[on8st]

Summary

On a radio with no Flex command plane (HL2, ANAN, Icom, RTL), several controls wrote Flex wire text by hand. RadioModel::sendCmd() dropped the text, and the operator was told the control is unsupported. In each case the radio can already do what was asked, through a path another control uses. This PR routes those controls to that path. Where no path exists, the control now refuses visibly instead of setting a model flag that nothing acts on.

Routed to a working path:

control	before, on a radio with no command plane	now
CAT set_ts, the RX applet STEP control, a net's Tune Now step	slice set <n> step= was dropped. CAT still answered RPRT 0, and get_ts read the old step.	RadioModel::applyClientOwnedSliceStep() applies the step on the client, which is the same write the host memory bank already makes (SliceModel::applyRecalledStepHz).
Band-stack bookmark recall: AGC mode and threshold, NB on and level, NR on and level	Hand-written slice set text was dropped. The recall restored frequency and mode and nothing else.	Goes through the SliceModel setters, which reach setSliceAgc / setSliceNoiseBlanker. NR is recalled only where radio-side NR exists.
A net's Tune Now filter	A hand-written filt was dropped.	SliceModel::setFilterWidth, which reaches setSliceFilter.
Graphic EQ (applet and the ten MIDI eq.* params)	Already served by ClientEq through applyGraphicEqToClientEq(), but the eq text still went into the drop, and the drop notice called a working control unsupported.	The EqualizerModel sink skips the wire text when there is no command plane.
S-meter TX "Level" face	Reads the MIC meter. An HL2 publishes TX:MICPEAK and no MIC, so the needle stayed at the -50 floor with a live mic.	MeterModel::transmitLevelFaceValue() shows MICPEAK where MIC is not defined.

Now refuse visibly, through showUnsupportedControlNotice(), the one-shot notice #5262 M3 ruled a refusing gate must raise:

• MIDI rx.nrEnable, MIDI rx.anfEnable and the anf_toggle shortcut turning NR/ANF on, where the radio declares no radio-side DSP (hasRadioSideDsp). The VFO already hides the NR and ANF buttons on the same field. OFF is already true there and is accepted, so a momentary MIDI button's release raises no second notice.
• MIDI phone.amCarrier, where the radio declares no AM carrier control (hasAmCarrierLevel). The Phone applet already dims the slider on the same field.
• nr_cycle skips its radio-NR step on such a radio and goes straight to NR2. Before this, its first press did nothing audible.

Flex is unchanged, and the test pins it. On a radio with a command plane, applyClientOwnedSliceStep() declines and the caller sends slice set <n> step= as before. The setters used by the band-stack and net paths produce the same text the hand-written code sent, in the same order among themselves (the AGC pair now goes out after the audio gain). Since #5904, the AGC and filter setters reach the Flex as receive intents that FlexBackend encodes into that same text on its guarded slice sink; NB and NR still go out as commandReady text. While KiwiSDR external receive replaces the slice, the AGC is not recalled through the setters, which would address the KiwiSDR AGC: MainWindow sends the original two slice set … agc_mode=/agc_threshold= lines instead (02dd0cc8). The test compares that text byte for byte, KiwiSDR case included, reading both the slice's commandReady and a real FlexBackend's slice sink. There is one deliberate exception, listed below.

#5262 M4. This lowers the command-plane baseline: MainWindow.cpp goes from 21 to 17 and MainWindow_Nets.cpp from 3 to 2 (406 to 401 in total on current main; the two KiwiSDR AGC lines stay in MainWindow.cpp). It removes hand-written wire text from GUI callers. It does not convert any of SliceModel's own wire sites. It calls the existing setters, whatever those do today.

#5904 (@rfoust's receive-control conversion, landed on main) routes setAgcMode, setAgcThreshold and setFilterWidth through typed backend intents. These callers use those routes with no code change; on a seam backend the band-stack AGC now reaches requestSliceAgc, whose default calls setSliceAgc.

#5919 (@rfoust, still open) converts the rest of the setters this PR calls (setNb, setNbLevel, setNr, setNrLevel, setAnf). @rfoust said to go ahead; the NB/NR commandReady assertions in reroute_dead_controls_test move with #5919's rebase, as the AGC/filter ones moved here for #5904.

Maintainer decisions (2026-10-02)

• set_ts 0 returns RPRT -1 on every radio, Flex included. Third-party CAT clients see this change on a Flex: before, they got RPRT 0 and the radio was sent step=0. FlexLib never sends a step below 1 (Slice.cs:1553-1572, TuneStep clamps to 1), so the Flex is no longer sent a value FlexLib never sends.
• The Flex wire text is pinned through FlexBackend's receive intents (c88e3fa1), since aetherd: migrate the first receive-command group behind the backend seam #5904 moved AGC and filter dispatch there.
• Accepted: a net preset with positive LSB edges is mirrored before filt reaches a Flex, and the Demo radio refuses NR (nr_cycle goes straight to NR2 there).

Choices a reviewer should see

• set_ts 0 is refused on every radio, Flex included, with RPRT -1 (RIG_EINVAL). Before, a Flex was sent step=0. The 0 that set_ts ? lists is Hamlib's RIG_TS_ANY marker, not a step (50a7477c).

• Remote NR/ANF ON is refused where the radio has no radio-side NR/ANF, on rigctld (RPRT -11), SmartSDR-CAT (?;), the automation bridge (error) and TCI (broadcasts false). OFF is accepted as before (9e81be62).

• setFilterWidth changes the text for one case. The raw filt sent a net preset's edges as stored. setFilterWidth first normalises polarity (Modes and width do not recover to profile settings when switching back from using FreeDV Flex on RASPberry PI5 #3434), as it does for every other caller. A net stored with positive lower-sideband edges, such as LSB 100..2900, now goes out as filt <n> -2900 -100, not filt <n> 100 2900. Canonical edges go out exactly as stored. Both cases are pinned in the test.

• The Demo radio now refuses MIDI NR and AM carrier. The Sim declares neither hasRadioSideDsp nor hasAmCarrierLevel, and its synthetic connection has no answer for nr= or am_carrier=. ANF is still accepted wherever a command plane exists, because the Demo connection turns anf= into the generator's audible notch (SimBackend::setDemoAnf). Only a radio with neither a command plane nor radio-side DSP refuses ANF.

• Pre-connect behaviour is kept. radioSideNoiseReductionAvailable() fails open with no backend attached, and the AM-carrier gate only refuses once a backend is attached.

• A test-only friend. RadioModel gains friend class RerouteDeadControlsTestAccess, next to the two existing test friends. It installs an unopened RadioConnection, so the test can exercise the command-plane branch with no socket.

Localization (docs/HERMES.md, "keep bring-up inside the family backend")

The pre-PR grep reports these hits. None of them is a family test: there is no family == check and no usesFlexCommandPlane() branch. Every gate uses hasCommandPlane() or a declared RadioCapabilities field.

• src/gui/MainWindow.cpp, MainWindow_Controllers.cpp, MainWindow_Nets.cpp, MainWindow_Shortcuts.cpp are the callers that wrote Flex text by hand. They now call a model method or a setter. That call site is what this PR changes.
• src/gui/MainWindow_Wiring.cpp is the S-meter micMetersChanged connection, which now passes transmitLevelFaceValue().
• src/models/RadioModel.cpp / .h hold the routing helpers. They sit next to hasCommandPlane() because the question each one answers is whether this radio has a command plane, or a declared capability. Also the EQ sink guard and the test friend.
• src/models/SliceModel.h is a comment only: applyRecalledStepHz() gains its second caller.

No backend changes, and no new seam verb.

Constitution principle honored

Principle VIII. A control either acts or says that it cannot. None of them fakes success. Principle II. Where a command plane exists, the step stays radio-owned: the client does not assert it, and it is set when the radio's status comes back.

Test plan

Maintainer landing pass, Linux (Arch, Qt 6, RelWithDebInfo), on this branch merged with current main:

• Full ctest, socket-owning tests excluded: all pass except connection_panel_size_test, a known local failure (Four tests fail deterministically on clean main locally: the a11y announcement fixture never receives focus (offscreen) #5811).
• reroute_dead_controls_test goes red under each of nine mutations of the no-command-plane path (step, NR gate, ANF carve-out, band-stack NR and KiwiSDR guards, level face, set_ts 0, TCI gate, NR OFF).
• Static gates --strict (engine boundary, capability records, command plane 401/401) and the touchpoint manifest check.
• Demo simulator driven offscreen: RX applet STEP sends slice set 0 step=250 through the command plane as before; anf_toggle and slice dsp anf on accepted; slice dsp nr on refused.

Author's run:

• Local build passes: Ninja, Qt 6.8.3, RelWithDebInfo, macOS arm64
• Full ctest at 0a88bdf4 (rebased on current main): 554/555 passed, reroute_dead_controls_test included. The one failure is vkamp_connection_test, which also fails on a clean main on this machine; its timing sensitivity is tracked in Replace retained socket fixtures with injected and opt-in coverage #5254. This PR touches no VKAmp file.
• New reroute_dead_controls_test (socket-free: a stub backend with no command plane, plus an unopened RadioConnection where one has to exist). It pins:
  • the client-owned step, and declining when a command plane exists
  • CAT set_ts/get_ts round trip
  • NR/ANF refusal with no phantom model state, and routing where radio-side DSP exists
  • Demo ANF still accepted, Demo NR still refused
  • AM carrier following its capability
  • EQ not dropped
  • the S-meter Level face on HL2, Flex and no-meter layouts
  • band-stack recall reaching the seam, plus the Flex wire text byte for byte
  • the net filter on the seam and on the wire, including the LSB mirroring
• The static-checks gates pass locally at the PR head: check_command_plane.py, check_engine_boundary.py, check_capability_records.py, check_test_registration.py, check_ci_test_gate.py, check_network_timeouts.py, check_theme_seed.py, check_shader_dialects.py (all --strict), and gen_touchpoint_manifest.py --check, gen_seam_probe_table.py --check
• Behaviour on a real radio: not claimed. Checked on the model and seam only.
• Tested on macOS only. Not built on Linux or Windows.

Checklist

• Commits are signed
• No new AppSettings keys
• Clean-room
• No meter UI change beyond which value the existing face receives
• No CHANGELOG.md edit

73, ON8ST

🤖 Generated with Claude Code

[aethersdr-agent]

1. Issue fit

No Fixes/Closes line is present in the PR body, so I reviewed against the PR's own stated intent: controls that a radio without a Flex command plane silently dropped, rerouted to a path that works or refused where none exists. It delivers that for the seven surfaces it names, and I could verify the load-bearing claims by reading the tree rather than taking them on trust:

• FlexBackend.cpp:337 declares hasRadioSideDsp = true and :314 hasAmCarrierLevel = true, so neither new gate refuses anything on a Flex — that was my first suspicion and it does not hold.
• RadioConnection.cpp:452 really does echo anf= and nb= but not nr=, so the ANF-on-Demo carve-out and the NR-still-refused asymmetry in requestRadioAutoNotch are both accurate rather than convenient.
• Hl2Backend.h:122/128 overrides setSliceAgc and setSliceNoiseBlanker, so the band-stack reroute genuinely lands AGC and NB on an HL2 — this is the strongest part of the PR. setSliceAutoNotch/setSliceNoiseReduction are not overridden there (base no-ops at IRadioBackend.h:770/778), so refusing rather than rerouting NR/ANF is the right call and not an over-gate.
• tools/check_command_plane.py: −6 in MainWindow.cpp (six deleted sendCommand calls) and −1 in MainWindow_Nets.cpp (the filt). The counts reconcile exactly; no send was quietly added elsewhere.

CI: all 5 checks green on 0a88bdf. The new test is not in any ctest -R gate in ci.yml, which is the repo's normal frozen-gate posture (#5405), not a finding.

2. Scope

File / group	What it changes	Claimed?	Verdict
RadioModel.{h,cpp}	5 new query/route helpers + recallBandStackReceiveDsp; EQ commandReady early-return	Yes	In scope
RigctlProtocol.cpp	set_ts routes through the client-owned step	Yes	In scope
MainWindow.cpp	RX-applet step; band-stack DSP recall via the helper	Yes	In scope
MainWindow_Controllers.cpp	MIDI NR/ANF/AM-carrier gated with notice	Yes	In scope
MainWindow_Shortcuts.cpp	nr_cycle skip, anf_toggle gate	Yes	In scope
MainWindow_Nets.cpp	net filter via setFilterWidth; step via the helper	Yes	In scope
MainWindow_Wiring.cpp	S-meter TX Level face reads MICPEAK	Yes	In scope
MeterModel.h	hasMicLevelMeter() / transmitLevelFaceValue()	Yes	In scope
SliceModel.h	comment only (second caller of applyRecalledStepHz)	Yes	In scope
tests/*, tools/check_command_plane.py	new test + ratchet counts	Yes	In scope

Everything in the diff is explained by the stated fix. No new capability field, settings key, protocol verb or CLI surface; CHANGELOG.md correctly untouched; no removed guard whose symptom can recur (the deleted sendCommand blocks are replaced by setters that emit the same text on a Flex, checked below). Nothing here reads as smuggled preference — every gate keys off an existing declaration (hasRadioSideDsp, hasAmCarrierLevel, hasCommandPlane()), not a family string.

Socket-test register: tests/reroute_dead_controls_test.cpp adds no socket. RadioConnection is constructed unopened and used only as a non-null pointer for hasCommandPlane(); there is no listen/bind/connectToHost/QTcpServer in the file. Nothing to notify.

CodeGuard: the six CG-PATH-001 hits are at RigctlProtocol.cpp:538 and MainWindow.cpp:9531/9643/9762-9764. None of those lines are in this diff (the hunks are at ~2072 and ~2050/5461). Pre-existing, not this PR's.

3. Blockers

None.

4. Nits (non-blocking)

• The S-meter fix has two siblings in the same signal, one of them in the same file. MainWindow_Wiring.cpp:1569 feeds the VFO SmartMTR scale and MainWindow_DspApplets.cpp:243 feeds the Phone/CW Level gauge (PhoneCwApplet.cpp:1377, m_levelGauge->setValue(micLevel)); both still pass the raw micLevel and so still sit on the −50 floor on an HL2. transmitLevelFaceValue() is exactly the helper they want. Worth noting that SMeterWidget.cpp:307's own comment says the S-meter Level face "matches Phone/CW Level gauge" — after this PR, on an HL2, it no longer does. See inline.
• The NR/ANF gate covers MIDI and the shortcut, not the four remote-control surfaces. RigctlProtocol.cpp:1949/1953, TciProtocol.cpp:1461/1485, AutomationServer.cpp:8166/8171 and SmartCatProtocol.cpp:1091/1241/1278 still call setNr/setAnf unguarded, so the phantom "NR on" the new test asserts against is still plantable on the same radio from rigctld or WSJT-X. The asymmetry is visible because the PR did reach into RigctlProtocol for the step. See inline.
• "Byte-for-byte on a Flex" has one more exception than the test covers. SliceModel::setAgcMode/setAgcThreshold divert to the KiwiSDR external-receive branch (m_externalReceiveAudioReplacement) and emit no wire text; the hand-written slice set … agc_mode= did. The test fixture never sets that flag. See inline.
• cmdSetTs accepts hz == 0 (only hz < 0 is rejected, and the ? list advertises "0 = any step accepted"). Without a command plane it now returns RPRT 0 while applyRecalledStepHz's hz <= 0 guard makes it a no-op and nothing is sent. Previously step=0 went to the wire. Trivial, but a silent success for an input the command documents.
• In buildUI the AGC pair used to be sent before slice->setAudioGain(); it now lands after it, since recallBandStackReceiveDsp is called below the Volume block. The set of commands and their order among themselves is unchanged (which is what the new test pins), but "the same relative order as the hand-written wire text" is slightly stronger than what the diff does.

5. What I tried to break

• "A Flex is unchanged." Attacked it four ways: (a) grepped every hasRadioSideDsp/hasAmCarrierLevel declaration to see whether a gate would refuse on Flex — FlexBackend.cpp:337/314 set both true; (b) read all six replaced setters for de-dup/clamp/early-return that would swallow a command the raw text sent — setNb/setNr have no equality guard, the level setters clamp to 0..100 and the recall already guards on difference, so the first-call output is identical; (c) checked the KiwiSDR branch, which is the one real divergence (reported above); (d) reconciled the check_command_plane.py ratchet against the deleted sends. Only (c) survived.
• The tuneToNet ordering hazard. setFilterWidth's LSB mirroring depends on the slice's current mode, and setMode runs two lines earlier — if the model waited for the radio echo, a preset switching USB→LSB would mirror against the stale mode. SliceModel.cpp:185 sets m_mode synchronously before returning, so the mirror sees the new mode. Not a bug.
• nr_cycle reachability. Walked all five branches: the new else if (!radioSideNoiseReductionAvailable()) sits after s->nrOn() and before the final else, so it is reachable exactly when NR is off and the radio has no radio-side NR, and it cannot shadow the NR2/NR4/DFNR steps above it.
• Lifetime and receiver context on the rewritten connect. The new lambda captures this but keeps m_appletPanel->sMeterWidget() as the context object, so it is still disconnected with the widget; and setMicMeters only stores micPeak for a not-yet-implemented peak tick (SMeterWidget.cpp:308), so passing it twice is inert rather than double-counting.
• Whether HL2/ANAN actually have an engine-side ANF the gate would wrongly refuse. The Hl2Backend.cpp:2493 comment about a WDSP notch looked like exactly that, but it is the manual/TNF notch (maxNotchFilters), and neither backend overrides setSliceAutoNotch/setSliceNoiseReduction. The refusal is correct.
• Test quality. The Flex halves compare SliceModel::commandReady output against literal expected strings rather than re-deriving them, and the LSB divergence is pinned as a deliberate exception rather than hidden — this is a test that would go red if the setters stopped emitting. What I could not check: nothing here was built or executed. In particular I could not confirm that RadioConnection's default constructor is genuinely inert when slice->setAnf() reaches sendCmd through an unopened connection in testAnfStillReachesTheDemoCommandPlane, nor that the new test actually fails against unfixed code. Every finding above is reasoned from the head checkout, not reproduced at runtime.

6. Recommendation

Approve with nits. The core reroute is well-targeted and, unusually, its central claims survived direct checking against the capability declarations and backend overrides rather than resting on the PR body. Nothing here breaks a Flex or a user on current main. The two worth acting on before merge are the S-meter siblings (one line each, and the PR's own helper already exists for them) and a sentence in the body acknowledging that the NR/ANF gate is GUI-only so the remote-control surfaces are a known follow-up rather than an oversight. Neither needs to hold the merge if the maintainer would rather take them as a separate PR.

---

_{🤖 aethersdr-agent · cost: $9.6985 · model: claude-opus-5}

[aethersdr-agent]

Cisco CodeGuard — static analysis of this PR (6 finding(s))

• [MEDIUM] CG-PATH-001 — Potential path traversal in src/core/RigctlProtocol.cpp /tmp/aetherclaude/pr-6049/src/core/RigctlProtocol.cpp:538
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6049/src/gui/MainWindow.cpp:9531
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6049/src/gui/MainWindow.cpp:9643
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6049/src/gui/MainWindow.cpp:9762
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6049/src/gui/MainWindow.cpp:9763
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6049/src/gui/MainWindow.cpp:9764

_{Automated static scan by Cisco DefenseClaw CodeGuard on the changed files. Advisory — some may be false positives; the review above verifies them.}

---

_{🤖 aethersdr-agent · cost: $10.3570 · model: claude-opus-5}

[on8st]

Thanks for the review. All four inline points were valid. Two of them showed that the PR body claimed more than the branch did. Each is fixed in its own commit on top of 0a88bdf4. No rebase and no force-push.

Corrections first.

• "A Flex receives the same commands" was false for KiwiSDR external receive, and the new routing had a second defect there. You found the first half: setAgcMode/setAgcThreshold take the KiwiSDR branch and send nothing. The second half is that the bookmark stores the radio's AGC (it is saved from agcMode()/agcThreshold()). Under KiwiSDR the recall therefore wrote a 0..100 radio threshold into the KiwiSDR AGC, which uses a dB range. That is fixed below, and a Flex is now byte-identical in that state too.
• Two numbers in the body are now wrong. The MainWindow.cpp command-plane baseline is 17, not 15. Total is 408, not 406; it was 413 before this PR. The two lines kept for the KiwiSDR case are the cause.
• One Flex-visible change is deliberate: set_ts 0 now answers RPRT -1 on every radio. Before, a Flex was sent step=0.
• Your ordering nit is correct, and I left the code as it is. Among the recalled commands the order is unchanged, but the AGC pair now goes out after setAudioGain(). So "the same relative order as the hand-written wire text" was stronger than the diff. The code comment now says "among themselves". I don't know of a Flex behaviour that depends on the order of AGC and audio gain. If you know of one, I'll move it.

MainWindow_Wiring.cpp:6393, the Level-face siblings (41313ab8). All micMetersChanged consumers now go through MeterModel::transmitLevelFaceValue(): the VFO SmartMTR (MainWindow_Wiring.cpp:1575) and the Phone/CW Level gauge (MainWindow_DspApplets.cpp:251). There was also a third one you didn't list: TCI tx_sensors' mic field (TciServer.cpp:255). So the SMeterWidget.cpp:307 comment is true again. Three of these consumers are MainWindow lambdas, so the test reads every &MeterModel::micMetersChanged connection under src/ as text and requires the helper in each. A future consumer that skips it will also fail.

RadioModel.cpp:4464, NR/ANF on the remote surfaces (9e81be62). All four surfaces now refuse ON where the radio has no radio-side NR/ANF, each in its own protocol's terms:

• rigctld set_func NR|ANF 1 answers RPRT -11 (RIG_ENAVAIL) (RigctlProtocol.cpp:1955/1961)
• SmartSDR-CAT ZZNR1/NR1|2/NT1 answer ?; (SmartCatProtocol.cpp:1092/1244/1283)
• the bridge's slice dsp nr|anf on returns an error (AutomationServer.cpp:8168)
• TCI has no error reply, so it broadcasts the true state, rx_nr_enable:<trx>,false; (TciProtocol.cpp:1464/1493)

OFF is already true on such a radio, so it is answered as before. That way a client that syncs state by sending OFF gets no new error. RadioModel::radioSideAutoNotchAvailable() (RadioModel.cpp:4454) is the ANF half of the existing predicate, so the Demo radio keeps ANF. The test covers each surface: the refusal, no phantom "on", no ON reaching the seam, OFF still accepted. It also checks that an Icom-shaped radio still reaches setSliceNoiseReduction/setSliceAutoNotch.

RadioModel.cpp:4507, Flex byte-for-byte under KiwiSDR (02dd0cc8). With external receive active, recallBandStackReceiveDsp() leaves the AGC alone (RadioModel.cpp:4518). MainWindow sends the same two slice set … agc_mode= / agc_threshold= lines the hand-written recall always sent (MainWindow.cpp:5474). They go before the Volume block, as they did before this PR. I kept the lines in MainWindow.cpp rather than moving them into RadioModel.cpp, so that no file's baseline grows. The test adds your third case: KiwiSDR active on a Flex-shaped slice. It checks that the KiwiSDR AGC is untouched, that no AGC intent is sent, that the NB/NR text is byte-for-byte as before, and that MainWindow still carries the two lines. On a radio with no command plane, this KiwiSDR case behaves as on main (the text is dropped).

RigctlProtocol.cpp:2079, set_ts 0 (50a7477c). In Hamlib a tuning step is a positive number of Hz. The trailing 0 that set_ts ? lists is RIG_TS_ANY, the capability marker meaning "any step", and is not itself a step. set_ts 0 now answers RPRT -1 (RIG_EINVAL) and leaves the step unchanged (RigctlProtocol.cpp:2086). The ? output is unchanged, and its comment now explains what the 0 means.

CodeGuard. I agree with your reading. The six CG-PATH-001 hits (RigctlProtocol.cpp:538, MainWindow.cpp:9531/9643/9762-9764 at the old head) are all outside this PR's hunks. They are a comment, two UI string literals containing \n\n, and three QDir::cdUp() calls on the application's own bundle path. None of them takes a path from input. They are pre-existing and none is this PR's.

Issue fit. There is no Fixes line because there is no single issue this closes. It is a slice of #5262 M4, the tracking issue, which must stay open. The work comes from a per-radio inventory of the UI: we traced 1,010 controls, and 118 of them are silent on an HL2. This PR is one group from that inventory: controls the radio can already serve through another path. Part B of the same group is #6021. On #5919, @rfoust said to go ahead (link), and whichever PR lands second adjusts the wire-text assertions. I'd welcome a Refs #5262 on the PR if a maintainer wants it linked.

Test plan update. Before the fix, the new checks fail against the unfixed source (a throwaway local commit with only the tests applied): reroute_dead_controls_test fails, with each thread's checks red: set_ts 0, all four remote surfaces, the level-face consumers, and the KiwiSDR AGC. Full ctest at 50a7477c: 555/555 passed (Ninja, Qt 6.8.3, RelWithDebInfo, macOS arm64). The static checks pass at 50a7477c: engine boundary, touchpoint manifest, seam probe table, test registration, capability records, command plane (408/408), CI test gate, network timeouts, theme seed and shader dialects.

73, ON8ST

[ten9876]

We're updating this branch against main and landing it (maintainer pass); please don't push to it meanwhile. New commits go on top, with no rebase or force-push.

[ten9876]

Maintainer landing pass at 10079f4a7 (on8st's six commits plus main merged in). Approved.

Review findings, each fixed by @on8st and re-proved here

• Level-face siblings: 41313ab87
• Remote NR/ANF surfaces: 9e81be623
• KiwiSDR AGC on a Flex: 02dd0cc87
• set_ts 0: 50a7477c1

All four threads are answered with evidence and resolved.

Landing-pass commits

• bfe826ddd / 94118f1a4 / 10079f4a7: merges of main. Every conflict was adjacent: RadioModel.h declarations (both kept) and tests.cmake blocks (#6075 retired wdsp_nb_hold_invariant_test, so its block stays out; #6013's two tests kept). #6013 also touches RigctlProtocol.cpp and MainWindow.cpp, in different functions (RF level), and merged cleanly.
• c88e3fa19: main's #5904 moved AGC and filter dispatch onto backend receive intents. The test's Flex cases now read a real FlexBackend slice sink plus commandReady, so the byte-for-byte Flex wire text is still pinned.
• c489c8a10: comments condensed to AGENTS.md § Comments.
• 86a8f0f80: radio NR/ANF OFF is accepted where the radio has none. Found by the automated review pass: a momentary MIDI button's release raised a second notice.

Maintainer decisions (Jeremy, 2026-10-02)

• set_ts 0 returns RPRT -1 on every radio, Flex included. Third-party CAT clients see this change on a Flex, which was sent step=0 before. FlexLib Slice.cs:1553-1572 never sends a step below 1.
• The FlexBackend-sink test re-pin is the accepted shape.
• Accepted as well: the LSB net-preset mirroring before filt on a Flex, and the Demo NR refusal (nr_cycle goes straight to NR2 there).

Verified empirically (Linux, RelWithDebInfo)

• Full ctest, socket-owning tests excluded: 551 of 552 pass, including #6013's rigctl_rf_gain_pan_test and receiver_slot_count_test. The one failure is connection_panel_size_test, a known local failure (#5811).
• reroute_dead_controls_test goes red under nine mutations of the no-command-plane path.
• Static gates --strict pass. Command-plane baseline lowered only (406→401), with no new gui→engine include.
• Demo simulator, driven offscreen: the RX applet STEP sends slice set 0 step=250 through the command plane as before. ANF is accepted and NR is refused.

Reasoned, not run

• A Flex is unchanged on the NR/ANF/AM gates because FlexBackend declares hasRadioSideDsp and hasAmCarrierLevel; the unit test covers this with a Flex-shaped fixture.
• Not tested on live hardware.

Green freshness: CI created 2026-10-03T02:37:25Z on this head. Main tip ad46155dc (02:23:24Z) is this head's merge parent, so there is no drift.