Module wire 

CTB point-to-point slots: what a sender writes into a receiver’s memory and how the receiver reads it back (U21, U22).

Problem. uBFT’s tail-p2p receiver copies size bytes, a field the remote writes, into a local buffer without checking it (U21). Its sender checks a payload against the slot size including the header, so a payload a header’s worth too long overruns into the next slot (U22).

Idea. A slot is one fixed record, written as a tagged subslot (crate::register): every word carries the write’s tag, so a read that races a write is seen as torn, never as a value. The record is

word 0: kind (1 data, 2 echo, 3 signature)
word 1: length in body words (32 bits, as the remote wrote it)
word 2: index
words 3 .. 3 + BODY: the body

• The sender checks the body length against the body capacity for the kind (data: P; echo: exactly 7, the 28-byte digest; signature: exactly 16), never against the slot size, and writes nothing when it is refused.
• The receiver parses the fixed record. The length is compared, as 32 bits, with the capacity before any body word is used; body words past the length are zeroed. A refused record is a typed result for the source, not a copy.

Slot k of a ring of T holds sequence numbers k, k + T, ...; its incarnation advances by one per write (as the tags require).

Modules

kind

Record kinds.

status

Parse results.

Structs

Parsed

A parsed slot.

Constants

BODY

Body words.

ECHO_WORDS

Words of an echo body and a signature body.

REC

Record words.

SIG_WORDS

Words of a signature body.

SLOT

Slot words (a tagged subslot of REC words).

Functions

capacity

The body capacity for a kind (0 for an unknown kind).

encode

The sender’s side: the slot words for a record, or false (and nothing to write) if the length does not fit the kind.

length_ok

Whether a body length is exact for its kind: data up to P, echoes and signatures exactly their size.

parse

The receiver’s side: classify the slot read against the incarnation expected there. No body word is used unless the record is whole and its kind and length are valid.