Module proto 

Full-protocol snapshot journal records (spec §Saved State).

Persists the opaque snapshot payload produced by Session::encode_snapshot — the journal knows nothing about its contents. Deliberately separate from the BLE bond/PIN journal (ble): the two have different lifecycles (CMD_CLEAR erases this journal but never touches bonds or the pairing PIN) and different record sizes. The record machinery — two-page rotation, CRC over the body, a trailing commit word written last, newest generation wins — is the shared record engine.

The same record format also carries the device identity and the device node’s frame-counter map (counter), each in a journal of its own; which pages each journal owns is the firmware’s memory-map decision.

Structs

Stored

One journal record with its monotonically increasing generation; the newest valid record is authoritative.

Enums

Record

What a journal record asserts about the saved protocol state.

RecordRef

Borrowed form of Record for the write path: persist callers pass their payload by reference so the record machinery never buffers a second copy (the write path’s task futures hold these across awaits, so every avoided MAX_PAYLOAD copy is RAM off a task pool).

Constants

COMMIT_OFFSET

IDENTITY_PAYLOAD_LEN

A device-identity record payload: the Ed25519 private key followed by its public key (stored so boot does not repeat the derivation).

MAX_PAYLOAD

Largest payload a record can carry.

SLOT_SIZE

Two records per page; the snapshot payload is bounded by umsh_ulcp_device::SNAPSHOT_MAX (1792) with headroom.

Functions

consider_older_slot

Consider one journal slot while looking for the newest committed record strictly older than newer_than.

consider_slot

Consider one journal slot while mounting: keep the newest committed slot’s address and generation. The payload stays in flash; the caller decodes the winner once the scan settles.

decode_identity

Split a persisted identity payload into (secret, public); anything but the exact expected length is treated as no identity.

encode_identity

encode_record

Encode one record body into a slot image. The payload must fit MAX_PAYLOAD; the commit word stays erased (0xFF) — write_committed_record writes zeros there only after the body lands.

payload_bytes

Borrow a validated slot’s committed payload in place: its generation, and the payload bytes when the record is a snapshot rather than a tombstone.

probe_record

Validate one slot image — magic, commit word, CRC, kind, length — and return its generation, without touching the payload.

write_record

Write one committed record. Failure leaves any previously committed record untouched: the body lands first and the commit word last, so a mount never selects a partial write.