fix(figc4.4 + figc4.5 + §4.4.2/§6.4.4): discard out-of-window duplicate I frames — X.25 2.4.6.4(a) guard, bound = negotiated k (#40)

[M0LTE]

Fixes #40. Figure + prose in one PR, following the #38/#65 (abd46b0) precedent: figc4.4 and figc4.5 as two independently revertable commits, prose in the v2.3 draft as a third.

What changed in each figure, and why

Both I-received out-of-sequence arms treated any N(s) ≠ V(r) as a fresh out-of-sequence frame. A late duplicate of an already-acknowledged frame was saved into the receive buffer (SREJ branch — the misdelivery vector) or answered with REJ; with an empty sender queue the SREJ names a frame that will never exist, an exception nothing can clear, re-sent on every poll per §4.4.4 (the 3m22s on-air capture against BPQ in #40, plus the fuzzer ping-pong livelock).

• figc4.4 DataLink_Connected.graphml (commit 1): new decision diamond spliced between N(s) == V(r)?:No and Reject Exception?. Its No arm merges into the existing reject-exception discard arm (Discard Contents of I Frame → P == 1? → RR F=1 / nothing) — no new action boxes, exactly the packet.net formulation quoted in figc4.4/figc4.5 Connected I_received lacks the X.25 §2.4.6.4(a) out-of-window duplicate-discard guard #40. The out-of-sequence subtree (Reject Exception? through the own-busy discard arm) shifted one column right (+202.5) to make room; the Reject Exception?:Yes edge re-routed down-then-left into the discard box's right side.
• figc4.5 DataLink_TimerRecovery.graphml (commit 2): identical splice; Reject Exception? moved one staircase step down-right (midway to SREJ Enabled), preserving the page's diagonal idiom. figc4.5 is where the on-air trigger actually fires — the peer's checkpoint retransmission (stale F=1 N(R)) is what delivers the already-acknowledged N(s).

Guard placement nuance (one step earlier than the issue comment's "before the srej_enabled split"): the diamond sits before Reject Exception?, not between Reject Exception?:No and SREJ Enabled?. Semantics are identical — the reject-exception:Yes arm already discards, and the guard's No arm routes to that same discard box — but this way all six out-of-sequence transitions route through the guard, and the drawing needs no crossing edges. The guard precedes Save Contents of I Frame on every path, closing the misdelivery vector.

The question text and what it mints

Drawn verbatim in both figures (matching the existing V(a) <= N(r) <= V(s)? chained-comparison idiom):

V(r) < N(s) < V(r) + k?

Walker-minted: id: i_vr_lt_ns_lt_vr_plus_k, predicate: vr_lt_ns_lt_vr_plus_k (verified by running Packet.Sdl.Transcribe; identical in both pages). Registered in spec-sdl/predicates.yaml under sequence_variables with a comment fixing the semantics: open interval per §4.4.2 / X.25 §2.4.6.4(b), modulo comparison, k = the window size this receiver granted — never a constant. direwolf's GENEROUS_K 63 collapses at modulo 8 (63 mod 8 = 7: the only value ever discarded is the frame exactly one behind V(r); two behind is saved as a future frame), and modulo 8 + SREJ is reachable (BPQ proposes exactly that; the #40 capture ran on it).

Walker output (house format)

• DataLink_Connected.graphml → connected.sdl.yaml: 68 transitions / 39 decisions (was 66 / 38), zero branch: Undefined, zero next: Undefined (before and after).
• DataLink_TimerRecovery.graphml → timer_recovery.sdl.yaml: 92 transitions / 47 decisions (was 90 / 46), zero branch: Undefined, zero next: Undefined (before and after).

Per figure: the six out-of-sequence transitions gain { decision: i_vr_lt_ns_lt_vr_plus_k, branch: Yes } and re-suffix (insert yes_ after ..._no_no_); two new guard:No transitions per figure (..._no_no_no_yes = discard + RR F=1, ..._no_no_no_no = discard only). Note the ids ..._no_no_no_{yes,no} are re-minted — the pre-change ..._no_no_no_no was the REJ arm; the citations files carry a CAUTION comment about this.

Citations: both .citations.yaml files re-keyed for the renames, header note added in the #55-correction style, and ERRATUM (#40) entries written for the four new transitions (§4.4.2 quotes; direwolf is_ns_in_window with the GENEROUS_K caveat; linbpq SDIFRM/CheckNSLoop as negative evidence — linbpq line numbers were verified at 560e9fc per #40, while the file's pinned commit is 88a6898; function anchors are the primary reference).

Prose amended (v2.3 draft only; v2.2.4 stays frozen, per the abd46b0 convention)

• §4.4.2: new paragraph making the disposal explicit — out-of-window N(S) is a duplicate of an already-acknowledged frame: discard, no REJ/SREJ exception raised (no frame is missing, so no coherent N(R) exists), respond RR F=1 N(R)=V(R) only to P=1, whether or not SREJ is negotiated; points at the new figure decision. This closes the "disposes only of the information field, silent on exceptions" gap.
• §6.4.4.1 (REJ): REJ now conditioned on N(S) being within the receive window; out-of-window → no REJ, no exception (cross-refs §4.4.2).
• §6.4.4.2 (SREJ): retention conditioned on the window; new paragraph for the out-of-window case, keyed to the "no coherent N(R)" argument. This removes the literal reading that ordered an SREJ for any N(S) ≠ V(R).
• "Changes from Version 2.2" table: row appended (the table asks for this; note abd46b0 did not add a row for figc4.5 (Timer Recovery): SREJ handler specifies go-back-N, contradicting §4.3.2.4/§6.4.8 and figc4.4 #38 — if the convention is actually "no table rows for errata", drop this hunk).

The three open editorial calls (from the #40 fix spec)

1. Does the guard cover the REJ branch too? → Yes. One guard ahead of the whole out-of-sequence fan covers SREJ and REJ branches alike; §6.4.4.1 amended to match. Trades a spurious go-back-N burst for a T1 wait; every deployed REJ-mode stack recovers through poll/F-bit machinery regardless.
2. P=1 out-of-window frame when genuine gaps exist → plain RR F=1 (§6.2 style), which is what the merged discard arm already draws. The direwolf-style SREJ fan (X.25 2.4.6.11) is not drawn and not mentioned in prose as a permitted alternative — flagging that as a residual editorial choice for review; adding a permissive note to §6.4.4.2 would be a one-sentence follow-up.
3. k <= modulus/2 clamp → stays in Window wrap — k should always be less than half the modulus? #13. Not drawn, not put in prose. The predicates.yaml comment records that the bound is the receiver's granted k; the Window wrap — k should always be less than half the modulus? #13 companion invariant (window guard alone is porous at mod 8 when k ≥ 5) still needs its own erratum, and this PR does not pretend to cover it.

Verification

• CI drift jobs simulated locally, both clean: Packet.Sdl.Transcribe (tooling pin ff5bc7d; the Transcribe walker is byte-identical between the pin and ax25sdl HEAD 4212c1e) regenerates exactly the committed *.sdl.yaml; tools/render/render_all.py regenerates exactly the committed SVGs.
• Renders: before/after rendered and inspected for both figures (full page + splice crops). Mechanical segment-vs-node check of every edge polyline against every node box: zero new edge-through-node incidents in either figure (TimerRecovery's six pre-existing incidents are unchanged). The two committed SVG diffs are reviewable as GitHub rich image diffs.
• ax25sdl (working tree only, nothing committed there): submodule pointed at this branch; Packet.Sdl.CodeGen runs clean through all pages and lints (the new predicate passes the catalog-completeness lint); dotnet test: conformance 270/270 pass; codegen tests show exactly the four expected movers — Walks_every_existing_state_page pins (Connected 66/38 → 68/39, TimerRecovery 90/46 → 92/47) and the two Yaml_round_trips_…_matches_committed_snapshot fixtures — plus 8 RustEmitter failures that are pre-existing on this machine (rustfmt not installed; identical failure set with the submodule at the old pin).
• The .g.mmd files committed here were produced by the ax25sdl CodeGen mermaid emitter against this branch.

Follow-up work this implies (not in this PR)

• ax25sdl regen PR (the 56bbccd shape): bump the submodule pin + .github/ax25sdl-tooling-ref consumers, update TranscribeTests.cs pins to (68, 39) and (92, 47), regenerate the Fixtures/transcribe/*.sdl.yaml snapshots and the seven language backends.
• Runtime bindings for the new predicate: vr_lt_ns_lt_vr_plus_k has no legacy binding. packet.net Ax25SessionBindings.cs and ax25-ts session-bindings.ts must bind it (modulo comparison, receiver's granted k) before consuming the regenerated backends — the bindings lint silently skips when those files are absent from the codegen working dir, so this will not fail CI anywhere; it has to be tracked manually.

Not verified / caveats

• The X.25 text itself was not read first-hand — 2.4.6.4(a)/(b) are cited as quoted in direwolf's comments and the existing connected.citations.yaml, per the same caveat in figc4.4/figc4.5 Connected I_received lacks the X.25 §2.4.6.4(a) out-of-window duplicate-discard guard #40.
• Go/Rust canonical-formatting steps of CodeGen could not run locally (gofmt/rustfmt not installed); irrelevant to this PR (no backends committed) but noted for the follow-up regen PR.
• A few pre-existing renderer quirks (edges whose yEd anchor sits ~0.007px outside the shape border collapse to a stub — e.g. the SReject Exception > 0?:No entry into N(s) > V(r) + 1? in figc4.4) exist in the committed renders and are deliberately left untouched so the SVG diffs stay scoped to the splice.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EvTRUwL676xWw3WHu1mKPE

[github-actions]

SVG figure changes (abd46b05 → 022289d6)

spec-sdl/v2.2-errata/data-link/svg/DataLink_Connected.svg

nodes 181→182, edges 209→211, labels 71→73

	what	change
+	node	V(r) < N(s) < V(r) + k?
+	label	No (by Discard Contents of I Frame)
+	label	Yes (by V(r) < N(s) < V(r) + k?)
+	edge	N(s) == V(r)? → V(r) < N(s) < V(r) + k?
+	edge	V(r) < N(s) < V(r) + k? → Discard Contents of I Frame
+	edge	V(r) < N(s) < V(r) + k? → Reject Exception?
−	edge	N(s) == V(r)? → Reject Exception?

spec-sdl/v2.2-errata/data-link/svg/DataLink_TimerRecovery.svg

nodes 240→241, edges 270→272, labels 112→114

	what	change
+	node	V(r) < N(s) < V(r) + k?
+	label	No (by Discard Contents of I Frame)
+	label	Yes (by Reject Exception?)
+	edge	N(s) == V(r)? → V(r) < N(s) < V(r) + k?
+	edge	V(r) < N(s) < V(r) + k? → Discard Contents of I Frame
+	edge	V(r) < N(s) < V(r) + k? → Reject Exception?
−	edge	N(s) == V(r)? → Reject Exception?

Interactive viewers — swipe, onion-skin, blink, and a clickable change list that zooms to each change — are attached to this run as the svg-figure-diff artifact: download, unzip, open the HTML.

_{Locally: python3 tools/svgdiff/svg_diff.py main HEAD --all --merge-base}

[M0LTE]

Claude Code review — 3 finding(s)

normal: doc/ax.25.2.3-draft.md:9-1170

Errata row and §4.4.2 body assert Figures C4.4 and C4.5 now contain a 'V(r) < N(s) < V(r) + k?' decision, but the embedded PNG figures are not updated in this PR — readers who follow the figure references find no such box.

nit: spec-sdl/predicates.yaml:68-70

X.25 sub-clause citation inconsistent with the rest of the change: predicates.yaml cites X.25 §2.4.6.4(b) for vr_lt_ns_lt_vr_plus_k, but the same commit cites X.25 §2.4.6.4(a) in three other places — the errata row in doc/ax.25.2.3-draft.md ("Matches X.25 §2.4.6.4(a)") and the identical direwolf is_ns_in_window note added to both connected.citations.yaml and timer_recovery.citations.yaml ("X.25 2.4.6.4 (a): N(S) outside the window — discard, respond only if P=1"). Only one sub-clause can name the out-of-window discard behaviour.

nit: spec-sdl/v2.2-errata/data-link/yaml/connected.citations.yaml:82-87

Legacy-id → t26 mapping table in the file header (lines 82-87) not updated for the #40 rename: it still lists the six old keys (e.g. t17_..._out_of_seq_srej_disabled → t26_i_received_yes_yes_yes_no_no_no_no, t12_..._reject_exception_p_eq_1 → t26_i_received_yes_yes_yes_no_no_yes_yes), but the diff renamed those keys under transitions: (_no_no_no_no → _no_no_yes_no_no, _no_no_yes_yes → _no_no_yes_yes_yes, etc.) and RE-MINTED t26_i_received_yes_yes_yes_no_no_no_{yes,no} for the two new out-of-window guard:No paths — a completely different semantic than the pre-#40 REJ arm the header still claims lives there.

---

Generated by Claude Code