Profile-load hardening: follow-up tidy-ups from #3563 review

[ten9876]

Non-blocking follow-ups deferred from the #3563 review (merged as 3266fe35). The core hardening is correct and shipped; these are cleanups + one confirmation.

1. Confirm the suppressed-write callback code is never surfaced as a user error

During a profile-load write-hold, suppressed profile-owned writes invoke the callback with a failure-looking code:

cb(0x50000061, QStringLiteral("suppressed during profile load"));  // RadioModel.cpp

while the function itself returns 0 (success). These are fire-and-forget slice/pan/display writes, so it almost certainly never reaches the user — but we should confirm no sendCommand callback path treats 0x50000061 as a user-visible error/toast or triggers a retry during profile recall. If any does, suppress this code there or use a benign sentinel.

2. De-duplicate profileLoadMayRebuildRadioTopology

It's defined twice — inline in src/models/ProfileLoadCommand.h (type == "global") and again in src/gui/MainWindow_Wiring.cpp's anonymous namespace (case-insensitive compare). No ODR clash today and they agree (type is pre-lowercased), but it's two sources of truth for the same rule — if "topology profile" ever broadens past global, one copy can drift. Have MainWindow_Wiring.cpp include the header and drop its local copy.

3. Consolidate the write-hold duration constant

kProfileLoadStateWriteHoldMs = 10000 is duplicated in three places (RadioModel.cpp file scope + two local constexpr in MainWindow_Wiring.cpp), and the recovery flush/reacquire timers (11000 / 11250 ms) are implicitly tuned to outlast that 10 s hold. If someone shortens the hold, those timers won't track it. Hoist to a single shared constant (or at minimum comment the timer sites noting the dependency on the hold duration).

4. (Minor) Recovery cascade uses uncancelable singleShot timers

The recovery passes are a set of uncancelable QTimer::singleShot lambdas (350/1200/1500/2500/3500/11000/11250 ms). Each guards on m_shuttingDown/isConnected, so back-to-back profile loads are safe but stack redundant timers. Fine as-is; worth revisiting only if rapid profile recall becomes a real workload.

---

Source: #3563 review (two aethersdr-agent passes + Copilot + maintainer review). None of these block; grouping them so they don't get lost.

[aethersdr-agent]

Triage — confirmed, ready for cleanup

Verified all three items against the merged code (3266fe35). All claims are accurate; this is a well-scoped, non-blocking refactor. Handoff below.

1. 0x50000061 suppressed-write code — confirmed safe, no user-visible path

The suppressed branch (RadioModel.cpp:3617-3627) only fires for commands matching isProfileOwnedRadioStateWrite() (RadioModel.cpp:88-116): slice set …, display pan set …, display panafall set …, display waterfall set … (xpixels/ypixels excepted). I traced the senders of those commands:

• The dominant path passes no callback at all. Every profile-owned write in SliceModel.cpp (e.g. :78, :95, :103, :142) is sendCommand(QString(...)) with no second arg — so cb is null and 0x50000061 is never even constructed/delivered.
• The few callback-bearing code != 0 sites (RadioModel.cpp:1587/1629/2005/2165/3331/…, MainWindow*.cpp) are log-only (qCWarning(lcProtocol) << … << Qt::hex << code, as at RadioModel.cpp:3330-3335). None of them maps an error code to a toast/status banner, and none retries on the slice/display-set paths.

Conclusion: worst case 0x50000061 produces one qCWarning log line; it never reaches the user and never triggers a retry. No change strictly required for correctness, but using a benign sentinel (or cb(0, …)) would remove the "failure-looking success" smell. Low risk either way.

2. De-duplicate profileLoadMayRebuildRadioTopology

Confirmed two definitions that currently agree:

• src/models/ProfileLoadCommand.h:14-17 — profileType == "global" (input is pre-lowercased by parseProfileLoadCommand, :31).
• src/gui/MainWindow_Wiring.cpp anonymous namespace — used at :781 and :934.

Fix: MainWindow_Wiring.cpp already calls the header version's name; have it #include "models/ProfileLoadCommand.h" and delete the local anon-namespace copy. The header version is the single source of truth and is already test-covered (tests/profile_load_command_test.cpp:40-54).

3. Consolidate kProfileLoadStateWriteHoldMs

Confirmed three copies of 10000:

• RadioModel.cpp:86 (file-scope constexpr)
• MainWindow_Wiring.cpp:789 and :945 (two local constexpr)

And the recovery timers in scheduleProfileLoadRecovery() (MainWindow_Wiring.cpp:971 = 11000, :974 = 11250) are implicitly tuned to outlast the 10 s hold — shortening the hold silently breaks that ordering.

Fix: hoist a single shared constexpr qint64 kProfileLoadStateWriteHoldMs (natural home: a shared header alongside ProfileLoadCommand.h, since both RadioModel.cpp and MainWindow_Wiring.cpp consume it). Replace the three literals. For the 11000/11250 flush/reacquire timers, either derive them from the hold constant (e.g. kProfileLoadStateWriteHoldMs + 1000/+ 1250) or at minimum add a comment at :971/:974 noting they must outlast the hold.

4. Uncancelable singleShot recovery cascade

Confirmed (MainWindow_Wiring.cpp:956-981): 350/1200/2500/1500/3500/11000/11250 ms one-shots, each guarding on m_shuttingDown/isConnected()/profileLoadRadioStateWritesHeld() (runProfileLoadRecoveryPass at :992). Reporter's assessment stands — safe under back-to-back loads, just stacks redundant timers. Leave as-is unless rapid profile recall becomes a real workload; not worth the complexity of a cancelable QTimer member now.

---

Handoff

• Known: items 2 and 3 are concrete dedup refactors; item 1 is confirmed safe (optional sentinel cleanup); item 4 is intentionally deferred.
• To fix (if authorized): (2) include header + drop local copy in MainWindow_Wiring.cpp; (3) hoist shared constant + tie/comment the 11 s timers; (1) optional — swap 0x50000061 for a benign code on the suppressed-write callback.
• Risk: low, mechanical, behavior-preserving. Existing profile_load_command_test.cpp covers the dedup'd predicate; no protocol behavior changes.

Good candidate for a single small PR (or even good first issue for items 2+3 if scoped tightly). Deferring to maintainer on whether to authorize implementation.

---

_{🤖 aethersdr-agent · cost: $1.7710 · model: claude-opus-4-8}

---

_{📍 Citation health check (Foundry Constitution Principle I): 2 resolved, 8 unresolved against /Users/aetherclaude/workspace/AetherSDR at origin/main.}

Unresolved citations (8)

Citation	Reason
MainWindow_Wiring.cpp:789	file not found in workspace
MainWindow_Wiring.cpp:956-981	file not found in workspace
MainWindow_Wiring.cpp:971	file not found in workspace
RadioModel.cpp:1587	file not found in workspace
RadioModel.cpp:3330-3335	file not found in workspace
RadioModel.cpp:3617-3627	file not found in workspace
RadioModel.cpp:86	file not found in workspace
RadioModel.cpp:88-116	file not found in workspace