feat(flex): take panadapter and slice capacity from the radio (#5594 item 3) (#5603)

Closes #5594 (item 3 — the last open item). Refs #5262 (M1), #5554
(§2.4, §2.6), #3849 (step 3).

Follows #5602, which closed items 1, 2, 4 and 5.

## The answer was on the status path, not discovery

`FlexBackend.cpp` reported `maxPanadapters = mc.maxSlices` under a
comment admitting it was an approximation *"refined from live radio
status in a later touchpoint conversion."* This is that conversion — and
the radio has been sending the answer all along.

The issue proposed reading the `max_panadapters` /
`available_panadapters` **discovery** keys. That would have meant
touching `RadioInfo` and the discovery parser, both above the seam and
both moving under §2.7 — which is exactly why #5594 flagged this item as
*"the one item genuinely entangled with §2.6/§2.7"* and said to defer it
alone if sequencing was in doubt.

**It isn't entangled.** The radio-global status already carries
`panadapters=N`, the exact mirror of the `slices=N` we have decoded
since aetherd RFC 2.3:

- FlexLib parses it into `PanadaptersRemaining` (`Radio.cs:3652`),
beside `SlicesRemaining` (`:3714`).
- Our own `docs/architecture/digital-voice-thumbdv-waveform.md:311-316`
already records a live run reading **5/6** with a foreign Multi-Flex
client's objects open, then **8/8** once that client left.
- Our own test fixture at `RadioConnection.cpp:138` emits `radio
slices=1 panadapters=1`.

We were receiving the key and dropping it on the floor. So the fix rides
the proven path: one `carry()` in `decodeRadioStatus`, and a derivation
in `applyRadioChanges` that mirrors the slice block line for line,
reusing `RadioStatusOwnership::boundedSliceCapacity` — capacity
arithmetic, not slice-specific. **No `RadioInfo` change, no
discovery-parser change, no `RadioConnectRequest` change**, and every
line lands in code §2.6 keeps.

## Remaining is not capacity

Both keys report *free slots*, so capacity is open objects plus free
ones. Reading either directly as a capacity under-reports the radio by
however many objects happen to be open — the trap the issue warned
about, just on the status keys rather than the discovery ones. The
existing slice block already reasons this way; the pan block now says so
too, logs an impossible total against the model table, and clamps rather
than believing it.

## Both fields, not just panadapters

`caps.maxSlices` had the identical gap: `RadioModel` refined
`m_maxSlices` from the radio while the backend descriptor kept reporting
the model-table estimate. Since `RadioResourceAdapter.cpp:95` serializes
`backendCapabilities()` onto the aetherd control protocol, **a protocol
client was told the estimate while the GUI and the automation bridge
used the radio's own number.** Fixing one and not the other would have
left the descriptor asymmetric, so `RadioModel` now hands both back
through `FlexBackend::setRadioReportedCapacity()`, which change-guards
them and announces a revision through the mechanism added in #5602.

The setter is **transitional and documented as such**: turning
"remaining" into "capacity" needs the count of open objects, which lives
in `RadioModel` today. When §2.6 moves slice/pan lifecycle behind the
seam this becomes a backend-side tally and the setter goes away. That
was the explicit scope call — the alternative (fix the GUI value, leave
the wire descriptor guessing) would have missed the point of M1, which
exists to make the descriptor honest *before* the protocol freezes it.

`0` means "the radio has not said" and leaves the model-table fallback
in place, so firmware that never sends the keys is unaffected. Both
values reset on disconnect — a FLEX-6700 followed by a FLEX-6400 must
not inherit 8.

## A correction to the issue, verified under Principle I

#5594's table says FlexLib maps `available_slices` onto `MaxSlices`,
*"which invites exactly that confusion."* It doesn't. `Discovery.cs`
keeps **four** separate keys mapping to four separate properties:

| Key | Property |
|---|---|
| `available_panadapters` | `AvailablePanadapters` (`:141`) |
| `available_slices` | `AvailableSlices` (`:154`) |
| `max_panadapters` | `MaxPanadapters` (`:247`) |
| `max_slices` | `MaxSlices` (`:260`) |

`API.cs:186-189` copies all four separately. The remaining-vs-capacity
trap is real, but it is not FlexLib's doing — and on the status path,
which is where this fix lives, FlexLib's own naming (`…Remaining`) is
unambiguous.

## Verification

Linux x86-64, GCC / Qt 6.11, RelWithDebInfo, RTL + ASR enabled, isolated
worktree.

| Check | Result |
|---|---|
| Full build (3165 targets) | passed |
| **Full CTest suite** | **405 / 405 passed**, 3 skipped |
| `check_engine_boundary.py --strict` | 1223 files, **0 would block**
(102 pre-existing EB3 warnings, unchanged) |
| `check_test_registration.py` / `check_ci_test_gate.py` /
`gen_touchpoint_manifest.py --check` | all OK |

### Mutation checks

| Mutation | Failures |
|---|---|
| Pan capacity re-derived from slice capacity (the assumption this
removes) | 3 |
| Announce guard removed (a storm on every `radio …` status) | 3 |
| `0` treated as a real capacity rather than "not reported" | 2 |
| No reset on disconnect (next radio inherits the previous one's limits)
| 1 |
| `panadapters` key not decoded | 1 |

Unmodified source passes both affected tests again.

### Coverage boundary

Decode and ok-guard are pinned in `aetherd_radio_decode_test` (the
`panadapters` key is carried independently of `slices`, and a malformed
value is dropped rather than becoming 0). The backend descriptor —
fallback, precedence, the change guard, the "not reported" sentinel and
the disconnect reset — is pinned in `backend_capability_revision_test`.

**Not pinned:** the `RadioModel` arithmetic that turns
`m_panadapters.size() + available` into a capacity.
`boundedSliceCapacity` itself is already covered at
`radio_status_ownership_test.cpp:367-381`; what is uncovered is the
wiring between it and the pan collection. Driving that needs a
`RadioModel` with a live backend and adopted pans, which has no
socket-free harness today — the same boundary #5602 documented, and
#5254's layer-1 work is what would close it.

No physical radio was connected and no RF was transmitted.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ten9876

src/core/RadioDiscovery.cpp

@@ -213,6 +213,13 @@ RadioInfo RadioDiscovery::parseDiscoveryPacket(const QByteArray& data) const
             info.inUse = (value == "1");
         } else if (key == "mf_enable") {
             info.multiFlexEnabled = (value != "0");
+        } else if (key == "max_slices") {
+            info.maxSlices = value.toInt();
+        } else if (key == "max_panadapters") {
+            // The radio's own capacity. Deliberately NOT available_panadapters,
+            // which is the free count and would read as a capacity that shrinks
+            // every time any client opens a panadapter. (#5594 item 3)
+            info.maxPanadapters = value.toInt();
         } else if (key == "max_licensed_version") {
             info.maxLicensedVersion = value.toInt();
         } else if (key == "is_system_model") {

src/core/RadioDiscovery.h

@@ -79,6 +79,19 @@ struct RadioInfo {
     quint16 port{4992};
     QString status;         // "Available" | "In_Use" | etc.
     int maxLicensedVersion{0};
+    // What the radio says it can run, from the discovery keys `max_slices` and
+    // `max_panadapters` (#5594 item 3). 0 means the radio did not say — older
+    // firmware, or a connect by IP where no discovery packet is ever seen — and
+    // the FlexLib model table remains the fallback.
+    //
+    // CAPACITY, not availability. The same packet also carries
+    // `available_slices` / `available_panadapters`, which are the currently FREE
+    // counts and fall as clients open objects; FlexLib keeps all four apart
+    // (Discovery.cs:141/154/247/260, copied separately at API.cs:186-189) and so
+    // do we. Observed on a FLEX-8600 running 4.2.20.41343: max_panadapters=4,
+    // available_panadapters=4, max_slices=4, available_slices=4.
+    int maxSlices{0};
+    int maxPanadapters{0};
     bool inUse{false};
     bool multiFlexEnabled{true}; // mf_enable from discovery; true = multi-client allowed
     bool isRouted{false};

src/core/backends/flex/FlexBackend.cpp

@@ -128,6 +128,23 @@ void FlexBackend::setModelProvider(std::function<QString()> provider)
     m_modelProvider = std::move(provider);
 }
 
+void FlexBackend::setRadioReportedCapacity(int maxSlices, int maxPanadapters)
+{
+    const bool slicesMoved = maxSlices > 0 && maxSlices != m_reportedMaxSlices;
+    const bool pansMoved = maxPanadapters > 0 && maxPanadapters != m_reportedMaxPanadapters;
+    if (!slicesMoved && !pansMoved)
+        return;
+    if (slicesMoved)
+        m_reportedMaxSlices = maxSlices;
+    if (pansMoved)
+        m_reportedMaxPanadapters = maxPanadapters;
+    // A real revision of the descriptor the control protocol serializes, so it
+    // is announced like any other (#5594 item 1). Guarded above: the caller
+    // republishes on every capacity-bearing edge, and an announcement per call
+    // would be the storm the model guard already avoids.
+    emit capabilitiesChanged();
+}
+
 RadioCapabilities FlexBackend::capabilities() const
 {
     RadioCapabilities caps;
@@ -164,10 +181,20 @@ RadioCapabilities FlexBackend::capabilities() const
     // FlexBackend refines these from live radio status as touchpoints convert.
     const ModelCapabilities mc = capabilitiesFor(caps.model);
     caps.canCreateSlices = true;
-    caps.maxSlices = mc.maxSlices;
-    // approx: pan capacity is not strictly slice count on real Flex hardware;
-    // refined from live radio status in a later touchpoint conversion.
-    caps.maxPanadapters = mc.maxSlices;
+    // What the radio declared wins over the model table when it said anything
+    // (#5594 item 3). The table is a per-model estimate keyed off the model
+    // string; these are what THIS radio reports for its own hardware and
+    // licence. Both fall back to the table at 0, so firmware that never sends
+    // the discovery keys behaves exactly as before.
+    caps.maxSlices = m_reportedMaxSlices > 0 ? m_reportedMaxSlices : mc.maxSlices;
+    // Pan capacity is no longer assumed equal to slice capacity. That was a
+    // documented approximation ("pan capacity tracks the radio's SCU/slice
+    // capacity, which is identical across every current model",
+    // ModelCapabilities.h) — true of the current line-up, but an assumption the
+    // radio settles for itself: a FLEX-8600 broadcasts max_panadapters=4 and
+    // max_slices=4 as separate keys, and nothing guarantees they stay equal.
+    caps.maxPanadapters =
+        m_reportedMaxPanadapters > 0 ? m_reportedMaxPanadapters : mc.maxSlices;
     caps.hasExtendedDsp = mc.hasExtendedDsp();
     // The LMS/FFT family is base Flex firmware, not an 8000-series extra —
     // every radio with hasRadioSideDsp below also has NRL/ANFL/ANFT.
@@ -1097,6 +1124,15 @@ void FlexBackend::clearExtensionHandles()
     // it is the same radio — capabilities were republished from scratch at the
     // connect edge, so the previous session's announcement describes nothing.
     m_announcedModel.clear();
+    // #5594 item 3: and it must not inherit the previous radio's capacity — a
+    // FLEX-6700 followed by a FLEX-6400 would otherwise keep reporting 8.
+    //
+    // Deliberately silent. Every other capacity change announces, but this one
+    // runs on the disconnect edge, where RadioModel republishes capabilities
+    // through connectionStateChanged anyway; announcing here as well would be a
+    // duplicate on a path where no client can act on it.
+    m_reportedMaxSlices = 0;
+    m_reportedMaxPanadapters = 0;
 }
 
 void FlexBackend::decodeApdStatus(const QMap<QString, QString>& kvs)

src/core/backends/flex/FlexBackend.h

@@ -54,6 +54,19 @@ class FlexBackend : public IRadioBackend {
     // caller exists yet; this documents the assumption).
     void setModelProvider(std::function<QString()> provider);
 
+    // The capacity THIS radio declared, as opposed to what the model table
+    // estimates for radios of its kind (#5594 item 3).
+    //
+    // Pushed down rather than read here because it arrives in the discovery
+    // packet, which RadioModel owns; #5554 §2.7 moves desktop discovery onto the
+    // unified source, and this becomes a backend-side read at that point.
+    //
+    // Either value may be <= 0, meaning "the radio did not say", which leaves
+    // capabilities() on the model-table estimate. Announces a revision when a
+    // value actually changes — the descriptor is what the control protocol
+    // serializes, so a silent change is a client holding a stale limit.
+    void setRadioReportedCapacity(int maxSlices, int maxPanadapters);
+
     // ---- IRadioBackend ----
     RadioCapabilities capabilities() const override;
     void connectRadio(const RadioConnectRequest& request) override;
@@ -192,6 +205,12 @@ class FlexBackend : public IRadioBackend {
     QString m_ampHandle;
     QString m_tunerHandle;
 
+    // Radio-declared capacity (#5594 item 3), 0 until the radio says. Cleared by
+    // clearExtensionHandles() on disconnect so a different radio cannot inherit
+    // the previous one's limits.
+    int m_reportedMaxSlices{0};
+    int m_reportedMaxPanadapters{0};
+
     // The model name the last capabilitiesChanged() announcement described
     // (#5594, M1). Flex's whole capability table is derived from the model name
     // — capabilitiesFor(caps.model) seeds maxSlices, the DSP tier and the rest —

src/models/RadioModel.cpp

@@ -2689,6 +2689,25 @@ RadioModel::RadioModel(QObject* parent)
             // so the flag has to be set here as well or an armed reconnect
             // reads as "nothing is happening".
             m_connectAttemptActive = true;
+            // Restore the capacity THIS radio declared (#5603 review, @NF0T).
+            // onDisconnected() cleared it — deliberately, because two of the
+            // three connect paths never re-seed and a second radio must not
+            // inherit the first one's limits. But this path is the exception:
+            // it reconnects to m_lastInfo.address, so it is by construction the
+            // same radio that just dropped, and m_lastInfo still carries what it
+            // declared. Without this a reduced-licence radio that rides out a
+            // network blip silently reverts to the model table's higher number
+            // until the next discovery-based connect — which is precisely the
+            // case this field exists to get right.
+            //
+            // Deliberately NOT done in onConnected(): connectViaWan() never sets
+            // m_lastInfo, so re-seeding from it on the shared edge would hand a
+            // WAN session the previous radio's limits — the cross-radio
+            // inheritance bug the disconnect-side clear exists to prevent.
+            m_declaredMaxSlices = m_lastInfo.maxSlices > 0 ? m_lastInfo.maxSlices : 0;
+            m_maxPanadapters = m_lastInfo.maxPanadapters > 0 ? m_lastInfo.maxPanadapters : 0;
+            if (m_declaredMaxSlices > 0)
+                m_maxSlices = m_declaredMaxSlices;
             clearAutomationSliceFixtures();
             if (m_connection) {
                 QMetaObject::invokeMethod(m_connection, [this] {
@@ -3753,7 +3772,16 @@ void RadioModel::connectToRadio(const RadioInfo& info)
     m_nickname = info.nickname;
     m_callsign = info.callsign;
     m_declaredBands = parseDeclaredBands(info.bands);   // empty for real Flex
-    m_maxSlices = maxSlicesForModel(m_model);
+    // #5594 item 3: the radio's own declaration wins over the model table.
+    // Both are captured here, at the connect edge, because a capacity is a fact
+    // about the hardware and licence rather than something that moves during a
+    // session. 0 means this radio did not say — older firmware, or a connect by
+    // IP where no discovery packet is ever seen — and the table still answers.
+    m_declaredMaxSlices = info.maxSlices > 0 ? info.maxSlices : 0;
+    m_maxPanadapters = info.maxPanadapters > 0 ? info.maxPanadapters : 0;
+    m_maxSlices = m_declaredMaxSlices > 0 ? m_declaredMaxSlices
+                                          : maxSlicesForModel(m_model);
+    publishRadioReportedCapacity();
     if (reloadAntennaAliases())
         emit antennaAliasesChanged();
     setKnownGuiClients(info.guiClientHandles,
@@ -6575,6 +6603,14 @@ void RadioModel::onConnected()
     qCDebug(lcProtocol) << "RadioModel: connected (family=" << m_family << ")";
     m_connectAttemptActive = false;  // the attempt landed (#4912)
     m_reconnectTimer.stop();
+    // Republish the declared capacity on the edge EVERY connect path reaches
+    // (#5603 review). connectToRadio() seeds it, but connectViaWan() and the
+    // LAN auto-reconnect timer never call that, and clearExtensionHandles() has
+    // already zeroed the backend's copy on the way down — so without this the
+    // control-protocol descriptor silently reverts to the model-table guess
+    // after any drop-and-reconnect while the GUI and bridge keep enforcing the
+    // declared number. That divergence is the thing this field exists to close.
+    publishRadioReportedCapacity();
     m_rebootInProgress = false;
     // Belt-and-braces (#4122 review): the connect entry points clear fixtures,
     // but isConnected() stays false for the whole Connecting phase, so a
@@ -7326,7 +7362,11 @@ void RadioModel::registerAsGuiClient(const QString& clientId)
                             else if (key == "options")     m_radioOptions = val;
                             else if (key == "model") {
                                 m_model = val;
-                                m_maxSlices = maxSlicesForModel(m_model);
+                                // #5594 item 3: only when the radio declared nothing. A model-string
+                                // change must not overwrite a capacity the radio stated for itself —
+                                // the table is the fallback, not an override.
+                                if (m_declaredMaxSlices <= 0)
+                                    m_maxSlices = maxSlicesForModel(m_model);
                             }
                             else if (key == "chassis_serial") m_chassisSerial = val;
                             else if (key == "software_ver")   m_version = val;
@@ -7725,6 +7765,16 @@ void RadioModel::onDisconnected()
     // three paths at once, so a reconnect can never show the previous radio's
     // station label while the async info reply is in flight. (#4260 review)
     m_nickname.clear();
+    // Same three-path reasoning as the nickname above, and for the same class of
+    // bug: connectToRadio() is the ONLY place the declared capacity is seeded,
+    // so on the two paths that bypass it a second radio would inherit the first
+    // one's limits. Worse than stale — the precedence guards added for #5594
+    // item 3 then REFUSE the model-table correction that used to repair this
+    // when the new radio's model= status landed, so a leftover 8 would offer
+    // pan and slice creates a FLEX-6400 must refuse. Clearing here closes all
+    // three connect paths at once. (#5603 review)
+    m_declaredMaxSlices = 0;
+    m_maxPanadapters = 0;
     m_region.clear();
     m_ip.clear();
     m_netmask.clear();
@@ -11280,15 +11330,42 @@ void RadioModel::handleRadioStatus(const QMap<QString, QString>& kvs)
     if (m_flexBackend) m_flexBackend->decodeRadioStatus(kvs);
 }
 
+void RadioModel::publishRadioReportedCapacity()
+{
+    if (!m_flexBackend)
+        return;
+    // Only what the radio actually spoke on. m_maxSlices carries the model-table
+    // estimate when nothing was declared, and pushing that down would pin the
+    // backend to a number no radio ever reported — the descriptor would then
+    // look authoritative while being a guess.
+    m_flexBackend->setRadioReportedCapacity(
+        m_declaredMaxSlices > 0 ? m_maxSlices : 0,
+        m_maxPanadapters);
+}
+
 void RadioModel::applyRadioChanges(const RadioDelta& d)
 {
     bool changed = false;
-    if (d.model) { m_model = *d.model; m_maxSlices = maxSlicesForModel(m_model); changed = true; }
+    if (d.model) {
+        m_model = *d.model;
+        // #5594 item 3: the table is the fallback, never an override. A radio
+        // that declared its capacity in discovery keeps it when its model name
+        // lands on the status plane a moment later.
+        if (m_declaredMaxSlices <= 0)
+            m_maxSlices = maxSlicesForModel(m_model);
+        changed = true;
+    }
     if (d.slicesAvailable) {
         // slices=N reports available (unused) slots; total capacity = open + available
         const int available = *d.slicesAvailable;
         const int currentSliceCount = static_cast<int>(m_slices.size());
-        const int modelLimit = m_model.isEmpty() ? 0 : maxSlicesForModel(m_model);
+        // Ceiling: what the radio DECLARED if it did, else the per-model
+        // estimate. Without this the ratchet below could raise the capacity back
+        // above a declared limit — a radio that says it runs 2 would be offered
+        // 4 the moment two slices were open. (#5594 item 3)
+        const int modelLimit = m_declaredMaxSlices > 0
+            ? m_declaredMaxSlices
+            : (m_model.isEmpty() ? 0 : maxSlicesForModel(m_model));
         const int reportedTotal = currentSliceCount + available;
         if (modelLimit > 0 && reportedTotal > modelLimit) {
             qCWarning(lcProtocol) << "RadioModel: ignoring impossible slice capacity"
@@ -11304,6 +11381,7 @@ void RadioModel::applyRadioChanges(const RadioDelta& d)
             available);
         if (updatedMax != m_maxSlices) {
             m_maxSlices = updatedMax;
+            publishRadioReportedCapacity();
         }
         changed = true;
     }

src/models/RadioModel.h

@@ -482,6 +482,14 @@ class RadioModel : public QObject {
             if (reported > 0)
                 return reported;
         }
+        // What the radio said in its discovery packet beats a per-model
+        // estimate: the table is keyed off the model string and is the same for
+        // every radio of that kind, while this is what THIS radio reports for
+        // its own hardware and licence. 0 means it never said (older firmware,
+        // or a connect by IP with no discovery packet), and then the table is
+        // still the best answer available. (#5594 item 3)
+        if (m_maxPanadapters > 0)
+            return m_maxPanadapters;
         return capabilitiesFor(m_model).maxSlices;
     }
 
@@ -1687,6 +1695,14 @@ private slots:
     {
         onStatusReceived(object, kvs);
     }
+    // Fire the LAN auto-reconnect timer's handler now instead of waiting for it.
+    // Drives the REAL handler, not a copy of its body, so a test can pin what the
+    // reconnect restores — see the licensed-capacity case in
+    // radio_capacity_declaration_test (#5603 review).
+    void triggerAutoReconnectForTest()
+    {
+        QMetaObject::invokeMethod(&m_reconnectTimer, "timeout", Qt::DirectConnection);
+    }
     // Drive the reconnect/reclaim portion of the normalized backend seam
     // without a synthetic radio peer. The socket-free resource test uses these
     // to prove that a reclaimed non-Flex slice is republished.
@@ -1818,6 +1834,27 @@ private slots:
     QString     m_model;
     QStringList m_declaredBands;    // optional "bands=" declaration (see declaredBands())
     int         m_maxSlices{4};
+    // What the radio DECLARED it can run, from the discovery keys max_slices /
+    // max_panadapters (#5594 item 3). 0 = the radio did not say, so the FlexLib
+    // model table remains the fallback.
+    //
+    // A declared capacity is a fact about the hardware and licence, so it is
+    // taken at the connect edge and does not move. The radio ALSO reports
+    // `slices=N` / `panadapters=N` in its live status, but those are the FREE
+    // counts — occupancy, not capacity — and turning them into a capacity means
+    // pairing them with an object inventory that is not populated yet when the
+    // first status lands. That derivation was tried and withdrawn; see #5603.
+    // Hand the radio-declared capacity to the Flex backend so the capability
+    // DESCRIPTOR agrees with what this model enforces. RadioResourceAdapter
+    // serializes backendCapabilities() onto the aetherd control protocol, so
+    // without this a protocol client is told the model-table estimate while the
+    // GUI and the automation bridge use the radio's own number. (#5594 item 3)
+    //
+    // Private: every caller is inside RadioModel, on the connect/seed edges.
+    void publishRadioReportedCapacity();
+
+    int         m_declaredMaxSlices{0};
+    int         m_maxPanadapters{0};
     QString     m_version;          // software version from discovery (e.g. "4.1.5")
     QString     m_versionLabel;     // display-only word for it (Gateware on an HL2)
     QString     m_protocolVersion;  // protocol version from V line (e.g. "1.4.0.0")