Merge branch 'dev' into export_v2

Co-authored-by: Niq Dudfield <ndudfield@gmail.com>

.codecov.yml

@@ -19,6 +19,15 @@ coverage:
       default:
         target: auto
         threshold: 2%
+        paths:
+          # PeerImp is historically hard to exercise in the current unit-test
+          # harness. Keep this list narrow; new testable code should remain
+          # covered by the default patch gate.
+          - "!src/xrpld/overlay/detail/PeerImp.cpp"
+      historically-untested:
+        target: 0%
+        paths:
+          - "src/xrpld/overlay/detail/PeerImp.cpp"
     changes: false
 
 github_checks:

.github/actions/xahau-ga-dependencies/action.yml

@@ -50,6 +50,10 @@ inputs:
     options:
       - libstdcxx
       - libcxx
+  conan_deps_cxxflags:
+    description: 'Extra cxxflags applied to Conan dependency package builds only (NOT the rippled build). JSON object keyed by Conan package pattern, e.g. {"grpc/*":["-Wno-foo"]}. Maps to <pattern>:tools.build:cxxflags.'
+    required: false
+    default: '{}'
 
 outputs:
   cache-hit:
@@ -81,6 +85,8 @@ runs:
 
     - name: Configure Conan
       shell: bash
+      env:
+        CONAN_DEPS_CXXFLAGS: ${{ inputs.conan_deps_cxxflags }}
       run: |
         # Create the default profile directory if it doesn't exist
         mkdir -p ~/.conan2/profiles
@@ -105,7 +111,14 @@ runs:
         os=${{ inputs.os }}
         EOF
 
-        # Add buildenv and conf sections for Linux (not needed for macOS)
+        # [buildenv] + [conf] sections.
+        # Linux pins compiler executables; macOS uses the system toolchain.
+        # conan_deps_cxxflags (matrix-driven) optionally adds package-pattern
+        # scoped tools.build:cxxflags for Conan dependency builds only - typically
+        # grpc workarounds for newer clang's stricter diagnostics. Because these
+        # are profile-pattern scoped (e.g. grpc/*:...), they do NOT affect the
+        # consumer/rippled toolchain generated for the main build.
+        NEED_CONF=0
         if [ "${{ inputs.os }}" = "Linux" ] && [ -n "${{ inputs.cc }}" ]; then
           cat >> ~/.conan2/profiles/default <<EOF
 
@@ -116,16 +129,38 @@ runs:
         [conf]
         tools.build:compiler_executables={"c": "/usr/bin/${{ inputs.cc }}", "cpp": "/usr/bin/${{ inputs.cxx }}"}
         EOF
+          NEED_CONF=1
         fi
 
-        # Add macOS-specific conf if needed
-        if [ "${{ inputs.os }}" = "Macos" ]; then
-          cat >> ~/.conan2/profiles/default <<EOF
+        if [ -n "${CONAN_DEPS_CXXFLAGS}" ] && [ "${CONAN_DEPS_CXXFLAGS}" != "{}" ]; then
+          CONAN_DEPS_CXXFLAGS_LINES="$(python3 - <<'PY'
+        import json
+        import os
+        import sys
 
-        [conf]
-        # Workaround for gRPC with newer Apple Clang
-        tools.build:cxxflags=["-Wno-missing-template-arg-list-after-template-kw"]
-        EOF
+        raw = os.environ["CONAN_DEPS_CXXFLAGS"]
+        data = json.loads(raw)
+        if not isinstance(data, dict):
+            sys.exit("conan_deps_cxxflags must be a JSON object like {\"grpc/*\": [\"-Wno-...\"]}")
+
+        for pattern, flags in data.items():
+            if not isinstance(pattern, str) or not pattern:
+                sys.exit("conan_deps_cxxflags keys must be non-empty Conan package patterns")
+            if pattern == "&":
+                sys.exit("conan_deps_cxxflags must target dependency package patterns, not the consumer (&)")
+            if not isinstance(flags, list) or not all(isinstance(flag, str) for flag in flags):
+                sys.exit(f"{pattern}: cxxflags must be a JSON string list")
+            if flags:
+                print(f"{pattern}:tools.build:cxxflags={json.dumps(flags, separators=(',', ':'))}")
+        PY
+          )"
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ] && [ "$NEED_CONF" = "0" ]; then
+            echo "" >> ~/.conan2/profiles/default
+            echo "[conf]" >> ~/.conan2/profiles/default
+          fi
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ]; then
+            printf '%s\n' "${CONAN_DEPS_CXXFLAGS_LINES}" >> ~/.conan2/profiles/default
+          fi
         fi
 
         # Display profile for verification

.github/workflows/build-in-docker.yml

@@ -15,6 +15,9 @@ env:
 
 jobs:
   checkout:
+    # build publishes to build.xahau.tech, so this workflow only runs from
+    # Xahau/xahaud. build and tests are skipped along with this job.
+    if: github.repository == 'Xahau/xahaud'
     runs-on: [self-hosted, vanity]
     outputs:
       checkout_path: ${{ steps.vars.outputs.checkout_path }}
@@ -86,10 +89,16 @@ jobs:
   cleanup:
     runs-on: [self-hosted, xahaud-build]
     needs: [tests, checkout]
-    if: always()
+    if: always() && github.repository == 'Xahau/xahaud'
     steps:
       - name: Cleanup workspace
         run: |
           CHECKOUT_PATH="${{ needs.checkout.outputs.checkout_path }}"
+          # A run cancelled before checkout has no path; an empty one would
+          # make the rm below delete every run's checkout on the runner.
+          if [[ -z "${CHECKOUT_PATH}" ]]; then
+            echo "No checkout path (cancelled before checkout); nothing to clean"
+            exit 0
+          fi
           echo "Cleaning workspace for ${CHECKOUT_PATH}"
           rm -rf "${{ github.workspace }}/${CHECKOUT_PATH}"

.github/workflows/check-genesis-hooks.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           # Download install.sh
           curl -o /tmp/wasienv-install.sh https://raw.githubusercontent.com/wasienv/wasienv/master/install.sh
-
+          
           # Replace /bin to /local/bin
           sed -i 's|/bin|/local/bin|g' /tmp/wasienv-install.sh
 

.github/workflows/verify-generated-headers.yml

@@ -16,8 +16,6 @@ jobs:
             generator: ./hook/generate_extern.sh
           - target: hook/sfcodes.h
             generator: bash ./hook/generate_sfcodes.sh
-          - target: hook/genesis/headers/sfcodes.h
-            generator: bash ./hook/generate_sfcodes.sh
           - target: hook/tts.h
             generator: ./hook/generate_tts.sh
           - target: hook/ls_flags.h

.github/workflows/xahau-ga-macos.yml

@@ -107,6 +107,9 @@ jobs:
           compiler: apple-clang
           compiler_version: ${{ steps.detect-compiler.outputs.compiler_version }}
           stdlib: libcxx
+          # grpc 1.50.1 trips clang-19+ -Werror=missing-template-arg-list-after-template-kw
+          # on Apple Clang. Drop when grpc is bumped past the fix.
+          conan_deps_cxxflags: '{"grpc/*":["-Wno-missing-template-arg-list-after-template-kw"]}'
 
       - name: Build
         uses: ./.github/actions/xahau-ga-build

.github/workflows/xahau-ga-nix.yml

@@ -8,12 +8,6 @@ on:
     types: [opened, synchronize, reopened, labeled, unlabeled]
   schedule:
     - cron: '0 0 * * *'
-  workflow_dispatch:
-    inputs:
-      full_matrix:
-        description: "Force full matrix (6 configs)"
-        required: false
-        default: "false"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,37 +24,14 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - name: escape double quotes
-        id: escape
-        shell: bash
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          ESCAPED_PR_TITLE="${PR_TITLE//\"/\\\"}"
-          echo "title=${ESCAPED_PR_TITLE}" >> "$GITHUB_OUTPUT"
       - name: Generate build matrix
         id: set-matrix
         shell: python
-        env:
-          GH_TOKEN: ${{ github.token }}
         run: |
           import json
           import os
-          import urllib.request
 
-          # Full matrix with all 6 compiler configurations
-          # Each configuration includes all parameters needed by the build job
-          full_matrix = [
-              {
-                  "compiler_id": "gcc-11-libstdcxx",
-                  "compiler": "gcc",
-                  "cc": "gcc-11",
-                  "cxx": "g++-11",
-                  "compiler_version": 11,
-                  "stdlib": "default",
-                  "configuration": "Debug",
-                  "job_type": "build"
-              },
+          matrix = [
               {
                   "compiler_id": "gcc-13-libstdcxx",
                   "compiler": "gcc",
@@ -72,26 +43,26 @@ jobs:
                   "job_type": "build"
               },
               {
-                  "compiler_id": "gcc-13-libstdcxx",
-                  "compiler": "gcc",
-                  "cc": "gcc-13",
-                  "cxx": "g++-13",
-                  "gcov": "gcov-13",
-                  "compiler_version": 13,
-                  "stdlib": "default",
-                  "configuration": "Debug",
-                  "job_type": "coverage"
-              },
-              {
-                  "compiler_id": "clang-14-libstdcxx-gcc11",
+                  # Latest stable Clang for the most accurate source-based
+                  # coverage mapping (newer language features, fewer bugs in
+                  # llvm-cov region inference). Pulled from apt.llvm.org since
+                  # Ubuntu 24.04 default repos cap at clang-18.
+                  "compiler_id": "clang-20-libcxx",
                   "compiler": "clang",
-                  "cc": "clang-14",
-                  "cxx": "clang++-14",
-                  "compiler_version": 14,
-                  "stdlib": "libstdcxx",
-                  "clang_gcc_toolchain": 11,
+                  "cc": "clang-20",
+                  "cxx": "clang++-20",
+                  "compiler_version": 20,
+                  "stdlib": "libcxx",
                   "configuration": "Debug",
-                  "job_type": "build"
+                  "job_type": "coverage",
+                  "coverage_tool": "llvm",
+                  "coverage_format": "lcov",
+                  # grpc 1.50.1 uses `Foo::template Bar(...)` without an
+                  # angle-bracket arg list; clang-19+ promoted that to
+                  # -Werror. Drop when grpc is bumped past the fix.
+                  "conan_deps_cxxflags": {
+                      "grpc/*": ["-Wno-missing-template-arg-list-after-template-kw"]
+                  }
               },
               {
                   "compiler_id": "clang-16-libstdcxx-gcc13",
@@ -103,117 +74,8 @@ jobs:
                   "clang_gcc_toolchain": 13,
                   "configuration": "Debug",
                   "job_type": "build"
-              },
-              {
-                  "compiler_id": "clang-17-libcxx",
-                  "compiler": "clang",
-                  "cc": "clang-17",
-                  "cxx": "clang++-17",
-                  "compiler_version": 17,
-                  "stdlib": "libcxx",
-                  "configuration": "Debug",
-                  "job_type": "build"
-              },
-              {
-                  # Clang 18 - testing if it's faster than Clang 17 with libc++
-                  # Requires patching Conan v1 settings.yml to add version 18
-                  "compiler_id": "clang-18-libcxx",
-                  "compiler": "clang",
-                  "cc": "clang-18",
-                  "cxx": "clang++-18",
-                  "compiler_version": 18,
-                  "stdlib": "libcxx",
-                  "configuration": "Debug",
-                  "job_type": "build"
               }
           ]
-          
-          # Minimal matrix for PRs and feature branches
-          minimal_matrix = [
-              full_matrix[1],  # gcc-13 (middle-ground gcc)
-              full_matrix[2],  # gcc-13 coverage
-              full_matrix[3]   # clang-14 (mature, stable clang)
-          ]
-          
-          # Determine which matrix to use based on the target branch
-          ref = "${{ github.ref }}"
-          base_ref = "${{ github.base_ref }}"  # For PRs, this is the target branch
-          event_name = "${{ github.event_name }}"
-          pr_title = """${{ steps.escape.outputs.title }}"""
-          pr_labels = """${{ join(github.event.pull_request.labels.*.name, ',') }}"""
-          pr_head_sha = "${{ github.event.pull_request.head.sha }}"
-
-          # Get commit message - for PRs, fetch via API since head_commit.message is empty
-          if event_name == "pull_request" and pr_head_sha:
-              try:
-                  url = f"https://api.github.com/repos/${{ github.repository }}/commits/{pr_head_sha}"
-                  req = urllib.request.Request(url, headers={
-                      "Accept": "application/vnd.github.v3+json",
-                      "Authorization": f"Bearer {os.environ.get('GH_TOKEN', '')}"
-                  })
-                  with urllib.request.urlopen(req) as response:
-                      data = json.load(response)
-                      commit_message = data["commit"]["message"]
-              except Exception as e:
-                  print(f"Failed to fetch commit message: {e}")
-                  commit_message = ""
-          else:
-              commit_message = """${{ github.event.head_commit.message }}"""
-
-          # Debug logging
-          print(f"Event: {event_name}")
-          print(f"Ref: {ref}")
-          print(f"Base ref: {base_ref}")
-          print(f"PR head SHA: {pr_head_sha}")
-          print(f"PR title: {pr_title}")
-          print(f"PR labels: {pr_labels}")
-          print(f"Commit message: {commit_message}")
-          
-          # Manual trigger input to force full matrix.
-          manual_full = "${{ github.event.inputs.full_matrix || 'false' }}" == "true"
-
-          # Label/manual overrides, while preserving existing title/commit behavior.
-          force_full = (
-              manual_full
-              or "[ci-nix-full-matrix]" in commit_message
-              or "[ci-nix-full-matrix]" in pr_title
-              or ("ci-full-build" in pr_labels and "ci-nix-full-matrix" in pr_labels)
-          )
-          force_min = (
-              "ci-full-build" in pr_labels
-          )
-          print(f"Force full matrix: {force_full}")
-          print(f"Force min matrix: {force_min}")
-          
-          # Check if this is targeting a main branch
-          # For PRs: check base_ref (target branch)
-          # For pushes: check ref (current branch)
-          main_branches = ["refs/heads/dev", "refs/heads/release", "refs/heads/candidate"]
-          
-          if force_full:
-              # Override: always use full matrix if forced by manual input or label.
-              use_full = True
-          elif force_min:
-              # Override: always use minimal matrix if ci-full-build label is present.
-              use_full = False
-          elif event_name == "pull_request":
-              # For PRs, base_ref is just the branch name (e.g., "dev", not "refs/heads/dev")
-              # Check if the PR targets release or candidate (more critical branches)
-              use_full = base_ref in ["release", "candidate"]
-          else:
-              # For pushes, ref is the full reference (e.g., "refs/heads/dev")
-              use_full = ref in main_branches
-          
-          # Select the appropriate matrix
-          if use_full:
-              if force_full:
-                  print(f"Using FULL matrix (7 configs) - forced by [ci-nix-full-matrix] tag")
-              else:
-                  print(f"Using FULL matrix (7 configs) - targeting main branch")
-              matrix = full_matrix
-          else:
-              print(f"Using MINIMAL matrix (3 configs) - feature branch/PR")
-              matrix = minimal_matrix
 
           # Add runs_on based on job_type
           for entry in matrix:
@@ -257,9 +119,25 @@ jobs:
 
       - name: Install build dependencies
         run: |
+          # Bump apt's default 3 retries; papers over short upstream blips
+          # like the recurring ppa.launchpadcontent.net outages.
+          echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
           apt-get update
           apt-get install -y software-properties-common
           add-apt-repository ppa:ubuntu-toolchain-r/test -y
+
+          # apt.llvm.org for Clang versions newer than what Ubuntu 24.04 ships
+          # (24.04 default repos cap at clang-18). The bootstrap script adds
+          # the LLVM apt source for the requested version and runs apt-get update.
+          if [ "${{ matrix.compiler }}" = "clang" ] && [ "${{ matrix.compiler_version }}" -ge 19 ]; then
+            apt-get install -y wget gnupg lsb-release
+            wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+            chmod +x /tmp/llvm.sh
+            # `all` installs clang + libllvm + lldb + lld + the llvm-N package
+            # (which provides llvm-profdata-N / llvm-cov-N for coverage runs).
+            /tmp/llvm.sh ${{ matrix.compiler_version }} all
+          fi
+
           apt-get update
           apt-get install -y git python3 python-is-python3 pipx
           pipx ensurepath
@@ -332,10 +210,16 @@ jobs:
           pipx install "conan>=2.0,<3"
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
-          # Install gcovr for coverage jobs
+          # Install coverage tooling
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
-            pipx install "gcovr>=7,<9"
             apt-get install -y curl lcov
+            if [ "${{ matrix.coverage_tool }}" = "llvm" ]; then
+              # Native LLVM source-based coverage: llvm-profdata + llvm-cov.
+              # The clang-N package doesn't pull these in; the llvm-N package does.
+              apt-get install -y "llvm-${{ matrix.compiler_version }}"
+            else
+              pipx install "gcovr>=7,<9"
+            fi
           fi
 
       - name: Check environment
@@ -348,10 +232,15 @@ jobs:
           which ${{ matrix.cxx }} && ${{ matrix.cxx }} --version || echo "${{ matrix.cxx }} not found"
           which ccache && ccache --version || echo "ccache not found"
 
-          # Check gcovr for coverage jobs
+          # Check coverage tooling
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
-            which gcov && gcov --version || echo "gcov not found"
-            which gcovr && gcovr --version || echo "gcovr not found"
+            if [ "${{ matrix.coverage_tool }}" = "llvm" ]; then
+              which "llvm-profdata-${{ matrix.compiler_version }}" && "llvm-profdata-${{ matrix.compiler_version }}" --version || echo "llvm-profdata not found"
+              which "llvm-cov-${{ matrix.compiler_version }}" && "llvm-cov-${{ matrix.compiler_version }}" --version || echo "llvm-cov not found"
+            else
+              which gcov && gcov --version || echo "gcov not found"
+              which gcovr && gcovr --version || echo "gcovr not found"
+            fi
           fi
 
           echo "---- Full Environment ----"
@@ -378,6 +267,7 @@ jobs:
           cc: ${{ matrix.cc }}
           cxx: ${{ matrix.cxx }}
           stdlib: ${{ matrix.stdlib }}
+          conan_deps_cxxflags: ${{ matrix.conan_deps_cxxflags && toJson(matrix.conan_deps_cxxflags) || '{}' }}
           gha_cache_enabled: 'false' # Disable caching for self hosted runner
 
       - name: Build
@@ -410,8 +300,9 @@ jobs:
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
           stdlib: ${{ matrix.stdlib }}
-          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness
-          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
+          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness.
+          # Use *_FLAGS_DEBUG so the build action's stdlib flag (e.g. -stdlib=libc++) in CMAKE_CXX_FLAGS isn't clobbered.
+          cmake-args: '-Dcoverage=ON -Dcoverage_tool=${{ matrix.coverage_tool }} -Dcoverage_format=${{ matrix.coverage_format }} -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS_DEBUG="-g -O0" -DCMAKE_C_FLAGS_DEBUG="-g -O0"'
           cmake-target: 'coverage'
           ccache_max_size: '100G'
 
@@ -443,22 +334,26 @@ jobs:
       - name: Move coverage report
         if: matrix.job_type == 'coverage'
         shell: bash
+        env:
+          COVERAGE_FILE: ${{ matrix.coverage_tool == 'llvm' && 'coverage.lcov' || 'coverage.xml' }}
         run: |
-          mv "${{ env.build_dir }}/coverage.xml" ./
+          mv "${{ env.build_dir }}/${COVERAGE_FILE}" ./
+          echo "COVERAGE_FILE=${COVERAGE_FILE}" >> "$GITHUB_ENV"
 
       - name: Archive coverage report
         if: matrix.job_type == 'coverage'
         uses: actions/upload-artifact@v4
         with:
-          name: coverage.xml
-          path: coverage.xml
+          name: ${{ env.COVERAGE_FILE }}-${{ matrix.compiler_id }}
+          path: ${{ env.COVERAGE_FILE }}
           retention-days: 30
 
       - name: Upload coverage report
-        if: matrix.job_type == 'coverage'
+        if: matrix.job_type == 'coverage' && github.repository == 'Xahau/xahaud'
         uses: codecov/codecov-action@v5
         with:
-          files: coverage.xml
+          files: ${{ env.COVERAGE_FILE }}
+          flags: ${{ matrix.coverage_tool }}
           fail_ci_if_error: true
           disable_search: true
           verbose: true

Builds/levelization/results/loops.txt

@@ -26,7 +26,7 @@ Loop: xrpld.app xrpld.nodestore
   xrpld.app > xrpld.nodestore
 
 Loop: xrpld.app xrpld.overlay
-  xrpld.overlay == xrpld.app
+  xrpld.overlay ~= xrpld.app
 
 Loop: xrpld.app xrpld.peerfinder
   xrpld.app > xrpld.peerfinder

Builds/levelization/results/ordering.txt

@@ -12,7 +12,6 @@ libxrpl.server > xrpl.basics
 libxrpl.server > xrpl.json
 libxrpl.server > xrpl.protocol
 libxrpl.server > xrpl.server
-test.app > test.shamap
 test.app > test.toplevel
 test.app > test.unit_test
 test.app > xrpl.basics
@@ -22,7 +21,6 @@ test.app > xrpld.ledger
 test.app > xrpld.nodestore
 test.app > xrpld.overlay
 test.app > xrpld.rpc
-test.app > xrpld.shamap
 test.app > xrpl.hook
 test.app > xrpl.json
 test.app > xrpl.protocol
@@ -34,11 +32,11 @@ test.basics > xrpld.perflog
 test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
+test.beast > test.unit_test
 test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpld.conditions
 test.consensus > test.csf
-test.consensus > test.jtx
 test.consensus > test.toplevel
 test.consensus > test.unit_test
 test.consensus > xrpl.basics
@@ -46,9 +44,6 @@ test.consensus > xrpld.app
 test.consensus > xrpld.consensus
 test.consensus > xrpld.core
 test.consensus > xrpld.ledger
-test.consensus > xrpld.overlay
-test.consensus > xrpld.shamap
-test.consensus > xrpl.json
 test.consensus > xrpl.protocol
 test.core > test.jtx
 test.core > test.toplevel
@@ -101,6 +96,7 @@ test.overlay > test.toplevel
 test.overlay > test.unit_test
 test.overlay > xrpl.basics
 test.overlay > xrpld.app
+test.overlay > xrpld.core
 test.overlay > xrpld.overlay
 test.overlay > xrpld.peerfinder
 test.overlay > xrpld.shamap
@@ -196,6 +192,7 @@ xrpld.overlay > xrpl.basics
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
 xrpld.overlay > xrpld.perflog
+xrpld.overlay > xrpld.shamap
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource

CMakeLists.txt

@@ -21,11 +21,7 @@ endif()
 project (xrpl)
 set(Boost_NO_BOOST_CMAKE ON)
 
-# Only sources that expose Git metadata should rebuild when HEAD changes.
-set(git_info_sources
-    "${CMAKE_CURRENT_SOURCE_DIR}/src/xrpld/app/main/Main.cpp"
-    "${CMAKE_CURRENT_SOURCE_DIR}/src/xrpld/app/misc/NetworkOPs.cpp")
-
+# make GIT_COMMIT_HASH define available to all sources
 find_package(Git)
 if(Git_FOUND)
     execute_process(COMMAND ${GIT_EXECUTABLE} --git-dir=${CMAKE_CURRENT_SOURCE_DIR}/.git rev-parse HEAD
@@ -33,8 +29,7 @@ if(Git_FOUND)
     if(gch)
         set(GIT_COMMIT_HASH "${gch}")
         message(STATUS gch: ${GIT_COMMIT_HASH})
-        set_property(SOURCE ${git_info_sources} APPEND PROPERTY
-            COMPILE_DEFINITIONS "GIT_COMMIT_HASH=\"${GIT_COMMIT_HASH}\"")
+        add_definitions(-DGIT_COMMIT_HASH="${GIT_COMMIT_HASH}")
     endif()
 
     execute_process(COMMAND ${GIT_EXECUTABLE} --git-dir=${CMAKE_CURRENT_SOURCE_DIR}/.git rev-parse --abbrev-ref HEAD
@@ -42,8 +37,7 @@ if(Git_FOUND)
     if(gb)
         set(GIT_BRANCH "${gb}")
         message(STATUS gb: ${GIT_BRANCH})
-        set_property(SOURCE ${git_info_sources} APPEND PROPERTY
-            COMPILE_DEFINITIONS "GIT_BRANCH=\"${GIT_BRANCH}\"")
+        add_definitions(-DGIT_BRANCH="${GIT_BRANCH}")
     endif()
 endif() #git
 

README.md

@@ -2,7 +2,7 @@
 
 **Note:** Throughout this README, references to "we" or "our" pertain to the community and contributors involved in the Xahau network. It does not imply a legal entity or a specific collection of individuals.
 
-[Xahau](https://xahau.network/) is a decentralized cryptographic ledger that builds upon the robust foundation of the XRP Ledger. It inherits the XRP Ledger's Byzantine Fault Tolerant consensus algorithm under the normal XRPL assumptions about configured validator-list overlap, timing, and fault bounds, and enhances it with additional features and functionalities. Developers and users familiar with the XRP Ledger will find that most documentation and tutorials available on [xrpl.org](https://xrpl.org) are relevant and applicable to Xahau, including those related to running validators and managing validator keys. For Xahau specific documentation you can visit our [documentation](https://xahau.network/)
+[Xahau](https://xahau.network/) is a decentralized cryptographic ledger that builds upon the robust foundation of the XRP Ledger. It inherits the XRP Ledger's Byzantine Fault Tolerant consensus algorithm and enhances it with additional features and functionalities. Developers and users familiar with the XRP Ledger will find that most documentation and tutorials available on [xrpl.org](https://xrpl.org) are relevant and applicable to Xahau, including those related to running validators and managing validator keys. For Xahau specific documentation you can visit our [documentation](https://xahau.network/)
 
 ## XAH
 XAH is the public, counterparty-free asset native to Xahau and functions primarily as network gas. Transactions submitted to the Xahau network must supply an appropriate amount of XAH, to be burnt by the network as a fee, in order to be successfully included in a validated ledger. In addition, XAH also acts as a bridge currency within the Xahau DEX. XAH is traded on the open-market and is available for anyone to access. Xahau was created in 2023 with a supply of 600 million units of XAH.

cfg/xahaud-example.cfg

@@ -727,6 +727,38 @@
 #
 #
 #
+# [export_key_file]
+#
+#   Where a validator keeps its export keys (featureExport), the keys it uses
+#   to multisign transactions hooks export to other networks. Defaults to
+#   export_keys.txt in [database_path]. The validator generates and rotates
+#   the keys itself, keeping each for as long as its account lists it on
+#   ledger, so this file is as sensitive as the validator token and should be
+#   backed up. Servers that take turns validating with the same token must
+#   share it, or each will replace the other's current export key.
+#
+#   Example:
+#    /var/lib/xahaud/export_keys.txt
+#
+#
+#
+# [xrpl_relay]
+#
+#   Carries exports (featureExport) to the XRPL and their results back: one
+#   XRPL peer per "host [port]" line (port defaults to 51235). Exports whose
+#   UNL signatures meet the exporter's quorum are sent to XRPL, and XRPL
+#   transactions returning an export are imported here as XPOPs. The XRPL UNL
+#   comes from validator lists signed by an [import_vl_keys] or voted import
+#   key, relayed by the peer or fetched from the optional vl_url. Set
+#   network_id when the XRPL network is not mainnet.
+#
+#   Example:
+#    s1.ripple.com 51235
+#    s2.ripple.com
+#    vl_url=https://vl.ripple.com
+#
+#
+#
 # [validator_key_revocation]
 #
 #   If a validator's secret key has been compromised, a revocation must be

cmake/CodeCoverageLLVM.cmake

@@ -0,0 +1,156 @@
+#[===================================================================[
+  Native LLVM source-based code coverage helper.
+
+  Drives the -fprofile-instr-generate / -fcoverage-mapping pipeline:
+    1. Run instrumented binary with LLVM_PROFILE_FILE=...%m-%p.profraw
+    2. llvm-profdata merge -sparse  -> coverage.profdata
+    3. llvm-cov export/show/report  -> final report
+
+  Output filename per coverage_format:
+    lcov              -> coverage.lcov
+    json              -> coverage.json
+    txt | text        -> coverage.txt
+    html | html-details -> <NAME>/index.html
+#]===================================================================]
+
+include(CMakeParseArguments)
+
+# Locate llvm-profdata / llvm-cov, preferring versioned variants matching the
+# Clang we're building with so we don't accidentally pair clang-20 with
+# llvm-cov-14 (profile format mismatch -> hard failure).
+function(_find_llvm_cov_tools)
+  if(LLVM_PROFDATA_PATH AND LLVM_COV_PATH)
+    return()
+  endif()
+
+  string(REGEX MATCH "^[0-9]+" _major "${CMAKE_CXX_COMPILER_VERSION}")
+
+  set(_pd_names llvm-profdata)
+  set(_cov_names llvm-cov)
+  if(_major)
+    list(PREPEND _pd_names "llvm-profdata-${_major}")
+    list(PREPEND _cov_names "llvm-cov-${_major}")
+  endif()
+
+  # Only delegate to xcrun when the *compiler* is AppleClang. On macOS with
+  # Homebrew/system clang-N, xcrun would resolve to Xcode's llvm tools which
+  # could be a different version - exactly the mismatch we want to avoid.
+  if(APPLE AND CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
+    execute_process(COMMAND xcrun -f llvm-profdata
+      OUTPUT_VARIABLE _pd_xcrun OUTPUT_STRIP_TRAILING_WHITESPACE
+      ERROR_QUIET RESULT_VARIABLE _pd_rc)
+    if(_pd_rc EQUAL 0 AND _pd_xcrun)
+      set(LLVM_PROFDATA_PATH "${_pd_xcrun}" CACHE FILEPATH "llvm-profdata" FORCE)
+    endif()
+    execute_process(COMMAND xcrun -f llvm-cov
+      OUTPUT_VARIABLE _cov_xcrun OUTPUT_STRIP_TRAILING_WHITESPACE
+      ERROR_QUIET RESULT_VARIABLE _cov_rc)
+    if(_cov_rc EQUAL 0 AND _cov_xcrun)
+      set(LLVM_COV_PATH "${_cov_xcrun}" CACHE FILEPATH "llvm-cov" FORCE)
+    endif()
+  endif()
+
+  if(NOT LLVM_PROFDATA_PATH)
+    find_program(LLVM_PROFDATA_PATH NAMES ${_pd_names})
+  endif()
+  if(NOT LLVM_COV_PATH)
+    find_program(LLVM_COV_PATH NAMES ${_cov_names})
+  endif()
+endfunction()
+
+function(setup_target_for_coverage_llvm)
+  set(oneValueArgs NAME FORMAT)
+  set(multiValueArgs EXCLUDE EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+  cmake_parse_arguments(Cov "" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
+
+  _find_llvm_cov_tools()
+  if(NOT LLVM_PROFDATA_PATH)
+    message(FATAL_ERROR "llvm-profdata not found (needed for coverage_tool=llvm)")
+  endif()
+  if(NOT LLVM_COV_PATH)
+    message(FATAL_ERROR "llvm-cov not found (needed for coverage_tool=llvm)")
+  endif()
+
+  if(NOT Cov_FORMAT)
+    set(Cov_FORMAT lcov)
+  endif()
+
+  set(_profraw_dir "${PROJECT_BINARY_DIR}/${Cov_NAME}-profraw")
+  set(_profdata    "${PROJECT_BINARY_DIR}/${Cov_NAME}.profdata")
+
+  # Resolve binary path: accept either an absolute path or a bare target name
+  # (resolved against PROJECT_BINARY_DIR). Splice the resolved path back into
+  # Cov_EXECUTABLE so the run command invokes it via absolute path - bare
+  # names aren't on PATH and the build dir isn't `.` either.
+  list(GET Cov_EXECUTABLE 0 _exec_name)
+  if(IS_ABSOLUTE "${_exec_name}")
+    set(_binary "${_exec_name}")
+  else()
+    set(_binary "${PROJECT_BINARY_DIR}/${_exec_name}")
+    list(REMOVE_AT Cov_EXECUTABLE 0)
+    list(PREPEND Cov_EXECUTABLE "${_binary}")
+  endif()
+
+  # llvm-cov takes a single -ignore-filename-regex; OR our excludes together.
+  set(_ignore_regex "")
+  foreach(EXC IN LISTS Cov_EXCLUDE)
+    if(_ignore_regex)
+      string(APPEND _ignore_regex "|")
+    endif()
+    string(APPEND _ignore_regex "${EXC}")
+  endforeach()
+  set(_filter "")
+  if(_ignore_regex)
+    set(_filter "-ignore-filename-regex='${_ignore_regex}'")
+  endif()
+
+  # Pick llvm-cov subcommand + output file for the requested format. Each
+  # branch builds a single shell command string that we'll hand to bash -c.
+  if(Cov_FORMAT STREQUAL "lcov")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.lcov")
+    set(_report_sh "${LLVM_COV_PATH} export -instr-profile='${_profdata}' -format=lcov ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "json")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.json")
+    set(_report_sh "${LLVM_COV_PATH} export -instr-profile='${_profdata}' -format=text ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "txt" OR Cov_FORMAT STREQUAL "text")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.txt")
+    set(_report_sh "${LLVM_COV_PATH} report -instr-profile='${_profdata}' ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "html" OR Cov_FORMAT STREQUAL "html-details")
+    set(_output "${PROJECT_BINARY_DIR}/${Cov_NAME}/index.html")
+    set(_report_sh "${LLVM_COV_PATH} show -instr-profile='${_profdata}' -format=html -output-dir='${PROJECT_BINARY_DIR}/${Cov_NAME}' ${_filter} '${_binary}'")
+  else()
+    message(FATAL_ERROR "coverage_tool=llvm: unsupported coverage_format '${Cov_FORMAT}' (use lcov|json|txt|html)")
+  endif()
+
+  set(_merge_sh "${LLVM_PROFDATA_PATH} merge -sparse -o '${_profdata}' '${_profraw_dir}'/*.profraw")
+
+  if(CODE_COVERAGE_VERBOSE)
+    message(STATUS "[coverage:llvm] binary:   ${_binary}")
+    message(STATUS "[coverage:llvm] profraw:  ${_profraw_dir}")
+    message(STATUS "[coverage:llvm] profdata: ${_profdata}")
+    message(STATUS "[coverage:llvm] format:   ${Cov_FORMAT}")
+    message(STATUS "[coverage:llvm] output:   ${_output}")
+    if(_ignore_regex)
+      message(STATUS "[coverage:llvm] ignore:   ${_ignore_regex}")
+    endif()
+    message(STATUS "[coverage:llvm] merge:    ${_merge_sh}")
+    message(STATUS "[coverage:llvm] report:   ${_report_sh}")
+  endif()
+
+  # %m: hash of the binary, %p: pid. Wipe the dir up front so stale profraw
+  # files can't leak into a fresh merge.
+  add_custom_target(${Cov_NAME}
+    COMMAND ${CMAKE_COMMAND} -E rm -rf "${_profraw_dir}"
+    COMMAND ${CMAKE_COMMAND} -E make_directory "${_profraw_dir}"
+    COMMAND ${CMAKE_COMMAND} -E env
+        "LLVM_PROFILE_FILE=${_profraw_dir}/rippled-%m-%p.profraw"
+        ${Cov_EXECUTABLE} ${Cov_EXECUTABLE_ARGS}
+    COMMAND bash -c "${_merge_sh}"
+    COMMAND bash -c "${_report_sh}"
+    BYPRODUCTS ${_output}
+    WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+    DEPENDS ${Cov_DEPENDENCIES}
+    VERBATIM
+    COMMENT "Running llvm-cov (${Cov_FORMAT}) -> ${_output}"
+  )
+endfunction()

cmake/RippledCore.cmake

@@ -165,9 +165,6 @@ if(xrpld)
   if(tests)
     target_compile_definitions(rippled PUBLIC ENABLE_TESTS)
   endif()
-  if(xahaud_runtime_test_config)
-    target_compile_definitions(rippled PUBLIC XAHAUD_ENABLE_RUNTIME_TEST_CONFIG=1)
-  endif()
   target_include_directories(rippled
     PRIVATE
       $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/src>
@@ -183,21 +180,6 @@ if(xrpld)
       "${CMAKE_CURRENT_SOURCE_DIR}/src/test/*.cpp"
     )
     target_sources(rippled PRIVATE ${sources})
-
-    set(HOOKS_TEST_DIR "" CACHE PATH "External hook Env-test directory")
-    if(NOT HOOKS_TEST_DIR AND DEFINED ENV{HOOKS_TEST_DIR})
-      set(HOOKS_TEST_DIR "$ENV{HOOKS_TEST_DIR}")
-    endif()
-    if(HOOKS_TEST_DIR)
-      file(GLOB_RECURSE hook_test_sources CONFIGURE_DEPENDS
-        "${HOOKS_TEST_DIR}/*_test.cpp"
-      )
-      if(hook_test_sources)
-        message(STATUS "Including external hook Env tests from ${HOOKS_TEST_DIR}")
-        target_sources(rippled PRIVATE ${hook_test_sources})
-        target_include_directories(rippled PRIVATE "${HOOKS_TEST_DIR}")
-      endif()
-    endif()
   endif()
 
   target_link_libraries(rippled

cmake/RippledCov.cmake

@@ -11,6 +11,21 @@ if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
   return()
 endif()
 
+if(coverage_tool STREQUAL "llvm")
+  include(CodeCoverageLLVM)
+
+  setup_target_for_coverage_llvm(
+    NAME coverage
+    FORMAT ${coverage_format}
+    EXECUTABLE rippled
+    EXECUTABLE_ARGS --unittest$<$<BOOL:${coverage_test}>:=${coverage_test}> --unittest-jobs ${coverage_test_parallelism} --quiet --unittest-log
+    EXCLUDE "src/test" "include/xrpl/beast/test" "include/xrpl/beast/unit_test" "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"
+    DEPENDENCIES rippled
+  )
+  return()
+endif()
+
+# coverage_tool == "gcov" (default): existing gcovr-driven pipeline.
 include(CodeCoverage)
 
 # The instructions for these commands come from the `CodeCoverage` module,

cmake/RippledInterface.cmake

@@ -22,24 +22,23 @@ target_compile_definitions (opts
     $<$<BOOL:${beast_no_unit_test_inline}>:BEAST_NO_UNIT_TEST_INLINE=1>
     $<$<BOOL:${beast_disable_autolink}>:BEAST_DONT_AUTOLINK_TO_WIN32_LIBRARIES=1>
     $<$<BOOL:${single_io_service_thread}>:RIPPLE_SINGLE_IO_SERVICE_THREAD=1>
-    # Enhanced logging is enabled for Debug builds, or explicitly via
-    # -DBEAST_ENHANCED_LOGGING=ON for other build types.
-    $<$<OR:$<CONFIG:Debug>,$<BOOL:${BEAST_ENHANCED_LOGGING}>>:BEAST_ENHANCED_LOGGING=1>
     $<$<BOOL:${voidstar}>:ENABLE_VOIDSTAR>)
 target_compile_options (opts
   INTERFACE
     $<$<AND:$<BOOL:${is_gcc}>,$<COMPILE_LANGUAGE:CXX>>:-Wsuggest-override>
     $<$<BOOL:${is_gcc}>:-Wno-maybe-uninitialized>
     $<$<BOOL:${perf}>:-fno-omit-frame-pointer>
-    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>>:-g --coverage -fprofile-abs-path>
-    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage -fprofile-abs-path>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},llvm>>:-g -fprofile-instr-generate -fcoverage-mapping>
     $<$<BOOL:${profile}>:-pg>
     $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${profile}>>:-p>)
 
 target_link_libraries (opts
   INTERFACE
-    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>>:-g --coverage -fprofile-abs-path>
-    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage -fprofile-abs-path>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},llvm>>:-g -fprofile-instr-generate -fcoverage-mapping>
     $<$<BOOL:${profile}>:-pg>
     $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${profile}>>:-p>)
 

cmake/RippledSettings.cmake

@@ -12,13 +12,6 @@ option(xrpld "Build xrpld" ON)
 
 option(tests "Build tests" ON)
 
-option(xahaud_runtime_test_config
-  "Enable XAHAUD_RUNTIME_TEST_CONFIG env and runtime_config RPC fault-injection controls"
-  OFF)
-# Conan 2 local opt-in:
-# [conf]
-# tools.cmake.cmaketoolchain:extra_variables={"xahaud_runtime_test_config":"ON"}
-
 option(unity "Creates a build using UNITY support in cmake. This is the default" ON)
 if(unity)
   if(NOT is_ci)
@@ -36,13 +29,25 @@ if(is_gcc OR is_clang)
     "Unit tests parallelism for the purpose of coverage report.")
   set(coverage_format "html-details" CACHE STRING
     "Output format of the coverage report.")
+  set(coverage_tool "gcov" CACHE STRING
+    "Coverage instrumentation tool: 'gcov' (default, gcc/clang via --coverage + gcovr) or 'llvm' (clang only, native source-based coverage via -fprofile-instr-generate).")
+  set_property(CACHE coverage_tool PROPERTY STRINGS "gcov" "llvm")
+  if(NOT coverage_tool MATCHES "^(gcov|llvm)$")
+    message(FATAL_ERROR "coverage_tool must be 'gcov' or 'llvm', got '${coverage_tool}'")
+  endif()
   set(coverage_extra_args "" CACHE STRING
-    "Additional arguments to pass to gcovr.")
+    "Additional arguments to pass to gcovr (gcov tool only).")
   set(coverage_test "" CACHE STRING
     "On gcc & clang, the specific unit test(s) to run for coverage. Default is all tests.")
   if(coverage_test AND NOT coverage)
     set(coverage ON CACHE BOOL "gcc/clang only" FORCE)
   endif()
+  # Validate after coverage_test may have flipped coverage on, otherwise
+  # `-Dcoverage_tool=llvm -Dcoverage_test=Foo` on gcc would silently slip
+  # past the Clang guard and produce a broken instrumentation combo.
+  if(coverage AND coverage_tool STREQUAL "llvm" AND NOT is_clang)
+    message(FATAL_ERROR "coverage_tool=llvm requires Clang (got ${CMAKE_CXX_COMPILER_ID})")
+  endif()
   option(wextra "compile with extra gcc/clang warnings enabled" ON)
 else()
   set(profile OFF CACHE BOOL "gcc/clang only" FORCE)
@@ -119,7 +124,7 @@ option(beast_no_unit_test_inline
   "Prevents unit test definitions from being inserted into global table"
   OFF)
 option(single_io_service_thread
-  "Restricts the number of threads calling io_service::run to one. \
+  "Restricts the number of threads calling io_context::run to one. \
   This can be useful when debugging."
   OFF)
 option(boost_show_deprecated

cmake/deps/Boost.cmake

@@ -32,9 +32,9 @@ target_link_libraries(ripple_boost
     Boost::date_time
     Boost::filesystem
     Boost::json
+    Boost::process
     Boost::program_options
     Boost::regex
-    Boost::system
     Boost::iostreams
     Boost::thread)
 if(Boost_COMPILER)

conanfile.py

@@ -2,158 +2,160 @@ from conan import ConanFile
 from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 import re
 
-class Xrpl(ConanFile):
-    name = 'xrpl'
 
-    license = 'ISC'
-    author = 'John Freeman <jfreeman@ripple.com>'
-    url = 'https://github.com/xrplf/rippled'
-    description = 'The XRP Ledger'
-    settings = 'os', 'compiler', 'build_type', 'arch'
+class Xrpl(ConanFile):
+    name = "xrpl"
+
+    license = "ISC"
+    author = "John Freeman <jfreeman@ripple.com>"
+    url = "https://github.com/xrplf/rippled"
+    description = "The XRP Ledger"
+    settings = "os", "compiler", "build_type", "arch"
     options = {
-        'assertions': [True, False],
-        'coverage': [True, False],
-        'fPIC': [True, False],
-        'jemalloc': [True, False],
-        'rocksdb': [True, False],
-        'shared': [True, False],
-        'static': [True, False],
-        'tests': [True, False],
-        'unity': [True, False],
-        'xrpld': [True, False],
-        'with_wasmedge': [True, False],
-        'tool_requires_b2': [True, False],
+        "assertions": [True, False],
+        "coverage": [True, False],
+        "fPIC": [True, False],
+        "jemalloc": [True, False],
+        "rocksdb": [True, False],
+        "shared": [True, False],
+        "static": [True, False],
+        "tests": [True, False],
+        "unity": [True, False],
+        "xrpld": [True, False],
+        "with_wasmedge": [True, False],
+        "tool_requires_b2": [True, False],
     }
 
     requires = [
-        'date/3.0.3',
-        'grpc/1.50.1',
-        'libarchive/3.7.6',
-        'magic_enum/0.9.5',
-        'nudb/2.0.8',
-        'openssl/3.6.0',
-        'soci/4.0.3@xahaud/stable',
-        'xxhash/0.8.2',
-        'zlib/1.3.1',
+        "date/3.0.3",
+        "grpc/1.50.1",
+        "libarchive/3.7.6",
+        "magic_enum/0.9.5",
+        "nudb/2.0.9",
+        "openssl/3.6.0",
+        "soci/4.0.3@xahaud/stable",
+        "xxhash/0.8.2",
+        "zlib/1.3.1",
     ]
 
     tool_requires = [
-        'protobuf/3.21.12',
+        "protobuf/3.21.12",
     ]
 
     default_options = {
-        'assertions': False,
-        'coverage': False,
-        'fPIC': True,
-        'jemalloc': False,
-        'rocksdb': True,
-        'shared': False,
-        'static': True,
-        'tests': False,
-        'unity': False,
-        'xrpld': False,
-        'with_wasmedge': True,
-        'tool_requires_b2': False,
-
-        'date/*:header_only': False,
-        'grpc/*:shared': False,
-        'grpc/*:secure': True,
-        'libarchive/*:shared': False,
-        'libarchive/*:with_acl': False,
-        'libarchive/*:with_bzip2': False,
-        'libarchive/*:with_cng': False,
-        'libarchive/*:with_expat': False,
-        'libarchive/*:with_iconv': False,
-        'libarchive/*:with_libxml2': False,
-        'libarchive/*:with_lz4': True,
-        'libarchive/*:with_lzma': False,
-        'libarchive/*:with_lzo': False,
-        'libarchive/*:with_nettle': False,
-        'libarchive/*:with_openssl': False,
-        'libarchive/*:with_pcreposix': False,
-        'libarchive/*:with_xattr': False,
-        'libarchive/*:with_zlib': False,
-        'lz4/*:shared': False,
-        'openssl/*:shared': False,
-        'protobuf/*:shared': False,
-        'protobuf/*:with_zlib': True,
-        'rocksdb/*:enable_sse': False,
-        'rocksdb/*:lite': False,
-        'rocksdb/*:shared': False,
-        'rocksdb/*:use_rtti': True,
-        'rocksdb/*:with_jemalloc': False,
-        'rocksdb/*:with_lz4': True,
-        'rocksdb/*:with_snappy': True,
-        'snappy/*:shared': False,
-        'soci/*:shared': False,
-        'soci/*:with_sqlite3': True,
-        'soci/*:with_boost': True,
-        'xxhash/*:shared': False,
+        "assertions": False,
+        "coverage": False,
+        "fPIC": True,
+        "jemalloc": False,
+        "rocksdb": True,
+        "shared": False,
+        "static": True,
+        "tests": False,
+        "unity": False,
+        "xrpld": False,
+        "with_wasmedge": True,
+        "tool_requires_b2": False,
+        "boost/*:without_cobalt": True,
+        "date/*:header_only": False,
+        "grpc/*:shared": False,
+        "grpc/*:secure": True,
+        "libarchive/*:shared": False,
+        "libarchive/*:with_acl": False,
+        "libarchive/*:with_bzip2": False,
+        "libarchive/*:with_cng": False,
+        "libarchive/*:with_expat": False,
+        "libarchive/*:with_iconv": False,
+        "libarchive/*:with_libxml2": False,
+        "libarchive/*:with_lz4": True,
+        "libarchive/*:with_lzma": False,
+        "libarchive/*:with_lzo": False,
+        "libarchive/*:with_nettle": False,
+        "libarchive/*:with_openssl": False,
+        "libarchive/*:with_pcreposix": False,
+        "libarchive/*:with_xattr": False,
+        "libarchive/*:with_zlib": False,
+        "lz4/*:shared": False,
+        "openssl/*:shared": False,
+        "protobuf/*:shared": False,
+        "protobuf/*:with_zlib": True,
+        "rocksdb/*:enable_sse": False,
+        "rocksdb/*:lite": False,
+        "rocksdb/*:shared": False,
+        "rocksdb/*:use_rtti": True,
+        "rocksdb/*:with_jemalloc": False,
+        "rocksdb/*:with_lz4": True,
+        "rocksdb/*:with_snappy": True,
+        "snappy/*:shared": False,
+        "soci/*:shared": False,
+        "soci/*:with_sqlite3": True,
+        "soci/*:with_boost": True,
+        "xxhash/*:shared": False,
     }
 
     def set_version(self):
-        path = f'{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp'
-        regex = r'versionString\s?=\s?\"(.*)\"'
-        with open(path, 'r') as file:
+        path = f"{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp"
+        regex = r"versionString\s?=\s?\"(.*)\""
+        with open(path, "r") as file:
             matches = (re.search(regex, line) for line in file)
             match = next(m for m in matches if m)
             self.version = match.group(1)
 
     def build_requirements(self):
         # These provide build tools (protoc, grpc plugins) that run during build
-        self.tool_requires('grpc/1.50.1')
+        self.tool_requires("grpc/1.50.1")
         # Explicitly require b2 (e.g. for building from source for glibc compatibility)
         if self.options.tool_requires_b2:
-            self.tool_requires('b2/5.3.2')
+            self.tool_requires("b2/5.3.2")
 
     def configure(self):
-        if self.settings.compiler == 'apple-clang':
-            self.options['boost/*'].visibility = 'global'
+        if self.settings.compiler == "apple-clang":
+            self.options["boost/*"].visibility = "global"
 
     def requirements(self):
         # Force sqlite3 version to avoid conflicts with soci
-        self.requires('sqlite3/3.47.0', override=True)
+        self.requires("sqlite3/3.47.0", override=True)
         # Force our custom snappy build for all dependencies
-        self.requires('snappy/1.1.10@xahaud/stable', override=True)
+        self.requires("snappy/1.1.10@xahaud/stable", override=True)
         # Force boost version for all dependencies to avoid conflicts
-        self.requires('boost/1.86.0', override=True)
-        self.requires('lz4/1.10.0', force=True)
+        self.requires("boost/1.91.0", override=True)
+        self.requires("lz4/1.10.0", force=True)
 
         if self.options.with_wasmedge:
-            self.requires('wasmedge/0.11.2@xahaud/stable')
+            self.requires("wasmedge/0.11.2@xahaud/stable")
         if self.options.jemalloc:
-            self.requires('jemalloc/5.3.0')
+            self.requires("jemalloc/5.3.0")
         if self.options.rocksdb:
-            self.requires('rocksdb/6.29.5')
+            self.requires("rocksdb/6.29.5")
 
     exports_sources = (
-        'CMakeLists.txt',
-        'bin/getRippledInfo',
-        'cfg/*',
-        'cmake/*',
-        'external/*',
-        'include/*',
-        'src/*',
+        "CMakeLists.txt",
+        "bin/getRippledInfo",
+        "cfg/*",
+        "cmake/*",
+        "external/*",
+        "include/*",
+        "src/*",
     )
 
     def layout(self):
         cmake_layout(self)
         # Fix this setting to follow the default introduced in Conan 1.48
         # to align with our build instructions.
-        self.folders.generators = 'build/generators'
+        self.folders.generators = "build/generators"
+
+    generators = "CMakeDeps"
 
-    generators = 'CMakeDeps'
     def generate(self):
         tc = CMakeToolchain(self)
-        tc.variables['tests'] = self.options.tests
-        tc.variables['assert'] = self.options.assertions
-        tc.variables['coverage'] = self.options.coverage
-        tc.variables['jemalloc'] = self.options.jemalloc
-        tc.variables['rocksdb'] = self.options.rocksdb
-        tc.variables['BUILD_SHARED_LIBS'] = self.options.shared
-        tc.variables['static'] = self.options.static
-        tc.variables['unity'] = self.options.unity
-        tc.variables['xrpld'] = self.options.xrpld
+        tc.variables["tests"] = self.options.tests
+        tc.variables["assert"] = self.options.assertions
+        tc.variables["coverage"] = self.options.coverage
+        tc.variables["jemalloc"] = self.options.jemalloc
+        tc.variables["rocksdb"] = self.options.rocksdb
+        tc.variables["BUILD_SHARED_LIBS"] = self.options.shared
+        tc.variables["static"] = self.options.static
+        tc.variables["unity"] = self.options.unity
+        tc.variables["xrpld"] = self.options.xrpld
         tc.generate()
 
     def build(self):
@@ -168,29 +170,29 @@ class Xrpl(ConanFile):
         cmake.install()
 
     def package_info(self):
-        libxrpl = self.cpp_info.components['libxrpl']
+        libxrpl = self.cpp_info.components["libxrpl"]
         libxrpl.libs = [
-            'xrpl',
-            'xrpl.libpb',
-            'ed25519',
-            'secp256k1',
+            "xrpl",
+            "xrpl.libpb",
+            "ed25519",
+            "secp256k1",
         ]
         # TODO: Fix the protobufs to include each other relative to
         # `include/`, not `include/ripple/proto/`.
-        libxrpl.includedirs = ['include', 'include/ripple/proto']
+        libxrpl.includedirs = ["include", "include/ripple/proto"]
         libxrpl.requires = [
-            'boost::boost',
-            'date::date',
-            'grpc::grpc++',
-            'libarchive::libarchive',
-            'lz4::lz4',
-            'nudb::nudb',
-            'openssl::crypto',
-            'protobuf::libprotobuf',
-            'soci::soci',
-            'sqlite3::sqlite',
-            'xxhash::xxhash',
-            'zlib::zlib',
+            "boost::boost",
+            "date::date",
+            "grpc::grpc++",
+            "libarchive::libarchive",
+            "lz4::lz4",
+            "nudb::nudb",
+            "openssl::crypto",
+            "protobuf::libprotobuf",
+            "soci::soci",
+            "sqlite3::sqlite",
+            "xxhash::xxhash",
+            "zlib::zlib",
         ]
         if self.options.rocksdb:
-            libxrpl.requires.append('rocksdb::librocksdb')
+            libxrpl.requires.append("rocksdb::librocksdb")

hook/error.h

@@ -47,8 +47,5 @@
 #define MEM_OVERLAP -43
 #define TOO_MANY_STATE_MODIFICATIONS -44
 #define TOO_MANY_NAMESPACES -45
-#define EXPORT_FAILURE -46
-#define TOO_MANY_EXPORTED_TXN -47
-#define TOO_LITTLE_ENTROPY -48
 #define HOOK_ERROR_CODES
 #endif //HOOK_ERROR_CODES

hook/extern.h

@@ -339,52 +339,12 @@ prepare(
     uint32_t read_ptr,
     uint32_t read_len);
 
-extern int64_t
-xport_reserve(uint32_t count);
-
-// callback_fee_drops: 0 omits third-party delivery permission; otherwise the
-// exact Import fee authorized by the emitted Export intent, in native drops.
 extern int64_t
 xport(
     uint32_t write_ptr,
     uint32_t write_len,
     uint32_t read_ptr,
-    uint32_t read_len,
-    uint32_t committee_hash_ptr,
-    uint32_t committee_hash_len,
-    uint64_t callback_fee_drops);
-
-extern int64_t
-xport_cancel(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
-
-/*
-    Consensus entropy APIs.
-
-    min_tier is a required fail-closed floor:
-      1 = consensus_fallback, 2 = participant_aligned,
-      3 = validator_quorum, 4 = validator_full.
-
-    entropy_cr_status returns a packed non-negative value:
-      bits 32..39 tier, 16..31 count, 0..15 denominator.
-    Check for a negative error before using the ENTROPY_* macros.
-
-    Classify tier before count/denominator arithmetic: fallback is tier 1
-    with count=denominator=0. Common policies are denominator-count <= 1,
-    5*count >= 4*denominator (use widened arithmetic), or count >= floor.
-
-    entropy_cr_dice/entropy_cr_random return TOO_LITTLE_ENTROPY if fresh
-    visible entropy is below
-    min_tier. Open-ledger and simulate execution are provisional previews;
-    final ordered execution may see a different entropy object.
-*/
-extern int64_t
-entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-
-extern int64_t
-entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-
-extern int64_t
-entropy_cr_status(void);
+    uint32_t read_len);
 
 #ifdef __cplusplus
 }

hook/generate_extern.sh

@@ -41,34 +41,6 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
                     # Insert __attribute__((noduplicate)) before _g
                     sub(/[[:space:]]+_g/, " __attribute__((noduplicate)) _g", line);
                 }
-
-                if (line ~ /[[:space:]]+xport[[:space:]]*\(/) {
-                    print "// callback_fee_drops: 0 omits third-party delivery permission; otherwise the";
-                    print "// exact Import fee authorized by the emitted Export intent, in native drops.";
-                }
-
-                if (line ~ /[[:space:]]+entropy_cr_dice[[:space:]]*\(/) {
-                    print "/*";
-                    print "    Consensus entropy APIs.";
-                    print "";
-                    print "    min_tier is a required fail-closed floor:";
-                    print "      1 = consensus_fallback, 2 = participant_aligned,";
-                    print "      3 = validator_quorum, 4 = validator_full.";
-                    print "";
-                    print "    entropy_cr_status returns a packed non-negative value:";
-                    print "      bits 32..39 tier, 16..31 count, 0..15 denominator.";
-                    print "    Check for a negative error before using the ENTROPY_* macros.";
-                    print "";
-                    print "    Classify tier before count/denominator arithmetic: fallback is tier 1";
-                    print "    with count=denominator=0. Common policies are denominator-count <= 1,";
-                    print "    5*count >= 4*denominator (use widened arithmetic), or count >= floor.";
-                    print "";
-                    print "    entropy_cr_dice/entropy_cr_random return TOO_LITTLE_ENTROPY if fresh";
-                    print "    visible entropy is below";
-                    print "    min_tier. Open-ledger and simulate execution are provisional previews;";
-                    print "    final ordered execution may see a different entropy object.";
-                    print "*/";
-                }
                 
                 # printf("\n");
                 

hook/genesis/headers/extern.h

@@ -348,24 +348,5 @@ util_verify(
     uint32_t kread_len);
 
 extern int64_t xpop_slot(uint32_t, uint32_t);
-
-extern int64_t
-xport_reserve(uint32_t count);
-
-// callback_fee_drops: 0 omits third-party delivery permission; otherwise the
-// exact Import fee authorized by the emitted Export intent, in native drops.
-extern int64_t
-xport(
-    uint32_t write_ptr,
-    uint32_t write_len,
-    uint32_t read_ptr,
-    uint32_t read_len,
-    uint32_t committee_hash_ptr,
-    uint32_t committee_hash_len,
-    uint64_t callback_fee_drops);
-
-extern int64_t
-xport_cancel(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
-
 #define HOOK_EXTERN
-#endif  // HOOK_EXTERN
+#endif  // HOOK_EXTERN

hook/genesis/headers/hookapi.h

@@ -47,4 +47,4 @@
 #include "macro.h"
 #include "types.h"
 
-#endif
+#endif

hook/genesis/headers/macro.h

@@ -607,37 +607,31 @@ int out_len = 0;\
 #define PREPARE_PAYMENT_SIMPLE_SIZE 248U
 #endif
 
-#define PREPARE_PAYMENT_SIMPLE(                                              \
-    buf_out_master, drops_amount_raw, to_address, dest_tag_raw, src_tag_raw) \
-    {                                                                        \
-        uint8_t* buf_out = buf_out_master;                                   \
-        uint8_t acc[20];                                                     \
-        uint64_t drops_amount = (drops_amount_raw);                          \
-        uint32_t dest_tag = (dest_tag_raw);                                  \
-        uint32_t src_tag = (src_tag_raw);                                    \
-        uint32_t cls = (uint32_t)ledger_seq();                               \
-        hook_account(SBUF(acc));                                             \
-        _01_02_ENCODE_TT(buf_out, ttPAYMENT);      /* uint16  | size   3 */  \
-        _02_02_ENCODE_FLAGS(buf_out, tfCANONICAL); /* uint32  | size   5 */  \
-        _02_03_ENCODE_TAG_SRC(buf_out, src_tag);   /* uint32  | size   5 */  \
-        _02_04_ENCODE_SEQUENCE(buf_out, 0);        /* uint32  | size   5 */  \
-        _02_14_ENCODE_TAG_DST(buf_out, dest_tag);  /* uint32  | size   5 */  \
-        _02_26_ENCODE_FLS(buf_out, cls + 1);       /* uint32  | size   6 */  \
-        _02_27_ENCODE_LLS(buf_out, cls + 5);       /* uint32  | size   6 */  \
-        _06_01_ENCODE_DROPS_AMOUNT(                                          \
-            buf_out, drops_amount); /* amount  | size   9 */                 \
-        uint8_t* fee_ptr = buf_out;                                          \
-        _06_08_ENCODE_DROPS_FEE(buf_out, 0);        /* amount  | size   9 */ \
-        _07_03_ENCODE_SIGNING_PUBKEY_NULL(buf_out); /* pk      | size  35 */ \
-        _08_01_ENCODE_ACCOUNT_SRC(buf_out, acc);    /* account | size  22 */ \
-        _08_03_ENCODE_ACCOUNT_DST(                                           \
-            buf_out, to_address); /* account | size  22 */                   \
-        int64_t edlen = etxn_details(                                        \
-            (uint32_t)buf_out,                                               \
-            PREPARE_PAYMENT_SIMPLE_SIZE); /* emitdet | size 1?? */           \
-        int64_t fee =                                                        \
-            etxn_fee_base(buf_out_master, PREPARE_PAYMENT_SIMPLE_SIZE);      \
-        _06_08_ENCODE_DROPS_FEE(fee_ptr, fee);                               \
+#define PREPARE_PAYMENT_SIMPLE(buf_out_master, drops_amount_raw, to_address, dest_tag_raw, src_tag_raw)\
+    {\
+        uint8_t* buf_out = buf_out_master;\
+        uint8_t acc[20];\
+        uint64_t drops_amount = (drops_amount_raw);\
+        uint32_t dest_tag = (dest_tag_raw);\
+        uint32_t src_tag = (src_tag_raw);\
+        uint32_t cls = (uint32_t)ledger_seq();\
+        hook_account(SBUF(acc));\
+        _01_02_ENCODE_TT                   (buf_out, ttPAYMENT                      );      /* uint16  | size   3 */ \
+        _02_02_ENCODE_FLAGS                (buf_out, tfCANONICAL                    );      /* uint32  | size   5 */ \
+        _02_03_ENCODE_TAG_SRC              (buf_out, src_tag                        );      /* uint32  | size   5 */ \
+        _02_04_ENCODE_SEQUENCE             (buf_out, 0                              );      /* uint32  | size   5 */ \
+        _02_14_ENCODE_TAG_DST              (buf_out, dest_tag                       );      /* uint32  | size   5 */ \
+        _02_26_ENCODE_FLS                  (buf_out, cls + 1                        );      /* uint32  | size   6 */ \
+        _02_27_ENCODE_LLS                  (buf_out, cls + 5                        );      /* uint32  | size   6 */ \
+        _06_01_ENCODE_DROPS_AMOUNT         (buf_out, drops_amount                   );      /* amount  | size   9 */ \
+        uint8_t* fee_ptr = buf_out;\
+        _06_08_ENCODE_DROPS_FEE            (buf_out, 0                              );      /* amount  | size   9 */ \
+        _07_03_ENCODE_SIGNING_PUBKEY_NULL  (buf_out                                 );      /* pk      | size  35 */ \
+        _08_01_ENCODE_ACCOUNT_SRC          (buf_out, acc                            );      /* account | size  22 */ \
+        _08_03_ENCODE_ACCOUNT_DST          (buf_out, to_address                     );      /* account | size  22 */ \
+        int64_t edlen = etxn_details((uint32_t)buf_out, PREPARE_PAYMENT_SIMPLE_SIZE);       /* emitdet | size 1?? */ \
+        int64_t fee = etxn_fee_base(buf_out_master, PREPARE_PAYMENT_SIMPLE_SIZE);                                    \ 
+        _06_08_ENCODE_DROPS_FEE            (fee_ptr, fee                            );                               \
     }
 
 #ifdef HAS_CALLBACK
@@ -645,35 +639,33 @@ int out_len = 0;\
 #else
 #define PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE 287
 #endif
-#define PREPARE_PAYMENT_SIMPLE_TRUSTLINE(                                    \
-    buf_out_master, tlamt, to_address, dest_tag_raw, src_tag_raw)            \
-    {                                                                        \
-        uint8_t* buf_out = buf_out_master;                                   \
-        uint8_t acc[20];                                                     \
-        uint32_t dest_tag = (dest_tag_raw);                                  \
-        uint32_t src_tag = (src_tag_raw);                                    \
-        uint32_t cls = (uint32_t)ledger_seq();                               \
-        hook_account(SBUF(acc));                                             \
-        _01_02_ENCODE_TT(buf_out, ttPAYMENT);      /* uint16  | size   3 */  \
-        _02_02_ENCODE_FLAGS(buf_out, tfCANONICAL); /* uint32  | size   5 */  \
-        _02_03_ENCODE_TAG_SRC(buf_out, src_tag);   /* uint32  | size   5 */  \
-        _02_04_ENCODE_SEQUENCE(buf_out, 0);        /* uint32  | size   5 */  \
-        _02_14_ENCODE_TAG_DST(buf_out, dest_tag);  /* uint32  | size   5 */  \
-        _02_26_ENCODE_FLS(buf_out, cls + 1);       /* uint32  | size   6 */  \
-        _02_27_ENCODE_LLS(buf_out, cls + 5);       /* uint32  | size   6 */  \
-        _06_01_ENCODE_TL_AMOUNT(buf_out, tlamt);   /* amount  | size  48 */  \
-        uint8_t* fee_ptr = buf_out;                                          \
-        _06_08_ENCODE_DROPS_FEE(buf_out, 0);        /* amount  | size   9 */ \
-        _07_03_ENCODE_SIGNING_PUBKEY_NULL(buf_out); /* pk      | size  35 */ \
-        _08_01_ENCODE_ACCOUNT_SRC(buf_out, acc);    /* account | size  22 */ \
-        _08_03_ENCODE_ACCOUNT_DST(                                           \
-            buf_out, to_address); /* account | size  22 */                   \
-        etxn_details(                                                        \
-            (uint32_t)buf_out,                                               \
-            PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE); /* emitdet | size 1?? */ \
-        int64_t fee = etxn_fee_base(                                         \
-            buf_out_master, PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE);          \
-        _06_08_ENCODE_DROPS_FEE(fee_ptr, fee);                               \
+#define PREPARE_PAYMENT_SIMPLE_TRUSTLINE(buf_out_master, tlamt, to_address, dest_tag_raw, src_tag_raw)\
+    {\
+        uint8_t* buf_out = buf_out_master;\
+        uint8_t acc[20];\
+        uint32_t dest_tag = (dest_tag_raw);\
+        uint32_t src_tag = (src_tag_raw);\
+        uint32_t cls = (uint32_t)ledger_seq();\
+        hook_account(SBUF(acc));\
+        _01_02_ENCODE_TT                   (buf_out, ttPAYMENT                      );      /* uint16  | size   3 */ \
+        _02_02_ENCODE_FLAGS                (buf_out, tfCANONICAL                    );      /* uint32  | size   5 */ \
+        _02_03_ENCODE_TAG_SRC              (buf_out, src_tag                        );      /* uint32  | size   5 */ \
+        _02_04_ENCODE_SEQUENCE             (buf_out, 0                              );      /* uint32  | size   5 */ \
+        _02_14_ENCODE_TAG_DST              (buf_out, dest_tag                       );      /* uint32  | size   5 */ \
+        _02_26_ENCODE_FLS                  (buf_out, cls + 1                        );      /* uint32  | size   6 */ \
+        _02_27_ENCODE_LLS                  (buf_out, cls + 5                        );      /* uint32  | size   6 */ \
+        _06_01_ENCODE_TL_AMOUNT            (buf_out, tlamt                          );      /* amount  | size  48 */ \
+        uint8_t* fee_ptr = buf_out;\
+        _06_08_ENCODE_DROPS_FEE            (buf_out, 0                              );      /* amount  | size   9 */ \
+        _07_03_ENCODE_SIGNING_PUBKEY_NULL  (buf_out                                 );      /* pk      | size  35 */ \
+        _08_01_ENCODE_ACCOUNT_SRC          (buf_out, acc                            );      /* account | size  22 */ \
+        _08_03_ENCODE_ACCOUNT_DST          (buf_out, to_address                     );      /* account | size  22 */ \
+        etxn_details((uint32_t)buf_out, PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE);             /* emitdet | size 1?? */  \
+        int64_t fee = etxn_fee_base(buf_out_master, PREPARE_PAYMENT_SIMPLE_TRUSTLINE_SIZE);                          \ 
+        _06_08_ENCODE_DROPS_FEE            (fee_ptr, fee                            );                               \
     }
 
+
+
 #endif
+

hook/genesis/headers/sfcodes.h

@@ -3,31 +3,18 @@
 #define sfCloseResolution ((16U << 16U) + 1U)
 #define sfMethod ((16U << 16U) + 2U)
 #define sfTransactionResult ((16U << 16U) + 3U)
-#define sfScale ((16U << 16U) + 4U)
-#define sfAssetScale ((16U << 16U) + 5U)
 #define sfTickSize ((16U << 16U) + 16U)
 #define sfUNLModifyDisabling ((16U << 16U) + 17U)
 #define sfHookResult ((16U << 16U) + 18U)
-#define sfWasLockingChainSend ((16U << 16U) + 19U)
-#define sfSidecarType ((16U << 16U) + 20U)
-#define sfEntropyTier ((16U << 16U) + 21U)
 #define sfLedgerEntryType ((1U << 16U) + 1U)
 #define sfTransactionType ((1U << 16U) + 2U)
 #define sfSignerWeight ((1U << 16U) + 3U)
 #define sfTransferFee ((1U << 16U) + 4U)
-#define sfTradingFee ((1U << 16U) + 5U)
-#define sfDiscountedFee ((1U << 16U) + 6U)
 #define sfVersion ((1U << 16U) + 16U)
 #define sfHookStateChangeCount ((1U << 16U) + 17U)
 #define sfHookEmitCount ((1U << 16U) + 18U)
 #define sfHookExecutionIndex ((1U << 16U) + 19U)
 #define sfHookApiVersion ((1U << 16U) + 20U)
-#define sfHookStateScale ((1U << 16U) + 21U)
-#define sfLedgerFixType ((1U << 16U) + 22U)
-#define sfHookExportCount ((1U << 16U) + 98U)
-#define sfEntropyCount ((1U << 16U) + 99U)
-#define sfEntropyDenominator ((1U << 16U) + 100U)
-#define sfExportCount ((1U << 16U) + 101U)
 #define sfNetworkID ((2U << 16U) + 1U)
 #define sfFlags ((2U << 16U) + 2U)
 #define sfSourceTag ((2U << 16U) + 3U)
@@ -42,7 +29,6 @@
 #define sfWalletSize ((2U << 16U) + 12U)
 #define sfOwnerCount ((2U << 16U) + 13U)
 #define sfDestinationTag ((2U << 16U) + 14U)
-#define sfLastUpdateTime ((2U << 16U) + 15U)
 #define sfHighQualityIn ((2U << 16U) + 16U)
 #define sfHighQualityOut ((2U << 16U) + 17U)
 #define sfLowQualityIn ((2U << 16U) + 18U)
@@ -74,15 +60,7 @@
 #define sfBurnedNFTokens ((2U << 16U) + 44U)
 #define sfHookStateCount ((2U << 16U) + 45U)
 #define sfEmitGeneration ((2U << 16U) + 46U)
-#define sfVoteWeight ((2U << 16U) + 48U)
-#define sfLockCount ((2U << 16U) + 49U)
-#define sfFirstNFTokenSequence ((2U << 16U) + 50U)
-#define sfOracleDocumentID ((2U << 16U) + 51U)
-#define sfStartTime ((2U << 16U) + 93U)
-#define sfRepeatCount ((2U << 16U) + 94U)
-#define sfDelaySeconds ((2U << 16U) + 95U)
-#define sfXahauActivationLgrSeq ((2U << 16U) + 96U)
-#define sfImportSequence ((2U << 16U) + 97U)
+#define sfLockCount ((2U << 16U) + 47U)
 #define sfRewardTime ((2U << 16U) + 98U)
 #define sfRewardLgrFirst ((2U << 16U) + 99U)
 #define sfRewardLgrLast ((2U << 16U) + 100U)
@@ -102,26 +80,12 @@
 #define sfHookInstructionCount ((3U << 16U) + 17U)
 #define sfHookReturnCode ((3U << 16U) + 18U)
 #define sfReferenceCount ((3U << 16U) + 19U)
-#define sfXChainClaimID ((3U << 16U) + 20U)
-#define sfXChainAccountCreateCount ((3U << 16U) + 21U)
-#define sfXChainAccountClaimCount ((3U << 16U) + 22U)
-#define sfAssetPrice ((3U << 16U) + 23U)
-#define sfMaximumAmount ((3U << 16U) + 24U)
-#define sfOutstandingAmount ((3U << 16U) + 25U)
-#define sfMPTAmount ((3U << 16U) + 26U)
-#define sfIssuerNode ((3U << 16U) + 27U)
-#define sfSubjectNode ((3U << 16U) + 28U)
-#define sfExportNode ((3U << 16U) + 29U)
-#define sfTouchCount ((3U << 16U) + 97U)
-#define sfAccountIndex ((3U << 16U) + 98U)
-#define sfAccountCount ((3U << 16U) + 99U)
 #define sfRewardAccumulator ((3U << 16U) + 100U)
 #define sfEmailHash ((4U << 16U) + 1U)
-#define sfTakerPaysCurrency ((17U << 16U) + 1U)
-#define sfTakerPaysIssuer ((17U << 16U) + 2U)
-#define sfTakerGetsCurrency ((17U << 16U) + 3U)
-#define sfTakerGetsIssuer ((17U << 16U) + 4U)
-#define sfMPTokenIssuanceID ((21U << 16U) + 1U)
+#define sfTakerPaysCurrency ((10U << 16U) + 1U)
+#define sfTakerPaysIssuer ((10U << 16U) + 2U)
+#define sfTakerGetsCurrency ((10U << 16U) + 3U)
+#define sfTakerGetsIssuer ((10U << 16U) + 4U)
 #define sfLedgerHash ((5U << 16U) + 1U)
 #define sfParentHash ((5U << 16U) + 2U)
 #define sfTransactionHash ((5U << 16U) + 3U)
@@ -135,8 +99,6 @@
 #define sfEmitParentTxnID ((5U << 16U) + 11U)
 #define sfEmitNonce ((5U << 16U) + 12U)
 #define sfEmitHookHash ((5U << 16U) + 13U)
-#define sfObjectID ((5U << 16U) + 14U)
-#define sfAMMID ((5U << 16U) + 15U)
 #define sfBookDirectory ((5U << 16U) + 16U)
 #define sfInvoiceID ((5U << 16U) + 17U)
 #define sfNickname ((5U << 16U) + 18U)
@@ -158,18 +120,6 @@
 #define sfOfferID ((5U << 16U) + 34U)
 #define sfEscrowID ((5U << 16U) + 35U)
 #define sfURITokenID ((5U << 16U) + 36U)
-#define sfDomainID ((5U << 16U) + 37U)
-#define sfExportSignatureHash ((5U << 16U) + 38U)
-#define sfExportCommitteeHash ((5U << 16U) + 39U)
-#define sfManifestID ((5U << 16U) + 91U)
-#define sfHookOnOutgoing ((5U << 16U) + 93U)
-#define sfHookOnIncoming ((5U << 16U) + 94U)
-#define sfCron ((5U << 16U) + 95U)
-#define sfHookCanEmit ((5U << 16U) + 96U)
-#define sfEmittedTxnID ((5U << 16U) + 97U)
-#define sfGovernanceMarks ((5U << 16U) + 98U)
-#define sfGovernanceFlags ((5U << 16U) + 99U)
-#define sfNumber ((9U << 16U) + 1U)
 #define sfAmount ((6U << 16U) + 1U)
 #define sfBalance ((6U << 16U) + 2U)
 #define sfLimitAmount ((6U << 16U) + 3U)
@@ -180,27 +130,12 @@
 #define sfFee ((6U << 16U) + 8U)
 #define sfSendMax ((6U << 16U) + 9U)
 #define sfDeliverMin ((6U << 16U) + 10U)
-#define sfAmount2 ((6U << 16U) + 11U)
-#define sfBidMin ((6U << 16U) + 12U)
-#define sfBidMax ((6U << 16U) + 13U)
 #define sfMinimumOffer ((6U << 16U) + 16U)
 #define sfRippleEscrow ((6U << 16U) + 17U)
 #define sfDeliveredAmount ((6U << 16U) + 18U)
 #define sfNFTokenBrokerFee ((6U << 16U) + 19U)
 #define sfHookCallbackFee ((6U << 16U) + 20U)
 #define sfLockedBalance ((6U << 16U) + 21U)
-#define sfBaseFeeDrops ((6U << 16U) + 22U)
-#define sfReserveBaseDrops ((6U << 16U) + 23U)
-#define sfReserveIncrementDrops ((6U << 16U) + 24U)
-#define sfLPTokenOut ((6U << 16U) + 25U)
-#define sfLPTokenIn ((6U << 16U) + 26U)
-#define sfEPrice ((6U << 16U) + 27U)
-#define sfPrice ((6U << 16U) + 28U)
-#define sfSignatureReward ((6U << 16U) + 29U)
-#define sfMinAccountCreateAmount ((6U << 16U) + 30U)
-#define sfLPTokenBalance ((6U << 16U) + 31U)
-#define sfExportCallbackFee ((6U << 16U) + 32U)
-#define sfTrustLineRewardAccumulator ((6U << 16U) + 99U)
 #define sfPublicKey ((7U << 16U) + 1U)
 #define sfMessageKey ((7U << 16U) + 2U)
 #define sfSigningPubKey ((7U << 16U) + 3U)
@@ -226,18 +161,6 @@
 #define sfHookParameterName ((7U << 16U) + 24U)
 #define sfHookParameterValue ((7U << 16U) + 25U)
 #define sfBlob ((7U << 16U) + 26U)
-#define sfDIDDocument ((7U << 16U) + 27U)
-#define sfData ((7U << 16U) + 28U)
-#define sfAssetClass ((7U << 16U) + 29U)
-#define sfProvider ((7U << 16U) + 30U)
-#define sfMPTokenMetadata ((7U << 16U) + 31U)
-#define sfCredentialType ((7U << 16U) + 32U)
-#define sfEntropyContributors ((7U << 16U) + 33U)
-#define sfExportCommittee ((7U << 16U) + 34U)
-#define sfExportContributors ((7U << 16U) + 35U)
-#define sfHookName ((7U << 16U) + 97U)
-#define sfRemarkValue ((7U << 16U) + 98U)
-#define sfRemarkName ((7U << 16U) + 99U)
 #define sfAccount ((8U << 16U) + 1U)
 #define sfOwner ((8U << 16U) + 2U)
 #define sfDestination ((8U << 16U) + 3U)
@@ -247,32 +170,13 @@
 #define sfRegularKey ((8U << 16U) + 8U)
 #define sfNFTokenMinter ((8U << 16U) + 9U)
 #define sfEmitCallback ((8U << 16U) + 10U)
-#define sfHolder ((8U << 16U) + 11U)
 #define sfHookAccount ((8U << 16U) + 16U)
-#define sfOtherChainSource ((8U << 16U) + 18U)
-#define sfOtherChainDestination ((8U << 16U) + 19U)
-#define sfAttestationSignerAccount ((8U << 16U) + 20U)
-#define sfAttestationRewardAccount ((8U << 16U) + 21U)
-#define sfLockingChainDoor ((8U << 16U) + 22U)
-#define sfIssuingChainDoor ((8U << 16U) + 23U)
-#define sfSubject ((8U << 16U) + 24U)
-#define sfInform ((8U << 16U) + 99U)
 #define sfIndexes ((19U << 16U) + 1U)
 #define sfHashes ((19U << 16U) + 2U)
 #define sfAmendments ((19U << 16U) + 3U)
 #define sfNFTokenOffers ((19U << 16U) + 4U)
 #define sfHookNamespaces ((19U << 16U) + 5U)
-#define sfCredentialIDs ((19U << 16U) + 6U)
-#define sfURITokenIDs ((19U << 16U) + 99U)
 #define sfPaths ((18U << 16U) + 1U)
-#define sfBaseAsset ((26U << 16U) + 1U)
-#define sfQuoteAsset ((26U << 16U) + 2U)
-#define sfLockingChainIssue ((24U << 16U) + 1U)
-#define sfIssuingChainIssue ((24U << 16U) + 2U)
-#define sfAsset ((24U << 16U) + 3U)
-#define sfAsset2 ((24U << 16U) + 4U)
-#define sfClaimCurrency ((24U << 16U) + 5U)
-#define sfXChainBridge ((25U << 16U) + 1U)
 #define sfTransactionMetaData ((14U << 16U) + 2U)
 #define sfCreatedNode ((14U << 16U) + 3U)
 #define sfDeletedNode ((14U << 16U) + 4U)
@@ -287,33 +191,13 @@
 #define sfEmitDetails ((14U << 16U) + 13U)
 #define sfHook ((14U << 16U) + 14U)
 #define sfSigner ((14U << 16U) + 16U)
-#define sfExportSigner ((14U << 16U) + 17U)
 #define sfMajority ((14U << 16U) + 18U)
 #define sfDisabledValidator ((14U << 16U) + 19U)
 #define sfEmittedTxn ((14U << 16U) + 20U)
 #define sfHookExecution ((14U << 16U) + 21U)
+#define sfHookDefinition ((14U << 16U) + 22U)
 #define sfHookParameter ((14U << 16U) + 23U)
 #define sfHookGrant ((14U << 16U) + 24U)
-#define sfVoteEntry ((14U << 16U) + 25U)
-#define sfAuctionSlot ((14U << 16U) + 26U)
-#define sfAuthAccount ((14U << 16U) + 27U)
-#define sfXChainClaimProofSig ((14U << 16U) + 28U)
-#define sfXChainCreateAccountProofSig ((14U << 16U) + 29U)
-#define sfXChainClaimAttestationCollectionElement ((14U << 16U) + 30U)
-#define sfXChainCreateAccountAttestationCollectionElement ((14U << 16U) + 31U)
-#define sfPriceData ((14U << 16U) + 32U)
-#define sfCredential ((14U << 16U) + 33U)
-#define sfExportedTxn ((14U << 16U) + 89U)
-#define sfManifest ((14U << 16U) + 90U)
-#define sfAmountEntry ((14U << 16U) + 91U)
-#define sfMintURIToken ((14U << 16U) + 92U)
-#define sfHookEmission ((14U << 16U) + 93U)
-#define sfImportVLKey ((14U << 16U) + 94U)
-#define sfActiveValidator ((14U << 16U) + 95U)
-#define sfGenesisMint ((14U << 16U) + 96U)
-#define sfRemark ((14U << 16U) + 97U)
-#define sfHighReward ((14U << 16U) + 98U)
-#define sfLowReward ((14U << 16U) + 99U)
 #define sfSigners ((15U << 16U) + 3U)
 #define sfSignerEntries ((15U << 16U) + 4U)
 #define sfTemplate ((15U << 16U) + 5U)
@@ -323,23 +207,9 @@
 #define sfMemos ((15U << 16U) + 9U)
 #define sfNFTokens ((15U << 16U) + 10U)
 #define sfHooks ((15U << 16U) + 11U)
-#define sfVoteSlots ((15U << 16U) + 12U)
 #define sfMajorities ((15U << 16U) + 16U)
 #define sfDisabledValidators ((15U << 16U) + 17U)
 #define sfHookExecutions ((15U << 16U) + 18U)
 #define sfHookParameters ((15U << 16U) + 19U)
 #define sfHookGrants ((15U << 16U) + 20U)
-#define sfXChainClaimAttestations ((15U << 16U) + 21U)
-#define sfXChainCreateAccountAttestations ((15U << 16U) + 22U)
-#define sfExportSigners ((15U << 16U) + 23U)
-#define sfPriceDataSeries ((15U << 16U) + 24U)
-#define sfAuthAccounts ((15U << 16U) + 25U)
-#define sfAuthorizeCredentials ((15U << 16U) + 26U)
-#define sfUnauthorizeCredentials ((15U << 16U) + 27U)
-#define sfAcceptedCredentials ((15U << 16U) + 28U)
-#define sfAmounts ((15U << 16U) + 92U)
-#define sfHookEmissions ((15U << 16U) + 93U)
-#define sfImportVLKeys ((15U << 16U) + 94U)
-#define sfActiveValidators ((15U << 16U) + 95U)
-#define sfGenesisMints ((15U << 16U) + 96U)
-#define sfRemarks ((15U << 16U) + 97U)
+#define sfActiveValidators ((15U << 16U) + 95U)

hook/hookapi.h

@@ -38,6 +38,7 @@
 #define KEYLET_HOOK_DEFINITION 24
 #define KEYLET_HOOK_STATE_DIR 25
 #define KEYLET_CRON 26
+#define KEYLET_MANIFEST 37
 
 #define COMPARE_EQUAL 1U
 #define COMPARE_LESS 2U

hook/ls_flags.h

@@ -56,10 +56,6 @@ enum ltURI_TOKEN {
 enum remarks {
     lsfImmutable = 1,
 };
-enum ltEXPORT_LATCH {
-    lsfExportXpopSeen = 0x00000001,
-    lsfExportCanceled = 0x00000002,
-};
 enum ltMPTOKEN_ISSUANCE {
     lsfMPTLocked = 0x00000001,
     lsfMPTCanLock = 0x00000002,

hook/macro.h

@@ -145,10 +145,6 @@ int out_len = 0;\
 #define SUB_OFFSET(x) ((int32_t)(x >> 32))
 #define SUB_LENGTH(x) ((int32_t)(x & 0xFFFFFFFFULL))
 
-#define ENTROPY_TIER(x) (((uint64_t)(x) >> 32U) & 0xFFU)
-#define ENTROPY_COUNT(x) (((uint64_t)(x) >> 16U) & 0xFFFFU)
-#define ENTROPY_DENOMINATOR(x) ((uint64_t)(x) & 0xFFFFU)
-
 #define BUFFER_EQUAL_20(buf1, buf2)\
     (\
         *(((uint64_t*)(buf1)) + 0) == *(((uint64_t*)(buf2)) + 0) &&\
@@ -382,3 +378,4 @@ int out_len = 0;\
 
 #endif
 
+

hook/sfcodes.h

@@ -9,8 +9,6 @@
 #define sfUNLModifyDisabling ((16U << 16U) + 17U)
 #define sfHookResult ((16U << 16U) + 18U)
 #define sfWasLockingChainSend ((16U << 16U) + 19U)
-#define sfSidecarType ((16U << 16U) + 20U)
-#define sfEntropyTier ((16U << 16U) + 21U)
 #define sfLedgerEntryType ((1U << 16U) + 1U)
 #define sfTransactionType ((1U << 16U) + 2U)
 #define sfSignerWeight ((1U << 16U) + 3U)
@@ -24,10 +22,6 @@
 #define sfHookApiVersion ((1U << 16U) + 20U)
 #define sfHookStateScale ((1U << 16U) + 21U)
 #define sfLedgerFixType ((1U << 16U) + 22U)
-#define sfHookExportCount ((1U << 16U) + 98U)
-#define sfEntropyCount ((1U << 16U) + 99U)
-#define sfEntropyDenominator ((1U << 16U) + 100U)
-#define sfExportCount ((1U << 16U) + 101U)
 #define sfNetworkID ((2U << 16U) + 1U)
 #define sfFlags ((2U << 16U) + 2U)
 #define sfSourceTag ((2U << 16U) + 3U)
@@ -78,6 +72,7 @@
 #define sfLockCount ((2U << 16U) + 49U)
 #define sfFirstNFTokenSequence ((2U << 16U) + 50U)
 #define sfOracleDocumentID ((2U << 16U) + 51U)
+#define sfExportKeysSeq ((2U << 16U) + 92U)
 #define sfStartTime ((2U << 16U) + 93U)
 #define sfRepeatCount ((2U << 16U) + 94U)
 #define sfDelaySeconds ((2U << 16U) + 95U)
@@ -111,7 +106,6 @@
 #define sfMPTAmount ((3U << 16U) + 26U)
 #define sfIssuerNode ((3U << 16U) + 27U)
 #define sfSubjectNode ((3U << 16U) + 28U)
-#define sfExportNode ((3U << 16U) + 29U)
 #define sfTouchCount ((3U << 16U) + 97U)
 #define sfAccountIndex ((3U << 16U) + 98U)
 #define sfAccountCount ((3U << 16U) + 99U)
@@ -159,8 +153,6 @@
 #define sfEscrowID ((5U << 16U) + 35U)
 #define sfURITokenID ((5U << 16U) + 36U)
 #define sfDomainID ((5U << 16U) + 37U)
-#define sfExportSignatureHash ((5U << 16U) + 38U)
-#define sfExportCommitteeHash ((5U << 16U) + 39U)
 #define sfManifestID ((5U << 16U) + 91U)
 #define sfHookOnOutgoing ((5U << 16U) + 93U)
 #define sfHookOnIncoming ((5U << 16U) + 94U)
@@ -199,7 +191,6 @@
 #define sfSignatureReward ((6U << 16U) + 29U)
 #define sfMinAccountCreateAmount ((6U << 16U) + 30U)
 #define sfLPTokenBalance ((6U << 16U) + 31U)
-#define sfExportCallbackFee ((6U << 16U) + 32U)
 #define sfTrustLineRewardAccumulator ((6U << 16U) + 99U)
 #define sfPublicKey ((7U << 16U) + 1U)
 #define sfMessageKey ((7U << 16U) + 2U)
@@ -232,9 +223,8 @@
 #define sfProvider ((7U << 16U) + 30U)
 #define sfMPTokenMetadata ((7U << 16U) + 31U)
 #define sfCredentialType ((7U << 16U) + 32U)
-#define sfEntropyContributors ((7U << 16U) + 33U)
-#define sfExportCommittee ((7U << 16U) + 34U)
-#define sfExportContributors ((7U << 16U) + 35U)
+#define sfExportKeyProof ((7U << 16U) + 95U)
+#define sfExportKey ((7U << 16U) + 96U)
 #define sfHookName ((7U << 16U) + 97U)
 #define sfRemarkValue ((7U << 16U) + 98U)
 #define sfRemarkName ((7U << 16U) + 99U)
@@ -287,7 +277,6 @@
 #define sfEmitDetails ((14U << 16U) + 13U)
 #define sfHook ((14U << 16U) + 14U)
 #define sfSigner ((14U << 16U) + 16U)
-#define sfExportSigner ((14U << 16U) + 17U)
 #define sfMajority ((14U << 16U) + 18U)
 #define sfDisabledValidator ((14U << 16U) + 19U)
 #define sfEmittedTxn ((14U << 16U) + 20U)
@@ -303,6 +292,9 @@
 #define sfXChainCreateAccountAttestationCollectionElement ((14U << 16U) + 31U)
 #define sfPriceData ((14U << 16U) + 32U)
 #define sfCredential ((14U << 16U) + 33U)
+#define sfExportSignerList ((14U << 16U) + 86U)
+#define sfExportKeyReport ((14U << 16U) + 87U)
+#define sfExportKeyEntry ((14U << 16U) + 88U)
 #define sfExportedTxn ((14U << 16U) + 89U)
 #define sfManifest ((14U << 16U) + 90U)
 #define sfAmountEntry ((14U << 16U) + 91U)
@@ -331,12 +323,12 @@
 #define sfHookGrants ((15U << 16U) + 20U)
 #define sfXChainClaimAttestations ((15U << 16U) + 21U)
 #define sfXChainCreateAccountAttestations ((15U << 16U) + 22U)
-#define sfExportSigners ((15U << 16U) + 23U)
 #define sfPriceDataSeries ((15U << 16U) + 24U)
 #define sfAuthAccounts ((15U << 16U) + 25U)
 #define sfAuthorizeCredentials ((15U << 16U) + 26U)
 #define sfUnauthorizeCredentials ((15U << 16U) + 27U)
 #define sfAcceptedCredentials ((15U << 16U) + 28U)
+#define sfExportKeys ((15U << 16U) + 91U)
 #define sfAmounts ((15U << 16U) + 92U)
 #define sfHookEmissions ((15U << 16U) + 93U)
 #define sfImportVLKeys ((15U << 16U) + 94U)

hook/tts.h

@@ -61,7 +61,9 @@
 #define ttNFTOKEN_MODIFY 70
 #define ttPERMISSIONED_DOMAIN_SET 71
 #define ttPERMISSIONED_DOMAIN_DELETE 72
-#define ttEXPORT 90
+#define ttEXPORT 88
+#define ttEXPORT_SIGN 89
+#define ttEXPORT_FINAL 90
 #define ttMANIFEST_SET 91
 #define ttCRON 92
 #define ttCRON_SET 93
@@ -76,5 +78,3 @@
 #define ttUNL_MODIFY 102
 #define ttEMIT_FAILURE 103
 #define ttUNL_REPORT 104
-#define ttCONSENSUS_ENTROPY 105
-#define ttEXPORT_SIGNATURES 106

hook/tx_flags.h

@@ -106,6 +106,8 @@ enum ClaimRewardFlags : uint32_t {
 
 enum CronSetFlags : uint32_t {
     tfCronUnset = 0x00000001,
+    // featureExport: fire after each export key rotation (see Export.h)
+    tfCronExportRotation = 0x00000002,
 };
 
 enum AMMClawbackFlags : uint32_t {
@@ -115,10 +117,3 @@ enum AMMClawbackFlags : uint32_t {
 enum BridgeModifyFlags : uint32_t {
     tfClearAccountCreateAmount = 0x00010000,
 };
-
-enum ExportFlags : uint32_t {
-    // Lifecycle control: erase the named latch and forfeit any later callback.
-    tfExportEraseLatch = 0x00010000,
-    // Committee control: erase the named immutable committee object.
-    tfExportEraseCommittee = 0x00020000,
-};

include/xrpl/basics/MathUtilities.h

@@ -23,9 +23,66 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
 
 namespace ripple {
 
+/** Add two signed 64-bit integers, returning std::nullopt when the exact
+ *  mathematical sum is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedAdd(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
+        return std::nullopt;
+
+    return a + b;
+}
+
+/** Subtract two signed 64-bit integers, returning std::nullopt when the exact
+ *  mathematical difference is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedSub(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
+        return std::nullopt;
+
+    return a - b;
+}
+
+namespace detail {
+using i64_limits = std::numeric_limits<std::int64_t>;
+
+static_assert(checkedAdd(0, 0) == 0);
+static_assert(checkedAdd(1, -1) == 0);
+static_assert(checkedAdd(-5, 2) == -3);
+static_assert(!checkedAdd(i64_limits::max(), 1).has_value());
+static_assert(!checkedAdd(i64_limits::min(), -1).has_value());
+static_assert(checkedAdd(i64_limits::max() - 1, 1) == i64_limits::max());
+static_assert(checkedAdd(i64_limits::min(), i64_limits::max()) == -1);
+static_assert(checkedAdd(i64_limits::max(), i64_limits::min()) == -1);
+static_assert(!checkedAdd(i64_limits::max(), i64_limits::max()).has_value());
+static_assert(!checkedAdd(i64_limits::min(), i64_limits::min()).has_value());
+
+static_assert(checkedSub(0, 0) == 0);
+static_assert(checkedSub(1, 1) == 0);
+static_assert(checkedSub(-5, 2) == -7);
+static_assert(checkedSub(-5, -2) == -3);
+static_assert(!checkedSub(i64_limits::min(), 1).has_value());
+static_assert(!checkedSub(i64_limits::max(), -1).has_value());
+static_assert(checkedSub(i64_limits::min() + 1, 1) == i64_limits::min());
+static_assert(checkedSub(-1, i64_limits::max()) == i64_limits::min());
+static_assert(!checkedSub(i64_limits::max(), i64_limits::min()).has_value());
+static_assert(!checkedSub(i64_limits::min(), i64_limits::max()).has_value());
+}  // namespace detail
+
 /** Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]
  * E.g. calculatePercent(1, 100) = 1 because 1/100 = 0.010000

include/xrpl/basics/ReaderPreferringSharedMutex.h

@@ -0,0 +1,105 @@
+#pragma once
+
+#include <shared_mutex>
+
+// On Linux (glibc), std::shared_mutex wraps pthread_rwlock_t initialised
+// with PTHREAD_RWLOCK_PREFER_WRITER_NONRECURSIVE_NP.  This means a
+// pending exclusive lock() blocks new shared (reader) acquisitions,
+// causing reader starvation when writers contend frequently.
+//
+// On macOS / ARM (libc++), std::shared_mutex is already reader-preferring,
+// so the same code behaves differently across platforms.
+//
+// This header provides ReaderPreferringSharedMutex:
+//   - On Linux it wraps pthread_rwlock_t initialised with
+//     PTHREAD_RWLOCK_PREFER_READER_NP, matching macOS semantics.
+//   - On all other platforms it is a type alias for std::shared_mutex.
+//
+// The interface is identical to std::shared_mutex, so it works with
+// std::shared_lock and std::unique_lock.
+
+#if defined(__linux__)
+
+#include <cerrno>
+#include <pthread.h>
+#include <system_error>
+
+namespace ripple {
+
+class ReaderPreferringSharedMutex
+{
+    pthread_rwlock_t rwlock_;
+
+public:
+    ReaderPreferringSharedMutex()
+    {
+        pthread_rwlockattr_t attr;
+        pthread_rwlockattr_init(&attr);
+        pthread_rwlockattr_setkind_np(&attr, PTHREAD_RWLOCK_PREFER_READER_NP);
+        int rc = pthread_rwlock_init(&rwlock_, &attr);
+        pthread_rwlockattr_destroy(&attr);
+        if (rc != 0)
+            throw std::system_error(
+                rc, std::system_category(), "pthread_rwlock_init");
+    }
+
+    ~ReaderPreferringSharedMutex()
+    {
+        pthread_rwlock_destroy(&rwlock_);
+    }
+
+    ReaderPreferringSharedMutex(ReaderPreferringSharedMutex const&) = delete;
+    ReaderPreferringSharedMutex&
+    operator=(ReaderPreferringSharedMutex const&) = delete;
+
+    // Exclusive (writer) locking
+    void
+    lock()
+    {
+        pthread_rwlock_wrlock(&rwlock_);
+    }
+
+    bool
+    try_lock()
+    {
+        return pthread_rwlock_trywrlock(&rwlock_) == 0;
+    }
+
+    void
+    unlock()
+    {
+        pthread_rwlock_unlock(&rwlock_);
+    }
+
+    // Shared (reader) locking
+    void
+    lock_shared()
+    {
+        pthread_rwlock_rdlock(&rwlock_);
+    }
+
+    bool
+    try_lock_shared()
+    {
+        return pthread_rwlock_tryrdlock(&rwlock_) == 0;
+    }
+
+    void
+    unlock_shared()
+    {
+        pthread_rwlock_unlock(&rwlock_);
+    }
+};
+
+}  // namespace ripple
+
+#else  // !__linux__
+
+namespace ripple {
+
+// macOS, Windows, etc. — std::shared_mutex is already reader-preferring.
+using ReaderPreferringSharedMutex = std::shared_mutex;
+
+}  // namespace ripple
+
+#endif

include/xrpl/basics/ResolverAsio.h

@@ -22,7 +22,8 @@
 
 #include <xrpl/basics/Resolver.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <boost/asio/io_service.hpp>
+
+#include <boost/asio/io_context.hpp>
 
 namespace ripple {
 
@@ -32,7 +33,7 @@ public:
     explicit ResolverAsio() = default;
 
     static std::unique_ptr<ResolverAsio>
-    New(boost::asio::io_service&, beast::Journal);
+    New(boost::asio::io_context&, beast::Journal);
 };
 
 }  // namespace ripple

include/xrpl/basics/StringUtilities.h

@@ -77,7 +77,7 @@ strUnHex(std::size_t strSize, Iterator begin, Iterator end)
 
     if (strSize & 1)
     {
-        int c = unxtab[*iter++];
+        int c = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (c < 0)
             return {};
@@ -87,12 +87,12 @@ strUnHex(std::size_t strSize, Iterator begin, Iterator end)
 
     while (iter != end)
     {
-        int cHigh = unxtab[*iter++];
+        int cHigh = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (cHigh < 0)
             return {};
 
-        int cLow = unxtab[*iter++];
+        int cLow = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (cLow < 0)
             return {};

include/xrpl/basics/UTF8.h

@@ -0,0 +1,60 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_BASICS_UTF8_H_INCLUDED
+#define RIPPLE_BASICS_UTF8_H_INCLUDED
+
+#include <xrpl/basics/Slice.h>
+
+namespace ripple {
+
+/** Check that a byte sequence is well-formed UTF-8, excluding the two
+    noncharacters U+FFFE and U+FFFF.
+
+    Rejects:
+      - overlong encodings;
+      - UTF-16 surrogate halves (U+D800..U+DFFF);
+      - scalar values above U+10FFFF, and 0xF5..0xFF lead bytes;
+      - stray continuation bytes;
+      - multi-byte sequences truncated by the end of the buffer;
+      - U+FFFE and U+FFFF (EF BF BE, EF BF BF).
+
+    U+FFFE and U+FFFF are well-formed, but have no use in a URI or a name
+    and exist to be misread: U+FFFE is a byte-swapped BOM, so a client that
+    transcodes to UTF-16/32 and sniffs the byte order can be pushed into
+    decoding the rest of the string with the wrong endianness, and both are
+    commonly used as in-band sentinels. They have always been rejected by
+    URIToken and HookName validation, and this function preserves that.
+
+    This is consensus-critical. For every input the previous decoder could
+    evaluate without reading past the end of the buffer, the result is
+    identical to it. The only difference is that truncated trailing
+    sequences, where the previous decoder read out of bounds, are now always
+    rejected. Any further change to what this accepts needs an amendment.
+
+    @param s The bytes to check.
+
+    @note Total: every byte read is within s.
+*/
+bool
+isValidUTF8(Slice const& s) noexcept;
+
+}  // namespace ripple
+
+#endif

include/xrpl/beast/asio/io_latency_probe.h

@@ -22,7 +22,8 @@
 
 #include <xrpl/beast/utility/instrumentation.h>
 #include <boost/asio/basic_waitable_timer.hpp>
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/post.hpp>
 
 #include <chrono>
 #include <condition_variable>
@@ -31,7 +32,7 @@
 
 namespace beast {
 
-/** Measures handler latency on an io_service queue. */
+/** Measures handler latency on an io_context queue. */
 template <class Clock>
 class io_latency_probe
 {
@@ -43,12 +44,12 @@ private:
     std::condition_variable_any m_cond;
     std::size_t m_count;
     duration const m_period;
-    boost::asio::io_service& m_ios;
+    boost::asio::io_context& m_ios;
     boost::asio::basic_waitable_timer<std::chrono::steady_clock> m_timer;
     bool m_cancel;
 
 public:
-    io_latency_probe(duration const& period, boost::asio::io_service& ios)
+    io_latency_probe(duration const& period, boost::asio::io_context& ios)
         : m_count(1)
         , m_period(period)
         , m_ios(ios)
@@ -63,16 +64,16 @@ public:
         cancel(lock, true);
     }
 
-    /** Return the io_service associated with the latency probe. */
+    /** Return the io_context associated with the latency probe. */
     /** @{ */
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
         return m_ios;
     }
 
-    boost::asio::io_service const&
-    get_io_service() const
+    boost::asio::io_context const&
+    get_io_context() const
     {
         return m_ios;
     }
@@ -108,8 +109,10 @@ public:
         std::lock_guard lock(m_mutex);
         if (m_cancel)
             throw std::logic_error("io_latency_probe is canceled");
-        m_ios.post(sample_op<Handler>(
-            std::forward<Handler>(handler), Clock::now(), false, this));
+        boost::asio::post(
+            m_ios,
+            sample_op<Handler>(
+                std::forward<Handler>(handler), Clock::now(), false, this));
     }
 
     /** Initiate continuous i/o latency sampling.
@@ -123,8 +126,10 @@ public:
         std::lock_guard lock(m_mutex);
         if (m_cancel)
             throw std::logic_error("io_latency_probe is canceled");
-        m_ios.post(sample_op<Handler>(
-            std::forward<Handler>(handler), Clock::now(), true, this));
+        boost::asio::post(
+            m_ios,
+            sample_op<Handler>(
+                std::forward<Handler>(handler), Clock::now(), true, this));
     }
 
 private:
@@ -235,12 +240,13 @@ private:
                     // The latency is too high to maintain the desired
                     // period so don't bother with a timer.
                     //
-                    m_probe->m_ios.post(
+                    boost::asio::post(
+                        m_probe->m_ios,
                         sample_op<Handler>(m_handler, now, m_repeat, m_probe));
                 }
                 else
                 {
-                    m_probe->m_timer.expires_from_now(when - now);
+                    m_probe->m_timer.expires_after(when - now);
                     m_probe->m_timer.async_wait(
                         sample_op<Handler>(m_handler, now, m_repeat, m_probe));
                 }
@@ -253,7 +259,8 @@ private:
             if (!m_probe)
                 return;
             typename Clock::time_point const now(Clock::now());
-            m_probe->m_ios.post(
+            boost::asio::post(
+                m_probe->m_ios,
                 sample_op<Handler>(m_handler, now, m_repeat, m_probe));
         }
     };

include/xrpl/beast/test/yield_to.h

@@ -8,9 +8,12 @@
 #ifndef BEAST_TEST_YIELD_TO_HPP
 #define BEAST_TEST_YIELD_TO_HPP
 
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 #include <boost/asio/spawn.hpp>
 #include <boost/optional.hpp>
+#include <boost/thread/csbl/memory/allocator_arg.hpp>
+
 #include <condition_variable>
 #include <functional>
 #include <mutex>
@@ -29,10 +32,12 @@ namespace test {
 class enable_yield_to
 {
 protected:
-    boost::asio::io_service ios_;
+    boost::asio::io_context ios_;
 
 private:
-    boost::optional<boost::asio::io_service::work> work_;
+    boost::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        work_;
     std::vector<std::thread> threads_;
     std::mutex m_;
     std::condition_variable cv_;
@@ -42,7 +47,8 @@ public:
     /// The type of yield context passed to functions.
     using yield_context = boost::asio::yield_context;
 
-    explicit enable_yield_to(std::size_t concurrency = 1) : work_(ios_)
+    explicit enable_yield_to(std::size_t concurrency = 1)
+        : work_(boost::asio::make_work_guard(ios_))
     {
         threads_.reserve(concurrency);
         while (concurrency--)
@@ -56,9 +62,9 @@ public:
             t.join();
     }
 
-    /// Return the `io_service` associated with the object
-    boost::asio::io_service&
-    get_io_service()
+    /// Return the `io_context` associated with the object
+    boost::asio::io_context&
+    get_io_context()
     {
         return ios_;
     }
@@ -111,13 +117,18 @@ enable_yield_to::spawn(F0&& f, FN&&... fn)
 {
     boost::asio::spawn(
         ios_,
+        boost::allocator_arg,
+        boost::context::fixedsize_stack(2 * 1024 * 1024),
         [&](yield_context yield) {
             f(yield);
             std::lock_guard lock{m_};
             if (--running_ == 0)
                 cv_.notify_all();
         },
-        boost::coroutines::attributes(2 * 1024 * 1024));
+        [](std::exception_ptr e) {
+            if (e)
+                std::rethrow_exception(e);
+        });
     spawn(fn...);
 }
 

include/xrpl/hook/Enum.h

@@ -15,8 +15,6 @@
 #define uint256 std::string
 #define featureHooksUpdate1 "1"
 #define featureHooksUpdate2 "1"
-#define featureExport "1"
-#define featureConsensusEntropy "1"
 #define fix20250131 "1"
 #define fixGuardDepth32 "1"
 namespace hook_api {
@@ -315,6 +313,7 @@ enum keylet_code : uint32_t {
     MPTOKEN = 34,
     CREDENTIAL = 35,
     PERMISSIONED_DOMAIN = 36,
+    MANIFEST = 37,
 };
 }
 
@@ -386,10 +385,7 @@ enum class hook_return_code : int64_t {
     MEM_OVERLAP = -43,   // one or more specified buffers are the same memory
     TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 256 modified state
                                          // entires in the combined hook chains
-    TOO_MANY_NAMESPACES = -45,
-    EXPORT_FAILURE = -46,
-    TOO_MANY_EXPORTED_TXN = -47,
-    TOO_LITTLE_ENTROPY = -48,
+    TOO_MANY_NAMESPACES = -45
 };
 
 enum class ExitType : uint8_t {
@@ -403,7 +399,6 @@ const uint16_t max_state_modifications = 256;
 const uint8_t max_slots = 255;
 const uint8_t max_nonce = 255;
 const uint8_t max_emit = 255;
-const uint8_t max_export = 2;
 const uint8_t max_params = 16;
 const double fee_base_multiplier = 1.1f;
 
@@ -421,7 +416,6 @@ getImportWhitelist(Rules const& rules)
 #undef HOOK_API_DEFINITION
 
 #define int64_t 0x7EU
-#define uint64_t 0x7EU
 #define int32_t 0x7FU
 #define uint32_t 0x7FU
 
@@ -438,7 +432,6 @@ getImportWhitelist(Rules const& rules)
 #undef HOOK_API_DEFINITION
 #undef HOOK_WRAP_PARAMS
 #undef int64_t
-#undef uint64_t
 #undef int32_t
 #undef uint32_t
 #pragma pop_macro("HOOK_API_DEFINITION")
@@ -446,6 +439,10 @@ getImportWhitelist(Rules const& rules)
     return whitelist;
 }
 
+#undef HOOK_API_DEFINITION
+#undef I32
+#undef I64
+
 enum GuardRulesVersion : uint64_t {
     GuardRuleFix20250131 = 0x00000001,
     GuardRuleDepth32 = 0x00000002,

include/xrpl/hook/Guard.h

@@ -87,7 +87,7 @@ parseSignedLeb128(
         }
         *end_offset = i;
         if (shift < 64 && (b & 0x40U))
-            val |= (~0 << shift);
+            val |= (~int64_t{0} << shift);
 
         return val;
     }

include/xrpl/hook/Macro.h

@@ -244,7 +244,13 @@
                                << "Tried to accept/rollback but specified "    \
                                   "memory outside of the wasm instance "       \
                                << "limit when specifying a reason string";     \
-                return OUT_OF_BOUNDS;                                          \
+                if (!view.rules().enabled(fix20260929))                        \
+                    return OUT_OF_BOUNDS;                                      \
+                /* fix20260929: terminate as a rollback so the                 \
+                   failure is visible in HookExecution metadata */             \
+                hookCtx.result.exitType = hook_api::ExitType::ROLLBACK;        \
+                hookCtx.result.exitCode = (int64_t)OUT_OF_BOUNDS;              \
+                return RC_ROLLBACK;                                            \
             }                                                                  \
             /* assembly script and some other languages use utf16 for strings  \
              */                                                                \

include/xrpl/hook/hook_api.macro

@@ -373,32 +373,7 @@ HOOK_API_DEFINITION(
   int64_t, prepare, (uint32_t, uint32_t, uint32_t, uint32_t),
   featureHooksUpdate2)
 
-// int64_t xport_reserve(uint32_t count);
+// int64_t xport(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, xport_reserve, (uint32_t),
+  int64_t, xport, (uint32_t, uint32_t, uint32_t, uint32_t),
   featureExport)
-
-// int64_t xport(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t committee_hash_ptr, uint32_t committee_hash_len, uint64_t callback_fee_drops);
-HOOK_API_DEFINITION(
-  int64_t, xport, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint64_t),
-  featureExport)
-
-// int64_t xport_cancel(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
-HOOK_API_DEFINITION(
-  int64_t, xport_cancel, (uint32_t, uint32_t, uint32_t),
-  featureExport)
-
-// int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-HOOK_API_DEFINITION(
-  int64_t, entropy_cr_dice, (uint32_t, uint32_t),
-  featureConsensusEntropy)
-
-// int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-HOOK_API_DEFINITION(
-  int64_t, entropy_cr_random, (uint32_t, uint32_t, uint32_t),
-  featureConsensusEntropy)
-
-// int64_t entropy_cr_status(void);
-HOOK_API_DEFINITION(
-  int64_t, entropy_cr_status, (),
-  featureConsensusEntropy)

include/xrpl/json/json_reader.h

@@ -215,7 +215,7 @@ Reader::parse(Value& root, BufferSequence const& bs)
     std::string s;
     s.reserve(buffer_size(bs));
     for (auto const& b : bs)
-        s.append(buffer_cast<char const*>(b), buffer_size(b));
+        s.append(static_cast<char const*>(b.data()), buffer_size(b));
     return parse(s, root);
 }
 

include/xrpl/proto/.clang-format

@@ -1,2 +0,0 @@
----
-DisableFormat: true

include/xrpl/proto/ripple.proto

@@ -27,7 +27,6 @@ enum MessageType
     mtREPLAY_DELTA_RESPONSE     = 60;
     mtHAVE_TRANSACTIONS         = 63;
     mtTRANSACTIONS              = 64;
-    mtEXPORT_SHARES             = 65;
 }
 
 // token, iterations, target, challenge = issue demand for proof of work
@@ -37,7 +36,6 @@ enum MessageType
 //------------------------------------------------------------------------------
 
 /* Provides the current ephemeral key for a validator. */
-//@@start opaque-self-verifying-overlay-artifact-precedent
 message TMManifest
 {
     // A Manifest object in the Ripple serialization format.
@@ -51,7 +49,6 @@ message TMManifests
     // The manifests sent when a peer first connects to another peer are `history`.
     optional bool history = 2 [deprecated=true];
 }
-//@@end opaque-self-verifying-overlay-artifact-precedent
 
 //------------------------------------------------------------------------------
 
@@ -121,15 +118,6 @@ message TMTransactions
     repeated TMTransaction transactions = 1;
 }
 
-// Canonical post-validation Export signature contributions. Receivers enforce
-// ExportLimits caps for entry count, each frame, aggregate frame payload, and
-// encoded protobuf size. The encoded-size cap includes protobuf tags and
-// length prefixes but excludes the overlay message header.
-message TMExportShares
-{
-    repeated bytes shares = 1;
-}
-
 
 enum NodeStatus
 {
@@ -165,11 +153,7 @@ message TMStatusChange
 message TMProposeSet
 {
     required uint32 proposeSeq          = 1;
-    // Proposed transaction-set identity. Legacy/plain proposals carry the
-    // tx-set hash directly; ConsensusExtensions proposals carry a serialized
-    // ExtendedPosition whose first field is that tx-set hash, followed by
-    // signed RNG/Export sidecar fields.
-    required bytes currentTxHash        = 2;
+    required bytes currentTxHash        = 2;    // the hash of the ledger we are proposing
     required bytes nodePubKey           = 3;
     required uint32 closeTime           = 4;
     required bytes signature            = 5;    // signature of above fields
@@ -182,16 +166,6 @@ message TMProposeSet
 
     // Number of hops traveled
     optional uint32 hops                = 12    [deprecated=true];
-
-    //@@start proposal-export-share-container-binding
-    // Canonical post-validation ExportShare frames authored by the proposing
-    // validator and re-advertised for anti-entropy. The proposal's
-    // ExtendedPosition includes a digest of this repeated field, so the exact
-    // frames are covered by the proposal signature. Each frame carries its
-    // version, owner, origin transaction, origin ledger sequence and hash,
-    // committee position, signing key, and multisign signature.
-    repeated bytes exportSignatures     = 13;
-    //@@end proposal-export-share-container-binding
 }
 
 enum TxSetStatus
@@ -410,3 +384,4 @@ message TMHaveTransactions
 {
     repeated bytes hashes = 1;
 }
+

include/xrpl/protocol/EntropyTier.h

@@ -1,62 +0,0 @@
-#ifndef RIPPLE_PROTOCOL_ENTROPY_TIER_H_INCLUDED
-#define RIPPLE_PROTOCOL_ENTROPY_TIER_H_INCLUDED
-
-#include <cstdint>
-
-namespace ripple {
-
-/// Which gate the ledger's entropy passed. Stored in sfEntropyTier (UINT8)
-/// on the ttCONSENSUS_ENTROPY pseudo-transaction and the ConsensusEntropy
-/// ledger entry.
-///
-/// EntropyCount says how many validators contributed; EntropyDenominator says
-/// how many active validators were in the ledger-anchored view for that
-/// non-fallback result; EntropyTier says which gate the result passed. Fallback
-/// entropy carries count=0/denominator=0 because no validator-derived
-/// denominator was accepted. Tier values are strength-ordered so consumers can
-/// gate with a numeric comparison (tier >= required).
-///
-/// RESIDUAL BIAS — applies to fallback, participant_aligned, and
-/// validator_quorum. This is a commit/reveal scheme: a validator can withhold
-/// its reveal until after observing peers' reveals, choosing between two
-/// outcomes (its contribution in vs. out) — up to one bit of influence per
-/// withholder, and colluding withholders near a threshold can instead force a
-/// downgrade to a lower tier. These tiers bound and *label* manipulation (it is
-/// observable and limited); they are NOT bias-resistant against a colluding
-/// validator minority. A hook that requires validator_full fails closed if any
-/// active validator withholds, trading availability for no selective-
-/// withholding slack.
-enum EntropyTier : std::uint8_t {
-    /// No usable entropy (reserved; a fresh ConsensusEntropy entry should
-    /// always carry one of the tiers below).
-    entropyTierNone = 0,
-
-    /// Consensus-bound deterministic fallback: derived from already-agreed
-    /// round inputs (parent ledger hash, base tx set hash, sequence) under
-    /// HashPrefix::entropyFallback when no agreed reveal set reaches either
-    /// participant_aligned or validator_quorum. Unpredictable in practice but
-    /// user-influenceable via transaction submission — never suitable for
-    /// value-bearing outcomes.
-    entropyTierConsensusFallback = 1,
-
-    /// Participant-aligned sub-quorum entropy: the agreed reveal set aligned at
-    /// the tier-2 participant threshold — below the 80% validator quorum but at
-    /// or above the equivocation-intersection floor over the original
-    /// (pre-nUNL)
-    /// view. Weaker than validator_quorum; opt-in for hooks via min_tier.
-    entropyTierParticipantAligned = 2,
-
-    /// Validator commit/reveal entropy whose sidecar set passed the
-    /// active-validator-view quorum alignment gate.
-    entropyTierValidatorQuorum = 3,
-
-    /// Validator commit/reveal entropy with reveals from every validator in
-    /// the ledger-anchored active view. Any missing active validator downgrades
-    /// the tier, so hooks can require this to fail closed on selective
-    /// withholding.
-    entropyTierValidatorFull = 4,
-};
-
-}  // namespace ripple
-
-#endif

include/xrpl/protocol/ExportCommittee.h

@@ -1,131 +0,0 @@
-#ifndef RIPPLE_PROTOCOL_EXPORTCOMMITTEE_H_INCLUDED
-#define RIPPLE_PROTOCOL_EXPORTCOMMITTEE_H_INCLUDED
-
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/protocol/ExportLimits.h>
-#include <xrpl/protocol/HashPrefix.h>
-#include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/UintTypes.h>
-
-#include <algorithm>
-#include <cstddef>
-#include <cstdint>
-#include <optional>
-#include <vector>
-
-namespace ripple {
-
-/** One canonical, network-neutral Export validator committee. */
-struct ExportCommitteeProfile
-{
-    std::vector<PublicKey> members;
-    std::size_t quorum;
-
-    std::optional<std::uint16_t>
-    position(PublicKey const& master) const
-    {
-        auto const it =
-            std::lower_bound(members.begin(), members.end(), master);
-        if (it == members.end() || *it != master)
-            return std::nullopt;
-        return static_cast<std::uint16_t>(std::distance(members.begin(), it));
-    }
-};
-
-/** Parse a strictly sorted sequence of compressed validator master keys. */
-inline std::optional<ExportCommitteeProfile>
-resolveExportCommittee(Slice roster)
-{
-    constexpr std::size_t publicKeyBytes = 33;
-    if (roster.empty() || roster.size() % publicKeyBytes != 0)
-        return std::nullopt;
-
-    auto const count = roster.size() / publicKeyBytes;
-    if (count == 0 || count > ExportLimits::maxCommitteeMembers)
-        return std::nullopt;
-
-    std::vector<PublicKey> members;
-    members.reserve(count);
-    for (std::size_t offset = 0; offset < roster.size();
-         offset += publicKeyBytes)
-    {
-        Slice const encoded{roster.data() + offset, publicKeyBytes};
-        if (!publicKeyType(encoded))
-            return std::nullopt;
-
-        PublicKey member{encoded};
-        if (!members.empty() && !(members.back() < member))
-            return std::nullopt;
-        members.push_back(std::move(member));
-    }
-
-    return ExportCommitteeProfile{
-        std::move(members), ExportLimits::committeeQuorumThreshold(count)};
-}
-
-inline Blob
-serializeExportCommittee(std::vector<PublicKey> members)
-{
-    if (members.empty() || members.size() > ExportLimits::maxCommitteeMembers)
-        return {};
-
-    std::sort(members.begin(), members.end());
-    if (std::adjacent_find(members.begin(), members.end()) != members.end())
-        return {};
-
-    Blob roster;
-    roster.reserve(members.size() * 33);
-    for (auto const& member : members)
-        roster.insert(roster.end(), member.begin(), member.end());
-    return roster;
-}
-
-/** Canonicalize an unordered transaction roster into strict stored form. */
-inline std::optional<Blob>
-canonicalizeExportCommittee(Slice roster)
-{
-    constexpr std::size_t publicKeyBytes = 33;
-    if (roster.empty() || roster.size() % publicKeyBytes != 0)
-        return std::nullopt;
-
-    auto const count = roster.size() / publicKeyBytes;
-    if (count == 0 || count > ExportLimits::maxCommitteeMembers)
-        return std::nullopt;
-
-    std::vector<PublicKey> members;
-    members.reserve(count);
-    for (std::size_t offset = 0; offset < roster.size();
-         offset += publicKeyBytes)
-    {
-        Slice const encoded{roster.data() + offset, publicKeyBytes};
-        if (!publicKeyType(encoded))
-            return std::nullopt;
-        members.emplace_back(encoded);
-    }
-
-    auto canonical = serializeExportCommittee(std::move(members));
-    if (canonical.empty())
-        return std::nullopt;
-    return canonical;
-}
-
-/** Content identity of one already-validated canonical roster. */
-inline uint256
-exportCommitteeHash(Slice roster)
-{
-    auto const profile = resolveExportCommittee(roster);
-    if (!profile)
-        return {};
-
-    Serializer serialized;
-    serialized.add32(HashPrefix::exportCommittee);
-    serialized.add32(static_cast<std::uint32_t>(profile->members.size()));
-    serialized.addRaw(roster);
-    return serialized.getSHA512Half();
-}
-
-}  // namespace ripple
-
-#endif

include/xrpl/protocol/ExportLimits.h

@@ -1,119 +0,0 @@
-#ifndef RIPPLE_PROTOCOL_EXPORT_LIMITS_H_INCLUDED
-#define RIPPLE_PROTOCOL_EXPORT_LIMITS_H_INCLUDED
-
-#include <xrpl/protocol/ValidatorBitset.h>
-
-#include <cstddef>
-#include <cstdint>
-
-namespace ripple {
-
-// Export system caps.
-//
-// These limits bound the DoS surface of the export signature system:
-// - Each selected validator signs once after exact source validation
-// - Pending shares are re-advertised through bounded proposal/relay batches
-// - Inbound signature processing involves crypto verification per sig
-// - Durable and per-message caps bound scans, crypto, and sidecar leaves
-struct ExportLimits
-{
-    // Ordinary XRPL multisigning accepts at most 32 signers. An account that
-    // reserves a separate operator signer must select fewer validators.
-    static constexpr std::size_t maxCommitteeMembers = 32;
-    static constexpr std::size_t maxCommitteeRosterBytes =
-        maxCommitteeMembers * 33;
-    static constexpr std::size_t maxCommitteeContributorBytes =
-        validatorBitsetBytes(maxCommitteeMembers);
-
-    // Export-specific serialized payload bounds. The release target includes
-    // the canonical origin Memo appended after validation; the witness wraps
-    // that target plus the accepted committee signatures.
-    static constexpr std::size_t maxExportReleaseTargetBytes = 2'048;
-    static constexpr std::size_t maxExportWitnessBytes = 8'192;
-
-    // V1 witnesses require the standard 80% quorum of the intent-selected
-    // committee, rounded up. The intent selects members but cannot lower this
-    // threshold. Split quotient/remainder arithmetic avoids overflow while
-    // preserving ceil(memberCount * 0.8).
-    static constexpr std::size_t
-    committeeQuorumThreshold(std::size_t memberCount)
-    {
-        auto const quotient = memberCount / 5;
-        auto const remainder = memberCount % 5;
-        return quotient * 4 + (remainder * 4 + 4) / 5;
-    }
-
-    // Maximum exports a single hook execution may produce. Hook API ABI
-    // constant hook_api::max_export must stay equal.
-    static constexpr std::uint8_t maxExportsPerHook = 2;
-
-    // Maximum Export intents admitted in one ledger and maximum live latches
-    // owned by one account.
-    static constexpr std::uint8_t maxPendingExports = 8;
-
-    // Global pending-latch and per-validation scan bound. Witnessed or canceled
-    // latches release this signing-work slot while their account owner count
-    // and reserve continue to bound retained state. This is a provisional
-    // activation tuning value.
-    static constexpr std::uint16_t maxLiveExportLatches = 64;
-
-    // Maximum admission window requested through the mandatory outer
-    // LastLedgerSequence. This bounds how long an Export may remain queued
-    // before entering a ledger; it does not bound post-validation release.
-    static constexpr std::uint32_t maxAdmissionWindowLedgers = 5;
-
-    // Fixed source-ledger window for post-validation share publication and
-    // witness materialization, measured from the ledger that admits the
-    // intent. This is a provisional activation tuning value. Keeping it
-    // separate from the outer LastLedgerSequence prevents queue delay from
-    // consuming the publication window.
-    static constexpr std::uint32_t maxPublicationLedgers = 5;
-
-    // A fully-canonical secp256k1 signature is at most 72 bytes; Ed25519 is 64.
-    static constexpr std::size_t maxCanonicalExportSignatureBytes = 72;
-
-    // Export-signature sidecar leaves encode an origin, committee position,
-    // signing key, and signature in an STObject envelope. Keep this comfortably
-    // above the canonical encoding while bounding peer-supplied leaf bytes
-    // before parse/hash work.
-    static constexpr std::size_t maxExportSignatureSidecarBytes = 256;
-
-    // Post-validation relay framing. Values are deliberately conservative
-    // local tuning knobs and require measurement before activation; changing
-    // them does not change the canonical per-share format.
-    // version + AccountID + 2 hashes + ledger sequence + committee position +
-    // compressed public key + one-byte VL prefix + maximum signature.
-    static constexpr std::size_t maxSerializedExportShareBytes =
-        1 + 20 + 32 + 4 + 32 + 2 + 33 + 1 + maxCanonicalExportSignatureBytes;
-    static constexpr std::size_t maxExportSharesPerRelay = 32;
-    static constexpr std::size_t maxExportShareRelayPayloadBytes =
-        maxSerializedExportShareBytes * maxExportSharesPerRelay;
-    // Protobuf repeated-bytes framing is one tag byte plus a two-byte varint
-    // length for every maximum-size frame. This excludes the overlay header.
-    static constexpr std::size_t maxExportShareRelayMessageBytes =
-        maxExportShareRelayPayloadBytes + 3 * maxExportSharesPerRelay;
-
-    // Provisional activation fee schedule. These values intentionally price
-    // Export intents above ordinary transactions until production measurements
-    // can replace the conservative work and storage estimates.
-    //
-    // Witness bytes are estimated from the exact serialized target size, a
-    // fixed allowance for the witness envelope/origin stamp/contributor mask,
-    // and one bounded signer entry for every selected member. The accepted
-    // sidecar witness retains every valid committee contribution, not merely
-    // the minimum quorum subset.
-    static constexpr std::uint64_t feeWitnessFixedAllowanceBytes = 384;
-    static constexpr std::uint64_t feeWitnessSignerAllowanceBytes = 128;
-    static constexpr std::uint64_t feeSharePublicationRounds =
-        maxPublicationLedgers + 1;
-    static constexpr std::uint64_t feeWorkUnitsPerSharePublication = 1;
-    static constexpr std::uint64_t feeWorkUnitsPerWitnessSignature = 2;
-    static constexpr std::uint64_t feeWitnessChunkBytes = 256;
-    static constexpr std::uint64_t feeWorkUnitsPerWitnessChunk = 1;
-    static constexpr std::uint64_t feePermanentWitnessByteDrops = 1;
-    static constexpr std::uint64_t feeSurchargeRoundDrops = 1'000;
-};
-
-}  // namespace ripple
-
-#endif

include/xrpl/protocol/ExportOriginMemo.h

@@ -1,104 +0,0 @@
-//------------------------------------------------------------------------------
-/*
-    This file is part of rippled: https://github.com/ripple/rippled
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-*/
-//==============================================================================
-
-#ifndef RIPPLE_PROTOCOL_EXPORTORIGINMEMO_H_INCLUDED
-#define RIPPLE_PROTOCOL_EXPORTORIGINMEMO_H_INCLUDED
-
-#include <xrpl/basics/Expected.h>
-#include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/UintTypes.h>
-
-#include <cstdint>
-#include <optional>
-#include <string_view>
-
-namespace ripple::ExportOriginMemo {
-
-inline constexpr std::string_view memoType = "xahau/export";
-inline constexpr std::uint8_t version = 1;
-inline constexpr std::uint8_t allowedFlags = 0;
-inline constexpr std::size_t identityBytes = 42;
-inline constexpr std::size_t releaseBytes = 78;
-
-struct Origin
-{
-    std::uint32_t sourceDomain;
-    std::uint32_t targetDomain;
-    uint256 transactionHash;
-
-    bool
-    operator==(Origin const&) const = default;
-};
-
-struct Anchor
-{
-    LedgerIndex ledgerSequence;
-    uint256 ledgerHash;
-
-    bool
-    operator==(Anchor const&) const = default;
-};
-
-struct Stamp
-{
-    Origin origin;
-    std::optional<Anchor> anchor;
-
-    bool
-    operator==(Stamp const&) const = default;
-};
-
-enum class Error {
-    reservedMemoPresent,
-    reservedMemoMissing,
-    reservedMemoPosition,
-    malformedMemo,
-    unsupportedVersion,
-    unsupportedFlags,
-    localChecks
-};
-
-/** Return true when any Memo reserves the Export protocol MemoType. */
-bool
-hasReservedMemo(STTx const& tx);
-
-/** Append the canonical identity projection as the final Memo.
-
-    Existing Memos remain byte-identical and in their original order. This
-    function does not normalize transaction authorization fields; callers must
-    supply the canonical unsigned multisign base.
-*/
-Expected<STTx, Error>
-identityForm(STTx const& base, Origin const& origin);
-
-/** Append the canonical release projection as the final Memo. */
-Expected<STTx, Error>
-releaseForm(STTx const& base, Origin const& origin, Anchor const& anchor);
-
-/** Parse one canonical final Export Memo. */
-Expected<Stamp, Error>
-parse(STTx const& tx);
-
-/** Replace a canonical release projection with its identity projection. */
-Expected<STTx, Error>
-projectIdentity(STTx const& stamped);
-
-}  // namespace ripple::ExportOriginMemo
-
-#endif

include/xrpl/protocol/ExportShare.h

@@ -1,142 +0,0 @@
-#ifndef RIPPLE_PROTOCOL_EXPORTSHARE_H_INCLUDED
-#define RIPPLE_PROTOCOL_EXPORTSHARE_H_INCLUDED
-
-#include <xrpl/basics/Buffer.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/ExportLimits.h>
-#include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/Serializer.h>
-#include <xrpl/protocol/digest.h>
-
-#include <cstdint>
-#include <cstring>
-#include <optional>
-#include <stdexcept>
-
-namespace ripple {
-
-/** Canonical post-validation Export signature contribution.
-
-    The multisign signature authenticates the derived destination transaction.
-    The remaining fields are bounded lookup and release context which live
-    admission checks against the origin latch and local validated chain.
-*/
-struct ExportShare
-{
-    static constexpr std::uint8_t currentVersion = 1;
-
-    std::uint8_t version{currentVersion};
-    AccountID owner;
-    uint256 originTxn;
-    LedgerIndex originLedgerSeq{0};
-    uint256 originLedgerHash;
-    std::uint16_t committeePosition{0};
-    PublicKey signingKey;
-    Buffer signature;
-
-    bool
-    hasCanonicalSignature() const
-    {
-        auto const keyType = publicKeyType(signingKey);
-        if (!keyType)
-            return false;
-
-        auto const sig = Slice{signature.data(), signature.size()};
-        if (*keyType == KeyType::secp256k1)
-        {
-            auto const canonicality = ecdsaCanonicality(sig);
-            return canonicality &&
-                *canonicality == ECDSACanonicality::fullyCanonical;
-        }
-
-        // Full Ed25519 canonicality is enforced by cryptographic admission.
-        // The framing layer can still reject every impossible wire length.
-        return *keyType == KeyType::ed25519 && signature.size() == 64;
-    }
-
-    bool
-    validShape() const
-    {
-        return version == currentVersion && owner != beast::zero &&
-            !originTxn.isZero() && originLedgerSeq != 0 &&
-            !originLedgerHash.isZero() &&
-            committeePosition < ExportLimits::maxCommitteeMembers &&
-            hasCanonicalSignature();
-    }
-
-    Serializer
-    serialize() const
-    {
-        if (!validShape())
-            throw std::invalid_argument("invalid ExportShare shape");
-
-        Serializer result;
-        result.add8(version);
-        result.addBitString(owner);
-        result.addBitString(originTxn);
-        result.add32(originLedgerSeq);
-        result.addBitString(originLedgerHash);
-        result.add16(committeePosition);
-        result.addRaw(signingKey.slice());
-        result.addVL(signature);
-        return result;
-    }
-
-    uint256
-    wireHash() const
-    {
-        // Raw-wire suppression only. Routing context such as committeePosition
-        // is checked against validated state before relay and is not
-        // authenticated by the destination multisignature.
-        auto const bytes = serialize();
-        return sha512Half(bytes.slice());
-    }
-
-    static std::optional<ExportShare>
-    parse(Slice bytes)
-    {
-        if (bytes.empty() ||
-            bytes.size() > ExportLimits::maxSerializedExportShareBytes)
-            return std::nullopt;
-
-        try
-        {
-            SerialIter sit{bytes};
-            auto const version = sit.get8();
-            auto const owner = sit.getBitString<160, detail::AccountIDTag>();
-            auto const originTxn = sit.get256();
-            auto const originLedgerSeq = sit.get32();
-            auto const originLedgerHash = sit.get256();
-            auto const committeePosition = sit.get16();
-            auto const keySlice = sit.getSlice(33);
-            if (!publicKeyType(keySlice))
-                return std::nullopt;
-            PublicKey const signingKey{keySlice};
-            auto signature = sit.getVLBuffer();
-            if (!sit.empty())
-                return std::nullopt;
-
-            ExportShare result{
-                version,
-                owner,
-                originTxn,
-                originLedgerSeq,
-                originLedgerHash,
-                committeePosition,
-                signingKey,
-                std::move(signature)};
-            if (!result.validShape())
-                return std::nullopt;
-            return result;
-        }
-        catch (std::exception const&)
-        {
-            return std::nullopt;
-        }
-    }
-};
-
-}  // namespace ripple
-
-#endif

include/xrpl/protocol/HashPrefix.h

@@ -97,23 +97,8 @@ enum class HashPrefix : std::uint32_t {
     /** Credentials signature */
     credential = detail::make_hash_prefix('C', 'R', 'D'),
 
-    /** consensus extension sidecar object */
-    sidecar = detail::make_hash_prefix('S', 'C', 'R'),
-
-    /** consensus diagnostic observed participant set */
-    observedParticipants = detail::make_hash_prefix('O', 'B', 'P'),
-
-    /** consensus-bound fallback entropy digest (Tier 1: derived from
-        already-agreed round inputs when no agreed reveal set reaches an
-        accepted validator-participant tier; never to be confused with
-        validator entropy) */
-    entropyFallback = detail::make_hash_prefix('E', 'F', 'B'),
-
-    /** consensus entropy transaction-ordering salt */
-    entropyTxnOrder = detail::make_hash_prefix('E', 'T', 'O'),
-
-    /** immutable Export committee roster */
-    exportCommittee = detail::make_hash_prefix('E', 'C', 'M'),
+    /** Proof that a validator holds the export key it nominates */
+    exportKeyProof = detail::make_hash_prefix('E', 'K', 'P'),
 };
 
 template <class Hasher>

include/xrpl/protocol/Import.h

@@ -24,6 +24,7 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/basics/base64.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/json/json_reader.h>
 #include <charconv>
 
@@ -118,8 +119,9 @@ syntaxCheckProof(
         {
             if (!proof["hash"].isString() ||
                 proof["hash"].asString().size() != 64 ||
-                !proof["key"].isString() ||
+                !isHex(proof["hash"].asString()) || !proof["key"].isString() ||
                 proof["key"].asString().size() != 64 ||
+                !isHex(proof["key"].asString()) ||
                 !proof["children"].isObject())
             {
                 JLOG(j.warn()) << "XPOP.transaction.proof tree node has wrong "
@@ -132,7 +134,11 @@ syntaxCheckProof(
 
         for (const auto& branch : proof.getMemberNames())
         {
-            if (branch.size() != 1 || !isHex(branch))
+            // Upper case only: the txroot computation only looks up "0"-"F",
+            // so any other key would be silently ignored.
+            if (branch.size() != 1 ||
+                branch.find_first_not_of("0123456789ABCDEF") !=
+                    std::string::npos)
             {
                 JLOG(j.warn())
                     << "XPOP.transaction.proof child node was not 0-F "
@@ -143,9 +149,9 @@ syntaxCheckProof(
             const auto& node = proof[branch];
             if (!node.isObject() || !node["hash"].isString() ||
                 node["hash"].asString().size() != 64 ||
-                !node["key"].isString() ||
+                !isHex(node["hash"].asString()) || !node["key"].isString() ||
                 node["key"].asString().size() != 64 ||
-                !node["children"].isObject())
+                !isHex(node["key"].asString()) || !node["children"].isObject())
             {
                 JLOG(j.warn())
                     << "XPOP.transaction.proof tree node has wrong format";
@@ -454,15 +460,6 @@ getVLInfo(Json::Value const& xpop, beast::Journal const& j)
             << "Import: unl blob was not valid json (after base64 decoding)";
         return {};
     }
-    auto const isNonNegativeUInt = [](Json::Value const& value) {
-        return value.isUInt() || (value.isInt() && value.asInt() >= 0);
-    };
-    if (!list.isMember(jss::sequence) ||
-        !isNonNegativeUInt(list[jss::sequence]))
-    {
-        JLOG(j.warn()) << "Import: unl blob sequence was missing or negative";
-        return {};
-    }
     auto const sequence = list[jss::sequence].asUInt();
     auto const m = deserializeManifest(base64_decode(
         xpop[jss::validation][jss::unl][jss::manifest].asString()));
@@ -474,6 +471,45 @@ getVLInfo(Json::Value const& xpop, beast::Journal const& j)
     return {{sequence, m->masterKey}};
 }
 
+// <effective, expiration> of the unl blob, effective defaulting to the epoch
+inline std::optional<std::pair<NetClock::time_point, NetClock::time_point>>
+getVLWindow(Json::Value const& xpop, beast::Journal const& j)
+{
+    auto const data =
+        base64_decode(xpop[jss::validation][jss::unl][jss::blob].asString());
+    Json::Reader r;
+    Json::Value parsed;
+    if (!r.parse(data, parsed) || !parsed.isObject())
+    {
+        JLOG(j.warn()) << "Import: unl blob was not a json object (after "
+                          "base64 decoding)";
+        return {};
+    }
+
+    // const, so that operator[] does not insert missing members
+    Json::Value const& list = parsed;
+    auto const time = [&list](Json::StaticString const& field)
+        -> std::optional<NetClock::time_point> {
+        auto const& v = list[field];
+        if (!v.isInt() || v.asInt() < 0)
+            return {};
+        return NetClock::time_point{NetClock::duration{v.asUInt()}};
+    };
+
+    auto const validUntil = time(jss::expiration);
+    auto const validFrom = list.isMember(jss::effective)
+        ? time(jss::effective)
+        : std::optional<NetClock::time_point>{NetClock::time_point{}};
+    if (!validUntil || !validFrom)
+    {
+        JLOG(j.warn()) << "Import: unl blob json (after base64 decoding) "
+                          "had missing or invalid effective/expiration";
+        return {};
+    }
+
+    return {{*validFrom, *validUntil}};
+}
+
 }  // namespace ripple
 
 #endif

include/xrpl/protocol/Indexes.h

@@ -62,22 +62,6 @@ emittedDir() noexcept;
 Keylet
 emittedTxn(uint256 const& id) noexcept;
 
-/** Locate an Export latch by its permanent source issuance identity.
-
-    The source Export transaction ID is content-addressed and cannot be reused,
-    including after AccountDelete.
-*/
-Keylet
-exportLatch(AccountID const& account, uint256 const& originTxnHash) noexcept;
-
-/** Locate an immutable Export committee owned by an account. */
-Keylet
-exportCommittee(AccountID const& account, uint256 const& digest) noexcept;
-
-/** The fixed global directory of Export latches awaiting witness work. */
-Keylet const&
-pendingExports() noexcept;
-
 Keylet
 hookDefinition(uint256 const& hash) noexcept;
 
@@ -134,10 +118,6 @@ negativeUNL() noexcept;
 Keylet const&
 UNLReport() noexcept;
 
-/** The (fixed) index of the object containing consensus-derived entropy. */
-Keylet const&
-consensusEntropy() noexcept;
-
 /** The beginning of an order book */
 struct book_t
 {
@@ -396,6 +376,14 @@ permissionedDomain(uint256 const& domainID) noexcept;
 Keylet
 manifest(PublicKey const& pk) noexcept;
 
+/** A pending export, ordered by creation ledger so TxQ can walk them. */
+Keylet
+exportedTxn(std::uint32_t seq, uint256 const& txid) noexcept;
+
+/** The shadow ticket for an export using `ticketSeq` on the other network. */
+Keylet
+shadowTicket(AccountID const& account, std::uint32_t ticketSeq) noexcept;
+
 }  // namespace keylet
 
 // Everything below is deprecated and should be removed in favor of keylets:

include/xrpl/protocol/LedgerFormats.h

@@ -186,10 +186,6 @@ enum LedgerSpecificFlags {
     // remarks
     lsfImmutable = 1,
 
-    // ltEXPORT_LATCH
-    lsfExportXpopSeen = 0x00000001,
-    lsfExportCanceled = 0x00000002,
-
     // ltMPTOKEN_ISSUANCE
     lsfMPTLocked = 0x00000001, // Also used in ltMPTOKEN
     lsfMPTCanLock = 0x00000002,

include/xrpl/protocol/Protocol.h

@@ -43,19 +43,6 @@ std::size_t constexpr txMinSizeBytes = 10;
 /** Largest legal byte size of a transaction. */
 std::size_t constexpr txMaxSizeBytes = megabytes(1);
 
-/** Largest network ID whose transactions retain the legacy canonical form.
-
-    Transactions on these networks must omit sfNetworkID. Transactions on
-    networks with larger IDs must include sfNetworkID matching the network.
- */
-std::uint32_t constexpr maxNetworkIDWithoutTxField = 1024;
-
-constexpr bool
-requiresTxNetworkID(std::uint32_t networkID)
-{
-    return networkID > maxNetworkIDWithoutTxField;
-}
-
 /** The maximum number of unfunded offers to delete at once */
 std::size_t constexpr unfundedOfferRemoveLimit = 1000;
 

include/xrpl/protocol/SidecarType.h

@@ -1,21 +0,0 @@
-#ifndef RIPPLE_PROTOCOL_SIDECAR_TYPE_H_INCLUDED
-#define RIPPLE_PROTOCOL_SIDECAR_TYPE_H_INCLUDED
-
-#include <cstdint>
-
-namespace ripple {
-
-/// Discriminator for sidecar set entries (SHAMap leaves used for
-/// consensus extension data: RNG commit/reveal, export signatures).
-///
-/// Stored in sfSidecarType (UINT8) on each STObject entry.
-/// Makes sidecar sets self-describing — no content-sniffing needed.
-enum SidecarType : std::uint8_t {
-    sidecarRngCommit = 1,
-    sidecarRngReveal = 2,
-    sidecarExportSig = 3,
-};
-
-}  // namespace ripple
-
-#endif

include/xrpl/protocol/TER.h

@@ -68,10 +68,8 @@ enum TELcodes : TERUnderlyingType {
     telNON_LOCAL_EMITTED_TXN,
     telIMPORT_VL_KEY_NOT_RECOGNISED,
     telCAN_NOT_QUEUE_IMPORT,
-    // Keep test-only sentinels before appended branch-local TEL codes so their
-    // numeric values do not move.
     telENV_RPC_FAILED,
-    telEXPORT_LATCH_REQUIRED,
+    telMANIFEST_FEE_MISMATCH,
 };
 
 //------------------------------------------------------------------------------
@@ -368,7 +366,6 @@ enum TECcodes : TERUnderlyingType {
     tecARRAY_TOO_LARGE = 197,
     tecLOCKED = 198,
     tecBAD_CREDENTIALS = 199,
-    tecEXPORT_COMMITTEE_UNAVAILABLE = 201,
     tecLAST_POSSIBLE_ENTRY = 255,
 };
 

include/xrpl/protocol/TxFlags.h

@@ -242,8 +242,11 @@ constexpr std::uint32_t const tfClawbackMask               = ~tfUniversal;
 // CronSet Flags:
 enum CronSetFlags : uint32_t {
     tfCronUnset = 0x00000001,
+    // featureExport: fire after each export key rotation (see Export.h)
+    tfCronExportRotation = 0x00000002,
 };
-constexpr std::uint32_t const tfCronSetMask = ~(tfUniversal | tfCronUnset);
+constexpr std::uint32_t const tfCronSetMask =
+    ~(tfUniversal | tfCronUnset | tfCronExportRotation);
 
 // AMM Flags:
 constexpr std::uint32_t tfLPToken                          = 0x00010000;
@@ -274,17 +277,6 @@ enum BridgeModifyFlags : uint32_t {
     tfClearAccountCreateAmount = 0x00010000,
 };
 constexpr std::uint32_t tfBridgeModifyMask = ~(tfUniversal | tfClearAccountCreateAmount);
-
-// Export flags:
-enum ExportFlags : uint32_t {
-    // Lifecycle control: erase the named latch and forfeit any later callback.
-    tfExportEraseLatch = 0x00010000,
-    // Committee control: erase the named immutable committee object.
-    tfExportEraseCommittee = 0x00020000,
-};
-constexpr std::uint32_t tfExportMask =
-    ~(tfUniversal | tfExportEraseLatch | tfExportEraseCommittee);
-
 // clang-format on
 
 }  // namespace ripple

include/xrpl/protocol/TxMeta.h

@@ -176,6 +176,7 @@ private:
     std::optional<STAmount> mDelivered;
     std::optional<STArray> mHookExecutions;
     std::optional<STArray> mHookEmissions;
+
     STArray mNodes;
 };
 

include/xrpl/protocol/ValidatorBitset.h

@@ -1,158 +0,0 @@
-//------------------------------------------------------------------------------
-/*
-    This file is part of rippled: https://github.com/ripple/rippled
-    Copyright 2026 Xahau
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose  with  or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-*/
-//==============================================================================
-
-#ifndef RIPPLE_PROTOCOL_VALIDATORBITSET_H_INCLUDED
-#define RIPPLE_PROTOCOL_VALIDATORBITSET_H_INCLUDED
-
-#include <xrpl/basics/Blob.h>
-#include <xrpl/basics/Slice.h>
-
-#include <bit>
-#include <cstddef>
-#include <cstdint>
-#include <optional>
-#include <utility>
-
-namespace ripple {
-
-class ValidatedValidatorBitset
-{
-    Blob bitset_;
-    std::size_t memberCount_ = 0;
-    std::size_t selected_ = 0;
-
-    ValidatedValidatorBitset(
-        Slice bitset,
-        std::size_t memberCount,
-        std::size_t selected)
-        : bitset_(bitset.begin(), bitset.end())
-        , memberCount_(memberCount)
-        , selected_(selected)
-    {
-    }
-
-public:
-    ValidatedValidatorBitset(ValidatedValidatorBitset const&) = default;
-    ValidatedValidatorBitset&
-    operator=(ValidatedValidatorBitset const&) = default;
-
-    ValidatedValidatorBitset(ValidatedValidatorBitset&& other) noexcept
-        : bitset_(std::move(other.bitset_))
-        , memberCount_(other.memberCount_)
-        , selected_(other.selected_)
-    {
-        other.bitset_.clear();
-        other.memberCount_ = 0;
-        other.selected_ = 0;
-    }
-
-    ValidatedValidatorBitset&
-    operator=(ValidatedValidatorBitset&& other) noexcept
-    {
-        if (this != &other)
-        {
-            bitset_ = std::move(other.bitset_);
-            memberCount_ = other.memberCount_;
-            selected_ = other.selected_;
-
-            other.bitset_.clear();
-            other.memberCount_ = 0;
-            other.selected_ = 0;
-        }
-        return *this;
-    }
-
-    /** Construct an owning, validated validator bitset. */
-    static std::optional<ValidatedValidatorBitset>
-    make(Slice bitset, std::size_t memberCount);
-
-    std::size_t
-    selected() const
-    {
-        return selected_;
-    }
-
-    bool
-    contains(std::size_t position) const
-    {
-        if (position >= memberCount_)
-            return false;
-
-        auto const byte = position / 8;
-        return (bitset_[byte] &
-                static_cast<std::uint8_t>(1u << (position % 8))) != 0;
-    }
-};
-
-constexpr std::size_t
-validatorBitsetBytes(std::size_t memberCount)
-{
-    return memberCount / 8 + (memberCount % 8 != 0);
-}
-
-/** Validate an LSB-first bitset over a fixed canonical validator universe.
-
-    A valid bitset has exactly enough bytes for the universe and leaves every
-    unused high bit in the final byte clear. The returned population can be
-    used by a caller's profile-specific admission and quorum rules.
-*/
-inline std::optional<ValidatedValidatorBitset>
-validateValidatorBitset(Slice bitset, std::size_t memberCount)
-{
-    return ValidatedValidatorBitset::make(bitset, memberCount);
-}
-
-inline std::optional<ValidatedValidatorBitset>
-ValidatedValidatorBitset::make(Slice bitset, std::size_t memberCount)
-{
-    if (bitset.size() != validatorBitsetBytes(memberCount))
-        return std::nullopt;
-
-    auto const remainder = memberCount % 8;
-    if (remainder != 0)
-    {
-        auto const allowed = static_cast<std::uint8_t>((1u << remainder) - 1u);
-        if ((bitset[bitset.size() - 1] & static_cast<std::uint8_t>(~allowed)) !=
-            0)
-            return std::nullopt;
-    }
-
-    std::size_t selected = 0;
-    for (auto const byte : bitset)
-        selected += std::popcount(byte);
-
-    return ValidatedValidatorBitset{bitset, memberCount, selected};
-}
-
-template <class Predicate>
-Blob
-makeValidatorBitset(std::size_t memberCount, Predicate&& selected)
-{
-    Blob bitset(validatorBitsetBytes(memberCount), 0);
-    for (std::size_t i = 0; i < memberCount; ++i)
-    {
-        if (selected(i))
-            bitset[i / 8] |= static_cast<std::uint8_t>(1u << (i % 8));
-    }
-    return bitset;
-}
-
-}  // namespace ripple
-
-#endif

include/xrpl/protocol/detail/features.macro

@@ -34,7 +34,12 @@
 // If you add an amendment here, then do not forget to increment `numFeatures`
 // in include/xrpl/protocol/Feature.h.
 
-XRPL_FEATURE(OnChainManifests,           Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(Export,                     Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (20261005,                   Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(EscrowDestinationCancel,    Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (20260929,                   Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(HookOnV2_1,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(OnChainManifests,           Supported::yes,  VoteBehavior::DefaultNo)
 XRPL_FIX    (HookMap,                    Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (GuardDepth32,               Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(NamedHooks,                 Supported::yes, VoteBehavior::DefaultNo)
@@ -45,7 +50,7 @@ XRPL_FEATURE(HookAPISerializedType240,   Supported::yes, VoteBehavior::DefaultNo
 XRPL_FEATURE(PermissionedDomains,        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(DynamicNFT,                 Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(Credentials,                Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(AMMClawback,                Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(AMMClawback,                Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(MPTokensV1,                 Supported::no,  VoteBehavior::DefaultNo)
 // InvariantsV1_1 will be changes to Supported::yes when all the
 // invariants expected to be included under it are complete.
@@ -65,9 +70,8 @@ XRPL_FEATURE(XChainBridge,               Supported::no,  VoteBehavior::DefaultNo
 XRPL_FEATURE(AMM,                        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (ReducedOffersV1,            Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(HooksUpdate2,               Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(HookOnV2,                   Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(Export,                     Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(ConsensusEntropy,           Supported::yes, VoteBehavior::DefaultNo)
+// replaced to HookOnV2_1
+XRPL_FEATURE(HookOnV2,                   Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (HookAPI20251128,            Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (CronStacking,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(ExtendedHookState,          Supported::yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -22,14 +22,14 @@
 #endif
 
 #ifndef LEDGER_ENTRY_DUPLICATE
-// The EXPAND macro is needed for Windows
+// The LEDGER_ENTRY_EXPAND macro is needed for Windows
 // https://stackoverflow.com/questions/5134523/msvc-doesnt-expand-va-args-correctly
-#define EXPAND(x) x
+#define LEDGER_ENTRY_EXPAND(x) x
 
 // The `LEDGER_ENTRY_DUPLICATE macro is needed to avoid JSS conflicts
 // Since some transactions and ledger entries have the same name (like `DepositPreauth`)
 // The compiler won't accept two instances of `JSS(DepositPreauth)`
-#define LEDGER_ENTRY_DUPLICATE(...) EXPAND(LEDGER_ENTRY(__VA_ARGS__))
+#define LEDGER_ENTRY_DUPLICATE(...) LEDGER_ENTRY_EXPAND(LEDGER_ENTRY(__VA_ARGS__))
 #endif
 
 /**
@@ -109,6 +109,44 @@ LEDGER_ENTRY(ltHOOK_DEFINITION, 'D', HookDefinition, hook_definition, ({
     {sfPreviousTxnLgrSeq,    soeOPTIONAL},
 }))
 
+/** A pending export: the transaction being multisigned for another network,
+    gathering UNL signatures in its sfSigners until ttEXPORT_FINAL deletes it,
+    with the exporter's signer list there when it was created. sfOwner is the
+    exporting account, so the signatures and the result are attributed to it
+    in metadata. sfEmitHookHash is the hook to call back if it closes below
+    quorum.
+
+    \sa keylet::exportedTxn
+*/
+LEDGER_ENTRY(ltEXPORTED_TXN, 'X', ExportedTxn, exported_txn, ({
+    {sfOwner,                soeREQUIRED},
+    {sfExportedTxn,          soeREQUIRED},
+    {sfTransactionHash,      soeREQUIRED},
+    {sfLedgerSequence,       soeREQUIRED},
+    {sfSignerEntries,        soeREQUIRED},
+    {sfSignerQuorum,         soeREQUIRED},
+    {sfEmitHookHash,         soeOPTIONAL},
+}))
+
+/** A shadow ticket: lets one XPOP of a ticketed export that is bound back to
+    this network (OperationLimit == NETWORK_ID) be imported, which consumes it.
+    Only ttEXPORT creates these. They are not hook state because a hook can
+    write any namespace of its own account's state, so it could forge one and
+    import the same XPOP again and again. sfEmitHookHash is the hook whose
+    cbak the Import calls.
+
+    \sa keylet::shadowTicket
+*/
+LEDGER_ENTRY(ltSHADOW_TICKET, 'Y', ShadowTicket, shadow_ticket, ({
+    {sfAccount,              soeREQUIRED},
+    {sfTicketSequence,       soeREQUIRED},
+    {sfTransactionHash,      soeREQUIRED},
+    {sfEmitHookHash,         soeOPTIONAL},
+    {sfOwnerNode,            soeREQUIRED},
+    {sfPreviousTxnID,        soeREQUIRED},
+    {sfPreviousTxnLgrSeq,    soeREQUIRED},
+}))
+
 /** A ledger object containing a hook-emitted transaction from a previous hook execution.
 
     \sa keylet::emitted
@@ -176,6 +214,12 @@ LEDGER_ENTRY(ltNFTOKEN_PAGE, 0x0050, NFTokenPage, nft_page, ({
 LEDGER_ENTRY_DUPLICATE(ltUNL_REPORT, 0x0052, UNLReport, unl_report, ({
     {sfImportVLKeys,         soeOPTIONAL},
     {sfActiveValidators,     soeOPTIONAL},
+    /* featureExport: the ledger of the last ActiveValidator/ImportVLKey
+       report, which decides when the arrays above are reset. Export key
+       reports also modify this object, so PreviousTxnLgrSeq no longer can. */
+    {sfLedgerSequence,       soeOPTIONAL},
+    /* featureExport: bumped whenever a validator's export key changes. */
+    {sfExportKeysSeq,        soeOPTIONAL},
     {sfPreviousTxnID,        soeREQUIRED},
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
@@ -223,23 +267,6 @@ LEDGER_ENTRY(ltURI_TOKEN, 0x0055, URIToken, uri_token, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
-/** The ledger object which stores consensus-derived entropy.
-
-    \note This is a singleton: only one such object exists in the ledger.
-
-    \sa keylet::consensusEntropy
- */
-LEDGER_ENTRY_DUPLICATE(ltCONSENSUS_ENTROPY, 0x0058, ConsensusEntropy, consensus_entropy, ({
-    {sfDigest,               soeREQUIRED},
-    {sfEntropyCount,         soeREQUIRED},
-    {sfEntropyDenominator,   soeREQUIRED},
-    {sfEntropyContributors,  soeREQUIRED},
-    {sfEntropyTier,          soeREQUIRED},
-    {sfLedgerSequence,       soeREQUIRED},
-    {sfPreviousTxnID,        soeREQUIRED},
-    {sfPreviousTxnLgrSeq,    soeREQUIRED},
-}))
-
 /** A ledger object which describes an account.
 
     \sa keylet::account
@@ -274,15 +301,17 @@ LEDGER_ENTRY(ltACCOUNT_ROOT, 0x0061, AccountRoot, account, ({
     {sfImportSequence,       soeOPTIONAL},
     {sfGovernanceFlags,      soeOPTIONAL},
     {sfGovernanceMarks,      soeOPTIONAL},
-    //@@start account-index-optional-accountroot-field
     {sfAccountIndex,         soeOPTIONAL},
-    //@@end account-index-optional-accountroot-field
     {sfTouchCount,           soeOPTIONAL},
     {sfHookStateScale,       soeOPTIONAL},
     {sfCron,                 soeOPTIONAL},
     {sfAMMID,                soeOPTIONAL},
-    {sfExportCount,          soeOPTIONAL},
     {sfManifestID,           soeOPTIONAL},
+    /* featureExport: a validator's export keys, newest first */
+    {sfExportKeys,           soeOPTIONAL},
+    /* featureExport: the signer list this account holds on the network it
+       exports to, as last proven by an Import of its SignerListSet */
+    {sfExportSignerList,     soeOPTIONAL},
 }))
 
 /** A ledger object which contains a list of object identifiers.
@@ -298,7 +327,6 @@ LEDGER_ENTRY(ltDIR_NODE, 0x0064, DirectoryNode, directory, ({
     {sfTakerGetsIssuer,      soeOPTIONAL},  // order book directories
     {sfExchangeRate,         soeOPTIONAL},  // order book directories
     {sfReferenceCount,       soeOPTIONAL},  // for hook state directories
-    {sfExportCount,          soeOPTIONAL},  // live latches on Export root
     {sfIndexes,              soeREQUIRED},
     {sfRootIndex,            soeREQUIRED},
     {sfIndexNext,            soeOPTIONAL},
@@ -439,9 +467,7 @@ LEDGER_ENTRY(ltFEE_SETTINGS, 0x0073, FeeSettings, fee, ({
     {sfReserveBaseDrops,       soeOPTIONAL},
     {sfReserveIncrementDrops,  soeOPTIONAL},
     {sfXahauActivationLgrSeq,  soeOPTIONAL},
-    //@@start account-count-optional-fees-field
     {sfAccountCount,           soeOPTIONAL},
-    //@@end account-count-optional-fees-field
     {sfNetworkID,              soeOPTIONAL},
     {sfPreviousTxnID,          soeOPTIONAL},
     {sfPreviousTxnLgrSeq,      soeOPTIONAL},
@@ -616,39 +642,6 @@ LEDGER_ENTRY(ltDID, 0x008D, DID, did, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
-//@@start export-latch-ledger-entry
-/** A live lifecycle latch for an Export intent.
-
-    Created when an Export intent is admitted. It records witness and
-    proof-of-execution arrival in either order and is erased once both facts
-    exist. Account-owned (pays reserve).
-    sfDigest stores the canonical target signing-intent hash.
-
-    \sa keylet::exportLatch
- */
-LEDGER_ENTRY(ltEXPORT_LATCH, 0x5374, ExportLatch, export_latch, ({
-    {sfAccount,              soeREQUIRED},
-    {sfExportCallbackFee, soeOPTIONAL},
-    {sfTicketSequence,       soeREQUIRED},
-    {sfTransactionHash,      soeOPTIONAL},
-    {sfDigest,               soeREQUIRED},
-    {sfLedgerSequence,       soeREQUIRED},
-    {sfExportCommitteeHash,  soeREQUIRED},
-    {sfExportSignatureHash,  soeOPTIONAL},
-    {sfLastLedgerSequence,   soeOPTIONAL},
-    {sfOwnerNode,            soeREQUIRED},
-    {sfExportNode,           soeOPTIONAL},
-}))
-//@@end export-latch-ledger-entry
-
-/** An immutable, account-owned Export validator committee. */
-LEDGER_ENTRY(ltEXPORT_COMMITTEE, 0x4563, ExportCommittee, export_committee, ({
-    {sfAccount,              soeREQUIRED},
-    {sfExportCommitteeHash,  soeREQUIRED},
-    {sfExportCommittee,      soeREQUIRED},
-    {sfOwnerNode,            soeREQUIRED},
-}))
-
 LEDGER_ENTRY(ltMANIFEST, 0x004D, Manifest, manifest_entry, ({
     {sfAccount,             soeREQUIRED},
     {sfPublicKey,           soeREQUIRED},
@@ -669,5 +662,6 @@ LEDGER_ENTRY(ltMANIFEST, 0x004D, Manifest, manifest_entry, ({
     {sfPreviousTxnLgrSeq,   soeREQUIRED},
 }))
 
-#undef EXPAND
+#undef LEDGER_ENTRY_EXPAND
 #undef LEDGER_ENTRY_DUPLICATE
+

include/xrpl/protocol/detail/sfields.macro

@@ -42,8 +42,6 @@ TYPED_SFIELD(sfTickSize,                 UINT8,     16)
 TYPED_SFIELD(sfUNLModifyDisabling,       UINT8,     17)
 TYPED_SFIELD(sfHookResult,               UINT8,     18)
 TYPED_SFIELD(sfWasLockingChainSend,      UINT8,     19)
-TYPED_SFIELD(sfSidecarType,              UINT8,     20)
-TYPED_SFIELD(sfEntropyTier,              UINT8,     21)
 
 // 16-bit integers (common)
 TYPED_SFIELD(sfLedgerEntryType,          UINT16,     1, SField::sMD_Never)
@@ -61,10 +59,6 @@ TYPED_SFIELD(sfHookExecutionIndex,       UINT16,    19)
 TYPED_SFIELD(sfHookApiVersion,           UINT16,    20)
 TYPED_SFIELD(sfHookStateScale,           UINT16,    21)
 TYPED_SFIELD(sfLedgerFixType,            UINT16,    22)
-TYPED_SFIELD(sfHookExportCount,          UINT16,    98)
-TYPED_SFIELD(sfEntropyCount,             UINT16,    99)
-TYPED_SFIELD(sfEntropyDenominator,       UINT16,   100)
-TYPED_SFIELD(sfExportCount,              UINT16,   101)
 
 // 32-bit integers (common)
 TYPED_SFIELD(sfNetworkID,                UINT32,     1)
@@ -121,6 +115,7 @@ TYPED_SFIELD(sfLockCount,                UINT32,    49)
 TYPED_SFIELD(sfFirstNFTokenSequence,     UINT32,    50)
 TYPED_SFIELD(sfOracleDocumentID,         UINT32,    51)
 
+TYPED_SFIELD(sfExportKeysSeq,            UINT32,    92)
 TYPED_SFIELD(sfStartTime,                UINT32,    93)
 TYPED_SFIELD(sfRepeatCount,              UINT32,    94)
 TYPED_SFIELD(sfDelaySeconds,             UINT32,    95)
@@ -159,7 +154,6 @@ TYPED_SFIELD(sfOutstandingAmount,        UINT64,    25, SField::sMD_BaseTen|SFie
 TYPED_SFIELD(sfMPTAmount,                UINT64,    26, SField::sMD_BaseTen|SField::sMD_Default)
 TYPED_SFIELD(sfIssuerNode,               UINT64,    27)
 TYPED_SFIELD(sfSubjectNode,              UINT64,    28)
-TYPED_SFIELD(sfExportNode,               UINT64,    29)
 TYPED_SFIELD(sfTouchCount,               UINT64,    97)
 TYPED_SFIELD(sfAccountIndex,             UINT64,    98)
 TYPED_SFIELD(sfAccountCount,             UINT64,    99)
@@ -217,8 +211,6 @@ TYPED_SFIELD(sfOfferID,                  UINT256,   34)
 TYPED_SFIELD(sfEscrowID,                 UINT256,   35)
 TYPED_SFIELD(sfURITokenID,               UINT256,   36)
 TYPED_SFIELD(sfDomainID,                 UINT256,   37)
-TYPED_SFIELD(sfExportSignatureHash,      UINT256,   38)
-TYPED_SFIELD(sfExportCommitteeHash,      UINT256,   39)
 TYPED_SFIELD(sfManifestID,               UINT256,   91)
 TYPED_SFIELD(sfHookOnOutgoing,           UINT256,   93)
 TYPED_SFIELD(sfHookOnIncoming,           UINT256,   94)
@@ -267,7 +259,6 @@ TYPED_SFIELD(sfPrice,                    AMOUNT,    28)
 TYPED_SFIELD(sfSignatureReward,          AMOUNT,    29)
 TYPED_SFIELD(sfMinAccountCreateAmount,   AMOUNT,    30)
 TYPED_SFIELD(sfLPTokenBalance,           AMOUNT,    31)
-TYPED_SFIELD(sfExportCallbackFee,        AMOUNT,    32)
 TYPED_SFIELD(sfTrustLineRewardAccumulator,AMOUNT,   99)
 
 // variable length (common)
@@ -304,9 +295,8 @@ TYPED_SFIELD(sfAssetClass,               VL,        29)
 TYPED_SFIELD(sfProvider,                 VL,        30)
 TYPED_SFIELD(sfMPTokenMetadata,          VL,        31)
 TYPED_SFIELD(sfCredentialType,           VL,        32)
-TYPED_SFIELD(sfEntropyContributors,      VL,        33)
-TYPED_SFIELD(sfExportCommittee,          VL,        34)
-TYPED_SFIELD(sfExportContributors,       VL,        35)
+TYPED_SFIELD(sfExportKeyProof,           VL,        95)
+TYPED_SFIELD(sfExportKey,                VL,        96)
 TYPED_SFIELD(sfHookName,                 VL,        97)
 TYPED_SFIELD(sfRemarkValue,              VL,        98)
 TYPED_SFIELD(sfRemarkName,               VL,        99)
@@ -379,7 +369,7 @@ UNTYPED_SFIELD(sfHook,                   OBJECT,    14)
 
 // inner object (uncommon)
 UNTYPED_SFIELD(sfSigner,                 OBJECT,    16)
-UNTYPED_SFIELD(sfExportSigner,           OBJECT,    17)
+//                                                  17 unused
 UNTYPED_SFIELD(sfMajority,               OBJECT,    18)
 UNTYPED_SFIELD(sfDisabledValidator,      OBJECT,    19)
 UNTYPED_SFIELD(sfEmittedTxn,             OBJECT,    20)
@@ -396,7 +386,10 @@ UNTYPED_SFIELD(sfXChainClaimAttestationCollectionElement, OBJECT, 30)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestationCollectionElement, OBJECT, 31)
 UNTYPED_SFIELD(sfPriceData,              OBJECT,    32)
 UNTYPED_SFIELD(sfCredential,             OBJECT,    33)
-UNTYPED_SFIELD(sfExportedTxn,            OBJECT,    89)
+UNTYPED_SFIELD(sfExportSignerList,       OBJECT,    86)
+UNTYPED_SFIELD(sfExportKeyReport,        OBJECT,    87)
+UNTYPED_SFIELD(sfExportKeyEntry,         OBJECT,    88)
+UNTYPED_SFIELD(sfExportedTxn,            OBJECT,    89, SField::sMD_Create|SField::sMD_DeleteFinal)
 UNTYPED_SFIELD(sfManifest,               OBJECT,    90)
 UNTYPED_SFIELD(sfAmountEntry,            OBJECT,    91)
 UNTYPED_SFIELD(sfMintURIToken,           OBJECT,    92)
@@ -431,12 +424,13 @@ UNTYPED_SFIELD(sfHookParameters,         ARRAY,     19)
 UNTYPED_SFIELD(sfHookGrants,             ARRAY,     20)
 UNTYPED_SFIELD(sfXChainClaimAttestations, ARRAY,    21)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestations, ARRAY, 22)
-UNTYPED_SFIELD(sfExportSigners,          ARRAY,     23)
+//                                                  23 unused
 UNTYPED_SFIELD(sfPriceDataSeries,        ARRAY,     24)
 UNTYPED_SFIELD(sfAuthAccounts,           ARRAY,     25)
 UNTYPED_SFIELD(sfAuthorizeCredentials,   ARRAY,     26)
 UNTYPED_SFIELD(sfUnauthorizeCredentials, ARRAY,     27)
 UNTYPED_SFIELD(sfAcceptedCredentials,    ARRAY,     28)
+UNTYPED_SFIELD(sfExportKeys,             ARRAY,     91)
 UNTYPED_SFIELD(sfAmounts,                ARRAY,     92)
 UNTYPED_SFIELD(sfHookEmissions,          ARRAY,     93)
 UNTYPED_SFIELD(sfImportVLKeys,           ARRAY,     94)

include/xrpl/protocol/detail/transactions.macro

@@ -500,17 +500,28 @@ TRANSACTION(ttPERMISSIONED_DOMAIN_DELETE, 72, PermissionedDomainDelete, ({
     {sfDomainID, soeREQUIRED},
 }))
 
-//@@start export-transaction-types
-/* User-submittable Export. Its mutually exclusive forms create an intent,
-   control an existing latch, or manage an immutable committee object. */
-TRANSACTION(ttEXPORT, 90, Export, ({
-    {sfExportedTxn, soeOPTIONAL},
-    {sfExportCallbackFee, soeOPTIONAL},
-    {sfTransactionHash, soeOPTIONAL},
-    {sfExportCommitteeHash, soeOPTIONAL},
-    {sfExportCommittee, soeOPTIONAL},
+/** Emitted by a hook (see xport()): have the export keys in the account's
+    sfExportSignerList multisign sfExportedTxn, a transaction for another
+    network from the hook's account. See Export.h. */
+TRANSACTION(ttEXPORT, 88, Export, ({
+    {sfExportedTxn, soeREQUIRED},
 }))
-//@@end export-transaction-types
+
+/** A UNL validator's multisignature over a pending export. Deliberately not a
+    pseudo-txn: disputed pseudo-txns are discarded, these are retried. */
+TRANSACTION(ttEXPORT_SIGN, 89, ExportSign, ({
+    {sfLedgerSequence, soeREQUIRED},
+    {sfTransactionHash, soeREQUIRED},
+    {sfSigner, soeREQUIRED},
+}))
+
+/** A pseudo-txn closing an export's signing window. */
+TRANSACTION(ttEXPORT_FINAL, 90, ExportFinal, ({
+    {sfOwner, soeREQUIRED},
+    {sfLedgerSequence, soeREQUIRED},
+    {sfTransactionHash, soeREQUIRED},
+}))
+
 /* sfAccount is supplied by TxFormats::commonFields; listing it here as well
    makes the SOTemplate reject the format at construction. */
 TRANSACTION(ttMANIFEST_SET, 91, SetManifest, ({
@@ -622,21 +633,5 @@ TRANSACTION(ttUNL_REPORT, 104, UNLReport, ({
     {sfLedgerSequence, soeREQUIRED},
     {sfActiveValidator, soeOPTIONAL},
     {sfImportVLKey, soeOPTIONAL},
-}))
-
-TRANSACTION(ttCONSENSUS_ENTROPY, 105, ConsensusEntropy, ({
-    {sfLedgerSequence, soeREQUIRED},
-    {sfDigest, soeREQUIRED},
-    {sfEntropyCount, soeREQUIRED},
-    {sfEntropyDenominator, soeREQUIRED},
-    {sfEntropyContributors, soeREQUIRED},
-    {sfEntropyTier, soeREQUIRED},
-}))
-
-TRANSACTION(ttEXPORT_SIGNATURES, 106, ExportSignatures, ({
-    {sfLedgerSequence, soeREQUIRED},
-    {sfTransactionHash, soeREQUIRED},
-    {sfExportedTxn, soeREQUIRED},
-    {sfExportContributors, soeREQUIRED},
-    {sfExportSigners, soeREQUIRED},
+    {sfExportKeyReport, soeOPTIONAL},
 }))

include/xrpl/protocol/jss.h

@@ -534,9 +534,6 @@ JSS(open_ledger_fee);         // out: TxQ
 JSS(open_ledger_level);       // out: TxQ
 JSS(oracles);                 // in: get_aggregate_price
 JSS(oracle_document_id);      // in: get_aggregate_price
-JSS(origin_ledger_hash);      // out: NetworkOPs
-JSS(origin_ledger_seq);       // out: NetworkOPs
-JSS(origin_txid);             // out: NetworkOPs
 JSS(owner);                   // in: LedgerEntry, out: NetworkOPs
 JSS(owner_funds);             // in/out: Ledger, NetworkOPs, AcceptedLedgerTx
 JSS(page_index);
@@ -658,7 +655,6 @@ JSS(state_now);               // in: Subscribe
 JSS(status);                  // error
 JSS(stop);                    // in: LedgerCleaner
 JSS(stop_history_tx_only);    // in: Unsubscribe, stop history tx stream
-JSS(stream);                  // out: NetworkOPs
 JSS(streams);                 // in: Subscribe, Unsubscribe
 JSS(strict);                  // in: AccountCurrencies, AccountInfo
 JSS(sub_index);               // in: LedgerEntry
@@ -740,7 +736,6 @@ JSS(TRANSACTION_FLAGS);     // out: RPC server_definitions
 JSS(TRANSACTION_FLAGS_INDICES);  // out: RPC server_definitions
 JSS(type_hex);                   // out: STPathSet
 JSS(unl);                        // out: UnlList
-JSS(committee_position);          // out: NetworkOPs
 JSS(unlimited);                  // out: Connection.h
 JSS(uptime);                     // out: GetCounts
 JSS(uri);                        // out: ValidatorSites

include/xrpl/server/Server.h

@@ -24,7 +24,8 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/server/Port.h>
 #include <xrpl/server/detail/ServerImpl.h>
-#include <boost/asio/io_service.hpp>
+
+#include <boost/asio/io_context.hpp>
 
 namespace ripple {
 
@@ -33,10 +34,10 @@ template <class Handler>
 std::unique_ptr<Server>
 make_Server(
     Handler& handler,
-    boost::asio::io_service& io_service,
+    boost::asio::io_context& io_context,
     beast::Journal journal)
 {
-    return std::make_unique<ServerImpl<Handler>>(handler, io_service, journal);
+    return std::make_unique<ServerImpl<Handler>>(handler, io_context, journal);
 }
 
 }  // namespace ripple

include/xrpl/server/Session.h

@@ -86,9 +86,7 @@ public:
              ++iter)
         {
             typename BufferSequence::value_type const& buffer(*iter);
-            write(
-                boost::asio::buffer_cast<void const*>(buffer),
-                boost::asio::buffer_size(buffer));
+            write(buffer.data(), boost::asio::buffer_size(buffer));
         }
     }
 
@@ -102,7 +100,7 @@ public:
 
     /** Detach the session.
         This holds the session open so that the response can be sent
-        asynchronously. Calls to io_service::run made by the server
+        asynchronously. Calls to io_context::run made by the server
         will not return until all detached sessions are closed.
     */
     virtual std::shared_ptr<Session>

include/xrpl/server/detail/BaseHTTPPeer.h

@@ -24,10 +24,12 @@
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/server/Session.h>
+#include <xrpl/server/detail/Spawn.h>
 #include <xrpl/server/detail/io_list.h>
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/asio/spawn.hpp>
 #include <boost/asio/ssl/stream.hpp>
+#include <boost/asio/strand.hpp>
 #include <boost/asio/streambuf.hpp>
 #include <boost/beast/core/stream_traits.hpp>
 #include <boost/beast/http/dynamic_body.hpp>
@@ -214,8 +216,8 @@ BaseHTTPPeer<Handler, Impl>::BaseHTTPPeer(
     ConstBufferSequence const& buffers)
     : port_(port)
     , handler_(handler)
-    , work_(executor)
-    , strand_(executor)
+    , work_(boost::asio::make_work_guard(executor))
+    , strand_(boost::asio::make_strand(executor))
     , remote_address_(remote_address)
     , journal_(journal)
 {
@@ -300,7 +302,13 @@ BaseHTTPPeer<Handler, Impl>::do_read(yield_context do_yield)
 {
     complete_ = false;
     error_code ec;
-    start_timer();
+    // Do not treat an established keep-alive waiting for its next request as
+    // an unfinished loopback request.
+    if (request_count_ == 0)
+        start_timer();
+    else
+        boost::beast::get_lowest_layer(impl().stream_)
+            .expires_after(std::chrono::seconds(timeoutSeconds));
     boost::beast::http::async_read(
         impl().stream_, read_buf_, message_, do_yield[ec]);
     cancel_timer();
@@ -355,7 +363,7 @@ BaseHTTPPeer<Handler, Impl>::on_write(
         return;
     if (graceful_)
         return do_close();
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
@@ -374,7 +382,7 @@ BaseHTTPPeer<Handler, Impl>::do_writer(
     {
         auto const p = impl().shared_from_this();
         resume = std::function<void(void)>([this, p, writer, keep_alive]() {
-            boost::asio::spawn(
+            util::spawn(
                 strand_,
                 std::bind(
                     &BaseHTTPPeer<Handler, Impl>::do_writer,
@@ -405,7 +413,7 @@ BaseHTTPPeer<Handler, Impl>::do_writer(
     if (!keep_alive)
         return do_close();
 
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
@@ -447,14 +455,14 @@ BaseHTTPPeer<Handler, Impl>::write(
     std::shared_ptr<Writer> const& writer,
     bool keep_alive)
 {
-    boost::asio::spawn(bind_executor(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_writer,
             impl().shared_from_this(),
             writer,
             keep_alive,
-            std::placeholders::_1)));
+            std::placeholders::_1));
 }
 
 // DEPRECATED
@@ -489,12 +497,12 @@ BaseHTTPPeer<Handler, Impl>::complete()
     }
 
     // keep-alive
-    boost::asio::spawn(bind_executor(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
             impl().shared_from_this(),
-            std::placeholders::_1)));
+            std::placeholders::_1));
 }
 
 // DEPRECATED

include/xrpl/server/detail/BasePeer.h

@@ -89,8 +89,8 @@ BasePeer<Handler, Impl>::BasePeer(
               return "##" + std::to_string(++id) + " ";
           }())
     , j_(sink_)
-    , work_(executor)
-    , strand_(executor)
+    , work_(boost::asio::make_work_guard(executor))
+    , strand_(boost::asio::make_strand(executor))
 {
 }
 

include/xrpl/server/detail/BaseWSPeer.h

@@ -29,6 +29,7 @@
 #include <xrpl/server/detail/BasePeer.h>
 #include <xrpl/server/detail/LowestLayer.h>
 
+#include <boost/asio/error.hpp>
 #include <boost/beast/core/multi_buffer.hpp>
 #include <boost/beast/http/message.hpp>
 #include <boost/beast/websocket.hpp>
@@ -420,11 +421,17 @@ BaseWSPeer<Handler, Impl>::start_timer()
     // Max seconds without completing a message
     static constexpr std::chrono::seconds timeout{30};
     static constexpr std::chrono::seconds timeoutLocal{3};
-    error_code ec;
-    timer_.expires_from_now(
-        remote_endpoint().address().is_loopback() ? timeoutLocal : timeout, ec);
-    if (ec)
-        return fail(ec, "start_timer");
+
+    try
+    {
+        timer_.expires_after(
+            remote_endpoint().address().is_loopback() ? timeoutLocal : timeout);
+    }
+    catch (boost::system::system_error const& e)
+    {
+        return fail(e.code(), "start_timer");
+    }
+
     timer_.async_wait(bind_executor(
         strand_,
         std::bind(
@@ -438,8 +445,14 @@ template <class Handler, class Impl>
 void
 BaseWSPeer<Handler, Impl>::cancel_timer()
 {
-    error_code ec;
-    timer_.cancel(ec);
+    try
+    {
+        timer_.cancel();
+    }
+    catch (boost::system::system_error const&)
+    {
+        // ignored
+    }
 }
 
 template <class Handler, class Impl>

include/xrpl/server/detail/Door.h

@@ -69,7 +69,7 @@ private:
         stream_type stream_;
         socket_type& socket_;
         endpoint_type remote_address_;
-        boost::asio::io_context::strand strand_;
+        boost::asio::strand<boost::asio::io_context::executor_type> strand_;
         beast::Journal const j_;
 
     public:
@@ -95,7 +95,7 @@ private:
     Handler& handler_;
     boost::asio::io_context& ioc_;
     acceptor_type acceptor_;
-    boost::asio::io_context::strand strand_;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand_;
     bool ssl_;
     bool plain_;
 
@@ -155,7 +155,7 @@ Door<Handler>::Detector::Detector(
     , stream_(std::move(stream))
     , socket_(stream_.socket())
     , remote_address_(remote_address)
-    , strand_(ioc_)
+    , strand_(boost::asio::make_strand(ioc_))
     , j_(j)
 {
 }
@@ -164,7 +164,7 @@ template <class Handler>
 void
 Door<Handler>::Detector::run()
 {
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &Detector::do_detect,
@@ -269,7 +269,7 @@ Door<Handler>::reOpen()
         Throw<std::exception>();
     }
 
-    acceptor_.listen(boost::asio::socket_base::max_connections, ec);
+    acceptor_.listen(boost::asio::socket_base::max_listen_connections, ec);
     if (ec)
     {
         JLOG(j_.error()) << "Listen on port '" << port_.name
@@ -291,7 +291,7 @@ Door<Handler>::Door(
     , handler_(handler)
     , ioc_(io_context)
     , acceptor_(io_context)
-    , strand_(io_context)
+    , strand_(boost::asio::make_strand(io_context))
     , ssl_(
           port_.protocol.count("https") > 0 ||
           port_.protocol.count("wss") > 0 || port_.protocol.count("wss2") > 0 ||
@@ -307,7 +307,7 @@ template <class Handler>
 void
 Door<Handler>::run()
 {
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &Door<Handler>::do_accept,
@@ -320,7 +320,8 @@ void
 Door<Handler>::close()
 {
     if (!strand_.running_in_this_thread())
-        return strand_.post(
+        return boost::asio::post(
+            strand_,
             std::bind(&Door<Handler>::close, this->shared_from_this()));
     error_code ec;
     acceptor_.close(ec);
@@ -400,7 +401,7 @@ Door<Handler>::do_accept(boost::asio::yield_context do_yield)
         {
             create(
                 ssl_,
-                boost::asio::null_buffers{},
+                boost::asio::const_buffer{},
                 std::move(stream),
                 remote_address);
         }

include/xrpl/server/detail/PlainHTTPPeer.h

@@ -103,7 +103,7 @@ PlainHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remote_address_))
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(&PlainHTTPPeer::do_close, this->shared_from_this()));
         return;
@@ -112,7 +112,7 @@ PlainHTTPPeer<Handler>::run()
     if (!socket_.is_open())
         return;
 
-    boost::asio::spawn(
+    util::spawn(
         this->strand_,
         std::bind(
             &PlainHTTPPeer::do_read,

include/xrpl/server/detail/SSLHTTPPeer.h

@@ -113,14 +113,14 @@ SSLHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remote_address_))
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(&SSLHTTPPeer::do_close, this->shared_from_this()));
         return;
     }
     if (!socket_.is_open())
         return;
-    boost::asio::spawn(
+    util::spawn(
         this->strand_,
         std::bind(
             &SSLHTTPPeer::do_handshake,
@@ -162,7 +162,7 @@ SSLHTTPPeer<Handler>::do_handshake(yield_context do_yield)
         this->port().protocol.count("https") > 0;
     if (http)
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(
                 &SSLHTTPPeer::do_read,

include/xrpl/server/detail/ServerImpl.h

@@ -27,6 +27,8 @@
 #include <xrpl/server/detail/io_list.h>
 
 #include <boost/asio.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 
 #include <array>
 #include <chrono>
@@ -86,9 +88,11 @@ private:
 
     Handler& handler_;
     beast::Journal const j_;
-    boost::asio::io_service& io_service_;
-    boost::asio::io_service::strand strand_;
-    std::optional<boost::asio::io_service::work> work_;
+    boost::asio::io_context& io_context_;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand_;
+    std::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        work_;
 
     std::mutex m_;
     std::vector<Port> ports_;
@@ -101,7 +105,7 @@ private:
 public:
     ServerImpl(
         Handler& handler,
-        boost::asio::io_service& io_service,
+        boost::asio::io_context& io_context,
         beast::Journal journal);
 
     ~ServerImpl();
@@ -124,10 +128,10 @@ public:
         return ios_;
     }
 
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
-        return io_service_;
+        return io_context_;
     }
 
     bool
@@ -141,13 +145,13 @@ private:
 template <class Handler>
 ServerImpl<Handler>::ServerImpl(
     Handler& handler,
-    boost::asio::io_service& io_service,
+    boost::asio::io_context& io_context,
     beast::Journal journal)
     : handler_(handler)
     , j_(journal)
-    , io_service_(io_service)
-    , strand_(io_service_)
-    , work_(io_service_)
+    , io_context_(io_context)
+    , strand_(boost::asio::make_strand(io_context_))
+    , work_(std::in_place, boost::asio::make_work_guard(io_context_))
 {
 }
 
@@ -179,7 +183,7 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
         {
             // UDP-RPC door
             if (auto sp = ios_.emplace<UDPDoor<Handler>>(
-                    handler_, io_service_, internalPort, j_))
+                    handler_, io_context_, internalPort, j_))
             {
                 auto ep = sp->get_endpoint();
                 if (!internalPort.port)
@@ -193,7 +197,7 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
         {
             // Standard TCP door
             if (auto sp = ios_.emplace<Door<Handler>>(
-                    handler_, io_service_, internalPort, j_))
+                    handler_, io_context_, internalPort, j_))
             {
                 list_.push_back(sp);
 

include/xrpl/server/detail/Spawn.h

@@ -0,0 +1,111 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright(c) 2025 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_SERVER_SPAWN_H_INCLUDED
+#define RIPPLE_SERVER_SPAWN_H_INCLUDED
+
+#include <xrpl/basics/Log.h>
+
+#include <boost/asio/spawn.hpp>
+#include <boost/asio/strand.hpp>
+
+#include <concepts>
+#include <type_traits>
+
+namespace ripple::util {
+namespace impl {
+
+template <typename T>
+concept IsStrand = std::same_as<
+    std::decay_t<T>,
+    boost::asio::strand<typename std::decay_t<T>::inner_executor_type>>;
+
+/**
+ * @brief A completion handler that restores `boost::asio::spawn`'s behaviour
+ * from Boost 1.83
+ *
+ * This is intended to be passed as the third argument to `boost::asio::spawn`
+ * so that exceptions are not ignored but propagated to `io_context.run()` call
+ * site.
+ *
+ * @param ePtr The exception that was caught on the coroutine
+ */
+inline constexpr auto kPROPAGATE_EXCEPTIONS = [](std::exception_ptr ePtr) {
+    if (ePtr)
+    {
+        try
+        {
+            std::rethrow_exception(ePtr);
+        }
+        catch (std::exception const& e)
+        {
+            JLOG(debugLog().warn()) << "Spawn exception: " << e.what();
+            throw;
+        }
+        catch (...)
+        {
+            JLOG(debugLog().warn()) << "Spawn exception: Unknown";
+            throw;
+        }
+    }
+};
+
+}  // namespace impl
+
+/**
+ * @brief Spawns a coroutine using `boost::asio::spawn`
+ *
+ * @note This uses kPROPAGATE_EXCEPTIONS to force asio to propagate exceptions
+ * through `io_context`
+ * @note Since implicit strand was removed from boost::asio::spawn this helper
+ * function adds the strand back
+ *
+ * @tparam Ctx The type of the context/strand
+ * @tparam F The type of the function to execute
+ * @param ctx The execution context
+ * @param func The function to execute. Must return `void`
+ */
+template <typename Ctx, typename F>
+    requires std::is_invocable_r_v<void, F, boost::asio::yield_context>
+void
+spawn(Ctx&& ctx, F&& func)
+{
+    if constexpr (impl::IsStrand<Ctx>)
+    {
+        boost::asio::spawn(
+            std::forward<Ctx>(ctx),
+            std::forward<F>(func),
+            impl::kPROPAGATE_EXCEPTIONS);
+    }
+    else
+    {
+        // make_strand accepts an executor or an execution context directly.
+        // Going through get_associated_executor here resolved a plain
+        // executor to asio's inline executor, which cannot be stranded and
+        // did not compile; nothing in the tree had instantiated this branch.
+        boost::asio::spawn(
+            boost::asio::make_strand(std::forward<Ctx>(ctx)),
+            std::forward<F>(func),
+            impl::kPROPAGATE_EXCEPTIONS);
+    }
+}
+
+}  // namespace ripple::util
+
+#endif

include/xrpl/server/detail/io_list.h

@@ -166,7 +166,7 @@ public:
             May be called concurrently.
 
         Preconditions:
-            No call to io_service::run on any io_service
+            No call to io_context::run on any io_context
             used by work objects associated with this io_list
             exists in the caller's call stack.
     */

src/libxrpl/basics/Log.cpp

@@ -31,7 +31,6 @@
 #include <cassert>
 #include <cstring>
 #include <ctime>
-#include <exception>
 #include <fstream>
 #include <functional>
 #include <iostream>
@@ -352,18 +351,9 @@ Logs::format(
 
     if (useLocalTime)
     {
-        try
-        {
-            auto now = std::chrono::system_clock::now();
-            auto local = date::make_zoned(date::current_zone(), now);
-            output = date::format(fmt, local);
-        }
-        catch (std::exception const&)
-        {
-            // Enhanced logging should not make startup fatal if tzdb lookup is
-            // unavailable or misconfigured. Fall back to UTC formatting.
-            output = date::format(fmt, std::chrono::system_clock::now());
-        }
+        auto now = std::chrono::system_clock::now();
+        auto local = date::make_zoned(date::current_zone(), now);
+        output = date::format(fmt, local);
     }
     else
     {

src/libxrpl/basics/ResolverAsio.cpp

@@ -22,7 +22,14 @@
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <boost/asio.hpp>
+
+#include <boost/asio/bind_executor.hpp>
+#include <boost/asio/error.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/system/detail/error_code.hpp>
+
+#include <algorithm>
 #include <atomic>
 #include <condition_variable>
 #include <deque>
@@ -110,8 +117,8 @@ public:
 
     beast::Journal m_journal;
 
-    boost::asio::io_service& m_io_service;
-    boost::asio::io_service::strand m_strand;
+    boost::asio::io_context& m_io_context;
+    boost::asio::strand<boost::asio::io_context::executor_type> m_strand;
     boost::asio::ip::tcp::resolver m_resolver;
 
     std::condition_variable m_cv;
@@ -141,12 +148,12 @@ public:
     std::deque<Work> m_work;
 
     ResolverAsioImpl(
-        boost::asio::io_service& io_service,
+        boost::asio::io_context& io_context,
         beast::Journal journal)
         : m_journal(journal)
-        , m_io_service(io_service)
-        , m_strand(io_service)
-        , m_resolver(io_service)
+        , m_io_context(io_context)
+        , m_strand(boost::asio::make_strand(io_context))
+        , m_resolver(io_context)
         , m_asyncHandlersCompleted(true)
         , m_stop_called(false)
         , m_stopped(true)
@@ -202,8 +209,14 @@ public:
     {
         if (m_stop_called.exchange(true) == false)
         {
-            m_io_service.dispatch(m_strand.wrap(std::bind(
-                &ResolverAsioImpl::do_stop, this, CompletionCounter(this))));
+            boost::asio::dispatch(
+                m_io_context,
+                boost::asio::bind_executor(
+                    m_strand,
+                    std::bind(
+                        &ResolverAsioImpl::do_stop,
+                        this,
+                        CompletionCounter(this))));
 
             JLOG(m_journal.debug()) << "Queued a stop request";
         }
@@ -234,12 +247,16 @@ public:
 
         // TODO NIKB use rvalue references to construct and move
         //           reducing cost.
-        m_io_service.dispatch(m_strand.wrap(std::bind(
-            &ResolverAsioImpl::do_resolve,
-            this,
-            names,
-            handler,
-            CompletionCounter(this))));
+        boost::asio::dispatch(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &ResolverAsioImpl::do_resolve,
+                    this,
+                    names,
+                    handler,
+                    CompletionCounter(this))));
     }
 
     //-------------------------------------------------------------------------
@@ -265,19 +282,20 @@ public:
         std::string name,
         boost::system::error_code const& ec,
         HandlerType handler,
-        boost::asio::ip::tcp::resolver::iterator iter,
+        boost::asio::ip::tcp::resolver::results_type results,
         CompletionCounter)
     {
         if (ec == boost::asio::error::operation_aborted)
             return;
 
         std::vector<beast::IP::Endpoint> addresses;
+        auto iter = results.begin();
 
         // If we get an error message back, we don't return any
         // results that we may have gotten.
         if (!ec)
         {
-            while (iter != boost::asio::ip::tcp::resolver::iterator())
+            while (iter != results.end())
             {
                 addresses.push_back(
                     beast::IPAddressConversion::from_asio(*iter));
@@ -287,8 +305,14 @@ public:
 
         handler(name, addresses);
 
-        m_io_service.post(m_strand.wrap(std::bind(
-            &ResolverAsioImpl::do_work, this, CompletionCounter(this))));
+        boost::asio::post(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &ResolverAsioImpl::do_work,
+                    this,
+                    CompletionCounter(this))));
     }
 
     HostAndPort
@@ -369,16 +393,21 @@ public:
         {
             JLOG(m_journal.error()) << "Unable to parse '" << name << "'";
 
-            m_io_service.post(m_strand.wrap(std::bind(
-                &ResolverAsioImpl::do_work, this, CompletionCounter(this))));
+            boost::asio::post(
+                m_io_context,
+                boost::asio::bind_executor(
+                    m_strand,
+                    std::bind(
+                        &ResolverAsioImpl::do_work,
+                        this,
+                        CompletionCounter(this))));
 
             return;
         }
 
-        boost::asio::ip::tcp::resolver::query query(host, port);
-
         m_resolver.async_resolve(
-            query,
+            host,
+            port,
             std::bind(
                 &ResolverAsioImpl::do_finish,
                 this,
@@ -409,10 +438,14 @@ public:
 
             if (m_work.size() > 0)
             {
-                m_io_service.post(m_strand.wrap(std::bind(
-                    &ResolverAsioImpl::do_work,
-                    this,
-                    CompletionCounter(this))));
+                boost::asio::post(
+                    m_io_context,
+                    boost::asio::bind_executor(
+                        m_strand,
+                        std::bind(
+                            &ResolverAsioImpl::do_work,
+                            this,
+                            CompletionCounter(this))));
             }
         }
     }
@@ -421,9 +454,9 @@ public:
 //-----------------------------------------------------------------------------
 
 std::unique_ptr<ResolverAsio>
-ResolverAsio::New(boost::asio::io_service& io_service, beast::Journal journal)
+ResolverAsio::New(boost::asio::io_context& io_context, beast::Journal journal)
 {
-    return std::make_unique<ResolverAsioImpl>(io_service, journal);
+    return std::make_unique<ResolverAsioImpl>(io_context, journal);
 }
 
 //-----------------------------------------------------------------------------

src/libxrpl/basics/UTF8.cpp

@@ -0,0 +1,101 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/basics/UTF8.h>
+
+namespace ripple {
+
+bool
+isValidUTF8(Slice const& s) noexcept
+{
+    std::size_t const size = s.size();
+
+    // Markus Kuhn's utf8_check.c
+    // (https://www.cl.cam.ac.uk/~mgk25/ucs/utf8_check.c), the decoder
+    // URIToken has always used, with one change: each branch establishes
+    // that the whole sequence is present before reading any continuation
+    // byte, so a truncated tail is invalid rather than an out-of-bounds read.
+    std::size_t i = 0;
+    while (i < size)
+    {
+        std::uint8_t const c0 = s[i];
+
+        if (c0 < 0x80)
+        {
+            // 0xxxxxxx
+            ++i;
+            continue;
+        }
+
+        if ((c0 & 0xE0) == 0xC0)
+        {
+            // 110xxxxx 10xxxxxx
+            if (size - i < 2)
+                return false;
+            if ((s[i + 1] & 0xC0) != 0x80)
+                return false;
+            if ((c0 & 0xFE) == 0xC0)  // overlong
+                return false;
+            i += 2;
+            continue;
+        }
+
+        if ((c0 & 0xF0) == 0xE0)
+        {
+            // 1110xxxx 10xxxxxx 10xxxxxx
+            if (size - i < 3)
+                return false;
+            std::uint8_t const c1 = s[i + 1];
+            if ((c1 & 0xC0) != 0x80 || (s[i + 2] & 0xC0) != 0x80)
+                return false;
+            if (c0 == 0xE0 && (c1 & 0xE0) == 0x80)  // overlong
+                return false;
+            if (c0 == 0xED && (c1 & 0xE0) == 0xA0)  // UTF-16 surrogate
+                return false;
+            if (c0 == 0xEF && c1 == 0xBF &&
+                (s[i + 2] & 0xFE) == 0xBE)  // U+FFFE or U+FFFF
+                return false;
+            i += 3;
+            continue;
+        }
+
+        if ((c0 & 0xF8) == 0xF0)
+        {
+            // 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
+            if (size - i < 4)
+                return false;
+            std::uint8_t const c1 = s[i + 1];
+            if ((c1 & 0xC0) != 0x80 || (s[i + 2] & 0xC0) != 0x80 ||
+                (s[i + 3] & 0xC0) != 0x80)
+                return false;
+            if (c0 == 0xF0 && (c1 & 0xF0) == 0x80)  // overlong
+                return false;
+            if (c0 > 0xF4 || (c0 == 0xF4 && c1 > 0x8F))  // > U+10FFFF
+                return false;
+            i += 4;
+            continue;
+        }
+
+        // Stray continuation byte or 0xF8..0xFF.
+        return false;
+    }
+    return true;
+}
+
+}  // namespace ripple

src/libxrpl/beast/insight/StatsDCollector.cpp

@@ -26,10 +26,24 @@
 #include <xrpl/beast/insight/StatsDCollector.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/utility/instrumentation.h>
+
+#include <boost/asio/basic_waitable_timer.hpp>
+#include <boost/asio/bind_executor.hpp>
+#include <boost/asio/buffer.hpp>
+#include <boost/asio/error.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/udp.hpp>
+#include <boost/asio/strand.hpp>
+#include <boost/system/detail/error_code.hpp>
+
 #include <boost/asio/ip/tcp.hpp>
+#include <chrono>
 #include <climits>
+#include <cstddef>
 #include <deque>
 #include <functional>
+#include <iostream>
 #include <mutex>
 #include <optional>
 #include <set>
@@ -223,9 +237,11 @@ private:
     Journal m_journal;
     IP::Endpoint m_address;
     std::string m_prefix;
-    boost::asio::io_service m_io_service;
-    std::optional<boost::asio::io_service::work> m_work;
-    boost::asio::io_service::strand m_strand;
+    boost::asio::io_context m_io_context;
+    std::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        m_work;
+    boost::asio::strand<boost::asio::io_context::executor_type> m_strand;
     boost::asio::basic_waitable_timer<std::chrono::steady_clock> m_timer;
     boost::asio::ip::udp::socket m_socket;
     std::deque<std::string> m_data;
@@ -249,18 +265,24 @@ public:
         : m_journal(journal)
         , m_address(address)
         , m_prefix(prefix)
-        , m_work(std::ref(m_io_service))
-        , m_strand(m_io_service)
-        , m_timer(m_io_service)
-        , m_socket(m_io_service)
+        , m_work(boost::asio::make_work_guard(m_io_context))
+        , m_strand(boost::asio::make_strand(m_io_context))
+        , m_timer(m_io_context)
+        , m_socket(m_io_context)
         , m_thread(&StatsDCollectorImp::run, this)
     {
     }
 
     ~StatsDCollectorImp() override
     {
-        boost::system::error_code ec;
-        m_timer.cancel(ec);
+        try
+        {
+            m_timer.cancel();
+        }
+        catch (boost::system::system_error const&)
+        {
+            // ignored
+        }
 
         m_work.reset();
         m_thread.join();
@@ -319,10 +341,10 @@ public:
 
     //--------------------------------------------------------------------------
 
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
-        return m_io_service;
+        return m_io_context;
     }
 
     std::string const&
@@ -340,8 +362,14 @@ public:
     void
     post_buffer(std::string&& buffer)
     {
-        m_io_service.dispatch(m_strand.wrap(std::bind(
-            &StatsDCollectorImp::do_post_buffer, this, std::move(buffer))));
+        boost::asio::dispatch(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &StatsDCollectorImp::do_post_buffer,
+                    this,
+                    std::move(buffer))));
     }
 
     // The keepAlive parameter makes sure the buffers sent to
@@ -371,7 +399,7 @@ public:
         for (auto const& buffer : buffers)
         {
             std::string const s(
-                boost::asio::buffer_cast<char const*>(buffer),
+                static_cast<char const*>(buffer.data()),
                 boost::asio::buffer_size(buffer));
             std::cerr << s;
         }
@@ -441,7 +469,7 @@ public:
     set_timer()
     {
         using namespace std::chrono_literals;
-        m_timer.expires_from_now(1s);
+        m_timer.expires_after(1s);
         m_timer.async_wait(std::bind(
             &StatsDCollectorImp::on_timer, this, std::placeholders::_1));
     }
@@ -483,13 +511,13 @@ public:
 
         set_timer();
 
-        m_io_service.run();
+        m_io_context.run();
 
         m_socket.shutdown(boost::asio::ip::udp::socket::shutdown_send, ec);
 
         m_socket.close();
 
-        m_io_service.poll();
+        m_io_context.poll();
     }
 };
 
@@ -532,10 +560,12 @@ StatsDCounterImpl::~StatsDCounterImpl()
 void
 StatsDCounterImpl::increment(CounterImpl::value_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDCounterImpl::do_increment,
-        std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDCounterImpl::do_increment,
+            std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
+            amount));
 }
 
 void
@@ -577,10 +607,12 @@ StatsDEventImpl::StatsDEventImpl(
 void
 StatsDEventImpl::notify(EventImpl::value_type const& value)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDEventImpl::do_notify,
-        std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
-        value));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDEventImpl::do_notify,
+            std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
+            value));
 }
 
 void
@@ -610,19 +642,23 @@ StatsDGaugeImpl::~StatsDGaugeImpl()
 void
 StatsDGaugeImpl::set(GaugeImpl::value_type value)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDGaugeImpl::do_set,
-        std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-        value));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDGaugeImpl::do_set,
+            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
+            value));
 }
 
 void
 StatsDGaugeImpl::increment(GaugeImpl::difference_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDGaugeImpl::do_increment,
-        std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDGaugeImpl::do_increment,
+            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
+            amount));
 }
 
 void
@@ -698,10 +734,12 @@ StatsDMeterImpl::~StatsDMeterImpl()
 void
 StatsDMeterImpl::increment(MeterImpl::value_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDMeterImpl::do_increment,
-        std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDMeterImpl::do_increment,
+            std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
+            amount));
 }
 
 void

src/libxrpl/beast/net/IPAddressV4.cpp

@@ -28,11 +28,11 @@ namespace IP {
 bool
 is_private(AddressV4 const& addr)
 {
-    return ((addr.to_ulong() & 0xff000000) ==
+    return ((addr.to_uint() & 0xff000000) ==
             0x0a000000) ||  // Prefix /8,    10.  #.#.#
-        ((addr.to_ulong() & 0xfff00000) ==
+        ((addr.to_uint() & 0xfff00000) ==
          0xac100000) ||  // Prefix /12   172. 16.#.# - 172.31.#.#
-        ((addr.to_ulong() & 0xffff0000) ==
+        ((addr.to_uint() & 0xffff0000) ==
          0xc0a80000) ||  // Prefix /16   192.168.#.#
         addr.is_loopback();
 }
@@ -47,7 +47,7 @@ char
 get_class(AddressV4 const& addr)
 {
     static char const* table = "AAAABBCD";
-    return table[(addr.to_ulong() & 0xE0000000) >> 29];
+    return table[(addr.to_uint() & 0xE0000000) >> 29];
 }
 
 }  // namespace IP

src/libxrpl/beast/net/IPAddressV6.cpp

@@ -20,6 +20,8 @@
 #include <xrpl/beast/net/IPAddressV4.h>
 #include <xrpl/beast/net/IPAddressV6.h>
 
+#include <boost/asio/ip/address_v4.hpp>
+
 namespace beast {
 namespace IP {
 
@@ -28,7 +30,9 @@ is_private(AddressV6 const& addr)
 {
     return (
         (addr.to_bytes()[0] & 0xfd) ||  // TODO  fc00::/8 too ?
-        (addr.is_v4_mapped() && is_private(addr.to_v4())));
+        (addr.is_v4_mapped() &&
+         is_private(boost::asio::ip::make_address_v4(
+             boost::asio::ip::v4_mapped, addr))));
 }
 
 bool

src/libxrpl/beast/net/IPEndpoint.cpp

@@ -18,7 +18,19 @@
 //==============================================================================
 
 #include <xrpl/beast/net/IPEndpoint.h>
+
+#include <boost/algorithm/string/trim.hpp>
+#include <boost/asio/ip/address.hpp>
+#include <boost/asio/ip/address_v4.hpp>
+#include <boost/system/detail/error_code.hpp>
+
 #include <boost/algorithm/string.hpp>
+#include <cctype>
+#include <ios>
+#include <istream>
+#include <optional>
+#include <sstream>
+#include <string>
 
 namespace beast {
 namespace IP {
@@ -157,7 +169,7 @@ operator>>(std::istream& is, Endpoint& endpoint)
     }
 
     boost::system::error_code ec;
-    auto addr = Address::from_string(addrStr, ec);
+    auto addr = boost::asio::ip::make_address(addrStr, ec);
     if (ec)
     {
         is.setstate(std::ios_base::failbit);

src/libxrpl/protocol/ExportOriginMemo.cpp

@@ -1,211 +0,0 @@
-//------------------------------------------------------------------------------
-/*
-    This file is part of rippled: https://github.com/ripple/rippled
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-*/
-//==============================================================================
-
-#include <xrpl/protocol/ExportOriginMemo.h>
-#include <xrpl/protocol/STArray.h>
-#include <xrpl/protocol/Serializer.h>
-
-#include <algorithm>
-#include <exception>
-#include <iterator>
-#include <string>
-
-namespace ripple::ExportOriginMemo {
-namespace {
-
-Blob const&
-memoTypeBytes()
-{
-    static Blob const value(memoType.begin(), memoType.end());
-    return value;
-}
-
-bool
-isReserved(STObject const& memo)
-{
-    return memo.getFName() == sfMemo && memo.isFieldPresent(sfMemoType) &&
-        memo.getFieldVL(sfMemoType) == memoTypeBytes();
-}
-
-STObject
-cloneObject(STTx const& tx)
-{
-    Serializer serializer;
-    tx.add(serializer);
-    SerialIter sit{serializer.slice()};
-    STObject result{sfGeneric};
-    result.set(sit);
-    return result;
-}
-
-Blob
-serialize(Origin const& origin, std::optional<Anchor> const& anchor)
-{
-    //@@start export-origin-memo-wire-format
-    Serializer serializer;
-    serializer.add8(version);
-    serializer.add8(allowedFlags);
-    serializer.add32(origin.sourceDomain);
-    serializer.add32(origin.targetDomain);
-    serializer.addBitString(origin.transactionHash);
-    if (anchor)
-    {
-        serializer.add32(anchor->ledgerSequence);
-        serializer.addBitString(anchor->ledgerHash);
-    }
-    return serializer.getData();
-    //@@end export-origin-memo-wire-format
-}
-
-Expected<STTx, Error>
-append(
-    STTx const& base,
-    Origin const& origin,
-    std::optional<Anchor> const& anchor)
-{
-    if (hasReservedMemo(base))
-        return Unexpected(Error::reservedMemoPresent);
-
-    //@@start export-origin-memo-canonical-append
-    auto object = cloneObject(base);
-    STArray memos = object.isFieldPresent(sfMemos)
-        ? object.getFieldArray(sfMemos)
-        : STArray{sfMemos};
-
-    STObject memo{sfMemo};
-    memo.setFieldVL(sfMemoType, memoTypeBytes());
-    memo.setFieldVL(sfMemoData, serialize(origin, anchor));
-    memos.emplace_back(std::move(memo));
-    object.setFieldArray(sfMemos, memos);
-
-    STTx result{std::move(object)};
-    std::string reason;
-    if (!passesLocalChecks(result, reason))
-        return Unexpected(Error::localChecks);
-    return result;
-    //@@end export-origin-memo-canonical-append
-}
-
-Expected<Stamp, Error>
-parseData(Blob const& data)
-{
-    if (data.size() != identityBytes && data.size() != releaseBytes)
-        return Unexpected(Error::malformedMemo);
-
-    try
-    {
-        SerialIter sit{makeSlice(data)};
-        if (sit.get8() != version)
-            return Unexpected(Error::unsupportedVersion);
-        if (sit.get8() != allowedFlags)
-            return Unexpected(Error::unsupportedFlags);
-
-        Stamp stamp{
-            .origin =
-                Origin{
-                    .sourceDomain = sit.get32(),
-                    .targetDomain = sit.get32(),
-                    .transactionHash = sit.get256()},
-            .anchor = std::nullopt};
-
-        if (data.size() == releaseBytes)
-            stamp.anchor = Anchor{sit.get32(), sit.get256()};
-        if (!sit.empty())
-            return Unexpected(Error::malformedMemo);
-        return stamp;
-    }
-    catch (std::exception const&)
-    {
-        return Unexpected(Error::malformedMemo);
-    }
-}
-
-}  // namespace
-
-bool
-hasReservedMemo(STTx const& tx)
-{
-    if (!tx.isFieldPresent(sfMemos))
-        return false;
-
-    auto const& memos = tx.getFieldArray(sfMemos);
-    return std::any_of(memos.begin(), memos.end(), isReserved);
-}
-
-Expected<STTx, Error>
-identityForm(STTx const& base, Origin const& origin)
-{
-    return append(base, origin, std::nullopt);
-}
-
-Expected<STTx, Error>
-releaseForm(STTx const& base, Origin const& origin, Anchor const& anchor)
-{
-    return append(base, origin, anchor);
-}
-
-Expected<Stamp, Error>
-parse(STTx const& tx)
-{
-    std::string reason;
-    if (!passesLocalChecks(tx, reason))
-        return Unexpected(Error::localChecks);
-    if (!tx.isFieldPresent(sfMemos))
-        return Unexpected(Error::reservedMemoMissing);
-
-    auto const& memos = tx.getFieldArray(sfMemos);
-    auto found = memos.end();
-    for (auto it = memos.begin(); it != memos.end(); ++it)
-    {
-        if (!isReserved(*it))
-            continue;
-        if (found != memos.end())
-            return Unexpected(Error::reservedMemoPosition);
-        found = it;
-    }
-
-    if (found == memos.end())
-        return Unexpected(Error::reservedMemoMissing);
-    if (found != std::prev(memos.end()))
-        return Unexpected(Error::reservedMemoPosition);
-    if (found->isFieldPresent(sfMemoFormat) ||
-        !found->isFieldPresent(sfMemoData))
-        return Unexpected(Error::malformedMemo);
-
-    return parseData(found->getFieldVL(sfMemoData));
-}
-
-Expected<STTx, Error>
-projectIdentity(STTx const& stamped)
-{
-    auto parsed = parse(stamped);
-    if (!parsed)
-        return Unexpected(parsed.error());
-
-    auto object = cloneObject(stamped);
-    auto memos = object.getFieldArray(sfMemos);
-    memos.erase(std::prev(memos.end()));
-    if (memos.empty())
-        object.delField(sfMemos);
-    else
-        object.setFieldArray(sfMemos, memos);
-
-    return identityForm(STTx{std::move(object)}, parsed.value().origin);
-}
-
-}  // namespace ripple::ExportOriginMemo

src/libxrpl/protocol/Indexes.cpp

@@ -74,9 +74,6 @@ enum class LedgerNameSpace : std::uint16_t {
     HOOK_DEFINITION = 'D',
     EMITTED_TXN = 'E',
     EMITTED_DIR = 'F',
-    EXPORT_LATCH = 0x5374,        // St
-    EXPORT_COMMITTEE = 0x4563,    // Ec
-    EXPORT_PENDING_DIR = 0x4570,  // Ep
     NFTOKEN_OFFER = 'q',
     NFTOKEN_BUY_OFFERS = 'h',
     NFTOKEN_SELL_OFFERS = 'i',
@@ -84,7 +81,6 @@ enum class LedgerNameSpace : std::uint16_t {
     IMPORT_VLSEQ = 'I',
     UNL_REPORT = 'R',
     CRON = 'L',
-    CONSENSUS_ENTROPY = 'X',
     AMM = 'A',
     BRIDGE = LEDGER_NAMESPACE2(0x01, 'H'),
     XCHAIN_CLAIM_ID = 'Q',
@@ -96,6 +92,8 @@ enum class LedgerNameSpace : std::uint16_t {
     MANIFEST = 'M',
     CREDENTIAL = LEDGER_NAMESPACE2(0x01, 'D'),
     PERMISSIONED_DOMAIN = 'm',
+    EXPORTED_TXN = 'X',
+    SHADOW_TICKET = 'Y',
 
     // No longer used or supported. Left here to reserve the space
     // to avoid accidental reuse.
@@ -193,34 +191,6 @@ emittedTxn(uint256 const& id) noexcept
     return {ltEMITTED_TXN, indexHash(LedgerNameSpace::EMITTED_TXN, id)};
 }
 
-//@@start export-origin-keylet
-Keylet
-exportLatch(AccountID const& account, uint256 const& originTxnHash) noexcept
-{
-    return {
-        ltEXPORT_LATCH,
-        indexHash(LedgerNameSpace::EXPORT_LATCH, account, originTxnHash)};
-}
-//@@end export-origin-keylet
-
-Keylet
-exportCommittee(AccountID const& account, uint256 const& digest) noexcept
-{
-    return {
-        ltEXPORT_COMMITTEE,
-        indexHash(LedgerNameSpace::EXPORT_COMMITTEE, account, digest)};
-}
-
-//@@start export-pending-directory-keylet
-Keylet const&
-pendingExports() noexcept
-{
-    static Keylet const ret{
-        ltDIR_NODE, indexHash(LedgerNameSpace::EXPORT_PENDING_DIR)};
-    return ret;
-}
-//@@end export-pending-directory-keylet
-
 Keylet
 hook(AccountID const& id) noexcept
 {
@@ -579,14 +549,6 @@ cron(uint32_t timestamp, std::optional<AccountID> const& id)
     return {ltCRON, uint256::fromVoid(h)};
 }
 
-Keylet const&
-consensusEntropy() noexcept
-{
-    static Keylet const ret{
-        ltCONSENSUS_ENTROPY, indexHash(LedgerNameSpace::CONSENSUS_ENTROPY)};
-    return ret;
-}
-
 Keylet
 amm(Asset const& issue1, Asset const& issue2) noexcept
 {
@@ -717,6 +679,27 @@ manifest(PublicKey const& pk) noexcept
     return {ltMANIFEST, indexHash(LedgerNameSpace::MANIFEST, pk.slice())};
 }
 
+Keylet
+exportedTxn(std::uint32_t seq, uint256 const& txid) noexcept
+{
+    // like cron: 8 bytes of namespace, 4 bytes BE ledger seq, 20 of the txid
+    static uint256 const ns = indexHash(LedgerNameSpace::EXPORTED_TXN);
+    uint256 k;
+    std::memcpy(k.data(), ns.data(), 8);
+    for (int i = 0; i < 4; ++i)
+        k.data()[8 + i] = static_cast<std::uint8_t>(seq >> (24 - 8 * i));
+    std::memcpy(k.data() + 12, txid.data(), 20);
+    return {ltEXPORTED_TXN, k};
+}
+
+Keylet
+shadowTicket(AccountID const& account, std::uint32_t ticketSeq) noexcept
+{
+    return {
+        ltSHADOW_TICKET,
+        indexHash(LedgerNameSpace::SHADOW_TICKET, account, ticketSeq)};
+}
+
 }  // namespace keylet
 
 }  // namespace ripple

src/libxrpl/protocol/InnerObjectFormats.cpp

@@ -53,13 +53,6 @@ InnerObjectFormats::InnerObjectFormats()
             {sfTxnSignature, soeREQUIRED},
         });
 
-    add(sfExportSigner.jsonName,
-        sfExportSigner.getCode(),
-        {
-            {sfSigningPubKey, soeREQUIRED},
-            {sfTxnSignature, soeREQUIRED},
-        });
-
     add(sfMajority.jsonName,
         sfMajority.getCode(),
         {
@@ -85,7 +78,6 @@ InnerObjectFormats::InnerObjectFormats()
          {sfHookExecutionIndex, soeREQUIRED},
          {sfHookStateChangeCount, soeREQUIRED},
          {sfHookEmitCount, soeREQUIRED},
-         {sfHookExportCount, soeOPTIONAL},
          {sfFlags, soeOPTIONAL}});
 
     add(sfHookEmission.jsonName,
@@ -151,6 +143,34 @@ InnerObjectFormats::InnerObjectFormats()
             {sfAccount, soeOPTIONAL},
         });
 
+    // featureExport: one validator's export key, as reported by the UNL
+    add(sfExportKeyReport.jsonName,
+        sfExportKeyReport.getCode(),
+        {
+            {sfPublicKey, soeREQUIRED},
+            {sfExportKey, soeREQUIRED},
+            {sfExportKeyProof, soeREQUIRED},
+        });
+
+    // featureExport: an account's signer list on the network it exports to,
+    // and the (ledger, index) there of the SignerListSet that set it
+    add(sfExportSignerList.jsonName,
+        sfExportSignerList.getCode(),
+        {
+            {sfSignerQuorum, soeREQUIRED},
+            {sfSignerEntries, soeREQUIRED},
+            {sfLedgerSequence, soeREQUIRED},
+            {sfTransactionIndex, soeREQUIRED},
+        });
+
+    // featureExport: an entry in a validator account's sfExportKeys
+    add(sfExportKeyEntry.jsonName,
+        sfExportKeyEntry.getCode(),
+        {
+            {sfExportKey, soeREQUIRED},
+            {sfCloseTime, soeREQUIRED},
+        });
+
     add(sfAmountEntry.jsonName,
         sfAmountEntry.getCode(),
         {

src/libxrpl/protocol/STTx.cpp

@@ -685,7 +685,7 @@ isPseudoTx(STObject const& tx)
     auto tt = safe_cast<TxType>(*t);
     return tt == ttAMENDMENT || tt == ttFEE || tt == ttUNL_MODIFY ||
         tt == ttEMIT_FAILURE || tt == ttUNL_REPORT || tt == ttCRON ||
-        tt == ttCONSENSUS_ENTROPY || tt == ttEXPORT_SIGNATURES;
+        tt == ttEXPORT_FINAL;
 }
 
 }  // namespace ripple

src/libxrpl/protocol/STValidation.cpp

@@ -66,6 +66,9 @@ STValidation::validationFormat()
         {sfBaseFeeDrops,          soeOPTIONAL},
         {sfReserveBaseDrops,      soeOPTIONAL},
         {sfReserveIncrementDrops, soeOPTIONAL},
+        // featureExport: sent on flag ledger validations only
+        {sfExportKey,             soeOPTIONAL},
+        {sfExportKeyProof,        soeOPTIONAL},
     };
     // clang-format on
 

src/libxrpl/protocol/TER.cpp

@@ -124,7 +124,6 @@ transResults()
         MAKE_ERROR(tecARRAY_TOO_LARGE,               "Array is too large."),
         MAKE_ERROR(tecLOCKED,                        "Fund is locked."),
         MAKE_ERROR(tecBAD_CREDENTIALS,               "Bad credentials."),
-        MAKE_ERROR(tecEXPORT_COMMITTEE_UNAVAILABLE, "Export committee is unavailable in the parent validator view."),
 
         MAKE_ERROR(tefALREADY,                     "The exact transaction was already in this ledger."),
         MAKE_ERROR(tefBAD_ADD_AUTH,                "Not authorized to add account."),
@@ -175,7 +174,7 @@ transResults()
         MAKE_ERROR(telIMPORT_VL_KEY_NOT_RECOGNISED, "Import vl key was not recognized."),
         MAKE_ERROR(telCAN_NOT_QUEUE_IMPORT,   "Import transaction was not able to be directly applied and cannot be queued."),
         MAKE_ERROR(telENV_RPC_FAILED,         "Unit test RPC failure."),
-        MAKE_ERROR(telEXPORT_LATCH_REQUIRED, "The imported Export callback has no matching Export latch."),
+        MAKE_ERROR(telMANIFEST_FEE_MISMATCH,  "Unsigned SetManifest fee is not, or cannot be confirmed as, canonical for this server's ledger fee settings."),
 
         MAKE_ERROR(temMALFORMED,                 "Malformed transaction."),
         MAKE_ERROR(temBAD_AMM_TOKENS,            "Malformed: Invalid LPTokens."),

src/libxrpl/protocol/tokens.cpp

@@ -545,7 +545,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     XRPL_ASSERT(
         num_b_58_10_coeffs <= b_58_10_coeff.size(),
         "ripple::b58_fast::detail::b58_to_b256_be : maximum coeff");
-    for (auto c : input.substr(0, partial_coeff_len))
+    for (unsigned char const c : input.substr(0, partial_coeff_len))
     {
         auto cur_val = ::ripple::alphabetReverse[c];
         if (cur_val < 0)
@@ -559,7 +559,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         for (int j = 0; j < num_full_coeffs; ++j)
         {
-            auto c = input[partial_coeff_len + j * 10 + i];
+            unsigned char const c = input[partial_coeff_len + j * 10 + i];
             auto cur_val = ::ripple::alphabetReverse[c];
             if (cur_val < 0)
             {
@@ -580,6 +580,12 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         std::uint64_t const c = b_58_10_coeff[i];
 
+        // Each digit is < 58, so at most 4 words are in use here and the
+        // span below always fits `result`. Guard the invariant anyway rather
+        // than letting a violation index past the end of the stack array.
+        if (cur_result_size >= result.size())
+            return Unexpected(TokenCodecErrc::inputTooLarge);
+
         {
             auto code = ripple::b58_fast::detail::inplace_bigint_mul(
                 std::span(&result[0], cur_result_size + 1), B_58_10);

src/libxrpl/server/Port.cpp

@@ -24,6 +24,9 @@
 #include <boost/algorithm/string/predicate.hpp>
 #include <boost/algorithm/string/trim.hpp>
 #include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
 
 namespace ripple {
 
@@ -205,7 +208,7 @@ parse_Port(ParsedPort& port, Section const& section, std::ostream& log)
         {
             try
             {
-                port.ip = boost::asio::ip::address::from_string(*optResult);
+                port.ip = boost::asio::ip::make_address(*optResult);
             }
             catch (std::exception const&)
             {

src/test/app/AMMExtended_test.cpp

@@ -150,12 +150,15 @@ private:
 
             env.fund(XRP(20'000), alice, bob, carol, gw1, gw2);
             env.fund(XRP(20'000), dan);
+            env.close();
             env.trust(USD1(20'000), alice, bob, carol, dan);
             env.trust(USD2(1'000), alice, bob, carol, dan);
+            env.close();
 
             env(pay(gw1, dan, USD1(10'050)));
             env(pay(gw1, bob, USD1(50)));
             env(pay(gw2, bob, USD2(50)));
+            env.close();
 
             AMM ammDan(env, dan, XRP(10'000), USD1(10'050));
 
@@ -1990,6 +1993,7 @@ private:
 
             env.fund(XRP(10'000), alice, carol, gw);
             env.fund(XRP(10'000), bob);
+            env.close();
             env.trust(USD(1'000), alice, bob, carol);
             env.trust(BTC(1'000), alice, bob, carol);
             env.trust(EUR(1'000), alice, bob, carol);
@@ -3641,7 +3645,7 @@ private:
             USD(10'000),
             false,
             0,
-            ammCrtFee(env).drops(),
+            ammCrtFee(env).drops() + 2 * env.current()->fees().base.drops(),
             std::nullopt,
             std::nullopt,
             ms,

src/test/app/AMM_test.cpp

@@ -5004,8 +5004,8 @@ private:
                     alice,
                     STAmount{USD, UINT64_C(30'000'0000000003), -10}));
                 // alice XRP balance is 30,000initial - 50 ammcreate fee -
-                // 10drops fee
-                BEAST_EXPECT(accountBalance(env, alice) == "29949999990");
+                // 10drops ammcreate base fee - 10drops fee
+                BEAST_EXPECT(accountBalance(env, alice) == "29949999980");
             },
             std::nullopt,
             0,
@@ -5081,7 +5081,7 @@ private:
                     (xrpBalance + drops(5)).getText());
                 BEAST_EXPECT(
                     accountBalance(env, alice) ==
-                    std::to_string(29'950'000'000 - baseFee + 80));
+                    std::to_string(29'950'000'000 - 2 * baseFee + 80));
             },
             std::nullopt,
             0,

src/test/app/AccountDelete_test.cpp

@@ -18,7 +18,6 @@
 //==============================================================================
 
 #include <test/jtx.h>
-#include <xrpl/protocol/ExportCommittee.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/jss.h>
 
@@ -470,40 +469,6 @@ public:
         env.close();
     }
 
-    void
-    testExportCommitteeCleanup(FeatureBitset features)
-    {
-        using namespace jtx;
-
-        testcase("Export committee cleanup");
-
-        Env env{*this, features | featureExport};
-        Account const alice("alice");
-        Account const becky("becky");
-        env.fund(XRP(10000), alice, becky);
-        env.close();
-
-        auto const roster = serializeExportCommittee({alice.pk()});
-        auto const digest = exportCommitteeHash(makeSlice(roster));
-        Json::Value setup;
-        setup[jss::TransactionType] = "Export";
-        setup[jss::Account] = alice.human();
-        setup[sfExportCommittee.jsonName] = strHex(roster);
-        env(setup);
-        env.close();
-
-        auto const committeeKey = keylet::exportCommittee(alice.id(), digest);
-        BEAST_EXPECT(env.closed()->exists(committeeKey));
-
-        incLgrSeqForAccDel(env, alice);
-        auto const acctDelFee{drops(env.current()->fees().increment)};
-        env(acctdelete(alice, becky), fee(acctDelFee));
-        env.close();
-
-        BEAST_EXPECT(!env.closed()->exists(keylet::account(alice.id())));
-        BEAST_EXPECT(!env.closed()->exists(committeeKey));
-    }
-
     void
     testResurrection(FeatureBitset features)
     {
@@ -1314,7 +1279,6 @@ public:
             testBasics(features);
             testDirectories(features);
             testOwnedTypes(features);
-            testExportCommitteeCleanup(features);
             testResurrection(features);
             testAmendmentEnable(features);
             testTooManyOffers(features);

src/test/app/ClaimReward_test.cpp

@@ -563,6 +563,20 @@ public:
                 env(reward::claim(alice),
                     reward::issuer(issuer),
                     ter(tecNO_TARGET));
+                env.close();
+            }
+            // Invalid HookName
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                hookObj[jss::HookName] = "4142434445";
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    ter(tecNO_TARGET));
+                env.close();
             }
             // Vaild HookOn
             {

src/test/app/ConsensusEntropy_test_hooks.h

@@ -1,785 +0,0 @@
-
-// This file is generated by hookz build-test-hooks
-#ifndef CONSENSUSENTROPY_TEST_WASM_INCLUDED
-#define CONSENSUSENTROPY_TEST_WASM_INCLUDED
-#include <map>
-#include <stdint.h>
-#include <string>
-#include <vector>
-namespace ripple {
-namespace test {
-inline std::map<std::string, std::vector<uint8_t>> consensusentropy_test_wasm =
-    {
-        /* ==== WASM: 0 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t rollback(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-            #define GUARD(maxiter) _g((1ULL << 31U) + __LINE__, (maxiter)+1)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-
-                // A wide range makes this a useful byte-order known answer.
-                int64_t result = entropy_cr_dice(1000000, 3);
-
-                // negative means error
-                if (result < 0)
-                    rollback(0, 0, result);
-
-                if (result >= 1000000)
-                    rollback(0, 0, -1);
-
-                // return the entropy_cr_dice result as the accept code
-                return accept(0, 0, result);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x19U, 0x04U, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U, 0x7EU,
-             0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U, 0x02U, 0x7FU,
-             0x7FU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U,
-             0x3CU, 0x04U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U,
-             0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U, 0x6EU,
-             0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU,
-             0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x02U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x08U, 0x72U, 0x6FU, 0x6CU, 0x6CU, 0x62U, 0x61U, 0x63U,
-             0x6BU, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x61U,
-             0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U, 0x00U, 0x03U, 0x02U,
-             0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U, 0x01U, 0x07U, 0x08U,
-             0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x04U, 0x0AU,
-             0x42U, 0x01U, 0x40U, 0x01U, 0x02U, 0x7EU, 0x41U, 0x01U, 0x41U,
-             0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0xC0U, 0x84U, 0x3DU, 0x41U,
-             0x03U, 0x10U, 0x01U, 0x22U, 0x01U, 0x21U, 0x02U, 0x02U, 0x40U,
-             0x20U, 0x01U, 0x42U, 0x00U, 0x59U, 0x04U, 0x40U, 0x42U, 0x7FU,
-             0x21U, 0x02U, 0x20U, 0x01U, 0x42U, 0xC0U, 0x84U, 0x3DU, 0x54U,
-             0x0DU, 0x01U, 0x0BU, 0x41U, 0x00U, 0x41U, 0x00U, 0x20U, 0x02U,
-             0x10U, 0x02U, 0x1AU, 0x0BU, 0x41U, 0x00U, 0x41U, 0x00U, 0x20U,
-             0x01U, 0x10U, 0x03U, 0x0BU,
-         }},
-
-        /* ==== WASM: 1 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t rollback(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-            #define GUARD(maxiter) _g((1ULL << 31U) + __LINE__, (maxiter)+1)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-
-                uint8_t buf[32];
-                for (int i = 0; GUARD(32), i < 32; ++i)
-                    buf[i] = 0;
-
-                int64_t result = entropy_cr_random((uint32_t)buf, 32, 3);
-
-                // Should return 32 (bytes written)
-                if (result != 32)
-                    rollback(0, 0, result);
-
-                // Verify buffer is not all zeroes
-                int nonzero = 0;
-                for (int i = 0; GUARD(32), i < 32; ++i)
-                    if (buf[i] != 0) nonzero = 1;
-
-                if (!nonzero)
-                    rollback(0, 0, -2);
-
-                return accept(0, 0, 0);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x1AU, 0x04U, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U, 0x7EU,
-             0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U, 0x03U, 0x7FU,
-             0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU,
-             0x02U, 0x3EU, 0x04U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU,
-             0x67U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x11U, 0x65U,
-             0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U,
-             0x5FU, 0x72U, 0x61U, 0x6EU, 0x64U, 0x6FU, 0x6DU, 0x00U, 0x02U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x08U, 0x72U, 0x6FU, 0x6CU, 0x6CU,
-             0x62U, 0x61U, 0x63U, 0x6BU, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U,
-             0x00U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U,
-             0x01U, 0x06U, 0x08U, 0x01U, 0x7FU, 0x01U, 0x41U, 0x80U, 0x80U,
-             0x04U, 0x0BU, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU,
-             0x6BU, 0x00U, 0x04U, 0x0AU, 0xCEU, 0x01U, 0x01U, 0xCBU, 0x01U,
-             0x02U, 0x03U, 0x7FU, 0x01U, 0x7EU, 0x23U, 0x00U, 0x41U, 0x20U,
-             0x6BU, 0x22U, 0x01U, 0x24U, 0x00U, 0x41U, 0x01U, 0x41U, 0x01U,
-             0x10U, 0x00U, 0x1AU, 0x41U, 0x8EU, 0x80U, 0x80U, 0x80U, 0x78U,
-             0x41U, 0x21U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x21U, 0x00U,
-             0x03U, 0x40U, 0x41U, 0x8EU, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U,
-             0x21U, 0x10U, 0x00U, 0x1AU, 0x20U, 0x00U, 0x20U, 0x01U, 0x6AU,
-             0x41U, 0x00U, 0x3AU, 0x00U, 0x00U, 0x01U, 0x01U, 0x01U, 0x01U,
-             0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x20U, 0x00U,
-             0x41U, 0x01U, 0x6AU, 0x22U, 0x00U, 0x41U, 0x20U, 0x47U, 0x0DU,
-             0x00U, 0x0BU, 0x20U, 0x01U, 0x41U, 0x20U, 0x41U, 0x03U, 0x10U,
-             0x01U, 0x22U, 0x04U, 0x42U, 0x20U, 0x52U, 0x04U, 0x40U, 0x41U,
-             0x00U, 0x41U, 0x00U, 0x20U, 0x04U, 0x10U, 0x02U, 0x1AU, 0x0BU,
-             0x41U, 0x99U, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U, 0x21U, 0x10U,
-             0x00U, 0x1AU, 0x41U, 0x00U, 0x21U, 0x00U, 0x03U, 0x40U, 0x41U,
-             0x99U, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U, 0x21U, 0x10U, 0x00U,
-             0x1AU, 0x20U, 0x00U, 0x20U, 0x01U, 0x6AU, 0x2DU, 0x00U, 0x00U,
-             0x21U, 0x03U, 0x41U, 0x01U, 0x20U, 0x02U, 0x20U, 0x03U, 0x1BU,
-             0x21U, 0x02U, 0x20U, 0x00U, 0x41U, 0x01U, 0x6AU, 0x22U, 0x00U,
-             0x41U, 0x20U, 0x47U, 0x0DU, 0x00U, 0x0BU, 0x20U, 0x02U, 0x45U,
-             0x04U, 0x40U, 0x41U, 0x00U, 0x41U, 0x00U, 0x42U, 0x7EU, 0x10U,
-             0x02U, 0x1AU, 0x0BU, 0x41U, 0x00U, 0x41U, 0x00U, 0x42U, 0x00U,
-             0x10U, 0x03U, 0x21U, 0x04U, 0x20U, 0x01U, 0x41U, 0x20U, 0x6AU,
-             0x24U, 0x00U, 0x20U, 0x04U, 0x0BU,
-         }},
-
-        /* ==== WASM: 2 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t rollback(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                int64_t r1 = entropy_cr_dice(1000000, 3);
-                if (r1 < 0)
-                    rollback(0, 0, r1);
-
-                int64_t r2 = entropy_cr_dice(1000000, 3);
-                if (r2 < 0)
-                    rollback(0, 0, r2);
-
-                // consecutive calls should differ (rngCallCounter)
-                if (r1 == r2)
-                    rollback(0, 0, -1);
-
-                return accept(0, 0, r1 | (r2 << 20));
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x19U, 0x04U, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U, 0x7EU,
-             0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U, 0x02U, 0x7FU,
-             0x7FU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U,
-             0x3CU, 0x04U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U,
-             0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U, 0x6EU,
-             0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU,
-             0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x02U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x08U, 0x72U, 0x6FU, 0x6CU, 0x6CU, 0x62U, 0x61U, 0x63U,
-             0x6BU, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x61U,
-             0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U, 0x00U, 0x03U, 0x02U,
-             0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U, 0x01U, 0x07U, 0x08U,
-             0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x04U, 0x0AU,
-             0x5EU, 0x01U, 0x5CU, 0x01U, 0x02U, 0x7EU, 0x41U, 0x01U, 0x41U,
-             0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0xC0U, 0x84U, 0x3DU, 0x41U,
-             0x03U, 0x10U, 0x01U, 0x22U, 0x01U, 0x42U, 0x00U, 0x53U, 0x04U,
-             0x40U, 0x41U, 0x00U, 0x41U, 0x00U, 0x20U, 0x01U, 0x10U, 0x02U,
-             0x1AU, 0x0BU, 0x41U, 0xC0U, 0x84U, 0x3DU, 0x41U, 0x03U, 0x10U,
-             0x01U, 0x22U, 0x02U, 0x42U, 0x00U, 0x53U, 0x04U, 0x40U, 0x41U,
-             0x00U, 0x41U, 0x00U, 0x20U, 0x02U, 0x10U, 0x02U, 0x1AU, 0x0BU,
-             0x20U, 0x01U, 0x20U, 0x02U, 0x51U, 0x04U, 0x40U, 0x41U, 0x00U,
-             0x41U, 0x00U, 0x42U, 0x7FU, 0x10U, 0x02U, 0x1AU, 0x0BU, 0x41U,
-             0x00U, 0x41U, 0x00U, 0x20U, 0x02U, 0x42U, 0x14U, 0x86U, 0x20U,
-             0x01U, 0x84U, 0x10U, 0x03U, 0x0BU,
-         }},
-
-        /* ==== WASM: 3 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                int64_t result = entropy_cr_dice(0, 3);
-                // entropy_cr_dice(0) should return negative error code, pass it through
-                return accept(0, 0, result);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x19U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU,
-             0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U,
-             0x2DU, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U,
-             0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U, 0x6EU,
-             0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU,
-             0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U,
-             0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U,
-             0x01U, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU,
-             0x00U, 0x03U, 0x0AU, 0x17U, 0x01U, 0x15U, 0x00U, 0x41U, 0x01U,
-             0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U,
-             0x41U, 0x00U, 0x41U, 0x03U, 0x10U, 0x01U, 0x10U, 0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 4 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_status(void);
-            #define ENTROPY_TIER(x) (((uint64_t)(x) >> 32U) & 0xFFU)
-            #define ENTROPY_COUNT(x) (((uint64_t)(x) >> 16U) & 0xFFFFU)
-            #define ENTROPY_DENOMINATOR(x) ((uint64_t)(x) & 0xFFFFU)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                int64_t status = entropy_cr_status();
-                if (status < 0)
-                    return accept(0, 0, 13);
-
-                uint64_t expected =
-                    ((uint64_t)3 << 32U) | ((uint64_t)19 << 16U) | 20U;
-                if ((uint64_t)status != expected)
-                    return accept(0, 0, 14);
-
-                uint32_t tier = ENTROPY_TIER(status);
-                uint32_t count = ENTROPY_COUNT(status);
-                uint32_t denominator = ENTROPY_DENOMINATOR(status);
-                if (tier != 3 || count != 19 || denominator != 20)
-                    return accept(0, 0, 15);
-
-                // Common caller-side policies: tolerate one absent, require
-                // 4/5 participation, and require an absolute floor of 19.
-                if (tier < 2 || denominator - count > 1)
-                    return accept(0, 0, 16);
-                if ((uint64_t)5 * count < (uint64_t)4 * denominator)
-                    return accept(0, 0, 17);
-                if (count < 19)
-                    return accept(0, 0, 18);
-
-                return accept(0, 0, 0);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x17U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x00U, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U,
-             0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U, 0x2FU, 0x03U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U, 0x00U, 0x00U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x11U, 0x65U, 0x6EU, 0x74U, 0x72U,
-             0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU, 0x73U, 0x74U,
-             0x61U, 0x74U, 0x75U, 0x73U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U,
-             0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U,
-             0x01U, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU,
-             0x00U, 0x03U, 0x0AU, 0x2BU, 0x01U, 0x29U, 0x01U, 0x01U, 0x7EU,
-             0x41U, 0x01U, 0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U,
-             0x41U, 0x00U, 0x42U, 0x0DU, 0x42U, 0x0EU, 0x42U, 0x00U, 0x10U,
-             0x01U, 0x22U, 0x01U, 0x42U, 0x94U, 0x80U, 0xCCU, 0x80U, 0x30U,
-             0x52U, 0x1BU, 0x20U, 0x01U, 0x42U, 0x00U, 0x53U, 0x1BU, 0x10U,
-             0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 5 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-            extern int64_t entropy_cr_status(void);
-            #define ENTROPY_TIER(x) (((uint64_t)(x) >> 32U) & 0xFFU)
-            #define ENTROPY_COUNT(x) (((uint64_t)(x) >> 16U) & 0xFFFFU)
-            #define ENTROPY_DENOMINATOR(x) ((uint64_t)(x) & 0xFFFFU)
-            #define TOO_LITTLE_ENTROPY (-48)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                int64_t status = entropy_cr_status();
-                if (status < 0)
-                    return accept(0, 0, 20);
-                if (ENTROPY_TIER(status) != 1 || ENTROPY_COUNT(status) != 0 ||
-                    ENTROPY_DENOMINATOR(status) != 0)
-                    return accept(0, 0, 21);
-
-                int64_t allowed = entropy_cr_dice(6, 1);
-                if (allowed < 0 || allowed > 5)
-                    return accept(0, 0, 22);
-                if (entropy_cr_dice(6, 2) != TOO_LITTLE_ENTROPY)
-                    return accept(0, 0, 23);
-
-                return accept(0, 0, 0);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x1DU, 0x05U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x00U, 0x01U, 0x7EU, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU,
-             0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U,
-             0x7FU, 0x01U, 0x7EU, 0x02U, 0x45U, 0x04U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x02U, 0x5FU, 0x67U, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x11U, 0x65U, 0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U,
-             0x5FU, 0x63U, 0x72U, 0x5FU, 0x73U, 0x74U, 0x61U, 0x74U, 0x75U,
-             0x73U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U,
-             0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U,
-             0x5FU, 0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x02U, 0x03U, 0x65U,
-             0x6EU, 0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U,
-             0x00U, 0x03U, 0x03U, 0x02U, 0x01U, 0x04U, 0x05U, 0x03U, 0x01U,
-             0x00U, 0x01U, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU,
-             0x6BU, 0x00U, 0x04U, 0x0AU, 0x54U, 0x01U, 0x52U, 0x01U, 0x01U,
-             0x7EU, 0x41U, 0x01U, 0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U,
-             0x00U, 0x41U, 0x00U, 0x02U, 0x7EU, 0x42U, 0x14U, 0x10U, 0x01U,
-             0x22U, 0x01U, 0x42U, 0x00U, 0x53U, 0x0DU, 0x00U, 0x1AU, 0x42U,
-             0x15U, 0x20U, 0x01U, 0x42U, 0xFFU, 0xFFU, 0xFFU, 0xFFU, 0xFFU,
-             0x1FU, 0x83U, 0x42U, 0x80U, 0x80U, 0x80U, 0x80U, 0x10U, 0x52U,
-             0x0DU, 0x00U, 0x1AU, 0x42U, 0x16U, 0x41U, 0x06U, 0x41U, 0x01U,
-             0x10U, 0x02U, 0x42U, 0x05U, 0x56U, 0x0DU, 0x00U, 0x1AU, 0x42U,
-             0x17U, 0x42U, 0x00U, 0x41U, 0x06U, 0x41U, 0x02U, 0x10U, 0x02U,
-             0x42U, 0x50U, 0x52U, 0x1BU, 0x0BU, 0x10U, 0x03U, 0x0BU,
-         }},
-
-        /* ==== WASM: 6 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-            extern int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-            extern int64_t entropy_cr_status(void);
-            #define GUARD(maxiter) _g((1ULL << 31U) + __LINE__, (maxiter)+1)
-            #define TOO_LITTLE_ENTROPY (-48)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                uint64_t expected =
-                    ((uint64_t)3 << 32U) | ((uint64_t)19 << 16U) | 20U;
-                if ((uint64_t)entropy_cr_status() != expected)
-                    return accept(0, 0, 40);
-
-                int64_t dice_result = entropy_cr_dice(6, 1);
-                if (dice_result != TOO_LITTLE_ENTROPY)
-                    return accept(0, 0, 41);
-
-                uint8_t buf[32];
-                for (int i = 0; GUARD(32), i < 32; ++i)
-                    buf[i] = 0xA5;
-                if (entropy_cr_random((uint32_t)buf, 32, 1) != TOO_LITTLE_ENTROPY)
-                    return accept(0, 0, 42);
-                for (int i = 0; GUARD(32), i < 32; ++i)
-                    if (buf[i] != 0xA5)
-                        return accept(0, 0, 43);
-
-                return accept(0, 0, 0);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x24U, 0x06U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x00U, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U,
-             0x7EU, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U,
-             0x7FU, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U,
-             0x7EU, 0x02U, 0x5DU, 0x05U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U,
-             0x5FU, 0x67U, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x11U,
-             0x65U, 0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U,
-             0x72U, 0x5FU, 0x73U, 0x74U, 0x61U, 0x74U, 0x75U, 0x73U, 0x00U,
-             0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x61U, 0x63U, 0x63U,
-             0x65U, 0x70U, 0x74U, 0x00U, 0x02U, 0x03U, 0x65U, 0x6EU, 0x76U,
-             0x0FU, 0x65U, 0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU,
-             0x63U, 0x72U, 0x5FU, 0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x03U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x11U, 0x65U, 0x6EU, 0x74U, 0x72U,
-             0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU, 0x72U, 0x61U,
-             0x6EU, 0x64U, 0x6FU, 0x6DU, 0x00U, 0x04U, 0x03U, 0x02U, 0x01U,
-             0x05U, 0x05U, 0x03U, 0x01U, 0x00U, 0x01U, 0x06U, 0x08U, 0x01U,
-             0x7FU, 0x01U, 0x41U, 0x80U, 0x80U, 0x04U, 0x0BU, 0x07U, 0x08U,
-             0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x05U, 0x0AU,
-             0xF6U, 0x01U, 0x01U, 0xF3U, 0x01U, 0x02U, 0x01U, 0x7FU, 0x01U,
-             0x7EU, 0x23U, 0x00U, 0x41U, 0x20U, 0x6BU, 0x22U, 0x01U, 0x24U,
-             0x00U, 0x41U, 0x01U, 0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x02U,
-             0x7EU, 0x10U, 0x01U, 0x42U, 0x94U, 0x80U, 0xCCU, 0x80U, 0x30U,
-             0x52U, 0x04U, 0x40U, 0x41U, 0x00U, 0x41U, 0x00U, 0x42U, 0x28U,
-             0x10U, 0x02U, 0x0CU, 0x01U, 0x0BU, 0x41U, 0x06U, 0x41U, 0x01U,
-             0x10U, 0x03U, 0x42U, 0x50U, 0x52U, 0x04U, 0x40U, 0x41U, 0x00U,
-             0x41U, 0x00U, 0x42U, 0x29U, 0x10U, 0x02U, 0x0CU, 0x01U, 0x0BU,
-             0x41U, 0x98U, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U, 0x21U, 0x10U,
-             0x00U, 0x1AU, 0x41U, 0x00U, 0x21U, 0x00U, 0x03U, 0x40U, 0x41U,
-             0x98U, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U, 0x21U, 0x10U, 0x00U,
-             0x1AU, 0x20U, 0x00U, 0x20U, 0x01U, 0x6AU, 0x41U, 0xA5U, 0x01U,
-             0x3AU, 0x00U, 0x00U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U,
-             0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x20U, 0x00U, 0x41U, 0x01U,
-             0x6AU, 0x22U, 0x00U, 0x41U, 0x20U, 0x47U, 0x0DU, 0x00U, 0x0BU,
-             0x41U, 0x00U, 0x41U, 0x00U, 0x02U, 0x7EU, 0x42U, 0x2AU, 0x20U,
-             0x01U, 0x41U, 0x20U, 0x41U, 0x01U, 0x10U, 0x04U, 0x42U, 0x50U,
-             0x52U, 0x0DU, 0x00U, 0x1AU, 0x41U, 0x9CU, 0x80U, 0x80U, 0x80U,
-             0x78U, 0x41U, 0x21U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x21U,
-             0x00U, 0x02U, 0x40U, 0x03U, 0x40U, 0x41U, 0x9CU, 0x80U, 0x80U,
-             0x80U, 0x78U, 0x41U, 0x21U, 0x10U, 0x00U, 0x1AU, 0x20U, 0x00U,
-             0x20U, 0x01U, 0x6AU, 0x2DU, 0x00U, 0x00U, 0x41U, 0xA5U, 0x01U,
-             0x47U, 0x0DU, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U,
-             0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x20U, 0x00U, 0x41U, 0x01U,
-             0x6AU, 0x22U, 0x00U, 0x41U, 0x20U, 0x47U, 0x0DU, 0x00U, 0x0BU,
-             0x42U, 0x00U, 0x0CU, 0x01U, 0x0BU, 0x42U, 0x2BU, 0x0BU, 0x10U,
-             0x02U, 0x0BU, 0x21U, 0x02U, 0x20U, 0x01U, 0x41U, 0x20U, 0x6AU,
-             0x24U, 0x00U, 0x20U, 0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 7 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                int64_t result = entropy_cr_dice(6, 4);
-                return accept(0, 0, result);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x19U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU,
-             0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U,
-             0x2DU, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U,
-             0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U, 0x6EU,
-             0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU,
-             0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U,
-             0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U,
-             0x01U, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU,
-             0x00U, 0x03U, 0x0AU, 0x17U, 0x01U, 0x15U, 0x00U, 0x41U, 0x01U,
-             0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U,
-             0x41U, 0x06U, 0x41U, 0x04U, 0x10U, 0x01U, 0x10U, 0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 8 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                return accept(0, 0, entropy_cr_dice(6, 3));
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x19U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU,
-             0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U,
-             0x2DU, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U,
-             0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U, 0x6EU,
-             0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU,
-             0x64U, 0x69U, 0x63U, 0x65U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U,
-             0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U,
-             0x01U, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU,
-             0x00U, 0x03U, 0x0AU, 0x17U, 0x01U, 0x15U, 0x00U, 0x41U, 0x01U,
-             0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U,
-             0x41U, 0x06U, 0x41U, 0x03U, 0x10U, 0x01U, 0x10U, 0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 9 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                uint8_t buf[32];
-                return accept(0, 0, entropy_cr_random((uint32_t)buf, 32, 3));
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x1AU, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x03U, 0x7FU, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU,
-             0x7FU, 0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU,
-             0x02U, 0x2FU, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU,
-             0x67U, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x11U, 0x65U,
-             0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U,
-             0x5FU, 0x72U, 0x61U, 0x6EU, 0x64U, 0x6FU, 0x6DU, 0x00U, 0x01U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U,
-             0x70U, 0x74U, 0x00U, 0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U,
-             0x03U, 0x01U, 0x00U, 0x01U, 0x06U, 0x08U, 0x01U, 0x7FU, 0x01U,
-             0x41U, 0x80U, 0x80U, 0x04U, 0x0BU, 0x07U, 0x08U, 0x01U, 0x04U,
-             0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x03U, 0x0AU, 0x2FU, 0x01U,
-             0x2DU, 0x01U, 0x01U, 0x7EU, 0x23U, 0x00U, 0x41U, 0x20U, 0x6BU,
-             0x22U, 0x00U, 0x24U, 0x00U, 0x41U, 0x01U, 0x41U, 0x01U, 0x10U,
-             0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U, 0x20U, 0x00U, 0x41U,
-             0x20U, 0x41U, 0x03U, 0x10U, 0x01U, 0x10U, 0x02U, 0x21U, 0x01U,
-             0x20U, 0x00U, 0x41U, 0x20U, 0x6AU, 0x24U, 0x00U, 0x20U, 0x01U,
-             0x0BU,
-         }},
-
-        /* ==== WASM: 10 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_status(void);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                return accept(0, 0, entropy_cr_status());
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x17U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x00U, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U,
-             0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U, 0x2FU, 0x03U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U, 0x00U, 0x00U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x11U, 0x65U, 0x6EU, 0x74U, 0x72U,
-             0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU, 0x73U, 0x74U,
-             0x61U, 0x74U, 0x75U, 0x73U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU,
-             0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U,
-             0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U,
-             0x01U, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU,
-             0x00U, 0x03U, 0x0AU, 0x13U, 0x01U, 0x11U, 0x00U, 0x41U, 0x01U,
-             0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U,
-             0x10U, 0x01U, 0x10U, 0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 11 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t dice(uint32_t sides, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                return accept(0, 0, dice(6, 3));
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x19U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU,
-             0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U,
-             0x22U, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U,
-             0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x04U, 0x64U, 0x69U,
-             0x63U, 0x65U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U,
-             0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U, 0x02U, 0x03U,
-             0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U, 0x01U, 0x07U,
-             0x08U, 0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x03U,
-             0x0AU, 0x17U, 0x01U, 0x15U, 0x00U, 0x41U, 0x01U, 0x41U, 0x01U,
-             0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U, 0x41U, 0x06U,
-             0x41U, 0x03U, 0x10U, 0x01U, 0x10U, 0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 12 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                uint8_t buf[32];
-                return accept(0, 0, random((uint32_t)buf, 32, 3));
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x1AU, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x03U, 0x7FU, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU,
-             0x7FU, 0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU,
-             0x02U, 0x24U, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU,
-             0x67U, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x72U,
-             0x61U, 0x6EU, 0x64U, 0x6FU, 0x6DU, 0x00U, 0x01U, 0x03U, 0x65U,
-             0x6EU, 0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U,
-             0x00U, 0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U, 0x03U, 0x01U,
-             0x00U, 0x01U, 0x06U, 0x08U, 0x01U, 0x7FU, 0x01U, 0x41U, 0x80U,
-             0x80U, 0x04U, 0x0BU, 0x07U, 0x08U, 0x01U, 0x04U, 0x68U, 0x6FU,
-             0x6FU, 0x6BU, 0x00U, 0x03U, 0x0AU, 0x2FU, 0x01U, 0x2DU, 0x01U,
-             0x01U, 0x7EU, 0x23U, 0x00U, 0x41U, 0x20U, 0x6BU, 0x22U, 0x00U,
-             0x24U, 0x00U, 0x41U, 0x01U, 0x41U, 0x01U, 0x10U, 0x00U, 0x1AU,
-             0x41U, 0x00U, 0x41U, 0x00U, 0x20U, 0x00U, 0x41U, 0x20U, 0x41U,
-             0x03U, 0x10U, 0x01U, 0x10U, 0x02U, 0x21U, 0x01U, 0x20U, 0x00U,
-             0x41U, 0x20U, 0x6AU, 0x24U, 0x00U, 0x20U, 0x01U, 0x0BU,
-         }},
-
-        /* ==== WASM: 13 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_status(void);
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                return accept(0, 0, entropy_status());
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x17U, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x00U, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7EU, 0x01U,
-             0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U, 0x2CU, 0x03U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U, 0x00U, 0x00U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x0EU, 0x65U, 0x6EU, 0x74U, 0x72U,
-             0x6FU, 0x70U, 0x79U, 0x5FU, 0x73U, 0x74U, 0x61U, 0x74U, 0x75U,
-             0x73U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x61U,
-             0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U, 0x02U, 0x03U, 0x02U,
-             0x01U, 0x03U, 0x05U, 0x03U, 0x01U, 0x00U, 0x01U, 0x07U, 0x08U,
-             0x01U, 0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x03U, 0x0AU,
-             0x13U, 0x01U, 0x11U, 0x00U, 0x41U, 0x01U, 0x41U, 0x01U, 0x10U,
-             0x00U, 0x1AU, 0x41U, 0x00U, 0x41U, 0x00U, 0x10U, 0x01U, 0x10U,
-             0x02U, 0x0BU,
-         }},
-
-        /* ==== WASM: 14 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-            #define GUARD(maxiter) _g((1ULL << 31U) + __LINE__, (maxiter)+1)
-            #define TOO_LITTLE_ENTROPY (-48)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                uint8_t buf[32];
-                for (int i = 0; GUARD(32), i < 32; ++i)
-                    buf[i] = 0xA5;
-
-                if (entropy_cr_random((uint32_t)buf, 32, 4) != TOO_LITTLE_ENTROPY)
-                    return accept(0, 0, 30);
-                for (int i = 0; GUARD(32), i < 32; ++i)
-                    if (buf[i] != 0xA5)
-                        return accept(0, 0, 31);
-
-                return accept(0, 0, 0);
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x1AU, 0x04U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x03U, 0x7FU, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU,
-             0x7FU, 0x7EU, 0x01U, 0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU,
-             0x02U, 0x2FU, 0x03U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU,
-             0x67U, 0x00U, 0x00U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x11U, 0x65U,
-             0x6EU, 0x74U, 0x72U, 0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U,
-             0x5FU, 0x72U, 0x61U, 0x6EU, 0x64U, 0x6FU, 0x6DU, 0x00U, 0x01U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x06U, 0x61U, 0x63U, 0x63U, 0x65U,
-             0x70U, 0x74U, 0x00U, 0x02U, 0x03U, 0x02U, 0x01U, 0x03U, 0x05U,
-             0x03U, 0x01U, 0x00U, 0x01U, 0x06U, 0x08U, 0x01U, 0x7FU, 0x01U,
-             0x41U, 0x80U, 0x80U, 0x04U, 0x0BU, 0x07U, 0x08U, 0x01U, 0x04U,
-             0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x03U, 0x0AU, 0xC7U, 0x01U,
-             0x01U, 0xC4U, 0x01U, 0x02U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x23U,
-             0x00U, 0x41U, 0x20U, 0x6BU, 0x22U, 0x01U, 0x24U, 0x00U, 0x41U,
-             0x01U, 0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x41U, 0x8DU, 0x80U,
-             0x80U, 0x80U, 0x78U, 0x41U, 0x21U, 0x10U, 0x00U, 0x1AU, 0x41U,
-             0x00U, 0x21U, 0x00U, 0x03U, 0x40U, 0x41U, 0x8DU, 0x80U, 0x80U,
-             0x80U, 0x78U, 0x41U, 0x21U, 0x10U, 0x00U, 0x1AU, 0x20U, 0x00U,
-             0x20U, 0x01U, 0x6AU, 0x41U, 0xA5U, 0x01U, 0x3AU, 0x00U, 0x00U,
-             0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U,
-             0x01U, 0x01U, 0x20U, 0x00U, 0x41U, 0x01U, 0x6AU, 0x22U, 0x00U,
-             0x41U, 0x20U, 0x47U, 0x0DU, 0x00U, 0x0BU, 0x41U, 0x00U, 0x41U,
-             0x00U, 0x02U, 0x7EU, 0x42U, 0x1EU, 0x20U, 0x01U, 0x41U, 0x20U,
-             0x41U, 0x04U, 0x10U, 0x01U, 0x42U, 0x50U, 0x52U, 0x0DU, 0x00U,
-             0x1AU, 0x41U, 0x92U, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U, 0x21U,
-             0x10U, 0x00U, 0x1AU, 0x41U, 0x00U, 0x21U, 0x00U, 0x02U, 0x40U,
-             0x03U, 0x40U, 0x41U, 0x92U, 0x80U, 0x80U, 0x80U, 0x78U, 0x41U,
-             0x21U, 0x10U, 0x00U, 0x1AU, 0x20U, 0x00U, 0x20U, 0x01U, 0x6AU,
-             0x2DU, 0x00U, 0x00U, 0x41U, 0xA5U, 0x01U, 0x47U, 0x0DU, 0x01U,
-             0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U, 0x01U,
-             0x01U, 0x01U, 0x20U, 0x00U, 0x41U, 0x01U, 0x6AU, 0x22U, 0x00U,
-             0x41U, 0x20U, 0x47U, 0x0DU, 0x00U, 0x0BU, 0x42U, 0x00U, 0x0CU,
-             0x01U, 0x0BU, 0x42U, 0x1FU, 0x0BU, 0x10U, 0x02U, 0x21U, 0x02U,
-             0x20U, 0x01U, 0x41U, 0x20U, 0x6AU, 0x24U, 0x00U, 0x20U, 0x02U,
-             0x0BU,
-         }},
-
-        /* ==== WASM: 15 ==== */
-        {R"[test.hook](
-            #include <stdint.h>
-            extern int32_t _g(uint32_t, uint32_t);
-            extern int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
-            extern int64_t entropy_cr_dice(uint32_t sides, uint32_t min_tier);
-            extern int64_t entropy_cr_random(uint32_t write_ptr, uint32_t write_len, uint32_t min_tier);
-            #define INVALID_ARGUMENT (-7)
-
-            int64_t hook(uint32_t r)
-            {
-                _g(1,1);
-                uint8_t buf[32];
-
-                int64_t bad_min_tier = entropy_cr_dice(6, 0);
-                if (bad_min_tier != INVALID_ARGUMENT)
-                    return accept(0, 0, 100);
-
-                int64_t bad_high_tier = entropy_cr_dice(6, 5);
-                if (bad_high_tier != INVALID_ARGUMENT)
-                    return accept(0, 0, 101);
-
-                int64_t bad_random_low = entropy_cr_random((uint32_t)buf, 32, 0);
-                if (bad_random_low != INVALID_ARGUMENT)
-                    return accept(0, 0, 102);
-
-                int64_t bad_random_high = entropy_cr_random((uint32_t)buf, 32, 5);
-                if (bad_random_high != INVALID_ARGUMENT)
-                    return accept(0, 0, 103);
-
-                // Failed calls must not consume the shared RNG call counter.
-                // The test pins the first valid draw as a known-answer vector.
-                return accept(0, 0, entropy_cr_dice(1000000, 4));
-            }
-        )[test.hook]",
-         {
-             0x00U, 0x61U, 0x73U, 0x6DU, 0x01U, 0x00U, 0x00U, 0x00U, 0x01U,
-             0x20U, 0x05U, 0x60U, 0x02U, 0x7FU, 0x7FU, 0x01U, 0x7FU, 0x60U,
-             0x02U, 0x7FU, 0x7FU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU,
-             0x7EU, 0x01U, 0x7EU, 0x60U, 0x03U, 0x7FU, 0x7FU, 0x7FU, 0x01U,
-             0x7EU, 0x60U, 0x01U, 0x7FU, 0x01U, 0x7EU, 0x02U, 0x45U, 0x04U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x02U, 0x5FU, 0x67U, 0x00U, 0x00U,
-             0x03U, 0x65U, 0x6EU, 0x76U, 0x0FU, 0x65U, 0x6EU, 0x74U, 0x72U,
-             0x6FU, 0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU, 0x64U, 0x69U,
-             0x63U, 0x65U, 0x00U, 0x01U, 0x03U, 0x65U, 0x6EU, 0x76U, 0x06U,
-             0x61U, 0x63U, 0x63U, 0x65U, 0x70U, 0x74U, 0x00U, 0x02U, 0x03U,
-             0x65U, 0x6EU, 0x76U, 0x11U, 0x65U, 0x6EU, 0x74U, 0x72U, 0x6FU,
-             0x70U, 0x79U, 0x5FU, 0x63U, 0x72U, 0x5FU, 0x72U, 0x61U, 0x6EU,
-             0x64U, 0x6FU, 0x6DU, 0x00U, 0x03U, 0x03U, 0x02U, 0x01U, 0x04U,
-             0x05U, 0x03U, 0x01U, 0x00U, 0x01U, 0x06U, 0x08U, 0x01U, 0x7FU,
-             0x01U, 0x41U, 0x80U, 0x80U, 0x04U, 0x0BU, 0x07U, 0x08U, 0x01U,
-             0x04U, 0x68U, 0x6FU, 0x6FU, 0x6BU, 0x00U, 0x04U, 0x0AU, 0x93U,
-             0x01U, 0x01U, 0x90U, 0x01U, 0x01U, 0x01U, 0x7EU, 0x23U, 0x00U,
-             0x41U, 0x20U, 0x6BU, 0x22U, 0x00U, 0x24U, 0x00U, 0x41U, 0x01U,
-             0x41U, 0x01U, 0x10U, 0x00U, 0x1AU, 0x02U, 0x7EU, 0x41U, 0x06U,
-             0x41U, 0x00U, 0x10U, 0x01U, 0x42U, 0x79U, 0x52U, 0x04U, 0x40U,
-             0x41U, 0x00U, 0x41U, 0x00U, 0x42U, 0xE4U, 0x00U, 0x10U, 0x02U,
-             0x0CU, 0x01U, 0x0BU, 0x41U, 0x06U, 0x41U, 0x05U, 0x10U, 0x01U,
-             0x42U, 0x79U, 0x52U, 0x04U, 0x40U, 0x41U, 0x00U, 0x41U, 0x00U,
-             0x42U, 0xE5U, 0x00U, 0x10U, 0x02U, 0x0CU, 0x01U, 0x0BU, 0x20U,
-             0x00U, 0x41U, 0x20U, 0x41U, 0x00U, 0x10U, 0x03U, 0x42U, 0x79U,
-             0x52U, 0x04U, 0x40U, 0x41U, 0x00U, 0x41U, 0x00U, 0x42U, 0xE6U,
-             0x00U, 0x10U, 0x02U, 0x0CU, 0x01U, 0x0BU, 0x20U, 0x00U, 0x41U,
-             0x20U, 0x41U, 0x05U, 0x10U, 0x03U, 0x42U, 0x79U, 0x52U, 0x04U,
-             0x40U, 0x41U, 0x00U, 0x41U, 0x00U, 0x42U, 0xE7U, 0x00U, 0x10U,
-             0x02U, 0x0CU, 0x01U, 0x0BU, 0x41U, 0x00U, 0x41U, 0x00U, 0x41U,
-             0xC0U, 0x84U, 0x3DU, 0x41U, 0x04U, 0x10U, 0x01U, 0x10U, 0x02U,
-             0x0BU, 0x21U, 0x01U, 0x20U, 0x00U, 0x41U, 0x20U, 0x6AU, 0x24U,
-             0x00U, 0x20U, 0x01U, 0x0BU,
-         }},
-
-};
-}
-}  // namespace ripple
-#endif

src/test/app/DNS_test.cpp

@@ -61,7 +61,7 @@ public:
             pUrl_.domain,
             pUrl_.path,
             port_,
-            env_.app().getIOService(),
+            env_.app().getIOContext(),
             env_.journal,
             env_.app().config(),
             lastEndpoint,
@@ -78,10 +78,11 @@ public:
     isMultipleEndpoints()
     {
         using boost::asio::ip::tcp;
-        tcp::resolver resolver(env_.app().getIOService());
+        tcp::resolver resolver(env_.app().getIOContext());
         std::string port = pUrl_.port ? std::to_string(*pUrl_.port) : "443";
-        tcp::resolver::iterator it = resolver.resolve(pUrl_.domain, port);
-        tcp::resolver::iterator end;
+        auto results = resolver.resolve(pUrl_.domain, port);
+        auto it = results.begin();
+        auto end = results.end();
         int n = 0;
         for (; it != end; ++it)
             ++n;

src/test/app/DepositAuth_test.cpp

@@ -301,8 +301,14 @@ struct DepositAuth_test : public beast::unit_test::suite
             Env env(*this, features);
 
             env.fund(XRP(10000), gw1, alice, bob);
-            env(trust(gw1, alice["USD"](10), noRipplePrev ? tfSetNoRipple : 0));
-            env(trust(gw1, bob["USD"](10), noRippleNext ? tfSetNoRipple : 0));
+            env(trust(
+                gw1,
+                alice["USD"](10),
+                noRipplePrev ? std::uint32_t(tfSetNoRipple) : 0));
+            env(trust(
+                gw1,
+                bob["USD"](10),
+                noRippleNext ? std::uint32_t(tfSetNoRipple) : 0));
             env.trust(USD1(10), alice, bob);
 
             env(pay(gw1, alice, USD1(10)));
@@ -324,8 +330,14 @@ struct DepositAuth_test : public beast::unit_test::suite
             Env env(*this, features);
 
             env.fund(XRP(10000), gw1, gw2, alice);
-            env(trust(alice, USD1(10), noRipplePrev ? tfSetNoRipple : 0));
-            env(trust(alice, USD2(10), noRippleNext ? tfSetNoRipple : 0));
+            env(trust(
+                alice,
+                USD1(10),
+                noRipplePrev ? std::uint32_t(tfSetNoRipple) : 0));
+            env(trust(
+                alice,
+                USD2(10),
+                noRippleNext ? std::uint32_t(tfSetNoRipple) : 0));
             env(pay(gw2, alice, USD2(10)));
 
             if (withDepositAuth)