rtl8733b: harden ARQ and qualify BlockAck response

[snokvist]

Follow-up to #406 after its merge.

Summary

• Make ACK-responder arm/disarm fail closed: check register writes, close the gate before retargeting, verify RTL8733B rollback/disarm, and keep teardown progressing after a failed safety clear.
• Propagate construction-time responder refusal on Jaguar1/2/3 instead of green-initializing a passive monitor.
• Apply tx.ack_timeout_us to both RTL8733B response-window registers (REG_ACKTO and REG_ACKTO_CCK) and verify both readbacks.
• Replace sampled/ambient-prone retry evidence with run-unique payload-counter witness ledgers; add an independent RTL8733B soliciting-TX ACK-closure test.
• Add a CCX-independent three-radio BlockAck test. The witness proves A-MPDU structure and retry-copy closure, and directly decodes addressed 0x94 compressed BlockAck frames, including the bitmap.
• Keep CCX wording scoped: no H2C/MACID registration transport is added here, and the absence of reports is not assigned to firmware.

Hardware evidence

Current rig:

• TX: 0bda:b812, RTL8822B/88x2BU, Jaguar2
• RTL8733B DUT: 0bda:f72b
• independent witness: 0bda:8812, RTL8812AU/Jaguar1

BlockAck, ch36/MCS3/retry 12 (tests/rtl8733b_blockack_onair.sh):

• active but unarmed RTL8733B: 1,605 unique aggregated payloads, 12.720 witnessed copies/payload, paggr=0.665, max burst 9, 0 matching BlockAcks;
• armed RTL8733B: 128,702 unique aggregated payloads, 1.001 copies/payload, paggr=1.0, max burst 9, 14,402 addressed compressed BlockAcks; all 14,402 carried nonzero bitmaps;
• the harness checks responder and witness liveness before and after TX and aborts unless the preparatory disarm and shutdown are verified.

Other reruns:

• RTL8733B soliciting normal-ACK TX, MCS3: responder on/off = 1.016/12.879 copies per observed payload, with 99.8%/100% witness coverage.
• Retry dose response 0/3/12/0/12: 1.00/4.00/12.34/1.00/12.34 copies per frame; verdict true.
• J2 construction-time group responder: nonzero initialization failure with the unicast diagnostic; valid unicast still arms. After valid-process exit, a J1 probe measured 0/1,311 ACK successes and retries pinned at 12, so no teardown leak was inferred.
• 11M CCK current J2-witness rerun separated on/off at 1.004/12.113 copies, but its one-shot on arm captured 55.7%, below the harness's fixed 60% coverage floor; this rerun is supportive, not counted as a new formal pass. The documented qualifying CCK cell used the prior J3 witness.

Checks

• Default build succeeds.
• ctest --test-dir build --output-on-failure: 54/54 pass.
• bash -n and shellcheck pass for all three RTL8733B on-air ARQ harnesses.
• git diff --check passes.

Scope

This qualifies RTL8733B as a BlockAck responder only on the measured Jaguar2-to-RTL8733B combination. RTL8733B A-MPDU TX remains unported and unmeasured. CCX/tx.report remains unimplemented pending a separately tested H2C queue plus MEDIA_STATUS_RPT registration path.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Harden RTL8733B ARQ and qualify BlockAck responses

🐞 Bug fix 🧪 Tests ✨ Enhancement 📝 Documentation 🕐 40+ Minutes

AI Description

• Fail closed on responder and timeout register failures across RTL8733B and Jaguar backends.
• Add air-side tests for retry closure, normal ACKs, and compressed BlockAck responses.
• Document measured RTL8733B ARQ capabilities, evidence, and remaining CCX/A-MPDU TX limits.

Diagram

graph TD
  CFG["Device Config"] --> BACK["Chip Backends"] --> ACK["ACK Helper"] --> REGS["ARQ Registers"]
  HARNESS["Air Test Harness"] --> TX["Jaguar2 TX"] --> DUT["RTL8733B DUT"] --> WIT["Passive Witness"]
  TX --> WIT
  DUT --> BACK

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use transmitter CCX reports

• ➕ Would provide transmitter-local retry and delivery accounting.
• ➕ Could simplify the external witness setup.
• ➖ RTL8733B lacks the required H2C and MACID registration path.
• ➖ Per-frame CCX accounting is not a valid A-MPDU retry oracle.

2. Capture all received frame bodies

• ➕ Provides complete packet contents for offline analysis.
• ➕ Avoids adding a dedicated BlockAck event.
• ➖ Produces excessive logs under saturated A-MPDU traffic.
• ➖ Adds processing pressure that could perturb witness measurements.

Recommendation: Keep the independent payload-counter witness and narrow BlockAck telemetry. This approach avoids unsupported or invalid CCX assumptions, limits observer overhead, and directly proves aggregate structure, retry closure, addressing, subtype, and bitmap content.

Files changed (18) +876 / -232

Enhancement (2) +36 / -5

main.cppEmit narrow BlockAck control-frame telemetry +25/-0

Emit narrow BlockAck control-frame telemetry

• Adds DEVOURER_RX_CONTROL-gated decoding for 0x94 BlockAck frames. Emits CRC, rate, control, sequence, addresses, and the first 64 bitmap bits without streaming all packet bodies.

examples/rx/main.cpp

Halmac8733bMac.hReturn structured dual-register ACK timeout state +11/-5

Return structured dual-register ACK timeout state

• Introduces AckTimeoutState to carry CCK and non-CCK readbacks plus combined write status. Updates the HALMAC interface contract accordingly.

src/rtl8733b/Halmac8733bMac.h

Bug fix (6) +169 / -76

AckResponder.hMake shared ACK responder transitions fail closed +46/-19

Make shared ACK responder transitions fail closed

• Returns register-write status, closes the responder gate before retargeting, and best-effort rolls back failed arm operations. Adds disarm-state readback helpers for safety verification.

src/AckResponder.h

RtlJaguarDevice.cppPropagate Jaguar1 responder arm and disarm failures +16/-6

Propagate Jaguar1 responder arm and disarm failures

• Fails initialization when a configured responder cannot arm and reports runtime arm failures. Throws on unsuccessful disarm instead of silently continuing.

src/jaguar1/RtlJaguarDevice.cpp

RtlJaguar2Device.cppPropagate Jaguar2 responder arm and disarm failures +16/-6

Propagate Jaguar2 responder arm and disarm failures

• Checks shared responder writes during runtime and construction-time setup. Initialization now refuses a passive monitor when responder configuration fails.

src/jaguar2/RtlJaguar2Device.cpp

RtlJaguar3Device.cppPropagate Jaguar3 responder arm and disarm failures +16/-6

Propagate Jaguar3 responder arm and disarm failures

• Checks responder operations under the existing register mutex and aborts initialization on arm refusal. Disarm failures now surface as exceptions.

src/jaguar3/RtlJaguar3Device.cpp

Halmac8733bMac.cppVerify both ACK timeout families and teardown disarm +17/-7

Verify both ACK timeout families and teardown disarm

• Programs and reads back the OFDM/HT and CCK ACK timeout registers with transport status. Teardown verifies responder disarm while allowing remaining shutdown steps to proceed after safety-clear errors.

src/rtl8733b/Halmac8733bMac.cpp

Rtl8733bDevice.cppFail RTL8733B bring-up and responder operations safely +58/-32

Fail RTL8733B bring-up and responder operations safely

• Aborts bring-up unless both ACK timeout registers match the configured value. Adds verified responder rollback, verified disarm, unknown-state reporting, and accurately scoped CCX warnings.

src/rtl8733b/Rtl8733bDevice.cpp

Tests (3) +527 / -36

rtl8733b_arq_tx_onair.shAdd independent RTL8733B normal-ACK closure test +149/-0

Add independent RTL8733B normal-ACK closure test

• Uses separate DUT, responder, and witness radios to compare payload-copy counts with the responder on and off. Enforces submission, coverage, retry-collapse, and retry-limit thresholds.

tests/rtl8733b_arq_tx_onair.sh

rtl8733b_blockack_onair.shAdd three-radio RTL8733B BlockAck qualification +306/-0

Add three-radio RTL8733B BlockAck qualification

• Proves A-MPDU structure, retry-copy closure, and addressed compressed BlockAck frames with nonzero bitmaps. Verifies responder and witness liveness, establishes a passive control state, and requires graceful verified shutdown.

tests/rtl8733b_blockack_onair.sh

rtl8733b_retry_limit_onair.shReplace sampled retry evidence with payload ledgers +72/-36

Replace sampled retry evidence with payload ledgers

• Uses run-unique source addresses and per-copy rx.seq events instead of quantized rx.txhit sampling. Requires a valid multi-level dose response, complete runs, and scoped process cleanup.

tests/rtl8733b_retry_limit_onair.sh

Documentation (7) +144 / -115

aggregation.mdScope and document RTL8733B BlockAck responder evidence +11/-2

Scope and document RTL8733B BlockAck responder evidence

• Qualifies BlockAck behavior only for measured adapter combinations and records the three-radio RTL8733B evidence. Explicitly keeps RTL8733B A-MPDU transmission out of scope.

docs/aggregation.md

logging.mdDocument the rx.blockack telemetry event +1/-0

Document the rx.blockack telemetry event

• Adds the control-frame event schema, including addressing, sequence, control, and bitmap fields. Explains its narrow use in BlockAck qualification.

docs/logging.md

rtl8733b.mdRefresh RTL8733B ARQ capabilities and limitations +30/-34

Refresh RTL8733B ARQ capabilities and limitations

• Documents dual-family ACK timeout validation, normal-ACK TX closure, BlockAck response evidence, and corrected retry measurements. Reframes missing CCX reports as unresolved pending H2C/MEDIA_STATUS_RPT support.

docs/rtl8733b.md

scheduled-mac.mdAdd witness-based RTL8733B ARQ results +17/-10

Add witness-based RTL8733B ARQ results

• Adds soliciting-TX, retry-dose, and BlockAck responder measurements outside the CCX matrix. Updates responder counts and scopes conclusions to the tested hardware sample.

docs/scheduled-mac.md

AdapterCaps.hUpdate RTL8733B ARQ capability evidence +2/-2

Update RTL8733B ARQ capability evidence

• Refreshes responder and retry-limit measurements in capability documentation comments to match the new witness-ledger results.

src/AdapterCaps.h

DeviceConfig.hClarify RTL8733B timeout and CCX contracts +12/-8

Clarify RTL8733B timeout and CCX contracts

• Documents that RTL8733B applies ACK timeout to CCK and non-CCK registers. Also scopes tx.report as unsupported while H2C/MACID registration is absent.

src/DeviceConfig.h

CLAUDE.mdRecord hardened RTL8733B ARQ qualification +71/-59

Record hardened RTL8733B ARQ qualification

• Captures the revised timeout, normal-ACK, retry-limit, and BlockAck bench evidence and its single-sample limits. Corrects prior CCX root-cause claims and documents the missing registration path.

src/rtl8733b/CLAUDE.md

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. cleanup skips responder teardown ✓ Resolved 📘 Rule violation ☼ Reliability

Description

The soliciting-TX ARQ harness runs the responder-ON phase first and ends it with SIGKILL,
preventing Halmac8733bMac::stop() from explicitly disarming the persistent hardware ACK gate
before the OFF phase. The supposedly responder-off measurement can therefore still receive ACKs from
an armed radio, collapsing retries, violating orderly device teardown, and invalidating the A/B
result.

Code

tests/rtl8733b_arq_tx_onair.sh[R34-36]

+cleanup() {
+  sudo pkill -9 -f "^$ESC_BUILD/rxdemo" 2>/dev/null
+  sudo pkill -9 -f "^$ESC_BUILD/txdemo" 2>/dev/null

Evidence

Rule 11 requires the device to stop before its USB resources are released, but the harness kills the
armed rxdemo process with SIGKILL and then begins the OFF phase without resetting or disarming
the adapter. The RTL8733B implementation documents that the net_type ACK gate survives ordinary
MAC shutdown and must be explicitly cleared, while Jaguar1's hardware deinitialization writes live
in Stop(); the sibling BlockAck harness accordingly documents that SIGKILL cannot establish a
passive responder and uses graceful SIGINT plus a verified passive-reset session.

CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order: CLAUDE.md: Preserve Correct libusb Ownership and Teardown Order
tests/rtl8733b_arq_tx_onair.sh[34-39]
tests/rtl8733b_arq_tx_onair.sh[93-95]
tests/rtl8733b_arq_tx_onair.sh[130-131]
src/rtl8733b/Halmac8733bMac.cpp[811-826]
tests/rtl8733b_blockack_onair.sh[79-114]
tests/rtl8733b_arq_tx_onair.sh[55-75]
tests/rtl8733b_blockack_onair.sh[91-114]
src/jaguar1/RtlJaguarDevice.cpp[1998-2009]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The ARQ harness kills the ON-phase `rxdemo` process with `SIGKILL`, bypassing the RTL8733B stop path that clears the persistent hardware ACK-responder gate. The subsequent OFF measurement may therefore still receive ACKs from the previously armed adapter.
## Issue Context
The harness runs the armed responder phase before the OFF control, and its common cleanup directly kills the responder without resetting or disarming the adapter. Use graceful receiver shutdown and verify responder disarm before accepting the OFF control, following the established BlockAck harness pattern; reserve `SIGKILL` for fallback cleanup after the measurement has already been rejected. The BlockAck harness documents that killing the process cannot guarantee passive state because `SIGKILL` cannot execute device stop logic, and Jaguar1 performs the relevant hardware deinitialization from `Stop()`.
## Fix Focus Areas
- tests/rtl8733b_arq_tx_onair.sh[34-39]
- tests/rtl8733b_arq_tx_onair.sh[55-95]
- tests/rtl8733b_arq_tx_onair.sh[130-131]
- tests/rtl8733b_blockack_onair.sh[91-114]
- src/jaguar1/RtlJaguarDevice.cpp[1998-2009]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Failed arm may stay active ✓ Resolved 🐞 Bug ☼ Reliability

Description

ack::enable() returns failure after only a best-effort, unverified gate clear, while Jaguar1/2/3
callers trust that result and perform no verified rollback. If the failed arm write landed and the
cleanup write did not, the API or constructor reports refusal while the radio remains an active
ACK/BlockAck responder.

Code

src/AckResponder.h[R64-67]

+  /* A failed status does not prove the gate write had no side effect. Make a
+   * best-effort close before reporting failure; RTL8733B additionally reads
+   * this back in its caller. */
+  (void)dev.rtw_write8(0x0102, static_cast<uint8_t>(nt & ~0x03u));

Evidence

The helper explicitly acknowledges that a failed write status may still have changed hardware, but
its fallback clear is not read back. RTL8733B compensates with disable_verified(), whereas all
three Jaguar callers immediately return false.

src/AckResponder.h[43-68]
src/AckResponder.h[81-86]
src/jaguar1/RtlJaguarDevice.cpp[773-775]
src/jaguar2/RtlJaguar2Device.cpp[383-385]
src/jaguar3/RtlJaguar3Device.cpp[2173-2177]
src/rtl8733b/Rtl8733bDevice.cpp[844-874]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The shared ACK-responder arm helper can return `false` without proving that the net-type gate is closed. Jaguar callers do not add the verified rollback used by RTL8733B, so a failed arm can leave the radio responding after the caller was told it is passive.
## Issue Context
The transport write result is not sufficient to establish register state, as the new code itself notes. This applies both when the initial gate-close write fails and when the final arm write reports failure after potentially taking effect.
## Fix Focus Areas
- src/AckResponder.h[43-68]
- src/jaguar1/RtlJaguarDevice.cpp[773-775]
- src/jaguar2/RtlJaguar2Device.cpp[383-385]
- src/jaguar3/RtlJaguar3Device.cpp[2174-2176]
- src/rtl8733b/Rtl8733bDevice.cpp[844-874]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Final disarm goes unchecked ✓ Resolved 🐞 Bug ☼ Reliability

Description

After each BlockAck phase, the harness only checks that receiver processes exit; it never checks the
responder's stop-time disarm warning as it does during the preparatory passive reset. Since
Halmac8733bMac::stop() catches a failed verified clear and continues shutdown, the test can pass
while leaving the responder gate active and while its claimed shutdown verification actually failed.

Code

tests/rtl8733b_blockack_onair.sh[R190-195]

+  if ! stop_receivers; then
+    echo "ABORT: phase=$phase receivers did not stop gracefully" >&2
+    cleanup
+    exit 1
+  fi
+  cleanup

Evidence

The preparatory reset explicitly greps for both stop-time failure messages, but run_phase() omits
that check. The MAC stop implementation catches these failures and only logs warnings, so
stop_receivers() can return success despite an unverified active gate.

tests/rtl8733b_blockack_onair.sh[79-114]
tests/rtl8733b_blockack_onair.sh[179-195]
src/rtl8733b/Halmac8733bMac.cpp[811-826]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The BlockAck harness validates the preparatory passive reset but does not inspect stop-time disarm results after the OFF and ON phases. A process can exit gracefully even when the verified responder clear failed, allowing a passing test to leave active radio state behind.
## Issue Context
`Halmac8733bMac::stop()` intentionally logs and suppresses disarm failures so the rest of teardown continues. Process exit therefore cannot serve as proof that the gate was cleared.
## Fix Focus Areas
- tests/rtl8733b_blockack_onair.sh[79-114]
- tests/rtl8733b_blockack_onair.sh[179-195]
- src/rtl8733b/Halmac8733bMac.cpp[811-826]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. BlockAck properties are disconnected ✓ Resolved 🐞 Bug ≡ Correctness

Description

The harness counts compressed BlockAcks and nonzero bitmaps independently, then requires only that
each total exceed 100. A mix of compressed frames with zero bitmaps and other addressed frames with
nonzero bitmap bytes can therefore pass without proving that any compressed BlockAck carries a
nonzero bitmap.

Code

tests/rtl8733b_blockack_onair.sh[R251-253]

+nonzero_bitmaps = sum(ba.get("bitmap", "0" * 16) != "0" * 16
+                      for ba in blockacks)
+compressed = sum(bool(int(ba.get("ctrl", 0)) & 0x4) for ba in blockacks)

Evidence

The analysis computes nonzero_bitmaps over all addressed BlockAcks and compressed over all
addressed BlockAcks as separate sums, and the verdict independently compares both totals to 100.
There is no per-frame conjunction between the compressed bit and a nonzero bitmap.

tests/rtl8733b_blockack_onair.sh[215-224]
tests/rtl8733b_blockack_onair.sh[251-263]
tests/rtl8733b_blockack_onair.sh[286-302]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The verdict combines separate compressed-frame and nonzero-bitmap totals, so the two required properties may come from different BlockAck events. This weakens the claimed proof that addressed compressed BlockAcks contain meaningful bitmaps.
## Issue Context
Each decoded event already contains both `ctrl` and `bitmap`, allowing the witness analysis to count their conjunction directly and optionally reject unexpected BlockAck variants.
## Fix Focus Areas
- tests/rtl8733b_blockack_onair.sh[215-224]
- tests/rtl8733b_blockack_onair.sh[251-263]
- tests/rtl8733b_blockack_onair.sh[286-302]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[josephnef]

Reviewed the ARQ hardening + BlockAck qualification. The goal is right — no silently dead responder, a verified ACK window — but the hardening contradicts its own stated contracts in three places (throw-on-write-status vs readback-is-authority, fail-passive with a stale-responder hole, a bool error contract the read path bypasses), and the three on-air harnesses have already drifted apart from each other inside this one PR. Details inline; one finding is outside the diff:

examples/chanmig/main.cpp:576 — the chanmig drone discards SetAckResponder's bool. With this PR's new deliberate fail-passive paths (enable() now closes the gate and returns false on a failed write), a single transient control-transfer failure at drone bring-up leaves the radio passive by design while chanmig proceeds anyway. The ground side's hardware-ARQ frames all retry to the limit against a silent responder and the operator debugs the RF link — the exact silent-dead-responder scenario the 8733B comments say this hardening exists to prevent, unhandled at the one in-tree runtime call site.

[snokvist]

Addressed the requested reliability findings in commit 4c2b0f7:

• ARQ A/B receiver teardown now uses graceful SIGINT and rejects a phase if responder disarm was not verified; SIGKILL remains fallback cleanup.
• Jaguar1/2/3 arm failures now perform verified rollback and throw if passive state cannot be proven; disarm uses readback authority.
• BlockAck phase teardown checks stop-time disarm warnings.
• BlockAck verdict now requires compressed-and-nonzero bitmap on the same addressed BA event.
• chanmig now aborts drone bring-up when SetAckResponder refuses the arm.

Local build and all 54 ctest tests pass; shellcheck/bash -n and git diff --check also pass.

[snokvist]

@josephnef All requested findings are addressed in 4c2b0f7 (and Qodo now reports 0 unresolved issues). Please re-review the updated head when convenient.

[josephnef]

Re-reviewed at 4c2b0f7 — thanks, the reliability core is in good shape now: the stale-active-responder hole (verified rollback), the harness SIGKILL/orphan-responder hazard (graceful SIGINT + verified-disarm gate), and the chanmig arm check are all resolved, along with the Qodo items.

But "all requested findings" isn't accurate — 6 of my findings are untouched and 1 is half-fixed (details in the threads):

• Rtl8733bDevice.cpp bring_up_to_phy still throws on !writes_ok even when both readbacks match — the condition should be readback-only.
• ClearAckResponder (half-fixed): readback authority ✓, but it still throws from a void teardown-shaped API — and post-unplug the internal read now throws ios_base::failure in a destructor path (std::terminate), while Halmac8733bMac::stop() swallow-and-warns the same failure.
• The bool error contract still doesn't cover reads: ack::enable's first rtw_read8(0x0102) throws uncaught out of SetAckResponder on all four backends.
• rtl8733b_arq_tx_onair.sh: verdict still arithmetically unsatisfiable at the guard's own RETRY_LIMIT=3 floor — floor at 5 like the blockack sibling.
• rtl8733b_retry_limit_onair.sh: untouched — still counts airings with no CRC filter against a witness that keeps FCS-error frames.
• ESC_BUILD BRE-vs-ERE escaping: untouched and now load-bearing — the new stop_receivers() uses the same broken pattern, so on an ERE-metachar path the graceful path silently matches nothing.
• Docs: the historical framing in src/rtl8733b/CLAUDE.md / docs/rtl8733b.md is all still there (repo convention is current-state only).

Keeping changes-requested until these are in.

[snokvist]

@josephnef The seven still-open findings from your latest pass are addressed in b039144, with per-thread replies and local verification. Please re-review the updated head when convenient.

[josephnef]

Re-reviewed at b039144 — all 7 outstanding findings are verified fixed, independently confirmed against the diff plus a local build (54/54 ctest, bash -n on all three harnesses):

• bring_up_to_phy now throws on readback mismatch only; a failed transport status with matching readbacks warns. ✓
• ClearAckResponder is non-throwing on all four backends, disable_verified/enable/verify are noexcept with the read path contained in the bool contract, and the IRtlDevice doc states the false-is-not-proof-of-passive semantics. ✓
• RETRY_LIMIT floor is 5 (band 3.6–6.9 vs the ≥5.0 separation — satisfiable, matching the sibling). ✓
• rtl8733b_retry_limit_onair.sh now counts only crc-clean rx.seq events, matching the siblings — and thanks for recomputing the retained qualifying logs. ✓
• ESC_BUILD escapes the full ERE set in all three scripts (checked the produced pattern against a + ( ) | path with grep -E — matches). ✓
• The historical framing is gone from the ARQ sections of both docs. ✓

Approving.