# FIXP recovery continuation, correlation timestamps and finalization diagnostics — 2026-10-16

This focused continuation of the full code review used a fresh worktree on the
rewritten history. Three parallel agents reviewed C++, Java and Rust; root reviewed
.NET, cross-reviewed the candidates and ran the builds. Heavy jobs ran serially
under the shared host lease with a foreign-process/memory guard and at most 16 workers.

## Confirmed defects and changes

- .NET finalization recovery stopped after the first count-limited RetransmitRequest
  when the peer's LastSeqNo required another chunk. Track the inclusive endpoint of
  the outstanding request and ask for the next suffix after delivering its last
  message. The initiator and acceptor use the new continuation method; the multi
  owner delegates to the acceptor. The existing public OnInboundProgress method
  keeps its completion-only contract. Duplicate peer heartbeats remain suppressed
  while a request is outstanding, and reset clears the recovery endpoint.
- C++, Java, .NET and Rust protocol events lost the wire correlation timestamp from
  Establish, EstablishmentAck, Retransmission and RetransmitReject. Each validated
  handler now retains it in requestTimestamp (or the language's corresponding field),
  independently of the local receipt timestamp. Zero and the full unsigned wire range
  are preserved. Existing malformed-message, session-ID and flow checks remain.
- C++ and Rust automatic Terminate responses to FinishedReceiving reused the public
  send path, which cleared or replaced the input diagnostics. An internal path now
  preserves the received frame, event and read byte count, while recording response
  bytes and the latest actual transport result. Successful immediate initiator close retains the
  completed step. Explicit public sends keep their prior clearing behavior. Failed
  required responses still retire the affected session; multi peers remain isolated.

The changes add scalar state and stack storage only. No allocation, blocking work or
new loop is added to the delivery path. No measured latency improvement is claimed.

## Regression design and independent review

.NET runner cases exercise three roles, both SOFH formats, flow enforcement on/off,
three recovery chunks ending at an ordinary number or ulong.MaxValue, and successful,
zero, negative and positive-prefix writes. Public frontiers seed large ranges; real
encoded Retransmission and application frames cross each boundary. Tests verify
exactly-once delivery, replay metadata, duplicate suppression, failed-response
retirement, later I/O refusal and multi-peer sibling usability. Unit controls preserve
the legacy completion-only API and exercise continuation/reset directly.

Correlation tests cover all four affected message kinds, both endpoint forms where
applicable, zero/nonzero/high-bit/maximum timestamps, local receipt time, reused-event
clearing and malformed/foreign-session controls. The Rust protocol fixture uses the
role-neutral negotiation-response adoption path, not an acceptor wire handshake.

C++ and Rust finalization cases cover initiator, acceptor and multi acceptor; both SOFH
formats; direct read versus already buffered input; enabled or disabled clocks;
earlier FinishedSending heartbeat; and four transport write outcomes. C++ varies flow
enforcement on/off; Rust uses the existing helpers' default flow-rules configuration.
Explicit public-send controls check compatibility. Baseline Rust macro tests stop at
the first failed matrix row; their full row counts describe fixed qualification only.

C++ and Java reviewers checked .NET endpoint arithmetic, overflow, reset and public
API compatibility. Java reviewed other-language timestamp cases and C++ diagnostics;
Rust independently reviewed the C++ diagnostics patch and fixture. Root reviewed the
Rust candidate and retained the prior read result when encoding fails before transport.
C++ and Rust keep their existing distinct SocketSessionStep.result conventions;
inbound event.result remains the received event's result.

## Scope and observations

This batch establishes correctness and diagnostic consistency. Potential cold-path
store-open/duplicate-close savings and replay-loop continuation were examined but
lack a demonstrated correctness failure or measured performance benefit. No fix or
performance claim is made for those observations. The native build retains four
pre-existing GCC array-bounds warnings in multi-peer replay dispatch. Independent
review traced the private dispatch calls to the guarded PumpPeer entry and confirmed
that the warned index cannot reach them; baseline and fixed builds emit the same warnings.

## Validation

Baseline production has the 13 source blobs recorded in the archive's source-manifest.
The combined baseline ran at `8750f3c90d44d24d915b1da754dec4429ef65d7e`.
C++ protocol tests reproduced 24 correlation failures among 144 correlation cases;
the existing 16 context and 96 admission cases passed. .NET reproduced all 96 runner
continuation cases and 24 nonzero timestamp cases, with 27 passing controls/original
cases. Java reproduced four timestamp methods, with 11 passing methods. Rust's
correlation suite had four failures and one passing control; the finalization suite
had three failures and three passing public-send controls. Both managed native guards
passed; no baseline test was skipped or ignored. The .NET baseline native library
was built at `0126c3f6a`; its C++ header/native inputs are unchanged at the baseline
source. Java built its JNI library during the combined baseline. Qualification
rebuilt both native libraries after the C++ changes, using the normal relocated paths.

The first C++ finalization fixture counted the empty Terminate reason length prefix
as one byte instead of two. Its 12 successful public-send control failures were a
fixture mistake, independently of the erased input diagnostics. The two expected
frame sizes were corrected from SOFH+26 to SOFH+27 at `acc4bc448`, with all production
blobs unchanged. Both the initial and corrected source/logs are retained.

The corrected C++ baseline ran 336 cases: all 288 automatic-response cases failed,
while all 48 explicit-send controls passed (10,016 checks, 2,040 failed checks).
Qualification ran at `d71d6c181` after a normal rebase onto the rewritten main.
All 20 changed engine files retain the exact candidate blobs through this rebase.

All 21 completed qualification stages passed.

| Qualification | Passing results |
|---|---:|
| C++ development and open | 13 programs each |
| C++11 ASan + UBSan test_fixp_session_protocol | context, application admission and correlation regression cases |
| C++11 ASan + UBSan test_fixp_heartbeat_diagnostics | heartbeat diagnostics: 940 cases, 0 failed cases, 23334 checks, 0 failed checks |
| Core tier tags and core gate | passed |
| .NET devel FIXP and native guard | 1955 tests |
| Java devel FIXP and native guard | 3352 tests |
| Rust devel FIXP unit | 385 tests in 1 program |
| Rust devel FIXP integration | 522 tests in 20 programs |
| .NET open FIXP and native guard | 1858 tests |
| Java open FIXP and native guard | 3220 tests |
| Rust open FIXP unit | 334 tests in 1 program |
| Rust open FIXP integration | 509 tests in 20 programs |
| Rust release timestamps regressions | 5 tests |

All four managed native-library guards passed. No executed managed test was skipped;
no executed Rust test was ignored. This covers the selected FIXP/core checks and
native loading, not the entire repository suite. The stage ledger records the exact
commands, source hashes and outcomes. The export scan passed all 20 changed engine
files, and git diff --check passed.

The additional optional O3 finalization unit-library run was stopped during
compilation after more than 25 minutes in one LLVM optimization task; those release
finalization tests did not execute. The full Rust development/open FIXP suites ran
all 144 automatic finalization rows and 48 explicit-send controls, and the separate
O3 timestamp integration passed. Independent review found no new unsafe code,
debug-only branch or overflow-sensitive behavior requiring this additional profile.
The cancellation log and original stage ledger are retained, including the compiler's
nonzero exit; it is not counted as a passing stage.

Final integration rebased normally onto current main. The complete engine and tools
trees, and tracked root build/config inputs, are byte-identical to the qualified
source. Upstream changes are outside those inputs; the archive records their paths
and the exact tree comparison. The post-rebase diff and export scan also passed.


Raw logs, reports, commands, source bundles, review notes and checksums are archived outside
Git at `~/archive/libhft/reviews/2026-10-16-codex-review-recovery-1016`.