# Sequence authority review — 2026-10-08

Session `codex-review-sequence-1008` started from `a4b79fe2c` in its own locked worktree. Three reviewers covered C++, Java and Rust; root owned builds and integration. Heavy work was serialized with the shared host lease and at most 16 compiler workers. Outputs used the session build root; Java used JDK 21 with the Java 8 target and required JNI loading. No .NET Pure files were edited.

## Findings and changes

- C++ QuickFIX/C++ store: a failed sender checkpoint changed the cached sender number. A later successful target checkpoint could persist that rejected sender value. The setter now restores its old cached value on failure. `SaveOutbound` retains its existing consumption semantics: when the body/index record is committed, a failed checkpoint must not make that outbound number reusable.
- Pure Java FIX replay: session replay copied tag 34 from the durable payload instead of the selected store key. A key 1 payload containing tag 34=9 could produce replay 9 followed by 2. Both session owners now supply the authoritative store key to a session-only encoder overload, which emits exactly one tag 34. The generic public encoder retains its old contract; checksum/body validation and administrative gap filling remain in place.
- FIXP ordinary input: after Sequence(7) at accepted frontier 1, an ordinary application was implicitly relabeled as missing sequence 1. A stale marker similarly turned duplicate input into fresh input. C++, pure Java and Rust now keep an optional ordinary wire cursor independent of the accepted recovery frontier and counted historical replay. Ordinary wire consumption advances the cursor even for a duplicate or gap; replay or idempotent skips that advance the accepted frontier lift a lagging cursor. Exhausted zero stays exhausted. Lifecycle/reset clears context; refused markers and explicit mismatched ordinary state calls cannot overwrite it. Sequenced Applied/NotApplied share ordinary numbering. No marker retains implicit numbering compatibility. Context remains event-only, and no out-of-order buffering is added.

The ordinary numbering rule is described in [FIXP 1.0 section 3.5.1](https://www.fixtrading.org/wp-content/uploads/download-manager-files/FIX_Performance_Session_Layer_V1.0.pdf). The implementation keeps libhft's documented implicit return from counted replay.

## Initial publication verification

| Gate | Result |
|---|---|
| C++ checkpoint, original header with new tests | Aborts at first rejected-setter cache assertion |
| C++ final QuickFIX/C++ store suite | Pass |
| C++ full store ASan/UBSan, leak detection and fatal UB | Pass |
| QuickFIX/J store control sharing the I/O fixture | Pass |
| Java original four-production-file overlay | 196 assertion failures, 125 passing controls; zero errors/skips |
| Java final focused suite | 439 pass; zero errors/skips |
| Java development suite | 5,641 unique cases pass |
| Java open-edition suite | 5,198 unique cases pass |
| Rust original five-production-file overlay | 9 assertion failures; finalization control passes |
| Rust focused suite | 10 tests pass |
| Rust full default features | 1,414 pass; one existing documentation example ignored |
| Rust full no-default features | 1,414 pass; same documentation example ignored |
| JNI validation on publication C++ sources | 67 development and 62 open cases pass; zero errors/skips |

The 320 new Java cases comprise 80 classic replay cases and 240 FIXP cases. On the original code, classic replay contributes 40 failures and 40 controls; FIXP contributes 156 failures and 84 controls; the native loading guard passes. Rust's 10 new methods contain 260 fixture scenarios. Its existing multi-acceptor response-capacity test is updated because its successful Sequence-gap branch explicitly expected the old relabeling defect.

Java uses the standard relocated development/open JNI locations with `libhft.require.native=true`. Full counts are deduplicated by class and test name from complete Surefire XML, including the dedicated counters-disabled execution. The three conditional skips in the ordinary counters execution pass in their configured fork. No native skip is counted as a pass.

Full Java runs initially used the proposed C++ cursor core. After deferring that part, both JNI libraries were rebuilt against the publication C++ sources and all native FIXP tests plus the native-load guard were run again in both editions. Java sources remain byte-identical to the full-suite inputs. The first publication's 16 engine files are bound by its `tested-source.sha256`.

The C++ pre-write ENOSPC seam checks four setter/increment paths, bounds and a committed `SaveOutbound` control. This is not evidence of atomicity against partial disk writes or power loss. `SaveOutbound` still consumes the sequence of a committed body/index record even when its checkpoint fails.

Intermediate results are retained. Rust's first focused iteration incorrectly expected automatic retransmit output from the legacy initiator; the corrected fixture preserves that existing owner policy. Java's first large-key fixture entered the existing MAX-255 Logout reserve before reaching replay; it now leaves eight more numbers below that reserve. No production behavior changed for either fixture correction. A later full Rust run exposed the old multi-acceptor expectation of relabeling sequence 12 as missing sequence 9; the corrected test retains both peers, response-capacity checks, recovery 9..11 and zero application callbacks.

Cross-review added direct state API protection against replacing ordinary context during active counted replay and aligned forward-only frontier lifting. Independent reviews are hash-bound. No Windows or NIC latency run was made. These changes use fixed state and existing parsing/storage paths; no measured latency improvement is claimed.

## C++ cursor completion

The user's continuation approved applying the prepared runner integration. Six finalization frontier updates now use `AdvanceInboundFrontier`: two in each of the initiator, acceptor and multi-acceptor. They advance a lagging ordinary cursor without rewinding an ahead cursor or reviving an exhausted zero. Cleanup and notification timing remain at their existing sites.

The sixth update also fixes a pre-existing legacy multi-acceptor bug. Finalizing through `UINT64_MAX` called the reset setter with zero, which normalized the frontier to 1 and reopened the sequence space. It now clears counted replay, advances to exhausted zero and clears the pending recovery request, as the other owners do. A dedicated no-marker case reproduces this defect with original main headers: expected frontier/cursor 0, actual 1.

The completed finalization matrix has 240 cases: three roles, two framing formats, flow enforcement on/off, four ranges (ordinary, crossing the signed boundary, near the unsigned maximum, through the unsigned maximum), and five cursor contexts (stale, current, ahead, absent, already exhausted). It checks exact NotApplied/FinishedReceiving replies, frontier/cursor, application delivery or the existing gap/duplicate result, the lenient finalization anomaly and sibling isolation. The two-case exhaustion selector is a subset of that matrix. The prior core checks include 66 owner scenarios and direct admission/lifecycle/unsigned-boundary controls.

| Completion gate | Result |
|---|---|
| Original main state/protocol/runner headers, cursor selector | Fails the first marker/cursor assertion |
| Original main headers, exhaustion-only selector | Legacy multi-acceptor restarts at 1 instead of retaining zero |
| Prior proposal core with original runner headers | First finalization case leaves wire cursor 7 behind accepted frontier 12 |
| Completed incoming-replay suite | Pass, including all 240 finalization cases and existing replay cases |
| Completed full incoming-replay ASan/UBSan | Pass with leak detection and fatal UB |
| C++11 open edition, layering and simulator gates | 147 selected, 147 ran, 147 pass; zero reported skips; 83 private binaries excluded |
| Private C++ FIXP suites | 8 binaries pass; zero skips |
| Rebuilt Java JNI development/open checks | 307 development and 302 open cases pass; zero failures/errors/skips |
| Rebuilt .NET native FIXP checks | 56 cases pass; zero failures/skips |

Counterfactual C++ binaries abort at their first failed assertion; these are independent reproductions of three failure modes, not a claim that every matrix row was run against the old headers. Final runs exercise the complete matrix. No out-of-order buffering, finalization policy redesign or measured latency improvement is claimed. The former five-site [proposal patch](evidence/sequence-authority-20261008/cpp-finalization-cursor.patch) remains as historical review evidence; final production additionally includes the legacy multi-acceptor fix.

Independent Java and Rust reviewers checked all six sites, every reset/establishment route and the expanded matrix against exact hashes. Completion verification binds the six C++ engine files to `completion/evidence/tested-source.sha256`. Java/.NET source and native ABI layouts are unchanged; their libraries are rebuilt from the completed C++ headers. The Java follow-up includes 67 development / 62 open native and loading-guard cases plus 240 pure cursor controls in each edition; it is a targeted follow-up, not another full Java run. The eight private C++ binaries are a subset of the 83 excluded from the open gate. No .NET Pure fix, .NET open-edition gate or Windows execution is claimed.

## Publication and retained evidence

The independent checkpoint and Java/Rust fixes were published at `e8e5d1b9b`. The C++ completion is published after a fresh fetch/rebase and source-hash verification; only this session's commits go to private `origin/main`. Incoming changes are checked for overlap. The temporary claim and request are released; other sessions' claim blocks are preserved.

The first publication remains archived at `~/archive/libhft/reviews/2026-10-08-codex-review-sequence-1008/` on this host and HP. Completion is retained separately at `~/archive/libhft/reviews/2026-10-08-codex-review-sequence-1008-completed/`. Both archives contain logs/reports, source snapshots/hashes, scripts, independent reviews, and Git bundles; the first also preserves the incomplete private proposal for reproducibility. Completion's `scratch/completion/evidence/verification-summary.json` records final counts. Manifests are verified on both hosts before removing the session worktree and build outputs.