…sets

Spec-driven improvements to the adaptive RX filter (RFC aethersdr#3878), plus operator
presets and an on-air over-cut fix.

Measurement core (new SliceModel-free TU src/core/OccupiedRegion.{h,cpp},
split out so it is unit-testable against Qt6::Core alone):
- Per-frequency noise-floor curve (sliding low percentile, clamped to only rise
  above the global scalar) so a tilted floor no longer runs the high-cut out
  into noise; presence gate stays on the robust global scalar.
- In-band reference (median of the confirmed-core bins, not the peak) feeds a
  reference-relative splatter cap that excludes slowly-decaying tails.
- Splatter cap is GATED: it engages only when the floor crossing runs past the
  plausible voice band, so normal voice that rolls off gradually to the floor is
  no longer chopped (fixes a ~3 kHz signal being cut to ~1.8 kHz on air).
- Sharp-edge precision: snap to a steep transition when a clear cliff exists.
- Rebound "separate stronger station" test compares the resume plateau to the
  in-band reference (robust to envelope blur); peak anchored to the carrier core
  so a louder neighbour can't hijack it.

Engine (AdaptiveFilterEngine):
- Faster attack, slow release: first fit out of idle commits on a short engage
  dwell; widening quicker than narrowing; fade/gap hold unchanged.

Operator presets (SliceModel + VfoWidget, persisted; shown only when enabled):
- Minimum SNR (Sensitive/Normal/Strong) -> presence gate.
- Response speed (Fast/Normal/Slow) -> dwell/settle timing.
- Splatter rejection (Tight/Normal/Wide) -> outer-edge cap.

UI: idle status ball is now neutral gray (color.text.disabled) instead of red —
idle is a normal waiting state, green still marks an active AUTO fit.

Tests: new tests/adaptive_filter_test.cpp — 10 scenarios x USB/LSB (clean, het,
QSB gap, splatter tail, stronger neighbour, soft roll-off, weak-signal gate,
tilted floor, reference-is-median, and the declining-voice over-cut regression).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

During TX the panadapter shows the transmit signal (or muted RX), so fitting
against it would chase garbage. Gate the per-frame driver on
RadioModel::isRadioTransmitting() and return early — this holds the current
passband and all per-slice engine state untouched, so the fit resumes cleanly
on unkey instead of re-fitting from scratch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Extract the Adaptive-RX-filter control group (enable checkbox + Min low-cut,
Max high-cut, Min SNR, Response, Splatter) out of VfoWidget into a reusable
AdaptiveFilterControls widget bound to a SliceModel, and embed it in both the
VFO flag and the RX Controls applet (RxApplet). Both instances bind to the same
slice, so editing one updates the other live via the model's *Changed signals;
QSignalBlocker on the programmatic sync keeps only the touched widget saving.

- AdaptiveFilterControls owns build + bidirectional binding + show/hide + the
  static load/save prefs (JSON schema, moved from VfoWidget, single source).
  withHeader/compact ctor flags fit each host; rows are label + stretched combo
  (no fixed width) so they flex to the host column. Compact shrinks fonts to
  11px and caps combo height at 22px to match the applet's dense rows.
- VfoWidget: replace the inline impl with one embedded instance; keep the
  flag-specific AUTO-badge wiring; load via AdaptiveFilterControls::loadPrefs.
- RxApplet: SSB-only instance placed as a full-width row BELOW the two columns
  so it doesn't unbalance column heights (which had pushed RIT/XIT to the
  bottom); bound in connectSlice, detached in disconnectSlice, shown for
  USB/LSB by updateModeSettings.

No SliceModel/engine/AppletPanel changes — the engine reads the slice getters
each frame, so edits from either surface take effect immediately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Refine the RX-applet placement of the adaptive controls so they read like the
rest of the applet without disturbing it.

- AdaptiveFilterControls gains a Section flag (SecCheckbox / SecBounds /
  SecPresets / SecAll) so one widget can render any subset of the group. The
  VFO flag uses SecAll; the applet splits the group into two instances bound to
  the same slice (live sync via the model).
- In the applet the group is now a SELF-CONTAINED 2-column block placed BELOW
  the main columns (full-width divider + left: enable checkbox + Lo/Hi cut,
  right: SNR/Speed/Splatter at 40/60). Keeping it out of the left/right columns
  means toggling it no longer restretches the filter passband (expanding size
  policy) above it, and rit/xit stay anchored under AGC (their stretch is back
  in its original spot).
- Condense the labels (Min low-cut -> Lo cut, Max high-cut -> Hi cut, Min SNR ->
  SNR, Response -> Speed, Splatter -> Splat) with the full name as tooltip +
  accessible name, and let the compact combos shrink
  (AdjustToMinimumContentsLengthWithIcon) so the rows never force the 2-column
  split wider.
- Compact preset matches the applet's dense rows: 11px label/combo font and
  20px combo height (like the mode/SQL controls).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add a twoColumn mode to AdaptiveFilterControls (checkbox + filter bounds left,
behaviour presets right) and use it in both hosts:

- VFO flag now uses the compact two-column arrangement (was a roomier single
  column), matching the applet's look and size.
- RX applet consolidates its previous manual two-instance block down to a single
  two-column widget — same result, less code (drops m_adaptivePresets and the
  hand-built block/separator).
- Small 6px bottom margin on the group so it isn't flush against the flag edge
  (matches the S-meter/SmartMTR menu); harmless in the applet (stretch below).

Known issue: the two-column layout can overflow the narrow VFO flag; placement
there still needs tuning (tighter columns or a single-column fallback).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Flag: give the VFO flag's root layout a 4px bottom margin (was 0). Every open
  tab/menu (Sound, DSP, Mode, X/RIT, DAX, and the adaptive section) sat flush
  against the flag's bottom edge, so with the 1px-inset rounded background the
  last row spilled a few px outside the painted shape. One global fix covers all
  menus.
- AdaptiveFilterControls: condense the labels (Lo cut / Hi cut / SNR / Speed /
  Splat) with the full name as tooltip + accessible name, and let the compact
  combos shrink (AdjustToMinimumContentsLengthWithIcon) so the two-column rows
  stay inside the host column. Wrap the two sub-columns in a real widget so the
  group's height propagates reliably. Drop the widget's own bottom margin now
  that the flag's root margin provides the spacing (the applet has a stretch
  below it).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The enable checkbox was shorter than a combo row, so the left column started ~2px
short and the offset cascaded, misaligning Lo cut/Hi cut against Speed/Splat.
Give the checkbox the combo row height (setMinimumHeight, compact mode) so both
columns are three equal-height rows and align row-for-row in the flag and applet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The per-offset temporal average (avgEnv) survived a dropout and kept EMA-tracking
the noise floor, so when a signal returned after a long silence the average had to
climb back up over ~1 s — the fit re-engaged slowly and narrow. A fresh tune does
not have this because clearFit() wipes avgEnv.

Clear avgEnv each frame while idle (active false, reverted to baseline) so a
returning signal is captured at full width on its first frame, like right after a
tune. active stays true through brief speech pauses (HOLD), so pause-riding is
untouched; the presence gate + confidence integrator still guard against engaging
on noise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

A signal whose energy peaks well above the carrier had its dominant high hump
cut off — the peak search and in-band reference were anchored near the carrier,
so the strong hump read far above that reference and the rebound treated it as a
separate/louder station.

Anchor both the peak and the reference to the "connected run" — the contiguous
energy from the carrier that never returns to the noise floor — instead of a
fixed near-carrier window:
- peak lands on the dominant hump wherever it sits, so the energy up to it is
  bridged and the hump is captured;
- reference is a high (75th) percentile of the run, so it tracks the signal's
  real level under a treble hump while staying robust to a lone transient het;
- the separate-station rebound cut now fires only across a real floor-reaching
  disconnection (kFloorDiscHz), never a relative dip, so one tilted signal is
  not split.

New treble-dominant test reproduces the on-air case (high hump captured); the
existing neighbour/gap/splatter/transient cases still pass (no regression).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…leInterface

The adaptive-filter markers (edge triangles, cut-frequency labels, AUTO
status ball) are data-bearing custom-painted content. Add the
docs/a11y.md-required TODO(a11y) marker linking the follow-up (aethersdr#3957).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sliceSnapshot() omitted every adaptive field, so an agent could drive the
controls via invoke but not read them back. Add the seven adaptive fields
(settings plus the live adaptiveActive AUTO state) and document them in the
get slice reference, making the feature assertable over the automation
bridge. Addresses review finding aethersdr#3 / jensenpat's request on PR aethersdr#3945.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…lope)

On a wide (~3 kHz) SSB signal the measured high edge jittered ~1800<->3100 Hz
frame to frame: SSB voice only fills its upper 1.5-3 kHz intermittently, and
the symmetric slow envelope average let the upper band sag below the occupied
gate in every word gap, collapsing the edge to the low formants and snapping
it back when speech resumed.

Replace the symmetric per-offset EMA with a video peak-hold: fast attack
(0.30, ~0.1 s) so the edge extends the instant the signal reaches out, slow
bounded release (0.03, ~1.1 s) so a gap or between-sibilant lull does not
collapse it. The high edge now reflects the SUSTAINED occupied width; release
stays short enough that a genuine narrowing still resolves in ~1-2 s.

New regression test (intermittent upper voice) holds the edge at 2885 Hz
across a ~0.7 s upper-band gap; the old symmetric average collapsed it to
1225 Hz. 24/24 assertions pass. DSP feel still expects on-air sign-off.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ent)

The per-frequency floor curve called percentileOfWindow — a QVector heap
copy + nth_element over a ±2500 Hz window — once per scan offset, i.e.
O(span × window) per frame per slice on the GUI thread. Both factors grow
as 1/hzPerBin, so the cost was QUADRATIC in zoom: at a 12 kHz span on a
4096-bin Retina pan it reached ~3.8M float copies + ~2200 heap allocs per
frame (the 'waterfall chokes when zoomed' regression, introduced with the
floor curve in 69ef02d and doubled by the 60 fps pan ceiling from main).

The window slides by exactly one bin per offset, so a 256-bucket dB
histogram (one remove + one add per step, running percentile by bucket
walk) produces the same low percentile in O(buckets) with zero heap
traffic. Bucket rounding is ≤0.24 dB — absorbed by the existing
[scalar, scalar+10] clamp and far below the 3/5 dB gates.

All 12 measurement tests pass unchanged (both sidebands).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hzPerBin = span/xpixels shrinks without bound as the pan zooms in
(xpixels tracks widget width, not span), so every measurement loop grew
linearly with zoom on top of the floor curve's window. Everything
downstream of the measurement is far coarser (50 Hz snap, 150 Hz margin,
220 Hz deadband), so sub-25 Hz bins buy no edge accuracy.

Below 25 Hz/bin the input is now decimated — mean in dB of D consecutive
bins (max would inflate averaged noise ~5 dB and risk false-engage at
Sensitive; stride subsampling makes narrow hets jitter the edges) — and
measured on the effective 25-50 Hz grid: the whole measurement is O(1)
in zoom (scan <= ~261 bins). Pans at or coarser than the cap take the
D=1 path, bit-identical to before (the canonical test grid included).

Tests: buildSpectrum generalized to buildSpectrumAt(N, bw, ...); new
fine-grid group (8192 bins / 50 kHz -> D=5) replays the clean-sharp,
soft-rolloff and declining-voice shapes and asserts the fit matches the
coarse grid within ±150 Hz / 2 dB. All pass both sidebands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The connected-run scan broke at the first >=250 Hz floor gap ANYWHERE, so
peak, reference and the presence gate all anchored to the bass-only lobe
of a two-hump (smiley-EQ / tilted) signal. Consequences, each reproduced:
the rebound test amputated treble humps >8 dB above the bass reference;
a strong treble-dominant signal whose weak bass lobe alone missed the
presence preset was rejected outright (baseline lurches at the fade
rate); the 600 Hz silence-stop truncated wide low-SNR mid scoops with
AUTO showing a confident (wrong) 1800 Hz fit. Three inconsistent gap
standards coexisted (250 Hz first pass / one-bin gapHitFloor / 600 Hz
silence) and the bin conversions int-truncated (250 -> 195 Hz at
~98 Hz/bin, one bin past 125 Hz/bin).

Now ONE extent pass decides how far the signal reaches, then an anchor
pass computes peak/presence/reference over the FULL kept extent, then
the cap pass runs against that final reference:

* Disconnections arm on the RAW work-grid bins, Hz-accumulated (no
  truncation), tracked for every bin — the raw valley starts under the
  envelope smear shoulder, and measuring it on the envelope re-shrank a
  real 400 Hz valley to 195 Hz.
* A resume across an armed gap compares its plateau to
  max(pre-gap level, reference-so-far) + kReboundDb — what the comment
  always claimed. Stronger lobe past a CONFIDENT run: cut (neighbour).
  Past an UNCONFIDENT run: RE-ANCHOR into the tuned signal's dominant
  hump, if it starts by kReanchorMaxStartHz (2 kHz) — energy first
  appearing beyond that above a silent low band is an adjacent station.
* The silence-stop only ends a CONFIDENT run; an unconfident run keeps
  scanning (bounded by kScanHz) so a wide at-floor scoop no longer hides
  the dominant hump behind it.

All 12 original scenarios keep passing (both sidebands), plus a new
two-hump matrix: sub-standard valley bridged, +6 dB resume bridged,
+12 dB lobe past a confident run cut, weak-bass smiley re-anchored, wide
scoop looked past, distant lobe rejected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

On a soft skirt the floor-relative crossing is a property of the SNR, not
of the TX signal: on S dB/kHz it moves ~1000/S Hz per dB of level change,
so the measured width breathed with QSB and weak stations were stably
fitted too narrow. ITU-R SM.443 defines SSB voice's 99% occupied
bandwidth as ~26 dB below the peak — a level-invariant criterion.

Inside the splatter guard the edge is now additionally capped at the
outermost occupied bin within (splatterDownDb + 5) dB of the in-band
reference — the SAME rule family as the splatter cap at a deeper depth
(Tight 23 / Normal 30 / Wide 40), so the operator's preset scales both
regimes and the past-guard splatter depth is always the tighter where
both apply. The +5 over ITU's 26 covers the reference sitting under the
peak plus envelope smear (a bare 26 re-chopped the declining-voice shape
the splatter guard exists to protect). The cap engages only with real
headroom (reference >= depth + 5 dB over the scalar floor): weak signals
stay on the floor crossing and are handled by the engine's widen-only
low-SNR rule (next commit). The floor+5 crossing remains the absolute
outer bound by construction.

OccupiedRegion now exports floorDbm (the scalar floor actually used,
supplied or fallback) so the engine can key low-SNR behaviour on
peakDbm - floorDbm.

Tests: level sweep (same soft-skirt shape at -60/-70/-80 dBm) shows a
0 Hz high-cut spread — was ~333 Hz per 10 dB; FCC 47 CFR 2.1049 two-tone
vectors (400/1800, 500/2100, 500/2400) land just past the upper tone;
floorDbm passthrough + fallback covered. All prior scenarios unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Three engine rules protecting the NARROWING direction, sharing the one
commit chokepoint (measurement, dwell and widening stay live throughout):

* Widen-only at low SNR: below kLowSnrNarrowFreezeDb (16 dB peak over
  the measurement's floor — above the strongest presence preset, so
  every preset has a widen-only band just over engagement) a narrower
  reading is an SNR artifact of the floor-relative crossing (the
  level-invariant cap has no headroom down there): narrowing commits are
  suppressed, so a weak DX station never gets pinched below the
  operator's baseline or its running fit.

* Fade freeze: while the in-band reference is falling (median of the
  first vs last kFadeEndFrames over a ~0.7 s trail drops by more than
  kFadeDropDb) the measured width is shrinking with the fade, not with
  the TX filter — narrowing holds until the level stabilises. Dwell
  keeps accumulating, so a genuine width change commits the moment the
  freeze lifts.

* Re-engage restore: a deep fade decays confidence, reverts to baseline,
  and the fresh engage fit was built from the first weak frames — narrow.
  The fit is now remembered at the dropout and restored verbatim when the
  same frequency re-engages within 20 s (an HF QSB cycle); the pipeline
  refines from there. Memory is invalidated by tune (frequency check),
  mode change (signed convention flips), and slice reset.

No engine unit test: the engine is QObject-coupled to SliceModel (whose
setters send wire commands); the measurement-layer inputs these rules key
on (floorDbm, peakDbm, referenceDbm) are covered by the measurement
tests, and the behaviours are on the on-air checklist.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The extent pass's raw-bin disconnection arming indexed binsDbm[binAt(o)]
directly; binAt(o) is unclamped and the scan runs the full kScanHz, so a
slice tuned within 6.5 kHz of the pan edge (with signal energy present)
walked past the last bin — QList assert abort in debug, OOB read in
release. Every other consumer of binAt() goes through env(), which
clamps; the raw access now clamps the same way (edge bin repeats).

Regression test: voice hump painted relative to a carrier 2 kHz inside
the pan edge, both sidebands, canonical and decimated grids — SIGABRT
before the fix, valid clipped fit after.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Two processFrame blockers from the aethersdr#3945 review:

1. The per-frame emittedNs timestamp is stamped only when perf-telemetry
   logging is on (it doubles as a telemetry gate in PanadapterStream and
   MainWindow_Session), so in production it arrives as 0 and every wall-clock
   guard here — the ~30 fps frame pacing, the <=8 filt/s send cap (RFC aethersdr#3878
   cond. 2), and the re-engage-restore memory — was silently inert. At the
   60 fps pan ceiling the send throttle fell back to the 4-frame counter alone
   (~15 filt/s per slice). Substitute a monotonic QElapsedTimer when
   emittedNs <= 0, so the gates hold regardless of telemetry state. Fixed in
   the engine rather than stamping unconditionally upstream, which would flip
   the emittedNs>0 telemetry-latency gates in MainWindow_Session on when
   telemetry is off. (jensenpat blocker 1)

2. The top guard dropped per-slice state on disable without sending anything,
   so unchecking the feature stranded the passband at the last auto-narrowed
   width — contradicting SliceModel::setAdaptiveFilterEnabled's own contract
   that 'the engine restores the operator's selected filter separately.' Before
   resetSlice(), if the operator disabled it on an SSB slice and the engine had
   narrowed off the frozen baseline, re-apply baseLow/baseHigh via
   applyAdaptiveFilter (no user-epoch bump); gated on ssb so a mode change,
   which already resets the filter, isn't fought.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

loadPrefs unconditionally called setAdaptiveFilterEnabled(false) to enforce the
session-scoped 'starts disabled' rule, but it runs on every re-bind — and a pan
migration destroys and rebuilds the host VfoWidget (re-running setSlice) — so
dragging a slice to another panadapter silently switched the feature off.

Force-disable only on the first load of a slice this session, via a set shared
across both host controls (VFO flag + RX applet); re-binds preserve the
operator's current enable state. (jensenpat blocker 2)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The controls lived in two widgets (VFO flag + RX applet), which meant keeping
the enable/bounds/preset state in sync across both instances. Remove the RX
applet copy so there is a single UI host backed by the one model source of
truth (SliceModel); the applet keeps its read-only filter-width readout, which
still shows "AUTO" while a live fit is applied (refreshFilterWidth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>