fix(rigctld): never leave the rig keyed when the client goes away

The Kenwood/Elecraft backend deliberately suspends its wire poll while PTT is
held — a K3 answers "?;" to IF; during transmit, and treating that as a fault
used to drop the whole CAT link. The consequence was that nothing watched the
transmitter: a client that crashed, was closed, or simply had its socket shut
under it left the rig on air.

And shutting the socket is routine. reloadCATShare tears the sharing server
down and rebuilds it on every settings save, so a Save while WSJT-X held PTT
was enough. A K3 operator's log shows exactly that: "TX;" at 17:53:09, no "RX;"
ever, the poll silent, and the rig still keyed 29 s later when the CAT link
happened to be rebuilt.

The server now drops PTT when a connection ends and when Stop() is called.
Stop() runs before reloadCAT restarts the backend, so the unkey still reaches
the radio. An atomic Swap keeps it once-only across the two paths.

changelog.json

@@ -15,7 +15,8 @@
       "Recent QSOs: a column dragged to sit AFTER an award column now stays there. Award columns were left out of the saved layout, so on reload they were pushed to the far right and jumped back in front of the column you had placed after them.",
       "Entry form and QSO editor: Name and QTH are capitalised word by word (\"JEAN-PIERRE\" → \"Jean-Pierre\"), Comment and Note get a capital first letter. Applied when you leave the field, so typing is never interrupted; the rest of a comment is left alone, since it usually holds callsigns and modes.",
       "Recent QSOs: the search box only ever takes callsigns, so it now upper-cases as you type and carries a small clear button.",
-      "CAT Elecraft K3/K4: the rig's mode is read back correctly. MD6 is DATA on a K3 but FSK on a Kenwood, and OpsLog decoded it as RTTY — so a K3 running FT8 showed RTTY, logged its QSOs as RTTY, and told WSJT-X/JTDX over the shared CAT link that the rig was in RTTY while they had asked for a data mode. Applies to the Elecraft K3/K4 backend and to the \"DATA A — MD6\" option; a plain Kenwood still reads MD6 as RTTY."
+      "CAT Elecraft K3/K4: the rig's mode is read back correctly. MD6 is DATA on a K3 but FSK on a Kenwood, and OpsLog decoded it as RTTY — so a K3 running FT8 showed RTTY, logged its QSOs as RTTY, and told WSJT-X/JTDX over the shared CAT link that the rig was in RTTY while they had asked for a data mode. Applies to the Elecraft K3/K4 backend and to the \"DATA A — MD6\" option; a plain Kenwood still reads MD6 as RTTY.",
+      "CAT sharing: the transmitter is dropped when the program keying it goes away. If WSJT-X/JTDX crashed, was closed, or simply had its connection cut — which is what saving the settings does, since the sharing server is rebuilt — the rig stayed on air with nobody watching: the Kenwood/Elecraft link stops polling while PTT is held, so nothing noticed. A K3 was seen transmitting for 29 seconds."
     ],
     "fr": [
       "Sauvegarde : nouvelle option \"Sauvegarder à chaque fermeture\" (Réglages → Sauvegarde). Activée, OpsLog sauvegarde la base à chaque fois que tu quittes au lieu d'une seule fois par jour — les QSO d'une seconde session sont ainsi toujours pris.",
@@ -30,7 +31,8 @@
       "QSO récents : une colonne déplacée APRÈS une colonne de diplôme y reste. Les colonnes de diplômes étaient exclues de la disposition enregistrée, donc au rechargement elles étaient repoussées tout à droite et repassaient devant la colonne que tu avais placée après elles.",
       "Saisie et éditeur de QSO : Name et QTH sont capitalisés mot par mot (« JEAN-PIERRE » → « Jean-Pierre »), Comment et Note prennent une majuscule en première lettre. Appliqué quand tu quittes le champ, donc la frappe n'est jamais perturbée ; la suite d'un commentaire est laissée telle quelle, puisqu'elle contient souvent des indicatifs et des modes.",
       "QSO récents : le champ de recherche ne prend que des indicatifs — il passe donc en majuscules à la frappe et reçoit un petit bouton d'effacement.",
-      "CAT Elecraft K3/K4 : le mode de la radio est relu correctement. MD6 vaut DATA sur un K3 mais FSK sur un Kenwood, et OpsLog le décodait en RTTY — un K3 en FT8 affichait donc RTTY, enregistrait ses QSO en RTTY, et annonçait RTTY à WSJT-X/JTDX via le partage CAT alors qu'ils avaient demandé un mode data. Vaut pour le backend Elecraft K3/K4 et pour l'option « DATA A — MD6 » ; un Kenwood classique lit toujours MD6 comme RTTY."
+      "CAT Elecraft K3/K4 : le mode de la radio est relu correctement. MD6 vaut DATA sur un K3 mais FSK sur un Kenwood, et OpsLog le décodait en RTTY — un K3 en FT8 affichait donc RTTY, enregistrait ses QSO en RTTY, et annonçait RTTY à WSJT-X/JTDX via le partage CAT alors qu'ils avaient demandé un mode data. Vaut pour le backend Elecraft K3/K4 et pour l'option « DATA A — MD6 » ; un Kenwood classique lit toujours MD6 comme RTTY.",
+      "Partage CAT : l'émission est coupée quand le logiciel qui la commandait disparaît. Si WSJT-X/JTDX plantait, était fermé, ou voyait simplement sa connexion coupée — ce que fait un enregistrement des réglages, puisque le serveur de partage est reconstruit — la radio restait en émission sans surveillance : la liaison Kenwood/Elecraft cesse d'interroger le poste tant que le PTT est tenu, donc rien ne s'en apercevait. Un K3 a été vu en émission pendant 29 secondes."
     ]
   },
   {

internal/rigctld/rigctld.go

@@ -118,7 +118,32 @@ func (s *Server) Start() error {
 	return nil
 }
 
+// releasePTT drops the transmitter when whoever was holding it goes away.
+//
+// Nothing else will. The Kenwood/Elecraft backend deliberately suspends its
+// wire poll while PTT is held (a K3 answers "?;" to IF; during transmit), so a
+// client that crashes, is killed, or simply has its socket closed under it
+// leaves the rig keyed with nobody watching — and closing the socket is exactly
+// what Stop() does on every settings save. Seen in the field: a K3 sat in
+// transmit for 29 s, until the CAT link happened to be rebuilt.
+//
+// Swap makes this once-only, so the Stop() path and the per-connection defer it
+// triggers can both call it without double-unkeying.
+func (s *Server) releasePTT(why string) {
+	if !s.ptt.Swap(false) {
+		return
+	}
+	s.log("rigctld: %s while the rig was keyed — dropping PTT", why)
+	if err := s.rig.SetPTT(false); err != nil {
+		s.log("rigctld: emergency unkey failed: %v", err)
+	}
+}
+
 func (s *Server) Stop() {
+	// Before anything is torn down: reloadCAT calls us BEFORE it restarts the CAT
+	// backend, so the rig is still reachable here and an unkey still lands.
+	s.releasePTT("CAT sharing stopped")
+
 	s.mu.Lock()
 	s.closed = true
 	ln := s.ln
@@ -146,6 +171,8 @@ func (s *Server) serve(c net.Conn) {
 		delete(s.conns, c)
 		s.mu.Unlock()
 		_ = c.Close()
+		// A client that walks away mid-over must not leave the rig transmitting.
+		s.releasePTT(fmt.Sprintf("client %s left", c.RemoteAddr()))
 	}()
 	s.log("rigctld: client connected from %s", c.RemoteAddr())
 	r := bufio.NewReader(c)

internal/rigctld/rigctld_test.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"time"
 )
 
 // fakeRig stands in for the CAT manager.
@@ -234,6 +235,66 @@ func TestServerOverTCP(t *testing.T) {
 	}
 }
 
+// A client that vanishes mid-over must not leave the transmitter keyed. Nothing
+// else would notice: the Kenwood/Elecraft backend stops polling while PTT is
+// held, so a K3 was seen sitting in transmit for 29 s after WSJT-X's socket was
+// closed under it by a settings save.
+func TestPTTIsDroppedWhenTheClientDisappears(t *testing.T) {
+	rig := &fakeRig{freq: 14074000, mode: "FT8"}
+	s := New(0, rig, nil)
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	s.mu.Lock()
+	s.ln = ln
+	s.mu.Unlock()
+	go func() {
+		for {
+			c, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go s.serve(c)
+		}
+	}()
+	defer s.Stop()
+
+	c, err := net.DialTimeout("tcp", ln.Addr().String(), dialTimeout)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	r := bufio.NewReader(c)
+	// "T 3" is what WSJT-X sends for PTT_ON_DATA — the form seen in the field.
+	if _, err := c.Write([]byte("T 3\n")); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	line, _ := r.ReadString('\n')
+	if strings.TrimSpace(line) != "RPRT 0" {
+		t.Fatalf("set_ptt = %q, want RPRT 0", strings.TrimSpace(line))
+	}
+	rig.mu.Lock()
+	keyed := rig.ptt
+	rig.mu.Unlock()
+	if !keyed {
+		t.Fatalf("rig is not keyed after T 3 — the test proves nothing")
+	}
+
+	_ = c.Close()
+	// The unkey happens on the serve goroutine's defer, so poll briefly.
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		rig.mu.Lock()
+		keyed = rig.ptt
+		rig.mu.Unlock()
+		if !keyed {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Error("rig still keyed after the client disconnected — the transmitter was left on air")
+}
+
 func TestModeMapping(t *testing.T) {
 	for _, c := range []struct{ adif, hamlib string }{
 		{"SSB", "USB"}, {"LSB", "LSB"}, {"CW", "CW"}, {"RTTY", "RTTY"},