feat(rtps): endpoint priority — banded channels, dedicated SEDP-advertised ports, deferred dispatch (phase 2)

[finger563]

Description

Phase 2 of priority-aware scheduling (#735 was phase 1): wires espp::QosBand into the RTPS stack so a high-priority subscriber/service actually preempts lower-priority traffic, end to end — from the socket to the user callback. Wire format is untouched (goldens byte-identical); the two intentional default-behavior changes are called out below.

Per-channel transport bands

rtps::ChannelOptions{band, dscp} on the transport's receive ports; DomainConfig{metatraffic_band, user_traffic_band, enable_dedicated_endpoint_ports, max_prioritized_endpoint_ports} exposed on RtpsParticipant::Config. Metatraffic (SPDP/SEDP) now dispatches at QosBand::High by default so discovery stays responsive under user-traffic floods. Two intentional default-behavior changes (everything else is opt-in): (1) this metatraffic elevation, and (2) the transport worker-pool queue is now bounded (64 jobs) instead of unbounded — under sustained overload a submission is rejected (real backpressure the reactor and the deferred/guaranteed retry paths recover from losslessly) rather than growing an unbounded heap backlog. This only changes behavior under extreme overload.

Per-endpoint priority via dedicated ports (the real enabler)

All user traffic for a participant normally shares ONE unicast port (demux happens in-engine), so socket-level priority alone can't distinguish endpoints. An endpoint configured with a non-default band (or a dscp) now gets:

• its own UDP port at 7400 + 250·domain + 100 + n (linear-probed, reuse-disabled bind; standard ports stay below the +100 offset for participant ids 0–44, and the range stays inside the domain's port block), registered on the reactor at the endpoint's band and optionally DSCP-marked (Socket::set_dscp);
• its SEDP announcement carrying that port via the standard PID_UNICAST_LOCATOR (already parsed/serialized by the engine — no new wire construct), which FastDDS/ROS 2 honor, so peers send that endpoint's traffic straight to the banded socket; outbound traffic also leaves from it (m_srcPort follows the locator);
• fd-budget rationing: max_prioritized_endpoint_ports (default 4, lwIP has ~10 sockets) — on exhaustion, warn + fall back to deferred dispatch below. Ports are released on endpoint deletion.

Deferred banded dispatch (shared-port fallback)

Banded endpoints without a dedicated port get their user callbacks re-submitted to the pool at their band instead of running inline on the receive worker: bounded queue (32/endpoint, newest-dropped with warn), single in-flight drain job so per-endpoint ordering is preserved (mirrors the reactor's one-shot pattern). Applies to reader on_sample, service-server handlers, and service-client reply delivery; default (Normal) endpoints keep today's inline path byte-for-byte.

Facade + python

band + optional dscp appended to Writer/Reader/Service/Action configs and all typed facades (a service applies them to request+reply; an action inherits to all sub-endpoints — a ROS action is ~8 endpoints, more than the default ration, so most defer). Python rtps_bindings.cpp: participant config fields + band/dscp kwargs on all creation methods.

Review-driven hardening (rounds 2–18)

The review rounds hardened the concurrency model well beyond the feature itself. Highlights, each with a regression test or sanitizer coverage:

• Guaranteed submission (submitGuaranteed): a pool-rejected writer progress() poke is parked (coalesced per producer, lossless owed counts) and re-armed by a retry timer whose admission is fair round-robin across producers — band priority is applied by the pool after admission, so no band or producer can be starved (rtps_guaranteed_submit, rtps_guaranteed_fairness).
• Endpoint lifecycle vs. concurrency: removal/quiesce phases run outside the facade mutex and are pinned by an active-engine-operation guard that stop() waits for; pooled endpoint slots carry generation counters checked by queued jobs and the inbound receive dispatch (DATA/DATA_FRAG/HEARTBEAT/ACKNACK/GAP), so deletion + slot reuse can never dispatch into the wrong endpoint; composite action builds are pinned end-to-end and commit under the lock; rollbacks join goal workers and retain failed engine deletions for retry at stop() (rtps_remove_reader_deadlock, rtps_writer_churn, rtps_service_rollback).
• Lock-order + data-race fixes found by the new sanitizer leg: SPDP/protocol-scheduler/nudge races → atomics + a leaf nudge mutex; checkAndResetHeartbeats and addBuiltInEndpoints lock-order inversions; executeCallbacks snapshots registrations and invokes unlocked; StatefulReader delivers user callbacks under a leaf delivery mutex instead of the proxies mutex (kills the callback→facade→SEDP→proxies cycle); Diagnostics counters and reader/writer init flags are atomic. The suite is TSan-clean with the deadlock detector enabled and ASan-clean.
• SEDP announcement wedge: an endpoint deleted before the SEDP writer's cursor reached its announcement permanently wedged all subsequent announcements; progress() now skips history holes (found by rtps_writer_churn).

Consumer-driven fixes (pace-racer-fw #14 / #15)

• Best-effort saturation no longer collapses silently (RTPS telemetry: delivery collapses to zero above ~485 Hz with pub_fail reporting 0 rammp-org/pace-racer-fw#14): StatelessWriter::progress() clamps a cursor that fell behind the ring, so a saturated publisher degrades to true KEEP_LAST drop-oldest (measured: 9.9% → 58–71% delivered at 40k/s on a 2-slot static ring); every overwrite is surfaced via a rate-limited publish() warning + Diagnostics::Writer::history_overwrite_drops and per-writer historyDrops(). HISTORY_SIZE_STATELESS now differs by profile (embedded 2 / host 8 / host_large 32). New rtps_stateless_saturation regression.
• Actionable capacity diagnostics + per-limit overrides (RTPS participant fails to start at >=5 writers (usable maximum is 4, not 8) rammp-org/pace-racer-fw#15): endpoint-creation failures now name the binding pools, the builtin-discovery reservations, the usable counts, and the Kconfig remedy; every capacity cap is individually overridable on top of a profile (ESP-IDF menuconfig "Custom capacity overrides", host -DRTPS_LIMIT_OVERRIDES="NUM_STATELESS_WRITERS=16;…", validated names + uint8 ranges).
• Portability: Winsock SO_RCVTIMEO (DWORD ms, sub-ms clamp) so the reactor's mandatory bounded read works on Windows.

Testing

• Wire safety: rtps_golden byte-identical; wire format never changed across all rounds.
• Host suite: 35+ standalone rtps/socket/thread_pool binaries, swept ×3 after every round (0 failures). New regression tests added by this PR: rtps_sedp_dedicated_locator, rtps_banded_pubsub, rtps_banded_deferred, rtps_banded_ration, rtps_banded_churn, rtps_deferred_recovery, rtps_guaranteed_submit, rtps_guaranteed_fairness, rtps_remove_reader_deadlock, rtps_writer_churn, rtps_stateless_saturation — each validated to fail against the bug it guards where feasible.
• Docker interop matrix: 40/40 PASS (FastDDS / ROS 2 Jazzy), including ros2_pub→espp_banded_sub on a dedicated port and all the regression tests above.
• New CI leg .github/workflows/host_sanitizers.yml: TSan (races + lock-order/deadlock detection) and ASan over the standalone suite, path-filtered to RTPS/socket/thread_pool/task/timer changes — both green; the leg found and led to fixes for 11 real defects while being brought up.
• esp32 rtps example builds every round; python config surface smoke-tested; cppcheck (CI flags) clean.

Reviewer notes

• Dedicated-port offsets only walk forward (released ports free the ration slot, not the offset) — ~150 banded-endpoint creations per Domain lifetime exhaust the range; documented.
• Deferred-queue drops are post-ack (not recovered by RTPS reliability) and only occur if a user callback stalls past 32 queued samples; warned on drop.
• Deferred closures capture shared_ptr<vector> payloads to work around a GCC 15 xtensa -Werror=free-nonheap-object false positive on moved-vector captures.
• publish() still returns true when KEEP_LAST overflow drops an older unsent sample (the new sample was queued); the drop is surfaced via the rate-limited warning and Diagnostics counters. false continues to mean "this sample was not accepted".
• Host/host_large profile default HISTORY_SIZE_STATELESS changed 2→8/32 (capacity-only, wire-neutral); embedded stays 2 and is per-limit overridable.

Phase 3 (flood-latency p99 acceptance test) remains as follow-up.

🤖 Generated with Claude Code

[github-actions]

✅Static analysis result - no issues found! ✅

[Copilot]

Pull request overview

This PR implements Phase 2 of priority-aware RTPS scheduling by threading espp::QosBand (and optional DSCP) through the RTPS transport, adding per-endpoint dedicated unicast ports (announced via standard SEDP PID_UNICAST_LOCATOR), and providing a shared-port fallback via deferred banded dispatch for user callbacks.

Changes:

• Add per-channel QosBand scheduling to RTPS transport receive ports, with metatraffic defaulting to High.
• Implement per-endpoint dedicated unicast ports (rationed) and route inbound dedicated-port traffic to the owning participant.
• Add deferred banded dispatch for banded shared-port readers / service handlers / client replies, plus Python/docs/tests/interop coverage.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pc/tests/rtps_sedp_dedicated_locator.cpp	New engine-level test validating dedicated-port allocation + SEDP locator encoding + ration + release.
pc/tests/rtps_interop_sub.cpp	Extend interop subscriber tool to accept a band argument and pass it into the reader config.
pc/tests/rtps_banded_ration.cpp	New end-to-end test proving ration exhaustion falls back while still delivering to both readers.
pc/tests/rtps_banded_pubsub.cpp	New loopback test proving traffic flows via the dedicated port announced in SEDP.
pc/tests/rtps_banded_deferred.cpp	New loopback test proving deferred shared-port dispatch preserves per-reader ordering.
lib/python_bindings/rtps_bindings.cpp	Expose participant config fields + band/dscp on endpoint creation APIs in Python.
doc/en/protocols/rtps.rst	Document banded channels, dedicated endpoint ports, and deferred dispatch behavior.
components/rtps/src/rtps_participant.cpp	Wire participant config into rtps::DomainConfig, pass endpoint options, and implement deferred dispatch helper + usage.
components/rtps/src/entities/Domain.cpp	Add DomainConfig, per-channel banding, dedicated-port allocation/release, and dedicated-port receive routing.
components/rtps/src/communication/EsppTransport.cpp	Add per-channel ChannelOptions (band/dscp) and band-aware submit() to the transport worker pool.
components/rtps/README.md	Add a “Priority scheduling” section describing bands, dedicated ports, DSCP, and deferred dispatch.
components/rtps/interop/run_interop.sh	Build and run new priority/dedicated-port tests; add ROS2→banded-espp interop scenario.
components/rtps/include/rtps/entities/Domain.hpp	Define DomainConfig + EndpointOptions, extend constructors/create APIs, expose getTransport().
components/rtps/include/rtps/discovery/TopicData.hpp	Add local-only band/dscp/hasDedicatedPort attributes (not serialized).
components/rtps/include/rtps/communication/EsppTransport.hpp	Define ChannelOptions; extend transport APIs for band/DSCP-aware channels and submissions.
components/rtps/include/rtps_service.hpp	Extend typed service facade configs to carry band/dscp into underlying endpoints.
components/rtps/include/rtps_pubsub.hpp	Extend typed publisher/subscriber facade configs to carry band/dscp.
components/rtps/include/rtps_participant.hpp	Extend public configs (participant/writer/reader/service/action) and define deferred dispatch helper.
components/rtps/include/rtps_action.hpp	Extend typed action facade configs to carry band/dscp into underlying endpoints.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[finger563]

The CI interop hang is fixed in c573c39..ef323f4 — the 30-minute timeout kill turned out to be a real shutdown deadlock, and reproducing it on Linux (gdb watchdog inside the interop image) surfaced three distinct concurrency bugs, two of them pre-existing in the engine and merely exposed by runtime endpoint deletion:

1. Use-after-free wedging stop() (the CI signature): releaseReceivePort() destroyed the UdpSocket right after the non-blocking reactor remove() while an in-flight dispatch still referenced it — the handler blocked forever on the freed object's mutex, and SocketReactor::stop() spun on "Still waiting for 1 in-flight handler(s)". Fixed by retiring released sockets (fd stays open, so stale select() readiness can't alias a reused fd) and closing them in stop() after the reactor/pool quiesce.
2. Pre-existing Participant↔SEDPAgent ABBA deadlock (exposed by runtime deletion): endpoint add/delete held Participant::m_mutex while calling into the agent; agent receive handlers take the locks in the opposite order. The SEDP call now happens outside Participant::m_mutex (global order SEDP→Participant), and deletion loops match by pointer identity (also fixing a null-slot deref).
3. Pre-existing unlocked proxy-pool iteration (reproduced as a SIGSEGV under churn): StatefulWriter::sendHeartBeat and several reader/writer accessors iterated m_proxies without the designated mutex while SEDP workers mutated it — all guarded now.

Defense-in-depth: the reactor's UDP receive is bounded with a 1 s SO_RCVTIMEO (Linux-documented spurious readiness + unbounded recvfrom could wedge stop even without the UAF), and the dedicated-port registry got its own mutex off the Domain::m_mutex hot path.

Evidence: new rtps_banded_churn stress test (create/receive/delete churn under flood + stop-under-deferred-load) reproduced hang@iter5 / deadlock@iter8 / segv@iter6 before the fixes and now passes 100/100 on Linux; the four banded suites pass 30/30 each on Linux; the full docker interop matrix is 33/33 PASS (including a new banded_churn entry); local sweep 75/75; esp32 rtps + socket examples build. Note for review: the engine lock-order and proxy-guard fixes touch shared code paths used by all traffic — the interop matrix and goldens are the regression evidence.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

pc/tests/rtps_banded_deferred.cpp:76

• The comment says each sample is sent until it is "acknowledged by observation" via paced resends of the head, but the loop actually sends each sequence number at most once (next_to_send is always incremented on a successful publish and never retried). Either adjust the comment to match the current send strategy, or implement the described resend behavior.

  // Wait for discovery/matching, then send the numbered sequence. Reliable
  // writers retransmit on the wire, but a sample must reach the reader at least
  // once for the deferred queue to see it - send each one until acknowledged by
  // observation (simple paced resend of the not-yet-seen head).

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 4 comments.

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

components/rtps/src/rtps_participant.cpp:673

• These two endpoint creations are not transactional. If the writer succeeds (and consumes a dedicated-port slot) but the reader pool is exhausted, the method returns false while leaving the writer announced and its dedicated socket allocated; the inverse case similarly leaves a reader behind. Roll back whichever endpoint was created before returning failure so failed service registration cannot permanently consume endpoint and fd budgets.

This issue also appears on line 1172 of the same file.

      domain_->createWriter(*participant_, rep_topic.c_str(), rep_type.c_str(), /*reliable=*/true,
                            /*enforceUnicast=*/false, endpoint_options);
  rtps::Reader *request_reader =
      domain_->createReader(*participant_, req_topic.c_str(), req_type.c_str(), /*reliable=*/true,
                            /*mcastaddress=*/{0, 0, 0, 0}, endpoint_options);

components/rtps/src/entities/Domain.cpp:413

• A failed probe window never advances m_nextDedicatedPortOffset; it is updated only on a successful bind. If offsets 0–15 are occupied while offset 16 is free, every later endpoint retries the same 16 ports and dedicated allocation remains permanently disabled despite the documented 100–249 range. Advance past the failed window (bounded by the domain block) before returning fallback.

  for (uint16_t probe = 0; probe < DEDICATED_PORT_PROBE_LIMIT; ++probe) {
    const uint16_t offset = m_nextDedicatedPortOffset + probe;
    if (DEDICATED_PORT_OFFSET + offset > 249) {
      break; // stay inside this domain's 250-port block

components/rtps/src/rtps_participant.cpp:1176

• As in the server path, partial creation leaks the successful endpoint. For example, a successful dedicated reply reader followed by request-writer exhaustion makes add_service_client() fail while retaining the reader/socket and ration slot. Delete whichever endpoint succeeded before returning failure.

      domain_->createReader(*participant_, rep_topic.c_str(), rep_type.c_str(), /*reliable=*/true,
                            /*mcastaddress=*/{0, 0, 0, 0}, endpoint_options);
  rtps::Writer *request_writer =
      domain_->createWriter(*participant_, req_topic.c_str(), req_type.c_str(), /*reliable=*/true,
                            /*enforceUnicast=*/false, endpoint_options);

[Copilot]

Pull request overview

Copilot reviewed 61 out of 62 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

Previously missed (2) — in code that hasn't changed since the last review.

components/rtps/src/rtps_participant.cpp:223

• The engine rejects names whose length is exactly the configured array size (Domain::createWriter() uses >=), but this diagnostic uses >. A 64-byte topic/type therefore reports a writer-capacity failure instead of the actual name-length failure and points users at the wrong Kconfig knobs.

This issue also appears on line 280 of the same file.
components/rtps/src/communication/EsppTransport.cpp:268

• Keeping one owed run per rejected publish creates an unbounded work debt for static KEEP_LAST writers. Once their finite history overwrites older samples, most of these counts no longer correspond to sendable data; after a sustained overload the retry timer can spend minutes submitting millions of no-op progress() jobs, continuing to occupy the bounded pool long after traffic stops. Coalesce/cap debt when history drops and have admitted work drain the currently retained history instead of preserving pokes for samples that no longer exist.

  // Coalesce by producer: a repeated poke for the same writer just bumps its
  // owed count (the job/band are identical), so the map is bounded by the
  // producer count and nothing is ever dropped. Each owed run re-invokes
  // progress() once, preserving one-poke/one-sample.
  auto &entry = m_pendingByKey[key];
  entry.job = std::move(job);
  entry.band = band;
  ++entry.count;

components/rtps/src/rtps_participant.cpp:281

• The reader engine rejects names at exactly MAX_*_LENGTH (Domain::createReader() uses >=), so this > check misclassifies that failure as pool exhaustion and emits an incorrect remediation.
  components/rtps/src/rtps_participant.cpp:734
• ServiceResponder is explicitly storable beyond the handler invocation, but this raw reply-writer lifetime is only guarded by the participant-wide token used during stop(). During action rollback, remove_service_server() can delete/reset this writer after close() returns while a retained responder still sees the participant as live, so a later or racing reply() can target a reused writer slot. Add an endpoint-scoped liveness/generation guard shared with responders and invalidate it before deleting this writer.

[finger563]

Addressed the 4 suppressed/previously-missed findings from the latest review round in 58a6934 (the inline DSCP finding is answered on its thread):

1. Unbounded owed-debt for KEEP_LAST writers (EsppTransport.cpp guaranteed submission): writer progress pokes now use a new drain-semantics API, submitGuaranteedDrain(), which parks with the pending-count capped at one, and both writers' progress() re-arm themselves while unsent samples remain (Stateless: cursor ≤ getSeqNumMax; Stateful: cursor ≤ getCurrentSeqNumMax). Under a KEEP_LAST overflow storm the old per-poke counts accumulated debt for samples the ring had already overwritten — a long tail of no-op pokes ground through the retry timer after the storm. Now debt per writer is bounded at 1 and each admitted run drains the retained history (send one, re-arm) — still lossless. submitGuaranteed() keeps its counted lossless contract for other producers (and the fairness/guaranteed-submit tests that assert it).
   • Side effect, deliberately kept: a burst now drains back-to-back at pool speed instead of being accidentally metered by the retry timer. The saturation test's dynamic-mode gate is retuned to the deterministic properties (publish accepted all + history_overwrite_drops == 0, i.e. every sample reached the wire) with an 80% collapse floor — a slow container receiver can shed a few percent as genuine best-effort UDP loss (observed 95.2% in the docker interop run, 100% on host), while a chain/parking regression delivers at most the pool-queue prefix (~13%).
2. Name-length off-by-one ×2 (rtps_participant.cpp add_writer/add_reader diagnostics): the too-long-name diagnostic now uses >=, matching the engine's fixed-array + terminating-NUL bound, so a name of exactly MAX_TOPICNAME/TYPENAME_LENGTH is attributed to its real cause instead of the pool-exhaustion hint.
3. ServiceResponder can outlive its server (rtps_participant.cpp): responders now carry an endpoint-scoped liveness token alongside the participant-wide one. remove_service_server() flips it false under its lock — waiting out an in-flight reply() — before deleting the reply writer, so a responder retained past an individual server removal no-ops instead of writing through a reset/reused writer slot while the participant is still alive. Lock order is participant → endpoint; removal takes the endpoint lock alone, so there is no reverse nesting.

Verified: rtps_guaranteed_submit/rtps_guaranteed_fairness (counted contract intact, all owed runs execute), rtps_stateless_saturation 100% local + docker (dynamic 95.2% with drops=0; static gate 89 + 411 drops = 500, conservation exact); docker interop matrix 43/43 PASS; standalone sweep ×3 (0 fails beyond one known port-in-use flake, passes solo ×3); TSan spot-checks 0 findings; cppcheck clean (writer syntaxError is a pre-existing DEBUG_BUILD-config false positive, present at HEAD); esp32 rtps example builds clean.

[Copilot]

Pull request overview

Copilot reviewed 61 out of 62 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

pc/tests/rtps_remove_reader_deadlock.cpp:197

• This wait stops as soon as the callback sets self_removed, before it stores the remove_reader() result into self_removed_ok. The main thread can therefore reach the check at line 194 during that window and fail a successful run nondeterministically. Wait for completion/result (or add a separate self_remove_done atomic) rather than the entry flag.

[finger563]

Also addressed the 1 previously-missed comment from the latest review round in 673ae02: rtps_remove_reader_deadlock.cpp scenario 2 waited on the entry flag (self_removed, set before remove_reader() runs) and could judge self_removed_ok mid-removal, failing a good run nondeterministically. The wait (and the failure check) now uses a self_remove_done completion flag set only after the result is stored.

Verified: rtps_remove_reader_deadlock 3× + TSan; standalone sweep ×3 0 fail; TSan spot-checks 0 findings (the lock-order change in this round is additionally covered by the CI linux TSan deadlock detector); docker interop 43/43 PASS; cppcheck clean; esp32 rtps example builds clean.

[Copilot]

Pull request overview

Copilot reviewed 61 out of 62 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

lib/espp.cmake:161

• This “participant budget” validation ignores the transport channel pool. A Domain permanently uses two multicast channels plus two unicast channels per participant, so the host defaults already need 18 channels for MAX_NUM_PARTICIPANTS=8 while Config::MAX_NUM_UDP_CONNECTIONS is 16 (host_large similarly needs 66 but has 32). Overrides can therefore pass this check yet createParticipant() still fails before reaching the advertised participant capacity. Include the channel constraint, and either raise the profile channel caps or lower the participant defaults.

components/rtps/CMakeLists.txt:120

• This cross-limit check still accepts an undeliverable participant budget because it omits MAX_NUM_UDP_CONNECTIONS: the Domain consumes two multicast channels plus two unicast channels per participant. For example, the host profile advertises 8 participants but its 16 channel slots only fit 7. Mirror a channel-capacity check here and reconcile the profile defaults/caps.

math(EXPR _rtps_need_stateful "2 * ${RTPS_EFFECTIVE_MAX_NUM_PARTICIPANTS}")
if(RTPS_EFFECTIVE_NUM_STATELESS_WRITERS LESS RTPS_EFFECTIVE_MAX_NUM_PARTICIPANTS
   OR RTPS_EFFECTIVE_NUM_STATELESS_READERS LESS RTPS_EFFECTIVE_MAX_NUM_PARTICIPANTS
   OR RTPS_EFFECTIVE_NUM_STATEFUL_WRITERS LESS _rtps_need_stateful
   OR RTPS_EFFECTIVE_NUM_STATEFUL_READERS LESS _rtps_need_stateful)

[finger563]

Also addressed the 2 previously-missed comments from the latest review round (the channel-pool validation gap in lib/espp.cmake and components/rtps/CMakeLists.txt) in 34c90b3:

The participant-budget cross-check now includes the transport channel pool: a Domain permanently binds 2 shared multicast channels (SPDP metatraffic + user multicast) plus 2 unicast channels per participant (builtin + user), all from the same MAX_NUM_UDP_CONNECTIONS pool that runtime dedicated endpoint ports draw from — so the old endpoint-pool math indeed accepted combinations whose createParticipant() still failed on channels first (host advertised 8 participants but its 16 channels fit only 7).

• MAX_NUM_UDP_CONNECTIONS is now an overridable knob (RTPS_CFG_ wrap in all three profile headers, espp.cmake allowlist entry, Kconfig int with the 0 = profile-default sentinel), minimum 4.
• Both build systems enforce MAX_NUM_UDP_CONNECTIONS >= 2 + 2*MAX_NUM_PARTICIPANTS on the effective combination, with the budget math and dedicated-port headroom spelled out in the error.
• Profile defaults reconciled so the advertised budgets actually fit with dedicated-port headroom: host 16 → 24 (needs 18), host_large 32 → 72 (needs 66); embedded stays 10 (needs 4; lwIP fd budget). Channels are ~32-byte array slots, so the host increases are negligible.

Verified: host cmake probes (channels=17 rejected for host's 8 participants / needs 18, 18 accepted, 3 rejected below the minimum of 4, channels=10 with participants=4 accepted); ESP-IDF reconfigure probes (channels=4 with participants=2 rejected with the budget math, a consistent lowered combo accepted); default builds clean on all profiles; standalone sweep ×3 0 fail; docker interop 43/43 PASS; esp32 rtps example builds clean.

[Copilot]

Pull request overview

Copilot reviewed 61 out of 62 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

components/rtps/src/rtps_participant.cpp:2057

• Pin this composite add before reading participant_ or creating either endpoint. participant_ is mutex-protected but is read here without that mutex while stop() can reset it; stop can also clear both nested endpoints before this function later commits the client, leaving a stale handle in a stopped/restarted participant. An engine-operation guard makes the pointer read and the full transaction coexist safely with teardown.

[finger563]

Also addressed the 1 previously-missed comment from the latest review round (rtps_participant.cpp:2057 — the native service client's unguarded participant_ read) in 02988fe: the composite pin added for the thread above also covers it. begin_engine_op() validates participant_ under mutex_ before the operation registers, and stop() cannot reset the pointer while the operation is in flight, so the participant_->m_guidPrefix read inside the pinned region is safe; the redundant unlocked null check was dropped in favor of the guard's authoritative one.

Verified: service/action loopback tests (native_service, service, typed_rpc, native_action) ×3 each; TSan spot-checks on the service paths 0 findings; standalone sweep ×3 (one known port-in-use flake, passes solo ×3); docker interop 43/43 PASS; esp32 rtps example builds clean.

[Copilot]

Pull request overview

Copilot reviewed 61 out of 62 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 61 out of 62 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

lib/python_bindings/rtps_bindings.cpp:1

• The Python binding accepts max_prioritized_endpoint_ports as uint8_t, which can silently wrap/truncate for Python ints outside 0..255 (and negative values). Consider taking this parameter as an int in the binding layer and explicitly range-checking (raising a Python ValueError) before assigning to the config’s uint8_t, to avoid surprising runtime behavior (e.g., 256 becoming 0).

[finger563]

Regarding the 1 suppressed comment from the latest round (rtps_bindings.cpp — max_prioritized_endpoint_ports bound as uint8_t "can silently wrap/truncate"): no code change — verified false positive. pybind11's integer caster range-checks integral conversions; tested empirically against the built module:

Config(max_prioritized_endpoint_ports=256)  -> TypeError
Config(max_prioritized_endpoint_ports=-1)   -> TypeError
Config(max_prioritized_endpoint_ports=300)  -> TypeError
cfg.max_prioritized_endpoint_ports = 256    -> TypeError
cfg.max_prioritized_endpoint_ports = -1     -> TypeError

Both the constructor argument and the def_readwrite attribute setter reject out-of-range values — nothing wraps to 0. (Raising ValueError instead of pybind11's TypeError would be cosmetic churn on an already-safe path.)

The inline Diagnostics comment is fixed in 6d59849 (missing definition added); verified with lib+pc rebuild, standalone sweep 0 fail, and a clean esp32 example build.