Adaptive FHSS: autonomous TX sensing and endpoint evidence fusion

[josephnef]

Summary

Add autonomous TX-side sensing and hopset decisions as the final adaptive-FHSS stage. TX sensing supplements receiver delivery feedback and becomes a conservative failsafe when the return channel is unavailable; it must not introduce a second, incompatible schedule mutation path.

Follow-up to #153 / #262 and docs/fhss.md. Depends on the shared protocol in #263 and receiver-driven controller in #264.

Constraints

TX observes interference at the transmitter, not necessarily at the receiver. Hidden interferers and asymmetric links make local CCA disagree with end-to-end delivery. A single adapter also cannot continuously transmit and sense the same channel, and the measured follower jammer may activate only after detecting TX, making pre-transmission CCA insufficient.

All autonomous changes therefore use the same generation/commit mechanism from #263. No independent local mask or mutable RNG state is allowed.

Sensing modes

Use existing GetRxEnergy telemetry: CCA/false-alarm counters, IGI, and NHM. Add explicit observation opportunities:

retune -> settle -> quiet sense window -> read energy -> transmit remainder

Also evaluate post-burst sensing: briefly pause after TX and measure whether a reactive jammer lingers on the just-used channel. A second sensing adapter may serve as a measurement oracle during development but is not a final requirement.

Record per-channel sample count, quiet-window duration, CCA/FA/NHM evidence, and whether the observation was pre- or post-burst.

Decision authority

Expose explicit fusion policies:

• rx_authoritative: TX never originates exclusion.
• rx_plus_tx_veto (recommended default): RX proposes; strong contradictory TX evidence can delay/reject.
• either_endpoint: either endpoint may originate a proposal, TX still commits one serialized generation.
• tx_failsafe: TX-only proposals are allowed only after feedback absence exceeds a configured timeout.

TX-only exclusion requires stronger evidence than RX-driven exclusion:

• persistent high CCA/NHM on one channel with sufficient samples;
• other channels demonstrably cleaner;
• longer hysteresis and cooldown;
• no broad-band degradation;
• one exclusion before waiting for feedback/recovery evidence;
• all minimum-diversity and anti-herding constraints from Adaptive FHSS: receiver-driven exclusion, recovery probes, and anti-herding #264.

When feedback returns, receiver delivery evidence regains authority. Conflicting evidence must be surfaced, not silently averaged away.

Implementation

• Add a pure TX evidence classifier and endpoint-evidence fusion policy with structured reasons.
• Add configurable quiet/post-burst sensing opportunities without touching caller FEC payload framing.
• Feed autonomous proposals through Adaptive FHSS: authenticated hopset state and commit protocol #263's authenticated generation protocol.
• Extend markers/events with decision origin (rx, tx, fused, failsafe) and evidence summary.
• Measure and document sensing airtime cost in docs/fhss.md.

Hardware validation

• Jammer visible at RX but hidden from TX: RX decision must still converge.
• Interference visible at TX while RX delivery remains healthy: default policy must avoid needless exclusion.
• Feedback outage: tx_failsafe may adapt without causing RX split-brain; RX must reacquire the committed generation.
• Reactive follower: compare pre-burst and post-burst sensing effectiveness against the measured ~3.5 ms follower reaction floor.
• Herding jammer: rotate interference after each TX-originated exclusion; minimum diversity and cooldown must hold.
• Jammer removal: autonomous exclusions recover through keyed probes.
• Compare FEC delivery and throughput cost for each fusion policy.

Acceptance criteria

• Offline tests cover hidden-node disagreement, stale/missing feedback, broad interference, herding sequences, and policy precedence.
• TX never applies an uncommitted mask and peers never maintain independent generations.
• Default rx_plus_tx_veto does not regress receiver-driven parked-jammer delivery.
• tx_failsafe maintains synchronization through a feedback outage and improves delivery in at least one hardware scenario where local TX evidence is valid.
• Quiet/post-burst sensing overhead is quantified and bounded by configuration.
• Autonomous behavior is opt-in; Adaptive FHSS: receiver-driven exclusion, recovery probes, and anti-herding #264 receiver-driven behavior remains the safe default.