ieee80211: publish management rate contexts

[mgonzalezlopezudc]

Management frames need the rate facts for the BSS selected by their transaction.
The active association alone cannot identify that BSS during reassociation.
Management publishes accepted facts through the MIB, which returns copied snapshots with complete relationship identities.
A rate context identifies a relationship and its rate facts.
A target identifies the BSS selected by an authentication, association, or reassociation transaction.

A station retains AP A's active rates while it prepares association with AP B.
Queued frames for B retain B's target reference.
Failure removes B's target while A's active relationship remains intact.
An unknown target does not use A's rates.

The snapshots supply facts without a change to rate-selection policy.
An invalid reference makes the query return unknown context.
It does not cancel a queued originator transmission.
Custom management must publish facts at the actual relationship commit points.

Dependency and commit order

This branch includes the TXOP prerequisite from PR #1273.
Its prerequisite source tree matches cb3fda07885379d75a5f83de5afec02a34cc3eb2 exactly.
The included prerequisite tip is 189f489f98.
Its commit messages use the plan name ieee80211-txop-duration as their group label.
PR #1273 retains its own commit identities.

The prerequisite restores Block Ack inactivity deadlines after stop or crash.
HCF retires overdue agreements before channel access resumes.
Recipient retirement clears the peer and TID's reorder buffer.
Timeout zero retains no inactivity event.

Review the prerequisite first.
GitHub compares this PR against master, so its displayed diff includes the prerequisite.
Read the four rate-context commits in this order:

Commit	Purpose
3930423ccb	Prepare MIB snapshots and query identities.
c777523db8	Publish local and discovery rate facts through the snapshot contract.
543b33097c	Preserve transaction contexts, publish association facts, and record the Address 3 fingerprint effect.
b9134c399b	Complete authentication canceled by deauthentication.

Each topic commit references plan/pending/ieee80211-rate-context.md.
Each topic group label is ieee80211-rate-context.
The first topic commit includes that plan.
The full series contains 15 commits on base d9e14c5af24741e5c4b52d4cdcded7119f3fc2da.

Architecture and behavior

Management owns accepted advertisements and transaction state.
The MIB owns rate records, generations, incoming bindings, and snapshot queries.
snapshotRateContext() takes the peer, frame subtype, optional BSSID, and optional context reference.
It returns copied facts and identities.

References contain the BSSID, transaction identifier, and relationship generation.
Snapshots also contain the MIB generation.
A generation identifies a committed version of a relationship.
Queries reject stale references, conflicting identities, and ambiguous relationships.
Unknown facts remain distinct from known empty sets.

Full and simplified management publish local facts, discovery facts, accepted Beacon updates, and association facts.
Management validates legacy rate advertisements before publication.
APs reject association requests that omit required basic legacy rates.
Ieee80211Mib::RateUpdate groups related changes so listeners receive one notification after the complete state transition.

Management installs a target before its first frame enters the queue.
It binds the expected incoming subtype and peer to the transaction.
References survive queues, Packet copies, fragmentation, and RTS creation.
The MAC puts the selected BSSID in Address 3 of management frames.
The previous STA path leaves that field unspecified.
Reception removes the sender-local tag so each receiver resolves its own relationship.

Failure, cancellation, replacement, disassociation, stop, and crash remove the affected targets and incoming bindings.
Transaction identifiers remain unique across restart.
Deauthentication during pending authentication cancels the timeout and target.
The STA sends one refusal to the agent, which resumes its scan.
A duplicate frame causes no second completion.

Ieee80211RateContextTag contains local metadata without rate values or a new wire format.
Ieee80211MgmtTransactionTag retains its role for association-response outcomes.
The migration guide describes custom management publication and the prerequisite's external API changes.
WHATSNEW explains the user effects.

The four topic commits change no NED parameters or feature descriptors.
They touch no sealed source path.
They introduce no architecture or naming exception.
Control-rate selection, PHY response timing, TXOP admission policy, Block Ack wire formats, and A-MPDU integration remain outside the rate-context topic.

Validation

The current head is b9134c399b0eec6c63ae22f9a6fb28f367e53c0c.
Every corrected commit retains exactly the source tree of its corresponding commit before the label correction.
The final tree equals the tested rebase head 92dbb610c0e53d90619b1257237e229956f0495d.
Only the group labels and resulting commit identities differ.
The correction changes no source, test, configuration, or fingerprint value.

All 15 corrected commits build in debug mode and pass their nonempty focused tests.
The final head also builds in release mode.
The final union passes 26 module targets and seven unit targets.
All 48 selected fingerprint cases pass for tplx, ~tNl, and ~tND, with run 0 and seed 0.

Topic commit	Module targets	Unit targets
3930423ccb	1 PASS	2 PASS
c777523db8	6 PASS	3 PASS
543b33097c	18 PASS	3 PASS
b9134c399b	3 PASS	1 PASS

The commit, classification, source-seal, and committed whitespace checks pass across all 15 commits.
The scoped Wi-Fi architecture and naming checks pass.
All group labels match their Plan file stems.

The project-wide gates still report 36 architecture findings, 23 naming findings, and 15 interface findings.
A fresh control at the common base reports the same findings.
The candidate adds or removes none of those findings.
These project-wide gates remain nonzero.

The local evidence resides in audit/pull-request/pr1276-label-fix-20261005.
It records every commit, source tree, selector, command, exit status, and normalized verification result.

Each commit uses a fresh incremental debug build from the repository root:

source ./setenv -q
make MODE=debug CXX='ccache clang++' -j8 LN='cp -f' LDFLAGS_EXTRA=-Wl,--threads=2

The release build uses the same command with MODE=release.

The module and unit verification uses the installed opp_repl interface:

source ./setenv -q
opp_repl --load /home/user/opp_repl/opp_repl/opp/omnetpp.opp --load /home/user/opp_repl/opp_repl/opp/inet.opp -l WARN --external-command-log-level WARN --no-handle-exception <<'PY'
exec(compile(open('audit/pull-request/pr1276-label-fix-20261005/verify.py').read(), 'verify.py', 'exec'))
PY

Each invocation sets PR1276_LABEL_STAGE to its position from 1 through 15.
The final union uses final.
The local evidence script records the exact selectors and rejects an empty selection or a failed result.
It adds tests/module to the test include paths.
Each selected fixture starts from its committed test input.

The final module selector covers these targets:

• Ieee80211TargetRateContext_1, Ieee80211MgmtStaSimplifiedInitialization_1, Ieee80211MgmtApReassociationSnapshot_1, and Ieee80211MgmtStaLifecycle_1.
• Ieee80211HtAssociation_1, Ieee80211MgmtStaBeaconUpdate_1, Ieee80211MgmtStaDeauthentication_1, and Ieee80211MgmtStaDisassociation_1.
• Ieee80211AgentStaReassociation_1, Ieee80211MgmtStaDiscovery_1, Ieee80211MgmtApTimeout_1, and Ieee80211MgmtApHcfRtsTimeout_1.
• Ieee80211MgmtApQueueDrop_1, Ieee80211MgmtApLifecycle_1, Ieee80211MgmtApChannelChange_1, and Ieee80211MgmtApHcfQueueDrop_1.
• Ieee80211MgmtApMalformedHtCap_1, Ieee80211HcfManagementRecovery_1, Ieee80211BlockAckLifecycle_1, and Ieee80211PreparedCancellation_1.
• Ieee80211RetryMode_1, Ieee80211ExchangeTeardown_1, Ieee80211BlockAckRestart_1, and Ieee80211BlockAckRetirement_1.
• Ieee80211LifecycleGroup_1 and Ieee80211TxopExchange_1.

The final unit selector covers these targets:

• Ieee80211SupportedRates_1, Ieee80211MibPeerTeardown_1, and Ieee80211MgmtStaPrimitiveDispatch_1.
• Ieee80211PreparedOriginatorPolicy_1 and Ieee80211TxopDuration_1.
• FrameSequence_1 and Ieee80211BlockAckInactivity_1.

The target regression checks identity, unknown and empty facts, both association directions, same-AP targets, stale references, copies, publication, and lifecycle cleanup.
Its authentication case uses the real agent response path.
The restart target covers stop, crash, both roles, short and expired downtime, and timeout zero.
The retirement target checks deletion notifications, recipient buffers, replacement agreements, and late activity.

Fingerprint provenance

The selected BSSID changes serialized management frame bytes.
The transaction commit records 30 changed ~tND values with run 0 and seed 0.
Their tplx and ~tNl values remain the same.
The correction changes no stored expectation.

The 13 affected examples.csv rows cover these groups:

• WirelessDHCP and Wireless2DHCP.
• MIPv6 Handover, RouteOptimizationTwoCNs, MIPv6 Roaming, and PMIPv6 General.
• Wireless Handover, all five wireless/qos configurations, and wiredandwirelesshostswithap General.

The 13 affected showcases.csv rows cover these groups:

• All four canvas/ieee80211 configurations, interfacetable AdvancedFeatures, and networkpathactivity ChangingPaths.
• Packetdrop QueueOverflow, physicallinkactivity Filtering, and styling Annotation.
• Wireless Handover, Multiradio, and both wireless/qos configurations.

The four affected tutorials.csv rows cover configurator Step8A, Step8B, Step9, and Step12.
Every affected configuration uses full STA management.
The transaction message declares this cause and its fingerprint obligation.
The prerequisite also contains its 37 previously approved fingerprint row updates.

The final fingerprint check uses this selector from tests/fingerprint:

source ../../setenv -q
./fingerprinttest -d -t 6 -m '(/examples/dhcp/.*-c Wireless(2)?DHCP |/examples/ipv6/(mipv6|mipv6roaming|pmipv6)/|/examples/wireless/(handover|qos|scaling|wiredandwirelesshostswithap)/|/showcases/visualizer/canvas/(ieee80211|interfacetable|networkpathactivity|packetdrop|physicallinkactivity|styling)/|/showcases/wireless/(handover|multiradio|qos)/|/examples/wireless/lan80211/.*-c Ping1 |/examples/adhoc/qos/.*-c MacNonQos |/tutorials/configurator/.*-c (Step8A|Step8B|Step9|Step12) -r 0)' -f tplx -f '~tNl' -f '~tND' -l /home/user/omnetpp_ws/inet-ieee80211-rate-context/audit/pull-request/pr1276-label-fix-20261005/fingerprint-detail.log examples.csv showcases.csv tutorials.csv

The selected simulation time limits remain unchanged.
The check excludes tyf.
Fresh local execution does not cover the complete fingerprint suite, statistical baselines, or release-mode behavior tests.
Per-commit CI and fingerprints at each intermediate baseline commit remain unverified.

[devin-ai-integration]

Devin Review found 3 potential issues.

3 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)

[devin-ai-integration]

🔴 Protected continuations lose their TXOP

For an RTS-protected continuation, fitsTxnav compares the full exchange against a reservation covering only its RTS/CTS handshake. The valid continuation gets refused and must contend for another channel grant.

Learn more

A prepared continuation can contain RTS, CTS, data, and ACK. The preceding transmitted frame reserves the current exchange and only the first protected interval of the continuation in computePreparedDurationField. The current TXNAV therefore ends after CTS, not after the continuation's ACK. Comparing its remaining reservation with the whole continuation cost refuses a valid protected exchange even when the TXOP limit has room. Its RTS will establish a new reservation for the remaining data exchange.

Example: A frame reserves its own ACK, then SIFS + RTS + SIFS + CTS for the next frame. Once its ACK arrives, the TXNAV has enough time for RTS/CTS, but not for RTS/CTS + data + ACK. The continuation is refused despite enough TXOP airtime for all four steps.

Recommended fix: Compare the available TXNAV only with the interval that the preceding frame reserves for the next exchange. Keep admitExchange() responsible for checking the complete continuation against the TXOP limit. Test an RTS-protected continuation that fits both limits but whose full exchange extends beyond the previous reservation.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Shutdown sends queued radio configuration

When a MAC stops with a queued radio command, sendDownPendingRadioConfigMsg sends it during sequence cleanup. Tx has already reset, so its transmission guard no longer protects the stopped radio.

Learn more

A radio configuration command is queued when the medium is busy or Tx has a transmission. On MAC shutdown, handleStopOperation first resets Tx, then resets HCF or DCF. Their frameSequenceFinished callbacks flush the pending command. Tx now reports no transmission, so this method sends the command while the MAC is stopping.

Example: Queue a channel-change command during an HCF exchange, then stop the interface before transmission finishes. Sequence cleanup sends the channel change to the radio during shutdown instead of keeping the radio stopped.

Recommended fix: Separate normal exchange completion from lifecycle cleanup when flushing pending radio commands. Clear or defer the pending command on stop according to the intended restart policy; only send it while the MAC is operational.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Old active reference overrides pending target

During same-AP reassociation, snapshotRateContext accepts an explicit active reference for the outgoing request subtype. incomingRateContexts binds only the response subtype, so the conflicting pending target is missed and active rates are returned.

Learn more

A rate context reference identifies the BSS whose rate facts a queued management frame uses. A station binds a new association target to its incoming response subtype in startReassociation. The target lookup already recognizes an outgoing request and its corresponding response subtype in useTarget. The explicit-active path instead checks only the exact subtype's binding, then returns active facts when that binding does not exist.

Example: A station reassociates with its current AP. The new target is bound to ST_REASSOCIATIONRESPONSE, but querying ST_REASSOCIATIONREQUEST with an old active reference returns the active rate set instead of an unknown conflicting context.

Recommended fix: Apply the same corresponding-subtype binding check to explicit active references before returning active facts. Preserve the existing distinction between an absent target and a target bound to a different peer.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[mgonzalezlopezudc]

Superseded by PR #1301