Module register_reader 

Reading a replicated register: recovery layer 2, the reader (docs/rhdl_ubft-recovery-design.md, docs/rhdl_ubft-host-generation.md).

Problem. A register lives on every memory host. A read must return a value no older than the last write that completed before it started (uBFT §6.1), never a mix of two writes, and never wait on one crashed host.

Idea. As in uBFT: ask every host for both subslots, use the first ⌊n/2⌋ + 1 answers (they intersect the writer’s majority), decode each host’s pair with select_register, which picks the higher physical generation within that host, and keep the answer with the highest logical incarnation across hosts (payload word 0, as the host packs it; physical counters of different hosts are never compared). For hardware:

• Age bound. A sample counts only if its whole span, from the attempt’s start to the last answer used, is strictly less than cooldown cycles. The age saturates and is checked on every busy cycle into a latch, so it cannot wrap. A slower sample is discarded and the read retried. With the host’s cooldown starting at visibility, such a read overlaps at most one write of the register.
• Per-host channels. A request offered to a host is held unchanged until that host takes it, even if the attempt it belongs to has ended; a stalled host never holds up the others.
• Attempt identity. A request carries the session, register and a 64-bit attempt id, never reused. An answer counts only if all three match the current attempt, so a delayed answer from a discarded attempt never counts. Exhausting the id space fails closed.

Boundaries. Answers must come from the trusted transport with the host’s identity from the ingress. If too many hosts are down, a read waits. No regular-register claim is made until writer, reader and host path are integrated and reviewed together.

Structs

HostAnswer

A host’s answer.

HostRead

A request offered to one host: both subslots of a register.

ObservedReaderOut

Opt-in observation ports; the existing reader ports remain unchanged.

ObservedReaderState

Attempt-local evidence alongside the unchanged value-selection state.

ReaderConfig

One-time configuration.

ReaderIn

Inputs of the reader.

ReaderOut

Outputs of the reader. P is the payload width: word 0 is the logical incarnation, the rest the value.

ReaderState

The reader’s registers.

ReaderTieReport

Qualified observations for exactly one completed, young read attempt. valid gates the identity and both host masks; an expired sample never produces a report. Consumers must choose their fault policy explicitly. This is an unbackpressured pulse coincident with reader.done: a consumer must capture both together or provide its own output buffering.

Constants

MAX_HOSTS

Most memory hosts.

Functions

observed_reader_step

Detect ties without changing the adopted R-32 selection policy. This is an explicit opt-in API: callers of reader_step still receive only values.

reader_step

The reader, one cycle. S is the subslot width, subslot_words(P).