Thanks for this, @ten9876 — this is a well-constructed feature. The "honor ext_api before we ever connect" framing is genuinely thoughtful, the clean-room sourcing is clearly documented, and the code follows AetherSDR conventions nicely: PersistentDialog (AppSettings-backed geometry, not raw QSettings), RAII via Qt parent ownership, namespaced, and a real unit test that locks the parser + the three ext_api regimes. Network errors are handled at every step of the fetch and the reply lambdas are bound to this as context, so in-flight requests disconnect safely on dialog teardown. CI is fully green. A few suggestions, none blocking:

1. Hardcoded/stale User-Agent version. KiwiPublicDirectory::userAgent() returns "AetherSDR/26.6 …" but the project is at 26.6.3 (project(AetherSDR VERSION 26.6.3) in CMakeLists.txt), and it'll drift on every bump. There's already an AETHERSDR_VERSION compile definition — but note it's currently set PRIVATE only on the AetherSDR target (CMakeLists.txt:1661), so it won't be visible to the new kiwi_public_directory_test / kiwi_directory_poc targets that compile KiwiPublicDirectory.cpp directly. Suggest adding AETHERSDR_VERSION to those two targets' target_compile_definitions and using it here with a literal fallback, so the honest identity stays honest after the next release.

2. No transfer timeout on the fetch. The 3-step gate→unlock→list flow has no timeout, so if a server stalls mid-handshake the picker sits on "Loading public receivers…" indefinitely with only Cancel as an escape. A req.setTransferTimeout(...) on each QNetworkRequest (and surfacing it through failed()) would close that boundary cleanly.

3. http:// for the directory. kDirectoryUrl is plain HTTP. For a feature whose whole premise is being a good, honest network citizen, preferring https://kiwisdr.com/public/ (with HTTP fallback if needed) avoids the cleartext fetch.

4. Minor: "web-only hidden" count under-reports. In onReady, m_hiddenWebOnly only increments for ApiPolicy::Disabled. Receivers with an unpublished policy (extApi == -1 → Unknown) also fail mayConnectViaApi() and are dropped from the list, but aren't counted anywhere, so the status line's hidden total can be short. The docs say ext_api is always published so this may be rare in practice — but a small "+N unknown" in the status would keep the accounting honest.

One scope note (not a change request): this PR honors the policy at the browse layer — a user can still hand-type an ext_api=0 host into the endpoint field. The connection-time enforcement appears to live in #3678's /status preflight, so the two landing together is what makes the "never connect to a web-only receiver" guarantee complete end-to-end.

Nice work overall.

_{🤖 aethersdr-agent · cost: $3.0933 · model: claude-opus-4-8}