[on8st]

Maintainer ruling (2026-10-03): the default is accepted; the AGC-off level persists per receiver in this PR, capability-shaped, in the radio's settings document, with no schema bump; stale DIGU/DIGL band-stack bookmarks are follow-up #6142.

Refs #5629

DIGU and DIGL open with AGC off on the Hermes-Lite 2, and the AGC-off level that then sets their gain is remembered per receiver.

Limits first.

1. The default changes for every Hermes-Lite 2. Ruled: accepted. Selecting DIGU or DIGL turns AGC off on that receiver, and a receiver that comes up in DIGU or DIGL does too. Only the hl2 family is touched. ANAN-G2 runs the same AGC and keeps the operator's mode; RTL-SDR offers no data mode. Neither was measured or changed.
2. DIGU/DIGL are still up to 29 dB quieter at the default level; what is new is that the operator's correction now sticks. With AGC off the gain is the AGC-off level (feat(hl2): route APF and the AGC-off level to WDSP. Principle VIII. #6050): 10 dB at the default level of 10, against an AGC ceiling of 39 dB at the default threshold. The 29 dB is the difference of the two settings, not a measurement. The default level is unchanged. An operator who raises the level (the AGC-T slider while AGC is off) gets it back on the next launch, on that receiver. What is not covered:
   • No schema bump (ruled). The field is optional and kSchemaVersion stays 2, as it did when the AGC pair was added (fix(hl2): persist the operator's AGC mode and threshold across restarts — Principle III. #4911). An older build that captures over the document drops the array, and the level is 10 again after a downgrade.
   • A receiver is identified by its index. Closing the first of two receivers moves the second to index 0, and the next capture stores its level there.
   • The gate reuses two existing declarations. feat(hl2): route APF and the AGC-off level to WDSP. Principle VIII. #6050 added no capability of its own for the off level; hasAgcThreshold is documented as "threshold/off level". The field is read and written when the backend declares the Agc settings domain and hasAgcThreshold. No new boolean (the capability-record count is frozen at 70).
3. Follow-up HL2: an old DIGU/DIGL band-stack bookmark re-applies medium AGC over the data-mode AGC off #6142, not in this PR: a band-stack bookmark still carries its own AGC. A bookmark saved in DIGU/DIGL before this change stores the AGC of that time, medium on a stock profile, and recalling it puts medium back (RadioModel::recallBandStackReceiveDsp). A bookmark saved after it stores off. Read from the source, not run.
4. The reason for the default is an offline measurement, and this PR adds no new one. The decode figures are §13 item 30 measured: TCI's post-AGC feed costs decodes only beside a +30 dB neighbour, and the Wideband tap is not the fix #5629's: WSJT-X's FT8 decoder fed through the shipped WDSP chain, no radio, no real band, no static crashes. Nothing was received on hardware for this PR.
5. §18.5 is corrected in place.

What changed

The default (src/core/backends/hl2/Hl2Backend.cpp):

event	AGC on that receiver
mode changes from a non-data mode to DIGU or DIGL	the current mode is held, AGC goes to off
connect restores the receiver into DIGU or DIGL	the remembered mode is held, AGC goes to off; a later link-up after EP6 silence does not repeat it
the remembered AGC is seeded on a receiver already in DIGU or DIGL	the seeded mode is held, AGC stays off
a receiver is created from the first one while that is in DIGU or DIGL	it copies the mode, the off and the held mode
DIGU ↔ DIGL	unchanged
the same data mode is selected again	unchanged, so an operator's own AGC choice survives
mode changes from DIGU/DIGL to a non-data mode	the held mode is restored
the operator changes the AGC mode while in DIGU/DIGL	that is their choice: it is kept on leaving, and nothing is restored
a threshold change while in DIGU/DIGL	AGC stays off, and the held mode is still what gets remembered

One function, Hl2Backend::followModeAgc, holds the rule; every site that writes a receiver's mode or seeds its AGC calls it.

The remembered AGC pair stays the operator's. It is one flat setting for the radio. The data mode's "off" never reaches it: setSliceAgc(), the seed and the capture all record the held mode instead.

The AGC-off level, per receiver (the ruling):

• Where it is stored. In the radio's OperatingState document in radio_settings, scope (hl2, <MAC>), as one array: "agcOffLevels": [37, 52], one 0..100 entry per receiver index, -1 for a receiver without one. No flat AppSettings key.
• The pattern. docs/agents/settings.md names one pipeline for state the radio cannot hold: a typed field in RestoredRadioState, written and read only by RadioStateMemory, gated by the backend's declaration. The AGC pair uses it, so the level sits beside the pair as RestoredRadioState::agcOffLevels. The other shape in that document, the per-domain ext sub-objects, holds the per-band maps of RfGain and TxSetpoints only.
• Capability-shaped. RadioStateMemory loads and stores the array only for a backend that declares the Agc domain and hasAgcThreshold. There is no family check.
• Capture. Hl2Backend::requestSliceAgc() records the level for that receiver and asks for a capture; currentOperatingState() reports the list.
• Restore. applyRestoredState() validates each entry (outside 0..100 is dropped, not clamped) and seedReceiverAgc() gives each receiver its own entry at connect, where the AGC pair is seeded. pushInitialState() and finishReceiverDspBuild() already push the receiver's level to WDSP (feat(hl2): route APF and the AGC-off level to WDSP. Principle VIII. #6050).
• A receiver opened later (createPanadapter()) takes the entry for its index, else the default. A receiver that is closed keeps its entry.
• No entry, or no array: the default of 10. A document written before this change loads as before.
• No migration. settings.md asks for one when a key is renamed or restructured; this is a new optional field.
• Other families do nothing with it. Flex, Sim and Icom declare no settings domains. ANAN-G2 declares hasAgcThreshold but not the Agc domain, and RTL-SDR declares neither, so RadioStateMemory hands them an empty list and writes no array for them. No backend other than Hl2Backend reads the field.

Docs and comments:

• docs/HERMES.md §13: item 30 is marked done with the measured result; item 26 no longer lists the Wideband tap as open; item 28 records that the HL2's tap-kinds answer is Demod only.
• docs/HERMES.md §18.5: the tap paragraph states the measured mechanism, the level step of limit 2, that the level is remembered per receiver, and that the default is HL2-only.
• docs/HERMES.md §5 (AGC): a paragraph on the per-receiver AGC-off level: field, document, gate, seed, validation.
• docs/architecture/radio-capabilities-map.md: the clientSettingsDomains row names the field, its gate and which families ignore it.
• src/core/backends/hl2/Hl2RxDsp.h and src/core/dsp/WdspChannel.h: the blockForOutput comments no longer claim a burst feed is deterministic.

Tests

All without a radio.

test	what it pins
hl2_tci_signaling_test, testDigitalModeDefaultAgc	the mode-change rows of the table, "the data mode's off is not captured", and the capture fallback before any AGC was set
hl2_tci_signaling_test, testAgcOffLevelCapture	without a socket: a restored {20, 61}, receiver 0 set to 37 → one capture request and the capture {37, 61}
hl2_state_restore_test (default)	restore into DIGU; a second link-up after an operator AGC choice; the seed on a receiver already in DIGL
hl2_state_restore_test (off level)	level 37 on receiver 0 and 52 on receiver 1 → currentOperatingState() → RadioStateMemory::store → a new backend → RadioStateMemory::load → applyRestoredState() → connect: each receiver publishes its own level, each WDSP channel reports the matching fixed gain (dspChains(), what the channel accepted), and the next capture is unchanged. Also: a change asks for a capture; a radio swap does not carry the levels across; a document without the array gives 10 on both receivers and 10 dB in the channel; an out-of-range entry falls to the default and its neighbour holds
radio_state_memory_test	the array round-trips with a hole; it is one array in the OperatingState document; a backend without hasAgcThreshold is handed none and still gets the AGC pair; a backend without the Agc domain is handed none; a store without the capability writes no array; a document without the field loads; a state carrying only levels is not "nothing stored"
hl2_pan_create_async_test	a receiver created beside a DIGU one opens on off and returns to the first receiver's held AGC; a receiver opened later takes the level remembered for its index

Fail-before, the off level. The new tests on bbddff97's source, plus the one struct field they need to compile (a throwaway commit, full suite): ten checks red.

[FAIL] an AGC-off level change asks for a capture
[FAIL] the capture carries each receiver's AGC-off level
[FAIL] a capture before the connect keeps the remembered AGC-off levels
[FAIL] a new backend restores each receiver's own AGC-off level
[FAIL] and each WDSP channel accepted the restored fixed gain
[FAIL] the restored AGC-off levels are captured again unchanged
[FAIL] an out-of-range AGC-off level falls to the default; its neighbour holds
[FAIL] the per-receiver AGC-off levels round-trip, holes included
[FAIL] they are one array in the radio's OperatingState document
[FAIL] a new receiver opens on the AGC-off level remembered for its index

Two mutations of the head, each in a full-suite run:

mutation	red checks
seedReceiverAgc() does not write the receiver's level (the restore)	4, all in hl2_state_restore_test: the restore, the WDSP gain, the second capture, the out-of-range case
currentOperatingState() does not report the levels (the capture)	5, all in hl2_state_restore_test: the capture, the capture before connect, and the three restore checks that depend on it

Fail-before, the default (earlier heads): the mode-change checks were red on main when the PR was opened (5 of 12); restore into DIGU, the seed in DIGL and the pan seed were red on 540e149e's source.

Full suite at the head (macOS, Apple Silicon, Qt 6.12.0, RelWithDebInfo): 612 of 615 at -j8, the same three on the serial rerun. None is from this PR:

• hl2_pan_create_async_test, one check, "the reuser has its own chain" (fix(hl2): drop spectrum and meter output from a closed receiver's DSP. Principle VIII. #6113). It fails on clean main at this branch's merge base d9de044c, and passes in the tree merged with main at 5fae2f86.
• peripheral_auth_dialog_test (feat(peripherals): authenticate direct TGXL, PGXL, and Antenna Genius connections #6008). It fails on clean main at d9de044c and in the merged tree.
• vkamp_connection_test, one check, "out-of-range antenna ports never reach the wire": the Replace retained socket fixtures with injected and opt-in coverage #5254 race in the test. It passed in the run of the same sources one commit earlier (the last commit is docs only).

The tree merged with main at 5fae2f86 (a throwaway merge, not pushed): 616 of 617, peripheral_auth_dialog_test only. git merge-tree against main at 52b6f7ad is clean; that tree was not built.

Static checks, every step of the "Static checks" job of static-checks.yml run locally at the head: all pass, including the capability-record convention (70 booleans, unchanged) and the QSettings ratchet. No src/gui file is touched, so the a11y step has nothing to scan. The "Sanitizer option configures" job was not re-run for this head; no CMake file changed.

Not verified

• On a radio. No HL2 was connected and nothing was decoded.
• Across a real restart of the app. The tests go through RadioStateMemory and the settings store in one process, with a new backend object. RadioModel's debounced capture and its flush on disconnect and on quit are the existing path for every field and were not driven for this one.
• The level drop. The 29 dB in limit 2 is arithmetic on two settings.
• The AGC mode push. The tests pin the AGC mode the backend holds and publishes; that WDSP receives the mode is not asserted. The fixed gain is asserted from the channel.
• More than two receivers, and closing a receiver, for the off level. The index rule in limit 2 is read from the source.
• Band-stack recall (limit 3) is read from the source, not run.
• Static crashes and other asynchronous interferers, which §13 item 30 measured: TCI's post-AGC feed costs decodes only beside a +30 dB neighbour, and the Wideband tap is not the fix #5629 named as the one regime where AGC off could behave differently.
• Windows locally. macOS by the author; Linux in the maintainer pass (merged with main at a8cfd9901: the socket-free suite, 507 of 508, the one failure the known local connection_panel_size_test, Four tests fail deterministically on clean main locally: the a11y announcement fixture never receives focus (offscreen) #5811). Windows only through CI.

73, ON8ST

🤖 Generated with Claude Code

[aethersdr-agent]

1 · Issue fit

Partially. #5629 asked for exactly this (agcMode = "off" on entering DIGU/DIGL, plus the §13/§18 doc corrections), and the triage comment invited it explicitly — "Do the DIGU/DIGL default AGC, subject to the level question above… send the XS PR" — so the shape is already ruled on and this is not an unratified default change. The doc rewrite is faithful to the measurement: §18.5 now states the real mechanism (noise reference inflated 18.25 dB, signal window within 0.042 dB) rather than the hand-wave it replaces, and withdrawing the Wideband tap rather than deferring it matches the recommendation.

What it does not cover is the path an FT8 operator actually takes most often: the AGC default is adopted only on a mode change through setSliceMode(), and connect-time mode restore does not go through setSliceMode(). Detail in Blocker 1. The title's claim "open DIGU/DIGL with AGC off" is true for a mode click and false for relaunching into DIGU.

The triage's one open question — the ~29 dB level step from a 39 dB AGC ceiling to a 10 dB fixed gain — is answered in the commit message ("DIGU/DIGL are quieter on the speaker and on the TCI level meter"), which satisfies the "be explicit" half. It is not in HERMES.md, where the next reader will look; see nits.

2 · Scope

File / group	What it changes	Claimed?	Verdict
Hl2Backend.cpp / .h	isDigitalDataMode(), the AGC-off adoption in setSliceMode, the agcModeBeforeDigital member, the capture/restore guards in setSliceAgc, seedReceiverAgc, currentOperatingState	Yes — the fix	In scope
tests/hl2_tci_signaling_test.cpp	testDigitalModeDefaultAgc(), registered in main()	Yes	In scope
docs/HERMES.md	§13 rows 26/28/30, §18.5, §18.7 item 5, the capability table row	Yes	In scope — all four named in the #5629 triage
Hl2RxDsp.h, WdspChannel.h	blockForOutput comments corrected: the flag blocks but does not make a burst feed reproducible	Not in the title; in the commit body and in #5629 §"One harness fault"	In scope — comment-only, two lines each, traceable to a named triage item

No new public surface, no settings keys, no capability fields, no CHANGELOG.md entry (correct). No removed guards — the only - lines of substance are the if/else brace conversion in setSliceAgc, which preserves the original branch logic exactly. The §18 edits delete no claim that was true: §18.5's old "it decodes, but a modem on AGC'd audio is a known-marginal arrangement" is replaced by the measurement that supersedes it. Nothing in the diff is unexplained.

3 · Blockers

1 · Restoring into DIGU/DIGL leaves medium AGC — the primary WSJT-X workflow doesn't get the fix. (inline on Hl2Backend.cpp:2906)

Reasoned from code, not reproduced at runtime:

• pushInitialState() writes the restored mode directly: txRx->mode = m_restoredState.mode; (Hl2Backend.cpp:7101-7102), then derives the passband from it and pushes setAgc(wdspAgcMode(r.agcMode), …) at :7155. It never calls setSliceMode(), so the new block never runs.
• seedReceiverAgc() has already set r.agcMode from the remembered flat pair and cleared agcModeBeforeDigital (:6530-6533).
• The capture side of this PR deliberately never stores the data mode's off, so the remembered pair is always the non-digital one — by design.

Net: operator runs FT8 in DIGU, quits, relaunches, reconnects → DIGU with slow/med AGC, agcModeBeforeDigital empty, and nothing pending. It self-heals only after a mode round-trip out of and back into a data mode. DIGU → DIGL doesn't help either (wasDigital && isDigital takes neither branch).

The PR's own analogy is what makes this a gap rather than a judgement call: the comment says "Adopted on entering them, like the passband", and the passband is handled at that exact restore site (defaultPassbandForMode(txRx->mode), :7104-7106). The AGC has no counterpart there. Fix looks like a few lines in the same restore block: if isDigitalDataMode(txRx->mode), stash agcModeBeforeDigital = agcMode and set off before the setAgc push at :7155, under the existing m_passbandDerivedThisConnect guard so an EP6 re-linkUp can't replay it over a live edit.

I'd call this a blocker because the PR reads as "fixed" and the most common entry into DIGU is the one left on medium.

4 · Nits (non-blocking)

• createPanadapter()'s seed can strand off. (inline on Hl2Backend.h:511) The seed at Hl2Backend.cpp:962-972 copies first.mode and first.agcMode but not agcModeBeforeDigital (correctly — it's per-receiver). So a pan created while receiver 0 sits in DIGU starts at mode=DIGU, agcMode=off, before=""; moving that receiver to USB hits wasDigital && !isDigital && before.isEmpty() and leaves it on off for the rest of the session. Smaller blast radius than Blocker 1 and the same root shape (a path that sets mode without going through setSliceMode); worth one line either way.
• The currentOperatingState() hunk is unreachable in practice. (inline on Hl2Backend.cpp:6565) m_agcMode is assigned unconditionally in applyRestoredState() (:6503, which runs before every connect) and again in seedReceiverAgc() (:6539), and is never cleared — so the else if fallback only fires pre-connect, when rx(m_txDdc) is null anyway. The test's currentOperatingState().agcMode == "slow" checks pass through the m_agcMode branch, not this one. The change is correct and defensive; it just isn't load-bearing and isn't covered.
• The level step isn't in the docs. The triage flagged the ~29 dB drop (39 dB AGC ceiling → agcFixedGainDb 10.0) as "a plausible next issue". The commit message says it; HERMES.md §13 row 30 and §18.5 don't. One sentence next to the row would stop the next reader filing it. Related question, not a finding: did #5629's AGC-off arm run at the same agcOffLevel default (10) this PR will produce, or at unity?
• !previous.isEmpty() is dead in both the passband and the new AGC block — Receiver::mode defaults to "USB" (Hl2Backend.h:498), so it's never empty. Harmless, and consistent with the sibling above it.

5 · What I tried to break

• Mode-transition matrix. DIGU→DIGL (no change, correct), DIGL→DIGU, re-selecting the same data mode, a refused mode string (early return before r->mode is written, so previous can't be corrupted), and USB→CWU with a pending before — all behave. agcModeBeforeDigital can only be non-empty while the mode is digital, so there's no path where the restore branch fires outside a data mode.
• The capture seam. Walked setSliceAgc → m_agcMode → currentOperatingState → applyRestoredState → seedReceiverAgc for leakage of the data mode's off into the persisted document. It doesn't leak: entering DIGU never touches m_agcMode, and the threshold-only call (m empty) keeps the before value. One edge the PR accepts rather than handles: an operator who explicitly re-selects off while in DIGU gets m == r->agcMode, so before is not cleared and their choice is overwritten on leaving — the test pins this deliberately, and I agree it's the lesser surprise.
• Multi-receiver. agcModeBeforeDigital is per-Receiver and resolved through ddcForSlice/rx(), every access null-checked, and the flat m_agcMode capture keeps the "last receiver the operator touched" rule from #4909 intact. Receiver 1 in DIGU does not drag receiver 0's AGC. buildReceivers() carries state wholesale; seedReceiverAgc() clears the member. The only hole found is the createPanadapter seed above.
• Threading and lifetime. The new setAgc push is Qt::QueuedConnection to r->dsp behind an r->dsp null check — byte-identical shape to the setAgc call in setSliceAgc four hundred lines down, and on the same (GUI) thread. No new ordering: the AGC push lands before the setMode/setFilter pair, and applyRxAgc is mode-independent, so the SetRXAMode rebuild below it can't discard the AGC the way it discards filter edges.
• The test. It would fail on main — without the new block the first check(agc == "off") sees "slow". Mutating if (m != r->agcMode) to clear unconditionally reddens the last assertion; dropping the wasDigital term reddens the DIGU→DIGL check. It runs with r->dsp == nullptr, so it covers the state machine and the published delta but not the WDSP push — an honest layer boundary, not a gap. Socket-free, no fake peer, registered at tests/tests.cmake:5660; one sticky agc capture variable means "a non-data mode change leaves AGC alone" would also pass if emitSliceState omitted agcMode, which is weak but not wrong.
• Could not check: anything at runtime — no build, no HL2, no WSJT-X. Every finding above is read from the head checkout at 540e149. CI is green on all five checks (build, check-macos, check-windows, Static checks, Sanitizer configures) against base 732b99a9, which is current main; note the per-PR ctest is -R-filtered, so hl2_tci_signaling_test passing in CI is not something I can confirm from the check list.

6 · Recommendation

Request changes, on Blocker 1 only. The measurement behind this is unusually well done and the doc rewrite is the kind that saves the next person a week — but the fix is wired into the one mode path that the connect-time restore bypasses, and the operator who benefits most from AGC-off in DIGU is precisely the one who left the radio there overnight. Concrete next step: extend the restore block in pushInitialState() (Hl2Backend.cpp:7099-7113) to adopt the data-mode AGC default alongside the passband it already derives, add the mirror-image case to testDigitalModeDefaultAgc() (restore into DIGU, check off, leave to USB, check the remembered mode returns), and decide the createPanadapter seed either way. The nits can ride along or follow.

---

_{🤖 aethersdr-agent · cost: $8.1571 · model: claude-opus-5}

[on8st]

Bad news first: Blocker 1 stands. I had it in the body as limit 3 and called it out of scope; that was the wrong call. Fixed in 6d09a779, a new commit on 540e149e, no rebase.

One limit remains. A band-stack bookmark applies its own stored AGC after the mode (RadioModel::recallBandStackReceiveDsp). A bookmark saved in DIGU before this change recalls the AGC of that time. Read from the source, not run, and not changed: it is every family's bookmark contract.

• Blocker 1 and the pan seed. One function, Hl2Backend::followModeAgc(), called from setSliceMode(), the restore block of pushInitialState() (inside the once-per-connect guard) and seedReceiverAgc(). createPanadapter() copies the held mode.
• Remembered AGC. The off never reaches it; the seed primes the capture from the held mode.
• currentOperatingState() nit. Reachable: the constructor builds one receiver (Hl2Backend.cpp:295). Kept, and now tested.
• Level step. In HERMES.md §18.5 and item 30. §13 item 30 measured: TCI's post-AGC feed costs decodes only beside a +30 dB neighbour, and the Wideband tap is not the fix #5629's AGC-off arm ran at SetRXAAGCFixed 10 dB, the same as the default level.
• !previous.isEmpty(). Dropped from the AGC rule. The passband one is not this PR's line.

Fail-before (the new tests on 540e149e's source): red on restore into DIGU, the seed in DIGL, and the pan seed. Mutations: the capture fallback and the seed priming reading agcMode each turn one check red.

Suite at 6d09a779: 610 of 610 (macOS, Qt 6.12.0). Static checks pass locally.

Not verified: anything on a radio, and that WDSP receives the pushed AGC.

73, ON8ST

[ten9876]

Issue fit

The mechanism is correct, and the head now covers every way into DIGU/DIGL. Whether HL2 should change this default is still a maintainer ruling, and nobody has made it yet. #5629 measured offline that WDSP's AGC costs FT8 decodes beside a +30/+40 dB neighbour, and that AGC off on the slice recovers them. The triage comment on #5629 said "send the XS PR". That comment came from aethersdr-agent, though, and the issue still carries maintainer-review. Under Principle XIII peer-agent suggestions "are hints", and GOVERNANCE.md lists "default values affecting all users" as something an agent "may not autonomously change". It also says "any change to default UX behavior" needs an RFC. This PR turns AGC off for every HL2 operator who selects DIGU/DIGL, and on a quiet band the receiver gets up to 29 dB quieter on the speaker and on the TCI meter. Limit 1 of the PR body already says this is the maintainer's call, which is right. The review agrees: the code is ready for that decision, and the decision itself is not made here.

Fix or preference (the skill's step 6): it is not a bare preference. It cites a measurement with a stated denominator and registered falsifiers. That measurement is offline only, though: no radio, no band, no static crashes. The HL2 gateware has nothing to say here, because AGC is host-side WDSP. The authority is #5629's harness, and nothing else backs it. FlexLib (reference/FlexLib_API_v4.1.5.39794/FlexLib/Slice.cs) couples DIGU/DIGL to nothing on the client side: AGC is a per-slice radio property, set and echoed independently of the mode. So no reference behaviour either supports or contradicts the default. With this PR, HL2 DIGU will open with AGC off and a Flex DIGU slice will keep whatever AGC the radio holds.

Scope

File / group	Change	Claimed?	Verdict
src/core/backends/hl2/Hl2Backend.cpp / .h	isDigitalDataMode(), followModeAgc() and its 3 callers, the pan-seed copy, capture/seed/fallback read the held mode, the setSliceAgc clear	Yes	In scope (the default change itself needs the maintainer, see above)
docs/HERMES.md §13 rows 26/28/30, §18.5, capability table, §18.7 item 5	Measured mechanism, Wideband withdrawn, level step stated	Yes, as the #5629 triage asked	In scope. §18.5 rewritten in place, limit 5 flags it for the maintainer
Hl2RxDsp.h, WdspChannel.h	blockForOutput comments corrected (comments only)	Yes	In scope (triage item)
tests/hl2_tci_signaling_test.cpp, hl2_state_restore_test.cpp, hl2_pan_create_async_test.cpp	New cases	Yes	In scope. See the socket note below

Commits are 540e149e and 6d09a779, both authored 2026-10-03, and both about the issue. The diff adds no new settings key, verb, capability field or CHANGELOG.md entry. Nothing on the - side removes a guard: the only removed logic is the brace conversion in setSliceAgc, and it keeps the same branches. Everything in the diff is explained by the issue.

Blockers

None in the code. The merge depends on the maintainer ruling on the default (above), which is not a defect the author can fix.

Nits / maintainer-decision inputs (non-blocking)

1. The PR's answer to the level drop does not survive a restart. Limit 2 says "the operator can raise the AGC-off level". On HL2 that level lives only in Receiver::agcOffLevel (Hl2Backend.cpp:3090, pushed at :3288). RestoredRadioState has no field for it (src/core/backends/RestoredRadioState.h:22-31 persists only agcMode/agcThreshold), and nothing in src/ writes it to settings. So an FT8 operator who raises it to get the 29 dB back has to raise it again every launch, on every receiver. Before this PR, AGC off was an explicit operator choice, so this was a corner. After it, the AGC-off level is the operating gain of every HL2 DIGU session. Not this PR's bug, but the maintainer should weigh it with the default. Either persist the off level next to the AGC pair, or rule on a data-mode fixed gain, which was the other option the triage offered.
2. Siblings left behind, disclosed in limit 1. ANAN-G2 (AnanBackend::setSliceAgc, AnanBackend.cpp:818) and RTL-SDR (RtlSdrBackend.cpp:572) run the same WDSP wcpAGC. The mechanism #5629 measured is a WDSP property, not an HL2 one. After this PR, the same mode on two host-DSP radios in one app behaves differently. That is fine as an HL2-first step, but it should be on record (an issue or a §13 row) so it does not look like a deliberate divergence.
3. Pre-PR band-stack bookmarks re-impose medium (limit 3). I read RadioModel::recallBandStackReceiveDsp (RadioModel.cpp:4183-4198). Mode, sliceChanged and AGC are all DirectConnection, so the backend's off reaches SliceModel before the bookmark comparison runs. A post-PR bookmark (stored off) therefore round-trips cleanly. A pre-PR DIGU bookmark (stored med) sends setSliceAgc("med") after slice->setMode (MainWindow.cpp:5317 and then :5351). Hl2Backend.cpp:3006 treats that as an operator choice, clears the held mode, and leaves medium AGC on in DIGU. Saving the entry again stores med again, so the old value never ages out unless the operator picks off by hand. The PR body discloses this as limit 3. The automated pass flagged the same path independently. If the maintainer accepts the default, a follow-up could ignore a stored AGC on DIGU/DIGL recall, or migrate those entries once.
4. One claim cannot be checked from the issue. "#5629's AGC-off arm ran at that same 10 dB" (docs/HERMES.md §18.5) is not in #5629's body. Only the author's PR comment says it. If the level matters to the decode result, put the figure in the issue thread, where the measurement lives.
5. Stale CI. The earliest run on 6d09a779 was created at 18:38Z, and main has since moved 7 commits (19:25Z). Three of those touch HL2 (#6104, #6113, #6126), including Hl2Backend.cpp and hl2_pan_create_async_test.cpp. git merge-tree against current main is clean. I checked main's Hl2Backend.cpp hunks: they are in TX keying/tune, openReceiverDsp, capabilities and the TX reset at the top of pushInitialState(), and none touches Receiver::mode/agcMode, the pan seed, seedReceiverAgc or the restore block. So I found no functional overlap, but I did not build the merged tree. A CI re-run on current main would close this.

Socket-test notice (step 0)

tests/hl2_state_restore_test.cpp gains three connectRadio() cases, and that path starts MetisClient. MetisClient binds a QUdpSocket on AnyIPv4:0 (MetisClient.cpp:330-331, via Hl2Backend.cpp:2658) and sends to TEST-NET-1. The existing cases in that test already do the same, so this is not new socket ownership. It does make the test a modified socket-owning one, so I did not run it, and its three checks are reasoned from code, not executed. The other two targets are socket-free: hl2_pan_create_async_test asserts transportIdle, and the new hl2_tci_signaling_test case never connects.

What was verified vs. read, and what held

• Built the head 6d09a779 (Linux, Qt 6, RelWithDebInfo) and ran hl2_tci_signaling_test ("all checks passed") and hl2_pan_create_async_test ("0 failure(s)").
• Mutations, both caught. Dropping seed.agcModeBeforeDigital = first.agcModeBeforeDigital; (Hl2Backend.cpp:971) gives [FAIL] and returns to the first receiver's held AGC on leaving DIGU. Short-circuiting the followModeAgc call in setSliceMode (:2926) gives 5 FAILs ("entering DIGU turns AGC off", "DIGU to DIGL keeps AGC off", "entering DIGL turns AGC off", "a threshold change in a data mode does not capture off", "and the held AGC still returns afterwards").
• GUI echo loop. If the GUI re-sent a stale AGC after the mode change, the default would be undone. The GUI does not: SliceModel::setAgcThreshold sends m_agcMode, which sliceChanged has already set to off synchronously, and an equal mode keeps the held mode (Hl2Backend.cpp:3004-3008). SliceModel::applyDelta's AGC update is equality-guarded and emits no command.
• Restore/seed matrix, read. Fresh connect, restore into DIGU, then seed: off, held = remembered. Carried receiver already in DIGU, then a different-radio seed: off over the seeded mode. Carried DIGU, then restore USB: the held mode returns. Same-radio reconnect: no reseed, and the restore block runs once per connect (m_passbandDerivedThisConnect). Every write to Receiver::mode (:967, :2914, :7116) either calls followModeAgc or copies the held mode.
• Capture. The data mode's off never reaches m_agcMode/currentOperatingState(), except when the operator picks a different AGC and then off inside DIGU. That is an explicit choice, so it being kept is consistent with the table.
• Doc numbers checked against #5629. 32/82 at +30 dB, 58/76 at +40 dB, 0.042 dB, 25–29 dB, 18.25 dB, and 39 dB = 65 × 0.6 (Hl2DbReference::agcCeilingDb). agcFixedGainDbForOffLevel(10) = 10 dB. All match.
• Automated pass (/code-review, medium): one low-severity finding, the pre-PR bookmark path, folded into nit 3 after I checked it against MainWindow.cpp:5310-5351. It found nothing else.
• Engine boundary. tools/check_engine_boundary.py gives identical per-file findings on the merge base 732b99a9 and the head.
• Not driven in the app. The demo is SimBackend, which never runs Hl2Backend, so a bridge session would exercise none of the changed lines. Nothing was run on an HL2. Speaker and TCI levels and the on-air decode result are unverified, and the PR says so itself.

Recommendation: Needs maintainer decision. If the default is accepted, the code is mergeable as is, after a CI re-run on current main. Nit 1 (the off level is not persisted) is the input most likely to change how the default lands.

[on8st]

Bad news first, two items.

1. Nothing in this push settles the PR. The default is yours to rule on and the PR waits for it. I am not arguing it; I write the RFC only if you ask.
2. The merged tree is not green here: 613 of 615 (macOS, Qt 6.12.0). hl2_pan_create_async_test ("the reuser has its own chain", fix(hl2): drop spectrum and meter output from a closed receiver's DSP. Principle VIII. #6113) and peripheral_auth_dialog_test (feat(peripherals): authenticate direct TGXL, PGXL, and Antenna Genius connections #6008) fail, identically on clean main at d9de044c. Neither check is this PR's. 6d09a779 was 610 of 610.

Pushed bbddff97, two commits, no rebase:

• Nit 5. main merged in. Static checks pass locally.
• Nit 2. §18.5 records the default as HL2-only. One correction: RTL-SDR offers no DIGU/DIGL and its setSliceAgc is empty (RtlSdrBackend.cpp:592), so only ANAN-G2 differs.
• Nit 4. The 10 dB is in §13 item 30 measured: TCI's post-AGC feed costs decodes only beside a +30 dB neighbour, and the Wideband tap is not the fix #5629's thread, with the harness lines.

Inputs to your ruling, not built:

• Nit 1. Confirmed. In feat(hl2): route APF and the AGC-off level to WDSP. Principle VIII. #6050 I left the off level unpersisted on purpose; with this default that reasoning no longer holds.
• Nit 3. Unchanged.

If you accept the default I build both as follow-ups, the persisted off level first: it touches every DIGU session on every launch, the bookmark recall only entries saved earlier.

On those two failures: the HL2 one fails here on clean main every time (60 of 60), and its cause is in the test, not in the guard; I posted it on #6113. The other one I have not traced beyond a layout that needs 680 px in a 640 px viewport on this Mac.

73, ON8ST

[ten9876]

Maintainer ruling on #6119:

• The default is accepted. On the HL2, DIGU and DIGL open with AGC off. §13 item 30 measured: TCI's post-AGC feed costs decodes only beside a +30 dB neighbour, and the Wideband tap is not the fix #5629's offline FT8 measurement is the basis.
• Also persist the AGC-off level per receiver. Today RestoredRadioState has no field for it, so it resets to 10 on every launch and the compensation the PR suggests doesn't stick. Please add it in this PR: capability-shaped persistence, in the radio's settings document, not a flat key.
• Stale DIGU/DIGL band-stack bookmarks that restore med are a follow-up, not a blocker here.

73, Jeremy KK7GWY

[on8st]

Bad news first: the head is not green here. 612 of 615 on macOS; the three failures are upstream's and are named in the body. Merged with main at 5fae2f86: 616 of 617 (peripheral_auth_dialog_test, #6008).

Pushed 71225eee, two commits on bbddff97, no rebase. The AGC-off level persists per receiver.

• Where. RestoredRadioState::agcOffLevels, stored as the agcOffLevels array of the radio's OperatingState document. No flat key.
• Gate. RadioStateMemory reads and writes it only for a backend declaring the Agc domain and hasAgcThreshold. Other families ignore it.
• HL2. Captured in requestSliceAgc(), seeded per receiver in seedReceiverAgc(). No array: 10.
• No schema bump, as with the AGC pair (fix(hl2): persist the operator's AGC mode and threshold across restarts — Principle III. #4911). An older build drops the array. Yours to choose.

Tests: two levels, capture, store, new backend, load, restore; each WDSP channel reports the gain. Ten checks red on the old source. Dropping the restore: 4 red. Dropping the capture: 5 red.

Not verified: a radio, a real app restart, more than two receivers. The bookmark follow-up is not started.

73, ON8ST

[ten9876]

We're updating this branch against main and landing it (maintainer pass); please don't push to it meanwhile. New commits go on top, with no rebase or force-push.

[ten9876]

Maintainer pass: answers to my review of 6d09a779, at head f48369a7b

The rulings are as posted on 2026-10-03: the default is accepted, the AGC-off level persists per receiver in this PR, and stale bookmarks are a follow-up. Point by point:

1. The AGC-off level did not survive a restart. Fixed by on8st in 7ce11806 / 71225eee, and I verified it at the head:

   • Shape. RestoredRadioState::agcOffLevels is stored as the agcOffLevels array in the radio's OperatingState document, scope (hl2, <MAC>). There is no flat key.

   • Gate. RadioStateMemory reads and writes the array only when ownsAgcOffLevel(caps) holds, meaning the Agc client-settings domain and hasAgcThreshold (src/core/RadioStateMemory.cpp). Only Hl2Backend declares Domain::Agc. ANAN, Flex and Sim declare hasAgcThreshold but not the domain, so they are handed nothing. There is no family check (Constitution II/III).

   • No schema bump. This is the maintainer's decision, the same as fix(hl2): persist the operator's AGC mode and threshold across restarts — Principle III. #4911: an additive array that older builds ignore.

   • Mutations, all run on the merged tree, each restored and sha256-checked:

     removed	red check
     the load line (RadioStateMemory)	radio_state_memory_test round-trip
     the store line	the round-trip and "one array in the OperatingState document"
     the capability gate	four gate checks
     the capture in requestSliceAgc()	hl2_tci_signaling_test testAgcOffLevelCapture, a socket-free check added in f48369a7b
     the report in currentOperatingState()	the same test
     the load in applyRestoredState()	that test plus hl2_pan_create_async_test "a new receiver opens on the AGC-off level remembered for its index"
     the pan-seed level	the pan test

     The seedReceiverAgc() restore and the store→load→connect round trip are in hl2_state_restore_test. That test binds a UDP socket through MetisClient, so I reviewed it from the code and did not run it.

2. Siblings. §18.5 records the default as HL2-only. on8st's correction stands: RTL-SDR has no DIGU/DIGL and an empty setSliceAgc, so only ANAN-G2 differs.
3. Pre-PR band-stack bookmarks. Filed as HL2: an old DIGU/DIGL band-stack bookmark re-applies medium AGC over the data-mode AGC off #6142 (bug), with the recall order on current main: MainWindow.cpp:5338 applies the mode, :5371 → RadioModel::recallBandStackReceiveDsp() applies the stored med, and Hl2Backend::setSliceAgc() clears the held AGC. Not in this PR.
4. The 10 dB figure. It is now in §13 item 30 measured: TCI's post-AGC feed costs decodes only beside a +30 dB neighbour, and the Wideband tap is not the fix #5629's thread with the harness lines, where the measurement lives.
5. Stale CI. Main is merged in at a8cfd9901 (signed merge c201755ec). git merge-tree was clean. Main had gained fix(squelch): SQL line and Auto SQL from a backend-published scale; HL2 amsq gate referred to the LNA. Principle VIII. #6127, fix(rit): carry the slice id through the RIT/XIT seam; HL2 holds them per receiver. Principle I. #6109, fix(gui): manual Black Level works on a dBm row. Principle VIII. #6115, fix(gui): NB Blank works on a dBm waterfall row. Principle VIII. #6117 and test: drop two host-dependent assumptions that fail on macOS. Principle VIII. #6134 in files this PR touches, so this was a real update, not drift. I built the merged tree locally (Linux, Qt 6, RelWithDebInfo, -j8). hl2_tci_signaling_test, hl2_pan_create_async_test and radio_state_memory_test pass. The full socket-free ctest passed 507 of 508; the one failure is connection_panel_size_test, the known local failure (Four tests fail deterministically on clean main locally: the a11y announcement fixture never receives focus (offscreen) #5811). The 123 tests whose sources open or drive a socket were excluded. CI on the new head is running.

Socket notice. hl2_state_restore_test (the restore cases, the seed case and the off-level round trip) was not executed. It is reviewed from the code only.

Static gates. check_engine_boundary --strict, gen_touchpoint_manifest --check, check_capability_records --strict and check_command_plane --strict give byte-identical output on main a8cfd9901 and on the head.

[ten9876]

Approved at f48369a7b: maintainer pass (/pr-land).

Maintainer decisions (Jeremy, KK7GWY)

• Default accepted. On HL2, DIGU/DIGL open with AGC off, on the basis of #5629's offline FT8 measurement.
• The AGC-off level persists per receiver in this PR. on8st did it in 7ce11806 / 71225eee: RestoredRadioState::agcOffLevels, the agcOffLevels array in the radio's OperatingState document. I verified it is capability-shaped (ownsAgcOffLevel = Agc domain ∧ hasAgcThreshold; only HL2 declares the domain). There is no family check and no flat key.
• No schema bump, as with #4911: an additive array that older builds ignore.
• Stale DIGU/DIGL band-stack bookmarks that restore med are follow-up #6142, not this PR.

Findings, each closed at this head

• Blocker, the connect-time restore bypassed the default. Fixed by on8st in 6d09a779. followModeAgc() (Hl2Backend.cpp:2922) is called from setSliceMode() :2972, seedReceiverAgc() :6699, and the pushInitialState() restore block :7288, inside the m_passbandDerivedThisConnect guard (:7268–:7318). The setAgc push at :7341 follows it.
• Nit, the pan seed stranded off. Fixed in 6d09a779 (:992). Proved by hl2_pan_create_async_test, which goes red when the copy is removed.
• Nit, the capture fallback looked unreachable. Refuted: it is reachable before a connect, and it is covered by testDigitalModeDefaultAgc, which goes red when the fallback is removed.
• Nit, the mirror-image restore test. Present in hl2_state_restore_test.
• My review's points 1–5 are answered in the top-level comment. Main is merged in at a8cfd9901 (signed merge c201755ec). f48369a7b adds testAgcOffLevelCapture, a socket-free capture check.

Verified empirically (Linux, Qt 6, RelWithDebInfo, the merged tree)

• hl2_tci_signaling_test, hl2_pan_create_async_test and radio_state_memory_test pass.
• Full socket-free ctest: 507 of 508. The one failure is connection_panel_size_test, the known local failure (#5811). The 123 tests whose sources open or drive a socket were excluded.
• Ten mutations, each red, each restored and sha256-checked: RadioStateMemory load, store and gate; capture in requestSliceAgc(); report in currentOperatingState(); load in applyRestoredState(); pan-seed level; pan held AGC; capture fallback; the mode-click followModeAgc call.
• Static gates (engine boundary, touchpoint manifest, capability records, command plane) give identical output on main a8cfd9901 and on the head. No ratchet moved. All commits are verified.

Reviewed from code only, not run

• hl2_state_restore_test: the restore-into-DIGU case, the second link-up, the seed in DIGL, and the off-level store→load→connect round trip. It binds a UDP socket through MetisClient and was not authorised to run.
• Nothing ran on an HL2 radio, and there was no app session: the demo's SimBackend never runs Hl2Backend.

Freshness. The CI run on this head was created at 2026-10-04T02:25:37Z. Main's tip is a8cfd9901 (01:53:44Z), which the head already contains, so the run builds against current main. Auto-merge waits for that run.