Thanks @jensenpat — this is a clean, well-reasoned fix, and the "prove the test fails against the pre-#4043 parser" step (Principle VIII/XI) is exactly the discipline that would have caught the original regression. I reviewed against current main.

Heads-up: #4043 has already merged

Commit 1e301dc (#4043) is on main now, which is why this PR shows mergeable_state: dirty. A rebase onto current main will drop the overlapping parseXml guard and reduce the diff to your actual contribution — no action needed beyond the rebase you already anticipated in the description.

What I verified (all good)

• Session-password fallback (CallsignLookupService): the memory-only m_sessionPassword is applied both in the keychain-less #else path and in the HAVE_KEYCHAIN read-failure branch, so it also rescues the locked-keychain / ACL-denied case on keychain-enabled builds — nice touch beyond the stated scope. savePassword() assigns m_sessionPassword before the empty-check, so clearing the field correctly clears the session copy too. Never touches disk, consistent with the existing QrzClient::m_password handling.
• Regression tests: parseXml is static, so exposing it public-for-tests is the minimal surface change. Field names (call, firstName, city, grid, licenseClass, hasLatLon, latitude/longitude) match CallsignInfo/the parser, <cmath> is already included for std::abs, and the three fixtures pin the real <QRZDatabase>-wrapped shapes including the error/no-key timeout path.
• CMake: adding QrzClient.cpp + Qt6::Network to qrz_callsign_test is required for the QNetworkReply link; the Windows/macOS keychain runtime-lib copies are all guarded by WIN32/APPLE + EXISTS, so they're no-ops where the staged libs aren't present and don't perturb the packaged (windeployqt/macdeployqt) paths.

No blocking issues from me — the code is correct and in-scope; just rebase now that #4043 has landed. Nice work.

_{🤖 aethersdr-agent · cost: $4.7873 · model: claude-opus-4-8}

Approving — this closes exactly the two follow-ups I asked for on #4043, and closes them well.

The regression test is the one that mattered. QRZ login broke end-to-end and shipped precisely because no test drove parseXml against a root-wrapped response. Your new cases pin all three real shapes: a full <QRZDatabase version="1.34" xmlns=…>-wrapped login yields the sessionKey, a lookup with Callsign+Session siblings retains it, and an expired body surfaces sessionError == "Session Timeout". That's the difference between "fixed" and "fixed to stay fixed" (Principle VIII) — a future token-walk refactor now trips a test instead of silently muting login. I ran the suite offscreen: ALL PASS, and a full build links clean (761/761).

The keychain-optional password fix is correct. The memory-only m_sessionPassword (documented — and verified — never written to disk) means a typed password works immediately when the keychain is empty, locked, or absent, while a stored keychain value still wins when present. That's exactly the failure I flagged on #4043 (keychain-missing → empty password → every lookup fails), and the precedence is right. No new persistence or security surface — the password already flowed as a QString.

Exposing parseXml/ParsedResponse as public static is the thin, stateless test seam I offered as the option — a clean way to pin the parser without a friend declaration. The macOS dylib-bundling commit layers correctly after the existing Windows staging block and is verifiable via check-macos.

Housekeeping: this was stacked on #4043's individual commits, which no longer matched main's squash-merge — I rebased it onto current origin/main (dropping the two already-landed commits) to clear the conflict and force-pushed with a lease; your two commits are unchanged and still yours. One pre-existing -Wunused-result on QTemporaryFile::open() in the cty.dat test (not touched by this PR) is worth folding into a future warning sweep, not a gate here.

Approving and enabling auto-merge. 73 — reviewed with Claude Code on behalf of KK7GWY.