feat: ON AIR status-bar badge + auto-updater UI (10-min check, progress)

ON AIR badge (bottom status bar, shown when live-status publishing is on): a
blinking red light + "On air" when a QSO was logged in the last 5 min, dim
"Offline" otherwise. Seeded at launch from LiveLastQSOAgeSec so it's right
immediately, flips online on qso:logged, expires via a 10s tick.

Auto-updater UI: the update check now also runs every 10 minutes, and the
update notification downloads and installs in-app — a live progress bar
(update:progress) then OpsLog restarts on the new build. Falls back to opening
the release page when there's no auto-download asset or on error (retry).
Regenerated bindings for DownloadAndApplyUpdate / LiveLastQSOAgeSec.

app.go

@@ -505,6 +505,7 @@ type App struct {
 	liveFreqHz         int64      // last freq/band/mode the UI reported (fallback when CAT is off)
 	liveBand           string
 	liveMode           string
+	liveLastQSOAt      time.Time  // when this operator last logged a NEW contact — drives online/offline
 	awardSnapMu        sync.Mutex // guards the award QSO snapshot
 	awardSnap          []qso.QSO  // light-scanned + enriched logbook snapshot reused across award computations
 	awardSnapRev       string     // logbook revision the snapshot was built at ("" = none)
@@ -1850,13 +1851,12 @@ func (a *App) AddQSO(q qso.QSO) (id int64, err error) {
 	a.refineDistrictZones(&q)          // W6 → CQ3/ITU6 for zone-split countries
 	a.applyQSLDefaults(&q)
 	a.applySolar(&q) // stamp SFI / A / K (and SSN as an extra) from live space-weather
-	// Fill the contacted operator's e-mail from the (cached) lookup so the
-	// recording can be auto-sent. Cheap: the entry already looked the call up.
-	if strings.TrimSpace(q.Email) == "" && a.lookup != nil {
-		if lr, e := a.lookup.Lookup(a.ctx, q.Callsign); e == nil && lr.Email != "" {
-			q.Email = lr.Email
-		}
-	}
+	// NOTE: the contacted operator's e-mail already rides in on the QSO — the entry
+	// lookup (when you typed the call) fetched it along with name/QTH/grid and the
+	// form carries it here. There is deliberately NO second lookup at log time: it
+	// was redundant with the entry lookup and only slowed logging (a call not yet in
+	// the cache made AddQSO wait on QRZ/HamQTH). If the entry lookup hadn't finished
+	// when you logged (fast CW: type → Enter), the e-mail is simply blank — fine.
 	id, err = a.qso.Add(a.ctx, q)
 	if err != nil && db.IsConnLost(err) {
 		// The database is UNREACHABLE (not a data error) — park the QSO in the
@@ -1872,6 +1872,7 @@ func (a *App) AddQSO(q qso.QSO) (id int64, err error) {
 	if err == nil {
 		q.ID = id
 		a.noteWorked(q.Callsign, q.Band, q.Mode) // keep the alert worked-index fresh
+		a.noteLiveQSO()                           // multi-op: flip this operator back "online"
 		// Announce the log so UI widgets can react (e.g. the Flex panel zeroing RIT).
 		wruntime.EventsEmit(a.ctx, "qso:logged", id)
 		a.saveQSORecording(&q)
@@ -4528,7 +4529,16 @@ func (a *App) GetQSORate() QSORate {
 	if a.qso == nil {
 		return QSORate{}
 	}
-	counts, err := a.qso.RecentRate(a.ctx, time.Now(), 10*time.Minute, 60*time.Minute)
+	// Per-operator on a shared logbook: count only the ACTIVE profile's operator
+	// so each op sees their own performance, not the cumulative station rate. An
+	// empty operator (single-op / station owner) matches all their QSOs.
+	operator := ""
+	if a.profiles != nil {
+		if p, err := a.profiles.Active(a.ctx); err == nil {
+			operator = p.Operator
+		}
+	}
+	counts, err := a.qso.RecentRate(a.ctx, time.Now(), operator, 10*time.Minute, 60*time.Minute)
 	if err != nil || len(counts) < 2 {
 		return QSORate{}
 	}
@@ -5292,7 +5302,14 @@ func (a *App) LookupCallsign(callsign string) (lookup.Result, error) {
 	if a.lookup == nil {
 		return lookup.Result{}, fmt.Errorf("lookup not initialized")
 	}
-	r, err := a.lookup.Lookup(a.ctx, callsign)
+	// Bound the whole lookup: give the providers a couple of seconds, then let
+	// Lookup fall through to cty.dat (country/zones). Without this a call that isn't
+	// in QRZ.com — or a slow/unresponsive provider — left the "looking up" spinner
+	// turning for 10 s+ before the cty.dat fallback showed. The providers respect
+	// the context, so they're cancelled at the deadline and cty.dat answers instantly.
+	ctx, cancel := context.WithTimeout(a.ctx, 2*time.Second)
+	defer cancel()
+	r, err := a.lookup.Lookup(ctx, callsign)
 	if errors.Is(err, lookup.ErrNotFound) {
 		return lookup.Result{}, fmt.Errorf("callsign not found")
 	}
@@ -5822,8 +5839,10 @@ func (a *App) saveQSORecording(q *qso.QSO) {
 		if q.Extras == nil {
 			q.Extras = map[string]string{}
 		}
-		q.Extras["APP_OPSLOG_RECORDING"] = name
-		if err := a.qso.Update(a.ctx, *q); err != nil {
+		q.Extras["APP_OPSLOG_RECORDING"] = name // in-memory copy for the encode goroutine
+		// Persist ONLY this extras key (targeted) — a full-row Update from this
+		// in-memory copy could revert a column a concurrent post-log action changed.
+		if err := a.qso.SetExtra(a.ctx, q.ID, "APP_OPSLOG_RECORDING", name); err != nil {
 			applog.Printf("qso-rec: store recording path: %v", err)
 		}
 	}
@@ -6695,17 +6714,10 @@ func (a *App) markRecordingSent(id int64) {
 	if a.qso == nil || id == 0 {
 		return
 	}
-	q, err := a.qso.GetByID(a.ctx, id)
-	if err != nil {
-		applog.Printf("qso-rec: mark sent: load %d: %v", id, err)
-		return
-	}
-	if q.Extras == nil {
-		q.Extras = map[string]string{}
-	}
-	q.Extras["APP_OPSLOG_RECORDING_SENT"] = time.Now().UTC().Format("2006-01-02")
-	if err := a.qso.Update(a.ctx, q); err != nil {
-		applog.Printf("qso-rec: mark sent: update %d: %v", id, err)
+	// Targeted extras write — never a full-row Update, which (from a stale copy)
+	// could revert a clublog/qrz upload-status another action just stamped.
+	if err := a.qso.SetExtra(a.ctx, id, "APP_OPSLOG_RECORDING_SENT", time.Now().UTC().Format("2006-01-02")); err != nil {
+		applog.Printf("qso-rec: mark sent %d: %v", id, err)
 	}
 }
 
@@ -9277,6 +9289,7 @@ func (a *App) LogUDPLoggedADIF(adifText string) (int64, error) {
 		return 0, fmt.Errorf("insert qso: %w", err)
 	}
 	q.ID = id
+	a.noteLiveQSO() // multi-op: flip this operator back "online"
 	a.saveQSORecording(&q)
 	if a.extsvc != nil {
 		a.extsvc.OnQSOLogged(id)

app_qsl_designer.go

@@ -437,17 +437,16 @@ func (a *App) SendEQSL(qsoID int64, templateID int64, jpegB64 string) error {
 		applog.Printf("qsl: send eQSL to %s (%s) failed: %v", to, q.Callsign, err)
 		return err
 	}
-	// Record WHEN OpsLog e-mailed its own QSL card, in a dedicated app field —
-	// NOT the ADIF eqsl_sent flag, which belongs to eQSL.cc and must stay
-	// independent. q came straight from GetByID, so a full Update rewrites the
-	// row unchanged apart from this field.
-	if q.Extras == nil {
-		q.Extras = map[string]string{}
-	}
-	q.Extras[appQSLCardSentField] = time.Now().UTC().Format(time.RFC3339)
-	if err := a.qso.Update(a.ctx, q); err != nil {
-		applog.Printf("qsl: eQSL sent to %s but marking failed: %v", q.Callsign, err)
-		return fmt.Errorf("eQSL sent but status not saved: %w", err)
+	// Record WHEN OpsLog e-mailed its own QSL card, in a dedicated app field — NOT
+	// the ADIF eqsl_sent flag, which belongs to eQSL.cc and must stay independent.
+	//
+	// Stamp ONLY this extras key (targeted UPDATE), never a full-row write. The `q`
+	// read up top is now stale after the slow e-mail send, and rewriting the whole
+	// row would revert any column an auto-upload changed meanwhile — that's how
+	// sending a QSL card was flipping clublog_qso_upload_status back from Y to R.
+	if err := a.qso.SetExtra(a.ctx, qsoID, appQSLCardSentField, time.Now().UTC().Format(time.RFC3339)); err != nil {
+		applog.Printf("qsl: card sent to %s but marking failed: %v", q.Callsign, err)
+		return fmt.Errorf("QSL card sent but status not saved: %w", err)
 	}
 	applog.Printf("qsl: eQSL sent to %s (%s)", to, q.Callsign)
 	wruntime.EventsEmit(a.ctx, "qsl:sent", qsoID)

frontend/src/App.tsx

@@ -13,7 +13,7 @@ import {
   GetQSO, UpdateQSO, DeleteQSO, DeleteQSOs, DeleteAllQSO,
   UpdateQSOsFromCty, UpdateQSOsFromQRZ, UpdateQSOsFromClublog, UploadQSOsManual, SendQSORecordingEmail,
   LookupCallsign, GetStationSettings, GetListsSettings,
-  GetStartupStatus, CheckForUpdate,
+  GetStartupStatus, CheckForUpdate, DownloadAndApplyUpdate,
   WorkedBefore,
   SetCompactMode,
   GetCATState, SetCATFrequency, SetCATMode, SwitchCATRig, FlexApplyBandAntenna,
@@ -42,7 +42,7 @@ import {
   QSOAudioBegin, QSOAudioCancel, QSOAudioRestart, QSOAudioResetClock,
   GetAwardDefs,
   GetUIPref,
-  ReportLiveActivity,
+  ReportLiveActivity, GetLiveStatusEnabled, LiveLastQSOAgeSec,
   AwardRefsForQSOs,
 } from '../wailsjs/go/main/App';
 import { Combobox } from '@/components/ui/combobox';
@@ -605,6 +605,11 @@ export default function App() {
     QSOAudioResetClock().then((active) => { setRecording(active); setRecTick((t) => t + 1); }).catch(() => {});
   };
   const [saving, setSaving] = useState(false);
+  // Synchronous re-entrancy guard: `saving` is React state (updates async), so it
+  // can't stop a burst of Enter presses / clicks fired before the re-render — each
+  // would run a full AddQSO and log the SAME contact several times when a slow QRZ
+  // lookup made the log take seconds. This ref blocks the repeat immediately.
+  const savingRef = useRef(false);
   const [filterCallsign, setFilterCallsign] = useState('');
   // Advanced filter builder (replaces the old band/mode dropdowns).
   const [filterOpen, setFilterOpen] = useState(false);
@@ -1086,6 +1091,30 @@ export default function App() {
   const [showSettings, setShowSettings] = useState(false);
   // Re-read the "beam on map" toggle when Preferences closes (it's edited there).
   useEffect(() => { if (!showSettings) setShowBeamOnMap(localStorage.getItem('opslog.showBeamOnMap') !== '0'); }, [showSettings]);
+  // "ON AIR" status-bar badge: mirrors the multi-op live status this operator
+  // publishes — online (blinking) when a QSO was logged in the last 5 min, else
+  // offline. Only shown when live-status publishing is enabled (Settings→General).
+  const [liveStatusOn, setLiveStatusOn] = useState(false);
+  const [onAir, setOnAir] = useState(false);
+  const lastQsoAtRef = useRef(0);
+  useEffect(() => { if (!showSettings) GetLiveStatusEnabled().then((v) => setLiveStatusOn(!!v)).catch(() => {}); }, [showSettings]);
+  useEffect(() => {
+    const LIVE_WINDOW = 5 * 60 * 1000; // 5 min, matches the backend
+    const evalOnAir = () => setOnAir(liveStatusOn && lastQsoAtRef.current > 0 && (Date.now() - lastQsoAtRef.current) < LIVE_WINDOW);
+    const off = EventsOn('qso:logged', () => { lastQsoAtRef.current = Date.now(); evalOnAir(); });
+    // Seed from the DB at launch so a QSO logged just before starting OpsLog still
+    // counts (otherwise the badge showed offline until the next contact).
+    LiveLastQSOAgeSec().then((sec: number) => {
+      if (typeof sec === 'number' && sec >= 0) {
+        const at = Date.now() - sec * 1000;
+        if (at > lastQsoAtRef.current) lastQsoAtRef.current = at;
+        evalOnAir();
+      }
+    }).catch(() => {});
+    evalOnAir();
+    const id = window.setInterval(evalOnAir, 10 * 1000); // flip to offline within ~10s of the window elapsing
+    return () => { off(); window.clearInterval(id); };
+  }, [liveStatusOn]);
   // QSO-rate meter (10/60 min) in the header — opt-in via Settings→General.
   const [showQsoRate, setShowQsoRate] = useState(() => localStorage.getItem('opslog.showQsoRate') === '1');
   useEffect(() => { if (!showSettings) setShowQsoRate(localStorage.getItem('opslog.showQsoRate') === '1'); }, [showSettings]);
@@ -1106,15 +1135,39 @@ export default function App() {
   const [showDeleteAll, setShowDeleteAll] = useState(false);
   const [showAbout, setShowAbout] = useState(false);
   const [showDuplicates, setShowDuplicates] = useState(false);
-  const [updateInfo, setUpdateInfo] = useState<{ latest: string; url: string } | null>(null);
-  // Check GitHub for a newer release once at startup (unless disabled in
-  // General); surface a toast if one exists. Best effort — silent on failure.
+  const [updateInfo, setUpdateInfo] = useState<{ latest: string; url: string; downloadUrl: string } | null>(null);
+  const [updating, setUpdating] = useState(false);
+  const [updateProgress, setUpdateProgress] = useState(0);
+  const [updateError, setUpdateError] = useState('');
+  // Check GitHub for a newer release at startup AND every 10 minutes (unless
+  // disabled in General). Best effort — silent on failure.
   useEffect(() => {
     if (localStorage.getItem('opslog.checkUpdates') === '0') return;
-    CheckForUpdate().then((u: any) => {
-      if (u?.available && u?.latest) setUpdateInfo({ latest: String(u.latest), url: String(u.url ?? '') });
+    const check = () => CheckForUpdate().then((u: any) => {
+      if (u?.available && u?.latest) setUpdateInfo({ latest: String(u.latest), url: String(u.url ?? ''), downloadUrl: String(u.download_url ?? '') });
     }).catch(() => {});
+    check();
+    const id = window.setInterval(check, 10 * 60 * 1000);
+    return () => window.clearInterval(id);
   }, []);
+  // Live download progress for the in-app updater.
+  useEffect(() => {
+    const off = EventsOn('update:progress', (p: any) => setUpdateProgress(Math.max(0, Math.min(100, Number(p) || 0))));
+    return () => { off(); };
+  }, []);
+  // startUpdate downloads the new build in-app and (on success) swaps + relaunches.
+  // Falls back to opening the release page when the release has no auto-download asset.
+  const startUpdate = useCallback(async () => {
+    if (!updateInfo) return;
+    if (!updateInfo.downloadUrl) { if (updateInfo.url) BrowserOpenURL(updateInfo.url); return; }
+    setUpdating(true); setUpdateProgress(0); setUpdateError('');
+    try {
+      await DownloadAndApplyUpdate(updateInfo.downloadUrl); // app quits + relaunches on success
+    } catch (e: any) {
+      setUpdateError(String(e?.message ?? e));
+      setUpdating(false);
+    }
+  }, [updateInfo]);
   const [deletingAll, setDeletingAll] = useState(false);
   const [ctyRefreshing, setCtyRefreshing] = useState(false);
   const [refsDownloading, setRefsDownloading] = useState(false);
@@ -1153,6 +1206,10 @@ export default function App() {
   const [lookupError, setLookupError] = useState('');
   const lookupTimerRef = useRef<number | null>(null);
   const wbTimerRef = useRef<number | null>(null);
+  // Bumped whenever the entry is cleared (ESC) or a new call starts, so a still
+  // in-flight lookup discards its result when it finally returns instead of
+  // re-populating a field the operator just cleared.
+  const lookupGenRef = useRef(0);
   const [wb, setWb] = useState<WB | null>(null);
   const [wbBusy, setWbBusy] = useState(false);
 
@@ -2155,7 +2212,9 @@ export default function App() {
   }, [spots]);
 
   async function save() {
+    if (savingRef.current) return; // a log is already in flight — ignore the repeat
     if (!callsign.trim()) { setError('Callsign required'); return; }
+    savingRef.current = true;
     setSaving(true); setError('');
     try {
       const freqHz = freqMhz.trim() ? Math.round(parseFloat(freqMhz) * 1_000_000) : undefined;
@@ -2225,13 +2284,21 @@ export default function App() {
       await refresh();
     } catch (e: any) {
       setError(String(e?.message ?? e));
-    } finally { setSaving(false); }
+    } finally { setSaving(false); savingRef.current = false; }
   }
 
   // resetEntry clears the form for the next QSO. Triggered after a
   // successful log AND by ESC. Locked values (band/mode/freq/start/end)
   // are preserved so backdated batches stay productive.
   function resetEntry() {
+    // Stop any callsign lookup DEAD: cancel the pending debounce, hide the "looking
+    // up" spinner immediately, and invalidate any request already in flight so its
+    // late result can't re-fill the field we're about to clear (the "ESC clears the
+    // QSO but the QRZ lookup keeps going" bug).
+    if (lookupTimerRef.current) { window.clearTimeout(lookupTimerRef.current); lookupTimerRef.current = null; }
+    if (wbTimerRef.current) { window.clearTimeout(wbTimerRef.current); wbTimerRef.current = null; }
+    lookupGenRef.current++;
+    setLookupBusy(false);
     // Discard any in-progress QSO recording (no-op if it was already saved on
     // log, or if the recorder is off).
     QSOAudioCancel(); setRecording(false); recordingCallRef.current = "";
@@ -2436,14 +2503,15 @@ export default function App() {
   }
   async function runLookup(call: string) {
     if (call !== lastLookedUpRef.current) resetAutoFill();
+    const gen = lookupGenRef.current; // invalidated by ESC / resetEntry
     setLookupBusy(true);
     try {
       const r = await LookupCallsign(call);
       // Discard a STALE result: the operator already moved to another call
-      // (clicked a new spot / typed) while this lookup was in flight. Applying it
-      // would clobber the current call's fields and zoom the map to the wrong
-      // station — the bug where replacing a call didn't re-zoom the map.
-      if (call !== callsignValRef.current.trim().toUpperCase()) return;
+      // (clicked a new spot / typed) OR cleared the entry (ESC) while this lookup
+      // was in flight. Applying it would clobber the current fields and zoom the
+      // map to the wrong station.
+      if (gen !== lookupGenRef.current || call !== callsignValRef.current.trim().toUpperCase()) return;
       lastLookedUpRef.current = call;
       // cty.dat carries ONLY DXCC-entity data (country / CQ / ITU zones / continent).
       // A QRZ/HamQTH hit is far richer (name, QTH, grid, address, image). When the
@@ -2496,9 +2564,15 @@ export default function App() {
         QSOAudioBegin().then(setRecording).catch(() => {});
       }
     } catch (e: any) {
-      setLookupResult(null);
-      setLookupError(String(e?.message ?? e));
-    } finally { setLookupBusy(false); }
+      if (gen === lookupGenRef.current && call === callsignValRef.current.trim().toUpperCase()) {
+        setLookupResult(null);
+        setLookupError(String(e?.message ?? e));
+      }
+    } finally {
+      // Only clear the spinner if we're still the current lookup — a newer one
+      // (or an ESC that already reset it) owns the busy state otherwise.
+      if (gen === lookupGenRef.current) setLookupBusy(false);
+    }
   }
   function scheduleLookup(value: string, force?: boolean) {
     setLookupError('');
@@ -2879,12 +2953,12 @@ export default function App() {
   );
   const rstTxBlock = (
     <div className="flex flex-col w-20"><Label className="mb-1 h-3.5">{t('field.rstTx')}</Label>
-      <Combobox value={rstSent} options={rstOptions(mode, rstLists)} allowFreeText commitOnType onChange={(v) => { setRstSent(v); rstUserEditedRef.current = true; }} />
+      <Combobox value={rstSent} options={rstOptions(mode, rstLists)} commitOnType onChange={(v) => { setRstSent(v); rstUserEditedRef.current = true; }} />
     </div>
   );
   const rstRxBlock = (
     <div className="flex flex-col w-20"><Label className="mb-1 h-3.5">{t('field.rstRx')}</Label>
-      <Combobox value={rstRcvd} options={rstOptions(mode, rstLists)} allowFreeText commitOnType onChange={(v) => { setRstRcvd(v); rstUserEditedRef.current = true; }} />
+      <Combobox value={rstRcvd} options={rstOptions(mode, rstLists)} commitOnType onChange={(v) => { setRstRcvd(v); rstUserEditedRef.current = true; }} />
     </div>
   );
   // DX country flag, shown large next to RST (moved here from the Country field).
@@ -3914,22 +3988,42 @@ export default function App() {
           <div className="flex items-start gap-2">
             <div className="size-2.5 mt-1 rounded-full bg-primary shrink-0 animate-pulse" />
             <div className="min-w-0 flex-1">
-              <p className="text-sm font-semibold">OpsLog v{updateInfo.latest} available</p>
-              <p className="text-xs text-muted-foreground">You're on v{APP_VERSION}.</p>
-              <div className="mt-2 flex items-center gap-2">
-                <button
-                  onClick={() => { if (updateInfo.url) BrowserOpenURL(updateInfo.url); setUpdateInfo(null); }}
-                  className="h-7 px-3 rounded-md bg-primary text-primary-foreground text-xs font-medium hover:opacity-90">
-                  Download
-                </button>
-                <button onClick={() => setUpdateInfo(null)} className="h-7 px-2 text-xs text-muted-foreground hover:text-foreground">
-                  Later
-                </button>
-              </div>
+              <p className="text-sm font-semibold">{t('upd.available', { v: updateInfo.latest })}</p>
+              <p className="text-xs text-muted-foreground">{t('upd.current', { v: APP_VERSION })}</p>
+
+              {updating ? (
+                <div className="mt-2">
+                  <div className="flex items-center justify-between text-[11px] text-muted-foreground mb-1">
+                    <span>{updateProgress >= 100 ? t('upd.installing') : t('upd.downloading')}</span>
+                    <span className="tabular-nums">{updateProgress}%</span>
+                  </div>
+                  <div className="h-2 w-full rounded-full bg-muted overflow-hidden">
+                    <div className="h-full bg-primary transition-[width] duration-150" style={{ width: `${updateProgress}%` }} />
+                  </div>
+                  <p className="mt-1 text-[10px] text-muted-foreground">{t('upd.restartNote')}</p>
+                </div>
+              ) : updateError ? (
+                <div className="mt-2">
+                  <p className="text-[11px] text-destructive break-words">{updateError}</p>
+                  <div className="mt-1.5 flex items-center gap-2">
+                    <button onClick={startUpdate} className="h-7 px-3 rounded-md bg-primary text-primary-foreground text-xs font-medium hover:opacity-90">{t('upd.retry')}</button>
+                    {updateInfo.url && <button onClick={() => BrowserOpenURL(updateInfo.url)} className="h-7 px-2 text-xs text-muted-foreground hover:text-foreground">{t('upd.browser')}</button>}
+                  </div>
+                </div>
+              ) : (
+                <div className="mt-2 flex items-center gap-2">
+                  <button onClick={startUpdate} className="h-7 px-3 rounded-md bg-primary text-primary-foreground text-xs font-medium hover:opacity-90">
+                    {updateInfo.downloadUrl ? t('upd.install') : t('upd.download')}
+                  </button>
+                  <button onClick={() => setUpdateInfo(null)} className="h-7 px-2 text-xs text-muted-foreground hover:text-foreground">{t('upd.later')}</button>
+                </div>
+              )}
             </div>
-            <button onClick={() => setUpdateInfo(null)} className="text-muted-foreground hover:text-foreground shrink-0" title="Dismiss">
-              <X className="size-4" />
-            </button>
+            {!updating && (
+              <button onClick={() => setUpdateInfo(null)} className="text-muted-foreground hover:text-foreground shrink-0" title="Dismiss">
+                <X className="size-4" />
+              </button>
+            )}
           </div>
         </div>
       )}
@@ -4854,6 +4948,16 @@ export default function App() {
               disabled={!rotatorHeading.enabled}
               onClick={() => { setSettingsSection('rotator'); setShowSettings(true); }}
             />
+            {liveStatusOn && (
+              <div
+                className={cn('inline-flex items-center gap-1.5 rounded-md border px-2 py-0.5 text-[11px] font-bold uppercase tracking-wider shrink-0 transition-colors',
+                  onAir ? 'border-danger-border bg-danger-muted text-danger-muted-foreground' : 'border-border text-muted-foreground')}
+                title={onAir ? t('live.onAirTip') : t('live.offlineTip')}
+              >
+                <span className={cn('size-2 rounded-full', onAir ? 'bg-danger animate-pulse' : 'bg-muted-foreground/40')} />
+                {onAir ? t('live.onAir') : t('live.offline')}
+              </div>
+            )}
             {/* Toasts / errors: the status bar's free space is far wider than the
                 header band they used to sit in. Still one line (the bar is 28px),
                 but CLICK opens the full text wrapped — long messages (a TQSL or

frontend/src/components/QSOEditModal.tsx

@@ -412,9 +412,9 @@ export function QSOEditModal({ qso, onSave, onDelete, onClose, countries = [], b
                     value={draft.callsign ?? ''} onChange={(e) => set('callsign', e.target.value)} />
                 </div>
                 <div className="flex flex-col w-20"><Label>S</Label>
-                  <Combobox value={draft.rst_sent ?? ''} options={rstOptions(draft.mode ?? '', rstLists)} allowFreeText commitOnType onChange={(v) => set('rst_sent', v)} /></div>
+                  <Combobox value={draft.rst_sent ?? ''} options={rstOptions(draft.mode ?? '', rstLists)} commitOnType onChange={(v) => set('rst_sent', v)} /></div>
                 <div className="flex flex-col w-20"><Label>R</Label>
-                  <Combobox value={draft.rst_rcvd ?? ''} options={rstOptions(draft.mode ?? '', rstLists)} allowFreeText commitOnType onChange={(v) => set('rst_rcvd', v)} /></div>
+                  <Combobox value={draft.rst_rcvd ?? ''} options={rstOptions(draft.mode ?? '', rstLists)} commitOnType onChange={(v) => set('rst_rcvd', v)} /></div>
                 <Button type="button" variant="outline" className="h-10" onClick={fetchLookup} disabled={looking}
                   title={t('qedit.fetchTitle')}>
                   {looking ? <Loader2 className="size-4 animate-spin" /> : <Search className="size-4" />} {t('qedit.fetch')}

frontend/src/components/StatsPanel.tsx

@@ -52,11 +52,14 @@ const nf = (n: number) => n.toLocaleString('en-US');
 
 // ── Shell ────────────────────────────────────────────────────────────────────
 
-function Card({ title, sub, children, className }: { title: string; sub?: string; children: React.ReactNode; className?: string }) {
+function Card({ title, sub, children, className, accent = 'var(--chart-1)' }: { title: string; sub?: string; children: React.ReactNode; className?: string; accent?: string }) {
   return (
-    <section className={cn('rounded-lg border border-border bg-card p-3.5 flex flex-col min-w-0', className)}>
+    <section className={cn('rounded-xl border border-border bg-card p-3.5 flex flex-col min-w-0 shadow-sm', className)}>
       <header className="mb-3 shrink-0">
-        <h3 className="text-[11px] font-semibold uppercase tracking-wider text-muted-foreground">{title}</h3>
+        <h3 className="flex items-center gap-1.5 text-[11px] font-semibold uppercase tracking-wider text-muted-foreground">
+          <span className="size-1.5 rounded-full shrink-0" style={{ background: accent }} />
+          {title}
+        </h3>
         {sub && <p className="text-[11px] text-muted-foreground/80 mt-0.5">{sub}</p>}
       </header>
       {children}
@@ -64,14 +67,22 @@ function Card({ title, sub, children, className }: { title: string; sub?: string
   );
 }
 
-// A headline number IS the chart — a one-bar bar chart would be noise.
-function StatTile({ label, value, sub }: { label: string; value: string; sub?: string }) {
+// A headline number IS the chart — a one-bar bar chart would be noise. Each tile
+// carries an accent (a categorical chart hue or a semantic token): a soft tint
+// wash + a left accent bar give it a colourful identity, while the number itself
+// stays in high-contrast foreground ink so it reads on every theme.
+function StatTile({ label, value, sub, accent = 'var(--chart-1)' }: { label: string; value: string; sub?: string; accent?: string }) {
   return (
-    <div className="rounded-lg border border-border bg-card px-4 py-3 min-w-0">
-      <p className="text-[11px] font-semibold uppercase tracking-wider text-muted-foreground truncate">{label}</p>
-      {/* Proportional figures: tabular-nums makes a big standalone number look loose. */}
-      <p className="mt-1 text-[28px] leading-none font-semibold text-foreground">{value}</p>
-      {sub && <p className="mt-1 text-[11px] text-muted-foreground truncate">{sub}</p>}
+    <div className="relative overflow-hidden rounded-xl border border-border bg-card px-4 py-3 min-w-0 shadow-sm">
+      <div className="pointer-events-none absolute inset-0 opacity-[0.08]" style={{ background: accent }} />
+      <div className="pointer-events-none absolute -right-5 -top-7 size-20 rounded-full blur-xl opacity-[0.14]" style={{ background: accent }} />
+      <div className="absolute left-0 inset-y-0 w-1" style={{ background: accent }} />
+      <div className="relative">
+        <p className="text-[11px] font-semibold uppercase tracking-wider text-muted-foreground truncate">{label}</p>
+        {/* Proportional figures: tabular-nums makes a big standalone number look loose. */}
+        <p className="mt-1 text-[28px] leading-none font-semibold text-foreground">{value}</p>
+        {sub && <p className="mt-1 text-[11px] text-muted-foreground truncate">{sub}</p>}
+      </div>
     </div>
   );
 }
@@ -80,7 +91,7 @@ function StatTile({ label, value, sub }: { label: string; value: string; sub?: s
 // One series → one hue. The value is direct-labelled, so no reader ever depends
 // on a tooltip to get a number.
 
-function HBars({ data, max, empty, share, labelWidth = 'w-20' }: { data: Bucket[]; max?: number; empty: string; share?: boolean; labelWidth?: string }) {
+function HBars({ data, max, empty, share, labelWidth = 'w-20', colorful, color = 'var(--chart-1)' }: { data: Bucket[]; max?: number; empty: string; share?: boolean; labelWidth?: string; colorful?: boolean; color?: string }) {
   // max is a display cap for long tails (top entities). Where EVERY row matters —
   // the operators of a multi-op — it is deliberately not set: a capped chart would
   // silently drop the 9th operator, and "who worked what" is the whole question.
@@ -90,13 +101,13 @@ function HBars({ data, max, empty, share, labelWidth = 'w-20' }: { data: Bucket[
   if (top.length === 0) return <p className="text-[11px] text-muted-foreground italic py-4 text-center">{empty}</p>;
   return (
     <div className="flex flex-col gap-1.5 min-w-0">
-      {top.map((d) => (
+      {top.map((d, i) => (
         <div key={d.key} className="group flex items-center gap-2 min-w-0" title={`${d.key} — ${nf(d.count)}`}>
           <span className={`${labelWidth} shrink-0 truncate text-[11px] text-muted-foreground text-right`} title={d.key}>{d.key}</span>
           <div className="flex-1 min-w-0 h-[14px] flex items-center">
             <div
               className="h-[10px] rounded-r-[4px] transition-[width] duration-300"
-              style={{ width: `${Math.max(2, (d.count / peak) * 100)}%`, background: 'var(--chart-1)' }}
+              style={{ width: `${Math.max(2, (d.count / peak) * 100)}%`, background: colorful ? `var(--chart-${(i % 8) + 1})` : color }}
             />
           </div>
           <span className="w-14 shrink-0 text-[11px] text-foreground text-right tabular-nums">{nf(d.count)}</span>
@@ -629,12 +640,12 @@ export function StatsPanel() {
 
       {/* Headline figures: stat tiles, not a grouped bar chart. */}
       <div className="grid grid-cols-2 md:grid-cols-5 gap-2.5 mb-3">
-        <StatTile label={t('stats.qsos')} value={nf(stats.total)} sub={span} />
-        <StatTile label={t('stats.uniqueCalls')} value={nf(stats.unique_calls)} />
-        <StatTile label={t('stats.entities')} value={nf(stats.entities)} sub="DXCC" />
-        <StatTile label={t('stats.continents')} value={nf(stats.continents)} sub="/ 7" />
+        <StatTile label={t('stats.qsos')} value={nf(stats.total)} sub={span} accent="var(--chart-1)" />
+        <StatTile label={t('stats.uniqueCalls')} value={nf(stats.unique_calls)} accent="var(--chart-2)" />
+        <StatTile label={t('stats.entities')} value={nf(stats.entities)} sub="DXCC" accent="var(--chart-5)" />
+        <StatTile label={t('stats.continents')} value={nf(stats.continents)} sub="/ 7" accent="var(--chart-8)" />
         <StatTile label={t('stats.confirmed')} value={`${stats.total ? ((stats.confirmed_any / stats.total) * 100).toFixed(0) : 0}%`}
-          sub={`${nf(stats.confirmed_any)} / ${nf(stats.total)}`} />
+          sub={`${nf(stats.confirmed_any)} / ${nf(stats.total)}`} accent="var(--success)" />
       </div>
 
       {/* Period / contest block — ONLY when a window is selected. "12 QSO/h" across
@@ -723,43 +734,43 @@ export function StatsPanel() {
         </div>
       ) : (
         <div className="grid grid-cols-1 lg:grid-cols-2 gap-2.5">
-          <Card title={t('stats.byBand')} sub={t('stats.byBandSub')}>
+          <Card title={t('stats.byBand')} sub={t('stats.byBandSub')} accent="var(--chart-3)">
             <VBars data={stats.by_band} empty={empty} showValues colorful />
           </Card>
-          <Card title={t('stats.byMode')}>
-            <HBars data={stats.by_mode} max={8} empty={empty} />
+          <Card title={t('stats.byMode')} accent="var(--chart-2)">
+            <HBars data={stats.by_mode} max={8} empty={empty} colorful />
           </Card>
 
-          <Card title={t('stats.overTime')} sub={t('stats.overTimeSub')} className="lg:col-span-2">
+          <Card title={t('stats.overTime')} sub={t('stats.overTimeSub')} className="lg:col-span-2" accent="var(--chart-1)">
             <AreaTrend data={stats.by_month} empty={empty} />
           </Card>
 
           {/* EVERY operator, never a top-N: on a multi-op contest the point is who
               worked what, and a cap would quietly delete the 9th operator. Scrolls
               instead of truncating. */}
-          <Card title={t('stats.byOperator')}>
+          <Card title={t('stats.byOperator')} accent="var(--chart-5)">
             <div className="max-h-[240px] overflow-auto pr-1 min-w-0">
-              <HBars data={stats.by_operator} empty={empty} share />
+              <HBars data={stats.by_operator} empty={empty} share color="var(--chart-5)" />
             </div>
           </Card>
-          <Card title={t('stats.byContinent')} sub={t('stats.byContinentSub')}>
+          <Card title={t('stats.byContinent')} sub={t('stats.byContinentSub')} accent="var(--chart-6)">
             <Donut data={stats.by_continent} empty={empty} />
           </Card>
 
-          <Card title={t('stats.topEntities')}>
-            <HBars data={stats.top_entities} max={12} empty={empty} labelWidth="w-40" />
+          <Card title={t('stats.topEntities')} accent="var(--chart-4)">
+            <HBars data={stats.top_entities} max={12} empty={empty} labelWidth="w-40" color="var(--chart-4)" />
           </Card>
           <div className="flex flex-col gap-2.5 min-w-0">
-            <Card title={t('stats.confirmations')} className="flex-1">
+            <Card title={t('stats.confirmations')} className="flex-1" accent="var(--success)">
               <div className="flex flex-col gap-3 justify-center flex-1">
                 <Meter label="LoTW" value={stats.confirmed_lotw} total={stats.total} />
                 <Meter label="eQSL" value={stats.confirmed_eqsl} total={stats.total} />
                 <Meter label={t('stats.paperQSL')} value={stats.confirmed_qsl} total={stats.total} />
               </div>
             </Card>
-            <Card title={t('stats.byStation')}>
+            <Card title={t('stats.byStation')} accent="var(--chart-8)">
               <div className="max-h-[140px] overflow-auto pr-1 min-w-0">
-                <HBars data={stats.by_station} empty={empty} share />
+                <HBars data={stats.by_station} empty={empty} share color="var(--chart-8)" />
               </div>
             </Card>
           </div>

frontend/src/components/ui/combobox.tsx

@@ -64,7 +64,17 @@ export function Combobox({
         // Focus selects the text so a keystroke replaces it — but does NOT
         // open the list (so tabbing in doesn't pop the dropdown).
         onFocus={(e) => { setQuery(value); e.currentTarget.select(); }}
-        onChange={(e) => { setQuery(e.target.value); setOpen(true); if (commitOnType) onChange(e.target.value); }}
+        onChange={(e) => {
+          const v = e.target.value;
+          setQuery(v);
+          setOpen(true);
+          // Commit-on-type pushes the value live to the parent (so a CW macro sent
+          // without leaving the field uses what was just typed). With free text that's
+          // any input; a restricted field (allowFreeText=false) commits ONLY a value
+          // that's actually in the list, so a half-typed or invalid report never
+          // becomes the committed value — blur then reverts the leftover text.
+          if (commitOnType && (allowFreeText || options.some((o) => o.toLowerCase() === v.trim().toLowerCase()))) onChange(v);
+        }}
         onBlur={onBlur}
         onKeyDown={(e) => {
           if ((e.key === 'ArrowDown' || e.key === 'Alt') && !open) { setOpen(true); }

frontend/src/lib/i18n.tsx

@@ -14,6 +14,14 @@ type Dict = Record<string, string>;
 const en: Dict = {
   // Menu bar
   'prop.title': 'Propagation', 'prop.geomag': 'Geomag', 'prop.refresh': 'Refresh space weather',
+  'live.onAir': 'On air', 'live.offline': 'Offline',
+  'live.onAirTip': 'On air — a QSO was logged in the last 5 minutes (published to the live status)',
+  'live.offlineTip': 'Offline — no QSO logged in the last 5 minutes',
+  'upd.available': 'OpsLog v{v} available', 'upd.current': "You're on v{v}.",
+  'upd.install': 'Update now', 'upd.download': 'Download', 'upd.later': 'Later',
+  'upd.downloading': 'Downloading…', 'upd.installing': 'Installing…',
+  'upd.restartNote': 'OpsLog will restart on the new version.',
+  'upd.retry': 'Retry', 'upd.browser': 'Open page',
   'rate.title': 'QSO rate (QSOs/hour) — projected from the last 10 / 60 minutes',
   'lotw.userTip': 'LoTW user — last upload {date} ({days} days ago)',
   'menu.file': 'File', 'menu.edit': 'Edit', 'menu.view': 'View', 'menu.tools': 'Tools',
@@ -324,6 +332,9 @@ const en: Dict = {
 
 const fr: Dict = {
   'prop.title': 'Propagation', 'prop.geomag': 'Géomag', 'prop.refresh': 'Actualiser la météo spatiale',
+  'live.onAir': 'On air', 'live.offline': 'Hors ligne',
+  'live.onAirTip': "On air — un QSO a été loggé dans les 5 dernières minutes (publié dans le statut live)",
+  'live.offlineTip': 'Hors ligne — aucun QSO loggé depuis 5 minutes',
   'rate.title': 'Rythme QSO (QSO/heure) — projeté sur les 10 / 60 dernières minutes',
   'lotw.userTip': 'Utilisateur LoTW — dernier upload {date} (il y a {days} j)',
   'menu.file': 'Fichier', 'menu.edit': 'Édition', 'menu.view': 'Affichage', 'menu.tools': 'Outils',

frontend/src/version.ts

@@ -1,6 +1,6 @@
 // Single source of truth for the app version shown in the UI (header + About).
 // Bump this on a release (the release script updates it alongside telemetry.go).
-export const APP_VERSION = '0.20.0';
+export const APP_VERSION = '0.20.1';
 
 // Author / credits, shown in Help -> About.
 export const APP_AUTHOR = 'F4BPO';

frontend/wailsjs/go/main/App.d.ts

@@ -146,6 +146,8 @@ export function DismissAwardUpdate(arg1:string):Promise<void>;
 
 export function DownloadAllReferenceLists():Promise<string>;
 
+export function DownloadAndApplyUpdate(arg1:string):Promise<void>;
+
 export function DownloadClublogCty():Promise<main.ClublogCtyInfo>;
 
 export function DownloadConfirmations(arg1:string,arg2:boolean,arg3:string):Promise<void>;
@@ -546,6 +548,8 @@ export function ListTQSLStationLocations():Promise<Array<extsvc.StationLocation>
 
 export function ListUDPIntegrations():Promise<Array<udp.Config>>;
 
+export function LiveLastQSOAgeSec():Promise<number>;
+
 export function LoTWUserInfo(arg1:string):Promise<lotwusers.Info>;
 
 export function LogUDPLoggedADIF(arg1:string):Promise<number>;

frontend/wailsjs/go/main/App.js

@@ -250,6 +250,10 @@ export function DownloadAllReferenceLists() {
   return window['go']['main']['App']['DownloadAllReferenceLists']();
 }
 
+export function DownloadAndApplyUpdate(arg1) {
+  return window['go']['main']['App']['DownloadAndApplyUpdate'](arg1);
+}
+
 export function DownloadClublogCty() {
   return window['go']['main']['App']['DownloadClublogCty']();
 }
@@ -1050,6 +1054,10 @@ export function ListUDPIntegrations() {
   return window['go']['main']['App']['ListUDPIntegrations']();
 }
 
+export function LiveLastQSOAgeSec() {
+  return window['go']['main']['App']['LiveLastQSOAgeSec']();
+}
+
 export function LoTWUserInfo(arg1) {
   return window['go']['main']['App']['LoTWUserInfo'](arg1);
 }

frontend/wailsjs/go/models.ts

@@ -2763,6 +2763,7 @@ export namespace main {
 	    latest: string;
 	    available: boolean;
 	    url: string;
+	    download_url: string;
 	
 	    static createFrom(source: any = {}) {
 	        return new UpdateInfo(source);
@@ -2774,6 +2775,7 @@ export namespace main {
 	        this.latest = source["latest"];
 	        this.available = source["available"];
 	        this.url = source["url"];
+	        this.download_url = source["download_url"];
 	    }
 	}
 	export class WKMacro {

internal/cat/icomnet.go

@@ -136,6 +136,11 @@ type icomNet struct {
 	// but link fine" (stay connected) from "link dead" (reconnect). See Alive().
 	lastRx atomic.Int64
 
+	// dead is set when the rig explicitly tears the session down (control 0x05):
+	// Alive() then returns false immediately so ReadState fails on the next poll and
+	// the manager reconnects cleanly, instead of waiting out the 6 s lastRx timeout.
+	dead atomic.Bool
+
 	// audio is the optional RX audio stream (UDP 50003). nil when audio is off.
 	// Torn down alongside the CI-V/control streams in Close.
 	audio *icomAudio
@@ -178,6 +183,9 @@ func (n *icomNet) markRx() { n.lastRx.Store(time.Now().UnixNano()) }
 // the radio — is gone. Independent of CI-V replies, so a powered-off rig still
 // reads as Alive and the session isn't torn down. Satisfies aliveTransport.
 func (n *icomNet) Alive() bool {
+	if n.dead.Load() {
+		return false // rig sent an explicit disconnect — reconnect now, don't wait
+	}
 	last := n.lastRx.Load()
 	if last == 0 {
 		return true // just connected, nothing received yet — give it a chance
@@ -292,6 +300,7 @@ func (n *icomNet) ctrlPump() {
 					n.ctrlResend(icnLE.Uint16(buf[6:]))
 				}
 			case 0x05: // rig-initiated disconnect — it dropped US
+				n.dead.Store(true) // make Alive() fail now → prompt clean reconnect
 				debugLog.Printf("icom net: rig sent DISCONNECT on control stream — session dropped by the rig")
 			default:
 				// Anything else on the control stream is (almost always) the rig's
@@ -367,6 +376,7 @@ func (n *icomNet) civPump() {
 					n.resend(icnLE.Uint16(buf[6:]))
 				}
 			case typ == 0x05: // rig-initiated disconnect — it dropped US
+				n.dead.Store(true) // make Alive() fail now → prompt clean reconnect
 				debugLog.Printf("icom net: rig sent DISCONNECT on CI-V stream — session dropped by the rig")
 			case typ == 0x00 && k > 0x15 && buf[0x10] == 0xc1: // CI-V data
 				n.trackRxSeq(icnLE.Uint16(buf[6:])) // note gaps for retransmit

internal/cat/omnirig.go

@@ -32,6 +32,7 @@ type OmniRig struct {
 	omnirig *ole.IDispatch
 	rig     *ole.IDispatch
 	lastSig string // last logged Split/VFO signature — only log on change
+	rigType string // OmniRig's RigType string (the .ini title), e.g. "IC-7610"
 
 	// lastSetFreq is the frequency most recently COMMANDED via SetFrequency.
 	// SetMode uses it to pick USB vs LSB for "SSB" instead of reading OmniRig's
@@ -80,11 +81,20 @@ func (o *OmniRig) Connect() error {
 	o.rig = rigVar.ToIDispatch()
 
 	if rt, err := oleutil.GetProperty(o.rig, "RigType"); err == nil {
-		debugLog.Printf("OmniRig connected to Rig%d type=%q", o.RigNum, rt.ToString())
+		o.rigType = rt.ToString()
+		debugLog.Printf("OmniRig connected to Rig%d type=%q", o.RigNum, o.rigType)
 	}
 	return nil
 }
 
+// isIC7610 reports whether the connected rig is an IC-7610. OmniRig's generic
+// Freq property reads the wrong VFO on the 7610 (its Main/Sub model confuses the
+// stock ini), so we read VFO A explicitly for it instead — matching what Log4OM
+// shows.
+func (o *OmniRig) isIC7610() bool {
+	return strings.Contains(strings.ToUpper(o.rigType), "7610")
+}
+
 func (o *OmniRig) Disconnect() {
 	if o.rig != nil {
 		o.rig.Release()
@@ -199,6 +209,12 @@ func (o *OmniRig) ReadState() (RigState, error) {
 		s.Split = false
 		s.RxFreqHz = 0
 		s.FreqHz = freqMain
+		// IC-7610 quirk: OmniRig's generic Freq reports VFO B (its Main/Sub model
+		// confuses the stock ini), so OpsLog showed the wrong VFO. Read VFO A
+		// explicitly for the 7610 — what the operator actually wants to see.
+		if o.isIC7610() && freqA != 0 {
+			s.FreqHz = freqA
+		}
 		if s.FreqHz == 0 {
 			if s.Vfo == "B" || s.Vfo == "BB" {
 				s.FreqHz = freqB

internal/extsvc/manager.go

@@ -89,6 +89,9 @@ type Manager struct {
 	rnd *rand.Rand
 }
 
+// maxUploadAttempts bounds retries of a transient upload failure.
+const maxUploadAttempts = 4
+
 func NewManager(deps Deps) *Manager {
 	if deps.Client == nil {
 		deps.Client = &http.Client{Timeout: 20 * time.Second}
@@ -101,6 +104,24 @@ func NewManager(deps Deps) *Manager {
 	}
 }
 
+// attemptUpload uploads a QSO in its OWN goroutine and, on a TRANSIENT failure
+// (rate-limit / network), re-arms itself with exponential back-off. Each upload is
+// independent — never serialised through a shared worker, because a single slow
+// upload (LoTW signs via TQSL; a service on a 30 s timeout) would otherwise block
+// every following QSO's upload and strand them all at "R" (the regression that hit
+// the operator on the newest build while everyone on the old concurrent path was
+// fine).
+func (m *Manager) attemptUpload(svc Service, id int64, cfg ServiceConfig, attempt int) {
+	go func() {
+		ok, retryable := m.upload(svc, id, cfg)
+		if !ok && retryable && attempt+1 < maxUploadAttempts {
+			backoff := time.Duration(1<<uint(attempt)) * time.Second // 1s, 2s, 4s…
+			m.logf("extsvc: %s upload of QSO %d will retry (attempt %d) in %s", svc, id, attempt+2, backoff)
+			time.AfterFunc(backoff, func() { m.attemptUpload(svc, id, cfg, attempt+1) })
+		}
+	}()
+}
+
 func (m *Manager) logf(format string, args ...any) {
 	if m.deps.Logf != nil {
 		m.deps.Logf(format, args...)
@@ -175,15 +196,17 @@ func (m *Manager) route(svc Service, id int64, cfg ServiceConfig) {
 	m.scheduleUpload(svc, id, cfg)
 }
 
-// scheduleUpload either uploads now (immediate) or arms a timer (delayed).
+// scheduleUpload uploads now (immediate) or after a random fuse (delayed). Each
+// upload runs in its own goroutine (attemptUpload) — never serialised — so a slow
+// one never holds up the rest.
 func (m *Manager) scheduleUpload(svc Service, id int64, cfg ServiceConfig) {
 	if cfg.UploadMode == ModeDelayed {
 		d := m.delaySeconds()
 		m.logf("extsvc: %s upload of QSO %d scheduled in %s", svc, id, d)
-		time.AfterFunc(d, func() { m.upload(svc, id, cfg) })
+		time.AfterFunc(d, func() { m.attemptUpload(svc, id, cfg, 0) })
 		return
 	}
-	go m.upload(svc, id, cfg)
+	m.attemptUpload(svc, id, cfg, 0)
 }
 
 // onCloseServices returns the services configured for on-close auto-upload,
@@ -243,25 +266,25 @@ func (m *Manager) FlushOnClose() int {
 			uploaded += m.flushLoTWBatch(ids, cfg.LoTW)
 		case ServiceQRZ:
 			for _, id := range ids {
-				if m.upload(svc, id, cfg.QRZ) {
+				if ok, _ := m.upload(svc, id, cfg.QRZ); ok {
 					uploaded++
 				}
 			}
 		case ServiceClublog:
 			for _, id := range ids {
-				if m.upload(svc, id, cfg.Clublog) {
+				if ok, _ := m.upload(svc, id, cfg.Clublog); ok {
 					uploaded++
 				}
 			}
 		case ServiceHRDLog:
 			for _, id := range ids {
-				if m.upload(svc, id, cfg.HRDLog) {
+				if ok, _ := m.upload(svc, id, cfg.HRDLog); ok {
 					uploaded++
 				}
 			}
 		case ServiceEQSL:
 			for _, id := range ids {
-				if m.upload(svc, id, cfg.EQSL) {
+				if ok, _ := m.upload(svc, id, cfg.EQSL); ok {
 					uploaded++
 				}
 			}
@@ -312,12 +335,16 @@ func (m *Manager) flushLoTWBatch(ids []int64, cfg ServiceConfig) int {
 // upload performs the actual push and returns true on success. It builds a
 // fresh, lifecycle-independent context so a delayed upload still completes
 // even if it fires close to shutdown.
-func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
+// upload performs one upload. It returns ok=true when the QSO was uploaded (and
+// marked), and retryable=true when it failed in a way worth retrying later (an
+// HTTP/service error such as a rate-limit 403) as opposed to a permanent skip
+// (not eligible, wrong station callsign, no record).
+func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) (ok bool, retryable bool) {
 	// Skip QSOs that aren't eligible (already sent, or sent status doesn't
 	// match the configured Upload flag).
 	if m.deps.ShouldUpload != nil && !m.deps.ShouldUpload(svc, id) {
 		m.logf("extsvc: %s upload of QSO %d skipped (not eligible)", svc, id)
-		return false
+		return false, false
 	}
 
 	// Station-callsign guard. Each logbook belongs to one callsign:
@@ -345,7 +372,7 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 			if m.deps.NotifyError != nil {
 				m.deps.NotifyError(svc, id, err)
 			}
-			return false
+			return false, false
 		}
 	}
 
@@ -360,7 +387,7 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		record, ok := m.deps.BuildADIF(id, cfg.ForceStationCallsign)
 		if !ok {
 			m.logf("extsvc: %s upload of QSO %d skipped (no record)", svc, id)
-			return false
+			return false, false
 		}
 		res, err = UploadQRZ(ctx, m.deps.Client, cfg.APIKey, record)
 	case ServiceClublog:
@@ -369,7 +396,7 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		record, ok := m.deps.BuildADIF(id, "")
 		if !ok {
 			m.logf("extsvc: %s upload of QSO %d skipped (no record)", svc, id)
-			return false
+			return false, false
 		}
 		res, err = UploadClublog(ctx, m.deps.Client, cfg, record)
 	case ServiceLoTW:
@@ -378,7 +405,7 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		record, ok := m.deps.BuildADIF(id, cfg.ForceStationCallsign)
 		if !ok {
 			m.logf("extsvc: %s upload of QSO %d skipped (no record)", svc, id)
-			return false
+			return false, false
 		}
 		res, err = UploadLoTW(ctx, cfg, "", record)
 	case ServiceHRDLog:
@@ -387,7 +414,7 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		record, ok := m.deps.BuildADIF(id, "")
 		if !ok {
 			m.logf("extsvc: %s upload of QSO %d skipped (no record)", svc, id)
-			return false
+			return false, false
 		}
 		res, err = UploadHRDLog(ctx, m.deps.Client, cfg.Callsign, cfg.Code, record)
 	case ServiceEQSL:
@@ -396,11 +423,11 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		record, ok := m.deps.BuildADIF(id, "")
 		if !ok {
 			m.logf("extsvc: %s upload of QSO %d skipped (no record)", svc, id)
-			return false
+			return false, false
 		}
 		res, err = UploadEQSL(ctx, m.deps.Client, cfg.Username, cfg.Password, cfg.QTHNickname, record)
 	default:
-		return false
+		return false, false
 	}
 
 	if err != nil || !res.OK {
@@ -411,12 +438,12 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		if m.deps.NotifyError != nil {
 			m.deps.NotifyError(svc, id, err)
 		}
-		return false
+		return false, true // transient (rate-limit / network) → worth a retry
 	}
 
 	m.logf("extsvc: %s upload of QSO %d OK (logid=%q)", svc, id, res.LogID)
 	if m.deps.MarkUploaded != nil {
 		m.deps.MarkUploaded(svc, id, res.LogID)
 	}
-	return true
+	return true, false
 }

internal/qso/qso.go

@@ -781,6 +781,38 @@ func (r *Repo) BulkSetField(ctx context.Context, ids []int64, column, value stri
 	return n, nil
 }
 
+// SetExtra merges ONE key into a QSO's extras JSON without rewriting the rest of
+// the row. A slow caller that only wants to stamp its own app field (e-mailing a
+// QSL card, saving a recording) must not do a full-row Update: the row it read may
+// be seconds stale, and writing it all back silently reverts any column another
+// action changed meanwhile — e.g. an auto-upload flipping clublog_qso_upload_status
+// from R to Y. Touching only `extras` makes that impossible. Empty value deletes
+// the key.
+func (r *Repo) SetExtra(ctx context.Context, id int64, key, value string) error {
+	if id == 0 || strings.TrimSpace(key) == "" {
+		return fmt.Errorf("missing id or key")
+	}
+	var extrasJSON sql.NullString
+	if err := r.db.QueryRowContext(ctx, `SELECT extras FROM qso WHERE id = ?`, id).Scan(&extrasJSON); err != nil {
+		return fmt.Errorf("load extras: %w", err)
+	}
+	m := decodeExtras(extrasJSON.String)
+	if m == nil {
+		m = map[string]string{}
+	}
+	if value == "" {
+		delete(m, key)
+	} else {
+		m[key] = value
+	}
+	if _, err := r.db.ExecContext(ctx,
+		`UPDATE qso SET extras = ?, updated_at = ? WHERE id = ?`,
+		encodeExtras(m), db.NowISO(), id); err != nil {
+		return fmt.Errorf("set extra %s: %w", key, err)
+	}
+	return nil
+}
+
 // Update overwrites all editable fields of an existing QSO. updated_at is bumped.
 func (r *Repo) Update(ctx context.Context, q QSO) error {
 	if q.ID == 0 {
@@ -1863,26 +1895,59 @@ func (r *Repo) Count(ctx context.Context) (int64, error) {
 	return n, err
 }
 
+// LastQSOTime returns the start time of the most recently LOGGED QSO for an
+// operator (highest id wins) — used to seed the live "on air" state at launch so an
+// operator who just worked someone before (re)starting OpsLog shows online right
+// away instead of waiting for their next QSO. Empty operator matches every QSO.
+func (r *Repo) LastQSOTime(ctx context.Context, operator string) (time.Time, bool) {
+	rows, err := r.db.QueryContext(ctx, `SELECT operator, qso_date FROM qso ORDER BY id DESC LIMIT 400`)
+	if err != nil {
+		return time.Time{}, false
+	}
+	defer rows.Close()
+	opFilter := strings.ToUpper(strings.TrimSpace(operator))
+	for rows.Next() {
+		var oper, dateStr sql.NullString
+		if err := rows.Scan(&oper, &dateStr); err != nil {
+			return time.Time{}, false
+		}
+		if strings.ToUpper(strings.TrimSpace(oper.String)) != opFilter {
+			continue
+		}
+		if t := parseTimeLoose(dateStr.String).UTC(); !t.IsZero() {
+			return t, true
+		}
+	}
+	return time.Time{}, false
+}
+
 // RecentRate counts QSOs whose start time falls within each trailing window from
-// `now` — the live "QSO rate" meter shown in the header. It scans only the most
-// recently inserted rows (ORDER BY id DESC LIMIT), since any QSO in the last hour
-// was inserted recently; that keeps it cheap even on a large log. qso_date is the
-// repo's text column, parsed with parseTimeLoose (backend-format agnostic).
-func (r *Repo) RecentRate(ctx context.Context, now time.Time, windows ...time.Duration) ([]int, error) {
+// `now` — the live "QSO rate" meter shown in the header. When operator is non-empty
+// (multi-op on a shared logbook) only that operator's QSOs are counted, so each op
+// sees their OWN performance, not the cumulative rate; empty operator matches every
+// QSO. It scans only the most recently inserted rows (ORDER BY id DESC LIMIT), since
+// any QSO in the last hour was inserted recently; that keeps it cheap even on a large
+// log. qso_date is the repo's text column, parsed with parseTimeLoose (backend-format
+// agnostic).
+func (r *Repo) RecentRate(ctx context.Context, now time.Time, operator string, windows ...time.Duration) ([]int, error) {
 	counts := make([]int, len(windows))
-	// 400 rows covers a full hour even at a blistering contest rate (>300/h); any
-	// QSO inside the trailing windows is among the most recently inserted.
-	rows, err := r.db.QueryContext(ctx, `SELECT qso_date FROM qso ORDER BY id DESC LIMIT 400`)
+	// 2000 rows covers a full hour for one operator even in a busy multi-op run
+	// (other operators' rows are discarded before counting).
+	rows, err := r.db.QueryContext(ctx, `SELECT operator, qso_date FROM qso ORDER BY id DESC LIMIT 2000`)
 	if err != nil {
 		return counts, err
 	}
 	defer rows.Close()
 	now = now.UTC()
+	opFilter := strings.ToUpper(strings.TrimSpace(operator))
 	for rows.Next() {
-		var dateStr sql.NullString
-		if err := rows.Scan(&dateStr); err != nil {
+		var oper, dateStr sql.NullString
+		if err := rows.Scan(&oper, &dateStr); err != nil {
 			return counts, err
 		}
+		if strings.ToUpper(strings.TrimSpace(oper.String)) != opFilter {
+			continue // a different operator's QSO — not part of my rate
+		}
 		t := parseTimeLoose(dateStr.String).UTC()
 		if t.IsZero() || t.After(now) {
 			continue

livestatus.go

@@ -19,6 +19,23 @@ import (
 
 const keyLiveStatusEnabled = "livestatus.enabled"
 
+// liveOnlineWindow is how long after the last logged contact an operator still
+// counts as "on air". Leaving the log open without working anyone flips them
+// offline once this elapses; logging a new QSO flips them back online.
+const liveOnlineWindow = 5 * time.Minute
+
+// noteLiveQSO records that this operator just logged a new contact and pushes the
+// live status right away, so they flip back to online the instant they work
+// someone. Called from the logging paths (manual entry, UDP auto-log).
+func (a *App) noteLiveQSO() {
+	a.liveActMu.Lock()
+	a.liveLastQSOAt = time.Now()
+	a.liveActMu.Unlock()
+	if a.liveStatusActive() {
+		go a.publishLiveStatus()
+	}
+}
+
 // GetLiveStatusEnabled reports whether this operator publishes live status.
 func (a *App) GetLiveStatusEnabled() bool {
 	if a.settings == nil {
@@ -50,11 +67,44 @@ func (a *App) SetLiveStatusEnabled(on bool) error {
 	return nil
 }
 
+// seedLiveLastQSO primes liveLastQSOAt from the DB at launch, so an operator who
+// worked someone shortly before (re)starting OpsLog is shown "on air" right away
+// instead of offline until their next QSO.
+func (a *App) seedLiveLastQSO() {
+	if a.qso == nil {
+		return
+	}
+	op, _ := a.liveStatusOperator()
+	if op == "" {
+		return
+	}
+	if t, ok := a.qso.LastQSOTime(a.ctx, op); ok {
+		a.liveActMu.Lock()
+		if a.liveLastQSOAt.IsZero() {
+			a.liveLastQSOAt = t
+		}
+		a.liveActMu.Unlock()
+	}
+}
+
+// LiveLastQSOAgeSec returns seconds since this operator's last logged QSO, or -1 if
+// none is known — the UI uses it to seed the "on air" badge at launch.
+func (a *App) LiveLastQSOAgeSec() int {
+	a.liveActMu.Lock()
+	last := a.liveLastQSOAt
+	a.liveActMu.Unlock()
+	if last.IsZero() {
+		return -1
+	}
+	return int(time.Since(last).Seconds())
+}
+
 // liveStatusLoop heartbeats the current activity while enabled. Started once at
 // startup; cheap no-op when disabled or not on MySQL.
 func (a *App) liveStatusLoop() {
 	defer func() { _ = recover() }() // never crash the app from here
 	applog.Printf("livestatus: loop started")
+	a.seedLiveLastQSO()   // so online/offline is right at launch, not only after the next QSO
 	a.publishLiveStatus() // attempt immediately, don't wait the first tick
 	t := time.NewTicker(15 * time.Second)
 	defer t.Stop()
@@ -132,34 +182,62 @@ func (a *App) publishLiveStatus() {
 	if mode == "" {
 		mode = a.liveMode
 	}
+	lastQSO := a.liveLastQSOAt
 	a.liveActMu.Unlock()
+	// Online = a new contact was logged within the window. An operator who leaves
+	// the log open but stops working shows offline after `liveOnlineWindow`; the
+	// next QSO flips them back on. never-logged (zero time) → offline.
+	online := 0
+	var lastQSOArg any
+	if !lastQSO.IsZero() {
+		lastQSOArg = lastQSO.UTC()
+		if time.Since(lastQSO) < liveOnlineWindow {
+			online = 1
+		}
+	}
 	if err := a.ensureLiveStatusTable(); err != nil {
 		applog.Printf("livestatus: CREATE TABLE failed: %v", err)
 		return
 	}
 	_, err := a.logDb.ExecContext(a.ctx,
-		"INSERT INTO live_status (operator, station, freq_hz, band, mode, updated_at) "+
-			"VALUES (?, ?, ?, ?, ?, UTC_TIMESTAMP()) "+
+		"INSERT INTO live_status (operator, station, freq_hz, band, mode, online, last_qso_at, updated_at) "+
+			"VALUES (?, ?, ?, ?, ?, ?, ?, UTC_TIMESTAMP()) "+
 			"ON DUPLICATE KEY UPDATE station=VALUES(station), freq_hz=VALUES(freq_hz), "+
-			"band=VALUES(band), mode=VALUES(mode), updated_at=UTC_TIMESTAMP()",
-		op, station, freqHz, band, mode)
+			"band=VALUES(band), mode=VALUES(mode), online=VALUES(online), "+
+			"last_qso_at=VALUES(last_qso_at), updated_at=UTC_TIMESTAMP()",
+		op, station, freqHz, band, mode, online, lastQSOArg)
 	if err != nil {
 		applog.Printf("livestatus: INSERT failed: %v", err)
 		return
 	}
-	applog.Printf("livestatus: published op=%s station=%s %dHz %s %s", op, station, freqHz, band, mode)
+	applog.Printf("livestatus: published op=%s station=%s %dHz %s %s online=%d", op, station, freqHz, band, mode, online)
 }
 
 func (a *App) ensureLiveStatusTable() error {
-	_, err := a.logDb.ExecContext(a.ctx,
+	if _, err := a.logDb.ExecContext(a.ctx,
 		"CREATE TABLE IF NOT EXISTS live_status ("+
 			"operator VARCHAR(32) PRIMARY KEY, "+
 			"station VARCHAR(32), "+
 			"freq_hz BIGINT, "+
 			"band VARCHAR(16), "+
 			"mode VARCHAR(16), "+
-			"updated_at DATETIME)")
-	return err
+			"online TINYINT DEFAULT 0, "+
+			"last_qso_at DATETIME NULL, "+
+			"updated_at DATETIME)"); err != nil {
+		return err
+	}
+	// Add the online/last_qso_at columns to a table created by an older build.
+	// MySQL has no portable "ADD COLUMN IF NOT EXISTS", so just run the ALTERs and
+	// ignore the duplicate-column error when they already exist.
+	for _, ddl := range []string{
+		"ALTER TABLE live_status ADD COLUMN online TINYINT DEFAULT 0",
+		"ALTER TABLE live_status ADD COLUMN last_qso_at DATETIME NULL",
+	} {
+		if _, err := a.logDb.ExecContext(a.ctx, ddl); err != nil && !strings.Contains(strings.ToLower(err.Error()), "duplicate column") {
+			applog.Printf("livestatus: %q: %v", ddl, err)
+		}
+	}
+	return nil
 }
 
 // clearLiveStatus removes this operator's row (on disable / shutdown).

main.go

@@ -4,6 +4,7 @@ import (
 	"embed"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/wailsapp/wails/v2"
 	"github.com/wailsapp/wails/v2/pkg/options"
@@ -35,15 +36,53 @@ func profileArg(args []string) string {
 	return ""
 }
 
+// hasFlag reports whether flag is present in args.
+func hasFlag(args []string, flag string) bool {
+	for _, a := range args {
+		if a == flag {
+			return true
+		}
+	}
+	return false
+}
+
+// acquireInstance grabs the single-instance mutex. On a normal launch it's a plain
+// try (fail → another OpsLog is running, so exit). On a --post-update relaunch the
+// previous instance may still be shutting down and holding the mutex, so retry for
+// a few seconds until it frees.
+func acquireInstance(postUpdate bool) bool {
+	if acquireSingleInstance() {
+		return true
+	}
+	if !postUpdate {
+		return false
+	}
+	deadline := time.Now().Add(20 * time.Second)
+	for time.Now().Before(deadline) {
+		time.Sleep(300 * time.Millisecond)
+		if acquireSingleInstance() {
+			return true
+		}
+	}
+	return false
+}
+
 func main() {
 	// Single-instance guard: if OpsLog is already running, focus that window and
 	// exit instead of spawning a duplicate. A second process would open its own
 	// CAT (FlexRadio) connection and Ultrabeam follow loop, and the two would
 	// fight over the rig/antenna frequency — the cause of "the antenna re-tunes on
 	// its own" when a windowless zombie instance was left running.
-	if !acquireSingleInstance() {
+	// A --post-update relaunch (from the auto-updater) may start while the previous
+	// instance is still exiting and holding the single-instance mutex — wait for it
+	// to free instead of bailing out. Then clear the old exe it left behind.
+	postUpdate := hasFlag(os.Args[1:], "--post-update")
+	if !acquireInstance(postUpdate) {
 		return
 	}
+	if postUpdate {
+		cleanupOldUpdateBinary()
+	}
 
 	// Create an instance of the app structure
 	app := NewApp()

telemetry.go

@@ -21,7 +21,7 @@ import (
 
 const (
 	// appVersion is stamped on every heartbeat (and could feed the About box).
-	appVersion = "0.20.0"
+	appVersion = "0.20.1"
 
 	// posthogHost is the PostHog ingestion endpoint. EU cloud by default; change
 	// to https://us.i.posthog.com for a US project.

update.go

@@ -1,12 +1,20 @@
 package main
 
 import (
+	"archive/zip"
 	"encoding/json"
+	"fmt"
+	"io"
 	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
+	wruntime "github.com/wailsapp/wails/v2/pkg/runtime"
+
 	"hamlog/internal/applog"
 )
 
@@ -14,12 +22,13 @@ import (
 // build (the exe lives there; source stays on Gitea). Adjust the repo if needed.
 const updateCheckURL = "https://api.github.com/repos/GregTroar/OpsLog/releases/latest"
 
-// UpdateInfo is the result of the startup version check.
+// UpdateInfo is the result of the version check.
 type UpdateInfo struct {
-	Current   string `json:"current"`   // this build's version (appVersion)
-	Latest    string `json:"latest"`    // newest published release, "" if unknown
-	Available bool   `json:"available"` // Latest > Current
-	URL       string `json:"url"`       // release page to open
+	Current     string `json:"current"`      // this build's version (appVersion)
+	Latest      string `json:"latest"`       // newest published release, "" if unknown
+	Available   bool   `json:"available"`    // Latest > Current
+	URL         string `json:"url"`          // release page to open (manual fallback)
+	DownloadURL string `json:"download_url"` // the .exe/.zip asset to auto-download, "" if none
 }
 
 // CheckForUpdate asks GitHub for the latest release and compares it to this
@@ -45,6 +54,10 @@ func (a *App) CheckForUpdate() UpdateInfo {
 	var r struct {
 		TagName string `json:"tag_name"`
 		HTMLURL string `json:"html_url"`
+		Assets  []struct {
+			Name string `json:"name"`
+			URL  string `json:"browser_download_url"`
+		} `json:"assets"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&r); err != nil {
 		return out
@@ -52,8 +65,25 @@ func (a *App) CheckForUpdate() UpdateInfo {
 	out.Latest = strings.TrimPrefix(strings.TrimSpace(r.TagName), "v")
 	out.URL = r.HTMLURL
 	out.Available = versionLess(appVersion, out.Latest)
+	// Pick the auto-download asset: a bare Windows .exe (portable build) first,
+	// else a .zip we can unpack. The frontend hands this straight to
+	// DownloadAndApplyUpdate for a one-click in-app update.
+	for _, as := range r.Assets {
+		if strings.HasSuffix(strings.ToLower(as.Name), ".exe") {
+			out.DownloadURL = as.URL
+			break
+		}
+	}
+	if out.DownloadURL == "" {
+		for _, as := range r.Assets {
+			if strings.HasSuffix(strings.ToLower(as.Name), ".zip") {
+				out.DownloadURL = as.URL
+				break
+			}
+		}
+	}
 	if out.Available {
-		applog.Printf("update: newer version available — current=%s latest=%s", appVersion, out.Latest)
+		applog.Printf("update: newer version available — current=%s latest=%s asset=%q", appVersion, out.Latest, out.DownloadURL)
 	}
 	return out
 }
@@ -82,6 +112,164 @@ func versionLess(a, b string) bool {
 	return false
 }
 
+// DownloadAndApplyUpdate downloads the new build, swaps it in for the running exe
+// and relaunches — the fully in-app update. Progress is emitted on "update:progress"
+// (0-100) so the UI can show a bar. On success it never returns normally: it starts
+// the new process and quits this one.
+func (a *App) DownloadAndApplyUpdate(url string) error {
+	if strings.TrimSpace(url) == "" {
+		return fmt.Errorf("no download URL")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return fmt.Errorf("locate executable: %w", err)
+	}
+	dir := filepath.Dir(exe)
+
+	// Download to a temp file next to the exe (same volume, so the rename-swap is
+	// atomic and can't fail across drives).
+	tmp := filepath.Join(dir, ".opslog-update.download")
+	_ = os.Remove(tmp)
+	if err := a.downloadWithProgress(url, tmp); err != nil {
+		_ = os.Remove(tmp)
+		return fmt.Errorf("download: %w", err)
+	}
+
+	// The asset is either the bare exe or a zip holding it. Resolve to the new exe.
+	newExe := tmp
+	if strings.HasSuffix(strings.ToLower(url), ".zip") {
+		extracted, xerr := extractExeFromZip(tmp, dir)
+		_ = os.Remove(tmp)
+		if xerr != nil {
+			return fmt.Errorf("unpack: %w", xerr)
+		}
+		newExe = extracted
+	}
+
+	// Swap: rename the running exe out of the way (Windows allows renaming a
+	// running image), move the new one into its place, then relaunch. Roll back if
+	// the second rename fails so we never end up with no exe.
+	oldExe := exe + ".old"
+	_ = os.Remove(oldExe)
+	if err := os.Rename(exe, oldExe); err != nil {
+		_ = os.Remove(newExe)
+		return fmt.Errorf("stage current exe: %w", err)
+	}
+	if err := os.Rename(newExe, exe); err != nil {
+		_ = os.Rename(oldExe, exe) // roll back
+		return fmt.Errorf("install new exe: %w", err)
+	}
+	applog.Printf("update: installed new exe, relaunching")
+
+	// Relaunch with a flag so the fresh instance waits for THIS one to exit and
+	// free the single-instance mutex instead of bailing out immediately.
+	cmd := exec.Command(exe, "--post-update")
+	cmd.Dir = dir
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("relaunch: %w", err)
+	}
+	if a.ctx != nil {
+		wruntime.Quit(a.ctx)
+	} else {
+		os.Exit(0)
+	}
+	return nil
+}
+
+// downloadWithProgress streams url into dest, emitting "update:progress" (0-100).
+func (a *App) downloadWithProgress(url, dest string) error {
+	client := &http.Client{Timeout: 10 * time.Minute}
+	resp, err := client.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+	f, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	total := resp.ContentLength
+	var read int64
+	last := -1
+	buf := make([]byte, 64*1024)
+	emit := func(pct int) {
+		if a.ctx != nil {
+			wruntime.EventsEmit(a.ctx, "update:progress", pct)
+		}
+	}
+	emit(0)
+	for {
+		n, rerr := resp.Body.Read(buf)
+		if n > 0 {
+			if _, werr := f.Write(buf[:n]); werr != nil {
+				return werr
+			}
+			read += int64(n)
+			if total > 0 {
+				if pct := int(read * 100 / total); pct != last {
+					last = pct
+					emit(pct)
+				}
+			}
+		}
+		if rerr == io.EOF {
+			break
+		}
+		if rerr != nil {
+			return rerr
+		}
+	}
+	emit(100)
+	return nil
+}
+
+// extractExeFromZip unpacks the first *.exe found in the zip into dir and returns
+// its path.
+func extractExeFromZip(zipPath, dir string) (string, error) {
+	zr, err := zip.OpenReader(zipPath)
+	if err != nil {
+		return "", err
+	}
+	defer zr.Close()
+	for _, zf := range zr.File {
+		if !strings.HasSuffix(strings.ToLower(zf.Name), ".exe") {
+			continue
+		}
+		rc, err := zf.Open()
+		if err != nil {
+			return "", err
+		}
+		out := filepath.Join(dir, ".opslog-update.exe")
+		f, err := os.Create(out)
+		if err != nil {
+			rc.Close()
+			return "", err
+		}
+		_, cerr := io.Copy(f, rc)
+		rc.Close()
+		f.Close()
+		if cerr != nil {
+			return "", cerr
+		}
+		return out, nil
+	}
+	return "", fmt.Errorf("no .exe inside the archive")
+}
+
+// cleanupOldUpdateBinary removes the previous exe left behind by a self-update
+// (exe + ".old"). Called at startup after a --post-update relaunch. Best-effort:
+// the file may still be briefly locked, in which case the next launch gets it.
+func cleanupOldUpdateBinary() {
+	if exe, err := os.Executable(); err == nil {
+		_ = os.Remove(exe + ".old")
+	}
+}
+
 // leadingInt parses the leading digits of s (e.g. "2beta" → 2), 0 if none.
 func leadingInt(s string) int {
 	s = strings.TrimSpace(s)