…rsdr#3703)

5.12 — implicit split enable via set_freq VFOB must record the enable so
a later set_split_vfo 0 reclaims TX (regression for aethersdr#3703 bug a).
5.13 — conditional guard test: on a single-slice-capacity port, set_split_vfo 1
must fail cleanly (get_split_freq RPRT -1) rather than arm a phantom create
(aethersdr#3703 bug b); skips when the radio has slice capacity.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…emand)

Four cohesive fixes to the on-demand split path, all in RigctlProtocol, found via
WSJT-X "Rig" split integration testing:

1. Create the TX slice at the RX frequency (addSliceOnPan) instead of addSlice()'s
   default geometry (pan-center + 20% BW), so the split slice is born
   on-frequency — WSJT-X sends set_split_freq AFTER the slice is created.
2. Guard ensureSplitTxSlice() against an already-in-flight create
   (m_pendingSplitEnable) so back-to-back set_freq/set_mode VFOB don't create
   duplicate TX slices, and the stashed split freq/mode isn't dropped by the
   promote-existing path.
3. Don't seize TX onto the bound (RX) slice on PTT while split is active, so the
   radio transmits on the split slice (VFOB), not VFOA.
4. set_split_freq / set_split_mode establish the TX slice on demand (like
   set_freq/set_mode VFOB), so a direct or race-timed call resolves instead of
   returning RPRT -1 and aborting the transmit.

Manually verified on-air with WSJT-X: TX lands on VFOB at the WSJT-X-set
frequency, following VFOB retunes. These extend the create-on-demand path the
aethersdr#3703 triage flagged (aethersdr#1/aethersdr#2); the broader consolidation remains RFC aethersdr#3715.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…inter guard)

Follow-on to the create-on-demand split fixes, found via WSJT-X integration
testing:

- Best-effort removal of the TX slice we created on demand: track its id in
  tryPromoteTxSlice (only reached after our own create, so never an operator
  slice), and remove it on a genuine split→non-split transition (set_split_vfo 0)
  and in a new ~RigctlProtocol() destructor (hard disconnect, e.g. WSJT-X quit).
  Re-resolved by id at removal time and skipped if already gone; m_model is the
  invoke context so a destroyed model cancels the queued call. Operator-promoted
  slices are never removed.
- QPointer-guard m_pendingTxSlice: if the user closes the split TX slice
  out-of-band, the raw pointer dangled and findTxSlice() handed it back, crashing
  on deref (UAF). QPointer auto-nulls so findTxSlice() returns nullptr and split
  re-establishes on demand. rigctld runs on the GUI thread (same as SliceModel),
  so the guard is safe; it was the only long-lived stored slice pointer in the
  class.

Robust create-ack-id ownership (eliminating the small mis-target window when a
slice is opened during the create) is deferred to RFC aethersdr#3715.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…rdowns

5.14 — set_split_freq / set_split_mode from a split-off state must establish
split on demand (RPRT 0, not -1) and engage split, so a direct or race-timed call
(WSJT-X "Rig" split via Hamlib set_split_freq_mode) doesn't abort the transmit.

disableSplitSettled() helper (kDaxSettleMs=700) — settle before every on-demand
split teardown in Section 5. Closing a just-created TX slice can fire a deferred
DAX-channel-assign timer on the freed slice and crash ASDR; only this test churns
create/remove that fast, so the settle lets the timer fire on the live slice. The
underlying app-side DAX-assign UAF is tracked separately (out of scope here).

Run: rigctld_test --port 4532 → Section 5 incl. 5.14 passes (5.13 skips when the
radio has slice capacity). aethersdr#3703.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…sdr#1-aethersdr#3)

From the high-effort review of the split work:

aethersdr#1 In-flight create guard is now time-bounded. The hard `if (m_pendingSplitEnable)
   return;` could wedge split "pending" forever if the create never landed for a
   reason other than local capacity (radio NAK, or Multi-Flex where local
   slices().size() < maxSlices() but the radio is really full — RadioModel has no
   sliceCreateFailed wiring here). After kPendingCreateTimeoutMs the guard clears
   the stale pending and lets the next call retry; the window still dedupes the
   rapid WSJT-X set_freq/set_mode VFOB burst.

aethersdr#2 PTT no longer seizes TX during the create window. splitActive now also covers
   m_pendingSplitEnable, so a key that arrives before the on-demand slice has
   appeared doesn't fall through to the seize and transmit on the RX VFO (VFOA).

aethersdr#3 Passive set_split_freq/set_split_mode no longer arm the reclaim edge. These now
   call ensureSplitTxSlice(recordExistingAsEnabled=false); when split is already
   engaged on a distinct slice they no longer set m_lastSplitEnable=1, so a client
   that never sent set_split_vfo 1 can't trigger a phantom 1->0 reclaim that steals
   TX off a slice it didn't put into split. Enable-intent callers (set_split_vfo 1,
   set_freq/set_mode VFOB) keep the default true.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…rologue (review aethersdr#8-aethersdr#10)

Test cleanup (aethersdr#9/aethersdr#10) — Section 5 had grown a hand-rolled "poll get_split_vfo
until Split==0/1 with timeout" loop copied ~8 times. Add two local helpers:
  - waitForSplit(want, timeoutMs) → returns the final Split value
  - resetSplitOff() → settle-disable + confirm off (the "known-off baseline")
and replace every duplicated poll/baseline loop (5.3, 5.9b, 5.11, 5.12, 5.13,
5.14) with them. No behavior change; rigctld_test still 183/184 (5.10b is the
known single-slice create-echo timing race, slice-count dependent). The
kDaxSettleMs=700 guard stays — it's deliberately masking the separate app-side
DAX-assign-timer UAF during the test's fast create/remove churn.

Production cleanup (aethersdr#8) — cmdSetSplitFreq and cmdSetSplitMode were copy-paste
twins of the create-on-demand contract (ensureSplitTxSlice(false) → stash if
pending → resolve TX slice → apply or RPRT -1). Factor it into applySplitParam()
so the two can't diverge (a divergence would reintroduce the aethersdr#3703 -1 symptom).
Left m_lastSplitEnable as per-branch writes: the records are intentional and the
recordExistingAsEnabled gate makes a single assignment awkward; the deeper
restructure belongs to RFC aethersdr#3715.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>