# C++ metrics renderer failures and recovery

Throwing capture/render callbacks no longer terminate the process. A renderer
that reports more bytes than its supplied buffer now fails that request with
HTTP 500 instead of reading past the buffer. Both classic FIX and FIXP workers
remain available for the next healthy request. This is endpoint runtime
reliability; the fix does not change FIX parsing, session traffic or NIC latency.

## Original failures

At `7f71db0ba2bdc9cdacbe46154a074de30342e336`, the new regression tests
run against unchanged endpoint implementations over real TCP and Unix sockets:

- Capture and custom-render callbacks throwing either `std::runtime_error` or
  an integer terminate the process in all 16 schema/transport combinations
  (exit 134).
- Returning 24,577 for a 24,576-byte buffer incorrectly answers HTTP 200 in
  four schema/transport combinations. The expected-500 assertion fails.
- The Clang 21 open-edition sanitizer probe independently reports a heap
  buffer over-read of 24,577 bytes in the response send path.
- Twelve controls pass: zero and negative render lengths already fail the
  request, while a render that exactly fills the buffer succeeds. Every
  control includes a subsequent healthy request.

The original INT_MAX case is deliberately not driven; the bounded sanitizer
probe establishes the defect without attempting a multi-gigabyte response.

## Correction

The endpoint contains exceptions at its capture/render invocation boundary and
checks `0 < rendered_bytes <= buffer_capacity` before writing a success response.
The classic and FIXP renderer adapters no longer promise not to throw when they
call application capture code. The exception boundary is compiled only where
C++ exceptions are enabled. No locks, allocations or work were added to session
send, receive or snapshot publication.

The endpoint and sources must still outlive their worker; arbitrary capture
code must return promptly. Exception containment does not interrupt callbacks
or make endpoint destruction from its own callback supported.

## Verified candidate

The fixed run uses `7f71db0ba` plus the exact endpoint patch retained with its
source pin and unchanged source manifests. All 15 complete suite runs pass:
five suites in each of the default, open, and Clang 21 open ASan/UBSan editions.
The suites cover callback stop/restart, ordinary HTTP I/O, portable Unix
ownership, FIXP HTTP and operations profiles. Open editions report that private
alert evaluation is not in that edition; this is not a skipped renderer case.

In each edition, the callback suite exercises 36 renderer combinations:
capture/render standard and nonstandard exceptions; over-capacity, INT_MAX,
zero, negative and exact-capacity lengths; both schemas and both transports.
Every combination includes a healthy next scrape. The existing eight callback
lifecycle cases also pass in each edition. Eight one-shot socket-wait failure
probes pass on ordinary default/open builds. Sanitizers report no errors or
leaks, and the four edited/covered public paths have zero scrub findings.

After rebasing over the concurrent C++ socket/configuration changes, all 15
suite runs and eight worker-failure probes pass again at
`bfbc04c454e5018fbda0135755ddb19d14d4990a`, with unchanged source and driver
manifests. That checkpoint is published on main. Default/open build logs name
GCC toolset 14; the generic `gcc --version` capture names the system GCC 11
used for the small poll shim, not the C++ suite compiler.

These are functional tests under shared/isolated CPU leases, not latency measurements
or a complete current-main C++ sweep. The independent .NET endpoint lifetime
closure is recorded separately in
`RECORD_2026-10-11_hp-dotnet-metrics-callback.md`.

## Retained evidence

`~/archive/libhft/cpp-metrics-render-20261011/{baseline,fixed,fixed-after-rebase}/` retains
individual logs, build commands, source pins/patches, compiler information and
source/driver hash manifests. Builds live under
`~/build/codex-libhft-hp/libhft/cpp-metrics-render-20261011/`.
The reusable drivers are under
`internal/docs/bench/evidence/cpp-metrics-render-20261011/` and preserve the
distinction between expected original failures and corrected passes.