feat(aprs): add WIDE1-1 fill-in with explicit TX arming — Principle VI.

Add the AetherModem WIDE1-1 fill-in tab, model-owned engine and beacon, destination-aware duplicate suppression, traffic counters, and automation controls.

Require explicit 1200-baud session arming. Bound all modem producers to one 64-frame queue and cancel digi-origin pending/active work on disarm while preserving unrelated traffic. Cover the lifecycle with socket-free regression tests and mutation checks.

Implements Phase 1 of #3571; wide-area and other Phase-2 work remains tracked there.

Co-authored-by: jensenpat <patjensen@gmail.com>
Co-authored-by: Robbie Foust <rfoust@gmail.com>

Author: jensenpat

CMakeLists.txt

@@ -928,6 +928,7 @@ set(CORE_SOURCES
     src/core/aprs/AprsMessenger.cpp
     src/core/aprs/AprsBeacon.cpp
     src/core/aprs/AprsSettings.cpp
+    src/core/aprs/AprsFillInDigipeater.cpp
 )
 
 if(APPLE)
@@ -949,6 +950,7 @@ elseif(UNIX)
 endif()
 
 set(MODEL_SOURCES
+    src/models/AprsDigipeaterModel.cpp
     src/models/Nr2SettingsModel.cpp
     src/models/Rn2SettingsModel.cpp
     src/models/RadioModel.cpp
@@ -1048,6 +1050,7 @@ set(GUI_SOURCES
     src/gui/NetworkDiagnosticsDialog.cpp
     src/gui/SystemInfoDialog.cpp
     src/gui/Ax25HfPacketDecodeDialog.cpp
+    src/gui/AprsRateGraph.cpp
     src/gui/DStarAccessibility.cpp
     src/gui/DStarModemPage.cpp
     src/gui/AprsMessagesDialog.cpp

ROADMAP.md

@@ -146,8 +146,9 @@ Substantial features requested on the
 
 **Packet / APRS / mapping** (building on the new map engine + AFSK demod)
 
-- **APRS digipeater** tab (MVP: WIDE1-1 fill-in)
-  ([#3571](https://github.com/aethersdr/AetherSDR/issues/3571)).
+- **Digipeater Phase 2**: wide-area WIDEn-N/SSn-N, N trapping, viscous/direct-only
+  operation, and tiered beacons ([#3571](https://github.com/aethersdr/AetherSDR/issues/3571)).
+  The current MVP covers 1200-baud WIDE1-1 fill-in only. APRS-IS is separate scope.
 - **Live NEXRAD / weather-radar tile overlay** on the map
   ([#3574](https://github.com/aethersdr/AetherSDR/issues/3574)).
 - **IQ-stream transmission over TCI** for CW/RTTY skimmers

docs/MODEM.md

@@ -277,8 +277,8 @@ in `AppSettings` (`AetherModemPms*` keys) across restarts; enabling the PMS turn
 the modem on. The bottom of the window is a slim status bar showing modem state,
 gain, and a compact packet-activity strip.
 
-These layers are intentionally split so the planned APRS/AX.25 **digipeater** can
-reuse `Ax25`/`Ax25Connection` and the heard list directly.
+These layers are intentionally split so the APRS/AX.25 **fill-in digipeater**
+can reuse `Ax25` and the heard list directly.
 
 ## Open Work
 
@@ -302,8 +302,21 @@ KISS-over-TCP, connected-mode AX.25, a Personal Mailbox System, and an **APRS
 client** (live station map, GPS beacon, two-way messaging on the AetherModem
 tab) are now implemented — see the sections above and the PSK Reporter map's
 shared Qt mapping engine, which the APRS map reuses. Out of scope remains
-**APRS-IS** (internet gateway) and a future **APRS/AX.25 digipeater**, which can
-reuse the `Ax25`/`Ax25Connection` primitives.
+**APRS-IS** (internet gateway). A **WIDE1-1 fill-in digipeater** now lives on the
+AetherModem **Digipeater** tab (`AprsDigipeaterModel`): it answers the first unused
+hop when it is `WIDE1-1` (optionally `MYCALL` or legacy `RELAY`), substitutes
+the station call with the H-bit set, and does not decrement `WIDE2-n`. The tab
+has a heard-message graph, a digipeat graph, a scrolling raw TNC-2 list, and
+configurable fill-in / beacon settings. Fill-in requires the shared **1200-baud
+VHF profile** and explicit arming each session. Configuration persists, but
+arming never restores from settings. Switching to 300 baud, disabling the modem,
+changing the attached slice, disconnecting, or application teardown disarms fill-in
+and cancels its queued and active TX. Other producers retain their own queued
+traffic when only fill-in is disabled. The shared queue admits at most 64 frames
+across all producers, dropping the oldest on overflow. Duplicate identity includes
+source/SSID, destination, and payload, independent of the received path.
+The counters describe repeat decisions, not proof of RF delivery. Wide-area
+`UITRACE WIDE` remains out of scope.
 
 PMS follow-ups worth tracking:
 

docs/architecture/aetherd-touchpoint-tags.json

@@ -1330,5 +1330,11 @@
   "note": "Capability-gated client for the ANAN calibration extension. Uses only IRadioBackend requests and replies; concrete calibration ownership, rate control and DSP stay below the backend seam.",
   "split": "Client protocol adapter only; no vendor implementation dependency.",
   "confidence": "high"
+ },
+ "models/AprsDigipeaterModel.h": {
+  "tag": "universal",
+  "note": "Session-local APRS fill-in policy and bounded modem queue; no backend-specific commands or transport ownership.",
+  "split": "",
+  "confidence": "high"
  }
 }

docs/architecture/aetherd-touchpoints.md

@@ -4,7 +4,7 @@
 
 Burndown manifest for the engine/UI decoupling ([RFC](../aetherd-headless-engine-design.md) §2, §10). One row per engine header the UI includes; converting a touchpoint means the UI reaches that surface through the versioned protocol instead of the header.
 
-**Totals:** 215 touchpoint headers (184 core, 31 models) — 215/215 tagged, 0/215 converted.
+**Totals:** 216 touchpoint headers (184 core, 32 models) — 216/216 tagged, 0/216 converted.
 
 | Header | Includers | Tag | Status |
 |---|---:|---|---|
@@ -142,7 +142,7 @@ Burndown manifest for the engine/UI decoupling ([RFC](../aetherd-headless-engine
 | `core/SystemInventory.h` | 1 | ui-support — Startup and support-bundle inventory of host CPU, SIMD and RAM capabilities. Process diagnostics, not radio state. | unconverted |
 | `core/TciServer.h` | 3 | mixed(flex) — TCI WebSocket server for WSJT-X et al: protocol surface is canonical radio state, but audio/IQ rides Flex DAX | unconverted |
 | `core/TgxlConnection.h` | 2 | peripheral(4o3a) — Direct TCP client for the 4O3A Tuner Genius XL (port 9010, relay/autotune), reverse-engineered from the 4O3A management app — a standalone accessory transport, not SmartSDR. Not radio-family wire; a peripheral accessory, NOT behind the IRadioBackend radio seam (reclassified from vendor(flex), #4087 follow-up). | unconverted |
-| `core/ThemeManager.h` | 145 | ui-support — Qt token-based theming singleton (colors/fonts/QSS, theme files, editor hooks) — pure client GUI plumbing, no radio state. | unconverted |
+| `core/ThemeManager.h` | 146 | ui-support — Qt token-based theming singleton (colors/fonts/QSS, theme files, editor hooks) — pure client GUI plumbing, no radio state. | unconverted |
 | `core/ThreadCpuRing.h` | 2 | ui-support — Short host-thread CPU history used by Runtime Monitor peak and sparkline presentation. Diagnostic UI support, not radio state. | unconverted |
 | `core/TimeFrameVoter.h` | 1 | universal — Shared AetherClock time-frame types plus confidence-weighted cross-frame bit voting over a sliding window. Map-agnostic pure DSP/logic — no Qt, no GUI, no vendor ties. | unconverted |
 | `core/TxKeyingMarker.h` | 6 | ui-support — QWidget property marker guarding TX-keying controls from the automation bridge; GUI-shell plumbing, no radio state. | unconverted |
@@ -194,6 +194,7 @@ Burndown manifest for the engine/UI decoupling ([RFC](../aetherd-headless-engine
 | `core/tnc/TncTerminal.h` | 1 | universal — Packet terminal session model (command/monitor); radio-agnostic operating feature. | unconverted |
 | `models/AetherClockModel.h` | 2 | universal — Thin first-class AetherClock model with full Q_PROPERTY coverage (protocol-serializable, QML-ready), mirroring engine state over queued connections. Owns no DSP and has no vendor ties — one of only three models already shaped the way the protocol will want them. | unconverted |
 | `models/AntennaGeniusModel.h` | 4 | peripheral(4o3a) — 4O3A Antenna Genius switch client — standalone accessory with its own UDP-broadcast discovery (port 9007) + direct TCP; connects by device IP/port independent of the radio, works with any radio. Not radio-family wire; a peripheral accessory, NOT behind the IRadioBackend radio seam (reclassified from vendor(flex), #4087 follow-up). | unconverted |
+| `models/AprsDigipeaterModel.h` | 1 | universal — Session-local APRS fill-in policy and bounded modem queue; no backend-specific commands or transport ownership. | unconverted |
 | `models/BandDefs.h` | 5 | universal — Static ARRL band plan table (edges, default freq/mode, GEN/WWV); canonical band-plan data, no vendor ties. | unconverted |
 | `models/BandPlanManager.h` | 9 | universal — Band-plan overlay data (segments/spots/license classes, region merge) from JSON; radio-agnostic canon | unconverted |
 | `models/BandSettings.h` | 5 | universal — Per-band save/restore of canonical state (freq/mode/filter/AGC/WNB/display range) — band memories, no vendor fields | unconverted |

docs/automation-bridge.md

@@ -3519,6 +3519,34 @@ mailbox, and the terminal, so a headless soak box never has to open it.
   checkbox actually took and returns `ok:false` if the modem refused (no audio
   engine, no attached slice) rather than reporting success for work that did not
   happen.
+- **`modem digi`** / **`modem digi status`** — WIDE1-1 fill-in digipeater
+  snapshot (`enabled`, call, alias, dupe window, beacon fields, heard/repeated
+  counters, and the **current air rate** `baud` / `profileId`). The fill-in
+  engine is baud-agnostic; 300 Hz HF and 1200 Hz VHF share one modem profile
+  (`modem profile hf300|vhf1200`). Read-only.
+- **`modem digi on` / `modem digi off`** — arm/disarm the fill-in. `on` ⚠️
+  keys the transmitter whenever a matching UI frame is heard, so it is refused
+  unless `AETHER_AUTOMATION_ALLOW_TX=1`. Verifies the checkbox actually took
+  (a missing digi callsign or a profile other than 1200 baud fails closed).
+  Fill-in starts disarmed on every launch; configuration and beacon preference
+  persist, but TX authorization does not. Disabling fill-in cancels its pending
+  repeats/beacons and active TX without discarding other producers' packets.
+  Disabling the modem, changing the attached slice, disconnecting the radio,
+  or switching to 300 baud also disarms fill-in. Both Digi enable checkboxes
+  are TX-keying controls for generic automation invocations.
+- **`modem digi beacon`** ⚠️ — fire one fill-in-style position beacon now
+  (same `AETHER_AUTOMATION_ALLOW_TX=1` rail). Fails if there is no callsign or
+  no GPS/manual position.
+
+```json
+→ {"cmd":"modem","action":"digi","value":"status"}
+← {"ok":true,"baud":1200,"profileId":"Vhf1200",
+   "digi":{"enabled":true,"call":"KI6BCJ-7","alias":"WIDE1-1",
+           "alsoMyCall":true,"alsoRelay":false,"dupeWindowSecs":30,
+           "beaconEnabled":false,"beaconIntervalMin":15,
+           "heard":12,"repeated":3,"droppedDupe":1,"droppedNoMatch":8,
+           "droppedOwn":0,"baud":1200,"profileId":"Vhf1200"}}
+```
 
 The `demod` block is what separates "no frames because the band is dead" from
 "no frames because the audio tap never started": `receiveGateOpen` plus a
@@ -3840,7 +3868,8 @@ the airtime model predicts for the current profile and paclen; comparing it with
 `rtt.avgMs` is how you tell whether the model matches the air. See
 [`HFMODEM.md`](HFMODEM.md).
 
-Bare-line forms: `modem profile hf300`, `modem on`, `link status`,
+Bare-line forms: `modem profile hf300`, `modem on`, `modem digi status`,
+`modem digi on`, `modem digi beacon`, `link status`,
 `link mycall KI6BCJ-7`, `link connect N0BBS-1 via WIDE1-1`, `link pms on`.
 
 ---
@@ -4209,7 +4238,7 @@ still a separate radiocert task.
 | `dss` | — | dss <snapshot\|reset\|inject\|scrollback\|live> [pan] [args] |
 | `streams` | — | streams [radio\|inventory\|resync\|refresh\|reset] — stream diagnostics |
 | `devices` | — | devices <list\|ulanzi\|ulanzi-start\|ulanzi-stop> — external-device diagnostics and lifecycle control |
-| `modem` | `aethermodem` | modem <status\|profile hf300\|profile vhf1200\|on\|off\|preamble <flags\|auto>> — AetherModem demod profile, TXDELAY, RX tap, and decoder health |
+| `modem` | `aethermodem` | modem <status\|profile hf300\|profile vhf1200\|on\|off\|preamble <flags\|auto>\|digi [status\|on\|off\|beacon]> — AetherModem demod, TXDELAY, RX tap, WIDE1-1 fill-in, and decoder health |
 | `link` | `ax25` | link <status\|connect <call> [via <digi>]\|disconnect\|mycall <call>\|listen <call>\|alias <call>\|pms on\|off> — connected-mode AX.25 terminal + mailbox, with measured RTT vs configured T1 |
 | `memprofile` | — | memprofile <snapshot\|start\|sample\|status\|report\|samples\|stop\|reset> [intervalMs maxSamples] |
 | `tci` | — | tci start\|status\|stop\|send\|trace\|routes [@id] [rx=N] — TCI simulator (multi-client: @id names a client, rx=N its audio_start receiver) and protocol diagnostics |

src/core/AutomationServer.cpp

@@ -2712,7 +2712,8 @@ namespace {
 // (#4188 area 6). Some diagnostic verbs mix read and write actions, so the
 // action must be checked as well as the canonical verb name. Everything else
 // (drive/connect/capture/keying) is refused when m_readOnly is set.
-bool isReadOnlyRequest(const QString& name, const QString& action)
+bool isReadOnlyRequest(const QString& name, const QString& action,
+                       const QString& value = {})
 {
     static const QSet<QString> kSafe = {
         QStringLiteral("ping"),     QStringLiteral("verbs"),
@@ -2751,7 +2752,16 @@ bool isReadOnlyRequest(const QString& name, const QString& action)
     // `modem`/`link` mix introspection with actions that key the radio
     // (link connect transmits a SABM), so only the status reads are safe here.
     if (name == QLatin1String("modem") || name == QLatin1String("link")) {
-        return normalizedAction.isEmpty() || normalizedAction == QLatin1String("status");
+        if (normalizedAction.isEmpty() || normalizedAction == QLatin1String("status"))
+            return true;
+        // `modem digi` / `modem digi status` is introspection; `modem digi on`
+        // and `modem digi beacon` key the radio and stay gated.
+        if (name == QLatin1String("modem")
+            && normalizedAction == QLatin1String("digi")) {
+            const QString v = value.trimmed().toLower();
+            return v.isEmpty() || v == QLatin1String("status");
+        }
+        return false;
     }
     if (name == QLatin1String("tci")) {
         return normalizedAction == QLatin1String("status")
@@ -3452,7 +3462,7 @@ const std::vector<AutomationServer::VerbSpec>& AutomationServer::verbRegistry()
             });
 
         add("modem", {"aethermodem"},
-            "modem <status|profile hf300|profile vhf1200|on|off|preamble <flags|auto>> — AetherModem demod profile, TXDELAY, RX tap, and decoder health",
+            "modem <status|profile hf300|profile vhf1200|on|off|preamble <flags|auto>|digi [status|on|off|beacon]> — AetherModem demod profile, TXDELAY, RX tap, WIDE1-1 fill-in digipeater, and decoder health",
             parseActionRest,
             [](AutomationServer& s, A& a, QLocalSocket*) {
                 return s.doModemAutomation(QStringLiteral("modem"), a.action, a.value);
@@ -3873,7 +3883,7 @@ QJsonObject AutomationServer::handleLine(const QByteArray& line, QLocalSocket* s
     // keying. Enforced HERE in the bridge (not the MCP client) so it can't be
     // bypassed by talking to the socket directly. Uses the resolved canonical
     // name so aliases are covered.
-    if (m_readOnly && !isReadOnlyRequest(spec->name, a.action)) {
+    if (m_readOnly && !isReadOnlyRequest(spec->name, a.action, a.value)) {
         qCWarning(lcAutomation) << "read-only mode: refused" << spec->name;
         return err(QStringLiteral("read-only mode: '") + spec->name
                    + QStringLiteral("' is blocked. This bridge is observe-only "
@@ -11574,15 +11584,26 @@ QJsonObject AutomationServer::doModemAutomation(const QString& verb,
     // mailbox OFF never keys, so it stays ungated.
     const QString normalizedAction = action.trimmed().toLower();
     const QString normalizedValue = value.trimmed();
-    const bool keysTransmitter = verb == QLatin1String("link")
-        && (normalizedAction == QLatin1String("connect")
-            || normalizedAction == QLatin1String("disconnect")
-            || (normalizedAction == QLatin1String("pms")
-                && normalizedValue.toLower() == QLatin1String("on")));
+    const QString valueLower = normalizedValue.toLower();
+    const bool keysTransmitter =
+        (verb == QLatin1String("link")
+         && (normalizedAction == QLatin1String("connect")
+             || normalizedAction == QLatin1String("disconnect")
+             || (normalizedAction == QLatin1String("pms")
+                 && valueLower == QLatin1String("on"))))
+        || (verb == QLatin1String("modem")
+            && normalizedAction == QLatin1String("digi")
+            && (valueLower == QLatin1String("on")
+                || valueLower == QLatin1String("enable")
+                || valueLower == QLatin1String("beacon")));
     if (keysTransmitter && !m_txAllowed) {
-        return err(QStringLiteral("'link %1' keys the transmitter — set "
+        const QString what = (verb == QLatin1String("modem")
+                              && normalizedAction == QLatin1String("digi"))
+            ? QStringLiteral("modem digi %1").arg(valueLower)
+            : QStringLiteral("link %1").arg(normalizedAction);
+        return err(QStringLiteral("'%1' keys the transmitter — set "
                                   "AETHER_AUTOMATION_ALLOW_TX=1 to allow")
-                       .arg(normalizedAction));
+                       .arg(what));
     }
     return m_modemAutomationHandler(verb, normalizedAction, normalizedValue);
 }