Module proto 

Full-protocol snapshot journal records (spec §Saved State).

Persists the opaque snapshot payload produced by Session::encode_snapshot — the journal knows nothing about its contents. Deliberately separate from the BLE bond/PIN journal (ble): the two have different lifecycles (CMD_CLEAR erases this journal but never touches bonds or the pairing PIN) and different record sizes. The record machinery — two-page rotation, CRC over the body, a trailing commit word written last, newest generation wins — is the shared record engine.

The same record format also carries the device identity and the device node’s frame-counter map (counter), each in a journal of its own; which pages each journal owns is the firmware’s memory-map decision.

Structs

Stored

One journal record with its monotonically increasing generation; the newest valid record is authoritative.

Enums

Record

What a journal record asserts about the saved protocol state.

RecordRef

Borrowed form of Record for the write path: persist callers pass their payload by reference so the record machinery never buffers a second copy (the write path’s task futures hold these across awaits, so every avoided MAX_PAYLOAD copy is RAM off a task pool).

Constants

COMMIT_OFFSET

IDENTITY_PAYLOAD_LEN

A device-identity record payload: the Ed25519 private key followed by its public key (stored so boot does not repeat the derivation).

MAX_PAYLOAD

Largest payload a record can carry.

SLOT_SIZE

Two records per page; the snapshot payload is bounded by umsh_ulcp_device::SNAPSHOT_MAX (1792) with headroom.

Functions

consider_older_record

Consider one journal slot while looking for the newest committed record strictly older than newer_than.

consider_record

Consider one journal slot while mounting.

decode_identity

Split a persisted identity payload into (secret, public); anything but the exact expected length is treated as no identity.

encode_identity

encode_record

Encode one record body into a slot image. The payload must fit MAX_PAYLOAD; the commit word stays erased (0xFF) — write_committed_record writes zeros there only after the body lands.

write_record

Write one committed record. Failure leaves any previously committed record untouched: the body lands first and the commit word last, so a mount never selects a partial write.