# TCP and TLS failure review — 2026-10-17

## Scope and fixes

Continuation of the deep review with parallel source review and independent cross-review.
Session: `codex-review-io-1017`. Builds and tests ran serially under one host CPU lease,
with parallelism capped at 16.

- C++ TLS clients now send SNI using the explicit verification host, or the retained venue
  host when no override is set. This also works when verification is disabled and when TCP
  connects through a proxy. IP literals omit SNI; DNS names omit one trailing root dot.
  Certificate verification keeps the original name. Oversized or unterminated retained
  names are refused, and reconnect refusal releases the preceding connection's resources.
- Rust FIXP TCP sends retain the positive byte count after a partial write followed by an
  error or idle timeout. Existing session logic can then retire the torn frame instead of
  keeping an established session with zero reported progress. Interrupted reads and sends
  before progress yield a bounded turn. After progress, interrupted retries obey the idle
  deadline; progress resets it. The initial successful send path does not read the clock.
- .NET FIXP TCP acceptors preserve the result and transport ownership of operations made
  inside an application callback. A nested store failure or rejected reconfiguration can
  no longer be overwritten by the old pump's neutral success result. Both leading and
  trailing multi-acceptor pump paths honor listener replacement.
- Java TLS handshake budgets use elapsed monotonic time instead of a saturated absolute
  deadline. Negative clock origins, crossing zero, and crossing the signed boundary retain
  the requested budget. No clock-provider object or persistent allocation is added.

Java's arithmetic follows the elapsed-time contract in
[System.nanoTime](https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/System.html#nanoTime()).
Qualified snapshot: `ce5e1bf66794f401a2f02826e50e0f0775191aa2`. Publication hashes are in the archived proof.
No measured latency improvement is claimed.

## Baseline reproduction

All new regression sources were committed before the baseline at `698a2538cfcf75b79c0f462caf42fccf9cf294c4`.
Java's baseline includes a neutral helper extraction retaining the old arithmetic.
The production patches were applied only after all four baseline selections reproduced:

| Selection | Baseline result |
| --- | --- |
| Rust TCP failure regressions | 9 failed; 3 controls passed; zero ignored |
| .NET callback lifecycle and native guard | 20 failed; 81 passed; zero skipped |
| Java clock boundaries and native guard | 6 failed; 7 passed; zero errors or skips |
| C++ named TLS peers | 130 failed checks |
| C++ numeric peer controls | 265 checks passed |
| C++ reuse and name-length refusal | 32 and 12 failed checks |

The C++ baseline ran under AddressSanitizer and UndefinedBehaviorSanitizer.
The new fixture includes the Windows OpenSSL applink header and is registered in
`tools/build-msvc`'s OpenSSL dependency list; shell syntax validation passed.

## Fixed qualification

All 16 fixed qualification stages passed on a clean source snapshot:

| Selection | Development edition | Open edition |
| --- | ---: | ---: |
| C++ TLS/proxy/reconnect suite | 6 programs passed | 6 programs passed |
| C++ SNI regression, ASan + UBSan | 682 checks passed | 682 checks passed |
| Rust TCP and terminal-input integration tests | 23 passed | 23 passed |
| Rust FIXP library tests | 385 passed | 334 passed |
| .NET FIXP/TLS tests and native guard | 2166 passed | 2068 passed |
| Java TLS/SSL tests and native guard | 96 passed | 96 passed |

Zero failures, errors, skips or ignored cases in these selections; all four Java/.NET
required-native guards passed. No explicit C++ skip diagnostics appeared. The .NET matrix
includes 100 callback lifecycle cases per edition; Java includes twelve clock cases.

C++ programs: `test_fix_ssl_server_name`, `test_fix_ssl_verify`, `test_fix_ssl_stress`,
`test_fix_ssl_ownership`, `test_fix_reconnect_realsocket`, `test_fix_http_proxy_connect`.
Rust integrations: `fixp_tcp_transport_failures`, `fixp_tcp_timeout_bounds`,
`fixp_runner_terminal_input`; library selection: `fixp::`.

The SNI tests use real loopback TLS 1.2/1.3, server-name callbacks, certificate checks,
reconnects and connection failure cleanup. Rust combines descriptor/thread-scoped syscall
fault injection with real non-draining peers and exact wire-prefix checks. Its injected
tests are Linux x86-64 specific. No Windows runtime or NIC/hardware qualification is claimed.
This is targeted transport qualification, not an all-repository suite.

The first open .NET attempt did not set `LIBHFTNET_LIBRARY` to the canonical
`target/native-open/libhftnet.so` output. Its required-native guard failed, with 253
failures and 77 skips in the full selection. That report is retained separately as
`dotnet-open-missing-library-reports`. Following `tools/check-dotnet-open-edition`,
the rerun supplied that library path and `LIBHFT_TEST_EDITION=public`; it passed as
shown above. No source change or library relocation was needed. The initial invalid
attempt is retained in `stages.jsonl` and `qualification-setup-correction.json`.

## Publication and evidence

The final rebase comparison preserves all qualified source and build inputs; details are
in `final-source-proof.json`. The changed-engine export scan and `git diff --check` passed.
Raw logs, XML/TRX reports, commands, source bundles, review notes and checksums stay outside
Git at `~/archive/libhft/reviews/2026-10-17-codex-review-io-1017/`.
Key files: `baseline-summary.json`, `qualification-summary.json`, `stages.jsonl`,
`patches-approved.json`, `final-source-proof.json`, and `publication-proof.json`.

The earlier Java TLS shutdown lock-chain and direct-core callback lifecycle observations
remain unverified follow-ups in the preceding review archives; this batch does not claim
to resolve them.