[ten9876]

Summary

Follow-up to #6247 (#6244). A second remediation pass on #6247 produced these fixes, but #6247 merged before they could be pushed. Each fix is below. All of them are on the same DVK surface, and the a11y fold-in is a maintainer call.

• License latch: a license feature name=digital_voice_keyer enabled=1 status clears an earlier 50004001 refusal, so a subscription activated mid-session re-enables DVK without a reconnect. The radio's licensed status outranks the earlier refusal.
• Import admission: Import re-checks DVK admission when the upload actually starts. The menu item was enabled before a modal file dialog, and the DVK may have started recording or playing while the dialog was open.
• Transfer flag on disconnect: DvkModel::reset() leaves the transfer flag to DvkWavTransfer, which clears it when its own transfer ends, because a transfer can outlive the connection by its timeout.
• Busy window: it starts only after an upload that actually connected. A refused dvk upload no longer turns the next try into "file server still busy".
• Upload port: a named port that never answers also gets the single retry on 42607, when the connect timeout fires, and an unparseable port reply is logged.
• Export peer check: export now says why it turned a connection away ("Ignored a connection from X; waiting for the radio at Y…") instead of timing out silently. The maintainer ruled to keep the check strict to the radio's address.
• STOP before the echo: its reply carries the pending start's slot, not −1.
• Parser: a quoted value left open stops at the next key=" token, so it can't swallow the keys after it.
• Screen readers: F-key name changes are announced one slot at a time. Slot loads and disconnect resets, which change many slots at once, stay silent.
• MainWindow a11y (maintainer: fold in): the four ATU/AGC menu actions (m_swrScanAction, m_preTuneAction, m_clearAtuAction, m_agcTCalibrationMenuAction) put their disabled reason on statusTip as well as the tooltip. check_a11y on the touched GUI files goes from 4 findings to 0.

Constitution principle honored

Principle VIII. Each fix comes with a test that fails without it.

Test plan

• Full local ctest on this branch: 671 of 672 pass. The one failure is control_receive_test, which already fails on main (CI Full Suite on 66f393220, before any DVK change); it is tracked in [full-suite] test suite failing on main (fp a1c5df639be3) #6248.
• dvk_model_status_test (47 cases), which adds:
  • RadioModel license status clearing the refusal (only for DVK, and only enabled=1)
  • the pending-slot stop tag
  • the transfer flag surviving reset()
  • the quote-join stop
• dvk_wav_transfer_generation_test adds three cases:
  • Import refused while the DVK is busy
  • a refused upload leaving no busy window
  • the timeout retry on 42607
• Checked by inverting the fix: with the license clear, the quote stop or the busy-window guard removed, its test goes red, then green again once the file is restored byte-for-byte.
• Static gates: check_engine_boundary (same 102 findings as main), check_capability_records, check_command_plane, check_test_registration, check_ci_test_gate and gen_touchpoint_manifest --check all pass.

Checklist

• Commits are signed
• No new flat-key AppSettings calls
• Clean-room
• No meter UI touched
• No CHANGELOG entry
• Security-relevant: this touches the export peer check (no change to its policy; it adds a visible reason)

🤖 Generated with Claude Code

[ten9876]

Issue fit

Partially. This follow-up to #6247/#6244 implements the intended license recovery, late Import admission, transfer ownership, connected-upload busy window, timeout fallback, export explanation, and pending STOP tag. The new shared-parser guard also truncates a valid quoted name, and the screen-reader change reduces rather than silences bulk name notifications. Reviewed head a02a4405a, merge base 5f86d2faa. The PR merged during verification at bc1d7b80 (2026-10-07 22:11:49 UTC); the parser condition is confirmed in that landed commit. This is a post-merge review; the blocking finding needs a follow-up fix.

Scope

Everything in the diff is explained by the body and DVK remediation, including the explicitly disclosed maintainer-approved MainWindow accessibility fold-in.

File/group	Change	Claimed?	Verdict
DvkWavTransfer.{cpp,h}	Late Import gate, connected-only busy window, single timeout retry, transfer diagnostics	Yes	In scope
DvkModel.{cpp,h}, RadioModel.cpp	Clear refusal on licensed status; pending STOP slot; retain owner-controlled transfer flag	Yes	In scope
CommandParser.cpp	Stop malformed quote joins at another quoted key	Yes	In scope; valid-value regression below
DvkPanel.{cpp,h}	Debounce/coalesce name announcements	Yes	In scope; partial improvement below
MainWindow.cpp	Four disabled reasons copied to statusTip	Yes; maintainer fold-in	In scope; verified
Two DVK tests, tests.cmake	Socket-free regression assertions and isolated settings	Yes	In scope

The single commit's author date/message fits this remediation and its signature is verified. No new settings keys, protocol verbs, capability fields, dependencies, visual redesign, or CHANGELOG entry. The four architecture gates have identical normalized findings on base/head: 102 engine findings (zero blocking), 70 capability booleans, 368 raw commands, and a current unchanged touchpoint manifest. No new #5554 seam coupling found.

Blockers

1. [P2] Preserve a legal quoted value whose closing token ends in = — src/core/backends/flex/CommandParser.cpp:24. For id=1 name="CQ a=" duration=1000, the closing token a=" contains =", so the new guard mistakes it for another quoted key and refuses the join. The real sanitizer accepts CQ a=; FlexLib's DVKRecordingStatus extracts the name between the quote pair, and its forbidden-character list does not prohibit =. Compiling the actual base/head parser and model against Qt 6.12 gives:

base: sent=CQ a= parsed="CQ a=" model=CQ a= duration=1000   (exit 0)
head: sent=CQ a= parsed="CQ     model=CQ    duration=1000   (exit 1)

The running head panel also reports Play slot 1: CQ after that status. Ordinary CQ Contest and CQ a=b controls remain intact. This reintroduces the name-truncation problem #6244 addressed for a valid user name; because parseKVs is shared, the same boundary affects other quoted fields.

Recognize a closing quote at the token's end before treating =" as a new key. Add the valid-name round trip to tests/dvk_model_status_test.cpp:103 beside the malformed-next-key case, keeping that existing case green. This drop-in replacement for the join block was compiled and passed both the valid CQ a= case and the existing malformed name="abc foo=1 bar="x" baz=2 case:

            if (end < tokens.size()
                && (!tokens[end].contains(QLatin1String("=\""))
                    || tokens[end].indexOf(QLatin1Char('"')) == tokens[end].size() - 1)) {
                for (qsizetype j = i + 1; j <= end; ++j) {
                    token += QLatin1Char(' ') + tokens[j];
                }
                i = end;
            }

Nits (non-blocking)

• The bulk-notification silence claim is not established — src/gui/DvkPanel.cpp:405, src/gui/DvkPanel.cpp:420. setAccessibleName() itself emits NameChanged, as the Qt 6.12 QWidget implementation confirms. With accessibility active, a real running panel and QAccessible::installUpdateHandler filtered to F-key NameChanged events produced:

                  single rename    12-slot load    disconnect reset
merge-base panel       2                24                 24
head panel             2                12                 12

The timer halves the bulk event count, but the setters bypass its suppression and a single change still emits twice. These are observed Qt notifications, not a claim about what each native screen reader speaks. Carry an event-count test in the panel coverage and revise the implementation or the body's silence claim accordingly. The announcement queue can be disabled while the existing panel admission/theme tests still pass, so those tests do not demonstrate this behavior.

Verification and attacks

• Built exact head and merge-base AetherSDR on Linux/Qt 6.12.0 using RelWithDebInfo -O2 -g1 and shared core. Built and ran only the focused targets: dvk_model_status_test (47 cases), dvk_wav_transfer_generation_test, dvk_panel_admission_test, and dvk_panel_theme_test: 4/4 passed. The modified transfer test is genuinely socket-free: its null model makes the deferred connect unreachable, and no download listener is started. Inert socket objects are not firmware peers.
• Reverted seven guards individually in the scratch checkout: license clearing, malformed-quote stopping, pending STOP slot, transfer ownership on reset, connected-only busy window, late Import admission, and timeout retry. Each relevant test failed for the intended assertion. Restored original source bytes, rebuilt, and the model/transfer tests passed again. The separate valid-name probe fails only on the head. The running panel and accessibility event handler independently verified the name truncation and the notification counts above.
• Drove only isolated offscreen demo instances with fresh settings, explicit sockets /tmp/pr6262-demo/{base,head,head2}/bridge.sock, identities pr6262-{base,head,head2}-review, and AETHER_AUTOMATION_NO_TX=1. Connected only to DEMO-0001; settled base/head2 state included {"connected":true,"serial":"DEMO-0001","sliceCount":1,"panCount":1,"transmitting":false}. menu open Tools plus dumpTree showed the three disabled SWR/ATU actions gaining a statusTip equal to their existing tooltip. For example, head Pre-tune returns {"enabled":false,"statusTip":"ATU memory controls are unavailable for this radio"}, while base has no statusTip. The first head snapshot also confirmed the disabled AGC-T reason; the settled head clears it when AGC-T becomes enabled. All owned instances were closed; no live radio or TX was used.
• Attacked disconnect while an upload awaits its first command reply using a cold, socket-free model probe. The real onDisconnected callback drain finishes the transfer (error 0x50000063), yielding transfer=0, admission=1; the suspected stranded-admission case does not survive that lifecycle check. Reviewed stale-generation, one-retry, connected-error, strict-peer and refusal paths. Real firmware Import/Export and a foreign-peer connection were not exercised: demo does not implement licensed DVK, and this review used no live hardware or new socket test.
• Accessibility lint reproduces 4 → 0 on the two touched GUI files. Test registration, CI-gate integrity, QSettings and whitespace checks pass. An additional automated code-review skill was unavailable; this was a manual audit with empirical checks. The full-suite claim was not independently rerun; #6248 records the disclosed pre-existing control_receive_test failure. Required CI checks passed for pull-request runs created 2026-10-07T21:52:55Z. Main subsequently advanced to this PR's squash merge at 2026-10-07T22:11:48Z, but both head and landed commit have tree 1a655602 and parent 5f86d2faa: the merge did not add untested tree changes.

Recommendation

Request changes in a follow-up. Fix and cover the valid quoted-name regression now present on main. The other seven guarded fixes survive targeted mutation, and the MainWindow accessibility reasons are verified. The remaining announcement issue is non-blocking partial remediation. The PR merged while this review was running; no merge or additional GitHub comment was performed by this review.

GitHub rejected REQUEST_CHANGES because the authenticated account is the PR author. This single review is therefore posted as COMMENT with the Request changes recommendation above.

[ten9876]

The review's blocker (a quoted name ending in = was truncated) and its accessibility finding (the panel's extra NameChanged on top of Qt's own) are both fixed in #6264. Each comes with a test that fails without the fix: dvk_model_status_test and the NameChanged event counts in dvk_panel_admission_test.