Pull request overview

This PR adjusts RadioModel’s TCP ping watchdog to avoid false disconnects during Multi-Flex join bursts, where the radio may temporarily delay ping replies while replaying status/stream ownership to another newly connected client.

Changes:

• Track the timestamp of recent foreign client ... connected status messages.
• Add a single 5-second grace window that defers the forced-disconnect decision if the missed-ping threshold coincides with a recent Multi-Flex client-connect burst.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

Thanks for this, @rfoust — it's a tidy, well-scoped fix backed by a real reproduction log. I traced the logic against RadioModel.cpp and it holds up. All 6 CI checks are green.

What I verified

• Grace state is reset on (re)connect — both m_lastMultiFlexClientConnectMs and m_multiFlexPingGraceUntilMs are cleared in startNetworkMonitor(), so a stale timestamp can't carry across sessions.
• The arming site is correctly gated — the m_lastMultiFlexClientConnectMs write sits inside the connected branch of onStatusReceived() and is guarded by handle != clientHandle(), so our own connect echo doesn't trigger it.
• The grace is bounded for a single connect burst — detection window is (missThreshold + 1) * interval (~6 s at the 1 s ping cadence) measured from the connect, and grace itself is 5 s; once the connect is older than the window, the normal forceDisconnect() path runs. So a genuinely-dead link after a join still disconnects, just ~5 s later. Good.
• sendCmd("ping") is kept alive during the deferral — so a recovered link resets m_pingMissCount via pingRttMeasured and the watchdog returns to normal. The now >= m_lastMultiFlexClientConnectMs clock-rewind guard is a nice defensive touch.

One minor observation (non-blocking)

The PR describes "one 5-second grace period," but the mechanism actually grants grace per foreign client-connect event, not once globally. If the radio replays multiple client … connected status messages (e.g. several SmartSDR clients joining, or repeated status replays), each refreshes m_lastMultiFlexClientConnectMs and can re-arm the 5 s window. In practice this is fine — and arguably what you'd want, since each real join deserves grace — but it does mean deferral can extend past a single 5 s window during a sustained connect storm. Worth a one-line comment noting the per-event semantics so a future reader doesn't assume it's strictly one-shot. No change required.

Nice work — the defensive resets and the bounded-window design are exactly right for a watchdog override.

_{🤖 aethersdr-agent · cost: $2.9577 · model: claude-opus-4-8}