[Ozy311]

Summary

RTL receive changes now publish only after hardware readback and DSP adoption. Capture browsing preserves each slice's frequency and settings, parks receivers outside usable capture, and resumes them when capture returns. Offscreen markers reveal the receiver through a confirmed capture transaction. Zoom uses a continuous 65,536-sample FFT (36.621 Hz bins at 2.4 MS/s), independently of audio and capture bandwidth.

FM/FM-N have symmetric capability-bounded filters, 48 kHz per-receiver PCM, squelch, session/revision fences, rollback and accepted-state persistence. Requested or refused state never becomes saved live state. Spectrum averaging preserves RF history through display movement, and coherent capture coverage supports the 3D waterfall. PPM/DC settings use confirmed backend controls. Production admission at this checkpoint remains one receiver.

Implements the bounded receive runtime of RFC #5468; respects the backend seam obligations in #5554/#5262. WFM stereo, optional digital decoding, live PPM interaction and multi-RX delivery are downstream increments.

Integration and validation

Reconciled with main at a798558ac (#6118).

The reconciliation preserves main's typed tune/filter/mode/APF intents, HL2 squelch and WDSP changes. Each slice's SQL intent uses the existing common audio-intent binding once; the merge does not add a duplicate backend connection. The confirmed-pan dispatch comment now distinguishes an accepted request awaiting observation from refusal. Runtime documentation now describes the implemented 65,536-bin display FFT.

Checkpoint efc358a1 native Apple Silicon/Qt 6.12 build and CTest: 5/5 pass, no skips, in 11.29 seconds (receive_intent_routing_test, slice_apf_agc_off_seam_test, flex_slice_mode_intent_test, rtl_model_acceptance_test, slice_model_letter_test). These are socket-free model/dispatch regressions; they do not claim live-radio, GUI or hardware timing qualification. The downstream #6083 application and broader tests are separately revision-pinned there.

This requests human review and preserves the outstanding in-scope maintainer decisions; it does not mark the free-pan amendment approved. HD decoding is outside this PR and HD consent is not a merge condition here.

Upstream's single spectrum outlet and socket-free test rehoming are preserved. The real model derives paced waterfall rows from spectrum observations; retired orphan waterfall signals are not restored. The new upstream receive-contract test now expects RTL's implemented FM/FM-N filter capability. Generated seam/touchpoint manifests are regenerated.

Earlier downstream aggregate evidence (not rerun on this individual head): the aggregate builds AetherSDR with native Apple Silicon/Qt 6.12, RTL required and the optional decoder OFF. Focused downstream tests already pass for Flex mode dispatch, confirmed RTL model/capture state, FFT averaging, WFM, the PPM widget and seam consumers. This is aggregate evidence, not a claim that every platform was rerun on this individual head. Fresh hosted checks are required on this PR.

The operator reports that the delivered 7601593f build ran stably for days. That is live hardware feedback on the delivered build, not an instrumented soak of the new upstream integration. Current-head sanitizer, ARM throughput and full release-artifact qualification are not claimed.

CI integration repair

Upstream Radio Setup test targets (including #6008's peripheral_auth_dialog_test) compile RadioSetupDialog.cpp, so they also list the RTL widget and its availability registry. Both repaired tests build and pass on the native Mac decoder-OFF integration (2/2, 4.00 seconds). This follow-up changes test linkage only; earlier application/regression measurements retain their stated revisions. New-head CI is required and remains distinct from those measurements.

Maintainer decisions

All of the decisions below were made by Jeremy, the maintainer.

• 2026-09-23 rulings. The mode-transition, seam and scope rulings stand.
• 2026-10-03, free capture browsing. The RFC [RFC] Complete RTL-SDR receive DSP with multiple slices, independent zoom and stereo WFM #5468 amendment of 2026-09-25 (free capture browsing with parked slices) is approved as RTL-only; other backends keep their existing pan behavior.
• 2026-10-03, later seam additions. The seam pieces added after 09-23 are ratified as RTL-owned, on the same terms as 09-23: a second backend must justify reuse. They are SquelchLevelScale's unit and modesExclusive fields; requestReceiveTune(view), recenterReceiveCapture and ReceiveCapturePlacement; and the BackendPanAveraging persistence/description fields. Averaging persistence and coherent 3D presentation are part of that ratification.
• 2026-10-04, one squelch record. RTL's squelch is described by fix(squelch): SQL line and Auto SQL from a backend-published scale; HL2 amsq gate referred to the LNA. Principle VIII. #6127's RadioCapabilities::squelchLevelScale, not a second record. unit carries RTL's dBFS/bin, and modesExclusive marks the record as the receiver's own gate.

HL2 FFT-FPS/dBm persistence coordination stays separate, with sibling ClientDisplay tables preserved.

New gui/ touchpoints (ratified)

Header	New includer	Why
core/backends/RadioCapabilities.h	src/gui/ModeFilterPresets.cpp	FM/squelch availability reads the declared ReceiveFilterControl/SquelchLevelScale records
models/PanadapterModel.h	src/gui/PanFrameGuard.h	Snapshots the pan's geometry when a frame arrives, so a confirmed FFT is never painted against a newer range
models/RadioModel.h	src/gui/ReceiveCaptureAction.h, src/gui/RtlReceiverSettingsWidget.cpp	Capture-recenter action and the RTL device settings both go through RadioModel's capability-gated verbs
models/SliceModel.h	src/gui/MainWindowHelpers.cpp	requestSlicePanCenter resolves the slice's pan and sends confirmed backends a Center tune instead of a pan request

Effects on other radios

• Squelch availability follows one rule in both the RX applet and the VFO (ModeFilters::squelchAvailableInMode). A squelchLevelScale with modesExclusive (RTL only: FM/FM-N, −120 + 1.2·level dBFS/bin, Auto SQL) lists the supported modes, keeps each receiver's manual/Auto intent, and has Auto start from the absolute threshold. Otherwise the squelch cuts signals in rtty #2504 rule disables SQL in DIGU/DIGL/NT/RTTY/CW, unless the radio declares mode-independent squelch. Every other family's scale leaves modesExclusive false, so its SQL line, Auto SQL and availability are unchanged.
• SQL's unavailable reason stays on the button. Where SQL is unavailable in the current mode, the RX applet and the VFO no longer replace the registry's accessible reason with the Auto-SQL description.
• FM-family passband availability follows ModeFilters::fmFilterAdjustable. Declared FM rows are authoritative (RTL). A radio-owned filter with no FM row refuses FM edits (Flex, per FlexLib Slice.cs). HL2, ANAN, Icom and the Demo keep their existing adjustable passband.
• WFM/WBFM use carrier-centered FM edges and no longer inherit the SSB preset ladder.
• Cancelled VFO drags release the drag hold without the final retune (SpectrumWidget::sliceDragCancelled).
• Off-thread SliceModel setters are refused and logged.

CI

The Linux build job now deletes unused host toolchains (Android, .NET, GHC, CodeQL) before building. The full RelWithDebInfo tree, which now includes this PR's RTL tests (about 3.6 GiB of test binaries), outgrew the hosted runner's free disk. Jeremy authorized the workflow change.

Integration with #6107

#6107 gated a stranded RTL worker on the connectRadio() wiring this PR replaces. This PR's startCapture() already detaches the worker before stopping it, and gates every relay on producer identity and the capture session, so that wiring is kept. #6107's read-error guarantee is pinned in rtl_capture_worker_test's stop-timeout block. That test fails if the producer gate is removed.

Principles II, V and XIV govern confirmed state and persistence; VIII/XI govern evidence and regression tests.

---

73, Ozy K6OZY · Codex

Generated with OpenAI Codex (GPT-6 Astra)

[aethersdr-agent]

1. Issue fit

No fixes/closes #NNNN reached me in the PR metadata, so I reviewed against the PR's own stated intent plus docs/rtl-m1-runtime.md (which this PR adds and which reads as the acceptance spec) and the RFC #5468 lineage already present in RtlSliceSettings.h / RadioStateMemory.h. On that basis: Partially — the M1 runtime (transactional capture owner, prepared-receiver reuse, 48 kHz FM extraction, mixer, typed PCM, accepted-state persistence) is all present, wired into CORE_SOURCES, and backed by real tests. What is not settled is the maintainer-facing surface the doc itself defers: the FM mode-transition passband resize, the new cross-family IRadioBackend virtuals, and the declared dependency on unmerged PR #5919. Those are decisions, not defects — see §3.

This is architecture work under GOVERNANCE.md, and it does cite RFC #5468 throughout; I take the RFC prerequisite as satisfied, but the new seam added here (configureSettingsScope / storeOperatingState on IRadioBackend) is broader than RTL and I did not find it named in the RFC text I can see.

2. Scope

File / group	What it changes	Claimed by the PR?	Verdict
CMakeLists.txt	registers the four new RTL sources in CORE_SOURCES	yes	In scope
docs/rtl-m1-runtime.md	new design/admission doc	yes	In scope
src/core/backends/rtl/Rtl{CaptureTransaction,ReceivePipeline,AudioMixer,RfExtractor}.*	the M1 runtime itself	yes	In scope
RtlReceiverRegistry.{h,cpp}	shared-ptr receivers, cross-bank reuse, currentHandle, submitVerifiedRollback, cancelPending	mostly	In scope; cancelPending() has no production caller (nit)
RtlSdrBackend.{h,cpp}, RtlSdrWorker.{h,cpp}, RtlSdrDdc.{h,cpp}	backend/worker integration, legacy DDC retained	yes	In scope
IRadioBackend.h	two new cross-family virtuals	yes, but understated	Needs maintainer decision
RadioCapabilities.h	new RtlSlices client-settings domain	yes	Needs maintainer decision (new capability surface)
RadioModel.cpp	routes the persistence write through the backend hook	yes	In scope
RtlSliceSettings.h, RadioStateMemory.h	comment-only ownership updates	yes	In scope
WdspChannel.{h,cpp}	per-thread allocation guard; Config::operator==	yes	In scope
third_party/wdsp/** (4 files)	adds wdspPortThreadAllocationSequence() on both platform arms, documented in AETHERSDR-PATCHES.md	yes	In scope — additive, process-wide counter retained, patch entry written. This is the right way to touch the vendored tree.
tests/** (+ tests.cmake)	7 new/extended targets, all registered	yes	In scope
CHANGELOG.md	not touched	—	Correct — please keep it that way

Nothing in the diff is unexplained by the stated scope. No unrelated bundling, no removed guards, no formatting churn.

Socket-test disclosure (informational, not a finding): I grepped every added/modified test source (rtl_capture_transaction_test, rtl_capture_worker_test, rtl_receive_pipeline_test, rtl_audio_mixer_test, rtl_rf_extractor_test, rtl_runtime_settings_test, rtl_backend_test, wdsp_allocation_scope_test, RtlInjectedDevice.h, CallbackAllocationProbe.h) for QTcpServer/QTcpSocket/QUdpSocket/QLocalServer/bind/listen/connectToHost/peer processes. Zero hits. Device access is via the injected RtlSdrWorker::Device seam, settings via TestSettingsProfile.h. This PR adds no socket-owning test and no fake radio peer. Every new target is registered in tests.cmake; none of them are in CI's -R filters, which is normal here.

3. Blockers

1. createSlice() dereferences m_capture.confirmed() without checking it is engaged — src/core/backends/rtl/RtlSdrBackend.cpp:464 (inline comment). RtlCaptureTransaction::complete() resets m_confirmed on the Invalidated path, and serviceCapture() reaches emit connectionError(...) before disconnectRadio(), so there is a window where m_connected == true, !m_capture.busy(), and confirmed() is std::nullopt. Any re-entrant event-loop spin from that signal (a modal notice, a queued GUI action) can land in createSlice() and dereference a disengaged optional. Every other reader of accepted state in this file goes through m_lastPublished and null-checks it first; this one does not. I reasoned this from code — I have no build and could not reproduce it at runtime — but the guard is one line and costs nothing. Suggested fix in the inline comment.

2. Needs maintainer decision, not a code defect — the FM mode-transition passband resize. src/core/backends/rtl/RtlSdrBackend.cpp:507: selecting FM/FMN on a receiver whose inherited passband cannot describe the FM graph now silently rewrites the user's filter edges to ±8 kHz. The PR's own doc says "This mode transition needs maintainer UX review", which I read as the author correctly refusing to self-certify it. Per GOVERNANCE.md this is a user-visible behavior change to an existing control and needs a maintainer ruling before merge — it is not something a reviewer can wave through. I am not calling it smuggled preference: it is technically forced (the 48 kHz graph cannot carry a 200 kHz passband) and it is disclosed.

3. Needs maintainer decision — new cross-family public seam. IRadioBackend gains configureSettingsScope() and storeOperatingState(), and RadioCapabilities::ClientSettingsDomain gains RtlSlices (RadioCapabilities.h:629, inline comment). Both are surfaces every backend inherits and that outlive this PR. The storeOperatingState contract in particular inverts a rule the header previously stated in absolute terms ("the backend never touches the settings store") — the new comment is honest about the inversion, which I appreciate, but the inversion itself is a maintainer call. I looked for a canon sentence forbidding it and did not find one; AGENTS.md's Settings Persistence section requires a feature document with one owner and a checked write result, and this design satisfies both (std::optional<bool>, refusal never falls through — rtl_runtime_settings_test.cpp:80-85 pins exactly that). So: legitimate, but it should be ratified rather than inherited.

4. Nits (non-blocking)

• RtlSlices = 1u << 8 is inserted above Cw = 1u << 7 (RadioCapabilities.h:629). Values are correct and unique; the ordering just reads as a mistake. Move it below Cw.
• docs/architecture/radio-capabilities-map.md is not updated. Line 186 enumerates clientSettingsDomains and line 256 still records RTL's row as Tuning|Passband|SpanRate|RfGain|Memories, which this PR makes conditionally false. I could not find a canon sentence making the caps-map update merge-gating, so this is a nit — but the doc is now wrong for RTL, and rtl_runtime_settings_test.cpp:63 already asserts the new shape, so the table is the only thing out of date.
• RtlReceiverRegistry::cancelPending() has no production caller (RtlReceiverRegistry.cpp:616, inline comment). Only rtl_receiver_registry_test.cpp:679 exercises it. Either wire it (the prepare()-fails-after-submit path below is a candidate) or drop it.
• RtlReceivePipeline::prepare() validates monitor bounds after the registry has already accepted the bank (RtlReceivePipeline.cpp:76, inline comment) and after m_prepared is latched at line 73. Unreachable today because RtlCaptureTransaction::submit() already clamps audioGain/audioPan to 0..100, so this is ordering hygiene, not a live bug.
• The mixer's configure() return value is discarded in RtlReceivePipeline::process(). A rejected configure (e.g. a zero handle.instance) leaves the mixer running against the previous slot map while push() silently rejects the mismatched instances — audible as one-sided silence with no counter a support bundle could show.
• storeOperatingState() refuses the generic writer before the first published capture (RtlSdrBackend.cpp:692, inline comment). if (!m_lastPublished && m_settingsScope.isValid()) return false; runs before the !m_settingsActive check, so a session that connects and disconnects without ever publishing a capture loses its disconnect-flush write entirely — on main that flush went to RadioStateMemory::store. Narrow window, no test covers it, and no comment explains whether it is deliberate. Worth a one-line comment either way.
• None of the observability counters reach diagnostics. RtlAudioMixer::lateFrames()/rejectedBlocks(), RtlReceivePipeline::droppedPackets(), RtlRfExtractor::outputFrames()/groupDelayInputFrames() are read only by tests. Given how much of this design's correctness argument rests on "drops are bounded and observable", a field report of RTL dropouts will arrive with zero evidence. A row in the RTL health/diagnostics map would close that.

5. What I tried to break

Everything below is reasoned from the head checkout at /tmp/aetherclaude/pr-5924; I have no build, no test run and no hardware, so nothing here was reproduced at runtime.

• The WDSP reservation accounting under cross-bank receiver reuse. I expected prepared->reservation = reserveChannels(newCount) to under-reserve and let the pool over-admit once the old bank's Reservation destructs while its reused WdspChannels stay alive. It doesn't: WdspChannel.h:108-128 documents that a consumed slot belongs to the channel and only unconsumed slots return, so the reused receivers carry their own channel IDs. I also checked the newCount == 0 path for a null-Reservation dereference — the if (prepared->receivers[i]) continue; skip makes *prepared->reservation unreachable in that case. Both attacks failed.
• Lifetime of reused receivers across the acquisition/executor boundary. The shared_ptr copy at RtlReceiverRegistry.cpp:~300 is taken under the executor mutex while the callback holds only raw pointers, destruction is executor-only, and ReceiverSpec::operator== includes epoch, handle.instance and capture — and submitImpl overwrites receivers[i].capture before comparing, so a capture change cannot alias into a reuse. I could not construct a two-banks-driving-one-receiver case.
• Integer/position arithmetic in the mixer and extractor. I walked push() for firstSample + size overflow, fully-past blocks, partial-past blocks, ring aliasing at position % kCapacity (stale frames fail the frame.position == m_next + i identity check and degrade to silence, not to wrong audio), and slot deactivate/reactivate with a matching instance+epoch (!slot.active forces invalidation). I hand-traced every assertion in rtl_audio_mixer_test.cpp against the implementation, including the 256 + kDeadlineFrames - 1 / + kDeadlineFrames boundary pair and the 0.4/0.2/clip expectations — they compute out exactly, and they would fail if the deadline, the 1/N headroom or the identity checks were removed. That test is not self-confirming.
• RtlRfExtractor late-join and subspan underflow. I tried to make input.subspan(m_startInput - firstSample) underflow by feeding blocks shorter than the lattice period; the contiguity guard (firstSample != m_nextInput → withdraw) plus the m_nextInput <= m_startInput early return make firstSample <= m_startInput an invariant on every pre-start call. The worst case I could produce is the documented ~1 s join delay at 225001 Hz, which the doc already states.
• The transaction's compensation path. I checked that a compensation completion cannot be confused with a forward one (operation is bumped, token retained), that a Restored result is validated against work.before rather than work.target, that m_confirmed survives a successful compensation, and that a malformed-but-correctly-tokened Applied still invalidates. I did not find a way to publish a superseded state.
• The persistence seam. rtl_runtime_settings_test.cpp covers the cases I would have asked for: pre-readback claim refusal, overlapping-domain removal as a set, the preserved legacy downgrade snapshot including an unknown "future" field, newer-schema refusal that stays handled, retry after refusal, anonymous-scope identity, and the USB index never becoming a persistent ID. The one gap I found is the pre-first-publish window in §4.
• What I could not check: anything requiring execution — the four-carrier WDSP separation threshold (rejection > 20 dB) and the callbackAllocations == 0 claim in rtl_receive_pipeline_test.cpp are well-constructed and would fail against a broken implementation, but I cannot say whether they pass or how stable that dB threshold is across platforms and FFTW wisdom states. The doc's 30-minute integrated qualification gate for raising kQualifiedReceiverCapacity is, correctly, not claimed as met here — kQualifiedReceiverCapacity is still 1.

6. Recommendation

Needs maintainer decision, with one small code fix first.

Fix blocker 1 (m_capture.confirmed() null-check) — it is a one-liner. Then this needs a maintainer on three things a reviewer cannot rule on: the FM mode-transition passband resize (which the author correctly flagged rather than self-certified), the new IRadioBackend virtuals and RtlSlices capability domain, and whether to land ahead of PR #5919 given the doc's own "refresh and integrate the dependency before claiming end-to-end model acceptance".

On engineering quality this is unusually strong for its size: the vendored-WDSP change is additive and documented in AETHERSDR-PATCHES.md, admission stays at one receiver with an explicit evidence gate for raising it, the tests are socket-free and would genuinely fail against broken code, and the doc is candid about what is not qualified. Thanks for writing the "Evidence and admission gates" section the way you did — a PR that names its own unproven claims is much faster to review than one that doesn't.

---

_{🤖 aethersdr-agent · cost: $8.7321 · model: claude-opus-5}

[Ozy311]

Review follow-up in 53b364fe5d4c121ce1d6f268dea320e1a18b1430:

• Guarded reentrant creation after capture invalidation; moved preparation refusal checks before submission and removed unused cancellation API.
• Handled mixer configuration refusal by discarding its old slot map/buffer and requesting repair. A seeded-audio regression proves stale output cannot escape; removing the reset fails it.
• Added cumulative queue-drop, late-frame, rejected-block and configuration-failure counters to the existing RTL health snapshot. Callback code only publishes atomic mirrors; the existing owner service timer caches them. Real injected acquisition saturates the bounded queue and proves its counter reaches health. These are independently sampled counters, not callback latency or full performance qualification.
• Preserved pre-publication persistence refusal with a mutation-proven actual model disconnect-flush test; pinned live capability ownership relay and corrected enum/docs.

Validation at 53b364fe5d4c121ce1d6f268dea320e1a18b1430: native Mac, Windows and Nobara each passed the five affected RTL-ON tests; Mac and Windows also passed the three RTL-OFF tests. Mac ASan/UBSan passed all five (the final strengthened persistence test was separately rebuilt/rerun). Instrumented-Qt TSan passed all five plus three repetitions each of pipeline, registry and worker. Five isolated mutations were caught, including a passing hardened control for the optional guard; seven static checks passed. Six production TSan objects and five ASan objects have instrumentation witnesses. The full source manifest (3545 files) and source-delta hash were verified across the native/TSan snapshots. Mac leak detection is disabled; TSan uses existing suppressions, instrumented Qt 6.8.3 and stock FFTW/librtlsdr. These checks cover the review fixes; the earlier full-app/39-test matrix remains evidence for 6a8baff9, not a rerun at this head.

Maintainer decisions remain open: FM passband UX, the cross-family settings hooks/domain and runtime ownership transition, and dependency integration with #5919. Admission remains one. #5919 was not modified or copied; no radio was opened, no drivers changed, and no merge/auto-merge is requested.

73, Ozy K6OZY · GPT-6 Astra-Ultra

[Ozy311]

Driver compatibility follow-up in ea7fb980d389ea4f6f23a886f6515fb734d17c2d:

• Confirmed and fixed an antenna-power side effect: Blog aed0ea19 toggles bias tee on R820T/R828D before returning offset-tuning error -2; the getter still reports tuning offset. Our failed request then compensated against offset=0, skipped that matching getter and could leave DC enabled. The adapter now refuses unsupported R82xx offset changes before the setter. It does not turn external bias tee off or reinterpret the offset control as power control.
• Moved the existing private USB adapter into a header for C-API injection. The new socket-free rtl_usb_controls_test drives the actual adapter and transaction, covering preserved accepted state, no DC writes on refusal/compensation, supported offset changes, genuine I/O failure and direct-sampling refusal. It has no USB enumeration, driver load or socket peer. Registered only in the existing RTL-enabled test graph; no frozen CI gate expansion.
• Mac/Nobara source checkouts are clean Blog aed0ea19; Windows DLL SHA256 0fa7f8bf4b7e07918a0a9e98228007cccac3109dbaac7497e116e416135d58a5 matches the vendor V1.4.0 archive (archive SHA256 verified). This is exact provenance for the audited artifacts, not a header/linkage-only inference. Upstream comparison: 797f8143.
• Native Mac/Windows/Nobara each passed adapter, capture transaction and capture worker tests. Mac ASan/UBSan passed those three, with leak detection disabled. The isolated guard-removal mutant fails the antenna-DC regression; seven mechanical checks pass. Windows initially exposed a missing FFTW header include in the new test target; the target now consumes both imported libraries' include properties and the final run passes. No unrelated matrix rerun; prior TSan/full-app evidence remains bound to its earlier heads.
• Isolated exact-source probes confirm Blog forced-bias EEPROM behavior and mode-0 auto-direct sampling. HF/V4 policy needs a separate device-specific decision; exact readback remains enforced. Added those prerequisites to the runtime document and saved receive runbook. No RTL device was opened, no GPIO/EEPROM/driver state changed, and Nigel's unspecified GATE issue was not reproduced.

All seven GitHub checks passed on preceding head 53b364fe; CI for this new head is pending. Ready status, one-receiver admission, maintainer architecture/UX and hardware qualification gates remain unchanged.

73, Ozy K6OZY · GPT-6 Astra-Ultra

[Ozy311]

Final validation and operator development-build delivery completed for signed, GitHub-Verified head d42619f107cd9a746bd527b2c5df42f60ca192e2.

• Native Mac, Nobara and Windows full RTL ON/OFF builds passed the affected 23 ON / 12 OFF tests on each platform. Mac ASan/UBSan passed 8 tests; instrumented-Qt TSan passed 6 plus 3 further full-model repetitions. Three isolated guard mutations were caught. Detailed coverage and sanitizer limitations are in the updated PR body.
• A self-contained arm64 Mac ZIP was delivered locally: 87 Mach-O objects audited, no unresolved non-system dependencies, minimum macOS 26.0, ad-hoc development signed and not notarized. Deep strict signature checks and native Cocoa startup passed after fresh ZIP extraction in a clean environment through the actual dedicated shortcut. ZIP SHA256: 41caef4ab55b4c15c6ec6e1ae8c81e7f8b57aeb6bf7a4b986d60622150f4d7c5.
• Nobara received a persistent same-revision binary, matching RTL/libusb runtime, separate settings profile and dedicated launcher. Artifact hash, runtime linkage, direct startup and actual launcher startup were verified. Binary SHA256: 719f2a341a0bb8d52942738443e34b6a6f0f793ce148ff578a5c1e62d2acaa3b.
• Both startup probes verified authenticated bridge identity against the exact child PID, refused tokenless access, had TX automation disabled and remained disconnected/idle. Each probe stopped only its own child. These are startup/offline results, not USB/RF reception or multi-receiver qualification. Production admission remains one; ASR/RADE/DFNR are unavailable in these operator builds.

All 3,548 final source-manifest files were rechecked and the worktree is clean. The existing Mac/stable installations and active sessions were preserved. The operator will perform live FM/FM-N reception testing. Required human review, the documented maintainer decisions, and live qualification remain open; no merge or auto-merge was performed.

73, Ozy K6OZY · GPT-6 Astra

[ten9876]

Review at d42619f1 — executed, not just read

The earlier agent review (at 6a8baff9) was reasoned from source with no build. This pass builds the PR head and runs it, attacks the newest commit (d42619f, which touches the shared SliceModel/RadioModel every backend uses), and checks the result against the RFC #5468 approval conditions.

Environment: Ubuntu 24.04, GCC 13, Qt 6.8.3 (aqtinstall), librtlsdr 2.0.1. That is the CI image's toolchain, and not a combination in the PR's own validation matrix (its Linux leg was GCC 16.2.1 / Qt 6.11.1), so these results reproduce the author's independently.

Issue fit

This implements the M1 receive runtime of RFC #5468, which was approved conditionally on 2026-09-07. On the conditions that bear on M1:

Condition	At this head
1 Persistence: one RtlSlices owner, schema v1, USB index never laundered into radioId, fitting-subset restore	Present. rtl_runtime_settings_test passes, and covers pre-readback refusal, newer-schema refusal, unknown-field preservation and index-never-an-ID
2 Audio at 48 kHz with no 24 kHz interim; the four 24000 literals	Met, by the A-series before this PR. Three literals are gone; the fourth (AudioEngine.cpp:1900) is the CW sidetone→decoder path, not RX. This PR adds the first production 48 kHz PcmFrame producer (RtlSdrBackend.cpp:1004); git grep finds none on base. The existing audio_engine_rates_test (35 references to 48 kHz ingest) covers the consumer side. I ran it and it passes
6 Capability fields documented	RtlSlices and the runtime clientSettingsDomains transfer are both in radio-capabilities-map.md
Process: "keep the existing WFM path working"	WFM and non-FM modes stay on the exclusive legacy 24 kHz DDC

Conditions 3, 4, 7 and 8 are release gates, and the body says plainly that they are not met here. I agree; admission stays at kQualifiedReceiverCapacity = 1.

Scope

File / group	Claimed?	Verdict
src/core/backends/rtl/** (capture transaction, pipeline, extractor, mixer, registry, worker, DDC, USB adapter)	Yes	In scope
RtlSdrUsbDevice.h, R82xx bias-tee refusal (ea7fb980)	Yes, in a follow-up comment	In scope. A safety fix found during the work, disclosed with provenance
IRadioBackend.h, SliceDelta.h (ReceiveControlPolicy, configureSettingsScope, storeOperatingState), RadioCapabilities.h (RtlSlices)	Yes, and flagged by the author for ratification	New cross-family surface. Maintainer decision, see below
SliceModel.{h,cpp}, RadioModel.{h,cpp} (d42619f)	Partly	Rewires Flex's slice-mode intent path, which the body does not say. See the inline comment on RadioModel.cpp:10146
WdspChannel.*, third_party/wdsp/** + AETHERSDR-PATCHES.md	Yes	In scope. Additive and documented
docs/rtl-m1-runtime.md, caps map	Yes	In scope
tests/**, tests.cmake	Yes	In scope. Preflight: no added or modified test binds, listens or connects. RtlInjectedDevice.h injects at the librtlsdr C-API seam, which is the injected-transport layer AGENTS.md's Test-layer boundary prescribes
CHANGELOG.md	Not touched	Correct

The merge base is one commit behind main, the PR merges cleanly, and the only overlapping file is tests.cmake. CI: all 7 checks are green on this head, including Linux build.

Every finding from the previous review is resolved at this head

The createSlice() disengaged-optional dereference is guarded (RtlSdrBackend.cpp:479). RtlSlices is ordered after Cw. The caps map is updated. cancelPending() is removed (the 31 remaining hits are unrelated classes). The mixer configure() result is handled. Monitor bounds are validated before submission. The drop, late-frame and rejection counters reach the RTL health snapshot.

Blockers

None found.

Maintainer decisions still open (none are defects)

1. The FM mode-transition passband resize to ±8 kHz (docs/rtl-m1-runtime.md). This changes an existing control's behaviour, so under GOVERNANCE.md it is a UX ruling and not a reviewer's call. The author flagged it rather than self-certifying it.
2. The new cross-family seam: receiveControlPolicy(), configureSettingsScope() / storeOperatingState(), the RtlSlices domain, and clientSettingsDomains changing at runtime. storeOperatingState reverses the header's former rule that "the backend never touches the settings store". The reversal is legitimate and honestly commented, but it should be ratified rather than inherited.
3. Whether d42619f ships here or separately. The RFC approval asked for exactly this split: "Keep PRs one-feature-and-its-tests rather than one-milestone — the foundation stage in particular will want splitting between the neutral slice lifecycle seam and the shared-window policy, since the former touches Flex behavior and deserves its own regression review." d42619f is that seam, and it rewires Flex's mode path. My probe below shows the rewire is equivalent, so the split is now a process choice rather than a correctness requirement. Either way, the probe (or something like it) should land as a registered test, because today nothing in the suite pins that path.
4. Integration order with #5919, as the body states.

Nits (non-blocking)

• The unconditional foreign-thread guard exits silently. Inline comment on SliceModel.cpp:117.
• A stale private contract, unreachable today. RadioModel.h:1665 still says dispatchPanCenterBandwidth "advances the model only when the send actually happened." It now sends, then returns false, for Confirmed backends. The profile-load flush at RadioModel.cpp:6803 counts that false as voided. RTL declares hasProfiles = false, so the hold never engages and the flush never runs on RTL. But the first Confirmed backend that declares profiles will log real sends as voided. A sentence on the header doc would close it. Inline comment on RadioModel.cpp:6649.

Verified by execution

What	Result
The PR's 11 affected targets (rtl_*, wdsp_allocation_scope_test)	11/11 pass
Shared-path regression: backend_slice_lifecycle_test (non-Flex, no duplicate intent bindings), audio_engine_rates_test (48 kHz ingest), memory_import_test	3/3 pass
Flex rewire probe. A throwaway, socket-free test that builds the real FlexBackend through rebuildBackendForTest("flex"), materialises slice 0 through handleSliceStatus, and captures only seam dispatches	8/8 pass. setMode(LSB) produces exactly one slice set 0 mode=LSB; repeated status adds no duplicate binding; Flex frequency and filter edits stay off the seam; Flex stays optimistic
M1 mutant: drop the Flex mode branch at RadioModel.cpp:10147	Probe fails (2 checks). The probe is sensitive
M2 mutant: RTL setFrequency publishes optimistically again	rtl_model_acceptance_test fails ("pending sparse receiver edits do not change observed getters" and three more). Confirms the author's mutation claim
M3 mutant: remove the R820T/R828D offset guard	rtl_usb_controls_test fails ("refused offset and compensation never enable antenna DC"). The bias-tee safety test genuinely guards

Running app, demo simulator only. I built the full app at this head and launched it with an isolated settings directory, AETHER_AUTOMATION_NO_TX=1, and connect local serial DEMO-0001. get radio confirmed "AetherSDR Demo", family sim; there was no live hardware. Sim takes the Optimistic path that d42619f rewired. Driving slice 0 through the GUI, each control landed in the model immediately: tune 14.2345 (asserted), mode LSB, filter -2700/-200, AF gain 73, Audio pan 20, Slice audio mute on. The app log shows zero warnings, criticals or asserts. So the "other backends retain optimistic publication" claim holds end to end in the running GUI, not only at model level.

What I tried to break, and could not

• The foreign-thread guard as a cross-backend regression. It is unconditional, so it applies to Flex, HL2, Icom and ANAN too. I looked for any worker-thread object that calls the eight guarded setters directly. The external controllers (FlexControl, MIDI, HID, serial, dial on m_extCtrlThread) all reach SliceModel through queued lambdas with MainWindow as context. The AudioEngine, Hl2RxDsp and AnanRxDsp hits are setMode on WDSP and gate objects, not on SliceModel. I found no live off-thread caller, so the guard changes nothing today; hence a nit and not a blocker.
• A disengaged confirmed() at RtlSdrBackend.cpp:945 after a failed first capture. Failed is only ever Restored, and complete() refuses Restored unless work.before is engaged; endSession() bumps the session, so stale completions are Ignored. It is safe by invariant, although the invariant isn't written down next to the dereference.
• 48 kHz PCM reaching a 24 kHz-assuming consumer. feedPcmFrame → resetMainPcmState(rate) prepares every RX DSP stage per rate, and post-DSP taps carry scopeSampleRate explicitly. The two remaining legacyStereo24() consumers that could see RTL frames are both fed from Flex's daxPcmReady, which RTL never emits. legacyStereo24() refuses rather than mislabels in any case.
• The bias-tee guard on the first apply of a session, with nothing confirmed yet and a restored setting requesting offset. The guard sits inside the per-control write and compares against the live getter, so it refuses any R82xx offset change, the first one included.
• dispatchPanCenterBandwidth returning false confusing a GUI caller into reverting. The only caller that reads it as failure is the profile-load flush, which RTL cannot reach (see the nit).

Could not verify

Anything that needs an RTL dongle: live reception, the integrated 1/2/4-receiver workload and thermal soak, cold start, and aarch64. The demo simulator cannot reach RTL-specific behaviour. The body already lists these as open, and they are RFC release gates rather than M1 merge criteria.

---

_{Review run by Claude Code under @ten9876's account using the repo's /pr-review skill. Scratch probe and mutants were run in an isolated worktree and nothing was pushed.}

---

Generated by Claude Code

[ten9876]

Maintainer rulings on the four open decisions

Thanks, @Ozy311. This one was straightforward to decide because the body named its own open questions instead of burying them.

1. FM/FMN mode-transition resize to ±8 kHz: approved. A 48 kHz FM graph can't carry an inherited wide or sideband passband, so the resize is forced by the graph, not a preference. Ordinary filter edits and stored restores staying unresized is the right boundary.

2. The cross-family seam: ratified. Here's what I checked before ratifying. Most of it follows existing practice:

• Backends already own feature documents. Hl2FreqCal::savePpb and AnanDroopCalibrator write through scope.featureExact, and Hl2Settings, AnanSettings and IcomSettings are backend-owned too. The old "the backend never touches the settings store" line only ever described the generic OperatingState write.
• capabilitiesChanged at runtime is established. ANAN, Flex, HL2, Icom and Sim all emit it.
• Waiting for the backend before publishing isn't new either. Non-Flex pan bandwidth already waits for the backend's report, and Icom's slaved scope re-asserts its own geometry.

Two pieces are genuinely new: storeOperatingState (a backend taking over the generic OperatingState write) and swapping clientSettingsDomains mid-session. I'm ratifying both as RTL-owned, the way the caps map already records them. If a second backend wants either, that PR should show why before we treat it as a general pattern. receiveControlPolicy() defaulting to Optimistic for every existing backend is what makes this safe to land.

3. Scope: this stays a single PR. No split. That means this PR carries the seam that rewires Flex's slice-mode path, so it also has to carry the regression test for that path (see below).

4. Merge order: this PR first, then the #5892 → #5907 → #5919 stack rebases onto it. A trial merge of #5919 against this head gives 6 content conflicts, about 365 lines, all in the shared seam (RadioModel.cpp 213, SliceModel.h 46, IRadioBackend.h 44, RtlSdrBackend.cpp 26, RadioModel.h 23, SliceModel.cpp 13). The two PRs independently built the same guards: off-thread refusal, retired-object / same-ID reuse, and a connected gate. Reasons for this order:

• This PR is green on all 7 checks and reviewed; aetherd: consolidate slice receive-control routing #5919 is a draft waiting on two unmerged prerequisites.
• rtl_model_acceptance_test is a proven pin for confirmed-publication semantics. Re-enabling optimistic publication makes it fail, so a rebase that drops them will be caught.
• Your body already states the reconciliation terms: accepted-state semantics and sparse stable IDs survive, and typed dispatch is not acknowledgment.

One thing needed before merge: pin the Flex mode path

d42619f removes the dedicated Flex modeChangeRequested binding in handleSliceStatus and reroutes it through wireSliceAudioIntentsToBackend. The review showed the reroute is equivalent, but nothing in the suite pins it. #5919's rebase will rewrite exactly this code, so the pin should land here, before that happens.

The probe from the review works as a drop-in, socket-free test. It builds the real FlexBackend through rebuildBackendForTest("flex") and captures only seam dispatches. It passed 8/8 at d42619f, and with the Flex branch at RadioModel.cpp:10147 mutated to a no-op it fails two checks, so it's not self-confirming.

tests/flex_slice_mode_intent_test.cpp

// The Flex slice-mode intent reaches FlexBackend exactly once, and Flex
// frequency/filter edits do NOT also go through the neutral seam verbs (they
// ride SliceModel::commandReady). The sink sees ONLY seam dispatches
// (FlexBackend::sendSlice). Pins the binding d42619f moved from
// handleSliceStatus into wireSliceAudioIntentsToBackend (#5924).
#include "models/RadioModel.h"
#include "models/SliceModel.h"
#include "core/backends/flex/FlexBackend.h"
#include "TestSettingsProfile.h"
#include <QCoreApplication>
#include <cstdio>
using namespace AetherSDR;
static int g_fail = 0;
static void check(bool ok, const char* m) { std::printf("%s  %s\n", ok ? "PASS" : "FAIL", m); if (!ok) ++g_fail; }
int main(int argc, char** argv)
{
    QCoreApplication app(argc, argv);
    TestSettingsProfile profile(QStringLiteral("flex-slice-mode-intent"));
    RadioModel model;
    check(model.rebuildBackendForTest(QStringLiteral("flex")), "real FlexBackend built via production family switch");
    auto* flex = dynamic_cast<FlexBackend*>(model.backend());
    check(flex != nullptr, "backend() is FlexBackend");
    if (!flex) return 1;
    QStringList seam;
    flex->setSliceCommandSink([&](const QString& c) { seam << c; });

    QMap<QString, QString> kvs;
    kvs["in_use"] = "1"; kvs["RF_frequency"] = "14.200000"; kvs["mode"] = "USB"; kvs["active"] = "1";
    model.handleSliceStatusForTest(0, kvs, false);
    SliceModel* s = model.slice(0);
    check(s != nullptr, "Flex slice 0 materialised from status (handleSliceStatus path)");
    if (!s) return 1;

    seam.clear();
    s->setMode(QStringLiteral("LSB"));
    check(seam.filter(QStringLiteral("slice set 0 mode=LSB")).size() == 1, "one setMode -> exactly one Flex mode dispatch");
    check(s->mode() == QLatin1String("LSB"), "Flex stays optimistic: model mode updated immediately");

    model.handleSliceStatusForTest(0, kvs, false);   // repeated status
    seam.clear();
    s->setMode(QStringLiteral("CW"));
    check(seam.filter(QStringLiteral("mode=CW")).size() == 1, "repeated status does not add a duplicate mode binding");

    seam.clear();
    s->setFrequency(14.210);
    s->setFilterWidth(100, 2800);
    check(seam.isEmpty(), "Flex freq/filter edits do not ALSO dispatch through the neutral seam");
    check(qFuzzyCompare(s->frequency(), 14.210), "Flex frequency stays optimistic");

    return g_fail ? 1 : 0;
}

add_executable(flex_slice_mode_intent_test tests/flex_slice_mode_intent_test.cpp)
target_include_directories(flex_slice_mode_intent_test PRIVATE src tests)
target_link_libraries(flex_slice_mode_intent_test PRIVATE aethercore Qt6::Core Qt6::Test)
add_test(NAME flex_slice_mode_intent_test COMMAND flex_slice_mode_intent_test)

It sits outside the RTL block, so it runs on RTL-OFF builds too. Adjust the tests.cmake shape to whatever the settings-consumer contract needs.

With that test in, this is clear to merge from my side. The two review nits (logging the off-thread refusal, and the stale RadioModel.h:1665 doc) are welcome but won't block it.

— Jeremy (KK7GWY)

_{Drafted with Claude Code at my direction.}

---

Generated by Claude Code

[github-actions]

Accessibility check findings

This PR touches src/gui/ files with 16 accessibility issue(s).
Full details appear as inline annotations on the diff above.

Files scanned : 12
Files with findings: 4
Total findings : 16

See docs/a11y.md for the canonical
Qt patterns (setAccessibleName, QAccessibleValueChangeEvent,
QAccessibleInterface subclasses, etc.). Structural remediation
(keyboard navigation, custom QAccessibleInterface subclasses)
is tracked in #3288.

Findings are warnings only — the build is not blocked.

[github-actions]

Accessibility check findings

This PR touches src/gui/ files with 16 accessibility issue(s).
Full details appear as inline annotations on the diff above.

Files scanned : 13
Files with findings: 4
Total findings : 16

See docs/a11y.md for the canonical
Qt patterns (setAccessibleName, QAccessibleValueChangeEvent,
QAccessibleInterface subclasses, etc.). Structural remediation
(keyboard navigation, custom QAccessibleInterface subclasses)
is tracked in #3288.

Findings are warnings only — the build is not blocked.

[Ozy311]

Implemented the requested Flex mode-path regression in signed commit 800dfebd1259e3b50fa6a86a203dfd2c04d0b07f. It is unconditional (RTL ON/OFF), uses the real Flex backend through the production family switch, isolates settings before constructing the application, and asserts the exact single seam command. It passed on Nobara in both native configurations and with instrumented Qt under TSan. Removing only the Flex mode-dispatch branch in an isolated object/library made the two mode checks fail; the unchanged control passed before and after. The working source was never mutated.

The body and runtime/capability docs now reflect your ruling: the earlier publication/settings seam is ratified as RTL-owned, a second backend must justify settings takeover separately, the FM transition resize is approved, and this PR precedes the #5892 → #5907 → #5919 rebases.

This push also includes the separately requested FM/FM-N DC-placement and independent viewport work in 19e85176. Capture displacement preserves receiver RF and production NCO; pan/zoom crops real FFT bins without retuning; typed receiver/view intent waits for acceptance together. The new placement policy, neutral intents/capability and concrete UI action remain explicitly pending your ratification. Production admission remains one; WFM stereo/192 kHz is deferred.

Final head validation: full Nobara RTL-ON app + 28/28 affected tests; full RTL-OFF app + 16/16; 11 TSan targets + three additional model repetitions; three focused ASan/UBSan targets with unchanged source hashes; four demonstrated mutations. The new package and activated dedicated launcher passed isolated offscreen startup/linkage checks with the existing detach-enabled RTL runtime; 41fc9314 remains available for rollback. No live radio/RF/TX, Mac/Windows native rebuild, or merge was performed. The body also discloses an earlier intermittent failure of the unchanged FM-audio test; final runs passed, but its root cause remains unresolved.

73, Ozy K6OZY · GPT-6 Astra-Ultra

[aethersdr-agent]

CI: only check-macos failed, at the Build step

Thanks for this one — it's a big, carefully-staged piece of work, and the failure looks narrow rather than structural.

Check runs for 800dfebd:

Job	Result
build (Linux)	✅ success
check-windows	✅ success
check-macos	❌ failure — step Build
Static checks / Sanitizer configures / CodeQL ×2	✅ success

Every step before Build passed (Configure, the GPU-spectrum assertion, Opus), and everything after it is skipped. So this is a compile/link failure in cmake --build build, not an environment or packaging problem.

Up front, so you don't chase a ghost: I could not retrieve the compiler output. The check-runs API I have access to returns step-level status only, and I'm not authenticated for raw log download — so I am not quoting an error message, because I don't have one. The fastest way to the actual line is:

gh run view 35835026792 --repo aethersdr/AetherSDR --log-failed

or the job log directly: https://github.com/aethersdr/AetherSDR/actions/runs/35835026792/job/107096297778

What I can do is narrow where to look, from your diff and the workflow files.

Why the two green jobs don't clear this

The first instinct is "RTL code only builds on macOS" — I checked, and that's not it. .github/docker/Dockerfile:37 installs librtlsdr-dev, so the Linux job configures AETHER_BACKEND_RTL on too and compiles RtlSdrBackend.cpp, RtlSdrWorker.cpp, RtlSdrDdc.cpp and the if(AETHER_BACKEND_RTL) test targets. It built them clean.

check-windows is a different story and is worth knowing about generally — ci.yml:758 builds a target subset:

cmake --build build -j ... --target AetherSDR aether-dv-waveform thumbdv_queue_test \
      dstar_model_test digital_voice_waveform_process_test cross_needle_meter_test

None of your ~20 new test TUs are in that list, so its green says nothing about them. Linux (ci.yml:274) and macOS (ci.yml:1133) are the two full-tree builds.

So the real delta between the job that failed and the job that passed the same sources is:

• Apple clang + libc++ vs GCC + libstdc++
• -DCMAKE_BUILD_TYPE=Release vs Linux's RelWithDebInfo
• macOS additionally configures -DREQUIRE_KEYCHAIN=ON -DMQTT_TLS=OFF

Worth noting there's no -Werror on these targets (CMakeLists.txt ~3226 sets only -Wall -Wextra -Wpedantic), so this is a hard error, not a warning promoted to one.

Where I'd look first

1. libc++ transitive-include differences. The usual "Linux and Windows pass, macOS doesn't" cause for new DSP code. I read the includes on all your new RTL files and they're actually disciplined — RtlRfExtractor.cpp pulls <algorithm> <cmath> <cstring> <limits> <numbers> <numeric> explicitly, RtlSquelchGate.h and RtlViewport.h are self-contained. Two spots that lean on transitive includes and are worth a second look: RtlSdrUsbDevice.h uses std::optional, std::int64_t and std::uint32_t but includes only RtlSdrWorker.h and <rtl-sdr.h>; RtlReceivePipeline.h uses the mixer/registry types without <cstdint> or <vector> of its own.

2. tests/CallbackAllocationProbe.h — this replaces global operator new/new[]/delete and is included by rtl_receive_pipeline_test.cpp and rtl_rf_extractor_test.cpp, both of which link Qt. Replacing global allocation operators is the most platform-sensitive thing in the diff by some distance. Separately from whatever the build error is: the C++17 aligned overloads aren't replaced (operator new(std::size_t, std::align_val_t) and its delete), so any over-aligned allocation in aethercore/WDSP/Qt bypasses your counter and takes libc++'s default path. That's worth closing regardless of this failure.

3. third_party/wdsp/port/wdsp_port.c — the new static _Thread_local uint64_t g_threadAllocationSequence. I verified the four newly-declared WDSP entry points (SetRXAFMDeviation, SetRXAFMLimGain, SetRXAFMLimRun, SetRXAPanelGain1) are defined upstream in fmd.c and patchpanel.c, so that's not an undefined-symbol link break.

Reproducing the CI compiler locally

If you're on a Mac, this matches the job's configure exactly (ci.yml:1103):

brew install ninja fftw portaudio hidapi librtlsdr autoconf automake libtool
cmake -B build -G Ninja \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_PREFIX_PATH="$QT_ROOT;$(brew --prefix)" \
  -DAETHER_GPU_SPECTRUM=ON -DREQUIRE_KEYCHAIN=ON -DMQTT_TLS=OFF
cmake --build build --target build_opus
cmake --build build

The Release build type and the full-tree (no --target) build are both load-bearing — a subset build is exactly how this class of failure stays hidden locally.

On the review comments

The aethersdr-agent blocker at RtlSdrBackend.cpp:536 (unchecked m_capture.confirmed() dereference on the Invalidated path) is a real correctness issue but is not related to this build break — it compiles fine. Same for the RadioCapabilities.h ordering nit and the RtlReceiverRegistry::cancelPending() dead-addition note. Those are worth addressing on their own merits, not as a fix for CI.

Post the failing lines here once you've pulled the log and I'll take another pass with you.

---

_{🤖 aethersdr-agent · cost: $9.4079 · model: claude-opus-5}

[github-actions]

Accessibility check findings

This PR touches src/gui/ files with 16 accessibility issue(s).
Full details appear as inline annotations on the diff above.

Files scanned : 13
Files with findings: 4
Total findings : 16

See docs/a11y.md for the canonical
Qt patterns (setAccessibleName, QAccessibleValueChangeEvent,
QAccessibleInterface subclasses, etc.). Structural remediation
(keyboard navigation, custom QAccessibleInterface subclasses)
is tracked in #3288.

Findings are warnings only — the build is not blocked.

[Ozy311]

The compiler output is now retrieved: macOS Build log reports tests/rtl_dc_audio_test.cpp:107:75: error: no member named 'cyl_bessel_j' in namespace 'std'. It is the test's ideal-carrier reference calculation, not the allocation probe or a production RTL compile failure.

Signed test-only commit 8a105f3f777bc7b1e519fce440df403da87f0e73 replaces that call with the NIST DLMF 10.2.2 J0 series, restricted to the fixture's 0 <= beta <= 2.5, evaluated once per measurement. The first omitted term is below 4.51e-36; double rounding is checked separately. A Nobara comparison with the prior libstdc++ reference passed 10,001 evenly spaced arguments over that interval with maximum observed absolute difference zero. The existing test also pins zero and its two modulation indices with fixed reference values and 1e-15 absolute tolerance. Its blind-mean negative control, all 29 generated IQ cases, and all audio criteria remain intact.

Focused Nobara checks: rtl_dc_audio_test, rtl_fm_audio_test, and rtl_capture_transaction_test passed (3/3). A deliberately truncated series failed the two numerical reference checks; the restored 29-case DC-audio control passed. No production source, test registration, CI allow-list or dependencies changed. The installed Nobara 800dfebd application, launcher and profile remain in place for the operator's test. Its earlier 28/16/11 validation counts remain tied to 800dfebd, not relabeled as this test-only head. All seven hosted CI checks passed on this exact head. The completed macOS Build log confirms rtl_dc_audio_test.cpp.o compiled and rtl_dc_audio_test linked. Linux full-tree and the existing Windows target-subset builds also passed. This is hosted compilation evidence; the new RTL test was executed on Nobara, not added to the frozen hosted macOS test gate. No local Mac/Windows build was run.

I also rechecked the feedback against this exact branch:

• The disengaged capture optional is already guarded in createSlice; the old unchecked post-request path is gone. ClientSettingsDomain::RtlSlices follows Cw, and RtlReceiverRegistry::cancelPending is absent. Jeremy's executed review already recorded these fixes; they are not new unresolved defects at this head.
• The allocation probe intentionally covers ordinary C++ allocation only. Its header explicitly excludes malloc/realloc, aligned new and private allocators; WDSP's separate guard covers its own C path. The runtime document also limits the claim. This does not prove zero aligned/Qt/private allocation, and I am not broadening that claim or adding allocation-operator replacements to fix an unrelated missing math function.
• Jeremy's two nonblocking nits remain: foreign-thread setters return silently, and the private pan-dispatch header comment still describes optimistic publication without the Confirmed exception. This bounded test-only change does not resolve either.

The earlier seam/settings and FM-transition rulings remain approved; the new DC/viewport and squelch/recipe decisions still require the stated maintainer review. No merge or hardware operation was performed.

73, Ozy K6OZY · GPT-6 Astra-Ultra

[github-actions]

Accessibility check findings

This PR touches src/gui/ files with 16 accessibility issue(s).
Full details appear as inline annotations on the diff above.

Files scanned : 15
Files with findings: 4
Total findings : 16

See docs/a11y.md for the canonical
Qt patterns (setAccessibleName, QAccessibleValueChangeEvent,
QAccessibleInterface subclasses, etc.). Structural remediation
(keyboard navigation, custom QAccessibleInterface subclasses)
is tracked in #3288.

Findings are warnings only — the build is not blocked.