[ten9876]

Summary

On a radio with no Flex command plane, six transmit controls reach the radio through the backend seam and still raise the one-shot "dropping transmit set …" notice: VOX (enable, level), the speech processor, the SSB monitor, CW speed and CW break-in. On an Icom all of them apply. The drop-notice gate from #6015, transmitCommandDeliveredThroughSeam(), did not route them, because no capability said their setters do anything.

Fixes #6086.

What changes

CW speed and break-in (first commit). cw wpm N and cw break_in N are bare cw … text, not transmit set keys, so they get prefix branches next to cw pitch. They are routed under hasRadioSideCwKeyer, the same capability their seam connections already use. cw break_in_delay has no seam setter and keeps its notice.

VOX, monitor, speech processor (second commit). Three new optional capability records:

record	replaces	present means	Flex	Icom (transmitting)	HL2 / ANAN / Sim / RTL
voxControl { hasDelay }	hasVoxDelay	the radio has its own VOX. Without a command plane, setVox applies enable and level; hasDelay means the hang time is applied too	✅ hasDelay	✅ no delay	absent
speechProcessorControl { levelMaximum, label }	speechProcessorLevelMaximum, speechProcessorLabel	the radio has its own processor (setSpeechProcessor)	✅ PROC 0..2	✅ from the profile: IC-9700 COMP 0..100, others PROC 0..2	absent
txMonitorControl {}	—	the radio has its own SSB monitor (setTxMonitor: MON and its gain)	✅	✅	absent

When speechProcessorControl is absent, the P/CW face shows PROC 0..2, the same as when disconnected. The UI is unchanged on every backend. The unidentified receive-only Icom fallback declares none of the three.

How the gate treats each key without a command plane:

key	treated as delivered when
vox_enable, vox_level	voxControl is present
vox_delay	voxControl->hasDelay. False on Icom (setVox ignores the delay), so the notice there is correct and stays
mon, mon_gain_sb	txMonitorControl is present
speech_processor_enable, speech_processor_level	speechProcessorControl is present, or hostModulates && canTransmit (the HL2's ClientComp, MainWindow::applySpeechProcessorToClientComp). ANAN sets hostModulates but not canTransmit, so nothing serves its PROC and the notice stands
mon_gain_cw, mon_pan_cw, cw break_in_delay	never: no seam setter

The three seam connections are now gated on the same records. They used to check m_backend (VOX), !usesFlexCommandPlane() (monitor) and !m_flexBackend (PROC).

PROC on the HL2: @on8st, your PROC-on-HL2 work should use this gate. A host-side processor is covered by the hostModulates && canTransmit arm. speechProcessorControl is only for a radio's own processor behind setSpeechProcessor.

Ratchet: hasVoxDelay moves into the VOX record, so the bool count drops from 71 to 70. FROZEN_BOOL_COUNT is lowered to 70 in the same commit. The checker prints capability-records: 70 boolean(s), at the frozen 70 — ok (shrink only). No ratchet grows.

Flex is unchanged

Flex has a command plane, so the gate is never consulted for it, and TransmitModel's wire text is untouched. Flex declares all three records. That means its setVox, setTxMonitor and setSpeechProcessor are now called; the last two were not called before. FlexBackend doesn't override them, so they are the base no-ops. flexSeamSettersWriteNothing pins two things. First, with all three of FlexBackend's command sinks recording, those calls write nothing. Second, the transmit set vox_enable=1 / vox_delay=30 / mon=1 / speech_processor_level=1 text is byte for byte what it was.

Choices a reviewer should see

• On the unidentified receive-only Icom fallback, VOX, monitor and PROC no longer cross the seam. Before, setVox was called there unconditionally. That model has no transmitter.
• The Sim's setVox/setSpeechProcessor (base no-ops) are no longer called. Its VOX delay control stays dimmed, as before.

Known limits

• HL2 CW break-in and break-in delay keep a false notice. The HL2 has no radio-side keyer (hasRadioSideCwKeyer is false), so cw break_in and cw break_in_delay stay unrouted. Both act there anyway: RadioModel passes cwBreakIn() and cwDelay() to setCwKeying() at key time, and Hl2Backend::setCwKeying keys MOX on the first and clamps the second into its hang timer. Routing them needs a capability that says a backend implements setCwKeying(); hostModulates is the wrong proxy, because ANAN sets it and does not override that setter. Found by @on8st on hardware.
• CW speed, break-in and pitch reach only the IC-705 and IC-7300MK2 among Icoms (Icom: CW speed, break-in and pitch do nothing on radios without a CW text keyer (IC-9700, IC-7610, IC-785x, IC-7300, IC-905) #6110).

Validation

Unit tests (Icom path; there is no Icom on this bench):

• transmit_seam_drop_notice_test: 57 PASS, 0 FAIL. For each newly routed key there is a positive case (record present: setter called, no notice) and a negative control (record absent: setter not called, notice stands). Also covered: vox_delay with and without hasDelay; PROC on a host-modulating transmitter and on a non-transmitting one; cw break_in_delay; mon_gain_cw; and the Flex no-write case.

• Mutation check: 17 mutants, each caught by the case meant to catch it. In the gate:

  • each key's routing forced to false, and forced to true;
  • vox_delay ignoring hasDelay;
  • each arm of the PROC disjunction removed;
  • the host arm without canTransmit.

  In the code around it:

  • each of the three connections with its gate removed;
  • the CW prefixes and the trailing space;
  • Flex's txMonitorControl declaration removed.

• Updated: icom_control_profile_test (Flex, IC-7300MK2, IC-9700 COMP, HL2 and the unidentified Icom records), phone_cw_mic_gain_authority_test (the MainWindow presentation fan-out). icom_family_test is unchanged and passes.

• ctest: 568/568 pass, excluding the tests that own sockets (QUdpSocket/QTcp*/QLocal*/bind(), the automation tests and connection_panel_size_test (Four tests fail deterministically on clean main locally: the a11y announcement fixture never receives focus (offscreen) #5811).

Static gates: engine boundary --strict 0 blocking, touchpoint manifest up to date, capability records 70 at frozen 70, command plane 401 = baseline.

The agent automation bridge, Demo sim (Flex path only). The binary was built from the tree in the second commit; the build stamp reads ddc9aa4b5-dirty because that commit was made right after the build. Steps:

1. Connected to DEMO-0001, then set the slice to CW.
2. invoke "CW speed" setValue and invoke "CW break-in" click: get transmit read cwSpeed 20→24 and cwBreakIn false→true.
3. Set the slice to USB, then invoke on VOX level (65), Speech processor, Processor level (2), TX monitor and Monitor volume (35): get transmit read voxLevel 50→65, speechProc false→true, speechProcLevel 0→2, monitor false→true, monGainSb 50→35.
4. A marked log window with aether.protocol on contains no dropping or seam lines, and the app log has none either.

The VOX enable click was refused by the bridge's TX-safety guard, as it should be. The Demo has a command plane, so this run shows the Flex path is unchanged. The Icom path is covered by the unit tests only.

Related

• Icom: CW speed, break-in and pitch do nothing on radios without a CW text keyer (IC-9700, IC-7610, IC-785x, IC-7300, IC-905) #6110 (filed from this work). hasRadioSideCwKeyer means "the radio buffers CW text", but it also gates setCwSpeed/setCwBreakIn/setCwPitch. So those controls do nothing on the IC-9700/7610/785x/7300/905, and this PR's CW routing reaches only the IC-705 and IC-7300MK2.
• fix(tx): no false drop notice; HL2 max power in watts. Principle VIII. #6015 (added the gate), Hermes-Lite 2 TX power commands are dropped by the HL2 backend #5637, fix(radio): reroute controls a non-Flex radio dropped. Principle VIII. #6049 (the don't-emit approach for the EQ), Tracking: capability-driven multi-radio migration — landing order M0–M6 #5262 M2 (records over bools).

🤖 Generated with Claude Code

https://claude.ai/code/session_01AADGw3HVn5FMMVrx2RQZ9g

[github-actions]

Accessibility check findings

This PR touches src/gui/ files with 4 accessibility issue(s).
Full details appear as inline annotations on the diff above.

Files scanned : 1
Files with findings: 1
Total findings : 4

See docs/a11y.md for the canonical
Qt patterns (setAccessibleName, QAccessibleValueChangeEvent,
QAccessibleInterface subclasses, etc.). Structural remediation
(keyboard navigation, custom QAccessibleInterface subclasses)
is tracked in #3288.

Findings are warnings only — the build is not blocked.

[on8st]

Checked on the HL2 at 8ed9dc0.

One HL2 gap remains, outside PROC: cw break_in still raises the notice (RadioModel.cpp:1919-1921; the HL2 has hasRadioSideCwKeyer = false, Hl2Backend.cpp:1922), yet break-in acts there: RadioModel.cpp:4728 passes cwBreakIn() to setCwKeying, which the HL2 uses (Hl2Backend.cpp:4282). Your call whether it belongs in this PR.

PROC: no notice (RadioModel.cpp:1954-1957), and the button still reaches ClientComp, since speechProcessorCommandIssued → applySpeechProcessorToClientComp (MainWindow_DspApplets.cpp:943-945) is untouched. VOX and MON keep their notice (Hl2Backend.cpp:1968-1969), which is correct on main.

Full ctest GREEN, 610 tests (two -j8 flakes passed serially). Your test builds the HL2 caps by hand; we have a small test that takes them from a constructed Hl2Backend instead, 13/13 pass. Happy to add it if useful.

73, ON8ST

[aethersdr-agent]

1. Issue fit

Yes, for the scope #6086 names. Each requirement maps to a hunk: cw wpm/cw break_in get prefix branches before the transmit set early return (Correction 1 of the triage comment — a k/v addition really would have been dead code); vox/speech_processor/mon get std::optional<…Control> records rather than new bools (Correction 2); the PROC gate is the disjunction with the host-ClientComp arm (Correction 3); and the test file's stale "setVox is deliberately NOT overridden" premise is corrected rather than left to mislead. I verified against the backends that the three records are honest on Icom: setSpeechProcessor (IcomCivBackend.cpp:4322), setTxMonitor (:4394) and setVox (:4485) are all model-independent CI-V writes with no profile gate, so declaring them for every hasTransmit model is right; and setVox really does Q_UNUSED(delayMs), so hasDelay=false keeps the vox_delay notice correctly.

Test layer is right: capability declarations and gate policy are socket-free CTests, and the new cases are real pins — each positive case fails against unfixed code (the setter was already called for VOX/MON; it was the notice that fired), and each has a capability-absent negative control.

2. Scope

File / group	What it changes	Claimed by the PR?	Verdict
RadioCapabilities.h	3 new optional records; hasVoxDelay, speechProcessorLevelMaximum, speechProcessorLabel folded in	yes	In scope
flex/, hl2/, anan/, rtl/, sim/, icom/ backends	declare or decline the records	yes	In scope
RadioModel.cpp	gate branches + 3 seam connections re-gated	yes	In scope
MainWindow.cpp	PROC presentation + VOX-delay availability read from the records	yes	In scope; no new widget, no default changed
tools/check_capability_records.py	FROZEN_BOOL_COUNT 71→70	yes	In scope — a sanctioned shrink, not a ratchet raise
docs/architecture/radio-capabilities-map.md	rows for the 3 records	yes	In scope (one wording error, inline)
3 tests	updated + 12 new cases	yes	In scope

Everything in the diff is explained by the issue. No CHANGELOG.md entry (correct). No new protocol verb, settings key or wire text — TransmitModel's text is byte-identical and src/core/control/ has no reference to any of the three records, so this is internal C++ capability surface, not third-party-visible. No preference change: no default moved, no control restyled, no confirmation removed. Both commits are on-topic and signed.

I ran the static gates in the head checkout myself: check_capability_records.py → "70 boolean(s), at the frozen 70 — ok (shrink only)"; check_command_plane.py → 401 = baseline; gen_touchpoint_manifest.py --check → up to date; gen_seam_probe_table.py --check → up to date; check_test_registration.py → OK; test_check_capability_records.py → 28 checks pass. CI on 8ed9dc04 is 7/7 green.

Socket surfacing (§2 disclosure, not a finding). tests/transmit_seam_drop_notice_test.cpp now constructs a real FlexBackend, whose ctor starts two QThreads whose init() slots do new QUdpSocket (PanadapterStream.cpp:87) and new QTcpSocket (RadioConnection.cpp:88). Those are inert socket objects — nothing binds, listens or connects, no peer — and the same construction already exists on main in icom_control_profile_test and ~8 other registered tests. ~FlexBackend is bounded (wait(3000)). Target transmit_seam_drop_notice_test, registered, run by CTest. Worth knowing that the body's socket-exclusion grep (QUdpSocket/QTcp*/bind() wouldn't have matched this file, so the claim "excluding the tests that own sockets" didn't deliberately include it.

Bot lead, refuted. The a11y check's 4 findings on MainWindow.cpp are byte-identical on main (m_swrScanAction, m_preTuneAction, m_clearAtuAction, m_agcTCalibrationMenuAction, line-shifted only) — pre-existing, nothing to do here. CodeGuard/Copilot sections were empty, which means no findings or no scan; I'm not reporting that as clean.

3. Blockers

None.

4. Nits (non-blocking)

• The gate comment overstates cw break_in_delay (RadioModel.cpp:1906, inline). RadioModel.cpp:4728 hands cwDelay() to setCwKeying, and Hl2Backend::setCwKeying clamps it into the hang timer (Hl2Backend.cpp:4296-4298). It has no setter of its own, which is what you meant, but the sentence as written will mislead the next reader.
• HL2 break-in is the same false-notice class, still open (inline at :1919). @on8st found it on hardware; it's wider than they said — HL2 consumes both breakIn and breakInDelayMs at key time, yet hasRadioSideCwKeyer=false (Hl2Backend.cpp:1922) keeps both notices. Not this PR's job (the gate would need something that says "the backend implements setCwKeying", and hostModulates is wrong for that — ANAN sets it and doesn't override the setter), but it belongs in the body's known limits the way #6015 listed this issue, and cwSpeedAndBreakInWithoutKeyerKeepDropNotice's comment currently pins the gap as correct behaviour on the HL2-shaped caps.
• ANAN's PROC is not served by ClientComp (inline at AnanBackend.cpp:375, same wording in the doc row). AnanBackend.cpp:423 is canTransmit = false, so hostModulates && canTransmit is false there and MainWindow::hostModulatesTxAudio() is too — the notice correctly stands on ANAN. The behaviour is right; only the comment and the doc row (inherited from the triage comment's "ANAN … is covered by the same arm") are wrong.
• One maintainer decision is still unruled (inline at :1956): gate-forgives (here) vs. don't-emit (#6049's merged EQ shape) for host-served controls. #6086 is still labelled maintainer-review and no maintainer has ruled in the thread.
• Micro: the three re-gated connections now build a full RadioCapabilities by value per signal, and monitorCommandIssued/voxCommandIssued fire per slider tick. The commandReady gate already did m_backend->capabilities() per tick, so this is not new in kind.
• unroutedVerbStillRaisesDropNotice's comment still says "keeps the first four honest … the same backend, the same model" — the backend changed to icomTransmitter().

5. What I tried to break (and could not)

• A wire text emitted without its typed intent — the way the gate would forgive a command that reached nothing. I read every emitter: setVoxEnable/Level/Delay, setSbMonitor, setMonGainSb, setSpeechProcessorEnable/Level, setCwSpeed, setCwBreakIn all emit commandReady and their …CommandIssued unconditionally, side by side — crucially cwSpeedCommandIssued sits outside the speedChanged guard, so cw wpm has none of the change-gating that forced the cwPitchHandedToBackend comparison.
• The PROC host arm forgiving a no-op. applySpeechProcessorToClientComp only writes a preset when on && (levelChanged || switchedOn), so I expected a level move with PROC off to be forgiven while nothing applied. It isn't a hole: m_lastAppliedProcLevel is still updated, and the next off→on applies the current level. Same for Icom, whose setSpeechProcessor skips the level register while bypassed but writes it on the next enable.
• A missed consumer. Grepped the whole head tree for hasVoxDelay, speechProcessorLabel, speechProcessorLevelMaximum, the three new records and the three setters. All six capabilities() implementations are updated; the only surviving uses of the old names are IcomModelProfile's own fields, which are the record's input. src/core/control/ (the aetherd/bridge transmit target, a RadioModel with no MainWindow and so no ClientComp) exposes none of these controls, so the host arm cannot forgive anything headless.
• UI drift from a "no behaviour change" claim. Walked the presentation for all six backends: Flex PROC/2 → PROC/2; Icom from the profile; HL2/Sim previously set PROC/2 explicitly and ANAN/RTL inherited the default — all four now go absent and value_or(SpeechProcessorControl{}) renders the identical PROC/2. VOX-delay availability resolves the same for every backend. The claim holds.
• Flex gaining live setter calls. Confirmed no setVox/setTxMonitor/setSpeechProcessor override anywhere outside IcomCivBackend — so on Flex these are the base no-ops and flexSeamSettersWriteNothing is a real pin. (It does mean the connections' only guard is now the record: if FlexBackend ever implements one, the control would be applied twice, text and setter.)
• A struct-revision or field-inventory ratchet that removing/adding fields should have bumped — backend_capability_revision_test counts announcements, not fields; nothing to bump.
• Could not check: everything runtime. No build, no CTest, no GUI here, so "57 PASS", the 17-mutant table and the Demo bridge run are unverified by me; every finding above is reasoned from the head checkout at /tmp/aetherclaude/pr-6111 with file:line evidence, not reproduced. The Icom path has no hardware behind it either way.

6. Recommendation

Approve with nits — plus one named maintainer decision. The code is right and the records are evidenced against the actual CI-V writes rather than asserted; the tests fail against the unfixed code, and the ratchet genuinely shrinks. The three comment/doc corrections are cheap and worth doing before merge because each one is the artefact the next reader will trust. The decision a maintainer should make explicitly, since #6086 still carries maintainer-review: gate-forgives vs. #6049's don't-emit as the shape for host-served controls — picking gate-forgives here means two places (the gate and MainWindow) must both know about every host-served control forever. Next step: fix the three comments, add the HL2 break-in/break-in-delay limit to the body, and file it as a follow-up alongside #6110.

---

_{🤖 aethersdr-agent · cost: $9.5667 · model: claude-opus-5}

[aethersdr-agent]

Antares Detector — candidate vulnerable file(s)

• src/core/AudioEngine.cpp

The vox accumulator accumulates arbitrary PCM data without a fixed-size limit (m_voxAccumulator.append(pcmData)), and only processes when size >= TX_PCM_BYTES_PER_PACKET. The code then uses reinterpret_cast to read a fixed number of bytes into a float buffer, but there is no check that the accumulated PCM data fits within that buffer size before appending. This can lead to unbounded memory growth if packets are large or repeatedly triggered, violating memory-safety constraints.

_{Localized by Cisco Foundation AI Antares-1B running locally in the AetherClaude sandbox, seeded by the Cartographer security map. Advisory only — please verify before acting.}

---

_{🤖 aethersdr-agent · cost: $9.7197 · model: claude-opus-5}

[github-actions]

Accessibility check findings

This PR touches src/gui/ files with 4 accessibility issue(s).
Full details appear as inline annotations on the diff above.

Files scanned : 1
Files with findings: 1
Total findings : 4

See docs/a11y.md for the canonical
Qt patterns (setAccessibleName, QAccessibleValueChangeEvent,
QAccessibleInterface subclasses, etc.). Structural remediation
(keyboard navigation, custom QAccessibleInterface subclasses)
is tracked in #3288.

Findings are warnings only — the build is not blocked.

[ten9876]

Maintainer pass, now at fae9e3f:

• Merged main twice (signed merge commits, no rebase). feat(tx): apply TUNE power live while TUNE is keyed (HL2, Icom). Principle VI. #6104 conflicted only in tests/transmit_seam_drop_notice_test.cpp. I kept both sides: the header names both seams, and RecordingBackend records setTunePower alongside this PR's CW, VOX, MON and PROC setters. transmitCommandDeliveredThroughSeam() merged cleanly and now keeps both behaviours: feat(tx): apply TUNE power live while TUNE is keyed (HL2, Icom). Principle VI. #6104's tunepower arm, which is routed while keyed only on tuneCarrierLive && tunePowerAppliesLive, and this PR's record-gated keys. The test passes 72/72 (main's 46 checks plus this PR's 57, less the 31 shared). I proved the merged gate with three mutations, each of which went red: tunepower's live arm forced true, VOX routing forced true, and the PROC host arm removed. fix(ci): deploy Qt 6.12's single Wayland platform plugin in the AppImage. Principle VIII. #6112 and fix(hl2): drop spectrum and meter output from a closed receiver's DSP. Principle VIII. #6113 then merged cleanly.
• Review nits (aethersdr-agent review): the break-in-delay comment, the HL2 break-in limit (now in the body's "Known limits" section and in the test comment), and the ANAN PROC wording are all fixed in 8bac44e. Details are in the threads. The stale "keeps the first four honest … the same model" comment on unroutedVerbStillRaisesDropNotice is corrected in the same commit.
• @on8st: thanks for the HL2 check. Your break-in finding is the new Known-limits entry, and I didn't route it in this PR. As the review notes, routing it needs a "this backend implements setCwKeying" capability.
• Local results at fae9e3f: static gates clean (engine boundary 0 blocking, with findings identical to main; manifest up to date; capability records 70 at frozen 70; command plane 401 = baseline). Socket-free ctest: 558/560 pass. The two failures are connection_panel_size_test (Four tests fail deterministically on clean main locally: the a11y announcement fixture never receives focus (offscreen) #5811, a known local failure) and hl2_backend_seam_test. The latter fails identically on main: it has been red since feat(tx): apply TUNE power live while TUNE is keyed (HL2, Icom). Principle VI. #6104 (main Full Suite run 37140572560, the four #4549/#4912 tune-power-restore checks). It isn't from this PR, whose HL2 change is capabilities() only.

[ten9876]

Admin-merged on the maintainer's approval (self-authored). Head fae9e3f6f:

• 4 of 4 review threads answered and resolved. The PROC host-arm ruling is corrected to cite the maintainer directly (thread reply above).
• transmit_seam_drop_notice_test passes 72/72 after merging feat(tx): apply TUNE power live while TUNE is keyed (HL2, Icom). Principle VI. #6104's gate changes. Mutations on both sides of the merged gate turn it red.
• FROZEN_BOOL_COUNT 71→70, a reduction. Command plane is unchanged at 401.
• All required checks green. Drift since the run: fix(hl2): update seam tests for the transmit tail. Principle XI. #6126 (test-only), which touches none of this PR's files and merges cleanly.