fix(update): relaunch without a hidden PowerShell

Windows Defender removed 0.27.14 from a station as
Trojan:Script/Wacatac.H!ml. That detection is machine-learning, not a
signature, and the behaviour it scored is ours: an unsigned binary
replaces itself on disk, clears the mark-of-the-web, and spawns a
windowless PowerShell that waits for its own process to die before
starting another executable. Byte for byte, that is a dropper; the model
reads the shape, not the intention, and "Script/" names the PowerShell.

The wait it was written for is not needed. --post-update already makes
the new instance patient with the single-instance mutex — twenty seconds
of it — so the new exe can be started directly while this one is still
shutting down and simply wait its turn.

The deferred-swap fallback keeps its helper: nothing else on a stock
Windows can wait for a pid and then move a file over an image that is
still running. It is reached only when the rename failed, never on the
ordinary path.

changelog.json

@@ -5,12 +5,14 @@
     "en": [
       "[NEW] Typing a digital watering hole sets the mode with it. A spot click has always carried one; a frequency typed by hand carried none, so the rig stayed in SSB on 28.074 while the operator waited for decodes. Same table and same tolerance as a spot (±3 kHz of a known FT8/FT4/JS8 frequency), only towards the digital modes: tuning away from one leaves the mode alone, because there the frequency says nothing about what you mean to do.",
       "Yaesu CAT now drives the older radios. The FTDX10, FT-991A, FT-891 and FT-710 write a frequency in nine digits; everything before them — FTDX3000, FTDX5000, FTDX1200, FT-2000, FT-950, FT-450 — writes eight and answers a nine-digit command with a rejection, which is what an FTDX3000 owner saw: every FA refused and a radio that would not follow. The width is taken from the rig’s own reply rather than from a table of models, so a set is in the format that radio speaks — including models this backend has never heard of.",
-      "Yaesu: RTTY can be set on USB (Settings → CAT). ADIF records only “RTTY” and the rig has both sidebands, so the log cannot answer for it — the older RTTY-L stays the default, and a station whose FSK controller wants the upper one says so once."
+      "Yaesu: RTTY can be set on USB (Settings → CAT). ADIF records only “RTTY” and the rig has both sidebands, so the log cannot answer for it — the older RTTY-L stays the default, and a station whose FSK controller wants the upper one says so once.",
+      "The update no longer relaunches OpsLog through a hidden PowerShell. An unsigned program that replaces itself on disk, clears the mark-of-the-web and then spawns a windowless PowerShell to start another executable is — byte for byte — the shape of a dropper, and Windows Defender’s machine-learning model reads the shape, not the intention: 0.27.14 was removed from a station under Trojan:Script/Wacatac.H!ml. The new version simply starts itself and waits its turn on the single-instance lock, which it already knew how to do. Only the rare fallback path, when the running file cannot even be renamed, still needs a helper that outlives the process."
     ],
     "fr": [
       "[NEW] Taper une fréquence d’appel numérique règle le mode avec elle. Un clic sur un spot en portait un depuis toujours ; une fréquence tapée à la main n’en portait aucun, si bien que le poste restait en SSB sur 28.074 pendant qu’on attendait les décodages. Même table et même tolérance qu’un spot (±3 kHz d’une fréquence FT8/FT4/JS8 connue), et seulement vers les modes numériques : en s’en éloignant le mode n’est pas touché, car là la fréquence ne dit rien de ce qu’on veut faire.",
       "Le CAT Yaesu pilote désormais les postes plus anciens. FTDX10, FT-991A, FT-891 et FT-710 écrivent une fréquence sur neuf chiffres ; tout ce qui précède — FTDX3000, FTDX5000, FTDX1200, FT-2000, FT-950, FT-450 — l’écrit sur huit et rejette une commande à neuf chiffres. C’est ce que voyait un possesseur de FTDX3000 : chaque FA refusée et une radio qui ne suivait pas. Le format est pris dans la réponse du poste plutôt que dans une table de modèles : l’envoi part donc dans la langue de cette radio-là, y compris pour des modèles que ce backend ne connaît pas.",
-      "Yaesu : le RTTY peut être placé en USB (Réglages → CAT). L’ADIF n’enregistre que « RTTY » et le poste a les deux bandes latérales : le log ne peut pas répondre à sa place. Le RTTY-L ancien reste par défaut, et une station dont l’interface FSK veut la supérieure le dit une fois."
+      "Yaesu : le RTTY peut être placé en USB (Réglages → CAT). L’ADIF n’enregistre que « RTTY » et le poste a les deux bandes latérales : le log ne peut pas répondre à sa place. Le RTTY-L ancien reste par défaut, et une station dont l’interface FSK veut la supérieure le dit une fois.",
+      "La mise à jour ne relance plus OpsLog par un PowerShell caché. Un programme non signé qui se remplace sur le disque, efface la marque « téléchargé depuis Internet » puis lance un PowerShell sans fenêtre pour démarrer un autre exécutable a — à l’octet près — la forme d’un dropper, et le modèle d’apprentissage de Windows Defender lit la forme, pas l’intention : la 0.27.14 a été supprimée chez un OM sous Trojan:Script/Wacatac.H!ml. La nouvelle version se lance elle-même et attend son tour sur le verrou d’instance unique, ce qu’elle savait déjà faire. Seul le repli rare, quand le fichier en cours d’exécution ne peut même pas être renommé, garde un assistant qui survit au processus."
     ]
   },
   {

update.go

@@ -212,20 +212,28 @@ func (a *App) DownloadAndApplyUpdate(url string) error {
 	_ = os.Remove(exe + ":Zone.Identifier")
 	applog.Printf("update: installed new exe, scheduling relaunch")
 
-	// Relaunch via a detached, hidden PowerShell that WAITS for this process to exit
-	// (so the single-instance mutex is free) and THEN starts the new exe. Launching
-	// the new exe directly while we're still alive raced the mutex and often left
-	// nothing running; waiting for our own exit first makes the restart reliable,
-	// and the launcher outlives us.
-	quoted := strings.ReplaceAll(exe, "'", "''")
-	ps := fmt.Sprintf(
-		"Wait-Process -Id %d -ErrorAction SilentlyContinue; Start-Sleep -Milliseconds 400; Start-Process -FilePath '%s' -ArgumentList '--post-update'",
-		os.Getpid(), quoted)
-	cmd := exec.Command("powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command", ps)
+	// THE NEW EXE STARTS ITSELF. No helper, no script.
+	//
+	// This used to go through a hidden PowerShell that waited for our process to
+	// die and then launched the new image — which is, byte for byte, the shape of
+	// a dropper: an unsigned binary replaces itself on disk, clears the
+	// mark-of-the-web, and spawns a windowless PowerShell that starts another
+	// executable. Windows Defender's machine-learning model reads that shape and
+	// not our intentions, and an operator updating to 0.27.14 had OpsLog removed
+	// under Trojan:Script/Wacatac.H!ml — the "Script/" being the PowerShell.
+	//
+	// The wait it existed for is not needed: --post-update already makes the new
+	// instance patient with the single-instance mutex (see acquireInstance), so it
+	// can start while this one is still shutting down and simply wait its turn.
+	cmd := exec.Command(exe, "--post-update")
+	cmd.Dir = dir
 	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: 0x08000000} // CREATE_NO_WINDOW
 	if err := cmd.Start(); err != nil {
 		return fmt.Errorf("schedule relaunch: %w", err)
 	}
+	// Released rather than waited on: this process is about to exit, and a child
+	// that outlives its parent must not be left as a zombie handle.
+	_ = cmd.Process.Release()
 	if a.ctx != nil {
 		wruntime.Quit(a.ctx)
 	} else {
@@ -249,6 +257,12 @@ func (a *App) DownloadAndApplyUpdate(url string) error {
 // than an update that waits. Only a successful swap passes --post-update, so a
 // failure leaves the .new file in place for the next attempt rather than having
 // the cleanup delete the download.
+// The LAST resort still needs a helper that outlives this process: nothing else
+// can move a file over an image that is still running. It stays PowerShell —
+// there is no smaller tool on a stock Windows that can wait for a pid and then
+// move a file — but it is reached only when the rename above failed, which is
+// rare, and never on the ordinary update path (see the relaunch there for why
+// that matters to Defender).
 func (a *App) scheduleDeferredSwap(exe, pending string) error {
 	// Clear the "downloaded from the internet" mark before it becomes the exe —
 	// SmartScreen silently blocks a programmatic launch of a marked file, and the