# Store persistence and boundary review — 2026-10-17

Owner: Codex `01a0fcb1-4c4d-7380-bb51-0d6ed4a2b4d6`, session
`codex-review-store-1017`. Continuation of the full engine correctness and latency
review. Parallel source reviews cover C++, Java, Rust and .NET stores; all builds
and tests are serial under the shared host CPU lease, with at most 16 jobs.

## Confirmed findings and fixes

- **.NET async file store:** `Sync` can append repaired dirty records after an
  already-queued checkpoint, or persist a newer frame after an unchanged checkpoint
  request was deduplicated. Without reasserting the checkpoint, reopening advances
  past the explicitly lowered outbound sequence. Bare appends also leave the
  default close checkpoint stale. The fix advances the fallback frontier after accepted
  appends (a later explicit checkpoint may lower it), tracks records written after
  the last checkpoint, and ends Sync with the authoritative checkpoint when needed.
  An unchanged second Sync must not grow the file. Queueing, allocation and file
  I/O policy on the append path remain unchanged.
- **Rust multi-peer FIXP runner:** converting a configured `PathBuf` to UTF-8
  rejects valid native filenames at negotiation. The fix adds the ASCII session suffix to
  the native path, preserving the existing public string helper and suffix bytes.
- **Rust classic memory store:** unchecked capacity multiplication wraps in release
  builds and constructs an undersized payload buffer. The fix checks multiplication before
  allocating metadata, as the FIXP memory store already does.
- **Java private classic mapped store:** recovery adds header/footer sizes in signed
  int arithmetic near the supported `Integer.MAX_VALUE` mapping limit. Complete
  and torn tails can wrap their offsets and throw. The fix compares remaining capacity
  before calculating offsets.

## Reproduction and qualification

Baseline tests are committed separately from production changes. The baseline
source is `50a78cd17` (production unchanged from the claim at `e2a1957ba`).
Tests cover .NET Sync and clean-close boundaries, dropped/queued/already-flushed
records, lower/ordinary/terminal checkpoints, implicit fresh/recovered frontiers,
refused appends and unchanged second Sync; Rust native basename/parent and Unicode
controls with real TCP multi-peer establishment, send and replay-store restart,
both SOFH formats and two session IDs; Rust overflow and zero/ordinary capacity;
Java complete/torn max-sized maps, legacy/current recovery, and small-map controls.

The unchanged baseline reproduced 13 failing cases: .NET 8 failures / 49 passes,
Rust path integration 2 failures / 14 passes, Rust release capacity 1 failure /
3 passes, and Java 2 boundary errors / 2 passes. Neither managed baseline skipped
any case; both native-load guards passed. Baseline `50a78cd17` is preserved in the
archive bundle, before rebasing the test commits onto current main.

The pre-publication production commits are `c69d909de` (.NET), `d5a1253f8` (Rust),
and `26fa8901d` (Java), preserved by `qualified.bundle`. Qualification ran from
`26fa8901d`; that source also includes
independently owned .NET timestamp / Rust connect-deadline fixes and Java Chronicle
compatibility changes, without changes to this review's production files.

All **10 qualification stages passed** (1,890 test executions):

| Surface | Passed | Failed / skipped or ignored |
|---|---:|---:|
| .NET development store selection | 502 | 0 / 0 |
| .NET open store selection | 373 | 0 / 0 |
| Java development store selection, 28 suites | 326 | 0 / 0 |
| Rust development store unit selection | 330 | 0 / 0 |
| Rust development integration, 9 programs | 61 | 0 / 0 |
| Rust release capacity and path integration, 2 programs | 20 | 0 / 0 |
| Rust open store unit selection | 227 | 0 / 0 |
| Rust open integration, 9 programs | 51 | 0 / 0 |

The native .NET prerequisites passed for both editions. Both .NET native guards
and the Java native guard passed. Java's three new methods cover 18 boundary/control
opens, including the corrected recovered append cursor. Rust's existing lowercase
UUID string-helper regression passed, alongside native-path and real TCP controls.
The unchanged second-Sync size assertion passed on every selected .NET Sync case.
Release integration specifically reproduced and then verified the arithmetic-overflow fix.

Export scan: all nine changed engine files, zero findings. The final rebase changed
only files outside `engine/`, `tools/` and tracked root files; all qualified inputs
are byte-identical, as recorded in `publication-source-proof.json`.

## Review limits

No new C++ store defect was confirmed. C++, Java and Rust synchronous journals
already put their final checkpoint after repaired records. No latency measurement
was run. The Rust suffix builder removes repeated temporary formatting allocations
on negotiation, but this is not a measured latency claim. Speculative store scan,
lookup and recovery optimizations were not applied.

## Evidence

Raw logs, stage manifests, test reports, source bundles and patches are retained
outside Git at `~/archive/libhft/reviews/2026-10-17-codex-review-store-1017`.
No benchmark result is produced by this review.