Recognise trunking control channels, and refuse to sit on them

A trunked system keeps one frequency transmitting a data stream around
the clock so its radios know where each conversation has been put.  There
is no speech on it and it never stops, which makes it the strongest and
most useless signal in the band: the scanner parked on 856.561 MHz for
the full record limit, saved four minutes of buzzing, and found it again
on the next sweep.

Five signatures, matched against a constant-envelope stream that never
pauses: 3600 baud two-level (Motorola SMARTNET/SmartZone), 9600 (EDACS),
1200 (MPT-1327), 4800 four-level (P25 or DMR Tier III), 2400 (NXDN).
The first two are believed at once -- nothing else sends at those rates
without pausing.  The rest share their shape with a digital voice call on
the same system, so they wait for the carrier to run unbroken past
--control-seconds, longer than a conversation goes without a breath.
Being in a trunked allocation raises confidence but is never required;
trunking is licensed on business pairs all over the spectrum.

One is named on screen, abandoned within a second or so, and its capture
deleted.  --keep-control records them for a decoder; --lockout-control
writes them into the lock-out list.

Three things had to be fixed to get there.

The simulator's "pseudo-random" symbols were a counter: multiplying the
symbol index by an odd constant and taking it modulo the level count
returns the low bits, so two-level FSK came out 0,1,0,1.  Every FSK test
in the suite was measuring a tone.  Its FSK is now shaped the way GFSK
and C4FM shape a stream, too, square-edged keying being a signal no
licensed transmitter would radiate.

The symbol-rate estimator locked onto harmonics -- 3600 baud read as
18000 -- because a transition impulse train is a comb of equal lines; it
now walks down to the fundamental.  The squared envelope is no longer a
candidate: it is not a transition signal, and its DC lobe made every
random OOK signal measure ninety baud.  The search starts at 200 Hz
rather than 40, below which it was reading drift, which is how a bare
carrier was awarded a symbol rate.  And a clean two-level signal counted
zero discriminator levels, because its modes land in the first and last
histogram bin, where find_peaks cannot see them.

Separately: locking out a frequency wrote to the settings file even under
--no-config, which has no settings file by definition.  It now writes
only where it read from, and --simulate never writes at all -- an
invented frequency would sit in a real config for ever, skipping whatever
genuine signal happened to land near it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PsWPTweCT6pwxKngvVxcg

packaging/make-man.py

@@ -237,6 +237,14 @@ bandsaunter scan \-r 144M\-148M \-\-lockout "162.55M, 450M\-455M"
 A single frequency is widened by
 .BR \-\-lockout\-width ;
 a span is used exactly as written.
+.PP
+Two runs never write anything back.
+.B \-\-no\-config
+has no settings file to write to, since the point of it is to leave the saved
+settings alone; and
+.B \-\-simulate
+is looking at an invented band, whose frequencies would be nonsense in a real
+settings file. Both still lock out for the run in hand, and say so.
 .SH KEYS DURING A SCAN
 .TP
 .B q
@@ -266,6 +274,60 @@ every transmission on one frequency is appended to a single growing file for
 that frequency, with a spoken date and time before each one, so a scan can be
 played back as a recording of that channel rather than clicked through as
 hundreds of fragments.
+.SH TRUNKED SYSTEMS
+Police, fire and large business radio in the US mostly runs on
+.IR trunked
+systems. Instead of giving each department its own frequency, the system owns
+a pool of channels and hands one out for each conversation as it happens. To
+make that work, one frequency in the pool is given over entirely to a data
+stream that runs day and night, telling every radio in the fleet where to go
+next. That frequency is the
+.IR "control channel" .
+.PP
+A control channel is the worst thing a scanner can find. It is loud, it is
+perfectly steady, it never stops, and there is nothing on it to listen to \[em]
+just a harsh buzz. A scanner without special handling parks on it for the
+whole record limit, saves the file, and then finds it again on the next sweep,
+for as long as it is left running.
+.PP
+bandsaunter recognises one from the shape of the signal, names the system on
+screen, deletes what it captured and moves on, usually within a second or
+two. What it looks for is a constant\-envelope data stream that never pauses,
+at a symbol rate belonging to a known trunking standard:
+.RS
+.PP
+3600 baud two\-level \[em] Motorola SMARTNET / SmartZone (Type I and II).
+.br
+9600 baud two\-level \[em] EDACS and ProVoice.
+.br
+1200 baud two\-level \[em] MPT\-1327.
+.br
+4800 baud four\-level \[em] P25 or DMR Tier III.
+.br
+2400 baud four\-level \[em] NXDN and NEXEDGE.
+.RE
+.PP
+The first two are recognised at once: nothing else transmits at those rates
+without pausing. The others share their shape with an ordinary digital voice
+call on the same system, so they are only called a control channel once the
+carrier has run unbroken for
+.B \-\-control\-seconds
+(20 s by default) \[em] long enough that a real conversation would have taken
+a breath. Raise that figure if digital voice calls are being skipped by
+mistake.
+.PP
+Being inside a band where trunking is common raises confidence but is never
+required: trunking is licensed on business pairs all over the spectrum.
+.PP
+Use
+.B \-\-keep\-control
+to record control channels anyway, which is what you want if you are feeding
+them to a decoder. Use
+.B \-\-lockout\-control
+to have each one written into the lock\-out list as it is found, so the
+scanner stops looking at it at all; with
+.B \-\-save\-lockouts
+on, that list survives a restart.
 .SH HF RECEPTION
 These receivers cannot normally tune below about 24 MHz. Below that they can
 sample the antenna directly instead, which opens up shortwave: broadcast,