doc: audit pull request #1173 and add its change summary

PASS with 3 findings and 3 notes. 24 commits, 93 files, +10454/-424,
stacked on #1172: its first fourteen commits are #1172's by content --
six by hash, eight re-created with identical patch-ids -- and ten more
carry the AP side.

Commit 19 brings back the best thing #1154 did, in its better form:
terminal management frame outcomes as a signal with a details object and
three statistics, without the 1-to-1 callback ever having existed. Commit
22 is the first of five cuts of this work to cite the standard clause it
implements in its message.

F-1: commit 15 puts back the trailing blank line commit 1 removed,
fourteen commits apart in the same series. A correction must not survive
to review, and a reversal is not squashed but deleted -- drop both. It
also says something #1172's own audit could not: its praised whitespace
commit was later unwanted.

F-2: commit 24 rewrites 72 values in store.json that the CSV baselines
had already accepted before this branch -- the claim was checked at the
merge base and holds. As a commit it is right; as a passenger in an
802.11 branch it is wrong, since it repairs staleness in directories the
branch never touches. Its own pull request, mergeable today. Our gate
prints the same line for "squash this" and "move this"; recorded.

F-3: no WHATSNEW, fifth pull request running.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: levy

doc/project/audit/architecture-exceptions.md

@@ -59,7 +59,7 @@ and the interface declaration becomes pure. Where no Base exists, one is created
 | Id | Coupling | Where | Suggested resolution | Status |
 |---|---|---|---|---|
 | AV-CONTRACT-01 | **default bodies in an interface** — the shape that hides a break: `IIndicatorFigure::getNumSeries() { return 1; }` and `refreshDisplay() {}`; `IResolver::resolveExpression() { return ""; }`; `ICongestionController::readParameters/setStatistics/setPath() {}`; `QuicSocket::ICallback::socketNewToken() {}`; `TcpSocket::ICallback::socketIcmpv4Error/socketIcmpv6Error() {}` (2); `SctpSocket::ICallback` (12 no-op defaults and `socketOptionsArrived() { delete indication; }`) | `common/figures/`, `common/StringFormat.h`, `transportlayer/quic/congestioncontrol/`, `transportlayer/contract/{tcp,sctp,quic}/` | Make each pure; put the default in the Base the implementors already extend (`TcpAppBase` implements `TcpSocket::ICallback`) or create one (`CongestionControllerBase`, `SctpSocketCallbackBase`, `IndicatorFigureBase`). `IIndicatorFigure` is the live case of the hazard — see [pr-1125.md](report/pull-request/pr-1125.md) F-2, which renames it while keeping the body. | Open |
-| AV-CONTRACT-02 | **a body the Base could take today**: `IFunction::printOn()` → `FunctionBase` exists; `IIeee80211Band::printToStream()` → `Ieee80211BandBase` exists — **repaired by [#1172](report/pull-request/pr-1172.md), done when it merges**; `ITransmitStep/IReceiveStep::getType() { return TRANSMIT/RECEIVE; }` | `common/math/`, `physicallayer/wireless/ieee80211/mode/`, `linklayer/ieee80211/mac/contract/IFrameSequence.h` | Move the body down one level. Three small commits. | Open |
+| AV-CONTRACT-02 | **a body the Base could take today**: `IFunction::printOn()` → `FunctionBase` exists; `IIeee80211Band::printToStream()` → `Ieee80211BandBase` exists — **repaired by [#1172](report/pull-request/pr-1172.md) and carried in [#1173](report/pull-request/pr-1173.md); done when either merges**; `ITransmitStep/IReceiveStep::getType() { return TRANSMIT/RECEIVE; }` | `common/math/`, `physicallayer/wireless/ieee80211/mode/`, `linklayer/ieee80211/mac/contract/IFrameSequence.h` | Move the body down one level. Three small commits. | Open |
 | AV-CONTRACT-03 | **state in an interface**: `IRadio` and `ITransmission` each hold `uint64_t& nextId = SIMULATION_SHARED_COUNTER(nextId)`; `IMessageHandler` holds `Router *router` and a constructor that sets it; `IScheduler` holds `streamMap` and a constructor that sets it | `physicallayer/wireless/common/contract/packetlevel/`, `routing/ospfv2/messagehandler/`, `transportlayer/quic/scheduler/` | An interface with a constructor argument is a base class wearing the wrong name. Move the state to `RadioBase` / `TransmissionBase` (both exist), `MessageHandlerBase`, `SchedulerBase`. | Open |
 
 ### Genuine violations — *fix*

doc/project/audit/report/pull-request/pr-1173-summary.md

@@ -0,0 +1,254 @@
+# Change summary — INET pull request #1173, "ieee80211: HT capability negotiation and association, AP side"
+
+> **Kind:** report · **Status:** generated, do not edit · **Seal:** none · **Owns:** — · **Stands on:** [rule/pull-request.md](../../../rule/pull-request.md), [design/protocol-anatomy.md](../../../design/protocol-anatomy.md)
+
+Base `fbf0cc0c2d` (merge base with master) to head `095c457c10` — 24 commits, 93 files changed, 10454 insertions(+), 424 deletions(-).
+
+Generated by `opp_summarize_changes --pr 1173 --usage` (opp_repl). Re-generate it rather than editing it; the process is `opp_repl/plan/pending/change-summary.md`. The companion rule audit of the same pull request is [pr-1173.md](pr-1173.md): that one judges the *commits* against `PR-*`, this one states what the change does to the *interface*. The base is master, so this includes everything #1172 adds; #1173 is stacked on it.
+
+Extracted 2026-09-09 from the sources in 1.3 seconds; no build was needed. NED and message facts come from `opp_nedtool` and `opp_msgtool`, so they are those parsers' own view of the tree. C++ facts come from the fast header scan and are **indicative**: it joins multi-line declarations and excludes generated `*_m.h`, but it does not expand macros or resolve templates, so a declaration built by a macro is invisible to it.
+
+## In one line
+
+**126** added; **2** removed; **1** changed; **2** with a changed signature.
+
+## Breaking — check these first
+
+### Removed
+
+**1 C++ public function**
+
+- `Ieee80211EnumeratedBand::Ieee80211EnumeratedBand(const char *, const std::vector<Hz>)`
+
+**1 C++ extension point**
+
+- `Ieee80211MgmtAp::receiveSignal(cComponent *, simsignal_t, intval_t, cObject *)`
+
+### Changed
+
+**1 C++ public function**
+
+| What | Attribute | Change |
+|---|---|---|
+| `IIeee80211Band::printToStream(std::ostream &, int, int)` | pure | gained |
+
+### Signature changed
+
+**1 C++ public function**
+
+| What | Change |
+|---|---|
+| `Ieee80211ModeSet::Ieee80211ModeSet` | **+** `bool` |
+
+**1 C++ extension point**
+
+| What | Change |
+|---|---|
+| `Ieee80211MgmtAp::sendManagementFrame` | **+** `uint64_t` |
+
+### Renamed
+
+_nothing renamed_
+
+## Added
+
+**8 NED parameters**
+
+- `inet.linklayer.ieee80211.mac.coordinationfunction.Dcf.mibModule`
+- `inet.linklayer.ieee80211.mac.coordinationfunction.Hcf.mibModule`
+- `inet.linklayer.ieee80211.mac.rateselection.QosRateSelection.mibModule`
+- `inet.linklayer.ieee80211.mac.rateselection.RateSelection.mibModule`
+- `inet.linklayer.ieee80211.mgmt.Ieee80211MgmtApSimplified.radioModule`
+- `inet.linklayer.ieee80211.mib.Ieee80211Mib.htMaxAmpduLengthExponent`
+- `inet.linklayer.ieee80211.mib.Ieee80211Mib.htProtectionMode`
+- `inet.linklayer.ieee80211.mib.Ieee80211Mib.htSecondaryChannelOffset`
+
+**4 NED signals**
+
+- `inet.linklayer.ieee80211.mac.Ieee80211Mac.frameTransmissionOutcome`
+- `inet.linklayer.ieee80211.mac.coordinationfunction.Dcf.frameTransmissionOutcome`
+- `inet.linklayer.ieee80211.mac.coordinationfunction.Hcf.frameTransmissionOutcome`
+- `inet.linklayer.ieee80211.mgmt.Ieee80211MgmtSta.htNegotiationFailed`
+
+**4 NED statistics**
+
+- `inet.linklayer.ieee80211.mac.Ieee80211Mac.frameAcked`
+- `inet.linklayer.ieee80211.mac.Ieee80211Mac.frameDroppedBeforeTx`
+- `inet.linklayer.ieee80211.mac.Ieee80211Mac.frameRetryLimitReached`
+- `inet.linklayer.ieee80211.mac.Ieee80211Mac.frameTransmissionOutcome`
+
+**5 message types**
+
+- `FrameTransmissionDetails`
+- `FrameTransmissionStatus`
+- `Ieee80211HtCapabilitiesElement`
+- `Ieee80211HtOperationElement`
+- `Ieee80211MgmtTransactionTag`
+
+<details><summary><b>22 message fields</b></summary>
+
+- `FrameTransmissionDetails.status`
+- `Ieee80211HtCapabilitiesElement.greenfield`
+- `Ieee80211HtCapabilitiesElement.ldpc`
+- `Ieee80211HtCapabilitiesElement.maxAmpduLengthExponent`
+- `Ieee80211HtCapabilitiesElement.rxMcsSupported`
+- `Ieee80211HtCapabilitiesElement.shortGi20`
+- `Ieee80211HtCapabilitiesElement.shortGi40`
+- `Ieee80211HtCapabilitiesElement.supportedChannelWidth40Mhz`
+- `Ieee80211HtCapabilitiesElement.txMaxNss`
+- `Ieee80211HtCapabilitiesElement.txMcsSetDefined`
+- `Ieee80211HtCapabilitiesElement.txRxMcsSetNotEqual`
+- `Ieee80211HtCapabilitiesElement.txUnequalModulation`
+- `Ieee80211HtOperationElement.basicMcsSupported`
+- `Ieee80211HtOperationElement.primaryChannel`
+- `Ieee80211HtOperationElement.protectionMode`
+- `Ieee80211HtOperationElement.secondaryChannelOffset`
+- `Ieee80211HtOperationElement.staChannelWidth40Mhz`
+- `Ieee80211MgmtFrame.htCapabilities`
+- `Ieee80211MgmtFrame.htCapabilitiesPresent`
+- `Ieee80211MgmtFrame.htOperation`
+- `Ieee80211MgmtFrame.htOperationPresent`
+- `Ieee80211MgmtTransactionTag.transactionId`
+
+</details>
+
+**3 message enum values**
+
+- `FrameTransmissionStatus::FRAME_TRANSMISSION_STATUS_ACKNOWLEDGED`
+- `FrameTransmissionStatus::FRAME_TRANSMISSION_STATUS_DROPPED_BEFORE_TRANSMISSION`
+- `FrameTransmissionStatus::FRAME_TRANSMISSION_STATUS_RETRY_LIMIT_REACHED`
+
+**3 C++ classes**
+
+- `FrameTransmissionStatusFilter`
+- `Ieee80211MgmtSta::HtNegotiationFailure`
+- `Ieee80211Mib::PeerHtState`
+
+<details><summary><b>53 C++ public functions</b></summary>
+
+- `FrameTransmissionStatusFilter::FrameTransmissionStatusFilter(FrameTransmissionStatus)`
+- `FrameTransmissionStatusFilter::receiveSignal(cResultFilter *, simtime_t_cref, cObject *, cObject *)`
+- `IIeee80211Band::getChannelIndex(int)` — 3 src, 2 tests, 1 override
+- `IIeee80211Band::getStandardChannelNumber(int)` — 3 src, 1 tests, 1 override
+- `IIeee80211Band::isHt40OperationSupported(int, int)` — 4 src, 1 tests, 1 override
+- `IIeee80211Mode::getHtMcsIndex()` — 7 src, 4 tests, 2 overrides
+- `IIeee80211Mode::isHtShortGuardInterval()` — 4 src, 2 tests, 2 overrides
+- `Ieee80211BandBase::getChannelIndex(int)`
+- `Ieee80211BandBase::getStandardChannelNumber(int)`
+- `Ieee80211BandBase::isHt40OperationSupported(int, int)`
+- `Ieee80211BandBase::printToStream(std::ostream &, int, int)`
+- `Ieee80211EnumeratedBand::getChannelIndex(int)`
+- `Ieee80211EnumeratedBand::getStandardChannelNumber(int)`
+- `Ieee80211HtMcsNssMap::Ieee80211HtMcsNssMap()`
+- `Ieee80211HtMode::getHtMcsIndex()`
+- `Ieee80211HtMode::isHtShortGuardInterval()`
+- `Ieee80211MgmtSta::HtNegotiationFailure::getPeerAddress()` — **uncalled**
+- `Ieee80211MgmtSta::HtNegotiationFailure::getReason()` — 4 src, 3 tests
+- `Ieee80211MgmtSta::HtNegotiationFailure::getStatus()` — 11 src, 1 tests
+- `Ieee80211MgmtSta::HtNegotiationFailure::isReassociation()` — **tests only**
+- `Ieee80211MgmtSta::HtNegotiationFailure::setPeerAddress(const MacAddress &)` — **uncalled**
+- `Ieee80211MgmtSta::HtNegotiationFailure::setReason(const std::string &)` — **uncalled**
+- `Ieee80211MgmtSta::HtNegotiationFailure::setReassociation(bool)` — **uncalled**
+- `Ieee80211MgmtSta::HtNegotiationFailure::setStatus(HtAssociationResponseStatus)` — 10 src, 2 tests
+- `Ieee80211MgmtSta::~Ieee80211MgmtSta()`
+- `Ieee80211Mib::cancelAssociationIdReservation(const MacAddress &)` — 1 src, 5 tests
+- `Ieee80211Mib::clearAssociationIds()` — 1 src, 1 tests
+- `Ieee80211Mib::clearPeerHtCapabilities()` — 1 src, 0 tests
+- `Ieee80211Mib::commitAssociationId(const MacAddress &)` — 1 src, 1 tests
+- `Ieee80211Mib::findPeerHtState(const MacAddress &)` — 2 src, 9 tests
+- `Ieee80211Mib::getHtOperation()` — 7 src, 7 tests
+- `Ieee80211Mib::hasPrimaryChannel()` — 1 src, 3 tests
+- `Ieee80211Mib::isHtOperationSupported()` — 7 src, 5 tests
+- `Ieee80211Mib::removePeerHtCapabilities(const MacAddress &)` — 3 src, 1 tests
+- `Ieee80211Mib::requirePrimaryChannel()` — 1 src, 2 tests
+- `Ieee80211Mib::reserveAssociationId(const MacAddress &)` — 1 src, 5 tests
+- `Ieee80211Mib::setPeerHtCapabilities(const MacAddress &, const Ieee80211HtCapabilities &, const Ieee80211HtOperation &)` — 3 src, 4 tests
+- `Ieee80211Mib::setPrimaryChannel(int)` — 1 src, 2 tests
+- `Ieee80211Mib::updateLocalHtCapabilities(const physicallayer::Ieee80211ModeSet *, const std::set<Hz> &, int)` — **uncalled**
+- `Ieee80211ModeBase::getHtMcsIndex()`
+- `Ieee80211ModeBase::isHtShortGuardInterval()`
+- `Ieee80211ModeSet::getFastestLegacyOperationalMode()` — **tests only**
+- `Ieee80211ModeSet::getHtMcsMandatory()` — 1 src, 1 tests
+- `Ieee80211ModeSet::getHtMcsSupported()` — **tests only**
+- `Ieee80211ModeSet::getHtShortGuardIntervalChannelWidths()` — **tests only**
+- `Ieee80211ModeSet::getHtSupportedChannelWidths()` — 4 src, 1 tests
+- `Ieee80211ModeSet::getMaximumChannelWidth()` — **uncalled**
+- `Ieee80211ModeSet::getMaximumNumberOfSpatialStreams()` — 1 src, 0 tests
+- `Ieee80211ModeSet::isHtOperationSupported()` — 8 src, 5 tests
+- `Ieee80211ModeSet::isHtShortGuardIntervalSupported(Hz)` — 1 src, 1 tests
+- `Ieee80211Receiver::isHtChannelWidthSupported(Hz)` — 3 src, 0 tests, 1 override
+- `Ieee80211Transmitter::getChannel()` — 18 src, 0 tests, 1 override
+- `Ieee80211Transmitter::isHtChannelWidthSupported(Hz)` — 3 src, 0 tests, 1 override
+
+</details>
+
+<details><summary><b>24 C++ extension points</b></summary>
+
+- `Dcf::receiveSignal(cComponent *, simsignal_t, cObject *, cObject *)`
+- `Hcf::receiveSignal(cComponent *, simsignal_t, cObject *, cObject *)`
+- `Ieee80211MgmtAp::clearPendingAssociation(StaInfo *)` — **overridden nowhere**
+- `Ieee80211MgmtAp::createAssociationTransactionId()` — **overridden nowhere**
+- `Ieee80211MgmtAp::frameTransmissionFinished(const Packet *, FrameTransmissionStatus)` — 4 overrides
+- `Ieee80211MgmtApBase::receiveSignal(cComponent *, simsignal_t, intval_t, cObject *)`
+- `Ieee80211MgmtBase::addHtCapabilities(const Ptr<Ieee80211MgmtFrame> &)` — **overridden nowhere**
+- `Ieee80211MgmtBase::addHtOperation(const Ptr<Ieee80211MgmtFrame> &, const physicallayer::IIeee80211Band *)` — **overridden nowhere**
+- `Ieee80211MgmtSta::cancelPendingAssociation()` — **overridden nowhere**
+- `Ieee80211MgmtSta::cancelScanTimer()` — **overridden nowhere**
+- `Ieee80211MgmtSta::classifyAssociationResponse(const Ptr<const Ieee80211AssociationResponseFrame> &, const physicallayer::IIeee80211Band *, const Ieee80211HtOperation *, Ieee80211HtCapabilities &, Ieee80211HtOperation &, std::string &)` — **overridden nowhere**
+- `Ieee80211MgmtSta::clearCurrentAssociation()` — **overridden nowhere**
+- `Ieee80211MgmtSta::handleReassociationFailure(ApInfo *)` — 1 override
+- `Ieee80211MgmtSta::isHtBssSupported(const ApInfo *, std::string &)` — **overridden nowhere**
+- `Ieee80211MgmtSta::processAssociationResponse(Packet *, const Ptr<const Ieee80211MgmtHeader> &, bool)` — **overridden nowhere**
+- `Ieee80211MgmtSta::sendReassociationConfirm(ApInfo *, Ieee80211PrimResultCode)` — 4 overrides
+- `Ieee80211MgmtSta::startReassociation(ApInfo *, simtime_t)` — **overridden nowhere**
+- `Ieee80211MgmtSta::stop()`
+- `Ieee80211MgmtSta::terminateCurrentAssociationFromPeer(const MacAddress &)` — **overridden nowhere**
+- `Ieee80211MgmtStaSimplified::configureAssociation()` — **overridden nowhere**
+- `Ieee80211MgmtStaSimplified::handleStartOperation(LifecycleOperation *)`
+- `Ieee80211MgmtStaSimplified::stop()`
+- `QosRateSelection::getPeerCompatibleMode(const MacAddress &, const physicallayer::IIeee80211Mode *)` — **overridden nowhere**
+- `RateSelection::getPeerCompatibleMode(const MacAddress &, const physicallayer::IIeee80211Mode *)` — **overridden nowhere**
+
+</details>
+
+## Questions for the review
+
+Counted by name over `src/` and `tests/`, so *uncalled* is exact and everything else is a hint. An override is not listed: its visibility is fixed by its base, and fulfilling a hook is not a new promise.
+
+**6 new public function(s) that nothing calls** — why public? ([AR-EXT-MINIMAL-SURFACE](../../../rule/architecture.md#ar-ext-minimal-surface))
+
+- `Ieee80211MgmtSta::HtNegotiationFailure::getPeerAddress()`
+- `Ieee80211MgmtSta::HtNegotiationFailure::setPeerAddress(const MacAddress &)`
+- `Ieee80211MgmtSta::HtNegotiationFailure::setReason(const std::string &)`
+- `Ieee80211MgmtSta::HtNegotiationFailure::setReassociation(bool)`
+- `Ieee80211Mib::updateLocalHtCapabilities(const physicallayer::Ieee80211ModeSet *, const std::set<Hz> &, int)`
+- `Ieee80211ModeSet::getMaximumChannelWidth()`
+
+**4 new public function(s) called only from tests** — is the test testing behavior, or reaching in? ([AR-EXT-MINIMAL-SURFACE](../../../rule/architecture.md#ar-ext-minimal-surface))
+
+- `Ieee80211MgmtSta::HtNegotiationFailure::isReassociation()`
+- `Ieee80211ModeSet::getFastestLegacyOperationalMode()`
+- `Ieee80211ModeSet::getHtMcsSupported()`
+- `Ieee80211ModeSet::getHtShortGuardIntervalChannelWidths()`
+
+**15 new virtual(s) that nothing overrides** — what would an override do, and does a comment say so? ([AR-EXT-VIRTUAL-IS-A-PROMISE](../../../rule/architecture.md#ar-ext-virtual-is-a-promise))
+
+- `Ieee80211MgmtAp::clearPendingAssociation(StaInfo *)`
+- `Ieee80211MgmtAp::createAssociationTransactionId()`
+- `Ieee80211MgmtBase::addHtCapabilities(const Ptr<Ieee80211MgmtFrame> &)`
+- `Ieee80211MgmtBase::addHtOperation(const Ptr<Ieee80211MgmtFrame> &, const physicallayer::IIeee80211Band *)`
+- `Ieee80211MgmtSta::cancelPendingAssociation()`
+- `Ieee80211MgmtSta::cancelScanTimer()`
+- `Ieee80211MgmtSta::classifyAssociationResponse(const Ptr<const Ieee80211AssociationResponseFrame> &, const physicallayer::IIeee80211Band *, const Ieee80211HtOperation *, Ieee80211HtCapabilities &, Ieee80211HtOperation &, std::string &)`
+- `Ieee80211MgmtSta::clearCurrentAssociation()`
+- `Ieee80211MgmtSta::isHtBssSupported(const ApInfo *, std::string &)`
+- `Ieee80211MgmtSta::processAssociationResponse(Packet *, const Ptr<const Ieee80211MgmtHeader> &, bool)`
+- `Ieee80211MgmtSta::startReassociation(ApInfo *, simtime_t)`
+- `Ieee80211MgmtSta::terminateCurrentAssociationFromPeer(const MacAddress &)`
+- `Ieee80211MgmtStaSimplified::configureAssociation()`
+- `QosRateSelection::getPeerCompatibleMode(const MacAddress &, const physicallayer::IIeee80211Mode *)`
+- `RateSelection::getPeerCompatibleMode(const MacAddress &, const physicallayer::IIeee80211Mode *)`
+
+## Not changed
+
+project features · source folders · NED gates · NED properties · NED types