# Replay and admission review — 2026-10-06

Base: `cd0bb15cd`. Session: `codex-review-replay-1006`. Three parallel reviewers
covered classic C++, classic Rust and FIXP; the root reviewed classic Java and
ran every build/test under the shared host lease. Builds used external roots,
at most 16 jobs, bounded LTO and C++11 for library code. Java targets Java 8 APIs
and runs on JDK 21. No .NET source or reserved FIXP runner paths were changed.

## Corrections

Classic resend bounds now agree across C++, Rust and Java. Zero remains
open-ended. The legacy 999999 sentinel is accepted only for FIX 4.0–4.2,
matching both local QuickFIX references. C++ and Rust previously expanded this
explicit bound on newer versions, replaying beyond the requested interval.
Java previously truncated legacy recovery there. Outbound requests continue
to use zero from FIX 4.2 onward. Empty and populated ranges, clipping past the
last sent message and unchanged fresh outbound counters are covered.

Classic Java initiators now stop Logon admission when replay required by tag789
fails to write. The prior branch ignored the replay result and replaced the
transport FAULTED status with LOGGED_ON. Tests cover ordinary and high-sequence
Logon replies, first and middle replay failures, and successful recovery.

Classic C++ closes fresh application admission before constructing Logout or
calling its admin hook. Later direct sends, callback echoes, sends allowed by
a callback that initiates Logout, and recursive admin-hook sends cannot claim
fresh sequence numbers or write application frames. A caller-composed frame
rolls back only its immediate unused claim. Refusal returns NONE so peer Logout
and stored replay can still complete recovery. Admission reopens on a new
connection, including an initiating Logon deferred by schedule. The closure is
owned by SessionState, so acceptor removal/slot compaction and protocol rebinding
preserve it. It occupies previously unused first-cache-line padding. Existing
low-level pre-Logon behavior remains supported.

Rust checks journal epoch replacement for teardown and all local/peer Logon
resets before rewinding outbound counters. A failed teardown reset takes
precedence over the transport/Logout error and latches E_STORE; automatic
teardown no longer erases a journal after an existing store fault. Direct
reconnect closes a refused replacement transport and retains E_STORE until
successful explicit offline reset. Direct initiating Logon cannot bypass the
fault. Checked reset already synchronizes, so teardown avoids a redundant sync.
The existing admitted inbound Logon checkpoint order stays intact: an inbound
reset can have consumed its Logon before later store replacement fails. The
terminal store fault prevents publishing a usable outbound epoch in that case.

FIXP Context now enforces the peer flow in Java, C++ and Rust before updating
peer sequence metadata. Unsequenced and None flows reject it when enforcement
is enabled; sequenced flows and disabled enforcement retain their behavior.
Their direct protocol application APIs also require ESTABLISHED before any
flow-specific early return or idempotent gap can advance the inbound cursor.
Java runner coverage checks both frame formats, both single-session owners and
multi-acceptor peer isolation. Active incoming replay remains protected.

## Reproduction

- C++ resend: 54 failed assertions across 18 modern-version cases; 126 controls pass.
- C++ Logout: corrected baseline has 258 failed assertions across 42 cases.
  Final coverage adds recursive admin-hook and replay/ack/reconnect controls.
  An intermediate protocol-owned flag failed six real acceptor compaction cases
  (30 assertions); the final connection-owned flag preserves closure across them.
- Rust teardown: seven failing tests, including real QuickFIX checkpoint failures.
- Rust second baseline: ten pass and nine fail, separating the repaired teardown
  from unchecked Logon resets and modern resend bounds.
- Java Logon recovery: four failing cases, ten controls pass after fixture correction.
- Java resend: twelve legacy failures and 84 controls pass.
- Java FIXP Context: twelve failures and 36 controls pass; its correction then
  exposes six failing direct application admission cases among 16 configurations.
- C++ FIXP: four failures among 16 Context cases; 30 failures among 96 application
  admission cases.
- Rust FIXP: five failing tests and three controls pass.

Initial Java harness attempts did not establish the synchronous initiator owner
and are retained as superseded fixture runs. C++ Logout's initial inbound order
omitted mandatory fields; the corrected baseline uses valid orders in every
mode. One initial C++ build named an absent target and ran no tests; the corrected
target set supersedes it. None of these setup failures is counted as a bug proof.
A targeted Maven invocation stopped at test-compile, before the configured native
build phase, and still loaded the prior JNI library. Its superseded run was
stopped through its own host lease; the corrected driver explicitly builds
native first and records library/header timestamps before rerunning the tests.

## Verification

Rust default and no-default-feature suites each pass 1304 tests with zero failures
and one intentionally ignored builders documentation example. Final C++ development
runs pass eleven binaries, including classic/pro replay and state tests, FIXP
protocol/pro runners, TLS stress, veto hooks and application sends. The full C++
open-edition gate passes 147/147 binaries with zero reported skips, plus its
layering and simulator gates; 83 private binaries are excluded by edition selection.

Java development passes 3528 unique cases with zero final failures/errors/skips.
The ordinary fork intentionally skips the three counters-disabled cases, which
pass in their configured fork. This full run preceded the C++ connection-owned
admission follow-up; Java source remained unchanged. An explicit final native rebuild then passes 44 affected integration cases
in twelve classes with zero failures/errors/skips, covering slot reuse, application
I/O, durability, reconnect, lifecycle, scheduling and close callbacks.
The final Java open-edition run, with a freshly compiled open JNI library and
native loading required, passes 3086 unique cases with zero final failures,
errors or skips. Its configured counters-disabled fork also passes all three
cases. The retained verification-summary.json is generated from final JUnit
reports and test summaries; the 44 repeated integration cases are not added
to the unique development count.

All fourteen final engine files pass the export scan with zero findings, and
whitespace checks pass. All fourteen source hashes still match after fetching
and rebasing on origin/main. These are Linux checks; no Windows or .NET suite
was run in this pass.
There are no new locks or allocations on application send paths. C++ places its
admission flag in existing SessionState padding and tests it with cold branches;
Rust removes an extra teardown synchronization after checked reset. No measured
latency speedup is claimed.

## Publication and evidence

C++ classic: `865a7c3ba`; Rust classic: `2e4a0370b`; Java classic:
`70aa7c6d3`; cross-language FIXP: `3aec56274`.
Private `atrekes/libhft-devel` only. Final commits, source hashes, complete logs
and JUnit reports are retained with this record under
`~/archive/libhft/reviews/2026-10-06-codex-review-replay-1006/` locally and on HP.
Publication follows fetch/rebase and verification of the exact tested source.
The session worktree/build root are removed after verified archival.