feat(arq): keepalive ACK v2 (8s default threshold) — rig-proven (stall 44->8s, no collision); default-off, TNC listen-before-ACK gap blocks default-on (filed)

Direct gap measurement F290/F291: max silence capped at exactly 8.0s vs OFF
36.7s, reproducible, cwfails normal. Default-on reverted — broke
UltraTncSimAudio (TNC lacks the GUI's listen-before-ACK gating the keepalive
relies on). Blocker: move channel-clear gating into connection/ARQ (universal).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019btwFxDt7D19SZSqPYvZnk

Author: secup

docs/CHANGELOG.md

@@ -84,6 +84,29 @@ Verified: ctest 85/85; good@20 PASS 1600 bps.
 
 ---
 
+## 2026-07-14 — feat(arq): keepalive ACK v2 (8 s) — rig-PROVEN (stall 44→8 s, no collision), default-off blocked by TNC listen-before-ACK gap
+
+Direct silence-gap measurement (epoch-independent, unlike the goodput A/B)
+validated the fix cleanly. Rig F290/F291 (ULTRA_KEEPALIVE_ACK_MS=8000): **max
+ACK-silence gap capped at exactly 8.0 s** (vs OFF 36.7 s, v1@25s 25.0 s),
+reproducible across both runs, 13 keepalives/transfer, and cwfails NORMAL
+(266/491 — the faster firing did NOT collide, because it routes through the
+GUI's listen-before-ACK deferral). Default threshold set to 8000 (from 25000).
+
+**Default-on ATTEMPTED and REVERTED:** flipping ULTRA_KEEPALIVE_ACK default-on
+broke UltraTncSimAudio (timeout 264 s vs 58 s off). Root cause: the keepalive's
+collision-safety depends on listen-before-ACK, which lives in the GUI app layer
+(app.cpp) — the HEADLESS TNC (ultra_tnc, the Winlink/PAT path) has NO such
+gating, so the keepalive TX'd over inbound bursts → collision. So it stays
+DEFAULT-OFF (opt-in on the rig/GUI where the gating exists).
+
+**BLOCKER for default-on (filed):** move the channel-clear gating from the GUI
+app layer into the connection/ARQ (universal) so the keepalive is collision-
+safe on TNC too — then flip default-on at 8 s. The mechanism + rig safety are
+already proven; only the TNC-path gating remains.
+
+---
+
 ## 2026-07-14 — feat(arq): keepalive ACK v1 (default off) + honest rig A/B — mechanism works, benefit epoch-noise-dominated; v2 (fire sooner) filed
 
 Built the receiver keepalive ACK for BUG-ANCHOR-WAIT-NO-ACK-STALL: re-emit the

src/protocol/connection.cpp

@@ -4424,6 +4424,17 @@ void Connection::tick(uint32_t elapsed_ms) {
             // routes through listen-before-ACK; the sender resends holes on any
             // tone-burst ACK (turn boundary). v2 (filed): channel-gated shorter
             // threshold for a bigger saving.
+            // ULTRA_KEEPALIVE_ACK, DEFAULT-OFF. On the rig/GUI the 8 s keepalive
+            // is mechanism-proven (F290/F291: max ACK-silence gap capped at
+            // exactly 8.0 s vs OFF's 36.7 s) and collision-free — because it
+            // routes through the GUI's listen-before-ACK (app.cpp), so a
+            // mid-burst fire DEFERS. BLOCKER for default-on: the HEADLESS TNC
+            // path (ultra_tnc) has NO listen-before-ACK gating, so default-on
+            // broke UltraTncSimAudio (keepalive TX'd over inbound bursts →
+            // collision → timeout). Fix before flipping: move the channel-clear
+            // gating into the connection/ARQ (universal) rather than the GUI
+            // app layer, so the keepalive is safe on TNC too. Until then:
+            // opt-in on the GUI/rig where the gating exists.
             static const bool keepalive_ack_enabled = [] {
                 const char* e = std::getenv("ULTRA_KEEPALIVE_ACK");
                 return e != nullptr && e[0] != '\0' && e[0] != '0';
@@ -4440,7 +4451,7 @@ void Connection::tick(uint32_t elapsed_ms) {
                     const long v = std::atol(e);
                     if (v >= 3000 && v <= 60000) return static_cast<uint32_t>(v);
                 }
-                return 25000u;
+                return 8000u;  // v2 (rig-proven): caps stall at 8 s, no collision
             }();
             if (keepalive_ack_enabled) {
                 arq_.keepaliveAckIfStalled(keepalive_ack_ms);