Reviewed the diff against the codebase — all referenced APIs resolve cleanly (SliceModel::txAntenna()/setTxAntenna()/setRxAntenna()/txAntennaList()/rxAntennaList(), TransmitModel::showTxInWaterfall(), RadioModel::createPanadapter()/removePanadapter()/setPanCenter()/maxPanadapters()/cwxModel(), CwxModel::send()/setSpeed()/clearBuffer(), and SpectrumWidget::panIndex()/m_smoothed/estimateNoiseFloorDbm). The generic QObject::property() read keeps core decoupled from the GUI class — nice approach. CI is all green and everything is correctly behind AETHER_AUTOMATION. Two notes, one worth addressing before merge.

1. The TX-safety watchdog can't actually stop a CWX transmission (worth a look).

doCwx("send", …) arms the watchdog by setting m_txKeyedSinceMs, matching txtest/key. But when the watchdog fires, forceUnkey() only does:

tx.stopTune();
tx.setMox(false);

CWX keys the transmitter through the CW keyer buffer, not MOX or TUNE — so neither call cuts a CWX transmission in flight. A long cwx send string at low WPM can exceed m_txMaxKeyMs (default 20 s); the watchdog would log a force-unkey while the radio keeps keying until the buffer drains on its own. The PR body states cwx send "arms the force-unkey watchdog, same as txtest/key" — it arms it, but the backstop is a no-op for this keying path, which undercuts the safety claim.

Suggest making forceUnkey() also abort the keyer when a radio model is present:

void AutomationServer::forceUnkey(const char* reason)
{
    if (!m_radioModel)
        return;
    auto& tx = m_radioModel->transmitModel();
    tx.stopTune();
    tx.setMox(false);
    m_radioModel->cwxModel().clearBuffer();   // also cut a CWX transmission
    m_txKeyedSinceMs = 0;
    ...
}

(cwx stop already does clearBuffer(), so this is the same lever the manual abort uses.)

2. Minor: the doFloors() comment says the payload is "keyed by panIndex," but it builds a flat QJsonArray with panIndex as a field on each entry. Cosmetic — just align the comment with the shape.

Everything else looks good: null-guards on m_radioModel/slice resolution are in place, the antenna-list validation with an empty-list fallback is sensible, and the pan create/remove guards (limit check, refuse-last-pan) are the right shape. The two known follow-ups you documented (panafall-created pan teardown, grab pan <index>) are reasonable to defer.

Thanks for the thorough write-up and the honest bench-vs-live caveat on the companion #3831 — that kind of transparency about what the test does and doesn't prove is appreciated. Just the watchdog/CWX gap is worth closing before this lands.

_{🤖 aethersdr-agent · cost: $7.2988 · model: claude-opus-4-8}

Reviewed in depth earlier — the bridge expansion is solid: non-keying verbs (slice txant/rxant, floors, txwaterfall, pan create/remove/center) correctly ungated; txAntenna/showTxInWaterfall and the noiseFloorDbm/displayFloorDbm/panIndex Q_PROPERTYs surfaced generically via QObject::property() (no core→gui coupling); cwx send properly ALLOW_TX-gated and arming the watchdog.

Transparency note: the one TX-safety gap I found in review — forceUnkey() (the watchdog all-stop) only did stopTune()+setMox(false), which can't abort an in-flight cwx send since CWX is buffer-driven independent of MOX — I closed by pushing f51f4b0, adding cwxModel().clearBuffer() to forceUnkey. So I co-authored that one commit; the rest is @jensenpat's work. CI is green on the fixed head.

Caveat for the record: the CWX-abort is logic/build-verified but not yet on-hardware-confirmed — worth a real-radio check that a long cwx send now force-unkeys at the watchdog limit. Not a blocker. Thanks @jensenpat.