## What was broken

PR #3990 added QRZ callsign lookup, but the login path was broken
end-to-end — verified by testing against a real QRZ.com account.

### 1. Every QRZ XML response failed to parse (`src/core/QrzClient.cpp`)

`QrzClient::parseXml()` walks `QXmlStreamReader` tokens, special-casing
`<Session>` and `<Callsign>` start tags. Every other start tag falls
through to `r.readElementText(QXmlStreamReader::SkipChildElements)`.

The problem: every QRZ response is wrapped in a root `<QRZDatabase>`
element. That root tag is the *first* `StartElement` the loop sees, and
it doesn't match `"Session"` or `"Callsign"` — so the loop calls
`readElementText(SkipChildElements)` on the **root itself**. Per Qt's
docs that reads "until the corresponding `EndElement`", i.e. it consumes
and discards the entire rest of the document (including the nested
`<Session><Key>…</Key></Session>` block) before the loop ever gets a
chance to inspect it.

Net effect: `sessionKey`/`sessionError`/`info` come back empty for
*every* login and lookup response, valid credentials or not, so every
login attempt reported `"QRZ login rejected (no session key)"`.

Fix: skip start tags encountered before entering a recognized block
instead of feeding them to `readElementText`, so the root wrapper is
passed over rather than consumed.

Note: `tests/qrz_callsign_test.cpp` (added in #3990) covers callsign
regex/spotter logic but never exercises `parseXml()` against a realistic
root-wrapped response, which is how this shipped.

### 2. Windows source builds silently compiled out credential
persistence, and even with it enabled, the app couldn't find the DLL

Found while confirming fix #1 on a real Windows 11 build:

- The README's "Windows 11" build steps never run
`scripts/setup/setup-qtkeychain.ps1`, so `find_package(Qt6Keychain)`
fails silently (`REQUIRE_KEYCHAIN` defaults `OFF`), `HAVE_KEYCHAIN`
never gets defined, and the QRZ password is never saved —
`CallsignLookupService::savePassword()`/`loadPasswordFromKeychain()`
become no-ops. The Setup dialog's "Test Login" button still worked
because it bypasses the keychain and tests raw typed credentials
directly, which masked the gap: real lookups (`View → Callsign Lookup`)
always got `AuthFailed` (empty password) and silently fell back to
offline `cty.dat` prefix data, appearing as "QRZ.com unavailable".
- After staging qtkeychain and confirming `Qt6Keychain found` in the
CMake configure log, running straight from the build directory still
failed with "qt6keychain.dll was not found" — `windeployqt` (which the
Windows installer CI job manually feeds the DLL through, see
`.github/workflows/windows-installer.yml`) isn't part of a plain local
build, so nothing put the DLL next to the exe.

Fix: add the `setup-qtkeychain.ps1` step to the README's Windows
instructions, and add a `WIN32`-guarded `POST_BUILD` step in
`CMakeLists.txt` that copies `qt6keychain.dll` next to the built exe
when present, so a local dev build gets working persistence without a
manual copy.

## Test plan

- [x] Built on Windows 11 (MSVC 2022, Qt 6.8.3) with qtkeychain staged
via `setup-qtkeychain.ps1`
- [x] Radio Setup → QRZ tab → Test Login succeeds with a real QRZ.com
account (previously always failed with "no session key")
- [x] Password persists across closing/reopening the Setup dialog
(previously lost every time — confirmed root cause was the missing
keychain DLL/build step, not app logic)
- [x] View → Callsign Lookup → enter callsign → Lookup returns real
QRZ.com data (previously always fell back to "QRZ.com unavailable"
prefix-only data)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…l regression tests — Principle VIII.

Two gaps surfaced by live testing on the keychain-less test-Mac build:

1. Session-password fallback. In a build without QtKeychain (or when the
   keychain read fails — locked keychain, ACL denial on an unsigned test
   binary), a password typed in Radio Setup → QRZ was never handed to
   QrzClient at all: savePassword() only warned, so lookups fell back to
   prefix cards even seconds after the operator entered valid
   credentials. CallsignLookupService now keeps a memory-only
   m_sessionPassword and applies it whenever the keychain can't supply
   one — persistence and usability are separate concerns. Never written
   to disk; a restart still requires re-entry when no keychain exists.

2. Parser regression tests. The aethersdr#4043 root-element bug (readElementText
   on <QRZDatabase> swallowed the whole response; login broken end-to-end
   since aethersdr#3990) shipped because parseXml had zero test coverage.
   ParsedResponse/parseXml are now public-for-tests, and
   qrz_callsign_test pins the three live response shapes: login
   (Session/Key), lookup (Callsign + Session), and session-timeout
   (Error, no Key). Verified the tests catch the original bug: against
   the pre-aethersdr#4043 parser they fail 6/6; with the aethersdr#4043 guard, all pass.

Stacked on aethersdr#4043 (requires its parser guard for the new tests to pass).

💻 Generated with Claude Code (claude-fable-5 7/1/26) with architecture by @jensenpat

…l regression tests (stacked on #4043) (#4044)

**Stacked on #4043 — merge that first.** This branch contains #4043's
commits plus one of mine; after #4043 merges, the diff reduces to my
commit alone.

## What live testing on a keychain-less build surfaced

Deploying a test build whose worktree had never run
`scripts/setup/setup-qtkeychain.sh` (so `find_package(Qt6Keychain
QUIET)` silently compiled persistence out) exposed two gaps:

### 1. Typed password unusable without a keychain
In a keychain-less build — or when the keychain read fails (locked
keychain, ACL denial on an unsigned test binary) — a password typed in
**Radio Setup → QRZ** was never handed to `QrzClient` at all:
`savePassword()` only logged a warning. Lookups fell back to country
prefix cards seconds after the operator entered valid credentials, which
reads as "lookup is broken".

`CallsignLookupService` now keeps a **memory-only session password** and
applies it whenever the keychain can't supply one. Persistence and
usability are separate concerns: without a keychain the password still
works for the whole session and simply has to be re-entered after a
restart (the QRZ tab's Test Login already worked, since it uses the
field values directly). Never written to disk.

### 2. Zero test coverage let the #4043 bug ship
The `<QRZDatabase>` root-element bug (login broken end-to-end since
#3990) shipped because `parseXml` had no tests.
`ParsedResponse`/`parseXml` are now public-for-tests with a comment
saying why, and `qrz_callsign_test` pins the three live response shapes:

- login success (`Session`/`Key`)
- lookup success (`Callsign` + `Session`)
- session timeout (`Error`, no `Key`)

**Verified the tests catch the original bug** (Principle VIII/XI):
against the pre-#4043 parser they fail 6/6; with #4043's guard, all 53
checks pass.

## Testing
- `qrz_callsign_test`: ALL PASS with #4043; 6 failures without it
(regression coverage proven both ways).
- Root-caused from pulled test-Mac logs: `WRN aether.qrz: QRZ password
persistence unavailable: built without QtKeychain` →
prefix-fallback-only lookups; this PR + a properly staged qtkeychain
build fix both symptoms.

💻 Generated with Claude Code (claude-fable-5 7/1/26) with architecture
by @jensenpat