Thanks for this, @nigelfenton — this is a careful, well-reasoned port. I traced the new threading model against IambicKeyer (which already does exactly this) and the key correctness points all hold up. CI is green across build/macOS/Windows/CodeQL.

What I verified

• Shutdown ordering is correct. MainWindow::~MainWindow() calls m_cwxLocalKeyer.reset() (line 1951) before the AudioEngine teardown at ~1977–1996, so the worker is joined before m_audio is freed — no key edge can fire into a dead audio object. This is the crux of the change and it's handled properly.
• Gate path is genuinely lock-free. CwSidetoneGenerator::setKeyDown is a std::atomic store (CwSidetoneGenerator.cpp:71), so calling onKeyDownChange directly from the worker thread is safe — matching the iambic keyer's gate exactly.
• Thread-safety partition is sound. m_queue is the only cross-thread state and is consistently guarded by m_mu; the schedule state (m_elements, m_running, m_epoch, m_currentlyDown) is touched only by whichever thread runs scheduleNext(). No lost-wakeup: start() enqueues under the lock and the worker re-checks the predicate under the same lock. The stale-abort-on-idle case is correctly cleared at the top of each send run.
• Test seam preserved. Retargeting the drift test to the spawnWorker=false synchronous subclass + onKeyDownChange callback keeps the #3271 coverage deterministic without a real thread, and the cumulative/late-tick assertions are unchanged. The pthread link guard for the test on UNIX is the right call.

Minor (non-blocking)

• isIdle() now reads m_elements/m_running — worker-owned state — so it would be a data race if ever called from the GUI thread. It currently has no callers, so this is benign today; worth a one-line caveat on the declaration (or routing it through m_mu) if it's ever promoted to a real public query, since the old QObject version was single-threaded and this hazard is new.
• The worker's onKeyDownChange lambda reads m_audio without synchronization, same theoretical lifetime/TOCTOU pattern as the existing iambic gate — acceptable since it mirrors the established code and the shutdown join guards the real teardown case.

Nothing here is a blocker. Clean change that matches repo conventions (RAII unique_ptr ownership, the steady_clock worker pattern from IambicKeyer). Nice work isolating this from the #3202 cumulative-drift logic and the live-mode CharGap behaviour.

_{🤖 aethersdr-agent · cost: $7.8101 · model: claude-opus-4-8}

Approving — a correct, well-executed real-time concurrency fix mirroring the proven IambicKeyer pattern.

Verified:

• Concurrency: worker parks on cv.wait(pred); each edge sleeps on an interruptible wait_until(absolute steady_clock deadline, [abort||shutdown]) — drift-corrected, no QTimer coalescing. Queue dequeued under m_mu; gate callback fires outside the lock and is lock-free (atomic setKeyDown); both waits predicated (spurious-wakeup safe).
• Lifecycle: unique_ptr ownership; reset() joins the worker before AudioEngine teardown (commented), and the gate callback null-guards m_audio/cwSidetone() regardless — no stuck tone, UAF, or shutdown hang.
• Abort/stop: clears queue + sets m_abort + notifies; worker wakes, keys up, resets to idle. Latched abort is cleared at the next send run; idle wait doesn't gate on it — no stuck state.
• Drift-correction preserved: encode() + scheduling math unchanged; the #3271 drift test retargeted to the synchronous spawnWorker=false seam still passes every assertion.

Live-validated at 20 and 40 wpm under heavy synthetic load (drops gone), clean startup/connect/shutdown. The documented faint non-speed-correlated click is plausibly an incidental under-run (keyer unchanged), with the sub-block-precision fix noted as a future follow-up. CI green across all six. Nice work @nigelfenton.