/app/LoadManager_test.cpp

@@ -0,0 +1,203 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF  USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <test/jtx/Env.h>
+#include <test/jtx/envconfig.h>
+#include <xrpld/app/main/LoadManager.h>
+#include <xrpld/app/misc/LoadFeeTrack.h>
+#include <xrpl/beast/unit_test.h>
+#include <cstdint>
+
+namespace ripple {
+
+/**
+ * Unit tests for LoadFeeTrack fee adjustment mechanics.
+ *
+ * These tests document the expected per-second behaviour of
+ * raiseLocalFee() and lowerLocalFee() as called by LoadManager::run().
+ *
+ * Background: prior to the fix in this PR, the fee adjustment block in
+ * LoadManager::run() was placed *outside* the while loop, meaning
+ * raiseLocalFee()/lowerLocalFee() fired only once on shutdown rather
+ * than every second during normal operation. localTxnLoadFee_ (and thus
+ * load_factor_local in server_info) was therefore never adjusted by
+ * local job queue load during normal operation.
+ */
+class LoadManager_test : public beast::unit_test::suite
+{
+public:
+    // The normal/minimum fee factor (kLftNormalFee in LoadFeeTrack)
+    static constexpr std::uint32_t kNormalFee = 256;
+
+    void
+    testRaiseHysteresis()
+    {
+        testcase("raiseLocalFee requires two consecutive calls");
+
+        LoadFeeTrack track;
+
+        // First call: raiseCount_ goes from 0 to 1, returns false (hysteresis)
+        BEAST_EXPECT(!track.raiseLocalFee());
+        BEAST_EXPECT(track.getLocalFee() == kNormalFee);
+
+        // Second call: raiseCount_ reaches 2, fee is raised
+        BEAST_EXPECT(track.raiseLocalFee());
+        BEAST_EXPECT(track.getLocalFee() > kNormalFee);
+    }
+
+    void
+    testLowerDecaysToBaseline()
+    {
+        testcase("lowerLocalFee decays elevated fee back to baseline");
+
+        LoadFeeTrack track;
+
+        // Raise the fee above baseline (requires two calls due to hysteresis)
+        track.raiseLocalFee();
+        track.raiseLocalFee();
+        auto const elevated = track.getLocalFee();
+        BEAST_EXPECT(elevated > kNormalFee);
+
+        // lowerLocalFee() should decay it each call
+        // Each call reduces by 1/kLftFeeDecFraction (1/4), so a few
+        // iterations should bring it back to kNormalFee
+        bool changed = false;
+        for (int i = 0; i < 100; ++i)
+        {
+            changed |= track.lowerLocalFee();
+            if (track.getLocalFee() == kNormalFee)
+                break;
+        }
+
+        BEAST_EXPECT(changed);
+        BEAST_EXPECT(track.getLocalFee() == kNormalFee);
+    }
+
+    void
+    testLowerAtBaselineIsNoop()
+    {
+        testcase("lowerLocalFee at baseline returns false");
+
+        LoadFeeTrack track;
+
+        // Already at baseline — should return false (no change)
+        BEAST_EXPECT(!track.lowerLocalFee());
+        BEAST_EXPECT(track.getLocalFee() == kNormalFee);
+    }
+
+    void
+    testRaiseResetsOnLower()
+    {
+        testcase("lowerLocalFee resets raiseCount");
+
+        LoadFeeTrack track;
+
+        // One raise call (hysteresis: count=1, no change yet)
+        BEAST_EXPECT(!track.raiseLocalFee());
+
+        // Lower resets raiseCount_ to 0
+        track.lowerLocalFee();
+
+        // Next raise call starts from 0 again — still needs two calls
+        BEAST_EXPECT(!track.raiseLocalFee());
+        BEAST_EXPECT(track.getLocalFee() == kNormalFee);
+    }
+
+    void
+    testIsLoadedLocal()
+    {
+        testcase("isLoadedLocal reflects fee state correctly");
+
+        LoadFeeTrack track;
+
+        // At baseline, not loaded
+        BEAST_EXPECT(!track.isLoadedLocal());
+
+        // After one raise (hysteresis, fee unchanged) — raiseCount_ != 0
+        track.raiseLocalFee();
+        BEAST_EXPECT(track.isLoadedLocal());
+
+        // After lower, raiseCount_ reset and fee back at baseline
+        track.lowerLocalFee();
+        BEAST_EXPECT(!track.isLoadedLocal());
+    }
+
+    void
+    testLoadManagerLoop()
+    {
+        testcase("LoadManager loop raises and decays load_factor_local");
+
+        using namespace test::jtx;
+
+        Env env(*this, envconfig());
+
+        // Stop the real LoadManager thread so we can drive the fee track
+        // manually without races. On stock code the fee adjustment block
+        // is outside the while loop and never fires during normal operation,
+        // so getFeeTrack().getLocalFee() stays at kNormalFee (256) regardless.
+        env.app().getLoadManager().stop();
+
+        auto& feeTrack = env.app().getFeeTrack();
+
+        // Confirm baseline
+        BEAST_EXPECT(feeTrack.getLocalFee() == kNormalFee);
+        BEAST_EXPECT(!feeTrack.isLoadedLocal());
+
+        // raiseLocalFee() requires two consecutive calls (hysteresis guard).
+        // This is the exact sequence LoadManager::run() executes each tick
+        // when the job queue is overloaded.
+        BEAST_EXPECT(!feeTrack.raiseLocalFee());  // tick 1: count=1, no change
+        BEAST_EXPECT(feeTrack.raiseLocalFee());   // tick 2: count=2, fee raised
+        BEAST_EXPECT(feeTrack.getLocalFee() > kNormalFee);
+        BEAST_EXPECT(feeTrack.isLoadedLocal());
+
+        // Now simulate the LoadManager loop calling lowerLocalFee() each tick
+        // until the fee decays back to baseline. On stock code this block
+        // never runs during normal operation so the fee would stay elevated.
+        bool decayed = false;
+        for (int i = 0; i < 100; ++i)
+        {
+            feeTrack.lowerLocalFee();
+            if (feeTrack.getLocalFee() == kNormalFee)
+            {
+                decayed = true;
+                break;
+            }
+        }
+
+        BEAST_EXPECT(decayed);
+        BEAST_EXPECT(feeTrack.getLocalFee() == kNormalFee);
+        BEAST_EXPECT(!feeTrack.isLoadedLocal());
+    }
+
+    void
+    run() override
+    {
+        testRaiseHysteresis();
+        testLowerDecaysToBaseline();
+        testLowerAtBaselineIsNoop();
+        testRaiseResetsOnLower();
+        testIsLoadedLocal();
+        testLoadManagerLoop();
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(LoadManager, app, ripple);
+
+}  // namespace ripple

src/test/app/MPToken_test.cpp

@@ -1174,11 +1174,11 @@ class MPToken_test : public beast::unit_test::suite
                 JsonOptions::none)[sfAffectedNodes.fieldName];
             // Issuer got 10 in the transfer fees
             BEAST_EXPECT(
-                meta[2u][sfModifiedNode.fieldName][sfFinalFields.fieldName]
+                meta[0u][sfModifiedNode.fieldName][sfFinalFields.fieldName]
                     [sfOutstandingAmount.fieldName] == "9990");
             // Destination account got 9'990
             BEAST_EXPECT(
-                meta[0u][sfModifiedNode.fieldName][sfFinalFields.fieldName]
+                meta[3u][sfModifiedNode.fieldName][sfFinalFields.fieldName]
                     [sfMPTAmount.fieldName] == "9990");
             // Source account spent 10'000
             BEAST_EXPECT(
@@ -1910,8 +1910,8 @@ class MPToken_test : public beast::unit_test::suite
             env.tx()->getJson(JsonOptions::none)[jss::hash].asString()};
         BEAST_EXPECTS(
             txHash ==
-                "42175D43E3D236A86B0F1B07182A1B2C78AD382372CFA09A48239C395FFFEE"
-                "30",
+                "61041108F0DAD50BAFD2F7B1102AC70B283EBDCED194CEBAF04D0184E4A70B"
+                "02",
             txHash);
         Json::Value const meta = env.rpc("tx", txHash)[jss::result][jss::meta];
         auto const id = meta[jss::mpt_issuance_id].asString();
@@ -1919,7 +1919,7 @@ class MPToken_test : public beast::unit_test::suite
         BEAST_EXPECT(meta.isMember(jss::mpt_issuance_id));
         BEAST_EXPECT(id == to_string(mptAlice.issuanceID()));
         BEAST_EXPECTS(
-            id == "00000001AE123A8556F3CF91154711376AFB0F894F832B3D", id);
+            id == "00000002AE123A8556F3CF91154711376AFB0F894F832B3D", id);
     }
 
     void

src/test/app/Offer_test.cpp

@@ -5104,11 +5104,39 @@ public:
 
         using namespace jtx;
 
-        // OfferCreate
-        for (bool const withXahauV1 : {true, false})
+        // OfferID is only valid when Hooks are enabled.
         {
-            auto const amend = withXahauV1 ? features : features - fixXahauV1;
-            Env env{*this, amend};
+            Env env{*this, features - featureHooks};
+            auto const gw = Account{"gateway"};
+            auto const alice = Account{"alice"};
+            auto const USD = gw["USD"];
+
+            env.fund(XRP(10000), gw, alice);
+            env.close();
+
+            env(trust(alice, USD(1000)));
+            env.close();
+
+            env(pay(gw, alice, USD(200)));
+            env.close();
+
+            uint256 const offerId{getOfferIndex(alice, env.seq(alice))};
+            env(offer(alice, XRP(50), USD(50)));
+            env.close();
+
+            uint256 const newOfferId{getOfferIndex(alice, env.seq(alice))};
+            env(offer(alice, XRP(50), USD(50)),
+                offer_id(offerId),
+                ter(temDISABLED));
+            env(offer_cancel(alice), offer_id(offerId), ter(temDISABLED));
+
+            BEAST_EXPECT(env.le(keylet::unchecked(offerId)));
+            BEAST_EXPECT(!env.le(keylet::unchecked(newOfferId)));
+        }
+
+        // OfferCreate
+        {
+            Env env{*this, features};
             auto const gw = Account{"gateway"};
             auto const alice = Account{"alice"};
             auto const USD = gw["USD"];
@@ -5192,10 +5220,8 @@ public:
         }
 
         // OfferCancel
-        for (bool const withXahauV1 : {true, false})
         {
-            auto const amend = withXahauV1 ? features : features - fixXahauV1;
-            Env env{*this, amend};
+            Env env{*this, features};
             auto const gw = Account{"gateway"};
             auto const alice = Account{"alice"};
             auto const USD = gw["USD"];
@@ -5227,24 +5253,10 @@ public:
                 env(offer(alice, XRP(50), USD(50)));
                 env.close();
 
-                if (withXahauV1)
-                {
-                    env(offer_cancel(alice),
-                        offer_id(offerId),
-                        ter(tesSUCCESS));
-                    env.close();
-                    auto const offerLE = env.le(keylet::unchecked(offerId));
-                    BEAST_EXPECT(!offerLE);
-                }
-                else
-                {
-                    env(offer_cancel(alice),
-                        offer_id(offerId),
-                        ter(temBAD_SEQUENCE));
-                    env.close();
-                    auto const offerLE = env.le(keylet::unchecked(offerId));
-                    BEAST_EXPECT(offerLE);
-                }
+                env(offer_cancel(alice), offer_id(offerId), ter(tesSUCCESS));
+                env.close();
+                auto const offerLE = env.le(keylet::unchecked(offerId));
+                BEAST_EXPECT(!offerLE);
             }
 
             // no offer id or offer sequence
@@ -5266,24 +5278,12 @@ public:
                 env(offer(alice, XRP(50), USD(50)));
                 env.close();
 
-                if (withXahauV1)
-                {
-                    env(offer_cancel(alice, offerSeqId),
-                        offer_id(offerId),
-                        ter(temBAD_SEQUENCE));
-                    env.close();
-                    auto const offerLE = env.le(keylet::unchecked(offerId));
-                    BEAST_EXPECT(offerLE);
-                }
-                else
-                {
-                    env(offer_cancel(alice, offerSeqId),
-                        offer_id(offerId),
-                        ter(tesSUCCESS));
-                    env.close();
-                    auto const offerLE = env.le(keylet::unchecked(offerId));
-                    BEAST_EXPECT(!offerLE);
-                }
+                env(offer_cancel(alice, offerSeqId),
+                    offer_id(offerId),
+                    ter(temBAD_SEQUENCE));
+                env.close();
+                auto const offerLE = env.le(keylet::unchecked(offerId));
+                BEAST_EXPECT(offerLE);
             }
 
             // both offer id and offer sequence 0
@@ -5511,6 +5511,71 @@ public:
             env.balance(taker, XRP) == takerXRPBalance);
     }
 
+    void
+    testFixCancelOfferExploit(FeatureBitset features)
+    {
+        testcase("fixCancelOfferExploit");
+        using namespace jtx;
+        Account const alice("alice");
+        Account const bob("bob");
+        Account const charlie("charlie");
+        auto const USD = alice["USD"];
+        auto const bobUSD = bob["USD"];
+
+        Env env(*this, features);
+
+        env.fund(XRP(1000), alice, bob);
+        env.close();
+
+        // OfferCancel: not ltOffer, exist account(alice)
+        uint256 const nonOfferId{keylet::account(alice.id()).key};
+        env(offer_cancel(bob), offer_id(nonOfferId), ter(tecNO_PERMISSION));
+        BEAST_EXPECT(env.le(keylet::unchecked(nonOfferId)));
+
+        // OfferCreate: not ltOffer
+        env(offer(bob, XRP(100), bobUSD(100)),
+            offer_id(nonOfferId),
+            ter(tecNO_PERMISSION));
+        BEAST_EXPECT(env.le(keylet::unchecked(nonOfferId)));
+
+        // OfferCancel: not ltOffer, not exist account(charlie)
+        uint256 const nonExistId{keylet::account(charlie.id()).key};
+        env(offer_cancel(bob), offer_id(nonExistId), ter(tesSUCCESS));
+        BEAST_EXPECT(!env.le(keylet::unchecked(nonExistId)));
+
+        // OfferCreate: not ltOffer, not exist account(charlie)
+        env(offer(bob, XRP(100), bobUSD(100)),
+            offer_id(nonExistId),
+            ter(tesSUCCESS));
+        BEAST_EXPECT(!env.le(keylet::unchecked(nonExistId)));
+
+        // create alice offer
+        uint256 const aliceOfferId{getOfferIndex(alice, env.seq(alice))};
+        env(offer(alice, XRP(100), USD(100)));
+        env.close();
+
+        // OfferCancel: bob cannot cancel alice's offer
+        env(offer_cancel(bob), offer_id(aliceOfferId), ter(tecNO_PERMISSION));
+        BEAST_EXPECT(env.le(keylet::unchecked(aliceOfferId)));
+
+        // OfferCreates: bob cannot cancel alice's offer
+        env(offer(bob, XRP(100), bobUSD(100)),
+            offer_id(aliceOfferId),
+            ter(tecNO_PERMISSION));
+        BEAST_EXPECT(env.le(keylet::unchecked(aliceOfferId)));
+
+        // An expired OfferCreate still cannot cancel another account's Offer.
+        uint256 const expiredBobOfferId{getOfferIndex(bob, env.seq(bob))};
+        env(offer(bob, XRP(100), bobUSD(100)),
+            offer_id(aliceOfferId),
+            json(sfExpiration.fieldName, lastClose(env)),
+            ter(tecNO_PERMISSION));
+        BEAST_EXPECT(env.le(keylet::unchecked(aliceOfferId)));
+        BEAST_EXPECT(!env.le(keylet::unchecked(expiredBobOfferId)));
+
+        env(offer_cancel(alice), offer_id(aliceOfferId), ter(tesSUCCESS));
+    }
+
     void
     testAll(FeatureBitset features)
     {
@@ -5574,6 +5639,7 @@ public:
         testRmSmallIncreasedQOffersIOU(features);
         testOfferID(features);
         testFillOrKill(features);
+        testFixCancelOfferExploit(features);
     }
 
     void

src/test/app/SHAMapStore_test.cpp

@@ -26,11 +26,17 @@
 #include <xrpld/app/misc/detail/OnlineDeleteRanges.h>
 #include <xrpld/app/rdb/backend/SQLiteDatabase.h>
 #include <xrpld/core/ConfigSections.h>
+#include <xrpld/nodestore/NodeObject.h>
 #include <xrpld/nodestore/detail/DatabaseRotatingImp.h>
 #include <xrpl/beast/utility/temp_dir.h>
+#include <xrpl/protocol/digest.h>
 #include <xrpl/protocol/jss.h>
 #include <boost/filesystem.hpp>
 
+#include <exception>
+#include <limits>
+#include <string>
+
 namespace ripple {
 namespace test {
 
@@ -47,6 +53,19 @@ class SHAMapStore_test : public beast::unit_test::suite
         return cfg;
     }
 
+    // Same as onlineDelete, but on a node store that persists nodes, so
+    // SHAMapStoreImp builds DatabaseRotatingImp and really rotates.
+    // envconfig defaults to type=rwdb, which is the null node store.
+    static auto
+    onlineDeleteStoring(std::unique_ptr<Config> cfg, std::string const& path)
+    {
+        cfg = onlineDelete(std::move(cfg));
+        auto& section = cfg->section(ConfigSection::nodeDatabase());
+        section.set("type", "memory");
+        section.set("path", path);
+        return cfg;
+    }
+
     static auto
     advisoryDelete(std::unique_ptr<Config> cfg)
     {
@@ -308,13 +327,23 @@ public:
     }
 
     void
-    testAutomatic()
+    testAutomatic(bool storing)
     {
-        testcase("automatic online_delete");
+        testcase(
+            storing ? "automatic online_delete (rotating node store)"
+                    : "automatic online_delete (null node store)");
         using namespace jtx;
         using namespace std::chrono_literals;
 
-        Env env(*this, envconfig(onlineDelete));
+        beast::temp_dir nodeDir;
+        Env env(
+            *this,
+            storing ? envconfig(onlineDeleteStoring, nodeDir.path())
+                    : envconfig(onlineDelete));
+        BEAST_EXPECT(
+            storing ==
+            (dynamic_cast<NodeStore::DatabaseRotating*>(
+                 &env.app().getNodeStore()) != nullptr));
         auto& store = env.app().getSHAMapStore();
 
         auto ledgerSeq = waitForReady(env);
@@ -572,6 +601,412 @@ public:
         return backend;
     }
 
+    std::unique_ptr<NodeStore::Backend>
+    makeMemoryBackend(
+        jtx::Env& env,
+        NodeStoreScheduler& scheduler,
+        std::string const& name)
+    {
+        Section section;
+        section.set("type", "memory");
+        section.set("path", name);
+        auto backend = NodeStore::Manager::instance().make_Backend(
+            section,
+            megabytes(env.app().config().getValueFor(
+                SizedItem::burstSize, std::nullopt)),
+            scheduler,
+            env.app().logs().journal("NodeStoreTest"));
+        backend->open();
+        return backend;
+    }
+
+    // Ordinary fetch (duplicate == false) must copy an archived object
+    // into the writable backend. The following rotation deletes the
+    // archive. Without that copy, a transaction node read between
+    // rotations disappears while callers can still name it.
+    void
+    testArchiveReadSurvivesRotation()
+    {
+        testcase("archive read survives rotation");
+
+        using namespace jtx;
+        Env env(*this, envconfig(onlineDelete));
+        NodeStoreScheduler scheduler(env.app().getJobQueue());
+
+        Section nscfg;
+        nscfg.set("type", "memory");
+        nscfg.set("path", "rotating");
+
+        auto dbr = std::make_unique<NodeStore::DatabaseRotatingImp>(
+            env.app(),
+            scheduler,
+            1,
+            makeMemoryBackend(env, scheduler, "writable"),
+            makeMemoryBackend(env, scheduler, "archive"),
+            nscfg,
+            env.app().logs().journal("NodeStoreTest"));
+
+        Blob const expected(32, 0xab);
+        auto const hash = sha512Half(makeSlice(expected));
+        {
+            Blob data = expected;
+            dbr->store(hotTRANSACTION_NODE, std::move(data), hash, 1);
+        }
+
+        auto const matches = [&](std::shared_ptr<NodeObject> const& object) {
+            return object && object->getType() == hotTRANSACTION_NODE &&
+                object->getData() == expected;
+        };
+
+        // Public fetch defaults duplicate to false. The private override
+        // is the rotation copy pass.
+        NodeStore::Database& db = *dbr;
+        BEAST_EXPECT(matches(db.fetchNodeObject(hash)));
+
+        auto const nop = [](std::string const&, std::string const&) {};
+        // Writable becomes the archive. The object now lives only there.
+        dbr->rotate(makeMemoryBackend(env, scheduler, "writable-2"), nop);
+
+        BEAST_EXPECT(matches(db.fetchNodeObject(hash)));
+
+        dbr->rotate(makeMemoryBackend(env, scheduler, "writable-3"), nop);
+        BEAST_EXPECT(matches(db.fetchNodeObject(hash)));
+    }
+
+    // getWriteLoad, sync, storeLedger, importDatabase and for_each changed
+    // lock type. In null mode no Env builds a DatabaseRotatingImp, so
+    // drive them directly.
+    void
+    testRotatingAccessors()
+    {
+        testcase("rotating database accessors");
+
+        using namespace jtx;
+        // Source ledger must come from a node store that holds its nodes.
+        Env env(*this, envconfig([](std::unique_ptr<Config> cfg) {
+            auto& section = cfg->section(ConfigSection::nodeDatabase());
+            section.set("type", "memory");
+            section.set("path", "rotating-accessors-app");
+            return cfg;
+        }));
+        env.fund(XRP(10000), Account{"alice"});
+        env.close();
+
+        NodeStoreScheduler scheduler(env.app().getJobQueue());
+        Section nscfg;
+        nscfg.set("type", "memory");
+        nscfg.set("path", "rotating-accessors");
+        auto makeDb = [&](std::string const& prefix) {
+            return std::make_unique<NodeStore::DatabaseRotatingImp>(
+                env.app(),
+                scheduler,
+                1,
+                makeMemoryBackend(env, scheduler, prefix + "-writable"),
+                makeMemoryBackend(env, scheduler, prefix + "-archive"),
+                nscfg,
+                env.app().logs().journal("NodeStoreTest"));
+        };
+
+        auto src = makeDb("rotating-accessors-src");
+        BEAST_EXPECT(src->getName() == "rotating-accessors-src-writable");
+        BEAST_EXPECT(src->getWriteLoad() >= 0);
+        src->sync();
+
+        auto const ledger = env.app().getLedgerMaster().getClosedLedger();
+        if (!BEAST_EXPECT(ledger))
+            return;
+        BEAST_EXPECT(src->storeLedger(ledger));
+
+        NodeStore::Database& srcDb = *src;
+        auto const stateRoot = ledger->stateMap().getHash().as_uint256();
+        BEAST_EXPECT(srcDb.fetchNodeObject(ledger->info().hash));
+        BEAST_EXPECT(srcDb.fetchNodeObject(stateRoot));
+
+        // importDatabase walks the source with for_each.
+        auto dst = makeDb("rotating-accessors-dst");
+        dst->importDatabase(*src);
+        NodeStore::Database& dstDb = *dst;
+        BEAST_EXPECT(dstDb.fetchNodeObject(ledger->info().hash));
+        BEAST_EXPECT(dstDb.fetchNodeObject(stateRoot));
+    }
+
+    static auto
+    nullBackend(std::unique_ptr<Config> cfg)
+    {
+        cfg->LEDGER_HISTORY = 8;
+        auto& section = cfg->section(ConfigSection::nodeDatabase());
+        section.set("type", "rwdb");
+        section.set("path", "main");
+        return cfg;
+    }
+
+    static auto
+    nullBackendFullHistory(std::unique_ptr<Config> cfg)
+    {
+        cfg = nullBackend(std::move(cfg));
+        cfg->LEDGER_HISTORY = std::numeric_limits<std::uint32_t>::max();
+        return cfg;
+    }
+
+    static auto
+    nullBackendDeleteOff(std::unique_ptr<Config> cfg)
+    {
+        cfg = nullBackend(std::move(cfg));
+        cfg->LEDGER_HISTORY = 256;
+        cfg->section(ConfigSection::nodeDatabase()).set("online_delete", "0");
+        return cfg;
+    }
+
+    // Payments keep applying after more closes than ledger_history,
+    // with no node-store record of the state tree. Close time comes
+    // from the resident ledger, not a node-store header walk.
+    void
+    testNullModeLedgerProgression()
+    {
+        testcase("null mode ledger progression");
+
+        using namespace jtx;
+        Env env(*this, envconfig(nullBackend));
+
+        Account const alice{"alice"};
+        Account const bob{"bob"};
+        env.fund(XRP(10000), alice, bob);
+        env.close();
+
+        auto const bobBefore = env.balance(bob);
+        constexpr int payments = 12;
+        for (int i = 0; i < payments; ++i)
+        {
+            env(pay(alice, bob, XRP(1)));
+            env.close();
+        }
+
+        BEAST_EXPECT(env.balance(bob) == bobBefore + XRP(payments));
+        BEAST_EXPECT(env.seq(alice) > 1);
+
+        auto const info = env.rpc(
+            "json",
+            "account_info",
+            std::string{"{\"account\": \""} + alice.human() + "\"}");
+        BEAST_EXPECT(
+            info[jss::result].isMember(jss::account_data) &&
+            info[jss::result][jss::account_data][jss::Account] ==
+                alice.human());
+
+        auto const ledger = env.app().getLedgerMaster().getClosedLedger();
+        if (!BEAST_EXPECT(ledger))
+            return;
+        BEAST_EXPECT(ledger->read(keylet::account(alice.id())));
+
+        auto const closeTime = env.app().getLedgerMaster().getCloseTimeByHash(
+            ledger->info().hash, ledger->info().seq);
+        BEAST_EXPECT(closeTime && *closeTime == ledger->info().closeTime);
+
+        auto const validated = env.rpc("ledger", "validated");
+        BEAST_EXPECT(goodLedger(
+            env, validated, std::to_string(ledger->info().seq), true));
+    }
+
+    // ledger_history=full would make the retained-ledger window grow
+    // without bound, since nothing else can drop a null-mode tree.
+    void
+    testNullModeRejectsFullHistory()
+    {
+        testcase("RWDB null mode rejects ledger_history=full");
+
+        using namespace jtx;
+        try
+        {
+            Env env(*this, envconfig(nullBackendFullHistory));
+            fail("Env should throw when ledger_history is full");
+        }
+        catch (std::exception const& e)
+        {
+            BEAST_EXPECT(
+                std::string(e.what()).find("ledger_history") !=
+                std::string::npos);
+        }
+    }
+
+    // online_delete=0 is an explicit disable. It must not be treated
+    // as a missing key and replaced with ledger_history.
+    void
+    testExplicitOnlineDeleteZero()
+    {
+        testcase("explicit online_delete zero stays off");
+
+        using namespace jtx;
+        Env env(*this, envconfig(nullBackendDeleteOff));
+
+        Account const alice{"alice"};
+        env.fund(XRP(10000), alice);
+        env.close();
+        auto const balance = env.balance(alice);
+        env.close();
+
+        BEAST_EXPECT(env.app().getSHAMapStore().getLastRotated() == 0);
+        BEAST_EXPECT(env.balance(alice) == balance);
+    }
+
+    void
+    testNullModeRequiresHistory()
+    {
+        testcase("RWDB null mode requires ledger_history > 0");
+
+        using namespace jtx;
+        try
+        {
+            Env env(*this, envconfig([](std::unique_ptr<Config> cfg) {
+                cfg->LEDGER_HISTORY = 0;
+                auto& section = cfg->section(ConfigSection::nodeDatabase());
+                section.set("type", "rwdb");
+                section.set("path", "main");
+                return cfg;
+            }));
+            fail("Env should throw when ledger_history is 0");
+        }
+        catch (std::exception const& e)
+        {
+            BEAST_EXPECT(
+                std::string(e.what()).find("ledger_history") !=
+                std::string::npos);
+        }
+    }
+
+    void
+    testRetainedLedgerCloseTime()
+    {
+        testcase("retained ledger close time survives later closes");
+
+        using namespace jtx;
+        Env env(*this, envconfig(nullBackend));
+
+        Account const alice{"alice"};
+        env.fund(XRP(10000), alice);
+        env.close();
+
+        auto const first = env.app().getLedgerMaster().getClosedLedger();
+        if (!BEAST_EXPECT(first))
+            return;
+        auto const firstHash = first->info().hash;
+        auto const firstSeq = first->info().seq;
+        auto const firstClose = first->info().closeTime;
+
+        for (int i = 0; i < 12; ++i)
+        {
+            env(pay(alice, env.master, XRP(1)));
+            env.close();
+        }
+
+        auto const closeTime =
+            env.app().getLedgerMaster().getCloseTimeByHash(firstHash, firstSeq);
+        BEAST_EXPECT(closeTime && *closeTime == firstClose);
+        BEAST_EXPECT(env.balance(alice) < XRP(10000));
+    }
+
+    void
+    testNullBackendIsPerConfig()
+    {
+        testcase("null backend flag is per configuration");
+
+        Config rwdbCfg;
+        Config upperCfg;
+        Config nudbCfg;
+        Config emptyCfg;
+        rwdbCfg.section(ConfigSection::nodeDatabase()).set("type", "rwdb");
+        upperCfg.section(ConfigSection::nodeDatabase()).set("type", "RWDB");
+        nudbCfg.section(ConfigSection::nodeDatabase()).set("type", "NuDB");
+
+        // Evaluated per Config object, not latched process-wide.
+        BEAST_EXPECT(rwdbCfg.nullBackend());
+        BEAST_EXPECT(upperCfg.nullBackend());
+        BEAST_EXPECT(!nudbCfg.nullBackend());
+        BEAST_EXPECT(!emptyCfg.nullBackend());
+        BEAST_EXPECT(rwdbCfg.nullBackend());
+    }
+
+    // Resident lookups are used with peer-supplied values. They must find
+    // in-memory ledgers but never load or edit the complete-ledger set.
+    void
+    testResidentLedgerLookup()
+    {
+        testcase("resident ledger lookup does not load or clear");
+
+        using namespace jtx;
+        Env env(*this, envconfig(nullBackend));
+
+        Account const alice{"alice"};
+        env.fund(XRP(10000), alice);
+        env.close();
+        for (int i = 0; i < 4; ++i)
+            env.close();
+
+        auto& lm = env.app().getLedgerMaster();
+        auto const closed = lm.getClosedLedger();
+        if (!BEAST_EXPECT(closed))
+            return;
+
+        auto const complete = lm.getCompleteLedgers();
+
+        auto const bySeq = lm.getResidentLedgerBySeq(closed->info().seq);
+        BEAST_EXPECT(bySeq && bySeq->info().hash == closed->info().hash);
+
+        auto const byHash = lm.getResidentLedgerByHash(closed->info().hash);
+        BEAST_EXPECT(byHash && byHash->info().seq == closed->info().seq);
+
+        // A recent ledger still inside the retained window.
+        auto const prior = lm.getResidentLedgerBySeq(closed->info().seq - 2);
+        BEAST_EXPECT(prior && prior->info().seq == closed->info().seq - 2);
+
+        BEAST_EXPECT(!lm.getResidentLedgerByHash(uint256{12345}));
+        BEAST_EXPECT(!lm.getResidentLedgerBySeq(closed->info().seq + 1000));
+
+        BEAST_EXPECT(lm.getCompleteLedgers() == complete);
+
+        // Drop every ledger from the history cache. Null mode must still
+        // reach recent ledgers through the closed/validated holders and
+        // the retained window, without loading anything.
+        env.app().getJobQueue().rendezvous();
+        auto const older = lm.getResidentLedgerBySeq(closed->info().seq - 3);
+        if (!BEAST_EXPECT(older))
+            return;
+        lm.clearLedgerCachePrior(closed->info().seq + 1);
+
+        auto const closedAgain = lm.getResidentLedgerBySeq(closed->info().seq);
+        BEAST_EXPECT(
+            closedAgain && closedAgain->info().hash == closed->info().hash);
+        auto const closedByHash =
+            lm.getResidentLedgerByHash(closed->info().hash);
+        BEAST_EXPECT(
+            closedByHash && closedByHash->info().seq == closed->info().seq);
+
+        auto const retainedBySeq = lm.getResidentLedgerBySeq(older->info().seq);
+        BEAST_EXPECT(
+            retainedBySeq && retainedBySeq->info().hash == older->info().hash);
+        auto const retainedByHash =
+            lm.getResidentLedgerByHash(older->info().hash);
+        BEAST_EXPECT(
+            retainedByHash && retainedByHash->info().seq == older->info().seq);
+
+        BEAST_EXPECT(!lm.getResidentLedgerByHash(uint256{12345}));
+        BEAST_EXPECT(lm.getCompleteLedgers() == complete);
+    }
+
+    void
+    testNullFactoryDropsWrites()
+    {
+        testcase("type=rwdb uses NullFactory and drops node-store writes");
+
+        using namespace jtx;
+        Env env(*this, envconfig(nullBackend));
+
+        auto& db = env.app().getNodeStore();
+        uint256 const hash{2};
+        Blob data(32, 7);
+        db.store(hotACCOUNT_NODE, std::move(data), hash, 1);
+        BEAST_EXPECT(!db.fetchNodeObject(hash, 1));
+    }
+
     void
     testRotate()
     {
@@ -852,8 +1287,19 @@ public:
     {
         testComputeOnlineDeleteTargets();
         testClear();
-        testAutomatic();
+        testAutomatic(false);
+        testAutomatic(true);
+        testRotatingAccessors();
         testCanDelete();
+        testArchiveReadSurvivesRotation();
+        testNullModeLedgerProgression();
+        testNullModeRejectsFullHistory();
+        testExplicitOnlineDeleteZero();
+        testNullModeRequiresHistory();
+        testRetainedLedgerCloseTime();
+        testNullBackendIsPerConfig();
+        testResidentLedgerLookup();
+        testNullFactoryDropsWrites();
         testRotate();
         testPinnedRangeRestoreRequiresPinnedData();
     }

src/test/app/SetHookTSH_test.cpp

@@ -30,7 +30,10 @@
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/hook/Enum.h>
 #include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/PayChan.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/Sign.h>
 #include <xrpl/protocol/jss.h>
 #include <vector>
 
@@ -737,15 +740,7 @@ private:
     {
         auto const executions = meta[sfHookExecutions.jsonName];
         auto const execution = executions[0u][sfHookExecution.jsonName];
-        bool const fixV2 = env.current()->rules().enabled(fixXahauV2);
-        if (fixV2)
-        {
-            BEAST_EXPECT(execution[sfFlags.jsonName] == expected);
-        }
-        else
-        {
-            BEAST_REQUIRE(!execution[sfFlags.jsonName]);
-        }
+        BEAST_EXPECT(execution[sfFlags.jsonName] == expected);
     }
 
     void
@@ -1967,7 +1962,8 @@ private:
     // |   A   |  A  |    S   |     S      |     S    |    S   |     S
     // |   A   |  D  |    N   |     N      |     S    |    S   |     S
     // |   D   |  D  |    S   |     S      |    N/A   |    S   |     S
-    // |   D   |  A  |    S   |     S      |    N/A   |    S   |     S
+    // |   D   |  A  |    W*  |     W*     |    N/A   |    S   |     S
+    // * S without featureEscrowDestinationCancel
 
     static uint256
     getEscrowIndex(AccountID const& account, std::uint32_t uSequence)
@@ -2122,7 +2118,7 @@ private:
 
         // otxn: dest
         // tsh account
-        // w/s: strong
+        // w/s: weak (strong without featureEscrowDestinationCancel)
         for (bool const testStrong : {true, false})
         {
             test::jtx::Env env{
@@ -2130,6 +2126,11 @@ private:
                 network::makeNetworkConfig(21337, "10", "1000000", "200000"),
                 features};
 
+            bool const withIOUIssuerWeakTSH =
+                env.current()->rules().enabled(featureIOUIssuerWeakTSH);
+            bool const withDestCancel =
+                env.current()->rules().enabled(featureEscrowDestinationCancel);
+
             auto const account = Account("alice");
             auto const dest = Account("bob");
             env.fund(XRP(1000), account, dest);
@@ -2159,7 +2160,10 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            testTSHStrongWeak(env, tshSTRONG, __LINE__);
+            auto const expected = !withDestCancel     ? tshSTRONG
+                : !testStrong && withIOUIssuerWeakTSH ? tshWEAK
+                                                      : tshNONE;
+            testTSHStrongWeak(env, expected, __LINE__);
         }
 
         // otxn: account
@@ -2266,16 +2270,10 @@ private:
             setTSHHook(env, account, testStrong);
 
             // cancel escrow
-            Json::Value tx;
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                tx = cancel(account, account, 0);
-            }
-            else
-            {
-                tx = cancel(account, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(cancel(account, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -2320,16 +2318,10 @@ private:
             setTSHHook(env, dest, testStrong);
 
             // cancel escrow
-            Json::Value tx;
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                tx = cancel(account, account, 0);
-            }
-            else
-            {
-                tx = cancel(account, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(cancel(account, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -2378,16 +2370,10 @@ private:
             setTSHHook(env, dest, testStrong);
 
             // cancel escrow
-            Json::Value tx;
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                tx = cancel(dest, account, 0);
-            }
-            else
-            {
-                tx = cancel(dest, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(cancel(dest, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -2396,7 +2382,7 @@ private:
 
         // otxn: dest
         // tsh account
-        // w/s: strong
+        // w/s: weak (strong without featureEscrowDestinationCancel)
         for (bool const testStrong : {true, false})
         {
             test::jtx::Env env{
@@ -2404,6 +2390,11 @@ private:
                 network::makeNetworkConfig(21337, "10", "1000000", "200000"),
                 features};
 
+            bool const withIOUIssuerWeakTSH =
+                env.current()->rules().enabled(featureIOUIssuerWeakTSH);
+            bool const withDestCancel =
+                env.current()->rules().enabled(featureEscrowDestinationCancel);
+
             auto const account = Account("alice");
             auto const dest = Account("bob");
             env.fund(XRP(1000), account, dest);
@@ -2429,23 +2420,16 @@ private:
             setTSHHook(env, account, testStrong);
 
             // cancel escrow
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
-            Json::Value tx;
-            if (!fixV1)
-            {
-                tx = cancel(dest, account, 0);
-            }
-            else
-            {
-                tx = cancel(dest, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(cancel(dest, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
-            auto const expected =
-                (fixV1 ? (testStrong ? tshSTRONG : tshSTRONG)
-                       : (testStrong ? tshNONE : tshNONE));
+            auto const expected = !withDestCancel     ? tshSTRONG
+                : !testStrong && withIOUIssuerWeakTSH ? tshWEAK
+                                                      : tshNONE;
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -2494,16 +2478,10 @@ private:
             setTSHHook(env, gw, testStrong);
 
             // cancel escrow
-            Json::Value tx;
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                tx = cancel(account, account, 0);
-            }
-            else
-            {
-                tx = cancel(account, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(cancel(account, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -2919,16 +2897,10 @@ private:
             setTSHHook(env, account, testStrong);
 
             // finish escrow
-            Json::Value tx;
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                tx = finish(account, account, 0);
-            }
-            else
-            {
-                tx = finish(account, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(finish(account, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -2967,23 +2939,14 @@ private:
             setTSHHook(env, dest, testStrong);
 
             // finish escrow
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
-            Json::Value tx;
-            if (!fixV1)
-            {
-                tx = finish(account, account, 0);
-            }
-            else
-            {
-                tx = finish(account, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(finish(account, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
-            auto const expected =
-                (fixV1 ? (testStrong ? tshSTRONG : tshSTRONG)
-                       : (testStrong ? tshNONE : tshNONE));
+            auto const expected = testStrong ? tshSTRONG : tshSTRONG;
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -3019,16 +2982,10 @@ private:
             setTSHHook(env, dest, testStrong);
 
             // finish escrow
-            Json::Value tx;
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                tx = finish(dest, account, 0);
-            }
-            else
-            {
-                tx = finish(dest, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(finish(dest, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -3067,23 +3024,14 @@ private:
             setTSHHook(env, account, testStrong);
 
             // finish escrow
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
-            Json::Value tx;
-            if (!fixV1)
-            {
-                tx = finish(dest, account, 0);
-            }
-            else
-            {
-                tx = finish(dest, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(finish(dest, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
-            auto const expected =
-                (fixV1 ? (testStrong ? tshSTRONG : tshSTRONG)
-                       : (testStrong ? tshNONE : tshNONE));
+            auto const expected = testStrong ? tshSTRONG : tshSTRONG;
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -3129,17 +3077,10 @@ private:
             setTSHHook(env, gw, testStrong);
 
             // finish escrow
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
-            Json::Value tx;
-            if (!fixV1)
-            {
-                tx = finish(dest, account, 0);
-            }
-            else
-            {
-                tx = finish(dest, account);
-            }
-            env(tx, escrow_id(escrowId), fee(XRP(1)), ter(tesSUCCESS));
+            env(finish(dest, account),
+                escrow_id(escrowId),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
             env.close();
 
             // verify tsh hook triggered
@@ -3445,10 +3386,7 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            bool const fixV2 = env.current()->rules().enabled(fixXahauV2);
-            auto const expected =
-                (fixV2 ? (testStrong ? tshNONE : tshWEAK)
-                       : (testStrong ? tshSTRONG : tshSTRONG));
+            auto const expected = testStrong ? tshNONE : tshWEAK;
             testTSHStrongWeak(env, expected, __LINE__);
         }
     }
@@ -4499,9 +4437,11 @@ private:
                 env,
                 issuer,
                 0,
-                mintFlags | (strongIssuerTSH ? tfStrongTSH : 0));
+                mintFlags | (strongIssuerTSH ? std::uint32_t(tfStrongTSH) : 0));
             env(token::mint(issuer),
-                txflags(mintFlags | (strongIssuerTSH ? tfStrongTSH : 0)));
+                txflags(
+                    mintFlags |
+                    (strongIssuerTSH ? std::uint32_t(tfStrongTSH) : 0)));
             env.close();
 
             auto const offerIndex =
@@ -6307,10 +6247,7 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            bool const fixV2 = env.current()->rules().enabled(fixXahauV2);
-            auto const expected =
-                (fixV2 ? (testStrong ? tshSTRONG : tshSTRONG)
-                       : (testStrong ? tshNONE : tshNONE));
+            auto const expected = testStrong ? tshSTRONG : tshSTRONG;
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -6391,10 +6328,7 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            bool const fixV2 = env.current()->rules().enabled(fixXahauV2);
-            auto const expected =
-                (fixV2 ? (testStrong ? tshSTRONG : tshSTRONG)
-                       : (testStrong ? tshNONE : tshNONE));
+            auto const expected = testStrong ? tshSTRONG : tshSTRONG;
             testTSHStrongWeak(env, expected, __LINE__);
         }
     }
@@ -6500,15 +6434,12 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
             bool const withIOUIssuerWeakTSH =
                 env.current()->rules().enabled(featureIOUIssuerWeakTSH);
 
-            auto const expected =
-                (fixV1
-                     ? (testStrong ? tshNONE
-                                   : (withIOUIssuerWeakTSH ? tshWEAK : tshNONE))
-                     : (testStrong ? tshSTRONG : tshSTRONG));
+            auto const expected = testStrong
+                ? tshNONE
+                : (withIOUIssuerWeakTSH ? tshWEAK : tshNONE);
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -6607,14 +6538,11 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
             bool const withIOUIssuerWeakTSH =
                 env.current()->rules().enabled(featureIOUIssuerWeakTSH);
-            auto const expected =
-                (fixV1
-                     ? (testStrong ? tshNONE
-                                   : (withIOUIssuerWeakTSH ? tshWEAK : tshNONE))
-                     : (testStrong ? tshSTRONG : tshSTRONG));
+            auto const expected = testStrong
+                ? tshNONE
+                : (withIOUIssuerWeakTSH ? tshWEAK : tshNONE);
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -6664,15 +6592,12 @@ private:
             env.close();
 
             // verify tsh hook triggered
-            bool const fixV1 = env.current()->rules().enabled(fixXahauV1);
             bool const withIOUIssuerWeakTSH =
                 env.current()->rules().enabled(featureIOUIssuerWeakTSH);
 
-            auto const expected =
-                (fixV1
-                     ? (testStrong ? tshNONE
-                                   : (withIOUIssuerWeakTSH ? tshWEAK : tshNONE))
-                     : (testStrong ? tshSTRONG : tshSTRONG));
+            auto const expected = testStrong
+                ? tshNONE
+                : (withIOUIssuerWeakTSH ? tshWEAK : tshNONE);
             testTSHStrongWeak(env, expected, __LINE__);
         }
 
@@ -7732,7 +7657,6 @@ private:
         env.close();
 
         auto const preDest = env.balance(dest);
-        bool const withFix = env.current()->rules().enabled(fixXahauV2);
 
         env.app().openLedger().modify([&](OpenView& view, beast::Journal j) {
             auto const tx =
@@ -7740,24 +7664,15 @@ private:
             auto result =
                 ripple::apply(env.app(), view, *tx, tapNONE, env.journal);
 
-            bool const applyResult = withFix ? false : true;
-            if (withFix)
-            {
-                BEAST_EXPECT(result.ter == tefNONDIR_EMIT);
-            }
-            else
-            {
-                BEAST_EXPECT(result.ter == tesSUCCESS);
-            }
-            BEAST_EXPECT(result.applied == applyResult);
+            BEAST_EXPECT(result.ter == tefNONDIR_EMIT);
+            BEAST_EXPECT(!result.applied);
             return result.applied;
         });
 
         env.close();
 
         auto const postDest = env.balance(dest);
-        auto const postValue = withFix ? XRP(0) : XRP(1);
-        BEAST_EXPECT(postDest == preDest + postValue);
+        BEAST_EXPECT(postDest == preDest);
 
         for (size_t i = 0; i < 4; i++)
         {
@@ -7768,8 +7683,7 @@ private:
         }
 
         auto const postDest1 = env.balance(dest);
-        auto const postValue1 = withFix ? XRP(0) : XRP(2);
-        BEAST_EXPECT(postDest1 == postDest + postValue1);
+        BEAST_EXPECT(postDest1 == postDest);
     }
 
     void
@@ -8383,16 +8297,16 @@ private:
 
         // validate the emitted txn ids
         std::vector<std::string> const txIds = {
-            "9610F73CDD6590EB6B3C82E5EC55D4B4C80CD7128B98AA556F7EC9DD96AE7056",
-            "2F4582A29272390C0C25A80D4A3BCE5A14ACE6D86D8D0CB2C57719EB6FA881AE",
-            "89A301CFEF0DD781AB9032A6A2DCE0937BC0119D2CDD06033B8B2FD80968E519",
-            "DD8721B59024E168480B4DF8F8E93778601F0BD2E77FC991F3DA1182F5AD8B1E",
-            "5D735C2EE3CB8289F8E11621FDC9565F9D6D67F3AE59D65332EACE591D67945F",
-            "F02470E01731C968881AF4CBDEC90BB9E1F7AB0BE1CC22AF15451FB6D191096D",
-            "8AD65E541DECD49B1693F8C17DFD8A2B906F49C673C4FD2034FF772E2BE50C30",
-            "9F225229059CCC6257814D03C107884CF588C1C246A89ADFC16E50DF671B834C",
-            "13C2A54A14BADF3648CED05175E1CCAD713F7E5EA56D9735CF8813CD5551F281",
-            "87C60F41A96554587CED289F83F52DEE3CF670EEB189B067E6066B9A06056ADF",
+            "2FBEF981BAC322225D13C274D0118FECC1B93A89EDBC0AB3CBD8B30A1591024E",
+            "3C0A12F6A322486ABDA4180DC2B424BD252FD2FA6A33553B0B5D1526C020C475",
+            "AFFD55D757136FC0BE665F16E0D8CFBDC0D37CF85B5D3329BE1DBD3A44BB281C",
+            "BBE43C01068CE511DBF24F84A928E481451FF448AF2493E1A9BE099628D1F523",
+            "45970753F7B52448C23D66E5E19DBBC65F5BE6055C04AC3BA9896D7D67891DB1",
+            "97F4E09B2AEF4D798D378B1390B0624A68F304247B358334167E93217D502A16",
+            "770D3B786C8E3BEF560D9589B02557B0BDFC1C7FD15C6CF42E86068A6A411EFC",
+            "239DFA86EE8391418170D7FDF5AA8B8EEE0BBEF5E9F928BC29C23EEF6F1858AD",
+            "9FAA93AC6340C87B5C722FF0E8D4D3F39B9A0CA5E9799EC4CE316BFD5E379540",
+            "8672B2D8AA5E9EF86929B8662FE436541B2F739052732020B874BC304601C4DB",
         };
         Json::Value params;
         params[jss::transaction] =
@@ -8445,6 +8359,150 @@ private:
         }
     }
 
+    // Builds a manifest signed by `master`, nominating `ephemeral` as the
+    // signing key. A sequence of UINT32_MAX makes it a revocation, which by
+    // definition carries no signing key.
+    static std::string
+    makeManifestString(
+        jtx::Account const& master,
+        jtx::Account const& ephemeral,
+        std::uint32_t seq)
+    {
+        STObject st(sfGeneric);
+        st[sfSequence] = seq;
+        st[sfPublicKey] = master.pk();
+
+        if (seq != std::numeric_limits<std::uint32_t>::max())
+        {
+            st[sfSigningPubKey] = ephemeral.pk();
+            sign(
+                st,
+                HashPrefix::manifest,
+                *publicKeyType(ephemeral.pk()),
+                ephemeral.sk());
+        }
+
+        sign(
+            st,
+            HashPrefix::manifest,
+            *publicKeyType(master.pk()),
+            master.sk(),
+            sfMasterSignature);
+
+        Serializer s;
+        st.add(s);
+        return std::string(static_cast<char const*>(s.data()), s.size());
+    }
+
+    // A manifest transaction carries no account signature, so it cannot be
+    // submitted through env() the way a signed transaction can. Returns the
+    // resulting transaction id so the caller can inspect its metadata.
+    uint256
+    submitManifest(jtx::Env& env, std::string const& manifest)
+    {
+        Json::Value params;
+        params[jss::manifest] = strHex(manifest);
+        auto const jrr = env.rpc("json", "submit", to_string(params));
+
+        auto const& result = jrr[jss::result];
+
+        if (!BEAST_EXPECT(
+                result[jss::engine_result].asString() == "tesSUCCESS"))
+        {
+            log << "submitManifest: " << to_string(jrr) << std::endl;
+            return beast::zero;
+        }
+
+        // An error response carries no tx_json, and strUnHex("") yields an
+        // engaged but empty Blob, so fromVoid() would memcpy from nullptr.
+        auto const blob = strUnHex(result[jss::tx_json][jss::hash].asString());
+        auto const hash =
+            blob ? uint256::fromVoidChecked(*blob) : std::optional<uint256>{};
+
+        if (!BEAST_EXPECT(hash.has_value()))
+        {
+            log << "submitManifest: " << to_string(jrr) << std::endl;
+            return beast::zero;
+        }
+
+        return *hash;
+    }
+
+    // SetManifest
+    // | otxn | tsh | manifest |
+    // |   M  |  M  |   N/A    |
+    // |   M  |  E  |    W     |  ephemeral key's logical account
+    void
+    testSetManifestTSH(FeatureBitset features)
+    {
+        using namespace test::jtx;
+        using namespace std::literals;
+        testcase("set manifest TSH");
+
+        // OnChainManifests is not yet Supported::yes, so enable it explicitly.
+        features = features | featureOnChainManifests;
+
+        // otxn: master
+        // tsh: ephemeral
+        // w/s: weak
+        //
+        // The ephemeral account is only named by the manifest, so it may
+        // observe the transaction but not rollback it. It therefore fires only
+        // when it has asked to collect.
+        for (bool const testStrong : {true, false})
+        {
+            test::jtx::Env env{
+                *this,
+                network::makeNetworkConfig(21337, "10", "1000000", "200000"),
+                features};
+
+            auto const master = Account("master", KeyType::ed25519);
+            auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+            env.fund(XRP(1000), master, ephemeral);
+            env.close();
+
+            if (!testStrong)
+                addWeakTSH(env, ephemeral);
+
+            setTSHHook(env, ephemeral, testStrong);
+
+            auto const txHash =
+                submitManifest(env, makeManifestString(master, ephemeral, 1));
+            env.close();
+
+            // A strong hook on a weak stake holder is never reached.
+            auto const expected = testStrong ? tshNONE : tshWEAK;
+            testTSHStrongWeak(env, txHash, expected, __LINE__);
+        }
+
+        // A revocation names no signing key, so there is no ephemeral stake
+        // holder to notify at all.
+        {
+            test::jtx::Env env{
+                *this,
+                network::makeNetworkConfig(21337, "10", "1000000", "200000"),
+                features};
+
+            auto const master = Account("master", KeyType::ed25519);
+            auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+            env.fund(XRP(1000), master, ephemeral);
+            env.close();
+
+            addWeakTSH(env, ephemeral);
+            setTSHHook(env, ephemeral, false);
+
+            auto const txHash = submitManifest(
+                env,
+                makeManifestString(
+                    master,
+                    ephemeral,
+                    std::numeric_limits<std::uint32_t>::max()));
+            env.close();
+
+            testTSHStrongWeak(env, txHash, tshNONE, __LINE__);
+        }
+    }
+
     void
     testTSH(FeatureBitset features)
     {
@@ -8474,10 +8532,9 @@ public:
         using namespace test::jtx;
         static FeatureBitset const all{supported_amendments()};
 
-        static std::array<FeatureBitset, 4> const feats{
+        static std::array<FeatureBitset, 3> const feats{
             all,
-            all - fixXahauV1 - fixXahauV2 - featureIOUIssuerWeakTSH,
-            all - fixXahauV2 - featureIOUIssuerWeakTSH,
+            all - featureEscrowDestinationCancel,
             all - featureIOUIssuerWeakTSH,
         };
 
@@ -8508,13 +8565,11 @@ public:
     };
 
 SETHOOKTSH_TEST(1, false)
-SETHOOKTSH_TEST(2, false)
-SETHOOKTSH_TEST(3, true)
+SETHOOKTSH_TEST(2, true)
 
 BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH0, app, ripple, 2);
 BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH1, app, ripple, 2);
 BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH2, app, ripple, 2);
-BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH3, app, ripple, 2);
 
 }  // namespace test
 }  // namespace ripple

src/test/app/SetManifest_test.cpp

@@ -0,0 +1,975 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <test/jtx.h>
+#include <test/jtx/network.h>
+#include <xrpld/app/ledger/OpenLedger.h>
+#include <xrpld/app/misc/HashRouter.h>
+#include <xrpld/app/misc/Manifest.h>
+#include <xrpld/app/misc/NetworkOPs.h>
+#include <xrpld/app/tx/apply.h>
+#include <xrpld/app/tx/detail/SetManifest.h>
+#include <xrpld/core/Config.h>
+#include <xrpld/ledger/OpenView.h>
+#include <xrpl/basics/StringUtilities.h>
+#include <xrpl/basics/strHex.h>
+#include <xrpl/json/to_string.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/HashPrefix.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/Sign.h>
+#include <xrpl/protocol/XRPAmount.h>
+#include <xrpl/protocol/jss.h>
+#include <xrpl/protocol/st.h>
+
+#include <functional>
+#include <limits>
+#include <utility>
+#include <vector>
+
+namespace ripple {
+namespace test {
+
+/** Tests the OnChainManifests amendment: the SetManifest transactor, the
+    submit RPC path that builds its transaction, and reading manifests back out
+    of the ledger into the manifest cache.
+*/
+struct SetManifest_test : public beast::unit_test::suite
+{
+    // A manifest transaction is unsigned, so the network id is mandatory and
+    // the network must be one that requires it (id > 1024).
+    static std::unique_ptr<Config>
+    makeConfig(std::string fee = "10")
+    {
+        return jtx::network::makeNetworkConfig(
+            21337, std::move(fee), "1000000", "200000");
+    }
+
+    /** Builds a manifest signed by `master` nominating `ephemeral`.
+
+        A sequence of UINT32_MAX makes it a revocation, which by definition
+        names no signing key and carries no ephemeral signature.
+    */
+    static std::string
+    makeManifest(
+        jtx::Account const& master,
+        jtx::Account const& ephemeral,
+        std::uint32_t seq)
+    {
+        STObject st(sfGeneric);
+        st[sfSequence] = seq;
+        st[sfPublicKey] = master.pk();
+
+        if (seq != std::numeric_limits<std::uint32_t>::max())
+        {
+            st[sfSigningPubKey] = ephemeral.pk();
+            sign(
+                st,
+                HashPrefix::manifest,
+                *publicKeyType(ephemeral.pk()),
+                ephemeral.sk());
+        }
+
+        sign(
+            st,
+            HashPrefix::manifest,
+            *publicKeyType(master.pk()),
+            master.sk(),
+            sfMasterSignature);
+
+        Serializer s;
+        st.add(s);
+        return std::string(static_cast<char const*>(s.data()), s.size());
+    }
+
+    /** Submits a manifest through the submit RPC.
+
+        The transaction is unsigned -- authority comes from the manifest's own
+        master and ephemeral signatures -- so it cannot be submitted through
+        env() the way a signed transaction can.
+    */
+    static Json::Value
+    submit(jtx::Env& env, std::string const& manifest)
+    {
+        Json::Value params;
+        params[jss::manifest] = strHex(manifest);
+        return env.rpc("json", "submit", to_string(params))[jss::result];
+    }
+
+    /** Submits an already formed SetManifest transaction. */
+    static Json::Value
+    submit(jtx::Env& env, std::shared_ptr<STTx const> const& tx)
+    {
+        Serializer s;
+        tx->add(s);
+        return env.rpc("submit", strHex(s.slice()))[jss::result];
+    }
+
+    static std::string
+    engineResult(Json::Value const& result)
+    {
+        return result[jss::engine_result].asString();
+    }
+
+    /** A well formed STObject that is not a well formed manifest.
+
+        The manifest format requires sfPublicKey and sfMasterSignature, so this
+        parses as an object and then fails applyTemplate.
+    */
+    static std::string
+    makeUnparseableManifest()
+    {
+        STObject st(sfGeneric);
+        st[sfSequence] = 1;
+
+        Serializer s;
+        st.add(s);
+        return std::string(static_cast<char const*>(s.data()), s.size());
+    }
+
+    /** The envelope Submit would build for `manifest`, optionally tweaked.
+
+        makeSetManifestTx() rejects any manifest the transactor would reject,
+        and checkValidity() rejects any envelope whose signatures do not check
+        out, so several of the transactor's own rejections cannot be provoked
+        through the submit RPC at all. Building the envelope here and applying
+        it straight to the open view reaches them.
+    */
+    static std::shared_ptr<STTx const>
+    envelope(
+        jtx::Env& env,
+        std::string const& manifest,
+        AccountID const& account,
+        std::function<void(STObject&)> const& tweak = {})
+    {
+        auto const build = [&](XRPAmount fee, bool tweaked) {
+            return std::make_shared<STTx const>(
+                ttMANIFEST_SET, [&](STObject& obj) {
+                    obj.setAccountID(sfAccount, account);
+                    obj.setFieldU32(sfSequence, 0);
+                    obj.setFieldU32(sfNetworkID, env.app().config().NETWORK_ID);
+                    obj.setFieldAmount(sfFee, fee);
+                    obj.setFieldVL(sfSigningPubKey, Blob{});
+                    obj.setFieldVL(sfTxnSignature, Blob{});
+
+                    SerialIter mit{makeSlice(manifest)};
+                    obj.peekFieldObject(sfManifest).set(mit);
+
+                    if (tweaked && tweak)
+                        tweak(obj);
+                });
+        };
+
+        // The canonical Fee makeSetManifestTx() uses for the open ledger.
+        SerialIter mit{makeSlice(manifest)};
+        STObject const manifestObject{mit, sfManifest};
+        return build(
+            canonicalSetManifestFee(env.current()->fees().base, manifestObject)
+                .value_or(XRPAmount{0}),
+            true);
+    }
+
+    /** A mutable copy of a ledger object, suitable for the RawView interface.
+
+        Round-tripped through the wire format rather than copy constructed.
+        applyTemplate() rejects an object carrying a materialised soeDEFAULT
+        field that holds its default value, and that is exactly what reading one
+        out of a view hands back: an AccountRoot arrives with sfMintedNFTokens
+        present and zero. Serializing omits those fields and deserializing
+        re-materialises them.
+    */
+    static std::shared_ptr<SLE>
+    rawCopy(std::shared_ptr<SLE const> const& sle)
+    {
+        Serializer s;
+        sle->add(s);
+        SerialIter sit{s.slice()};
+        return std::make_shared<SLE>(sit, sle->key());
+    }
+
+    /** Removes a ledger object from a view, if present.
+
+        OpenView exposes only the RawView interface, so the entry has to be
+        copied off the read side before it can be handed back to rawErase.
+    */
+    static void
+    rawErase(OpenView& view, Keylet const& kl)
+    {
+        if (auto const sle = view.read(kl))
+            view.rawErase(rawCopy(sle));
+    }
+
+    /** Applies `tx` to a throwaway copy of the open ledger and reports the TER.
+
+        `prepare` runs against the same view first, so a test can corrupt state
+        that no ordinary transaction could produce. Nothing is retained.
+    */
+    TER
+    applyDirect(
+        jtx::Env& env,
+        std::shared_ptr<STTx const> const& tx,
+        std::function<void(OpenView&)> const& prepare = {})
+    {
+        TER ret = tesSUCCESS;
+        env.app().openLedger().modify([&](OpenView& view, beast::Journal j) {
+            if (prepare)
+                prepare(view);
+            ret = ripple::apply(env.app(), view, *tx, tapNONE, j).ter;
+            return false;  // discard, corrupt or otherwise
+        });
+        return ret;
+    }
+
+    void
+    testSubmission(FeatureBitset features)
+    {
+        testcase("submission");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(master, ephemeral, 1))) ==
+            "tesSUCCESS");
+        env.close();
+
+        // A manifest is written twice so it can be found from either key, and
+        // each copy points at the other.
+        auto const byMaster = env.le(keylet::manifest(master.pk()));
+        auto const byEphemeral = env.le(keylet::manifest(ephemeral.pk()));
+        if (!BEAST_EXPECT(byMaster))
+            return;
+        if (!BEAST_EXPECT(byEphemeral))
+            return;
+
+        BEAST_EXPECT(byMaster->getAccountID(sfAccount) == master.id());
+        BEAST_EXPECT(byEphemeral->getAccountID(sfAccount) == master.id());
+        BEAST_EXPECT(byMaster->getFieldU32(sfSequence) == 1);
+        BEAST_EXPECT(
+            byMaster->getFieldH256(sfManifestID) ==
+            keylet::manifest(ephemeral.pk()).key);
+        BEAST_EXPECT(
+            byEphemeral->getFieldH256(sfManifestID) ==
+            keylet::manifest(master.pk()).key);
+
+        // Both signatures are mirrored so the object can be verified, and
+        // re-served, by any node that reads it.
+        BEAST_EXPECT(byMaster->isFieldPresent(sfMasterSignature));
+        BEAST_EXPECT(byMaster->isFieldPresent(sfSignature));
+
+        // The account root points at the master key's copy.
+        auto const sleAcct = env.le(master);
+        if (!BEAST_EXPECT(sleAcct))
+            return;
+        BEAST_EXPECT(
+            sleAcct->getFieldH256(sfManifestID) ==
+            keylet::manifest(master.pk()).key);
+
+        // The account sequence must be untouched: the transaction is unsigned
+        // and pinned to sequence 0, so consuming a sequence would let a third
+        // party burn the validator's sequence numbers -- and writing seq + 1
+        // would reset the account to 1.
+        BEAST_EXPECT(sleAcct->getFieldU32(sfSequence) == env.seq(master));
+    }
+
+    void
+    testUpdate(FeatureBitset features)
+    {
+        testcase("update and stale rejection");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const eph1 = Account("eph1", KeyType::ed25519);
+        auto const eph2 = Account("eph2", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        submit(env, makeManifest(master, eph1, 1));
+        env.close();
+
+        // Rotating the ephemeral key erases both old copies and writes two
+        // new ones, so the two can never drift apart.
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(master, eph2, 2))) ==
+            "tesSUCCESS");
+        env.close();
+
+        BEAST_EXPECT(!env.le(keylet::manifest(eph1.pk())));
+        if (!BEAST_EXPECT(env.le(keylet::manifest(eph2.pk()))))
+            return;
+        BEAST_EXPECT(
+            env.le(keylet::manifest(master.pk()))->getFieldU32(sfSequence) ==
+            2);
+
+        // Replaying the manifest we just applied, and anything older, is
+        // rejected on sequence. This is what prevents replay: the transaction
+        // is unsigned, so nothing else would.
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(master, eph2, 2))) ==
+            "tefPAST_MANIFEST_SEQ");
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(master, eph1, 1))) ==
+            "tefPAST_MANIFEST_SEQ");
+    }
+
+    void
+    testRevocation(FeatureBitset features)
+    {
+        testcase("revocation");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        submit(env, makeManifest(master, ephemeral, 1));
+        env.close();
+
+        BEAST_EXPECT(
+            engineResult(submit(
+                env,
+                makeManifest(
+                    master,
+                    ephemeral,
+                    std::numeric_limits<std::uint32_t>::max()))) ==
+            "tesSUCCESS");
+        env.close();
+
+        // A revocation has no signing key, so only the master key's copy
+        // exists and it points at nothing.
+        auto const byMaster = env.le(keylet::manifest(master.pk()));
+        if (!BEAST_EXPECT(byMaster))
+            return;
+        BEAST_EXPECT(!env.le(keylet::manifest(ephemeral.pk())));
+        BEAST_EXPECT(!byMaster->isFieldPresent(sfManifestID));
+        BEAST_EXPECT(!byMaster->isFieldPresent(sfSigningPubKey));
+        BEAST_EXPECT(
+            byMaster->getFieldU32(sfSequence) ==
+            std::numeric_limits<std::uint32_t>::max());
+
+        // Nothing supersedes a revocation.
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(master, ephemeral, 2))) ==
+            "tefREVOKED_MANIFEST");
+    }
+
+    void
+    testRetrieval(FeatureBitset features)
+    {
+        testcase("retrieval into the manifest cache");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const eph1 = Account("eph1", KeyType::ed25519);
+        auto const eph2 = Account("eph2", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        submit(env, makeManifest(master, eph1, 1));
+        env.close();
+
+        auto& cache = env.app().validatorManifests();
+
+        // Nothing has fed the cache yet, so an unknown key maps to itself.
+        BEAST_EXPECT(cache.getMasterKey(eph1.pk()) == eph1.pk());
+
+        // Reading the ledger resolves both directions of the mapping. The
+        // manifest is reconstructed from the ledger object and verified, so a
+        // lossy round trip would fail here rather than be accepted.
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), {master.pk()}) == 1);
+        BEAST_EXPECT(cache.getMasterKey(eph1.pk()) == master.pk());
+        BEAST_EXPECT(cache.getSigningKey(master.pk()) == eph1.pk());
+        BEAST_EXPECT(cache.getSequence(master.pk()) == 1);
+
+        // Applying the same ledger again is a no-op: the cache is already at
+        // that sequence.
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), {master.pk()}) == 0);
+
+        // A rotation on-ledger is picked up, and the superseded ephemeral key
+        // stops resolving.
+        submit(env, makeManifest(master, eph2, 2));
+        env.close();
+
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), {master.pk()}) == 1);
+        BEAST_EXPECT(cache.getSigningKey(master.pk()) == eph2.pk());
+        BEAST_EXPECT(cache.getMasterKey(eph1.pk()) == eph1.pk());
+
+        // A key we never ask about is never read.
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), {eph2.pk()}) == 0);
+
+        // A revocation reaches the cache too, and is the one thing that must
+        // never be lost: forgetting it would mean trusting the old key again.
+        submit(
+            env,
+            makeManifest(
+                master, eph2, std::numeric_limits<std::uint32_t>::max()));
+        env.close();
+
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), {master.pk()}) == 1);
+        BEAST_EXPECT(cache.revoked(master.pk()));
+    }
+
+    void
+    testSigningKeyRetrieval(FeatureBitset features)
+    {
+        testcase("retrieval by ephemeral key");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const eph1 = Account("eph1", KeyType::ed25519);
+        auto const eph2 = Account("eph2", KeyType::ed25519);
+        auto const stranger = Account("stranger", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        submit(env, makeManifest(master, eph1, 1));
+        env.close();
+
+        auto& cache = env.app().validatorManifests();
+
+        // The situation applyLedger() cannot serve: a validation arrives
+        // signed by eph1 and the node holds no manifest naming it, so the
+        // master key to probe for is exactly what is missing.
+        BEAST_EXPECT(cache.getMasterKey(eph1.pk()) == eph1.pk());
+
+        BEAST_EXPECT(
+            cache.applyLedgerSigningKey(*env.closed(), eph1.pk()) ==
+            master.pk());
+        BEAST_EXPECT(cache.getMasterKey(eph1.pk()) == master.pk());
+        BEAST_EXPECT(cache.getSigningKey(master.pk()) == eph1.pk());
+        BEAST_EXPECT(cache.getSequence(master.pk()) == 1);
+
+        // A key with no manifest on-ledger resolves to nothing and leaves the
+        // cache untouched.
+        BEAST_EXPECT(
+            !cache.applyLedgerSigningKey(*env.closed(), stranger.pk()));
+        BEAST_EXPECT(cache.getMasterKey(stranger.pk()) == stranger.pk());
+
+        // A rotation is recovered from the new ephemeral key alone, and the
+        // superseded key stops resolving because its object is gone.
+        submit(env, makeManifest(master, eph2, 2));
+        env.close();
+
+        BEAST_EXPECT(
+            cache.applyLedgerSigningKey(*env.closed(), eph2.pk()) ==
+            master.pk());
+        BEAST_EXPECT(cache.getSigningKey(master.pk()) == eph2.pk());
+        BEAST_EXPECT(cache.getMasterKey(eph1.pk()) == eph1.pk());
+        BEAST_EXPECT(!env.le(keylet::manifest(eph1.pk())));
+        BEAST_EXPECT(!cache.applyLedgerSigningKey(*env.closed(), eph1.pk()));
+
+        // Asking again is answered from the cache, ahead of the per-ledger
+        // probe bookkeeping.
+        BEAST_EXPECT(
+            cache.applyLedgerSigningKey(*env.closed(), eph2.pk()) ==
+            master.pk());
+
+        // A master key is not a signing key. The object at its keylet is a
+        // perfectly good manifest and is ingested, but it binds eph2, not the
+        // master key, so nothing is reported for the key asked about.
+        BEAST_EXPECT(!cache.applyLedgerSigningKey(*env.closed(), master.pk()));
+
+        // A revoked master publishes no ephemeral object at all, so this
+        // direction goes quiet. The revocation still reaches the cache by
+        // master key, which is what applyLedger() is for.
+        submit(
+            env,
+            makeManifest(
+                master, eph2, std::numeric_limits<std::uint32_t>::max()));
+        env.close();
+
+        BEAST_EXPECT(!env.le(keylet::manifest(eph2.pk())));
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), {master.pk()}) == 1);
+        BEAST_EXPECT(cache.revoked(master.pk()));
+    }
+
+    void
+    testMalformed(FeatureBitset features)
+    {
+        testcase("malformed submissions");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const other = Account("other", KeyType::ed25519);
+        auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+        env.fund(XRP(1000), master, other);
+        env.close();
+
+        // Not a manifest at all.
+        BEAST_EXPECT(
+            submit(env, "not a manifest")[jss::error].asString() ==
+            "invalidManifest");
+
+        // A manifest whose ephemeral signature does not check out.
+        {
+            auto blob = makeManifest(master, ephemeral, 1);
+            blob[blob.size() - 1] ^= 0xFF;
+            BEAST_EXPECT(
+                submit(env, blob)[jss::error].asString() == "invalidManifest");
+        }
+
+        // The master key's account must exist: it pays the fee and holds the
+        // pointer to the manifest.
+        auto const unfunded = Account("unfunded", KeyType::ed25519);
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(unfunded, ephemeral, 1))) ==
+            "terNO_ACCOUNT");
+
+        // An ephemeral key already claimed by a different account would
+        // collide with -- and clobber -- that account's manifest object.
+        submit(env, makeManifest(master, ephemeral, 1));
+        env.close();
+
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(other, ephemeral, 1))) ==
+            "tecDUPLICATE");
+    }
+
+    void
+    testEnvelopeRejections(FeatureBitset features)
+    {
+        testcase("envelope rejections");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const other = Account("other", KeyType::ed25519);
+        auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+        env.fund(XRP(1000), master, other);
+        env.close();
+
+        auto const good = makeManifest(master, ephemeral, 1);
+
+        // Sanity check: the unmodified envelope is the one Submit builds, so
+        // every rejection below is attributable to the tweak and nothing else.
+        BEAST_EXPECT(
+            applyDirect(env, envelope(env, good, master.id())) == tesSUCCESS);
+
+        // Any bit but tfFullyCanonicalSig (0x80000000), which is tfUniversal
+        // and so permitted on every transaction.
+        BEAST_EXPECT(
+            applyDirect(
+                env, envelope(env, good, master.id(), [](STObject& obj) {
+                    obj.setFieldU32(sfFlags, 0x00000001);
+                })) == temINVALID_FLAG);
+
+        // sfManifest parses as an object but not as a manifest.
+        BEAST_EXPECT(
+            applyDirect(
+                env, envelope(env, makeUnparseableManifest(), master.id())) ==
+            temMALFORMED);
+
+        // A manifest whose signatures do not check out. checkValidity() would
+        // stop this before preflight, so only a direct apply reaches the
+        // transactor's own verify() call.
+        {
+            auto bad = good;
+            bad[bad.size() - 1] ^= 0xFF;
+            BEAST_EXPECT(
+                applyDirect(env, envelope(env, bad, master.id())) ==
+                temMALFORMED);
+        }
+
+        // The envelope's account must be the manifest's master key.
+        BEAST_EXPECT(
+            applyDirect(env, envelope(env, good, other.id())) == temMALFORMED);
+
+        // Every envelope field a relayer could otherwise choose is pinned: the
+        // envelope is one exact transaction, with Account and NetworkID derived
+        // rather than mirrored.
+        for (auto const& [name, tweak] : std::vector<
+                 std::pair<char const*, std::function<void(STObject&)>>>{
+                 {"Sequence",
+                  [](STObject& obj) { obj.setFieldU32(sfSequence, 1); }},
+                 {"AccountTxnID",
+                  [](STObject& obj) {
+                      obj.setFieldH256(sfAccountTxnID, uint256{1});
+                  }},
+                 {"TicketSequence",
+                  [](STObject& obj) { obj.setFieldU32(sfTicketSequence, 1); }},
+                 {"SigningPubKey",
+                  [&](STObject& obj) {
+                      obj.setFieldVL(sfSigningPubKey, master.pk().slice());
+                  }},
+                 {"Memos",
+                  [](STObject& obj) {
+                      obj.setFieldArray(sfMemos, STArray(sfMemos, 1));
+                      STObject memo{sfMemo};
+                      memo.setFieldVL(sfMemoData, Blob{0x01});
+                      obj.peekFieldArray(sfMemos).emplace_back(std::move(memo));
+                  }},
+                 {"SourceTag",
+                  [](STObject& obj) { obj.setFieldU32(sfSourceTag, 1); }},
+                 {"LastLedgerSequence",
+                  [](STObject& obj) {
+                      obj.setFieldU32(sfLastLedgerSequence, 1'000'000);
+                  }},
+                 {"NetworkID",
+                  [](STObject& obj) { obj.setFieldU32(sfNetworkID, 21338); }}})
+        {
+            auto const variant = envelope(env, good, master.id(), tweak);
+            // The generic network check runs first for a foreign NetworkID.
+            auto const expected = std::string(name) == "NetworkID"
+                ? TER{telWRONG_NETWORK}
+                : TER{temMALFORMED};
+            BEAST_EXPECTS(applyDirect(env, variant) == expected, name);
+
+            // Ingress rejects the variant as a bad envelope before any
+            // manifest signature work, and never as a soft fee miss.
+            auto const [validity, reason] = checkValidity(
+                env.app().getHashRouter(),
+                *variant,
+                env.current()->rules(),
+                env.app().config());
+            BEAST_EXPECTS(validity == Validity::SigBad, name);
+            BEAST_EXPECTS(
+                checkManifestIngressFee(env.app(), *variant).first ==
+                    ManifestIngressFee::NotApplicable,
+                name);
+        }
+
+        // The Fee is pinned to the one canonical value for the applying view's
+        // base fee. A different value is a local miss, not a malformed
+        // transaction, and ingress drops it before manifest crypto.
+        auto const priced = envelope(env, good, master.id());
+        auto const canonicalFee = priced->getFieldAmount(sfFee).xrp();
+        BEAST_EXPECT(
+            checkManifestIngressFee(env.app(), *priced).first ==
+            ManifestIngressFee::Canonical);
+        for (auto const fee :
+             {canonicalFee + XRPAmount{1}, canonicalFee - XRPAmount{1}})
+        {
+            auto const variant =
+                envelope(env, good, master.id(), [&](STObject& obj) {
+                    obj.setFieldAmount(sfFee, fee);
+                });
+            BEAST_EXPECT(
+                checkManifestIngressFee(env.app(), *variant).first ==
+                ManifestIngressFee::Refused);
+            BEAST_EXPECT(applyDirect(env, variant) == telMANIFEST_FEE_MISMATCH);
+        }
+
+        // At the canonical value exactly, which is what Submit sends.
+        BEAST_EXPECT(applyDirect(env, priced) == tesSUCCESS);
+    }
+
+    void
+    testCanonicalFee(FeatureBitset features)
+    {
+        testcase("canonical fee");
+        using namespace jtx;
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const eph1 = Account("eph1", KeyType::ed25519);
+        auto const units = [](STObject const& manifestObject) {
+            return 100 +
+                10 *
+                static_cast<std::int64_t>(
+                    manifestObject.getSerializer().getDataLength());
+        };
+        auto const manifest = makeManifest(master, eph1, 1);
+
+        // The builder prices against the voted base fee of the open ledger.
+        auto const build = [&](Env& env) -> std::shared_ptr<STTx const> {
+            auto const hex = makeSetManifestTx(
+                makeSlice(manifest),
+                env.app().config().NETWORK_ID,
+                *env.current(),
+                env.app().journal("SetManifest_test"));
+            if (!BEAST_EXPECT(hex))
+                return nullptr;
+            auto const bytes = strUnHex(*hex);
+            if (!BEAST_EXPECT(bytes))
+                return nullptr;
+            SerialIter txIter{makeSlice(*bytes)};
+            return std::make_shared<STTx const>(std::ref(txIter));
+        };
+        auto const manifestOf = [](STTx const& tx) -> STObject const& {
+            return const_cast<STTx&>(tx)
+                .getField(sfManifest)
+                .downcast<STObject>();
+        };
+
+        std::shared_ptr<STTx const> ordinaryTx;
+        {
+            Env ordinary{*this, makeConfig("10"), features};
+            ordinaryTx = build(ordinary);
+            if (!ordinaryTx)
+                return;
+            BEAST_EXPECT(
+                (*ordinaryTx)[sfFee].xrp().drops() ==
+                10 * units(manifestOf(*ordinaryTx)));
+
+            // A zero base would make the transaction free, so there is no
+            // canonical Fee for it at all.
+            BEAST_EXPECT(!canonicalSetManifestFee(
+                XRPAmount{0}, manifestOf(*ordinaryTx)));
+        }
+
+        // A different fee setting maps the same manifest to exactly one
+        // different txid.
+        Env expensive{*this, makeConfig("100000"), features};
+        auto const expensiveTx = build(expensive);
+        if (!expensiveTx)
+            return;
+        BEAST_EXPECT(
+            (*expensiveTx)[sfFee].xrp().drops() ==
+            100'000 * units(manifestOf(*expensiveTx)));
+        BEAST_EXPECT(
+            expensiveTx->getTransactionID() != ordinaryTx->getTransactionID());
+
+        expensive.fund(XRP(10000), master);
+        expensive.close();
+
+        // A wrapper priced for another fee setting is a local miss, not a bad
+        // signature: ingress drops it before manifest crypto without marking
+        // it bad, and preclaim refuses it with a tel result.
+        BEAST_EXPECT(
+            checkManifestIngressFee(expensive.app(), *ordinaryTx).first ==
+            ManifestIngressFee::Refused);
+        BEAST_EXPECT(
+            submit(expensive, ordinaryTx)[jss::error] == "invalidTransaction");
+        BEAST_EXPECT(
+            (expensive.app().getHashRouter().getFlags(
+                 ordinaryTx->getTransactionID()) &
+             SF_BAD) == 0);
+        BEAST_EXPECT(
+            applyDirect(expensive, ordinaryTx) == telMANIFEST_FEE_MISMATCH);
+
+        BEAST_EXPECT(
+            checkManifestIngressFee(expensive.app(), *expensiveTx).first ==
+            ManifestIngressFee::Canonical);
+        BEAST_EXPECT(engineResult(submit(expensive, manifest)) == "tesSUCCESS");
+        expensive.close();
+        BEAST_EXPECT(expensive.le(keylet::manifest(master.pk())));
+
+        // An amendment-blocked server has no base fee it can trust, so ingress
+        // refuses even the canonical transaction rather than verify it.
+        Env blocked{*this, makeConfig("10"), features};
+        auto const blockedTx = build(blocked);
+        if (!blockedTx)
+            return;
+        BEAST_EXPECT(
+            checkManifestIngressFee(blocked.app(), *blockedTx).first ==
+            ManifestIngressFee::Canonical);
+        blocked.app().getOPs().setAmendmentBlocked();
+        BEAST_EXPECT(
+            checkManifestIngressFee(blocked.app(), *blockedTx).first ==
+            ManifestIngressFee::Refused);
+    }
+
+    void
+    testCorruptLedger(FeatureBitset features)
+    {
+        testcase("corrupt manifest state");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const eph1 = Account("eph1", KeyType::ed25519);
+        auto const eph2 = Account("eph2", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        BEAST_EXPECT(
+            engineResult(submit(env, makeManifest(master, eph1, 1))) ==
+            "tesSUCCESS");
+        env.close();
+
+        auto const update =
+            envelope(env, makeManifest(master, eph2, 2), master.id());
+
+        // sfManifestID on the account root points at nothing.
+        BEAST_EXPECT(applyDirect(env, update, [&](OpenView& view) {
+                         rawErase(view, keylet::manifest(master.pk()));
+                     }) == tefBAD_LEDGER);
+
+        // The master copy survives but the ephemeral copy it points at is
+        // gone.
+        BEAST_EXPECT(applyDirect(env, update, [&](OpenView& view) {
+                         rawErase(view, keylet::manifest(eph1.pk()));
+                     }) == tefBAD_LEDGER);
+
+        // The reverse: the account root has forgotten its manifest, so the
+        // erase pass is skipped and the keylet is found occupied.
+        BEAST_EXPECT(applyDirect(env, update, [&](OpenView& view) {
+                         auto replacement =
+                             rawCopy(view.read(keylet::account(master.id())));
+                         replacement->makeFieldAbsent(sfManifestID);
+                         view.rawReplace(replacement);
+                     }) == tefBAD_LEDGER);
+
+        // None of the above was retained, so the ledger is still intact and an
+        // ordinary update still works.
+        BEAST_EXPECT(applyDirect(env, update) == tesSUCCESS);
+    }
+
+    void
+    testGossipSelection(FeatureBitset features)
+    {
+        testcase("gossip selection");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features};
+
+        std::vector<Account> masters;
+        for (int i = 0; i < 4; ++i)
+            masters.emplace_back("gm" + std::to_string(i), KeyType::ed25519);
+
+        auto const ephemeral = Account("gossipeph", KeyType::ed25519);
+
+        for (auto const& m : masters)
+            env.fund(XRP(1000), m);
+        env.close();
+
+        // Each master needs its own ephemeral key: preclaim rejects a key
+        // already claimed by another account.
+        std::vector<Account> ephs;
+        for (int i = 0; i < 4; ++i)
+            ephs.emplace_back("ge" + std::to_string(i), KeyType::ed25519);
+
+        for (int i = 0; i < 4; ++i)
+        {
+            BEAST_EXPECT(
+                engineResult(
+                    submit(env, makeManifest(masters[i], ephs[i], 1))) ==
+                "tesSUCCESS");
+            env.close();
+        }
+
+        ManifestCache cache;
+
+        hash_set<PublicKey> all;
+        for (auto const& m : masters)
+            all.insert(m.pk());
+
+        BEAST_EXPECT(cache.applyLedger(*env.closed(), all) == 4);
+
+        // The raw form is what a republishing node needs: the exact bytes the
+        // master key signed, plus the sequence to compare against the ledger.
+        auto const raw = cache.getRawManifest(masters[0].pk());
+        if (BEAST_EXPECT(raw))
+        {
+            BEAST_EXPECT(raw->first == 1);
+            BEAST_EXPECT(!raw->second.empty());
+        }
+        BEAST_EXPECT(!cache.getRawManifest(ephemeral.pk()));
+
+        // Pinning bumps the sequence so a cached gossip message is rebuilt,
+        // and pinning the same set again does not.
+        auto const seq = cache.sequence();
+        cache.pin({masters[0].pk(), masters[1].pk()});
+        BEAST_EXPECT(cache.sequence() > seq);
+
+        auto const seq2 = cache.sequence();
+        cache.pin({masters[0].pk(), masters[1].pk()});
+        BEAST_EXPECT(cache.sequence() == seq2);
+
+        // Everything is offered: two pinned plus two under the gossip limit.
+        std::size_t reserved = 0;
+        std::vector<PublicKey> offered;
+        cache.for_each_gossip_manifest(
+            [&](std::size_t n) { reserved = n; },
+            [&](Manifest const& m) { offered.push_back(m.masterKey); });
+
+        BEAST_EXPECT(reserved == 4);
+        BEAST_EXPECT(offered.size() == 4);
+        BEAST_EXPECT(
+            hash_set<PublicKey>(offered.begin(), offered.end()) == all);
+
+        // A pinned key with no manifest is counted in the reservation but not
+        // offered, since the reservation is only an upper bound.
+        cache.pin({masters[0].pk(), ephemeral.pk()});
+        offered.clear();
+        cache.for_each_gossip_manifest(
+            [&](std::size_t n) { reserved = n; },
+            [&](Manifest const& m) { offered.push_back(m.masterKey); });
+
+        BEAST_EXPECT(reserved == 5);
+        BEAST_EXPECT(offered.size() == 4);
+    }
+
+    void
+    testDisabled(FeatureBitset features)
+    {
+        testcase("amendment gate");
+        using namespace jtx;
+
+        Env env{*this, makeConfig(), features - featureOnChainManifests};
+
+        auto const master = Account("master", KeyType::ed25519);
+        auto const ephemeral = Account("ephemeral", KeyType::ed25519);
+        env.fund(XRP(1000), master);
+        env.close();
+
+        // The submitted transaction carries no account signature, so with the
+        // amendment off it would otherwise be rejected as unsigned and never
+        // reach preflight's temDISABLED. The RPC therefore refuses it up
+        // front, and says why.
+        auto const result = submit(env, makeManifest(master, ephemeral, 1));
+        BEAST_EXPECT(result[jss::error].asString() == "notEnabled");
+        BEAST_EXPECT(!result.isMember(jss::engine_result));
+        env.close();
+
+        BEAST_EXPECT(!env.le(keylet::manifest(master.pk())));
+    }
+
+public:
+    void
+    run() override
+    {
+        using namespace test::jtx;
+        auto const sa = supported_amendments();
+        testSubmission(sa);
+        testUpdate(sa);
+        testRevocation(sa);
+        testRetrieval(sa);
+        testSigningKeyRetrieval(sa);
+        testMalformed(sa);
+        testEnvelopeRejections(sa);
+        testCanonicalFee(sa);
+        testCorruptLedger(sa);
+        testGossipSelection(sa);
+        testDisabled(sa);
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(SetManifest, app, ripple);
+
+}  // namespace test
+}  // namespace ripple

src/test/app/Taker_test.cpp

@@ -224,7 +224,7 @@ private:
             taker_offer,
             taker_quality,
             parse_amount(funds, issue_in),
-            sell ? tfSell : 0,
+            sell ? std::uint32_t(tfSell) : 0,
             rate_in,
             rate_out);
 

src/test/app/URIToken_test.cpp

@@ -191,7 +191,6 @@ struct URIToken_test : public beast::unit_test::suite
         using namespace jtx;
         using namespace std::literals::chrono_literals;
 
-        // fixXahauV1
         {
             Env env{*this, features};
             auto const alice = Account("alice");
@@ -204,11 +203,9 @@ struct URIToken_test : public beast::unit_test::suite
             std::string const hexid{strHex(tid)};
 
             // temMALFORMED - cannot include sfDestination without sfAmount
-            bool const withFixXahauV1 =
-                env.current()->rules().enabled(fixXahauV1);
-            auto const txResult =
-                withFixXahauV1 ? ter(temMALFORMED) : ter(tefINTERNAL);
-            env(uritoken::mint(alice, uri), uritoken::dest(bob), txResult);
+            env(uritoken::mint(alice, uri),
+                uritoken::dest(bob),
+                ter(temMALFORMED));
             env.close();
         }
 
@@ -517,12 +514,10 @@ struct URIToken_test : public beast::unit_test::suite
         env.close();
 
         // tecINSUFFICIENT_FUNDS - insufficient xrp - fees
-        // fixXahauV1 - fix checking wrong account for insufficient xrp
         env(pay(env.master, alice, XRP(10000)));
-        auto const txResult = env.current()->rules().enabled(fixXahauV1)
-            ? ter(tecINSUFFICIENT_FUNDS)
-            : ter(tecINTERNAL);
-        env(uritoken::buy(bob, hexid), uritoken::amt(XRP(10000)), txResult);
+        env(uritoken::buy(bob, hexid),
+            uritoken::amt(XRP(10000)),
+            ter(tecINSUFFICIENT_FUNDS));
         env.close();
 
         // clear sell and reset new sell
@@ -579,11 +574,9 @@ struct URIToken_test : public beast::unit_test::suite
         env.close();
 
         // tecINSUFFICIENT_FUNDS - insufficient xrp - fees
-        // fixXahauV1 - fix checking wrong account for insufficient xrp
-        auto const txResult1 = env.current()->rules().enabled(fixXahauV1)
-            ? ter(tecINSUFFICIENT_FUNDS)
-            : ter(tecINTERNAL);
-        env(uritoken::buy(bob, hexid), uritoken::amt(XRP(1000)), txResult1);
+        env(uritoken::buy(bob, hexid),
+            uritoken::amt(XRP(1000)),
+            ter(tecINSUFFICIENT_FUNDS));
         env.close();
 
         // clear sell and set usd sell
@@ -623,12 +616,10 @@ struct URIToken_test : public beast::unit_test::suite
             env.close();
 
             // tecNO_LINE_INSUF_RESERVE - insufficient xrp to create line
-            auto const txResult = env.current()->rules().enabled(fixXahauV1)
-                ? ter(tecINSUF_RESERVE_SELLER)
-                : ter(tecNO_LINE_INSUF_RESERVE);
-
             env(noop(echo), fee(XRP(50)), ter(tesSUCCESS));
-            env(uritoken::buy(dave, hexid), uritoken::amt(USD(1)), txResult);
+            env(uritoken::buy(dave, hexid),
+                uritoken::amt(USD(1)),
+                ter(tecINSUF_RESERVE_SELLER));
             env.close();
         }
 
@@ -989,6 +980,7 @@ struct URIToken_test : public beast::unit_test::suite
 
         // setup env
         env.fund(XRP(1000), alice, bob, gw);
+        env.close();
         env.trust(USD(100000), alice, bob);
         env.close();
         env(pay(gw, alice, USD(1000)));
@@ -2121,14 +2113,7 @@ struct URIToken_test : public beast::unit_test::suite
             env(uritoken::buy(bob, id), uritoken::amt(delta));
             env.close();
             auto const postAlice = env.balance(alice, USD.issue());
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                BEAST_EXPECT(to_string(postAlice.value()) == tc.multiply);
-            }
-            else
-            {
-                BEAST_EXPECT(to_string(postAlice.value()) == tc.divide);
-            }
+            BEAST_EXPECT(to_string(postAlice.value()) == tc.divide);
             BEAST_EXPECT(env.balance(bob, USD.issue()) == preBob - delta);
         }
 
@@ -2167,14 +2152,7 @@ struct URIToken_test : public beast::unit_test::suite
             env.close();
             auto const postAlice = env.balance(alice, USD.issue());
 
-            if (!env.current()->rules().enabled(fixXahauV1))
-            {
-                BEAST_EXPECT(postAlice.value() == preAlice);
-            }
-            else
-            {
-                BEAST_EXPECT(postAlice.value() == preAlice);
-            }
+            BEAST_EXPECT(postAlice.value() == preAlice);
             BEAST_EXPECT(env.balance(bob, USD.issue()) == preBob - USD(0));
         }
 
@@ -2333,12 +2311,16 @@ struct URIToken_test : public beast::unit_test::suite
         auto const bob = Account("bob");
 
         Env env{*this, features};
+
         env.fund(XRP(10000), alice, bob);
         env.close();
 
         std::string uri = "";
 
-        // test utf-8 success
+        // =========================================================================
+        // Cases that should succeed:
+        // valid well-formed UTF-8 that is not a noncharacter
+        // =========================================================================
         {
             // case: kosme
             uri = "κόσμε";
@@ -2371,133 +2353,83 @@ struct URIToken_test : public beast::unit_test::suite
             // case: ipfs metadata url
             uri = "https://example.com/ipfs/";
             env(uritoken::mint(alice, uri));
+        }
 
+        // =========================================================================
+        // Cases that should fail:
+        // genuinely malformed UTF-8 (well-formedness failures)
+        // =========================================================================
+        {
             // BOUNDRY - START
             // ----------------------------------------------------------------
 
-            // case: 1 byte  (U-00000000)
-            uri = "\x00";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
-            // case: 2 bytes (U-00000080)
-            uri = "\xC2\x80";
-            env(uritoken::mint(alice, uri));
-            // case: 3 bytes (U-00000800)
-            uri = "\xE0\xA0\x80";
-            env(uritoken::mint(alice, uri));
-            // case: 4 bytes (U-00010000)
-            uri = "\xF0\x90\x80\x80";
-            env(uritoken::mint(alice, uri));
-            // case: 5 bytes (U-00200000)
+            // case: 5 bytes (U-00200000) - beyond valid UTF-8 range
             uri = "\xF8\x88\x80\x80\x80";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
-            // case: 6 bytes (U-04000000)
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
+            // case: 6 bytes (U-04000000) - beyond valid UTF-8 range
             uri = "\xFC\x84\x80\x80\x80\x80";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
             // BOUNDRY - END
             // ----------------------------------------------------------------
 
-            // case: 1 byte  (U-0000007F)
-            uri = "\x7F";
-            env(uritoken::mint(alice, uri));
-            // case: 2 bytes (U-000007FF)
-            uri = "\xDF\xBF";
-            env(uritoken::mint(alice, uri));
-            // case: 3 bytes (U-0000FFFF)
-            uri = "\xEF\xBF\xBF";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
-            // case: 4 bytes (U-001FFFFF)
-            uri = "\xF7\xBF\xBF\xBF";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
-            // case: 5 bytes (U-03FFFFFF)
-            uri = "\xFB\xBF\xBF\xBF\xBF";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
-            // case: 6 bytes (U-7FFFFFFF)
-            uri = "\xFD\xBF\xBF\xBF\xBF\xBF";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
+            // case: 3 bytes max (U-0000FFFF) - but this is U+FFFF
+            // noncharacter, rejected, see below
 
-            // // BOUNDRY - OTHER
+            // case: 4 bytes max (U-001FFFFF) - beyond valid BMP
+            uri = "\xF7\xBF\xBF\xBF";
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
+            // case: 5 bytes max (U-03FFFFFF) - beyond valid UTF-8
+            uri = "\xFB\xBF\xBF\xBF\xBF";
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
+            // case: 6 bytes max (U-7FFFFFFF) - beyond valid UTF-8
+            uri = "\xFD\xBF\xBF\xBF\xBF\xBF";
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
+            // BOUNDRY - OTHER
             // ----------------------------------------------------------------
-            // case: 1 bytes (U-0000D7FF)
+            // case: 1 bytes (U-0000D7FF) - incomplete 2-byte sequence
             uri = "\xD7\xFF";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
-            // case: 2 bytes (U-0000E000)
-            uri = "\xEE\x80\x80";
-            env(uritoken::mint(alice, uri));
-            // case: 3 bytes (U-0000FFFD)
-            uri = "\xEF\xBF\xBD";
-            env(uritoken::mint(alice, uri));
-            // // case: 4 bytes (U-0010FFFF)
-            uri = "\xF4\x8F\xBF\xBF";
-            env(uritoken::mint(alice, uri));
-            // // case: 4 bytes (U-00110000)
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
+            // case: 4 bytes (U-00110000) - beyond valid UTF-8 range
             uri = "\xF4\x90\x80\x80";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD NOT FAIL
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
         }
-        // test utf8 malformed
+
+        // =========================================================================
+        // Genuinely malformed UTF-8 sequences - always fail
+        // =========================================================================
         {
-            // MALFORMED - END
+            // MALFORMED - START
             // ----------------------------------------------------------------
+
             // First continuation byte 0x80:
             uri = "\x80";
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
             // Last continuation byte 0xbf
             uri = "\xBF";
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
-            // 2 continuation bytes
-            uri = "��";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
-
-            // 3 continuation bytes
-            uri = "���";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
-
-            // 4 continuation bytes
-            uri = "����";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
-
-            // 5 continuation bytes
-            uri = "�����";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
-
-            // 6 continuation bytes
-            uri = "������";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
-
-            // 7 continuation bytes
-            uri = "�������";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
-
             // Sequence of all 64 possible continuation bytes (0x80-0xbf)
             uri =
-                "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E"
-                "\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D"
-                "\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC"
-                "\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB"
+                "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D"
+                "\x8E"
+                "\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C"
+                "\x9D"
+                "\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB"
+                "\xAC"
+                "\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA"
+                "\xBB"
                 "\xBC\xBD\xBE\xBF";
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
-            // TODO: REVIEW - THIS IS NOT THE CORRECT 32 byte sequence.
-            // All 32 first bytes of 2-byte sequences (0xc0-0xdf), each followed
-            // by a space character
-            // uri = "\xE0\x80\x80 \xE0\x80\x81 \xE0\x80\x82 \xE0\x80\x83
-            // \xE0\x80\x84 \xE0\x80\x85 \xE0\x80\x86 \xE0\x80\x87 \xE0\x80\x88
-            // \xE0\x80\x89 \xE0\x80\x8A \xE0\x80\x8B \xE0\x80\x8C \xE0\x80\x8D
-            // \xE0\x80\x8E \xE0\x80\x8F \xE0\x80\x90";
-            // env(uritoken::mint(alice, uri), ter(temMALFORMED));
-
-            // All 16 first bytes of 3-byte sequences (0xe0-0xef), each followed
-            // by a space character
+            // All 16 first bytes of 3-byte sequences (0xe0-0xef), each
+            // followed by a space character
             uri =
                 "\xE0\x80\x80 \xE0\x80\x81 \xE0\x80\x82 \xE0\x80\x83 "
                 "\xE0\x80\x84 \xE0\x80\x85 \xE0\x80\x86 \xE0\x80\x87 "
@@ -2506,30 +2438,25 @@ struct URIToken_test : public beast::unit_test::suite
                 "\xE0\x80\x90";
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
-            // All 8 first bytes of 4-byte sequences (0xf0-0xf7), each followed
-            // by a space character
+            // All 8 first bytes of 4-byte sequences (0xf0-0xf7), each
+            // followed by a space character
             uri =
                 "\xF0\x90\x80\x80 \xF0\x90\x80\x81 \xF0\x90\x80\x82 "
                 "\xF0\x90\x80\x83 \xF0\x90\x80\x84 \xF0\x90\x80\x85 "
                 "\xF0\x90\x80\x86 \xF0\x90\x80\x87";
-            env(uritoken::mint(alice, uri));  // TODO: REVIEW - SHOULD FAIL
+            env(uritoken::mint(alice, uri));
 
-            // All 4 first bytes of 5-byte sequences (0xf8-0xfb), each followed
-            // by a space character
+            // All 4 first bytes of 5-byte sequences (0xf8-0xfb), each
+            // followed by a space character
             uri =
                 "\xF8\x88\x80\x80\x80 \xF8\x88\x80\x80\x81 "
                 "\xF8\x88\x80\x80\x82 \xF8\x88\x80\x80\x83";
-            env(uritoken::mint(alice, uri),
-                ter(temMALFORMED));  // TODO: REVIEW - SHOULD FAIL
-
-            // All 2 first bytes of 6-byte sequences (0xfc-0xfd), each followed
-            // by a space character
-            uri = "\xFC\x84\x80\x80\x80\x80 \xFC\x84\x80\x80\x80\x81";
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
-            // Sequences with last continuation byte missing
-
-            // Concatenation of incomplete sequences
+            // All 2 first bytes of 6-byte sequences (0xfc-0xfd), each
+            // followed by a space character
+            uri = "\xFC\x84\x80\x80\x80\x80 \xFC\x84\x80\x80\x80\x81";
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
             // Impossible bytes
             uri = "\xFE";
@@ -2639,15 +2566,75 @@ struct URIToken_test : public beast::unit_test::suite
             uri = "\xED\xAF\xBF\xED\xBF\xBF";
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
 
-            // problematic noncharacters in 16-bit applications
-            // case: (U+FFFE)
-            uri = "\xEF\xBF\xBE";
+            // MALFORMED - END
+            // ----------------------------------------------------------------
+        }
+
+        // =========================================================================
+        // Noncharacters U+FFFE and U+FFFF: well-formed UTF-8, but
+        // deliberately rejected (U+FFFE is a byte-swapped BOM).
+        // =========================================================================
+        {
+            uri = "\xEF\xBF\xBE";  // U+FFFE
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
-            // case: (U+FFFF)
-            uri = "\xEF\xBF\xBF";
+
+            uri = "\xEF\xBF\xBF";  // U+FFFF
+            env(uritoken::mint(alice, uri), ter(temMALFORMED));
+
+            uri = "ipfs://x\xEF\xBF\xBE";  // not only at the start
             env(uritoken::mint(alice, uri), ter(temMALFORMED));
         }
+
+        // =========================================================================
+        // Valid boundary cases that should always succeed
+        // =========================================================================
+        {
+            // BOUNDRY - START (valid minimums)
+            // ----------------------------------------------------------------
+
+            // case: 1 byte  (U-00000000). Must use the string
+            // constructor, not a C-string literal, to avoid strlen
+            // truncation to an empty URI.
+            uri = std::string(1, '\0');
+            env(uritoken::mint(alice, uri));
+            // case: 2 bytes (U-00000080)
+            uri = "\xC2\x80";
+            env(uritoken::mint(alice, uri));
+            // case: 3 bytes (U-00000800)
+            uri = "\xE0\xA0\x80";
+            env(uritoken::mint(alice, uri));
+            // case: 4 bytes (U-00010000)
+            uri = "\xF0\x90\x80\x80";
+            env(uritoken::mint(alice, uri));
+
+            // BOUNDRY - END (valid maximums)
+            // ----------------------------------------------------------------
+
+            // case: 1 byte  (U-0000007F)
+            uri = "\x7F";
+            env(uritoken::mint(alice, uri));
+            // case: 2 bytes (U-000007FF)
+            uri = "\xDF\xBF";
+            env(uritoken::mint(alice, uri));
+            // case: 3 bytes (U-0000FFFF) - noncharacter, rejected, see
+            // above.
+            // case: 4 bytes (U-001FFFFF) - beyond U+10FFFF, always
+            // rejected, see above.
+
+            // BOUNDRY - OTHER
+            // ----------------------------------------------------------------
+            // case: 2 bytes (U-0000E000) - above surrogates
+            uri = "\xEE\x80\x80";
+            env(uritoken::mint(alice, uri));
+            // case: 3 bytes (U-0000FFFD) - replacement character, valid
+            uri = "\xEF\xBF\xBD";
+            env(uritoken::mint(alice, uri));
+            // case: 4 bytes (U-0010FFFF) - max valid code point
+            uri = "\xF4\x8F\xBF\xBF";
+            env(uritoken::mint(alice, uri));
+        }
     }
+
     void
     testWithFeats(FeatureBitset features)
     {
@@ -2682,7 +2669,6 @@ public:
         using namespace test::jtx;
         auto const sa = supported_amendments();
         testWithFeats(sa);
-        testWithFeats(sa - fixXahauV1);
     }
 };
 

src/test/app/ValidatorSite_test.cpp

@@ -206,7 +206,7 @@ private:
             NetClock::time_point const expires2 =
                 effective2 + cfg.expiresFromNow;
             item.server = make_TrustedPublisherServer(
-                env.app().getIOService(),
+                env.app().getIOContext(),
                 item.list,
                 expires,
                 {{effective2, expires2}},

src/test/app/XahauGenesis_test.cpp

@@ -327,8 +327,8 @@ struct XahauGenesis_test : public beast::unit_test::suite
                 const char first = rn.c_str()[0];
                 BEAST_EXPECT(
                     (first == 'r' && !!parseBase58<AccountID>(rn)) ||
-                    first == 'n' &&
-                        !!parseBase58<PublicKey>(TokenType::NodePublic, rn));
+                    (first == 'n' &&
+                     !!parseBase58<PublicKey>(TokenType::NodePublic, rn)));
 
                 if (first == 'r')
                 {
@@ -363,8 +363,8 @@ struct XahauGenesis_test : public beast::unit_test::suite
                 const char first = rn.c_str()[0];
                 BEAST_EXPECT(
                     (first == 'r' && !!parseBase58<AccountID>(rn)) ||
-                    first == 'n' &&
-                        !!parseBase58<PublicKey>(TokenType::NodePublic, rn));
+                    (first == 'n' &&
+                     !!parseBase58<PublicKey>(TokenType::NodePublic, rn)));
 
                 if (first == 'r')
                 {
@@ -4354,11 +4354,11 @@ struct XahauGenesis_test : public beast::unit_test::suite
         using namespace std::chrono_literals;
         testcase("test claim reward valid for L1 with unl report");
 
-        for (bool const withXahauV1 : {true, false})
         {
-            FeatureBitset _features = features - featureXahauGenesis;
-            auto const amend = withXahauV1 ? _features : _features - fixXahauV1;
-            Env env{*this, makeNetworkConfig(21337), amend};
+            Env env{
+                *this,
+                makeNetworkConfig(21337),
+                features - featureXahauGenesis};
 
             double const rateDrops = 0.00333333333 * 1'000'000;
             STAmount const feesXRP = XRP(1);
@@ -4453,9 +4453,7 @@ struct XahauGenesis_test : public beast::unit_test::suite
                 accountKeyAndSle(*env.current(), alice);
 
             // claim reward
-            auto const txResult =
-                withXahauV1 ? ter(tesSUCCESS) : ter(tecHOOK_REJECTED);
-            env(claimReward(alice, env.master), fee(feesXRP), txResult);
+            env(claimReward(alice, env.master), fee(feesXRP), ter(tesSUCCESS));
             env.close();
 
             // trigger emitted txn
@@ -4464,8 +4462,7 @@ struct XahauGenesis_test : public beast::unit_test::suite
             // calculate rewards
             STAmount const netReward =
                 rewardUserAmount(*acctSle, preLedger, rateDrops);
-            STAmount const l1Reward =
-                withXahauV1 ? rewardL1Amount(netReward, 20) : STAmount(0);
+            STAmount const l1Reward = rewardL1Amount(netReward, 20);
 
             // validate govern rewards
             BEAST_EXPECT(env.balance(bob) == preBob + l1Reward);
@@ -4475,16 +4472,14 @@ struct XahauGenesis_test : public beast::unit_test::suite
 
             // validate account fields
             STAmount const postAlice = preAlice + netReward + l1Reward;
-            bool const boolResult = withXahauV1 ? true : false;
             bool const has240819 = env.current()->rules().enabled(fix240819);
-            BEAST_EXPECT(
-                expectAccountFields(
-                    env,
-                    alice,
-                    preLedger,
-                    preLedger + 1,
-                    has240819 ? (preAlice - feesXRP) : postAlice,
-                    preTime) == boolResult);
+            BEAST_EXPECT(expectAccountFields(
+                env,
+                alice,
+                preLedger,
+                preLedger + 1,
+                has240819 ? (preAlice - feesXRP) : postAlice,
+                preTime));
         }
     }
 

src/test/app/build_test_hooks.sh

@@ -48,7 +48,6 @@ cat $INPUT_FILE | tr '\n' '\f' |
         sed -E 's/\)\[test\.hook\]"[\f \t]*/\/*end*\//g' | 
         while read -r line
         do
-            echo "/* ==== WASM: $COUNTER ==== */" >> $OUTPUT_FILE
             echo -n '{ R"[test.hook](' >> $OUTPUT_FILE
             cat <<< "$line" | sed -E 's/.{7}$//g' | tr -d '\n' | tr '\f' '\n' >> $OUTPUT_FILE
             echo ')[test.hook]",' >> $OUTPUT_FILE

src/test/basics/ReaderPreferringSharedMutex_test.cpp

@@ -0,0 +1,79 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2026 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/basics/ReaderPreferringSharedMutex.h>
+#include <xrpl/beast/unit_test.h>
+
+#include <mutex>
+#include <shared_mutex>
+
+namespace ripple {
+namespace test {
+
+class ReaderPreferringSharedMutex_test : public beast::unit_test::suite
+{
+    void
+    testExclusiveAndShared()
+    {
+        testcase("exclusive and shared locking");
+
+        ReaderPreferringSharedMutex mutex;
+
+        BEAST_EXPECT(mutex.try_lock());
+        BEAST_EXPECT(!mutex.try_lock());
+        BEAST_EXPECT(!mutex.try_lock_shared());
+        mutex.unlock();
+
+        mutex.lock_shared();
+        BEAST_EXPECT(mutex.try_lock_shared());
+        BEAST_EXPECT(!mutex.try_lock());
+        mutex.unlock_shared();
+        mutex.unlock_shared();
+
+        {
+            std::shared_lock shared{mutex};
+            BEAST_EXPECT(!mutex.try_lock());
+            BEAST_EXPECT(mutex.try_lock_shared());
+            mutex.unlock_shared();
+        }
+
+        {
+            std::unique_lock exclusive{mutex};
+            BEAST_EXPECT(!mutex.try_lock());
+            BEAST_EXPECT(!mutex.try_lock_shared());
+        }
+
+        mutex.lock();
+        BEAST_EXPECT(!mutex.try_lock_shared());
+        mutex.unlock();
+        BEAST_EXPECT(mutex.try_lock_shared());
+        mutex.unlock_shared();
+    }
+
+    void
+    run() override
+    {
+        testExclusiveAndShared();
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(ReaderPreferringSharedMutex, ripple_basics, ripple);
+
+}  // namespace test
+}  // namespace ripple

src/test/basics/ResolverAsio_test.cpp

@@ -0,0 +1,246 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2026 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <test/unit_test/SuiteJournal.h>
+
+#include <xrpl/basics/ResolverAsio.h>
+#include <xrpl/beast/unit_test.h>
+
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
+
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace ripple {
+namespace test {
+
+// ResolverAsio was ported from io_service / strand.wrap / resolver iterators
+// to io_context / bind_executor / results_type for Boost 1.87+. This covers
+// the ported dispatch, resolve, results iteration, work chaining and stop
+// paths against a live io_context on a worker thread.
+class ResolverAsio_test : public beast::unit_test::suite
+{
+    struct Loop
+    {
+        boost::asio::io_context ioc;
+        std::optional<boost::asio::executor_work_guard<
+            boost::asio::io_context::executor_type>>
+            work{boost::asio::make_work_guard(ioc)};
+        std::thread thread{[this] { ioc.run(); }};
+
+        ~Loop()
+        {
+            work.reset();
+            ioc.stop();
+            thread.join();
+        }
+    };
+
+    using Result = std::pair<std::string, std::vector<beast::IP::Endpoint>>;
+
+    struct Results
+    {
+        std::mutex mutex;
+        std::condition_variable cv;
+        std::vector<Result> items;
+
+        Resolver::HandlerType
+        handler()
+        {
+            return [this](
+                       std::string name,
+                       std::vector<beast::IP::Endpoint> endpoints) {
+                std::lock_guard lock(mutex);
+                items.emplace_back(std::move(name), std::move(endpoints));
+                cv.notify_all();
+            };
+        }
+
+        bool
+        waitFor(std::size_t n, std::chrono::milliseconds timeout)
+        {
+            std::unique_lock lock(mutex);
+            return cv.wait_for(
+                lock, timeout, [&] { return items.size() >= n; });
+        }
+    };
+
+    void
+    testNumericHost()
+    {
+        testcase("a numeric host:port resolves to itself");
+        using namespace std::chrono_literals;
+        Loop loop;
+        SuiteJournal journal("ResolverAsio_test", *this);
+        auto resolver = ResolverAsio::New(loop.ioc, journal);
+        resolver->start();
+
+        Results results;
+        resolver->resolve({"127.0.0.1:2222"}, results.handler());
+        BEAST_EXPECT(results.waitFor(1, 5000ms));
+        {
+            std::lock_guard lock(results.mutex);
+            if (BEAST_EXPECT(results.items.size() == 1))
+            {
+                auto const& [name, endpoints] = results.items.front();
+                BEAST_EXPECT(name == "127.0.0.1:2222");
+                if (BEAST_EXPECT(endpoints.size() == 1))
+                {
+                    BEAST_EXPECT(endpoints.front().port() == 2222);
+                    BEAST_EXPECT(
+                        endpoints.front().address().to_string() == "127.0.0.1");
+                }
+            }
+        }
+        resolver->stop();
+    }
+
+    void
+    testBatchSkipsUnparseable()
+    {
+        testcase("a batch resolves in order; unparseable names are skipped");
+        using namespace std::chrono_literals;
+        Loop loop;
+        SuiteJournal journal("ResolverAsio_test", *this);
+        auto resolver = ResolverAsio::New(loop.ioc, journal);
+        resolver->start();
+
+        Results results;
+        // the whitespace-only name has no host: the resolver logs and moves
+        // on without invoking the handler for it
+        resolver->resolve(
+            {"127.0.0.1:1", "   ", "127.0.0.1:2", "127.0.0.1:3"},
+            results.handler());
+        BEAST_EXPECT(results.waitFor(3, 5000ms));
+        {
+            std::lock_guard lock(results.mutex);
+            if (BEAST_EXPECT(results.items.size() == 3))
+            {
+                BEAST_EXPECT(results.items[0].first == "127.0.0.1:1");
+                BEAST_EXPECT(results.items[1].first == "127.0.0.1:2");
+                BEAST_EXPECT(results.items[2].first == "127.0.0.1:3");
+                for (auto const& [name, endpoints] : results.items)
+                    BEAST_EXPECT(endpoints.size() == 1);
+            }
+        }
+        resolver->stop();
+    }
+
+    void
+    testUnresolvableName()
+    {
+        testcase("an unresolvable name reports no endpoints");
+        using namespace std::chrono_literals;
+        Loop loop;
+        SuiteJournal journal("ResolverAsio_test", *this);
+        auto resolver = ResolverAsio::New(loop.ioc, journal);
+        resolver->start();
+
+        Results results;
+        // .invalid is reserved to never resolve (RFC 2606)
+        resolver->resolve({"nonexistent.invalid:80"}, results.handler());
+        // a DNS error surfaces as a callback with an empty list; a slow or
+        // absent resolver makes this take a few seconds, not forever
+        BEAST_EXPECT(results.waitFor(1, 20000ms));
+        {
+            std::lock_guard lock(results.mutex);
+            if (BEAST_EXPECT(results.items.size() == 1))
+            {
+                BEAST_EXPECT(
+                    results.items.front().first == "nonexistent.invalid:80");
+                BEAST_EXPECT(results.items.front().second.empty());
+            }
+        }
+        resolver->stop();
+    }
+
+    void
+    testStopWithPendingWork()
+    {
+        testcase("stop with work pending returns and drops the queue");
+        using namespace std::chrono_literals;
+        Loop loop;
+        SuiteJournal journal("ResolverAsio_test", *this);
+        auto resolver = ResolverAsio::New(loop.ioc, journal);
+        resolver->start();
+
+        Results results;
+        std::vector<std::string> names;
+        for (int i = 1; i <= 200; ++i)
+            names.push_back("127.0.0.1:" + std::to_string(i));
+        resolver->resolve(names, results.handler());
+        // a synchronous stop waits for the in-flight handler and clears the
+        // rest; it must return promptly and the destructor's invariants
+        // (no pending work, stopped) must then hold
+        auto const start = std::chrono::steady_clock::now();
+        resolver->stop();
+        BEAST_EXPECT(
+            std::chrono::steady_clock::now() - start < std::chrono::seconds(5));
+        std::size_t delivered;
+        {
+            std::lock_guard lock(results.mutex);
+            delivered = results.items.size();
+        }
+        BEAST_EXPECT(delivered < names.size());
+        resolver.reset();
+        pass();
+    }
+
+    void
+    testStopAsync()
+    {
+        testcase("stop_async followed by stop is idempotent");
+        using namespace std::chrono_literals;
+        Loop loop;
+        SuiteJournal journal("ResolverAsio_test", *this);
+        auto resolver = ResolverAsio::New(loop.ioc, journal);
+        resolver->start();
+
+        Results results;
+        resolver->resolve({"127.0.0.1:9"}, results.handler());
+        BEAST_EXPECT(results.waitFor(1, 5000ms));
+        resolver->stop_async();
+        resolver->stop();
+        resolver.reset();
+        pass();
+    }
+
+public:
+    void
+    run() override
+    {
+        testNumericHost();
+        testBatchSkipsUnparseable();
+        testUnresolvableName();
+        testStopWithPendingWork();
+        testStopAsync();
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(ResolverAsio, basics, ripple);
+
+}  // namespace test
+}  // namespace ripple

src/test/basics/StringUtilities_test.cpp

@@ -59,6 +59,17 @@ public:
         testUnHexFailure("123X");
         testUnHexFailure("V");
         testUnHexFailure("XAH");
+
+        // Bytes >= 0x80 (negative when char is signed) must be rejected, not
+        // used to index the lookup table out of bounds
+        for (int b = 0x80; b <= 0xff; ++b)
+        {
+            std::string const c(1, static_cast<char>(b));
+            testUnHexFailure(c);
+            testUnHexFailure("0" + c);
+            testUnHexFailure(c + "0");
+            testUnHexFailure("00" + c + "00");
+        }
     }
 
     void

src/test/basics/UTF8_test.cpp

@@ -0,0 +1,69 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/UTF8.h>
+#include <xrpl/beast/unit_test.h>
+
+namespace ripple {
+
+struct UTF8_test : public beast::unit_test::suite
+{
+    void
+    run() override
+    {
+        testcase("isValidUTF8");
+
+        auto const check = [](std::string const& s) {
+            return isValidUTF8(makeSlice(s));
+        };
+
+        // Sequences truncated by the end of the buffer are invalid. The
+        // previous decoder read past the end of the vector here.
+        BEAST_EXPECT(!check("a\xC2"));
+        BEAST_EXPECT(!check("a\xE0\xA4"));
+        BEAST_EXPECT(!check("a\xEF\xBF"));
+        BEAST_EXPECT(!check("a\xF0\x90\x8D"));
+        BEAST_EXPECT(!check(std::string("\xC2", 1)));
+        BEAST_EXPECT(!check(std::string("\xF4\x8F\xBF", 3)));
+
+        // The complete sequences are fine.
+        BEAST_EXPECT(check("a\xC2\xA2"));
+        BEAST_EXPECT(check("a\xE0\xA4\xB9"));
+        BEAST_EXPECT(check("a\xF0\x90\x8D\x88"));
+        BEAST_EXPECT(check("a\xF4\x8F\xBF\xBF"));
+        BEAST_EXPECT(check(""));
+
+        // U+FFFE and U+FFFF are rejected wherever they appear.
+        BEAST_EXPECT(!check("\xEF\xBF\xBE"));
+        BEAST_EXPECT(!check("ab\xEF\xBF\xBF"));
+        BEAST_EXPECT(!check("\xE2\x82\xAC\xEF\xBF\xBEz"));
+
+        // Their neighbours are not, and nor are the other noncharacters,
+        // which the validator has never rejected.
+        BEAST_EXPECT(check("\xEF\xBF\xBD"));      // U+FFFD
+        BEAST_EXPECT(check("\xEF\xBE\xBF"));      // U+FFBF
+        BEAST_EXPECT(check("\xEF\xBB\xBF"));      // U+FEFF (BOM)
+        BEAST_EXPECT(check("\xF0\x9F\xBF\xBE"));  // U+1FFFE
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(UTF8, basics, ripple);
+
+}  // namespace ripple

src/test/basics/base58_test.cpp

@@ -462,11 +462,102 @@ class base58_test : public beast::unit_test::suite
         }
     }
 
+    void
+    testDecodeInvalidChars()
+    {
+        testcase("decode_invalid_chars");
+
+        // Every byte outside the base58 alphabet, including bytes >= 0x80
+        // (negative when char is signed), must be rejected at any position.
+        // The fast decoder reads the leading `size % 10` characters and the
+        // remaining characters in two separate loops; varying the length and
+        // the position of the bad byte exercises both.
+        constexpr std::string_view alphabet =
+            "rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz";
+        std::array<bool, 256> inAlphabet{};
+        for (unsigned char const c : alphabet)
+            inAlphabet[c] = true;
+
+        auto const invalidCode =
+            make_error_code(TokenCodecErrc::invalidEncodingChar);
+
+        // 52 is the longest input the fast decoder accepts
+        for (std::size_t len = 1; len <= 52; ++len)
+        {
+            std::string base;
+            for (std::size_t i = 0; i < len; ++i)
+                base.push_back(alphabet[(i * 7 + len) % alphabet.size()]);
+
+            for (std::size_t pos = 0; pos < len; ++pos)
+            {
+                for (int b = 0; b < 256; ++b)
+                {
+                    if (inAlphabet[b])
+                        continue;
+
+                    std::string s = base;
+                    s[pos] = static_cast<char>(b);
+
+                    std::array<std::uint8_t, 64> outBuf;
+                    auto const r = b58_fast::detail::b58_to_b256_be(s, outBuf);
+                    BEAST_EXPECT(!r && r.error() == invalidCode);
+                    BEAST_EXPECT(b58_ref::detail::decodeBase58(s).empty());
+                }
+            }
+        }
+
+        // Same through the token API, using a valid AccountID as the base
+        constexpr TokenType tokType = TokenType::AccountID;
+        std::string const addr = "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh";
+        BEAST_EXPECT(!decodeBase58Token(addr, tokType).empty());
+        for (std::size_t pos = 0; pos < addr.size(); ++pos)
+        {
+            for (int b = 0; b < 256; ++b)
+            {
+                if (inAlphabet[b])
+                    continue;
+
+                std::string s = addr;
+                s[pos] = static_cast<char>(b);
+
+                std::array<std::uint8_t, 64> outBuf;
+                auto const r = b58_fast::decodeBase58Token(tokType, s, outBuf);
+                BEAST_EXPECT(!r && r.error() == invalidCode);
+                BEAST_EXPECT(b58_ref::decodeBase58Token(s, tokType).empty());
+                BEAST_EXPECT(decodeBase58Token(s, tokType).empty());
+            }
+        }
+    }
+
+    void
+    testDecodeMaxValue()
+    {
+        testcase("decode_max_value");
+
+        // The largest value of every accepted length ('z' is digit 57) must
+        // decode identically in both implementations. At 52 chars this is the
+        // widest intermediate the fast decoder's bigint ever has to hold.
+        for (std::size_t len = 1; len <= 52; ++len)
+        {
+            std::string const s(len, 'z');
+
+            std::array<std::uint8_t, 64> outBuf;
+            auto const r = b58_fast::detail::b58_to_b256_be(s, outBuf);
+            std::string const ref = b58_ref::detail::decodeBase58(s);
+            if (!BEAST_EXPECT(r))
+                continue;
+            BEAST_EXPECT(
+                std::string(r.value().begin(), r.value().end()) == ref);
+        }
+    }
+
     void
     run() override
     {
         testMultiprecision();
         testFastMatchesRef();
+        testDecodeInvalidChars();
+        testDecodeMaxValue();
     }
 };
 

src/test/beast/IPEndpoint_test.cpp

@@ -44,13 +44,13 @@ public:
         std::string const& normal = "")
     {
         boost::system::error_code ec;
-        Address const result{Address::from_string(s, ec)};
+        Address const result{boost::asio::ip::make_address(s, ec)};
         if (!BEAST_EXPECTS(!ec, ec.message()))
             return;
         if (!BEAST_EXPECTS(result.is_v4(), s + " not v4"))
             return;
         if (!BEAST_EXPECTS(
-                result.to_v4().to_ulong() == value, s + " value mismatch"))
+                result.to_v4().to_uint() == value, s + " value mismatch"))
             return;
         BEAST_EXPECTS(
             result.to_string() == (normal.empty() ? s : normal),
@@ -61,7 +61,7 @@ public:
     failParseAddr(std::string const& s)
     {
         boost::system::error_code ec;
-        auto a = Address::from_string(s, ec);
+        auto a = boost::asio::ip::make_address(s, ec);
         BEAST_EXPECTS(ec, s + " parses as " + a.to_string());
     }
 
@@ -70,24 +70,24 @@ public:
     {
         testcase("AddressV4");
 
-        BEAST_EXPECT(AddressV4{}.to_ulong() == 0);
+        BEAST_EXPECT(AddressV4{}.to_uint() == 0);
         BEAST_EXPECT(is_unspecified(AddressV4{}));
-        BEAST_EXPECT(AddressV4{0x01020304}.to_ulong() == 0x01020304);
+        BEAST_EXPECT(AddressV4{0x01020304}.to_uint() == 0x01020304);
 
         {
             AddressV4::bytes_type d = {{1, 2, 3, 4}};
-            BEAST_EXPECT(AddressV4{d}.to_ulong() == 0x01020304);
+            BEAST_EXPECT(AddressV4{d}.to_uint() == 0x01020304);
 
             unexpected(is_unspecified(AddressV4{d}));
         }
 
         AddressV4 const v1{1};
-        BEAST_EXPECT(AddressV4{v1}.to_ulong() == 1);
+        BEAST_EXPECT(AddressV4{v1}.to_uint() == 1);
 
         {
             AddressV4 v;
             v = v1;
-            BEAST_EXPECT(v.to_ulong() == v1.to_ulong());
+            BEAST_EXPECT(v.to_uint() == v1.to_uint());
         }
 
         {
@@ -98,7 +98,7 @@ public:
             d[2] = 3;
             d[3] = 4;
             v = AddressV4{d};
-            BEAST_EXPECT(v.to_ulong() == 0x01020304);
+            BEAST_EXPECT(v.to_uint() == 0x01020304);
         }
 
         BEAST_EXPECT(AddressV4(0x01020304).to_string() == "1.2.3.4");
@@ -160,7 +160,7 @@ public:
         testcase("Address");
 
         boost::system::error_code ec;
-        Address result{Address::from_string("1.2.3.4", ec)};
+        Address result{boost::asio::ip::make_address("1.2.3.4", ec)};
         AddressV4::bytes_type d = {{1, 2, 3, 4}};
         BEAST_EXPECT(!ec);
         BEAST_EXPECT(result.is_v4() && result.to_v4() == AddressV4{d});
@@ -262,7 +262,10 @@ public:
         BEAST_EXPECT(is_loopback(ep));
         BEAST_EXPECT(to_string(ep) == "127.0.0.1:80");
         // same address as v4 mapped in ipv6
-        ep = Endpoint(AddressV6::v4_mapped(AddressV4{d}), 80);
+        ep = Endpoint(
+            boost::asio::ip::make_address_v6(
+                boost::asio::ip::v4_mapped, AddressV4{d}),
+            80);
         BEAST_EXPECT(!is_unspecified(ep));
         BEAST_EXPECT(!is_public(ep));
         BEAST_EXPECT(is_private(ep));
@@ -280,8 +283,11 @@ public:
         BEAST_EXPECT(!is_loopback(ep));
         BEAST_EXPECT(to_string(ep) == "10.0.0.1");
         // same address as v4 mapped in ipv6
-        ep = Endpoint(AddressV6::v4_mapped(AddressV4{d}));
-        BEAST_EXPECT(get_class(ep.to_v6().to_v4()) == 'A');
+        ep = Endpoint(boost::asio::ip::make_address_v6(
+            boost::asio::ip::v4_mapped, AddressV4{d}));
+        BEAST_EXPECT(
+            get_class(boost::asio::ip::make_address_v4(
+                boost::asio::ip::v4_mapped, ep.to_v6())) == 'A');
         BEAST_EXPECT(!is_unspecified(ep));
         BEAST_EXPECT(!is_public(ep));
         BEAST_EXPECT(is_private(ep));
@@ -298,7 +304,8 @@ public:
         BEAST_EXPECT(!is_loopback(ep));
         BEAST_EXPECT(to_string(ep) == "166.78.151.147");
         // same address as v4 mapped in ipv6
-        ep = Endpoint(AddressV6::v4_mapped(AddressV4{d}));
+        ep = Endpoint(boost::asio::ip::make_address_v6(
+            boost::asio::ip::v4_mapped, AddressV4{d}));
         BEAST_EXPECT(!is_unspecified(ep));
         BEAST_EXPECT(is_public(ep));
         BEAST_EXPECT(!is_private(ep));

src/test/beast/StatsDCollector_test.cpp

@@ -0,0 +1,202 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2026 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <test/unit_test/SuiteJournal.h>
+
+#include <xrpl/beast/insight/StatsDCollector.h>
+#include <xrpl/beast/unit_test.h>
+
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/udp.hpp>
+
+#include <atomic>
+#include <chrono>
+#include <mutex>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace ripple {
+namespace test {
+
+// The StatsD collector was ported from io_service / strand.wrap /
+// expires_from_now to io_context / bind_executor / expires_after for Boost
+// 1.87+. Nothing exercised it before; this drives every path of the port:
+// metric posts (dispatch onto the strand), the 1 s flush tick, the UDP send,
+// and the timer-cancelling teardown.
+class StatsDCollector_test : public beast::unit_test::suite
+{
+    // A StatsD "server": a loopback UDP socket polled by its own thread.
+    struct UdpSink
+    {
+        boost::asio::io_context ioc;
+        boost::asio::ip::udp::socket socket;
+        std::mutex mutex;
+        std::string received;
+        std::atomic<bool> stopping{false};
+        std::thread thread;
+
+        UdpSink()
+            : socket(
+                  ioc,
+                  boost::asio::ip::udp::endpoint{
+                      boost::asio::ip::make_address("127.0.0.1"),
+                      0})
+        {
+            socket.non_blocking(true);
+            thread = std::thread([this] { poll(); });
+        }
+
+        ~UdpSink()
+        {
+            stopping = true;
+            thread.join();
+        }
+
+        beast::IP::Endpoint
+        endpoint() const
+        {
+            auto const local = socket.local_endpoint();
+            // IP::Address is boost::asio::ip::address itself
+            return beast::IP::Endpoint{local.address(), local.port()};
+        }
+
+        void
+        poll()
+        {
+            char buf[2048];
+            while (!stopping)
+            {
+                boost::system::error_code ec;
+                auto const n = socket.receive(boost::asio::buffer(buf), 0, ec);
+                if (!ec && n > 0)
+                {
+                    std::lock_guard lock(mutex);
+                    received.append(buf, n);
+                    received.push_back('\n');
+                }
+                else
+                {
+                    std::this_thread::sleep_for(std::chrono::milliseconds(5));
+                }
+            }
+        }
+
+        template <class Cond>
+        bool
+        waitFor(Cond cond, std::chrono::milliseconds timeout)
+        {
+            auto const deadline = std::chrono::steady_clock::now() + timeout;
+            while (std::chrono::steady_clock::now() < deadline)
+            {
+                {
+                    std::lock_guard lock(mutex);
+                    if (cond(received))
+                        return true;
+                }
+                std::this_thread::sleep_for(std::chrono::milliseconds(20));
+            }
+            std::lock_guard lock(mutex);
+            return cond(received);
+        }
+    };
+
+    static bool
+    has(std::string const& all, std::string const& s)
+    {
+        return all.find(s) != std::string::npos;
+    }
+
+    void
+    testMetricsReachServer()
+    {
+        testcase("counters, gauges, meters, events and hooks reach the server");
+        using namespace std::chrono_literals;
+
+        UdpSink sink;
+        SuiteJournal journal("StatsDCollector_test", *this);
+        std::atomic<int> hookCalls{0};
+        {
+            auto collector = beast::insight::StatsDCollector::New(
+                sink.endpoint(), "prefix", journal);
+
+            auto hook = collector->make_hook([&] { ++hookCalls; });
+            auto counter = collector->make_counter("hits");
+            auto gauge = collector->make_gauge("depth");
+            auto meter = collector->make_meter("rate");
+            auto event = collector->make_event("latency");
+
+            counter.increment(5);
+            gauge.set(42);
+            meter.increment(3);
+            event.notify(7ms);
+
+            // counters/gauges/meters flush on the collector's 1 s tick and
+            // the batch leaves in one or more datagrams; events post at once
+            // but travel with the same batch
+            bool const arrived = sink.waitFor(
+                [](std::string const& all) {
+                    return has(all, "prefix.hits:5|c") &&
+                        has(all, "prefix.depth:42|g") &&
+                        has(all, "prefix.rate:3|") &&
+                        has(all, "prefix.latency:7|ms");
+                },
+                5000ms);
+            BEAST_EXPECT(arrived);
+            if (!arrived)
+            {
+                std::lock_guard lock(sink.mutex);
+                log << "received: " << sink.received << std::endl;
+            }
+        }
+        // leaving the scope destroys the collector: it cancels its flush
+        // timer, drops its work guard and joins its io thread
+        BEAST_EXPECT(hookCalls >= 1);
+    }
+
+    void
+    testTeardownWithoutTraffic()
+    {
+        testcase("a collector with no metrics tears down promptly");
+        UdpSink sink;
+        SuiteJournal journal("StatsDCollector_test", *this);
+        auto const start = std::chrono::steady_clock::now();
+        {
+            auto collector = beast::insight::StatsDCollector::New(
+                sink.endpoint(), "idle", journal);
+            (void)collector;
+        }
+        auto const elapsed = std::chrono::steady_clock::now() - start;
+        // the destructor must not wait for the next 1 s tick
+        BEAST_EXPECT(elapsed < std::chrono::seconds(3));
+    }
+
+public:
+    void
+    run() override
+    {
+        testMetricsReachServer();
+        testTeardownWithoutTraffic();
+    }
+};
+
+BEAST_DEFINE_TESTSUITE(StatsDCollector, insight, ripple);
+
+}  // namespace test
+}  // namespace ripple

src/test/beast/beast_io_latency_probe_test.cpp

@@ -23,7 +23,8 @@
 
 #include <boost/asio/basic_waitable_timer.hpp>
 #include <boost/asio/deadline_timer.hpp>
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 
 #include <algorithm>
 #include <chrono>
@@ -62,8 +63,10 @@ class io_latency_probe_test : public beast::unit_test::suite,
         measure_asio_timers(duration interval = 100ms, size_t num_samples = 50)
         {
             using namespace std::chrono;
-            boost::asio::io_service ios;
-            std::optional<boost::asio::io_service::work> work{ios};
+            boost::asio::io_context ios;
+            std::optional<boost::asio::executor_work_guard<
+                boost::asio::io_context::executor_type>>
+                work{boost::asio::make_work_guard(ios)};
             std::thread worker{[&] { ios.run(); }};
             boost::asio::basic_waitable_timer<Clock> timer{ios};
             elapsed_times_.reserve(num_samples);
@@ -137,7 +140,7 @@ class io_latency_probe_test : public beast::unit_test::suite,
 
         test_sampler(
             std::chrono::milliseconds interval,
-            boost::asio::io_service& ios)
+            boost::asio::io_context& ios)
             : probe_(interval, ios)
         {
         }
@@ -166,9 +169,9 @@ class io_latency_probe_test : public beast::unit_test::suite,
     {
         testcase << "sample one";
         boost::system::error_code ec;
-        test_sampler io_probe{100ms, get_io_service()};
+        test_sampler io_probe{100ms, get_io_context()};
         io_probe.start_one();
-        MyTimer timer{get_io_service(), 1s};
+        MyTimer timer{get_io_context(), 1s};
         timer.async_wait(yield[ec]);
         if (!BEAST_EXPECTS(!ec, ec.message()))
             return;
@@ -200,9 +203,9 @@ class io_latency_probe_test : public beast::unit_test::suite,
                 duration_cast<milliseconds>(probe_duration).count()) /
             static_cast<size_t>(tt.getMean<milliseconds>());
 #endif
-        test_sampler io_probe{interval, get_io_service()};
+        test_sampler io_probe{interval, get_io_context()};
         io_probe.start();
-        MyTimer timer{get_io_service(), probe_duration};
+        MyTimer timer{get_io_context(), probe_duration};
         timer.async_wait(yield[ec]);
         if (!BEAST_EXPECTS(!ec, ec.message()))
             return;
@@ -214,7 +217,7 @@ class io_latency_probe_test : public beast::unit_test::suite,
         io_probe.probe_.cancel_async();
         // wait again in order to flush the remaining
         // probes from the work queue
-        timer.expires_from_now(1s);
+        timer.expires_after(1s);
         timer.async_wait(yield[ec]);
     }
 
@@ -222,7 +225,7 @@ class io_latency_probe_test : public beast::unit_test::suite,
     testCanceled(boost::asio::yield_context& yield)
     {
         testcase << "canceled";
-        test_sampler io_probe{100ms, get_io_service()};
+        test_sampler io_probe{100ms, get_io_context()};
         io_probe.probe_.cancel_async();
         except<std::logic_error>([&io_probe]() { io_probe.start_one(); });
         except<std::logic_error>([&io_probe]() { io_probe.start(); });

src/test/consensus/UNLReport_test.cpp

@@ -1203,6 +1203,96 @@ class UNLReportVoteNewValidator_test : public beast::unit_test::suite
     }
 };
 
+/*
+ * Regression test: UNLReport proposals must not be gated on the N-UNL local
+ * reliability threshold.
+ *
+ * The local node (validator 0) validates exactly `myVals` of the 256 scored
+ * ledgers, validator 1 validates none (so it is an N-UNL disable candidate and
+ * absent from the report), every other validator validates all of them.
+ *
+ * == myVals <= 128: not active ourselves -> no UNLReport, no UNLModify
+ * == 129 .. 229:    UNLReport proposed, not reliable enough to vote on N-UNL
+ * == >= 230:        UNLReport and one UNLModify (230 used to fall into the
+ *                   "Too many!" branch and fail)
+ */
+class UNLReportVoteLocalReliability_test : public beast::unit_test::suite
+{
+    void
+    testDoVoting()
+    {
+        testcase("Do Voting with local reliability below N-UNL threshold");
+
+        struct Case
+        {
+            std::uint32_t myVals;
+            bool expectReport;
+            bool expectModify;
+        };
+
+        std::array<Case, 6> const cases = {{
+            {128, false, false},
+            {129, true, false},
+            {229, true, false},
+            {230, true, true},
+            {231, true, true},
+            {256, true, true},
+        }};
+
+        for (bool const withVLImport : {true, false})
+        {
+            for (auto const& c : cases)
+            {
+                std::uint32_t const numNodes = 20;
+                URNetworkHistory history = {
+                    *this, {numNodes, 0, false, false, withVLImport, {}}};
+                BEAST_EXPECT(history.goodHistory);
+                if (!history.goodHistory)
+                    continue;
+
+                // scored ledgers are [lastSeq - 256, lastSeq - 1]
+                auto const lastSeq = history.lastLedger()->seq();
+                history.walkHistoryAndAddValidations(
+                    [&](std::shared_ptr<Ledger const> const& l,
+                        std::size_t idx) -> bool {
+                        if (idx == 1)
+                            return false;
+                        if (idx != 0)
+                            return true;
+                        return l->seq() + 256 < lastSeq + c.myVals;
+                    });
+
+                NegativeUNLVote vote(
+                    history.UNLNodeIDs[0],
+                    history.env.journal,
+                    history.env.app());
+                auto txSet = std::make_shared<SHAMap>(
+                    SHAMapType::TRANSACTION, history.env.app().getNodeFamily());
+                vote.doVoting(
+                    history.lastLedger(),
+                    history.UNLKeySet,
+                    history.validations,
+                    txSet);
+
+                std::size_t const expectReport =
+                    c.expectReport ? numNodes - 1 + (withVLImport ? 1 : 0) : 0;
+                std::size_t const expectModify = c.expectModify ? 1 : 0;
+                std::string const ctx = "myVals=" + std::to_string(c.myVals) +
+                    " withVLImport=" + std::to_string(withVLImport);
+
+                BEAST_EXPECTS(countUNLRTx(txSet) == expectReport, ctx);
+                BEAST_EXPECTS(unl::countTx(txSet) == expectModify, ctx);
+            }
+        }
+    }
+
+    void
+    run() override
+    {
+        testDoVoting();
+    }
+};
+
 BEAST_DEFINE_TESTSUITE(UNLReport, ledger, ripple);
 BEAST_DEFINE_TESTSUITE(UNLReportNoAmendment, ledger, ripple);
 BEAST_DEFINE_TESTSUITE(UNLReportFork, consensus, ripple);
@@ -1215,6 +1305,7 @@ BEAST_DEFINE_TESTSUITE_PRIO(
     ripple,
     1);
 BEAST_DEFINE_TESTSUITE(UNLReportVoteNewValidator, consensus, ripple);
+BEAST_DEFINE_TESTSUITE(UNLReportVoteLocalReliability, consensus, ripple);
 
 ///////////////////////////////////////////////////////////////////////
 ///////////////////////////////////////////////////////////////////////

src/test/core/Config_test.cpp

@@ -1102,23 +1102,24 @@ trustthesevalidators.gov
         Config cfg;
         /* NOTE: this string includes some explicit
          * space chars in order to verify proper trimming */
-        std::string toLoad(R"(
+        std::string toLoad(
+            R"(
 [port_rpc])"
-                           "\x20"
-                           R"(
+            "\x20"
+            R"(
 # comment
     # indented comment
 )"
-                           "\x20\x20"
-                           R"(
+            "\x20\x20"
+            R"(
 [ips])"
-                           "\x20"
-                           R"(
+            "\x20"
+            R"(
 r.ripple.com 51235
 
   [ips_fixed])"
-                           "\x20\x20"
-                           R"(
+            "\x20\x20"
+            R"(
     # COMMENT
     s1.ripple.com 51235
     s2.ripple.com 51235
@@ -1144,23 +1145,24 @@ r.ripple.com 51235
         Config cfg;
         /* NOTE: this string includes some explicit
          * space chars in order to verify proper trimming */
-        std::string toLoad(R"(
+        std::string toLoad(
+            R"(
 [port_rpc])"
-                           "\x20"
-                           R"(
+            "\x20"
+            R"(
 # comment
     # indented comment
 )"
-                           "\x20\x20"
-                           R"(
+            "\x20\x20"
+            R"(
 [ips])"
-                           "\x20"
-                           R"(
+            "\x20"
+            R"(
 r.ripple.com:51235
 
   [ips_fixed])"
-                           "\x20\x20"
-                           R"(
+            "\x20\x20"
+            R"(
     # COMMENT
     s1.ripple.com:51235
     s2.ripple.com 51235
@@ -1447,8 +1449,8 @@ r.ripple.com:51235
             }
         }
 
-        // Test 2: RWDB without online_delete NOT in standalone mode (should
-        // throw)
+        // Test 2: RWDB without online_delete NOT in standalone mode
+        // (now allowed — SHAMapStoreImp defaults it to ledger_history)
         {
             Config c;
             std::string toLoad =
@@ -1459,16 +1461,12 @@ r.ripple.com:51235
             try
             {
                 c.loadFromString(toLoad);
-                fail("Expected exception for RWDB without online_delete");
-            }
-            catch (std::runtime_error const& e)
-            {
-                BEAST_EXPECT(
-                    std::string(e.what()).find(
-                        "RWDB (in-memory backend) requires online_delete") !=
-                    std::string::npos);
                 pass();
             }
+            catch (std::runtime_error const&)
+            {
+                fail("Should not throw for RWDB without online_delete");
+            }
         }
 
         // Test 3: RWDB with online_delete NOT in standalone mode (should
@@ -1613,7 +1611,33 @@ r.ripple.com:51235
             }
         }
 
-        // Test 5: pinned_type without online_delete (should throw)
+        // Test 5: type=rwdb with pinned_type (should throw, even in
+        // standalone). The rwdb node store is tree-only, so pinned data
+        // would be accepted and then dropped.
+        for (bool const standalone : {false, true})
+        {
+            Config c;
+            std::string toLoad =
+                "[node_db]\n"
+                "type=rwdb\n"
+                "online_delete=256\n"
+                "pinned_type=NuDB\n"
+                "pinned_path=pinned\n";
+            c.setupControl(true, true, standalone);
+            try
+            {
+                c.loadFromString(toLoad);
+                fail("Expected exception for pinned_type with type=rwdb");
+            }
+            catch (std::runtime_error const& e)
+            {
+                BEAST_EXPECT(
+                    std::string(e.what()).find("type=rwdb") !=
+                    std::string::npos);
+            }
+        }
+
+        // Test 6: pinned_type without online_delete (should throw)
         {
             Config c;
             std::string toLoad =

src/test/jtx/AbstractClient.h

@@ -56,6 +56,13 @@ public:
     /// Get RPC 1.0 or RPC 2.0
     virtual unsigned
     version() const = 0;
+
+    /// Times invoke() replaced a connection the server had closed.
+    virtual unsigned
+    reconnects() const
+    {
+        return 0;
+    }
 };
 
 }  // namespace test

src/test/jtx/Env_test.cpp

@@ -18,6 +18,7 @@
 //==============================================================================
 
 #include <test/jtx.h>
+#include <test/jtx/JSONRPCClient.h>
 #include <xrpld/app/misc/NetworkOPs.h>
 #include <xrpld/app/misc/TxQ.h>
 #include <xrpl/beast/hash/uhash.h>
@@ -27,8 +28,16 @@
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/jss.h>
 
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/beast/core/flat_buffer.hpp>
+#include <boost/beast/http/read.hpp>
+#include <boost/beast/http/string_body.hpp>
+#include <boost/beast/http/write.hpp>
 #include <boost/lexical_cast.hpp>
+#include <chrono>
 #include <optional>
+#include <thread>
 #include <utility>
 
 namespace ripple {
@@ -906,6 +915,106 @@ public:
         pass();
     }
 
+    void
+    testJSONRPCClientKeepAlive()
+    {
+        testcase("JSON-RPC keep-alive survives test work");
+        using namespace std::chrono_literals;
+        using namespace jtx;
+
+        Env env{*this};
+        env.client().invoke("server_info", {});
+        auto const reconnects = env.client().reconnects();
+
+        // The normal loopback message timeout is three seconds. Established
+        // Env connections have a separate idle lease because test work can
+        // legitimately take longer between RPCs.
+        std::this_thread::sleep_for(4s);
+        auto const response = env.client().invoke("server_info", {});
+        BEAST_EXPECT(response[jss::result][jss::status] == "success");
+        // The server kept the connection; the client did not replace it.
+        BEAST_EXPECT(env.client().reconnects() == reconnects);
+    }
+
+    void
+    testJSONRPCClientSlowFirstRequest()
+    {
+        testcase("JSON-RPC first request survives slow test setup");
+        using namespace std::chrono_literals;
+        using namespace jtx;
+
+        Env env{*this};
+
+        // The client connects when the Env is built, and the server closes a
+        // loopback connection whose first request takes longer than
+        // BaseHTTPPeer::timeoutSecondsLocal (3 s) to arrive. Test setup can
+        // take that long on a loaded machine. Whether or not the server's
+        // timer has fired by now, the request must succeed;
+        // testJSONRPCClientReconnects covers the replacement itself.
+        std::this_thread::sleep_for(4s);
+        auto const response = env.client().invoke("server_info", {});
+        BEAST_EXPECT(response[jss::result][jss::status] == "success");
+    }
+
+    void
+    testJSONRPCClientReconnects()
+    {
+        testcase("JSON-RPC client replaces a connection the server closed");
+        using namespace boost::asio;
+        namespace http = boost::beast::http;
+
+        // A server that closes the client's first connection without
+        // answering, as BaseHTTPPeer does when the first request is late, and
+        // answers on the second.
+        io_context ioc;
+        ip::tcp::acceptor acceptor(ioc, {ip::make_address("127.0.0.1"), 0});
+        ip::tcp::socket first(ioc);
+        ip::tcp::socket second(ioc);
+        boost::beast::flat_buffer buffer;
+        http::request<http::string_body> req;
+        http::response<http::string_body> res{http::status::ok, 11};
+        res.body() = R"({"result":{"status":"success"}})";
+        res.prepare_payload();
+        acceptor.async_accept(first, [&](boost::system::error_code) {
+            boost::system::error_code ignored;
+            first.close(ignored);
+            acceptor.async_accept(second, [&](boost::system::error_code acc) {
+                if (acc)
+                    return;
+                http::async_read(
+                    second,
+                    buffer,
+                    req,
+                    [&](boost::system::error_code rd, std::size_t) {
+                        if (!rd)
+                            http::async_write(
+                                second,
+                                res,
+                                [](boost::system::error_code, std::size_t) {});
+                    });
+            });
+        });
+        std::thread server([&] { ioc.run(); });
+
+        auto cfg = jtx::envconfig();
+        (*cfg)["port_rpc"].set("ip", "127.0.0.1");
+        (*cfg)["port_rpc"].set(
+            "port", std::to_string(acceptor.local_endpoint().port()));
+        auto client = makeJSONRPCClient(*cfg);
+        try
+        {
+            auto const response = client->invoke("server_info", {});
+            BEAST_EXPECT(response[jss::result][jss::status] == "success");
+            BEAST_EXPECT(client->reconnects() == 1);
+        }
+        catch (std::exception const& e)
+        {
+            fail(e.what(), __FILE__, __LINE__);
+        }
+        ioc.stop();
+        server.join();
+    }
+
     void
     run() override
     {
@@ -933,6 +1042,9 @@ public:
         testSignAndSubmit(all);
         testFeatures(all);
         testExceptionalShutdown();
+        testJSONRPCClientKeepAlive();
+        testJSONRPCClientSlowFirstRequest();
+        testJSONRPCClientReconnects();
     }
 };
 

src/test/jtx/TrustedPublisherServer.h

@@ -180,7 +180,7 @@ public:
         bool immediateStart = true,
         int sequence = 1)
         : sock_{ioc}
-        , ep_{beast::IP::Address::from_string(
+        , ep_{boost::asio::ip::make_address(
                   ripple::test::getEnvLocalhostAddr()),
               // 0 means let OS pick the port based on what's available
               0}
@@ -281,7 +281,7 @@ public:
         acceptor_.set_option(
             boost::asio::ip::tcp::acceptor::reuse_address(true), ec);
         acceptor_.bind(ep_);
-        acceptor_.listen(boost::asio::socket_base::max_connections);
+        acceptor_.listen(boost::asio::socket_base::max_listen_connections);
         acceptor_.async_accept(
             sock_,
             [wp = std::weak_ptr<TrustedPublisherServer>{shared_from_this()}](

src/test/jtx/genesis.h

@@ -143,6 +143,25 @@ static const std::vector<uint8_t> AcceptHook = {
     0x41U, 0x00U, 0x42U, 0x00U, 0x10U, 0x81U, 0x80U, 0x80U, 0x80U, 0x00U, 0x1AU,
     0x20U, 0x01U, 0x0BU};
 
+// rollback_wasm from SetHook_test.cpp: rolls back every transaction.
+static const std::vector<uint8_t> RollbackHook = {
+    0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U, 0x13U, 0x03U,
+    0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU,
+    0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U, 0x19U, 0x02U, 0x03U,
+    0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU,
+    0x76U, 0x08U, 0x72U, 0x6FU, 0x6CU, 0x6CU, 0x62U, 0x61U, 0x63U, 0x6BU, 0x00U,
+    0x01U, 0x03U, 0x02U, 0x01U, 0x02U, 0x05U, 0x03U, 0x01U, 0x00U, 0x02U, 0x06U,
+    0x21U, 0x05U, 0x7FU, 0x01U, 0x41U, 0x90U, 0x88U, 0x04U, 0x0BU, 0x7FU, 0x00U,
+    0x41U, 0x8EU, 0x08U, 0x0BU, 0x7FU, 0x00U, 0x41U, 0x80U, 0x08U, 0x0BU, 0x7FU,
+    0x00U, 0x41U, 0x90U, 0x88U, 0x04U, 0x0BU, 0x7FU, 0x00U, 0x41U, 0x80U, 0x08U,
+    0x0BU, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x02U,
+    0x0AU, 0xA1U, 0x80U, 0x00U, 0x01U, 0x9DU, 0x80U, 0x00U, 0x00U, 0x41U, 0x01U,
+    0x41U, 0x01U, 0x10U, 0x80U, 0x80U, 0x80U, 0x80U, 0x00U, 0x1AU, 0x41U, 0x80U,
+    0x88U, 0x80U, 0x80U, 0x00U, 0x41U, 0x0EU, 0x42U, 0x00U, 0x10U, 0x81U, 0x80U,
+    0x80U, 0x80U, 0x00U, 0x0BU, 0x0BU, 0x15U, 0x01U, 0x00U, 0x41U, 0x80U, 0x08U,
+    0x0BU, 0x0EU, 0x48U, 0x6FU, 0x6FU, 0x6BU, 0x20U, 0x52U, 0x65U, 0x6AU, 0x65U,
+    0x63U, 0x74U, 0x65U, 0x64U, 0x00U};
+
 struct GenMint
 {
     std::optional<std::string> dest;

src/test/jtx/impl/AMM.cpp

@@ -141,7 +141,9 @@ AMM::create(
     if (fee_ != 0)
         jv[sfFee] = std::to_string(fee_);
     else
-        jv[jss::Fee] = std::to_string(env_.current()->fees().increment.drops());
+        jv[jss::Fee] = std::to_string(
+            env_.current()->fees().increment.drops() +
+            env_.current()->fees().base.drops());
     submit(jv, seq, ter);
 
     if (!ter || env_.ter() == tesSUCCESS)