arq/fsm: anchor the CALL retry to PTT-OFF, not to enqueue

fsm_calling had no ARQ_EV_TX_COMPLETE handler, so the 8 s retry deadline was
set when the CALL was QUEUED. A CALL spends ~3.8 s modulating (DATAC16), and
the peer cannot even start its ACCEPT until our PTT drops — its own ACCEPT then
takes another ~3.8 s. The retransmission therefore fired at t~8.0 s while the
ACCEPT was still arriving at t~8.1 s: a collision on essentially every connect,
costing a fourth transmission on a channel that had lost nothing.

fsm_accepting already anchors ACCEPT exactly this way (its TX_COMPLETE resets
the RX window from PTT-OFF); CALLING never got the same treatment.

Measured with tests/sim/connect_bench, 24 seeds per point:

     PER   connects            frames           censored time
    0.00   24/24 -> 24/24    4.0 -> 3.0      13.1 s -> 13.1 s
    0.10   24/24 -> 24/24    4.6 -> 3.9      19.5 s -> 22.2 s
    0.20   23/24 -> 24/24    5.4 -> 4.6      32.3 s -> 28.7 s
    0.30   21/24 -> 22/24    5.9 -> 5.3      49.4 s -> 48.2 s
    0.50   10/24 -> 15/24    6.5 -> 6.9     121.8 s -> 101.5 s

A clean connect now costs three transmissions for a three-frame handshake,
which is the point. Reliability improves where it matters most: at PER 0.5 the
success rate goes 10/24 to 15/24 and censored time drops 20 s.

Reported honestly: PER 0.10 censored time is ~2.7 s worse. The buggy early
retransmission was accidentally acting as a fast retry, so a genuinely lost
CALL now waits the full interval. I checked whether the interval should shrink
to compensate and it should not — at 6.5 s and 5.5 s the success rate FALLS
(12/12 -> 11/12 at PER 0.2, and worse at 0.5), because the four retry slots are
consumed sooner. 8 s stays.

The censored column counts a failure as the 180 s cap. Means over successes
alone are survivor-biased: when a change makes previously-hopeless connects
succeed, those slow successes inflate the success-only mean while the link has
actually improved. An earlier 12-seed run showed a PER 0.20 "regression" that
reversed at 24 seeds — small-sample means on this metric are not trustworthy.

Test verified to fail without the fix. Full C suite green (36 FSM tests).
Integration: one failure observed when the suite was started immediately after
a full parallel rebuild, then four consecutive passes (three at 203.6 s
identical); treated as load-related flake, not reproducible.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: rafael2k

datalink_arq/arq_fsm.c

@@ -839,6 +839,23 @@ static void fsm_calling(arq_session_t *sess, const arq_event_t *ev)
         }
         break;
 
+    case ARQ_EV_TX_COMPLETE:
+        /* Re-anchor the retry clock to PTT-OFF, not to when the frame was
+         * queued.
+         *
+         * A CALL spends ~3.8 s modulating (DATAC16), and the retry deadline
+         * was set when the frame was ENQUEUED — so that airtime came straight
+         * out of the 8 s retry interval. The peer cannot even begin its ACCEPT
+         * until our PTT drops, and its own ACCEPT takes another ~3.8 s, so the
+         * retransmission fired at t~8.0 s while the ACCEPT was still arriving
+         * at t~8.1 s: a collision on essentially every connect, costing a
+         * fourth transmission on a channel that lost nothing.
+         *
+         * fsm_accepting already anchors ACCEPT this way (see its TX_COMPLETE);
+         * CALLING never got the same treatment. */
+        sess->deadline_ms = deadline_from_s(arq_protocol_call_interval_s());
+        break;
+
     case ARQ_EV_TIMER_RETRY:
         if (sess->tx_retries_left > 0)
         {

tests/datalink_arq/test_arq_fsm.c

@@ -932,6 +932,39 @@ void test_irs_mirror_resets_toward_floor_on_silence(void)
     TEST_ASSERT_EQUAL_INT(MERCURY_MODE_MFSK, sess.peer_tx_mode);     /* stepped back to the floor */
 }
 
+/* The CALL retry clock must start when the burst leaves the air, not when it
+ * was queued.  A CALL spends ~3.8 s modulating, so anchoring at enqueue spent
+ * that airtime out of the 8 s retry interval and fired the retransmission at
+ * t~8.0 s — while the peer's ACCEPT was still arriving at t~8.1 s.  That cost
+ * a fourth transmission on a channel that had lost nothing (measured: 4.0
+ * frames for a 3-frame handshake on a clean link). */
+void test_calling_reanchors_retry_on_tx_complete(void)
+{
+    arq_event_t ev = make_event(ARQ_EV_APP_LISTEN);
+    arq_fsm_dispatch(&sess, &ev);
+
+    mock_set_uptime_ms(1000);
+    ev = make_event(ARQ_EV_APP_CONNECT);
+    strncpy(ev.remote_call, "DST1", CALLSIGN_MAX_SIZE);
+    arq_fsm_dispatch(&sess, &ev);
+    TEST_ASSERT_EQUAL_INT(ARQ_CONN_CALLING, sess.conn_state);
+    uint64_t deadline_at_enqueue = sess.deadline_ms;
+
+    /* The burst occupies the channel, then PTT drops. */
+    mock_set_uptime_ms(1000 + 3840);
+    ev = make_event(ARQ_EV_TX_COMPLETE);
+    arq_fsm_dispatch(&sess, &ev);
+
+    TEST_ASSERT_EQUAL_INT(ARQ_CONN_CALLING, sess.conn_state);
+    TEST_ASSERT_TRUE_MESSAGE(sess.deadline_ms > deadline_at_enqueue,
+        "CALL retry still anchored at enqueue: it will collide with the ACCEPT");
+    /* A full retry interval measured from PTT-OFF. */
+    TEST_ASSERT_UINT64_WITHIN(50,
+        (uint64_t)(1000 + 3840) +
+            (uint64_t)(arq_protocol_call_interval_s() * 1000.0f),
+        sess.deadline_ms);
+}
+
 int main(void)
 {
     UNITY_BEGIN();
@@ -972,5 +1005,6 @@ int main(void)
     RUN_TEST(test_irs_mirror_climbs_with_peer);
     RUN_TEST(test_irs_mirror_steps_down_on_duplicate);
     RUN_TEST(test_irs_mirror_resets_toward_floor_on_silence);
+    RUN_TEST(test_calling_reanchors_retry_on_tx_complete);
     return UNITY_END();
 }

tests/sim/connect_bench.c

@@ -76,31 +76,38 @@ int main(int argc, char **argv)
     int trials = (argc > 1) ? atoi(argv[1]) : 8;
 
     printf("Connect latency (virtual time, %d seeds per point)\n\n", trials);
-    printf("%8s %9s %12s %12s %10s\n",
-           "PER", "connects", "caller(ms)", "callee(ms)", "frames");
+    printf("%8s %9s %12s %12s %10s %12s\n",
+           "PER", "connects", "caller(ms)", "callee(ms)", "frames", "censored");
 
     const double pers[] = { 0.0, 0.1, 0.2, 0.3, 0.5 };
     for (unsigned p = 0; p < sizeof pers / sizeof pers[0]; p++)
     {
         unsigned ok = 0, fr = 0;
-        uint64_t sum_caller = 0, sum_callee = 0;
+        uint64_t sum_caller = 0, sum_callee = 0, sum_censored = 0;
         for (int t = 0; t < trials; t++)
         {
             run_t r = one_connect(pers[p], 1000u + (uint64_t)t * 7919u);
+            /* Censored mean: a failure counts as the cap, so improving the
+             * success rate cannot masquerade as a latency regression. Means
+             * over successes ALONE are survivor-biased — when a change makes
+             * previously-hopeless connects succeed, those slow successes pull
+             * the success-only mean up while the link actually got better. */
+            sum_censored += r.ok ? r.callee_ms : CONNECT_CAP_MS;
             if (!r.ok) continue;
             ok++;
             sum_caller += r.caller_ms;
             sum_callee += r.callee_ms;
             fr         += r.frames_a + r.frames_b;
         }
         if (ok)
-            printf("%8.2f %6u/%-3d %12.0f %12.0f %10.1f\n",
+            printf("%8.2f %6u/%-3d %12.0f %12.0f %10.1f %12.0f\n",
                    pers[p], ok, trials,
                    (double)sum_caller / ok, (double)sum_callee / ok,
-                   (double)fr / ok);
+                   (double)fr / ok, (double)sum_censored / trials);
         else
-            printf("%8.2f %6u/%-3d %12s %12s %10s\n",
-                   pers[p], ok, trials, "-", "-", "-");
+            printf("%8.2f %6u/%-3d %12s %12s %10s %12.0f\n",
+                   pers[p], ok, trials, "-", "-", "-",
+                   (double)sum_censored / trials);
         fflush(stdout);
     }
     return 0;