# Queue counters and signed latency snapshots, 2026-10-19

Session `codex-review-values-1019`, thread `01a0fcb1-4c4d-7380-bb51-0d6ed4a2b4d6`,
on BEELINK2. Three parallel source reviewers examined C++, Java, .NET and Rust
queue paths. Builds and tests used shared host leases with sequential stages,
explicit out-of-tree roots and at most 16 workers.

## Findings and changes

Java's `LatencyStamps` treated every nonpositive stamp as absent. Pure Java
captures `System.nanoTime()` unchanged, whose arbitrary origin may legally
produce negative readings. A completed negative bracket therefore reported zero
elapsed time. Presence checks now reserve only zero for the established missing
endpoint sentinel. The .NET public snapshot struct had the same arithmetic defect
for its accepted signed constructor inputs and receives the same correction. No
negative default .NET platform-clock session was established. Snapshot fields,
generation, subtraction semantics and ABI remain unchanged. The existing Pure Java
round-trip test also accepts nonzero signed stamps rather than requiring positive
raw values; its ordering and duration assertions remain in place.

The Java clock-origin contract is documented by
[Oracle Java 21](https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/System.html#nanoTime()).

C++ heap and shared-memory SPSC rings used atomic read-modify-write increments
for producer-owned drop counters. Both Push and NoteDrop already require one
producer. Relaxed atomic load/store increments preserve atomic observations
without requesting an unnecessary locked RMW. Payload publication and consumption
orders, queue layouts and the distinction between counted and uncounted failures
remain unchanged. FileLog and its acceptor/thread-pool callers respect one writer
per ring. The unrelated JNI command/event ring implementation is unchanged.

## Qualification

The test-only baseline `e9c69cd749e066cd29145a362129475fc5cd3e11`
reproduced exactly six Java and seven .NET signed-duration assertion failures.
Native-loading guards passed and neither run skipped a test. The fixes at
`745574a53c9f66cb4ad7f133659f874bd1f9de10` pass all 27 selected Java cases
and all 19 selected .NET cases, including native guards and existing latency
instrumentation/seqlock coverage. All baseline regression identities are preserved.
Both C++ ring suites passed before and after, including every new observer case,
with no skipped page-lock or interprocess fixtures. Independent reviewers inspected
the actual XML/TRX reports, C++ execution logs and assembly.

The Java table covers negative readings, zero crossings, equal readings,
receive-only/send-only samples and zero endpoint controls. .NET adds signed
endpoint extremes and verifies public values and generation unchanged. Two new
C++ concurrent observer tests each verify exactly 200,000 drops from counted
Push and NoteDrop, no extra counts from PushUncounted, ordered observations and
unchanged retained records. The existing suites also exercise FIFO handoff,
page-lock lifetime, two-process publication and producer-crash behavior.

GCC 15.2 `-O3 -std=c++11 -S` emitted one locked increment in each of
four noinline wrappers (heap/shared ring Push and NoteDrop) before the patch,
and none afterward. The assembly differs only in those four substitutions from
locked add to ordinary atomic load/add/store instructions; the rest is identical.

The focused qualification covers the open managed/native editions and the two
open C++ ring suites. Broader .NET publication checks are recorded below.

The publication pass at `3d8c3cea8101c4ce4d4f13e2cc47f2195e85db2d`
rebuilds and reruns both C++ suites and all 27 Java cases, including the corrected
Pure Java round-trip assertions, with no failures or skips. Both explicit .NET
native editions build successfully. The full default .NET suite passes 6,149 of
6,152 cases, with three explicit skips: no configured bypass NIC; Linux supports
SO_REUSEPORT, so its unsupported-platform refusal case does not apply; and the
native pool-broadcast case requires LIBHFT_ACCEPTOR_THREADS greater than one.
The native guard and all signed-latency cases pass.

The first full .NET run used a temporary-directory prefix long enough to exceed
the Unix-domain socket pathname limit in five endpoint fixtures. After shortening
the session-owned temporary root, the entire suite was rerun with exactly the
same 6,152 test identities; all five failures pass and the three skips are unchanged.
Both reports are retained. The isolated open build compiles 149 sources without
the 69 private sources and its six boundary probes pass.

The complete open .NET test gate is **not green**: its full run and isolated
retry fail `FixpNativeDurableInitiatorRuntimeTests.The_mmap_store_is_there_with_libhft_pro_and_refused_by_name_without`
(expected `Unsupported`, actual `InvalidArg` at line 329). Commit `83e411b7d`
moved the capability check after runtime validation. The open mmap validation
returns a refusal first, so the direct C ABI exits `InvalidArg` before reaching
its `Unsupported` branch. The managed constructor still refuses by name.
The relevant native source, managed wrapper and test are byte-identical at the
publication base and the tested commit. The active native-seam freeze owns the
repair. An unapplied candidate is retained as
`unqualified-owner-native-refusal.patch`; only patch applicability was checked.

Seven of the nine selected publication guard stages pass: binding coverage,
hftnet ABI reference and export table, publisher self-tests, open .NET projects,
parity checker self-tests and cross-binding inventory. None are skipped.
The initial guard pass has two pre-existing relocation failures: `doc-build-facts` finds two unique
`../README.md` links in the .NET guide and internals guide after the devel README
move; `telemetry-snapshot-contract` still reads the removed
`engine/cpp/include/libhft/fix/SessionMetrics.h` path. At the qualified commit, both helper sources are unchanged by the batch.
The public guide links remain valid in exports because the .NET manifest supplies
`publish/templates/dotnet/README.md` as the package-root README. The checker needs
to recognize that declared template; it must not redirect public documentation to
the relocated private devel README.

The free checker paths are corrected in this batch: product links may resolve
through an exact template destination declared by the originating product's
manifest, provided its source is an existing file below the explicit template
root. Missing sources, directories, undeclared destinations and another
product's templates still fail. The helper takes no implicit checkout fallback;
the CLI declares its default manifests and template root. Seven new regression
cases join the existing tests; all 22 pass. After rebasing onto `9479af18f`,
source commit `a5dbe03113c51ca1c44b83720ad926b2da20009f` passes the 22 tests
again and all 206 build facts plus links in 21 product documents. The telemetry
checker still fails on its original removed C++ path in this final source check.
The complete nine-stage report is retained as its original failed run; these
focused reruns do not relabel it as green.

The original selected conformance report is FAIL. The telemetry relocation repair
remains claimed by the Java owner, and the full open .NET suite remains blocked by
the separate native capability-refusal regression. Neither is presented as passing.
No timed latency benchmark or end-to-end latency percentage is claimed.

## Review boundaries

Adjacent Java/.NET TxQueue, .NET CommandRing and C++ buffer/ring caller review
found no other supported-input defect. The apparent CommandRing capacity-one
alias is unreachable through validated settings (minimum two).
Rust pending TX/batching, TLS retries, FIXP partial sends, FrameStream, mapped
SPSC and audit/transcript queue review found no confirmed new defect; no Rust
production changes or runtime qualification are part of this batch.

Publication source equivalence and exact commits are retained with raw logs,
XML/TRX reports, reviewed patches, assembly and commit bundles under
`~/archive/libhft/reviews/2026-10-19-codex-review-values-1019`.

## Publication equivalence

The final source pass at `a5dbe03113c51ca1c44b83720ad926b2da20009f` verifies
that the C++ ring/runtime headers and selected tests, Java runtime and selected
latency tests, .NET runtime/native/private roots and selected regressions, and
their build inputs are unchanged from the qualified publication source
`3d8c3cea8101c4ce4d4f13e2cc47f2195e85db2d`. The exact checked paths are in
`final-source-equivalence.json` in the archive. Incoming main independently
adds acceptor parity coverage and moves QuickFIX/n benchmark tests out of the
.NET suite, so the 6,152-case full-suite count above belongs to that qualified
source and is not a claim of a fresh full-suite run at the final rebased head.
The standard pre-push split gate and outgoing author/DCO check are required
at publication; their actual results are retained in the archive.