Adaptive FHSS: receiver-driven exclusion, recovery probes, and anti-herding

[josephnef]

Summary

Implement receiver-driven adaptive channel exclusion and recovery on top of the authenticated hopset protocol in #263. RX is the decision-maker because its delivery measurements describe the endpoint that must successfully decode; TX validates and commits the proposed generation.

Follow-up to #153 / #262 and docs/fhss.md. Depends on #263.

Channel evidence

Score each base-hopset channel by complete schedule opportunities, including frames that never decoded:

• expected and decoded slots / delivery ratio;
• CRC/ICV failures where surfaced;
• RSSI, SNR, EVM, and post-retune first-decode latency;
• CCA, false-alarm, IGI, and NHM snapshots where valid;
• consecutive impaired and recovered rounds.

Delivery is authoritative. Energy metrics distinguish interference from weak signal or synchronization loss but must not independently trigger exclusion.

Initial policy

Ship conservative configurable defaults:

• require at least 8 observation rounds;
• exclude at most one channel per generation;
• propose exclusion after delivery remains below 30% for 5 scored rounds while another channel remains healthy;
• minimum active set max(3, configured minimum);
• at least 10 rounds between updates;
• do not exclude when most channels degrade together;
• restore only after probe delivery exceeds 70% on 3 probes.

Expose the evidence and exact decision/rejection reason in structured events. Keep policy logic pure and headlessly testable.

Excluded-channel recovery probes

An excluded channel cannot prove recovery unless deliberately revisited. Every configurable P rounds, replace one normal data opportunity with a keyed probe slot:

• select excluded channels with a keyed permutation;
• transmit sync/control plus a small known probe, not caller FEC payload shards;
• feed probe delivery into restoration hysteresis;
• keep probe timing and selection keyed so recovery does not create a public periodic target.

Feedback transport

Reuse examples/duplex and existing hardware ACK/BlockAck support. Reserve an explicit low-rate feedback opportunity instead of sending arbitrary periodic feedback:

1. RX sends compact proposal/status after a known slot boundary.
2. TX listens during that control interval.
3. Hardware ACK confirms physical receipt where supported.
4. TX emits the authenticated commit from Adaptive FHSS: authenticated hopset state and commit protocol #263.
5. Normal video transmission resumes.

Measure the RX-blind cost using the methodology in tests/halfduplex_baseline.sh. First validate with separate directional adapters if useful, then require the final one-adapter-per-endpoint duplex arrangement.

Anti-herding constraints

• hard minimum active-channel count;
• one exclusion per update and update cooldown;
• evidence across multiple keyed visits;
• optional diversity requirements across configured channel groups;
• stop excluding under broad degradation;
• mandatory keyed recovery probes;
• configurable maximum excluded fraction.

Hardware validation

• Parked jammer: fixed keyed hopset versus adaptive exclusion; FEC delivery must improve after convergence.
• Jammer removal: excluded channel must rejoin after probe hysteresis.
• Herding jammer: move interference after every exclusion; controller must retain minimum diversity and avoid oscillation.
• Feedback loss during proposal/commit and TX/RX restart.
• Hidden interferer visible at RX but not TX.
• Quantify feedback/probe overhead and RX-blind delivery loss.

Acceptance criteria

• Offline tests cover thresholds, hysteresis, cooldown, broad-degradation detection, minimum diversity, exclusion/restoration, and adversarial evidence sequences.
• Process-level test completes proposal -> commit -> activation -> restoration without split-brain state.
• Hardware run improves FEC delivery under a parked jammer without losing lockstep synchronization.
• Herding test cannot reduce the link below configured minimum diversity.
• Adaptive mode remains opt-in; fixed keyed FHSS is unchanged by default.

Out of scope

• Autonomous TX-only exclusion; tracked separately after this receiver-driven stage.