Thorough, well-documented batch — thanks @jensenpat. I traced every new path against the codebase and it holds up: all RadioModel/PanadapterModel APIs used by doPan exist (maxPanadapters, panadapters, createPanadapter, activePanadapter, panadapter(pid), sendCommand; panId/waterfallId), the panIndex/panId getters the new Q_PROPERTYs wrap are already present, and all required includes (QMouseEvent, QPointer, QPushButton, QToolButton, QComboBox, QMetaType) are in place. The core→gui decoupling via meta-object property() reads is clean — core/ stays GUI-include-free. CI is green across all 6 checks.

A few highlights I checked specifically:

• Token tokenizer is correct. I hand-traced aprsSvcWXBOT → ["aprs","svc","wxbot"] (the acronym-hump rule keeps WXBOT whole), so cwx no longer false-matches, and status/temperature stay single tokens that don't equal atu. moxButton/Auto-Tune still match. The fix does what it claims.
• Crash-safe deferral on close/showMenu (singleShot(0) + unconditional raise()/activateWindow() before popup) matches the macOS hazard described in #3828's findings. Good.
• Drag globals computed once from the press point — correct call for QSizeGrip, where re-mapping mid-resize would compound.

Two small things worth a note (neither blocking):

1. TX-guard narrowing is strictly more permissive than the old contains(). Whole-token anchoring is the right fix for the false positives, but it also drops fallback coverage for compound names where a deny-word is a substring of a larger token — e.g. Tuner/tuner no longer matches tune (an ATU "Tuner" button briefly keys TX), and transmitter/transmitting no longer matches transmit. Since markTxKeying() is the authoritative path this is an acceptable trade, but it does mean any keyer relying solely on a compound-name fallback now slips through unguarded. Worth a quick sanity-check that no current keying control depends on substring-only matching.

2. pan close <0x…> is format-sensitive. radio->panadapter(pid) is a direct string lookup, so if the caller's hex formatting differs from the stored id, the lookup returns null and the display panafall remove (waterfall teardown) is silently skipped — you'd get resolved:false and a half-closed pan. Index/active/all selectors avoid this since they source the id from the model; just a caveat for the explicit-id path.

Overall this is a high-quality, faithfully-verified change. Nice work.

_{🤖 aethersdr-agent · cost: $6.3968 · model: claude-opus-4-8}

Review — strong PR, one blocker (rebase needed)

Reviewed the full diff with a focus on the TX-safety guard (Principle VI). Verdict below.

⚠️ Blocker: mergeable=CONFLICTING

This now conflicts with main as a direct result of #3832 landing earlier today — both PRs edit the same verb-dispatch region of AutomationServer.cpp (and SpectrumWidget.h). #3832 added doCwx/floors/antenna+pan verbs; this PR adds close/drag/showMenu/pan add+close + grab-pan into the same dispatch, so git can't auto-merge.

Because the conflict lands squarely in the safety-critical verb dispatch + TX-guard, and you already live-verified these changes against a real radio, the safest path is you rebase onto current main and re-run the live TX-guard verification rather than have a conflict resolved blind in keying code. (Happy to do the rebase myself if you'd rather — just say the word.)

✅ TX-safety (Principle VI) — PASS

• Authoritative guard unchanged. kTxKeyingProperty (the markTxKeying() marker) is still checked first in isTransmitControl/isTransmitAction. Every marked keyer is blocked regardless of name. The change touches only the name-match fallback.
• Fallback is more precise, not weaker for real keyers. Substring contains() → whole-token match via identifierTokens() (camelCase humps + separator split) + matchesTxDenyToken() (tokens.contains(d)), kDeny = {mox, ptt, transmit, vox, cwx, atu}.
  • Genuine keyers still match: moxButton→[mox,button], pttSend→[ptt,send], ATU tuner→[atu], VOX→[vox]. ✅
  • False-positives correctly freed: status/temperature (no atu token), aprsSvcWXBOT→[aprs,svc,wxbot] (no cwx token). ✅
• Residual risk (low, acceptable): a stricter fallback would miss an unmarked keyer with a glued all-lowercase name (e.g. cwxsend). But real keyers carry the marker, the primary fail-safe is intact, and the fallback still logs a qCWarning telling the dev to add markTxKeying(). Right trade.

✅ Other changes

• Verbs (close/drag/showMenu): deferred / GUI-loop-posted with window raise+activate — handles the macOS popup re-entrancy crash class cited.
• Observability (toolTip, QComboBox items[]/currentIndex, panIndex/panId via meta-object): no core→gui include leak. Closes most of #3845 as intended.

CI is green on all 6 checks; only the merge conflict + a fresh live-verify stand between this and merge. Rebase and I'll merge.

Approved. Re-reviewed after the rebase onto current main (bb5e575a):

• Clean rebase — both #3832's verbs (cwx/floors/antenna) and this PR's (showMenu/drag/close/grab) survive the merge; none dropped or duplicated.
• TX-safety (Principle VI) PASS — kTxKeyingProperty marker checked first in isTransmitControl, then the whole-token fallback; kDeny = {mox, ptt, tune, transmit, vox, cwx, atu} covers every genuine keyer (moxButton, pttSend, Auto-Tune, VOX, ATU, cwx send) while freeing the prior false-positives (status/temperature/WXBot).
• Crash-safe verbs — close/drag/showMenu are GUI-loop-deferred with window raise+activate (handles the macOS popup re-entrancy class).
• Observability — toolTip, combo items[]/currentIndex, panIndex/panId via meta-object; no core→gui include leak.
• Builds clean on current main locally; CI green on all 6.

Closes most of #3845. Thanks @jensenpat — clean work, and the rebase resolved the conflict cleanly.