[jensenpat]

Closes #6561 #6223 and #6539.

Connection workflow

Choose a Location, select a saved or discovered radio, and press Connect. Locations organize radio connections; the window is titled Connect to a radio, and its blue list heading identifies the selected Location, such as Radios at Home.

• Start with Home, POTA, Club and RV. Create custom Locations such as Cabin. The selected Location is bold and the saved order can be changed by dragging or using Move.
• Use Edit, Move, Rename and Remove on Locations and saved radio entries. Remove asks for confirmation. Moving a radio carries its saved connection paths to the chosen Location.
• Show saved radio names prominently, with model or address and availability on the second line. Group access paths that share the same saved family and serial.
• Use Nearby radios for discovery and + Add radio by IP for manual setup. Existing family-specific setup controls remain available. Put Connection name first and Save connection beside Connect by IP.
• Select an operator through Operating as or Profiles…. Create, edit, duplicate and remove profiles containing microphone, audio-output and pan-arrangement choices. The initial profile is Radio operator. Create and use profile saves and selects the new profile.
• Save multiple named SmartLink accounts with separate credential references and session credentials. A saved remote connection selects its owning account. Switching accounts clears the previous listing and fences callbacks from the previous authentication attempt. A dependent WAN session locks account switching and removal.
• Save Icom credentials by connection identity, and restore each saved connection's source path, Icom port selection, CI-V choice and low-bandwidth choice.
• Support Return and keypad Enter in profile entry dialogs. Expanding Startup and connection preferences exposes all its checkboxes.

Persistence and integration

• Store Locations, connections, operator preferences, account metadata and selected IDs in the versioned ConnectionWorkspace feature document through AppSettings. The internal stations collection name is retained for saved-document compatibility.
• Migrate existing routed paths, address history, last-radio identity, SmartLink metadata/token references and client audio/layout preferences. Retain the legacy settings snapshot and the existing startup preference.
• Keep credential values in the existing credential store or session vault. Reserve scoped credential keys at the settings boundary and keep credential values out of workspace documents and settings exports.
• Apply operator preferences when connecting. Browsing Locations or operator profiles preserves the active session and its audio choices. An unavailable saved audio device is shown as a choice needing replacement.
• Build the connection surface and entry dialogs with CanonWindow and existing Canon theme tokens. Update connection documentation and its screenshot catalog.
• Add connect profiles for redacted workspace inspection and connect profile stations|operators <id> for selection. Creation and editing use the normal widgets through the existing invoke bridge command.

Tests and exercised flows

Test or exercise	Covered behavior
connection_workspace_test	Migration and schema guards; credential-field rejection; mixed-family Location memberships; operator and account metadata; account reset/locking; profile forms and Enter; named radio grouping; Move/Remove; saved order; Icom port restoration; preference sizing; empty-email account rename.
connection_panel_source_pick_test	A chosen IPv6 source survives address editing and family changes, using fixed interface snapshots; an explicit Auto choice remains selected.
network_path_resolver_test	Address-family selection and saved-interface/address matching, including IPv6 GUA/ULA choices.
icom_credentials_singleflight_test	Credential read coordination and connection-scoped credential isolation.
connection_panel_size_test, startup_autoconnect_lockout_test, app_settings_safety_*	Connection-window geometry, startup lockout behavior and settings persistence/safety cases.
Automation bridge and native keyboard exercises	Simulator connect/disconnect; Location browsing during a session; saved paths; Location/operator/account creation; connection and account rename; Move and confirmed/cancelled Remove; saved Icom port restoration; preference expansion; Return and keypad Enter.
Documentation and static checks	User-guide build; screenshot embeds; bridge/touchpoint generation; test registration; settings-use, engine-boundary and command-plane checks.

Recorded results: 35 focused CTest cases passed. The app build, user-guide build and listed static checks completed successfully.

Screenshots

Home:

POTA:

Cabin:

Operator selection:

Operator creation:

[jensenpat]

Heads up to reviewers, I have approval from @ten9876 for use of a new gradient theme color. Noted in the event that color audit fails.

[ten9876]

Review of #6885, reviewed together with the stacked #6889

What I ran: this head (136dba0b1), plus #6889 (d878d7e3c) merged with current main (155850f50). Built on Linux with Qt 6.12.0, the same Qt CI uses.

• Focused tests: 37 CTest registrations.
• A bridge session against the built-in demo radio (DEMO-0001): offscreen, isolated settings store, TX disabled. No hardware was involved.
• Findings that come only from #6889's delta are in my review on #6889.

Issue fit. #6561 is the RFC, approved by @ten9876 on 2026-10-18. #6223 and #6539 are the multi-account SmartLink requests.

• The workspace model and its versioning, one-shot migration, credential isolation and multi-account SmartLink with an auth-generation fence all address those asks. Most of it held up under attack (see the end).
• Two things don't hold yet: the Return/Enter claim, and the operator-profile behavior on connect. Both are below.

CI. Green, but the runs were created at 06:14Z, before main moved (tip 14:09Z), and the PR is now CONFLICTING.

• The only conflict is the generated docs/architecture/aetherd-touchpoints.md. Regenerating it with tools/gen_touchpoint_manifest.py resolves it.
• Neither connection_workspace_test nor connection_panel_size_test is in ci.yml's -R filter, so green never ran them.

Scope

File / group	Claimed in body?	Verdict
models/ConnectionWorkspace.{h,cpp} and the ConnectionPanel workspace UI	Yes	In scope
SmartLinkClient multi-account and auth fence	Yes (#6223, #6539)	In scope
IcomCredentials per-connection scoping, SettingsCredentialPolicy.h, AppSettings.cpp	Yes	In scope
AutomationServer / IConnectionAutomation: connect profiles, connect profile …	Yes	New public bridge surface. Maintainer accepts it.
docs/user/**, screenshots, screens.json, sidebars.js	Yes	In scope
aetherd-touchpoint-tags.json: new models/ConnectionWorkspace.h tagged universal	No	Nit 4
connection_panel_source_pick_test rewrite: new m_manualSourceCandidates seam, SKIP_RETURN_CODE 77 dropped	No	A good change, but please mention it in the body
docs/BUILDING.md +5, CMakeLists.txt +1	No	Please explain these in the body

Blockers

1. Return / keypad Enter does nothing in the Move and Copy dialogs on Linux, and this PR's own test fails 3/3 there.

• connection_workspace_test fails deterministically on this head, unmerged, with 3 failures in each of 3 runs:

  [FAIL] Move carries all paths to the destination location
  [FAIL] confirmed Remove deletes this location's paths only
  [FAIL] keypad Enter copies the connection to the chosen location
  

• Cause: the focused widget in the Move dialog (src/gui/ConnectionPanel.cpp:4863) and the Copy dialog (:4391) is a non-editable QComboBox. On Qt 6.12 on Linux, Return and Enter on that combo open its popup; they do not reach the dialog's default button.
  • I confirmed it with a 20-line standalone Qt 6.12 probe: a QDialog holding a combo and a default Ok, then QTest::keyClick(combo, Key_Return) gives accepted=0 popupVisible=1.
  • Instrumenting the test shows connectionMoveRadio is still visible after the keypress.
  • The "Remove" failure is a knock-on effect: the Move never happened.
• So "Support Return and keypad Enter in profile entry dialogs" doesn't hold in these two dialogs, and "35 focused CTest cases passed" can't have been a Linux run.
• Fix: handle Return/Enter on the combo explicitly, for example by accepting from QComboBox::activated or with a small key filter that clicks the default button when the popup is closed.
• Separately, connection_panel_size_test fails identically on main (horizontal overflow is reachable, not clipped), so that one is pre-existing and not this PR's.

2. Operator profiles override the operator's own audio and layout choices on every connect, and a missing saved device blocks connect. The maintainer ruled that both parts need fixing.

• The selected profile is captured once, at migration (src/models/ConnectionWorkspace.cpp:157-159). It is re-applied on every connect: applyWorkspaceOperator() at ConnectionPanel.cpp:2177/2214/2770, then MainWindow_Session.cpp:468-488 writes PanadapterLayout and calls applyAudioDeviceSelection.
  • Nothing updates the profile when the operator changes devices or layout in Settings. The next connect silently reverts them.
  • Please make Settings changes update the active profile, or apply a profile only when the operator explicitly picks one.
• A saved device that is now missing makes applyWorkspaceOperator() refuse the connect (MainWindow_Session.cpp:873). That includes unattended startup auto-connect, which previously fell back to the default device. An unplugged USB headset now leaves a kiosk sitting on a status line.
  • The test pins this as intended ("missing saved microphone blocks connect").
  • Please fall back to the default device with a visible warning instead.

3. If this lands without #6889, a failed SmartLink reconnect leaves the account locked until restart.

• MainWindow.cpp:833 locks the account on WAN connect.
• The authFailed reconnect handler (MainWindow_Session.cpp:702-720) closes the reconnect dialog and opens the connection dialog. It never calls setAccountLocked(false) or clears m_pendingWanRadio.
• Sign-in, account switching and account removal are then all refused, and the Disconnect button is hidden while disconnected.
• #6889's beginExplicitRadioChoice unlocks it (MainWindow_Session.cpp:333-336 at d878d7e3c), so in the stack the user can recover by clicking a tab. On its own this PR has no way out.
• Fix: in that handler, add m_smartLink.setAccountLocked(false); m_pendingWanRadio = {}; beside m_wanReconnectTimer.stop();.
• This was reasoned from the code. I did not reproduce it: the demo has no SmartLink path.

Nits (non-blocking)

1. The legacy flat keys are still live co-owners. This is a maintainer call; I am not citing it as a canon violation.
   • setConnected still writes IcomCredentials::save(), saveManualProfile and IcomSettings::setLastHost (ConnectionPanel.cpp:1513-1525), and login() still writes SmartLinkEmail.
   • So routes live in both RoutedProfilesJson and the workspace. Two Locations with the same host and different routes overwrite each other's legacy entry.
   • The body calls this "retain the legacy settings snapshot", but it isn't a snapshot. Constitution V asks for one owner. Either freeze the legacy keys or explain why they stay live.
2. ConnectionWorkspace::load() carries fixups for document shapes that never shipped (ConnectionWorkspace.cpp:196-228): the "Existing preferences" and "Existing setup" renames. They run on every load. A user profile literally named "Existing preferences" gets renamed to "Radio operator". Drop them before merge.
3. connect profiles is described as redacted, but nothing is redacted.
   • ConnectionPanel.h:139 returns workspaceSnapshot() unchanged: emails, hosts, Icom usernames and device IDs.
   • No secrets leak, because validate rejects credential-shaped keys. Either redact, or change the doc and body wording.
4. The touchpoint tag for models/ConnectionWorkspace.h is universal.
   • Its content is client UI preference (audio devices, layout, Locations). The precedent is CwDecodeSettings.h → ui-support.
   • Also, SmartLinkClient.cpp, an engine file, now includes models/ConnectionWorkspace.h only to get a key string.
5. Per-connection Icom keychain entries (icom/<hash>/password) are never deleted. They are shared across Locations by hash, so deleting one needs a reference check. Please at least say so in the Remove confirmation. SmartLink removal does delete its key correctly.
6. The scoped-key formats are hand-written in three places: SettingsCredentialPolicy.h, ConnectionWorkspace::credentialKey, and IcomCredentials.cpp (twice). Build them from the policy table so they can't drift.
7. Migration always creates an "Existing account" SmartLink entry, even with no prior SmartLink use (seen on a clean store: {"id":"legacy","name":"Existing account","email":""}). Also, RecentConnectByIpAddresses hosts are all tagged flex.
8. Weak tests. "switching fences pending asynchronous authentication" only checks that m_authGeneration incremented, so deleting every generation != m_authGeneration guard would still pass. Deliver a stale reply instead. "legacy source is retained" checks contains(), not that the value is unchanged.
9. Small items.
   • Operator-dialog button labels are not wrapped in tr() (ConnectionPanel.cpp:4944).
   • The friend struct name ConnectionPanelSmartLinkTestAccess is misleading.
   • A 129–254-character email can't sign in, because the name is capped at 128 by validate.
10. Main moved. Whichever of #6885 / #6889 lands second needs tools/gen_touchpoint_manifest.py re-run.

What I tried to break that held

• Newer schema, corrupt or unavailable store: load() returns {} and save() refuses, so a newer document is never overwritten.
• Migration is one-shot: the document's existence is the marker, and a failed save retries next launch.
• Credentials in the document or exports: hasSecrets rejects them at save. Scoped keys are reserved at the setValue, import and export seam. The test proves setValue(scopedKey) lands in the session vault.
• The SmartLink fence covers the login and refresh replies and the keychain read. logout, setAccountId and login are refused while locked.
• Removing the last or the selected Location or operator is refused, and empty or duplicate names are refused. Removing the Location that holds the connected radio leaves the session alone. Dialogs follow the CanonWindow exception and new widgets carry accessible names.
• Engine-boundary and command-plane gates, run on merge base and head and compared per file: identical except for line shifts. The theme seed check passes. color.brand.gradient is an existing token, not a new one.
• Bridge, on the demo:
  • A clean store migrates to Home/POTA/Club/RV plus "Radio operator".
  • Connecting the demo saves it to Home: connect profiles shows {"family":"sim","serial":"DEMO-0001","kind":"local"} under Home.
  • A saved TEST-NET manual connection (192.0.2.10) persists.
  • The workspace survives a process restart.