Checkpoint Rendezvous

Bounded cross-channel synchronization for distributed vital channels. More...

Files
file	src/redundancy/checkpoint/sapi_checkpoint.c
	Implementation of the bounded checkpoint rendezvous (ADR-017).

Data Structures
struct	sapi_checkpoint_config_t
	Checkpoint configuration. More...

Functions
sapi_status_t	sapi_channel_checkpoint (sapi_voter_t *voter, const sapi_checkpoint_config_t *config)
	Performs one bounded checkpoint rendezvous across every channel registered with a voter.

Detailed Description

Bounded cross-channel synchronization for distributed vital channels.

REQ-CHECKPOINT-001: sapi_channel_checkpoint() shall never block longer than config->max_delay_ms. REQ-CHECKPOINT-002: a checkpoint-arrival reply that fails CRC verification or carries a different checkpoint_id shall not count toward expected_node_count. REQ-CHECKPOINT-003: if fewer than expected_node_count valid replies arrive within max_delay_ms, sapi_channel_checkpoint() shall call sapi_safestate_enter() at SAPI_SAFESTATE_LEVEL_SAFE with SAPI_SAFESTATE_REASON_CHECKPOINT_TIMEOUT before returning SAPI_STATUS_TIMEOUT.

Function Documentation

sapi_channel_checkpoint()

sapi_status_t sapi_channel_checkpoint	(	sapi_voter_t *	voter,
		const sapi_checkpoint_config_t *	config )

Performs one bounded checkpoint rendezvous across every channel registered with a voter.

Broadcasts a checkpoint-arrival message (config->checkpoint_id) to every one of voter's registered channels (via each channel's own sapi_channel_send()), then polls each channel's sapi_channel_receive() bounded by config->max_delay_ms, counting only replies that pass sapi_checksum_vital_message_verify() and carry the matching checkpoint_id. This is direct per-channel I/O, not a sapi_voter_send()/_receive() voting round - checkpoint messages are rendezvous markers, not data to vote on.

Parameters

voter	Voter with 1+ channels already registered (sapi_voter_register_channel()). Must not be NULL.
config	Checkpoint configuration. Must not be NULL.

Returns

SAPI_STATUS_OK if at least config->expected_node_count valid confirmations arrived within config->max_delay_ms (the optional watchdog, if any, has been kicked at least once - once per internal retry round, plus once more on this success).

SAPI_STATUS_INVALID_PARAM if voter or config is NULL, or config->expected_node_count exceeds voter's registered channel count.

SAPI_STATUS_TIMEOUT if fewer than expected_node_count valid confirmations arrived in time.

Precondition

voter != NULL, config != NULL

Postcondition

On SAPI_STATUS_TIMEOUT, sapi_safestate_enter() has already been called at SAPI_SAFESTATE_LEVEL_SAFE with SAPI_SAFESTATE_REASON_CHECKPOINT_TIMEOUT before this function returns (REQ-CHECKPOINT-003) - the same "safe-state is triggered automatically by the sync/vote logic itself" pattern sapi_voter_receive() already uses on a voting disagreement.

Safety:

No dynamic memory allocation. Never blocks longer than config->max_delay_ms (REQ-CHECKPOINT-001).

Definition at line 198 of file sapi_checkpoint.c.