Reviewed the Quindar migration commit (the AudioOutputRouter content belongs to the stacked #3630). The factory wiring is clean and the contract handling is careful — thanks for the thorough write-up. CI is green across build/macOS/Windows/CodeQL.

One substantive issue: the Quindar ladder is gated on isFormatSupported, not walked via start()

The PR says this "mirrors the RX-speaker migration," but the consumption pattern differs in a way that matters. The RX speaker (AudioEngine.cpp:1034-1054) walks the Float rungs and tries each with a real sink->start(), falling through to the next rung on failure — which is exactly what formatLadder() is built for. Its own doc comment is explicit:

The full ordered Qt-format ladder, for backends where isFormatSupported() is unreliable and the caller must try-at-open (Windows WASAPI). … Each rung is tried with a real start(), so reliable backends and WASAPI's probe-at-open are handled identically.

The new Quindar code instead does:

for (const QAudioFormat& cand : ladder) {
    if (cand.sampleFormat() != QAudioFormat::Float) continue;
    if (dev.isFormatSupported(cand)) { fmt = cand; haveFormat = true; break; }
}
if (!haveFormat) { /* log + return false */ }

i.e. it picks the first isFormatSupported-true rung and then opens it once. Two consequences:

1. Windows/WASAPI regression risk. isFormatSupported is documented-unreliable there — bypassing it is the whole reason formatLadder exists. If it returns false for every Float rung, Quindar now bails with return false without ever attempting an open, where the old code at least tried preferredFormat via start(). So on a WASAPI box this can turn "plays" into "silently never starts." (Windows wasn't part of the test matrix per the description, so this wouldn't have surfaced.)
2. No open-time fallback. Even on reliable backends, if the chosen rung's start() fails there's no fall-through to the next rung — undercutting the "graceful fallback ladder" this PR is meant to add.

Suggested fix is to mirror RX literally: drop the isFormatSupported gate and walk the ladder constructing+start()ing each Float rung, keeping the first that yields a non-null QIODevice, and only emit the open-failure summary if all rungs fail. That also lets you delete the separate isFormatSupported check and fold the existing start()-failure logging into the loop.

Smaller notes (non-blocking)

• formatLadder always emits channels = 2 (AudioFormatNegotiator.cpp:96), so the hardcoded stereo write in onTimerTick (frameBytes = 2 * sizeof(float)) stays consistent — good. Worth a one-line comment noting the sink relies on the ladder being stereo, since a future ladder change to honor mono devices would silently corrupt the interleaving here.
• Diagnostics/summary logging and the RegenerateAtRate retune contract look correctly preserved.

Everything else (the router registry, QPointer guard, snapshot-during-fan-out, MainWindow seed-then-register ordering) reads cleanly. The only thing I'd want addressed before merge is the ladder-walk vs. isFormatSupported gating above.

_{🤖 aethersdr-agent · cost: $6.0724 · model: claude-opus-4-8}

Approving — clean, well-scoped migration (and now rebased to just the Quindar commit).

QuindarLocalSink moves from "48 kHz Float or device-preferredFormat, no real ladder" to walking the shared AudioDeviceNegotiator Float rungs — gaining the per-OS preferred rate + 44.1 kHz + preferredFormat fallbacks. Fixes a real bug: a 44.1k-only output previously failed outright. Correctly skips Int16 rungs (Float-generated tone), fails honestly with a structured OpenFailureSummary when no Float rung is supported, and m_actualRate drives the (unchanged) RegenerateAtRate generator + buffer sizing. Phase-6 scoping is sound (CW sidetone QAudio is fallback-only/48k; Pudu+QSO are Int16-native pending an Int16-first negotiator enabler).

CI green across all six; builds clean on current main. Nice work @jensenpat.