Complete redesign of the audio watermark system. The previous time-domain
PN chip correlator failed over the FM air channel due to non-linear clock
drift between TX and RX sample clocks, destroying bit-boundary alignment
and producing ~50% BER (random).

The new system embeds the watermark in STFT magnitudes (frequency domain),
eliminating all sample-clock sensitivity. Based on:

 D. Kirovski, H.S. Malvar, "Spread-Spectrum Watermarking of Audio Signals"
 IEEE Trans. Signal Processing, Vol. 51, No. 4, April 2003

Architecture:

 Encoder (generator.go, two-pass):
 Audio → Stages 1-3 (LPF, drive, clip, cleanup)
 → Decimate ÷19 → 12 kHz mono
 → STFT (512-point Hann, hop=256, 21ms frames)
 → Magnitude × (1 ± 0.059) per PN chip (0.5 dB, multiplicative)
 → ISTFT → difference → ZOH ×19 → interpolation LPF@5.5kHz
 → add to L/R → Stages 4-6 (stereo encode, composite clip, pilot, RDS)

 Decoder (wmdecode, key-free):
 Recording → LPF@5.5kHz → decimate to 12 kHz
 → STFT (same parameters)
 → Cepstrum filter (DCT, zero first 8 coefficients → -6 dB carrier noise)
 → Cycle-offset search (6400 candidates, ~70s for 20-min recording)
 → PN correlation → 128 soft bit decisions
 → RS(16,8) Vandermonde decode → 64-bit fingerprint

Key properties:

 - Multiplicative embedding: watermark scales with audio content.
 Loud audio masks stronger watermark, silence gets zero watermark.
 No gate needed (old system required silence gate to prevent audibility).
 - Block repetition R=5: each PN chip repeated across 5 consecutive
 STFT frames. Detection uses center frame only. Tolerates ±2 frames
 (±43ms) of timing drift without any clock recovery.
 - Fixed PN sequence: spreading code is public (seed "fmrtx-stft-pn-v1"),
 enabling blind fingerprint extraction without knowing the license key.
 Key identity is carried solely in the RS-encoded payload.
 - PCC covert channel: PN partitioned into 128 subsets (one per data bit),
 permuted across the watermark cycle for localized-damage resilience.

Parameters:

 WMRate: 12000 Hz (228000/19, 192000/16 — exact both sides)
 FFT: 512-point, Hann window, hop=256 (50% overlap)
 Sub-band: bins 9-213 (200-5000 Hz), 204 frequency chips/frame
 Embedding: 0.5 dB (multiplicative, 0.00 dB RMS change on audio)
 Spreading: 204 bins × 10 groups/bit = 2040 chips/bit (33 dB gain)
 Block rep: R=5 (±2 frame drift tolerance)
 Payload: RS(16,8) → 64 bit fingerprint (SHA-256 truncated)
 WM cycle: 136.5 seconds
 Decode margin: ~19 dB over noise floor at 0.5 dB embedding

Over-the-air results (PlutoSDR TX → SDRplay RX, 102.8 MHz):

 BER: 0/128
 Erasures: 0
 avg|c|: 2260
 Spectrum: clean, no artifacts above 6 kHz

Bug fixes included:

 - RS decoder: replaced Forney formula (used α^pos instead of α^(15-pos)
 due to polynomial convention mismatch) with Vandermonde Gaussian
 elimination solver. The Horner-method syndrome computation uses
 C(x) = c[0]x^15 + ... + c[15], mapping byte position j to polynomial
 power (15-j). Forney was using α^j as the error locator instead of
 α^(15-j), producing wrong correction magnitudes for all erasure
 configurations.

 - Generator decimation: anti-alias LPF was applied only to every 19th
 sample instead of all composite-rate samples. IIR filter state was
 updated only at 12 kHz effective rate, producing incorrect filtering.
 Fixed: LPF processes all 228 kHz samples, then decimate.

 - ZOH spectral images: zero-order hold upsample (12k→228k) created
 images at 12k, 24k, 36k Hz, leaking into pilot/stereo-sub/RDS bands.
 Fixed: separate interpolation LPF@5.5kHz on the upsample path.

 - Detect() single-cycle bug: iterated over groups (one frame per group)
 instead of all recording frames. Longer recordings did not improve
 SNR. Fixed: iterate all frames with modular wrapping for automatic
 multi-cycle averaging.

New files:
 internal/dsp/fft.go Radix-2 Cooley-Tukey FFT/IFFT
 internal/watermark/stft_watermark.go STFT embedder + detector
 internal/watermark/stft_roundtrip_test.go

Changed files:
 internal/watermark/watermark.go RS Vandermonde fix, accessor methods
 internal/offline/generator.go Two-pass architecture, STFT overlay
 cmd/wmdecode/main.go Complete rewrite, key-free extraction
 cmd/fmrtx/main.go Remove old watermark log + import

Removed:
 Old time-domain Embedder, gate, pulse-shaping LPF, PN sequence,
 ChipRate/Level/RecordingRate constants, DiagnosticState

Add an STFT watermark path inspired by Kirovski & Malvar, including the frequency-domain embedder/decoder, FFT support, and round-trip coverage. Wire the generator and CLI tools to use the new analysis/synthesis flow for watermark experiments on the watermark-rework branch.

Wire tone frequency, tone amplitude, and audio gain through the live control path so the UI's live-update behavior matches the engine.

This changes the generator live params to carry tone and gain values, propagates them through Engine.UpdateConfig and txBridge.UpdateConfig, and extends the control-plane patch types accordingly.

It also refines the control API behavior:
- avoid holding the server config mutex across tx.UpdateConfig()
- report live=true only when a request contains at least one genuinely live-applicable field

Together these fixes align the UI semantics with the actual runtime behavior and remove a lock hazard in the config update path.

Introduce an optional ITU-R BS.412 MPX power limiter, tighten the low-pass/notch filter design around the protected composite path, and document the full DSP architecture and recommended Pluto configuration in detail.

Rework the DSP chain to a clip-filter-clip architecture with cascaded 14 kHz low-pass stages, double 19/57 kHz protection notches, fixed pilot/RDS injection semantics, and explicit MPX gain calibration support. Update config defaults and tests to match the new broadcast-style modulation budgeting and protected composite path.

Upgrade the audio path to a broadcast-style chain with a 4th-order 15 kHz low-pass, 19 kHz pilot notch, audio-only composite clipping, and post-clip protection notches at 19/57 kHz before adding clean pilot and RDS carriers. This reorders the processing so pilot and RDS stay fixed and unclipped while audio dynamics are constrained within the available modulation budget.

Add a lock-free stdin PCM ingest path, streaming resampler, stereo-linked limiting and pre-MPX audio filtering, plus the engine/control wiring needed to drive live audio into TX mode. Also document the ingest API and include a helper batch script for piping ffmpeg audio into fmrtx.

All major TX parameters are now hot-swappable during transmission:
- DSP params (drive, stereo, pilot, RDS levels, limiter) via
 atomic.Pointer[LiveParams], loaded once per chunk (~50ms)
- RDS text (PS, RT) via atomic.Value in encoder, applied at
 RDS group boundaries (~88ms)
- TX frequency via driver.Tune(), applied between chunks

Zero locks in DSP path. HTTP handler writes atomics, run loop
reads them. Validation happens before store.

New: SoapyDriver.Tune() for live frequency changes.
New: LiveConfigUpdate/LivePatch types for type-safe patching.
New: 4 engine tests for live DSP/freq/RDS updates + validation.

=== SIGNAL PATH (fixes audible/measurable on HW) ===

[CRITICAL] stereo: fix 38kHz subcarrier 1-sample phase offset
  Encode() called Sample() before capturing Phase(), so the 38kHz
  subcarrier used phase_{n+1} while pilot used phase_n — a constant
  60° phase error at 228kHz, degrading stereo separation to ~50%.
  Now captures phase BEFORE tick; stores lastPhase for coherent
  RDS carrier derivation.

[HIGH] rds: phase-lock 57kHz carrier to pilot via StereoEncoder
  RDS encoder had its own free-running 57kHz oscillator instead of
  deriving from 3×pilot. Two independent float64 oscillators drift
  apart over hours. Added NextSampleWithCarrier(carrier float64),
  generator now passes stereoEncoder.RDSCarrier() (sin(3·pilotPhase))
  so all subcarriers share one phase reference. NextSample() remains
  as backward-compat fallback with internal carrier.

[MEDIUM] dsp/fmmod: fix phase wrapping for negative phase
  Wrap condition only triggered on phase > pi. Negative phase from
  negative-biased composite could grow unbounded, losing float64
  precision after extended runtime. Now wraps on |phase| > pi.

[MEDIUM] dsp/oscillator: phase wrapping handles both directions
  Same pattern as fmmod — only wrapped positive overflow. Now wraps
  on phase >= 1 OR phase < 0 for defensive robustness.

=== DAUERLAUF / SBC STABILITY ===

[HIGH] offline/generator: eliminate per-chunk allocation (912KB @ 2.28MHz)
  GenerateFrame() allocated a new []IQSample every call. At Pluto
  rate (2.28MHz, 50ms chunks) that's 114k*8=912KB * 20/sec = 18MB/s
  garbage, causing GC pauses and hardware underruns on Raspi.
  Now pre-allocates frameBuf, reuses across calls. Grow-only policy,
  never shrinks. Safe because driver.Write() is blocking.

[MEDIUM] output/file: batch-write entire frame in one syscall
  Was writing 8 bytes per sample = 114k syscalls per chunk on Pluto.
  Now serializes into a reusable byte buffer, single file.Write().
  Orders of magnitude faster on Raspi SD-card I/O.

[MEDIUM] app/engine: add error backoff in TX loop
  run() tight-looped at 100% CPU on persistent driver errors
  (hardware disconnect, USB reset). Now backs off by chunkDuration
  per error using select with ctx.Done() for clean cancellation.

[MEDIUM] app/engine: replace time.Sleep shutdown with sync.WaitGroup
  Stop() used time.Sleep(2*chunkDuration) hoping run() would exit.
  Race condition if hardware Write() stalls. Now uses wg.Wait() for
  deterministic goroutine join before Flush/Stop.

=== CORRECTNESS / HYGIENE ===

[LOW] rds/normalize: filter to ASCII, prevent mid-rune truncation
  normalizePS truncated at 8 bytes, not 8 characters. UTF-8 input
  (e.g. umlauts) could split mid-rune producing corrupt RDS bitstream.
  Now replaces non-ASCII with space before truncation.

[LOW] offline/generator: increment frame sequence counter
  Sequence was hardcoded to 1 on every frame, useless for debugging.
  Now increments per GenerateFrame() call.

[LOW] control: document that config PATCH doesn't reach running engine
  Added TODO noting that POST /config updates server's copy only;
  running Engine/Generator holds its own snapshot.

[COSMETIC] dsp/preemphasis: remove dead fields y1, a1
  PreEmphasis.y1 and .a1 were never read in Process(). Removed from
  struct, constructor, and Reset(). Fixed misleading doc comment on
  PreEmphasizedSource (claims audio-rate, actually composite-rate).

Files changed:
  internal/stereo/encoder.go      - phase coherence fix
  internal/rds/encoder.go         - pilot-locked carrier API
  internal/rds/normalize.go       - ASCII safety
  internal/offline/generator.go   - buffer reuse + sequence + doc
  internal/dsp/fmmod.go           - bidirectional phase wrap
  internal/dsp/oscillator.go      - bidirectional phase wrap
  internal/dsp/preemphasis.go     - dead field removal
  internal/output/file.go         - batch write
  internal/app/engine.go          - WaitGroup + backoff
  internal/control/control.go     - TODO config propagation

Keep frame sequence numbers monotonic, lock the RDS carrier to the exact pilot phase used by the stereo encoder, and apply the accompanying DSP/control cleanups needed for stable live transmission behaviour.

Keep DSP state persistent across generated frames, move the RDS encoder to arbitrary sample-rate operation, and tune the Pluto profile to the working 2.28 MHz path with the levels that finally decode reliably.

Replace the pilot-derived RDS path with a PiFmRds-style 228 kHz shaped biphase generator, resample it into the composite loop, and retune Pluto example levels plus spectral thresholds around the new RDS behaviour.

Drive RDS in the offline/MPX path from the pilot-locked 57 kHz carrier with biphase symbol timing, and adjust Pluto example levels plus spectral thresholds for the new multiplex behaviour.