# Transport buffer and resource review — 2026-10-17

## Scope and changes

Continuation of the transport review in C++, Java and Rust, with parallel source review
and independent cross-review. Builds and tests ran serially under one host CPU lease,
with parallelism capped at 16. Session: `codex-review-transport-1017`.

- Java TLS reads now accept a destination smaller than a TLS record, including the free
  suffix of a partially filled FIX parse buffer. Overflow plaintext uses the existing
  handshake scratch buffer, retains its unread tail, and is drained before another socket
  read. Readiness includes that tail. Normal reads still unwrap directly into the caller's
  buffer, and plaintext emitted during handshake work is preserved.
- C++ transcript append/send checks use remaining capacity, avoiding signed addition
  overflow for large lengths. Positive-length null inputs are rejected before changing
  bytes, counters or records. Zero-length behavior is preserved.
- Rust TCPDirect stack construction owns attributes immediately after successful allocation
  and frees them on later failure. Scoped owners free the stack before its attributes.
  The intentional process-lifetime shared stack remains retained. Free-function signatures
  were checked against the TCPDirect SDK.
- C++ HTTP CONNECT retries interrupted waits and receives, distinguishes transient
  would-block from EOF, and retains its original absolute deadline. Wait budgets are
  sampled immediately before waiting, safely rounded and clamped at `INT_MAX`. Hard wait
  failures retain send/receive-specific errors. Retry turns no longer exhaust a response
  iteration limit; response bytes and the absolute deadline bound the exchange. Tunnel
  payload bytes remain unread after the HTTP header.

Qualified fix snapshot: `dfe2dbf378edc8a6fb0deb6affb9d5342d325989`.
Final publication hashes are retained in the archived source and publication proofs.
No measured latency improvement is claimed. The Java fix reuses an existing buffer;
it adds no persistent buffer or allocation to an idle poll.

## Baseline reproduction

The production fixes were applied only after the new regressions reproduced at
`e5ad4e704398be7374a961f995052bfe0e288c36`:

| Selection | Baseline result |
| --- | --- |
| C++ transcript bounds, ASan + UBSan | Four expected overflow/null-input failures; boundary controls passed |
| C++ HTTP CONNECT, ASan + UBSan | Seven expected assertion-selector failures and one signed timeout-overflow failure |
| Rust TCPDirect ownership | Five failed resource-release checks; two controls passed; zero ignored |
| Java TLS read buffers | Eight buffer-overflow errors; four controls passed; zero skipped |
| Java required native-library guard | Passed |

The HTTP CONNECT baseline fixture was compiled from the hash-locked scratch source rather
than the baseline commit; that same source was copied into the fixed commit. Its SHA-256 is
`49f014ee794ebfd5c6f78f3e9da72cd3c379f5317edc961b3a53121f440e325b`.
The Rust baseline includes a neutral injected-API constructor seam and the free-function
symbols, but no resource-release behavior.

Java's original twelve cases cover TLS 1.2/1.3 and blocking/nonblocking sockets. Fixed
qualification expands them to twenty cases, adding a 70,001-byte multi-record stream
and a scripted provider that emits plaintext across handshake task turns. The tests check
destination offsets/limits and guard bytes, byte ordering, retained-input readiness, and
EOF. Peer close-notify is withheld until the payload has been drained.

## Fixed qualification

All fifteen qualification stages passed at
`dfe2dbf378edc8a6fb0deb6affb9d5342d325989`:

| Selection | Development edition | Open edition |
| --- | ---: | ---: |
| Java TLS/SSL tests and required native guard | 84 passed | 84 passed |
| C++ normal transport suite | 9 programs passed | 9 programs passed |
| C++ transcript ASan + UBSan | 69 checks passed | 69 checks passed |
| C++ HTTP CONNECT ASan + UBSan | 16,896 checks passed | 16,896 checks passed |
| Rust TCPDirect resource and session tests | 9 passed | Private driver excluded |
| Rust open library compile | — | Passed |

Java: zero failures, errors or skips in either edition; both native guards passed.
Rust: zero failures or ignored tests in the selected development tests. No explicit skip
diagnostics appeared in the nine C++ programs. This is targeted transport qualification,
not an all-repository test run.

The C++ programs were `test_transcript_transport_bounds`,
`test_fix_http_proxy_interruption`, `test_fix_http_proxy`, `test_fix_http_proxy_connect`,
`test_fix_proxy_initiator`, `test_fix_architecture`, `test_fix_tx_queue_transport`,
`test_fix_session_reliability`, and `test_fix_hotpath_alloc`.
Rust selections were `cargo test --lib zf::` (seven tests) and
`cargo test --lib tcpdirect` (two tests); open used `cargo check --lib`.
Java selected `*Tls*Test,*Ssl*Test,NativeLibraryRequiredTest`.

The existing C++ hot-path test reported zero global-new allocations in both editions.
Java's warmed idle checks reported zero allocated bytes over 10,000 polls in all four
configurations of each edition. These allocation checks are not a latency benchmark.

The TCPDirect tests inject SDK callbacks; no NIC/hardware qualification is claimed.
The HTTP interruption tests inject syscall outcomes and clock samples, complemented by
the existing real loopback proxy tests. No Windows runtime qualification was performed.

## Rebase and evidence

The publication rebases changed unrelated .NET FileLog, its tests and private runner,
export-tool self-tests, conformance-runner documentation, a prepared-campaign Python test,
and review/claim documentation. C++, Java and Rust source trees and their
build inputs are byte-identical to the qualified snapshot; their tree IDs are recorded in
`final-source-proof.json`. The changed-engine export scan passed: nine files, zero findings.
`git diff --check` passed.

Raw logs, XML reports, commands, source bundles, source comparisons, review notes and
checksums are retained outside Git at:

`~/archive/libhft/reviews/2026-10-17-codex-review-transport-1017/`

Key files: `baseline-summary.json`, `qualification-summary.json`, `stages.jsonl`,
`patches-approved.json`, `final-source-proof.json`, and `publication-proof.json`.
Source bundles preserve the original pre-rebase test and qualified snapshots. No raw
captures or build products are committed.

## Follow-up observations

The previously recorded Java TLS shutdown lock chain remains unverified and is not fixed
by this buffer change. Direct-core callback lifecycle observations are also unverified;
the owning classic session files remain under other agents' claims. Reproduction notes
are retained in `java-core-lifecycle-followup.md` here and `java-tls-finding.md` in the
preceding `2026-10-17-codex-review-replay-1017` archive.