@@ -1003,6 +1003,19 @@ if(DEVOURER_MT7612U)
         ${CMAKE_CURRENT_SOURCE_DIR}/src/mt7612u/include)
 
     add_test(NAME mt7612u_tsf_api COMMAND Mt7612uTsfApiSelftest)
+
+    # The async RX ring's completion callback, driven with hand-filled
+    # transfers through a test hook: the parse runs under the ring lock, and a
+    # parser that counts an invalid PHY under that lock self-deadlocks. The
+    # cell fails itself after 2 s; TIMEOUT is the backstop.
+    add_executable(Mt7612uRxRingSelftest tests/mt7612u_rx_ring_selftest.cpp)
+    target_link_libraries(Mt7612uRxRingSelftest PRIVATE devourer
+                          PkgConfig::libusb Threads::Threads)
+    target_include_directories(Mt7612uRxRingSelftest PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}/src/mt7612u
+        ${CMAKE_CURRENT_SOURCE_DIR}/src/mt7612u/include)
+    add_test(NAME mt7612u_rx_ring COMMAND Mt7612uRxRingSelftest)
+    set_tests_properties(mt7612u_rx_ring PROPERTIES TIMEOUT 10)
 endif()
 
 # --- src/sta/: the device-free 802.11 station core -------------------------
 
@@ -60,11 +60,18 @@ How it reads the status FIFO:
   entries that echo the current arm's pktid. Entries carrying the previous
   arm's pktid are reported as late, any other as foreign - so late status from
   an unsettled arm never lands in the next arm's columns.
-- **Paced to the status, not the submit.** A submit only queues the USB
-  transfer, so each frame waits for its own status entry before the next is
-  sent, bounded by the ladder at the effective limit; an expired wait counts
-  as a per-frame status timeout. A final settle loop collects anything still
-  owed.
+- **Paced to the chip, then to the status.** A submit only queues the USB
+  transfer, so each frame first waits up to 1.5 s for that transfer to
+  complete - one that fails within that wait is resent and not counted as
+  sent, and the arm says how many did; one still in flight then counts as
+  sent, since a TX transfer has no timeout and a resend would air it twice
+  (should it fail later, the failure is charged to the next frame) - then
+  for its own
+  status entry, bounded by the ladder at the
+  effective limit and never less than 2 s; an expired wait counts as a
+  per-frame status timeout. A final settle loop collects anything still
+  owed. `DEVOURER_TXS_TRACE=1` logs every submit, expired wait and popped
+  entry with its raw words (`TXS` lines; the table is unchanged).
 - On receiver-ON passes the 1 Hz PHY tick runs from those waits, and WCID 1
   must read back as installed or the gate fails.
 
@@ -96,7 +103,8 @@ initvals.
 
 Columns: own-pktid entries / sent, successes, mean retry, max retry, fps,
 then per-frame status timeouts `T`, late entries from the previous arm `L`,
-foreign entries `F`; `U` = UNSETTLED. fps includes each frame's wait for its
+foreign entries `F`; `U` = UNSETTLED (fewer entries than frames sent, or
+an arm cut short before it sent all of its frames). fps includes each frame's wait for its
 own status entry: on a clean row it is per-frame submit-to-status time, on a
 row with timeouts it is the wait bound, not a rate.
 
@@ -163,30 +171,92 @@ What it shows:
   one late entry (or, for the very first arm, one foreign entry) in that
   SAME arm's row. Counting 39/40 rows, it hit five of sixteen at limit 0,
   eleven at limit 5 and seven on the initvals - one run each. Arm a lags in
-  every pass; which other arms lag varies from pass to pass. The table rules
-  out "status posted only on the next TX": at limit 0, receiver ON, arm f
-  lags with L1 although arm e before it settled 40/40 and owed nothing, and
-  arm g after it shows no late entry. What fits is the two-transfer read:
+  every pass; which other arms lag varies from pass to pass. This table
+  alone does not show "status posted only on the next TX" (at limit 0,
+  receiver ON, arm f lags with L1 although arm e before it settled 40/40 and
+  owed nothing, and arm g after it shows no late entry); the trace in
+  "Status posted on the next submit" below shows it for some arms. What fits
+  this table's first-entry case is the two-transfer read:
   when the FIFO is empty at the EXT read and an entry is filed before the
   main read, the popped entry is paired with the stale EXT word of the
   previous entry. On an arm's first entry that is the previous arm's pktid,
-  so the entry was counted late, the arm stayed one short, and every
-  per-frame wait timed out. A race on the poll timing, which is why it
-  varies from pass to pass and with the host. The gate now claims that
-  entry back (`txs_drain`), under all of: it is the arm's first popped entry
-  (no own entry yet), the arm has submitted a frame, and its pktid is that
-  of the last arm that sent a frame, which must have settled with no entry
-  owed - or, on the session's first arm, any pktid. A claimed entry counts
-  in entries, and in success when its SUCCESS bit is set; it stays out of
-  the retry columns, and is reported as "stale-EXT entries claimed". These
-  tables were taken before that change. With the claim keyed to the
-  previous arm, the author's unit then settled 16/16 arms at limits 5 and 0
-  (recorded on issue #461); keying it to the last arm that sent a frame,
-  so an arm with every submit failed is skipped, has not been run on
-  hardware.
+  so without a correction the entry counts as late, the arm stays one short,
+  and every per-frame wait times out. A race on the poll timing, which is
+  why it varies from pass to pass and with the host. These tables are
+  uncorrected. The gate claims that entry back (`txs_drain`), under all of:
+  it is the arm's first popped entry (no own entry yet), the arm has
+  submitted a frame, and its pktid is that of the last arm that sent a
+  frame, which must have settled with no entry owed - or, on the session's
+  first arm, any pktid. A claimed entry counts in entries, and in success
+  when its SUCCESS bit is set; it stays out of the retry columns, and is
+  reported as "stale-EXT entries claimed". With the claim, the author's unit
+  settled 16/16 arms at limits 5 and 0, and the ch6 uplink harness settled
+  every arm of both passes. If the arm's own entries still reach `sent`,
+  the claimed entry was not its own (one arm read 61/60 with one claimed),
+  and the gate hands it back to the late/foreign column at arm end; it does
+  the same when the claim was taken while the arm's first transfer was in
+  flight and that transfer then completed in error. The hand-back has a
+  blind spot: the claimed entry counts in entries, so the per-frame wait and
+  the settle loop are satisfied one status early, and the hand-back fires
+  only when the arm's last own entry pops inside the arm. A wrong claim
+  whose last own entry pops after the arm (n-1 own plus 1 claimed) reads
+  n/n, indistinguishable from a right one, and that entry lands in the next
+  arm - which, with the arm counted settled, may claim it in turn. An arm
+  whose surplus claim was handed back reads `sent`/`sent` and counts as
+  settled for the next arm's claim - it owes no entries, which is what the
+  condition asks; a MAC duplicate (own entries above `sent`) does not. The
+  settled condition cascades: one UNSETTLED arm disables the claim for every
+  following arm until an arm settles on its own, so on a unit whose arms do
+  not settle the claim buys almost nothing.
 - **Arms e-h**: e, f and g read like c whenever they are clean; nothing
   distinguishes them. h (broadcast, WCID 1) lagged in five of six passes.
 
+## Status posted on the next submit
+
+`tests/mt7612u_sta_uplink.sh` at ch6, retry limit 15, the RTL8812CU peer
+answering for the DUT's target in its arm A and for another address in arm
+B, with `DEVOURER_TXS_TRACE=1`: one run at 60 frames per arm and two at 20
+(the second pair differing only in the data-frame QSEL, below) - six harness
+arms, each running all sixteen gate arms.
+
+**Frames, not status, are what a gate paced faster than the air loses.** A
+per-frame wait far shorter than an unacknowledged frame's ~1.1 s on this
+channel (60 + 50 ms, say) submits ahead of the air: the chip's queue
+fills, its bulk OUT stops accepting, and a ring with a 1000 ms transfer
+timeout cancels 9-50 of every 60 frames per unicast arm. Those count as
+sent, and the surviving backlog files its status seconds later in later
+arms' rows, as late or foreign. TX transfers carry no timeout (as mt76's do
+not) - a full ring refuses a submit instead - and the gate waits for each
+transfer and floors the status wait at 2 s; with both, no transfer failed
+in any of the three runs.
+
+**Some arms file each frame's status only when the NEXT frame is
+submitted.** The trace shows it frame by frame: SUBMIT, the whole 2 s wait
+expires with nothing, and the entry pops within ~1 ms of the next frame's
+bulk transfer - so every wait times out, and the arm's last entry lands in
+the next arm as late (N-1/N, `late=1`). Which arms, across the six harness
+arms (rx0/rx1 = receiver off/on):
+
+| arm | rx0 | rx1 |
+|---|---|---|
+| a broadcast, No Ack | 6/6 | 6/6 |
+| h broadcast, wcid 1 | 6/6 | 6/6 |
+| e, f, g unicast No Ack (ownSA) | 0/6 | in all 3 peer-answering arms (A), one to three of e/f/g each; 0/3 in B |
+| b unicast Normal (static SA, never ACKed) | 1/6 | 1/6 |
+| c unicast No Ack; d unicast Normal (ownSA) | 0/6 | 0/6 |
+
+So broadcast holds every time, in both receiver states; unicast No-Ack holds
+only with the receiver on and a peer answering on the channel. Why the MAC
+holds the entry is not established. The 2 s floor does not cause it - no wait
+helps when the entry needs the next submit - but it makes a held arm cost
+2 s a frame, which is what makes the harness slow (35 min at 60 frames).
+
+**The data-frame queue is not it.** `MT_QSEL_EDCA` here is 1, which is
+mt76's HCCA value (`enum mt76_qsel`: MGMT 0, HCCA 1, EDCA 2). The two 20-frame
+runs aired data at QSEL 1 and at QSEL 2 from one build and read the same:
+the same arms held and the same ~1.1 s unacknowledged retire. The define is
+left as it is.
+
 ## Radiotap NOACK disables the retry
 
 `src/mt7612u/radiotap.cpp` maps radiotap TX_FLAGS NOACK to `rate->no_ack`, and
@@ -247,6 +317,25 @@ It is the difference between `docs/mt7612u.md`'s "address one-way links to
 broadcast or multicast" guidance and a usable one-way *unicast* link, which is
 why it is worth an issue of its own.
 
+## Open: ~1.1 s per unacknowledged frame on ch6
+
+On ch6 an unacknowledged frame at limit 15 retires in 1.1-1.4 s (arms b and d
+in arm B, b in both; the status reads 16 retries at OFDM 6M, rate word
+0x2000), against ~46 ms on ch36 above - ~70 ms an attempt where the EDCA
+arithmetic gives ~3-5 ms. Not the queue (above). What the registers say,
+decoded against mt76's field layout, none of it decisive:
+
+- `MT_TX_RTS_CFG` 0x00ffff20: RTS retry limit 32, threshold 0xffff.
+- `MT_CCK_PROT_CFG` 0x07f40003 / `MT_OFDM_PROT_CFG` 0x07f42004: CTRL 0 (no
+  protection), RTS-threshold enable set - so no RTS at 1400 bytes.
+- `MT_MM20/GF20_PROT_CFG` 0x01752004, `MM40/GF40` 0x03f52084: CTRL 1, RTS/CTS
+  FORCED for HT frames, at OFDM 24M. The first attempts at HT MCS7 would
+  each be an unanswered RTS, retried to 32 - but the same initvals ran on
+  ch36, and the final attempts (OFDM 6M) fall under OFDM_PROT, which is off.
+- `MT_TX_TIMEOUT_CFG` 0x000a2290: ACK timeout 0x22 (34 us).
+
+Nothing in-tree writes these after the initvals.
+
 ## Caveats
 
 - One adapter, near field, 40 frames per arm, one run per setting, one
 
@@ -380,11 +380,11 @@ and nothing was ever queued on the healthy path.
 
 ## Offline tests
 
-`ctest` runs eight MediaTek cells. The first four are C++ and need neither
+`ctest` runs nine MediaTek cells. The first four are C++ and need neither
 hardware nor the `DEVOURER_MT7612U` option — the code they cover is
-header-only. The fifth is C++ and needs the option, because it calls the
-subtree's own symbols. The sixth is header-only C++ gated on the option. The
-last two are Python and need the `reference/mt76` submodule:
+header-only. The fifth and sixth are C++ and need the option, because they
+call the subtree's own symbols. The seventh is header-only C++ gated on the
+option. The last two are Python and need the `reference/mt76` submodule:
 
 | cell | what it holds |
 |---|---|
@@ -393,6 +393,7 @@ last two are Python and need the `reference/mt76` submodule:
 | `mt7612u_rx_queue` | the RX hand-off queue's two load-bearing properties: a full ring drops the **newest** frame and counts it, and a popped slot outlives the queue lock. Broken, the first reorders frames or wedges the part and the second is a use-after-free — and both look like a healthy link until a packet processor falls behind |
 | `mt7612u_tsf_read` | that the TSF read stays coherent when the low word wraps between any two of its register accesses: a scripted counter swept across the wrap one microsecond at a time, every failure position, and an all-ones low word as a value. The pre-fix DW0,DW1 order runs against the same sweep and must tear, or the cell cannot see the bug. Mutation-tested by hand three ways — no retry, a retry that keeps the first high word, a retry that skips the low-word re-read — each fails |
 | `mt7612u_tsf_api` | that a failed TSF read stays distinguishable from a value at the C entry points: `mt7612u_read_tsf_chk` refuses a NULL device or output with -1 and does not write through the pointer, and `mt7612u_read_tsf` answers 0. `0xffffffff` is a legitimate register word here, so only the return code can carry a failure. Not free: deleting the guard in `mt7612u_read_tsf_chk` segfaults the cell (hand-run). Reaches the NULL refusals only; a failed transfer on a live device, the `Mt7612uRadio::ReadTsf` throw and the `tsf_write` caps bit need the part (`bringup caps` prints it, and `Mt7612uRadio::GetAdapterCaps` takes `tsf_write_ok` from it rather than restating it) |
+| `mt7612u_rx_ring` | the async ring's RX completion (`rx_done`, through the test hook `mt_async_rx_done_for_test`), driven with hand-filled transfers and no device: an invalid-PHY frame returns and counts `rx_invalid` and `rx_dropped`, a valid frame is delivered once, and a stranded slot (device pointer cleared by a stop) parses and counts nothing. The parse runs under the ring lock, so a parser that takes that lock again self-deadlocks on one corrupt RXWI; the cell fails itself after 2 s if the call does not return. It does not cover the resubmit or the stop/strand ordering, which need a transfer libusb owns |
 | `mt7612u_station_identity` | the station-identity decision and ownership hand-off (`src/mt7612u/StationIdentity.h`): both register reads fail closed, a failed port read is reported as a failed read rather than a mismatch, argument checks run before any I/O, the port comparison is tri-state (a failed read is UNKNOWN, never DIFFERENT), a verified move drops the arm, an unreadable one keeps it, and a failed start that unwinds restores it. Header-only, gated on `DEVOURER_MT7612U`, which the MediaTek CI jobs set. The hardware counterpart is `mt7612uprobe staid` (`docs/mt7612u-station-identity.md`) |
 | `mt7612u_usb_ids_vs_mt76` | that the id table above really is the complete `mt76x2u_device_table` from the pinned reference, byte-checked. An id we *forgot* is invisible to `mt7612u_usb_ids` — the adapter just falls through to the Realtek path — and the first draft of that header had 11 of the 16, taken from the host's kernel tree |
 | `mt7612u_initvals_generated` | that the checked-in `initvals.h` still matches what `tools/extract_mt7612u_tables.py` produces from the pinned reference |
@@ -421,7 +422,7 @@ nothing. Each fails the cell, and each names the property it broke.
 
 | test | what it holds |
 |---|---|
-| `api_link` | takes the address of all 39 public entry points while including only the public header, so a declaration that loses its definition is a link error. Still compiled as C, which is what keeps the `extern "C"` guard honest now the library itself is C++ |
+| `api_link` | takes the address of all 40 public entry points while including only the public header, so a declaration that loses its definition is a link error. Still compiled as C, which is what keeps the `extern "C"` guard honest while the library itself is C++ |
 | `frame_shape` | `mt_hdrlen_from_fc()` over management, all eight control subtypes and the five data shapes; the RX L2-pad fold on a synthetic QoS frame, with a negative control that redoes the old fixed-24 fold and asserts the QoS Control really is destroyed; the radiotap VHT bandwidth mapping over all eleven codes the part can express; the txwi pktid for a normal send (0), `MT_TXOPT_TXS` alone and `MT_TXOPT_PKTID(id)` |
 | `field_macros` | `MT_CTZ` against `__builtin_ctz` over all 32 single-bit and all 528 contiguous masks, plus a `FIELD_PREP`/`FIELD_GET` round-trip, plus a static initialiser that fails to compile if the macro stops being constant-foldable, plus the `MT_TX_RETRY_CFG` read-modify-write (both limits set, bits 16+ kept) |
 | `log_sink` | that `mt7612u_set_log_sink()` **diverts** rather than copies — stderr must stay silent while a sink is installed — that the sink gets the bare message with no prefix to double up, that every level letter arrives, and that NULL restores the built-in sink instead of silencing the library |
@@ -556,8 +557,9 @@ Stated because the numbers above are uniformly favourable.
   accepted and the URB then failed to deliver does not move it. The library's
   own `tx_err` cannot simply be added: it double-counts submit failures, counts
   URBs where this counts frames, and restarts at zero when a ring is torn down,
-  so `failed` would go backwards across an RX restart. Needs a monotonic
-  wire-failure counter in the library.
+  so `failed` would go backwards across an RX restart. `failed` counts
+  refusals only. `mt7612u_tx_wire_failed()` is the library's monotonic
+  per-frame wire-failure counter; `GetTxStats` does not read it yet.
 - **Effectively one witness implementation.** Every on-air number outside the
   regression matrix is an RTL8812AU running this project's `rxdemo`: `paggr`,
   `bw` and `rate` are that implementation's reading, not an independent
 
@@ -1001,8 +1001,8 @@ devourer::TxStats Mt7612uRadio::GetTxStats() {
    * a uint64_t reads as ~1.8e19. Reading it also took _mu, which send_packet
    * holds across a blocking submit - so a stats poll from another thread
    * stalled for as long as the TX ring was saturated. A documented gap beats
-   * four wrong numbers; the fix belongs in the library, which needs a
-   * monotonic wire-failure counter that outlives a ring.
+   * four wrong numbers. The library's monotonic per-frame counter is
+   * mt7612u_tx_wire_failed(), which this does not read yet.
    *
    * Counted here rather than read from mt7612u_get_stats(), which reports the
    * ASYNC RING's counters. mt_tx_raw() only uses that ring when one is running