fix(snr): SNR-SANITY exclusion connected-only + ring-distribution conviction (F241: chirp samples met the >=3 bar and a single-sample compare still blinded the entry)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019btwFxDt7D19SZSqPYvZnk

Author: secup

docs/CHANGELOG.md

@@ -10,6 +10,19 @@ This log tracks all bug fixes and behavioral changes to prevent re-doing work du
 
 ---
 
+## 2026-07-13 — fix(snr): SNR-SANITY exclusion is connected-only + distribution-convicted (F241: the ≥3 threshold was satisfied by chirp samples, and a single-sample comparison still blinded the entry)
+
+F241 failed identically AFTER the ≥3-sample threshold: the §6 chirp samples
+legitimately fill the ring to ≥3 by CONNECT time, and the comparison still
+used the LATEST single physical sample — which on this bench episodically
+under-reads (the filed IONOS gap-reference instability). Two rules now:
+(1) NO exclusion authority pre-connected — the physical entry CAP already
+bounds hot entries there; a false conviction blinds the pick entirely.
+(2) Conviction requires usable > ring_mean + ring_spread + 2.0 — on fading,
+one sample is one fade instant; the invariant only binds distributions.
+
+---
+
 ## 2026-07-13 — fix(snr): SNR-SANITY attribution threshold — the gate may only exclude with a ≥3-sample physical distribution (rig F238/F239: single-snapshot exclusion left entries BLIND at 15.0/none)
 
 At the handshake the physical ring holds 1-2 samples in an unknown fade state.

src/gui/modem/streaming_sync_acquisition.cpp

@@ -312,19 +312,29 @@ void StreamingDecoder::populateDecodeMetrics(DecodeResult& result, bool is_ofdm,
         // fallback). Single-sample disagreement is logged by the WARN below
         // when it trips with n>=3; below that, silence — a snapshot cannot
         // convict a meter.
+        // F241 (2026-07-13): two hard-won rules for exclusion authority.
+        // (1) NEVER pre-connected — at the handshake the physical entry CAP
+        //     already bounds a hot reading physically, so exclusion buys
+        //     nothing there and a false conviction blinds the entry pick
+        //     entirely (15.0/source-none default -> DQPSK fallback; F238/239/
+        //     241 all died this way, each against a single trough/ref-glitch
+        //     physical sample).
+        // (2) Convict against the ring DISTRIBUTION (mean + spread + margin),
+        //     never a single sample — on fading, usable and any one physical
+        //     sample are different fade instants; the invariant usable<=channel
+        //     only binds same-moment or distribution-vs-distribution.
         float ph_mean = 0.0f, ph_spread = 0.0f;
         const size_t ph_n = physicalSnrStats(ph_mean, ph_spread);
         if (result.snr_source == SNRSource::MCDPSK_IN_BAND &&
+            connected_ &&
             ph_n >= 3 &&
-            last_physical_snr_valid_.load() &&
-            result.snr_db > last_physical_snr_db_.load() + 2.0f) {
+            result.snr_db > ph_mean + ph_spread + 2.0f) {
             LOG_MODEM(WARN,
-                      "[%s] SNR-SANITY: usable %.1f dB EXCEEDS channel %.1f dB "
-                      "(+%.1f > 2.0 margin) — meter suspect, reading excluded "
-                      "from rate selection for this frame",
-                      log_prefix_.c_str(), result.snr_db,
-                      last_physical_snr_db_.load(),
-                      result.snr_db - last_physical_snr_db_.load());
+                      "[%s] SNR-SANITY: usable %.1f dB EXCEEDS channel "
+                      "%.1f±%.1f dB (n=%zu, margin 2.0) — meter suspect, "
+                      "reading excluded from rate selection for this frame",
+                      log_prefix_.c_str(), result.snr_db, ph_mean, ph_spread,
+                      ph_n);
             result.snr_source = SNRSource::SYNC_QUALITY;
         }
     }