RS-11.5 leg C: RXCONT turnaround exonerated — software discriminator space closed

LifeTrac-v25/DESIGN-CONTROLLER/TODO.md

@@ -2132,11 +2132,17 @@ Two consequences for what is worth doing next:
   Δcrc_err + Δtx_ok reconciles exactly; ring/host drops zero; CRC delta
   ≈ attributed loss). Eliminated: TX skips, host cmd TX, RX re-arm at
   start, prepare-ahead (A/B, spike unchanged), host drops, cumulative
-  in-train. Host+firmware audit clean at visible layers — root cause is
-  inside the L072 TX turnaround at the train tail (drain phase: all
-  submitted, last parked). Next: firmware discriminators — measured TX
-  duration in RFCO_PERTX, a counter on rearm-while-tx-pending, or one
-  run with inter-fragment RXCONT re-arm disabled. Also: (a) fix base
+  in-train. **Leg C (2026-08-02) also exonerated the RXCONT turnaround**:
+  with `LIFETRAC_RXCONT_ARM=0` (new daemon env + harness `-RxcontArm`,
+  production default 1 — NEVER ship 0, in-stream command delivery lives
+  in those listening gaps) the radio sat in STANDBY between fragments
+  and the spike was unchanged (idx11 22/66, Δcrc +62). Every
+  software-layer candidate is now eliminated; the cause is
+  physical/silicon (TX chain radiating corrupt bits, or deterministic
+  self-EMI). Next: **flash session** with firmware discriminators
+  (post-TX FIFO readback CRC at slot total−2, measured TX duration in
+  RFCO_PERTX, IRQ-flag capture) — or an SDR capture, which would settle
+  it without a flash. Also: (a) fix base
   gpio163 NRST (no longer resets the L072 — harness resets silently
   no-op; probe deltas are the workaround); (b) once fixed, revisit the
   CR-4/5 decision — its "zero CRC errors" basis was measured at the

LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_11_4_train_length_sweep_2026-08-02/RESULTS.md

@@ -172,18 +172,53 @@ opmode-guarded. The corruption source sits below host-side evidence —
 inside the fragment-turnaround (TX→STANDBY→RXCONT→TX cycling with the
 mailbox drain timing) or the PA/synth behaviour around it.
 
-## 8. Session verdict and residuals
+## 8. Leg C — RXCONT turnaround refuted; host-side discriminator space closed
+
+A daemon env gate (`LIFETRAC_RXCONT_ARM=0`, harness `-RxcontArm 0`,
+production default unchanged) disables all RXCONT arming, so the
+firmware's RS-4.12 re-arm chain never starts and the tractor radio sits
+in STANDBY between fragments — no TX→RXCONT→TX cycling at all (command
+downlink deliberately deaf for the run). 300 s @ 3000 B, probe-bracketed
+(archive `radio_monitor_20260802_094053_86bf5d7f`):
+
+| leg | RXCONT cycling | Δcrc_err | attributed | idx 11 |
+|-----|---------------:|---------:|-----------:|-------:|
+| A/B | on             | +75/+80  | 82/79      | 23/21  |
+| C   | **off**        | +62      | 66         | **22** |
+
+The spike and the CRC rate are unchanged (Δ within run-to-run spread).
+The inter-fragment turnaround is NOT the mechanism.
+
+Incidental: the idle bench accumulated +47 radio CRC errors over ~11 h
+overnight (ambient noise false-demods at ~4/h) — negligible against
+62–80 per 300 s run, but worth knowing the counter's noise floor.
+
+**With leg C, every software-layer candidate is eliminated** (TX skips,
+host command TX, RX re-arm at start, prepare-ahead, host-side drops,
+in-train cumulative, RXCONT turnaround). What remains is physical/
+silicon-level at slot total−2: the transmitter radiating corrupt bits
+for a reason invisible to the C-code guards (FIFO/PLL/PA behaviour), or
+deterministic self-EMI at the tractor (e.g., host UART burst timing).
+Discriminating those needs an SDR capture of a corrupt slot, or firmware
+instrumentation (post-TX FIFO readback CRC, IRQ-flag dumps) — a flash
+session either way.
+
+## 9. Session verdict and residuals
 
 **Diagnosis: 11–18% of trains lose per-frame slot total−2 to on-air CRC
-corruption; every other candidate eliminated; root cause is inside the
-L072 TX turnaround at the train tail and needs firmware-level
-instrumentation (or an SDR capture) to pin further.**
+corruption; every software-layer candidate eliminated (including, via
+leg C, the RXCONT turnaround); root cause is physical/silicon-level in
+the transmit chain or deterministic self-EMI, and needs an SDR capture
+or firmware instrumentation (post-TX FIFO readback CRC, IRQ-flag dumps,
+measured TX duration in RFCO) to pin further — a flash session either
+way.**
 
 Residuals for RS-11.5 follow-up:
-- Firmware discriminator ideas: per-fragment RFCO with measured (not
-  estimated) TX duration; a counter on RXCONT-arm-while-TX-pending;
-  disabling the inter-fragment RXCONT re-arm for one run (firmware
-  toggle) to test the turnaround-interference theory directly.
+- Firmware discriminators for the flash session: post-TX FIFO readback
+  CRC at slot total−2 (splits FIFO-corrupted-before-radiating from
+  radiated-clean-and-damaged-in-flight); measured (not estimated) TX
+  duration in RFCO_PERTX; SX1276 IRQ-flag capture per fragment. An SDR
+  capture of a corrupt slot would settle it without a flash.
 - Base board gpio163 NRST no longer resets the L072 (counters survived
   ~8 harness launches; harness resets silently no-op) — bench
   infrastructure fix needed; probe deltas are the workaround.

LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/radio_monitor_20260802_094053_86bf5d7f/params.txt

@@ -0,0 +1,28 @@
+git_sha=86bf5d7f
+duration_s=300
+synth_fps=2
+synth_budget_b=3000
+tx_pipeline=v3
+tx_pipeline_depth=2
+tx_batch=1
+tx_prepare_ahead=1
+train_gap_ms=40
+kf_request_disable=1
+parity_group=0
+aligned_pump=1
+reactive_fire=0
+probe_phase_sweep_ms=
+probe_sizes_b=
+ack_copies=2
+probe_echo=0
+fhss_farm_id=0
+fhss_link_id=0
+airtime_budget_us=0
+pacing_mode=smooth
+pacing_headroom=0
+tx_feed=local
+reg_profile=2
+tx_serial=2E2C1209DABC240B
+rx_serial=2D0A1209DABC240B
+host_ip=192.168.1.79
+timestamp=20260802_094053