nros_rmw_cffi/

generated.rs

//! AUTO-GENERATED by scripts/gen-abi-bindings.sh (bindgen 0.72.1) — DO NOT EDIT.
//!
//! Source of truth: `packages/core/nros-rmw-abi/include/nros/*.h` (RFC-0054).
//! Edit the headers, rerun the script, commit both.
#![allow(non_camel_case_types, non_snake_case, non_upper_case_globals)]
#![allow(unsafe_op_in_unsafe_fn, clippy::missing_safety_doc)]
/* automatically generated by rust-bindgen 0.72.1 */

#[doc = " Status code. Zero on success.\n\n  Phase 376 W3.d step B — the VALUES are upstream rmw's. `RMW_RET_OK` was\n  already 0 on both sides; everything else moved from a negative code to\n  upstream's positive one, so a status means the same number on both sides of\n  the seam: OK 0, ERROR 1, TIMEOUT 2, UNSUPPORTED 3, BAD_ALLOC 10,\n  INVALID_ARGUMENT 11, INCORRECT_RMW_IMPLEMENTATION 12,\n  NODE_NAME_NON_EXISTENT 203.\n\n  (Written as prose, not an indented block: bindgen copies this comment into\n  `generated.rs` verbatim, and rustdoc reads an indented block there as a Rust\n  DOCTEST — which then fails to compile. Caught by `cargo test`.)\n\n  This is why step A had to come first. Eleven slots used to return a COUNT\n  or a FLAG as a non-negative value and a status as a negative one; with\n  `ERROR` at 1, a return of `1` would have meant both \"one message\" and\n  \"failed\". Every one of those slots now reports through an out-parameter, so\n  the sign carries nothing and the numbers are free to move.\n\n  Codes upstream does not define live in the EXTENSION RANGE at 1000+, so a\n  future upstream addition can never collide with one of ours. That range is\n  the one place we knowingly add to upstream's namespace.\n\n  Signedness is kept (`int32_t`, not an unsigned type) to match upstream's\n  `rmw_ret_t` exactly. Nothing returns a negative value any more."]
pub type rmw_ret_t = i32;
#[doc = " Nanoseconds since a clock's epoch — upstream's `rmw_time_point_value_t`."]
pub type rmw_time_point_value_t = i64;
#[doc = " Visit one network flow endpoint. Return `false` to stop.\n\n  Upstream fills an ALLOCATING `rmw_network_flow_endpoint_array_t` through an\n  `rcutils_allocator_t *`. There is no allocator at this seam and the flow\n  count is a property of the OS's routing, not of anything the caller can\n  size in advance — so it streams, exactly like the graph slots."]
pub type rmw_network_flow_endpoint_visit_fn = ::core::option::Option<
    unsafe extern "C" fn(
        ctx: *mut core::ffi::c_void,
        endpoint: *const rmw_network_flow_endpoint_t,
    ) -> bool,
>;
#[doc = " Visit a subscription's content filter. Return value ignored: there is\n  exactly one filter per subscription, so this is a callback only to avoid\n  handing back an allocated `rmw_subscription_content_filter_options_t`.\n\n  `expression` and every `parameters[i]` are BORROWED for the call. A\n  subscription with no filter is reported as `expression == NULL`, which is\n  what upstream's empty options struct means."]
pub type rmw_content_filter_visit_fn = ::core::option::Option<
    unsafe extern "C" fn(
        ctx: *mut core::ffi::c_void,
        expression: *const core::ffi::c_char,
        parameters: *const *const core::ffi::c_char,
        parameter_count: usize,
    ),
>;
pub type rmw_status_event_callback_t = ::core::option::Option<
    unsafe extern "C" fn(
        kind: rmw_event_type_t::Type,
        payload: *const rmw_event_payload_t,
        user_context: *mut core::ffi::c_void,
    ),
>;
#[doc = " Upstream `rmw_event_callback_t` — the callback the `set_on_new_*` slots\n  install. Distinct from `rmw_status_event_callback_t` above, which is the DDS\n  STATUS-event callback; upstream binds this name to this shape and we now\n  match it."]
pub type rmw_event_callback_t = ::core::option::Option<
    unsafe extern "C" fn(user_data: *const core::ffi::c_void, number_of_events: usize),
>;
#[doc = " Visit one node. `enclave` is NULL where the backend does not track one —\n  which is what lets a single slot answer both `rmw_get_node_names` and\n  `rmw_get_node_names_with_enclaves`. Return `false` to stop."]
pub type rmw_node_visit_fn = ::core::option::Option<
    unsafe extern "C" fn(
        ctx: *mut core::ffi::c_void,
        node_name: *const core::ffi::c_char,
        node_namespace: *const core::ffi::c_char,
        enclave: *const core::ffi::c_char,
    ) -> bool,
>;
#[doc = " Visit one name and the types on it. `types_count` may legitimately be 0 on a\n  partially discovered graph — reporting the name without a type beats\n  dropping it. Return `false` to stop."]
pub type rmw_names_and_types_visit_fn = ::core::option::Option<
    unsafe extern "C" fn(
        ctx: *mut core::ffi::c_void,
        name: *const core::ffi::c_char,
        types: *const *const core::ffi::c_char,
        types_count: usize,
    ) -> bool,
>;
#[doc = " Visit one discovered endpoint. Return `false` to stop."]
pub type rmw_topic_endpoint_info_visit_fn = ::core::option::Option<
    unsafe extern "C" fn(
        ctx: *mut core::ffi::c_void,
        info: *const rmw_topic_endpoint_info_t,
    ) -> bool,
>;
#[doc = " Runtime-pluggable custom transport. The runtime never\n dereferences `user_data`; it's the caller's per-transport\n context, threaded back into every callback's first argument.\n\n THIS declaration is the ABI single source of truth (RFC-0054): Rust\n consumes the committed bindgen output of this header, and\n `nros_rmw::NrosTransportOps` is the hand-written Rust-side view kept in\n lockstep with it — not the other way round. The previous wording had that\n backwards (issue 0331). Layout equivalence is asserted on both sides: see\n `nros_transport_ops_t` in `nros-rmw-cffi/tests/c_stubs/abi_layout_check.c`\n and the `const _` size/align block beside\n `nros_rmw_cffi_set_custom_transport` in `nros-rmw-cffi/src/lib.rs`. Same\n layout, same threading contract, same return codes."]
pub type nros_transport_ops_t = nros_transport_ops_s;
#[doc = " Global identifier for a publisher — upstream `rmw_gid_t`, field for field.\n\n  Phase 376 W4. Mirrors upstream exactly, including the 24-byte width and the\n  `implementation_identifier`. The identifier matters MORE here than upstream:\n  `nros_rmw_cffi_register_named` admits several backends in one image, so two\n  gids are comparable only when it matches.\n\n  Comparison is over the whole array, so a producer MUST zero-pad an\n  identifier shorter than 24 bytes rather than leave the tail undefined —\n  otherwise two gids naming the same entity compare unequal on stack garbage.\n\n  **24, not 16, and that is a discrepancy worth knowing about.** Our own\n  `MessageInfo::publisher_gid` (`nros-core`, `PUBLISHER_GID_SIZE`) is 16 bytes,\n  while the Cyclone backend already computes 24-byte gids for the DDS graph\n  (`entity_gid_24` in `graph.cpp`). Under upstream semantics those are the SAME\n  identifier, so a gid obtained from a take cannot today be compared with one\n  from `get_gid_for_publisher` without a documented mapping — and the narrower\n  one truncates. The ABI takes upstream's width; reconciling `MessageInfo` is\n  its own change and is NOT done here. */\n/** Bytes to READ — phase-406 W2.\n\n  `len` is a FACT: how many bytes exist. Nothing is written through this, and\n  `const` says so — `publish` handing a backend a mutable pointer is an\n  invitation.\n\n  PASSED BY VALUE. Two words, and there is nothing to report back."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_byte_span_t {
    pub data: *const u8,
    pub len: usize,
}
#[doc = " Room to WRITE — phase-406 W2.\n\n  This is upstream's `rmw_serialized_message_t` MINUS THE ALLOCATOR. That is\n  not a coincidence and it is the whole argument: upstream's is an\n  `rcutils_uint8_array_t`, `{buffer, buffer_length, buffer_capacity,\n  allocator}`, and this ABI declined it because of the last field. Drop that\n  field and the remaining three are exactly what a caller-owned destination\n  needs, so the \"carries an allocator\" objection does not transfer to this.\n\n  `capacity` is a LIMIT (in) and `len` is a RESULT (out). They are separate\n  fields rather than one overloaded `len` because \"capacity on the way in,\n  length on the way out\" is the `snprintf` ambiguity, and it is a bug\n  generator.\n\n  PASSED BY POINTER, always. The callee must set `len`, and a by-value copy\n  would discard it — code that compiles, runs, and yields zero-length\n  messages."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_mut_byte_span_t {
    pub data: *mut u8,
    #[doc = " In: bytes available at `data`."]
    pub capacity: usize,
    #[doc = " Out: bytes actually written. Undefined on failure."]
    pub len: usize,
}
#[doc = " A message type's identity — phase-406 W1.\n\n  Upstream passes `const rosidl_message_type_support_t *`: a runtime-dispatch\n  handle carrying `{typesupport_identifier, data, func}`, where `func` walks a\n  type description at run time. This ABI resolves types at BUILD time, so\n  there is nothing for `func` to do and the handle's contents do not cross.\n\n  What DOES cross is the identity, and it was crossing as two loose\n  `const char *` wedged between `topic_name` and `qos` — so the argument order\n  did not even line up with upstream's, and every create slot took two\n  arguments where ROS 2 takes one. Grouping them costs nothing: codegen emits\n  one `static const rmw_message_type_support_t` per type, exactly as\n  `ROSIDL_GET_MSG_TYPE_SUPPORT(...)` already hands back a pointer to a static.\n\n  NAMED `rmw_`, NOT `rosidl_`, and not `nros_`. This ABI is a standard\n  interface, so a vendor prefix would say the interface is ours — but\n  `rosidl_message_type_support_t` belongs to `rosidl_runtime_c`, a package we\n  do not implement, and redefining it would collide with a host build that\n  legitimately has it in scope. Reusing `rmw_publisher_t` is safe because we\n  ARE the rmw implementation and own that name; `rmw_` is ours to spend and\n  neutral to a reader.\n\n  Future type-carried data (a serialize/deserialize pair, a bounded-size hint)\n  lands here without changing any slot's arity again — which matters, because\n  appending to a hand-mirrored FFI struct is what `check-ffi-struct-mirrors`\n  exists for."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_message_type_support_t {
    #[doc = " Fully-qualified ROS type, e.g. `\"std_msgs/msg/String\"`. Borrowed;\n  must outlive every entity created with it, which a codegen `static`\n  satisfies by construction."]
    pub type_name: *const core::ffi::c_char,
    #[doc = " RIHS type hash, e.g. `\"RIHS01_...\"`, or NULL where the backend does not\n  carry one. NULL is \"not supplied\", never \"empty\"."]
    pub type_hash: *const core::ffi::c_char,
}
#[doc = " A service type's identity. See @ref rmw_message_type_support_t.\n\n  Separate from the message form for the reason upstream separates them:\n  `rosidl_service_type_support_t` and `rosidl_message_type_support_t` are\n  distinct types there, and collapsing them here would let a service type be\n  passed where a message type is required with no diagnostic."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_service_type_support_t {
    #[doc = " Fully-qualified ROS service type, e.g. `\"example_interfaces/srv/AddTwoInts\"`."]
    pub type_name: *const core::ffi::c_char,
    #[doc = " RIHS type hash, or NULL."]
    pub type_hash: *const core::ffi::c_char,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_gid_t {
    #[doc = " Which backend produced this gid; gids from different backends are not\n  comparable. Borrowed, static for the life of the image."]
    pub implementation_identifier: *const core::ffi::c_char,
    #[doc = " The identifier bytes, zero-padded to the full width."]
    pub data: [u8; 24usize],
}
#[doc = " Per-sample metadata — upstream `rmw_message_info_t`, field for field.\n\n  Phase 376 W4. Today this metadata reaches Rust callers through\n  `MESSAGE_INFO_TABLE`, a side table in `nros-rmw-cffi` keyed on the\n  subscription's `backend_data` ADDRESS. That table is a workaround, not a\n  design, and it never crosses the seam it exists for: only the Rust\n  trampoline writes it, so a C or C++ backend has no symbol to call and\n  message info is permanently absent for them. It also claims a pool slot per\n  subscription and never releases it, so a reused handle address inherits the\n  previous subscription's metadata.\n\n  Passing the struct by pointer on the take call — which is what upstream does\n  — removes all of that: the caller owns the storage, it lives exactly as long\n  as the call, and every backend can fill it.\n\n  Retiring the side table is NOT part of this change; the `take_with_info`\n  slots are the mechanism that makes retiring it possible."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_message_info_t {
    #[doc = " Publisher's clock at publication, ns. 0 = no source timestamp."]
    pub source_timestamp: rmw_time_point_value_t,
    #[doc = " Subscriber's clock at reception, ns. 0 = receptions are not stamped."]
    pub received_timestamp: rmw_time_point_value_t,
    #[doc = " Publisher-side sequence, or\n  `RMW_MESSAGE_INFO_SEQUENCE_NUMBER_UNSUPPORTED`. Whether this is real is\n  what `feature_supported` answers."]
    pub publication_sequence_number: u64,
    #[doc = " Subscriber-side reception count, or the same sentinel."]
    pub reception_sequence_number: u64,
    #[doc = " Which publisher sent it. All-zero `data` = unknown."]
    pub publisher_gid: rmw_gid_t,
    #[doc = " True when the sample never left the image (Zephyr's\n  `Z_FEATURE_LOCAL_SUBSCRIBER`, DDS intra-process)."]
    pub from_intra_process: bool,
}
#[doc = " Full DDS-shaped QoS profile.\n\n Matches the field set of upstream `rmw_qos_profile_t`. Backends\n advertise per-policy support via the runtime's\n `supported_qos_policies()` query; entities created with a profile\n the active backend can't honour return\n `NROS_RMW_RET_INCOMPATIBLE_QOS` synchronously at create time\n — no silent downgrade.\n\n Zero-valued fields (\"off\") preserve the cheap default for apps\n that don't request the policy:\n  - `deadline_ms = 0`            → infinite deadline (no check).\n  - `lifespan_ms = 0`            → infinite lifespan (no expiry).\n  - `liveliness_kind = NONE`     → no liveliness tracking.\n  - `liveliness_lease_ms = 0`    → infinite lease.\n\n **Boundary semantics (phase-301, issue 0241).** Durations are u32\n MILLISECONDS; that width is part of the contract:\n  - `0` = unset/no-check (matches upstream `RMW_QOS_*_DEFAULT`, the\n    zero time — a \"real 0-duration\" is inexpressible upstream too).\n  - `NROS_RMW_DURATION_INFINITE_MS` = explicit infinite.\n  - Callers lowering finer-grained times MUST round sub-ms values UP\n    to 1 ms (rounding down would silently turn a real deadline into\n    \"no deadline\") and MUST reject values past the u32-ms range\n    (other than the infinite sentinel) at create time\n    (`NROS_RMW_RET_INVALID_ARGUMENT`) — never clamp.\n\n `depth` is `uint16_t` (max 65 535). Embedded ROS application queue\n depths are typically 1–100; the 16-bit width saves two bytes per\n entity vs the upstream 32-bit choice. A requested depth the width\n cannot represent is a create-time error, never a silent saturate\n (phase-301, issue 0241).\n\n **Pure policy mirror (phase-301, issue 0240).** Transport hints\n (`tx_express`, `rx_buffer_hint`) moved OUT of this struct into\n `rmw_publisher_options_t` / `rmw_subscription_options_t` —\n the upstream `rmw_publisher_options_t` / `rmw_subscription_options_t`\n home for exactly that class. QoS carries DDS policy only; hint growth\n no longer churns this ABI."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_qos_profile_t {
    #[doc = "< @see NROS_RMW_RELIABILITY_*"]
    pub reliability: u8,
    #[doc = "< @see NROS_RMW_DURABILITY_*"]
    pub durability: u8,
    #[doc = "< @see NROS_RMW_HISTORY_*"]
    pub history: u8,
    #[doc = "< @see rmw_liveliness_kind_t"]
    pub liveliness_kind: u8,
    pub depth: u16,
    #[doc = "< Reserved; must be zero."]
    pub _reserved0: u16,
    #[doc = " Subscription: max acceptable inter-arrival time, ms. Publisher:\n  max acceptable inter-publish (offered rate), ms.\n  0 = infinite (no deadline)."]
    pub deadline_ms: u32,
    #[doc = " Sample expiry, ms. Subscription filters samples older than\n  this. 0 = infinite (no expiry)."]
    pub lifespan_ms: u32,
    #[doc = " Liveliness lease, ms. Publisher must assert liveliness\n  within this window or be considered dead. 0 = infinite."]
    pub liveliness_lease_ms: u32,
    #[doc = " If non-zero, topic-name encoding skips the ROS `/rt/` prefix\n  and uses raw application names. Matches upstream\n  `avoid_ros_namespace_conventions`. `0` = false, non-zero =\n  true. (`uint8_t` instead of `bool`; `sizeof(_Bool)` is impl-\n  defined per C99 — `uint8_t` keeps the layout stable across\n  toolchains.)"]
    pub avoid_ros_namespace_conventions: u8,
    #[doc = "< Reserved; must be zero."]
    pub _reserved1: [u8; 3usize],
}
#[doc = " One discovered endpoint — upstream `rmw_topic_endpoint_info_t`.\n\n  Every string is BORROWED for the duration of the visit that hands this out;\n  a caller that needs one past the callback copies it. That is what lets the\n  graph slots stream without an allocator."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_topic_endpoint_info_t {
    #[doc = " Node that owns the endpoint."]
    pub node_name: *const core::ffi::c_char,
    #[doc = " That node's namespace."]
    pub node_namespace: *const core::ffi::c_char,
    #[doc = " Fully-qualified type on the wire, e.g. `\"std_msgs/msg/Int32\"`."]
    pub topic_type: *const core::ffi::c_char,
    #[doc = " Publisher or subscription."]
    pub endpoint_type: rmw_endpoint_type_t::Type,
    #[doc = " The endpoint's identity; `data` all-zero when the backend has none."]
    pub endpoint_gid: rmw_gid_t,
    #[doc = " The GRANTED profile, not the requested one — which is the whole reason a\n  consumer asks. A backend that cannot read back a remote's granted QoS\n  reports what it MATCHED on, and must not substitute the local entity's\n  requested profile."]
    pub qos_profile: rmw_qos_profile_t,
}
#[doc = " One network flow endpoint — upstream `rmw_network_flow_endpoint_t`, field\n  for field. Unlike the graph structs this one carries no pointers, so it\n  costs nothing to mirror exactly and a caller may copy it wholesale."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_network_flow_endpoint_t {
    pub transport_protocol: rmw_transport_protocol_t::Type,
    pub internet_protocol: rmw_internet_protocol_t::Type,
    pub transport_port: u16,
    #[doc = " Publisher-side only; 0 elsewhere."]
    pub flow_label: u32,
    #[doc = " Differentiated Services Code Point. Publisher-side only; 0 elsewhere."]
    pub dscp: u8,
    pub internet_address: [core::ffi::c_char; 48usize],
}
#[doc = " Publisher creation options — the home for publisher-side transport\n hints (upstream: `rmw_publisher_options_t`). Passed as a NULLable\n trailing param to `create_publisher`; NULL = all defaults.\n/\n/**\n Session creation options — the home for init-time context that\n `create_session`'s flat argument list cannot grow without another ABI break\n (issue 0808). Passed as a NULLable trailing param; NULL = all defaults.\n\n The carrier question 0808 opened had two candidates: encode this behind the\n locator string, or take one options struct. The struct wins on precedent —\n `rmw_publisher_options_t` and `rmw_subscription_options_t` already solved\n exactly this problem for entities, with the same NULLable-trailing-param\n shape — and on cost: parsing config out of a locator means every backend\n reimplements a parser, which is code size on a target plus a new class of\n silent misparse. One break, then the struct grows.\n\n Of Humble's eight `rmw_init_options_t` fields this carries the two that were\n GAPS (issue 0785). `domain_id` stays a named argument because every backend\n needs it; `security_options` remains declined on the target (a DDS-SROS2\n keystore path, and there is neither a filesystem nor a security plugin\n where this ABI runs); `allocator`, `instance_id`, `impl` and\n `implementation_identifier` are answered elsewhere or declined ABI-wide.\n/\n/**\n One backend-specific session configuration property.\n\n The counterpart of `RmwConfig::properties` on the Rust side, which every\n backend already accepts and which — until phase-206 W3 — NO non-Rust caller\n could reach: the cffi adapter built `properties: &[]` and threw the options\n pointer away, so a C or C++ entry could state no transport configuration at\n all, on any platform.\n\n Backend-specific by design. For zenoh this is zenoh-pico's run-time option\n set — `zp_config_insert(config, Z_CONFIG_<X>_KEY, value)`, which upstream\n calls \"the primary configuration method\" and which has no file format for\n the pico client — with the accepted names derived from zenoh-pico's own\n `config.h` (`zpico_config_keys.h`). A backend that does not recognise a name\n MUST fail the session rather than drop it: a silently ignored configuration\n line is indistinguishable from one that took effect.\n\n Both strings are NUL-terminated and BORROWED for the duration of the\n `create_session` call."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_session_property_t {
    #[doc = "< Property name; never NULL."]
    pub key: *const core::ffi::c_char,
    #[doc = "< Property value; never NULL."]
    pub value: *const core::ffi::c_char,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_session_options_t {
    #[doc = " Restrict discovery to this host. Upstream `rmw_localhost_only_t`,\n  narrowed to a flag: 0 = the system default, non-zero = localhost only.\n\n  A backend that cannot restrict discovery must IGNORE this rather than\n  fail — same contract as `mode`. Cyclone is the one that can honour it."]
    pub localhost_only: u8,
    #[doc = "< Reserved; must be zero."]
    pub _reserved: [u8; 7usize],
    #[doc = " The security enclave this session belongs to, or NULL.\n\n  Borrowed for the duration of the call. Carried so\n  `rmw_get_node_names_with_enclaves` stops being a HOLLOW grouping: the\n  visitor's `enclave` argument was structurally always NULL because\n  nothing in this ABI accepted one (issue 0785). A backend that does not\n  track enclaves still reports NULL, which is now a fact about the\n  backend rather than about the seam."]
    pub enclave: *const core::ffi::c_char,
    #[doc = " Backend-specific configuration properties, or NULL.\n\n  Borrowed for the duration of the call, as is every string they point\n  at. `property_count` must be 0 when this is NULL, and must not exceed\n  `RMW_SESSION_MAX_PROPERTIES`; a violation is\n  `RMW_RET_INVALID_ARGUMENT`, not a truncation."]
    pub properties: *const rmw_session_property_t,
    #[doc = "< Number of entries in `properties`."]
    pub property_count: usize,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_publisher_options_t {
    #[doc = " phase-279 (#145) — express hint (`TopicInfo::tx_express` across\n  the C ABI): non-zero = this publisher's samples bypass transport\n  tx batching. A transport hint, not a DDS policy — no RxO\n  matching."]
    pub tx_express: u8,
    #[doc = "< Reserved; must be zero."]
    pub _reserved: [u8; 7usize],
}
#[doc = " Subscription creation options — the home for subscription-side\n transport hints (upstream: `rmw_subscription_options_t`). Passed as a\n NULLable trailing param to `create_subscription`; NULL = all defaults."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_subscription_options_t {
    #[doc = " Phase 231 (RFC-0038) — receive-buffer size hint, bytes, so a\n  size-classing backend (zenoh-pico) can pick a small/large receive\n  buffer. `0` = unset. A transport hint, not a DDS policy.\n\n  Phase 403 W1 — the paragraph above is what this field MEANS; the rules\n  below are what it OBLIGES, and they are normative. They were prose in\n  RFC-0005 (\"Receive-buffer sizing: what a backend is obliged to do\") and\n  nowhere else, so a third party reading only this header could not tell\n  whether ignoring the hint was conformant. It is.\n\n  - ADVISORY. A backend MAY ignore this field entirely. A backend with a\n    single receive-buffer size is conformant, and so is one that rounds\n    68 up to 1024.\n  - `0` IS \"THIS CALLER SAID NOTHING\", NOT \"THIS TYPE HAS NO BOUND\".\n    Every message type carries a derived upper bound — bounded in the\n    `.msg` (`string<=64`) or capped in `nros-codegen.toml`, and an\n    unbounded type is a BUILD ERROR rather than something that falls back\n    to a configured default — so the runtime always has a number to put\n    here. `0` therefore reaches a backend only from a caller that\n    supplied no options at all (`options == NULL`, or a zero-filled\n    struct from a hand-rolled C caller). A backend must never read it as\n    a claim that the type is unbounded, and must not treat a non-zero\n    hint as a tighter bound than the type's own.\n  - IT IS NOT THE TAKE BUFFER. `take`'s `buf` / `buf_len` are owned by\n    the RUNTIME, and `buf_len` is authoritative on every call — including\n    when it disagrees with this hint, and when it changes between calls\n    for the same subscription. A backend must not cache a length from\n    here and write `buf` against it.\n  - MUST NOT LIE. A backend MUST NOT copy a sample that does not fit the\n    caller's take buffer and return `NROS_RMW_RET_OK`. A sample larger\n    than `buf_len` is reported as a failure — `*taken = false` with\n    `NROS_RMW_RET_BUFFER_TOO_SMALL` — never as a truncated success. The\n    runtime turns that into a diagnostic naming the buffer\n    (`report_dropped_take`); a silent truncation is a corrupt message\n    with no symptom at all. This is the ONE guarantee the hint carries,\n    and it holds whether or not the backend honoured the hint.\n  - NOT A WIRE BOUND. A remote publisher is bound by the `.msg`, never by\n    our config, so this is no promise about incoming sample size. A\n    backend must not size a fixed structure from it in a way that makes a\n    larger sample undeliverable WITHOUT a diagnostic.\n\n  The vtable's OPTIONAL `required_rx_bytes` is the other direction: how a\n  backend says what it would rather the take buffer were."]
    pub rx_buffer_hint: u32,
    #[doc = "< Reserved; must be zero."]
    pub _reserved: [u8; 4usize],
}
#[doc = " Per-process RMW session — the entity returned by `vtable->create_session`.\n\n Carries the node identity (used for diagnostics + wire-level\n topic-key derivation in some backends) plus the opaque\n backend-private state.\n\n The 8-byte `_reserved` slot is sized for a forthcoming\n `vtable: const struct nros_rmw_vtable_t *` field that Phase 104's\n multi-instance work will land here. Backends and runtime keep\n these bytes zero."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_session_t {
    #[doc = " Node name (borrowed from caller; outlives the session)."]
    pub node_name: *const core::ffi::c_char,
    #[doc = " Node namespace (borrowed from caller; outlives the session)."]
    pub namespace_: *const core::ffi::c_char,
    #[doc = " Reserved for future fields (Phase 104 vtable pointer slot);\n  must be zero."]
    pub _reserved: [u8; 8usize],
    #[doc = " Opaque backend state. NULL for an uninitialised session."]
    pub backend_data: *mut core::ffi::c_void,
}
#[doc = " A graph node — upstream `rmw_node_t`, minus what an image has no use for.\n\n  Phase 376 W4. Storage is CALLER-OWNED, like every other entity here: the\n  runtime hands `create_node` a zero-initialised shell and the backend writes\n  its `backend_data` into it.\n\n  **Why a node exists at all when an image opens ONE session.** The session\n  half of that statement holds; the node half does not, and our own code says\n  so. `Executor` keeps a node table, and `CffiSession::entity_view` exists\n  SOLELY to fabricate a per-call session carrying the entity's owning-node\n  identity — its own comment reads \"one session can host N graph nodes\". The\n  zenoh backend then re-derives a node registry from that string by\n  linear-scanning declared tokens. So node identity already reaches the\n  backend, through a side channel, in every image.\n\n  **Done, W5/B1 (2026-08-24).** `create_publisher` / `create_subscription` /\n  `create_service` / `create_client` take `const rmw_node_t *` the way\n  upstream does. That retired the `entity_view` fabrication — the shim now\n  owns a node table and calls `create_node` once per distinct\n  `(name, namespace)`, which is only true because `Executor::create_node`\n  deduplicates (W5/B1.a).\n\n  **Still owed:** zenoh's `ensure_node_liveliness` still linear-scans its own\n  `per_node_liveliness` table. Retiring it needs a `create_node` method on the\n  Rust `Rmw`/`Session` trait plus a trampoline in `RustBackendAdapter`, so\n  that a Rust backend can be TOLD about a node the way a C one is. The slot\n  and the table it needs both exist now; only that trait hop is missing. Do\n  not read this paragraph as done — the first draft of this comment said the\n  registry was retired, which it was not.\n\n  Not carried from upstream: `implementation_identifier` and `data` (one\n  image links one backend per session, so there is nothing to disambiguate).\n\n  `session` IS carried, and is our `context`. Upstream's node reaches its\n  context that way and every `rmw_create_*` relies on it; a node with no route\n  to its session cannot be the only argument those slots get, which is what\n  made this field the precondition for the whole change rather than a\n  convenience. Set by the runtime BEFORE `create_node`, and stable for the\n  node's life."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_node_t {
    #[doc = " Node name. Borrowed; outlives the node."]
    pub name: *const core::ffi::c_char,
    #[doc = " Node namespace. Borrowed; outlives the node."]
    pub namespace_: *const core::ffi::c_char,
    #[doc = " The session this node lives on — upstream's `context`. Set by the\n  runtime before `create_node`; never NULL in a node the runtime hands to\n  a slot. A backend reaches its own session state through\n  `node->session->backend_data`."]
    pub session: *mut rmw_session_t,
    #[doc = " Reserved; must be zero."]
    pub _reserved: [u8; 8usize],
    #[doc = " Opaque backend state. NULL until `create_node` succeeds."]
    pub backend_data: *mut core::ffi::c_void,
}
#[doc = " Publisher entity.\n\n Created by `vtable->create_publisher`; destroyed by\n `vtable->destroy_publisher`. The runtime owns the storage; the\n runtime fills `topic_name` / `type_name` / `qos` before the\n create call. The backend writes `backend_data`.\n\n `can_loan_messages` matches upstream `rmw_publisher_t`'s field of\n the same name — `true` means the backend exposes the\n `loan_publish` / `commit_publish` primitive (Phase 99).\n\n **The runtime DERIVES it; a backend does not write it** (issue 0814).\n Its value is exactly `vtable->borrow_loaned_message != NULL`, because\n that is the same fact, and a fact with two spellings drifts — this one\n had drifted in both directions at once. Anything a backend writes here\n is overwritten.\n\n This paragraph used to read \"the runtime reads it once at create time\n and picks the publish path accordingly; no per-call probe\". That was\n never true: nothing has ever branched on the field, and the publish\n path is chosen per call from `vtable->borrow_loaned_message` itself.\n\n To refuse a loan for a PARTICULAR entity, return\n `RMW_RET_UNSUPPORTED` from `borrow_loaned_message`. The per-entity\n answer belongs on the call, which the runtime consults; not on this\n flag, which it does not."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_publisher_t {
    #[doc = " Topic name (borrowed; outlives the publisher)."]
    pub topic_name: *const core::ffi::c_char,
    #[doc = " ROS-2-style fully-qualified type name\n  (e.g., `\"std_msgs/msg/Int32\"`). Borrowed; outlives the publisher."]
    pub type_name: *const core::ffi::c_char,
    #[doc = " QoS subset honoured by this publisher."]
    pub qos: rmw_qos_profile_t,
    #[doc = " Backend exposes loan_publish / commit_publish (Phase 99).\n  DERIVED by the runtime from `vtable->borrow_loaned_message`;\n  a backend's write is overwritten (issue 0814)."]
    pub can_loan_messages: bool,
    #[doc = " Reserved for future fields; must be zero."]
    pub _reserved: [u8; 7usize],
    #[doc = " Opaque backend state. NULL if creation failed."]
    pub backend_data: *mut core::ffi::c_void,
}
#[doc = " Subscription entity (phase-301: renamed from `subscriber` to the upstream `rmw_subscription_t` term). Same shape as the publisher; `can_loan_messages`\n means the backend exposes the receive-side loan primitive."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_subscription_t {
    #[doc = " Topic name (borrowed; outlives the subscription)."]
    pub topic_name: *const core::ffi::c_char,
    #[doc = " Fully-qualified type name. Borrowed."]
    pub type_name: *const core::ffi::c_char,
    #[doc = " QoS subset honoured by this subscription."]
    pub qos: rmw_qos_profile_t,
    #[doc = " Backend exposes loan_recv / release_recv (Phase 99).\n  DERIVED by the runtime from `vtable->take_loaned_message`;\n  a backend's write is overwritten (issue 0814)."]
    pub can_loan_messages: bool,
    #[doc = " Reserved for future fields; must be zero."]
    pub _reserved: [u8; 7usize],
    #[doc = " Opaque backend state. NULL if creation failed."]
    pub backend_data: *mut core::ffi::c_void,
}
#[doc = " Service entity (phase-301: renamed from `service_server` to the upstream `rmw_service_t` term).\n\n Service entities have no QoS in the nros subset (the upstream\n `rmw_qos_profile_services_default` distinction does not generalise\n across non-DDS backends — see book `concepts/ros2-comparison.md`).\n\n No `can_loan_messages` field — service request/reply currently\n always goes through `take_request` / `send_response` byte-buffer\n APIs. If a future backend wants service-side lending, the\n `_reserved[8]` block accommodates the bool + 7 padding bytes\n without an ABI break."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_service_t {
    #[doc = " Service name (borrowed; outlives the server)."]
    pub service_name: *const core::ffi::c_char,
    #[doc = " Fully-qualified service type name (e.g.,\n  `\"example_interfaces/srv/AddTwoInts\"`). Borrowed."]
    pub type_name: *const core::ffi::c_char,
    #[doc = " Reserved for future fields; must be zero."]
    pub _reserved: [u8; 8usize],
    #[doc = " Opaque backend state. NULL if creation failed."]
    pub backend_data: *mut core::ffi::c_void,
}
#[doc = " Client entity (phase-301: renamed from `service_client` to the upstream `rmw_client_t` term). Same shape as the service."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_client_t {
    #[doc = " Service name (borrowed; outlives the client)."]
    pub service_name: *const core::ffi::c_char,
    #[doc = " Fully-qualified service type name. Borrowed."]
    pub type_name: *const core::ffi::c_char,
    #[doc = " Reserved for future fields; must be zero."]
    pub _reserved: [u8; 8usize],
    #[doc = " Opaque backend state. NULL if creation failed."]
    pub backend_data: *mut core::ffi::c_void,
}
#[doc = " Liveliness payload. Mirrors the DDS\n  `rmw_liveliness_changed_status_t` shape."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_liveliness_changed_status_t {
    pub alive_count: u16,
    pub not_alive_count: u16,
    pub alive_count_change: i16,
    pub not_alive_count_change: i16,
}
#[doc = " Count payload. Used for `MESSAGE_LOST`,\n  `REQUESTED_DEADLINE_MISSED`, `LIVELINESS_LOST`,\n  `OFFERED_DEADLINE_MISSED` — all share the same shape."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_count_status_t {
    pub total_count: u32,
    pub total_count_change: u32,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_loan_token_t {
    _unused: [u8; 0],
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_node_visitor_t {
    pub visit: rmw_node_visit_fn,
    pub ctx: *mut core::ffi::c_void,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_names_and_types_visitor_t {
    pub visit: rmw_names_and_types_visit_fn,
    pub ctx: *mut core::ffi::c_void,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rmw_topic_endpoint_info_visitor_t {
    pub visit: rmw_topic_endpoint_info_visit_fn,
    pub ctx: *mut core::ffi::c_void,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct nros_rmw_vtable_t {
    #[doc = " Create a session (phase-301: renamed from `open` to the table's\n  own `create_*` convention). The runtime supplies a\n  zero-initialised `rmw_session_t` via @p out with\n  `node_name` / `namespace_` already filled. The backend writes\n  `out->backend_data`.\n\n  @param mode One of `nros_rmw_session_mode_t`. Passed as `uint8_t`\n              rather than the enum to keep the slot's width fixed\n              across compilers. A backend with no peer/client\n              distinction must IGNORE it, not reject it.\n  @param options NULLable; NULL means every default. Issue 0808 — the\n              home for init-time context this flat list cannot grow\n              without another break. `mode` is NOT moved into it: doing\n              so would be a second break for no gain, and it is already\n              a named argument every backend reads. What moved in are the\n              two fields issue 0785 measured as GAPS, `localhost_only`\n              and `enclave`."]
    pub create_session: ::core::option::Option<
        unsafe extern "C" fn(
            locator: *const core::ffi::c_char,
            mode: u8,
            domain_id: u32,
            node_name: *const core::ffi::c_char,
            options: *const rmw_session_options_t,
            out: *mut rmw_session_t,
        ) -> rmw_ret_t,
    >,
    pub destroy_session:
        ::core::option::Option<unsafe extern "C" fn(session: *mut rmw_session_t) -> rmw_ret_t>,
    pub drive_io: ::core::option::Option<
        unsafe extern "C" fn(session: *mut rmw_session_t, timeout_ms: i32) -> rmw_ret_t,
    >,
    #[doc = " Create a publisher. The runtime fills `out->topic_name`,\n  `out->type_name`, `out->qos` before this call; the backend\n  writes `out->backend_data`. `out->can_loan_messages` is DERIVED\n  by the runtime, not written here (issue 0814).\n  `options` carries transport hints (phase-301: moved out of the\n  QoS struct); NULL = all defaults."]
    pub create_publisher: ::core::option::Option<
        unsafe extern "C" fn(
            node: *const rmw_node_t,
            type_support: *const rmw_message_type_support_t,
            topic_name: *const core::ffi::c_char,
            domain_id: u32,
            qos: *const rmw_qos_profile_t,
            options: *const rmw_publisher_options_t,
            out: *mut rmw_publisher_t,
        ) -> rmw_ret_t,
    >,
    pub destroy_publisher:
        ::core::option::Option<unsafe extern "C" fn(publisher: *mut rmw_publisher_t) -> rmw_ret_t>,
    pub publish: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            payload: rmw_byte_span_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " `options` carries transport hints (phase-301: moved out of the\n  QoS struct); NULL = all defaults."]
    pub create_subscription: ::core::option::Option<
        unsafe extern "C" fn(
            node: *const rmw_node_t,
            type_support: *const rmw_message_type_support_t,
            topic_name: *const core::ffi::c_char,
            domain_id: u32,
            qos: *const rmw_qos_profile_t,
            options: *const rmw_subscription_options_t,
            out: *mut rmw_subscription_t,
        ) -> rmw_ret_t,
    >,
    pub destroy_subscription: ::core::option::Option<
        unsafe extern "C" fn(subscription: *mut rmw_subscription_t) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_take`. Phase 376 W3.b/W3.d step A.\n\n  `*taken` says whether a message was copied; `*out_len` is\n  how many bytes, meaningful only when taken. Both are\n  written only on `NROS_RMW_RET_OK`.\n\n  Second slot to retire `NROS_RMW_RET_NO_DATA`: an empty\n  subscription is `taken = false` with OK, which is what\n  upstream's `taken` out-parameter means.\n\n  Deviations from upstream, declared:\n  - `buf` / `buf_len` / `*out_len` replace upstream's typed\n    `void *ros_message`. There is no typesupport indirection\n    on target — the payload is bytes and the caller owns the\n    buffer, so it needs the length back.\n  - no `rmw_subscription_allocation_t *`: it is an OPAQUE\n    per-implementation handle (`{const char *implementation_identifier;\n    void *data;}` in Humble's `rmw/types.h` — no allocator in\n    it), and the only thing that produces one is\n    `rmw_init_subscription_allocation`, whose other parameters\n    are a typesupport pointer and a sequence bound, both\n    declined ABI-wide. Nothing can make one, so the argument has\n    nothing to point at. Two earlier reasons here were wrong:\n    \"pools are baked\" (issue 0777 — cyclonedds calls\n    `ddsrt_calloc` on this very path) and then \"upstream\n    pre-sizes an `rcutils_allocator_t`\" (there is none).\n\n  Phase 403 W1 — `buf_len` is AUTHORITATIVE on every call, and a\n  sample that does not fit it is a FAILURE (`*taken = false` with\n  `NROS_RMW_RET_BUFFER_TOO_SMALL`), never a truncated success.\n  That holds however the backend treated\n  `rmw_subscription_options_t.rx_buffer_hint`, whose doc writes the\n  rule out in full."]
    pub take: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            out: *mut rmw_mut_byte_span_t,
            taken: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 376 W3.d step A — status in the return, answer in the\n  out-parameter, so no slot multiplexes a flag with a status.\n  `*out_has_data` is written only on `NROS_RMW_RET_OK`.\n\n  RTOS addition: upstream has no equivalent, because a hosted\n  caller reaches for a wait-set. This is the poll a loop with\n  no wait-set needs, and it allocates nothing.\n\n  Logically read-only, and that is weaker than it sounds: zenoh's\n  implementation fires deadline and liveliness callbacks from inside this\n  probe and writes their cells, and cyclonedds' peeks its reader (which\n  marks samples READ). The rule a backend must actually keep is that a\n  probe may not CONSUME a message — the sample a `has_data` reports must\n  still be there for the `take` that follows. The stronger \"must not\n  mutate subscription state\" was recorded here and true of nobody\n  (issue 0780)."]
    pub has_data: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *mut rmw_subscription_t,
            out_has_data: *mut bool,
        ) -> rmw_ret_t,
    >,
    pub create_service: ::core::option::Option<
        unsafe extern "C" fn(
            node: *const rmw_node_t,
            type_support: *const rmw_service_type_support_t,
            service_name: *const core::ffi::c_char,
            domain_id: u32,
            qos: *const rmw_qos_profile_t,
            out: *mut rmw_service_t,
        ) -> rmw_ret_t,
    >,
    pub destroy_service:
        ::core::option::Option<unsafe extern "C" fn(server: *mut rmw_service_t) -> rmw_ret_t>,
    #[doc = " Upstream `rmw_take_request`. Phase 376 W3.b/W3.d step A.\n\n  `*taken` says whether a request was copied, `*out_len` how\n  many bytes, `*seq_out` the sequence number to reply against.\n  All three are written only on `NROS_RMW_RET_OK`.\n\n  Deviations from upstream, declared: the payload is bytes\n  (`buf` / `buf_len` / `*out_len`) rather than a typed\n  `void *ros_request`, and `*seq_out` stands in for\n  `rmw_service_info_t *` — an RTOS reply needs the sequence\n  and nothing else in that struct."]
    pub take_request: ::core::option::Option<
        unsafe extern "C" fn(
            server: *const rmw_service_t,
            request: *mut rmw_mut_byte_span_t,
            seq_out: *mut i64,
            taken: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 376 W3.d step A — the service-side sibling of\n  `has_data`; same contract, same reason."]
    pub has_request: ::core::option::Option<
        unsafe extern "C" fn(server: *mut rmw_service_t, out_has_request: *mut bool) -> rmw_ret_t,
    >,
    pub send_response: ::core::option::Option<
        unsafe extern "C" fn(
            server: *const rmw_service_t,
            seq: i64,
            response: rmw_byte_span_t,
        ) -> rmw_ret_t,
    >,
    pub create_client: ::core::option::Option<
        unsafe extern "C" fn(
            node: *const rmw_node_t,
            type_support: *const rmw_service_type_support_t,
            service_name: *const core::ffi::c_char,
            domain_id: u32,
            qos: *const rmw_qos_profile_t,
            out: *mut rmw_client_t,
        ) -> rmw_ret_t,
    >,
    pub destroy_client:
        ::core::option::Option<unsafe extern "C" fn(client: *mut rmw_client_t) -> rmw_ret_t>,
    #[doc = " Phase 130.4 — non-blocking send_request_raw. Phase-301: the\n  deprecated blocking `call_raw` slot is DELETED (rmw has no\n  blocking call); this + `try_recv_reply_raw` is the ONE\n  request/reply path and both slots are now REQUIRED for a backend\n  that supports services.\n\n  Sends the request to the backend without blocking for a\n  reply. Returns immediately.\n\n  `*sequence_id` is the id the backend assigned, written only on\n  `NROS_RMW_RET_OK`. Upstream returns it for one reason and it is the\n  same reason here: a client with two calls outstanding has nothing else\n  to match a reply against.\n\n  Issue 0778 — this out-parameter was ABSENT until 2026-08-25, and every\n  backend computed the id and threw it away (cyclonedds a\n  `RequestId{guid, seq}`, zenoh a `fetch_add` into the rmw attachment,\n  xrce `uxr_buffer_request`'s id). With nothing to correlate BY, each\n  invented a policy: cyclonedds ABANDONED the first request when a second\n  was sent, zenoh took FIRST REPLY WINS on the grounds that \"a queryable\n  is idempotent at the application layer\" — which this ABI cannot\n  enforce and which is false for `send_goal` and `SetParameters`, both of\n  which travel this path. Same application code, different behaviour per\n  transport. The id is what deletes both policies."]
    pub send_request: ::core::option::Option<
        unsafe extern "C" fn(
            client: *const rmw_client_t,
            request: rmw_byte_span_t,
            sequence_id: *mut i64,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_take_response`. Same shape and the same\n  declared deviations as `take_request`.\n\n  `*seq_out` is the `sequence_id` of the request this reply answers,\n  written only when `*taken` is true. It is the other half of issue\n  0778: handing the id out at send time is useless if it does not come\n  back. Mirrors `take_request`'s `seq_out`, which the SERVER side has\n  always had — the asymmetry was the tell.\n\n  (The paragraph that used to sit here described `>= 0` = bytes and\n  \"other negative = backend error\", the pre-W3.d shape, three phases\n  after step A moved the count to an out-parameter and step B made the\n  errors positive.)"]
    pub take_response: ::core::option::Option<
        unsafe extern "C" fn(
            client: *const rmw_client_t,
            reply: *mut rmw_mut_byte_span_t,
            seq_out: *mut i64,
            taken: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Register a callback for a subscription-side event. NULL function\n  pointer = backend doesn't generate any subscription events.\n  Specific kind unsupported on a backend that supports some\n  events = `NROS_RMW_RET_UNSUPPORTED` return.\n  `deadline_ms` is consulted for `REQUESTED_DEADLINE_MISSED`\n  only; ignored otherwise."]
    pub subscription_event_init: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            kind: rmw_event_type_t::Type,
            deadline_ms: u32,
            cb: rmw_status_event_callback_t,
            user_context: *mut core::ffi::c_void,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_take_event`, subscription side.\n\n  `*taken` says whether an event was copied into `*out`; both are written\n  only on `NROS_RMW_RET_OK`. `kind` selects which event to drain, and\n  which member of the payload union is valid.\n\n  Deviations from upstream, declared: no `rmw_event_t *` — that handle is\n  declined, so the entity plus the kind identifies the event — and the\n  payload is our `rmw_event_payload_t` union rather than a `void *` the\n  caller must know the shape of.\n\n  NULL is the normal answer for a backend that delivers status events\n  through the `*_event_init` callback and has a safe context to do it\n  from. It is NOT the right answer for a backend whose notifications\n  arrive on a thread of its own."]
    pub subscription_take_event: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            kind: rmw_event_type_t::Type,
            out: *mut rmw_event_payload_t,
            taken: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_take_event`, publisher side. Same contract as\n  `subscription_take_event`; `rmw_take_event` is recorded as GROUPED onto\n  that one, since upstream has a single name for both."]
    pub publisher_take_event: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            kind: rmw_event_type_t::Type,
            out: *mut rmw_event_payload_t,
            taken: *mut bool,
        ) -> rmw_ret_t,
    >,
    pub publisher_event_init: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            kind: rmw_event_type_t::Type,
            deadline_ms: u32,
            cb: rmw_status_event_callback_t,
            user_context: *mut core::ffi::c_void,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 108.B — manually assert this publisher's liveliness.\n  Required for `MANUAL_BY_TOPIC` / `MANUAL_BY_NODE` liveliness\n  kinds; no-op (return `NROS_RMW_RET_OK`) for other kinds.\n  NULL function pointer = backend doesn't support manual\n  liveliness; runtime returns `NROS_RMW_RET_OK` for AUTOMATIC /\n  NONE callers and `NROS_RMW_RET_UNSUPPORTED` for MANUAL_*."]
    pub publisher_assert_liveliness: ::core::option::Option<
        unsafe extern "C" fn(publisher: *const rmw_publisher_t) -> rmw_ret_t,
    >,
    #[doc = " Phase 110.0 — backend's next internal-event deadline in\n  milliseconds from now (lease keepalive, heartbeat, reader\n  ACK-NACK timeout, etc.). The runtime caps its `drive_io`\n  timeout against `min(user_timeout, timer_deadline, this)` so\n  quiet links don't wake early, see no user-visible work, and\n  round-trip back into `drive_io`.\n\n  Phase 376 W3.d step A — `*out_ms` carries the value and\n  `*has_deadline` whether there is one; both are written only\n  on `NROS_RMW_RET_OK`.\n\n  This slot was the ONE member of the eleven that step B's\n  renumbering did not force: its old negative return was a\n  \"no deadline\" SENTINEL, not an error code, so nothing would\n  have collided. It is converted anyway because it had the\n  shape every other conversion found a silent failure in — a\n  backend that FAILED to compute its deadline returned `-1`\n  and was read as \"quiet link\", which is exactly the reading\n  that makes the executor sleep longer. It now has an error\n  channel it never had.\n\n  NULL function pointer is permitted — the runtime treats it\n  the same as `*has_deadline = false`."]
    pub next_deadline_ms: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            out_ms: *mut u32,
            has_deadline: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.B.1 — executor wake callback.\n\n  The runtime calls this once per session right after `open`\n  with `cb` pointing at a runtime-supplied function and `ctx`\n  pointing at the executor's wake state. The backend stores\n  both in its per-session state and calls `cb(ctx)` whenever\n  its transport-notification path fires — datagram arrival,\n  condvar wake-up, select-fd ready, etc. The runtime cb does\n  flag-write + condvar-signal atomically so a `spin_once`\n  blocked on the wake condvar resumes immediately.\n\n  `cb == NULL` clears any previously installed callback; the\n  backend must drop the stored (cb, ctx) and never invoke\n  again after this returns.\n\n  NULL slot = backend has no asynchronous wake path (purely\n  poll-driven: XRCE, bare-metal). The runtime still drains the\n  session on its deadline-bound cv-wait boundary."]
    pub set_wake_callback: ::core::option::Option<
        unsafe extern "C" fn(
            session: *mut rmw_session_t,
            cb: ::core::option::Option<unsafe extern "C" fn(ctx: *mut core::ffi::c_void)>,
            ctx: *mut core::ffi::c_void,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.A — zero-copy publisher loan.\n\n  Reserve a writable slot of at least `requested_len` bytes inside\n  the backend's outbound buffer. Returns:\n    * `NROS_RMW_RET_OK` + writes `*out_buf` / `*out_cap` / `*out_token`.\n    * `NROS_RMW_RET_TRY_AGAIN` if the backend has no slot\n      available (caller may retry or fall back to a copy path).\n    * `NROS_RMW_RET_INVALID_ARGUMENT` on bad pointers / size.\n\n  `*out_cap` may exceed `requested_len`. The slot's bytes are\n  valid until the matching `pub_commit` or `pub_discard` runs.\n  `*out_token` is an opaque per-loan handle the backend uses to\n  match commit / discard back to the right slot.\n\n  NULL function pointer = backend doesn't natively lend; the\n  runtime falls back to a per-publisher staging arena and emits\n  a single memcpy on commit."]
    pub borrow_loaned_message: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            requested_len: usize,
            out_slot: *mut rmw_mut_byte_span_t,
            out_token: *mut *mut rmw_loan_token_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.A — commit a previously loaned slot.\n\n  `token` MUST be a value returned from a prior `pub_loan` on the\n  same publisher. `actual_len` is the byte count actually\n  written into the slot (≤ the loan's `out_cap`). Triggers the\n  wire send.\n\n  NULL = paired NULL with `pub_loan`."]
    pub publish_loaned_message: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            token: *mut rmw_loan_token_t,
            actual_len: usize,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.A — abandon a previously loaned slot.\n\n  Releases the slot without sending. `token` MUST be a value\n  returned from a prior `pub_loan` on the same publisher.\n\n  NULL = paired NULL with `pub_loan`."]
    pub return_loaned_message_from_publisher: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            token: *mut rmw_loan_token_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.A — zero-copy subscription borrow.\n\n  Borrow a read-only view of the next available message in\n  place, without copying into a caller buffer. Returns:\n    * `>= 0` — message length; writes `*out_buf` / `*out_token`.\n    * `0` — no message ready (subscription empty).\n    * `< 0` — error (see `rmw_ret_t` codes negated).\n\n  The view is valid until the matching `sub_release` runs.\n  Only one borrow may be outstanding per subscription at a time —\n  callers MUST release before requesting another borrow.\n\n  NULL function pointer = backend doesn't natively borrow; the\n  runtime falls back to `try_recv_raw` into a staging buffer. */\n/** Upstream `rmw_take_loaned_message`. Phase 376 W3.b/W3.d step A.\n\n  `*taken` says whether a view was handed out; `*out_buf`,\n  `*out_len` and `*out_token` describe it and are meaningful\n  only when taken. All are written only on\n  `NROS_RMW_RET_OK`.\n\n  Before this, the length was returned AND written to\n  `*out_len`, and the runtime used the return — so a backend\n  that disagreed with itself had one of its two answers\n  silently ignored. There is now one length.\n\n  Deviation from upstream, declared: upstream loans a typed\n  `void **loaned_message`; ours is a byte view plus an opaque\n  token to release, because there is no typesupport on target\n  and the backend owns the buffer until `sub_release`.\n\n  **No backend fills this slot today** (Cyclone NULL, XRCE NULL, and the\n  Rust adapter leaves it at `EMPTY_VTABLE`), so every `try_borrow` through\n  the C ABI takes the copy fallback. The slot is carried, not deleted,\n  because it is the only shape that can hand a view to a caller which\n  outlives the call — `nros-c` / `nros-cpp` `try_borrow` — where\n  `process_raw_in_place`'s scoped callback cannot reach. Zenoh's native\n  zero-copy receive is live but arrives through Rust\n  `SlotBorrowing for ZenohSubscriber`, not through here. Recorded so\n  \"the slot exists\" is not read as \"the capability works\": issue 0781."]
    pub take_loaned_message: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            out_view: *mut rmw_byte_span_t,
            out_token: *mut *mut rmw_loan_token_t,
            taken: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.A — release a previously borrowed view.\n\n  `token` MUST be a value returned from a prior `sub_borrow`\n  on the same subscription. Lets the next message advance into\n  the buffer.\n\n  NULL = paired NULL with `sub_borrow`."]
    pub return_loaned_message_from_subscription: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            token: *mut rmw_loan_token_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.C.1 — service-server availability probe.\n\n  Returns `1` if ≥ 1 matching server has been discovered on the\n  RMW graph, `0` if none yet, or a negative `rmw_ret_t`\n  constant on backend error. The runtime exposes this to user\n  code as `nros_client_server_available()` /\n  `Client<S>::server_available()` — clients use it to gate the\n  first request so a startup-ordering race doesn't surface as\n  a request-side timeout.\n\n  Implementation notes per backend:\n  - **Zenoh**: `z_session` tracks matched queryables via\n    interest declarations.\n  - **Cyclone DDS / dust-DDS**: built-in topic readers expose\n    matched-pub counts.\n  - **XRCE**: agent has no participant enumeration; return\n    `NROS_RMW_RET_UNSUPPORTED`.\n\n  NULL function pointer = backend cannot answer; the runtime\n  surfaces `NROS_RMW_RET_UNSUPPORTED` to the caller.\n\n  Phase 376 W3.d step A — upstream's shape: the STATUS is the\n  return value and the answer is an out-parameter. Previously\n  this slot multiplexed both through one `int32_t` (1 = yes,\n  0 = no, negative = error), which is what makes upstream's\n  positive `RMW_RET_ERROR = 1` unadoptable — `1` would mean\n  both \"available\" and \"failed\". Splitting them is what lets\n  step B renumber at all.\n\n  A backend writes `*out_available` only on\n  `NROS_RMW_RET_OK`; on any error the caller's value is\n  untouched. The old contract's tolerance for \"any positive\n  value other than 1 means available\" is gone with the int:\n  a `bool` has no non-spec value to be lenient about.\n\n  Deviation from upstream, declared: no `node` parameter.\n  `rmw_service_server_is_available` takes both a node and a\n  client; an image has no node object to pass — the client\n  reaches its session directly."]
    pub service_server_is_available: ::core::option::Option<
        unsafe extern "C" fn(client: *const rmw_client_t, out_available: *mut bool) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.D.1 — burst-take.\n\n  Drains up to `max_msgs` queued messages into a contiguous\n  caller buffer in a single backend call, avoiding N × vtable\n  dispatch when a burst-sensor subscription catches up on a\n  backlog (e.g. a 100 Hz IMU feed polled at 10 Hz).\n\n  Storage contract:\n    * `buf` is a contiguous `max_msgs * per_msg_cap` block.\n    * The i-th delivered message lives at `buf + i * per_msg_cap`\n      and has byte length `out_lens[i]`.\n    * `out_lens` is at least `max_msgs` entries long.\n\n  Returns:\n    * `>= 0` — count of messages taken (0..=max_msgs).\n    * `< 0` — `rmw_ret_t` error code; partial drains MUST\n      use the count form, not error-out.\n\n  NULL function pointer = backend doesn't natively batch; the\n  runtime emits a `try_recv_raw` loop fallback in\n  `CffiSubscriber::try_recv_sequence`. The fallback gives\n  identical observable behaviour (each call still costs N\n  vtable hops) but lets user code commit to the batched API. */\n/** Upstream `rmw_take_sequence`. Phase 376 W3.b/W3.d step A —\n  the COUNT moves to `*taken`, matching upstream's\n  `size_t *taken`, and the return carries only a status.\n  `*taken` is written only on `NROS_RMW_RET_OK`; a partial\n  drain reports what it got rather than erroring.\n\n  Issue 0971 — which leaves a question the count alone cannot\n  answer: WHY the drain stopped. A batch that ends because a\n  message did not fit `per_msg_cap` returns the same shape as\n  one that drained the reader, and the message that stopped it\n  is consumed — deliberately, for the reason the single take\n  consumes it too: a sample left behind that no caller can\n  ever take is a stuck subscription\n  (`nros-verification`'s `try_recv_post_fix` /\n  `no_silent_truncation`).\n\n  So a backend that stops a drain for a reason the caller must\n  hear PARKS that status on the subscription and returns it\n  from the NEXT `take` or `take_sequence`, which takes nothing\n  else that call. That rule is what makes the fallback note\n  above true rather than aspirational: without it the runtime's\n  `try_recv_raw` loop and a native batch answer the same\n  condition differently — the loop erroring out and discarding\n  the count it had already earned, the native path reporting a\n  count and no reason."]
    pub take_sequence: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            buf: *mut u8,
            per_msg_cap: usize,
            max_msgs: usize,
            out_lens: *mut usize,
            taken: *mut usize,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.E.1 — streamed publish.\n\n  Caller hands the backend two callbacks. The backend invokes\n  `size_cb` once to learn the total payload length, allocates\n  a single slot of that size in its outbound buffer, then\n  invokes `chunk_cb` repeatedly to fill the slot in chunks\n  until the buffer is full. What it saves is the CALLER-side\n  buffer holding a whole serialised message.\n\n  That justification used to read \"saves the per-publisher\n  staging buffer … where the staging buffer dominates `.bss`\",\n  which described a design this tree does not have (issue 0782).\n  There is no per-publisher buffer and none of it is in `.bss`:\n  `EmbeddedPublisher::publish` serialises into a per-CALL STACK\n  array of `DEFAULT_TX_BUF` (= `NROS_SUBSCRIPTION_BUFFER_SIZE`,\n  1024 by default), and the runtime's own NULL-slot fallback\n  stages into a 4 KiB stack array and refuses anything larger.\n  The saving is real and it is STACK — which on an MCU with\n  small per-task stacks is the tighter budget of the two — but a\n  reason has to name the thing it is about.\n\n  Callback contract:\n    * `size_cb(*out_total_len, user_ctx)` — write the exact\n      total payload length, in bytes, to `*out_total_len`.\n      Called exactly once per `publish_streamed` invocation.\n    * `chunk_cb(out_buf, cap, *out_written, user_ctx)` —\n      write up to `cap` bytes starting at `out_buf`, then\n      report the count written via `*out_written`. The backend\n      may call `chunk_cb` repeatedly until the total promised\n      by `size_cb` has been delivered. `*out_written == 0`\n      means EOF; the backend tears down the slot.\n\n  Lesson from micro-ROS's\n  `rmw_uros_set_continous_serialization_callbacks`: pass the\n  callbacks per-call rather than binding them to publisher\n  state, so different messages on the same publisher can use\n  different serialisation strategies.\n\n  NULL function pointer = backend doesn't stream; the runtime\n  falls back to a one-shot staging buffer (capped at the\n  configured `NROS_MAX_STREAM_CHUNK`) + `publish_raw`."]
    pub publish_streamed: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *mut rmw_publisher_t,
            size_cb: ::core::option::Option<
                unsafe extern "C" fn(out_total_len: *mut usize, user_ctx: *mut core::ffi::c_void),
            >,
            chunk_cb: ::core::option::Option<
                unsafe extern "C" fn(
                    out_buf: *mut u8,
                    cap: usize,
                    out_written: *mut usize,
                    user_ctx: *mut core::ffi::c_void,
                ),
            >,
            user_ctx: *mut core::ffi::c_void,
        ) -> rmw_ret_t,
    >,
    #[doc = " Phase 124.F.1 — session-level connectivity probe.\n\n  Sends a wire-level round-trip probe (\"is the peer / agent /\n  router still reachable?\") and waits up to `timeout_ms` for\n  a reply. No discovery state required — cheaper than the\n  service-availability probe (which needs matched-publication\n  bookkeeping). Lesson from micro-ROS's\n  `rmw_uros_ping_agent`.\n\n  Returns:\n    * `NROS_RMW_RET_OK` — peer responded within budget.\n    * `NROS_RMW_RET_TIMEOUT` — no reply before `timeout_ms`.\n    * `NROS_RMW_RET_UNSUPPORTED` — backend can't probe (DDS\n      with no participant introspection).\n    * other negative — backend error.\n\n  Implementation notes per backend:\n  - **Zenoh**: `z_send_ping` (or session keep-alive piggyback).\n  - **XRCE**: `uxr_ping_agent_session_until_timeout`.\n  - **DDS**: built-in participant ping if available, else\n    `RET_UNSUPPORTED`.\n\n  NULL function pointer = runtime surfaces\n  `NROS_RMW_RET_UNSUPPORTED` to the caller."]
    pub ping_session: ::core::option::Option<
        unsafe extern "C" fn(session: *mut rmw_session_t, timeout_ms: i32) -> rmw_ret_t,
    >,
    #[doc = " Capability query: does this subscription support process_raw_in_place()?\n  The runtime consults it once at subscription registration to choose\n  in-place dispatch over the buffered (copying) path.\n\n  `*out_supports` is written only on `NROS_RMW_RET_OK` (Phase 376 W3.d\n  step A — capability out, status returned).\n\n  **The capability is the CONJUNCTION** of this probe answering true and\n  `process_raw_in_place` being non-NULL. Either alone is unsupported.\n\n  Why the probe is not redundant with that nullity (issue 0781 proposed\n  deleting it, and this is the counterexample that stopped it):\n  `RustBackendAdapter::<R>::VTABLE` is a `const`, so it installs\n  `process_raw_in_place` for EVERY `R: RustBackend` — the slot is non-NULL\n  whatever the backend can do. The Rust-side answer is a runtime `&self`\n  method (`Subscription::supports_process_in_place`) because\n  `CffiSubscription` multiplexes over whichever backend registered, so it\n  cannot become an associated const the vtable initializer could branch\n  on. Today `nros-rmw-zenoh` says true and `nros-rmw-metadata` takes the\n  `false` default behind an identically-shaped vtable: two backends, same\n  nullity, different capability. Deriving from nullity would route\n  metadata's subscriptions into in-place dispatch and every take would\n  return `MessageTooLarge` from the trait default.\n\n  A C backend that knows its answer at compile time (XRCE says true,\n  Cyclone leaves both NULL) may express it with nullity alone; the\n  conjunction makes that spelling correct without making it the only one.\n\n  NULL function pointer = treated as unsupported (buffered path)."]
    pub subscription_supports_in_place: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *mut rmw_subscription_t,
            out_supports: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Borrow one ready message in place: hand its raw CDR bytes to `cb` (with\n  the opaque `ctx`) for the duration of the call, then release the slot.\n  `cb` MUST NOT re-enter this subscription's receive.\n\n  Deviation from upstream, declared. Avoiding the copy is NOT the reason —\n  upstream already has a name for that, `rmw_take_loaned_message`, and we\n  carry it (`take_loaned_message`). What this shape buys is that the\n  borrow is SCOPED: it ends when `cb` returns, so there is no release\n  token to hold and nothing a caller can forget. Upstream's loan is\n  unscoped — a caller who misses\n  `rmw_return_loaned_message_from_subscription` retires one entry of a\n  fixed-depth receive ring for good, and a target with no reclaim and no\n  swap does not get that entry back. That is the RTOS constraint; \"no\n  copy\" is a property both shapes share.\n\n  Both are carried because they answer different callers: this one serves\n  dispatch from inside the executor, where the callback frame is the\n  natural scope, and the loan pair serves `nros-c` / `nros-cpp`, whose\n  `try_borrow` hands a view back to a caller that outlives the call.\n\n  NULL function pointer = unsupported (the runtime uses the buffered\n  path); see `subscription_supports_in_place` for the conjunction. */\n/** Phase 376 W3.d step A — \"did it process one\" moves to an\n  out-parameter and the return is a plain status.\n\n  This retires `NROS_RMW_RET_NO_DATA` from this slot: an empty\n  subscription is `*out_processed = false` with\n  `NROS_RMW_RET_OK`, which is upstream's `taken = false`\n  semantics. A sentinel that means \"fine, but nothing\" is\n  exactly the shape that makes a status enum ambiguous.\n\n  `*out_processed` is written only on OK."]
    pub process_raw_in_place: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *mut rmw_subscription_t,
            ctx: *mut core::ffi::c_void,
            cb: ::core::option::Option<
                unsafe extern "C" fn(ctx: *mut core::ffi::c_void, message: rmw_byte_span_t),
            >,
            out_processed: *mut bool,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_implementation_identifier`.\n\n  The backend's name, static for the life of the image. A gid is only\n  comparable with another carrying the same identifier, which matters here\n  because `nros_rmw_cffi_register_named` admits several backends at once.\n\n  RESERVED, and NULL in every backend. **There is no runtime fallback**:\n  this doc said the runtime answered with the registry name, and no such\n  code was ever written — nothing in the tree calls this slot, so a NULL\n  one is not \"answered elsewhere\", it is unanswerable. Corrected 2026-08-29\n  (phase-393 W2) after grepping for the promised fallback and finding only\n  this sentence.\n\n  Filling it is NOT what makes the identity correct. The identity that is\n  load-bearing today is the one a backend stamps into `rmw_gid_t`, because\n  `rmw_compare_gids_equal` compares that string before the bytes — so what\n  matters is that a backend has ONE spelling of its name, not that it can\n  be asked for it. Cyclone's `kImplementationIdentifier` is that shape.\n\n  Do not fill this slot to move a counter: `check-rmw-slot-producers`\n  classifies any slot with a producer as `produced` whether or not\n  anything reads it, which is exactly the overstatement issue 0800 exists\n  to catch. It earns a body when a CALLER exists — a bridge image asking\n  which of two linked backends it is on."]
    pub get_implementation_identifier:
        ::core::option::Option<unsafe extern "C" fn() -> *const core::ffi::c_char>,
    #[doc = " Upstream `rmw_get_serialization_format`.\n\n  The backend's wire encoding, as its cross-image identity STRING\n  (RFC-0088 D2: the `u8` discriminant is assigned per image and means\n  nothing outside it; the name is what two images can agree on). Static\n  for the life of the image, like the identifier above.\n\n  PRODUCED by every backend since phase-421 W2. It was reserved until\n  then for a stated reason — \"every backend here speaks CDR, nothing\n  asks, so a body would be parity shape with no reader\" — and both halves\n  of that reason have since stopped being true. uORB's wire is the PX4\n  struct verbatim (RFC-0011), so it answers `\"uorb\"` where every other\n  backend answers `\"cdr\"`; and `nros_rmw_cffi_register_named` admits\n  several backends in one image, so a bridge has two sessions whose\n  formats differ and one compile-time constant cannot describe both.\n  `CffiSession::serialization_format` is the reader.\n\n  This is the ONLY per-session answer. `nros_node::IMAGE_SERIALIZATION_\n  FORMAT` and the generated `NROS_SERIALIZATION_FORMAT` macro are\n  compile-time constants and are meaningful only in a single-backend\n  image; ask the slot whenever the image links more than one.\n\n  NULL slot: the runtime answers NULL — it does NOT guess `\"cdr\"`. A\n  backend that does not declare its format has not told anyone what it\n  speaks, and inventing an answer is how the identifier slot's doc came\n  to promise a fallback nobody had written (corrected phase-393 W2)."]
    pub get_serialization_format:
        ::core::option::Option<unsafe extern "C" fn() -> *const core::ffi::c_char>,
    #[doc = " Upstream `rmw_feature_supported`.\n\n  Whether the backend populates an optional piece of CONTENT — upstream's\n  two values both concern message-info sequence numbers. Deliberately not\n  expressed as slot nullity: a NULL pointer says the backend cannot\n  perform an OPERATION, which is a different question from whether the\n  data an implemented operation returns is populated.\n\n  NULL slot: the runtime answers `false` for every feature."]
    pub feature_supported:
        ::core::option::Option<unsafe extern "C" fn(feature: rmw_feature_t::Type) -> bool>,
    #[doc = " Upstream `rmw_get_gid_for_publisher`. Exact parity.\n\n  The backend zero-pads to the full width; see `rmw_gid_t`."]
    pub get_gid_for_publisher: ::core::option::Option<
        unsafe extern "C" fn(publisher: *const rmw_publisher_t, gid: *mut rmw_gid_t) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_publisher_count_matched_subscriptions`. Exact parity.\n\n  Every backend already tracks this to implement liveliness events — see\n  `service_server_is_available`, which is the same question one entity\n  over. NULL where a backend has no discovery at all (XRCE)."]
    pub publisher_count_matched_subscriptions: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            subscription_count: *mut usize,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_subscription_count_matched_publishers`. Exact parity."]
    pub subscription_count_matched_publishers: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            publisher_count: *mut usize,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_publisher_get_actual_qos`. Exact parity.\n\n  We bake the REQUESTED profile and, until now, never read back the\n  GRANTED one. On DDS the two differ whenever a writer and reader\n  negotiate, and the difference is exactly what answers \"why is nothing\n  arriving\" — so a consumer that cannot ask has to guess.\n\n  PARTIAL ANSWERS ARE ALLOWED (W5/B2). A backend that can determine four\n  policies and not the fifth writes the four it knows and\n  `*_UNKNOWN` for the fifth, then returns `NROS_RMW_RET_OK`. Until the\n  policy values took upstream's numbering there was no `UNKNOWN` to write,\n  so the contract had to be all-or-nothing — a partial answer would have\n  been indistinguishable from a confident one, and W4 chose\n  `NROS_RMW_RET_UNSUPPORTED` over lying.\n\n  `NROS_RMW_RET_UNSUPPORTED` now means what it says: this backend has no\n  read-back at all. It is NOT the answer for \"I know some of it\".\n\n  A caller that treats `UNKNOWN` as a value rather than as an absence gets\n  a wrong comparison, so `rmw_qos_profile_check_compatible` reports it as\n  a WARNING rather than an incompatibility — upstream's\n  `RMW_QOS_COMPATIBILITY_WARNING`, which was unreachable here until there\n  was a sentinel to trigger it.\n\n  Six upstream entry points, six slots, deliberately: the name rule is\n  mechanical so that no alias table has to be authored and kept true.\n  Backends share ONE helper and write six one-line thunks — sharing an\n  implementation is free, sharing an ABI slot is not."]
    pub publisher_get_actual_qos: ::core::option::Option<
        unsafe extern "C" fn(
            publisher: *const rmw_publisher_t,
            qos: *mut rmw_qos_profile_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_subscription_get_actual_qos`. Exact parity."]
    pub subscription_get_actual_qos: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            qos: *mut rmw_qos_profile_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_client_request_publisher_get_actual_qos`. Exact parity.\n\n  The four service/client read-backs carry information available NOWHERE\n  else: `rmw_client_t` and `rmw_service_t` have no `qos` field, and\n  `create_client` / `create_service` take ONE profile for both\n  directions, so the granted per-direction profile is otherwise\n  unobservable."]
    pub client_request_publisher_get_actual_qos: ::core::option::Option<
        unsafe extern "C" fn(client: *const rmw_client_t, qos: *mut rmw_qos_profile_t) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_client_response_subscription_get_actual_qos`."]
    pub client_response_subscription_get_actual_qos: ::core::option::Option<
        unsafe extern "C" fn(client: *const rmw_client_t, qos: *mut rmw_qos_profile_t) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_service_request_subscription_get_actual_qos`."]
    pub service_request_subscription_get_actual_qos: ::core::option::Option<
        unsafe extern "C" fn(
            service: *const rmw_service_t,
            qos: *mut rmw_qos_profile_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_service_response_publisher_get_actual_qos`."]
    pub service_response_publisher_get_actual_qos: ::core::option::Option<
        unsafe extern "C" fn(
            service: *const rmw_service_t,
            qos: *mut rmw_qos_profile_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_publisher_wait_for_all_acked`.\n\n  Blocks until every sample this publisher sent has been acknowledged, or\n  the timeout elapses. Without it an image that publishes and then halts\n  cannot know whether anything left the box.\n\n  Deviation from upstream, declared: `uint32_t timeout_ms` for upstream's\n  by-value `rmw_time_t`. Every duration in this ABI is u32 milliseconds\n  (issue 0241) — one width, one unit, no per-call struct.\n\n  Best-effort backends (zenoh best-effort, XRCE) leave this NULL."]
    pub publisher_wait_for_all_acked: ::core::option::Option<
        unsafe extern "C" fn(publisher: *const rmw_publisher_t, timeout_ms: u32) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_take_with_info`.\n\n  `take` plus the sample's metadata, written to caller-owned storage. See\n  `rmw_message_info_t` for why this is a pointer parameter rather than the\n  side table the runtime uses today.\n\n  Deviations from upstream, declared: the same two `take` declares —\n  bytes (`buf`/`buf_len`/`*out_len`) instead of a typed `void *`, because\n  there is no typesupport on target; and no allocation argument, because\n  nothing in this ABI can produce upstream's opaque\n  `rmw_subscription_allocation_t` — see `take`, which carries the full\n  reason and the two wrong ones that preceded it.\n\n  NULL slot: the runtime falls back to `take`, and the caller gets no\n  metadata — which is exactly today's behaviour for every C backend."]
    pub take_with_info: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            message: *mut rmw_mut_byte_span_t,
            taken: *mut bool,
            message_info: *mut rmw_message_info_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_take_loaned_message_with_info`.\n\n  `take_loaned_message` plus metadata; same deviations as that slot (a\n  byte view and an opaque release token rather than a typed loan)."]
    pub take_loaned_message_with_info: ::core::option::Option<
        unsafe extern "C" fn(
            subscription: *const rmw_subscription_t,
            out_view: *mut rmw_byte_span_t,
            out_token: *mut *mut rmw_loan_token_t,
            taken: *mut bool,
            message_info: *mut rmw_message_info_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_node_names` AND `rmw_get_node_names_with_enclaves`.\n\n  One slot, two upstream names: upstream split them only because appending\n  to a fixed out-parameter list would have broken its ABI. A visitor has\n  no such list, so the enclave is simply a fourth argument, NULL where\n  untracked. Recorded in the checker's grouping table."]
    pub get_node_names: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            visitor: rmw_node_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_topic_names_and_types`."]
    pub get_topic_names_and_types: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            no_demangle: bool,
            visitor: rmw_names_and_types_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_service_names_and_types`."]
    pub get_service_names_and_types: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            visitor: rmw_names_and_types_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_publisher_names_and_types_by_node`."]
    pub get_publisher_names_and_types_by_node: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            node_name: *const core::ffi::c_char,
            node_namespace: *const core::ffi::c_char,
            no_demangle: bool,
            visitor: rmw_names_and_types_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_subscriber_names_and_types_by_node`."]
    pub get_subscriber_names_and_types_by_node: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            node_name: *const core::ffi::c_char,
            node_namespace: *const core::ffi::c_char,
            no_demangle: bool,
            visitor: rmw_names_and_types_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_service_names_and_types_by_node`."]
    pub get_service_names_and_types_by_node: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            node_name: *const core::ffi::c_char,
            node_namespace: *const core::ffi::c_char,
            visitor: rmw_names_and_types_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_client_names_and_types_by_node`."]
    pub get_client_names_and_types_by_node: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            node_name: *const core::ffi::c_char,
            node_namespace: *const core::ffi::c_char,
            visitor: rmw_names_and_types_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_publishers_info_by_topic`."]
    pub get_publishers_info_by_topic: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            topic_name: *const core::ffi::c_char,
            no_mangle: bool,
            visitor: rmw_topic_endpoint_info_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_get_subscriptions_info_by_topic`."]
    pub get_subscriptions_info_by_topic: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            topic_name: *const core::ffi::c_char,
            no_mangle: bool,
            visitor: rmw_topic_endpoint_info_visitor_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_count_publishers`."]
    pub count_publishers: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            topic_name: *const core::ffi::c_char,
            count: *mut usize,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_count_subscribers`."]
    pub count_subscribers: ::core::option::Option<
        unsafe extern "C" fn(
            session: *const rmw_session_t,
            topic_name: *const core::ffi::c_char,
            count: *mut usize,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_node_get_graph_guard_condition`.\n\n  Registers a callback fired when the graph CHANGES. Upstream returns a\n  guard condition the caller adds to a wait set; we have no wait set to\n  add it to, and guard conditions are an executor concept here, so this is\n  the `set_wake_callback` shape instead — the one guard condition whose\n  trigger is genuinely backend knowledge.\n\n  The callback is an EDGE, carrying no payload: delivering WHAT changed\n  would mean buffering it, which is the graph cache a small target cannot\n  afford.\n\n  Named after upstream mechanically, per the campaign's rule, but the\n  honest name for this shape is `set_on_graph_change_callback` — flagged\n  for W5 rather than decided quietly here."]
    pub node_get_graph_guard_condition: ::core::option::Option<
        unsafe extern "C" fn(
            session: *mut rmw_session_t,
            callback: rmw_event_callback_t,
            user_data: *const core::ffi::c_void,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_create_node`.\n\n  Declares a node on the graph. NULL slot is the expected implementation\n  in a static image: the runtime still tracks the node, the backend simply\n  has nothing to declare.\n\n  Deviations from upstream, declared: no `rmw_context_t *` (an image has\n  one session and reaches it directly), and the node is an OUT parameter\n  rather than a returned pointer — no runtime allocation, the caller owns\n  the storage, exactly as `create_publisher` does.\n\n  The runtime calls this once per distinct `(name, namespace_)`."]
    pub create_node: ::core::option::Option<
        unsafe extern "C" fn(
            session: *mut rmw_session_t,
            name: *const core::ffi::c_char,
            namespace_: *const core::ffi::c_char,
            out: *mut rmw_node_t,
        ) -> rmw_ret_t,
    >,
    #[doc = " Upstream `rmw_destroy_node`.\n\n  Releases the backend's `backend_data`; the shell stays valid until its\n  owner drops it. Called for every node the session created, from\n  `close()`, BEFORE `destroy_session` — a backend's node state hangs off\n  its session state, so the order is not free.\n\n  NULL slot: nothing is called and the runtime simply forgets the node.\n  Correct only for a backend that allocates nothing in `create_node`;\n  a backend that fills `backend_data` there must fill this too, or it\n  leaks one node's state per session close (issue 0800 — this slot had a\n  producer in no backend and a consumer nowhere, so the leak was\n  indistinguishable from an optional slot nobody needed)."]
    pub destroy_node:
        ::core::option::Option<unsafe extern "C" fn(node: *mut rmw_node_t) -> rmw_ret_t>,
    #[doc = " Upstream `rmw_set_log_severity`. Exact parity.\n\n  Sets the verbosity of the BACKEND's own logging — Cyclone's `dds_log`,\n  zenoh-pico's log, the XRCE client's. Not `nros_log`: that is the\n  runtime's logger, already runtime-settable through\n  `nros_log::Logger::set_level`, and it needs no ABI to reach.\n\n  This IS a slot rather than a plain ABI function, and the distinction is\n  the one the pure functions turn on: \"what does this middleware print\"\n  genuinely varies by middleware, so a per-backend answer is correct here\n  rather than a defect. All three reference implementations\n  (`librmw_{cyclonedds,fastrtps,zenoh}_cpp.so`) implement it with real\n  bodies, which is the opposite of what they do for\n  `rmw_get_serialized_message_size`.\n\n  Phase 376 W5 — this was DECLINED, on the reasoning that \"log level is a\n  build-time constant (nros_log); a runtime setter implies a mutable\n  global\". Both clauses were false: `Logger::level` is an `AtomicU8` with a\n  public `set_level` already used by tests, and the compile-time part is a\n  CEILING that defaults open. The decline described a design we do not\n  have.\n\n  NULL slot: the backend has no adjustable logging, and the runtime\n  surfaces `UNSUPPORTED`."]
    pub set_log_severity: ::core::option::Option<
        unsafe extern "C" fn(severity: rmw_log_severity_t::Type) -> rmw_ret_t,
    >,
    #[doc = " How many bytes of TAKE buffer this type actually needs, so the runtime\n  can stop sizing `take`'s `buf` from one global constant.\n\n  RTOS addition; upstream has no counterpart. Upstream's nearest thing is\n  `rmw_get_serialized_message_size`, which is about a MESSAGE and which\n  all three reference implementations leave unimplemented; this is about\n  the buffer the CALLER must present, and the answer is the backend's\n  because only the backend knows what its framing, size classes and\n  attachment handling add on top of the payload.\n\n  `type_name` and `type_hash` name the type (both BORROWED for the call;\n  `type_hash` may be NULL exactly as in `create_subscription`). `hint` is\n  the same number the runtime would put in\n  `rmw_subscription_options_t.rx_buffer_hint`, and carries the same\n  meaning, including that `0` says the CALLER stated nothing rather than\n  that the type is unbounded — every message type has a derived bound or\n  the build fails. On `NROS_RMW_RET_OK`, `*out_bytes` is the MINIMUM\n  take-buffer length that is sufficient for this type at this hint: a\n  `take` given that many bytes must not fail for want of room, and no\n  smaller number has that property. It may exceed `hint` — a backend that\n  frames or pads says so here rather than discovering it at `take` time —\n  and it may be smaller.\n\n  MINIMUM, tightened in phase-403 W4, and the word carries the whole\n  value of the slot. A backend that keeps size CLASSES may not answer with\n  the class it would round this type up to. Doing so is arithmetically\n  safe and useless: a 68-byte type and a 1000-byte type sharing a class\n  come back with one number, which is the global-constant answer the\n  runtime already had without asking, and the runtime would spend the\n  difference on every subscription in the image. Report what the type\n  needs; the rounding is the backend's own business and stays there.\n  If a backend genuinely cannot separate the two — its framing really\n  does make the class size the floor — then the class size IS the\n  minimum and answering it is correct; what is forbidden is reporting a\n  rounding as though it were a requirement.\n\n  This is a QUERY about a type, not about an entity: it is answerable\n  before any subscription exists, which is the point — the runtime has to\n  size the buffer in order to create one.\n\n  NULL slot: FALLBACK class (RFC-0035's NULL-slot contract) — THE HINT IS\n  THE ANSWER, never `UNSUPPORTED` to the caller. The runtime uses `hint`,\n  and since a type without a derived bound is a build error, that is a\n  real number rather than a fallback to a configured default. A backend\n  that cannot answer for a PARTICULAR type returns\n  `NROS_RMW_RET_UNSUPPORTED` and leaves `*out_bytes` untouched; the\n  runtime falls back to the hint exactly as for a NULL slot.\n\n  OPTIONAL on the merits, not for compatibility. nano-ros is unreleased\n  and this ABI may be broken, so \"a mandatory slot breaks every\n  out-of-tree backend\" is not the reason and must not be cited as one.\n  Three reasons that survive without it:\n\n  - A SLOT CANNOT BE REQUIRED BEFORE SOMETHING DISPATCHES IT. Required\n    here means `first_missing_vtable_slot` REFUSES to register a backend\n    that leaves it NULL, and `check-rmw-required-slots.sh` holds that set\n    equal to the set the runtime `.expect()`s. Nothing calls this yet —\n    phase-403 W3/W5 own the dispatch site — so requiring it now would\n    refuse working backends over a function no caller reaches. That is\n    issue 0349 exactly, and it cost three backends their registration\n    once. (W4 filled the slot for zenoh-pico, which makes the slot\n    PRODUCED; it is the CONSUMER that decides whether required is\n    reachable, and there is still none.)\n  - \"NO OPINION\" IS A REAL ANSWER, and mandatory does not delete it, only\n    relocates it: five in-tree backends would each carry the same\n    `*out_bytes = hint; return OK;` body, and the Rust ones would get it\n    from a defaulted `RustBackend` trait method — the same special case,\n    one layer up and less visible.\n  - IT IS SLOT 75, AND TWO BACKENDS INITIALISE POSITIONALLY. uORB's\n    C++14 initialiser stops at slot 17 and positional initialisation\n    cannot skip, so reaching a mandatory slot 75 means writing 58\n    meaningless entries to get there.\n\n  Promotion stays cheap and stays open: making this required later is a\n  change to the registration check, not to the struct.\n\n  DECIDED 2026-08-31: this slot stays OPTIONAL permanently. Phase-403 W4\n  recommended it after filling the slot for zenoh-pico, and that is now a\n  ruling rather than a recommendation, so promotion is off the table\n  unless the reason below stops being true.\n  The first argument above dissolves once a dispatch site exists, but the\n  other two do not, and they are the load-bearing ones: cyclonedds and\n  XRCE keep ONE receive buffer, so \"no opinion\" is their true answer and\n  requiring the slot only relocates it into identical bodies; and slot 75\n  is out of reach of uORB's positional C++14 initialiser whatever the\n  registration check says. A slot that most backends must fill with a\n  restatement of the default is worse than a NULL whose meaning the\n  header pins down, which this one does.\n\n  It does not weaken `take`'s obligation. The runtime may pass a `buf_len`\n  smaller than what this returned — it has its own memory to answer to —\n  and a sample that does not fit is still a reported failure rather than\n  a truncated success. Answering here is how a backend avoids that\n  outcome, not how it licenses one."]
    pub required_rx_bytes: ::core::option::Option<
        unsafe extern "C" fn(
            type_name: *const core::ffi::c_char,
            type_hash: *const core::ffi::c_char,
            hint: usize,
            out_bytes: *mut usize,
        ) -> rmw_ret_t,
    >,
}
#[doc = " Runtime-pluggable custom transport. The runtime never\n dereferences `user_data`; it's the caller's per-transport\n context, threaded back into every callback's first argument.\n\n THIS declaration is the ABI single source of truth (RFC-0054): Rust\n consumes the committed bindgen output of this header, and\n `nros_rmw::NrosTransportOps` is the hand-written Rust-side view kept in\n lockstep with it — not the other way round. The previous wording had that\n backwards (issue 0331). Layout equivalence is asserted on both sides: see\n `nros_transport_ops_t` in `nros-rmw-cffi/tests/c_stubs/abi_layout_check.c`\n and the `const _` size/align block beside\n `nros_rmw_cffi_set_custom_transport` in `nros-rmw-cffi/src/lib.rs`. Same\n layout, same threading contract, same return codes."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct nros_transport_ops_s {
    #[doc = " ABI version. MUST equal `NROS_TRANSPORT_OPS_ABI_VERSION_V1`.\n Any other value is rejected at registration time with\n `NROS_RMW_RET_INCOMPATIBLE_ABI`."]
    pub abi_version: u32,
    #[doc = " Reserved padding for alignment stability across appends.\n Set to zero."]
    pub _reserved: u32,
    #[doc = " Opaque caller context, threaded back into every callback.\n Lifetime: must outlive the transport's active period\n (i.e. until `close` returns)."]
    pub user_data: *mut core::ffi::c_void,
    #[doc = " Open the underlying medium.\n\n @param user_data Caller-supplied context.\n @param params Opaque per-transport metadata (e.g. UART baud\n               rate, USB-CDC endpoint id). May be NULL.\n @retval NROS_RMW_RET_OK on success.\n @retval <0 on failure (any `rmw_ret_t` error code)."]
    pub open: ::core::option::Option<
        unsafe extern "C" fn(
            user_data: *mut core::ffi::c_void,
            params: *const core::ffi::c_void,
        ) -> i32,
    >,
    #[doc = " Tear the transport down. After `close` returns, the runtime\n will not invoke `read` or `write` on this transport unless\n `nros_set_custom_transport` is called again."]
    pub close: ::core::option::Option<unsafe extern "C" fn(user_data: *mut core::ffi::c_void)>,
    #[doc = " Send `len` bytes from `buf`. Must NOT block beyond a brief\n hardware retry; long blocking should surface as\n `NROS_RMW_RET_TIMEOUT`.\n\n @retval NROS_RMW_RET_OK on success.\n @retval <0 on failure (any `rmw_ret_t` error code)."]
    pub write: ::core::option::Option<
        unsafe extern "C" fn(user_data: *mut core::ffi::c_void, buf: *const u8, len: usize) -> i32,
    >,
    #[doc = " Receive up to `len` bytes into `buf` within `timeout_ms`.\n\n @retval >=0 number of bytes read (may be less than `len`).\n @retval <0 on error / timeout (any `rmw_ret_t` error\n            code)."]
    pub read: ::core::option::Option<
        unsafe extern "C" fn(
            user_data: *mut core::ffi::c_void,
            buf: *mut u8,
            len: usize,
            timeout_ms: u32,
        ) -> i32,
    >,
}
pub const NROS_RMW_RET_EXTENSION_BASE: i32 = 1000;
pub const NROS_RMW_RET_OK: i32 = 0;
pub const NROS_RMW_RET_ERROR: i32 = 1;
pub const NROS_RMW_RET_TIMEOUT: i32 = 2;
pub const NROS_RMW_RET_BAD_ALLOC: i32 = 10;
pub const NROS_RMW_RET_INVALID_ARGUMENT: i32 = 11;
pub const NROS_RMW_RET_UNSUPPORTED: i32 = 3;
pub const NROS_RMW_RET_INCOMPATIBLE_QOS: i32 = 1000;
pub const NROS_RMW_RET_TOPIC_NAME_INVALID: i32 = 1001;
pub const NROS_RMW_RET_NODE_NAME_NON_EXISTENT: i32 = 203;
pub const NROS_RMW_RET_LOAN_NOT_SUPPORTED: i32 = 1002;
pub const NROS_RMW_RET_NO_DATA: i32 = 1003;
pub const NROS_RMW_RET_WOULD_BLOCK: i32 = 1004;
pub const NROS_RMW_RET_BUFFER_TOO_SMALL: i32 = 1005;
pub const NROS_RMW_RET_MESSAGE_TOO_LARGE: i32 = 1006;
pub const NROS_RMW_RET_INCOMPATIBLE_ABI: i32 = 1007;
pub const NROS_RMW_RET_NO_BACKEND: i32 = 1008;
pub const NROS_RMW_RET_AMBIGUOUS_BACKEND: i32 = 1009;
pub const NROS_RMW_RET_UNKNOWN_BACKEND: i32 = 1010;
pub const NROS_RMW_RET_CONNECTION_FAILED: i32 = 1011;
pub const NROS_RMW_RET_INVALID_CONFIG: i32 = 1012;
pub const NROS_RMW_RET_INCORRECT_RMW_IMPLEMENTATION: i32 = 12;
pub const NROS_RMW_RELIABILITY_SYSTEM_DEFAULT: i32 = 0;
pub const NROS_RMW_RELIABILITY_RELIABLE: i32 = 1;
pub const NROS_RMW_RELIABILITY_BEST_EFFORT: i32 = 2;
pub const NROS_RMW_RELIABILITY_UNKNOWN: i32 = 3;
pub const NROS_RMW_DURABILITY_SYSTEM_DEFAULT: i32 = 0;
pub const NROS_RMW_DURABILITY_TRANSIENT_LOCAL: i32 = 1;
pub const NROS_RMW_DURABILITY_VOLATILE: i32 = 2;
pub const NROS_RMW_DURABILITY_UNKNOWN: i32 = 3;
pub const NROS_RMW_HISTORY_SYSTEM_DEFAULT: i32 = 0;
pub const NROS_RMW_HISTORY_KEEP_LAST: i32 = 1;
pub const NROS_RMW_HISTORY_KEEP_ALL: i32 = 2;
pub const NROS_RMW_HISTORY_UNKNOWN: i32 = 3;
pub const RMW_GID_STORAGE_SIZE: i32 = 24;
pub const RMW_INET_ADDRSTRLEN: i32 = 48;
pub const NROS_RMW_DURATION_INFINITE_MS: i64 = 4294967295;
pub const RMW_SESSION_MAX_PROPERTIES: i32 = 16;
pub const NROS_RMW_VISITOR_DEFINED: i32 = 1;
#[doc = " Borrow-shaped union the backend supplies to the registered\n  callback. The `kind` argument selects which member is valid."]
#[repr(C)]
#[derive(Copy, Clone)]
pub union rmw_event_payload_t {
    pub liveliness_changed: rmw_liveliness_changed_status_t,
    pub count: rmw_count_status_t,
}
pub mod rmw_feature_t {
    #[doc = " Upstream `rmw_feature_t` — an optional piece of CONTENT a backend may or may\n  not populate. Upstream defines exactly these two, both about whether\n  message-info sequence numbers are real. Values mirror upstream's."]
    pub type Type = core::ffi::c_uint;
    pub const RMW_FEATURE_MESSAGE_INFO_PUBLICATION_SEQUENCE_NUMBER: Type = 0;
    pub const RMW_FEATURE_MESSAGE_INFO_RECEPTION_SEQUENCE_NUMBER: Type = 1;
}
pub mod rmw_liveliness_kind_t {
    #[doc = " Liveliness kind values for `rmw_qos_profile_t::liveliness_kind`.\n\n  Upstream's numbering (W5/B2). `MANUAL_BY_NODE` and `MANUAL_BY_TOPIC` were\n  SWAPPED here until 2026-08-24 — 2 meant BY_TOPIC to us and BY_NODE to\n  upstream — which the cyclonedds backend then translated into a real DDS\n  liveliness kind a ROS peer matches on."]
    pub type Type = core::ffi::c_uint;
    #[doc = " Let the middleware choose. Spelled `NONE` before W5/B2 and used the same\n  way: nothing is asserted and nothing is tracked. Upstream has no\n  separate `NONE`, so the two collapse onto value 0."]
    pub const NROS_RMW_LIVELINESS_SYSTEM_DEFAULT: Type = 0;
    #[doc = " Backend's keepalive task asserts liveliness automatically."]
    pub const NROS_RMW_LIVELINESS_AUTOMATIC: Type = 1;
    #[doc = " Application calls `assert_liveliness()` at the node level."]
    pub const NROS_RMW_LIVELINESS_MANUAL_BY_NODE: Type = 2;
    #[doc = " Application calls `assert_liveliness()` per topic explicitly."]
    pub const NROS_RMW_LIVELINESS_MANUAL_BY_TOPIC: Type = 3;
    #[doc = " The backend could not determine this policy."]
    pub const NROS_RMW_LIVELINESS_UNKNOWN: Type = 4;
}
pub mod rmw_qos_compatibility_type_t {
    #[doc = " Verdict of a QoS compatibility check. Upstream `rmw_qos_compatibility_type_t`,\n  values included.\n\n  `WARNING` means \"compatible as far as could be checked, but at least one\n  policy on one side is `*_UNKNOWN`\" — the backend could not read it back.\n  Reachable since W5/B2 gave the policies an UNKNOWN encoding; it was defined\n  and unreachable before that, so the value could not be reused for anything\n  else in the meantime.\n\n  A definite clash OUTRANKS an unknown: if the policies that COULD be compared\n  are already incompatible the verdict is `ERROR`, because softening it to a\n  warning would hide something the caller can act on."]
    pub type Type = core::ffi::c_uint;
    pub const RMW_QOS_COMPATIBILITY_OK: Type = 0;
    pub const RMW_QOS_COMPATIBILITY_WARNING: Type = 1;
    pub const RMW_QOS_COMPATIBILITY_ERROR: Type = 2;
}
pub mod nros_rmw_qos_clash_t {
    #[doc = " Which policies clashed, as a bitmask. A nano-ros extension: upstream reports\n  the reason only as prose, which a target cannot act on."]
    pub type Type = core::ffi::c_uint;
    pub const NROS_RMW_QOS_CLASH_NONE: Type = 0;
    pub const NROS_RMW_QOS_CLASH_RELIABILITY: Type = 1;
    pub const NROS_RMW_QOS_CLASH_DURABILITY: Type = 2;
    pub const NROS_RMW_QOS_CLASH_DEADLINE: Type = 4;
    pub const NROS_RMW_QOS_CLASH_LIVELINESS_KIND: Type = 8;
    pub const NROS_RMW_QOS_CLASH_LIVELINESS_LEASE: Type = 16;
}
pub mod rmw_log_severity_t {
    #[doc = " Log severity — upstream `rmw_log_severity_t`, values included.\n\n  The values are `rcutils`' ladder (`DEBUG 10`, `INFO 20`, …), not a dense\n  0..N, so they are written out rather than renumbered: a caller that has an\n  `rcutils` severity in hand can pass it straight through.\n\n  There is no `TRACE`. `nros_log::Severity` has one, and it maps to `DEBUG`\n  crossing this seam — losing a distinction upstream never had is better than\n  inventing a value a ROS-side caller cannot produce."]
    pub type Type = core::ffi::c_uint;
    pub const RMW_LOG_SEVERITY_UNSET: Type = 0;
    pub const RMW_LOG_SEVERITY_DEBUG: Type = 10;
    pub const RMW_LOG_SEVERITY_INFO: Type = 20;
    pub const RMW_LOG_SEVERITY_WARN: Type = 30;
    pub const RMW_LOG_SEVERITY_ERROR: Type = 40;
    pub const RMW_LOG_SEVERITY_FATAL: Type = 50;
}
pub mod rmw_endpoint_type_t {
    #[doc = " Which end of a topic an endpoint is — upstream `rmw_endpoint_type_t`."]
    pub type Type = core::ffi::c_uint;
    pub const RMW_ENDPOINT_INVALID: Type = 0;
    pub const RMW_ENDPOINT_PUBLISHER: Type = 1;
    pub const RMW_ENDPOINT_SUBSCRIPTION: Type = 2;
}
pub mod rmw_transport_protocol_t {
    #[doc = " Transport protocol of a network flow — upstream `rmw_transport_protocol_t`,\n  values included."]
    pub type Type = core::ffi::c_uint;
    pub const RMW_TRANSPORT_PROTOCOL_UNKNOWN: Type = 0;
    pub const RMW_TRANSPORT_PROTOCOL_UDP: Type = 1;
    pub const RMW_TRANSPORT_PROTOCOL_TCP: Type = 2;
    pub const RMW_TRANSPORT_PROTOCOL_COUNT: Type = 3;
}
pub mod rmw_internet_protocol_t {
    #[doc = " Internet protocol of a network flow — upstream `rmw_internet_protocol_t`."]
    pub type Type = core::ffi::c_uint;
    pub const RMW_INTERNET_PROTOCOL_UNKNOWN: Type = 0;
    pub const RMW_INTERNET_PROTOCOL_IPV4: Type = 1;
    pub const RMW_INTERNET_PROTOCOL_IPV6: Type = 2;
    pub const RMW_INTERNET_PROTOCOL_COUNT: Type = 3;
}
pub mod rmw_event_type_t {
    #[doc = " Tier-1 event kinds. Stable integer values; future kinds (Tier-2)\n  extend the enum at end."]
    pub type Type = core::ffi::c_uint;
    #[doc = " Subscriber: a tracked publisher's liveliness state changed."]
    pub const NROS_RMW_EVENT_LIVELINESS_CHANGED: Type = 0;
    #[doc = " Subscriber: an expected sample didn't arrive within the\n  configured deadline."]
    pub const NROS_RMW_EVENT_REQUESTED_DEADLINE_MISSED: Type = 1;
    #[doc = " Subscriber: backend dropped a sample (overflow / etc.)."]
    pub const NROS_RMW_EVENT_MESSAGE_LOST: Type = 2;
    #[doc = " Publisher: this publisher missed its own liveliness assertion."]
    pub const NROS_RMW_EVENT_LIVELINESS_LOST: Type = 3;
    #[doc = " Publisher: this publisher promised X Hz, fell behind."]
    pub const NROS_RMW_EVENT_OFFERED_DEADLINE_MISSED: Type = 4;
}
pub mod nros_rmw_session_mode_t {
    #[doc = " Session mode for `create_session`'s @p mode parameter (issue 0331).\n\n These values were previously an undocumented bare `uint8_t` with no legal-\n value list — the only slot in the vtable without one — encoded inline as\n `0u8` / `1u8` at the Rust boundary.\n\n Divergence from `rmw.h`, recorded deliberately: Humble's\n `rmw_init_options_t` carries `instance_id`, `implementation_identifier`,\n `domain_id`, `security_options`, `localhost_only`, `enclave`, `allocator`\n and `impl` — and has NO session-mode concept. (This list said \"domain_id,\n enclave, security_options and discovery_options\" until 2026-08-24, which\n omitted five of the eight and named one, `discovery_options`, that is an\n IRON field and does not exist in the distro our recorded contract is taken\n from. What we do and do not carry from those eight is issue 0785.) This parameter is closest to zenoh's `whatami`, and a\n backend that has no such notion (cyclonedds, XRCE) is expected to IGNORE it\n rather than fail. Folding it into backend-private config behind the locator\n — so the agnostic vtable stops carrying a backend-shaped field — is the\n structural fix, and is not done here; see issue 0808. (This said \"see issue\n 0331\" until 2026-08-26. That issue documented this enum and stated in its own\n resolution that the structural half was NOT done, deferring it to issue 0330\n part 3 — which resolved a different concern entirely. Both are closed, so the\n fold was tracked by nothing; 0808 is its home.)"]
    pub type Type = core::ffi::c_uint;
    #[doc = " Connect to a router/agent as a client. The default."]
    pub const NROS_RMW_SESSION_MODE_CLIENT: Type = 0;
    #[doc = " Peer-to-peer, no router. Backends without a peer mode ignore this."]
    pub const NROS_RMW_SESSION_MODE_PEER: Type = 1;
}
unsafe extern "C" {
    #[doc = " Which policies of `offered` (a publisher's) and `requested` (a\n  subscription's) are incompatible, as a bitmask — no strings, so an image\n  that only needs the verdict never links the reason table.\n\n  Argument order is upstream's: publisher profile first.\n\n  Writes `*compatibility` and `*clash_mask` on `NROS_RMW_RET_OK`;\n  `NROS_RMW_RET_INVALID_ARGUMENT` if either out-parameter is NULL."]
    pub fn nros_rmw_qos_incompatibility_mask(
        offered: rmw_qos_profile_t,
        requested: rmw_qos_profile_t,
        compatibility: *mut rmw_qos_compatibility_type_t::Type,
        clash_mask: *mut u32,
    ) -> rmw_ret_t;
}
unsafe extern "C" {
    #[doc = " Upstream `rmw_qos_profile_check_compatible`. Exact parity.\n\n  `reason` may be NULL with `reason_size` 0 — the create-time path, which\n  wants the verdict and nothing else.\n\n  The reason is SELECTED, never FORMATTED: each clash bit maps to one\n  `static const char[]` and they are appended by a bounded copy. Upstream's\n  implementations use `snprintf`, which would drag the printf engine into\n  images that deliberately excluded it.\n\n  Truncation is NOT failure: the buffer is always NUL-terminated and the\n  verdict is still written. Returning `BUFFER_TOO_SMALL` would make a\n  small-buffer caller lose the load-bearing half of the answer."]
    pub fn rmw_qos_profile_check_compatible(
        publisher_profile: rmw_qos_profile_t,
        subscription_profile: rmw_qos_profile_t,
        compatibility: *mut rmw_qos_compatibility_type_t::Type,
        reason: *mut core::ffi::c_char,
        reason_size: usize,
    ) -> rmw_ret_t;
}
unsafe extern "C" {
    #[doc = " Upstream `rmw_compare_gids_equal`. Exact parity.\n\n  Equal means the same `implementation_identifier` AND the same 24 bytes. Gids\n  from different backends are never equal — which matters more here than\n  upstream, because `nros_rmw_cffi_register_named` admits several backends in\n  one image.\n\n  Comparison is over the WHOLE array, so a producer must zero-pad; see\n  `rmw_gid_t`."]
    pub fn rmw_compare_gids_equal(
        gid1: *const rmw_gid_t,
        gid2: *const rmw_gid_t,
        result: *mut bool,
    ) -> rmw_ret_t;
}
unsafe extern "C" {
    #[doc = " Register a custom RMW backend under the implicit name \"default\".\n  Legacy single-arg form retained for source compatibility with\n  backend ctors authored before the named registry (Phase 104.B.2).\n\n  Deprecated (Phase 128.B.5): every in-tree backend now calls\n  `nros_rmw_cffi_register_named` with its canonical name. The\n  unnamed shim will be removed in a follow-up phase.\n  Returns NROS_RMW_RET_OK."]
    pub fn nros_rmw_cffi_register(vtable: *const nros_rmw_vtable_t) -> rmw_ret_t;
}
unsafe extern "C" {
    #[doc = " Phase 104.B.2 — register a backend under a stable name. Multiple\n  backends can coexist (bridge nodes); consumers select via\n  `nros_rmw_cffi_lookup` or the higher-level\n  `Executor::node_builder(...).rmw(...)` path.\n\n  Names: UTF-8, NUL-terminated, ≤ 31 bytes (excluding NUL).\n  Reserved: \"zenoh\", \"dds\", \"xrce\", \"cyclonedds\", future \"uorb\".\n  \"default\" is the implicit name used by `nros_rmw_cffi_register`.\n\n  Duplicate registration of the same name overwrites the previous\n  vtable (idempotent for ctor-fires-twice).\n\n  Returns:\n    * NROS_RMW_RET_OK on success.\n    * NROS_RMW_RET_INVALID_ARGUMENT if name or vtable is NULL,\n      the name is empty, or exceeds 31 bytes.\n    * NROS_RMW_RET_ERROR if the registry is full\n      (NROS_RMW_MAX_BACKENDS reached)."]
    pub fn nros_rmw_cffi_register_named(
        name: *const core::ffi::c_char,
        vtable: *const nros_rmw_vtable_t,
    ) -> rmw_ret_t;
}
unsafe extern "C" {
    #[doc = " Look up a backend's vtable by name. Returns NULL if no backend is\n  registered under `name`. The returned pointer is valid for the\n  program's lifetime."]
    pub fn nros_rmw_cffi_lookup(name: *const core::ffi::c_char) -> *const nros_rmw_vtable_t;
}
unsafe extern "C" {
    #[doc = " Diagnostic helper — fills `buf` with pointers to up to `cap`\n  registered backend names. Returns the total number of registered\n  backends (may exceed `cap`; caller can re-query with a larger\n  buffer). Pointer-valid for the program's lifetime. Pass\n  `buf=NULL, cap=0` to query the count only."]
    pub fn nros_rmw_cffi_registered_names(buf: *mut *const core::ffi::c_char, cap: usize) -> usize;
}
unsafe extern "C" {
    #[doc = " Install a custom transport for subsequent session opens.\n\n The struct's contents are copied internally; the caller may\n stack-allocate. To clear the slot, pass NULL.\n\n The fn pointer is exported from the nano-ros C staticlib\n (`packages/api/nros-c/`), where it forwards to the\n `nros-rmw-cffi` registry. C++ consumers should include\n `<nros/transport.hpp>` (from `nros-cpp`) which calls this\n function under the hood.\n\n @retval NROS_RMW_RET_OK on success (transport installed or\n         cleared).\n @retval NROS_RMW_RET_INCOMPATIBLE_ABI when `ops` is non-NULL but\n         `ops->abi_version` does not match\n         `NROS_TRANSPORT_OPS_ABI_VERSION_V1`. The previously\n         installed transport (if any) is left untouched."]
    pub fn nros_rmw_cffi_set_custom_transport(ops: *const nros_transport_ops_t) -> rmw_ret_t;
}