Module monitor 

RFC-0052 / phase-296 W3b.4/.5 — on-target contract monitors.

The baked shape mirrors Phase 211.H’s qos_overrides: codegen emits a &'static [MonitorSpec] table (plus one static PubMonitorCell per contracted publisher) from the SystemModel’s contract layer; the entry installs it on the executor before entity creation. An uncontracted image bakes an empty table — every path below dead-code-eliminates.

Publish counting is an atomic bump on the publisher handle (no clock, no lock on the hot path); the rate check runs on spin ticks over a ~RATE_CHECK_INTERVAL_US window and pushes violations into a small ring the entry glue drains into the nros-diagnostics reporter.

W3b.5 adds three more rules on the same drain:

• max-age-runtime — subscriber take-age (epoch_now - header.stamp peeked from the raw CDR buffer at [RosMessage::STAMP_OFFSET], recorded into a SubMonitorCell on the take path).
• max-latency-runtime — node-path (take → publish) latency: the dispatch elapsed time is attributed to every monitored publisher whose counter advanced during that dispatch (an upper bound on take → publish, measured on the executor’s monotonic clock).
• deadline-miss-runtime — a dispatched callback ran past its bound SchedContext’s deadline_us; what ELSE happens is the tier’s DeadlineAction.

Structs

AgeMonitorSpec

One monitored subscriber endpoint (W3b.5 age contracts). Separate table from MonitorSpec — sub contracts key different endpoints and need no publish counter.

MonitorSpec

One monitored publisher endpoint.

PubMonitorCell

One contracted publisher’s counters. Baked as a static by codegen (or declared by the fixture); the publisher handle bumps count on every publish, the executor reads deltas on spin ticks.

SubMonitorCell

One contracted subscriber’s take-age accumulator (W3b.5). The take path records epoch_now - header.stamp per message (fetch_max); the age check drains it (swap 0) per window.

Violation

A detected contract violation, in the play_launch rule-id vocabulary.

Constants

MAX_MONITORS

Max monitored endpoints per executor (const table, no_std).

MAX_VIOLATIONS

Violation ring depth.

RATE_CHECK_INTERVAL_US

Rate-check window (µs). Matches play_launch’s ~5 s time-based trigger so both runtimes converge on comparable cadence.

Functions

peek_stamp_us

Peek Time { i32 sec; u32 nanosec } little-endian at offset in a raw CDR receive buffer (encapsulation header included) and return µs since the UNIX epoch. None when the buffer is too short or the stamp is pre-epoch/zero (unstamped messages never fire age monitors).