Module monitor

Structs§

AgeMonitorSpec: One monitored subscriber endpoint (W3b.5 age contracts). Separate table from MonitorSpec — sub contracts key different endpoints and need no publish counter.
GuardSpec: One fault a hazard covers: a topic, or a redundant set of topics.
HazardCell: One hazard’s observer state. Baked as a static beside the spec, the way PubMonitorCell is, so the observer adds a slice to the Executor value and nothing per hazard (issue 0961).
HazardSpec: One contracted hazard (contracts.hazards), lowered by the bake.
MonitorArming: phase-474 I2 – when an executor’s contract monitors start judging.
MonitorSpec: One monitored publisher endpoint.
MonitorTableFull: A monitor table longer than the executor can watch – phase-496 W1.
PubMonitorCell: One contracted publisher’s counters. Baked as a static by codegen (or declared by the fixture); the publisher handle bumps count on every publish, the executor reads deltas on spin ticks.
ReactionEvent: phase-503 – what the reaction hook receives when a supervised route passes its deadline. repr(C): the C ABI hands the same struct through.
SubMonitorCell: One contracted subscriber’s take-age accumulator (W3b.5). The take path records epoch_now - header.stamp per message (fetch_max); the age check drains it (swap 0) per window.
Violation: A detected contract violation, in the play_launch rule-id vocabulary.

GuardRef: One guard member: which monitor row’s verdict says this topic has faulted.

MAX_AGE_MONITORS: Max AGE-monitored subscriptions per executor – the second table, on its own knob (NROS_EXECUTOR_MAX_AGE_MONITORS, derived from age_rows) so an image with rate contracts and no age contracts pays for one table only.
MAX_MONITORS: Max RATE/LATENCY-monitored endpoints per executor (inline table, no_std).
MAX_VIOLATIONS: Violation ring depth, per executor, and the slot count of the image-wide SWD record (ViolationRecord).
MECHANISM_EXECUTOR: phase-503 – MonitorSpec::mechanism: checked in the executor’s spin loop. Catches a slow route, not a callback that never returns.
MECHANISM_TIMER: phase-503 – MonitorSpec::mechanism: an independent timer outside the executor (the port’s), which also catches a stuck callback.
NO_SINK: HazardSpec::sink when the hazard’s reaction states no safe_state publisher this image monitors: the observer reports detection and recovery, and no reaction.
REACTION_NONE: phase-503 – MonitorSpec::reaction_id: no reaction named.
RULE_IDS: phase-474 I1 – every rule id the executor reports, in WIRE ORDER: a rule’s numeric code is its index here plus one, and 0 means “not a rule this table knows”.

check_table_capacity: Whether a table of n_rows rate/latency rows and n_ages age rows fits this build’s executor. The rate table is judged first.
fqn_hash: 32-bit FNV-1a of an endpoint ref – the identity a trace marker and the SWD record carry for Violation::fqn (a string neither can hold).
request_monitor_arming: phase-474 I2 – the application says its start-up is over: arm the contract monitors of every executor in the image that waits for this (NROS_MONITOR_ARM_ON_CALL, or Executor::set_monitor_arming).
route_next_due_us: phase-503 – time from now to the earliest deadline of a pending supervised route, in microseconds (0 when one is already due), or None when no supervised route is waiting. This is the executor’s wake source for the rule, and what a port’s independent timer (MECHANISM_TIMER) arms on.
rule_code: The wire code of rule (RULE_IDS index + 1), or 0 for a rule the table does not know.
rule_name: The rule a wire code names, or None for 0 / an unknown code.

ReactionHookFn: phase-503 – the reaction hook: called on the spin thread, inside spin_once, once per missed route deadline. It must not block; it starts the fallback (or hands it to another thread) and returns. ctx is what was registered with the hook.