Module proto_store 

Protocol snapshot / identity / counter journals: shared machinery from umsh-journal-store, plus this firmware’s flash placement.

The record codec and its power-cut tests live in the crate; only the journal page chain — a memory.x fact — is decided here.

Structs

Stored

One journal record with its monotonically increasing generation; the newest valid record is authoritative.

Enums

Record

What a journal record asserts about the saved protocol state.

RecordRef

Borrowed form of Record for the write path: persist callers pass their payload by reference so the record machinery never buffers a second copy (the write path’s task futures hold these across awaits, so every avoided MAX_PAYLOAD copy is RAM off a task pool).

Constants

COMMIT_OFFSET

COUNTER_PAGE0

Device-node frame-counter journal (device-node plan increment 4): the persisted TX reservation boundary for the device identity and RX replay boundaries for its peers, batch-written as one counter_map payload per flush. Separate journal because its write cadence (every COUNTER_PERSIST_BLOCK_SIZE secured frames) must never rotate a snapshot or the identity record away.

IDENTITY_PAGE0

Flash pages owned by the device-identity journal: the next two pages. The identity is persisted the moment it is installed or generated, independently of snapshots (spec §PROP_DEV_PRIVATE_KEY), so it gets a journal of its own: snapshot saves can never rotate the identity record away, and each journal clears atomically with one committed tombstone.

IDENTITY_PAYLOAD_LEN

A device-identity record payload: the Ed25519 private key followed by its public key (stored so boot does not repeat the derivation).

MAX_PAYLOAD

Largest payload a record can carry.

PAGE0

Flash pages owned by the snapshot journal: the two 4 KB pages immediately after the BLE store’s, inside the NV storage region (0x000E_4000..0x000F_4000; see memory.x).

PAGE1

PAGE_SIZE

Flash page size shared by every backend the journals run on (nRF52840 NVMC and ESP32-S3 SPI flash are both 4 KiB-erase parts).

SLOT_SIZE

Two records per page; the snapshot payload is bounded by umsh_ulcp_device::SNAPSHOT_MAX (1792) with headroom.

UX_PAGE0

T-1000E user-facing Sleep/Silence preference journal. The shared T-Echo image does not use it, but reserving it here keeps the flash map explicit.

Functions

consider_older_record

Consider one journal slot while looking for the newest committed record strictly older than newer_than.

consider_record

Consider one journal slot while mounting.

decode_identity

Split a persisted identity payload into (secret, public); anything but the exact expected length is treated as no identity.

encode_identity

encode_record

Encode one record body into a slot image. The payload must fit MAX_PAYLOAD; the commit word stays erased (0xFF) — write_committed_record writes zeros there only after the body lands.

write_record

Write one committed record. Failure leaves any previously committed record untouched: the body lands first and the commit word last, so a mount never selects a partial write.