# FIX admission and recovery review — 2026-10-10

Session `codex-review-fixpaths-1010`; initial source `3ed28ff015a0b8fa8b45c2b89b5f9a60c0a34001`. Work was isolated under the session worktree. Parallel agents reviewed Rust FIXT, Java FIXP send/replay admission, and C++ classic FIX recovery and sends; root cross-reviewed and ran every build/test under the host CPU lease, at most one heavy job at a time and `-j16`. Native LTO used `-flto=1`.

## Changes

- C++ raw-body application sends include negotiated LastMsgSeqNumProcessed(369), before body fields. Batched sends retain the same progress metadata in wire and replay records; replay refreshes it without changing original records.
- Rust initiators require a valid FIXT DefaultApplVerID(1137) before sequence/reset work and select the inbound application dictionary after admitting the reply. Explicit dictionary precedence, inferred-table reconnect ownership, and independent outbound defaults are preserved. Discarded valid duplicate replies do not select a dictionary; mandatory version admission also checks malformed low duplicates. Version lookup borrows wire bytes rather than allocating a temporary vector.
- Rust high Logons run the same configured field admission as ordinary Logons before establishment/recovery. Rejection preserves the missing inbound frontier; normal ordered rejection keeps its existing consumed frontier. Existing learned-peer acceptor store preadmission ordering is unchanged; the new high-Logon matrix does not claim to alter that earlier binding/callback path.
- C++ explicit configured Logon validation runs before peer learning, admission, store binding/reset and Logon sequence changes. Default permissive and configured Reject/log-only policies remain. The existing ignored high-Logon path during pending recovery remains unchanged. Dedicated validation covers isolated empty-value checks in SAFE/TEST. A bounded temporary rendered header addresses a learning peer's rejection without persistently learning identity; existing failed required-send/store behavior remains in force when an unopened store cannot persist the response.
- C++ ResetSeqNumFlag(141) is correctly classified as a Logon body field. Strict validation accepts valid reset Logons while dictionary and optional header-only scans recognize the body boundary.
- C++ generated Logons no longer append DeliverToCompID(128) a second time after their header builder already included it.
- Java FIXP null-transport sends fail before replay persistence, sequence consumption or finalization; ordinary control sends report errors instead of throwing. Per-call diagnostics describe the failure, and a valid retry remains usable when no transport/store failure occurred.

## Verification

- C++ raw-body progress: 48 regression cases pass optimized and under ASan/UBSan, including batched sends and stored replay; saved original production gives 24 failures and 24 controls. The existing full application-send binary passes.
- C++ configured Logon admission: all 1,278 cases pass optimized and under ASan/UBSan; saved original production gives 852 failures and 426 controls. The full validation binary passes. The dictionary oracle exercises 418 cases, including all six Logon rows and the mandatory silent-disconnect case; final has zero differences, baseline has two. Master-enabled cases also verify newly enabled validation telemetry, so the baseline count is not a count of unique bugs.
- C++ broad verification: 154 open-edition binaries pass, zero reported skips, 85 private binaries excluded by edition design. Both affected private reliability/store-selection binaries pass without reported skips; the open core gates pass.
- Rust FIXT reply admission: 14 final passes, baseline five passes/nine failures. High-Logon field admission: six final passes, baseline three passes/three failures. Baselines repeat with service packs; final repeats with service packs, no default features and open edition. Both full suites (telemetry enabled/disabled) pass 1,536 tests each, with one pre-existing ignored builders documentation example each. Strict all-target Clippy passes both default and service-pack configurations.
- Java FIXP admission: unchanged final regressions against original production give 38 failures/33 passes including the native guard, no errors or skips. Final broad FIXP selection passes 2,721 cases, no errors, failures or skips.
- Java full verification: development passes 6,232 unique cases; open edition passes 5,764 unique cases. Native loading is required. The three telemetry-disabled cases skipped in the default run are rerun successfully in their dedicated counter-disabled fork; final XML has zero remaining skips.
- Source snapshots, whitespace checks, and public-export scans: all nine reviewed engine files match their saved final hashes, whitespace checks pass, and the export scan reports nine files with zero findings.

Baseline regressions use unchanged final tests against saved original production, with exact restoration. Early test-fixture failures are retained separately: C++ constructor argument omission, Rust misplaced PossDup header, and Rust rejection fixture assuming both roles were CONNECTED. The first C++ strict gate also exposed the pre-existing 141 header-classification error (120 reset-case failures); its valid wire fixtures were retained and production was corrected. The test-fixture errors were corrected before final acceptance; an affected Rust driver was interrupted as its own process group, and final-source restoration and absence of leftover compilers were verified.

No hardware latency percentile claim is made. The cached-header raw-send optimization was investigated but not implemented or benchmarked; its evidence is retained in scratch. No all-language conformance or Windows verification is claimed. The previously prepared .NET borrowed-buffer append proposal remains separate and unintegrated because its paths are reserved.

## Publication and evidence

The four fix commits were rebased onto `a73046ad831f2416778c54484276bd62dabd1140` after a fresh fetch. Incoming benchmark and JNI changes did not overlap the nine reviewed files, whose hashes remained exact; compiler dependency files showed no intersection between the incoming paths and the C++ suite. Both full Java editions rebuilt JNI after this rebase. A final rebase onto `6ac0791413bb6a698aec8bc194b0c2e9d30dcd52` incorporated two benchmark-only commits; the complete `engine/` Git tree remained identical, as did all four fix patches in range-diff. The evidence audit and final hashes were checked again after rebase. Only this session's commits are published to main with a normal fast-forward push, followed by a fast-forward-only pull of the main checkout.

Evidence archive: `/home/yann/archive/libhft/reviews/2026-10-10-codex-review-fixpaths-1010`, mirrored to the same path on `hp`. `MANIFEST.sha256`, `source-final.sha256`, and the prerequisite-based history bundle are verified; final publication commit IDs are in `archive-info.json` and `published-commits.txt`.

The archive preserves drivers, original/final source snapshots, stdout/XML results, source hashes, review notes, and a history bundle. Session worktree, build outputs and scratch are removed only after publication and archive verification.