# C++ lifecycle and cancellation review — 2026-10-04

Review base: `21dd8ef3e68b130e9307e2a5490b28a90eb55117` (the engine source
introduced by `194d79e26`, plus coordination documents). Worktree:
`codex-review-lifecycle-1004`. The development/open runs used GCC 15 on
BEELINK2; two sanitized suites used GCC 14 on HP. Supplementary old-header probes used GCC 15 on HP. Each host
used a guarded CPU lease and a process/memory preflight; `make -j8`, with
`-flto=1` per optimized linker. Outputs are below the session's external build
root. A local sanitizer queue was stopped before compilation and moved to HP
because other sessions were building; its waiting log is retained.

## Reproduced failures

- `RunOnce()` ignored preset cancellation until after dialing and sending Logon.
  Cancellation while a schedule or primary-store lock deferred connection did
  not terminate the wait. Bounded virtual-clock tests escape the old behavior
  through a separate Logout after three sleeps; the corrected behavior must
  stop after the first sleep with zero dials.
- Simultaneous cancellation and Logout left the Logout request queued, so a
  later explicit run stopped unexpectedly after cancellation was cleared.
  A Logout requested by a Disconnected lifecycle observer or during a failed
  dial could also be left pending and produce the wrong terminal status.
- Cancellation could mask a latched durable-store fault as successful Stopped.
  Faulted and an error return must survive a coincident stop request.
- `Shutdown()` from an acceptor's Listening, Connected or LoggedOn lifecycle
  observer closed the listener and published Stopped, but `Start()` continued
  serving until a separate cancellation flag was set. Each old-code probe
  needed its bounded fallback after four post-stop clock reads.

The seven isolated initiator regression groups abort on the baseline's relevant
assertions; all three acceptor stop groups return failure. No reproduction
hit its external timeout. These are deterministic control-flow/stop-latency
failures, not throughput measurements.

## Scope and verification

The initiator checks both stop mechanisms before each deferred connection and
after teardown. The terminal path consumes late requests and gives an explicit
or latched store fault priority. A callback-triggered Logout ends before endpoint
rotation, reconnect counters or backoff publication. The acceptor observes its
existing shutdown latch after Bind and each served step; admission reports zero
if the observer already removed the child. This adds no per-message allocation,
locking, or timer scan. No throughput or percentile-latency claim is made.

Validation: 10 development suites, 4 open-edition suites and 2 ASan/UBSan
open-edition suites pass, with no reported skips. The development set includes reconnect driver/open+pro,
acceptor connection metrics, acceptor stop, real-socket reconnect, pollless
acceptor, TLS verification/ownership, real-socket runner, and acceptor clock
seam. The open set repeats reconnect, acceptor metrics/stop, and TLS verification.
The sanitized suites are reconnect driver and acceptor connection metrics,
with leak detection and halt-on-error enabled. Two supplementary probes also
fail against the original headers: an observer Logout starts reconnect
bookkeeping despite stopping (assertion failure), and direct Accept reports
one admission after its observer has closed everything (exit 1). Both pass
in the fixed suites. All twelve isolated regression groups thus reproduce on
the old headers; none reaches its timeout.

The corrected tests show zero dials for preset cancellation, one virtual sleep
for cancellation in schedule/HA waits, no stale Logout after a stopped run,
and Faulted/-1 for a coincident journal fault. Shutdown observers at Listening,
Connected and LoggedOn return without the fallback cancellation, and direct
Accept reports zero live admissions. Independent reviewers inspected the two
runners' final changes across their assigned scopes. Export scan: four changed
engine files, zero findings.

The parallel Java replay review produced a separate, confirmed handoff issue:
[stored administrative frames](RECORD_2026-10-04_java-replay-admin.md).
Java production sources are owned by another session and were not modified.

Incoming rebases changed documents, verification tooling and an optional Java
compatibility module. Every tracked C++ source and build-file hash still
matched the tested candidate. The source manifest, export scan and whitespace
checks were verified again before publication; unchanged suites were not rerun.

Raw baseline and final logs, drivers, and source hashes are archived under
`~/archive/libhft/reviews/2026-10-04-codex-review-lifecycle-1004/` and mirrored
to HP with a verified SHA-256 manifest. No Windows, JNI/.NET integration, NIC
or external FIX-engine qualification is claimed by these C++ tests.