Nice, well-structured PR — thanks @jensenpat. I read the full diff (the inline preview truncates) plus the resulting MemoryDialog.cpp/RadioModel.cpp/MemoryCsvCompat.cpp on the branch. All six CI checks are green (build, macOS, Windows, CodeQL, Qt a11y), includes for QTimer/<functional> are present, and the removed onEdit/setInlineEditMode/m_inlineEditMode/m_editBtn plumbing is cleanly excised on both sides.

What I like:

• Sanitization at every boundary is the right design — centralizing it in MemoryFields::sanitizeText() and wiring it into radio-in (handleMemoryStatus), radio-out (encodeMemoryText + *ToWire), CSV-in (parseRecord) and CSV-out (recordToFields) means corruption genuinely can't enter or escape. The decodeText ordering (0x7f→space then sanitize) is correct.
• Single source of truth for the value lists / display↔wire conversion, with focused unit coverage in memory_field_values_test. Bonus that you registered the previously-unregistered memory_recall_policy_test with add_test while you were in there.
• Delegate ownership/RAII is clean (delegates parented to the dialog, validators to the combo), and the setEditorData "preserve an out-of-list value" path is a thoughtful touch for legacy modes.

A couple of minor, non-blocking observations:

1. toneModeToDisplay collapses unknown tone modes to OFF. FlexLib's FMToneMode reserves ctcss_txrx (your header notes it's "not exposed"). If a memory ever arrives from the radio with that value, populateTable will render it as OFF — a faithful-display gap rather than a crash. If you're confident the radio never emits it for memories, this is fine to leave; otherwise consider preserving the raw token the way the Mode delegate's setEditorData does. Worth a one-line confirmation.

2. offsetDirToWire/toneModeToWire return "" for unrecognized input. Not reachable today (cols 6/8 use strict, non-editable combos), but if a preserved out-of-list value were committed unchanged it'd send repeater=/tone_mode= with an empty value. Low severity given the strict delegates — just flagging the latent edge for future callers.

3. Trivial: the if (combo) guard inside the QTimer::singleShot lambda is always true (combo is captured by value and non-null); the combo context object already cancels the timer if the editor is destroyed. Harmless, ignore at will.

None of these block — the core fix and UX work look solid and well-tested. 👍

_{🤖 aethersdr-agent · cost: $6.8243 · model: claude-opus-4-8}

Approving — a genuine data-corruption fix plus well-architected ergonomics.

Verified:

• sanitizeText() correctly drops C0 controls (< 0x20, incl. NUL) + 0x7f DEL, and is wired at all four boundaries. The radio-in path orders it right: decode 0x7f→space first, then sanitize, so legit spaces survive while stray control bytes are stripped. App→radio, CSV import, and CSV export all sanitize too — corruption can't enter the model, reach the radio, or leak to a .csv.
• Display↔wire conversion is centralized + authoritative (FlexLib Slice.cs/Memory.cs), normalizing case from one place so table/commands/CSV can't drift.
• isKnownMode() logs an unrecognized CSV mode and passes it through to the radio rather than rejecting — radio stays authoritative (Principle I).
• New hardware-independent memory_field_values_test; CI green across all six. macOS column-sizing fixes solve a platform-specific problem.

The editing-model change (modal Edit → always-editable + F2/Tab) is a UX refinement the RFC gate technically names — landing it as a maintainer-driven dialog refinement. Nice work @jensenpat.