# Admission, rejected recovery and bounded finalization — 2026-10-08

Worktree `codex-review-admission-1008`, based on `846bc4605`.
Parallel reviewers examined C++ classic FIX recovery, Java FIXP finalization and
Rust classic FIX admission. Root reviewed Rust FIXP finalization and ran builds
serially under the shared host CPU lease, with at most 16 workers.

## Findings and changes

- C++ consumed validation rejects advanced the inbound sequence but bypassed its
  checkpoint and recovery continuation. A reject at the end of a requested chunk
  could leave both peers waiting. Consumed rejects now complete the checkpoint and
  next request; raw high/low rejects remain non-consuming. Deferred TestRequest
  response order remains compatible with the QuickFIX regression contract.
  Failed inbound checkpoints also discard callback-created send batches before
  notifying logout observers, preventing a reentrant or later flush after fault.
- Rust classic FIX store failure left queued bytes flushable. It now discards the
  unsent batch while retaining stored replay records and sequence authority.
  High ResendRequest and high/low non-PossDup Logout now pass configured field
  admission before acting. High Logout can confirm a local Logout without gap
  recovery; accepted confirmations are recorded for configured ResetOnLogout.
- Java and Rust legacy FIXP finalization could loop over billions of NotApplied
  frames in a single pump. Both now retain the remainder in the existing bounded
  notification queue and emit at most one count-sized notification per pump. The
  final notification may be followed by FinishedReceiving in that same pump.
  Legacy notifications remain unsequenced, without replay saves, and their inbound
  frontier advances only after the final notification succeeds. Enforced flows
  retain their sequenced notification and frontier behavior.
  Failed required notifications retire the connection, including zero-byte sends;
  a partial write closes once. Diagnostics retain the failed write result.
  A follow-up also guards Rust FinishedReceiving and acceptor finalization
  Terminate cleanup after their frame helper already retired a positive short
  write. Its five regression methods cover 128 combinations, including immediate
  and post-recovery FinishedReceiving, both formats, keepalive off/on,
  negative/zero/partial/full sends and unaffected multi-peer siblings.

## Evidence and verification

Rust default and no-default-features each pass 1376 tests (1228 in the library),
with zero failures and one pre-existing ignored builder documentation example.
The 20 focused regression methods pass; the original code fails 19 and passes
one healthy control with the same tests. The classic tests cover 31 subcases;
the FIXP tests exercise all three runner roles, both SOFH formats, first/later
notification failures, maximum gaps, per-pump writes and sibling usability.
The five cleanup follow-up methods add 128 subcases. Initial green Rust logs
(1371 tests per configuration) are retained alongside the final runs.

Java focused verification passes 271 tests with mandatory JNI: the new 216-case
matrix, 54 existing finalization tests and the native-loading guard. Original
production fails 116 of the new cases, with 100 new-case controls and the native
guard passing, zero errors or skips. The matrix combines three roles, two formats,
flow enforcement off/on and keepalive off/on. Java development passes 3975 unique cases; open passes 3533. Both have zero
final failures/errors/skips with separately built native libraries and mandatory
JNI loading. The three counters-disabled cases skip in the ordinary fork and
pass in their configured fork; final aggregation keys by class and case name.

Regression transports are
scripted; no real network or durable-I/O failure injection is claimed. Java tests
create no filesystem fixtures. The maximum-gap counterfactual probes limit send
calls so the old loop fails promptly rather than running billions of iterations.

The first C++ matrix had 122 cases and the first fixed run reported 58 fixture
failures: positive NewOrderSingle fixtures omitted SAFE/TEST-required fields.
Those fixtures were corrected, and 18 deferred TestRequest controls added. The
original logs are preserved. The corrected 140-case matrix reports 429 failed
assertions against the original header and passes in the full reliability run
with the fix. The C++11 open gate selects, runs and passes 147 binaries, with
zero reported skips and 83 private binaries excluded. The private reliability
companion separately passes its own mmap cases. The full open reliability run
and ASan/UBSan run both execute the 140 new cases and pass; leak detection and
fatal UB diagnostics are enabled. The private companion includes open fixtures
but does not run the open main.

Independent review covered the C++ and both Rust patches; root reviewed Java.
No .NET or reserved C++ FIXP source is edited. Verification is Linux-only. No
throughput or percentile latency measurement is claimed. The work bound is tested
by counting transport writes per pump, including the largest unsigned gap.

## Publication and retention

Published fix commits:
- `55e983eaf`: Rust classic administrative admission, Logout confirmation and batch retirement.
- `86686d5f9`: bounded Rust legacy finalization notifications and failure retirement.
- `79f0f319a`: bounded Java legacy finalization notifications, retirement and diagnostics.
- `b069fa62e`: C++ consumed rejection progress and inbound-fault batch retirement.
- `2b9145852`: single cleanup for Rust partial finalization responses.

Fetched and rebased against `8666fcfe1`; no incoming source changes required
retesting. All eleven changed engine files match their tested SHA-256 hashes.
The export scan checks all eleven with zero findings; whitespace checks pass.
The outgoing history contains only this session's commits. Publication is a
linear direct push to private `atrekes/libhft-devel` main; other claims are
preserved exactly when this session's claim block is removed.

Checkpoints were pushed to the private session branch during verification.
A pre-integration history bundle preserves those exact checkpoint IDs, beside
the final publication bundle. Logs, JUnit reports, source hashes, test drivers,
independent reviews, the patch and this record are retained locally and on HP
under `~/archive/libhft/reviews/2026-10-08-codex-review-admission-1008/`. Both
SHA-256 manifests are verified before the worktree and build outputs are removed.
Final counts are in archived `scratch/evidence/verification-summary.json`.