Harden beacon sessions and mark automatic messages

docs/PROJECT_CONTEXT.md

@@ -215,10 +215,12 @@ CR/LF framing, XML framing, ports/transports, callsign normalization and frequen
 ## Autoanswer / Beacon
 
 - Automated-message loops must be prevented.
-- Cooldown/minimum-interval rules must be preserved.
+- Every user-visible automatic chat message generated by KST4Contest ends with the exact suffix ` *a*`: generic and QRG-specific automatic replies, `//VER` replies and both category beacons. Automatic replies retain their `[KST4C Automsg]` prefix as the loop guard. The suffix is appended unconditionally after message construction or beacon variable resolution; manual messages and internal login, keepalive and control frames are unchanged. Beacon content remains limited to 120 characters before the suffix, making 124 characters the final transmitted maximum.
+- Cooldown/minimum-interval rules must be preserved. The shared beacon interval has a hard minimum of five minutes; older stored values below five are normalized while loading.
 - A reply rejected before a complete valid TX item is queued must not consume cooldown.
-- Both category beacons share one timer, while their enable flags and templates remain profile-scoped and independent. The enable flags are observable runtime preferences: Settings changes and the `MyBeacon` status-chip action update them immediately, and every timer run reads their current values without restarting the timer or causing an immediate transmission. Only the explicit full settings write persists those flags; layout autosave deliberately leaves the on-disk functional state untouched.
-- `MyBeacon` owns one aggregate thread-status entry for both categories (`off`, a partial `enabled/available` count, `on`, or `FAILED`). Its action disables all currently usable beacons if any is enabled, otherwise it enables all currently usable beacons. A disabled second chat is not usable and its dormant enable flag must not be changed by the aggregate action. Category-specific timer failures remain authoritative while the affected beacon stays active; independent switch changes cannot hide them. The status bar resolves the aggregate from current controller state when a queued UI update is applied, so a delayed timer snapshot cannot overwrite a newer manual switch. Open Settings views observe the same preference values, so changes from the status chip remain synchronized without a parallel UI state.
+- Both category beacons share one timer, while their message templates remain profile-scoped and independent. `BeaconSessionState` is the authoritative owner of activation, per-category QRG references, deactivation reasons and send failures. Activations are never restored from XML: both start off after program startup and every profile switch, remain unchanged during an ON4KST reconnect in the same application session, and are projected into the legacy observable preference booleans for Settings/UI compatibility. Full preference writes emit both legacy/current enable tags as `false`.
+- Enabling validates QRG placeholders across either template: `MYQRG` and `MYQRGSHORT` require a valid primary QRG; `SECONDQRG` requires a valid secondary QRG. A template without a QRG placeholder may be enabled without a current QRG, and the first later valid own-category QRG establishes its reference. A valid manual QRG change always rebases the corresponding active beacon. A UCXLog or Win-Test update more than 5,000 Hz away from the reference disables only that category; exactly 5,000 Hz remains allowed. Without SO2R, logger updates reach the primary category only; with SO2R each radio/category is handled independently. A missing/invalid required QRG disables an active beacon, while an invalid own QRG without a QRG placeholder only clears its reference.
+- `MyBeacon` owns one structured aggregate thread-status snapshot for both categories (`off`, `1/2`, `on`, or `FAILED`). Its action disables all currently usable beacons if any is enabled, otherwise it attempts to enable each usable beacon independently, so one invalid category can remain off. The tooltip derives the state or last general deactivation reason for each category from the same snapshot. Active states use the dedicated green treatment with a 200 ms orange activity flash; `off` keeps a neutral surface with red text; `FAILED` uses a persistent red surface with white text and suppresses the activity flash. Other thread-status chips keep their existing styling.
 - Current implementation/tests define the exact message markers and timer details.
 
 ## Build / Verification
@@ -417,10 +419,21 @@ Before implementing planned items, re-check current decisions and obtain a fresh
 - Historical project context is useful but may be stale; current code/tests win.
 - External service/API behaviour must be verified against current upstream documentation when uncertain.
 - Screenshots in manuals/website may need targeted replacement after visible UI changes; never fabricate them.
+- `client_settings_window_beacon.png` was recaptured from the current Compose UI in a live application session on 2026-11-13. It shows both beacons disabled after a profile switch and the five-minute minimum interval.
 - `station_map_path_analysis.png` and `station_map_reset.png` predate the current header controls, callsign-only markers, shared station context menu and Worked-square overlay. The former remains useful only where the visible analysis panel itself is the subject. `station_map_spatial_filters.png` is the current general map screenshot shared by the DE/EN interface manuals and the website through `/manual/assets/`.
 
 ## Recent Significant Changes
 
+### 2026-11-13 – Automatic chat messages marked with a suffix
+
+- Generic and QRG-specific automatic replies, `//VER` replies and both beacons now carry the exact ` *a*` suffix. Existing auto-reply loop protection remains based on `[KST4C Automsg]`; manual chat and ON4KST control traffic are unchanged.
+- Beacon templates and resolved payloads retain the 120-character limit. The fixed suffix is added afterwards, so a transmitted beacon may contain up to 124 characters.
+
+### 2026-11-12 – Beacon activation and QRG safety made session-scoped
+
+- Beacon activation is now explicit per application session, while ordinary ON4KST reconnects preserve it. Per-category references distinguish deliberate manual QRG changes from UCXLog/Win-Test moves and disable only the affected beacon after a change greater than 5 kHz.
+- The structured aggregate beacon status keeps per-category deactivation reasons and drives the dedicated green/orange/red `MyBeacon` chip without changing other thread-status chips.
+
 ### 2026-10-17 – Repository moved to the HamRadioOnline organisation
 
 - The GitHub repository moved from `praktimarc/kst4contest` to `HamRadioOnline/kst4contest`. GitHub redirects the old repository, Pages, API and git URLs, so published links and release assets from before the move keep working.