fix(pgxl): read Id from the radio's ID meter. Principle VIII.

[w5jwp]

Merge order for the PGXL / 4O3A PRs (the same map is in each of them; #6030 has merged):

Stage 1:
  #6008  authenticate TGXL, PGXL and Antenna Genius
Stage 2 (either order, after what each needs):
  #6027  Peripherals settings UI          needs #6008
  #6033  PGXL drain current (ID meter)    needs #6008
Stage 3:
  #6036  PGXL docked layout               needs #6008 and #6033

How to review: this PR's own commits are ec0d432a and 590a798e. d473b183 merges #6008 in (one conflict in AmpApplet.cpp, resolved as described under "Merging with #6008") and b41ed522 merges #6030 in (no change to the tree; this branch used to carry #6030's last commit as a cherry-pick, which conflicted with the original). 92fd1aa5 merges #6008 in again for its hostname-bound credential (907a88e8). Everything else is carried from #6008 and #6030, which are reviewed in their own PRs.

Summary

Fixes #6032.

Stacked on #6008 and #6030, not a replacement for either. It merges both in until they merge; this PR will then be rebased onto main and show only its own.

When PGXL status is relayed through a FlexRadio, the Id gauge did not move. The radio sends drain current as its ID meter, which AetherSDR never decoded, and the relay path instead waited for amplifier-status keys the radio never sends. This PR reads each PGXL reading from where the radio actually sends it, and picks between the radio and the PGXL by measured refresh rate.

Verified on a FLEX-8600 (SmartSDR 4.2.20.41343) and a PowerGeniusXL running firmware 3.9.8. The captures, rates and method are in docs/pgxl-telemetry-source-evidence.md.

The rule for each reading

• Available only from the radio: use the radio (drive).
• Available only from the PGXL: use the PGXL (Harmonic Load heatsink temperature, Vdd, Vac, fan mode, MEffA).
• Available from both: use the faster source. The radio is faster for forward power and SWR. Drain current and PA heatsink temperature are a tie, and a tie goes to the radio. In every case the radio's value is used while fresh (1500 ms), and the PGXL's value otherwise.

Changes

• MeterModel decodes the PGXL's ID meter. RadioModel passes the amplifier's handle to MeterModel::setAmpHandle; once it is known, an AMP meter (FWD, RL, DRV, TEMP, ID) reaches the PGXL only when its source index matches, as FlexLib Radio.FindMetersByAmplifier does, so neither a tuner's nor a second amplifier's meters land on it. Before the handle is known, any AMP meter that is not the tuner's goes to the PGXL, and a handle change re-routes the meters and withdraws Id and PA temperature until the next sample. A new ampVitalsChanged signal carries drain current and PA heatsink temperature, each with a valid flag.
• AmpApplet gains setRadioDrainCurrent and setRadioPaHeatsinkTemp. The radio's values win while fresh, the same rule forward power and SWR already use.
• Removed the radio amplifier-status handler in MainWindow_Wiring. None of the keys it read (temp, id, vdd, vac, meffa) arrive. Also removed AmpApplet::setMeff, which only that handler called, and its test.
• Corrected the applyMeters comment: it said the PGXL is polled at 5 Hz, and now cites the measured rates.
• Added tools/probe_pgxl_telemetry_sources.py, the read-only probe that produced the evidence, and docs/pgxl-telemetry-source-evidence.md.

Merging with #6008: src/gui/AmpApplet.cpp conflicts in one place. #6008 adds setRadioConnected, updateSourceIndicator, setDirectFailureReason and hasRadioRelay just before setMeff, which this PR removes. Keep #6008's four functions and drop setMeff. Tested that way (see below).

Constitution principle honored

Principle VIII (Evidence Over Assertion). The relay handler rested on an untested claim about what the radio sends (#2444). Every choice here is taken from captures of the radio and the PGXL, and the evidence page records how to repeat them.

Test plan

• Local build passes
• Behavior verified on a real radio: FLEX-8600 (SmartSDR 4.2.20.41343) with a PowerGeniusXL on firmware 3.9.8
  • When PGXL status is relayed through a FlexRadio: Id read 19 A during a TUNE and dropped after unkey; PA temperature updated; HL, Vdd and Vac blank.
  • Direct connection (built together with feat(peripherals): authenticate direct TGXL, PGXL, and Antenna Genius connections #6008, which this PGXL firmware needs for authentication): Id 19 A, Vdd 52.0 V, Vac 117 V, both heatsink temperatures; no flicker between sources.
• Tests pass: amp_applet_test, meter_model_test, health_applet_test, pgxl_panel_test, amp_model_test
• New tests: testAmplifierVitalsAreRouted and testTunerDrainCurrentIsNotRoutedToTheAmplifier (MeterModel), testRadioVitalsWinOverTheDeviceWhileFresh (AmpApplet)
• Reproduction steps documented in the linked issue

Checklist

• Commits are signed (docs/COMMIT-SIGNING.md)
• No new flat-key AppSettings calls
• Protocol behavior comes from captures of the radio and the PGXL; the meter-to-amplifier match follows FlexLib Radio.FindMetersByAmplifier (Principle I)
• All meter UI uses MeterSmoother (no meter UI changed)
• Documentation updated: docs/pgxl-telemetry-source-evidence.md
• Security-sensitive changes reference a GHSA if applicable (not applicable; the probe reads the authorization code without echoing it and never records it)

🤖 Generated with Claude Code

Review follow-up (2026-10-03)

• ampVitalsChanged carries a per-reading "updated in this packet" flag, so an ID packet no longer restamps TEMP's freshness and the reverse. A new meter_model_test case sends only ID and checks TEMP is not marked updated.
• testAmpAndTunerMetersSplitByHandleAfterALateHandle now includes a tuner ID/TEMP, pinning the rescan after a late handle.
• AMP meters match the amplifier's handle (maintainer ruling on N3). testOnlyTheAmplifiersOwnMetersReachIt and radiomodel_amp_meter_routing_test cover it.
• Merged feat(peripherals): authenticate direct TGXL, PGXL, and Antenna Genius connections #6008's branch.

[aethersdr-agent]

1. Issue fit

Yes, for #6032, and the diff also carries #6029's fix (the first two commits are PR #6030's). Mapping the issue's three asks:

Ask	Where
Id must move on RADIO, from the radio's ID meter	MeterModel.cpp:118,240 (route, handle-matched), :1187-1190 (sample), ampVitalsChanged → MainWindow_Wiring.cpp:7155
Read each reading from where the radio actually sends it; stop waiting on status keys that never arrive	the whole AmpModel::telemetryUpdated reader is deleted from MainWindow_Wiring.cpp
Where both sources exist, use the faster one	setDrainCurrent/setPaHeatsinkTemp drop-while-fresh, kRelayMeterFreshnessMs

I checked the one thing the deletion could silently cost: meffa. AmpModel::telemetryUpdated is emitted only from the radio-status path (AmpModel.cpp:371), the deleted handler was its only GUI consumer, and setMeff had no other caller. So on a relay-only station MEffA now goes through applyMeffaControls's known = !m_meffaState.isEmpty() gate and the control is hidden — which is exactly what already happened, because the radio never sent meffa for it to display. The deleted comment claiming "this is the only place the state appears at all" was describing a path that never fired. Clean removal, and the evidence doc covers it. AmpModel::telemetryUpdated is now GUI-dead (still exercised by amp_model_test) — worth noting, not worth changing here.

One process item, not a code problem: PR #6030 is still open carrying commits 029d7e44 and a9a635d6 verbatim. This PR supersedes it. Please say so in the body / close #6030 so the two don't both land.

2. Scope

File(s)	Change	Claimed?	Verdict
src/models/MeterModel.{h,cpp}	decode AMP ID, new ampVitalsChanged, m_hasAmpTempValue	yes (#6032)	In scope
src/gui/MainWindow_Wiring.cpp	wire ampVitalsChanged; delete the whole amplifier-status telemetry reader	yes (#6032 names id/temp/vdd/vac/meffa as the wrong source)	In scope
src/gui/AmpApplet.{h,cpp}	PA/HL rename, HL cleared on relay, radio-vs-device arbitration for Id and PA temp	#6029 + #6032	In scope, but arrives from #6030 — disclose
docs/pgxl-telemetry-source-evidence.md	new evidence doc	Principle VIII	In scope
tools/probe_pgxl_telemetry_sources.py	new read-only capture tool, referenced from the doc	Principle VIII	In scope. Not dead — the doc links it, and it is a dev tool, not a build target
tests/amp_applet_test.cpp, tests/meter_model_test.cpp	coverage	yes	In scope

No CHANGELOG.md edit. No new settings key, capability, protocol verb or public wire surface. No socket test added, modified or removed — I read the added test bodies in /tmp/aetherclaude/pr-6033, not the working tree, and neither touches QTcpServer/QUdpSocket/bind/connectToHost or a fake peer. No preference smuggled in: every user-visible change (PA/HL labels, HL cleared on relay, tooltip and accessible-name wording) traces to #6029's citation of the PowerGeniusXL User Guide v3.9.8 p. 55 or to the captured meter manifest. The PR body already flags the user-visible text for maintainer review, which is the right call.

3. Blockers

None. Nothing here breaks users, violates canon or fails on current main.

4. Nits (all non-blocking)

• MeterModel.cpp:240 — TEMP is left name-matched while ID gains handle-matching. The new ID branch cites DRV's rationale ("which device is this meter about … the day one appears"), but TEMP, the other half of the signal this PR introduces, still has no handle guard in either defineMeter or setTgxlHandle. I found no evidence a TGXL publishes TEMP — the capture in the doc lists only the PGXL's five meters — so this is hypothetical today. But it now costs more than it did: because setRadioPaHeatsinkTemp holds the PGXL off for kRelayMeterFreshnessMs, a misrouted tuner TEMP would not merely show the wrong number, it would suppress the PGXL's correct PA reading on a DIRECT station. Reasoned from code, not reproduced. One if would close it.
• amp_applet_test.cpp:393 — a withdrawn ID meter leaves the last drain current on the gauge, and the test pins that. It is the same shape as the stale-HL defect this PR fixes, and setDrivePower(w, valid) next door hides its whole row on valid=false. It is probably invisible in practice (the ID meter goes away when the amplifier does, and applyMeffaControls-style visibility gating takes the panel with it) — but the asymmetry is deliberate enough to be worth a sentence of justification in the comment, since a reader comparing it to setDrivePower will assume one of the two is wrong.
• AmpApplet.cpp:1213 — the tooltip explains HL even when no HL value is on the button. On a RADIO-only station the button reads PA 47.9 C and the tooltip still defines a label that is not there.
• AmpApplet.cpp:413 — setAccessibleDescription is not wrapped in tr(). Pre-existing on that line and widespread in the tree, but docs/a11y.md:62,73 shows both accessor examples inside tr(), and you are already editing the string. The accessible name three hundred lines down is translated; the description is not.
• The header comment now reads "the device's own 2 to 11 times [a second]", sourced from the probe polling the PGXL at 50 ms — twice the app's own transmit poll rate. The real device-path rate is lower, so the conclusion ("the relay wins") only gets stronger; the doc discloses the 50 ms, the header does not.

5. What I tried to break

• The claim that the radio relays no PGXL telemetry in amplifier status. I traced AmpModel::telemetryUpdated to its single emit site (AmpModel.cpp:371, the appliesToAmp block) and confirmed the deleted handler was its only GUI consumer and setMeff its only caller — so nothing else silently depended on the deleted reads. I then checked the one field whose loss would be user-visible, meffa, through applyMeffaControls's known gate: hidden before, hidden after. No behavior lost.
• Unit and scaling. convertRaw (MeterModel.cpp:456) divides Amps by 256 and degC by 64, citing FlexLib Meter.cs — matching the raw values the tests construct and the doc's table. 70 A hi against qint16/256 = 127.99 A ceiling, no overflow.
• The new test's index collisions. defineAmpManifest uses 12,13,14,16,17,18; the new ID takes 15, so defineMeter's ID-reuse purge never fires and index 16 really is TEMP. Both new meter tests fail to compile against unfixed code (the signal does not exist), so neither is self-asserting.
• testReadoutWidthIsStable. I suspected the new m_directConnected gate on setHarmonicLoadHeatsinkTemp had silently turned the pair-width assertion into a single-sensor one. It has not — setDirectConnected(true) is at the top of the test (line 598), so the pair is still exercised. Withdrawn.
• Partial-manifest and withdrawal paths. ampVitalsChanged carries both readings on every sample of either, so a station with only TEMP invalidates the drain-current timer each sample (PGXL owns Id) and vice versa; removeMeter clears index, value and flag together for both, and emits. setTgxlHandle's rescan clears m_ampDrainCurrent/its flag but not m_ampTemp — correct, because TEMP is unconditionally re-found in the same loop while ID may not be. clear() does not emit ampVitalsChanged, which costs at most one 1500 ms window before the PGXL resumes.
• Late writes and ordering. setHarmonicLoadHeatsinkTemp's !m_directConnected early return follows the setDrainVoltage/setMainsVoltage precedent exactly, and setDirectConnected(false) arrives from PgxlConnection::disconnected before any late status can land. Repeated setDirectConnected(false) is idempotent.
• Couldn't check: anything at runtime. I have no build, no test run and no way to drive the GUI, so every statement above is read off the code in the PR head checkout, not reproduced. CI is green on ec0d432a (build, check-macos, check-windows, Static checks, Sanitizer configure) but its ctest steps are -R-filtered, so green does not tell me amp_applet_test or meter_model_test ran. The hardware claims — the FLEX-8600 capture, the refresh-rate table, the in-app DIRECT/RADIO verification — I cannot test at all; the probe script and the doc make them auditable by someone who can, which is the right substitute.

6. Recommendation

Approve with nits. The framing is right: the previous code read PGXL telemetry from a status message that never carries it, and this reads it from the meter the radio actually publishes. The arbitration rule is stated once, applied identically to both shared readings, and backed by a measurement rather than an assertion — which is the part I most expected to find hand-waved and did not. Nothing I found rises above a comment or a defensive if. Next step for the maintainer: rule on the tooltip/accessible-name wording (the author flagged it), and close or retarget #6030 so its two commits don't land twice.

---

_{🤖 aethersdr-agent · cost: $9.7106 · model: claude-opus-5}

[w5jwp]

Pushed 590a798, plus e21d21a (#6030's latest commit, cherry-picked), covering the review:

• TEMP routed by handle, in defineMeter and the setTgxlHandle rescan, with a new test that fails without the guard.
• Withdrawn ID keeps its last value: the reason is now in a comment at setRadioDrainCurrent.
• Tooltip and tr(): fixed in fix(pgxl): define the heatsink temperatures and clear stale HL. Principle VIII. #6030 and brought in here.
• The rate comment now says the device figure came from polling at 50 ms, twice this client's rate.

On #6030: this PR is stacked on it, not a replacement, so #6030 should stay open and land first. Its commits appear here only until then; after it merges this branch is rebased onto main. I've made that explicit at the top of the body.

amp_applet_test, meter_model_test, health_applet_test, pgxl_panel_test and amp_model_test pass.

[w5jwp]

Verified on a FLEX-8600 (SmartSDR 4.2.20.41343) with a PGXL on firmware 3.9.8, both during a TUNE.

1. Relayed through the FlexRadio (RADIO). Id reads 19 A and follows the transmit, from the radio's ID meter; before this PR it did not move in this mode. PA temperature comes from the TEMP meter; HL, Vdd and Vac have no radio source and read blank.

2. Direct connection (DIRECT), built together with #6008 (this PGXL firmware needs #6008's authentication for a direct connection). Id 19 A, Vdd 52.0 V, Vac 117 V and both heatsink temperatures; Id and PA temperature did not flicker between the two sources. The clipped buttons in this shot are the separate docked-layout bug #5903, fixed in #6036.

[ten9876]

Issue fit

Yes. #6032 asks for three things, and each maps to the diff:

#6032 asks	Where in the diff
Id moves on RADIO, from the radio's ID meter	MeterModel decodes AMP/ID, matched by handle, and emits ampVitalsChanged
Stop waiting on amplifier-status keys that never arrive	the relay handler is deleted from MainWindow_Wiring.cpp
Use the faster source where both exist	setRadioDrainCurrent / setRadioPaHeatsinkTemp with the 1500 ms freshness rule

FlexLib confirms the premise: Amplifier.StatusUpdate parses only model, serial_num, ant, state and ip (reference/FlexLib_*/Amplifier.cs:236-300). ID conversion matches Meter.cs (Amps ÷ 256). The previous review's nits are addressed in 590a798e:

• TEMP is now handle-routed at both sites.
• The withdrawn-ID behaviour is commented.
• The 50 ms probe rate is disclosed.

Reviewed as the increment over #6008 (git diff 71d5bcd7 fccf8e47, 9 files).

Scope

File	Change	Claimed?	Verdict
src/models/MeterModel.{h,cpp}	decode ID; handle-route ID and TEMP; ampVitalsChanged	yes	in scope
src/gui/MainWindow_Wiring.cpp	wire ampVitalsChanged; delete the dead amplifier-status reader	yes	in scope
src/gui/AmpApplet.{h,cpp}	radio-vs-device arbitration for Id and PA temp; setMeff removed	yes	in scope
docs/pgxl-telemetry-source-evidence.md, tools/probe_pgxl_telemetry_sources.py	evidence + read-only probe	yes	in scope
tests/amp_applet_test.cpp, tests/meter_model_test.cpp	coverage	yes	in scope

Everything in the increment is explained by the issue. CHANGELOG.md is untouched. The probe sends only client udpport, sub amplifier all, sub meter all, auth code= and status. That is no TX and no state change (Principle VI), and it never logs the code. It opens UDP/TCP to a radio but is a dev tool, not a registered test.

Blockers

None. The branch now conflicts with main in AmpApplet.cpp, MainWindow_Wiring.cpp, TunerApplet.h and AmpModel.cpp, three of them inherited from #6008 (see #6008's review for the AmpModel.cpp trap). The planned post-#6008 rebase resolves that.

Nits (non-blocking)

• N1. Each reading's freshness is renewed by the other reading's samples.
  • MeterModel emits ampVitalsChanged(id, idValid, temp, tempValid) when either meter lands (MeterModel.cpp:1196-1200, :1280-1281). The lambda at MainWindow_Wiring.cpp:7301 calls both setRadioDrainCurrent and setRadioPaHeatsinkTemp every time.
  • So an ID packet restamps TEMP's freshness and vice versa. If the radio ever stopped sending one meter while the other continued, the applet would hold a stale relayed value and drop the PGXL's live one indefinitely.
  • This is the class of problem #4805 fixed for FWD. Low risk today, since both run at about 20/s per your capture. A per-reading "updated in this packet" flag would close it.
• N2. No test covers the real boot order for ID/TEMP. The order is manifest before the tuner handle, then the setTgxlHandle rescan. testAmpAndTunerMetersSplitByHandleAfterALateHandle covers FWD/RL only, and the new tuner tests all set the handle first. Adding a tuner ID/TEMP to that test's manifest would pin the rescan.
• N3. The routing is "not the tuner", not "is this amplifier", so with two amplifiers the last-defined ID/TEMP wins. FlexLib matches positively (Radio.cs FindMetersByAmplifier compares SourceIndex with the amp handle). This pattern predates the PR; the PR extends it.

What I verified vs. read

• Built #6036's head f5eafa06, which contains this branch unchanged (#6036's increment touches only AmpApplet.* and two tests), and ran meter_model_test, amp_applet_test, amp_model_test, health_applet_test and pgxl_panel_test: all pass. pgxl_panel_test binds a loopback stub PGXL; the operator approved it for this review.
• Mutation: with the TEMP handle guard removed at both sites (MeterModel.cpp:121, :247), meter_model_test fails. The new test pins the guard.
• Gates: engine-boundary, command-plane and capability-record checks are identical to #6008's, and the manifest check passes.
• Attacks that held (reasoned from code, read-only second pass):
  • Threads. The meter path is unchanged: the network thread queues to RadioModel on main, so ampVitalsChanged adds no new thread crossing.
  • No TGXL handle (0). All AMP meters go to the amp, and the rescan corrects this once the tuner reports.
  • Lost behaviour. state handling still lives in AmpModel, and setMeff and the deleted reader had no other consumers.
  • Merge d473b183. It keeps #6008's four functions and drops only the claimed code.
• Could not drive it: the demo backend advertises hasAmplifier = false, so the relay/direct switching is evidenced only by your FLEX-8600 + PGXL 3.9.8 captures and screenshots, not reproduced here.
• CI is stale: the earliest run was created 2026-10-01 22:26Z, before main's 2026-10-02 19:07Z tip, and the touched tests aren't in a ci.yml -R filter.

[w5jwp]

Thanks for the review. Pushed 5fb8b154 (this branch merges #6008, no force-push).

• N1 (c485cdf5): each reading's freshness is its own. ampVitalsChanged carries per-reading "updated in this packet" flags, both false when a meter is withdrawn, and the MainWindow_Wiring.cpp lambda calls only the setter for the reading that arrived. New meter_model_test cases: only ID arriving does not mark TEMP updated, and the reverse. Re-coupling the flags makes those fail.
• N2 (c485cdf5): testAmpAndTunerMetersSplitByHandleAfterALateHandle now has a tuner ID/TEMP in the manifest before setTgxlHandle, and asserts neither reaches the amplifier after the rescan.
• N3: not done. MeterModel is only told the tuner's handle (setTgxlHandle), not the amplifier's. A positive FindMetersByAmplifier-style match needs a new setAmpHandle from RadioModel. FWD/SWR/DRV use the same "not the tuner" rule, so it predates this PR. Happy to do it as a follow-up if you want.

The merge conflicts with #6008's side in AmpApplet.cpp / MainWindow_Wiring.cpp were resolved by keeping this PR's removal of the relay telemetry reader and AmpApplet::setMeff. Please look at that hunk. Focused targets pass locally; the gates are clean. The relay/direct switching still rests on your hardware captures.

[w5jwp]

@ten9876 the updates from your review are pushed (5fb8b154). The itemized reply is above. Ready for another look when you have time.

[ten9876]

Follow-up on the review at fccf8e47, now on 255553eb:

• N1: per-reading freshness, c485cdf5. Re-coupling the *Updated flags makes meter_model_test fail ("a packet carrying only ID marks ID updated and TEMP not", and the reverse).
• N2: the late-handle rescan covers tuner ID/TEMP, c485cdf5.
• N3: maintainer ruling: fold it in. e372d423:
  • RadioModel passes the amplifier's handle to MeterModel::setAmpHandle. Once that's known, an AMP meter reaches the PGXL only when its source index matches, as Radio.FindMetersByAmplifier does.
  • A handle change re-routes the meters and withdraws Id/TEMP until the next sample.
  • Removing the handle match, the RadioModel call, or the withdrawal fails meter_model_test or the new radiomodel_amp_meter_routing_test.
• e372d423 also restores the condensed fan-mode/OPERATE wiring comment that a merge had reverted to its pre-docs: cut review latency — comment policy, AGENTS.md split, condensed comments, Constitution 2.1.0, body-only reviews. Principle VIII. #6072 text.

The 14 focused targets pass. The four static gates show the same findings as main.

[ten9876]

Approving at 972f991f.

Fixed (each one proved):

• N1, per-reading freshness: c485cdf5. Re-coupling the *Updated flags fails meter_model_test (only-ID / only-TEMP cases).
• N2, rescan of tuner ID/TEMP after a late handle: c485cdf5.
• N3, positive amplifier match (maintainer ruling: fold in): e372d423. RadioModel passes the amplifier's handle to MeterModel::setAmpHandle, and AMP meters then match it as FlexLib Radio.FindMetersByAmplifier does. A handle change re-routes the meters and withdraws Id/TEMP until the next sample. Each of these breaks fails a test:
  • removing the match: testOnlyTheAmplifiersOwnMetersReachIt, radiomodel_amp_meter_routing_test;
  • removing the RadioModel call: radiomodel_amp_meter_routing_test;
  • removing the withdrawal: the re-route check.
• Comment policy: e372d423 restores the condensed fan-mode/OPERATE wiring comment.
• Stack: 972f991f merges main with #6008's head 071ddd0b as the base. The squash differs from that head only by main's own commits (the changed lines are byte-identical), and this branch's net diff against main is exactly its increment over #6008.

Verified empirically: Linux build. 14 focused targets pass on this merged head, including pgxl_panel_test on loopback. Mutations as listed. The four static gates match main. CI is green on this head, created after main's tip.

Not verified: relay/direct switching with real hardware. The demo backend has no amplifier, so that rests on the author's FLEX-8600 + PGXL 3.9.8 captures.