#1 (bug) — mutual exclusion: setMnrEnabled now disables all other NR modes
    before enabling MNR; every other NR setter (NR2/RN2/NR4/BNR/DFNR) now
    also calls setMnrEnabled(false) in its mutual-exclusion block.

aethersdr#2 (bug) — RADE guard: setMnrEnabled early-returns when m_radeMode is active,
    matching the pattern used by all other NR setters.

aethersdr#3 — raw pointer → std::unique_ptr<MacNRFilter>: AudioEngine.h gains a
    forward declaration (#ifdef __APPLE__) and unique_ptr member; AudioEngine.cpp
    already had the full include; new/delete replaced with make_unique/reset.
    std::atomic<float> m_mnrStrength replaces plain float.

aethersdr#5 — MacNRFilter.h: processing-chain comment corrected from
    "stereo int16 → … → stereo int16" to "stereo float32 → … → stereo float32";
    also fixes the process() doc-comment.

aethersdr#6 — MacNRFilter: m_strength changed to std::atomic<float>; setStrength/
    strength() use store/load; processFrame() reads m_strength.load().
    Allows AudioEngine to write strength from the audio thread while the
    DSP dialog reads it from the UI thread without a data race.

aethersdr#8 — strength persistence: setMnrEnabled(true) restores m_mnrStrength from
    AppSettings("MnrStrength"); setMnrStrength() now saves to AppSettings
    on every change, so the value survives restarts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…sdr#1-aethersdr#3)

From the high-effort review of the split work:

aethersdr#1 In-flight create guard is now time-bounded. The hard `if (m_pendingSplitEnable)
   return;` could wedge split "pending" forever if the create never landed for a
   reason other than local capacity (radio NAK, or Multi-Flex where local
   slices().size() < maxSlices() but the radio is really full — RadioModel has no
   sliceCreateFailed wiring here). After kPendingCreateTimeoutMs the guard clears
   the stale pending and lets the next call retry; the window still dedupes the
   rapid WSJT-X set_freq/set_mode VFOB burst.

aethersdr#2 PTT no longer seizes TX during the create window. splitActive now also covers
   m_pendingSplitEnable, so a key that arrives before the on-demand slice has
   appeared doesn't fall through to the seize and transmit on the RX VFO (VFOA).

aethersdr#3 Passive set_split_freq/set_split_mode no longer arm the reclaim edge. These now
   call ensureSplitTxSlice(recordExistingAsEnabled=false); when split is already
   engaged on a distinct slice they no longer set m_lastSplitEnable=1, so a client
   that never sent set_split_vfo 1 can't trigger a phantom 1->0 reclaim that steals
   TX off a slice it didn't put into split. Enable-intent callers (set_split_vfo 1,
   set_freq/set_mode VFOB) keep the default true.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- aethersdr#1: split teardown on disconnect undoes a split ONLY if WE engaged it (new
  m_weEngagedSplit) — no longer stomps an operator's/another client's split that
  this client merely adopted via FT1/ZZSW1.
- aethersdr#2: cmdOI returns "?;" with no VFO B instead of falling back to VFO A,
  consistent with FB/ZZME (aethersdr#3633).
- aethersdr#4/aethersdr#8: FT/ZZSW/ZZFT share one splitCommand() helper; a malformed arg returns
  "?;" rather than silently disabling split (was: any non-"1" arg → disable).
- aethersdr#5: clear the m_rxVfoB RX-VFO selector on split teardown.
- aethersdr#7: reported split state is derived from the model (splitActive(): a non-RX
  slice is TX) instead of a stored m_splitEnabled flag that could drift when split
  is changed via the GUI / rigctld / another CAT client.
- aethersdr#9: drop the stale "…else XIT" remnant from the split-mechanism comment.
- aethersdr#3: document that the FR selector (m_rxVfoB) intentionally does not swap VFOs
  (SmartSDR-Mac parity) — echo-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- aethersdr#1: split teardown on disconnect undoes a split ONLY if WE engaged it (new
  m_weEngagedSplit) — no longer stomps an operator's/another client's split that
  this client merely adopted via FT1/ZZSW1.
- aethersdr#2: cmdOI returns "?;" with no VFO B instead of falling back to VFO A,
  consistent with FB/ZZME (aethersdr#3633).
- aethersdr#4/aethersdr#8: FT/ZZSW/ZZFT share one splitCommand() helper; a malformed arg returns
  "?;" rather than silently disabling split (was: any non-"1" arg → disable).
- aethersdr#5: clear the m_rxVfoB RX-VFO selector on split teardown.
- aethersdr#7: reported split state is derived from the model (splitActive(): a non-RX
  slice is TX) instead of a stored m_splitEnabled flag that could drift when split
  is changed via the GUI / rigctld / another CAT client.
- aethersdr#9: drop the stale "…else XIT" remnant from the split-mechanism comment.
- aethersdr#3: document that the FR selector (m_rxVfoB) intentionally does not swap VFOs
  (SmartSDR-Mac parity) — echo-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… factory-loader v2 (aethersdr#3199)

Four targeted fixes to the Theme Editor surface picking up the Tier 3
"editor UX polish" bullets from
[aethersdr#3184](aethersdr#3184). Hand-tested
across both bundled themes and a forked user theme; `theme_manager_test`
gains coverage for the per-applet cascade and the new v2-aware factory
snapshot.

## 1. Filter persistence across scope changes

`refreshTokenList()` rebuilds the token tree from scratch but never
re-applied the current text/inspector subset filter — so switching the
scope dropdown (or any path that triggers a refresh) caused the filter
to silently fall back to "show everything" while the `QLineEdit` kept
the text it was apparently filtering by.

One-line fix: call `filterTokensTo(m_activeSubset)` at the end of
`refreshTokenList` so the rebuilt rows immediately honour the filter.

## 2. Theme-delete-time cleanup of recent-color buckets

Per-theme recent-color grids persist under the `AppSettings` key
`ThemeEditor.RecentColors/<theme name>`. Deleting the theme file used to
leave those entries behind forever — a small but real leak called out in
aethersdr#3184.

`onDeleteThemeClicked` now removes the matching key after the theme file
deletion succeeds. `TokenEditorWidget::recentColorsKeyFor` is promoted
from private to public-static so the dialog can call the canonical key
formatter directly (no string-duplication risk).

## 3. Reset-to-default semantics at nested scopes

**At root scope** Reset still loads the bundled factory value into the
edit buffer for the user to confirm via OK — that behaviour is
preserved.

**At nested scopes** (`applet/tx`, `applet/rx`, `applet/comp`, …) the
previous behaviour was incorrect: Reset loaded the factory value into
the buffer, and OK then wrote that value as a *new* override at the
nested scope. Per aethersdr#3184 the intended semantic at a non-root scope is
"clear my override here so the scope falls back to inheriting from its
parent" — i.e. exactly what right-click → Clear Override on the
scope-chain column already does.

`onResetClicked` now branches:
- **root scope**: existing factory-load-into-buffer behaviour
- **nested scope**: calls `removeOverride()` directly, reloads the
editor's buffer + picker from the now-inherited value, emits
`tokenChanged` so the parent dialog repopulates the matching row (so the
scope column flips to italic *"inherited"* AND the Value column reflects
the now-resolved value — without that signal the Value column would stay
stale, as observed during testing).

`refreshResetButton` also branches: at root scope it enables based on
`hasFactoryValue` (existing), at nested scope it enables only when
there's actually an override at this scope to clear — mirrors the
right-click → Clear Override gating, so the button visually reflects
whether clicking it has any effect.

## 4. Factory-snapshot v2 schema awareness (uncovered during testing)

While verifying Fix aethersdr#3 at root scope, discovered that Reset there was
*also* broken — but for an unrelated reason that predates this PR.

`ThemeManager::ensureFactoryLoaded()` reads `:/themes/default-dark.json`
to build the `m_factoryTokens` map that `factoryColor` / `factoryString`
/ `factorySizing` / `hasFactoryValue` all read from. Its single
`flattenTokens` call read from `doc.object().value("tokens")` — which is
the **v1 schema** shape. In v2 (the canonical shape since
[aethersdr#3176](aethersdr#3176)) the tokens
live under `scopes.root.tokens`; the v1 path produces an empty
`m_factoryTokens` against any v2 theme.

Downstream effect: `hasFactoryValue` returns false for every token in a
v2 theme → `refreshResetButton` disables the Reset button at root scope
(or with the existing styling, leaves it visually indistinguishable from
enabled — silent failure either way) → `factoryColor` returns invalid
QColor. **Silently broken across every v2 theme since aethersdr#3176 landed in
March.**

`ensureFactoryLoaded` now branches on `schemaVersion`:
- **v2**: reads `primitives` + `scopes.root.tokens`, then resolves
`{primitive}` aliases inline before storing in `m_factoryTokens`, so
`factoryColor` sees concrete hex values without needing a second lookup
pass (matches the live runtime resolver — single-hop).
- **v1**: existing path preserved for older themes still on disk pending
auto-migration.

`theme_manager_test` gains assertions on `hasFactoryValue` +
`factoryColor` for `color.accent` (alias-resolved) and
`color.background.0` to lock this in against future schema bumps.

## Verification

Windows 11, MSVC + Ninja + Qt 6.10.3, branched from
`aethersdr/AetherSDR` main at `4ee99f78`.

| Check | Result |
|---|---|
| Filter persistence — type "accent", switch scope to `applet/tx` |
Filter stays applied (list does NOT re-expand) ✓ |
| Nested-scope Reset — forked theme, `applet/tx`,
`color.slider.foreground` (`#ff4d4d` override) → click Reset | Picker
reloaded `#ff4d4d` → `#00b4d8`, tx column flipped from override to
italic *"inherited"*, Value column updated to `#00b4d8`, Reset button
disabled ✓ |
| Root-scope Reset — same theme, `(root)`, changed `color.accent` to
magenta `#a12c66`, OK'd, then Reset | Picker flipped magenta → factory
blue `#00b4d8`, `• unsaved` indicator appeared, OK + Cancel re-enabled,
token list row still showed `#a12c66` (uncommitted buffer) ✓ |
| `theme_manager_test` — new factory-snapshot + per-applet cascade
assertions | Pass ✓ |
| `theme_manager_test` — 4 pre-existing failures
(`importThemeFromFile`-related, Windows-vs-CI env issue) | Also present
on clean `main` at the same source line numbers (398/400/451/590 there →
419/421/472/611 here, +21 from inserted test block). Not introduced by
this PR. Happy to investigate separately. |

## Out of scope (follow-ups)

- The `importThemeFromFile` test failures are not investigated here —
they predate this PR and the root-cause looks
Windows-environment-specific (`QTemporaryDir` / `XDG_CONFIG_HOME`
interaction).
- Tooltips / hint text explaining what Reset does at root vs nested
could further close the UX gap, but the enable-state gating already
gives correct feedback.

cc @ten9876 @jensenpat @chibondking

73 Nigel G0JKN

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

## Summary

- Mirror FlexLib XVTR MaxPower bounds in `XvtrPolicy` so AetherSDR
clamps before sending `xvtr set ... max_power=`.
- Add a `QDoubleValidator` to the Radio Setup XVTR Max Power field using
the active radio model and IF-frequency-dependent dBm range.
- Clamp again on submit, including after IF frequency edits that tighten
the allowed Max Power ceiling.
- Add focused `xvtr_policy_test` coverage for the FlexLib ranges: -10
dBm floor, +8 dBm high IF ceiling, +10 dBm 6400/6600 low IF ceiling, and
+15 dBm default low IF ceiling.

Refs aethersdr#3246 (fix aethersdr#3 only: XVTR Max Power clamp).

## Test Plan

- `cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo
-DCMAKE_OSX_SYSROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk`
- `cmake --build build -j22`
- `./build/xvtr_policy_test`
- Built app:
`/Users/patj/.codex/worktrees/145c/AetherSDR/build/AetherSDR.app`
- Deploy attempted with `$deploy-aethersdr-test-build`; upload reached
the remote, but replacing `/Users/patj/Desktop/AetherSDR.app` failed
repeatedly because remote `rm` returned `Operation not permitted` for
the existing app bundle contents.

👨🏼‍💻 Generated with OpenAI Codex (GPT-5.5 Pro 4/23) and tested by
@jensenpat

Co-authored-by: Codex <noreply@openai.com>

…#3414)

## Summary

- `CatPort::stop()` called `c.socket->abort()` after `delete
m_tcpServer`, which freed the sockets first (Qt parents them to the
server via `nextPendingConnection()`) — use-after-free on every shutdown
with a connected rigctld client

## Root cause

`QTcpServer::nextPendingConnection()` creates each `QTcpSocket` with the
Qt server as its parent. `delete m_tcpServer` therefore frees all client
sockets before the rigctld loop ran `abort()` on them.

## Fix

Move the rigctld client cleanup (abort + delete protocol) to before
`delete m_tcpServer`.

## Repro / evidence

Triggered reliably by closing AetherSDR via the window close button
while an external client is connected via rigctld (e.g. Direwolf PTT).
AddressSanitizer trace:

```
ERROR: AddressSanitizer: SEGV on unknown address 0x0000000bd97d
    #0  QAbstractSocket::abort()             libQt6Network.so.6
    aethersdr#1  AetherSDR::CatPort::stop()           CatPort.cpp:98
    aethersdr#2  AetherSDR::CatPort::~CatPort()       CatPort.cpp:60
    aethersdr#3  QObjectPrivate::deleteChildren()     libQt6Core.so.6
    aethersdr#4  QWidget::~QWidget()                  libQt6Widgets.so.6
    aethersdr#5  AetherSDR::MainWindow::~MainWindow() MainWindow.cpp:5490
```

## Test

- Debug build (ASAN): no SEGV on close with rigctld client connected ✓
- RelWithDebInfo build: clean exit on close ✓
- Platform: RPi5, Debian, Qt 6, rigctld client = Direwolf PTT

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…ygiene

Review fixes for NvidiaAfxPack / the BNR panel:

- Extract archives off the GUI thread via QtConcurrent (runExtract is a pure
  worker; a QFutureWatcher resumes the pipeline) so decompression no longer
  freezes the UI. (review #3)
- updateAvailable() now also flags a component the installed pack lacks
  entirely (a newly-added manifest entry, e.g. Windows TensorRT), not just
  version drift — otherwise an outdated pack reads "ready" while missing a
  required lib. Offline-imported packs are still left alone. (review #5)
- Discard staging on a version bump: if any staged component no longer matches
  the manifest, wipe staging before re-extracting so stale files can't ride
  into the committed pack. (review #4)
- cancel()/fail() close the in-flight download QFile before removing the temp
  file (an open handle blocks the remove on Windows). (review #6)
- Hash the download incrementally as bytes arrive instead of re-reading the
  whole file afterward; clearer (non-transient) checksum-mismatch message.
- Dedup the staged/installed JSON readers and writers into shared helpers;
  memoize detectArch() (nvidia-smi can't change mid-session); fetch the pack
  queries once per updateBnrStatus() instead of 3-4×. Brace single-line control
  flow per the style guide. (review #10 + cleanup)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sliceSnapshot() omitted every adaptive field, so an agent could drive the
controls via invoke but not read them back. Add the seven adaptive fields
(settings plus the live adaptiveActive AUTO state) and document them in the
get slice reference, making the feature assertable over the automation
bridge. Addresses review finding aethersdr#3 / jensenpat's request on PR aethersdr#3945.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>