refactor: include transactor headers from transactions.macro

Partial cherry-pick of XRPLF/rippled#5590. Each TRANSACTION entry now
carries its transactor header behind `#if TRANSACTION_INCLUDE`, and
applySteps.cpp pulls them in by expanding the macro with
TRANSACTION_INCLUDE defined. Adding a transaction type no longer
requires touching the include list in applySteps.cpp.

ApplyContext.h (reached via Transactor.h) and XahauGenesis.h (unused
there) are dropped from applySteps.cpp.

.codecov.yml

@@ -1,6 +1,46 @@
+codecov:
+  require_ci_to_pass: true
+
+comment:
+  behavior: default
+  layout: reach,diff,flags,tree,reach
+  show_carryforward_flags: false
+
 coverage:
+  range: "60..80"
+  precision: 1
+  round: nearest
   status:
     project:
       default:
         target: 60%
         threshold: 2%
+    patch:
+      default:
+        target: auto
+        threshold: 2%
+        paths:
+          # PeerImp is historically hard to exercise in the current unit-test
+          # harness. Keep this list narrow; new testable code should remain
+          # covered by the default patch gate.
+          - "!src/xrpld/overlay/detail/PeerImp.cpp"
+      historically-untested:
+        target: 0%
+        paths:
+          - "src/xrpld/overlay/detail/PeerImp.cpp"
+    changes: false
+
+github_checks:
+  annotations: true
+
+parsers:
+  cobertura:
+    partials_as_hits: true
+    handle_missing_conditions : true
+
+slack_app: false
+
+ignore:
+  - "src/test/"
+  - "include/xrpl/beast/test/"
+  - "include/xrpl/beast/unit_test/"

.git-blame-ignore-revs

@@ -1,8 +1,25 @@
 # This feature requires Git >= 2.24
 # To use it by default in git blame:
 # git config blame.ignoreRevsFile .git-blame-ignore-revs
+# Format first-party source according to .clang-format
 50760c693510894ca368e90369b0cc2dabfd07f3
-e2384885f5f630c8f0ffe4bf21a169b433a16858
-241b9ddde9e11beb7480600fd5ed90e1ef109b21
-760f16f56835663d9286bd29294d074de26a7ba6
-0eebe6a5f4246fced516d52b83ec4e7f47373edd
+# Reintroduce Clang-Format & Levelization
+da1d20d6d5d862716125d60899b80fab5302954a
+# Consolidate external libraries
+da1d20d6d5d862716125d60899b80fab5302954a
+# Rename .hpp to .h
+0345a2645d0f5ad900f4fbbcaff96040d3a887fc
+# Format formerly .hpp files
+5a227dc719016e10045e17c9396ad401118044f1
+# Rewrite includes
+e61880699997398f5a746e6c4034edc7632661f5
+# Move CMake directory (#4997)
+e47b1c1b3b97c3f6d11858ee02f463596e29e7f0
+# Rearrange sources (#4997)
+bfafa2bb39e562901736d656806bd700c3699a2f
+# Rewrite includes (#4997)
+e61880699997398f5a746e6c4034edc7632661f5
+# Recompute loops (#4997)
+d25b5dcd568bb96c18e347d55fac10fe901a1bfb
+# Reformat code with clang-format-18
+02749feea88ce61c1f7eeb2d61a57d8ecf07ab11

.github/actions/xahau-ga-dependencies/action.yml

@@ -50,6 +50,10 @@ inputs:
     options:
       - libstdcxx
       - libcxx
+  conan_deps_cxxflags:
+    description: 'Extra cxxflags applied to Conan dependency package builds only (NOT the rippled build). JSON object keyed by Conan package pattern, e.g. {"grpc/*":["-Wno-foo"]}. Maps to <pattern>:tools.build:cxxflags.'
+    required: false
+    default: '{}'
 
 outputs:
   cache-hit:
@@ -81,6 +85,8 @@ runs:
 
     - name: Configure Conan
       shell: bash
+      env:
+        CONAN_DEPS_CXXFLAGS: ${{ inputs.conan_deps_cxxflags }}
       run: |
         # Create the default profile directory if it doesn't exist
         mkdir -p ~/.conan2/profiles
@@ -105,7 +111,14 @@ runs:
         os=${{ inputs.os }}
         EOF
 
-        # Add buildenv and conf sections for Linux (not needed for macOS)
+        # [buildenv] + [conf] sections.
+        # Linux pins compiler executables; macOS uses the system toolchain.
+        # conan_deps_cxxflags (matrix-driven) optionally adds package-pattern
+        # scoped tools.build:cxxflags for Conan dependency builds only - typically
+        # grpc workarounds for newer clang's stricter diagnostics. Because these
+        # are profile-pattern scoped (e.g. grpc/*:...), they do NOT affect the
+        # consumer/rippled toolchain generated for the main build.
+        NEED_CONF=0
         if [ "${{ inputs.os }}" = "Linux" ] && [ -n "${{ inputs.cc }}" ]; then
           cat >> ~/.conan2/profiles/default <<EOF
 
@@ -116,16 +129,38 @@ runs:
         [conf]
         tools.build:compiler_executables={"c": "/usr/bin/${{ inputs.cc }}", "cpp": "/usr/bin/${{ inputs.cxx }}"}
         EOF
+          NEED_CONF=1
         fi
 
-        # Add macOS-specific conf if needed
-        if [ "${{ inputs.os }}" = "Macos" ]; then
-          cat >> ~/.conan2/profiles/default <<EOF
+        if [ -n "${CONAN_DEPS_CXXFLAGS}" ] && [ "${CONAN_DEPS_CXXFLAGS}" != "{}" ]; then
+          CONAN_DEPS_CXXFLAGS_LINES="$(python3 - <<'PY'
+        import json
+        import os
+        import sys
 
-        [conf]
-        # Workaround for gRPC with newer Apple Clang
-        tools.build:cxxflags=["-Wno-missing-template-arg-list-after-template-kw"]
-        EOF
+        raw = os.environ["CONAN_DEPS_CXXFLAGS"]
+        data = json.loads(raw)
+        if not isinstance(data, dict):
+            sys.exit("conan_deps_cxxflags must be a JSON object like {\"grpc/*\": [\"-Wno-...\"]}")
+
+        for pattern, flags in data.items():
+            if not isinstance(pattern, str) or not pattern:
+                sys.exit("conan_deps_cxxflags keys must be non-empty Conan package patterns")
+            if pattern == "&":
+                sys.exit("conan_deps_cxxflags must target dependency package patterns, not the consumer (&)")
+            if not isinstance(flags, list) or not all(isinstance(flag, str) for flag in flags):
+                sys.exit(f"{pattern}: cxxflags must be a JSON string list")
+            if flags:
+                print(f"{pattern}:tools.build:cxxflags={json.dumps(flags, separators=(',', ':'))}")
+        PY
+          )"
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ] && [ "$NEED_CONF" = "0" ]; then
+            echo "" >> ~/.conan2/profiles/default
+            echo "[conf]" >> ~/.conan2/profiles/default
+          fi
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ]; then
+            printf '%s\n' "${CONAN_DEPS_CXXFLAGS_LINES}" >> ~/.conan2/profiles/default
+          fi
         fi
 
         # Display profile for verification

.github/workflows/build-in-docker.yml

@@ -15,6 +15,9 @@ env:
 
 jobs:
   checkout:
+    # build publishes to build.xahau.tech, so this workflow only runs from
+    # Xahau/xahaud. build and tests are skipped along with this job.
+    if: github.repository == 'Xahau/xahaud'
     runs-on: [self-hosted, vanity]
     outputs:
       checkout_path: ${{ steps.vars.outputs.checkout_path }}
@@ -86,10 +89,16 @@ jobs:
   cleanup:
     runs-on: [self-hosted, xahaud-build]
     needs: [tests, checkout]
-    if: always()
+    if: always() && github.repository == 'Xahau/xahaud'
     steps:
       - name: Cleanup workspace
         run: |
           CHECKOUT_PATH="${{ needs.checkout.outputs.checkout_path }}"
+          # A run cancelled before checkout has no path; an empty one would
+          # make the rm below delete every run's checkout on the runner.
+          if [[ -z "${CHECKOUT_PATH}" ]]; then
+            echo "No checkout path (cancelled before checkout); nothing to clean"
+            exit 0
+          fi
           echo "Cleaning workspace for ${CHECKOUT_PATH}"
           rm -rf "${{ github.workspace }}/${CHECKOUT_PATH}"

.github/workflows/clang-format.yml

@@ -20,7 +20,7 @@ jobs:
         sudo apt-get update
         sudo apt-get install clang-format-${CLANG_VERSION}
     - name: Format first-party sources
-      run: find include src -type f \( -name '*.cpp' -o -name '*.hpp' -o -name '*.h' -o -name '*.ipp' \) -not -path "src/magic/magic_enum.h" -exec clang-format-${CLANG_VERSION} -i {} +
+      run: find include src -type f \( -name '*.cpp' -o -name '*.hpp' -o -name '*.h' -o -name '*.ipp' \) -exec clang-format-${CLANG_VERSION} -i {} +
     - name: Check for differences
       id: assert
       run: |

.github/workflows/verify-generated-headers.yml

@@ -18,6 +18,10 @@ jobs:
             generator: bash ./hook/generate_sfcodes.sh
           - target: hook/tts.h
             generator: ./hook/generate_tts.sh
+          - target: hook/ls_flags.h
+            generator: ./hook/generate_lsflags.sh
+          - target: hook/tx_flags.h
+            generator: ./hook/generate_txflags.sh
     runs-on: ubuntu-24.04
     env:
       CLANG_VERSION: 18

.github/workflows/xahau-ga-macos.yml

@@ -107,6 +107,9 @@ jobs:
           compiler: apple-clang
           compiler_version: ${{ steps.detect-compiler.outputs.compiler_version }}
           stdlib: libcxx
+          # grpc 1.50.1 trips clang-19+ -Werror=missing-template-arg-list-after-template-kw
+          # on Apple Clang. Drop when grpc is bumped past the fix.
+          conan_deps_cxxflags: '{"grpc/*":["-Wno-missing-template-arg-list-after-template-kw"]}'
 
       - name: Build
         uses: ./.github/actions/xahau-ga-build

.github/workflows/xahau-ga-nix.yml

@@ -8,12 +8,6 @@ on:
     types: [opened, synchronize, reopened, labeled, unlabeled]
   schedule:
     - cron: '0 0 * * *'
-  workflow_dispatch:
-    inputs:
-      full_matrix:
-        description: "Force full matrix (6 configs)"
-        required: false
-        default: "false"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,37 +24,14 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - name: escape double quotes
-        id: escape
-        shell: bash
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          ESCAPED_PR_TITLE="${PR_TITLE//\"/\\\"}"
-          echo "title=${ESCAPED_PR_TITLE}" >> "$GITHUB_OUTPUT"
       - name: Generate build matrix
         id: set-matrix
         shell: python
-        env:
-          GH_TOKEN: ${{ github.token }}
         run: |
           import json
           import os
-          import urllib.request
 
-          # Full matrix with all 6 compiler configurations
-          # Each configuration includes all parameters needed by the build job
-          full_matrix = [
-              {
-                  "compiler_id": "gcc-11-libstdcxx",
-                  "compiler": "gcc",
-                  "cc": "gcc-11",
-                  "cxx": "g++-11",
-                  "compiler_version": 11,
-                  "stdlib": "default",
-                  "configuration": "Debug",
-                  "job_type": "build"
-              },
+          matrix = [
               {
                   "compiler_id": "gcc-13-libstdcxx",
                   "compiler": "gcc",
@@ -72,26 +43,26 @@ jobs:
                   "job_type": "build"
               },
               {
-                  "compiler_id": "gcc-13-libstdcxx",
-                  "compiler": "gcc",
-                  "cc": "gcc-13",
-                  "cxx": "g++-13",
-                  "gcov": "gcov-13",
-                  "compiler_version": 13,
-                  "stdlib": "default",
-                  "configuration": "Debug",
-                  "job_type": "coverage"
-              },
-              {
-                  "compiler_id": "clang-14-libstdcxx-gcc11",
+                  # Latest stable Clang for the most accurate source-based
+                  # coverage mapping (newer language features, fewer bugs in
+                  # llvm-cov region inference). Pulled from apt.llvm.org since
+                  # Ubuntu 24.04 default repos cap at clang-18.
+                  "compiler_id": "clang-20-libcxx",
                   "compiler": "clang",
-                  "cc": "clang-14",
-                  "cxx": "clang++-14",
-                  "compiler_version": 14,
-                  "stdlib": "libstdcxx",
-                  "clang_gcc_toolchain": 11,
+                  "cc": "clang-20",
+                  "cxx": "clang++-20",
+                  "compiler_version": 20,
+                  "stdlib": "libcxx",
                   "configuration": "Debug",
-                  "job_type": "build"
+                  "job_type": "coverage",
+                  "coverage_tool": "llvm",
+                  "coverage_format": "lcov",
+                  # grpc 1.50.1 uses `Foo::template Bar(...)` without an
+                  # angle-bracket arg list; clang-19+ promoted that to
+                  # -Werror. Drop when grpc is bumped past the fix.
+                  "conan_deps_cxxflags": {
+                      "grpc/*": ["-Wno-missing-template-arg-list-after-template-kw"]
+                  }
               },
               {
                   "compiler_id": "clang-16-libstdcxx-gcc13",
@@ -103,117 +74,8 @@ jobs:
                   "clang_gcc_toolchain": 13,
                   "configuration": "Debug",
                   "job_type": "build"
-              },
-              {
-                  "compiler_id": "clang-17-libcxx",
-                  "compiler": "clang",
-                  "cc": "clang-17",
-                  "cxx": "clang++-17",
-                  "compiler_version": 17,
-                  "stdlib": "libcxx",
-                  "configuration": "Debug",
-                  "job_type": "build"
-              },
-              {
-                  # Clang 18 - testing if it's faster than Clang 17 with libc++
-                  # Requires patching Conan v1 settings.yml to add version 18
-                  "compiler_id": "clang-18-libcxx",
-                  "compiler": "clang",
-                  "cc": "clang-18",
-                  "cxx": "clang++-18",
-                  "compiler_version": 18,
-                  "stdlib": "libcxx",
-                  "configuration": "Debug",
-                  "job_type": "build"
               }
           ]
-          
-          # Minimal matrix for PRs and feature branches
-          minimal_matrix = [
-              full_matrix[1],  # gcc-13 (middle-ground gcc)
-              full_matrix[2],  # gcc-13 coverage
-              full_matrix[3]   # clang-14 (mature, stable clang)
-          ]
-          
-          # Determine which matrix to use based on the target branch
-          ref = "${{ github.ref }}"
-          base_ref = "${{ github.base_ref }}"  # For PRs, this is the target branch
-          event_name = "${{ github.event_name }}"
-          pr_title = """${{ steps.escape.outputs.title }}"""
-          pr_labels = """${{ join(github.event.pull_request.labels.*.name, ',') }}"""
-          pr_head_sha = "${{ github.event.pull_request.head.sha }}"
-
-          # Get commit message - for PRs, fetch via API since head_commit.message is empty
-          if event_name == "pull_request" and pr_head_sha:
-              try:
-                  url = f"https://api.github.com/repos/${{ github.repository }}/commits/{pr_head_sha}"
-                  req = urllib.request.Request(url, headers={
-                      "Accept": "application/vnd.github.v3+json",
-                      "Authorization": f"Bearer {os.environ.get('GH_TOKEN', '')}"
-                  })
-                  with urllib.request.urlopen(req) as response:
-                      data = json.load(response)
-                      commit_message = data["commit"]["message"]
-              except Exception as e:
-                  print(f"Failed to fetch commit message: {e}")
-                  commit_message = ""
-          else:
-              commit_message = """${{ github.event.head_commit.message }}"""
-
-          # Debug logging
-          print(f"Event: {event_name}")
-          print(f"Ref: {ref}")
-          print(f"Base ref: {base_ref}")
-          print(f"PR head SHA: {pr_head_sha}")
-          print(f"PR title: {pr_title}")
-          print(f"PR labels: {pr_labels}")
-          print(f"Commit message: {commit_message}")
-          
-          # Manual trigger input to force full matrix.
-          manual_full = "${{ github.event.inputs.full_matrix || 'false' }}" == "true"
-
-          # Label/manual overrides, while preserving existing title/commit behavior.
-          force_full = (
-              manual_full
-              or "[ci-nix-full-matrix]" in commit_message
-              or "[ci-nix-full-matrix]" in pr_title
-              or ("ci-full-build" in pr_labels and "ci-nix-full-matrix" in pr_labels)
-          )
-          force_min = (
-              "ci-full-build" in pr_labels
-          )
-          print(f"Force full matrix: {force_full}")
-          print(f"Force min matrix: {force_min}")
-          
-          # Check if this is targeting a main branch
-          # For PRs: check base_ref (target branch)
-          # For pushes: check ref (current branch)
-          main_branches = ["refs/heads/dev", "refs/heads/release", "refs/heads/candidate"]
-          
-          if force_full:
-              # Override: always use full matrix if forced by manual input or label.
-              use_full = True
-          elif force_min:
-              # Override: always use minimal matrix if ci-full-build label is present.
-              use_full = False
-          elif event_name == "pull_request":
-              # For PRs, base_ref is just the branch name (e.g., "dev", not "refs/heads/dev")
-              # Check if the PR targets release or candidate (more critical branches)
-              use_full = base_ref in ["release", "candidate"]
-          else:
-              # For pushes, ref is the full reference (e.g., "refs/heads/dev")
-              use_full = ref in main_branches
-          
-          # Select the appropriate matrix
-          if use_full:
-              if force_full:
-                  print(f"Using FULL matrix (7 configs) - forced by [ci-nix-full-matrix] tag")
-              else:
-                  print(f"Using FULL matrix (7 configs) - targeting main branch")
-              matrix = full_matrix
-          else:
-              print(f"Using MINIMAL matrix (3 configs) - feature branch/PR")
-              matrix = minimal_matrix
 
           # Add runs_on based on job_type
           for entry in matrix:
@@ -257,9 +119,25 @@ jobs:
 
       - name: Install build dependencies
         run: |
+          # Bump apt's default 3 retries; papers over short upstream blips
+          # like the recurring ppa.launchpadcontent.net outages.
+          echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
           apt-get update
           apt-get install -y software-properties-common
           add-apt-repository ppa:ubuntu-toolchain-r/test -y
+
+          # apt.llvm.org for Clang versions newer than what Ubuntu 24.04 ships
+          # (24.04 default repos cap at clang-18). The bootstrap script adds
+          # the LLVM apt source for the requested version and runs apt-get update.
+          if [ "${{ matrix.compiler }}" = "clang" ] && [ "${{ matrix.compiler_version }}" -ge 19 ]; then
+            apt-get install -y wget gnupg lsb-release
+            wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+            chmod +x /tmp/llvm.sh
+            # `all` installs clang + libllvm + lldb + lld + the llvm-N package
+            # (which provides llvm-profdata-N / llvm-cov-N for coverage runs).
+            /tmp/llvm.sh ${{ matrix.compiler_version }} all
+          fi
+
           apt-get update
           apt-get install -y git python3 python-is-python3 pipx
           pipx ensurepath
@@ -332,10 +210,16 @@ jobs:
           pipx install "conan>=2.0,<3"
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
-          # Install gcovr for coverage jobs
+          # Install coverage tooling
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
-            pipx install "gcovr>=7,<9"
             apt-get install -y curl lcov
+            if [ "${{ matrix.coverage_tool }}" = "llvm" ]; then
+              # Native LLVM source-based coverage: llvm-profdata + llvm-cov.
+              # The clang-N package doesn't pull these in; the llvm-N package does.
+              apt-get install -y "llvm-${{ matrix.compiler_version }}"
+            else
+              pipx install "gcovr>=7,<9"
+            fi
           fi
 
       - name: Check environment
@@ -348,10 +232,15 @@ jobs:
           which ${{ matrix.cxx }} && ${{ matrix.cxx }} --version || echo "${{ matrix.cxx }} not found"
           which ccache && ccache --version || echo "ccache not found"
 
-          # Check gcovr for coverage jobs
+          # Check coverage tooling
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
-            which gcov && gcov --version || echo "gcov not found"
-            which gcovr && gcovr --version || echo "gcovr not found"
+            if [ "${{ matrix.coverage_tool }}" = "llvm" ]; then
+              which "llvm-profdata-${{ matrix.compiler_version }}" && "llvm-profdata-${{ matrix.compiler_version }}" --version || echo "llvm-profdata not found"
+              which "llvm-cov-${{ matrix.compiler_version }}" && "llvm-cov-${{ matrix.compiler_version }}" --version || echo "llvm-cov not found"
+            else
+              which gcov && gcov --version || echo "gcov not found"
+              which gcovr && gcovr --version || echo "gcovr not found"
+            fi
           fi
 
           echo "---- Full Environment ----"
@@ -378,6 +267,7 @@ jobs:
           cc: ${{ matrix.cc }}
           cxx: ${{ matrix.cxx }}
           stdlib: ${{ matrix.stdlib }}
+          conan_deps_cxxflags: ${{ matrix.conan_deps_cxxflags && toJson(matrix.conan_deps_cxxflags) || '{}' }}
           gha_cache_enabled: 'false' # Disable caching for self hosted runner
 
       - name: Build
@@ -410,8 +300,9 @@ jobs:
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
           stdlib: ${{ matrix.stdlib }}
-          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness
-          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
+          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness.
+          # Use *_FLAGS_DEBUG so the build action's stdlib flag (e.g. -stdlib=libc++) in CMAKE_CXX_FLAGS isn't clobbered.
+          cmake-args: '-Dcoverage=ON -Dcoverage_tool=${{ matrix.coverage_tool }} -Dcoverage_format=${{ matrix.coverage_format }} -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS_DEBUG="-g -O0" -DCMAKE_C_FLAGS_DEBUG="-g -O0"'
           cmake-target: 'coverage'
           ccache_max_size: '100G'
 
@@ -443,24 +334,41 @@ jobs:
       - name: Move coverage report
         if: matrix.job_type == 'coverage'
         shell: bash
+        env:
+          COVERAGE_FILE: ${{ matrix.coverage_tool == 'llvm' && 'coverage.lcov' || 'coverage.xml' }}
         run: |
-          mv "${{ env.build_dir }}/coverage.xml" ./
+          mv "${{ env.build_dir }}/${COVERAGE_FILE}" ./
+          echo "COVERAGE_FILE=${COVERAGE_FILE}" >> "$GITHUB_ENV"
 
       - name: Archive coverage report
         if: matrix.job_type == 'coverage'
         uses: actions/upload-artifact@v4
         with:
-          name: coverage.xml
-          path: coverage.xml
+          name: ${{ env.COVERAGE_FILE }}-${{ matrix.compiler_id }}
+          path: ${{ env.COVERAGE_FILE }}
           retention-days: 30
 
       - name: Upload coverage report
-        if: matrix.job_type == 'coverage'
+        if: matrix.job_type == 'coverage' && github.repository == 'Xahau/xahaud'
         uses: codecov/codecov-action@v5
         with:
-          files: coverage.xml
+          files: ${{ env.COVERAGE_FILE }}
+          flags: ${{ matrix.coverage_tool }}
           fail_ci_if_error: true
           disable_search: true
           verbose: true
           plugins: noop
           use_oidc: true
+
+      - name: Export server definitions
+        if: matrix.job_type == 'build' && matrix.compiler_id == 'gcc-13-libstdcxx'
+        run: |
+          ${{ env.build_dir }}/rippled --definitions | python3 -m json.tool > server_definitions.json
+
+      - name: Upload server definitions
+        if: matrix.job_type == 'build' && matrix.compiler_id == 'gcc-13-libstdcxx'
+        uses: actions/upload-artifact@v7
+        with:
+          name: server-definitions
+          path: server_definitions.json
+          archive: false

Builds/levelization/results/loops.txt

@@ -26,7 +26,7 @@ Loop: xrpld.app xrpld.nodestore
   xrpld.app > xrpld.nodestore
 
 Loop: xrpld.app xrpld.overlay
-  xrpld.overlay ~= xrpld.app
+  xrpld.overlay == xrpld.app
 
 Loop: xrpld.app xrpld.peerfinder
   xrpld.app > xrpld.peerfinder

Builds/levelization/results/ordering.txt

@@ -12,6 +12,7 @@ libxrpl.server > xrpl.basics
 libxrpl.server > xrpl.json
 libxrpl.server > xrpl.protocol
 libxrpl.server > xrpl.server
+test.app > test.shamap
 test.app > test.toplevel
 test.app > test.unit_test
 test.app > xrpl.basics
@@ -21,6 +22,7 @@ test.app > xrpld.ledger
 test.app > xrpld.nodestore
 test.app > xrpld.overlay
 test.app > xrpld.rpc
+test.app > xrpld.shamap
 test.app > xrpl.hook
 test.app > xrpl.json
 test.app > xrpl.protocol
@@ -32,6 +34,7 @@ test.basics > xrpld.perflog
 test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
+test.beast > test.unit_test
 test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpld.conditions
@@ -77,6 +80,11 @@ test.ledger > xrpld.app
 test.ledger > xrpld.core
 test.ledger > xrpld.ledger
 test.ledger > xrpl.protocol
+test.net > test.toplevel
+test.net > xrpl.basics
+test.net > xrpld.core
+test.net > xrpld.net
+test.net > xrpl.json
 test.nodestore > test.jtx
 test.nodestore > test.toplevel
 test.nodestore > test.unit_test
@@ -84,15 +92,18 @@ test.nodestore > xrpl.basics
 test.nodestore > xrpld.core
 test.nodestore > xrpld.nodestore
 test.nodestore > xrpld.unity
+test.nodestore > xrpl.protocol
 test.overlay > test.jtx
 test.overlay > test.toplevel
 test.overlay > test.unit_test
 test.overlay > xrpl.basics
 test.overlay > xrpld.app
+test.overlay > xrpld.core
 test.overlay > xrpld.overlay
 test.overlay > xrpld.peerfinder
 test.overlay > xrpld.shamap
 test.overlay > xrpl.protocol
+test.overlay > xrpl.resource
 test.peerfinder > test.beast
 test.peerfinder > test.unit_test
 test.peerfinder > xrpl.basics
@@ -116,8 +127,10 @@ test.rpc > xrpl.basics
 test.rpc > xrpld.app
 test.rpc > xrpld.core
 test.rpc > xrpld.net
+test.rpc > xrpld.nodestore
 test.rpc > xrpld.overlay
 test.rpc > xrpld.rpc
+test.rpc > xrpld.shamap
 test.rpc > xrpl.hook
 test.rpc > xrpl.json
 test.rpc > xrpl.protocol
@@ -183,6 +196,7 @@ xrpld.overlay > xrpl.basics
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
 xrpld.overlay > xrpld.perflog
+xrpld.overlay > xrpld.shamap
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource
@@ -198,6 +212,7 @@ xrpld.rpc > xrpld.core
 xrpld.rpc > xrpld.ledger
 xrpld.rpc > xrpld.nodestore
 xrpld.rpc > xrpld.shamap
+xrpld.rpc > xrpl.hook
 xrpld.rpc > xrpl.json
 xrpld.rpc > xrpl.protocol
 xrpld.rpc > xrpl.resource

CMakeLists.txt

@@ -122,6 +122,7 @@ endif()
 find_package(nudb REQUIRED)
 find_package(date REQUIRED)
 find_package(xxHash REQUIRED)
+find_package(magic_enum REQUIRED)
 
 include(deps/WasmEdge) 
   if(TARGET nudb::core)

build-core.sh

@@ -95,8 +95,16 @@ if [[ "$4" == "" ]]; then
   echo "Non GH, local building, no Action runner magic"
 else
   # GH Action, runner
-  cp /io/release-build/xahaud /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
-  cp /io/release-build/release.info /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4.releaseinfo
+    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "release" ]]; then
+        echo "building on the release branch... placing it in builds/candidate"
+        mkdir -p /data/builds/candidate
+        cp /io/release-build/xahaud /data/builds/candidate/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
+        cp /io/release-build/release.info /data/builds/candidate/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4.releaseinfo
+    else
+        echo "building non-release branch, placing it in builds root"
+        cp /io/release-build/xahaud /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
+        cp /io/release-build/release.info /data/builds/$(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4.releaseinfo
+    fi  
   echo "Published build to: http://build.xahau.tech/"
   echo $(date +%Y).$(date +%-m).$(date +%-d)-$(git rev-parse --abbrev-ref HEAD)+$4
 fi

build-full.sh

@@ -12,17 +12,16 @@ echo "-- GITHUB_REPOSITORY: $1"
 echo "-- GITHUB_SHA:        $2"
 echo "-- GITHUB_RUN_NUMBER: $4"
 
-umask 0000;
+umask 0000
 
 ####
 
-cd /io;
-mkdir -p src/certs;
-curl --silent -k https://raw.githubusercontent.com/RichardAH/rippled-release-builder/main/ca-bundle/certbundle.h -o src/certs/certbundle.h;
-if [ "`grep certbundle.h src/xrpld/net/detail/RegisterSSLCerts.cpp | wc -l`" -eq "0" ]
-then
-    cp src/xrpld/net/detail/RegisterSSLCerts.cpp src/xrpld/net/detail/RegisterSSLCerts.cpp.old
-    perl -i -pe "s/^{/{
+cd /io
+mkdir -p src/certs
+curl --silent -k https://raw.githubusercontent.com/RichardAH/rippled-release-builder/main/ca-bundle/certbundle.h -o src/certs/certbundle.h
+if [ "$(grep certbundle.h src/xrpld/net/detail/RegisterSSLCerts.cpp | wc -l)" -eq "0" ]; then
+  cp src/xrpld/net/detail/RegisterSSLCerts.cpp src/xrpld/net/detail/RegisterSSLCerts.cpp.old
+  perl -i -pe "s/^{/{
     #ifdef EMBEDDED_CA_BUNDLE
     BIO *cbio = BIO_new_mem_buf(ca_bundle.data(), ca_bundle.size());
     X509_STORE  *cts = SSL_CTX_get_cert_store(ctx.native_handle());
@@ -68,15 +67,14 @@ fi
 source /opt/rh/gcc-toolset-11/enable
 export PATH=/usr/local/bin:$PATH
 export CC='/usr/lib64/ccache/gcc' &&
-export CXX='/usr/lib64/ccache/g++' &&
-echo "-- Build Rippled --" &&
-pwd &&
+  export CXX='/usr/lib64/ccache/g++' &&
+  echo "-- Build Rippled --" &&
+  pwd &&
+  echo "MOVING TO [ build-core.sh ]"
 
-echo "MOVING TO [ build-core.sh ]";
-
-printenv > .env.temp;
-cat .env.temp | grep '=' | sed s/\\\(^[^=]\\+=\\\)/\\1\\\"/g|sed s/\$/\\\"/g > .env;
-rm .env.temp;
+printenv >.env.temp
+cat .env.temp | grep '=' | sed s/\\\(^[^=]\\+=\\\)/\\1\\\"/g | sed s/\$/\\\"/g >.env
+rm .env.temp
 
 echo "Persisting ENV:"
 cat .env

cfg/xahaud-example.cfg

@@ -166,10 +166,13 @@
 #       ws          Websockets
 #       wss         Secure Websockets
 #       peer        Peer Protocol
+#       pwa         On-ledger AppLoader documents (featurePWALoader), for a
+#                   reverse proxy only. Read "pwa ports" below first.
 #
 #       Restrictions:
 #
 #       Only one port may be configured to support the peer protocol.
+#       The pwa protocol cannot be combined with any other protocol.
 #       A port cannot have websocket and non websocket protocols at the
 #       same time. It is possible have both Websockets and Secure Websockets
 #       together in one port.
@@ -264,6 +267,119 @@
 #       "secure_gateway" connections, then they will be treated as
 #       "admin" addresses.
 #
+#   pwa ports
+#
+#       A port whose protocol is "pwa" serves accounts' on-ledger AppLoader
+#       documents (featurePWALoader) as HTML. This makes the node a web host
+#       for third-party content: anyone can publish a loader to an account
+#       for about a drop per byte, and nothing in protocol takes one down.
+#       Hosting, and a hosting provider's obligations, are yours.
+#
+#       One host per account, on a zone used for nothing else:
+#
+#           https://pwa<account-index>.<domain>/<r-address>
+#           https://<domain>/<r-address>          301 to the above
+#           https://<custom host>/                see custom_domains
+#
+#       The first label of the Host header is "pwa" followed by the decimal
+#       AccountIndex of the account (an account created before AccountIndex
+#       existed has no host); the rest must be one of the port's "domain"
+#       values; the path must be that account's exact r-address. One
+#       trailing slash and a query string are ignored; anything else is
+#       404. The bare zone never serves a document (every page would share
+#       one origin): it redirects, keeping :port and query.
+#       Never set cookies at or above the zone and never serve your own
+#       site from it. Wildcard DNS and a wildcard certificate cover it.
+#
+#       Rules enforced at startup and on every request:
+#
+#       - "pwa" is the port's only protocol; no admin, user/password or
+#         ssl_* keys (terminate TLS at the proxy).
+#       - "domain" is required: the zone(s), comma-separated. The proxy must
+#         forward the Host header unchanged.
+#       - "secure_gateway" is required and may not cover every address.
+#         Every request must come from it carrying X-Forwarded-For, whose
+#         RIGHTMOST entry (the one the proxy wrote) is the client. The
+#         "Forwarded" header is ignored.
+#       - Clients are metered per IPv4 address, per IPv6 /64; a miss costs
+#         what a hit does; over-use is answered 503 until it decays.
+#       - GET and HEAD only; every response closes the connection; only
+#         validated state is served, with an ETag (304 on If-None-Match).
+#         X-NetworkID, X-LedgerSeq, X-LedgerHash and X-PWASeq name the
+#         validated ledger and AppLoaderSequence the document came from, so
+#         a client (a browser extension, say) can vet it against a second
+#         node with the pwa_validate RPC (account, hash of the bytes, host).
+#       - Lookups run on at most two job queue threads, below client RPC;
+#         beyond a bounded backlog they are refused with 503. Put a cache in
+#         front (the ETag makes revalidation cheap).
+#       - The admin RPC "pwa_info" reports requests by outcome and bytes
+#         served; "reset": true zeroes them, "flush_dns": true drops the
+#         custom domain cache (CLI: xahaud pwa_info [reset] [flush_dns]).
+#
+#       Example (also add port_pwa to the [server] list):
+#
+#           [port_pwa]
+#           port = 8088
+#           ip = 127.0.0.1
+#           protocol = pwa
+#           secure_gateway = 127.0.0.1
+#           domain = pwapp.example
+#
+#       with nginx in front, TLS terminated there, Host passed through:
+#
+#           server {
+#               listen 443 ssl;
+#               server_name pwapp.example ~^pwa[0-9]+\.pwapp\.example$;
+#               ssl_certificate     /etc/ssl/wildcard.pwapp.example.pem;
+#               ssl_certificate_key /etc/ssl/wildcard.pwapp.example.key;
+#               location / {
+#                   proxy_pass http://127.0.0.1:8088;
+#                   proxy_set_header Host $host;
+#                   proxy_set_header X-Forwarded-For $remote_addr;
+#               }
+#           }
+#
+#   custom_domains = 0 | 1
+#
+#       Default 0. With 1, a request whose Host is outside every zone is
+#       served as the account named by DNS, so a domain owner can point
+#       their own name at your proxy:
+#
+#           app.example.org.             CNAME  pwa-proxy.your.example.
+#           _xahau-pwa.app.example.org.  TXT    "rAbC..."
+#
+#       The record lives on the _xahau-pwa label beneath the host because
+#       the host is usually a CNAME to your proxy. Exactly one address must
+#       be present there (other TXT strings are ignored; two addresses count
+#       as none). The named account must consent: its Domain field must
+#       equal the host or a parent of it (ignoring case), else 503. Lists
+#       apply as at the account's own host; only the root path is a
+#       document. No usable record is 404 (cached 15 minutes), a resolver
+#       failure 503 (cached 60 s), a record is cached for its TTL (clamped
+#       to 60..3600 s). Lookups run on their own job queue threads, at most
+#       four at a time and one per host; a request that misses the cache is
+#       answered 429 with Retry-After and a refreshing page rather than
+#       waiting, so a flood of Host headers cannot tie up the node. The
+#       admin RPC pwa_info with "flush_dns": true drops the cache. Your
+#       proxy must accept, and hold certificates for, the hosts you will
+#       serve (e.g. Caddy on-demand TLS); xahaud only sees the Host header.
+#
+#   resolver = <IPv4 address>[:port]
+#
+#       The recursive resolver for custom_domains; default is the system
+#       resolver. xahaud does not validate DNSSEC, so prefer a validating
+#       resolver on the same host.
+#
+#       Documents are served with "Content-Security-Policy: sandbox
+#       allow-scripts ...": an opaque origin that cannot read anything from
+#       the node but can still send requests anywhere, including the
+#       visitor's own machine, so keep admin ports behind credentials.
+#
+#       [pwa_allowlist] and [pwa_blocklist], one r-address per line, apply to
+#       every pwa port: if the allowlist is non-empty only those accounts are
+#       served; blocklisted accounts are never served (403), whatever the
+#       allowlist says. An account on both is a startup error.
+#
 #   ssl_key = <filename>
 #   ssl_cert = <filename>
 #   ssl_chain = <filename>
@@ -448,6 +564,30 @@
 #
 #
 #
+# [udp_highway]
+#
+#   0 or 1.
+#
+#   0: Disable the Xahau UDP Superhighway (XUSH). [default]
+#   1: Enable the Xahau UDP Superhighway (XUSH).
+#
+#   The UDP Superhighway is a best-effort transport that runs alongside the
+#   peer protocol. When it is enabled the server also listens for UDP
+#   datagrams on its peer port number, and every transaction it relays to its
+#   peers is also sent, over UDP, to a small random set of other servers that
+#   have the highway enabled. It never replaces the peer protocol: anything
+#   sent over the highway is also relayed normally.
+#
+#   To receive highway traffic, inbound UDP must be allowed to the peer port
+#   (in addition to inbound TCP).
+#
+#   A server that keeps its address private (peer_private = 1, or any server
+#   configured as a validator) only exchanges highway traffic with the peers
+#   listed in [ips_fixed], and never advertises highway endpoints. Fixed peers
+#   are never advertised to other servers.
+#
+#
+#
 # [peers_max]
 #
 #   The largest number of desired peer connections (incoming or outgoing).
@@ -494,7 +634,7 @@
 #
 #   Configure the maximum number of transactions to have in the job queue
 #
-#   Must be a number between 100 and 1000, defaults to 250
+#   Must be a number between 100 and 1000, defaults to 1000
 #
 #
 # [overlay]
@@ -593,7 +733,7 @@
 #       reaches or exceeds this number. After that the limit may still
 #       change, but will stay above the target. If consensus is not
 #       healthy, the limit will be clamped to this value or lower.
-#       Default: 50.
+#       Default: 1000.
 #
 #   maximum_txn_in_ledger = <number>
 #
@@ -674,6 +814,38 @@
 #
 #
 #
+# [early_manifest_sync]
+#
+#   Controls whether, while acquiring its first ledger, the server fetches and
+#   reads the on-ledger validator manifests ahead of the rest of that ledger's
+#   state. Doing so lets it resolve validators' current signing keys, including
+#   rotations and revocations published on-ledger, within seconds of starting
+#   a sync rather than once the whole state has arrived.
+#
+#   The manifests read are those of the master keys on the server's own
+#   validator lists, fetched by key, and as many more from the on-ledger
+#   manifest directory as the manifest cache keeps.
+#
+#   The cost is a dozen or so request/response rounds with peers. With more
+#   than one peer serving the ledger these overlap with fetching the rest of
+#   its state; with only one, they come first.
+#
+#   It also lets a server that starts with nothing but the master keys of its
+#   validators and a few peers find its way. Until it has validated a ledger,
+#   while it holds manifests for too few of its validators to make a quorum,
+#   it reads them from up to three of the ledgers its peers report, the most
+#   widely reported first, every 15 seconds. Every manifest read is checked
+#   against its master key's signature, so a ledger reported by a peer that
+#   is not on the network can leave something out but cannot add anything.
+#
+#   Legal values are:
+#     1 - Fetch the manifests first, and from peers' ledgers if needed
+#     0 - Fetch the ledger's state in the usual order, and read the manifests
+#         from it once it is complete
+#
+#   The default is 1. A ledger without on-ledger manifests costs only the few
+#   nodes on the paths to where their directory and objects would be.
+#
 #
 #
 # [ledger_history]
@@ -1416,6 +1588,19 @@
 #      contains breaking changes that require a new API version number.
 #      They are not ready for public consumption.
 #
+# [hook_validate_rpc]
+#
+#   0 or 1.
+#
+#   0: Disable the hook_validate RPC method
+#   1: Enable the hook_validate RPC method, which runs the Hook guard
+#      checker and WASM VM validation against caller-supplied code using
+#      the current open ledger's rules.
+#
+#   The default is 0 on networked nodes and 1 in standalone mode (-a).
+#   When enabled the method is available to non-admin (user role) clients,
+#   so consider the CPU cost before enabling it on a public-facing node.
+#
 #-------------------------------------------------------------------------------
 #
 # 10. Example Settings

cfg/xahaud-standalone.cfg

@@ -146,11 +146,8 @@ D686F2538F410C9D0D856788E98E3579595DAF7B38D38887F81ECAC934B06040 HooksUpdate1
 3C43D9A973AA4443EF3FC38E42DD306160FBFFDAB901CD8BAA15D09F2597EB87 NonFungibleTokensV1
 0285B7E5E08E1A8E4C15636F0591D87F73CB6A7B6452A932AD72BBC8E5D1CBE3 fixNFTokenDirV1
 36799EA497B1369B170805C078AEFE6188345F9B3E324C21E9CA3FF574E3C3D6 fixNFTokenNegOffer
-4C499D17719BB365B69010A436B64FD1A82AAB199FC1CEB06962EBD01059FB09 fixXahauV1
-215181D23BF5C173314B5FDB9C872C92DE6CC918483727DE037C0C13E7E6EE9D fixXahauV2
 0D8BF22FF7570D58598D1EF19EBB6E142AD46E59A223FD3816262FBB69345BEA Remit
 7CA0426E7F411D39BB014E57CD9E08F61DE1750F0D41FCD428D9FB80BB7596B0 ZeroB2M
 4B8466415FAB32FFA89D9DCBE166A42340115771DF611A7160F8D7439C87ECD8 fixNSDelete
 EDB4EE4C524E16BDD91D9A529332DED08DCAAA51CC6DC897ACFA1A0ED131C5B6 fix240819
 8063140E9260799D6716756B891CEC3E7006C4E4F277AB84670663A88F94B9C4 fixPageCap
-88693F108C3CD8A967F3F4253A32DEF5E35F9406ACD2A11B88B11D90865763A9 fix240911

cmake/CodeCoverage.cmake

@@ -95,6 +95,9 @@
 #     - replace both functions setup_target_for_coverage_gcovr_* with a single setup_target_for_coverage_gcovr
 #     - add support for all gcovr output formats
 #
+# 2024-04-03, Bronek Kozicki
+#     - add support for output formats: jacoco, clover, lcov
+#
 # USAGE:
 #
 # 1. Copy this file into your cmake modules path.
@@ -256,10 +259,10 @@ endif()
 #     BASE_DIRECTORY "../"                   # Base directory for report
 #                                            #  (defaults to PROJECT_SOURCE_DIR)
 #     FORMAT "cobertura"                     # Output format, one of:
-#                                            #  xml cobertura sonarqube json-summary
-#                                            #  json-details coveralls csv txt
-#                                            #  html-single html-nested html-details
-#                                            #  (xml is an alias to cobertura;
+#                                            #  xml cobertura sonarqube jacoco clover
+#                                            #  json-summary json-details coveralls csv
+#                                            #  txt html-single html-nested html-details
+#                                            #  lcov (xml is an alias to cobertura;
 #                                            #  if no format is set, defaults to xml)
 #     EXCLUDE "src/dir1/*" "src/dir2/*"      # Patterns to exclude (can be relative
 #                                            #  to BASE_DIRECTORY, with CMake 3.4+)
@@ -308,6 +311,8 @@ function(setup_target_for_coverage_gcovr)
             set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.txt)
         elseif(Coverage_FORMAT STREQUAL "csv")
             set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.csv)
+        elseif(Coverage_FORMAT STREQUAL "lcov")
+            set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.lcov)
         else()
             set(GCOVR_OUTPUT_FILE ${Coverage_NAME}.xml)
         endif()
@@ -320,6 +325,14 @@ function(setup_target_for_coverage_gcovr)
         set(Coverage_FORMAT cobertura) # overwrite xml
     elseif(Coverage_FORMAT STREQUAL "sonarqube")
         list(APPEND GCOVR_ADDITIONAL_ARGS --sonarqube "${GCOVR_OUTPUT_FILE}" )
+    elseif(Coverage_FORMAT STREQUAL "jacoco")
+        list(APPEND GCOVR_ADDITIONAL_ARGS --jacoco "${GCOVR_OUTPUT_FILE}" )
+        list(APPEND GCOVR_ADDITIONAL_ARGS --jacoco-pretty )
+    elseif(Coverage_FORMAT STREQUAL "clover")
+        list(APPEND GCOVR_ADDITIONAL_ARGS --clover "${GCOVR_OUTPUT_FILE}" )
+        list(APPEND GCOVR_ADDITIONAL_ARGS --clover-pretty )
+    elseif(Coverage_FORMAT STREQUAL "lcov")
+        list(APPEND GCOVR_ADDITIONAL_ARGS --lcov "${GCOVR_OUTPUT_FILE}" )
     elseif(Coverage_FORMAT STREQUAL "json-summary")
         list(APPEND GCOVR_ADDITIONAL_ARGS --json-summary "${GCOVR_OUTPUT_FILE}" )
         list(APPEND GCOVR_ADDITIONAL_ARGS --json-summary-pretty)
@@ -380,6 +393,7 @@ function(setup_target_for_coverage_gcovr)
         ${GCOVR_PATH}
         --gcov-executable ${GCOV_TOOL}
         --gcov-ignore-parse-errors=negative_hits.warn_once_per_file
+        --gcov-ignore-parse-errors=suspicious_hits.warn_once_per_file
         -r ${BASEDIR}
         ${GCOVR_ADDITIONAL_ARGS}
         ${GCOVR_EXCLUDE_ARGS}

cmake/CodeCoverageLLVM.cmake

@@ -0,0 +1,156 @@
+#[===================================================================[
+  Native LLVM source-based code coverage helper.
+
+  Drives the -fprofile-instr-generate / -fcoverage-mapping pipeline:
+    1. Run instrumented binary with LLVM_PROFILE_FILE=...%m-%p.profraw
+    2. llvm-profdata merge -sparse  -> coverage.profdata
+    3. llvm-cov export/show/report  -> final report
+
+  Output filename per coverage_format:
+    lcov              -> coverage.lcov
+    json              -> coverage.json
+    txt | text        -> coverage.txt
+    html | html-details -> <NAME>/index.html
+#]===================================================================]
+
+include(CMakeParseArguments)
+
+# Locate llvm-profdata / llvm-cov, preferring versioned variants matching the
+# Clang we're building with so we don't accidentally pair clang-20 with
+# llvm-cov-14 (profile format mismatch -> hard failure).
+function(_find_llvm_cov_tools)
+  if(LLVM_PROFDATA_PATH AND LLVM_COV_PATH)
+    return()
+  endif()
+
+  string(REGEX MATCH "^[0-9]+" _major "${CMAKE_CXX_COMPILER_VERSION}")
+
+  set(_pd_names llvm-profdata)
+  set(_cov_names llvm-cov)
+  if(_major)
+    list(PREPEND _pd_names "llvm-profdata-${_major}")
+    list(PREPEND _cov_names "llvm-cov-${_major}")
+  endif()
+
+  # Only delegate to xcrun when the *compiler* is AppleClang. On macOS with
+  # Homebrew/system clang-N, xcrun would resolve to Xcode's llvm tools which
+  # could be a different version - exactly the mismatch we want to avoid.
+  if(APPLE AND CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
+    execute_process(COMMAND xcrun -f llvm-profdata
+      OUTPUT_VARIABLE _pd_xcrun OUTPUT_STRIP_TRAILING_WHITESPACE
+      ERROR_QUIET RESULT_VARIABLE _pd_rc)
+    if(_pd_rc EQUAL 0 AND _pd_xcrun)
+      set(LLVM_PROFDATA_PATH "${_pd_xcrun}" CACHE FILEPATH "llvm-profdata" FORCE)
+    endif()
+    execute_process(COMMAND xcrun -f llvm-cov
+      OUTPUT_VARIABLE _cov_xcrun OUTPUT_STRIP_TRAILING_WHITESPACE
+      ERROR_QUIET RESULT_VARIABLE _cov_rc)
+    if(_cov_rc EQUAL 0 AND _cov_xcrun)
+      set(LLVM_COV_PATH "${_cov_xcrun}" CACHE FILEPATH "llvm-cov" FORCE)
+    endif()
+  endif()
+
+  if(NOT LLVM_PROFDATA_PATH)
+    find_program(LLVM_PROFDATA_PATH NAMES ${_pd_names})
+  endif()
+  if(NOT LLVM_COV_PATH)
+    find_program(LLVM_COV_PATH NAMES ${_cov_names})
+  endif()
+endfunction()
+
+function(setup_target_for_coverage_llvm)
+  set(oneValueArgs NAME FORMAT)
+  set(multiValueArgs EXCLUDE EXECUTABLE EXECUTABLE_ARGS DEPENDENCIES)
+  cmake_parse_arguments(Cov "" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
+
+  _find_llvm_cov_tools()
+  if(NOT LLVM_PROFDATA_PATH)
+    message(FATAL_ERROR "llvm-profdata not found (needed for coverage_tool=llvm)")
+  endif()
+  if(NOT LLVM_COV_PATH)
+    message(FATAL_ERROR "llvm-cov not found (needed for coverage_tool=llvm)")
+  endif()
+
+  if(NOT Cov_FORMAT)
+    set(Cov_FORMAT lcov)
+  endif()
+
+  set(_profraw_dir "${PROJECT_BINARY_DIR}/${Cov_NAME}-profraw")
+  set(_profdata    "${PROJECT_BINARY_DIR}/${Cov_NAME}.profdata")
+
+  # Resolve binary path: accept either an absolute path or a bare target name
+  # (resolved against PROJECT_BINARY_DIR). Splice the resolved path back into
+  # Cov_EXECUTABLE so the run command invokes it via absolute path - bare
+  # names aren't on PATH and the build dir isn't `.` either.
+  list(GET Cov_EXECUTABLE 0 _exec_name)
+  if(IS_ABSOLUTE "${_exec_name}")
+    set(_binary "${_exec_name}")
+  else()
+    set(_binary "${PROJECT_BINARY_DIR}/${_exec_name}")
+    list(REMOVE_AT Cov_EXECUTABLE 0)
+    list(PREPEND Cov_EXECUTABLE "${_binary}")
+  endif()
+
+  # llvm-cov takes a single -ignore-filename-regex; OR our excludes together.
+  set(_ignore_regex "")
+  foreach(EXC IN LISTS Cov_EXCLUDE)
+    if(_ignore_regex)
+      string(APPEND _ignore_regex "|")
+    endif()
+    string(APPEND _ignore_regex "${EXC}")
+  endforeach()
+  set(_filter "")
+  if(_ignore_regex)
+    set(_filter "-ignore-filename-regex='${_ignore_regex}'")
+  endif()
+
+  # Pick llvm-cov subcommand + output file for the requested format. Each
+  # branch builds a single shell command string that we'll hand to bash -c.
+  if(Cov_FORMAT STREQUAL "lcov")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.lcov")
+    set(_report_sh "${LLVM_COV_PATH} export -instr-profile='${_profdata}' -format=lcov ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "json")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.json")
+    set(_report_sh "${LLVM_COV_PATH} export -instr-profile='${_profdata}' -format=text ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "txt" OR Cov_FORMAT STREQUAL "text")
+    set(_output "${PROJECT_BINARY_DIR}/coverage.txt")
+    set(_report_sh "${LLVM_COV_PATH} report -instr-profile='${_profdata}' ${_filter} '${_binary}' > '${_output}'")
+  elseif(Cov_FORMAT STREQUAL "html" OR Cov_FORMAT STREQUAL "html-details")
+    set(_output "${PROJECT_BINARY_DIR}/${Cov_NAME}/index.html")
+    set(_report_sh "${LLVM_COV_PATH} show -instr-profile='${_profdata}' -format=html -output-dir='${PROJECT_BINARY_DIR}/${Cov_NAME}' ${_filter} '${_binary}'")
+  else()
+    message(FATAL_ERROR "coverage_tool=llvm: unsupported coverage_format '${Cov_FORMAT}' (use lcov|json|txt|html)")
+  endif()
+
+  set(_merge_sh "${LLVM_PROFDATA_PATH} merge -sparse -o '${_profdata}' '${_profraw_dir}'/*.profraw")
+
+  if(CODE_COVERAGE_VERBOSE)
+    message(STATUS "[coverage:llvm] binary:   ${_binary}")
+    message(STATUS "[coverage:llvm] profraw:  ${_profraw_dir}")
+    message(STATUS "[coverage:llvm] profdata: ${_profdata}")
+    message(STATUS "[coverage:llvm] format:   ${Cov_FORMAT}")
+    message(STATUS "[coverage:llvm] output:   ${_output}")
+    if(_ignore_regex)
+      message(STATUS "[coverage:llvm] ignore:   ${_ignore_regex}")
+    endif()
+    message(STATUS "[coverage:llvm] merge:    ${_merge_sh}")
+    message(STATUS "[coverage:llvm] report:   ${_report_sh}")
+  endif()
+
+  # %m: hash of the binary, %p: pid. Wipe the dir up front so stale profraw
+  # files can't leak into a fresh merge.
+  add_custom_target(${Cov_NAME}
+    COMMAND ${CMAKE_COMMAND} -E rm -rf "${_profraw_dir}"
+    COMMAND ${CMAKE_COMMAND} -E make_directory "${_profraw_dir}"
+    COMMAND ${CMAKE_COMMAND} -E env
+        "LLVM_PROFILE_FILE=${_profraw_dir}/rippled-%m-%p.profraw"
+        ${Cov_EXECUTABLE} ${Cov_EXECUTABLE_ARGS}
+    COMMAND bash -c "${_merge_sh}"
+    COMMAND bash -c "${_report_sh}"
+    BYPRODUCTS ${_output}
+    WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+    DEPENDS ${Cov_DEPENDENCIES}
+    VERBATIM
+    COMMENT "Running llvm-cov (${Cov_FORMAT}) -> ${_output}"
+  )
+endfunction()

cmake/RippledCore.cmake

@@ -54,6 +54,7 @@ add_library(xrpl.imports.main INTERFACE)
 target_link_libraries(xrpl.imports.main
   INTERFACE
     LibArchive::LibArchive
+    magic_enum::magic_enum
     OpenSSL::Crypto
     Ripple::boost
     wasmedge::wasmedge

cmake/RippledCov.cmake

@@ -11,6 +11,21 @@ if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
   return()
 endif()
 
+if(coverage_tool STREQUAL "llvm")
+  include(CodeCoverageLLVM)
+
+  setup_target_for_coverage_llvm(
+    NAME coverage
+    FORMAT ${coverage_format}
+    EXECUTABLE rippled
+    EXECUTABLE_ARGS --unittest$<$<BOOL:${coverage_test}>:=${coverage_test}> --unittest-jobs ${coverage_test_parallelism} --quiet --unittest-log
+    EXCLUDE "src/test" "include/xrpl/beast/test" "include/xrpl/beast/unit_test" "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"
+    DEPENDENCIES rippled
+  )
+  return()
+endif()
+
+# coverage_tool == "gcov" (default): existing gcovr-driven pipeline.
 include(CodeCoverage)
 
 # The instructions for these commands come from the `CodeCoverage` module,

cmake/RippledInterface.cmake

@@ -28,15 +28,17 @@ target_compile_options (opts
     $<$<AND:$<BOOL:${is_gcc}>,$<COMPILE_LANGUAGE:CXX>>:-Wsuggest-override>
     $<$<BOOL:${is_gcc}>:-Wno-maybe-uninitialized>
     $<$<BOOL:${perf}>:-fno-omit-frame-pointer>
-    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>>:-g --coverage -fprofile-abs-path>
-    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage -fprofile-abs-path>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},llvm>>:-g -fprofile-instr-generate -fcoverage-mapping>
     $<$<BOOL:${profile}>:-pg>
     $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${profile}>>:-p>)
 
 target_link_libraries (opts
   INTERFACE
-    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>>:-g --coverage -fprofile-abs-path>
-    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage -fprofile-abs-path>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},gcov>>:-g --coverage>
+    $<$<AND:$<BOOL:${is_clang}>,$<BOOL:${coverage}>,$<STREQUAL:${coverage_tool},llvm>>:-g -fprofile-instr-generate -fcoverage-mapping>
     $<$<BOOL:${profile}>:-pg>
     $<$<AND:$<BOOL:${is_gcc}>,$<BOOL:${profile}>>:-p>)
 
@@ -95,6 +97,7 @@ target_link_libraries (ripple_syslibs
       crypt32
     >
     $<$<NOT:$<BOOL:${MSVC}>>:dl>
+    $<$<NOT:$<BOOL:${MSVC}>>:resolv>
     $<$<NOT:$<OR:$<BOOL:${MSVC}>,$<BOOL:${APPLE}>>>:rt>)
 
 if (NOT MSVC)

cmake/RippledSettings.cmake

@@ -29,13 +29,25 @@ if(is_gcc OR is_clang)
     "Unit tests parallelism for the purpose of coverage report.")
   set(coverage_format "html-details" CACHE STRING
     "Output format of the coverage report.")
+  set(coverage_tool "gcov" CACHE STRING
+    "Coverage instrumentation tool: 'gcov' (default, gcc/clang via --coverage + gcovr) or 'llvm' (clang only, native source-based coverage via -fprofile-instr-generate).")
+  set_property(CACHE coverage_tool PROPERTY STRINGS "gcov" "llvm")
+  if(NOT coverage_tool MATCHES "^(gcov|llvm)$")
+    message(FATAL_ERROR "coverage_tool must be 'gcov' or 'llvm', got '${coverage_tool}'")
+  endif()
   set(coverage_extra_args "" CACHE STRING
-    "Additional arguments to pass to gcovr.")
+    "Additional arguments to pass to gcovr (gcov tool only).")
   set(coverage_test "" CACHE STRING
     "On gcc & clang, the specific unit test(s) to run for coverage. Default is all tests.")
   if(coverage_test AND NOT coverage)
     set(coverage ON CACHE BOOL "gcc/clang only" FORCE)
   endif()
+  # Validate after coverage_test may have flipped coverage on, otherwise
+  # `-Dcoverage_tool=llvm -Dcoverage_test=Foo` on gcc would silently slip
+  # past the Clang guard and produce a broken instrumentation combo.
+  if(coverage AND coverage_tool STREQUAL "llvm" AND NOT is_clang)
+    message(FATAL_ERROR "coverage_tool=llvm requires Clang (got ${CMAKE_CXX_COMPILER_ID})")
+  endif()
   option(wextra "compile with extra gcc/clang warnings enabled" ON)
 else()
   set(profile OFF CACHE BOOL "gcc/clang only" FORCE)
@@ -112,7 +124,7 @@ option(beast_no_unit_test_inline
   "Prevents unit test definitions from being inserted into global table"
   OFF)
 option(single_io_service_thread
-  "Restricts the number of threads calling io_service::run to one. \
+  "Restricts the number of threads calling io_context::run to one. \
   This can be useful when debugging."
   OFF)
 option(boost_show_deprecated

cmake/deps/Boost.cmake

@@ -32,9 +32,9 @@ target_link_libraries(ripple_boost
     Boost::date_time
     Boost::filesystem
     Boost::json
+    Boost::process
     Boost::program_options
     Boost::regex
-    Boost::system
     Boost::iostreams
     Boost::thread)
 if(Boost_COMPILER)

conanfile.py

@@ -2,157 +2,160 @@ from conan import ConanFile
 from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 import re
 
-class Xrpl(ConanFile):
-    name = 'xrpl'
 
-    license = 'ISC'
-    author = 'John Freeman <[email protected]>'
-    url = 'https://github.com/xrplf/rippled'
-    description = 'The XRP Ledger'
-    settings = 'os', 'compiler', 'build_type', 'arch'
+class Xrpl(ConanFile):
+    name = "xrpl"
+
+    license = "ISC"
+    author = "John Freeman <[email protected]>"
+    url = "https://github.com/xrplf/rippled"
+    description = "The XRP Ledger"
+    settings = "os", "compiler", "build_type", "arch"
     options = {
-        'assertions': [True, False],
-        'coverage': [True, False],
-        'fPIC': [True, False],
-        'jemalloc': [True, False],
-        'rocksdb': [True, False],
-        'shared': [True, False],
-        'static': [True, False],
-        'tests': [True, False],
-        'unity': [True, False],
-        'xrpld': [True, False],
-        'with_wasmedge': [True, False],
-        'tool_requires_b2': [True, False],
+        "assertions": [True, False],
+        "coverage": [True, False],
+        "fPIC": [True, False],
+        "jemalloc": [True, False],
+        "rocksdb": [True, False],
+        "shared": [True, False],
+        "static": [True, False],
+        "tests": [True, False],
+        "unity": [True, False],
+        "xrpld": [True, False],
+        "with_wasmedge": [True, False],
+        "tool_requires_b2": [True, False],
     }
 
     requires = [
-        'date/3.0.3',
-        'grpc/1.50.1',
-        'libarchive/3.7.6',
-        'nudb/2.0.8',
-        'openssl/3.6.0',
-        'soci/4.0.3@xahaud/stable',
-        'xxhash/0.8.2',
-        'zlib/1.3.1',
+        "date/3.0.3",
+        "grpc/1.50.1",
+        "libarchive/3.7.6",
+        "magic_enum/0.9.5",
+        "nudb/2.0.9",
+        "openssl/3.6.0",
+        "soci/4.0.3@xahaud/stable",
+        "xxhash/0.8.2",
+        "zlib/1.3.1",
     ]
 
     tool_requires = [
-        'protobuf/3.21.12',
+        "protobuf/3.21.12",
     ]
 
     default_options = {
-        'assertions': False,
-        'coverage': False,
-        'fPIC': True,
-        'jemalloc': False,
-        'rocksdb': True,
-        'shared': False,
-        'static': True,
-        'tests': False,
-        'unity': False,
-        'xrpld': False,
-        'with_wasmedge': True,
-        'tool_requires_b2': False,
-
-        'date/*:header_only': False,
-        'grpc/*:shared': False,
-        'grpc/*:secure': True,
-        'libarchive/*:shared': False,
-        'libarchive/*:with_acl': False,
-        'libarchive/*:with_bzip2': False,
-        'libarchive/*:with_cng': False,
-        'libarchive/*:with_expat': False,
-        'libarchive/*:with_iconv': False,
-        'libarchive/*:with_libxml2': False,
-        'libarchive/*:with_lz4': True,
-        'libarchive/*:with_lzma': False,
-        'libarchive/*:with_lzo': False,
-        'libarchive/*:with_nettle': False,
-        'libarchive/*:with_openssl': False,
-        'libarchive/*:with_pcreposix': False,
-        'libarchive/*:with_xattr': False,
-        'libarchive/*:with_zlib': False,
-        'lz4/*:shared': False,
-        'openssl/*:shared': False,
-        'protobuf/*:shared': False,
-        'protobuf/*:with_zlib': True,
-        'rocksdb/*:enable_sse': False,
-        'rocksdb/*:lite': False,
-        'rocksdb/*:shared': False,
-        'rocksdb/*:use_rtti': True,
-        'rocksdb/*:with_jemalloc': False,
-        'rocksdb/*:with_lz4': True,
-        'rocksdb/*:with_snappy': True,
-        'snappy/*:shared': False,
-        'soci/*:shared': False,
-        'soci/*:with_sqlite3': True,
-        'soci/*:with_boost': True,
-        'xxhash/*:shared': False,
+        "assertions": False,
+        "coverage": False,
+        "fPIC": True,
+        "jemalloc": False,
+        "rocksdb": True,
+        "shared": False,
+        "static": True,
+        "tests": False,
+        "unity": False,
+        "xrpld": False,
+        "with_wasmedge": True,
+        "tool_requires_b2": False,
+        "boost/*:without_cobalt": True,
+        "date/*:header_only": False,
+        "grpc/*:shared": False,
+        "grpc/*:secure": True,
+        "libarchive/*:shared": False,
+        "libarchive/*:with_acl": False,
+        "libarchive/*:with_bzip2": False,
+        "libarchive/*:with_cng": False,
+        "libarchive/*:with_expat": False,
+        "libarchive/*:with_iconv": False,
+        "libarchive/*:with_libxml2": False,
+        "libarchive/*:with_lz4": True,
+        "libarchive/*:with_lzma": False,
+        "libarchive/*:with_lzo": False,
+        "libarchive/*:with_nettle": False,
+        "libarchive/*:with_openssl": False,
+        "libarchive/*:with_pcreposix": False,
+        "libarchive/*:with_xattr": False,
+        "libarchive/*:with_zlib": False,
+        "lz4/*:shared": False,
+        "openssl/*:shared": False,
+        "protobuf/*:shared": False,
+        "protobuf/*:with_zlib": True,
+        "rocksdb/*:enable_sse": False,
+        "rocksdb/*:lite": False,
+        "rocksdb/*:shared": False,
+        "rocksdb/*:use_rtti": True,
+        "rocksdb/*:with_jemalloc": False,
+        "rocksdb/*:with_lz4": True,
+        "rocksdb/*:with_snappy": True,
+        "snappy/*:shared": False,
+        "soci/*:shared": False,
+        "soci/*:with_sqlite3": True,
+        "soci/*:with_boost": True,
+        "xxhash/*:shared": False,
     }
 
     def set_version(self):
-        path = f'{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp'
-        regex = r'versionString\s?=\s?\"(.*)\"'
-        with open(path, 'r') as file:
+        path = f"{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp"
+        regex = r"versionString\s?=\s?\"(.*)\""
+        with open(path, "r") as file:
             matches = (re.search(regex, line) for line in file)
             match = next(m for m in matches if m)
             self.version = match.group(1)
 
     def build_requirements(self):
         # These provide build tools (protoc, grpc plugins) that run during build
-        self.tool_requires('grpc/1.50.1')
+        self.tool_requires("grpc/1.50.1")
         # Explicitly require b2 (e.g. for building from source for glibc compatibility)
         if self.options.tool_requires_b2:
-            self.tool_requires('b2/5.3.2')
+            self.tool_requires("b2/5.3.2")
 
     def configure(self):
-        if self.settings.compiler == 'apple-clang':
-            self.options['boost/*'].visibility = 'global'
+        if self.settings.compiler == "apple-clang":
+            self.options["boost/*"].visibility = "global"
 
     def requirements(self):
         # Force sqlite3 version to avoid conflicts with soci
-        self.requires('sqlite3/3.47.0', override=True)
+        self.requires("sqlite3/3.47.0", override=True)
         # Force our custom snappy build for all dependencies
-        self.requires('snappy/1.1.10@xahaud/stable', override=True)
+        self.requires("snappy/1.1.10@xahaud/stable", override=True)
         # Force boost version for all dependencies to avoid conflicts
-        self.requires('boost/1.86.0', override=True)
-        self.requires('lz4/1.10.0', force=True)
+        self.requires("boost/1.91.0", override=True)
+        self.requires("lz4/1.10.0", force=True)
 
         if self.options.with_wasmedge:
-            self.requires('wasmedge/0.11.2@xahaud/stable')
+            self.requires("wasmedge/0.11.2@xahaud/stable")
         if self.options.jemalloc:
-            self.requires('jemalloc/5.3.0')
+            self.requires("jemalloc/5.3.0")
         if self.options.rocksdb:
-            self.requires('rocksdb/6.29.5')
+            self.requires("rocksdb/6.29.5")
 
     exports_sources = (
-        'CMakeLists.txt',
-        'bin/getRippledInfo',
-        'cfg/*',
-        'cmake/*',
-        'external/*',
-        'include/*',
-        'src/*',
+        "CMakeLists.txt",
+        "bin/getRippledInfo",
+        "cfg/*",
+        "cmake/*",
+        "external/*",
+        "include/*",
+        "src/*",
     )
 
     def layout(self):
         cmake_layout(self)
         # Fix this setting to follow the default introduced in Conan 1.48
         # to align with our build instructions.
-        self.folders.generators = 'build/generators'
+        self.folders.generators = "build/generators"
+
+    generators = "CMakeDeps"
 
-    generators = 'CMakeDeps'
     def generate(self):
         tc = CMakeToolchain(self)
-        tc.variables['tests'] = self.options.tests
-        tc.variables['assert'] = self.options.assertions
-        tc.variables['coverage'] = self.options.coverage
-        tc.variables['jemalloc'] = self.options.jemalloc
-        tc.variables['rocksdb'] = self.options.rocksdb
-        tc.variables['BUILD_SHARED_LIBS'] = self.options.shared
-        tc.variables['static'] = self.options.static
-        tc.variables['unity'] = self.options.unity
-        tc.variables['xrpld'] = self.options.xrpld
+        tc.variables["tests"] = self.options.tests
+        tc.variables["assert"] = self.options.assertions
+        tc.variables["coverage"] = self.options.coverage
+        tc.variables["jemalloc"] = self.options.jemalloc
+        tc.variables["rocksdb"] = self.options.rocksdb
+        tc.variables["BUILD_SHARED_LIBS"] = self.options.shared
+        tc.variables["static"] = self.options.static
+        tc.variables["unity"] = self.options.unity
+        tc.variables["xrpld"] = self.options.xrpld
         tc.generate()
 
     def build(self):
@@ -167,29 +170,29 @@ class Xrpl(ConanFile):
         cmake.install()
 
     def package_info(self):
-        libxrpl = self.cpp_info.components['libxrpl']
+        libxrpl = self.cpp_info.components["libxrpl"]
         libxrpl.libs = [
-            'xrpl',
-            'xrpl.libpb',
-            'ed25519',
-            'secp256k1',
+            "xrpl",
+            "xrpl.libpb",
+            "ed25519",
+            "secp256k1",
         ]
         # TODO: Fix the protobufs to include each other relative to
         # `include/`, not `include/ripple/proto/`.
-        libxrpl.includedirs = ['include', 'include/ripple/proto']
+        libxrpl.includedirs = ["include", "include/ripple/proto"]
         libxrpl.requires = [
-            'boost::boost',
-            'date::date',
-            'grpc::grpc++',
-            'libarchive::libarchive',
-            'lz4::lz4',
-            'nudb::nudb',
-            'openssl::crypto',
-            'protobuf::libprotobuf',
-            'soci::soci',
-            'sqlite3::sqlite',
-            'xxhash::xxhash',
-            'zlib::zlib',
+            "boost::boost",
+            "date::date",
+            "grpc::grpc++",
+            "libarchive::libarchive",
+            "lz4::lz4",
+            "nudb::nudb",
+            "openssl::crypto",
+            "protobuf::libprotobuf",
+            "soci::soci",
+            "sqlite3::sqlite",
+            "xxhash::xxhash",
+            "zlib::zlib",
         ]
         if self.options.rocksdb:
-            libxrpl.requires.append('rocksdb::librocksdb')
+            libxrpl.requires.append("rocksdb::librocksdb")

hook/error.h

@@ -47,5 +47,6 @@
 #define MEM_OVERLAP -43
 #define TOO_MANY_STATE_MODIFICATIONS -44
 #define TOO_MANY_NAMESPACES -45
+#define TOO_LITTLE_ENTROPY -46
 #define HOOK_ERROR_CODES
 #endif //HOOK_ERROR_CODES

hook/extern.h

@@ -2,6 +2,9 @@
 // Generated using generate_extern.sh
 #include <stdint.h>
 #ifndef HOOK_EXTERN
+#ifdef __cplusplus
+extern "C" {
+#endif
 
 extern int32_t __attribute__((noduplicate))
 _g(uint32_t guard_id, uint32_t maxiter);
@@ -336,5 +339,14 @@ prepare(
     uint32_t read_ptr,
     uint32_t read_len);
 
+extern int64_t
+dice(uint32_t sides);
+
+extern int64_t
+util_random(uint32_t write_ptr, uint32_t write_len);
+
+#ifdef __cplusplus
+}
+#endif
 #define HOOK_EXTERN
 #endif  // HOOK_EXTERN

hook/generate_error.sh

@@ -9,7 +9,7 @@ ENUM_FILE="$SCRIPT_DIR/../include/xrpl/hook/Enum.h"
 echo '// For documentation please see: https://xrpl-hooks.readme.io/reference/'
 echo '// Generated using generate_error.sh'
 echo '#ifndef HOOK_ERROR_CODES'
-sed -n '/enum hook_return_code/,/};/p' "$ENUM_FILE" |
+sed -n '/enum class hook_return_code/,/};/p' "$ENUM_FILE" |
     awk '
         function ltrim(s) { sub(/^[[:space:]]+/, "", s); return s }
         function rtrim(s) { sub(/[[:space:]]+$/, "", s); return s }
@@ -31,7 +31,7 @@ sed -n '/enum hook_return_code/,/};/p' "$ENUM_FILE" |
 
         {
             line = $0
-            if (line ~ /enum[[:space:]]+hook_return_code/)
+            if (line ~ /enum[[:space:]]+class[[:space:]]+hook_return_code/)
                 next
             if (line ~ /^[[:space:]]*\{/)
                 next

hook/generate_extern.sh

@@ -11,6 +11,9 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
     echo '// Generated using generate_extern.sh'
     echo '#include <stdint.h>'
     echo '#ifndef HOOK_EXTERN'
+    echo '#ifdef __cplusplus'
+    echo 'extern "C" {'
+    echo '#endif'
     echo
     awk '
         function trim(s) {
@@ -19,33 +22,36 @@ APPLY_HOOK="$SCRIPT_DIR/../include/xrpl/hook/hook_api.macro"
             return s;
         }
 
-        {
-            line = $0;
-            
-            # Skip block comments
-            if (line ~ /\/\*/) {
-                next;
-            }
-            
-            # Look for comment lines that start with // and contain function signature
-            if (line ~ /^[[:space:]]*\/\/[[:space:]]*[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]+[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]*\(/) {
-                # Remove leading // and trim
-                sub(/^[[:space:]]*\/\/[[:space:]]*/, "", line);
-                line = trim(line);
-                
-                # Check if function name is "_g" to add attribute
-                if (line ~ /[[:space:]]+_g[[:space:]]*\(/) {
-                    # Insert __attribute__((noduplicate)) before _g
-                    sub(/[[:space:]]+_g/, " __attribute__((noduplicate)) _g", line);
-                }
-                
-                # printf("\n");
-                
-                printf("extern %s\n\n", line);
+        # Each entry is HOOK_API_DEFINITION(RET, NAME, (PARAMS), AMENDMENT),
+        # possibly spread over several lines. Collect until the parentheses
+        # balance, then split on the first two commas; the parameter tuple
+        # is the first parenthesised group.
+        function emit(s,    i, ret, name, p, q, params) {
+            sub(/^[[:space:]]*HOOK_API_DEFINITION[[:space:]]*\(/, "", s);
+            gsub(/[[:space:]]+/, " ", s);
+            i = index(s, ","); ret = trim(substr(s, 1, i - 1)); s = substr(s, i + 1);
+            i = index(s, ","); name = trim(substr(s, 1, i - 1)); s = substr(s, i + 1);
+            p = index(s, "("); q = index(s, ")");
+            params = trim(substr(s, p + 1, q - p - 1));
+            if (name == "_g")
+                name = "__attribute__((noduplicate)) _g";
+            printf("extern %s %s(%s);\n\n", ret, name, params);
+        }
+
+        /^[[:space:]]*HOOK_API_DEFINITION[[:space:]]*\(/ { buf = ""; collecting = 1; }
+
+        collecting {
+            buf = buf " " $0;
+            if (gsub(/\(/, "(", buf) == gsub(/\)/, ")", buf)) {
+                collecting = 0;
+                emit(buf);
             }
         }
     ' "$APPLY_HOOK"
 
+    echo '#ifdef __cplusplus'
+    echo '}'
+    echo '#endif'
     echo '#define HOOK_EXTERN'
     echo '#endif  // HOOK_EXTERN'
 } | (

hook/generate_lsflags.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+set -eu
+
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_DIR=$(cd "$SCRIPT_DIR" && pwd)
+
+RIPPLED_ROOT="$SCRIPT_DIR/../include/xrpl"
+LEDGER_FORMATS="$RIPPLED_ROOT/protocol/LedgerFormats.h"
+
+echo '// Generated using generate_lsflags.sh'
+echo ''
+echo '#ifndef HOOKLSFLAGS_INCLUDED'
+echo '#define HOOKLSFLAGS_INCLUDED 1'
+echo ''
+awk '
+    function ltrim(s) { sub(/^[[:space:]]+/, "", s); return s }
+    function rtrim(s) { sub(/[[:space:]]+$/, "", s); return s }
+    function trim(s) { return rtrim(ltrim(s)) }
+
+    function flush_group() {
+        if (entry_count > 0 && group != "") {
+            printf "enum %s {\n", group
+            for (i = 1; i <= entry_count; i++) {
+                printf "    %s,\n", entries[i]
+            }
+            printf "};\n"
+        }
+        delete entries
+        entry_count = 0
+    }
+
+    /enum LedgerSpecificFlags \{/ { inside = 1; next }
+    inside && /^\};/ { inside = 0; flush_group(); next }
+    !inside { next }
+
+    # Group header comments: // ltFOO or // remarks
+    /^[[:space:]]*\/\/[[:space:]]*(lt[A-Z_]+|remarks)[[:space:]]*$/ {
+        flush_group()
+        line = $0
+        sub(/.*\/\/[[:space:]]*/, "", line)
+        group = trim(line)
+        next
+    }
+
+    # Skip pure comment lines (not group headers)
+    /^[[:space:]]*\/\// { next }
+
+    # Skip blank lines
+    /^[[:space:]]*$/ { next }
+
+    # Accumulate flag lines (handle multi-line values)
+    {
+        line = $0
+        # Strip inline comments
+        sub(/\/\/.*/, "", line)
+        line = trim(line)
+        if (line == "") next
+
+        if (pending != "") {
+            pending = pending " " line
+        } else {
+            pending = line
+        }
+
+        # If line ends with comma, the entry is complete
+        if (pending ~ /,$/) {
+            # Remove trailing comma
+            sub(/,$/, "", pending)
+            entries[++entry_count] = pending
+            pending = ""
+        }
+    }
+
+    BEGIN {
+        inside = 0
+        group = ""
+        pending = ""
+        entry_count = 0
+    }
+' "$LEDGER_FORMATS"
+echo ''
+echo '#endif // HOOKLSFLAGS_INCLUDED'

hook/generate_txflags.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -eu
+
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_DIR=$(cd "$SCRIPT_DIR" && pwd)
+
+RIPPLED_ROOT="$SCRIPT_DIR/../include/xrpl"
+TX_FLAGS="$RIPPLED_ROOT/protocol/TxFlags.h"
+
+echo '// Generated using generate_txflags.sh'
+echo '#include "ls_flags.h"'
+echo '#include <stdint.h>'
+echo ''
+cat "$TX_FLAGS" |
+    awk '
+        /^[[:space:]]*enum / {
+            if (count > 0) print ""
+            inside = 1
+            count++
+        }
+        inside {
+            print
+            if (/};/) inside = 0
+        }
+    '

hook/hookapi.h

@@ -38,6 +38,7 @@
 #define KEYLET_HOOK_DEFINITION 24
 #define KEYLET_HOOK_STATE_DIR 25
 #define KEYLET_CRON 26
+#define KEYLET_MANIFEST 37
 
 #define COMPARE_EQUAL 1U
 #define COMPARE_LESS 2U
@@ -45,8 +46,11 @@
 
 #include "error.h"
 #include "extern.h"
-#include "sfcodes.h"
 #include "macro.h"
+#include "sfcodes.h"
 #include "tts.h"
 
+#include "ls_flags.h"
+#include "tx_flags.h"
+
 #endif

hook/ls_flags.h

@@ -0,0 +1,75 @@
+// Generated using generate_lsflags.sh
+
+#ifndef HOOKLSFLAGS_INCLUDED
+#define HOOKLSFLAGS_INCLUDED 1
+
+enum ltACCOUNT_ROOT {
+    lsfPasswordSpent = 0x00010000,
+    lsfRequireDestTag = 0x00020000,
+    lsfRequireAuth = 0x00040000,
+    lsfDisallowXRP = 0x00080000,
+    lsfDisableMaster = 0x00100000,
+    lsfNoFreeze = 0x00200000,
+    lsfGlobalFreeze = 0x00400000,
+    lsfDefaultRipple = 0x00800000,
+    lsfDepositAuth = 0x01000000,
+    lsfTshCollect = 0x02000000,
+    lsfDisallowIncomingNFTokenOffer = 0x04000000,
+    lsfDisallowIncomingCheck = 0x08000000,
+    lsfDisallowIncomingPayChan = 0x10000000,
+    lsfDisallowIncomingTrustline = 0x20000000,
+    lsfURITokenIssuer = 0x40000000,
+    lsfDisallowIncomingRemit = 0x80000000,
+    lsfAllowTrustLineClawback = 0x00001000,
+};
+enum ltOFFER {
+    lsfPassive = 0x00010000,
+    lsfSell = 0x00020000,
+};
+enum ltRIPPLE_STATE {
+    lsfLowReserve = 0x00010000,
+    lsfHighReserve = 0x00020000,
+    lsfLowAuth = 0x00040000,
+    lsfHighAuth = 0x00080000,
+    lsfLowNoRipple = 0x00100000,
+    lsfHighNoRipple = 0x00200000,
+    lsfLowFreeze = 0x00400000,
+    lsfHighFreeze = 0x00800000,
+    lsfLowDeepFreeze = 0x02000000,
+    lsfHighDeepFreeze = 0x04000000,
+    lsfAMMNode = 0x01000000,
+};
+enum ltSIGNER_LIST {
+    lsfOneOwnerCount = 0x00010000,
+};
+enum ltDIR_NODE {
+    lsfNFTokenBuyOffers = 0x00000001,
+    lsfNFTokenSellOffers = 0x00000002,
+    lsfEmittedDir = 0x00000004,
+};
+enum ltNFTOKEN_OFFER {
+    lsfSellNFToken = 0x00000001,
+};
+enum ltURI_TOKEN {
+    lsfBurnable = 0x00000001,
+};
+enum remarks {
+    lsfImmutable = 1,
+};
+enum ltMPTOKEN_ISSUANCE {
+    lsfMPTLocked = 0x00000001,
+    lsfMPTCanLock = 0x00000002,
+    lsfMPTRequireAuth = 0x00000004,
+    lsfMPTCanEscrow = 0x00000008,
+    lsfMPTCanTrade = 0x00000010,
+    lsfMPTCanTransfer = 0x00000020,
+    lsfMPTCanClawback = 0x00000040,
+};
+enum ltMPTOKEN {
+    lsfMPTAuthorized = 0x00000002,
+};
+enum ltCREDENTIAL {
+    lsfAccepted = 0x00010000,
+};
+
+#endif // HOOKLSFLAGS_INCLUDED

hook/sfcodes.h

@@ -22,6 +22,8 @@
 #define sfHookApiVersion ((1U << 16U) + 20U)
 #define sfHookStateScale ((1U << 16U) + 21U)
 #define sfLedgerFixType ((1U << 16U) + 22U)
+#define sfEntropyCount ((1U << 16U) + 99U)
+#define sfEntropyDenominator ((1U << 16U) + 100U)
 #define sfNetworkID ((2U << 16U) + 1U)
 #define sfFlags ((2U << 16U) + 2U)
 #define sfSourceTag ((2U << 16U) + 3U)
@@ -80,6 +82,7 @@
 #define sfRewardTime ((2U << 16U) + 98U)
 #define sfRewardLgrFirst ((2U << 16U) + 99U)
 #define sfRewardLgrLast ((2U << 16U) + 100U)
+#define sfAppLoaderSequence ((2U << 16U) + 101U)
 #define sfIndexNext ((3U << 16U) + 1U)
 #define sfIndexPrevious ((3U << 16U) + 2U)
 #define sfBookNode ((3U << 16U) + 3U)
@@ -152,6 +155,9 @@
 #define sfEscrowID ((5U << 16U) + 35U)
 #define sfURITokenID ((5U << 16U) + 36U)
 #define sfDomainID ((5U << 16U) + 37U)
+#define sfNextRandomDigest ((5U << 16U) + 89U)
+#define sfRandomData ((5U << 16U) + 90U)
+#define sfManifestID ((5U << 16U) + 91U)
 #define sfHookOnOutgoing ((5U << 16U) + 93U)
 #define sfHookOnIncoming ((5U << 16U) + 94U)
 #define sfCron ((5U << 16U) + 95U)
@@ -189,6 +195,7 @@
 #define sfSignatureReward ((6U << 16U) + 29U)
 #define sfMinAccountCreateAmount ((6U << 16U) + 30U)
 #define sfLPTokenBalance ((6U << 16U) + 31U)
+#define sfTrustLineRewardAccumulator ((6U << 16U) + 99U)
 #define sfPublicKey ((7U << 16U) + 1U)
 #define sfMessageKey ((7U << 16U) + 2U)
 #define sfSigningPubKey ((7U << 16U) + 3U)
@@ -220,6 +227,8 @@
 #define sfProvider ((7U << 16U) + 30U)
 #define sfMPTokenMetadata ((7U << 16U) + 31U)
 #define sfCredentialType ((7U << 16U) + 32U)
+#define sfAppLoader ((7U << 16U) + 96U)
+#define sfHookName ((7U << 16U) + 97U)
 #define sfRemarkValue ((7U << 16U) + 98U)
 #define sfRemarkName ((7U << 16U) + 99U)
 #define sfAccount ((8U << 16U) + 1U)
@@ -255,6 +264,7 @@
 #define sfIssuingChainIssue ((24U << 16U) + 2U)
 #define sfAsset ((24U << 16U) + 3U)
 #define sfAsset2 ((24U << 16U) + 4U)
+#define sfClaimCurrency ((24U << 16U) + 5U)
 #define sfXChainBridge ((25U << 16U) + 1U)
 #define sfTransactionMetaData ((14U << 16U) + 2U)
 #define sfCreatedNode ((14U << 16U) + 3U)
@@ -274,7 +284,6 @@
 #define sfDisabledValidator ((14U << 16U) + 19U)
 #define sfEmittedTxn ((14U << 16U) + 20U)
 #define sfHookExecution ((14U << 16U) + 21U)
-#define sfHookDefinition ((14U << 16U) + 22U)
 #define sfHookParameter ((14U << 16U) + 23U)
 #define sfHookGrant ((14U << 16U) + 24U)
 #define sfVoteEntry ((14U << 16U) + 25U)
@@ -286,6 +295,8 @@
 #define sfXChainCreateAccountAttestationCollectionElement ((14U << 16U) + 31U)
 #define sfPriceData ((14U << 16U) + 32U)
 #define sfCredential ((14U << 16U) + 33U)
+#define sfRandomDigestEntry ((14U << 16U) + 88U)
+#define sfManifest ((14U << 16U) + 90U)
 #define sfAmountEntry ((14U << 16U) + 91U)
 #define sfMintURIToken ((14U << 16U) + 92U)
 #define sfHookEmission ((14U << 16U) + 93U)
@@ -293,6 +304,8 @@
 #define sfActiveValidator ((14U << 16U) + 95U)
 #define sfGenesisMint ((14U << 16U) + 96U)
 #define sfRemark ((14U << 16U) + 97U)
+#define sfHighReward ((14U << 16U) + 98U)
+#define sfLowReward ((14U << 16U) + 99U)
 #define sfSigners ((15U << 16U) + 3U)
 #define sfSignerEntries ((15U << 16U) + 4U)
 #define sfTemplate ((15U << 16U) + 5U)
@@ -315,6 +328,7 @@
 #define sfAuthorizeCredentials ((15U << 16U) + 26U)
 #define sfUnauthorizeCredentials ((15U << 16U) + 27U)
 #define sfAcceptedCredentials ((15U << 16U) + 28U)
+#define sfRandomDigests ((15U << 16U) + 91U)
 #define sfAmounts ((15U << 16U) + 92U)
 #define sfHookEmissions ((15U << 16U) + 93U)
 #define sfImportVLKeys ((15U << 16U) + 94U)

hook/tts.h

@@ -61,6 +61,8 @@
 #define ttNFTOKEN_MODIFY 70
 #define ttPERMISSIONED_DOMAIN_SET 71
 #define ttPERMISSIONED_DOMAIN_DELETE 72
+#define ttENTROPY 89
+#define ttMANIFEST_SET 91
 #define ttCRON 92
 #define ttCRON_SET 93
 #define ttREMARKS_SET 94

hook/tx_flags.h

@@ -0,0 +1,117 @@
+// Generated using generate_txflags.sh
+#include "ls_flags.h"
+#include <stdint.h>
+
+enum UniversalFlags : uint32_t {
+    tfFullyCanonicalSig = 0x80000000,
+};
+
+enum AccountSetFlags : uint32_t {
+    tfRequireDestTag = 0x00010000,
+    tfOptionalDestTag = 0x00020000,
+    tfRequireAuth = 0x00040000,
+    tfOptionalAuth = 0x00080000,
+    tfDisallowXRP = 0x00100000,
+    tfAllowXRP = 0x00200000,
+};
+
+enum AccountFlags : uint32_t {
+    asfRequireDest = 1,
+    asfRequireAuth = 2,
+    asfDisallowXRP = 3,
+    asfDisableMaster = 4,
+    asfAccountTxnID = 5,
+    asfNoFreeze = 6,
+    asfGlobalFreeze = 7,
+    asfDefaultRipple = 8,
+    asfDepositAuth = 9,
+    asfAuthorizedNFTokenMinter = 10,
+    asfTshCollect = 11,
+    asfDisallowIncomingNFTokenOffer = 12,
+    asfDisallowIncomingCheck = 13,
+    asfDisallowIncomingPayChan = 14,
+    asfDisallowIncomingTrustline = 15,
+    asfDisallowIncomingRemit = 16,
+    asfAllowTrustLineClawback = 17,
+};
+
+enum OfferCreateFlags : uint32_t {
+    tfPassive = 0x00010000,
+    tfImmediateOrCancel = 0x00020000,
+    tfFillOrKill = 0x00040000,
+    tfSell = 0x00080000,
+};
+
+enum PaymentFlags : uint32_t {
+    tfNoRippleDirect = 0x00010000,
+    tfPartialPayment = 0x00020000,
+    tfLimitQuality = 0x00040000,
+};
+
+enum TrustSetFlags : uint32_t {
+    tfSetfAuth = 0x00010000,
+    tfSetNoRipple = 0x00020000,
+    tfClearNoRipple = 0x00040000,
+    tfSetFreeze = 0x00100000,
+    tfClearFreeze = 0x00200000,
+    tfSetDeepFreeze = 0x00400000,
+    tfClearDeepFreeze = 0x00800000
+};
+
+enum EnableAmendmentFlags : uint32_t {
+    tfGotMajority = 0x00010000,
+    tfLostMajority = 0x00020000,
+    tfTestSuite = 0x80000000,
+};
+
+enum PaymentChannelClaimFlags : uint32_t {
+    tfRenew = 0x00010000,
+    tfClose = 0x00020000,
+};
+
+enum NFTokenMintFlags : uint32_t {
+    tfBurnable = 0x00000001,
+    tfOnlyXRP = 0x00000002,
+    tfTrustLine = 0x00000004,
+    tfTransferable = 0x00000008,
+    tfMutable = 0x00000010,
+    tfStrongTSH = 0x00008000,
+};
+
+enum MPTokenIssuanceCreateFlags : uint32_t {
+    tfMPTCanLock = lsfMPTCanLock,
+    tfMPTRequireAuth = lsfMPTRequireAuth,
+    tfMPTCanEscrow = lsfMPTCanEscrow,
+    tfMPTCanTrade = lsfMPTCanTrade,
+    tfMPTCanTransfer = lsfMPTCanTransfer,
+    tfMPTCanClawback = lsfMPTCanClawback,
+};
+
+enum MPTokenAuthorizeFlags : uint32_t {
+    tfMPTUnauthorize = 0x00000001,
+};
+
+enum MPTokenIssuanceSetFlags : uint32_t {
+    tfMPTLock = 0x00000001,
+    tfMPTUnlock = 0x00000002,
+};
+
+enum NFTokenCreateOfferFlags : uint32_t {
+    tfSellNFToken = 0x00000001,
+};
+
+enum ClaimRewardFlags : uint32_t {
+    tfOptOut = 0x00000001,
+};
+
+enum CronSetFlags : uint32_t {
+    tfCronUnset = 0x00000001,
+};
+
+enum AMMClawbackFlags : uint32_t {
+    tfClawTwoAssets = 0x00000001,
+};
+
+enum BridgeModifyFlags : uint32_t {
+    tfClearAccountCreateAmount = 0x00010000,
+};

include/xrpl/basics/MathUtilities.h

@@ -23,9 +23,66 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
 
 namespace ripple {
 
+/** Add two signed 64-bit integers, returning std::nullopt when the exact
+ *  mathematical sum is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedAdd(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
+        return std::nullopt;
+
+    return a + b;
+}
+
+/** Subtract two signed 64-bit integers, returning std::nullopt when the exact
+ *  mathematical difference is not representable in std::int64_t.
+ */
+[[nodiscard]] constexpr std::optional<std::int64_t>
+checkedSub(std::int64_t a, std::int64_t b) noexcept
+{
+    using L = std::numeric_limits<std::int64_t>;
+
+    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
+        return std::nullopt;
+
+    return a - b;
+}
+
+namespace detail {
+using i64_limits = std::numeric_limits<std::int64_t>;
+
+static_assert(checkedAdd(0, 0) == 0);
+static_assert(checkedAdd(1, -1) == 0);
+static_assert(checkedAdd(-5, 2) == -3);
+static_assert(!checkedAdd(i64_limits::max(), 1).has_value());
+static_assert(!checkedAdd(i64_limits::min(), -1).has_value());
+static_assert(checkedAdd(i64_limits::max() - 1, 1) == i64_limits::max());
+static_assert(checkedAdd(i64_limits::min(), i64_limits::max()) == -1);
+static_assert(checkedAdd(i64_limits::max(), i64_limits::min()) == -1);
+static_assert(!checkedAdd(i64_limits::max(), i64_limits::max()).has_value());
+static_assert(!checkedAdd(i64_limits::min(), i64_limits::min()).has_value());
+
+static_assert(checkedSub(0, 0) == 0);
+static_assert(checkedSub(1, 1) == 0);
+static_assert(checkedSub(-5, 2) == -7);
+static_assert(checkedSub(-5, -2) == -3);
+static_assert(!checkedSub(i64_limits::min(), 1).has_value());
+static_assert(!checkedSub(i64_limits::max(), -1).has_value());
+static_assert(checkedSub(i64_limits::min() + 1, 1) == i64_limits::min());
+static_assert(checkedSub(-1, i64_limits::max()) == i64_limits::min());
+static_assert(!checkedSub(i64_limits::max(), i64_limits::min()).has_value());
+static_assert(!checkedSub(i64_limits::min(), i64_limits::max()).has_value());
+}  // namespace detail
+
 /** Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]
  * E.g. calculatePercent(1, 100) = 1 because 1/100 = 0.010000

include/xrpl/basics/ReaderPreferringSharedMutex.h

@@ -0,0 +1,105 @@
+#pragma once
+
+#include <shared_mutex>
+
+// On Linux (glibc), std::shared_mutex wraps pthread_rwlock_t initialised
+// with PTHREAD_RWLOCK_PREFER_WRITER_NONRECURSIVE_NP.  This means a
+// pending exclusive lock() blocks new shared (reader) acquisitions,
+// causing reader starvation when writers contend frequently.
+//
+// On macOS / ARM (libc++), std::shared_mutex is already reader-preferring,
+// so the same code behaves differently across platforms.
+//
+// This header provides ReaderPreferringSharedMutex:
+//   - On Linux it wraps pthread_rwlock_t initialised with
+//     PTHREAD_RWLOCK_PREFER_READER_NP, matching macOS semantics.
+//   - On all other platforms it is a type alias for std::shared_mutex.
+//
+// The interface is identical to std::shared_mutex, so it works with
+// std::shared_lock and std::unique_lock.
+
+#if defined(__linux__)
+
+#include <cerrno>
+#include <pthread.h>
+#include <system_error>
+
+namespace ripple {
+
+class ReaderPreferringSharedMutex
+{
+    pthread_rwlock_t rwlock_;
+
+public:
+    ReaderPreferringSharedMutex()
+    {
+        pthread_rwlockattr_t attr;
+        pthread_rwlockattr_init(&attr);
+        pthread_rwlockattr_setkind_np(&attr, PTHREAD_RWLOCK_PREFER_READER_NP);
+        int rc = pthread_rwlock_init(&rwlock_, &attr);
+        pthread_rwlockattr_destroy(&attr);
+        if (rc != 0)
+            throw std::system_error(
+                rc, std::system_category(), "pthread_rwlock_init");
+    }
+
+    ~ReaderPreferringSharedMutex()
+    {
+        pthread_rwlock_destroy(&rwlock_);
+    }
+
+    ReaderPreferringSharedMutex(ReaderPreferringSharedMutex const&) = delete;
+    ReaderPreferringSharedMutex&
+    operator=(ReaderPreferringSharedMutex const&) = delete;
+
+    // Exclusive (writer) locking
+    void
+    lock()
+    {
+        pthread_rwlock_wrlock(&rwlock_);
+    }
+
+    bool
+    try_lock()
+    {
+        return pthread_rwlock_trywrlock(&rwlock_) == 0;
+    }
+
+    void
+    unlock()
+    {
+        pthread_rwlock_unlock(&rwlock_);
+    }
+
+    // Shared (reader) locking
+    void
+    lock_shared()
+    {
+        pthread_rwlock_rdlock(&rwlock_);
+    }
+
+    bool
+    try_lock_shared()
+    {
+        return pthread_rwlock_tryrdlock(&rwlock_) == 0;
+    }
+
+    void
+    unlock_shared()
+    {
+        pthread_rwlock_unlock(&rwlock_);
+    }
+};
+
+}  // namespace ripple
+
+#else  // !__linux__
+
+namespace ripple {
+
+// macOS, Windows, etc. — std::shared_mutex is already reader-preferring.
+using ReaderPreferringSharedMutex = std::shared_mutex;
+
+}  // namespace ripple
+
+#endif

include/xrpl/basics/ResolverAsio.h

@@ -22,7 +22,8 @@
 
 #include <xrpl/basics/Resolver.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <boost/asio/io_service.hpp>
+
+#include <boost/asio/io_context.hpp>
 
 namespace ripple {
 
@@ -32,7 +33,7 @@ public:
     explicit ResolverAsio() = default;
 
     static std::unique_ptr<ResolverAsio>
-    New(boost::asio::io_service&, beast::Journal);
+    New(boost::asio::io_context&, beast::Journal);
 };
 
 }  // namespace ripple

include/xrpl/basics/StringUtilities.h

@@ -77,7 +77,7 @@ strUnHex(std::size_t strSize, Iterator begin, Iterator end)
 
     if (strSize & 1)
     {
-        int c = unxtab[*iter++];
+        int c = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (c < 0)
             return {};
@@ -87,12 +87,12 @@ strUnHex(std::size_t strSize, Iterator begin, Iterator end)
 
     while (iter != end)
     {
-        int cHigh = unxtab[*iter++];
+        int cHigh = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (cHigh < 0)
             return {};
 
-        int cLow = unxtab[*iter++];
+        int cLow = unxtab[static_cast<unsigned char>(*iter++)];
 
         if (cLow < 0)
             return {};

include/xrpl/basics/UTF8.h

@@ -0,0 +1,60 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_BASICS_UTF8_H_INCLUDED
+#define RIPPLE_BASICS_UTF8_H_INCLUDED
+
+#include <xrpl/basics/Slice.h>
+
+namespace ripple {
+
+/** Check that a byte sequence is well-formed UTF-8, excluding the two
+    noncharacters U+FFFE and U+FFFF.
+
+    Rejects:
+      - overlong encodings;
+      - UTF-16 surrogate halves (U+D800..U+DFFF);
+      - scalar values above U+10FFFF, and 0xF5..0xFF lead bytes;
+      - stray continuation bytes;
+      - multi-byte sequences truncated by the end of the buffer;
+      - U+FFFE and U+FFFF (EF BF BE, EF BF BF).
+
+    U+FFFE and U+FFFF are well-formed, but have no use in a URI or a name
+    and exist to be misread: U+FFFE is a byte-swapped BOM, so a client that
+    transcodes to UTF-16/32 and sniffs the byte order can be pushed into
+    decoding the rest of the string with the wrong endianness, and both are
+    commonly used as in-band sentinels. They have always been rejected by
+    URIToken and HookName validation, and this function preserves that.
+
+    This is consensus-critical. For every input the previous decoder could
+    evaluate without reading past the end of the buffer, the result is
+    identical to it. The only difference is that truncated trailing
+    sequences, where the previous decoder read out of bounds, are now always
+    rejected. Any further change to what this accepts needs an amendment.
+
+    @param s The bytes to check.
+
+    @note Total: every byte read is within s.
+*/
+bool
+isValidUTF8(Slice const& s) noexcept;
+
+}  // namespace ripple
+
+#endif

include/xrpl/beast/asio/io_latency_probe.h

@@ -22,7 +22,8 @@
 
 #include <xrpl/beast/utility/instrumentation.h>
 #include <boost/asio/basic_waitable_timer.hpp>
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/post.hpp>
 
 #include <chrono>
 #include <condition_variable>
@@ -31,7 +32,7 @@
 
 namespace beast {
 
-/** Measures handler latency on an io_service queue. */
+/** Measures handler latency on an io_context queue. */
 template <class Clock>
 class io_latency_probe
 {
@@ -43,12 +44,12 @@ private:
     std::condition_variable_any m_cond;
     std::size_t m_count;
     duration const m_period;
-    boost::asio::io_service& m_ios;
+    boost::asio::io_context& m_ios;
     boost::asio::basic_waitable_timer<std::chrono::steady_clock> m_timer;
     bool m_cancel;
 
 public:
-    io_latency_probe(duration const& period, boost::asio::io_service& ios)
+    io_latency_probe(duration const& period, boost::asio::io_context& ios)
         : m_count(1)
         , m_period(period)
         , m_ios(ios)
@@ -63,16 +64,16 @@ public:
         cancel(lock, true);
     }
 
-    /** Return the io_service associated with the latency probe. */
+    /** Return the io_context associated with the latency probe. */
     /** @{ */
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
         return m_ios;
     }
 
-    boost::asio::io_service const&
-    get_io_service() const
+    boost::asio::io_context const&
+    get_io_context() const
     {
         return m_ios;
     }
@@ -108,8 +109,10 @@ public:
         std::lock_guard lock(m_mutex);
         if (m_cancel)
             throw std::logic_error("io_latency_probe is canceled");
-        m_ios.post(sample_op<Handler>(
-            std::forward<Handler>(handler), Clock::now(), false, this));
+        boost::asio::post(
+            m_ios,
+            sample_op<Handler>(
+                std::forward<Handler>(handler), Clock::now(), false, this));
     }
 
     /** Initiate continuous i/o latency sampling.
@@ -123,8 +126,10 @@ public:
         std::lock_guard lock(m_mutex);
         if (m_cancel)
             throw std::logic_error("io_latency_probe is canceled");
-        m_ios.post(sample_op<Handler>(
-            std::forward<Handler>(handler), Clock::now(), true, this));
+        boost::asio::post(
+            m_ios,
+            sample_op<Handler>(
+                std::forward<Handler>(handler), Clock::now(), true, this));
     }
 
 private:
@@ -235,12 +240,13 @@ private:
                     // The latency is too high to maintain the desired
                     // period so don't bother with a timer.
                     //
-                    m_probe->m_ios.post(
+                    boost::asio::post(
+                        m_probe->m_ios,
                         sample_op<Handler>(m_handler, now, m_repeat, m_probe));
                 }
                 else
                 {
-                    m_probe->m_timer.expires_from_now(when - now);
+                    m_probe->m_timer.expires_after(when - now);
                     m_probe->m_timer.async_wait(
                         sample_op<Handler>(m_handler, now, m_repeat, m_probe));
                 }
@@ -253,7 +259,8 @@ private:
             if (!m_probe)
                 return;
             typename Clock::time_point const now(Clock::now());
-            m_probe->m_ios.post(
+            boost::asio::post(
+                m_probe->m_ios,
                 sample_op<Handler>(m_handler, now, m_repeat, m_probe));
         }
     };

include/xrpl/beast/test/yield_to.h

@@ -8,9 +8,12 @@
 #ifndef BEAST_TEST_YIELD_TO_HPP
 #define BEAST_TEST_YIELD_TO_HPP
 
-#include <boost/asio/io_service.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 #include <boost/asio/spawn.hpp>
 #include <boost/optional.hpp>
+#include <boost/thread/csbl/memory/allocator_arg.hpp>
+
 #include <condition_variable>
 #include <functional>
 #include <mutex>
@@ -29,10 +32,12 @@ namespace test {
 class enable_yield_to
 {
 protected:
-    boost::asio::io_service ios_;
+    boost::asio::io_context ios_;
 
 private:
-    boost::optional<boost::asio::io_service::work> work_;
+    boost::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        work_;
     std::vector<std::thread> threads_;
     std::mutex m_;
     std::condition_variable cv_;
@@ -42,7 +47,8 @@ public:
     /// The type of yield context passed to functions.
     using yield_context = boost::asio::yield_context;
 
-    explicit enable_yield_to(std::size_t concurrency = 1) : work_(ios_)
+    explicit enable_yield_to(std::size_t concurrency = 1)
+        : work_(boost::asio::make_work_guard(ios_))
     {
         threads_.reserve(concurrency);
         while (concurrency--)
@@ -56,9 +62,9 @@ public:
             t.join();
     }
 
-    /// Return the `io_service` associated with the object
-    boost::asio::io_service&
-    get_io_service()
+    /// Return the `io_context` associated with the object
+    boost::asio::io_context&
+    get_io_context()
     {
         return ios_;
     }
@@ -111,13 +117,18 @@ enable_yield_to::spawn(F0&& f, FN&&... fn)
 {
     boost::asio::spawn(
         ios_,
+        boost::allocator_arg,
+        boost::context::fixedsize_stack(2 * 1024 * 1024),
         [&](yield_context yield) {
             f(yield);
             std::lock_guard lock{m_};
             if (--running_ == 0)
                 cv_.notify_all();
         },
-        boost::coroutines::attributes(2 * 1024 * 1024));
+        [](std::exception_ptr e) {
+            if (e)
+                std::rethrow_exception(e);
+        });
     spawn(fn...);
 }
 

include/xrpl/hook/Enum.h

@@ -15,7 +15,9 @@
 #define uint256 std::string
 #define featureHooksUpdate1 "1"
 #define featureHooksUpdate2 "1"
+#define featureRNG "1"
 #define fix20250131 "1"
+#define fixGuardDepth32 "1"
 namespace hook_api {
 struct Rules
 {
@@ -312,6 +314,7 @@ enum keylet_code : uint32_t {
     MPTOKEN = 34,
     CREDENTIAL = 35,
     PERMISSIONED_DOMAIN = 36,
+    MANIFEST = 37,
 };
 }
 
@@ -319,7 +322,7 @@ namespace compare_mode {
 enum compare_mode : uint32_t { EQUAL = 1, LESS = 2, GREATER = 4 };
 }
 
-enum hook_return_code : int64_t {
+enum class hook_return_code : int64_t {
     SUCCESS =
         0,  // return codes > 0 are reserved for hook apis to return "success"
     OUT_OF_BOUNDS =
@@ -381,12 +384,14 @@ enum hook_return_code : int64_t {
     INVALID_KEY = -41,   // user supplied key was not valid
     NOT_A_STRING = -42,  // nul terminator missing from a string argument
     MEM_OVERLAP = -43,   // one or more specified buffers are the same memory
-    TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 5000 modified state
+    TOO_MANY_STATE_MODIFICATIONS = -44,  // more than 256 modified state
                                          // entires in the combined hook chains
-    TOO_MANY_NAMESPACES = -45
+    TOO_MANY_NAMESPACES = -45,
+    TOO_LITTLE_ENTROPY = -46  // featureRNG: no seed for this ledger, or too few
+                              // validators contributed to it
 };
 
-enum ExitType : uint8_t {
+enum class ExitType : uint8_t {
     UNSET = 0,
     WASM_ERROR = 1,
     ROLLBACK = 2,
@@ -396,12 +401,25 @@ enum ExitType : uint8_t {
 const uint16_t max_state_modifications = 256;
 const uint8_t max_slots = 255;
 const uint8_t max_nonce = 255;
+const uint16_t max_rng_draws = 256;  // featureRNG, per Hook execution
 const uint8_t max_emit = 255;
 const uint8_t max_params = 16;
 const double fee_base_multiplier = 1.1f;
 
 using APIWhitelist = std::map<std::string, std::vector<uint8_t>>;
 
+namespace detail {
+template <class T>
+constexpr uint8_t wasmTypeCode = sizeof(T) == 8 ? 0x7EU : 0x7FU;
+
+template <class R, class... Args>
+std::vector<uint8_t>
+wasmSignature(R (*)(Args...))
+{
+    return {wasmTypeCode<R>, wasmTypeCode<Args>...};
+}
+}  // namespace detail
+
 // RH NOTE: Find descriptions of api functions in ./impl/applyHook.cpp and
 // hookapi.h (include for hooks) this is a map of the api name to its return
 // code (vec[0] and its parameters vec[>0]) as wasm type codes
@@ -413,25 +431,15 @@ getImportWhitelist(Rules const& rules)
 #pragma push_macro("HOOK_API_DEFINITION")
 #undef HOOK_API_DEFINITION
 
-#define int64_t 0x7EU
-#define int32_t 0x7FU
-#define uint32_t 0x7FU
-
-#define HOOK_WRAP_PARAMS(...) __VA_ARGS__
-
 #define HOOK_API_DEFINITION(                                \
     RETURN_TYPE, FUNCTION_NAME, PARAMS_TUPLE, AMENDMENT)    \
     if (AMENDMENT == uint256{} || rules.enabled(AMENDMENT)) \
-        whitelist[#FUNCTION_NAME] = {                       \
-            RETURN_TYPE, HOOK_WRAP_PARAMS PARAMS_TUPLE};
+        whitelist[#FUNCTION_NAME] =                         \
+            detail::wasmSignature((RETURN_TYPE(*) PARAMS_TUPLE) nullptr);
 
 #include "hook_api.macro"
 
 #undef HOOK_API_DEFINITION
-#undef HOOK_WRAP_PARAMS
-#undef int64_t
-#undef int32_t
-#undef uint32_t
 #pragma pop_macro("HOOK_API_DEFINITION")
 
     return whitelist;
@@ -443,6 +451,7 @@ getImportWhitelist(Rules const& rules)
 
 enum GuardRulesVersion : uint64_t {
     GuardRuleFix20250131 = 0x00000001,
+    GuardRuleDepth32 = 0x00000002,
 };
 
 inline uint64_t
@@ -451,6 +460,8 @@ getGuardRulesVersion(Rules const& rules)
     uint64_t version = 0;
     if (rules.enabled(fix20250131))
         version |= GuardRuleFix20250131;
+    if (rules.enabled(fixGuardDepth32))
+        version |= GuardRuleDepth32;
     return version;
 }
 

include/xrpl/hook/Guard.h

@@ -87,7 +87,7 @@ parseSignedLeb128(
         }
         *end_offset = i;
         if (shift < 64 && (b & 0x40U))
-            val |= (~0 << shift);
+            val |= (~int64_t{0} << shift);
 
         return val;
     }
@@ -204,9 +204,13 @@ struct WasmBlkInf
     }
 // compute worst case execution time
 inline uint64_t
-compute_wce(const WasmBlkInf* blk, int level, bool* recursion_limit_reached)
+compute_wce(
+    const WasmBlkInf* blk,
+    int level,
+    int max_level,
+    bool* recursion_limit_reached)
 {
-    if (level > 16)
+    if (level > max_level)
     {
         *recursion_limit_reached = true;
         return 0;
@@ -233,8 +237,8 @@ compute_wce(const WasmBlkInf* blk, int level, bool* recursion_limit_reached)
 
     if (blk->children.size() > 0)
         for (auto const& child : blk->children)
-            worst_case_execution +=
-                compute_wce(child, level + 1, recursion_limit_reached);
+            worst_case_execution += compute_wce(
+                child, level + 1, max_level, recursion_limit_reached);
 
     if (parent == 0 ||
         parent->iteration_bound ==
@@ -788,12 +792,17 @@ check_guard(
     }
 
     bool recursion_limit_reached = false;
-    uint64_t wce = compute_wce(&(*root), 0, &recursion_limit_reached);
+    int max_level = 16;
+    if (rulesVersion & hook_api::GuardRuleDepth32)
+        max_level = 32;
+    uint64_t wce =
+        compute_wce(&(*root), 0, max_level, &recursion_limit_reached);
     if (recursion_limit_reached)
     {
         GUARDLOG(hook::log::NESTING_LIMIT)
             << "GuardCheck "
-            << "Maximum allowable depth of blocks reached (16 levels). Flatten "
+            << "Maximum allowable depth of blocks reached (" << max_level
+            << " levels). Flatten "
                "your loops and conditions!.\n";
         return {};
     }
@@ -1087,7 +1096,11 @@ validateGuards(
             {
                 int name_len = parseLeb128(wasm, i, &i);
                 CHECK_SHORT_HOOK();
-                if (name_len == 4)
+                // Only compare the name if all four bytes are in bounds. A
+                // name running past the end is rejected as a short hook below
+                // either way, so this does not change which hooks are valid.
+                if (name_len == 4 &&
+                    static_cast<std::size_t>(i) + 4 <= wasm.size())
                 {
                     if (wasm[i] == 'h' && wasm[i + 1] == 'o' &&
                         wasm[i + 2] == 'o' && wasm[i + 3] == 'k')

include/xrpl/hook/Macro.h

@@ -89,58 +89,69 @@
 
 #define WASM_VAL_TYPE(T, b) CAT2(TYP_, T)
 
-#define DECLARE_HOOK_FUNCTION(R, F, ...)                         \
-    R F(hook::HookContext& hookCtx,                              \
-        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__( \
-            COMMA __VA_ARGS__));                                 \
-    extern WasmEdge_Result WasmFunction##F(                      \
-        void* data_ptr,                                          \
-        const WasmEdge_CallingFrameContext* frameCtx,            \
-        const WasmEdge_Value* in,                                \
-        WasmEdge_Value* out);                                    \
-    extern WasmEdge_ValType WasmFunctionParams##F[];             \
-    extern WasmEdge_ValType WasmFunctionResult##F[];             \
-    extern WasmEdge_FunctionTypeContext* WasmFunctionType##F;    \
+#define UNSIGNED_TYPE(T) std::make_unsigned_t<T>
+
+#define DECLARE_HOOK_FUNCTION(R, F, ...)                          \
+    std::variant<UNSIGNED_TYPE(R), hook_api::hook_return_code> F( \
+        hook::HookContext& hookCtx,                               \
+        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__(  \
+            COMMA __VA_ARGS__));                                  \
+    extern WasmEdge_Result WasmFunction##F(                       \
+        void* data_ptr,                                           \
+        const WasmEdge_CallingFrameContext* frameCtx,             \
+        const WasmEdge_Value* in,                                 \
+        WasmEdge_Value* out);                                     \
+    extern WasmEdge_ValType WasmFunctionParams##F[];              \
+    extern WasmEdge_ValType WasmFunctionResult##F[];              \
+    extern WasmEdge_FunctionTypeContext* WasmFunctionType##F;     \
     extern WasmEdge_String WasmFunctionName##F;
 
-#define DEFINE_HOOK_FUNCTION(R, F, ...)                             \
-    WasmEdge_Result hook_api::WasmFunction##F(                      \
-        void* data_ptr,                                             \
-        const WasmEdge_CallingFrameContext* frameCtx,               \
-        const WasmEdge_Value* in,                                   \
-        WasmEdge_Value* out)                                        \
-    {                                                               \
-        __VA_OPT__(int _stack = 0;)                                 \
-        __VA_OPT__(FOR_VARS(VAR_ASSIGN, 2, __VA_ARGS__);)           \
-        hook::HookContext* hookCtx =                                \
-            reinterpret_cast<hook::HookContext*>(data_ptr);         \
-        R return_code = hook_api::F(                                \
-            *hookCtx,                                               \
-            *const_cast<WasmEdge_CallingFrameContext*>(frameCtx)    \
-                __VA_OPT__(COMMA STRIP_TYPES(__VA_ARGS__)));        \
-        if (return_code == RC_ROLLBACK || return_code == RC_ACCEPT) \
-            return WasmEdge_Result_Terminate;                       \
-        out[0] = RET_ASSIGN(R, return_code);                        \
-        return WasmEdge_Result_Success;                             \
-    };                                                              \
-    WasmEdge_ValType hook_api::WasmFunctionParams##F[] = {          \
-        __VA_OPT__(FOR_VARS(WASM_VAL_TYPE, 0, __VA_ARGS__))};       \
-    WasmEdge_ValType hook_api::WasmFunctionResult##F[1] = {         \
-        WASM_VAL_TYPE(R, dummy)};                                   \
-    WasmEdge_FunctionTypeContext* hook_api::WasmFunctionType##F =   \
-        WasmEdge_FunctionTypeCreate(                                \
-            WasmFunctionParams##F,                                  \
-            VA_NARGS(NULL __VA_OPT__(, __VA_ARGS__)),               \
-            WasmFunctionResult##F,                                  \
-            1);                                                     \
-    WasmEdge_String hook_api::WasmFunctionName##F =                 \
-        WasmEdge_StringCreateByCString(#F);                         \
-    R hook_api::F(                                                  \
-        hook::HookContext& hookCtx,                                 \
-        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__(    \
+#define DEFINE_HOOK_FUNCTION(R, F, ...)                                        \
+    WasmEdge_Result hook_api::WasmFunction##F(                                 \
+        void* data_ptr,                                                        \
+        const WasmEdge_CallingFrameContext* frameCtx,                          \
+        const WasmEdge_Value* in,                                              \
+        WasmEdge_Value* out)                                                   \
+    {                                                                          \
+        __VA_OPT__(int _stack = 0;)                                            \
+        __VA_OPT__(FOR_VARS(VAR_ASSIGN, 2, __VA_ARGS__);)                      \
+        hook::HookContext* hookCtx =                                           \
+            reinterpret_cast<hook::HookContext*>(data_ptr);                    \
+        auto const& return_code = hook_api::F(                                 \
+            *hookCtx,                                                          \
+            *const_cast<WasmEdge_CallingFrameContext*>(frameCtx)               \
+                __VA_OPT__(COMMA STRIP_TYPES(__VA_ARGS__)));                   \
+        if (std::holds_alternative<hook_api::hook_return_code>(return_code) && \
+            (std::get<hook_api::hook_return_code>(return_code) ==              \
+                 RC_ROLLBACK ||                                                \
+             std::get<hook_api::hook_return_code>(return_code) == RC_ACCEPT))  \
+            return WasmEdge_Result_Terminate;                                  \
+        out[0] = RET_ASSIGN(                                                   \
+            R,                                                                 \
+            std::holds_alternative<UNSIGNED_TYPE(R)>(return_code)              \
+                ? std::get<UNSIGNED_TYPE(R)>(return_code)                      \
+                : R(std::get<hook_api::hook_return_code>(return_code)));       \
+        return WasmEdge_Result_Success;                                        \
+    };                                                                         \
+    WasmEdge_ValType hook_api::WasmFunctionParams##F[] = {                     \
+        __VA_OPT__(FOR_VARS(WASM_VAL_TYPE, 0, __VA_ARGS__))};                  \
+    WasmEdge_ValType hook_api::WasmFunctionResult##F[1] = {                    \
+        WASM_VAL_TYPE(R, dummy)};                                              \
+    WasmEdge_FunctionTypeContext* hook_api::WasmFunctionType##F =              \
+        WasmEdge_FunctionTypeCreate(                                           \
+            WasmFunctionParams##F,                                             \
+            VA_NARGS(NULL __VA_OPT__(, __VA_ARGS__)),                          \
+            WasmFunctionResult##F,                                             \
+            1);                                                                \
+    WasmEdge_String hook_api::WasmFunctionName##F =                            \
+        WasmEdge_StringCreateByCString(#F);                                    \
+    std::variant<UNSIGNED_TYPE(R), hook_api::hook_return_code> hook_api::F(    \
+        hook::HookContext& hookCtx,                                            \
+        WasmEdge_CallingFrameContext const& frameCtx __VA_OPT__(               \
             COMMA __VA_ARGS__))
 
 #define HOOK_SETUP()                                                 \
+    using enum hook_api::hook_return_code;                           \
     try                                                              \
     {                                                                \
         [[maybe_unused]] ApplyContext& applyCtx = hookCtx.applyCtx;  \
@@ -203,7 +214,7 @@
     host_memory_ptr,                  \
     guest_memory_length)              \
     {                                 \
-        int64_t bytes_written = 0;    \
+        uint64_t bytes_written = 0;   \
         WRITE_WASM_MEMORY(            \
             bytes_written,            \
             guest_dst_ptr,            \
@@ -233,7 +244,13 @@
                                << "Tried to accept/rollback but specified "    \
                                   "memory outside of the wasm instance "       \
                                << "limit when specifying a reason string";     \
-                return OUT_OF_BOUNDS;                                          \
+                if (!view.rules().enabled(fix20260929))                        \
+                    return OUT_OF_BOUNDS;                                      \
+                /* fix20260929: terminate as a rollback so the                 \
+                   failure is visible in HookExecution metadata */             \
+                hookCtx.result.exitType = hook_api::ExitType::ROLLBACK;        \
+                hookCtx.result.exitCode = (int64_t)OUT_OF_BOUNDS;              \
+                return RC_ROLLBACK;                                            \
             }                                                                  \
             /* assembly script and some other languages use utf16 for strings  \
              */                                                                \
@@ -272,7 +289,7 @@
             data_ptr < (data_ptr_in))                                    \
             return INTERNAL_ERROR;                                       \
         if (data_len == 0)                                               \
-            return 0;                                                    \
+            return 0ULL;                                                 \
         if ((write_ptr_in) == 0)                                         \
             return data_as_int64(data_ptr, data_len);                    \
         if (data_len > (write_len_in))                                   \

include/xrpl/hook/hook_api.macro

@@ -1,374 +1,309 @@
-// int32_t _g(uint32_t guard_id, uint32_t maxiter);
+// clang-format off
 HOOK_API_DEFINITION(
-  int32_t, _g, (uint32_t, uint32_t),
+  int32_t, _g, (uint32_t guard_id, uint32_t maxiter),
   uint256{})
 
-// int64_t accept(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
 HOOK_API_DEFINITION(
-  int64_t, accept, (uint32_t, uint32_t, int64_t),
+  int64_t, accept, (uint32_t read_ptr, uint32_t read_len, int64_t error_code),
   uint256{})
 
-// int64_t rollback(uint32_t read_ptr, uint32_t read_len, int64_t error_code);
 HOOK_API_DEFINITION(
-  int64_t, rollback, (uint32_t, uint32_t, int64_t),
+  int64_t, rollback, (uint32_t read_ptr, uint32_t read_len, int64_t error_code),
   uint256{})
 
-// int64_t util_raddr(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, util_raddr, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_raddr, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t util_accid(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, util_accid, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_accid, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t util_verify(uint32_t dread_ptr, uint32_t dread_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t kread_ptr, uint32_t kread_len);
 HOOK_API_DEFINITION(
-  int64_t, util_verify, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_verify, (uint32_t dread_ptr, uint32_t dread_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t kread_ptr, uint32_t kread_len),
   uint256{})
 
-// int64_t util_sha512h(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, util_sha512h, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_sha512h, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t util_keylet(uint32_t write_ptr, uint32_t write_len, uint32_t keylet_type, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f);
 HOOK_API_DEFINITION(
-  int64_t, util_keylet, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, util_keylet, (uint32_t write_ptr, uint32_t write_len, uint32_t keylet_type, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f),
   uint256{})
 
-// int64_t sto_validate(uint32_t tread_ptr, uint32_t tread_len);
 HOOK_API_DEFINITION(
-  int64_t, sto_validate, (uint32_t, uint32_t),
+  int64_t, sto_validate, (uint32_t tread_ptr, uint32_t tread_len),
   uint256{})
 
-// int64_t sto_subfield(uint32_t read_ptr, uint32_t read_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_subfield, (uint32_t, uint32_t, uint32_t),
+  int64_t, sto_subfield, (uint32_t read_ptr, uint32_t read_len, uint32_t field_id),
   uint256{})
 
-// int64_t sto_subarray(uint32_t read_ptr, uint32_t read_len, uint32_t array_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_subarray, (uint32_t, uint32_t, uint32_t),
+  int64_t, sto_subarray, (uint32_t read_ptr, uint32_t read_len, uint32_t array_id),
   uint256{})
 
-// int64_t sto_emplace(uint32_t write_ptr, uint32_t write_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t fread_ptr, uint32_t fread_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_emplace, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, sto_emplace, (uint32_t write_ptr, uint32_t write_len, uint32_t sread_ptr, uint32_t sread_len, uint32_t fread_ptr, uint32_t fread_len, uint32_t field_id),
   uint256{})
 
-// int64_t sto_erase(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, sto_erase, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, sto_erase, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len, uint32_t field_id),
   uint256{})
 
-// int64_t etxn_burden();
 HOOK_API_DEFINITION(
   int64_t, etxn_burden, (),
   uint256{})
 
-// int64_t etxn_details(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, etxn_details, (uint32_t, uint32_t),
+  int64_t, etxn_details, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t etxn_fee_base(uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, etxn_fee_base, (uint32_t, uint32_t),
+  int64_t, etxn_fee_base, (uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t etxn_reserve(uint32_t count);
 HOOK_API_DEFINITION(
-  int64_t, etxn_reserve, (uint32_t),
+  int64_t, etxn_reserve, (uint32_t count),
   uint256{})
 
-// int64_t etxn_generation();
 HOOK_API_DEFINITION(
   int64_t, etxn_generation, (),
   uint256{})
 
-// int64_t etxn_nonce(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, etxn_nonce, (uint32_t, uint32_t),
+  int64_t, etxn_nonce, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t emit(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, emit, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, emit, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t float_set(int32_t exponent, int64_t mantissa);
 HOOK_API_DEFINITION(
-  int64_t, float_set, (int32_t, int64_t),
+  int64_t, float_set, (int32_t exponent, int64_t mantissa),
   uint256{})
 
-// int64_t float_multiply(int64_t float1, int64_t float2);
 HOOK_API_DEFINITION(
-  int64_t, float_multiply, (int64_t, int64_t),
+  int64_t, float_multiply, (int64_t float1, int64_t float2),
   uint256{})
 
-// int64_t float_mulratio(int64_t float1, uint32_t round_up, uint32_t numerator, uint32_t denominator);
 HOOK_API_DEFINITION(
-  int64_t, float_mulratio, (int64_t, uint32_t, uint32_t, uint32_t),
+  int64_t, float_mulratio, (int64_t float1, uint32_t round_up, uint32_t numerator, uint32_t denominator),
   uint256{})
 
-// int64_t float_negate(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_negate, (int64_t),
+  int64_t, float_negate, (int64_t float1),
   uint256{})
 
-// int64_t float_compare(int64_t float1, int64_t float2, uint32_t mode);
 HOOK_API_DEFINITION(
-  int64_t, float_compare, (int64_t, int64_t, uint32_t),
+  int64_t, float_compare, (int64_t float1, int64_t float2, uint32_t mode),
   uint256{})
 
-// int64_t float_sum(int64_t float1, int64_t float2);
 HOOK_API_DEFINITION(
-  int64_t, float_sum, (int64_t, int64_t),
+  int64_t, float_sum, (int64_t float1, int64_t float2),
   uint256{})
 
-// int64_t float_sto(uint32_t write_ptr, uint32_t write_len, uint32_t cread_ptr, uint32_t cread_len, uint32_t iread_ptr, uint32_t iread_len, int64_t float1, uint32_t field_code);
 HOOK_API_DEFINITION(
-  int64_t, float_sto, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, int64_t, uint32_t),
+  int64_t, float_sto, (uint32_t write_ptr, uint32_t write_len, uint32_t cread_ptr, uint32_t cread_len, uint32_t iread_ptr, uint32_t iread_len, int64_t float1, uint32_t field_code),
   uint256{})
 
-// int64_t float_sto_set(uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, float_sto_set, (uint32_t, uint32_t),
+  int64_t, float_sto_set, (uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t float_invert(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_invert, (int64_t),
+  int64_t, float_invert, (int64_t float1),
   uint256{})
 
-// int64_t float_divide(int64_t float1, int64_t float2);
 HOOK_API_DEFINITION(
-  int64_t, float_divide, (int64_t, int64_t),
+  int64_t, float_divide, (int64_t float1, int64_t float2),
   uint256{})
 
-// int64_t float_one();
 HOOK_API_DEFINITION(
   int64_t, float_one, (),
   uint256{})
 
-// int64_t float_mantissa(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_mantissa, (int64_t),
+  int64_t, float_mantissa, (int64_t float1),
   uint256{})
 
-// int64_t float_sign(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_sign, (int64_t),
+  int64_t, float_sign, (int64_t float1),
   uint256{})
 
-// int64_t float_int(int64_t float1, uint32_t decimal_places, uint32_t abs);
 HOOK_API_DEFINITION(
-  int64_t, float_int, (int64_t, uint32_t, uint32_t),
+  int64_t, float_int, (int64_t float1, uint32_t decimal_places, uint32_t abs),
   uint256{})
 
-// int64_t float_log(int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, float_log, (int64_t),
+  int64_t, float_log, (int64_t float1),
   uint256{})
 
-// int64_t float_root(int64_t float1, uint32_t n);
 HOOK_API_DEFINITION(
-  int64_t, float_root, (int64_t, uint32_t),
+  int64_t, float_root, (int64_t float1, uint32_t n),
   uint256{})
 
-// int64_t fee_base();
 HOOK_API_DEFINITION(
   int64_t, fee_base, (),
   uint256{})
 
-// int64_t ledger_seq();
 HOOK_API_DEFINITION(
   int64_t, ledger_seq, (),
   uint256{})
 
-// int64_t ledger_last_time();
 HOOK_API_DEFINITION(
   int64_t, ledger_last_time, (),
   uint256{})
 
-// int64_t ledger_last_hash(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, ledger_last_hash, (uint32_t, uint32_t),
+  int64_t, ledger_last_hash, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t ledger_nonce(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, ledger_nonce, (uint32_t, uint32_t),
+  int64_t, ledger_nonce, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t ledger_keylet(uint32_t write_ptr, uint32_t write_len, uint32_t lread_ptr, uint32_t lread_len, uint32_t hread_ptr, uint32_t hread_len);
 HOOK_API_DEFINITION(
-  int64_t, ledger_keylet, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, ledger_keylet, (uint32_t write_ptr, uint32_t write_len, uint32_t lread_ptr, uint32_t lread_len, uint32_t hread_ptr, uint32_t hread_len),
   uint256{})
 
-// int64_t hook_account(uint32_t write_ptr, uint32_t write_len);
 HOOK_API_DEFINITION(
-  int64_t, hook_account, (uint32_t, uint32_t),
+  int64_t, hook_account, (uint32_t write_ptr, uint32_t write_len),
   uint256{})
 
-// int64_t hook_hash(uint32_t write_ptr, uint32_t write_len, int32_t hook_no);
 HOOK_API_DEFINITION(
-  int64_t, hook_hash, (uint32_t, uint32_t, int32_t),
+  int64_t, hook_hash, (uint32_t write_ptr, uint32_t write_len, int32_t hook_no),
   uint256{})
 
-// int64_t hook_param_set(uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t hread_ptr, uint32_t hread_len);
 HOOK_API_DEFINITION(
-  int64_t, hook_param_set, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, hook_param_set, (uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t hread_ptr, uint32_t hread_len),
   uint256{})
 
-// int64_t hook_param(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, hook_param, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, hook_param, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t hook_again();
 HOOK_API_DEFINITION(
   int64_t, hook_again, (),
   uint256{})
 
-// int64_t hook_skip(uint32_t read_ptr, uint32_t read_len, uint32_t flags);
 HOOK_API_DEFINITION(
-  int64_t, hook_skip, (uint32_t, uint32_t, uint32_t),
+  int64_t, hook_skip, (uint32_t read_ptr, uint32_t read_len, uint32_t flags),
   uint256{})
 
-// int64_t hook_pos();
 HOOK_API_DEFINITION(
   int64_t, hook_pos, (),
   uint256{})
 
-// int64_t slot(uint32_t write_ptr, uint32_t write_len, uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot, (uint32_t write_ptr, uint32_t write_len, uint32_t slot),
   uint256{})
 
-// int64_t slot_clear(uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_clear, (uint32_t),
+  int64_t, slot_clear, (uint32_t slot),
   uint256{})
 
-// int64_t slot_count(uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_count, (uint32_t),
+  int64_t, slot_count, (uint32_t slot),
   uint256{})
 
-// int64_t slot_set(uint32_t read_ptr, uint32_t read_len, uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_set, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot_set, (uint32_t read_ptr, uint32_t read_len, uint32_t slot),
   uint256{})
 
-// int64_t slot_size(uint32_t slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_size, (uint32_t),
+  int64_t, slot_size, (uint32_t slot),
   uint256{})
 
-// int64_t slot_subarray(uint32_t parent_slot, uint32_t array_id, uint32_t new_slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_subarray, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot_subarray, (uint32_t parent_slot, uint32_t array_id, uint32_t new_slot),
   uint256{})
 
-// int64_t slot_subfield(uint32_t parent_slot, uint32_t field_id, uint32_t new_slot);
 HOOK_API_DEFINITION(
-  int64_t, slot_subfield, (uint32_t, uint32_t, uint32_t),
+  int64_t, slot_subfield, (uint32_t parent_slot, uint32_t field_id, uint32_t new_slot),
   uint256{})
 
-// int64_t slot_type(uint32_t slot_no, uint32_t flags);
 HOOK_API_DEFINITION(
-  int64_t, slot_type, (uint32_t, uint32_t),
+  int64_t, slot_type, (uint32_t slot_no, uint32_t flags),
   uint256{})
 
-// int64_t slot_float(uint32_t slot_no);
 HOOK_API_DEFINITION(
-  int64_t, slot_float, (uint32_t),
+  int64_t, slot_float, (uint32_t slot_no),
   uint256{})
 
-// int64_t state_set(uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len);
 HOOK_API_DEFINITION(
-  int64_t, state_set, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state_set, (uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len),
   uint256{})
 
-// int64_t state_foreign_set(uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len);
 HOOK_API_DEFINITION(
-  int64_t, state_foreign_set, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state_foreign_set, (uint32_t read_ptr, uint32_t read_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len),
   uint256{})
 
-// int64_t state(uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len);
 HOOK_API_DEFINITION(
-  int64_t, state, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state, (uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len),
   uint256{})
 
-// int64_t state_foreign(uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len);
 HOOK_API_DEFINITION(
-  int64_t, state_foreign, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, state_foreign, (uint32_t write_ptr, uint32_t write_len, uint32_t kread_ptr, uint32_t kread_len, uint32_t nread_ptr, uint32_t nread_len, uint32_t aread_ptr, uint32_t aread_len),
   uint256{})
 
-// int64_t trace(uint32_t mread_ptr, uint32_t mread_len, uint32_t dread_ptr, uint32_t dread_len, uint32_t as_hex);
 HOOK_API_DEFINITION(
-  int64_t, trace, (uint32_t, uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, trace, (uint32_t mread_ptr, uint32_t mread_len, uint32_t dread_ptr, uint32_t dread_len, uint32_t as_hex),
   uint256{})
 
-// int64_t trace_num(uint32_t read_ptr, uint32_t read_len, int64_t number);
 HOOK_API_DEFINITION(
-  int64_t, trace_num, (uint32_t, uint32_t, int64_t),
+  int64_t, trace_num, (uint32_t read_ptr, uint32_t read_len, int64_t number),
   uint256{})
 
-// int64_t trace_float(uint32_t read_ptr, uint32_t read_len, int64_t float1);
 HOOK_API_DEFINITION(
-  int64_t, trace_float, (uint32_t, uint32_t, int64_t),
+  int64_t, trace_float, (uint32_t read_ptr, uint32_t read_len, int64_t float1),
   uint256{})
 
-// int64_t otxn_burden();
 HOOK_API_DEFINITION(
   int64_t, otxn_burden, (),
   uint256{})
 
-// int64_t otxn_field(uint32_t write_ptr, uint32_t write_len, uint32_t field_id);
 HOOK_API_DEFINITION(
-  int64_t, otxn_field, (uint32_t, uint32_t, uint32_t),
+  int64_t, otxn_field, (uint32_t write_ptr, uint32_t write_len, uint32_t field_id),
   uint256{})
 
-// int64_t otxn_generation();
 HOOK_API_DEFINITION(
   int64_t, otxn_generation, (),
   uint256{})
 
-// int64_t otxn_id(uint32_t write_ptr, uint32_t write_len, uint32_t flags);
 HOOK_API_DEFINITION(
-  int64_t, otxn_id, (uint32_t, uint32_t, uint32_t),
+  int64_t, otxn_id, (uint32_t write_ptr, uint32_t write_len, uint32_t flags),
   uint256{})
 
-// int64_t otxn_type();
 HOOK_API_DEFINITION(
   int64_t, otxn_type, (),
   uint256{})
 
-// int64_t otxn_slot(uint32_t slot_no);
 HOOK_API_DEFINITION(
-  int64_t, otxn_slot, (uint32_t),
+  int64_t, otxn_slot, (uint32_t slot_no),
   uint256{})
 
-// int64_t otxn_param(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, otxn_param, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, otxn_param, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   uint256{})
 
-// int64_t meta_slot(uint32_t slot_no);
 HOOK_API_DEFINITION(
-  int64_t, meta_slot, (uint32_t),
+  int64_t, meta_slot, (uint32_t slot_no),
   uint256{})
 
-// int64_t xpop_slot(uint32_t slot_no_tx, uint32_t slot_no_meta);
 HOOK_API_DEFINITION(
-  int64_t, xpop_slot, (uint32_t, uint32_t),
+  int64_t, xpop_slot, (uint32_t slot_no_tx, uint32_t slot_no_meta),
   featureHooksUpdate1)
 
-// int64_t prepare(uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len);
 HOOK_API_DEFINITION(
-  int64_t, prepare, (uint32_t, uint32_t, uint32_t, uint32_t),
+  int64_t, prepare, (uint32_t write_ptr, uint32_t write_len, uint32_t read_ptr, uint32_t read_len),
   featureHooksUpdate2)
+
+HOOK_API_DEFINITION(
+  int64_t, dice, (uint32_t sides),
+  featureRNG)
+
+HOOK_API_DEFINITION(
+  int64_t, util_random, (uint32_t write_ptr, uint32_t write_len),
+  featureRNG)
+// clang-format on

include/xrpl/json/json_reader.h

@@ -215,7 +215,7 @@ Reader::parse(Value& root, BufferSequence const& bs)
     std::string s;
     s.reserve(buffer_size(bs));
     for (auto const& b : bs)
-        s.append(buffer_cast<char const*>(b), buffer_size(b));
+        s.append(static_cast<char const*>(b.data()), buffer_size(b));
     return parse(s, root);
 }
 

include/xrpl/protocol/AppLoader.h

@@ -0,0 +1,66 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_PROTOCOL_APPLOADER_H_INCLUDED
+#define RIPPLE_PROTOCOL_APPLOADER_H_INCLUDED
+
+#include <cstddef>
+#include <cstdint>
+
+namespace ripple {
+
+/** Validation of an AppLoader document (sfAppLoader), the bootstrap page of
+    a Progressive Web App served from an account.
+
+    Consensus cannot afford a real HTML parser, so this is a shallow sanity
+    gate and nothing more. A document must be non-empty and at most
+    maxAppLoaderLength bytes; well-formed UTF-8; free of C0 control
+    characters other than TAB, LF, FF and CR, and of DEL; begin, after an
+    optional BOM and whitespace, with an HTML doctype or an <html start tag;
+    and contain an <html start tag followed later by a </html> end tag with
+    nothing but whitespace after the last one. Nothing parses comments,
+    scripts or attributes, and content is not policed.
+
+    Consensus critical: a change to what it accepts needs an amendment.
+*/
+namespace appLoader {
+
+enum class Result : std::uint8_t {
+    ok = 0,
+    empty,
+    tooLarge,
+    badUTF8,
+    badControlChar,
+    noDoctype,        // does not open with a doctype or <html tag
+    noHtmlElement,    // no <html start tag
+    unclosed,         // no </html> end tag after it
+    trailingGarbage,  // non-whitespace after the last </html>
+};
+
+/** Total: every input yields a result. `data` may be null iff size is 0. */
+Result
+validate(std::uint8_t const* data, std::size_t size);
+
+char const*
+to_string(Result r);
+
+}  // namespace appLoader
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/Feature.h

@@ -33,35 +33,39 @@
  *
  * Steps required to add new features to the code:
  *
- * 1) In this file, increment `numFeatures` and add a uint256 declaration
- *    for the feature at the bottom
- * 2) Add a uint256 definition for the feature to the corresponding source
- *    file (Feature.cpp). Use `registerFeature` to create the feature with
- *    the feature's name, `Supported::no`, and `VoteBehavior::DefaultNo`. This
- *    should be the only place the feature's name appears in code as a string.
- * 3) Use the uint256 as the parameter to `view.rules.enabled()` to
- *    control flow into new code that this feature limits.
- * 4) If the feature development is COMPLETE, and the feature is ready to be
- *    SUPPORTED, change the `registerFeature` parameter to Supported::yes.
- * 5) When the feature is ready to be ENABLED, change the `registerFeature`
- *    parameter to `VoteBehavior::DefaultYes`.
- * In general, any newly supported amendments (`Supported::yes`) should have
- * a `VoteBehavior::DefaultNo` for at least one full release cycle. High
- * priority bug fixes can be an exception to this rule of thumb.
+ * 1) Add the appropriate XRPL_FEATURE or XRPL_FIX macro definition for the
+ *    feature to features.macro with the feature's name, `Supported::no`, and
+ *    `VoteBehavior::DefaultNo`.
+ *
+ * 2) Use the generated variable name as the parameter to `view.rules.enabled()`
+ *    to control flow into new code that this feature limits. (featureName or
+ *    fixName)
+ *
+ * 3) If the feature development is COMPLETE, and the feature is ready to be
+ *    SUPPORTED, change the macro parameter in features.macro to Supported::yes.
+ *
+ * 4) In general, any newly supported amendments (`Supported::yes`) should have
+ *    a `VoteBehavior::DefaultNo` indefinitely so that external governance can
+ *    make the decision on when to activate it. High priority bug fixes can be
+ *    an exception to this rule. In such cases, ensure the fix has been
+ *    clearly communicated to the community using appropriate channels,
+ *    then change the macro parameter in features.macro to
+ *    `VoteBehavior::DefaultYes`. The communication process is beyond
+ *    the scope of these instructions.
+ *
  *
  * When a feature has been enabled for several years, the conditional code
  * may be removed, and the feature "retired". To retire a feature:
- * 1) Remove the uint256 declaration from this file.
- * 2) MOVE the uint256 definition in Feature.cpp to the "retired features"
- *    section at the end of the file.
- * 3) CHANGE the name of the variable to start with "retired".
- * 4) CHANGE the parameters of the `registerFeature` call to `Supported::yes`
- *    and `VoteBehavior::DefaultNo`.
+ *
+ * 1) MOVE the macro definition in features.macro to the "retired features"
+ *    section at the end of the file, and change the macro to XRPL_RETIRE.
+ *
  * The feature must remain registered and supported indefinitely because it
- * still exists in the ledger, but there is no need to vote for it because
- * there's nothing to vote for. If it is removed completely from the code, any
- * instances running that code will get amendment blocked. Removing the
- * feature from the ledger is beyond the scope of these instructions.
+ * may exist in the Amendments object on ledger. There is no need to vote
+ * for it because there's nothing to vote for. If the feature definition is
+ * removed completely from the code, any instances running that code will get
+ * amendment blocked. Removing the feature from the ledger is beyond the scope
+ * of these instructions.
  *
  */
 
@@ -76,11 +80,32 @@ allAmendments();
 
 namespace detail {
 
+#pragma push_macro("XRPL_FEATURE")
+#undef XRPL_FEATURE
+#pragma push_macro("XRPL_FIX")
+#undef XRPL_FIX
+#pragma push_macro("XRPL_RETIRE")
+#undef XRPL_RETIRE
+
+#define XRPL_FEATURE(name, supported, vote) +1
+#define XRPL_FIX(name, supported, vote) +1
+#define XRPL_RETIRE(name) +1
+
 // This value SHOULD be equal to the number of amendments registered in
 // Feature.cpp. Because it's only used to reserve storage, and determine how
 // large to make the FeatureBitset, it MAY be larger. It MUST NOT be less than
 // the actual number of amendments. A LogicError on startup will verify this.
-static constexpr std::size_t numFeatures = 113;
+static constexpr std::size_t numFeatures =
+    (0 +
+#include <xrpl/protocol/detail/features.macro>
+    );
+
+#undef XRPL_RETIRE
+#pragma pop_macro("XRPL_RETIRE")
+#undef XRPL_FIX
+#pragma pop_macro("XRPL_FIX")
+#undef XRPL_FEATURE
+#pragma pop_macro("XRPL_FEATURE")
 
 /** Amendments that this server supports and the default voting behavior.
    Whether they are enabled depends on the Rules defined in the validated
@@ -320,12 +345,17 @@ foreachFeature(FeatureBitset bs, F&& f)
 #undef XRPL_FEATURE
 #pragma push_macro("XRPL_FIX")
 #undef XRPL_FIX
+#pragma push_macro("XRPL_RETIRE")
+#undef XRPL_RETIRE
 
 #define XRPL_FEATURE(name, supported, vote) extern uint256 const feature##name;
 #define XRPL_FIX(name, supported, vote) extern uint256 const fix##name;
+#define XRPL_RETIRE(name)
 
 #include <xrpl/protocol/detail/features.macro>
 
+#undef XRPL_RETIRE
+#pragma pop_macro("XRPL_RETIRE")
 #undef XRPL_FIX
 #pragma pop_macro("XRPL_FIX")
 #undef XRPL_FEATURE

include/xrpl/protocol/Import.h

@@ -24,6 +24,7 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/basics/base64.h>
+#include <xrpl/basics/chrono.h>
 #include <xrpl/json/json_reader.h>
 #include <charconv>
 
@@ -118,8 +119,9 @@ syntaxCheckProof(
         {
             if (!proof["hash"].isString() ||
                 proof["hash"].asString().size() != 64 ||
-                !proof["key"].isString() ||
+                !isHex(proof["hash"].asString()) || !proof["key"].isString() ||
                 proof["key"].asString().size() != 64 ||
+                !isHex(proof["key"].asString()) ||
                 !proof["children"].isObject())
             {
                 JLOG(j.warn()) << "XPOP.transaction.proof tree node has wrong "
@@ -132,7 +134,11 @@ syntaxCheckProof(
 
         for (const auto& branch : proof.getMemberNames())
         {
-            if (branch.size() != 1 || !isHex(branch))
+            // Upper case only: the txroot computation only looks up "0"-"F",
+            // so any other key would be silently ignored.
+            if (branch.size() != 1 ||
+                branch.find_first_not_of("0123456789ABCDEF") !=
+                    std::string::npos)
             {
                 JLOG(j.warn())
                     << "XPOP.transaction.proof child node was not 0-F "
@@ -143,9 +149,9 @@ syntaxCheckProof(
             const auto& node = proof[branch];
             if (!node.isObject() || !node["hash"].isString() ||
                 node["hash"].asString().size() != 64 ||
-                !node["key"].isString() ||
+                !isHex(node["hash"].asString()) || !node["key"].isString() ||
                 node["key"].asString().size() != 64 ||
-                !node["children"].isObject())
+                !isHex(node["key"].asString()) || !node["children"].isObject())
             {
                 JLOG(j.warn())
                     << "XPOP.transaction.proof tree node has wrong format";
@@ -465,6 +471,45 @@ getVLInfo(Json::Value const& xpop, beast::Journal const& j)
     return {{sequence, m->masterKey}};
 }
 
+// <effective, expiration> of the unl blob, effective defaulting to the epoch
+inline std::optional<std::pair<NetClock::time_point, NetClock::time_point>>
+getVLWindow(Json::Value const& xpop, beast::Journal const& j)
+{
+    auto const data =
+        base64_decode(xpop[jss::validation][jss::unl][jss::blob].asString());
+    Json::Reader r;
+    Json::Value parsed;
+    if (!r.parse(data, parsed) || !parsed.isObject())
+    {
+        JLOG(j.warn()) << "Import: unl blob was not a json object (after "
+                          "base64 decoding)";
+        return {};
+    }
+
+    // const, so that operator[] does not insert missing members
+    Json::Value const& list = parsed;
+    auto const time = [&list](Json::StaticString const& field)
+        -> std::optional<NetClock::time_point> {
+        auto const& v = list[field];
+        if (!v.isInt() || v.asInt() < 0)
+            return {};
+        return NetClock::time_point{NetClock::duration{v.asUInt()}};
+    };
+
+    auto const validUntil = time(jss::expiration);
+    auto const validFrom = list.isMember(jss::effective)
+        ? time(jss::effective)
+        : std::optional<NetClock::time_point>{NetClock::time_point{}};
+    if (!validUntil || !validFrom)
+    {
+        JLOG(j.warn()) << "Import: unl blob json (after base64 decoding) "
+                          "had missing or invalid effective/expiration";
+        return {};
+    }
+
+    return {{*validFrom, *validUntil}};
+}
+
 }  // namespace ripple
 
 #endif

include/xrpl/protocol/Indexes.h

@@ -118,6 +118,10 @@ negativeUNL() noexcept;
 Keylet const&
 UNLReport() noexcept;
 
+/** The (fixed) index of the featureRNG random number generator object. */
+Keylet const&
+random() noexcept;
+
 /** The beginning of an order book */
 struct book_t
 {
@@ -328,6 +332,14 @@ xChainCreateAccountClaimID(STXChainBridge const& bridge, std::uint64_t seq);
 Keylet
 did(AccountID const& account) noexcept;
 
+/** An AppLoader belonging to an account.
+
+    There is at most one per account, so the key is derived from the owner's
+    AccountID alone.
+*/
+Keylet
+appLoader(AccountID const& account) noexcept;
+
 Keylet
 oracle(AccountID const& account, std::uint32_t const& documentID) noexcept;
 
@@ -372,6 +384,20 @@ permissionedDomain(AccountID const& account, std::uint32_t seq) noexcept;
 
 Keylet
 permissionedDomain(uint256 const& domainID) noexcept;
+
+Keylet
+manifest(PublicKey const& pk) noexcept;
+
+/** The directory listing every master key's ltMANIFEST object.
+
+    One entry per master key, made when its first manifest is published and
+    kept for good: a newer manifest, a revocation included, replaces the object
+    at the same key and keeps its place. The copy at the ephemeral key is not
+    listed; it is named by the master object.
+*/
+Keylet const&
+manifestDir() noexcept;
+
 }  // namespace keylet
 
 // Everything below is deprecated and should be removed in favor of keylets:
@@ -402,7 +428,7 @@ struct keyletDesc
 
 // This list should include all of the keylet functions that take a single
 // AccountID parameter.
-std::array<keyletDesc<AccountID const&>, 6> const directAccountKeylets{
+std::array<keyletDesc<AccountID const&>, 7> const directAccountKeylets{
     {{&keylet::account, jss::AccountRoot, false},
      {&keylet::ownerDir, jss::DirectoryNode, true},
      {&keylet::signers, jss::SignerList, true},
@@ -410,7 +436,8 @@ std::array<keyletDesc<AccountID const&>, 6> const directAccountKeylets{
      // test it anyway, since the invariant checks for it.
      {&keylet::nftpage_min, jss::NFTokenPage, true},
      {&keylet::nftpage_max, jss::NFTokenPage, true},
-     {&keylet::did, jss::DID, true}}};
+     {&keylet::did, jss::DID, true},
+     {&keylet::appLoader, jss::AppLoader, true}}};
 
 MPTID
 makeMptID(std::uint32_t sequence, AccountID const& account);

include/xrpl/protocol/Protocol.h

@@ -96,6 +96,25 @@ std::size_t constexpr maxDIDAttestationLength = 256;
 /** The maximum length of a domain */
 std::size_t constexpr maxDomainLength = 256;
 
+/** The maximum length of an AppLoader document.
+
+    The AppLoader holds the bootstrap document of a Progressive Web App
+    served from an account. It is deliberately capped: the blob lives in a
+    ledger object that carries no owner reserve at all, so the only things
+    standing between it and unbounded ledger growth are this limit and the
+    per-byte transaction fee below.
+*/
+std::size_t constexpr maxAppLoaderLength = 4096;
+
+/** Drops of transaction fee charged per byte of AppLoader document.
+
+    Storage is paid for through the fee rather than through an owner
+    reserve, so that a loader can be published by an account sitting at its
+    reserve floor. The fee is charged on every AccountSet that carries the
+    field, including overwrites.
+*/
+std::uint64_t constexpr appLoaderFeeDropsPerByte = 1;
+
 /** The maximum length of a URI inside a Credential */
 std::size_t constexpr maxCredentialURILength = 256;
 

include/xrpl/protocol/TER.h

@@ -69,6 +69,7 @@ enum TELcodes : TERUnderlyingType {
     telIMPORT_VL_KEY_NOT_RECOGNISED,
     telCAN_NOT_QUEUE_IMPORT,
     telENV_RPC_FAILED,
+    telMANIFEST_FEE_MISMATCH,
 };
 
 //------------------------------------------------------------------------------
@@ -137,6 +138,7 @@ enum TEMcodes : TERUnderlyingType {
     temXCHAIN_BRIDGE_NONDOOR_OWNER,
     temXCHAIN_BRIDGE_BAD_MIN_ACCOUNT_CREATE_AMOUNT,
     temXCHAIN_BRIDGE_BAD_REWARD_AMOUNT,
+    temXCHAIN_TOO_MANY_ATTESTATIONS,  // RESERVED - not used
 
     temHOOK_DATA_TOO_LARGE,
     temEMPTY_DID,
@@ -193,6 +195,9 @@ enum TEFcodes : TERUnderlyingType {
     tefNONDIR_EMIT,
     tefIMPORT_BLACKHOLED,
     tefINVALID_LEDGER_FIX_TYPE,
+    tefPAST_MANIFEST_SEQ,
+    tefREVOKED_MANIFEST,
+    tefMANIFEST_KEY_IN_USE,
 };
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/TxFlags.h

@@ -132,7 +132,7 @@ constexpr std::uint32_t tfTrustSetMask =
       tfClearFreeze | tfSetDeepFreeze | tfClearDeepFreeze);
 
 // EnableAmendment flags:
-enum EnableAmendmentFlags : std::uint32_t {
+enum EnableAmendmentFlags : uint32_t {
     tfGotMajority = 0x00010000,
     tfLostMajority = 0x00020000,
     tfTestSuite = 0x80000000,

include/xrpl/protocol/TxMeta.h

@@ -152,6 +152,26 @@ public:
         return static_cast<bool>(mHookEmissions);
     }
 
+    /** featureRNG: the RNG state this transaction's first Hook draw saw.
+        Every value the transaction's Hooks drew is derived from it. */
+    void
+    setRandomData(uint256 const& randomData)
+    {
+        mRandomData = randomData;
+    }
+
+    bool
+    hasRandomData() const
+    {
+        return static_cast<bool>(mRandomData);
+    }
+
+    uint256 const&
+    getRandomData() const
+    {
+        return *mRandomData;
+    }
+
     STAmount
     getDeliveredAmount() const
     {
@@ -176,6 +196,7 @@ private:
     std::optional<STAmount> mDelivered;
     std::optional<STArray> mHookExecutions;
     std::optional<STArray> mHookEmissions;
+    std::optional<uint256> mRandomData;
 
     STArray mNodes;
 };

include/xrpl/protocol/detail/features.macro

@@ -23,6 +23,9 @@
 #if !defined(XRPL_FIX)
 #error "undefined macro: XRPL_FIX"
 #endif
+#if !defined(XRPL_RETIRE)
+#error "undefined macro: XRPL_RETIRE"
+#endif
 
 // clang-format off
 
@@ -31,11 +34,24 @@
 // If you add an amendment here, then do not forget to increment `numFeatures`
 // in include/xrpl/protocol/Feature.h.
 
+XRPL_FEATURE(RNG,                        Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(PWALoader,                  Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (20261005,                   Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(EscrowDestinationCancel,    Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (20260929,                   Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(HookOnV2_1,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(OnChainManifests,           Supported::yes,  VoteBehavior::DefaultNo)
+XRPL_FIX    (HookMap,                    Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FIX    (GuardDepth32,               Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(NamedHooks,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(IOURewardClaim,             Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (IOULockedBalanceInvariant,  Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (ImportIssuer,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(HookAPISerializedType240,   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(PermissionedDomains,        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(DynamicNFT,                 Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(Credentials,                Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(AMMClawback,                Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(AMMClawback,                Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(MPTokensV1,                 Supported::no,  VoteBehavior::DefaultNo)
 // InvariantsV1_1 will be changes to Supported::yes when all the
 // invariants expected to be included under it are complete.
@@ -52,18 +68,19 @@ XRPL_FIX    (FillOrKill,                 Supported::yes, VoteBehavior::DefaultYe
 XRPL_FEATURE(DID,                        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (DisallowIncomingV1,         Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(XChainBridge,               Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(AMM,                        Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(AMM,                        Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (ReducedOffersV1,            Supported::yes, VoteBehavior::DefaultYes)
-XRPL_FEATURE(HooksUpdate2,               Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FEATURE(HookOnV2,                   Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FIX    (HookAPI20251128,            Supported::yes, VoteBehavior::DefaultYes);
-XRPL_FIX    (CronStacking,               Supported::yes, VoteBehavior::DefaultYes);
-XRPL_FEATURE(ExtendedHookState,          Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FIX    (InvalidTxFlags,             Supported::yes, VoteBehavior::DefaultYes);
-XRPL_FEATURE(Cron,                       Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FEATURE(IOUIssuerWeakTSH,           Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FEATURE(DeepFreeze,                 Supported::yes, VoteBehavior::DefaultNo);
-XRPL_FIX    (ProvisionalDoubleThreading, Supported::yes, VoteBehavior::DefaultYes);
+XRPL_FEATURE(HooksUpdate2,               Supported::yes, VoteBehavior::DefaultNo)
+// replaced to HookOnV2_1
+XRPL_FEATURE(HookOnV2,                   Supported::no,  VoteBehavior::DefaultNo)
+XRPL_FIX    (HookAPI20251128,            Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FIX    (CronStacking,               Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(ExtendedHookState,          Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (InvalidTxFlags,             Supported::yes, VoteBehavior::DefaultYes)
+XRPL_FEATURE(Cron,                       Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(IOUIssuerWeakTSH,           Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(DeepFreeze,                 Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FIX    (ProvisionalDoubleThreading, Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(Clawback,                   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (RewardClaimFlags,           Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(HookCanEmit,                Supported::yes, VoteBehavior::DefaultNo)
@@ -73,14 +90,11 @@ XRPL_FIX    (ReduceImport,               Supported::yes, VoteBehavior::DefaultYe
 XRPL_FEATURE(Touch,                      Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Remarks,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (FloatDivide,                Supported::yes, VoteBehavior::DefaultYes)
-XRPL_FIX    (240911,                     Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (PageCap,                    Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (240819,                     Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FIX    (NSDelete,                   Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(ZeroB2M,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Remit,                      Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (XahauV2,                    Supported::yes, VoteBehavior::DefaultNo)
-XRPL_FIX    (XahauV1,                    Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(HooksUpdate1,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(XahauGenesis,               Supported::yes, VoteBehavior::DefaultYes)
 XRPL_FEATURE(Import,                     Supported::yes, VoteBehavior::DefaultYes)
@@ -147,4 +161,27 @@ XRPL_FIX    (NFTokenDirV1,          Supported::yes, VoteBehavior::Obsolete)
 XRPL_FEATURE(NonFungibleTokensV1,   Supported::yes, VoteBehavior::Obsolete)
 XRPL_FEATURE(CryptoConditionsSuite, Supported::yes, VoteBehavior::Obsolete)
 
+// The following amendments have been active for at least two years. Their
+// pre-amendment code has been removed and the identifiers are deprecated.
+// All known amendments and amendments that may appear in a validated
+// ledger must be registered either here or above with the "active" amendments
+XRPL_RETIRE(fix240911)
+XRPL_RETIRE(fixXahauV2)
+XRPL_RETIRE(fixXahauV1)
+XRPL_RETIRE(MultiSign)
+XRPL_RETIRE(TrustSetAuth)
+XRPL_RETIRE(FeeEscalation)
+XRPL_RETIRE(PayChan)
+XRPL_RETIRE(CryptoConditions)
+XRPL_RETIRE(TickSize)
+XRPL_RETIRE(fix1368)
+XRPL_RETIRE(Escrow)
+XRPL_RETIRE(fix1373)
+XRPL_RETIRE(EnforceInvariants)
+XRPL_RETIRE(SortedDirectories)
+XRPL_RETIRE(fix1201)
+XRPL_RETIRE(fix1512)
+XRPL_RETIRE(fix1523)
+XRPL_RETIRE(fix1528)
+
 // clang-format on

include/xrpl/protocol/detail/ledger_entries.macro

@@ -22,14 +22,14 @@
 #endif
 
 #ifndef LEDGER_ENTRY_DUPLICATE
-// The EXPAND macro is needed for Windows
+// The LEDGER_ENTRY_EXPAND macro is needed for Windows
 // https://stackoverflow.com/questions/5134523/msvc-doesnt-expand-va-args-correctly
-#define EXPAND(x) x
+#define LEDGER_ENTRY_EXPAND(x) x
 
 // The `LEDGER_ENTRY_DUPLICATE macro is needed to avoid JSS conflicts
 // Since some transactions and ledger entries have the same name (like `DepositPreauth`)
 // The compiler won't accept two instances of `JSS(DepositPreauth)`
-#define LEDGER_ENTRY_DUPLICATE(...) EXPAND(LEDGER_ENTRY(__VA_ARGS__))
+#define LEDGER_ENTRY_DUPLICATE(...) LEDGER_ENTRY_EXPAND(LEDGER_ENTRY(__VA_ARGS__))
 #endif
 
 /**
@@ -93,7 +93,7 @@ LEDGER_ENTRY(ltCHECK, 0x0043, Check, check, ({
 */
 LEDGER_ENTRY(ltHOOK_DEFINITION, 'D', HookDefinition, hook_definition, ({
     {sfHookHash,             soeREQUIRED},
-    {sfHookOn,               soeREQUIRED},
+    {sfHookOn,               soeOPTIONAL},
     {sfHookOnIncoming,       soeOPTIONAL},
     {sfHookOnOutgoing,       soeOPTIONAL},
     {sfHookCanEmit,          soeOPTIONAL},
@@ -142,6 +142,22 @@ LEDGER_ENTRY(ltIMPORT_VLSEQ, 0x0049, ImportVLSequence, import_vlseq, ({
     {sfPreviousTxnLgrSeq,    soeOPTIONAL},
 }))
 
+/** The bootstrap document of a Progressive Web App (featurePWALoader).
+
+    At most one per account, keyed on the owner alone (keylet::appLoader).
+    It is in no owner directory and takes no reserve: its storage is paid
+    for by a per-byte fee on the AccountSet that writes it, and
+    DeleteAccount erases it explicitly. AppLoaderSequence equals the owner's
+    AccountRoot AppLoaderSequence as of the AccountSet that wrote it.
+ */
+LEDGER_ENTRY(ltAPP_LOADER, 0x004c, AppLoader, app_loader, ({
+    {sfOwner,                soeREQUIRED},
+    {sfAppLoader,            soeREQUIRED},
+    {sfAppLoaderSequence,    soeREQUIRED},
+    {sfPreviousTxnID,        soeREQUIRED},
+    {sfPreviousTxnLgrSeq,    soeREQUIRED},
+}))
+
 /** The ledger object which tracks the current negative UNL state.
 
     \note This is a singleton: only one such object exists in the ledger.
@@ -180,6 +196,26 @@ LEDGER_ENTRY_DUPLICATE(ltUNL_REPORT, 0x0052, UNLReport, unl_report, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
+/** featureRNG: the consensus random number generator.
+
+    A singleton. sfRandomData is seeded from validator reveals by the
+    ttENTROPY transactions applied at the start of each ledger, and then
+    iterated by every Hook API draw for the rest of that ledger.
+    sfRandomData and sfRandomDigests are never written to metadata, and
+    Hooks cannot load this object.
+
+    \sa keylet::random
+ */
+LEDGER_ENTRY(ltRANDOM, 0x526E, Random, random, ({
+    {sfLedgerSequence,       soeREQUIRED},
+    {sfRandomData,           soeREQUIRED},
+    {sfEntropyCount,         soeREQUIRED},
+    {sfEntropyDenominator,   soeREQUIRED},
+    {sfRandomDigests,        soeREQUIRED},
+    {sfPreviousTxnID,        soeREQUIRED},
+    {sfPreviousTxnLgrSeq,    soeREQUIRED},
+}))
+
 /** A ledger object which contains a signer list for an account.
 
     \sa keylet::signers
@@ -262,6 +298,8 @@ LEDGER_ENTRY(ltACCOUNT_ROOT, 0x0061, AccountRoot, account, ({
     {sfHookStateScale,       soeOPTIONAL},
     {sfCron,                 soeOPTIONAL},
     {sfAMMID,                soeOPTIONAL},
+    {sfAppLoaderSequence,    soeOPTIONAL},
+    {sfManifestID,           soeOPTIONAL},
 }))
 
 /** A ledger object which contains a list of object identifiers.
@@ -396,6 +434,8 @@ LEDGER_ENTRY(ltRIPPLE_STATE, 0x0072, RippleState, state, ({
     {sfHighQualityOut,       soeOPTIONAL},
     {sfLockedBalance,        soeOPTIONAL},
     {sfLockCount,            soeOPTIONAL},
+    {sfHighReward,           soeOPTIONAL},
+    {sfLowReward,            soeOPTIONAL},
 }))
 
 /** The ledger object which lists the network's fee settings.
@@ -590,6 +630,27 @@ LEDGER_ENTRY(ltDID, 0x008D, DID, did, ({
     {sfPreviousTxnLgrSeq,    soeREQUIRED},
 }))
 
-#undef EXPAND
+LEDGER_ENTRY(ltMANIFEST, 0x004D, Manifest, manifest_entry, ({
+    {sfAccount,             soeREQUIRED},
+    {sfPublicKey,           soeREQUIRED},
+    {sfSigningPubKey,       soeOPTIONAL}, /* may be absent if the master is revoked */
+    {sfSequence,            soeREQUIRED},
+    /* sfVersion defaults to 0 and is omitted from the signed payload when
+       absent. Storing it unconditionally would change the bytes and break
+       signature verification when the manifest is reconstructed. */
+    {sfVersion,             soeOPTIONAL},
+    {sfDomain,              soeOPTIONAL},
+    /* The signatures are mirrored so the object is a lossless copy of the
+       manifest and can be independently verified, and re-served to peers,
+       by any node reading it (see ManifestCache::applyLedger). */
+    {sfMasterSignature,     soeREQUIRED},
+    {sfSignature,           soeOPTIONAL}, /* absent if the master is revoked */
+    {sfManifestID,          soeOPTIONAL}, /* pointer to the identical other copy on the other key */
+    {sfOwnerNode,           soeOPTIONAL}, /* master copy only: its page in keylet::manifestDir() */
+    {sfPreviousTxnID,       soeREQUIRED},
+    {sfPreviousTxnLgrSeq,   soeREQUIRED},
+}))
+
+#undef LEDGER_ENTRY_EXPAND
 #undef LEDGER_ENTRY_DUPLICATE
 

include/xrpl/protocol/detail/sfields.macro

@@ -59,6 +59,8 @@ TYPED_SFIELD(sfHookExecutionIndex,       UINT16,    19)
 TYPED_SFIELD(sfHookApiVersion,           UINT16,    20)
 TYPED_SFIELD(sfHookStateScale,           UINT16,    21)
 TYPED_SFIELD(sfLedgerFixType,            UINT16,    22)
+TYPED_SFIELD(sfEntropyCount,             UINT16,    99)
+TYPED_SFIELD(sfEntropyDenominator,       UINT16,   100)
 
 // 32-bit integers (common)
 TYPED_SFIELD(sfNetworkID,                UINT32,     1)
@@ -123,6 +125,7 @@ TYPED_SFIELD(sfImportSequence,           UINT32,    97)
 TYPED_SFIELD(sfRewardTime,               UINT32,    98)
 TYPED_SFIELD(sfRewardLgrFirst,           UINT32,    99)
 TYPED_SFIELD(sfRewardLgrLast,            UINT32,   100)
+TYPED_SFIELD(sfAppLoaderSequence,        UINT32,   101)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -210,6 +213,10 @@ TYPED_SFIELD(sfOfferID,                  UINT256,   34)
 TYPED_SFIELD(sfEscrowID,                 UINT256,   35)
 TYPED_SFIELD(sfURITokenID,               UINT256,   36)
 TYPED_SFIELD(sfDomainID,                 UINT256,   37)
+TYPED_SFIELD(sfNextRandomDigest,         UINT256,   89)
+// RNG running state: never written to metadata (see featureRNG)
+TYPED_SFIELD(sfRandomData,               UINT256,   90, SField::sMD_Never)
+TYPED_SFIELD(sfManifestID,               UINT256,   91)
 TYPED_SFIELD(sfHookOnOutgoing,           UINT256,   93)
 TYPED_SFIELD(sfHookOnIncoming,           UINT256,   94)
 TYPED_SFIELD(sfCron,                     UINT256,   95)
@@ -257,6 +264,7 @@ TYPED_SFIELD(sfPrice,                    AMOUNT,    28)
 TYPED_SFIELD(sfSignatureReward,          AMOUNT,    29)
 TYPED_SFIELD(sfMinAccountCreateAmount,   AMOUNT,    30)
 TYPED_SFIELD(sfLPTokenBalance,           AMOUNT,    31)
+TYPED_SFIELD(sfTrustLineRewardAccumulator,AMOUNT,   99)
 
 // variable length (common)
 TYPED_SFIELD(sfPublicKey,                VL,         1)
@@ -292,6 +300,8 @@ TYPED_SFIELD(sfAssetClass,               VL,        29)
 TYPED_SFIELD(sfProvider,                 VL,        30)
 TYPED_SFIELD(sfMPTokenMetadata,          VL,        31)
 TYPED_SFIELD(sfCredentialType,           VL,        32)
+TYPED_SFIELD(sfAppLoader,                VL,        96)
+TYPED_SFIELD(sfHookName,                 VL,        97)
 TYPED_SFIELD(sfRemarkValue,              VL,        98)
 TYPED_SFIELD(sfRemarkName,               VL,        99)
 
@@ -340,6 +350,7 @@ TYPED_SFIELD(sfLockingChainIssue,        ISSUE,      1)
 TYPED_SFIELD(sfIssuingChainIssue,        ISSUE,      2)
 TYPED_SFIELD(sfAsset,                    ISSUE,      3)
 TYPED_SFIELD(sfAsset2,                   ISSUE,      4)
+TYPED_SFIELD(sfClaimCurrency,            ISSUE,      5)
 
 // bridge
 TYPED_SFIELD(sfXChainBridge,             XCHAIN_BRIDGE, 1)
@@ -367,7 +378,7 @@ UNTYPED_SFIELD(sfMajority,               OBJECT,    18)
 UNTYPED_SFIELD(sfDisabledValidator,      OBJECT,    19)
 UNTYPED_SFIELD(sfEmittedTxn,             OBJECT,    20)
 UNTYPED_SFIELD(sfHookExecution,          OBJECT,    21)
-UNTYPED_SFIELD(sfHookDefinition,         OBJECT,    22)
+                                                 // 22 unused
 UNTYPED_SFIELD(sfHookParameter,          OBJECT,    23)
 UNTYPED_SFIELD(sfHookGrant,              OBJECT,    24)
 UNTYPED_SFIELD(sfVoteEntry,              OBJECT,    25)
@@ -379,6 +390,8 @@ UNTYPED_SFIELD(sfXChainClaimAttestationCollectionElement, OBJECT, 30)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestationCollectionElement, OBJECT, 31)
 UNTYPED_SFIELD(sfPriceData,              OBJECT,    32)
 UNTYPED_SFIELD(sfCredential,             OBJECT,    33)
+UNTYPED_SFIELD(sfRandomDigestEntry,      OBJECT,    88)
+UNTYPED_SFIELD(sfManifest,               OBJECT,    90)
 UNTYPED_SFIELD(sfAmountEntry,            OBJECT,    91)
 UNTYPED_SFIELD(sfMintURIToken,           OBJECT,    92)
 UNTYPED_SFIELD(sfHookEmission,           OBJECT,    93)
@@ -386,6 +399,8 @@ UNTYPED_SFIELD(sfImportVLKey,            OBJECT,    94)
 UNTYPED_SFIELD(sfActiveValidator,        OBJECT,    95)
 UNTYPED_SFIELD(sfGenesisMint,            OBJECT,    96)
 UNTYPED_SFIELD(sfRemark,                 OBJECT,    97)
+UNTYPED_SFIELD(sfHighReward,             OBJECT,    98)
+UNTYPED_SFIELD(sfLowReward,              OBJECT,    99)
 
 // array of objects (common)
 // ARRAY/1 is reserved for end of array
@@ -416,6 +431,8 @@ UNTYPED_SFIELD(sfAuthAccounts,           ARRAY,     25)
 UNTYPED_SFIELD(sfAuthorizeCredentials,   ARRAY,     26)
 UNTYPED_SFIELD(sfUnauthorizeCredentials, ARRAY,     27)
 UNTYPED_SFIELD(sfAcceptedCredentials,    ARRAY,     28)
+// RNG validator commitments: never written to metadata (see featureRNG)
+UNTYPED_SFIELD(sfRandomDigests,          ARRAY,     91, SField::sMD_Never)
 UNTYPED_SFIELD(sfAmounts,                ARRAY,     92)
 UNTYPED_SFIELD(sfHookEmissions,          ARRAY,     93)
 UNTYPED_SFIELD(sfImportVLKeys,           ARRAY,     94)

include/xrpl/protocol/detail/transactions.macro

@@ -24,11 +24,21 @@
 /**
  * TRANSACTION(tag, value, name, fields)
  *
+ * To ease maintenance, you may replace any unneeded values with "..."
+ * e.g. #define TRANSACTION(tag, value, name, ...)
+ *
  * You must define a transactor class in the `ripple` namespace named `name`,
- * and include its header in `src/xrpld/app/tx/detail/applySteps.cpp`.
+ * and include its header alongside the TRANSACTOR definition using this
+ * format:
+ * #if TRANSACTION_INCLUDE
+ * #   include <xrpld/app/tx/detail/HEADER.h>
+ * #endif
  */
 
 /** This transaction type executes a payment. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Payment.h>
+#endif
 TRANSACTION(ttPAYMENT, 0, Payment, ({
     {sfDestination, soeREQUIRED},
     {sfAmount, soeREQUIRED, soeMPTSupported},
@@ -41,6 +51,9 @@ TRANSACTION(ttPAYMENT, 0, Payment, ({
 }))
 
 /** This transaction type creates an escrow object. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Escrow.h>
+#endif
 TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate, ({
     {sfDestination, soeREQUIRED},
     {sfAmount, soeREQUIRED},
@@ -62,6 +75,9 @@ TRANSACTION(ttESCROW_FINISH, 2, EscrowFinish, ({
 
 
 /** This transaction type adjusts various account settings. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetAccount.h>
+#endif
 TRANSACTION(ttACCOUNT_SET, 3, AccountSet, ({
     {sfEmailHash, soeOPTIONAL},
     {sfWalletLocator, soeOPTIONAL},
@@ -74,6 +90,7 @@ TRANSACTION(ttACCOUNT_SET, 3, AccountSet, ({
     {sfTickSize, soeOPTIONAL},
     {sfNFTokenMinter, soeOPTIONAL},
     {sfHookStateScale, soeOPTIONAL},
+    {sfAppLoader, soeOPTIONAL},
 }))
 
 /** This transaction type cancels an existing escrow. */
@@ -84,6 +101,9 @@ TRANSACTION(ttESCROW_CANCEL, 4, EscrowCancel, ({
 }))
 
 /** This transaction type sets or clears an account's "regular key". */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetRegularKey.h>
+#endif
 TRANSACTION(ttREGULAR_KEY_SET, 5, SetRegularKey, ({
     {sfRegularKey, soeOPTIONAL},
 }))
@@ -91,6 +111,9 @@ TRANSACTION(ttREGULAR_KEY_SET, 5, SetRegularKey, ({
 // 6 deprecated
 
 /** This transaction type creates an offer to trade one asset for another. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CreateOffer.h>
+#endif
 TRANSACTION(ttOFFER_CREATE, 7, OfferCreate, ({
     {sfTakerPays, soeREQUIRED},
     {sfTakerGets, soeREQUIRED},
@@ -100,6 +123,9 @@ TRANSACTION(ttOFFER_CREATE, 7, OfferCreate, ({
 }))
 
 /** This transaction type cancels existing offers to trade one asset for another. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CancelOffer.h>
+#endif
 TRANSACTION(ttOFFER_CANCEL, 8, OfferCancel, ({
     {sfOfferSequence, soeOPTIONAL},
     {sfOfferID, soeOPTIONAL},  // keylet as alternative to offerseq
@@ -108,6 +134,9 @@ TRANSACTION(ttOFFER_CANCEL, 8, OfferCancel, ({
 // 9 deprecated
 
 /** This transaction type creates a new set of tickets. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CreateTicket.h>
+#endif
 TRANSACTION(ttTICKET_CREATE, 10, TicketCreate, ({
     {sfTicketCount, soeREQUIRED},
 }))
@@ -117,12 +146,18 @@ TRANSACTION(ttTICKET_CREATE, 10, TicketCreate, ({
 /** This transaction type modifies the signer list associated with an account. */
 // The SignerEntries are optional because a SignerList is deleted by
 // setting the SignerQuorum to zero and omitting SignerEntries.
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetSignerList.h>
+#endif
 TRANSACTION(ttSIGNER_LIST_SET, 12, SignerListSet, ({
     {sfSignerQuorum, soeREQUIRED},
     {sfSignerEntries, soeOPTIONAL},
 }))
 
 /** This transaction type creates a new unidirectional XRP payment channel. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/PayChan.h>
+#endif
 TRANSACTION(ttPAYCHAN_CREATE, 13, PaymentChannelCreate, ({
     {sfDestination, soeREQUIRED},
     {sfAmount, soeREQUIRED},
@@ -150,6 +185,9 @@ TRANSACTION(ttPAYCHAN_CLAIM, 15, PaymentChannelClaim, ({
 }))
 
 /** This transaction type creates a new check. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CreateCheck.h>
+#endif
 TRANSACTION(ttCHECK_CREATE, 16, CheckCreate, ({
     {sfDestination, soeREQUIRED},
     {sfSendMax, soeREQUIRED},
@@ -159,6 +197,9 @@ TRANSACTION(ttCHECK_CREATE, 16, CheckCreate, ({
 }))
 
 /** This transaction type cashes an existing check. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CashCheck.h>
+#endif
 TRANSACTION(ttCHECK_CASH, 17, CheckCash, ({
     {sfCheckID, soeREQUIRED},
     {sfAmount, soeOPTIONAL},
@@ -166,11 +207,17 @@ TRANSACTION(ttCHECK_CASH, 17, CheckCash, ({
 }))
 
 /** This transaction type cancels an existing check. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CancelCheck.h>
+#endif
 TRANSACTION(ttCHECK_CANCEL, 18, CheckCancel, ({
     {sfCheckID, soeREQUIRED},
 }))
 
 /** This transaction type grants or revokes authorization to transfer funds. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DepositPreauth.h>
+#endif
 TRANSACTION(ttDEPOSIT_PREAUTH, 19, DepositPreauth, ({
     {sfAuthorize, soeOPTIONAL},
     {sfUnauthorize, soeOPTIONAL},
@@ -179,6 +226,9 @@ TRANSACTION(ttDEPOSIT_PREAUTH, 19, DepositPreauth, ({
 }))
 
 /** This transaction type modifies a trustline between two accounts. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetTrust.h>
+#endif
 TRANSACTION(ttTRUST_SET, 20, TrustSet, ({
     {sfLimitAmount, soeOPTIONAL},
     {sfQualityIn, soeOPTIONAL},
@@ -186,6 +236,9 @@ TRANSACTION(ttTRUST_SET, 20, TrustSet, ({
 }))
 
 /** This transaction type deletes an existing account. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DeleteAccount.h>
+#endif
 TRANSACTION(ttACCOUNT_DELETE, 21, AccountDelete, ({
     {sfDestination, soeREQUIRED},
     {sfDestinationTag, soeOPTIONAL},
@@ -193,11 +246,17 @@ TRANSACTION(ttACCOUNT_DELETE, 21, AccountDelete, ({
 }))
 
 /** This transaction type installs a hook. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetHook.h>
+#endif
 TRANSACTION(ttHOOK_SET, 22, SetHook, ({
     {sfHooks, soeREQUIRED},
 }))
 
 /** This transaction mints a new NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenMint.h>
+#endif
 TRANSACTION(ttNFTOKEN_MINT, 25, NFTokenMint, ({
     {sfNFTokenTaxon, soeREQUIRED},
     {sfTransferFee, soeOPTIONAL},
@@ -209,12 +268,18 @@ TRANSACTION(ttNFTOKEN_MINT, 25, NFTokenMint, ({
 }))
 
 /** This transaction burns (i.e. destroys) an existing NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenBurn.h>
+#endif
 TRANSACTION(ttNFTOKEN_BURN, 26, NFTokenBurn, ({
     {sfNFTokenID, soeREQUIRED},
     {sfOwner, soeOPTIONAL},
 }))
 
 /** This transaction creates a new offer to buy or sell an NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenCreateOffer.h>
+#endif
 TRANSACTION(ttNFTOKEN_CREATE_OFFER, 27, NFTokenCreateOffer, ({
     {sfNFTokenID, soeREQUIRED},
     {sfAmount, soeREQUIRED},
@@ -224,11 +289,17 @@ TRANSACTION(ttNFTOKEN_CREATE_OFFER, 27, NFTokenCreateOffer, ({
 }))
 
 /** This transaction cancels an existing offer to buy or sell an existing NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenCancelOffer.h>
+#endif
 TRANSACTION(ttNFTOKEN_CANCEL_OFFER, 28, NFTokenCancelOffer, ({
     {sfNFTokenOffers, soeREQUIRED},
 }))
 
 /** This transaction accepts an existing offer to buy or sell an existing  NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenAcceptOffer.h>
+#endif
 TRANSACTION(ttNFTOKEN_ACCEPT_OFFER, 29, NFTokenAcceptOffer, ({
     {sfNFTokenBuyOffer, soeOPTIONAL},
     {sfNFTokenSellOffer, soeOPTIONAL},
@@ -236,12 +307,18 @@ TRANSACTION(ttNFTOKEN_ACCEPT_OFFER, 29, NFTokenAcceptOffer, ({
 }))
 
 /** This transaction claws back issued tokens. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Clawback.h>
+#endif
 TRANSACTION(ttCLAWBACK, 30, Clawback, ({
     {sfAmount, soeREQUIRED, soeMPTSupported},
     {sfHolder, soeOPTIONAL},
 }))
 
 /** This transaction claws back tokens from an AMM pool. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMClawback.h>
+#endif
 TRANSACTION(ttAMM_CLAWBACK, 31, AMMClawback, ({
     {sfHolder, soeREQUIRED},
     {sfAsset, soeREQUIRED},
@@ -250,6 +327,9 @@ TRANSACTION(ttAMM_CLAWBACK, 31, AMMClawback, ({
 }))
 
 /** This transaction type creates an AMM instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMCreate.h>
+#endif
 TRANSACTION(ttAMM_CREATE, 35, AMMCreate, ({
     {sfAmount, soeREQUIRED},
     {sfAmount2, soeREQUIRED},
@@ -257,6 +337,9 @@ TRANSACTION(ttAMM_CREATE, 35, AMMCreate, ({
 }))
 
 /** This transaction type deposits into an AMM instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMDeposit.h>
+#endif
 TRANSACTION(ttAMM_DEPOSIT, 36, AMMDeposit, ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -268,6 +351,9 @@ TRANSACTION(ttAMM_DEPOSIT, 36, AMMDeposit, ({
 }))
 
 /** This transaction type withdraws from an AMM instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMWithdraw.h>
+#endif
 TRANSACTION(ttAMM_WITHDRAW, 37, AMMWithdraw, ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -278,6 +364,9 @@ TRANSACTION(ttAMM_WITHDRAW, 37, AMMWithdraw, ({
 }))
 
 /** This transaction type votes for the trading fee */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMVote.h>
+#endif
 TRANSACTION(ttAMM_VOTE, 38, AMMVote, ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -285,6 +374,9 @@ TRANSACTION(ttAMM_VOTE, 38, AMMVote, ({
 }))
 
 /** This transaction type bids for the auction slot */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMBid.h>
+#endif
 TRANSACTION(ttAMM_BID, 39, AMMBid, ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -294,12 +386,18 @@ TRANSACTION(ttAMM_BID, 39, AMMBid, ({
 }))
 
 /** This transaction type deletes AMM in the empty state */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMDelete.h>
+#endif
 TRANSACTION(ttAMM_DELETE, 40, AMMDelete, ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
 }))
 
 /** This transaction mints/burns/buys/sells a URI TOKEN */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/URIToken.h>
+#endif
 TRANSACTION(ttURITOKEN_MINT, 45, URITokenMint, ({
     {sfURI, soeREQUIRED},
     {sfDigest, soeOPTIONAL},
@@ -327,6 +425,9 @@ TRANSACTION(ttURITOKEN_CANCEL_SELL_OFFER, 49, URITokenCancelSellOffer, ({
 }))
 
 /** This transactions creates a crosschain sequence number */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/XChainBridge.h>
+#endif
 TRANSACTION(ttXCHAIN_CREATE_CLAIM_ID, 50, XChainCreateClaimID, ({
     {sfXChainBridge, soeREQUIRED},
     {sfSignatureReward, soeREQUIRED},
@@ -406,6 +507,9 @@ TRANSACTION(ttXCHAIN_CREATE_BRIDGE, 57, XChainCreateBridge, ({
 }))
 
 /** This transaction type creates or updates a DID */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DID.h>
+#endif
 TRANSACTION(ttDID_SET, 58, DIDSet, ({
     {sfDIDDocument, soeOPTIONAL},
     {sfURI, soeOPTIONAL},
@@ -416,6 +520,9 @@ TRANSACTION(ttDID_SET, 58, DIDSet, ({
 TRANSACTION(ttDID_DELETE, 59, DIDDelete, ({}))
 
 /** This transaction type creates an Oracle instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetOracle.h>
+#endif
 TRANSACTION(ttORACLE_SET, 60, OracleSet, ({
     {sfOracleDocumentID, soeREQUIRED},
     {sfProvider, soeOPTIONAL},
@@ -426,17 +533,26 @@ TRANSACTION(ttORACLE_SET, 60, OracleSet, ({
 }))
 
 /** This transaction type deletes an Oracle instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DeleteOracle.h>
+#endif
 TRANSACTION(ttORACLE_DELETE, 61, OracleDelete, ({
     {sfOracleDocumentID, soeREQUIRED},
 }))
 
 /** This transaction type fixes a problem in the ledger state */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/LedgerStateFix.h>
+#endif
 TRANSACTION(ttLEDGER_STATE_FIX, 62, LedgerStateFix, ({
     {sfLedgerFixType, soeREQUIRED},
     {sfOwner, soeOPTIONAL},
 }))
 
 /** This transaction type creates a MPTokensIssuance instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenIssuanceCreate.h>
+#endif
 TRANSACTION(ttMPTOKEN_ISSUANCE_CREATE, 63, MPTokenIssuanceCreate, ({
     {sfAssetScale, soeOPTIONAL},
     {sfTransferFee, soeOPTIONAL},
@@ -445,23 +561,35 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_CREATE, 63, MPTokenIssuanceCreate, ({
 }))
 
 /** This transaction type destroys a MPTokensIssuance instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenIssuanceDestroy.h>
+#endif
 TRANSACTION(ttMPTOKEN_ISSUANCE_DESTROY, 64, MPTokenIssuanceDestroy, ({
     {sfMPTokenIssuanceID, soeREQUIRED},
 }))
 
 /** This transaction type sets flags on a MPTokensIssuance or MPToken instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenIssuanceSet.h>
+#endif
 TRANSACTION(ttMPTOKEN_ISSUANCE_SET, 65, MPTokenIssuanceSet, ({
     {sfMPTokenIssuanceID, soeREQUIRED},
     {sfHolder, soeOPTIONAL},
 }))
 
 /** This transaction type authorizes a MPToken instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenAuthorize.h>
+#endif
 TRANSACTION(ttMPTOKEN_AUTHORIZE, 66, MPTokenAuthorize, ({
     {sfMPTokenIssuanceID, soeREQUIRED},
     {sfHolder, soeOPTIONAL},
 }))
 
 /** This transaction type create an Credential instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Credentials.h>
+#endif
 TRANSACTION(ttCREDENTIAL_CREATE, 67, CredentialCreate, ({
     {sfSubject, soeREQUIRED},
     {sfCredentialType, soeREQUIRED},
@@ -483,6 +611,9 @@ TRANSACTION(ttCREDENTIAL_DELETE, 69, CredentialDelete, ({
 }))
 
 /** This transaction type modify a NFToken */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenModify.h>
+#endif
 TRANSACTION(ttNFTOKEN_MODIFY, 70, NFTokenModify, ({
     {sfNFTokenID, soeREQUIRED},
     {sfOwner, soeOPTIONAL},
@@ -490,23 +621,63 @@ TRANSACTION(ttNFTOKEN_MODIFY, 70, NFTokenModify, ({
 }))
 
 /** This transaction type creates or modifies a Permissioned Domain */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/PermissionedDomainSet.h>
+#endif
 TRANSACTION(ttPERMISSIONED_DOMAIN_SET, 71, PermissionedDomainSet, ({
     {sfDomainID, soeOPTIONAL},
     {sfAcceptedCredentials, soeREQUIRED},
 }))
 
 /** This transaction type deletes a Permissioned Domain */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/PermissionedDomainDelete.h>
+#endif
 TRANSACTION(ttPERMISSIONED_DOMAIN_DELETE, 72, PermissionedDomainDelete, ({
     {sfDomainID, soeREQUIRED},
 }))
 
+/** featureRNG: a validator's entropy contribution for one ledger.
+
+    Each proposing UNLReport validator places exactly one of these in its own
+    initial position when it closes the ledger. It reveals the secret behind
+    the validator's commitment currently stored in the Random object (if any)
+    and commits to the secret it will reveal next time. It never enters the
+    open ledger, so a reveal only becomes public after the revealing
+    validator's transaction set is locked.
+ */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Change.h>
+#endif
+TRANSACTION(ttENTROPY, 89, Entropy, ({
+    {sfLedgerSequence, soeREQUIRED},
+    {sfPublicKey, soeREQUIRED},
+    {sfNextRandomDigest, soeREQUIRED},
+    {sfRandomData, soeOPTIONAL},
+}))
+
+/* sfAccount is supplied by TxFormats::commonFields; listing it here as well
+   makes the SOTemplate reject the format at construction. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetManifest.h>
+#endif
+TRANSACTION(ttMANIFEST_SET, 91, SetManifest, ({
+    {sfManifest, soeREQUIRED},
+}))
+
 /* A pseudo-txn alarm signal for invoking a hook, emitted by validators after alarm set conditions are met */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Cron.h>
+#endif
 TRANSACTION(ttCRON, 92, Cron, ({
     {sfOwner, soeREQUIRED},
     {sfLedgerSequence, soeREQUIRED},
 }))
 
 /* Sechedule an alarm for later */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CronSet.h>
+#endif
 TRANSACTION(ttCRON_SET, 93, CronSet, ({
     {sfDelaySeconds, soeOPTIONAL},
     {sfRepeatCount, soeOPTIONAL},
@@ -514,6 +685,9 @@ TRANSACTION(ttCRON_SET, 93, CronSet, ({
 }))
 
 /* A note attaching transactor that allows the owner or issuer (on a object by object basis) to attach remarks */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetRemarks.h>
+#endif
 TRANSACTION(ttREMARKS_SET, 94, SetRemarks, ({
     {sfObjectID, soeREQUIRED},
     {sfRemarks, soeREQUIRED},
@@ -521,6 +695,9 @@ TRANSACTION(ttREMARKS_SET, 94, SetRemarks, ({
 
 /* A payment transactor that delivers only the exact amounts specified, creating accounts and TLs as needed 
   * that the sender pays for. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Remit.h>
+#endif
 TRANSACTION(ttREMIT, 95, Remit, ({
     {sfDestination, soeREQUIRED},
     {sfAmounts, soeOPTIONAL},
@@ -535,12 +712,18 @@ TRANSACTION(ttREMIT, 95, Remit, ({
 /** This transaction can only be used by the genesis account, which is controlled exclusively by
   * rewards/governance hooks, to print new XRP to be delivered directly to an array of destinations,
   * according to reward schedule */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/GenesisMint.h>
+#endif
 TRANSACTION(ttGENESIS_MINT, 96, GenesisMint, ({
     {sfGenesisMints, soeREQUIRED},
 }))
 
 /** This transaction accepts a proof of burn from an external network as a basis
   * for minting according to featureImport */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Import.h>
+#endif
 TRANSACTION(ttIMPORT, 97, Import, ({
     {sfBlob, soeREQUIRED},
     {sfIssuer, soeOPTIONAL},
@@ -548,11 +731,18 @@ TRANSACTION(ttIMPORT, 97, Import, ({
 
 /** This transaction resets accumulator/counters and claims a reward for holding an average balance
   * from a specified hook */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/ClaimReward.h>
+#endif
 TRANSACTION(ttCLAIM_REWARD, 98, ClaimReward, ({
     {sfIssuer, soeOPTIONAL},
+    {sfClaimCurrency, soeOPTIONAL},
 }))
 
 /** This transaction invokes a hook, providing arbitrary data. Essentially as a 0 drop payment. **/
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Invoke.h>
+#endif
 TRANSACTION(ttINVOKE, 99, Invoke, ({
     {sfBlob, soeOPTIONAL},
     {sfDestination, soeOPTIONAL},

include/xrpl/protocol/jss.h

@@ -47,6 +47,7 @@ JSS(AL_hit_rate);    // out: GetCounts
 JSS(AcceptedCredentials);  // out: AccountObjects
 JSS(Account);        // in: TransactionSign; field.
 JSS(AMMID);          // field
+JSS(API);            // out: RPC server_definitions (HOOK)
 JSS(Amount);         // in: TransactionSign; field.
 JSS(Authorize);      // field
 JSS(Amount2);        // in/out: AMM IOU/XRP pool, deposit, withdraw amount
@@ -68,6 +69,9 @@ JSS(Destination);      // in: TransactionSign; field.
 JSS(EPrice);           // in: AMM Deposit option
 JSS(Fee);              // in/out: TransactionSign; field.
 JSS(FIELDS);           // out: RPC server_definitions
+JSS(HOOK);             // out: RPC server_definitions
+JSS(KEYLET_TYPES);     // out: RPC server_definitions (HOOK)
+JSS(RETURN_CODES);     // out: RPC server_definitions (HOOK)
 JSS(Flags);            // in/out: TransactionSign; field.
 JSS(GenesisMints);
 JSS(GovernanceMarks);
@@ -76,6 +80,7 @@ JSS(Holder);              // field.
 JSS(HookApiVersion);      // field
 JSS(HookCanEmit);         // field
 JSS(HookHash);            // field
+JSS(HookName);            // field
 JSS(HookNamespace);       // field
 JSS(HookOn);              // field
 JSS(HookOnIncoming);      // field
@@ -166,6 +171,7 @@ JSS(amendment_blocked);           // out: NetworkOPs
 JSS(amm_account);                 // in: amm_info
 JSS(amount);                      // out: AccountChannels, amm_info
 JSS(amount2);                     // out: amm_info
+JSS(anchored_through);            // out: CatalogueLoad
 JSS(api_version);                 // in: many, out: Version
 JSS(api_version_low);             // out: Version
 JSS(applied);                     // out: SubmitTransaction
@@ -233,7 +239,7 @@ JSS(closed);                 // out: NetworkOPs, LedgerToJson,
                              //      handlers/Ledger
 JSS(closed_ledger);          // out: NetworkOPs
 JSS(cluster);                // out: PeerImp
-JSS(code);                   // out: errors
+JSS(code);                   // in: HookValidate; out: errors
 JSS(command);                // in: RPCHandler
 JSS(complete);               // out: NetworkOPs, InboundLedger
 JSS(complete_ledgers);       // out: NetworkOPs, PeerImp
@@ -291,7 +297,9 @@ JSS(duration_us);             // out: NetworkOPs
 JSS(effective);               // out: ValidatorList
                               // in: UNL
 JSS(elapsed_seconds);
-JSS(enabled);                // out: AmendmentTable
+JSS(enabled);                // out: AmendmentTable (on-ledger);
+                             //      ServerDefinitions (this server)
+JSS(ledger_enabled);         // out: ServerDefinitions (on-ledger)
 JSS(engine_result);          // out: NetworkOPs, TransactionSign, Submit
 JSS(engine_result_code);     // out: NetworkOPs, TransactionSign, Submit
 JSS(engine_result_message);  // out: NetworkOPs, TransactionSign, Submit
@@ -349,6 +357,7 @@ JSS(hash_mismatches);       // out: catalogue
 JSS(have_header);           // out: InboundLedger
 JSS(have_state);            // out: InboundLedger
 JSS(have_transactions);     // out: InboundLedger
+JSS(hooks);                 // in/out: AccountInfo
 JSS(high);                  // out: BookChanges
 JSS(highest_sequence);      // out: AccountInfo
 JSS(highest_ticket);        // out: AccountInfo
@@ -370,6 +379,8 @@ JSS(index);    // in: LedgerEntry,
                //      LedgerEntry, TxHistory, LedgerData
 JSS(info);     // out: ServerInfo, ConsensusInfo, FetchInfo
 JSS(initial_sync_duration_us);
+JSS(instruction_count_cbak);  // out: HookValidate
+JSS(instruction_count_hook);  // out: HookValidate
 JSS(internal_command);     // in: Internal
 JSS(invalid_API_version);  // out: Many, when a request has an invalid
                            //      version
@@ -443,6 +454,7 @@ JSS(local);                   // out: resource/Logic.h
 JSS(local_txs);               // out: GetCounts
 JSS(local_static_keys);       // out: ValidatorList
 JSS(locked_balance);          // out: AccountLines
+JSS(log);                     // out: HookValidate
 JSS(low);                     // out: BookChanges
 JSS(lock_count);              // out: AccountLines
 JSS(lowest_sequence);         // out: AccountInfo
@@ -581,7 +593,6 @@ JSS(queue_data);        // out: AccountInfo
 JSS(queued);            // out: SubmitTransaction
 JSS(queued_duration_us);
 JSS(quote_asset);           // in: get_aggregate_price
-JSS(random);                // out: Random
 JSS(raw_meta);              // out: AcceptedLedgerTx
 JSS(receive_currencies);    // out: AccountCurrencies
 JSS(reference_level);       // out: TxQ
@@ -599,6 +610,7 @@ JSS(reserve_base_native);   // out: NetworkOPs
 JSS(reserve_inc);           // out: NetworkOPs
 JSS(reserve_inc_xrp);       // out: NetworkOPs
 JSS(reserve_inc_native);    // out: NetworkOPs
+JSS(reset);                 // in/out: PWAInfo
 JSS(response);              // websocket
 JSS(result);                // RPC
 JSS(ripple_lines);          // out: NetworkOPs
@@ -733,6 +745,7 @@ JSS(TRANSACTION_FLAGS_INDICES);  // out: RPC server_definitions
 JSS(type_hex);                   // out: STPathSet
 JSS(unl);                        // out: UnlList
 JSS(unlimited);                  // out: Connection.h
+JSS(unpinned);                   // out: CatalogueUnpin
 JSS(uptime);                     // out: GetCounts
 JSS(uri);                        // out: ValidatorSites
 JSS(url);                        // in/out: Subscribe, Unsubscribe
@@ -740,6 +753,7 @@ JSS(url_password);               // in: Subscribe
 JSS(url_username);               // in: Subscribe
 JSS(urlgravatar);                //
 JSS(username);                   // in: Subscribe
+JSS(valid);                      // out: HookValidate
 JSS(validated);                  // out: NetworkOPs, RPCHelpers, AccountTx*
                                  //      Tx
 JSS(validator_list_expires);     // out: NetworkOps, ValidatorList
@@ -761,6 +775,7 @@ JSS(validator_sites);  // out: ValidatorSites
 JSS(value);            // out: STAmount
 JSS(version);          // out: RPCVersion
 JSS(vetoed);           // out: AmendmentTableImpl
+JSS(vm_error);         // out: HookValidate
 JSS(volume_a);         // out: BookChanges
 JSS(volume_b);         // out: BookChanges
 JSS(vote);             // in: Feature

include/xrpl/server/Port.h

@@ -22,6 +22,7 @@
 
 #include <xrpl/basics/BasicConfig.h>
 #include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/protocol/AccountID.h>
 #include <boost/asio/ip/address.hpp>
 #include <boost/asio/ip/network_v4.hpp>
 #include <boost/asio/ip/network_v6.hpp>
@@ -57,6 +58,12 @@ struct Port
     std::vector<boost::asio::ip::network_v6> admin_nets_v6;
     std::vector<boost::asio::ip::network_v4> secure_gateway_nets_v4;
     std::vector<boost::asio::ip::network_v6> secure_gateway_nets_v6;
+    // "pwa" ports only; see the "pwa ports" section of xahaud-example.cfg.
+    std::set<std::string> pwa_domains;  // zones, lower case, no trailing dot
+    std::set<AccountID> pwa_allowlist;  // if non-empty, only these are served
+    std::set<AccountID> pwa_blocklist;  // never served; wins over allowlist
+    bool pwa_custom_domains = false;    // serve hosts named by TXT records
+    std::optional<beast::IP::Endpoint> pwa_resolver;  // for those; else system
     std::string user;
     std::string password;
     std::string admin_user;
@@ -93,8 +100,18 @@ struct Port
         return protocol.count("udp") > 0;
     }
 
+    bool
+    has_peer() const
+    {
+        return protocol.count("peer") > 0;
+    }
+
     // Maximum UDP packet size (default 64KB)
     std::size_t udp_packet_size = 65536;
+
+    // If this is a peer port, also listen for UDP Superhighway (XUSH)
+    // datagrams on the same port number.
+    bool udp_highway = false;
 };
 
 std::ostream&
@@ -126,6 +143,9 @@ struct ParsedPort
     std::vector<boost::asio::ip::network_v6> admin_nets_v6;
     std::vector<boost::asio::ip::network_v4> secure_gateway_nets_v4;
     std::vector<boost::asio::ip::network_v6> secure_gateway_nets_v6;
+    std::set<std::string> pwa_domains;
+    bool pwa_custom_domains = false;
+    std::optional<beast::IP::Endpoint> pwa_resolver;
 };
 
 void

include/xrpl/server/Server.h

@@ -24,7 +24,8 @@
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/server/Port.h>
 #include <xrpl/server/detail/ServerImpl.h>
-#include <boost/asio/io_service.hpp>
+
+#include <boost/asio/io_context.hpp>
 
 namespace ripple {
 
@@ -33,10 +34,10 @@ template <class Handler>
 std::unique_ptr<Server>
 make_Server(
     Handler& handler,
-    boost::asio::io_service& io_service,
+    boost::asio::io_context& io_context,
     beast::Journal journal)
 {
-    return std::make_unique<ServerImpl<Handler>>(handler, io_service, journal);
+    return std::make_unique<ServerImpl<Handler>>(handler, io_context, journal);
 }
 
 }  // namespace ripple

include/xrpl/server/Session.h

@@ -86,9 +86,7 @@ public:
              ++iter)
         {
             typename BufferSequence::value_type const& buffer(*iter);
-            write(
-                boost::asio::buffer_cast<void const*>(buffer),
-                boost::asio::buffer_size(buffer));
+            write(buffer.data(), boost::asio::buffer_size(buffer));
         }
     }
 
@@ -102,7 +100,7 @@ public:
 
     /** Detach the session.
         This holds the session open so that the response can be sent
-        asynchronously. Calls to io_service::run made by the server
+        asynchronously. Calls to io_context::run made by the server
         will not return until all detached sessions are closed.
     */
     virtual std::shared_ptr<Session>

include/xrpl/server/detail/BaseHTTPPeer.h

@@ -24,10 +24,12 @@
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/server/Session.h>
+#include <xrpl/server/detail/Spawn.h>
 #include <xrpl/server/detail/io_list.h>
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/asio/spawn.hpp>
 #include <boost/asio/ssl/stream.hpp>
+#include <boost/asio/strand.hpp>
 #include <boost/asio/streambuf.hpp>
 #include <boost/beast/core/stream_traits.hpp>
 #include <boost/beast/http/dynamic_body.hpp>
@@ -214,8 +216,8 @@ BaseHTTPPeer<Handler, Impl>::BaseHTTPPeer(
     ConstBufferSequence const& buffers)
     : port_(port)
     , handler_(handler)
-    , work_(executor)
-    , strand_(executor)
+    , work_(boost::asio::make_work_guard(executor))
+    , strand_(boost::asio::make_strand(executor))
     , remote_address_(remote_address)
     , journal_(journal)
 {
@@ -300,7 +302,13 @@ BaseHTTPPeer<Handler, Impl>::do_read(yield_context do_yield)
 {
     complete_ = false;
     error_code ec;
-    start_timer();
+    // Do not treat an established keep-alive waiting for its next request as
+    // an unfinished loopback request.
+    if (request_count_ == 0)
+        start_timer();
+    else
+        boost::beast::get_lowest_layer(impl().stream_)
+            .expires_after(std::chrono::seconds(timeoutSeconds));
     boost::beast::http::async_read(
         impl().stream_, read_buf_, message_, do_yield[ec]);
     cancel_timer();
@@ -355,7 +363,7 @@ BaseHTTPPeer<Handler, Impl>::on_write(
         return;
     if (graceful_)
         return do_close();
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
@@ -374,7 +382,7 @@ BaseHTTPPeer<Handler, Impl>::do_writer(
     {
         auto const p = impl().shared_from_this();
         resume = std::function<void(void)>([this, p, writer, keep_alive]() {
-            boost::asio::spawn(
+            util::spawn(
                 strand_,
                 std::bind(
                     &BaseHTTPPeer<Handler, Impl>::do_writer,
@@ -405,7 +413,7 @@ BaseHTTPPeer<Handler, Impl>::do_writer(
     if (!keep_alive)
         return do_close();
 
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
@@ -447,14 +455,14 @@ BaseHTTPPeer<Handler, Impl>::write(
     std::shared_ptr<Writer> const& writer,
     bool keep_alive)
 {
-    boost::asio::spawn(bind_executor(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_writer,
             impl().shared_from_this(),
             writer,
             keep_alive,
-            std::placeholders::_1)));
+            std::placeholders::_1));
 }
 
 // DEPRECATED
@@ -489,12 +497,12 @@ BaseHTTPPeer<Handler, Impl>::complete()
     }
 
     // keep-alive
-    boost::asio::spawn(bind_executor(
+    util::spawn(
         strand_,
         std::bind(
             &BaseHTTPPeer<Handler, Impl>::do_read,
             impl().shared_from_this(),
-            std::placeholders::_1)));
+            std::placeholders::_1));
 }
 
 // DEPRECATED

include/xrpl/server/detail/BasePeer.h

@@ -89,8 +89,8 @@ BasePeer<Handler, Impl>::BasePeer(
               return "##" + std::to_string(++id) + " ";
           }())
     , j_(sink_)
-    , work_(executor)
-    , strand_(executor)
+    , work_(boost::asio::make_work_guard(executor))
+    , strand_(boost::asio::make_strand(executor))
 {
 }
 

include/xrpl/server/detail/BaseWSPeer.h

@@ -29,6 +29,7 @@
 #include <xrpl/server/detail/BasePeer.h>
 #include <xrpl/server/detail/LowestLayer.h>
 
+#include <boost/asio/error.hpp>
 #include <boost/beast/core/multi_buffer.hpp>
 #include <boost/beast/http/message.hpp>
 #include <boost/beast/websocket.hpp>
@@ -420,11 +421,17 @@ BaseWSPeer<Handler, Impl>::start_timer()
     // Max seconds without completing a message
     static constexpr std::chrono::seconds timeout{30};
     static constexpr std::chrono::seconds timeoutLocal{3};
-    error_code ec;
-    timer_.expires_from_now(
-        remote_endpoint().address().is_loopback() ? timeoutLocal : timeout, ec);
-    if (ec)
-        return fail(ec, "start_timer");
+
+    try
+    {
+        timer_.expires_after(
+            remote_endpoint().address().is_loopback() ? timeoutLocal : timeout);
+    }
+    catch (boost::system::system_error const& e)
+    {
+        return fail(e.code(), "start_timer");
+    }
+
     timer_.async_wait(bind_executor(
         strand_,
         std::bind(
@@ -438,8 +445,14 @@ template <class Handler, class Impl>
 void
 BaseWSPeer<Handler, Impl>::cancel_timer()
 {
-    error_code ec;
-    timer_.cancel(ec);
+    try
+    {
+        timer_.cancel();
+    }
+    catch (boost::system::system_error const&)
+    {
+        // ignored
+    }
 }
 
 template <class Handler, class Impl>

include/xrpl/server/detail/Door.h

@@ -69,7 +69,7 @@ private:
         stream_type stream_;
         socket_type& socket_;
         endpoint_type remote_address_;
-        boost::asio::io_context::strand strand_;
+        boost::asio::strand<boost::asio::io_context::executor_type> strand_;
         beast::Journal const j_;
 
     public:
@@ -95,7 +95,7 @@ private:
     Handler& handler_;
     boost::asio::io_context& ioc_;
     acceptor_type acceptor_;
-    boost::asio::io_context::strand strand_;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand_;
     bool ssl_;
     bool plain_;
 
@@ -155,7 +155,7 @@ Door<Handler>::Detector::Detector(
     , stream_(std::move(stream))
     , socket_(stream_.socket())
     , remote_address_(remote_address)
-    , strand_(ioc_)
+    , strand_(boost::asio::make_strand(ioc_))
     , j_(j)
 {
 }
@@ -164,7 +164,7 @@ template <class Handler>
 void
 Door<Handler>::Detector::run()
 {
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &Detector::do_detect,
@@ -269,7 +269,7 @@ Door<Handler>::reOpen()
         Throw<std::exception>();
     }
 
-    acceptor_.listen(boost::asio::socket_base::max_connections, ec);
+    acceptor_.listen(boost::asio::socket_base::max_listen_connections, ec);
     if (ec)
     {
         JLOG(j_.error()) << "Listen on port '" << port_.name
@@ -291,14 +291,14 @@ Door<Handler>::Door(
     , handler_(handler)
     , ioc_(io_context)
     , acceptor_(io_context)
-    , strand_(io_context)
+    , strand_(boost::asio::make_strand(io_context))
     , ssl_(
           port_.protocol.count("https") > 0 ||
           port_.protocol.count("wss") > 0 || port_.protocol.count("wss2") > 0 ||
           port_.protocol.count("peer") > 0)
     , plain_(
           port_.protocol.count("http") > 0 || port_.protocol.count("ws") > 0 ||
-          port_.protocol.count("ws2"))
+          port_.protocol.count("ws2") || port_.protocol.count("pwa"))
 {
     reOpen();
 }
@@ -307,7 +307,7 @@ template <class Handler>
 void
 Door<Handler>::run()
 {
-    boost::asio::spawn(
+    util::spawn(
         strand_,
         std::bind(
             &Door<Handler>::do_accept,
@@ -320,7 +320,8 @@ void
 Door<Handler>::close()
 {
     if (!strand_.running_in_this_thread())
-        return strand_.post(
+        return boost::asio::post(
+            strand_,
             std::bind(&Door<Handler>::close, this->shared_from_this()));
     error_code ec;
     acceptor_.close(ec);
@@ -400,7 +401,7 @@ Door<Handler>::do_accept(boost::asio::yield_context do_yield)
         {
             create(
                 ssl_,
-                boost::asio::null_buffers{},
+                boost::asio::const_buffer{},
                 std::move(stream),
                 remote_address);
         }

include/xrpl/server/detail/PlainHTTPPeer.h

@@ -103,7 +103,7 @@ PlainHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remote_address_))
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(&PlainHTTPPeer::do_close, this->shared_from_this()));
         return;
@@ -112,7 +112,7 @@ PlainHTTPPeer<Handler>::run()
     if (!socket_.is_open())
         return;
 
-    boost::asio::spawn(
+    util::spawn(
         this->strand_,
         std::bind(
             &PlainHTTPPeer::do_read,

include/xrpl/server/detail/SSLHTTPPeer.h

@@ -113,14 +113,14 @@ SSLHTTPPeer<Handler>::run()
 {
     if (!this->handler_.onAccept(this->session(), this->remote_address_))
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(&SSLHTTPPeer::do_close, this->shared_from_this()));
         return;
     }
     if (!socket_.is_open())
         return;
-    boost::asio::spawn(
+    util::spawn(
         this->strand_,
         std::bind(
             &SSLHTTPPeer::do_handshake,
@@ -162,7 +162,7 @@ SSLHTTPPeer<Handler>::do_handshake(yield_context do_yield)
         this->port().protocol.count("https") > 0;
     if (http)
     {
-        boost::asio::spawn(
+        util::spawn(
             this->strand_,
             std::bind(
                 &SSLHTTPPeer::do_read,

include/xrpl/server/detail/ServerImpl.h

@@ -27,6 +27,8 @@
 #include <xrpl/server/detail/io_list.h>
 
 #include <boost/asio.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
 
 #include <array>
 #include <chrono>
@@ -86,9 +88,11 @@ private:
 
     Handler& handler_;
     beast::Journal const j_;
-    boost::asio::io_service& io_service_;
-    boost::asio::io_service::strand strand_;
-    std::optional<boost::asio::io_service::work> work_;
+    boost::asio::io_context& io_context_;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand_;
+    std::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        work_;
 
     std::mutex m_;
     std::vector<Port> ports_;
@@ -101,7 +105,7 @@ private:
 public:
     ServerImpl(
         Handler& handler,
-        boost::asio::io_service& io_service,
+        boost::asio::io_context& io_context,
         beast::Journal journal);
 
     ~ServerImpl();
@@ -124,10 +128,10 @@ public:
         return ios_;
     }
 
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
-        return io_service_;
+        return io_context_;
     }
 
     bool
@@ -141,13 +145,13 @@ private:
 template <class Handler>
 ServerImpl<Handler>::ServerImpl(
     Handler& handler,
-    boost::asio::io_service& io_service,
+    boost::asio::io_context& io_context,
     beast::Journal journal)
     : handler_(handler)
     , j_(journal)
-    , io_service_(io_service)
-    , strand_(io_service_)
-    , work_(io_service_)
+    , io_context_(io_context)
+    , strand_(boost::asio::make_strand(io_context_))
+    , work_(std::in_place, boost::asio::make_work_guard(io_context_))
 {
 }
 
@@ -179,7 +183,7 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
         {
             // UDP-RPC door
             if (auto sp = ios_.emplace<UDPDoor<Handler>>(
-                    handler_, io_service_, internalPort, j_))
+                    handler_, io_context_, internalPort, j_))
             {
                 auto ep = sp->get_endpoint();
                 if (!internalPort.port)
@@ -193,7 +197,7 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
         {
             // Standard TCP door
             if (auto sp = ios_.emplace<Door<Handler>>(
-                    handler_, io_service_, internalPort, j_))
+                    handler_, io_context_, internalPort, j_))
             {
                 list_.push_back(sp);
 
@@ -204,6 +208,16 @@ ServerImpl<Handler>::ports(std::vector<Port> const& ports)
 
                 sp->run();
             }
+
+            // UDP Superhighway (XUSH) datagrams arrive on the peer port
+            // number. TCP and UDP port numbers are independent, so this
+            // needs no socket sharing with the TCP door.
+            if (internalPort.has_peer() && internalPort.udp_highway)
+            {
+                if (auto sp = ios_.emplace<UDPDoor<Handler>>(
+                        handler_, io_context_, internalPort, j_))
+                    sp->run();
+            }
         }
     }
     return eps;

include/xrpl/server/detail/Spawn.h

@@ -0,0 +1,111 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright(c) 2025 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_SERVER_SPAWN_H_INCLUDED
+#define RIPPLE_SERVER_SPAWN_H_INCLUDED
+
+#include <xrpl/basics/Log.h>
+
+#include <boost/asio/spawn.hpp>
+#include <boost/asio/strand.hpp>
+
+#include <concepts>
+#include <type_traits>
+
+namespace ripple::util {
+namespace impl {
+
+template <typename T>
+concept IsStrand = std::same_as<
+    std::decay_t<T>,
+    boost::asio::strand<typename std::decay_t<T>::inner_executor_type>>;
+
+/**
+ * @brief A completion handler that restores `boost::asio::spawn`'s behaviour
+ * from Boost 1.83
+ *
+ * This is intended to be passed as the third argument to `boost::asio::spawn`
+ * so that exceptions are not ignored but propagated to `io_context.run()` call
+ * site.
+ *
+ * @param ePtr The exception that was caught on the coroutine
+ */
+inline constexpr auto kPROPAGATE_EXCEPTIONS = [](std::exception_ptr ePtr) {
+    if (ePtr)
+    {
+        try
+        {
+            std::rethrow_exception(ePtr);
+        }
+        catch (std::exception const& e)
+        {
+            JLOG(debugLog().warn()) << "Spawn exception: " << e.what();
+            throw;
+        }
+        catch (...)
+        {
+            JLOG(debugLog().warn()) << "Spawn exception: Unknown";
+            throw;
+        }
+    }
+};
+
+}  // namespace impl
+
+/**
+ * @brief Spawns a coroutine using `boost::asio::spawn`
+ *
+ * @note This uses kPROPAGATE_EXCEPTIONS to force asio to propagate exceptions
+ * through `io_context`
+ * @note Since implicit strand was removed from boost::asio::spawn this helper
+ * function adds the strand back
+ *
+ * @tparam Ctx The type of the context/strand
+ * @tparam F The type of the function to execute
+ * @param ctx The execution context
+ * @param func The function to execute. Must return `void`
+ */
+template <typename Ctx, typename F>
+    requires std::is_invocable_r_v<void, F, boost::asio::yield_context>
+void
+spawn(Ctx&& ctx, F&& func)
+{
+    if constexpr (impl::IsStrand<Ctx>)
+    {
+        boost::asio::spawn(
+            std::forward<Ctx>(ctx),
+            std::forward<F>(func),
+            impl::kPROPAGATE_EXCEPTIONS);
+    }
+    else
+    {
+        // make_strand accepts an executor or an execution context directly.
+        // Going through get_associated_executor here resolved a plain
+        // executor to asio's inline executor, which cannot be stranded and
+        // did not compile; nothing in the tree had instantiated this branch.
+        boost::asio::spawn(
+            boost::asio::make_strand(std::forward<Ctx>(ctx)),
+            std::forward<F>(func),
+            impl::kPROPAGATE_EXCEPTIONS);
+    }
+}
+
+}  // namespace ripple::util
+
+#endif

include/xrpl/server/detail/UDPDoor.h

@@ -78,10 +78,9 @@ public:
         error_code ec;
 
         // Create UDP endpoint from port configuration
-        auto const addr = port_.ip.to_v4();
-        boost::asio::ip::udp::endpoint udp_endpoint(addr, port_.port);
+        boost::asio::ip::udp::endpoint udp_endpoint(port_.ip, port_.port);
 
-        socket_.open(boost::asio::ip::udp::v4(), ec);
+        socket_.open(udp_endpoint.protocol(), ec);
         if (ec)
         {
             JLOG(j_.error()) << "UDP socket open failed: " << ec.message();
@@ -94,17 +93,22 @@ public:
         {
             JLOG(j_.error())
                 << "UDP set reuse_address failed: " << ec.message();
+            close();
             return;
         }
 
         socket_.bind(udp_endpoint, ec);
         if (ec)
         {
-            JLOG(j_.error()) << "UDP socket bind failed: " << ec.message();
+            // Close the socket so that run() does not start receiving on an
+            // unbound socket, which would silently bind an ephemeral port.
+            JLOG(j_.error()) << "UDP socket bind to " << udp_endpoint
+                             << " failed: " << ec.message();
+            close();
             return;
         }
 
-        JLOG(j_.info()) << "UDP-RPC listening on " << udp_endpoint;
+        JLOG(j_.info()) << "UDP listening on " << udp_endpoint;
     }
 
     endpoint_type
@@ -169,6 +173,7 @@ private:
         handler_.onUDPMessage(
             std::string(recv_buffer_.data(), bytes_transferred),
             tcp_endpoint,
+            port_,
             [this, tcp_endpoint](std::string const& response) {
                 do_send(response, tcp_endpoint);
             });

include/xrpl/server/detail/io_list.h

@@ -166,7 +166,7 @@ public:
             May be called concurrently.
 
         Preconditions:
-            No call to io_service::run on any io_service
+            No call to io_context::run on any io_context
             used by work objects associated with this io_list
             exists in the caller's call stack.
     */

release-builder.sh

@@ -11,11 +11,11 @@ echo "START BUILDING (HOST)"
 echo "Cleaning previously built binary"
 rm -f release-build/xahaud
 
-BUILD_CORES=$(echo "scale=0 ; `nproc` / 1.337" | bc)
+BUILD_CORES=$(echo "scale=0 ; $(nproc) / 1.337" | bc)
 
 if [[ "$GITHUB_REPOSITORY" == "" ]]; then
   #Default
-  BUILD_CORES=${BUILD_CORES:-8} 
+  BUILD_CORES=${BUILD_CORES:-8}
 fi
 
 # Ensure still works outside of GH Actions by setting these to /dev/null
@@ -31,21 +31,19 @@ echo "-- GITHUB_SHA:        $GITHUB_SHA"
 echo "-- GITHUB_RUN_NUMBER: $GITHUB_RUN_NUMBER"
 echo "-- CONTAINER_NAME:    $CONTAINER_NAME"
 
-which docker 2> /dev/null 2> /dev/null
-if [ "$?" -eq "1" ]
-then
+which docker 2>/dev/null 2>/dev/null
+if [ "$?" -eq "1" ]; then
   echo 'Docker not found. Install it first.'
   exit 1
 fi
 
-stat .git 2> /dev/null 2> /dev/null
-if [ "$?" -eq "1" ]
-then
+stat .git 2>/dev/null 2>/dev/null
+if [ "$?" -eq "1" ]; then
   echo 'Run this inside the source directory. (.git dir not found).'
   exit 1
 fi
 
-STATIC_CONTAINER=$(docker ps -a | grep $CONTAINER_NAME |wc -l)
+STATIC_CONTAINER=$(docker ps -a | grep $CONTAINER_NAME | wc -l)
 
 CACHE_VOLUME_NAME="xahau-release-builder-cache"
 
@@ -57,13 +55,14 @@ if false; then
   docker stop $CONTAINER_NAME
 else
   echo "No static container, build on temp container"
-  rm -rf release-build;
-  mkdir -p release-build;
+  rm -rf release-build
+  mkdir -p release-build
 
   docker volume create $CACHE_VOLUME_NAME
 
   # Create inline Dockerfile with environment setup for build-full.sh
-  DOCKERFILE_CONTENT=$(cat <<'DOCKERFILE_EOF'
+  DOCKERFILE_CONTENT=$(
+    cat <<'DOCKERFILE_EOF'
 FROM ghcr.io/phusion/holy-build-box:4.0.1-amd64
 
 ARG BUILD_CORES=8
@@ -218,7 +217,7 @@ RUN /hbb_exe/activate-exec bash -c "ccache -M 100G && \
     ln -s ../../bin/ccache /usr/lib64/ccache/c++"
 
 DOCKERFILE_EOF
-)
+  )
 
   # Build custom Docker image
   IMAGE_NAME="xahaud-builder:latest"
@@ -228,14 +227,14 @@ DOCKERFILE_EOF
   if [[ "$GITHUB_REPOSITORY" == "" ]]; then
     # Non GH, local building
     echo "Non-GH runner, local building, temp container"
-    docker run -i --user 0:$(id -g) --rm -v /data/builds:/data/builds -v `pwd`:/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash -c "source /opt/rh/gcc-toolset-11/enable && bash -x /io/build-full.sh '$GITHUB_REPOSITORY' '$GITHUB_SHA' '$BUILD_CORES' '$GITHUB_RUN_NUMBER'"
+    docker run -i --user 0:$(id -g) --rm -v /data/builds:/data/builds -v $(pwd):/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash -c "source /opt/rh/gcc-toolset-11/enable && bash -x /io/build-full.sh '$GITHUB_REPOSITORY' '$GITHUB_SHA' '$BUILD_CORES' '$GITHUB_RUN_NUMBER'"
   else
     # GH Action, runner
     echo "GH Action, runner, clean & re-create create persistent container"
     docker rm -f $CONTAINER_NAME
-    echo "echo 'Stopping container: $CONTAINER_NAME'" >> "$JOB_CLEANUP_SCRIPT"
-    echo "docker stop --time=15 \"$CONTAINER_NAME\" || echo 'Failed to stop container or container not running'" >> "$JOB_CLEANUP_SCRIPT"
-    docker run -di --user 0:$(id -g) --name $CONTAINER_NAME -v /data/builds:/data/builds -v `pwd`:/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash
+    echo "echo 'Stopping container: $CONTAINER_NAME'" >>"$JOB_CLEANUP_SCRIPT"
+    echo "docker stop --time=15 \"$CONTAINER_NAME\" || echo 'Failed to stop container or container not running'" >>"$JOB_CLEANUP_SCRIPT"
+    docker run -di --user 0:$(id -g) --name $CONTAINER_NAME -v /data/builds:/data/builds -v $(pwd):/io -v "$CACHE_VOLUME_NAME":/cache --network host "$IMAGE_NAME" /hbb_exe/activate-exec bash
     docker exec -i $CONTAINER_NAME /hbb_exe/activate-exec bash -c "source /opt/rh/gcc-toolset-11/enable && bash -x /io/build-full.sh '$GITHUB_REPOSITORY' '$GITHUB_SHA' '$BUILD_CORES' '$GITHUB_RUN_NUMBER'"
     docker stop $CONTAINER_NAME
   fi

src/libxrpl/basics/ResolverAsio.cpp

@@ -22,7 +22,14 @@
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/net/IPEndpoint.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <boost/asio.hpp>
+
+#include <boost/asio/bind_executor.hpp>
+#include <boost/asio/error.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/system/detail/error_code.hpp>
+
+#include <algorithm>
 #include <atomic>
 #include <condition_variable>
 #include <deque>
@@ -110,8 +117,8 @@ public:
 
     beast::Journal m_journal;
 
-    boost::asio::io_service& m_io_service;
-    boost::asio::io_service::strand m_strand;
+    boost::asio::io_context& m_io_context;
+    boost::asio::strand<boost::asio::io_context::executor_type> m_strand;
     boost::asio::ip::tcp::resolver m_resolver;
 
     std::condition_variable m_cv;
@@ -141,12 +148,12 @@ public:
     std::deque<Work> m_work;
 
     ResolverAsioImpl(
-        boost::asio::io_service& io_service,
+        boost::asio::io_context& io_context,
         beast::Journal journal)
         : m_journal(journal)
-        , m_io_service(io_service)
-        , m_strand(io_service)
-        , m_resolver(io_service)
+        , m_io_context(io_context)
+        , m_strand(boost::asio::make_strand(io_context))
+        , m_resolver(io_context)
         , m_asyncHandlersCompleted(true)
         , m_stop_called(false)
         , m_stopped(true)
@@ -202,8 +209,14 @@ public:
     {
         if (m_stop_called.exchange(true) == false)
         {
-            m_io_service.dispatch(m_strand.wrap(std::bind(
-                &ResolverAsioImpl::do_stop, this, CompletionCounter(this))));
+            boost::asio::dispatch(
+                m_io_context,
+                boost::asio::bind_executor(
+                    m_strand,
+                    std::bind(
+                        &ResolverAsioImpl::do_stop,
+                        this,
+                        CompletionCounter(this))));
 
             JLOG(m_journal.debug()) << "Queued a stop request";
         }
@@ -234,12 +247,16 @@ public:
 
         // TODO NIKB use rvalue references to construct and move
         //           reducing cost.
-        m_io_service.dispatch(m_strand.wrap(std::bind(
-            &ResolverAsioImpl::do_resolve,
-            this,
-            names,
-            handler,
-            CompletionCounter(this))));
+        boost::asio::dispatch(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &ResolverAsioImpl::do_resolve,
+                    this,
+                    names,
+                    handler,
+                    CompletionCounter(this))));
     }
 
     //-------------------------------------------------------------------------
@@ -265,19 +282,20 @@ public:
         std::string name,
         boost::system::error_code const& ec,
         HandlerType handler,
-        boost::asio::ip::tcp::resolver::iterator iter,
+        boost::asio::ip::tcp::resolver::results_type results,
         CompletionCounter)
     {
         if (ec == boost::asio::error::operation_aborted)
             return;
 
         std::vector<beast::IP::Endpoint> addresses;
+        auto iter = results.begin();
 
         // If we get an error message back, we don't return any
         // results that we may have gotten.
         if (!ec)
         {
-            while (iter != boost::asio::ip::tcp::resolver::iterator())
+            while (iter != results.end())
             {
                 addresses.push_back(
                     beast::IPAddressConversion::from_asio(*iter));
@@ -287,8 +305,14 @@ public:
 
         handler(name, addresses);
 
-        m_io_service.post(m_strand.wrap(std::bind(
-            &ResolverAsioImpl::do_work, this, CompletionCounter(this))));
+        boost::asio::post(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &ResolverAsioImpl::do_work,
+                    this,
+                    CompletionCounter(this))));
     }
 
     HostAndPort
@@ -369,16 +393,21 @@ public:
         {
             JLOG(m_journal.error()) << "Unable to parse '" << name << "'";
 
-            m_io_service.post(m_strand.wrap(std::bind(
-                &ResolverAsioImpl::do_work, this, CompletionCounter(this))));
+            boost::asio::post(
+                m_io_context,
+                boost::asio::bind_executor(
+                    m_strand,
+                    std::bind(
+                        &ResolverAsioImpl::do_work,
+                        this,
+                        CompletionCounter(this))));
 
             return;
         }
 
-        boost::asio::ip::tcp::resolver::query query(host, port);
-
         m_resolver.async_resolve(
-            query,
+            host,
+            port,
             std::bind(
                 &ResolverAsioImpl::do_finish,
                 this,
@@ -409,10 +438,14 @@ public:
 
             if (m_work.size() > 0)
             {
-                m_io_service.post(m_strand.wrap(std::bind(
-                    &ResolverAsioImpl::do_work,
-                    this,
-                    CompletionCounter(this))));
+                boost::asio::post(
+                    m_io_context,
+                    boost::asio::bind_executor(
+                        m_strand,
+                        std::bind(
+                            &ResolverAsioImpl::do_work,
+                            this,
+                            CompletionCounter(this))));
             }
         }
     }
@@ -421,9 +454,9 @@ public:
 //-----------------------------------------------------------------------------
 
 std::unique_ptr<ResolverAsio>
-ResolverAsio::New(boost::asio::io_service& io_service, beast::Journal journal)
+ResolverAsio::New(boost::asio::io_context& io_context, beast::Journal journal)
 {
-    return std::make_unique<ResolverAsioImpl>(io_service, journal);
+    return std::make_unique<ResolverAsioImpl>(io_context, journal);
 }
 
 //-----------------------------------------------------------------------------

src/libxrpl/basics/UTF8.cpp

@@ -0,0 +1,101 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/basics/UTF8.h>
+
+namespace ripple {
+
+bool
+isValidUTF8(Slice const& s) noexcept
+{
+    std::size_t const size = s.size();
+
+    // Markus Kuhn's utf8_check.c
+    // (https://www.cl.cam.ac.uk/~mgk25/ucs/utf8_check.c), the decoder
+    // URIToken has always used, with one change: each branch establishes
+    // that the whole sequence is present before reading any continuation
+    // byte, so a truncated tail is invalid rather than an out-of-bounds read.
+    std::size_t i = 0;
+    while (i < size)
+    {
+        std::uint8_t const c0 = s[i];
+
+        if (c0 < 0x80)
+        {
+            // 0xxxxxxx
+            ++i;
+            continue;
+        }
+
+        if ((c0 & 0xE0) == 0xC0)
+        {
+            // 110xxxxx 10xxxxxx
+            if (size - i < 2)
+                return false;
+            if ((s[i + 1] & 0xC0) != 0x80)
+                return false;
+            if ((c0 & 0xFE) == 0xC0)  // overlong
+                return false;
+            i += 2;
+            continue;
+        }
+
+        if ((c0 & 0xF0) == 0xE0)
+        {
+            // 1110xxxx 10xxxxxx 10xxxxxx
+            if (size - i < 3)
+                return false;
+            std::uint8_t const c1 = s[i + 1];
+            if ((c1 & 0xC0) != 0x80 || (s[i + 2] & 0xC0) != 0x80)
+                return false;
+            if (c0 == 0xE0 && (c1 & 0xE0) == 0x80)  // overlong
+                return false;
+            if (c0 == 0xED && (c1 & 0xE0) == 0xA0)  // UTF-16 surrogate
+                return false;
+            if (c0 == 0xEF && c1 == 0xBF &&
+                (s[i + 2] & 0xFE) == 0xBE)  // U+FFFE or U+FFFF
+                return false;
+            i += 3;
+            continue;
+        }
+
+        if ((c0 & 0xF8) == 0xF0)
+        {
+            // 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
+            if (size - i < 4)
+                return false;
+            std::uint8_t const c1 = s[i + 1];
+            if ((c1 & 0xC0) != 0x80 || (s[i + 2] & 0xC0) != 0x80 ||
+                (s[i + 3] & 0xC0) != 0x80)
+                return false;
+            if (c0 == 0xF0 && (c1 & 0xF0) == 0x80)  // overlong
+                return false;
+            if (c0 > 0xF4 || (c0 == 0xF4 && c1 > 0x8F))  // > U+10FFFF
+                return false;
+            i += 4;
+            continue;
+        }
+
+        // Stray continuation byte or 0xF8..0xFF.
+        return false;
+    }
+    return true;
+}
+
+}  // namespace ripple

src/libxrpl/beast/insight/StatsDCollector.cpp

@@ -26,10 +26,24 @@
 #include <xrpl/beast/insight/StatsDCollector.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
 #include <xrpl/beast/utility/instrumentation.h>
+
+#include <boost/asio/basic_waitable_timer.hpp>
+#include <boost/asio/bind_executor.hpp>
+#include <boost/asio/buffer.hpp>
+#include <boost/asio/error.hpp>
+#include <boost/asio/executor_work_guard.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/udp.hpp>
+#include <boost/asio/strand.hpp>
+#include <boost/system/detail/error_code.hpp>
+
 #include <boost/asio/ip/tcp.hpp>
+#include <chrono>
 #include <climits>
+#include <cstddef>
 #include <deque>
 #include <functional>
+#include <iostream>
 #include <mutex>
 #include <optional>
 #include <set>
@@ -223,9 +237,11 @@ private:
     Journal m_journal;
     IP::Endpoint m_address;
     std::string m_prefix;
-    boost::asio::io_service m_io_service;
-    std::optional<boost::asio::io_service::work> m_work;
-    boost::asio::io_service::strand m_strand;
+    boost::asio::io_context m_io_context;
+    std::optional<boost::asio::executor_work_guard<
+        boost::asio::io_context::executor_type>>
+        m_work;
+    boost::asio::strand<boost::asio::io_context::executor_type> m_strand;
     boost::asio::basic_waitable_timer<std::chrono::steady_clock> m_timer;
     boost::asio::ip::udp::socket m_socket;
     std::deque<std::string> m_data;
@@ -249,18 +265,24 @@ public:
         : m_journal(journal)
         , m_address(address)
         , m_prefix(prefix)
-        , m_work(std::ref(m_io_service))
-        , m_strand(m_io_service)
-        , m_timer(m_io_service)
-        , m_socket(m_io_service)
+        , m_work(boost::asio::make_work_guard(m_io_context))
+        , m_strand(boost::asio::make_strand(m_io_context))
+        , m_timer(m_io_context)
+        , m_socket(m_io_context)
         , m_thread(&StatsDCollectorImp::run, this)
     {
     }
 
     ~StatsDCollectorImp() override
     {
-        boost::system::error_code ec;
-        m_timer.cancel(ec);
+        try
+        {
+            m_timer.cancel();
+        }
+        catch (boost::system::system_error const&)
+        {
+            // ignored
+        }
 
         m_work.reset();
         m_thread.join();
@@ -319,10 +341,10 @@ public:
 
     //--------------------------------------------------------------------------
 
-    boost::asio::io_service&
-    get_io_service()
+    boost::asio::io_context&
+    get_io_context()
     {
-        return m_io_service;
+        return m_io_context;
     }
 
     std::string const&
@@ -340,8 +362,14 @@ public:
     void
     post_buffer(std::string&& buffer)
     {
-        m_io_service.dispatch(m_strand.wrap(std::bind(
-            &StatsDCollectorImp::do_post_buffer, this, std::move(buffer))));
+        boost::asio::dispatch(
+            m_io_context,
+            boost::asio::bind_executor(
+                m_strand,
+                std::bind(
+                    &StatsDCollectorImp::do_post_buffer,
+                    this,
+                    std::move(buffer))));
     }
 
     // The keepAlive parameter makes sure the buffers sent to
@@ -371,7 +399,7 @@ public:
         for (auto const& buffer : buffers)
         {
             std::string const s(
-                boost::asio::buffer_cast<char const*>(buffer),
+                static_cast<char const*>(buffer.data()),
                 boost::asio::buffer_size(buffer));
             std::cerr << s;
         }
@@ -441,7 +469,7 @@ public:
     set_timer()
     {
         using namespace std::chrono_literals;
-        m_timer.expires_from_now(1s);
+        m_timer.expires_after(1s);
         m_timer.async_wait(std::bind(
             &StatsDCollectorImp::on_timer, this, std::placeholders::_1));
     }
@@ -483,13 +511,13 @@ public:
 
         set_timer();
 
-        m_io_service.run();
+        m_io_context.run();
 
         m_socket.shutdown(boost::asio::ip::udp::socket::shutdown_send, ec);
 
         m_socket.close();
 
-        m_io_service.poll();
+        m_io_context.poll();
     }
 };
 
@@ -532,10 +560,12 @@ StatsDCounterImpl::~StatsDCounterImpl()
 void
 StatsDCounterImpl::increment(CounterImpl::value_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDCounterImpl::do_increment,
-        std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDCounterImpl::do_increment,
+            std::static_pointer_cast<StatsDCounterImpl>(shared_from_this()),
+            amount));
 }
 
 void
@@ -577,10 +607,12 @@ StatsDEventImpl::StatsDEventImpl(
 void
 StatsDEventImpl::notify(EventImpl::value_type const& value)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDEventImpl::do_notify,
-        std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
-        value));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDEventImpl::do_notify,
+            std::static_pointer_cast<StatsDEventImpl>(shared_from_this()),
+            value));
 }
 
 void
@@ -610,19 +642,23 @@ StatsDGaugeImpl::~StatsDGaugeImpl()
 void
 StatsDGaugeImpl::set(GaugeImpl::value_type value)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDGaugeImpl::do_set,
-        std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-        value));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDGaugeImpl::do_set,
+            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
+            value));
 }
 
 void
 StatsDGaugeImpl::increment(GaugeImpl::difference_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDGaugeImpl::do_increment,
-        std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDGaugeImpl::do_increment,
+            std::static_pointer_cast<StatsDGaugeImpl>(shared_from_this()),
+            amount));
 }
 
 void
@@ -698,10 +734,12 @@ StatsDMeterImpl::~StatsDMeterImpl()
 void
 StatsDMeterImpl::increment(MeterImpl::value_type amount)
 {
-    m_impl->get_io_service().dispatch(std::bind(
-        &StatsDMeterImpl::do_increment,
-        std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
-        amount));
+    boost::asio::dispatch(
+        m_impl->get_io_context(),
+        std::bind(
+            &StatsDMeterImpl::do_increment,
+            std::static_pointer_cast<StatsDMeterImpl>(shared_from_this()),
+            amount));
 }
 
 void

src/libxrpl/beast/net/IPAddressV4.cpp

@@ -28,11 +28,11 @@ namespace IP {
 bool
 is_private(AddressV4 const& addr)
 {
-    return ((addr.to_ulong() & 0xff000000) ==
+    return ((addr.to_uint() & 0xff000000) ==
             0x0a000000) ||  // Prefix /8,    10.  #.#.#
-        ((addr.to_ulong() & 0xfff00000) ==
+        ((addr.to_uint() & 0xfff00000) ==
          0xac100000) ||  // Prefix /12   172. 16.#.# - 172.31.#.#
-        ((addr.to_ulong() & 0xffff0000) ==
+        ((addr.to_uint() & 0xffff0000) ==
          0xc0a80000) ||  // Prefix /16   192.168.#.#
         addr.is_loopback();
 }
@@ -47,7 +47,7 @@ char
 get_class(AddressV4 const& addr)
 {
     static char const* table = "AAAABBCD";
-    return table[(addr.to_ulong() & 0xE0000000) >> 29];
+    return table[(addr.to_uint() & 0xE0000000) >> 29];
 }
 
 }  // namespace IP

src/libxrpl/beast/net/IPAddressV6.cpp

@@ -20,6 +20,8 @@
 #include <xrpl/beast/net/IPAddressV4.h>
 #include <xrpl/beast/net/IPAddressV6.h>
 
+#include <boost/asio/ip/address_v4.hpp>
+
 namespace beast {
 namespace IP {
 
@@ -28,7 +30,9 @@ is_private(AddressV6 const& addr)
 {
     return (
         (addr.to_bytes()[0] & 0xfd) ||  // TODO  fc00::/8 too ?
-        (addr.is_v4_mapped() && is_private(addr.to_v4())));
+        (addr.is_v4_mapped() &&
+         is_private(boost::asio::ip::make_address_v4(
+             boost::asio::ip::v4_mapped, addr))));
 }
 
 bool

src/libxrpl/beast/net/IPEndpoint.cpp

@@ -18,7 +18,19 @@
 //==============================================================================
 
 #include <xrpl/beast/net/IPEndpoint.h>
+
+#include <boost/algorithm/string/trim.hpp>
+#include <boost/asio/ip/address.hpp>
+#include <boost/asio/ip/address_v4.hpp>
+#include <boost/system/detail/error_code.hpp>
+
 #include <boost/algorithm/string.hpp>
+#include <cctype>
+#include <ios>
+#include <istream>
+#include <optional>
+#include <sstream>
+#include <string>
 
 namespace beast {
 namespace IP {
@@ -157,7 +169,7 @@ operator>>(std::istream& is, Endpoint& endpoint)
     }
 
     boost::system::error_code ec;
-    auto addr = Address::from_string(addrStr, ec);
+    auto addr = boost::asio::ip::make_address(addrStr, ec);
     if (ec)
     {
         is.setstate(std::ios_base::failbit);

src/libxrpl/protocol/AMMCore.cpp

@@ -66,7 +66,7 @@ invalidAMMAsset(
     Issue const& issue,
     std::optional<std::pair<Issue, Issue>> const& pair)
 {
-    if (badCurrency() == issue.currency)
+    if (isBadCurrency(issue.currency))
         return temBAD_CURRENCY;
     if (isXRP(issue) && issue.account.isNonZero())
         return temBAD_ISSUER;

src/libxrpl/protocol/AppLoader.cpp

@@ -0,0 +1,180 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2025 XRPL Labs
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/UTF8.h>
+#include <xrpl/protocol/AppLoader.h>
+#include <xrpl/protocol/Protocol.h>
+
+#include <string_view>
+
+namespace ripple {
+namespace appLoader {
+
+namespace {
+
+// HTML "ASCII whitespace": TAB, LF, FF, CR, SPACE.
+inline bool
+isSpace(std::uint8_t c) noexcept
+{
+    return c == 0x09 || c == 0x0A || c == 0x0C || c == 0x0D || c == 0x20;
+}
+
+inline std::uint8_t
+lower(std::uint8_t c) noexcept
+{
+    return (c >= 'A' && c <= 'Z') ? static_cast<std::uint8_t>(c + 32) : c;
+}
+
+// Case-insensitive match of lower-case `lit` at `pos`; never reads past
+// the end.
+bool
+matchAt(
+    std::uint8_t const* data,
+    std::size_t size,
+    std::size_t pos,
+    std::string_view lit) noexcept
+{
+    if (pos > size || size - pos < lit.size())
+        return false;
+    for (std::size_t i = 0; i < lit.size(); ++i)
+        if (lower(data[pos + i]) != static_cast<std::uint8_t>(lit[i]))
+            return false;
+    return true;
+}
+
+std::size_t
+findFrom(
+    std::uint8_t const* data,
+    std::size_t size,
+    std::size_t from,
+    std::string_view lit) noexcept
+{
+    for (std::size_t i = from; i + lit.size() <= size; ++i)
+        if (matchAt(data, size, i, lit))
+            return i;
+    return size;
+}
+
+// So that "<htmlish>" is not mistaken for "<html>".
+inline bool
+isTagNameEnd(std::uint8_t c) noexcept
+{
+    return isSpace(c) || c == '>' || c == '/';
+}
+
+}  // namespace
+
+Result
+validate(std::uint8_t const* data, std::size_t size)
+{
+    if (size == 0 || data == nullptr)
+        return Result::empty;
+    if (size > maxAppLoaderLength)
+        return Result::tooLarge;
+    if (!isValidUTF8(Slice(data, size)))
+        return Result::badUTF8;
+    for (std::size_t i = 0; i < size; ++i)
+        if (!isSpace(data[i]) && (data[i] < 0x20 || data[i] == 0x7F))
+            return Result::badControlChar;
+
+    std::size_t begin = 0;
+    if (size >= 3 && data[0] == 0xEF && data[1] == 0xBB && data[2] == 0xBF)
+        begin = 3;
+    while (begin < size && isSpace(data[begin]))
+        ++begin;
+    if (begin == size)
+        return Result::empty;
+
+    // "<!doctype" followed by whitespace is the only doctype form any
+    // browser treats as standards-mode HTML.
+    bool const doctype = matchAt(data, size, begin, "<!doctype") &&
+        begin + 9 < size && isSpace(data[begin + 9]);
+    bool const html = matchAt(data, size, begin, "<html") && begin + 5 < size &&
+        isTagNameEnd(data[begin + 5]);
+    if (!doctype && !html)
+        return Result::noDoctype;
+
+    std::size_t open = begin;
+    for (;;)
+    {
+        open = findFrom(data, size, open, "<html");
+        if (open == size)
+            return Result::noHtmlElement;
+        if (open + 5 < size && isTagNameEnd(data[open + 5]))
+            break;
+        ++open;
+    }
+
+    // The LAST well-formed </html>, so that one quoted inside a script
+    // does not shadow the real one. Linear: each probe resumes one past
+    // the previous match.
+    // closeEnd == 0 means none found: a well-formed </html> always ends
+    // past position 0.
+    std::size_t closeEnd = 0;
+    for (std::size_t probe = open;;)
+    {
+        std::size_t const found = findFrom(data, size, probe, "</html");
+        if (found == size)
+            break;
+        std::size_t j = found + 6;
+        while (j < size && isSpace(data[j]))
+            ++j;
+        if (j < size && data[j] == '>')
+            closeEnd = j + 1;
+        probe = found + 1;
+    }
+    if (closeEnd == 0)
+        return Result::unclosed;
+
+    for (std::size_t i = closeEnd; i < size; ++i)
+        if (!isSpace(data[i]))
+            return Result::trailingGarbage;
+    return Result::ok;
+}
+
+char const*
+to_string(Result r)
+{
+    switch (r)
+    {
+        case Result::ok:
+            return "ok";
+        case Result::empty:
+            return "empty document";
+        case Result::tooLarge:
+            return "document exceeds maxAppLoaderLength";
+        case Result::badUTF8:
+            return "malformed UTF-8";
+        case Result::badControlChar:
+            return "forbidden control character";
+        case Result::noDoctype:
+            return "does not open with a doctype or <html> tag";
+        case Result::noHtmlElement:
+            return "missing <html> start tag";
+        case Result::unclosed:
+            return "missing or misplaced </html> end tag";
+        case Result::trailingGarbage:
+            return "content after </html>";
+    }
+    return "unknown";
+}
+
+}  // namespace appLoader
+}  // namespace ripple

src/libxrpl/protocol/BuildInfo.cpp

@@ -56,9 +56,9 @@ getVersionString()
         (versionString == std::string("0.") + std::string("0.0") ||
          versionString == std::string("0.0.0+DEBUG")))
     {
-        std::string y = std::string(__DATE__ + 7);
+        std::string y = std::string(&__DATE__[7]);
         std::string d = std::string(
-            __DATE__ + 4 + (__DATE__[4] == ' ' ? 1 : 0),
+            &__DATE__[4 + (__DATE__[4] == ' ' ? 1 : 0)],
             __DATE__[4] == ' ' ? 1 : 2);
         std::string m;
         switch (__DATE__[0])

src/libxrpl/protocol/Feature.cpp

@@ -250,12 +250,9 @@ FeatureCollections::registerFeature(
     Feature const* i = getByName(name);
     if (!i)
     {
-        // If this check fails, and you just added a feature, increase the
-        // numFeatures value in Feature.h
         check(
             features.size() < detail::numFeatures,
-            "More features defined than allocated. Adjust numFeatures in "
-            "Feature.h.");
+            "More features defined than allocated.");
 
         auto const f = sha512Half(Slice(name.data(), name.size()));
 
@@ -424,45 +421,26 @@ featureToName(uint256 const& f)
 #undef XRPL_FEATURE
 #pragma push_macro("XRPL_FIX")
 #undef XRPL_FIX
+#pragma push_macro("XRPL_RETIRE")
+#undef XRPL_RETIRE
 
 #define XRPL_FEATURE(name, supported, vote) \
     uint256 const feature##name = registerFeature(#name, supported, vote);
 #define XRPL_FIX(name, supported, vote) \
     uint256 const fix##name = registerFeature("fix" #name, supported, vote);
+#define XRPL_RETIRE(name)                                                     \
+    [[deprecated("The referenced amendment has been retired"), maybe_unused]] \
+    uint256 const retired##name = retireFeature(#name);
 
 #include <xrpl/protocol/detail/features.macro>
 
+#undef XRPL_RETIRE
+#pragma pop_macro("XRPL_RETIRE")
 #undef XRPL_FIX
 #pragma pop_macro("XRPL_FIX")
 #undef XRPL_FEATURE
 #pragma pop_macro("XRPL_FEATURE")
 
-// clang-format off
-
-// The following amendments have been active for at least two years. Their
-// pre-amendment code has been removed and the identifiers are deprecated.
-// All known amendments and amendments that may appear in a validated
-// ledger must be registered either here or above with the "active" amendments
-[[deprecated("The referenced amendment has been retired"), maybe_unused]]
-uint256 const
-    retiredMultiSign         = retireFeature("MultiSign"),
-    retiredTrustSetAuth      = retireFeature("TrustSetAuth"),
-    retiredFeeEscalation     = retireFeature("FeeEscalation"),
-    retiredPayChan           = retireFeature("PayChan"),
-    retiredCryptoConditions  = retireFeature("CryptoConditions"),
-    retiredTickSize          = retireFeature("TickSize"),
-    retiredFix1368           = retireFeature("fix1368"),
-    retiredEscrow            = retireFeature("Escrow"),
-    retiredFix1373           = retireFeature("fix1373"),
-    retiredEnforceInvariants = retireFeature("EnforceInvariants"),
-    retiredSortedDirectories = retireFeature("SortedDirectories"),
-    retiredFix1201           = retireFeature("fix1201"),
-    retiredFix1512           = retireFeature("fix1512"),
-    retiredFix1523           = retireFeature("fix1523"),
-    retiredFix1528           = retireFeature("fix1528");
-
-// clang-format on
-
 // All of the features should now be registered, since variables in a cpp file
 // are initialized from top to bottom.
 //

src/libxrpl/protocol/Indexes.cpp

@@ -31,6 +31,8 @@
 
 namespace ripple {
 
+#define LEDGER_NAMESPACE2(value1, value2) (uint16_t(value1) << 8) | value2
+
 /** Type-specific prefix for calculating ledger indices.
 
     The identifier for a given object within the ledger is calculated based
@@ -79,16 +81,20 @@ enum class LedgerNameSpace : std::uint16_t {
     IMPORT_VLSEQ = 'I',
     UNL_REPORT = 'R',
     CRON = 'L',
+    APP_LOADER = 'W',
     AMM = 'A',
-    BRIDGE = 'H',
+    BRIDGE = LEDGER_NAMESPACE2(0x01, 'H'),
     XCHAIN_CLAIM_ID = 'Q',
     XCHAIN_CREATE_ACCOUNT_CLAIM_ID = 'K',
-    DID = 'I',
-    ORACLE = 'R',
+    DID = LEDGER_NAMESPACE2(0x01, 'I'),
+    ORACLE = LEDGER_NAMESPACE2(0x01, 'R'),
     MPTOKEN_ISSUANCE = '~',
     MPTOKEN = 't',
-    CREDENTIAL = 'D',
+    MANIFEST = 'M',
+    MANIFEST_DIR = LEDGER_NAMESPACE2(0x01, 'M'),
+    CREDENTIAL = LEDGER_NAMESPACE2(0x01, 'D'),
     PERMISSIONED_DOMAIN = 'm',
+    RANDOM = 0x526E,  // Rn
 
     // No longer used or supported. Left here to reserve the space
     // to avoid accidental reuse.
@@ -273,6 +279,13 @@ UNLReport() noexcept
     return ret;
 }
 
+Keylet const&
+random() noexcept
+{
+    static Keylet const ret{ltRANDOM, indexHash(LedgerNameSpace::RANDOM)};
+    return ret;
+}
+
 Keylet
 book_t::operator()(Book const& b) const
 {
@@ -610,6 +623,12 @@ did(AccountID const& account) noexcept
     return {ltDID, indexHash(LedgerNameSpace::DID, account)};
 }
 
+Keylet
+appLoader(AccountID const& account) noexcept
+{
+    return {ltAPP_LOADER, indexHash(LedgerNameSpace::APP_LOADER, account)};
+}
+
 Keylet
 oracle(AccountID const& account, std::uint32_t const& documentID) noexcept
 {
@@ -668,6 +687,20 @@ permissionedDomain(uint256 const& domainID) noexcept
     return {ltPERMISSIONED_DOMAIN, domainID};
 }
 
+Keylet
+manifest(PublicKey const& pk) noexcept
+{
+    return {ltMANIFEST, indexHash(LedgerNameSpace::MANIFEST, pk.slice())};
+}
+
+Keylet const&
+manifestDir() noexcept
+{
+    static Keylet const ret{
+        ltDIR_NODE, indexHash(LedgerNameSpace::MANIFEST_DIR)};
+    return ret;
+}
+
 }  // namespace keylet
 
 }  // namespace ripple

src/libxrpl/protocol/InnerObjectFormats.cpp

@@ -87,19 +87,6 @@ InnerObjectFormats::InnerObjectFormats()
          {sfEmittedTxnID, soeREQUIRED},
          {sfEmitNonce, soeOPTIONAL}});
 
-    add(sfHookDefinition.jsonName,
-        sfHookDefinition.getCode(),
-        {{sfCreateCode, soeREQUIRED},
-         {sfHookNamespace, soeREQUIRED},
-         {sfHookParameters, soeREQUIRED},
-         {sfHookOn, soeOPTIONAL},
-         {sfHookOnIncoming, soeOPTIONAL},
-         {sfHookOnOutgoing, soeOPTIONAL},
-         {sfHookCanEmit, soeOPTIONAL},
-         {sfHookApiVersion, soeREQUIRED},
-         {sfFlags, soeREQUIRED},
-         {sfFee, soeREQUIRED}});
-
     add(sfHook.jsonName,
         sfHook.getCode(),
         {{sfHookHash, soeOPTIONAL},
@@ -112,6 +99,7 @@ InnerObjectFormats::InnerObjectFormats()
          {sfHookOnOutgoing, soeOPTIONAL},
          {sfHookCanEmit, soeOPTIONAL},
          {sfHookApiVersion, soeOPTIONAL},
+         {sfHookName, soeOPTIONAL},
          {sfFlags, soeOPTIONAL}});
 
     add(sfHookGrant.jsonName,
@@ -155,6 +143,14 @@ InnerObjectFormats::InnerObjectFormats()
             {sfAccount, soeOPTIONAL},
         });
 
+    add(sfRandomDigestEntry.jsonName,
+        sfRandomDigestEntry.getCode(),
+        {
+            {sfPublicKey, soeREQUIRED},
+            {sfNextRandomDigest, soeREQUIRED},
+            {sfLedgerSequence, soeREQUIRED},
+        });
+
     add(sfAmountEntry.jsonName,
         sfAmountEntry.getCode(),
         {
@@ -266,6 +262,24 @@ InnerObjectFormats::InnerObjectFormats()
             {sfIssuer, soeREQUIRED},
             {sfCredentialType, soeREQUIRED},
         });
+
+    add(sfHighReward.jsonName,
+        sfHighReward.getCode(),
+        {
+            {sfRewardLgrFirst, soeREQUIRED},
+            {sfRewardLgrLast, soeREQUIRED},
+            {sfRewardTime, soeREQUIRED},
+            {sfTrustLineRewardAccumulator, soeREQUIRED},
+        });
+
+    add(sfLowReward.jsonName,
+        sfLowReward.getCode(),
+        {
+            {sfRewardLgrFirst, soeREQUIRED},
+            {sfRewardLgrLast, soeREQUIRED},
+            {sfRewardTime, soeREQUIRED},
+            {sfTrustLineRewardAccumulator, soeREQUIRED},
+        });
 }
 
 InnerObjectFormats const&

src/libxrpl/protocol/Issue.cpp

@@ -111,7 +111,7 @@ issueFromJson(Json::Value const& v)
     }
 
     auto const currency = to_currency(curStr.asString());
-    if (currency == badCurrency() || currency == noCurrency())
+    if (isBadCurrency(currency) || currency == noCurrency())
     {
         Throw<Json::error>("issueFromJson currency must be a valid currency");
     }

src/libxrpl/protocol/STCurrency.cpp

@@ -103,7 +103,7 @@ currencyFromJson(SField const& name, Json::Value const& v)
     }
 
     auto const currency = to_currency(v.asString());
-    if (currency == badCurrency() || currency == noCurrency())
+    if (isBadCurrency(currency) || currency == noCurrency())
     {
         Throw<std::runtime_error>(
             "currencyFromJson currency must be a valid currency");

src/libxrpl/protocol/STTx.cpp

@@ -684,7 +684,8 @@ isPseudoTx(STObject const& tx)
 
     auto tt = safe_cast<TxType>(*t);
     return tt == ttAMENDMENT || tt == ttFEE || tt == ttUNL_MODIFY ||
-        tt == ttEMIT_FAILURE || tt == ttUNL_REPORT || tt == ttCRON;
+        tt == ttEMIT_FAILURE || tt == ttUNL_REPORT || tt == ttCRON ||
+        tt == ttENTROPY;
 }
 
 }  // namespace ripple

src/libxrpl/protocol/TER.cpp

@@ -151,6 +151,9 @@ transResults()
         MAKE_ERROR(tefNONDIR_EMIT,                 "An emitted txn was injected into the ledger without a corresponding directory entry."),
         MAKE_ERROR(tefIMPORT_BLACKHOLED,           "Cannot import keying because target account is blackholed."),
         MAKE_ERROR(tefINVALID_LEDGER_FIX_TYPE,     "The LedgerFixType field has an invalid value."),
+        MAKE_ERROR(tefPAST_MANIFEST_SEQ,           "The submitted manifest's sequence is not newer than the current."),
+        MAKE_ERROR(tefREVOKED_MANIFEST,            "The submitted manifest is for a revoked master key."),
+        MAKE_ERROR(tefMANIFEST_KEY_IN_USE,         "A key the submitted manifest names is already in use by another manifest."),
 
         MAKE_ERROR(telLOCAL_ERROR,            "Local failure."),
         MAKE_ERROR(telBAD_DOMAIN,             "Domain too long."),
@@ -172,6 +175,7 @@ transResults()
         MAKE_ERROR(telIMPORT_VL_KEY_NOT_RECOGNISED, "Import vl key was not recognized."),
         MAKE_ERROR(telCAN_NOT_QUEUE_IMPORT,   "Import transaction was not able to be directly applied and cannot be queued."),
         MAKE_ERROR(telENV_RPC_FAILED,         "Unit test RPC failure."),
+        MAKE_ERROR(telMANIFEST_FEE_MISMATCH,  "Unsigned SetManifest fee is not, or cannot be confirmed as, canonical for this server's ledger fee settings."),
 
         MAKE_ERROR(temMALFORMED,                 "Malformed transaction."),
         MAKE_ERROR(temBAD_AMM_TOKENS,            "Malformed: Invalid LPTokens."),

src/libxrpl/protocol/TxFormats.cpp

@@ -48,6 +48,7 @@ TxFormats::TxFormats()
         {sfFirstLedgerSequence, soeOPTIONAL},
         {sfNetworkID, soeOPTIONAL},
         {sfHookParameters, soeOPTIONAL},
+        {sfHookName, soeOPTIONAL},
     };
 
 #pragma push_macro("UNWRAP")

src/libxrpl/protocol/TxMeta.cpp

@@ -49,6 +49,9 @@ TxMeta::TxMeta(
 
     if (obj.isFieldPresent(sfHookEmissions))
         setHookEmissions(obj.getFieldArray(sfHookEmissions));
+
+    if (obj.isFieldPresent(sfRandomData))
+        setRandomData(obj.getFieldH256(sfRandomData));
 }
 
 TxMeta::TxMeta(uint256 const& txid, std::uint32_t ledger, STObject const& obj)
@@ -75,6 +78,9 @@ TxMeta::TxMeta(uint256 const& txid, std::uint32_t ledger, STObject const& obj)
 
     if (obj.isFieldPresent(sfHookEmissions))
         setHookEmissions(obj.getFieldArray(sfHookEmissions));
+
+    if (obj.isFieldPresent(sfRandomData))
+        setRandomData(obj.getFieldH256(sfRandomData));
 }
 
 TxMeta::TxMeta(uint256 const& txid, std::uint32_t ledger, Blob const& vec)
@@ -245,6 +251,9 @@ TxMeta::getAsObject() const
     if (hasHookEmissions())
         metaData.setFieldArray(sfHookEmissions, getHookEmissions());
 
+    if (hasRandomData())
+        metaData.setFieldH256(sfRandomData, getRandomData());
+
     return metaData;
 }
 

src/libxrpl/protocol/tokens.cpp

@@ -545,7 +545,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     XRPL_ASSERT(
         num_b_58_10_coeffs <= b_58_10_coeff.size(),
         "ripple::b58_fast::detail::b58_to_b256_be : maximum coeff");
-    for (auto c : input.substr(0, partial_coeff_len))
+    for (unsigned char const c : input.substr(0, partial_coeff_len))
     {
         auto cur_val = ::ripple::alphabetReverse[c];
         if (cur_val < 0)
@@ -559,7 +559,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         for (int j = 0; j < num_full_coeffs; ++j)
         {
-            auto c = input[partial_coeff_len + j * 10 + i];
+            unsigned char const c = input[partial_coeff_len + j * 10 + i];
             auto cur_val = ::ripple::alphabetReverse[c];
             if (cur_val < 0)
             {
@@ -580,6 +580,12 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         std::uint64_t const c = b_58_10_coeff[i];
 
+        // Each digit is < 58, so at most 4 words are in use here and the
+        // span below always fits `result`. Guard the invariant anyway rather
+        // than letting a violation index past the end of the stack array.
+        if (cur_result_size >= result.size())
+            return Unexpected(TokenCodecErrc::inputTooLarge);
+
         {
             auto code = ripple::b58_fast::detail::inplace_bigint_mul(
                 std::span(&result[0], cur_result_size + 1), B_58_10);

src/libxrpl/server/Port.cpp

@@ -21,9 +21,15 @@
 #include <xrpl/beast/core/LexicalCast.h>
 #include <xrpl/beast/rfc2616.h>
 #include <xrpl/server/Port.h>
+#include <boost/algorithm/string/case_conv.hpp>
+#include <boost/algorithm/string/classification.hpp>
 #include <boost/algorithm/string/predicate.hpp>
+#include <boost/algorithm/string/split.hpp>
 #include <boost/algorithm/string/trim.hpp>
 #include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
 
 namespace ripple {
 
@@ -63,6 +69,14 @@ operator<<(std::ostream& os, Port const& p)
         }
     }
 
+    if (!p.pwa_domains.empty())
+    {
+        os << "domains:";
+        for (auto const& d : p.pwa_domains)
+            os << " " << d;
+        os << ", ";
+    }
+
     if (p.secure_gateway_nets_v4.size() || p.secure_gateway_nets_v6.size())
     {
         os << "secure_gateway nets:";
@@ -205,7 +219,7 @@ parse_Port(ParsedPort& port, Section const& section, std::ostream& log)
         {
             try
             {
-                port.ip = boost::asio::ip::address::from_string(*optResult);
+                port.ip = boost::asio::ip::make_address(*optResult);
             }
             catch (std::exception const&)
             {
@@ -308,6 +322,64 @@ parse_Port(ParsedPort& port, Section const& section, std::ostream& log)
         port.secure_gateway_nets_v4,
         port.secure_gateway_nets_v6);
 
+    // pwa ports: the zone(s) documents are served under, normalised like a
+    // Host header: lower case, no trailing dot, LDH labels of 1..63, with
+    // room left for the longest "pwa<AccountIndex>" label in front.
+    if (auto const optResult = section.get("domain"))
+    {
+        std::vector<std::string> domains;
+        boost::algorithm::split(
+            domains, *optResult, boost::algorithm::is_any_of(","));
+        for (auto& domain : domains)
+        {
+            boost::algorithm::trim(domain);
+            boost::algorithm::to_lower(domain);
+            if (!domain.empty() && domain.back() == '.')
+                domain.pop_back();
+            if (domain.empty())
+                continue;
+            bool valid = domain.size() + 24 <= 253;
+            std::vector<std::string> labels;
+            boost::algorithm::split(
+                labels, domain, boost::algorithm::is_any_of("."));
+            for (auto const& l : labels)
+                valid = valid && !l.empty() && l.size() <= 63 &&
+                    l.front() != '-' && l.back() != '-' &&
+                    l.find_first_not_of(
+                        "abcdefghijklmnopqrstuvwxyz0123456789-") ==
+                        std::string::npos;
+            if (!valid)
+            {
+                log << "Invalid value '" << domain << "' for key 'domain' in ["
+                    << section.name()
+                    << "]: expected a DNS zone such as pwapp.example";
+                Throw<std::exception>();
+            }
+            port.pwa_domains.insert(domain);
+        }
+    }
+
+    // Custom domains on pwa ports, and the IPv4 recursive resolver to use for
+    // their TXT records (default: the system resolver).
+    if (auto const v = section.get("custom_domains"))
+        if (!beast::lexicalCastChecked(port.pwa_custom_domains, *v))
+        {
+            log << "Invalid value '" << *v << "' for key 'custom_domains' in ["
+                << section.name() << "]: expected 0 or 1";
+            Throw<std::exception>();
+        }
+    if (auto const v = section.get("resolver"))
+    {
+        auto const ep = beast::IP::Endpoint::from_string_checked(*v);
+        if (!ep || !ep->is_v4() || ep->address().is_unspecified())
+        {
+            log << "Invalid value '" << *v << "' for key 'resolver' in ["
+                << section.name() << "]: expected an IPv4 address[:port]";
+            Throw<std::exception>();
+        }
+        port.pwa_resolver = ep->port() ? *ep : ep->at_port(53);
+    }
+
     set(port.user, "user", section);
     set(port.password, "password", section);
     set(port.admin_user, "admin_user", section);

src/test/app/AMMClawback_test.cpp

@@ -32,9 +32,12 @@ class AMMClawback_test : public beast::unit_test::suite
         testcase("test invalid request");
         using namespace jtx;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         // Test if holder does not exist.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(100000), gw, alice);
@@ -60,7 +63,7 @@ class AMMClawback_test : public beast::unit_test::suite
         // Test if asset pair provided does not exist. This should
         // return terNO_AMM error.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(100000), gw, alice);
@@ -93,7 +96,7 @@ class AMMClawback_test : public beast::unit_test::suite
         // Test if the issuer field and holder field is the same. This should
         // return temMALFORMED error.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -123,7 +126,7 @@ class AMMClawback_test : public beast::unit_test::suite
 
         // Test if the Asset field matches the Account field.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -155,7 +158,7 @@ class AMMClawback_test : public beast::unit_test::suite
 
         // Test if the Amount field matches the Asset field.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -188,7 +191,7 @@ class AMMClawback_test : public beast::unit_test::suite
 
         // Test if the Amount is invalid, which is less than zero.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -229,7 +232,7 @@ class AMMClawback_test : public beast::unit_test::suite
         // Test if the issuer did not set asfAllowTrustLineClawback, AMMClawback
         // transaction is prohibited.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -254,7 +257,7 @@ class AMMClawback_test : public beast::unit_test::suite
 
         // Test invalid flag.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -282,7 +285,7 @@ class AMMClawback_test : public beast::unit_test::suite
         // Test if tfClawTwoAssets is set when the two assets in the AMM pool
         // are not issued by the same issuer.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(10000), gw, alice);
@@ -313,7 +316,7 @@ class AMMClawback_test : public beast::unit_test::suite
 
         // Test clawing back XRP is being prohibited.
         {
-            Env env(*this);
+            Env env(*this, features);
             Account gw{"gateway"};
             Account alice{"alice"};
             env.fund(XRP(1000000), gw, alice);
@@ -2085,7 +2088,8 @@ class AMMClawback_test : public beast::unit_test::suite
     void
     run() override
     {
-        FeatureBitset const all{jtx::supported_amendments()};
+        FeatureBitset const all{
+            jtx::supported_amendments() | featureAMM | featureAMMClawback};
 
         testInvalidRequest();
         testFeatureDisabled(all - featureAMMClawback);

src/test/app/AMMExtended_test.cpp

@@ -150,12 +150,15 @@ private:
 
             env.fund(XRP(20'000), alice, bob, carol, gw1, gw2);
             env.fund(XRP(20'000), dan);
+            env.close();
             env.trust(USD1(20'000), alice, bob, carol, dan);
             env.trust(USD2(1'000), alice, bob, carol, dan);
+            env.close();
 
             env(pay(gw1, dan, USD1(10'050)));
             env(pay(gw1, bob, USD1(50)));
             env(pay(gw2, bob, USD2(50)));
+            env.close();
 
             AMM ammDan(env, dan, XRP(10'000), USD1(10'050));
 
@@ -1403,7 +1406,8 @@ private:
     testOffers()
     {
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
         testRmFundedOffer(all);
         testEnforceNoRipple(all);
         testFillModes(all);
@@ -1989,6 +1993,7 @@ private:
 
             env.fund(XRP(10'000), alice, carol, gw);
             env.fund(XRP(10'000), bob);
+            env.close();
             env.trust(USD(1'000), alice, bob, carol);
             env.trust(BTC(1'000), alice, bob, carol);
             env.trust(EUR(1'000), alice, bob, carol);
@@ -2802,8 +2807,11 @@ private:
         testcase("limitQuality");
         using namespace jtx;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         {
-            Env env(*this);
+            Env env(*this, features);
 
             fund(env, gw, {alice, bob, carol}, XRP(10'000), {USD(2'000)});
 
@@ -2829,11 +2837,13 @@ private:
 
         using namespace jtx;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         for (auto const withFix : {true, false})
         {
-            auto const feats = withFix
-                ? supported_amendments()
-                : supported_amendments() - FeatureBitset{fix1781};
+            auto const feats =
+                withFix ? features : features - FeatureBitset{fix1781};
 
             // Payment path starting with XRP
             Env env(*this, feats);
@@ -2861,7 +2871,7 @@ private:
         }
         {
             // Payment path ending with XRP
-            Env env(*this);
+            Env env(*this, features);
             // Note, if alice doesn't have default ripple, then pay fails
             // with tecPATH_DRY.
             fund(
@@ -2885,7 +2895,7 @@ private:
             // Payment where loop is formed in the middle of the path, not
             // on an endpoint
             auto const JPY = gw["JPY"];
-            Env env(*this);
+            Env env(*this, features);
             // Note, if alice doesn't have default ripple, then pay fails
             // with tecPATH_DRY.
             fund(
@@ -3113,7 +3123,10 @@ private:
 
         using namespace jtx;
 
-        Env env(*this);
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
+        Env env(*this, features);
 
         fund(env, gw, {alice, bob, carol}, XRP(10'000));
         env.trust(USD(1'000), alice, bob, carol);
@@ -3632,7 +3645,7 @@ private:
             USD(10'000),
             false,
             0,
-            ammCrtFee(env).drops(),
+            ammCrtFee(env).drops() + 2 * env.current()->fees().base.drops(),
             std::nullopt,
             std::nullopt,
             ms,
@@ -3828,7 +3841,8 @@ private:
     testFlow()
     {
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
         FeatureBitset const ownerPaysFee{featureOwnerPaysFee};
 
         testFalseDry(all);
@@ -3844,7 +3858,8 @@ private:
     testCrossingLimits()
     {
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
         testStepLimit(all);
     }
 
@@ -3852,14 +3867,16 @@ private:
     testDeliverMin()
     {
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
         test_convert_all_of_an_asset(all);
     }
 
     void
     testDepositAuth()
     {
-        auto const supported{jtx::supported_amendments()};
+        auto const supported{
+            jtx::supported_amendments() | featureAMM | featureAMMClawback};
         testPayment(supported - featureDepositPreauth);
         testPayment(supported);
         testPayIOU();
@@ -3869,7 +3886,8 @@ private:
     testFreeze()
     {
         using namespace test::jtx;
-        auto const sa = supported_amendments();
+        auto const sa =
+            supported_amendments() | featureAMM | featureAMMClawback;
         testRippleState(sa);
         testGlobalFreeze(sa);
         testOffersWhenFrozen(sa);
@@ -3879,7 +3897,8 @@ private:
     testMultisign()
     {
         using namespace jtx;
-        auto const all = supported_amendments();
+        auto const all =
+            supported_amendments() | featureAMM | featureAMMClawback;
 
         testTxMultisign(
             all - featureMultiSignReserve - featureExpandedSignerList);
@@ -3891,7 +3910,8 @@ private:
     testPayStrand()
     {
         using namespace jtx;
-        auto const all = supported_amendments();
+        auto const all =
+            supported_amendments() | featureAMM | featureAMMClawback;
 
         testToStrand(all);
         testRIPD1373(all);

src/test/app/AMM_test.cpp

@@ -56,6 +56,9 @@ private:
 
         using namespace jtx;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         // XRP to IOU
         testAMM([&](AMM& ammAlice, Env&) {
             BEAST_EXPECT(ammAlice.expectBalances(
@@ -72,7 +75,7 @@ private:
 
         // IOU to IOU + transfer fee
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(20'000), BTC(0.5)}, Fund::All);
             env(rate(gw, 1.25));
             env.close();
@@ -86,7 +89,7 @@ private:
 
         // Require authorization is set, account is authorized
         {
-            Env env{*this};
+            Env env{*this, features};
             env.fund(XRP(30'000), gw, alice);
             env.close();
             env(fset(gw, asfRequireAuth));
@@ -100,7 +103,7 @@ private:
 
         // Cleared global freeze
         {
-            Env env{*this};
+            Env env{*this, features};
             env.fund(XRP(30'000), gw, alice);
             env.close();
             env.trust(USD(30'000), alice);
@@ -141,9 +144,12 @@ private:
 
         using namespace jtx;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         // Can't have both XRP tokens
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env, alice, XRP(10'000), XRP(10'000), ter(temBAD_AMM_TOKENS));
@@ -152,7 +158,7 @@ private:
 
         // Can't have both tokens the same IOU
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env, alice, USD(10'000), USD(10'000), ter(temBAD_AMM_TOKENS));
@@ -161,7 +167,7 @@ private:
 
         // Can't have zero or negative amounts
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(env, alice, XRP(0), USD(10'000), ter(temBAD_AMOUNT));
             BEAST_EXPECT(!ammAlice.ammExists());
@@ -177,7 +183,7 @@ private:
 
         // Bad currency
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env, alice, XRP(10'000), BAD(10'000), ter(temBAD_CURRENCY));
@@ -186,7 +192,7 @@ private:
 
         // Insufficient IOU balance
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env, alice, XRP(10'000), USD(40'000), ter(tecUNFUNDED_AMM));
@@ -195,7 +201,7 @@ private:
 
         // Insufficient XRP balance
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env, alice, XRP(40'000), USD(10'000), ter(tecUNFUNDED_AMM));
@@ -204,7 +210,7 @@ private:
 
         // Invalid trading fee
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env,
@@ -229,7 +235,7 @@ private:
 
         // Invalid flags
         {
-            Env env{*this};
+            Env env{*this, features};
             fund(env, gw, {alice}, {USD(30'000)}, Fund::All);
             AMM ammAlice(
                 env,
@@ -248,7 +254,7 @@ private:
 
         // Invalid Account
         {
-            Env env{*this};
+            Env env{*this, features};
             Account bad("bad");
             env.memoize(bad);
             AMM ammAlice(
@@ -268,7 +274,7 @@ private:
 
         // Require authorization is set
         {
-            Env env{*this};
+            Env env{*this, features};
             env.fund(XRP(30'000), gw, alice);
             env.close();
             env(fset(gw, asfRequireAuth));
@@ -281,7 +287,7 @@ private:
 
         // Globally frozen
         {
-            Env env{*this};
+            Env env{*this, features};
             env.fund(XRP(30'000), gw, alice);
             env.close();
             env(fset(gw, asfGlobalFreeze));
@@ -294,7 +300,7 @@ private:
 
         // Individually frozen
         {
-            Env env{*this};
+            Env env{*this, features};
             env.fund(XRP(30'000), gw, alice);
             env.close();
             env(trust(gw, alice["USD"](30'000)));
@@ -307,7 +313,7 @@ private:
 
         // Insufficient reserve, XRP/IOU
         {
-            Env env(*this);
+            Env env(*this, features);
             auto const starting_xrp =
                 XRP(1'000) + reserve(env, 3) + env.current()->fees().base * 4;
             env.fund(starting_xrp, gw);
@@ -324,7 +330,7 @@ private:
 
         // Insufficient reserve, IOU/IOU
         {
-            Env env(*this);
+            Env env(*this, features);
             auto const starting_xrp =
                 reserve(env, 4) + env.current()->fees().base * 5;
             env.fund(starting_xrp, gw);
@@ -343,7 +349,7 @@ private:
 
         // Insufficient fee
         {
-            Env env(*this);
+            Env env(*this, features);
             fund(env, gw, {alice}, XRP(2'000), {USD(2'000), EUR(2'000)});
             AMM ammAlice(
                 env,
@@ -394,7 +400,7 @@ private:
 
         // Issuer has DefaultRipple disabled
         {
-            Env env(*this);
+            Env env(*this, features);
             env.fund(XRP(30'000), gw);
             env(fclear(gw, asfDefaultRipple));
             AMM ammGw(env, gw, XRP(10'000), USD(10'000), ter(terNO_RIPPLE));
@@ -1119,7 +1125,7 @@ private:
 
         // Insufficient reserve, XRP/IOU
         {
-            Env env(*this);
+            Env env(*this, features);
             auto const starting_xrp =
                 reserve(env, 4) + env.current()->fees().base * 4;
             env.fund(XRP(10'000), gw);
@@ -1154,7 +1160,7 @@ private:
 
         // Insufficient reserve, IOU/IOU
         {
-            Env env(*this);
+            Env env(*this, features);
             auto const starting_xrp =
                 reserve(env, 4) + env.current()->fees().base * 4;
             env.fund(XRP(10'000), gw);
@@ -1356,7 +1362,8 @@ private:
         testcase("Deposit");
 
         using namespace jtx;
-        auto const all = supported_amendments();
+        auto const all =
+            supported_amendments() | featureAMM | featureAMMClawback;
 
         // Equal deposit: 1000000 tokens, 10% of the current pool
         testAMM([&](AMM& ammAlice, Env& env) {
@@ -1516,7 +1523,7 @@ private:
 
         // IOU to IOU + transfer fee
         {
-            Env env{*this};
+            Env env{*this, all};
             fund(env, gw, {alice}, {USD(20'000), BTC(0.5)}, Fund::All);
             env(rate(gw, 1.25));
             env.close();
@@ -1657,7 +1664,8 @@ private:
         testcase("Invalid Withdraw");
 
         using namespace jtx;
-        auto const all = supported_amendments();
+        auto const all =
+            supported_amendments() | featureAMM | featureAMMClawback;
 
         testAMM(
             [&](AMM& ammAlice, Env& env) {
@@ -1680,7 +1688,7 @@ private:
             {{XRP(99), USD(99)}});
 
         {
-            Env env{*this};
+            Env env{*this, all};
             env.fund(XRP(30'000), gw, alice, bob);
             env.close();
             env(fset(gw, asfRequireAuth));
@@ -2228,7 +2236,8 @@ private:
         testcase("Withdraw");
 
         using namespace jtx;
-        auto const all = supported_amendments();
+        auto const all =
+            supported_amendments() | featureAMM | featureAMMClawback;
 
         // Equal withdrawal by Carol: 1000000 of tokens, 10% of the current
         // pool
@@ -2442,7 +2451,7 @@ private:
 
         // IOU to IOU + transfer fee
         {
-            Env env{*this};
+            Env env{*this, all};
             fund(env, gw, {alice}, {USD(20'000), BTC(0.5)}, Fund::All);
             env(rate(gw, 1.25));
             env.close();
@@ -2605,7 +2614,8 @@ private:
     {
         testcase("Fee Vote");
         using namespace jtx;
-        auto const all = supported_amendments();
+        auto const all =
+            supported_amendments() | featureAMM | featureAMMClawback;
 
         // One vote sets fee to 1%.
         testAMM([&](AMM& ammAlice, Env& env) {
@@ -2723,9 +2733,12 @@ private:
         using namespace jtx;
         using namespace std::chrono;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         // burn all the LPTokens through a AMMBid transaction
         {
-            Env env(*this);
+            Env env(*this, features);
             fund(env, gw, {alice}, XRP(2'000), {USD(2'000)});
             AMM amm(env, gw, XRP(1'000), USD(1'000), false, 1'000);
 
@@ -2744,7 +2757,7 @@ private:
 
         // burn all the LPTokens through a AMMBid transaction
         {
-            Env env(*this);
+            Env env(*this, features);
             fund(env, gw, {alice}, XRP(2'000), {USD(2'000)});
             AMM amm(env, gw, XRP(1'000), USD(1'000), false, 1'000);
 
@@ -2922,7 +2935,7 @@ private:
 
         // Bid all tokens, still own the slot
         {
-            Env env(*this);
+            Env env(*this, features);
             fund(env, gw, {alice, bob}, XRP(1'000), {USD(1'000)});
             AMM amm(env, gw, XRP(10), USD(1'000));
             auto const lpIssue = amm.lptIssue();
@@ -3361,12 +3374,15 @@ private:
         using namespace std::chrono;
         using namespace std::literals::chrono_literals;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         // Can't pay into AMM account.
         // Can't pay out since there is no keys
         for (auto const& acct : {gw, alice})
         {
             {
-                Env env(*this);
+                Env env(*this, features);
                 fund(env, gw, {alice, carol}, XRP(1'000), {USD(100)});
                 // XRP balance is below reserve
                 AMM ammAlice(env, acct, XRP(10), USD(10));
@@ -3381,7 +3397,7 @@ private:
                     ter(tecNO_PERMISSION));
             }
             {
-                Env env(*this);
+                Env env(*this, features);
                 fund(env, gw, {alice, carol}, XRP(10'000'000), {USD(10'000)});
                 // XRP balance is above reserve
                 AMM ammAlice(env, acct, XRP(1'000'000), USD(100));
@@ -4417,7 +4433,8 @@ private:
     {
         testcase("Amendment");
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
         FeatureBitset const noAMM{all - featureAMM};
         FeatureBitset const noNumber{all - fixUniversalNumber};
         FeatureBitset const noAMMAndNumber{
@@ -4467,6 +4484,9 @@ private:
         testcase("Rippling");
         using namespace jtx;
 
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+
         // Rippling via AMM fails because AMM trust line has 0 limit.
         // Set up two issuers, A and B. Have each issue a token called TST.
         // Have another account C hold TST from both issuers,
@@ -4478,7 +4498,7 @@ private:
         //   to shift at a 1:1 rate with no fee applied has it not been
         //   for 0 limit.
         {
-            Env env(*this);
+            Env env(*this, features);
             auto const A = Account("A");
             auto const B = Account("B");
             auto const TSTA = A["TST"];
@@ -4984,8 +5004,8 @@ private:
                     alice,
                     STAmount{USD, UINT64_C(30'000'0000000003), -10}));
                 // alice XRP balance is 30,000initial - 50 ammcreate fee -
-                // 10drops fee
-                BEAST_EXPECT(accountBalance(env, alice) == "29949999990");
+                // 10drops ammcreate base fee - 10drops fee
+                BEAST_EXPECT(accountBalance(env, alice) == "29949999980");
             },
             std::nullopt,
             0,
@@ -5061,7 +5081,7 @@ private:
                     (xrpBalance + drops(5)).getText());
                 BEAST_EXPECT(
                     accountBalance(env, alice) ==
-                    std::to_string(29'950'000'000 - baseFee + 80));
+                    std::to_string(29'950'000'000 - 2 * baseFee + 80));
             },
             std::nullopt,
             0,
@@ -5075,7 +5095,8 @@ private:
         testcase("Auto Delete");
 
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
 
         {
             Env env(
@@ -5187,7 +5208,9 @@ private:
     {
         testcase("Clawback");
         using namespace jtx;
-        Env env(*this);
+        auto const features =
+            supported_amendments() | featureAMM | featureAMMClawback;
+        Env env(*this, features);
         env.fund(XRP(2'000), gw);
         env.fund(XRP(2'000), alice);
         AMM amm(env, gw, XRP(1'000), USD(1'000));
@@ -5586,7 +5609,8 @@ private:
     {
         testcase("Fix Default Inner Object");
         using namespace jtx;
-        FeatureBitset const all{supported_amendments()};
+        FeatureBitset const all{
+            supported_amendments() | featureAMM | featureAMMClawback};
 
         auto test = [&](FeatureBitset features,
                         TER const& err1,
@@ -6305,7 +6329,7 @@ private:
             {{xrpPool, iouPool}},
             889,
             std::nullopt,
-            {jtx::supported_amendments()});
+            {jtx::supported_amendments() | featureAMM | featureAMMClawback});
     }
 
     void
@@ -7121,7 +7145,8 @@ private:
     void
     run() override
     {
-        FeatureBitset const all{jtx::supported_amendments()};
+        FeatureBitset const all{
+            jtx::supported_amendments() | featureAMM | featureAMMClawback};
         testInvalidInstance();
         testInstanceCreate();
         testInvalidDeposit(all);

src/test/app/AmendmentTable_test.cpp

@@ -1271,6 +1271,79 @@ public:
         BEAST_EXPECT(table->needValidatedLedger(257));
     }
 
+    void
+    testIgnoredUnsupported()
+    {
+        testcase("ignore_amendments");
+
+        using namespace std::chrono_literals;
+        weeks constexpr w(1);
+        test::jtx::Env env{*this, makeConfig()};
+
+        static std::vector<AmendmentTable::FeatureInfo> const supported =
+            makeDefaultYes(yes_);
+
+        // Ignore every unsupported_ amendment except the first one.
+        BEAST_EXPECT(unsupported_.size() > 1);
+        std::vector<std::string> const ignoredNames(
+            unsupported_.begin() + 1, unsupported_.end());
+
+        auto table = make_AmendmentTable(
+            env.app(),
+            w,
+            supported,
+            emptySection_,
+            emptySection_,
+            journal_,
+            makeSection(ignoredNames));
+
+        for (auto const& a : ignoredNames)
+            BEAST_EXPECT(table->isSupported(amendmentId(a)));
+        BEAST_EXPECT(!table->isSupported(amendmentId(unsupported_[0])));
+
+        majorityAmendments_t const majority;
+
+        // Enabling only ignored amendments must not block.
+        std::set<uint256> enabled;
+        for (auto const& a : ignoredNames)
+            enabled.insert(amendmentId(a));
+        table->doValidatedLedger(1, enabled, majority);
+        BEAST_EXPECT(!table->hasUnsupportedEnabled());
+        BEAST_EXPECT(table->unsupportedAmendments().empty());
+
+        // An ignored amendment must never be voted for.
+        auto const desired = table->getDesired();
+        for (auto const& a : ignoredNames)
+            BEAST_EXPECT(
+                std::find(desired.begin(), desired.end(), amendmentId(a)) ==
+                desired.end());
+
+        // A non-ignored unsupported amendment still blocks.
+        enabled.insert(amendmentId(unsupported_[0]));
+        table->doValidatedLedger(2, enabled, majority);
+        BEAST_EXPECT(table->hasUnsupportedEnabled());
+
+        // Bad entries are rejected.
+        Section bad("ignore_amendments");
+        bad.append("NotARealFeatureName");
+        try
+        {
+            make_AmendmentTable(
+                env.app(),
+                w,
+                supported,
+                emptySection_,
+                emptySection_,
+                journal_,
+                bad);
+            fail("expected bad [ignore_amendments] entry to throw");
+        }
+        catch (std::runtime_error const&)
+        {
+            pass();
+        }
+    }
+
     void
     testFeature(FeatureBitset const& feat)
     {
@@ -1294,6 +1367,7 @@ public:
         testBadConfig();
         testEnableVeto();
         testHasUnsupported();
+        testIgnoredUnsupported();
         testFeature(all - fixMajorityCalc);
         testFeature(all);
     }

src/test/app/BaseFee_test.cpp

@@ -88,9 +88,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = fset(account, asfTshCollect);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -112,9 +110,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = acctdelete(account, bene);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "200000" : "200000";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "200000");
     }
 
     static uint256
@@ -142,9 +138,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = check::cancel(account, checkId);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -167,9 +161,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = check::cash(dest, checkId, XRP(100));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -191,9 +183,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = check::create(account, dest, XRP(100));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -214,9 +204,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = reward::claim(account);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -238,9 +226,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = deposit::auth(account, authed);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -262,9 +248,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = cancel(account, account, seq1);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -286,8 +270,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = escrow(account, dest, XRP(10));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
+        std::string const feeResult = "16";
         testRPCCall(env, tx, feeResult);
     }
 
@@ -310,9 +293,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = finish(account, account, seq1);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -334,9 +315,7 @@ class BaseFee_test : public beast::unit_test::suite
             account, import::loadXpop(ImportTCAccountSet::w_seed));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "106" : "100";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "106");
     }
 
     void
@@ -357,9 +336,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = invoke::invoke(account);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "16";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -381,9 +358,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = offer_cancel(account, offerSeq);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -406,9 +381,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = offer(account, USD(1000), XRP(1000));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -430,9 +403,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = pay(account, dest, XRP(1));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     static uint256
@@ -468,9 +439,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = paychan::claim(account, chan, reqBal, authAmt);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -494,9 +463,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = paychan::create(account, dest, XRP(10), settleDelay, pk);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -519,9 +486,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = paychan::fund(account, chan, XRP(1));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -552,9 +517,7 @@ class BaseFee_test : public beast::unit_test::suite
         hookParams[jss::HookParameter][jss::HookParameterValue] = "DEADBEEF";
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "73022" : "73016";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "73022");
     }
 
     void
@@ -576,9 +539,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = regkey(account, dest);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "0" : "0";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "0");
     }
 
     void
@@ -601,9 +562,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = signers(account, 2, {{signer1, 1}, {signer2, 1}});
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -624,9 +583,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = ticket::create(account, 2);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -649,9 +606,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = trust(account, USD(1000));
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -675,9 +630,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = uritoken::burn(issuer, hexid);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -702,9 +655,7 @@ class BaseFee_test : public beast::unit_test::suite
         tx[jss::Amount] = "1000000";
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -728,9 +679,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = uritoken::cancel(issuer, hexid);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -757,8 +706,7 @@ class BaseFee_test : public beast::unit_test::suite
         tx[jss::Amount] = "1000000";
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
+        std::string const feeResult = "16";
         testRPCCall(env, tx, feeResult);
     }
 
@@ -781,9 +729,7 @@ class BaseFee_test : public beast::unit_test::suite
         auto tx = uritoken::mint(account, uri);
 
         // verify hooks fee
-        std::string const feeResult =
-            env.current()->rules().enabled(fixXahauV1) ? "16" : "10";
-        testRPCCall(env, tx, feeResult);
+        testRPCCall(env, tx, "16");
     }
 
     void
@@ -827,7 +773,6 @@ public:
         using namespace test::jtx;
         auto const sa = supported_amendments();
         testWithFeats(sa);
-        testWithFeats(sa - fixXahauV1);
     }
 };
 

src/test/app/ClaimReward_test.cpp

@@ -18,6 +18,7 @@
 //==============================================================================
 
 #include <test/jtx.h>
+#include <test/jtx/AMM.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/jss.h>
@@ -26,6 +27,14 @@ namespace ripple {
 namespace test {
 struct ClaimReward_test : public beast::unit_test::suite
 {
+private:
+    // helper
+    void static overrideFlag(Json::Value& jv)
+    {
+        jv[jss::Flags] = hsfOVERRIDE;
+    }
+
+public:
     bool
     expectRewards(
         jtx::Env const& env,
@@ -59,6 +68,52 @@ struct ClaimReward_test : public beast::unit_test::suite
         return true;
     }
 
+    bool
+    expectRewardsIOU(
+        jtx::Env const& env,
+        jtx::Account const& acct,
+        jtx::IOU const& iou,
+        std::uint32_t ledgerFirst,
+        std::uint32_t ledgerLast,
+        STAmount accumulator,
+        std::uint32_t time)
+    {
+        auto const sle = env.le(keylet::line(acct, iou.account, iou.currency));
+        BEAST_EXPECT(!!sle);
+        auto const& sfRewardField =
+            std::minmax(acct.id(), iou.account.id()).first == acct.id()
+            ? sfLowReward
+            : sfHighReward;
+
+        if (!sle->isFieldPresent(sfRewardField))
+            return false;
+
+        auto const& reward =
+            static_cast<STObject const&>(sle->peekAtField(sfRewardField));
+
+        if (!reward.isFieldPresent(sfRewardLgrFirst) ||
+            reward.getFieldU32(sfRewardLgrFirst) != ledgerFirst)
+        {
+            return false;
+        }
+        if (!reward.isFieldPresent(sfRewardLgrLast) ||
+            reward.getFieldU32(sfRewardLgrLast) != ledgerLast)
+        {
+            return false;
+        }
+        if (!reward.isFieldPresent(sfTrustLineRewardAccumulator) ||
+            reward.getFieldAmount(sfTrustLineRewardAccumulator) != accumulator)
+        {
+            return false;
+        }
+        if (!reward.isFieldPresent(sfRewardTime) ||
+            reward.getFieldU32(sfRewardTime) != time)
+        {
+            return false;
+        }
+        return true;
+    }
+
     bool
     expectNoRewards(jtx::Env const& env, jtx::Account const& acct)
     {
@@ -82,6 +137,24 @@ struct ClaimReward_test : public beast::unit_test::suite
         return true;
     }
 
+    bool
+    expectNoRewardsIOU(
+        jtx::Env const& env,
+        jtx::Account const& acct,
+        jtx::IOU const& iou)
+    {
+        auto const sle = env.le(keylet::line(acct, iou.account, iou.currency));
+        BEAST_EXPECT(!!sle);
+        auto const& sfRewardField =
+            std::minmax(acct.id(), iou.account.id()).first == acct.id()
+            ? sfLowReward
+            : sfHighReward;
+
+        if (sle->isFieldPresent(sfRewardField))
+            return false;
+        return true;
+    }
+
     void
     testEnabled(FeatureBitset features)
     {
@@ -91,7 +164,7 @@ struct ClaimReward_test : public beast::unit_test::suite
 
         // setup env
         auto const alice = Account("alice");
-        auto const issuer = Account("issuer");
+        auto const issuer = Account::master;
 
         for (bool const withClaimReward : {false, true})
         {
@@ -101,7 +174,11 @@ struct ClaimReward_test : public beast::unit_test::suite
                 withClaimReward ? features : features - featureBalanceRewards;
             Env env{*this, amend};
 
-            env.fund(XRP(1000), alice, issuer);
+            env.fund(XRP(1000), alice);
+            env.close();
+
+            env(hook(issuer, {{hso(jtx::genesis::AcceptHook)}}, 0),
+                fee(XRP(1)));
             env.close();
 
             auto const txResult =
@@ -118,7 +195,10 @@ struct ClaimReward_test : public beast::unit_test::suite
                     .count();
 
             // CLAIM
-            env(reward::claim(alice), reward::issuer(issuer), txResult);
+            env(reward::claim(alice),
+                reward::issuer(issuer),
+                fee(XRP(1)),
+                txResult);
             env.close();
 
             if (withClaimReward)
@@ -194,14 +274,19 @@ struct ClaimReward_test : public beast::unit_test::suite
                 Env env{*this, amend};
 
                 auto const alice = Account("alice");
-                auto const issuer = Account("issuer");
+                auto const issuer = Account::master;
 
-                env.fund(XRP(1000), alice, issuer);
+                env.fund(XRP(1000), alice);
+                env.close();
+
+                env(hook(issuer, {{hso(jtx::genesis::AcceptHook)}}, 0),
+                    fee(XRP(1)));
                 env.close();
 
                 auto tx = reward::claim(alice);
                 env(tx,
                     reward::issuer(issuer),
+                    fee(XRP(1)),
                     txflags(tfFullyCanonicalSig),
                     withFixFlags ? ter(tesSUCCESS) : ter(temINVALID_FLAG));
                 env.close();
@@ -220,6 +305,105 @@ struct ClaimReward_test : public beast::unit_test::suite
             env(reward::claim(alice), reward::issuer(alice), ter(temMALFORMED));
             env.close();
         }
+
+        // featureIOURewardClaim
+
+        // temDISABLED
+        // featureIOURewardClaim amendment is disabled
+        {
+            test::jtx::Env env{
+                *this,
+                network::makeNetworkConfig(21337),
+                features - featureIOURewardClaim};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const gw = Account("gw");
+            env.fund(XRP(1000), alice, bob, gw);
+            env.close();
+
+            jtx::IOU const USD = gw["USD"];
+
+            env(reward::claim(alice),
+                reward::issuer(bob),
+                reward::claimCurrency(USD),
+                ter(temDISABLED));
+            env.close();
+        }
+
+        // temMALFORMED
+        // ClaimCurrency.account cannot be the source account.
+        {
+            test::jtx::Env env{*this, network::makeNetworkConfig(21337)};
+
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            env.fund(XRP(1000), alice);
+            env.close();
+
+            jtx::IOU const USD = alice["USD"];
+
+            env(reward::claim(alice),
+                reward::issuer(bob),
+                reward::claimCurrency(USD),
+                ter(temMALFORMED));
+            env.close();
+        }
+
+        // temMALFORMED
+        // Issuer cannot be Genesis account if ClaimCurrency is set.
+        {
+            test::jtx::Env env{*this, network::makeNetworkConfig(21337)};
+
+            auto const alice = Account("alice");
+            auto const gw = Account("gw");
+            env.fund(XRP(1000), alice, gw);
+            env.close();
+
+            jtx::IOU const USD = gw["USD"];
+
+            env(reward::claim(alice),
+                reward::issuer(Account::master),
+                reward::claimCurrency(USD),
+                ter(temBAD_ISSUER));
+        }
+
+        // MPT
+        {
+            // tested in testMPTInvalidInTx() at MPToken_test.cpp
+        }
+
+        // XAH RewardClaim: Issuer must be the Genesis account if
+        // featureXahauGenesis and featureIOURewardClaim are enabled.
+        for (bool const withIOURewardClaim : {false, true})
+        {
+            auto const amend = withIOURewardClaim
+                ? features
+                : features - featureIOURewardClaim;
+
+            auto const alice = Account("alice");
+            auto const badIssuer = Account("gw");
+            auto const issuer = Account::master;
+            auto const USD = badIssuer["USD"];
+
+            Env env{*this, amend};
+            env.fund(XRP(1000), alice, badIssuer);
+            env.close();
+
+            env(hook(issuer, {{hso(jtx::genesis::AcceptHook)}}, 0),
+                fee(XRP(1)));
+            env.close();
+
+            env(reward::claim(alice),
+                reward::issuer(badIssuer),
+                fee(XRP(1)),
+                withIOURewardClaim ? ter(temBAD_ISSUER) : ter(tesSUCCESS));
+
+            env(reward::claim(alice),
+                reward::issuer(issuer),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
+        }
     }
 
     void
@@ -243,6 +427,7 @@ struct ClaimReward_test : public beast::unit_test::suite
             auto const alice = Account("alice");
             auto const issuer = Account("issuer");
             env.memoize(alice);
+            auto USD = issuer["USD"];
 
             env.fund(XRP(1000), issuer);
             env.close();
@@ -250,7 +435,10 @@ struct ClaimReward_test : public beast::unit_test::suite
             auto tx = reward::claim(alice);
             tx[jss::Sequence] = 0;
             tx[jss::Fee] = 10;
-            env(tx, reward::issuer(issuer), ter(terNO_ACCOUNT));
+            env(tx,
+                reward::issuer(issuer),
+                reward::claimCurrency(USD),
+                ter(terNO_ACCOUNT));
             env.close();
         }
 
@@ -260,9 +448,9 @@ struct ClaimReward_test : public beast::unit_test::suite
             test::jtx::Env env{*this, network::makeNetworkConfig(21337)};
 
             auto const alice = Account("alice");
-            auto const issuer = Account("issuer");
+            auto const issuer = Account::master;
 
-            env.fund(XRP(1000), alice, issuer);
+            env.fund(XRP(1000), alice);
             env.close();
 
             env(reward::claim(alice),
@@ -293,13 +481,229 @@ struct ClaimReward_test : public beast::unit_test::suite
             auto const issuer = Account("issuer");
             env.memoize(issuer);
 
+            auto USD = issuer["USD"];
+
             env.fund(XRP(1000), alice);
             env.close();
 
             auto tx = reward::claim(alice);
-            env(tx, reward::issuer(issuer), ter(tecNO_ISSUER));
+            env(tx,
+                reward::issuer(issuer),
+                reward::claimCurrency(USD),
+                ter(tecNO_ISSUER));
             env.close();
         }
+
+        // tecNO_PERMISSION
+        // issuer is an AMM account
+        {
+            test::jtx::Env env{
+                *this,
+                network::makeNetworkConfig(21337),
+                features | featureAMM};
+
+            auto const alice = Account("alice");
+            auto const issuer = Account("issuer");
+            auto const USD = issuer["USD"];
+
+            env.fund(XRP(1000), alice, issuer);
+            env.close();
+
+            AMM amm(env, issuer, XRP(100), USD(100));
+
+            BEAST_EXPECT(amm.ammExists());
+
+            env(reward::claim(alice),
+                reward::issuer(amm.ammAccount()),
+                reward::claimCurrency(USD),
+                ter(tecNO_PERMISSION));
+            env.close();
+        }
+
+        // tecNO_TARGET
+        // no claim reward hook
+        {
+            Env env{*this};
+
+            auto const alice = Account("alice");
+            auto const issuer = Account::master;
+
+            env.fund(XRP(1000), alice);
+            env.close();
+
+            // Doesn't have hook
+            {
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    ter(tecNO_TARGET));
+                env.close();
+            }
+            // Invalid HookOn
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(UINT256_BIT[ttCLAIM_REWARD]);
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    ter(tecNO_TARGET));
+                env.close();
+            }
+            // Invalid IncomingHookOn
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj.removeMember(jss::HookOn);
+                hookObj[jss::HookOnIncoming] =
+                    to_string(UINT256_BIT[ttCLAIM_REWARD]);
+                hookObj[jss::HookOnOutgoing] = to_string(uint256{});
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    ter(tecNO_TARGET));
+                env.close();
+            }
+            // Invalid HookName
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                hookObj[jss::HookName] = "4142434445";
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    ter(tecNO_TARGET));
+                env.close();
+            }
+            // HookName removed with a HookName-only update
+            // The sfHooks entry keeps an STI_NOTPRESENT placeholder for
+            // sfHookName, which preclaim must treat as "no name".
+            {
+                Json::Value jv;
+                jv[jss::Account] = issuer.human();
+                jv[jss::TransactionType] = jss::SetHook;
+                jv[jss::Flags] = 0;
+                jv[jss::Hooks] = Json::Value{Json::arrayValue};
+                jv[jss::Hooks][0U][jss::Hook][jss::HookName] = "";
+                env(jv, fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    fee(XRP(1)),
+                    ter(tesSUCCESS));
+                env.close();
+            }
+            // Vaild HookOn
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    fee(XRP(1)),
+                    ter(tesSUCCESS));
+            }
+            // Vaild IncomingHookOn
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj.removeMember(jss::HookOn);
+                hookObj[jss::HookOnIncoming] =
+                    to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                hookObj[jss::HookOnOutgoing] = to_string(uint256{});
+                env(hook(issuer, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    fee(XRP(1)),
+                    ter(tesSUCCESS));
+            }
+            // Invalid Hooks Array
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(UINT256_BIT[ttCLAIM_REWARD]);
+                env(hook(
+                        issuer,
+                        {{
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                        }},
+                        0),
+                    fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    fee(XRP(1)),
+                    ter(tecNO_TARGET));
+            }
+            // Vaild Hooks Array
+            {
+                auto hookObj = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj[jss::HookOn] = to_string(UINT256_BIT[ttCLAIM_REWARD]);
+                auto hookObj2 = hso(jtx::genesis::AcceptHook, overrideFlag);
+                hookObj2[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                env(hook(
+                        issuer,
+                        {{
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj,
+                            hookObj2,
+                        }},
+                        0),
+                    fee(XRP(1)));
+                env.close();
+
+                env(reward::claim(alice),
+                    reward::issuer(issuer),
+                    fee(XRP(1)),
+                    ter(tesSUCCESS));
+            }
+        }
+
+        // tecNO_LINE
+        // trustline does not exist.
+        {
+            test::jtx::Env env{*this, network::makeNetworkConfig(21337)};
+
+            auto const alice = Account("alice");
+
+            auto const gw = Account("gw");
+            env.fund(XRP(1000), alice, gw);
+            env.close();
+
+            env(hook(gw, {{hso(jtx::genesis::AcceptHook)}}, 0), fee(XRP(1)));
+            env.close();
+
+            jtx::IOU const USD = gw["USD"];
+
+            env(reward::claim(alice),
+                reward::issuer(gw),
+                reward::claimCurrency(USD),
+                fee(XRP(1)),
+                ter(tecNO_LINE));
+        }
     }
 
     void
@@ -312,9 +716,17 @@ struct ClaimReward_test : public beast::unit_test::suite
         test::jtx::Env env{*this, network::makeNetworkConfig(21337)};
 
         auto const alice = Account("alice");
+        auto const bob = Account("bob");
+        auto const gw = Account("gw");
         auto const issuer = Account("issuer");
 
-        env.fund(XRP(1000), alice, issuer);
+        env.fund(XRP(1000), alice, bob, gw, issuer);
+        env.close();
+
+        env(hook(issuer, {{hso(jtx::genesis::AcceptHook)}}, 0), fee(XRP(1)));
+        env.close();
+        env(hook(Account::master, {{hso(jtx::genesis::AcceptHook)}}, 0),
+            fee(XRP(1)));
         env.close();
 
         // test claim rewards - no opt out
@@ -329,7 +741,7 @@ struct ClaimReward_test : public beast::unit_test::suite
                 .count();
 
         auto tx = reward::claim(alice);
-        env(tx, reward::issuer(issuer), ter(tesSUCCESS));
+        env(tx, reward::issuer(Account::master), fee(XRP(1)), ter(tesSUCCESS));
         env.close();
 
         BEAST_EXPECT(
@@ -342,6 +754,51 @@ struct ClaimReward_test : public beast::unit_test::suite
         env.close();
 
         BEAST_EXPECT(expectNoRewards(env, alice) == true);
+
+        // test iou claim rewards
+        {
+            // set trustline
+            env(trust(bob, gw["USD"](10000)));
+            env.close();
+
+            // opt in
+            auto const currentLedger = env.current()->seq();
+            auto const currentTime =
+                std::chrono::duration_cast<std::chrono::seconds>(
+                    env.app()
+                        .getLedgerMaster()
+                        .getValidatedLedger()
+                        ->info()
+                        .parentCloseTime.time_since_epoch())
+                    .count();
+
+            auto tx = reward::claim(bob);
+            env(tx,
+                reward::issuer(issuer),
+                reward::claimCurrency(gw["USD"]),
+                fee(XRP(1)),
+                ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(
+                expectRewardsIOU(
+                    env,
+                    bob,
+                    gw["USD"],
+                    currentLedger,
+                    currentLedger,
+                    gw["USD"](0),
+                    currentTime) == true);
+
+            // opt out
+            env(reward::claim(bob),
+                reward::claimCurrency(gw["USD"]),
+                txflags(tfOptOut),
+                ter(tesSUCCESS));
+            env.close();
+
+            BEAST_EXPECT(expectNoRewardsIOU(env, bob, gw["USD"]) == true);
+        }
     }
 
     void
@@ -352,16 +809,20 @@ struct ClaimReward_test : public beast::unit_test::suite
         using namespace std::literals::chrono_literals;
         Env env{*this, features};
         auto const alice = Account("alice");
-        auto const issuer = Account("issuer");
-        env.fund(XRP(10000), alice, issuer);
+        auto const issuer = Account::master;
+        env.fund(XRP(10000), alice);
         std::uint32_t aliceTicketSeq{env.seq(alice) + 1};
         env(ticket::create(alice, 10));
         std::uint32_t const aliceSeq{env.seq(alice)};
         env.require(owners(alice, 10));
 
+        env(hook(issuer, {{hso(jtx::genesis::AcceptHook)}}, 0), fee(XRP(1)));
+        env.close();
+
         env(reward::claim(alice),
             reward::issuer(issuer),
             ticket::use(aliceTicketSeq++),
+            fee(XRP(1)),
             ter(tesSUCCESS));
 
         env.require(tickets(alice, env.seq(alice) - aliceTicketSeq));
@@ -369,6 +830,317 @@ struct ClaimReward_test : public beast::unit_test::suite
         env.require(owners(alice, 9));
     }
 
+    void
+    testBalanceChanges(FeatureBitset features)
+    {
+        testcase("balance changes");
+        using namespace jtx;
+        using namespace std::literals::chrono_literals;
+
+        auto const getCurrentTime = [&](Env& env) {
+            return std::chrono::duration_cast<std::chrono::seconds>(
+                       env.app()
+                           .getLedgerMaster()
+                           .getValidatedLedger()
+                           ->info()
+                           .parentCloseTime.time_since_epoch())
+                .count();
+        };
+
+        // Native Reward Claim
+        {
+            Env env{*this, features};
+            auto const alice = Account("alice");
+            auto const gw = Account("gw");
+
+            auto const issuer = Account::master;
+            env.fund(XRP(10001), alice, gw);
+            env.close();
+
+            env(hook(issuer, {{hso(jtx::genesis::AcceptHook)}}, 0),
+                fee(XRP(1)));
+            env.close();
+
+            auto const currentTime = getCurrentTime(env);
+            auto const currentLedger = env.current()->seq();
+
+            env(reward::claim(alice), reward::issuer(issuer), fee(XRP(1)));
+            env.close();
+
+            env(fset(alice, 0));
+            env.close();
+
+            BEAST_EXPECT(
+                expectRewards(
+                    env,
+                    alice,
+                    currentLedger,
+                    currentLedger + 1,
+                    10000,  // 10000 XAH * time 1
+                    currentTime) == true);
+        }
+
+        // IOU Reward Claim
+        for (bool const fromHighAccount : {true, false})
+        {
+            Env env{*this, features};
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const issuer = Account("issuer");
+
+            auto const user = fromHighAccount ? alice : bob;
+            auto const gw = fromHighAccount ? bob : alice;
+
+            if (fromHighAccount)
+                BEAST_EXPECT(user.id() < gw.id());
+            else
+                BEAST_EXPECT(user.id() > gw.id());
+
+            env.fund(XRP(10000), user, gw, issuer);
+            env(fset(gw, asfDefaultRipple));
+
+            auto hookObj = hso(jtx::genesis::AcceptHook);
+            hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+            env(hook(gw, {{hookObj}}, 0), fee(XRP(1)));
+            env.close();
+
+            env(trust(user, gw["USD"](1000000)), fee(XRP(1)));
+            env.close();
+            env(pay(gw, user, gw["USD"](10000)));
+            env.close();
+
+            auto currentTime = getCurrentTime(env);
+            auto currentLedger = env.current()->seq();
+
+            env(reward::claim(user),
+                reward::issuer(gw),
+                reward::claimCurrency(gw["USD"]),
+                fee(XRP(1)));
+            env.close();
+
+            env(pay(user, gw, gw["USD"](10000)));
+            env.close();
+
+            BEAST_EXPECT(
+                expectRewardsIOU(
+                    env,
+                    user,
+                    gw["USD"],
+                    currentLedger,
+                    currentLedger + 1,
+                    user["USD"](10000),  // 10000 USD * time 1
+                    currentTime) == true);
+
+            env(pay(gw, user, gw["USD"](1)));
+            env.close();
+
+            // check Balance == 0
+            BEAST_EXPECT(
+                expectRewardsIOU(
+                    env,
+                    user,
+                    gw["USD"],
+                    currentLedger,
+                    currentLedger + 2,
+                    user["USD"](10000),  // 10000 USD * time 1 + 0 USD * time 1
+                    currentTime) == true);
+        }
+
+        // Check Balance minus -> plus, plus -> minus
+        for (bool const fromHighAccount : {true, false})
+        {
+            Env env{*this, features};
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const issuer = Account("issuer");
+
+            auto const user = fromHighAccount ? alice : bob;
+            auto const gw = fromHighAccount ? bob : alice;
+
+            if (fromHighAccount)
+                BEAST_EXPECT(user.id() < gw.id());
+            else
+                BEAST_EXPECT(user.id() > gw.id());
+
+            env.fund(XRP(10000), user, gw, issuer);
+            env(fset(gw, asfDefaultRipple));
+            env.close();
+
+            auto hookObj = hso(jtx::genesis::AcceptHook);
+            hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+            env(hook(gw, {{hookObj}}, 0), fee(XRP(1)));
+            env.close();
+
+            env(trust(user, gw["USD"](1000000)));
+            env.close();
+            env(trust(gw, user["USD"](1000000)));
+            env(pay(gw, user, gw["USD"](10000)));
+            env.close();
+
+            auto currentTime = getCurrentTime(env);
+            auto currentLedger = env.current()->seq();
+
+            env(reward::claim(user),
+                reward::issuer(gw),
+                reward::claimCurrency(gw["USD"]),
+                fee(XRP(1)));
+            env.close();
+
+            env(pay(user, gw, gw["USD"](20000)));
+            env.close();
+
+            env(pay(user, gw, gw["USD"](1)));
+            env.close();
+
+            BEAST_EXPECT(
+                expectRewardsIOU(
+                    env,
+                    user,
+                    gw["USD"],
+                    currentLedger,
+                    currentLedger + 2,
+                    user["USD"](10000),  // 10000 USD * time 1 + 0 USD * time 1
+                    currentTime) == true);
+        }
+
+        // test with escrow (locked balance)
+        for (bool const fromHighAccount : {true, false})
+        {
+            for (bool const hasEscrow : {true, false})
+            {
+                Env env{*this, features};
+                auto const alice = Account("alice");
+                auto const bob = Account("bob");
+                auto const issuer = Account("issuer");
+
+                auto const user = fromHighAccount ? alice : bob;
+                auto const gw = fromHighAccount ? bob : alice;
+
+                if (fromHighAccount)
+                    BEAST_EXPECT(user.id() < gw.id());
+                else
+                    BEAST_EXPECT(user.id() > gw.id());
+
+                env.fund(XRP(10000), user, gw, issuer);
+                env(fset(gw, asfDefaultRipple));
+
+                auto hookObj = hso(jtx::genesis::AcceptHook);
+                hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+                env(hook(gw, {{hookObj}}, 0), fee(XRP(1)));
+                env.close();
+
+                env(trust(user, gw["USD"](1000000)), fee(XRP(1)));
+                env.close();
+                env(pay(gw, user, gw["USD"](10000)));
+                env.close();
+
+                if (hasEscrow)
+                {
+                    env(escrow(user, user, gw["USD"](2000)),
+                        finish_time(env.now() + 1s),
+                        fee(XRP(1)));
+                    env.close();
+                }
+
+                auto currentTime = getCurrentTime(env);
+                auto currentLedger = env.current()->seq();
+
+                env(reward::claim(user),
+                    reward::issuer(gw),
+                    reward::claimCurrency(gw["USD"]),
+                    fee(XRP(1)));
+                env.close();
+                env(pay(user, gw, gw["USD"](5000)));
+                env.close();
+
+                BEAST_EXPECT(
+                    expectRewardsIOU(
+                        env,
+                        user,
+                        gw["USD"],
+                        currentLedger,
+                        currentLedger + 1,
+                        user["USD"](10000),  // 10000 USD * time 1
+                        currentTime) == true);
+
+                env(pay(gw, user, gw["USD"](1)));
+                env.close();
+
+                // check Balance == 0
+                BEAST_EXPECT(
+                    expectRewardsIOU(
+                        env,
+                        user,
+                        gw["USD"],
+                        currentLedger,
+                        currentLedger + 2,
+                        user["USD"](
+                            15000),  // 10000 USD * time 1 + 5000 USD * time 1
+                        currentTime) == true);
+            }
+        }
+
+        // STAmount overflow in reward accumulation should not cause
+        // transaction failure (tefEXCEPTION). The overflow should be
+        // gracefully skipped via try-catch.
+        for (bool const fromHighAccount : {true, false})
+        {
+            Env env{*this, features};
+            auto const alice = Account("alice");
+            auto const bob = Account("bob");
+            auto const issuer = Account("issuer");
+
+            auto const user = fromHighAccount ? alice : bob;
+            auto const gw = fromHighAccount ? bob : alice;
+
+            env.fund(XRP(10000), user, gw, issuer);
+            env(fset(gw, asfDefaultRipple));
+            env.close();
+
+            auto hookObj = hso(jtx::genesis::AcceptHook);
+            hookObj[jss::HookOn] = to_string(~UINT256_BIT[ttCLAIM_REWARD]);
+            env(hook(gw, {{hookObj}}, 0), fee(XRP(1)));
+            env.close();
+
+            // Use a near-max IOU balance at exponent 80. When
+            // multiply(balance, STAmount(lgrElapsed), issue) is called
+            // with lgrElapsed >= 2, the result exponent exceeds
+            // cMaxOffset(80), causing IOUAmount::normalize to throw
+            // std::overflow_error("value overflow").
+            auto const bigUSD = STAmount{
+                gw["USD"].issue(), std::uint64_t(5000000000000000ull), 80};
+            // Payment amount must be large enough to register a
+            // balance change given STAmount's 16-digit precision.
+            auto const payBackUSD = STAmount{
+                gw["USD"].issue(), std::uint64_t(1000000000000000ull), 80};
+
+            env(trust(user, bigUSD));
+            env.close();
+            env(pay(gw, user, bigUSD));
+            env.close();
+
+            // Claim IOU reward to initialize reward tracking
+            env(reward::claim(user),
+                reward::issuer(gw),
+                reward::claimCurrency(gw["USD"]),
+                fee(XRP(1)));
+            env.close();
+
+            // Advance ledger so lgrElapsed >= 2. With lgrElapsed=1
+            // the multiply result is exactly at cMaxOffset boundary
+            // (no overflow). With lgrElapsed >= 2, the result exponent
+            // exceeds cMaxOffset and triggers the overflow.
+            env.close();
+
+            // This payment modifies the trustline balance, triggering
+            // reward accumulation in Transactor. Without the try-catch
+            // fix, multiply() throws std::overflow_error("value overflow")
+            // and the transaction fails with tefEXCEPTION.
+            env(pay(user, gw, payBackUSD), ter(tesSUCCESS));
+            env.close();
+        }
+    }
+
     void
     testWithFeats(FeatureBitset features)
     {
@@ -377,6 +1149,7 @@ struct ClaimReward_test : public beast::unit_test::suite
         testInvalidPreclaim(features);
         testValidNoHook(features);
         testUsingTickets(features);
+        testBalanceChanges(features);
     }
 
 public: