[josephnef]

#566, causes not established: the two that remained after #576.

Witness logging: each cell.w frame line now carries per-path RSSI (dBm) and SNR (dB). This makes the witness a second receiver, aligned to each DU's clock, for TX power sweeps.

The power-to-RSSI non-linearity is one radio. testrig scripts/m6_txpwr_sweep.sh steps both DUs from 0 to −20 dB of offset, reading at four TX→RX pairs; results/2026-11-14-m6-causes.txt has the tables.

• DU2 (j6412-3 09:00) is linear over the full 20 dB at every reading, with SNR 33–41 dB.
• DU1 (j6412-1 09:00) is linear down to 9 dBm commanded. At 8 dBm it steps down 3–10 dB, depending on the receiving path, and the receivers' SNR falls 13–15 dB with it. So the signal fell, not just its estimate. A 0.5 dB sweep repeats the step.
• With the roles swapped, j6412-1 09:00 as the receiver sees the same collapse below about −62 dBm, from both transmitters. Links without it read exactly linear (−35 → −55 dBm and −43 → −64.5 dBm).

That localises it to that unit, in both directions. The mechanism inside it is not established. The crossing's "−9 dB reads −12" came from ramping DU1 into that region.

The roam baseline's 5.6–5.9 s return is a stale station. testrig m6_roam_baseline.sh --debug 1, A/B with --drop-left:

• An SME roam leaves the old AP holding the client.
• On the return, hostapd first deletes that station, and DEL_STATION took 428–443 ms on every removal.
• The client's authentication wait ran out first. It fell back to the AP it was leaving, which paid the same deletion, and ignored both for ~4.5 s.
• With the old AP dropping the client as it leaves (deauthenticate STA tx=0), every roam took 0.41–0.57 s (10/10, against 5/5 slow returns without).

docs/cell-m6.md updates both notes.

🤖 Generated with Claude Code

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Log per-path cell witness signal levels and document M6 findings

✨ Enhancement 📝 Documentation 🕐 10-20 Minutes

AI Description

• Add per-path RSSI and SNR to witness beacon and uplink logs for power-sweep analysis.
• Document evidence localizing the power-to-RSSI non-linearity to one radio.
• Explain slow roam returns as stale-station deletion and record the drop-left comparison.

Diagram

graph TD
  Radio["Radio packets"] --> Witness{"Beacon or UL?"} --> Levels["Path measurements"] --> Events["cell.w logs"] --> Sweep["TX power sweep"] --> Notes["M6 findings"]
  Roam["Roam A/B"] --> Notes

Loading

High-Level Assessment

Using existing packet radio attributes in the witness log is the smallest change that exposes a second receiver's measurements. The hardware and roam diagnoses belong in the M6 notes rather than in a new runtime mechanism; the cited testrig scripts and results are external to this diff.

Files changed (2) +34 / -10

Enhancement (1) +7 / -2

main.cppAdd per-path RSSI and SNR to witness frame events +7/-2

Add per-path RSSI and SNR to witness frame events

• Adds two-element RSSI and SNR arrays to beacon and uplink 'cell.w' JSON lines, converting packet radio attributes to dBm and dB. Other witness event formats are unchanged.

examples/cell/main.cpp

Documentation (1) +27 / -8

cell-m6.mdRecord radio-specific power behavior and stale-station roam diagnosis +27/-8

Record radio-specific power behavior and stale-station roam diagnosis

• Attributes the non-linear power-to-RSSI readings to one radio based on transmit, receive, and roles-swapped sweeps, while leaving its internal mechanism unresolved. Explains the slow roam return through stale station deletion and records the faster results when the departed AP drops the station.

docs/cell-m6.md

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Roam cycle claim outruns the cited roam evidence ✓ Resolved

Description

The roam-return paragraph in docs/cell-m6.md presents the stale-station mechanism as the settled
cause of the 5.6–5.9 s return and claims that each fallback clears the other AP's entry so the cycle
always alternates, with returns to one AP always slow and roams into the other always fast. The only
cited evidence is one drop-left A/B (10/10 fast versus 5/5 slow) and the 428–443 ms DEL_STATION
timings, which show neither the alternation nor any per-direction behaviour, and the results file
the doc relies on is not in the repository.

---

2. Unmeasured witness paths log as real readings ✓ Resolved

Description

The cell.w line writes rssi[1] - 110 and snr[1] / 2.0 unconditionally, so a path the PHY never
measured (raw 0, which the Kestrel parser documents as 'not measured') is emitted as -110 dBm and
0.0 dB. The Kestrel parser's per-path SNR on the 8852C is only filled from the IE walk, and rssi[1]
is left at 0 on any chip whose frame parser only sets rssi[0] (for example rtl8733b and the Jaguar
parsers), so such a path reads as a plausible-looking measurement. Because this line is meant as a
second receiver for TX power sweeps, a silently unmeasured path would be read as a real -110 dBm or
0 dB sample.

---

Tip of the day

💡 Did you know, you can ask Qodo to dismiss a finding you disagree with, with your reason on record

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[josephnef]

Both findings fixed in 3cd28251:

1. Roam wording. The doc now states what was measured. In 4 runs (40 roams), every roam into one AP was slow and every roam into the other was fast. hostapd logs the fallback's DEL_STATION at the AP being left. With --drop-left there were 10/10 fast, against 5/5 slow returns without it in the same session (testrig results/2026-11-14-m6-causes.txt, which has the per-roam gaps). The kernel-side split of the 430 ms remains stated as not traced. Follow-ups left open by M6 (#260): EVM, roam baseline, the named test, residuals #566 is updated after the merge.
2. Unmeasured path. A raw 0 (not measured) now logs as null for both RSSI and SNR. The sweep analyzer skips it.