…/shim

- Delete default constructor (= delete) to prevent null-vector deref (aethersdr#1)
- Remove noexcept from processBlock overrides, buildPrefilter, buildRrcLowpass
  — allocating ops inside noexcept terminate on OOM (aethersdr#2)
- Unconditionally call lane.demod->reset() on gate-close so DPLL/AGC
  are not left stale across silence gaps (aethersdr#3)
- Add lastHdlcFrameStartSampleIndex with 10-sample dedup window to
  prevent 9x inflation of totalHdlcFrameStarts in A+ mode (aethersdr#4)
- Record demod diagnostics from lanes.size()/2 (middle slicer) instead
  of lane 0 (weakest slicer in A+ mode) (aethersdr#6)
- Fix int*int overflow in duplicateWindowSamples: cast first operand
  to quint64 before multiply (aethersdr#8)
- Extract vhfModeLayout() free function; replace two switch copies
  in configure() and ax25DemodLaneCount() (aethersdr#10)
- AfskDemodWrapper<Demod,Result> template replaces two identical structs;
  using aliases preserve LibmodemAfskDemod / DirewolfAfskDemod names (aethersdr#11)
- Delete dead try_demodulate(double, uint8_t&) overload; all callers
  use the demod_result overload (aethersdr#12)
- Add pushLP() helper for LP ring-buffer writes; replaces 4 open-coded
  stores with manual bump in try_demodulate (aethersdr#13)

Not fixed (intentional):
  aethersdr#5 — phaseOffsetSamples=0 on all A+ lanes: DPLL pull-in makes
       phase stagger redundant (kPllSearchingInertia=0.50 locks in 4-5
       symbols from any starting phase, matching Direwolf behaviour)
  aethersdr#7 — Normal polarity hard-coded in setModemProfile: pre-existing in
       main since PR aethersdr#3279; no polarity UI or AppSettings key exists
  aethersdr#9 — DC-sum normalisation in buildRrcLowpass: correct for envelope
       detector on IQ baseband; energy norm only valid for matched filter

Principle VIII.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

aethersdr#8 — applyVhfMode: early-return when profile is not Vhf1200, so a
programmatic combo index change while HF-300 is active cannot trigger
a spurious shim->configure().

aethersdr#9 — buildPrefilter / buildRrcLowpass: reset m_preBufPos and
m_lpBufPos alongside their respective buffers, so calling either
function standalone (bypassing reset()) leaves the ring-buffer
cursors consistent with the freshly-zeroed buffers.

aethersdr#10 — static_assert on VhfMode integer values in the dialog; the
combo box encodes VhfMode as static_cast<VhfMode>(index + 1), which
silently breaks if a new enum value is inserted. The asserts fire at
compile time before any saved user preference can be misread.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…/shim

- Delete default constructor (= delete) to prevent null-vector deref (aethersdr#1)
- Remove noexcept from processBlock overrides, buildPrefilter, buildRrcLowpass
  — allocating ops inside noexcept terminate on OOM (aethersdr#2)
- Unconditionally call lane.demod->reset() on gate-close so DPLL/AGC
  are not left stale across silence gaps (aethersdr#3)
- Add lastHdlcFrameStartSampleIndex with 10-sample dedup window to
  prevent 9x inflation of totalHdlcFrameStarts in A+ mode (aethersdr#4)
- Record demod diagnostics from lanes.size()/2 (middle slicer) instead
  of lane 0 (weakest slicer in A+ mode) (aethersdr#6)
- Fix int*int overflow in duplicateWindowSamples: cast first operand
  to quint64 before multiply (aethersdr#8)
- Extract vhfModeLayout() free function; replace two switch copies
  in configure() and ax25DemodLaneCount() (aethersdr#10)
- AfskDemodWrapper<Demod,Result> template replaces two identical structs;
  using aliases preserve LibmodemAfskDemod / DirewolfAfskDemod names (aethersdr#11)
- Delete dead try_demodulate(double, uint8_t&) overload; all callers
  use the demod_result overload (aethersdr#12)
- Add pushLP() helper for LP ring-buffer writes; replaces 4 open-coded
  stores with manual bump in try_demodulate (aethersdr#13)

Not fixed (intentional):
  aethersdr#5 — phaseOffsetSamples=0 on all A+ lanes: DPLL pull-in makes
       phase stagger redundant (kPllSearchingInertia=0.50 locks in 4-5
       symbols from any starting phase, matching Direwolf behaviour)
  aethersdr#7 — Normal polarity hard-coded in setModemProfile: pre-existing in
       main since PR aethersdr#3279; no polarity UI or AppSettings key exists
  aethersdr#9 — DC-sum normalisation in buildRrcLowpass: correct for envelope
       detector on IQ baseband; energy norm only valid for matched filter

Principle VIII.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

WSJT-X "Rig" split failed with "Invalid parameter": in chk_vfo=1 mode Hamlib
sends the TX VFO as a leading token (e.g. "set_split_freq VFOB <hz>"), but
cmdSetSplitFreq/cmdSetSplitMode/set_split_freq_mode parsed the whole arg —
toDouble("VFOB 14075000") failed and returned RPRT -1. Reproduced against the
running rigctld; the un-prefixed form already worked. Same class as the aethersdr#2/aethersdr#3
VFO-prefix gaps, missed for the split setters in the aethersdr#10 resolver pass.

Add a strip-only dropVfoPrefix() helper (these commands resolve the TX slice
themselves via findTxSlice, so they strip the token rather than resolving it),
applied to cmdSetSplitFreq, cmdSetSplitMode, and both set_split_freq_mode forms.

Tests: 5.7g exercises the three VFO-prefixed split setters. Also hardened two
flaky read-back assertions surfaced by repeated live runs (test-only, not code):
5.7e now polls for the mode to settle; 3.10 deterministically drains the async
mode-set queue (set USB + poll) instead of a "two equal reads" heuristic that
latched a transient. 5 consecutive clean runs (--ptt --cw).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…rologue (review aethersdr#8-aethersdr#10)

Test cleanup (aethersdr#9/aethersdr#10) — Section 5 had grown a hand-rolled "poll get_split_vfo
until Split==0/1 with timeout" loop copied ~8 times. Add two local helpers:
  - waitForSplit(want, timeoutMs) → returns the final Split value
  - resetSplitOff() → settle-disable + confirm off (the "known-off baseline")
and replace every duplicated poll/baseline loop (5.3, 5.9b, 5.11, 5.12, 5.13,
5.14) with them. No behavior change; rigctld_test still 183/184 (5.10b is the
known single-slice create-echo timing race, slice-count dependent). The
kDaxSettleMs=700 guard stays — it's deliberately masking the separate app-side
DAX-assign-timer UAF during the test's fast create/remove churn.

Production cleanup (aethersdr#8) — cmdSetSplitFreq and cmdSetSplitMode were copy-paste
twins of the create-on-demand contract (ensureSplitTxSlice(false) → stash if
pending → resolve TX slice → apply or RPRT -1). Factor it into applySplitParam()
so the two can't diverge (a divergence would reintroduce the aethersdr#3703 -1 symptom).
Left m_lastSplitEnable as per-branch writes: the records are intentional and the
recordExistingAsEnabled gate makes a single assignment awkward; the deeper
restructure belongs to RFC aethersdr#3715.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…dr#10)

Replace the duplicated `c.query("ZZFB"/"FB").startsWith(...)` VFO-B probe in the
split-section gates with one hasVfoB(CatClient&) helper per suite, so the gates
have a single definition and can't drift apart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…dr#10)

Replace the duplicated `c.query("ZZFB"/"FB").startsWith(...)` VFO-B probe in the
split-section gates with one hasVfoB(CatClient&) helper per suite, so the gates
have a single definition and can't drift apart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

) (#3799)

## Summary
Fixes the weekly **ASan/UBSan** job failure in
`cwx_local_keyer_drift_test` (#3740): a heap-use-after-free at `Fixture`
teardown.

This is a **test-only** lifetime bug — no production code change.

## Root cause
`Fixture` members destruct in reverse declaration order. With `keyer`
declared **before** `states`, `states` is freed **first**:

```cpp
struct Fixture {
    TestKeyer keyer;          // declared first  -> destroyed LAST
    std::vector<int> states;  // declared last   -> destroyed FIRST  (freed)
    Fixture() { keyer.setOnKeyDownChange([this](bool d){ states.push_back(d?1:0); }); }
};
```

When a test leaves the keyer **key-down** at teardown, the keyer's
destructor still fires the callback into the already-freed vector:

`~CwxLocalKeyer()` (`CwxLocalKeyer.cpp:48`) → `keyUpIfDown()` (`:235`) →
`emitKeyDown(false)` (`:229`) → installed callback →
`states.push_back(0)` **into freed memory**.

`emitKeyDown` early-returns when the requested state already matches
`m_lastEmittedKeyDown`, so only a test that ends **key-down** trips it.
`testLateTicksShortenNextWait` starts `"S"`, ticks twice, and never
drains or stops — leaving the key down — which is exactly the case the
ASan trace points at.

## Fix
Reorder the two members so `states` is declared first (destroyed last)
and outlives `keyer`. The destructor callback now writes into a live
vector. Robust against any future test that leaves the keyer keyed-down.

## Why production is unaffected
- `MainWindow` resets the keyer **before** the audio sink it calls into.
- The sidetone callback is null-guarded.

So no runtime UAF is reachable — this only broke the sanitizer job
(`priority: low`).

## Proof — agent automation bridge N/A; this is a sanitizer/unit-test
bug
The automation bridge drives the running app and can't observe a
unit-test teardown UAF, so the proof here is a direct **before → after**
ASan run. The keyer's worker thread makes the live test's
key-up/key-down state at teardown timing-dependent (hence a *weekly*
flake); to make the proof deterministic I replicated the exact
synchronous `TestKeyer(spawnWorker=false)` path and the
`testLateTicksShortenNextWait` sequence (which leaves `states` at
`size=3, cap=4` — matching the CI trace's "12 bytes inside of 16-byte
region"):

**Before (buggy `states`-freed-first order)** — reproduces the CI stack
frame-for-frame:
```
==ERROR: AddressSanitizer: heap-use-after-free ... WRITE of size 4
  #9  AetherSDR::CwxLocalKeyer::emitKeyDown(bool)  CwxLocalKeyer.cpp:229
  #10 AetherSDR::CwxLocalKeyer::keyUpIfDown()      CwxLocalKeyer.cpp:235
  #11 AetherSDR::CwxLocalKeyer::~CwxLocalKeyer()   CwxLocalKeyer.cpp:48
SUMMARY: AddressSanitizer: heap-use-after-free in std::vector<int>::emplace_back
exit=134
```

**After (fixed `states`-outlives-`keyer` order)** — clean:
```
states=3 key DOWN; teardown fires keyUpIfDown into LIVE states
OK: clean teardown
exit=0
```

**Real test, fixed, built with `-fsanitize=address`:** `54 OK, 0 FAIL`,
no ASan report, `All tests passed.`

## Related
- #3740 (this issue) — `good first issue`, `sanitizer`, `asan-ubsan`,
`CW`.

Fixes #3740

💻 Generated with Claude Code (Opus 4.8) with architecture by @jensenpat

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…eanups

Review fixes for NvidiaAfxFilter:

- Add reset() (flush the jitter accumulators, rebuild the resamplers) and call
  it from AudioEngine::resetRxChainStateForSourceSwitch alongside the other NR
  modules. The old NIM BNR cleared its buffers on stream restart / source switch
  / mute; that invariant was lost when BNR became AFX, so stale pre-gap audio
  and a resampler discontinuity bled into the next stream. (review #1)
- Audio hot-path: read m_outAccum via a cursor (compact only when the consumed
  prefix exceeds the tail) instead of an O(n) front-erase every block, and reuse
  a scratch buffer for NvAFX_Run output instead of allocating per block. (review #2)
- Use a categorized logging channel (qCWarning/qCDebug, lcNvAfx) instead of the
  bare qWarning/qDebug so AFX load failures show up in the support logs. (review #9)
- Brace single-line control flow per the C++ style guide. (review #10)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ygiene

Review fixes for NvidiaAfxPack / the BNR panel:

- Extract archives off the GUI thread via QtConcurrent (runExtract is a pure
  worker; a QFutureWatcher resumes the pipeline) so decompression no longer
  freezes the UI. (review #3)
- updateAvailable() now also flags a component the installed pack lacks
  entirely (a newly-added manifest entry, e.g. Windows TensorRT), not just
  version drift — otherwise an outdated pack reads "ready" while missing a
  required lib. Offline-imported packs are still left alone. (review #5)
- Discard staging on a version bump: if any staged component no longer matches
  the manifest, wipe staging before re-extracting so stale files can't ride
  into the committed pack. (review #4)
- cancel()/fail() close the in-flight download QFile before removing the temp
  file (an open handle blocks the remove on Windows). (review #6)
- Hash the download incrementally as bytes arrive instead of re-reading the
  whole file afterward; clearer (non-transient) checksum-mismatch message.
- Dedup the staged/installed JSON readers and writers into shared helpers;
  memoize detectArch() (nvidia-smi can't change mid-session); fetch the pack
  queries once per updateBnrStatus() instead of 3-4×. Brace single-line control
  flow per the style guide. (review #10 + cleanup)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>