fix: auto-update relaunch — clear Mark-of-the-Web + wait for exit

The new build downloaded and OpsLog quit, but never came back. Two Windows
causes: the freshly written exe carried the internet Zone.Identifier mark, so
SmartScreen wanted to prompt "are you sure you want to open this?" — invisibly,
since we launch it programmatically — and silently blocked the launch; and
starting the new exe while the old one was still exiting raced the single-
instance mutex.

Now the swapped exe's Zone.Identifier stream is removed, and the relaunch is
done by a detached, hidden PowerShell that Wait-Process's on our PID (so we're
fully gone and the mutex is free) before Start-Process'ing the new exe.

app.go

@@ -505,6 +505,7 @@ type App struct {
 	liveFreqHz         int64      // last freq/band/mode the UI reported (fallback when CAT is off)
 	liveBand           string
 	liveMode           string
+	liveLastQSOAt      time.Time  // when this operator last logged a NEW contact — drives online/offline
 	awardSnapMu        sync.Mutex // guards the award QSO snapshot
 	awardSnap          []qso.QSO  // light-scanned + enriched logbook snapshot reused across award computations
 	awardSnapRev       string     // logbook revision the snapshot was built at ("" = none)
@@ -1850,13 +1851,12 @@ func (a *App) AddQSO(q qso.QSO) (id int64, err error) {
 	a.refineDistrictZones(&q)          // W6 → CQ3/ITU6 for zone-split countries
 	a.applyQSLDefaults(&q)
 	a.applySolar(&q) // stamp SFI / A / K (and SSN as an extra) from live space-weather
-	// Fill the contacted operator's e-mail from the (cached) lookup so the
-	// recording can be auto-sent. Cheap: the entry already looked the call up.
-	if strings.TrimSpace(q.Email) == "" && a.lookup != nil {
-		if lr, e := a.lookup.Lookup(a.ctx, q.Callsign); e == nil && lr.Email != "" {
-			q.Email = lr.Email
-		}
-	}
+	// NOTE: the contacted operator's e-mail already rides in on the QSO — the entry
+	// lookup (when you typed the call) fetched it along with name/QTH/grid and the
+	// form carries it here. There is deliberately NO second lookup at log time: it
+	// was redundant with the entry lookup and only slowed logging (a call not yet in
+	// the cache made AddQSO wait on QRZ/HamQTH). If the entry lookup hadn't finished
+	// when you logged (fast CW: type → Enter), the e-mail is simply blank — fine.
 	id, err = a.qso.Add(a.ctx, q)
 	if err != nil && db.IsConnLost(err) {
 		// The database is UNREACHABLE (not a data error) — park the QSO in the
@@ -1872,6 +1872,7 @@ func (a *App) AddQSO(q qso.QSO) (id int64, err error) {
 	if err == nil {
 		q.ID = id
 		a.noteWorked(q.Callsign, q.Band, q.Mode) // keep the alert worked-index fresh
+		a.noteLiveQSO()                           // multi-op: flip this operator back "online"
 		// Announce the log so UI widgets can react (e.g. the Flex panel zeroing RIT).
 		wruntime.EventsEmit(a.ctx, "qso:logged", id)
 		a.saveQSORecording(&q)
@@ -4528,7 +4529,16 @@ func (a *App) GetQSORate() QSORate {
 	if a.qso == nil {
 		return QSORate{}
 	}
-	counts, err := a.qso.RecentRate(a.ctx, time.Now(), 10*time.Minute, 60*time.Minute)
+	// Per-operator on a shared logbook: count only the ACTIVE profile's operator
+	// so each op sees their own performance, not the cumulative station rate. An
+	// empty operator (single-op / station owner) matches all their QSOs.
+	operator := ""
+	if a.profiles != nil {
+		if p, err := a.profiles.Active(a.ctx); err == nil {
+			operator = p.Operator
+		}
+	}
+	counts, err := a.qso.RecentRate(a.ctx, time.Now(), operator, 10*time.Minute, 60*time.Minute)
 	if err != nil || len(counts) < 2 {
 		return QSORate{}
 	}
@@ -5292,7 +5302,14 @@ func (a *App) LookupCallsign(callsign string) (lookup.Result, error) {
 	if a.lookup == nil {
 		return lookup.Result{}, fmt.Errorf("lookup not initialized")
 	}
-	r, err := a.lookup.Lookup(a.ctx, callsign)
+	// Bound the whole lookup: give the providers a couple of seconds, then let
+	// Lookup fall through to cty.dat (country/zones). Without this a call that isn't
+	// in QRZ.com — or a slow/unresponsive provider — left the "looking up" spinner
+	// turning for 10 s+ before the cty.dat fallback showed. The providers respect
+	// the context, so they're cancelled at the deadline and cty.dat answers instantly.
+	ctx, cancel := context.WithTimeout(a.ctx, 2*time.Second)
+	defer cancel()
+	r, err := a.lookup.Lookup(ctx, callsign)
 	if errors.Is(err, lookup.ErrNotFound) {
 		return lookup.Result{}, fmt.Errorf("callsign not found")
 	}
@@ -5822,8 +5839,10 @@ func (a *App) saveQSORecording(q *qso.QSO) {
 		if q.Extras == nil {
 			q.Extras = map[string]string{}
 		}
-		q.Extras["APP_OPSLOG_RECORDING"] = name
-		if err := a.qso.Update(a.ctx, *q); err != nil {
+		q.Extras["APP_OPSLOG_RECORDING"] = name // in-memory copy for the encode goroutine
+		// Persist ONLY this extras key (targeted) — a full-row Update from this
+		// in-memory copy could revert a column a concurrent post-log action changed.
+		if err := a.qso.SetExtra(a.ctx, q.ID, "APP_OPSLOG_RECORDING", name); err != nil {
 			applog.Printf("qso-rec: store recording path: %v", err)
 		}
 	}
@@ -6695,17 +6714,10 @@ func (a *App) markRecordingSent(id int64) {
 	if a.qso == nil || id == 0 {
 		return
 	}
-	q, err := a.qso.GetByID(a.ctx, id)
-	if err != nil {
-		applog.Printf("qso-rec: mark sent: load %d: %v", id, err)
-		return
-	}
-	if q.Extras == nil {
-		q.Extras = map[string]string{}
-	}
-	q.Extras["APP_OPSLOG_RECORDING_SENT"] = time.Now().UTC().Format("2006-01-02")
-	if err := a.qso.Update(a.ctx, q); err != nil {
-		applog.Printf("qso-rec: mark sent: update %d: %v", id, err)
+	// Targeted extras write — never a full-row Update, which (from a stale copy)
+	// could revert a clublog/qrz upload-status another action just stamped.
+	if err := a.qso.SetExtra(a.ctx, id, "APP_OPSLOG_RECORDING_SENT", time.Now().UTC().Format("2006-01-02")); err != nil {
+		applog.Printf("qso-rec: mark sent %d: %v", id, err)
 	}
 }
 
@@ -9277,6 +9289,7 @@ func (a *App) LogUDPLoggedADIF(adifText string) (int64, error) {
 		return 0, fmt.Errorf("insert qso: %w", err)
 	}
 	q.ID = id
+	a.noteLiveQSO() // multi-op: flip this operator back "online"
 	a.saveQSORecording(&q)
 	if a.extsvc != nil {
 		a.extsvc.OnQSOLogged(id)

app_qsl_designer.go

@@ -437,17 +437,16 @@ func (a *App) SendEQSL(qsoID int64, templateID int64, jpegB64 string) error {
 		applog.Printf("qsl: send eQSL to %s (%s) failed: %v", to, q.Callsign, err)
 		return err
 	}
-	// Record WHEN OpsLog e-mailed its own QSL card, in a dedicated app field —
-	// NOT the ADIF eqsl_sent flag, which belongs to eQSL.cc and must stay
-	// independent. q came straight from GetByID, so a full Update rewrites the
-	// row unchanged apart from this field.
-	if q.Extras == nil {
-		q.Extras = map[string]string{}
-	}
-	q.Extras[appQSLCardSentField] = time.Now().UTC().Format(time.RFC3339)
-	if err := a.qso.Update(a.ctx, q); err != nil {
-		applog.Printf("qsl: eQSL sent to %s but marking failed: %v", q.Callsign, err)
-		return fmt.Errorf("eQSL sent but status not saved: %w", err)
+	// Record WHEN OpsLog e-mailed its own QSL card, in a dedicated app field — NOT
+	// the ADIF eqsl_sent flag, which belongs to eQSL.cc and must stay independent.
+	//
+	// Stamp ONLY this extras key (targeted UPDATE), never a full-row write. The `q`
+	// read up top is now stale after the slow e-mail send, and rewriting the whole
+	// row would revert any column an auto-upload changed meanwhile — that's how
+	// sending a QSL card was flipping clublog_qso_upload_status back from Y to R.
+	if err := a.qso.SetExtra(a.ctx, qsoID, appQSLCardSentField, time.Now().UTC().Format(time.RFC3339)); err != nil {
+		applog.Printf("qsl: card sent to %s but marking failed: %v", q.Callsign, err)
+		return fmt.Errorf("QSL card sent but status not saved: %w", err)
 	}
 	applog.Printf("qsl: eQSL sent to %s (%s)", to, q.Callsign)
 	wruntime.EventsEmit(a.ctx, "qsl:sent", qsoID)

frontend/src/App.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import {
   Activity, AlertCircle, Antenna, Bell, CheckCircle2, Clock, CloudOff, Compass, Database, Ear, Eraser, Hash, Loader2, Lock,
-  Maximize2, Minimize2, Mic, MessageSquare, Pencil, RadioTower, RefreshCw, Satellite, Send, Settings, SlidersHorizontal, Square, Terminal, Trash2, Unlock, X, Zap,
+  Maximize2, Minimize2, Mic, MessageSquare, Pencil, Radio, RadioTower, RefreshCw, Satellite, Send, Settings, SlidersHorizontal, Square, Terminal, Trash2, Unlock, X, Zap,
 } from 'lucide-react';
 
 import {
@@ -13,7 +13,7 @@ import {
   GetQSO, UpdateQSO, DeleteQSO, DeleteQSOs, DeleteAllQSO,
   UpdateQSOsFromCty, UpdateQSOsFromQRZ, UpdateQSOsFromClublog, UploadQSOsManual, SendQSORecordingEmail,
   LookupCallsign, GetStationSettings, GetListsSettings,
-  GetStartupStatus, CheckForUpdate,
+  GetStartupStatus, CheckForUpdate, DownloadAndApplyUpdate, GetLiveStations,
   WorkedBefore,
   SetCompactMode,
   GetCATState, SetCATFrequency, SetCATMode, SwitchCATRig, FlexApplyBandAntenna,
@@ -42,7 +42,7 @@ import {
   QSOAudioBegin, QSOAudioCancel, QSOAudioRestart, QSOAudioResetClock,
   GetAwardDefs,
   GetUIPref,
-  ReportLiveActivity,
+  ReportLiveActivity, GetLiveStatusEnabled, LiveLastQSOAgeSec,
   AwardRefsForQSOs,
 } from '../wailsjs/go/main/App';
 import { Combobox } from '@/components/ui/combobox';
@@ -210,6 +210,16 @@ function bandForMHz(mhz: number): string {
   return '';
 }
 
+// modeAccent maps a mode to a theme-aware colour for the live-stations widget:
+// CW gold, phone green, digital blue, unknown muted.
+function modeAccent(mode?: string): string {
+  const m = (mode || '').toUpperCase();
+  if (/CW/.test(m)) return 'var(--chart-3)';
+  if (/SSB|USB|LSB|AM|FM|PHONE|DV/.test(m)) return 'var(--chart-2)';
+  if (/FT8|FT4|RTTY|PSK|JT|JS8|Q65|MSK|FST|MFSK|OLIVIA|DIG|DATA|WSPR/.test(m)) return 'var(--chart-1)';
+  return 'var(--muted-foreground)';
+}
+
 // rstCategory buckets a mode into the report family used for its RST list.
 type RSTLists = { phone: string[]; cw: string[]; digital: string[] };
 function rstCategory(mode: string): keyof RSTLists {
@@ -410,6 +420,18 @@ export default function App() {
   // click reverts the UI and the click looks like it did nothing.
   const agPending = useRef<{ a?: { v: number; t: number }; b?: { v: number; t: number } }>({});
   const [dbConn, setDbConn] = useState<{ backend: string; label: string } | null>(null);
+  // Multi-op "who's on air" widget: every operator's live status from the shared
+  // MySQL logbook (freq/mode/version). Only polled on a MySQL logbook.
+  type LiveStation = { operator: string; station: string; freq_hz: number; band: string; mode: string; online: boolean; version: string; age_sec: number };
+  const [liveStations, setLiveStations] = useState<LiveStation[]>([]);
+  const [showLiveStations, setShowLiveStations] = useState(() => localStorage.getItem('opslog.showLiveStations') === '1');
+  useEffect(() => {
+    if (dbConn?.backend !== 'mysql') { setLiveStations([]); return; }
+    const load = () => GetLiveStations().then((s) => setLiveStations((s ?? []) as LiveStation[])).catch(() => {});
+    load();
+    const id = window.setInterval(load, 15 * 1000);
+    return () => window.clearInterval(id);
+  }, [dbConn]);
   // Mode OpsLog shows when the rig reports generic DIG_U/DIG_L. OmniRig
   // can't tell us if it's FT8 vs FT4 vs RTTY, so the user picks the default
   // in Preferences > Hardware > CAT interface.
@@ -605,6 +627,11 @@ export default function App() {
     QSOAudioResetClock().then((active) => { setRecording(active); setRecTick((t) => t + 1); }).catch(() => {});
   };
   const [saving, setSaving] = useState(false);
+  // Synchronous re-entrancy guard: `saving` is React state (updates async), so it
+  // can't stop a burst of Enter presses / clicks fired before the re-render — each
+  // would run a full AddQSO and log the SAME contact several times when a slow QRZ
+  // lookup made the log take seconds. This ref blocks the repeat immediately.
+  const savingRef = useRef(false);
   const [filterCallsign, setFilterCallsign] = useState('');
   // Advanced filter builder (replaces the old band/mode dropdowns).
   const [filterOpen, setFilterOpen] = useState(false);
@@ -1086,6 +1113,24 @@ export default function App() {
   const [showSettings, setShowSettings] = useState(false);
   // Re-read the "beam on map" toggle when Preferences closes (it's edited there).
   useEffect(() => { if (!showSettings) setShowBeamOnMap(localStorage.getItem('opslog.showBeamOnMap') !== '0'); }, [showSettings]);
+  // "ON AIR" status-bar badge: mirrors the multi-op live status this operator
+  // publishes — online (blinking) when a QSO was logged in the last 5 min, else
+  // offline. Only shown when live-status publishing is enabled (Settings→General).
+  const [liveStatusOn, setLiveStatusOn] = useState(false);
+  const [onAir, setOnAir] = useState(false);
+  useEffect(() => { if (!showSettings) GetLiveStatusEnabled().then((v) => setLiveStatusOn(!!v)).catch(() => {}); }, [showSettings]);
+  useEffect(() => {
+    // Read the ON-AIR state straight from the backend (single source of truth:
+    // liveLastQSOAt, stamped on every log and seeded from the DB at launch). Poll
+    // it + refresh on each logged QSO — no fragile frontend timestamp to drift.
+    const refresh = () => LiveLastQSOAgeSec()
+      .then((sec: number) => setOnAir(liveStatusOn && typeof sec === 'number' && sec >= 0 && sec < 300))
+      .catch(() => {});
+    refresh();
+    const off = EventsOn('qso:logged', refresh);
+    const id = window.setInterval(refresh, 5 * 1000); // responsive without hammering (cheap 400-row scan)
+    return () => { off(); window.clearInterval(id); };
+  }, [liveStatusOn]);
   // QSO-rate meter (10/60 min) in the header — opt-in via Settings→General.
   const [showQsoRate, setShowQsoRate] = useState(() => localStorage.getItem('opslog.showQsoRate') === '1');
   useEffect(() => { if (!showSettings) setShowQsoRate(localStorage.getItem('opslog.showQsoRate') === '1'); }, [showSettings]);
@@ -1106,15 +1151,39 @@ export default function App() {
   const [showDeleteAll, setShowDeleteAll] = useState(false);
   const [showAbout, setShowAbout] = useState(false);
   const [showDuplicates, setShowDuplicates] = useState(false);
-  const [updateInfo, setUpdateInfo] = useState<{ latest: string; url: string } | null>(null);
-  // Check GitHub for a newer release once at startup (unless disabled in
-  // General); surface a toast if one exists. Best effort — silent on failure.
+  const [updateInfo, setUpdateInfo] = useState<{ latest: string; url: string; downloadUrl: string } | null>(null);
+  const [updating, setUpdating] = useState(false);
+  const [updateProgress, setUpdateProgress] = useState(0);
+  const [updateError, setUpdateError] = useState('');
+  // Check GitHub for a newer release at startup AND every 10 minutes (unless
+  // disabled in General). Best effort — silent on failure.
   useEffect(() => {
     if (localStorage.getItem('opslog.checkUpdates') === '0') return;
-    CheckForUpdate().then((u: any) => {
-      if (u?.available && u?.latest) setUpdateInfo({ latest: String(u.latest), url: String(u.url ?? '') });
+    const check = () => CheckForUpdate().then((u: any) => {
+      if (u?.available && u?.latest) setUpdateInfo({ latest: String(u.latest), url: String(u.url ?? ''), downloadUrl: String(u.download_url ?? '') });
     }).catch(() => {});
+    check();
+    const id = window.setInterval(check, 10 * 60 * 1000);
+    return () => window.clearInterval(id);
   }, []);
+  // Live download progress for the in-app updater.
+  useEffect(() => {
+    const off = EventsOn('update:progress', (p: any) => setUpdateProgress(Math.max(0, Math.min(100, Number(p) || 0))));
+    return () => { off(); };
+  }, []);
+  // startUpdate downloads the new build in-app and (on success) swaps + relaunches.
+  // Falls back to opening the release page when the release has no auto-download asset.
+  const startUpdate = useCallback(async () => {
+    if (!updateInfo) return;
+    if (!updateInfo.downloadUrl) { if (updateInfo.url) BrowserOpenURL(updateInfo.url); return; }
+    setUpdating(true); setUpdateProgress(0); setUpdateError('');
+    try {
+      await DownloadAndApplyUpdate(updateInfo.downloadUrl); // app quits + relaunches on success
+    } catch (e: any) {
+      setUpdateError(String(e?.message ?? e));
+      setUpdating(false);
+    }
+  }, [updateInfo]);
   const [deletingAll, setDeletingAll] = useState(false);
   const [ctyRefreshing, setCtyRefreshing] = useState(false);
   const [refsDownloading, setRefsDownloading] = useState(false);
@@ -1153,6 +1222,10 @@ export default function App() {
   const [lookupError, setLookupError] = useState('');
   const lookupTimerRef = useRef<number | null>(null);
   const wbTimerRef = useRef<number | null>(null);
+  // Bumped whenever the entry is cleared (ESC) or a new call starts, so a still
+  // in-flight lookup discards its result when it finally returns instead of
+  // re-populating a field the operator just cleared.
+  const lookupGenRef = useRef(0);
   const [wb, setWb] = useState<WB | null>(null);
   const [wbBusy, setWbBusy] = useState(false);
 
@@ -2155,7 +2228,9 @@ export default function App() {
   }, [spots]);
 
   async function save() {
+    if (savingRef.current) return; // a log is already in flight — ignore the repeat
     if (!callsign.trim()) { setError('Callsign required'); return; }
+    savingRef.current = true;
     setSaving(true); setError('');
     try {
       const freqHz = freqMhz.trim() ? Math.round(parseFloat(freqMhz) * 1_000_000) : undefined;
@@ -2225,13 +2300,21 @@ export default function App() {
       await refresh();
     } catch (e: any) {
       setError(String(e?.message ?? e));
-    } finally { setSaving(false); }
+    } finally { setSaving(false); savingRef.current = false; }
   }
 
   // resetEntry clears the form for the next QSO. Triggered after a
   // successful log AND by ESC. Locked values (band/mode/freq/start/end)
   // are preserved so backdated batches stay productive.
   function resetEntry() {
+    // Stop any callsign lookup DEAD: cancel the pending debounce, hide the "looking
+    // up" spinner immediately, and invalidate any request already in flight so its
+    // late result can't re-fill the field we're about to clear (the "ESC clears the
+    // QSO but the QRZ lookup keeps going" bug).
+    if (lookupTimerRef.current) { window.clearTimeout(lookupTimerRef.current); lookupTimerRef.current = null; }
+    if (wbTimerRef.current) { window.clearTimeout(wbTimerRef.current); wbTimerRef.current = null; }
+    lookupGenRef.current++;
+    setLookupBusy(false);
     // Discard any in-progress QSO recording (no-op if it was already saved on
     // log, or if the recorder is off).
     QSOAudioCancel(); setRecording(false); recordingCallRef.current = "";
@@ -2436,14 +2519,15 @@ export default function App() {
   }
   async function runLookup(call: string) {
     if (call !== lastLookedUpRef.current) resetAutoFill();
+    const gen = lookupGenRef.current; // invalidated by ESC / resetEntry
     setLookupBusy(true);
     try {
       const r = await LookupCallsign(call);
       // Discard a STALE result: the operator already moved to another call
-      // (clicked a new spot / typed) while this lookup was in flight. Applying it
-      // would clobber the current call's fields and zoom the map to the wrong
-      // station — the bug where replacing a call didn't re-zoom the map.
-      if (call !== callsignValRef.current.trim().toUpperCase()) return;
+      // (clicked a new spot / typed) OR cleared the entry (ESC) while this lookup
+      // was in flight. Applying it would clobber the current fields and zoom the
+      // map to the wrong station.
+      if (gen !== lookupGenRef.current || call !== callsignValRef.current.trim().toUpperCase()) return;
       lastLookedUpRef.current = call;
       // cty.dat carries ONLY DXCC-entity data (country / CQ / ITU zones / continent).
       // A QRZ/HamQTH hit is far richer (name, QTH, grid, address, image). When the
@@ -2496,9 +2580,15 @@ export default function App() {
         QSOAudioBegin().then(setRecording).catch(() => {});
       }
     } catch (e: any) {
-      setLookupResult(null);
-      setLookupError(String(e?.message ?? e));
-    } finally { setLookupBusy(false); }
+      if (gen === lookupGenRef.current && call === callsignValRef.current.trim().toUpperCase()) {
+        setLookupResult(null);
+        setLookupError(String(e?.message ?? e));
+      }
+    } finally {
+      // Only clear the spinner if we're still the current lookup — a newer one
+      // (or an ESC that already reset it) owns the busy state otherwise.
+      if (gen === lookupGenRef.current) setLookupBusy(false);
+    }
   }
   function scheduleLookup(value: string, force?: boolean) {
     setLookupError('');
@@ -3772,6 +3862,24 @@ export default function App() {
                 )}
               </button>
             )}
+            {/* Multi-op "who's on air": a dockable widget (toggle), not a popover. */}
+            {dbConn?.backend === 'mysql' && (
+              <button
+                type="button"
+                onClick={() => { const v = !showLiveStations; setShowLiveStations(v); writeUiPref('opslog.showLiveStations', v ? '1' : '0'); }}
+                title={showLiveStations ? `${t('live.stationsTitle')} — shown · click to hide` : `${t('live.stationsTitle')} · click to show`}
+                className={cn('relative inline-flex items-center justify-center size-7 rounded-md border transition-colors',
+                  showLiveStations ? 'border-info-border bg-info-muted text-info-muted-foreground hover:bg-info-muted'
+                    : 'border-border text-muted-foreground hover:bg-muted')}
+              >
+                <Radio className="size-4" />
+                {liveStations.filter((s) => s.online).length > 0 && (
+                  <span className="absolute -top-1 -right-1 min-w-3.5 h-3.5 px-0.5 rounded-full bg-danger text-danger-foreground text-[9px] font-bold leading-[14px] text-center">
+                    {(() => { const n = liveStations.filter((s) => s.online).length; return n > 9 ? '9+' : n; })()}
+                  </span>
+                )}
+              </button>
+            )}
           </div>
 
           {/* QSO-rate meter (opt-in) + propagation share ONE grid cell: the header
@@ -3914,22 +4022,42 @@ export default function App() {
           <div className="flex items-start gap-2">
             <div className="size-2.5 mt-1 rounded-full bg-primary shrink-0 animate-pulse" />
             <div className="min-w-0 flex-1">
-              <p className="text-sm font-semibold">OpsLog v{updateInfo.latest} available</p>
-              <p className="text-xs text-muted-foreground">You're on v{APP_VERSION}.</p>
-              <div className="mt-2 flex items-center gap-2">
-                <button
-                  onClick={() => { if (updateInfo.url) BrowserOpenURL(updateInfo.url); setUpdateInfo(null); }}
-                  className="h-7 px-3 rounded-md bg-primary text-primary-foreground text-xs font-medium hover:opacity-90">
-                  Download
-                </button>
-                <button onClick={() => setUpdateInfo(null)} className="h-7 px-2 text-xs text-muted-foreground hover:text-foreground">
-                  Later
-                </button>
-              </div>
+              <p className="text-sm font-semibold">{t('upd.available', { v: updateInfo.latest })}</p>
+              <p className="text-xs text-muted-foreground">{t('upd.current', { v: APP_VERSION })}</p>
+
+              {updating ? (
+                <div className="mt-2">
+                  <div className="flex items-center justify-between text-[11px] text-muted-foreground mb-1">
+                    <span>{updateProgress >= 100 ? t('upd.installing') : t('upd.downloading')}</span>
+                    <span className="tabular-nums">{updateProgress}%</span>
+                  </div>
+                  <div className="h-2 w-full rounded-full bg-muted overflow-hidden">
+                    <div className="h-full bg-primary transition-[width] duration-150" style={{ width: `${updateProgress}%` }} />
+                  </div>
+                  <p className="mt-1 text-[10px] text-muted-foreground">{t('upd.restartNote')}</p>
+                </div>
+              ) : updateError ? (
+                <div className="mt-2">
+                  <p className="text-[11px] text-destructive break-words">{updateError}</p>
+                  <div className="mt-1.5 flex items-center gap-2">
+                    <button onClick={startUpdate} className="h-7 px-3 rounded-md bg-primary text-primary-foreground text-xs font-medium hover:opacity-90">{t('upd.retry')}</button>
+                    {updateInfo.url && <button onClick={() => BrowserOpenURL(updateInfo.url)} className="h-7 px-2 text-xs text-muted-foreground hover:text-foreground">{t('upd.browser')}</button>}
+                  </div>
+                </div>
+              ) : (
+                <div className="mt-2 flex items-center gap-2">
+                  <button onClick={startUpdate} className="h-7 px-3 rounded-md bg-primary text-primary-foreground text-xs font-medium hover:opacity-90">
+                    {updateInfo.downloadUrl ? t('upd.install') : t('upd.download')}
+                  </button>
+                  <button onClick={() => setUpdateInfo(null)} className="h-7 px-2 text-xs text-muted-foreground hover:text-foreground">{t('upd.later')}</button>
+                </div>
+              )}
             </div>
-            <button onClick={() => setUpdateInfo(null)} className="text-muted-foreground hover:text-foreground shrink-0" title="Dismiss">
-              <X className="size-4" />
-            </button>
+            {!updating && (
+              <button onClick={() => setUpdateInfo(null)} className="text-muted-foreground hover:text-foreground shrink-0" title="Dismiss">
+                <X className="size-4" />
+              </button>
+            )}
           </div>
         </div>
       )}
@@ -4120,8 +4248,55 @@ export default function App() {
       {/* Reserved free space to the right. The WinKeyer CW keyer and/or the
           Digital Voice Keyer take this slot when enabled (Log4OM-style);
           otherwise it shows the QRZ profile photo. */}
-      {!compact && (chatShown || wkEnabled || dvkEnabled || lookupResult?.image_url || (showRotor && (rotatorHeading.enabled || dxPath)) || (showAntGenius && agEnabled)) && (
+      {!compact && (chatShown || wkEnabled || dvkEnabled || lookupResult?.image_url || (showRotor && (rotatorHeading.enabled || dxPath)) || (showAntGenius && agEnabled) || (showLiveStations && dbConn?.backend === 'mysql')) && (
         <div className="flex-1 min-w-0 min-h-0 flex gap-2.5 items-stretch">
+          {/* Multi-op "who's on air" widget: every operator on the shared logbook,
+              their freq/mode (colour-coded) and OpsLog version. */}
+          {showLiveStations && dbConn?.backend === 'mysql' && (
+            <div className="w-[248px] shrink-0 min-h-0 relative">
+              <div className="absolute inset-0 flex flex-col min-h-0 rounded-xl border border-border bg-card shadow-sm overflow-hidden">
+                <div className="flex items-center gap-1.5 px-3 h-8 border-b border-border shrink-0">
+                  <Radio className="size-3.5 text-primary" />
+                  <span className="text-[11px] font-semibold uppercase tracking-wider truncate">{t('live.stationsTitle')}</span>
+                  <div className="flex-1" />
+                  <span className="text-[10px] text-muted-foreground tabular-nums">{liveStations.filter((s) => s.online).length}/{liveStations.length}</span>
+                  <button type="button" className="text-muted-foreground hover:text-foreground shrink-0"
+                    onClick={() => { setShowLiveStations(false); writeUiPref('opslog.showLiveStations', '0'); }} title={t('live.stationsHide')}>
+                    <X className="size-3.5" />
+                  </button>
+                </div>
+                <div className="flex-1 min-h-0 overflow-auto p-1.5 flex flex-col gap-1">
+                  {liveStations.length === 0 ? (
+                    <p className="text-xs text-muted-foreground italic px-1 py-2">{t('live.stationsEmpty')}</p>
+                  ) : liveStations.map((s, i) => {
+                    const mc = modeAccent(s.mode);
+                    return (
+                      <div key={i} className={cn('flex items-center gap-2 rounded-md px-2 py-1.5 border', s.online ? 'bg-muted/40 border-border' : 'border-transparent opacity-60')}>
+                        <span className={cn('size-2 rounded-full shrink-0', s.online ? 'bg-danger animate-pulse' : 'bg-muted-foreground/40')}
+                          title={s.online ? t('live.onAir') : t('live.offline')} />
+                        <div className="min-w-0 flex-1">
+                          <div className="flex items-baseline gap-1.5 min-w-0">
+                            <span className="text-xs font-bold font-mono truncate">{s.operator}</span>
+                            {s.version && <span className="text-[9px] text-muted-foreground shrink-0 tabular-nums ml-auto">v{s.version}</span>}
+                          </div>
+                          <div className="flex items-center gap-1.5 mt-0.5 min-w-0">
+                            <span className="font-mono text-[11px] font-semibold tabular-nums" style={{ color: mc }}>
+                              {s.freq_hz ? (s.freq_hz / 1e6).toFixed(3) : '—'}
+                            </span>
+                            {s.mode && (
+                              <span className="text-[9px] font-bold uppercase px-1.5 rounded-full leading-[15px] shrink-0"
+                                style={{ background: `${mc}22`, color: mc }}>{s.mode}</span>
+                            )}
+                            {s.band && <span className="text-[10px] text-muted-foreground shrink-0">{s.band}</span>}
+                          </div>
+                        </div>
+                      </div>
+                    );
+                  })}
+                </div>
+              </div>
+            </div>
+          )}
           {chatShown && (
             // relative + absolute inner: the chat takes the row height (set by the
             // entry strip) WITHOUT its message list growing the row, like the
@@ -4854,6 +5029,16 @@ export default function App() {
               disabled={!rotatorHeading.enabled}
               onClick={() => { setSettingsSection('rotator'); setShowSettings(true); }}
             />
+            {liveStatusOn && (
+              <div
+                className={cn('inline-flex items-center gap-1.5 rounded-md border px-2 py-0.5 text-[11px] font-bold uppercase tracking-wider shrink-0 transition-colors',
+                  onAir ? 'border-danger-border bg-danger-muted text-danger-muted-foreground' : 'border-border text-muted-foreground')}
+                title={onAir ? t('live.onAirTip') : t('live.offlineTip')}
+              >
+                <span className={cn('size-2 rounded-full', onAir ? 'bg-danger animate-pulse' : 'bg-muted-foreground/40')} />
+                {onAir ? t('live.onAir') : t('live.offline')}
+              </div>
+            )}
             {/* Toasts / errors: the status bar's free space is far wider than the
                 header band they used to sit in. Still one line (the bar is 28px),
                 but CLICK opens the full text wrapped — long messages (a TQSL or

frontend/src/lib/i18n.tsx

@@ -14,6 +14,15 @@ type Dict = Record<string, string>;
 const en: Dict = {
   // Menu bar
   'prop.title': 'Propagation', 'prop.geomag': 'Geomag', 'prop.refresh': 'Refresh space weather',
+  'live.onAir': 'On air', 'live.offline': 'Offline',
+  'live.onAirTip': 'On air — a QSO was logged in the last 5 minutes (published to the live status)',
+  'live.offlineTip': 'Offline — no QSO logged in the last 5 minutes',
+  'live.stationsTitle': 'Stations on air', 'live.stationsEmpty': 'No station reporting yet.', 'live.stationsHide': 'Hide',
+  'upd.available': 'OpsLog v{v} available', 'upd.current': "You're on v{v}.",
+  'upd.install': 'Update now', 'upd.download': 'Download', 'upd.later': 'Later',
+  'upd.downloading': 'Downloading…', 'upd.installing': 'Installing…',
+  'upd.restartNote': 'OpsLog will restart on the new version.',
+  'upd.retry': 'Retry', 'upd.browser': 'Open page',
   'rate.title': 'QSO rate (QSOs/hour) — projected from the last 10 / 60 minutes',
   'lotw.userTip': 'LoTW user — last upload {date} ({days} days ago)',
   'menu.file': 'File', 'menu.edit': 'Edit', 'menu.view': 'View', 'menu.tools': 'Tools',
@@ -324,6 +333,10 @@ const en: Dict = {
 
 const fr: Dict = {
   'prop.title': 'Propagation', 'prop.geomag': 'Géomag', 'prop.refresh': 'Actualiser la météo spatiale',
+  'live.onAir': 'On air', 'live.offline': 'Hors ligne',
+  'live.onAirTip': "On air — un QSO a été loggé dans les 5 dernières minutes (publié dans le statut live)",
+  'live.offlineTip': 'Hors ligne — aucun QSO loggé depuis 5 minutes',
+  'live.stationsTitle': 'Stations on air', 'live.stationsEmpty': 'Aucune station ne reporte pour le moment.', 'live.stationsHide': 'Masquer',
   'rate.title': 'Rythme QSO (QSO/heure) — projeté sur les 10 / 60 dernières minutes',
   'lotw.userTip': 'Utilisateur LoTW — dernier upload {date} (il y a {days} j)',
   'menu.file': 'Fichier', 'menu.edit': 'Édition', 'menu.view': 'Affichage', 'menu.tools': 'Outils',

frontend/src/version.ts

@@ -1,6 +1,6 @@
 // Single source of truth for the app version shown in the UI (header + About).
 // Bump this on a release (the release script updates it alongside telemetry.go).
-export const APP_VERSION = '0.20.1';
+export const APP_VERSION = '0.20.2';
 
 // Author / credits, shown in Help -> About.
 export const APP_AUTHOR = 'F4BPO';

frontend/wailsjs/go/main/App.d.ts

@@ -146,6 +146,8 @@ export function DismissAwardUpdate(arg1:string):Promise<void>;
 
 export function DownloadAllReferenceLists():Promise<string>;
 
+export function DownloadAndApplyUpdate(arg1:string):Promise<void>;
+
 export function DownloadClublogCty():Promise<main.ClublogCtyInfo>;
 
 export function DownloadConfirmations(arg1:string,arg2:boolean,arg3:string):Promise<void>;
@@ -352,6 +354,8 @@ export function GetIcomState():Promise<cat.IcomTXState>;
 
 export function GetListsSettings():Promise<main.ListsSettings>;
 
+export function GetLiveStations():Promise<Array<main.LiveStation>>;
+
 export function GetLiveStatusEnabled():Promise<boolean>;
 
 export function GetLoTWUsersStatus():Promise<main.LoTWUsersStatus>;
@@ -546,6 +550,8 @@ export function ListTQSLStationLocations():Promise<Array<extsvc.StationLocation>
 
 export function ListUDPIntegrations():Promise<Array<udp.Config>>;
 
+export function LiveLastQSOAgeSec():Promise<number>;
+
 export function LoTWUserInfo(arg1:string):Promise<lotwusers.Info>;
 
 export function LogUDPLoggedADIF(arg1:string):Promise<number>;

frontend/wailsjs/go/main/App.js

@@ -250,6 +250,10 @@ export function DownloadAllReferenceLists() {
   return window['go']['main']['App']['DownloadAllReferenceLists']();
 }
 
+export function DownloadAndApplyUpdate(arg1) {
+  return window['go']['main']['App']['DownloadAndApplyUpdate'](arg1);
+}
+
 export function DownloadClublogCty() {
   return window['go']['main']['App']['DownloadClublogCty']();
 }
@@ -662,6 +666,10 @@ export function GetListsSettings() {
   return window['go']['main']['App']['GetListsSettings']();
 }
 
+export function GetLiveStations() {
+  return window['go']['main']['App']['GetLiveStations']();
+}
+
 export function GetLiveStatusEnabled() {
   return window['go']['main']['App']['GetLiveStatusEnabled']();
 }
@@ -1050,6 +1058,10 @@ export function ListUDPIntegrations() {
   return window['go']['main']['App']['ListUDPIntegrations']();
 }
 
+export function LiveLastQSOAgeSec() {
+  return window['go']['main']['App']['LiveLastQSOAgeSec']();
+}
+
 export function LoTWUserInfo(arg1) {
   return window['go']['main']['App']['LoTWUserInfo'](arg1);
 }

frontend/wailsjs/go/models.ts

@@ -2054,6 +2054,32 @@ export namespace main {
 		    return a;
 		}
 	}
+	export class LiveStation {
+	    operator: string;
+	    station: string;
+	    freq_hz: number;
+	    band: string;
+	    mode: string;
+	    online: boolean;
+	    version: string;
+	    age_sec: number;
+	
+	    static createFrom(source: any = {}) {
+	        return new LiveStation(source);
+	    }
+	
+	    constructor(source: any = {}) {
+	        if ('string' === typeof source) source = JSON.parse(source);
+	        this.operator = source["operator"];
+	        this.station = source["station"];
+	        this.freq_hz = source["freq_hz"];
+	        this.band = source["band"];
+	        this.mode = source["mode"];
+	        this.online = source["online"];
+	        this.version = source["version"];
+	        this.age_sec = source["age_sec"];
+	    }
+	}
 	export class LoTWUsersStatus {
 	    count: number;
 	    updated?: string;
@@ -2763,6 +2789,7 @@ export namespace main {
 	    latest: string;
 	    available: boolean;
 	    url: string;
+	    download_url: string;
 	
 	    static createFrom(source: any = {}) {
 	        return new UpdateInfo(source);
@@ -2774,6 +2801,7 @@ export namespace main {
 	        this.latest = source["latest"];
 	        this.available = source["available"];
 	        this.url = source["url"];
+	        this.download_url = source["download_url"];
 	    }
 	}
 	export class WKMacro {

internal/cat/icomnet.go

@@ -136,6 +136,11 @@ type icomNet struct {
 	// but link fine" (stay connected) from "link dead" (reconnect). See Alive().
 	lastRx atomic.Int64
 
+	// dead is set when the rig explicitly tears the session down (control 0x05):
+	// Alive() then returns false immediately so ReadState fails on the next poll and
+	// the manager reconnects cleanly, instead of waiting out the 6 s lastRx timeout.
+	dead atomic.Bool
+
 	// audio is the optional RX audio stream (UDP 50003). nil when audio is off.
 	// Torn down alongside the CI-V/control streams in Close.
 	audio *icomAudio
@@ -178,6 +183,9 @@ func (n *icomNet) markRx() { n.lastRx.Store(time.Now().UnixNano()) }
 // the radio — is gone. Independent of CI-V replies, so a powered-off rig still
 // reads as Alive and the session isn't torn down. Satisfies aliveTransport.
 func (n *icomNet) Alive() bool {
+	if n.dead.Load() {
+		return false // rig sent an explicit disconnect — reconnect now, don't wait
+	}
 	last := n.lastRx.Load()
 	if last == 0 {
 		return true // just connected, nothing received yet — give it a chance
@@ -292,6 +300,7 @@ func (n *icomNet) ctrlPump() {
 					n.ctrlResend(icnLE.Uint16(buf[6:]))
 				}
 			case 0x05: // rig-initiated disconnect — it dropped US
+				n.dead.Store(true) // make Alive() fail now → prompt clean reconnect
 				debugLog.Printf("icom net: rig sent DISCONNECT on control stream — session dropped by the rig")
 			default:
 				// Anything else on the control stream is (almost always) the rig's
@@ -367,6 +376,7 @@ func (n *icomNet) civPump() {
 					n.resend(icnLE.Uint16(buf[6:]))
 				}
 			case typ == 0x05: // rig-initiated disconnect — it dropped US
+				n.dead.Store(true) // make Alive() fail now → prompt clean reconnect
 				debugLog.Printf("icom net: rig sent DISCONNECT on CI-V stream — session dropped by the rig")
 			case typ == 0x00 && k > 0x15 && buf[0x10] == 0xc1: // CI-V data
 				n.trackRxSeq(icnLE.Uint16(buf[6:])) // note gaps for retransmit

internal/cat/omnirig.go

@@ -32,6 +32,7 @@ type OmniRig struct {
 	omnirig *ole.IDispatch
 	rig     *ole.IDispatch
 	lastSig string // last logged Split/VFO signature — only log on change
+	rigType string // OmniRig's RigType string (the .ini title), e.g. "IC-7610"
 
 	// lastSetFreq is the frequency most recently COMMANDED via SetFrequency.
 	// SetMode uses it to pick USB vs LSB for "SSB" instead of reading OmniRig's
@@ -80,11 +81,20 @@ func (o *OmniRig) Connect() error {
 	o.rig = rigVar.ToIDispatch()
 
 	if rt, err := oleutil.GetProperty(o.rig, "RigType"); err == nil {
-		debugLog.Printf("OmniRig connected to Rig%d type=%q", o.RigNum, rt.ToString())
+		o.rigType = rt.ToString()
+		debugLog.Printf("OmniRig connected to Rig%d type=%q", o.RigNum, o.rigType)
 	}
 	return nil
 }
 
+// isIC7610 reports whether the connected rig is an IC-7610. OmniRig's generic
+// Freq property reads the wrong VFO on the 7610 (its Main/Sub model confuses the
+// stock ini), so we read VFO A explicitly for it instead — matching what Log4OM
+// shows.
+func (o *OmniRig) isIC7610() bool {
+	return strings.Contains(strings.ToUpper(o.rigType), "7610")
+}
+
 func (o *OmniRig) Disconnect() {
 	if o.rig != nil {
 		o.rig.Release()
@@ -199,6 +209,12 @@ func (o *OmniRig) ReadState() (RigState, error) {
 		s.Split = false
 		s.RxFreqHz = 0
 		s.FreqHz = freqMain
+		// IC-7610 quirk: OmniRig's generic Freq reports VFO B (its Main/Sub model
+		// confuses the stock ini), so OpsLog showed the wrong VFO. Read VFO A
+		// explicitly for the 7610 — what the operator actually wants to see.
+		if o.isIC7610() && freqA != 0 {
+			s.FreqHz = freqA
+		}
 		if s.FreqHz == 0 {
 			if s.Vfo == "B" || s.Vfo == "BB" {
 				s.FreqHz = freqB

internal/extsvc/manager.go

@@ -87,77 +87,39 @@ type Manager struct {
 	mu  sync.Mutex
 	cfg ExternalServices
 	rnd *rand.Rand
-
-	// uploadCh serialises immediate auto-uploads through a single worker. Firing a
-	// goroutine per QSO meant a pileup / ADIF-import burst hit a service with dozens
-	// of concurrent requests at once — Club Log's nginx answers that with 403, the
-	// upload is counted as failed and the QSO stays at "R" despite the others going
-	// through. One-at-a-time with a small gap keeps every upload under the limit.
-	uploadCh chan uploadJob
 }
 
-// uploadJob is one queued auto-upload.
-type uploadJob struct {
-	svc     Service
-	id      int64
-	cfg     ServiceConfig
-	attempt int // 0 on first try; incremented on each retry
-}
-
-// uploadGap spaces serialized uploads so a burst never trips a service's per-IP
-// rate limiter. maxUploadAttempts bounds retries of a transient failure.
-const (
-	uploadGap         = 250 * time.Millisecond
-	maxUploadAttempts = 4
-)
+// maxUploadAttempts bounds retries of a transient upload failure.
+const maxUploadAttempts = 4
 
 func NewManager(deps Deps) *Manager {
 	if deps.Client == nil {
 		deps.Client = &http.Client{Timeout: 20 * time.Second}
 	}
-	m := &Manager{
+	return &Manager{
 		deps: deps,
 		// Seeded from the clock; the delay only needs to be unpredictable
 		// enough to spread bursts, not cryptographically random.
-		rnd:      rand.New(rand.NewSource(time.Now().UnixNano())),
-		uploadCh: make(chan uploadJob, 4096),
+		rnd: rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
-	go m.uploadWorker()
-	return m
 }
 
-// uploadWorker drains the queue one upload at a time, spacing them so a burst of
-// freshly-logged QSOs can't hammer (and get 403'd by) a service. A transient
-// failure is re-queued with an exponential back-off, so a QSO that hit a
-// momentary rate-limit still ends up marked instead of stuck at "R".
-func (m *Manager) uploadWorker() {
-	for job := range m.uploadCh {
-		ok, retryable := m.upload(job.svc, job.id, job.cfg)
-		if !ok && retryable && job.attempt+1 < maxUploadAttempts {
-			next := job
-			next.attempt++
-			backoff := time.Duration(1<<uint(job.attempt)) * time.Second // 1s, 2s, 4s…
-			m.logf("extsvc: %s upload of QSO %d will retry (attempt %d) in %s", job.svc, job.id, next.attempt+1, backoff)
-			time.AfterFunc(backoff, func() { m.enqueueJob(next) })
+// attemptUpload uploads a QSO in its OWN goroutine and, on a TRANSIENT failure
+// (rate-limit / network), re-arms itself with exponential back-off. Each upload is
+// independent — never serialised through a shared worker, because a single slow
+// upload (LoTW signs via TQSL; a service on a 30 s timeout) would otherwise block
+// every following QSO's upload and strand them all at "R" (the regression that hit
+// the operator on the newest build while everyone on the old concurrent path was
+// fine).
+func (m *Manager) attemptUpload(svc Service, id int64, cfg ServiceConfig, attempt int) {
+	go func() {
+		ok, retryable := m.upload(svc, id, cfg)
+		if !ok && retryable && attempt+1 < maxUploadAttempts {
+			backoff := time.Duration(1<<uint(attempt)) * time.Second // 1s, 2s, 4s…
+			m.logf("extsvc: %s upload of QSO %d will retry (attempt %d) in %s", svc, id, attempt+2, backoff)
+			time.AfterFunc(backoff, func() { m.attemptUpload(svc, id, cfg, attempt+1) })
 		}
-		time.Sleep(uploadGap)
-	}
-}
-
-// enqueueUpload queues a first-attempt upload without blocking the logging path.
-func (m *Manager) enqueueUpload(svc Service, id int64, cfg ServiceConfig) {
-	m.enqueueJob(uploadJob{svc: svc, id: id, cfg: cfg})
-}
-
-// enqueueJob queues a job (possibly a retry). If the queue is somehow full (an
-// enormous burst), it falls back to a goroutine rather than dropping the upload —
-// a dropped upload would leave the QSO stuck at "R".
-func (m *Manager) enqueueJob(job uploadJob) {
-	select {
-	case m.uploadCh <- job:
-	default:
-		go m.upload(job.svc, job.id, job.cfg)
-	}
+	}()
 }
 
 func (m *Manager) logf(format string, args ...any) {
@@ -234,17 +196,17 @@ func (m *Manager) route(svc Service, id int64, cfg ServiceConfig) {
 	m.scheduleUpload(svc, id, cfg)
 }
 
-// scheduleUpload either queues the upload now (immediate) or arms a timer that
-// queues it later (delayed). Both go through the serialised worker so uploads are
-// never fired concurrently in a burst.
+// scheduleUpload uploads now (immediate) or after a random fuse (delayed). Each
+// upload runs in its own goroutine (attemptUpload) — never serialised — so a slow
+// one never holds up the rest.
 func (m *Manager) scheduleUpload(svc Service, id int64, cfg ServiceConfig) {
 	if cfg.UploadMode == ModeDelayed {
 		d := m.delaySeconds()
 		m.logf("extsvc: %s upload of QSO %d scheduled in %s", svc, id, d)
-		time.AfterFunc(d, func() { m.enqueueUpload(svc, id, cfg) })
+		time.AfterFunc(d, func() { m.attemptUpload(svc, id, cfg, 0) })
 		return
 	}
-	m.enqueueUpload(svc, id, cfg)
+	m.attemptUpload(svc, id, cfg, 0)
 }
 
 // onCloseServices returns the services configured for on-close auto-upload,

internal/qso/qso.go

@@ -781,6 +781,38 @@ func (r *Repo) BulkSetField(ctx context.Context, ids []int64, column, value stri
 	return n, nil
 }
 
+// SetExtra merges ONE key into a QSO's extras JSON without rewriting the rest of
+// the row. A slow caller that only wants to stamp its own app field (e-mailing a
+// QSL card, saving a recording) must not do a full-row Update: the row it read may
+// be seconds stale, and writing it all back silently reverts any column another
+// action changed meanwhile — e.g. an auto-upload flipping clublog_qso_upload_status
+// from R to Y. Touching only `extras` makes that impossible. Empty value deletes
+// the key.
+func (r *Repo) SetExtra(ctx context.Context, id int64, key, value string) error {
+	if id == 0 || strings.TrimSpace(key) == "" {
+		return fmt.Errorf("missing id or key")
+	}
+	var extrasJSON sql.NullString
+	if err := r.db.QueryRowContext(ctx, `SELECT extras_json FROM qso WHERE id = ?`, id).Scan(&extrasJSON); err != nil {
+		return fmt.Errorf("load extras: %w", err)
+	}
+	m := decodeExtras(extrasJSON.String)
+	if m == nil {
+		m = map[string]string{}
+	}
+	if value == "" {
+		delete(m, key)
+	} else {
+		m[key] = value
+	}
+	if _, err := r.db.ExecContext(ctx,
+		`UPDATE qso SET extras_json = ?, updated_at = ? WHERE id = ?`,
+		encodeExtras(m), db.NowISO(), id); err != nil {
+		return fmt.Errorf("set extra %s: %w", key, err)
+	}
+	return nil
+}
+
 // Update overwrites all editable fields of an existing QSO. updated_at is bumped.
 func (r *Repo) Update(ctx context.Context, q QSO) error {
 	if q.ID == 0 {
@@ -1863,26 +1895,59 @@ func (r *Repo) Count(ctx context.Context) (int64, error) {
 	return n, err
 }
 
+// LastQSOTime returns the start time of the most recently LOGGED QSO for an
+// operator (highest id wins) — used to seed the live "on air" state at launch so an
+// operator who just worked someone before (re)starting OpsLog shows online right
+// away instead of waiting for their next QSO. Empty operator matches every QSO.
+func (r *Repo) LastQSOTime(ctx context.Context, operator string) (time.Time, bool) {
+	rows, err := r.db.QueryContext(ctx, `SELECT operator, qso_date FROM qso ORDER BY id DESC LIMIT 400`)
+	if err != nil {
+		return time.Time{}, false
+	}
+	defer rows.Close()
+	opFilter := strings.ToUpper(strings.TrimSpace(operator))
+	for rows.Next() {
+		var oper, dateStr sql.NullString
+		if err := rows.Scan(&oper, &dateStr); err != nil {
+			return time.Time{}, false
+		}
+		if strings.ToUpper(strings.TrimSpace(oper.String)) != opFilter {
+			continue
+		}
+		if t := parseTimeLoose(dateStr.String).UTC(); !t.IsZero() {
+			return t, true
+		}
+	}
+	return time.Time{}, false
+}
+
 // RecentRate counts QSOs whose start time falls within each trailing window from
-// `now` — the live "QSO rate" meter shown in the header. It scans only the most
-// recently inserted rows (ORDER BY id DESC LIMIT), since any QSO in the last hour
-// was inserted recently; that keeps it cheap even on a large log. qso_date is the
-// repo's text column, parsed with parseTimeLoose (backend-format agnostic).
-func (r *Repo) RecentRate(ctx context.Context, now time.Time, windows ...time.Duration) ([]int, error) {
+// `now` — the live "QSO rate" meter shown in the header. When operator is non-empty
+// (multi-op on a shared logbook) only that operator's QSOs are counted, so each op
+// sees their OWN performance, not the cumulative rate; empty operator matches every
+// QSO. It scans only the most recently inserted rows (ORDER BY id DESC LIMIT), since
+// any QSO in the last hour was inserted recently; that keeps it cheap even on a large
+// log. qso_date is the repo's text column, parsed with parseTimeLoose (backend-format
+// agnostic).
+func (r *Repo) RecentRate(ctx context.Context, now time.Time, operator string, windows ...time.Duration) ([]int, error) {
 	counts := make([]int, len(windows))
-	// 400 rows covers a full hour even at a blistering contest rate (>300/h); any
-	// QSO inside the trailing windows is among the most recently inserted.
-	rows, err := r.db.QueryContext(ctx, `SELECT qso_date FROM qso ORDER BY id DESC LIMIT 400`)
+	// 2000 rows covers a full hour for one operator even in a busy multi-op run
+	// (other operators' rows are discarded before counting).
+	rows, err := r.db.QueryContext(ctx, `SELECT operator, qso_date FROM qso ORDER BY id DESC LIMIT 2000`)
 	if err != nil {
 		return counts, err
 	}
 	defer rows.Close()
 	now = now.UTC()
+	opFilter := strings.ToUpper(strings.TrimSpace(operator))
 	for rows.Next() {
-		var dateStr sql.NullString
-		if err := rows.Scan(&dateStr); err != nil {
+		var oper, dateStr sql.NullString
+		if err := rows.Scan(&oper, &dateStr); err != nil {
 			return counts, err
 		}
+		if strings.ToUpper(strings.TrimSpace(oper.String)) != opFilter {
+			continue // a different operator's QSO — not part of my rate
+		}
 		t := parseTimeLoose(dateStr.String).UTC()
 		if t.IsZero() || t.After(now) {
 			continue

livestatus.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"database/sql"
 	"fmt"
 	"strings"
 	"time"
@@ -19,6 +20,23 @@ import (
 
 const keyLiveStatusEnabled = "livestatus.enabled"
 
+// liveOnlineWindow is how long after the last logged contact an operator still
+// counts as "on air". Leaving the log open without working anyone flips them
+// offline once this elapses; logging a new QSO flips them back online.
+const liveOnlineWindow = 5 * time.Minute
+
+// noteLiveQSO records that this operator just logged a new contact and pushes the
+// live status right away, so they flip back to online the instant they work
+// someone. Called from the logging paths (manual entry, UDP auto-log).
+func (a *App) noteLiveQSO() {
+	a.liveActMu.Lock()
+	a.liveLastQSOAt = time.Now()
+	a.liveActMu.Unlock()
+	if a.liveStatusActive() {
+		go a.publishLiveStatus()
+	}
+}
+
 // GetLiveStatusEnabled reports whether this operator publishes live status.
 func (a *App) GetLiveStatusEnabled() bool {
 	if a.settings == nil {
@@ -50,11 +68,61 @@ func (a *App) SetLiveStatusEnabled(on bool) error {
 	return nil
 }
 
+// seedLiveLastQSO primes liveLastQSOAt from the DB at launch, so an operator who
+// worked someone shortly before (re)starting OpsLog is shown "on air" right away
+// instead of offline until their next QSO.
+func (a *App) seedLiveLastQSO() {
+	if a.qso == nil {
+		return
+	}
+	op, _ := a.liveStatusOperator()
+	if op == "" {
+		return
+	}
+	if t, ok := a.qso.LastQSOTime(a.ctx, op); ok {
+		a.liveActMu.Lock()
+		if a.liveLastQSOAt.IsZero() {
+			a.liveLastQSOAt = t
+		}
+		a.liveActMu.Unlock()
+	}
+}
+
+// liveLastQSOTime is the authoritative "last contact" instant for this operator:
+// the most recent of the in-memory stamp (this session's local logs, updated
+// instantly) AND the DB (a contact that arrived via the SHARED logbook from another
+// station, or one logged before launch). Used by both the published status and the
+// UI badge so on-air/offline is right in every multi-op case.
+func (a *App) liveLastQSOTime() time.Time {
+	a.liveActMu.Lock()
+	last := a.liveLastQSOAt
+	a.liveActMu.Unlock()
+	if a.qso != nil {
+		if op, _ := a.liveStatusOperator(); op != "" {
+			if t, ok := a.qso.LastQSOTime(a.ctx, op); ok && t.After(last) {
+				last = t
+			}
+		}
+	}
+	return last
+}
+
+// LiveLastQSOAgeSec returns seconds since this operator's last logged QSO, or -1 if
+// none is known — the UI polls it for the "on air" badge.
+func (a *App) LiveLastQSOAgeSec() int {
+	last := a.liveLastQSOTime()
+	if last.IsZero() {
+		return -1
+	}
+	return int(time.Since(last).Seconds())
+}
+
 // liveStatusLoop heartbeats the current activity while enabled. Started once at
 // startup; cheap no-op when disabled or not on MySQL.
 func (a *App) liveStatusLoop() {
 	defer func() { _ = recover() }() // never crash the app from here
 	applog.Printf("livestatus: loop started")
+	a.seedLiveLastQSO()   // so online/offline is right at launch, not only after the next QSO
 	a.publishLiveStatus() // attempt immediately, don't wait the first tick
 	t := time.NewTicker(15 * time.Second)
 	defer t.Stop()
@@ -133,33 +201,117 @@ func (a *App) publishLiveStatus() {
 		mode = a.liveMode
 	}
 	a.liveActMu.Unlock()
+	lastQSO := a.liveLastQSOTime() // authoritative (in-memory OR shared DB)
+	// Online = a new contact was logged within the window. An operator who leaves
+	// the log open but stops working shows offline after `liveOnlineWindow`; the
+	// next QSO flips them back on. never-logged (zero time) → offline.
+	online := 0
+	var lastQSOArg any
+	if !lastQSO.IsZero() {
+		lastQSOArg = lastQSO.UTC()
+		if time.Since(lastQSO) < liveOnlineWindow {
+			online = 1
+		}
+	}
 	if err := a.ensureLiveStatusTable(); err != nil {
 		applog.Printf("livestatus: CREATE TABLE failed: %v", err)
 		return
 	}
 	_, err := a.logDb.ExecContext(a.ctx,
-		"INSERT INTO live_status (operator, station, freq_hz, band, mode, updated_at) "+
-			"VALUES (?, ?, ?, ?, ?, UTC_TIMESTAMP()) "+
+		"INSERT INTO live_status (operator, station, freq_hz, band, mode, online, version, last_qso_at, updated_at) "+
+			"VALUES (?, ?, ?, ?, ?, ?, ?, ?, UTC_TIMESTAMP()) "+
 			"ON DUPLICATE KEY UPDATE station=VALUES(station), freq_hz=VALUES(freq_hz), "+
-			"band=VALUES(band), mode=VALUES(mode), updated_at=UTC_TIMESTAMP()",
-		op, station, freqHz, band, mode)
+			"band=VALUES(band), mode=VALUES(mode), online=VALUES(online), version=VALUES(version), "+
+			"last_qso_at=VALUES(last_qso_at), updated_at=UTC_TIMESTAMP()",
+		op, station, freqHz, band, mode, online, appVersion, lastQSOArg)
 	if err != nil {
 		applog.Printf("livestatus: INSERT failed: %v", err)
 		return
 	}
-	applog.Printf("livestatus: published op=%s station=%s %dHz %s %s", op, station, freqHz, band, mode)
+	applog.Printf("livestatus: published op=%s station=%s %dHz %s %s online=%d", op, station, freqHz, band, mode, online)
+}
+
+// LiveStation is one operator's live status for the multi-op "who's on air" widget.
+type LiveStation struct {
+	Operator string `json:"operator"`
+	Station  string `json:"station"`
+	FreqHz   int64  `json:"freq_hz"`
+	Band     string `json:"band"`
+	Mode     string `json:"mode"`
+	Online   bool   `json:"online"`  // logged a QSO in the last 5 min
+	Version  string `json:"version"` // that operator's OpsLog version
+	AgeSec   int    `json:"age_sec"` // seconds since their last heartbeat (stale = OpsLog closed)
+}
+
+// GetLiveStations returns every operator's live status from the shared MySQL
+// logbook (empty on a local SQLite logbook). Rows whose heartbeat is very stale
+// (OpsLog closed without clearing its row) are dropped. Online stations first.
+func (a *App) GetLiveStations() []LiveStation {
+	if a.logDb == nil || a.dbBackend != "mysql" {
+		return nil
+	}
+	if err := a.ensureLiveStatusTable(); err != nil {
+		return nil
+	}
+	rows, err := a.logDb.QueryContext(a.ctx,
+		"SELECT operator, COALESCE(station,''), COALESCE(freq_hz,0), COALESCE(band,''), "+
+			"COALESCE(mode,''), COALESCE(online,0), COALESCE(version,''), "+
+			"TIMESTAMPDIFF(SECOND, updated_at, UTC_TIMESTAMP()) "+
+			"FROM live_status ORDER BY online DESC, operator")
+	if err != nil {
+		applog.Printf("livestatus: list failed: %v", err)
+		return nil
+	}
+	defer rows.Close()
+	out := []LiveStation{}
+	for rows.Next() {
+		var s LiveStation
+		var online int
+		var age sql.NullInt64
+		if err := rows.Scan(&s.Operator, &s.Station, &s.FreqHz, &s.Band, &s.Mode, &online, &s.Version, &age); err != nil {
+			continue
+		}
+		// Drop rows from an OpsLog that hasn't heartbeated in a while (closed): the
+		// heartbeat is every 15 s, so > 3 min means it's gone.
+		if age.Valid && age.Int64 > 180 {
+			continue
+		}
+		s.Online = online == 1
+		if age.Valid {
+			s.AgeSec = int(age.Int64)
+		}
+		out = append(out, s)
+	}
+	return out
 }
 
 func (a *App) ensureLiveStatusTable() error {
-	_, err := a.logDb.ExecContext(a.ctx,
+	if _, err := a.logDb.ExecContext(a.ctx,
 		"CREATE TABLE IF NOT EXISTS live_status ("+
 			"operator VARCHAR(32) PRIMARY KEY, "+
 			"station VARCHAR(32), "+
 			"freq_hz BIGINT, "+
 			"band VARCHAR(16), "+
 			"mode VARCHAR(16), "+
-			"updated_at DATETIME)")
-	return err
+			"online TINYINT DEFAULT 0, "+
+			"version VARCHAR(32), "+
+			"last_qso_at DATETIME NULL, "+
+			"updated_at DATETIME)"); err != nil {
+		return err
+	}
+	// Add newer columns to a table created by an older build. MySQL has no portable
+	// "ADD COLUMN IF NOT EXISTS", so just run the ALTERs and ignore the duplicate-
+	// column error when they already exist.
+	for _, ddl := range []string{
+		"ALTER TABLE live_status ADD COLUMN online TINYINT DEFAULT 0",
+		"ALTER TABLE live_status ADD COLUMN version VARCHAR(32)",
+		"ALTER TABLE live_status ADD COLUMN last_qso_at DATETIME NULL",
+	} {
+		if _, err := a.logDb.ExecContext(a.ctx, ddl); err != nil && !strings.Contains(strings.ToLower(err.Error()), "duplicate column") {
+			applog.Printf("livestatus: %q: %v", ddl, err)
+		}
+	}
+	return nil
 }
 
 // clearLiveStatus removes this operator's row (on disable / shutdown).

main.go

@@ -4,6 +4,7 @@ import (
 	"embed"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/wailsapp/wails/v2"
 	"github.com/wailsapp/wails/v2/pkg/options"
@@ -35,15 +36,53 @@ func profileArg(args []string) string {
 	return ""
 }
 
+// hasFlag reports whether flag is present in args.
+func hasFlag(args []string, flag string) bool {
+	for _, a := range args {
+		if a == flag {
+			return true
+		}
+	}
+	return false
+}
+
+// acquireInstance grabs the single-instance mutex. On a normal launch it's a plain
+// try (fail → another OpsLog is running, so exit). On a --post-update relaunch the
+// previous instance may still be shutting down and holding the mutex, so retry for
+// a few seconds until it frees.
+func acquireInstance(postUpdate bool) bool {
+	if acquireSingleInstance() {
+		return true
+	}
+	if !postUpdate {
+		return false
+	}
+	deadline := time.Now().Add(20 * time.Second)
+	for time.Now().Before(deadline) {
+		time.Sleep(300 * time.Millisecond)
+		if acquireSingleInstance() {
+			return true
+		}
+	}
+	return false
+}
+
 func main() {
 	// Single-instance guard: if OpsLog is already running, focus that window and
 	// exit instead of spawning a duplicate. A second process would open its own
 	// CAT (FlexRadio) connection and Ultrabeam follow loop, and the two would
 	// fight over the rig/antenna frequency — the cause of "the antenna re-tunes on
 	// its own" when a windowless zombie instance was left running.
-	if !acquireSingleInstance() {
+	// A --post-update relaunch (from the auto-updater) may start while the previous
+	// instance is still exiting and holding the single-instance mutex — wait for it
+	// to free instead of bailing out. Then clear the old exe it left behind.
+	postUpdate := hasFlag(os.Args[1:], "--post-update")
+	if !acquireInstance(postUpdate) {
 		return
 	}
+	if postUpdate {
+		cleanupOldUpdateBinary()
+	}
 
 	// Create an instance of the app structure
 	app := NewApp()

relayauto.go

@@ -96,8 +96,23 @@ func bandInList(bands []string, band string) bool {
 	return false
 }
 
+// relayAction is one relay's computed desired state for this evaluation.
+type relayAction struct {
+	dev   string
+	relay int
+	want  bool
+}
+
 // applyRelayAuto evaluates every rule against the current frequency/band and
-// switches only the relays whose desired state changed since the last apply.
+// switches only the relays that are NOT already in the wanted position. Two things
+// it deliberately does NOT do, which used to make the relay clunk on every
+// launch/close:
+//   - Never acts on an UNKNOWN frequency/band. When the CAT disconnects (app close)
+//     the frequency drops to 0; reading that as "out of range" and switching the
+//     relay off — then back on at the next launch — was the whole bug.
+//   - Never commands a relay already in the right position: on the first evaluation
+//     after launch/save it reads the boards' LIVE state, so a relay that's already
+//     correct is left untouched instead of being re-sent.
 func (a *App) applyRelayAuto(freqHz int64, band string) {
 	a.relayAutoMu.Lock()
 	defer a.relayAutoMu.Unlock()
@@ -110,8 +125,11 @@ func (a *App) applyRelayAuto(freqHz int64, band string) {
 		a.relayAutoLast = map[string]bool{}
 	}
 	khz := float64(freqHz) / 1000.0
+	band = strings.TrimSpace(band)
 
-	changed := false
+	// Compute desired states, skipping rules whose input is unknown right now.
+	var acts []relayAction
+	needLive := false
 	for _, r := range cfg.Rules {
 		if r.Relay < 1 {
 			continue
@@ -119,8 +137,11 @@ func (a *App) applyRelayAuto(freqHz int64, band string) {
 		var want bool
 		switch r.Mode {
 		case "freq":
+			if freqHz <= 0 {
+				continue // no known frequency (CAT off/closing) → leave the relay as-is
+			}
 			if r.FreqLoKHz <= 0 && r.FreqHiKHz <= 0 {
-				continue // unconfigured range → leave the relay alone
+				continue // unconfigured range
 			}
 			lo, hi := r.FreqLoKHz, r.FreqHiKHz
 			if hi < lo {
@@ -128,6 +149,9 @@ func (a *App) applyRelayAuto(freqHz int64, band string) {
 			}
 			want = khz >= lo && khz <= hi
 		case "band":
+			if band == "" {
+				continue // no known band → leave the relay as-is
+			}
 			if len(r.Bands) == 0 {
 				continue
 			}
@@ -135,16 +159,43 @@ func (a *App) applyRelayAuto(freqHz int64, band string) {
 		default:
 			continue // "off"/empty → not managed
 		}
-
-		key := relayAutoKey(r.DeviceID, r.Relay)
-		if last, ok := a.relayAutoLast[key]; ok && last == want {
-			continue // no change → don't hammer the board
+		acts = append(acts, relayAction{r.DeviceID, r.Relay, want})
+		if _, ok := a.relayAutoLast[relayAutoKey(r.DeviceID, r.Relay)]; !ok {
+			needLive = true
 		}
-		if err := a.StationSetRelay(r.DeviceID, r.Relay, want); err != nil {
-			applog.Printf("relay auto: set %s relay %d = %v failed: %v", r.DeviceID, r.Relay, want, err)
+	}
+	if len(acts) == 0 {
+		return
+	}
+
+	// First evaluation after launch/save: read the boards' LIVE relay states once
+	// so we don't re-command a relay that's already in the wanted position.
+	var live map[string]bool
+	if needLive {
+		live = map[string]bool{}
+		for _, ds := range a.GetStationStatus() {
+			for _, rl := range ds.Relays {
+				live[relayAutoKey(ds.ID, rl.Number)] = rl.On
+			}
+		}
+	}
+
+	changed := false
+	for _, ac := range acts {
+		key := relayAutoKey(ac.dev, ac.relay)
+		cur, known := a.relayAutoLast[key]
+		if !known && live != nil {
+			cur, known = live[key]
+		}
+		if known && cur == ac.want {
+			a.relayAutoLast[key] = ac.want // already in position — record it, don't switch
+			continue
+		}
+		if err := a.StationSetRelay(ac.dev, ac.relay, ac.want); err != nil {
+			applog.Printf("relay auto: set %s relay %d = %v failed: %v", ac.dev, ac.relay, ac.want, err)
 			continue // don't cache a failed write — retry next change
 		}
-		a.relayAutoLast[key] = want
+		a.relayAutoLast[key] = ac.want
 		changed = true
 	}
 

telemetry.go

@@ -21,7 +21,7 @@ import (
 
 const (
 	// appVersion is stamped on every heartbeat (and could feed the About box).
-	appVersion = "0.20.1"
+	appVersion = "0.20.2"
 
 	// posthogHost is the PostHog ingestion endpoint. EU cloud by default; change
 	// to https://us.i.posthog.com for a US project.

update.go

@@ -1,12 +1,21 @@
 package main
 
 import (
+	"archive/zip"
 	"encoding/json"
+	"fmt"
+	"io"
 	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
 	"strconv"
 	"strings"
+	"syscall"
 	"time"
 
+	wruntime "github.com/wailsapp/wails/v2/pkg/runtime"
+
 	"hamlog/internal/applog"
 )
 
@@ -14,12 +23,13 @@ import (
 // build (the exe lives there; source stays on Gitea). Adjust the repo if needed.
 const updateCheckURL = "https://api.github.com/repos/GregTroar/OpsLog/releases/latest"
 
-// UpdateInfo is the result of the startup version check.
+// UpdateInfo is the result of the version check.
 type UpdateInfo struct {
-	Current   string `json:"current"`   // this build's version (appVersion)
-	Latest    string `json:"latest"`    // newest published release, "" if unknown
-	Available bool   `json:"available"` // Latest > Current
-	URL       string `json:"url"`       // release page to open
+	Current     string `json:"current"`      // this build's version (appVersion)
+	Latest      string `json:"latest"`       // newest published release, "" if unknown
+	Available   bool   `json:"available"`    // Latest > Current
+	URL         string `json:"url"`          // release page to open (manual fallback)
+	DownloadURL string `json:"download_url"` // the .exe/.zip asset to auto-download, "" if none
 }
 
 // CheckForUpdate asks GitHub for the latest release and compares it to this
@@ -45,6 +55,10 @@ func (a *App) CheckForUpdate() UpdateInfo {
 	var r struct {
 		TagName string `json:"tag_name"`
 		HTMLURL string `json:"html_url"`
+		Assets  []struct {
+			Name string `json:"name"`
+			URL  string `json:"browser_download_url"`
+		} `json:"assets"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&r); err != nil {
 		return out
@@ -52,8 +66,25 @@ func (a *App) CheckForUpdate() UpdateInfo {
 	out.Latest = strings.TrimPrefix(strings.TrimSpace(r.TagName), "v")
 	out.URL = r.HTMLURL
 	out.Available = versionLess(appVersion, out.Latest)
+	// Pick the auto-download asset: a bare Windows .exe (portable build) first,
+	// else a .zip we can unpack. The frontend hands this straight to
+	// DownloadAndApplyUpdate for a one-click in-app update.
+	for _, as := range r.Assets {
+		if strings.HasSuffix(strings.ToLower(as.Name), ".exe") {
+			out.DownloadURL = as.URL
+			break
+		}
+	}
+	if out.DownloadURL == "" {
+		for _, as := range r.Assets {
+			if strings.HasSuffix(strings.ToLower(as.Name), ".zip") {
+				out.DownloadURL = as.URL
+				break
+			}
+		}
+	}
 	if out.Available {
-		applog.Printf("update: newer version available — current=%s latest=%s", appVersion, out.Latest)
+		applog.Printf("update: newer version available — current=%s latest=%s asset=%q", appVersion, out.Latest, out.DownloadURL)
 	}
 	return out
 }
@@ -82,6 +113,176 @@ func versionLess(a, b string) bool {
 	return false
 }
 
+// DownloadAndApplyUpdate downloads the new build, swaps it in for the running exe
+// and relaunches — the fully in-app update. Progress is emitted on "update:progress"
+// (0-100) so the UI can show a bar. On success it never returns normally: it starts
+// the new process and quits this one.
+func (a *App) DownloadAndApplyUpdate(url string) error {
+	if strings.TrimSpace(url) == "" {
+		return fmt.Errorf("no download URL")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return fmt.Errorf("locate executable: %w", err)
+	}
+	dir := filepath.Dir(exe)
+
+	// Download to a temp file next to the exe (same volume, so the rename-swap is
+	// atomic and can't fail across drives).
+	tmp := filepath.Join(dir, ".opslog-update.download")
+	_ = os.Remove(tmp)
+	if err := a.downloadWithProgress(url, tmp); err != nil {
+		_ = os.Remove(tmp)
+		return fmt.Errorf("download: %w", err)
+	}
+
+	// The asset is either the bare exe or a zip holding it. Resolve to the new exe.
+	newExe := tmp
+	if strings.HasSuffix(strings.ToLower(url), ".zip") {
+		extracted, xerr := extractExeFromZip(tmp, dir)
+		_ = os.Remove(tmp)
+		if xerr != nil {
+			return fmt.Errorf("unpack: %w", xerr)
+		}
+		newExe = extracted
+	}
+
+	// Swap: rename the running exe out of the way (Windows allows renaming a
+	// running image), move the new one into its place, then relaunch. Roll back if
+	// the second rename fails so we never end up with no exe.
+	oldExe := exe + ".old"
+	_ = os.Remove(oldExe)
+	if err := os.Rename(exe, oldExe); err != nil {
+		_ = os.Remove(newExe)
+		return fmt.Errorf("stage current exe: %w", err)
+	}
+	if err := os.Rename(newExe, exe); err != nil {
+		_ = os.Rename(oldExe, exe) // roll back
+		return fmt.Errorf("install new exe: %w", err)
+	}
+	// Clear the "downloaded from the internet" mark (NTFS Zone.Identifier stream).
+	// Otherwise Windows SmartScreen wants to prompt "are you sure you want to open
+	// this?" — but since we launch the exe programmatically that prompt never shows,
+	// and the launch is silently blocked. This is exactly why the relaunch failed.
+	_ = os.Remove(exe + ":Zone.Identifier")
+	applog.Printf("update: installed new exe, scheduling relaunch")
+
+	// Relaunch via a detached, hidden PowerShell that WAITS for this process to exit
+	// (so the single-instance mutex is free) and THEN starts the new exe. Launching
+	// the new exe directly while we're still alive raced the mutex and often left
+	// nothing running; waiting for our own exit first makes the restart reliable,
+	// and the launcher outlives us.
+	quoted := strings.ReplaceAll(exe, "'", "''")
+	ps := fmt.Sprintf(
+		"Wait-Process -Id %d -ErrorAction SilentlyContinue; Start-Sleep -Milliseconds 400; Start-Process -FilePath '%s' -ArgumentList '--post-update'",
+		os.Getpid(), quoted)
+	cmd := exec.Command("powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command", ps)
+	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: 0x08000000} // CREATE_NO_WINDOW
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("schedule relaunch: %w", err)
+	}
+	if a.ctx != nil {
+		wruntime.Quit(a.ctx)
+	} else {
+		os.Exit(0)
+	}
+	return nil
+}
+
+// downloadWithProgress streams url into dest, emitting "update:progress" (0-100).
+func (a *App) downloadWithProgress(url, dest string) error {
+	client := &http.Client{Timeout: 10 * time.Minute}
+	resp, err := client.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+	f, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	total := resp.ContentLength
+	var read int64
+	last := -1
+	buf := make([]byte, 64*1024)
+	emit := func(pct int) {
+		if a.ctx != nil {
+			wruntime.EventsEmit(a.ctx, "update:progress", pct)
+		}
+	}
+	emit(0)
+	for {
+		n, rerr := resp.Body.Read(buf)
+		if n > 0 {
+			if _, werr := f.Write(buf[:n]); werr != nil {
+				return werr
+			}
+			read += int64(n)
+			if total > 0 {
+				if pct := int(read * 100 / total); pct != last {
+					last = pct
+					emit(pct)
+				}
+			}
+		}
+		if rerr == io.EOF {
+			break
+		}
+		if rerr != nil {
+			return rerr
+		}
+	}
+	emit(100)
+	return nil
+}
+
+// extractExeFromZip unpacks the first *.exe found in the zip into dir and returns
+// its path.
+func extractExeFromZip(zipPath, dir string) (string, error) {
+	zr, err := zip.OpenReader(zipPath)
+	if err != nil {
+		return "", err
+	}
+	defer zr.Close()
+	for _, zf := range zr.File {
+		if !strings.HasSuffix(strings.ToLower(zf.Name), ".exe") {
+			continue
+		}
+		rc, err := zf.Open()
+		if err != nil {
+			return "", err
+		}
+		out := filepath.Join(dir, ".opslog-update.exe")
+		f, err := os.Create(out)
+		if err != nil {
+			rc.Close()
+			return "", err
+		}
+		_, cerr := io.Copy(f, rc)
+		rc.Close()
+		f.Close()
+		if cerr != nil {
+			return "", cerr
+		}
+		return out, nil
+	}
+	return "", fmt.Errorf("no .exe inside the archive")
+}
+
+// cleanupOldUpdateBinary removes the previous exe left behind by a self-update
+// (exe + ".old"). Called at startup after a --post-update relaunch. Best-effort:
+// the file may still be briefly locked, in which case the next launch gets it.
+func cleanupOldUpdateBinary() {
+	if exe, err := os.Executable(); err == nil {
+		_ = os.Remove(exe + ".old")
+	}
+}
+
 // leadingInt parses the leading digits of s (e.g. "2beta" → 2), 0 if none.
 func leadingInt(s string) int {
 	s = strings.TrimSpace(s)