# FIXP replay review — 2026-10-14

Parallel review of C++, Java, .NET and Rust replay stores, recovery, borrowed payloads
and retransmission costs. This batch fixes two confirmed defects.

## Behavior

- A live outbound frontier of zero means the unsigned sequence space is exhausted.
  Durable resume previously replaced zero with a positive recovered successor.
  A real mmap acceptor that sent `UINT64_MAX`, closed, and reopened with
  `resetOnOpen=true` could therefore reuse sequence one. Every supplied durable
  resume implementation now preserves zero. Native acceptors refuse the exhausted
  listen; managed acceptors refuse the same session's negotiation. Ordinary
  frontiers still advance from recovered history. Explicit new-session behavior
  is unchanged and covered by the managed reconnect controls.
- C++ and Rust FIXP occupancy multiplied a 64-bit byte count by one million before
  dividing. This could overflow, including a panic in Rust's checked build.
  Rust now computes in `u128`. C++ uses an exact portable integer helper with the
  existing small-counter multiply/divide path and a bounded search for large
  counters. Zero capacity reports zero; full capacity saturates at one million.
  C++ checks 20,000 deterministic pairs against an independent wide-integer oracle.

Both changes are outside normal message sending. No latency improvement is claimed.
Borrowed-slot copies were already overlap-safe. Empty-path mmap opening deliberately
preserves an injected/preopened store. Classic C++ and managed mmap size limits
make their corresponding arithmetic safe; those implementations were left alone.
The optional Rust checkpoint-CRC optimization was not changed without optimized-code
measurement. Existing restart identity behavior is pinned by recovery fixtures.

## Reproduction

Baseline source: `6b1a6285fd6b098d87234af55bb0a39e5d6e5209`, production unchanged.

- C++: all three targeted programs reproduced failures: file resume, mmap occupancy,
  and exhausted acceptor restart. The latter reproduced for both SOFH formats and
  HA enabled/disabled; nonterminal controls passed.
- .NET: 10 failed and 7 passed, including the native-library guard.
- Java: 3 failed and 3 passed, including the native-library guard; zero skips.
- Rust: integration 4 failed / 3 passed; the separate mmap occupancy unit failed
  with multiplication overflow. No ignored tests.

`baseline.bundle` retains that source and requires published commit `200180686`.

## Qualification

Qualified source: `ab1f18338af4f210137c693f1a8ca88a847d0bde`.
Qualified complete `engine/` tree: `d16c431470dc8d2327cdbb4f660871e3bfdbac77`.
All 14 post-fix build/test stages passed. These are the selected replay, runner,
metrics and related provider suites, not an entire repository conformance run.

| Check | Development | Open |
|---|---:|---:|
| C++ programs, GCC 15 / C++11 | 10 | 5 |
| .NET tests, Release | 1,374 | 1,277 |
| Java tests | 3,162 | 3,030 |
| Rust FIXP unit tests | 379 | 328 |
| Rust FIXP integration tests, 15 programs | 331 | 318 |

Zero selected tests skipped or ignored. Both managed flavours' native-library
required guards passed in both editions. Native libraries were rebuilt through
the normal Make/Maven paths. C++ includes the 20,000 arithmetic-oracle cases in
each edition. Export scan: 17 changed engine files, zero findings.

The qualification drivers serialize all heavy builds/tests using the shared host
lease, check running compilers and available memory before each stage, and cap
parallelism at 16. The initial per-stage scheduler was handed off before the first
managed qualification stage to one sequential lease; this was a control handoff,
not a failed build/test. `stages.jsonl` records every executed stage and its command.

## Retained evidence

`/home/yann/archive/libhft/reviews/2026-10-14-codex-review-replay-1014`
contains the baseline and qualified source bundles, exact drivers, per-stage logs,
Java XML reports, aggregate qualification JSON, source hashes, and a SHA-256
manifest. Large raw reports stay outside the repository. Publication verifies
that rebasing preserves the entire qualified engine tree; final Git and cleanup
receipts are retained in the archive.