# Stream input and partial-send review — 2026-10-17

## Scope and fixes

Continuation of the deep review with three parallel reviewers and independent cross-review.
Session: `codex-review-stream-1017`. Builds and tests ran serially under the host CPU lease,
with build parallelism capped at 16.

- Java and .NET FIXP TCP transports retain the positive byte count when a send fails after
  writing a prefix. The existing socket-session primitive can immediately retire the torn
  frame, report the real byte count and admit a replacement connection. Hard failures before
  progress remain negative; would-block before progress remains zero. Successful sends,
  retry timing and transport disposal retain their existing behavior.
- C++ and Rust raw Ethernet/IPv4/UDP parsers reject fragmented packets. The C++ helper is
  shared by ef_vi and ibverbs. Without reassembly, these paths previously delivered a
  truncated first fragment or interpreted later fragment data as a fresh UDP header.
  Unfragmented packets, DF-only packets, VLAN tags, IPv4 options and the existing declared
  UDP-length clamping behavior are preserved. The check follows the MF flag and 13-bit
  offset in [RFC 791 section 3.1](https://www.rfc-editor.org/rfc/rfc791.html#section-3.1).
- Rust's diagnostic transcript transport reclaims consumed input while a nonempty backlog
  remains. Previously, consumed history accumulated until the queue drained completely.
  Reads still advance only a cursor. Append compacts only when tail space is exhausted and
  either the consumed prefix or incoming chunk pays for moving the unread suffix. This
  avoids copying a large backlog on every one-byte read/append turn.

Qualified snapshot: `c0ded394f5cdd4e2387fc42dfd6550caf854845e`. Publication source comparison is archived separately.
No measured production latency improvement is claimed. The transcript improvement concerns
bounded storage and amortized copying in a diagnostic transport.

## Baseline reproduction

Regression sources were frozen at `a5c0957c056baa4d64c57fee7a75d882a32141ee` with production unchanged.
All five production patches were applied only after these expected failures reproduced:

| Selection | Baseline result |
| --- | --- |
| Java partial writes and native guard | 4 failed; 2 passed; zero errors/skips |
| .NET partial writes and native guard | 2 failed; 1 passed; zero skips |
| Rust transcript module | 3 failed; 6 passed; zero ignored |
| Rust ibverbs parser module | 5 failed; 6 passed; zero ignored |
| C++ fragment matrix | 40 failed checks; 36 controls passed |

The managed fixtures use real loopback sockets and both SOFH formats. They compare the
received bytes with the exact frame prefix, then check the reported count, session retirement,
unchanged sequence and immediate reconnect admission. Java also injects an IOException
after a real prefix write and checks the no-prefix failure control. Setup and drain loops
are bounded and sockets are scoped for cleanup.

The UDP matrix covers first, middle and final fragments, including the high fragment-offset
bit, with and without VLAN and IPv4 options. Rust transcript tests verify FIFO, EOF, retained
tail space, overlapping compaction, bounded steady-backlog capacity and compaction frequency
over 4,096 one-byte turns.

## Fixed qualification

| Selection | Development edition | Open edition |
| --- | ---: | ---: |
| Java FIXP tests and native guard | 3389 passed | 3257 passed |
| .NET FIXP tests and native guard | 2107 passed | 2010 passed |
| Complete Rust library unit suite | 1534 passed | 1364 passed |

All selections above had zero failures, errors, skipped or ignored cases. All four managed
required-native guards passed. Open .NET used the canonical native-open output through
`LIBHFTNET_LIBRARY`; no library was relocated.

The development C++ fragment regression passed all 76 checks normally and with AddressSanitizer
and UndefinedBehaviorSanitizer. The existing `test_fix_efvi` parser program also passed.
The new C++ fixture is registered in the normal pro correctness target and needs no SDK.
No live NIC, ef_vi/libibverbs hardware or Windows runtime qualification is claimed.
This is targeted transport qualification plus the Rust library unit suites, not a full
repository test run.


The qualification driver recorded exit 0 after all 13 fixed stages completed. Its terminal
wrapper later reported 143, after the 60-second idle lease-release message. The signal source
was not established. This occurred after reports and the clean-source assertion were written;
no test was interrupted. The lease transferred to the next job and no session build process
remained. `lease-release.json` preserves the wrapper status separately from test results.

## Publication and evidence

The final source comparison, changed-engine export scan and whitespace check are archived.
Raw logs, XML/TRX reports, commands, source bundles, review notes and checksums stay outside
Git at `~/archive/libhft/reviews/2026-10-17-codex-review-stream-1017/`.
Key files: `baseline-summary.json`, `qualification-summary.json`, `stages.jsonl`,
`patches-approved.json`, `final-source-proof.json`, and `publication-proof.json`.

The earlier Java TLS shutdown lock-chain and direct-core callback lifecycle observations
remain unverified follow-ups in previous archives. Large Rust replay batches remain a
scheduling question requiring a separate reproducer; this batch does not claim to resolve it.