fix(arq): revert keepalive default-on — re-emits re-assert rung command (pins R1/4); file BUG-MPG20-OVER-DEMOTE-R14 (pre-existing Good@20->R1/4 over-demote, the real 'doesn't make sense')

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019btwFxDt7D19SZSqPYvZnk

Author: secup

docs/CHANGELOG.md

@@ -84,6 +84,35 @@ Verified: ctest 85/85; good@20 PASS 1600 bps.
 
 ---
 
+## 2026-07-14 — fix(arq): keepalive ACK REVERTED to default-off — re-emits re-assert the rung command (pins R1/4 on a stall); + surfaced a pre-existing MPG@20 over-demote
+
+Rig F293-F298 (MPG@20, keepalive default-on) exposed two problems (operator-
+caught: "R1/4 doesn't make sense" + "ACK while receiving"):
+
+1. **KEEPALIVE FLAW (mine):** the keepalive re-emits the FULL tone-burst ACK,
+   which carries the current rung command (rate_hint). During a stall the
+   receiver's reading is momentarily low, so the re-emits (7× the same
+   group_seq) RE-ASSERT rate_hint=1 → PIN R1/4 through any recovery, and the
+   18 fires/transfer add ACK-vs-burst collision traffic (visible on the
+   waterfall). A keepalive must trigger a RESEND, not re-command the rung.
+   REVERTED to default-off. BLOCKER for default-on: emit a rung-NEUTRAL/HOLD
+   keepalive (base+bitmap only, don't refresh rate_hint).
+
+2. **PRE-EXISTING OVER-DEMOTE (the real "R1/4 doesn't make sense"):** at MPG@20
+   — Multipath GOOD — the receiver read fading index 0.65 as **Moderate** and
+   usable **8.8 dB** (channel 12.0, dial 20 → an 11 dB gap), so its authority
+   demoted to R1/4 (38× rate_hint=1). The Good/Moderate discriminator
+   fuzzy-boundary (0.65 straddles the threshold) + the large dial→usable gap
+   over-demote a healthy Good@20 channel. FILED: this is a rate-selection
+   accuracy issue independent of the keepalive — likely a bigger lever than the
+   stall fix (over-demoting to R1/4 at Good@20 caps throughput hard).
+
+The keepalive mechanism (cap the 44 s stall) remains sound + rig-proven
+(F290/F291 8 s cap; F292 universal 16 s cap); it needs the neutral-rung
+variant before default-on. Stays opt-in (ULTRA_KEEPALIVE_ACK=1).
+
+---
+
 ## 2026-07-14 — feat(arq): keepalive ACK now DEFAULT-ON — universal channel-busy gate makes it collision-safe on GUI AND TNC
 
 The TNC-path blocker is fixed. The keepalive's collision-safety no longer

docs/KNOWN_BUGS.md

@@ -27,6 +27,29 @@ Fixed/obsolete historical deep dives belong in `docs/CHANGELOG.md`.
   (~1.2 Hz clock/jitter wander over the 144 ms training window explains it exactly; sim reads
   10.1 dead-on). The operator display should eventually show BOTH numbers.
 
+### BUG-MPG20-OVER-DEMOTE-R14: Good@20 read as Moderate + low usable → authority over-demotes to R1/4 (operator: "R1/4 doesn't make sense")
+
+- **Rig F293-F298 (MPG@20, 2026-07-14).** At MPG@20 (Multipath GOOD, effective
+  ~15 dB) the receiver read fading index **0.65 → "Moderate"** and usable
+  **8.8 dB** (physical channel 12.0; dial 20 → usable 8.8 = ~11 dB gap), so the
+  RX authority commanded rate_hint=1 → **QPSK R1/4** (38× rate_hint=1 in one
+  transfer). R1/4 at Good@20 caps throughput hard (2 bits × R1/4 vs the R2/3
+  the channel supports).
+- **Two contributing causes (both pre-existing):** (a) the Good/Moderate
+  Doppler discriminator fuzzy boundary — 0.65 straddles the Good/Moderate
+  threshold, so Good@20 intermittently reads Moderate (see
+  [[project_disc_radio_agnostic_fuzzy_boundary_2026_06_20]]); (b) usable 8.8 vs
+  channel 12.0 vs dial 20 — the usable (effective/demod) SNR is ~3 dB under
+  physical AND physical is ~8 dB under dial (fading Jensen + implementation
+  loss), and the rate anchors may be too conservative for the honest-meter
+  scale at this fading class.
+- **Likely a BIGGER throughput lever than the stall fix** — over-demoting a
+  healthy Good@20 to R1/4 is a large, systematic loss. Investigate: is the
+  fading misclassification the dominant cause (fix the discriminator boundary),
+  or the usable-reading conservatism (fading class × anchor calibration)?
+- Independent of the keepalive (which merely AMPLIFIED it by re-asserting the
+  low rung — see CHANGELOG 2026-07-14).
+
 ### BUG-ANCHOR-WAIT-NO-ACK-STALL: marginal-SNR bursts rejected in full-anchor-wait emit NO ACK → sender 44 s RTO stall (THE marginal-SNR throughput lever, quantified ~+30%)
 
 - **Discovered/quantified 2026-07-14 (operator-caught "we didn't even ACK at

src/protocol/connection.cpp

@@ -4432,10 +4432,19 @@ void Connection::tick(uint32_t elapsed_ms) {
             // so it no longer depends on the GUI-only listen-before-ACK (which
             // had blocked default-on: the headless TNC lacked it). Both the GUI
             // (app.cpp) and the TNC (ultra_tnc.cpp) wire the query from the modem.
+            // DEFAULT-OFF (reverted 2026-07-14, rig F293-F298 MPG@20): the
+            // keepalive re-emits the FULL tone-burst ACK, which carries the
+            // current rung command (rate_hint). During a stall the receiver's
+            // reading is momentarily low (usable 8.8, fading misread Moderate),
+            // so the re-emits RE-ASSERT the low rung (rate_hint=1 → R1/4) 7×,
+            // PINNING R1/4 through recovery + adding ACK-vs-burst collision
+            // traffic (18 fires/transfer). A keepalive must trigger a RESEND,
+            // NOT re-command the rung. BLOCKER for default-on: emit a
+            // rung-NEUTRAL/HOLD keepalive (base+bitmap only, no rate_hint
+            // update). Until then opt-in.
             static const bool keepalive_ack_enabled = [] {
                 const char* e = std::getenv("ULTRA_KEEPALIVE_ACK");
-                if (!e || e[0] == '\0') return true;         // default-ON
-                return !(e[0] == '0' && e[1] == '\0');       // "0" opts out
+                return e != nullptr && e[0] != '\0' && e[0] != '0';
             }();
             // Threshold env-tunable (ULTRA_KEEPALIVE_ACK_MS, default 25000).
             // The keepalive routes through listen-before-ACK (defers on channel