# C++ metrics connection deadlines and bounded shutdown C++ FIX and FIXP metrics endpoints now apply one two-second monotonic budget to a client's socket I/O, including positive read and write progress. Active clients no longer keep Stop waiting for a fresh per-call timeout. Four new socket regressions fail before the fix and pass afterwards in both editions. Sanitizers also exposed and verified the repair of an operations-profile enum whose invalid configuration values were undefined behaviour before validation. No FIX session hot path, installed benchmark binary or NIC configuration changes. ## Reproduced client failures The baseline is source checkpoint `a064df16a`, with only the added regression tests applied. The retained test patch, header/test hashes, executable copies, build output and assertion failures make that state reproducible. An incomplete request feeds one byte every 50 ms for four seconds. A different client asks for a healthy scrape while the first remains connected. The old blocking recv loop renews its two-second timeout after each successful read. The healthy scrape waits 5,823 ms. Stop during the same trickle waits 5,807 ms. Both exceed their test limits and exit 134 at the assertion. A slow reader uses a small receive window and drains 512 bytes every 10 ms for four seconds. A custom renderer supplies a response larger than the send queue, using the endpoint's existing maximum source-count buffer. The old send loop renews its timeout after partial sends. A following healthy scrape waits 8,017 ms; Stop waits 8,038 ms. Both cases exit 134. The slow client received 114,167 bytes, confirming actual positive progress rather than a silent client. It stays open until after the observed endpoint operation. Each regression has a separate command-line selector for baseline/fault isolation; all four also run in the ordinary endpoint suite. The assertions allow three seconds for recovery and one second for Stop, with setup allowing the worker to accept the first connection. These are coarse functional bounds, not network-latency benchmarks. The final healthy slow-writer control additionally checks its advertised length, all 6,291,455 body bytes and the served-scrape count, so a truncated 200 response cannot satisfy it; an incomplete slow response must not count as a served scrape. ## Changes Accepted sockets are explicitly nonblocking on both platforms. Every read and write wait checks one steady-clock deadline and the running flag. Poll slices are at most 50 ms; positive I/O and EINTR do not renew the budget. Short sends advance the offset, and retryable socket errors use the platform's error classification, including Winsock. HTTP error replies use the same deadline. Failure to establish nonblocking mode refuses the listener/client rather than silently entering an unbounded blocking operation. The existing worker owns and closes its client, and Stop still joins before closing the listener. No active descriptor is closed by another thread, no hot-path lock or allocation is added, and the preallocated render buffer is unchanged. The FIXP endpoint inherits this implementation. A user-supplied renderer must return promptly; a socket deadline cannot interrupt arbitrary callback code. Unix-listener pathname ownership is not changed by this patch. The first sanitized run passed the FIX and FIXP endpoint suites but stopped in the existing operations-profile test: loading enum value 99 is undefined for its unfixed underlying type. `OperationsMetricsEndpointMode` now explicitly uses int, so validation may safely reject representable integers. Its existing invalid-mode test additionally covers -1, 3, INT_MIN and INT_MAX. No sanitizer check was disabled. The original sanitizer report is retained. ## Verification The stock GCC 14 C++11 Makefile builds pass these three complete binaries in both the development and open editions: - `test_fix_metrics_http`, including all four new slow-client cases. - `test_fixp_metrics_http`, including its TCP and Unix-domain renderer coverage. - `test_fix_operations_profile`, including invalid-mode validation. Clang 21 builds and runs the same three open-edition binaries with address, undefined-behaviour and leak checking enabled; all pass. There are nine green suite executions, with no skips. Build logs contain no compiler warnings. The public-source scrub scans the four changed C++ files with zero findings. Full C++ input hashes check unchanged through the successful run. On the successful repeat, the healthy scrape behind a trickling reader returns in 1,849 ms and behind the slow response reader in 1,855–1,858 ms. Those measurements start after 150 ms of setup, not at acceptance. Stop returns in 49–50 ms in the read/write scenarios across the three tested configurations. These observations establish the functional deadline and shutdown repair; they are not FIX round-trip latency results. All commands ran under host-cpu-slot isolated-pool leases, while another session used the shared pool. Builds, sockets and fixtures stayed under the session's build root on /home; this was not an isol-no-shared latency sitting. No root staging, installed library replacement or benchmark publication ran. ## Evidence and remaining scope `~/archive/libhft/cpp-metrics-io-20261004/` retains all four red baseline logs, the expanded regression test patch, baseline executable copies, and pre-fix hashes. `fixed-a064df16a/` retains the initial sanitized operations-profile failure; `fixed2-a064df16a/` retains the nine successful suite logs, source patch and full source manifest, toolchain output and public scan. `integrated/` retains the post-rebase repeat; `final-fullbody/` retains the nine green repeats with the strengthened complete-body and scrape-count assertions at `3e64e5877`. That tested generation is also retained on `s/codex-libhft-hp-cpp-metrics-verified-20261004`. Integration of the later benchmark-documentation commit leaves every checked C++ source hash unchanged. The portable driver is `evidence/cpp-metrics-io-20261004/run-checks.sh` beside this record and must be wrapped in host-cpu-slot by its caller. Windows runtime tests, deliberate EINTR/nonblocking-setup fault injection, Unix-path ownership fixes, the whole C++ correctness matrix and NIC-sensitive latency evidence are outside this check. Other flavours' endpoint fixes belong to their owners; this record proves only the C++ implementation. The separate .NET FIXP last-close/new-open lock reproduction remains requested from its source owner. The all-flavour review is not complete.