# Fixed FIXP replay-store reset review — 2026-10-12

Session `codex-review-wire-1012` reviews the fixed in-memory FIXP replay stores
in C++, Java, .NET and Rust. The initial wire/numeric/replay review produced
no additional confirmed correctness defect. It did identify redundant work
when a peer retires or a store is reused: reset cleared every payload byte,
even though slot metadata already prevents any old record from being returned.

## Change and contract

Reset now clears sequence, length and validity metadata without rewriting
large payload storage. C++ retains its original contiguous clear for payload
capacities up to 64 bytes: measurements found it faster than separate metadata
writes at 64 bytes. The choice is a compile-time constant. Java, .NET and Rust
clear only metadata at every capacity. Lookup, range availability and occupancy
all consult that metadata. A successful save overwrites the complete visible prefix before
publishing its new length and validity. Empty and shorter records therefore
expose only their own payload, including after repeated reset and slot reuse.
Rejected saves still leave existing records untouched.

C++ keeps its full constructor initialization; managed arrays and Rust's
payload vector also start initialized. Allocation, layout, file truncation,
mmap reset policy and durable ownership are unchanged. Borrowed record views
continue to refer to mutable storage; the tests make no new assertion about
bytes outside a returned record or after a view's slot is mutated.

Public regression cases cover invalidated lookups and ranges, cleared missed
lookup output, reset/reuse cycles, shorter and empty records, unsigned
sequence boundaries, refused saves and occupancy where the API exposes it.
These behavioral tests also pass with the original implementation: this is
a reset-cost optimization, not a new correctness claim.

## Qualification and measurements

The qualification worktree is based on `30c42ee59`. Source manifests below
pin that base plus the reset changes and regression fixtures. They do not
claim qualification of later, unrelated upstream implementation changes.

Java's pure-store baseline and candidate each pass the exact 11-case fixture
with zero failures, errors or skips. Five independent JVM forks provide
25 samples per capacity per variant. With 256 slots, median reset-cycle time
falls from 3,958 ns to 280 ns at 64 bytes per slot, and from 2,760,671 ns to
281 ns at 65,536 bytes per slot. Each cycle includes an empty save, reset,
missed lookup and volatile payload observation; initial population is excluded.
The source and JVM settings are otherwise identical. An independent audit
rechecks all 44 retained evidence hashes, raw XML reports and the 50 samples
per variant. Java's native integration passes the exact 46-case selection in
each edition with zero failures, errors or skips. Both editions build a fresh JNI
library at its normal location, with GCC 14, C++11 and LTO1 on HP at j4.
The required-native control and actual library hashes are checked. All 1,236
Java/C++/shared/build input hashes match the qualified candidate. Root
independently rechecks the retained evidence hashes and raw XML totals.

C++ initial development qualification passes five selected binaries: the nine-case
fixed replay-store fixture, 129 alias cases, 16 acceptor-reset-failure cases,
and the file replay-store and multi-acceptor assertion suites. The latter two
contain 19 and 14 top-level call groups, respectively; these are call-group
counts, not framework-discovered individual cases. The new nine-case fixture
also passes against the original reset. All 13 completed baseline/development
stages and their raw log hashes were independently checked. Compilation uses
GCC 15, C++11, O2/LTO1 and enabled assertions on the local host. The initial
open qualification and paired measurements moved to HP after the local stage
waited behind other sessions; the waiting job was canceled before any open
build began. HP passed the same five open suites and all 38 stages.
Fifteen alternating benchmark pairs on HP found a 256-slot, 4 KiB payload
reset improved from 20,768 ns to 260 ns, but a 64 B payload reset regressed
from 126 ns to 177 ns. That finding motivated the small-capacity specialization;
these initial measurements remain separate from final-candidate evidence.
No own builds ran concurrently on either host.

The final C++ candidate passes the expanded 12-case fixture against both the
original implementation and the final implementation. Named reset/reuse
cases cover payload capacities 8, 64, 65 and 4096. Development and open each
pass the same five suites: 12 fixed-store cases, 129 alias cases, 16 reset-failure
cases, and the 19/14 assertion call groups above. All 50 stages, their raw log
hashes and all 533 source hashes were independently checked. Final qualification
uses GCC 14/C++11/O2/LTO1, enabled assertions and j4 on HP.

Final paired measurements use GCC 14/O3/LTO1, CPU 0 and 15 alternating pairs,
with 8192 resets per sample. At 256 slots × 64 B, medians are 125.731 ns before
and 125.583 ns after: the original small-store speed is preserved. At 256 slots
× 4 KiB, medians are 21,682.469 ns before and 259.752 ns after, about 83.5×
faster. These samples include the non-inlined wrapper and opaque compiler
barriers; allocation and initial population are excluded.

The Java/.NET native runs above used the initial metadata-only header. Their
four fixed-store instantiations all have payload capacities above 64 B, so
the final specialization leaves their reset path unchanged. Separate GCC 14
C++11 and C++17/LTO1 probes verify identical optimized `.text` and exported
symbols for those four reset instantiations before/after the specialization.
This supports the applicability of the native results; it is not a claim that
the full JNI/.NET native libraries were rebuilt after that refinement.

Rust's original implementation passes both new public regression cases with
zero ignored tests. Its release baseline probe captured seven samples per
capacity with public-state observations checked after timing. The Scan
candidate also passes the two reset cases and its release probe. Matched
before/after phases use one process per variant; these are not alternating
process pairs. Median reset time is 222 ns versus 100 ns at 64 slots × 64 B,
and 853,235 ns versus 4,769 ns at 4096 slots × 4 KiB. Timing includes the clock
read overhead; saving and public-state observations are outside the timed
interval. An independent audit recomputes both variants' 14 raw rows, checks
their observations and verifies all 850 candidate source hashes.
The subsequent library-test compile failed while rustc wrote its incremental
query cache (`ENOSPC`); no broader test from that executable ran. Logs and
measurement receipts were preserved. Remaining candidate tests were queued
locally, then moved to HP after local foreign jobs kept the guard waiting.
The local waiter was canceled before its first compiler launch. HP uses the
same Rust 1.92 toolchain as the measurement host, j4 and a whole-host lease.
The failed compile is recorded as an infrastructure failure, not a test pass.
The completed HP gate passes 2 reset regressions plus 154 selected FIXP
store/vector/lifecycle cases in development, and 2 plus 129 in open. Both
editions use default Cargo features and explicit edition selection. Root
independently verifies exact discovery/execution identities, zero failures or
ignored cases, all eight successful commands and all 850 candidate inputs.

.NET's baseline passes both reset regressions and the required-native control
(3 passed, 0 failed or skipped). After the one-line deletion, development
passes 89 selected cases and open passes 85. Raw TRX identities match each
edition's discovery exactly, every executed case is `Passed`, and both native
test copies match the products built at their normal paths. All 1,866
.NET/C++/shared/build input hashes match the candidate. Qualification uses
HP SDK 8.0.131/runtime 8.0.31 and GCC 14/C++17 at j4. The development native
library is freshly built for the baseline with the initial metadata-only C++
candidate header and reused unchanged by the managed candidate; the open
library is built separately.
An independent second audit confirms the raw TRX/discovery identities, all
17 successful stages, source hashes and recomputed paired measurements.

.NET paired measurements retain the two compiled binaries, reverse execution
order in the second pair and pin each run to CPU 0. Tiered compilation is
disabled; each sample includes a one-byte save, reset and missed lookup through
a non-inlined wrapper. Each table cell is the median of 14 samples across two
processes, after warmup and untimed store population.

| Slots × payload capacity | Baseline reset cycle | Candidate reset cycle |
| --- | ---: | ---: |
| 256 × 64 B | 1,772 ns | 308 ns |
| 256 × 4 KiB | 30,290 ns | 523 ns |
| 4096 × 4 KiB | 817,971 ns | 20,282 ns |

All builds use session worktrees and `LIBHFT_BUILD_ROOT`. Jobs take actual
host CPU leases and wait for foreign heavy processes, including processes
outside those leases. Local builds cap parallelism at j16, HP at j4 and
Scan at j8. Native bindings use their normal edition-specific library paths
and their required-native controls; skip counts are checked explicitly.

The benchmarks measure fixed-store reset work with compiler/JIT barriers
and public-state observations. They do not measure end-to-end peer retirement
or message latency, and results from different hosts are not a language
performance comparison.

## Integration and retained evidence

The publication review checks upstream imports separately from the pinned
qualification base. Through `2a1f5a458`, imported implementation changes affect
classic FIX reject/recovery and Logon/Logout handling, plus .NET QuickFIX
writer fault handling. The native C ABI declarations and layouts are unchanged.
All 395 pinned FIXP files and the relevant build/policy files are unchanged by
those imports. General native/managed source manifests describe the qualified
base; they do not claim a rerun of the unrelated imported classic FIX code.

Raw logs, exact test inventories, source hashes, retained probe binaries,
before/after measurements, infrastructure failures and independent audits
are archived under
`~/archive/libhft/reviews/2026-10-12-codex-review-wire-1012/`.
The archive also retains publication and worktree cleanup receipts.