11. Component Model

11.1 DSP Layer

The standard FT8 ABI accepts exactly 180,000 mono int16 samples at 12 kHz. It also fails closed unless QSO progress is 0–5, sensitivity is 1–3, UTC is a valid HHMMSS, and the decode band satisfies 100 <= low < high <= 4910 with at least 100 Hz width. These native checks run before sample/result mapping and vendor entry; failed calls clear count and overflow without copying result records. One ABI request resets one result batch, then reproduces the vendor full-slot disk orchestration on a single ft8_decoder: staged nzhsym calls 41, 47 and 50 expose 141,696, 162,432 and 172,800 caller samples respectively and zero the remainder. This is required because the standard depth-2/3 decoder loads its saved working buffer during the early stages; the third stage alone does not load fresh input. Results cross the C boundary only after all three stages return. The shared library exports only the ABI entry points; its callback and batch module symbols remain internal. Same-process CQ→CQ→empty→CQ regression covers batch reset, stage-41 vendor reset, slot replacement and saved-state isolation expected by a long-lived Worker.

The Improved ABI applies the same pointer, struct, 12 kHz/180,000-sample, capacity and native configuration checks, plus profile 0–4, thread count 1–12 and cycle count 1–3 validation. Profiles 0–4 dispatch 41+49, 41+46+50, 48, 49 and 50 respectively. Improved pass N exposes min(180000, N*3456) samples and zeroes the tail. The configured inclusive frequency window is divided into exactly the requested number of adjacent, non-overlapping bands; a 100 Hz configured width is 101 integer frequency points, so even 12 threads receive non-empty 8- or 9-point bands. All OpenMP callbacks append to the Fortran batch. After every profile pass returns, stable deduplication keeps the first exact (text, rounded Hz, rounded 0.1 s) key; overflow remains asserted if the pre-dedup fixed batch ever exceeded 256. Before every Improved request, the Worker-side initializer clears all even/odd CQ, MyCall and QSO detection histories across the vendor thread arrays: frequency is the vendor-compatible 6000.0 end sentinel, time offset is zero and every complex symbol is zero. A8 eligibility is also assigned afresh from the request: AP must be enabled, DX call length must be at least three and the four-character DX grid prefix must be complete. Thus neither detection history nor A8 state can carry across profiles or requests in a long-lived Worker.

The OpenMP region must contain exactly the requested team size. A constrained runtime that forms a smaller team returns WSJT_E_INTERNAL=8; the C shim leaves count/overflow cleared and does not copy the partial Fortran batch. Every team member uses copyin(dd8) with thread-private slot, downsample and FFTW state, and cycle 2/3 scratch belongs to its private decoder instance. Consequently successful subtraction changes only that thread’s assigned frequency band. This band-local subtraction intentionally differs from the upstream GUI’s unsynchronized shared dd8 subtraction and is the accepted deterministic headless behavior. The thread-private FFTW plan caches persist for the Worker process lifetime and are reclaimed at process exit.

A8 has one deterministic owner: the band containing Rx, or band 1 when Rx is outside the configured window. Ordinary callbacks atomically clear the shared gate for a result strictly within 3 Hz of Rx; after the decode barrier the owner atomically snapshots that gate before any direct A8 attempt. Result collection is safe but OpenMP scheduling determines append order, so result order is unspecified. The ABI does not sort it.

Improved sync8var uses multi-megabyte automatic arrays on every OpenMP thread. The DSP process therefore has a runtime prerequisite, inherited from the upstream GUI launcher: OMP_STACKSIZE=10M must be present before NumPy/SciPy, the shared library, or any OpenMP runtime can load. The Task 5 direct-ABI fixture sets it at module import. worker.py itself imports neither NumPy nor the binding at module load. The first executable statement in worker_main sets the same default, then locally imports NumPy and CoreBinding; the binding repeats the pre-load default defensively before its own NumPy import. Constructing the one binding loads either the explicit library path or the platform-specific dsp/build/libwsjt_core default and sends no unsolicited ready message.

protocol.py applies one exact schema on both encode and decode. A 64 KiB frame limit is checked before parsing and after serialization; nine frame types, complete DecodeConfig metadata, fixed RX/TX descriptors, 256 exact result objects and sanitized errors are the entire v1 control surface. The Worker checks generation before SharedMemory(create=False), verifies the uniquely observable allocation size, maps the fixed logical NumPy shape, makes decode views read-only, and closes in finally without unlinking. Darwin’s POSIX SHM allocation is uniquely page-rounded and must equal the logical size rounded up to mmap.PAGESIZE; other platforms require exact logical size. Only the parent owns unlink. Valid request/ABI/SHM failures are sanitized and recoverable; protocol/pipe corruption or unexpected internal corruption exits nonzero.

CoreBinding configures signatures for exactly the four production exports and queries wsjt_get_abi_info at construction. ABI version, ABI-info/result structure sizes, capacity, both RX/TX domains and the complete profile/thread/ cycle capability set plus zero reserved field must match before any encode or decode may run. Python validates array shape/contiguity/type/alignment, native configuration ranges and bounded ASCII fields before acquiring the one module-level reentrant lock; TX output must also be writeable. Inside that lock it calls exactly one selected decode entry point or one encode entry point. A failed decode status discards every native out value without reading or copying it. On success, count must be 0–256 and overflow exactly 0/1; the common adapter boundary repeats those metadata checks before copying records into immutable Python values. Encode writes only to the caller-owned exact 606,720-sample float32 buffer and returns immutable metadata; no raw CDLL handle crosses the private adapter.

Production builds export exactly the four C ABI functions. ELF builds generate the linker version map from a configured template; test-hook builds add only wsjt_test_ft8_a8d. The hook validates direct-A8 plumbing with a clean fixed signal and is never part of the production surface.

11.2 Engine Layer

11.3 Web Layer

The lifespan’s background maintenance loop (session sweep plus retention) catches and logs each tick’s exceptions, so one failed sweep cannot kill the loop; the 1 s lease-expiry watchdog is guarded the same way.

11.4 Dependency Rules

• Web depends on engine interfaces, never on ctypes.
• Engine requests DSP through the supervisor, never imports the shared library.
• server/core/worker.py alone imports binding; server/core/binding.py alone may use standard ctypes DLL loaders. Static dependency regressions enforce these exact paths, including function-local aliases and CDLL/PyDLL/WinDLL/OleDLL/LoadLibrary forms.
• Only rig.py speaks rigctld; no module opens serial.
• Only safety.py controls PTT and audio cancellation.
• Static clients submit intent and cannot construct raw PTT actions.

11.5 Vendor Patch Register

Each file under dsp/patched/ records original vendor path, upstream revision, minimal difference, reason and regression evidence here and in AGENTS.md.

tests/dsp/test_vendor_policy.py also retains the independent full-tree vendor digest gate, so these seven registered copies cannot mask a vendor edit.

Headless build adaptations outside dsp/patched/ are also explicit: