ieee80211: separate capability and BSS state ownership

WHATSNEW

@@ -280,6 +280,23 @@ Notable backward incompatible changes are the following:
     arrives, so renewal timing does not move; traffic from the client starts one
     probeWait later.
 
+16. IEEE 802.11 capability and BSS state ownership
+
+    HT capabilities are prepared independently of the active BSS operation.
+    Simplified associations prepare both peers before network configuration,
+    regardless of node declaration order. Accepted BSS changes publish a
+    bssStateChanged notification after management completes its bookkeeping.
+    Legacy simplified stations retain BSS identity and channel information
+    without accepting the HT operation advertised by an HT access point.
+
+    Custom WLAN modules must replace ModeSetListener and modesetChanged with
+    an explicit modeSetModule using IIeee80211ModeSetProvider, and replace
+    direct MIB BSS/profile writes with the owner APIs. Custom HT PHY contributors
+    use typed capability interfaces. The migration guide describes these source
+    and wiring changes.
+    The selected legacy QoS and non-QoS ad hoc fingerprints remain unchanged;
+    no recorded fingerprint baseline was updated.
+
 Notable backward compatible changes are the following:
 
 1. IEEE 802.11 per-station rate statistics

doc/project/design/ieee80211-model-architecture.md

@@ -92,3 +92,29 @@ Concrete signals declare their source/scope, change condition, payload, and life
 [AR-COM-NOTIFY](../rule/architecture.md#ar-com-notify). An immutable borrowed snapshot is allowed;
 it creates no second writable authority. Commands, queries, and required coordination use typed
 calls or protocol messages, rather than notifications.
+
+**Implemented HT contracts.** `IIeee80211ModeSetProvider` exposes the configured catalog after
+`LOCAL`. `IIeee80211MacConfiguration` extends it with an idempotent `prepareLocalCapabilities()`
+operation after PHY readiness. MAC consumers resolve their `modeSetModule` dependency through the
+narrow provider in `ModeSetModuleBase` at `LINK_LAYER`; the MAC NED provides the default descendant
+path. Management uses `macModule`. `LINK_LAYER` depends explicitly
+on both `PHYSICAL_LAYER` and `NETWORK_INTERFACE_CONFIGURATION`, so addresses and contribution inputs
+are available before simplified association. Its AP preparation/install/removal calls use
+`IIeee80211BssProvider`; no remote `LAST` callback is required.
+
+`Ieee80211Mib` provides const BSS/profile queries and guarded mutations. Management stages a complete
+BSS/peer change, finishes its transaction and timer bookkeeping, then calls `publishStateChange()`.
+The MIB's `bssStateChanged` signal covers meaningful BSS or peer changes. Its Boolean value reports
+whether a BSS is active; observers query the current MIB for details. There is no borrowed signal
+payload. Delivery is synchronous and observational: MIB mutation during delivery throws an error.
+References into the MIB are valid only until the next corresponding mutation. A retained
+`shared_ptr<const Ieee80211NegotiatedHtCapabilities>` keeps an immutable capability result alive,
+but does not grant continued relationship eligibility.
+
+`hasPreparedLocalCapabilities()`, `isLocalHtCapable()`, `hasActiveBss()`, `hasHtOperation()`, and
+`relationshipAllowsHt(peer)` distinguish readiness, implementation support, current BSS presence,
+accepted operation presence, and permission to select HT. A legacy BSS may be active without HT
+operation. The current ad hoc no-beacon abstraction likewise has no learned channel/HT operation or
+accepted peer advertisements. Stop/crash clears operational relationships while retaining prepared
+configuration. Physical AP channel context is retained by management for restart; STA operation is
+learned from accepted management information, independently of scan tuning.

doc/src/migration-guide/index.rst

@@ -4,6 +4,51 @@ Migrating Code from INET 3.x
 ============================
 Release: |release|
 
+IEEE 802.11 Capability and BSS State Ownership
+--------------------------------------------
+
+Custom modules that used ``ModeSetListener`` or subscribed to ``modesetChanged``
+must obtain the configured catalog through ``IIeee80211ModeSetProvider``.
+For catalog consumers, derive from ``ModeSetModuleBase``, declare a
+``modeSetModule`` NED parameter, and call the base initialization before using
+``modeSet`` at ``INITSTAGE_LINK_LAYER``. Keep ``NUM_INIT_STAGES``. The built-in
+MAC supplies the descendant parameter default; standalone consumers must point
+it at a module implementing the C++ and NED mode-set provider contracts. Move
+algorithm initialization formerly performed by the signal callback to that
+initialization stage. Ordinary catalog queries must not reset algorithm state.
+Management uses ``IIeee80211MacConfiguration``, which extends the mode-set
+provider with capability preparation; catalog-only providers need not implement
+that operation.
+
+Custom transmitters and receivers that contribute HT capabilities implement
+``IIeee80211TransmitterCapabilities`` and ``IIeee80211ReceiverCapabilities``,
+respectively, in C++ and NED. Report implemented width support and, for receivers,
+short-GI support independently of the current BSS operation. The MAC's
+``prepareLocalCapabilities()`` assembles the local profile after PHY readiness;
+repeated preparation preserves active protocol state.
+
+Replace direct access to MIB BSS/profile fields with ``getBssData()``,
+``getBssStationData()``, ``getBssAccessPointData()`` and
+``getLocalHtCapabilities()`` for reads. Management owners use ``commitBss()``,
+``clearBss()`` and the association/peer methods for writes. Profile installation
+uses ``installLocalHtCapabilities()``; replacing a changed profile requires an
+inactive BSS with no peer relationships. Custom simplified AP management
+implements ``IIeee80211BssProvider`` for explicit preparation and peer
+installation/removal instead of allowing another module to modify its MIB.
+
+Subscribe to the MIB's Boolean ``bssStateChanged`` signal to observe accepted
+state transitions. Query the MIB synchronously; the signal carries no borrowed
+state object. Management calls ``publishStateChange()`` after completing the
+transition's timer and transaction bookkeeping. Observers must not mutate the
+MIB during publication or retain raw BSS/peer references across a mutation.
+Use ``hasActiveBss()`` and ``hasHtOperation()`` explicitly, and supply operation
+and HT eligibility separately from cached capabilities to peer mode selection.
+
+The old initialization signal and writable BSS/profile fields are removed
+without compatibility adapters because they permit missed initialization or
+state changes that bypass owner bookkeeping and notification. Existing custom
+implementations must migrate together with their consumers.
+
 IEEE 802.11 Beacon and Probe Response Fields
 ------------------------------------------