chore: release v0.27.22

An operator spent three hours setting up, accepted the update, and reopened a
program that had forgotten everything. It is the second such report.

The updater is not the culprit — it touches its own exe and nothing else. The
pointer is. config.json is the only record of WHERE the database is, and it was
written with os.WriteFile: truncate, then fill. A process that stops between
those two steps — a crash, a power cut, an update's watchdog force-exiting the
old instance — leaves the file empty. readBootstrap then swallowed the parse
error, returned an empty pointer, and startup read that as "no database chosen":
it created a NEW one at the default path and opened it. Three hours of work
still on disk, and an application presenting itself as freshly installed.

Three changes, in the order they defend:

  - The write is atomic. A temporary file, fsync'd, renamed into place — and a
    rename within a volume cannot publish half a file. The previous contents are
    kept as config.json.bak, because a pointer is a few dozen bytes and an
    evening of configuration is not.
  - A pointer that EXISTS and cannot be read is no longer treated as no pointer.
    It is restored from the backup, and when there is nothing to restore from
    the broken file is KEPT as config.json.broken — it is evidence, and it may
    still be readable by hand.
  - Creating a new, empty settings database in a folder that already holds a
    full one is now said out loud, in the startup log and on screen. Nothing is
    deleted and nothing is guessed — guessing which file is theirs is how the
    wrong one gets opened — but the message names the other file, which is where
    their settings still are.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

app.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/json"
@@ -950,6 +951,7 @@ type App struct {
 	pttPort           serial.Port            // open serial port while PTT (RTS/DTR) is asserted
 	pttKeyedMethod    string                 // "cat" | "rts" | "dtr" while keyed; "" when idle
 	pttGen            int64                  // bumped on every key; a delayed unkey only fires if unchanged (guards against a stale release cutting a new transmission)
+	startupWarn       string                 // a non-fatal warning worth putting in front of the operator at launch
 	startupErr        string                 // captured for surfacing to the frontend
 	settingsScoped    atomic.Bool            // true once a.settings is scoped to the active profile — GetUIPref/SetUIPref (per-profile) must wait for it, else an early call reads the wrong scope and e.g. resets the theme
 	dbPath            string                 // settings/config database file (settings + profiles); may be a user-chosen location
@@ -1194,6 +1196,25 @@ func (a *App) startup(ctx context.Context) {
 		boot.DeletePending = ""
 		_ = writeBootstrap(dataDir, boot)
 	}
+	// About to create a database in a folder that already has one.
+	//
+	// This is the shape of every "everything I set up is gone" report: the
+	// pointer was lost or the default moved, OpsLog opened a NEW empty database
+	// beside the full one, and the operator was shown a program that had
+	// forgotten them. Nothing is changed here — guessing which file is theirs is
+	// how the wrong one gets picked — but it is said loudly, in the startup log
+	// and on screen, while the old file is still sitting there untouched.
+	if !fileExists(a.dbPath) {
+		if others := otherDatabasesIn(dataDir, a.dbPath); len(others) > 0 {
+			msg := fmt.Sprintf("OpsLog is starting a NEW, EMPTY settings database (%s) although this folder already holds %s. "+
+				"Nothing has been deleted. If your settings have gone, that other file is where they are: "+
+				"Settings ▸ Database ▸ open an existing database, and pick it.",
+				filepath.Base(a.dbPath), strings.Join(others, ", "))
+			bootLog("%s", msg)
+			fmt.Println("OpsLog:", msg)
+			a.startupWarn = msg
+		}
+	}
 	if err := os.MkdirAll(filepath.Dir(a.dbPath), 0o755); err != nil {
 		a.startupErr = "cannot create db folder: " + err.Error()
 		fmt.Println("OpsLog:", a.startupErr)
@@ -1741,6 +1762,10 @@ type StartupStatus struct {
 	OK     bool   `json:"ok"`
 	Err    string `json:"err"`
 	DBPath string `json:"db_path"`
+	// Warn is not a failure and must not be swallowed: OpsLog started, and
+	// something about WHERE it started is worth an operator seeing before they
+	// conclude their configuration has been thrown away.
+	Warn string `json:"warn"`
 }
 
 // GetStartupStatus exposes whatever happened during startup so the UI
@@ -1771,6 +1796,7 @@ func (a *App) GetStartupStatus() StartupStatus {
 		OK:     a.startupErr == "",
 		Err:    a.startupErr,
 		DBPath: a.dbPath,
+		Warn:   a.startupWarn,
 	}
 }
 
@@ -2405,11 +2431,37 @@ func overlapsEnough(x, y, w, h, vx, vy, vw, vh int) bool {
 // value if the file is missing/unreadable.
 func readBootstrap(dataDir string) dbPointer {
 	var c dbPointer
-	b, err := os.ReadFile(dbPointerPath(dataDir))
+	path := dbPointerPath(dataDir)
+	b, err := os.ReadFile(path)
 	if err != nil {
+		// No pointer at all: a first run, or a folder that never had one. The
+		// caller falls back to this folder's own default, which is correct.
 		return c
 	}
-	_ = json.Unmarshal(b, &c)
+	if uerr := json.Unmarshal(b, &c); uerr != nil || len(bytes.TrimSpace(b)) == 0 {
+		// A pointer that EXISTS and cannot be read is not the same thing as no
+		// pointer, and treating it as one is how an operator loses an evening:
+		// the database moves back to this folder's default, the default is
+		// empty, and the program opens having forgotten everything. Reported
+		// twice, both times just after an update.
+		//
+		// The previous contents are kept beside it for exactly this, so the
+		// answer is usually one file away.
+		bootLog("config.json is unreadable (%v, %d bytes) — trying the backup", uerr, len(b))
+		var prev dbPointer
+		if bk, berr := os.ReadFile(path + ".bak"); berr == nil && json.Unmarshal(bk, &prev) == nil {
+			bootLog("config.json restored from its backup (database %q)", prev.DBPath)
+			c = prev
+			// Put it back, so the next launch does not have to do this again.
+			_ = os.WriteFile(path, bk, 0o644)
+		} else {
+			// Nothing to restore from. Keep the broken file rather than
+			// overwriting it — it is evidence, and it may still be readable by
+			// hand.
+			_ = os.Rename(path, path+".broken")
+			bootLog("no usable backup — the broken config.json was kept as config.json.broken")
+		}
+	}
 	// Stored relative when it lives inside the app folder, so the pointer follows
 	// the folder from C:OpsLog to D:OpsLog or to a stick.
 	c.DBPath = resolvePath(dataDir, c.DBPath)
@@ -2417,11 +2469,51 @@ func readBootstrap(dataDir string) dbPointer {
 	return c
 }
 
+// writeBootstrap saves the pointer ATOMICALLY, and keeps the previous one.
+//
+// os.WriteFile truncates the file and then fills it, so a process that stops
+// in between — a crash, a power cut, an update's watchdog force-exiting the old
+// instance — leaves an empty or half-written config.json. That file is the only
+// record of WHERE the database is, and losing it moved an operator's whole
+// station back to an empty default. It has happened twice.
+//
+// A temporary file renamed into place cannot do that: on Windows and on Unix
+// alike the rename is atomic within a volume, so config.json is either entirely
+// the old contents or entirely the new. The previous contents are kept as a
+// .bak because a pointer is a few dozen bytes and an evening of configuration
+// is not.
 func writeBootstrap(dataDir string, c dbPointer) error {
 	c.DBPath = portablePath(c.DBPath)
 	c.DeletePending = portablePath(c.DeletePending)
-	b, _ := json.MarshalIndent(c, "", "  ")
-	return os.WriteFile(dbPointerPath(dataDir), b, 0o644)
+	b, err := json.MarshalIndent(c, "", "  ")
+	if err != nil {
+		return err
+	}
+	path := dbPointerPath(dataDir)
+	if old, rerr := os.ReadFile(path); rerr == nil && len(bytes.TrimSpace(old)) > 0 {
+		_ = os.WriteFile(path+".bak", old, 0o644)
+	}
+	tmp := path + ".tmp"
+	f, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o644)
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(b); err != nil {
+		f.Close()
+		_ = os.Remove(tmp)
+		return err
+	}
+	// On disk before the rename, or the rename can publish an empty file.
+	if err := f.Sync(); err != nil {
+		f.Close()
+		_ = os.Remove(tmp)
+		return err
+	}
+	if err := f.Close(); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	return os.Rename(tmp, path)
 }
 
 // readDBPointer returns the user-chosen DB path, or "" for the default.
@@ -17486,7 +17578,7 @@ func linkHeading(l rotorLink) (az, el float64, hasEl bool, raw string, err error
 func linkGoTo(l rotorLink, az, el int) error {
 	switch l.Type {
 	case "rotgenius":
-		return rotgenius.New(l.Host, l.Port).GoTo(l.Num, az)
+		return rotgeniusGoTo(l, az)
 	case "arco":
 		return arcoClient(l).GoTo(az)
 	case "erc":
@@ -22517,3 +22609,68 @@ func (a *App) IcomConsolePTT(on bool) error {
 	}
 	return a.cat.SetPTT(on)
 }
+
+// rotgeniusGoTo picks which way round to reach a bearing when the controller
+// has an overlap to offer.
+//
+// THE GENIUS DECIDES, and it needs no setting from us. It reports the limits it
+// is configured with on every heading query, and those are the truth about what
+// is bolted to the tower: if the far side of an overlap is reachable it says so,
+// and if it is not, asking anyway turns a working command into a rejected one.
+// Its manual is unambiguous — "you will not be able to give it a target beyond
+// the limits".
+//
+// In practice today that means the plain bearing, every time. A Rotator Genius
+// is a 360° controller: its Limits fields say where the mechanical stop sits
+// within one turn ("5 to 4" is a dead zone at four and a half degrees), not how
+// far the mast can travel, and an operator with a 450° rotator gets 360° of it.
+// The overlap branch stays because the decision is made from what the device
+// reports rather than from an assumption about it — a controller that one day
+// answers 450 will be driven through the overlap without a line changing here.
+//
+// Which of the two forms is right depends on where the antenna IS, so the
+// heading is read first and the nearer one wins: a beam at 350° heading for 010°
+// should cross north, not travel the other 340 degrees.
+func rotgeniusGoTo(l rotorLink, az int) error {
+	c := rotgenius.New(l.Host, l.Port)
+	a := ((az % 360) + 360) % 360
+	st, _, err := c.Heading(l.Num)
+	if err != nil || !st.Connected || st.LimitCW <= 360 {
+		return c.GoTo(l.Num, a)
+	}
+	if alt := a + 360; alt <= st.LimitCW && absInt(alt-st.Azimuth) < absInt(a-st.Azimuth) {
+		applog.Printf("rotator: %d° is nearer as %d° from the antenna's %d° (Genius limit %d)",
+			a, alt, st.Azimuth, st.LimitCW)
+		return c.GoTo(l.Num, alt)
+	}
+	return c.GoTo(l.Num, a)
+}
+
+func absInt(v int) int {
+	if v < 0 {
+		return -v
+	}
+	return v
+}
+
+// otherDatabasesIn lists the settings databases sitting in the data folder that
+// are NOT the one about to be opened.
+//
+// Only the two names OpsLog itself ever uses, and only files with something in
+// them: a stray .db from another program is not evidence, and a zero-byte file
+// is not a lost configuration. The point is to recognise the one situation that
+// matters — a full database next to a new empty one — and to say so before the
+// operator concludes their evening is gone.
+func otherDatabasesIn(dataDir, chosen string) []string {
+	var out []string
+	for _, name := range []string{"settings.db", "opslog.db"} {
+		p := filepath.Join(dataDir, name)
+		if p == chosen {
+			continue
+		}
+		if fi, err := os.Stat(p); err == nil && fi.Size() > 0 {
+			out = append(out, name)
+		}
+	}
+	return out
+}

app_sat_track.go

@@ -338,22 +338,28 @@ func (a *App) satTrackStep(t *satTracker) {
 	down, up := sh.DownHz, sh.UpHz
 
 	t.mu.Lock()
-	t.status = SatTrackStatus{
-		On: true, Name: b.Name, Transponder: tp.Label, Mode: tp.Mode,
-		NominalDown: nominal, NominalUp: nomUp,
-		DownHz: down, UpHz: up,
-		Az: pos.Az, El: pos.El, Visible: visible,
-		Radio: t.status.Radio, Error: t.status.Error,
-	}
+	// Rebuilt from the old one, not from nothing.
+	//
+	// The rotator fields are written by readRotator, which runs at most every
+	// three seconds — a controller query binds a socket and waits. Building a
+	// fresh status here dropped them on every OTHER tick, so the antenna
+	// readout appeared for one second in three and vanished again, which reads
+	// as a rotator that keeps disconnecting.
+	st := t.status
+	st.On, st.Name, st.Transponder, st.Mode = true, b.Name, tp.Label, tp.Mode
+	st.NominalDown, st.NominalUp = nominal, nomUp
+	st.DownHz, st.UpHz = down, up
+	st.Az, st.El, st.Visible = pos.Az, pos.El, visible
+	t.status = st
 	t.mu.Unlock()
 
 	t.pointRotator(pos, b.Geostationary)
 	t.readRotator()
 
 	t.mu.Lock()
-	st := t.status
+	out := t.status
 	t.mu.Unlock()
-	a.emitSatTrack(st)
+	a.emitSatTrack(out)
 
 	// Only send what has actually moved. The step is the smallest change worth a
 	// command: on SSB a listener hears twenty hertz, on an FM channel nothing

changelog.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "0.27.22",
+    "date": "",
+    "en": [
+      "If OpsLog is about to create a new, empty settings database in a folder that already holds a full one, it says so — in the startup log and on screen — instead of opening quietly as though nothing were configured. Nothing is deleted and nothing is guessed: the message names the other file, which is where your settings still are.",
+      "config.json — the one file that records WHERE your database is — is now written atomically, and a copy of the previous one is kept beside it. It was written by truncating the file and then filling it, so a process that stopped in between (a crash, a power cut, an update closing the old instance) left it empty; OpsLog then read \"no database chosen\", opened a new empty one, and started having forgotten everything. An unreadable config.json is now restored from its backup, and one that cannot be restored is KEPT as config.json.broken rather than silently replaced.",
+      "The antenna readout no longer flickers in and out during a pass. The rotator is asked where it is every three seconds, but the tracking status was rebuilt from scratch every second and dropped the answer in between — so the antenna appeared for one second in three, which reads as a rotator that keeps disconnecting.",
+      "While tracking, the two frequencies and the antenna bearing sit beside the Tracking button. During a pass an operator watches the radio and the antenna, not a column on the far side of the window — and that column is the first thing hidden to get the map full width. The compass spins while the antenna is still slewing: a mast takes tens of seconds to cross a pass, and the difference between \"on its way\" and \"stuck\" is the whole reason to look at it.",
+      "Satellite frequencies are shown to a hundred hertz instead of one. The Doppler moves about sixty hertz a second on 70 cm, so the last two digits changed every tick and the display was a blur of numbers nobody could read and nobody needed. The radio still gets the whole figure — this is only how much of it is worth putting in front of you. The shift beside it now reads \"+9.7 kHz\" rather than \"+9741 Hz\".",
+      "Rotator Genius: OpsLog no longer clamps a target to 360°, and reads the limits the Genius reports so it can drive an overlap when the controller offers one. In practice a Rotator Genius is a 360° controller — its Limits fields say where the mechanical stop sits within one turn, not how far the mast travels — so an operator with a 450° rotator still gets 360° of it, and that limit is the controller’s, not OpsLog’s. The rotator range is therefore not offered for it: a setting that can only ever be refused by the box is worse than none.",
+      "FlexRadio, satellite: the uplink slice is properly armed. Creating a slice is asynchronous — the radio reports its number afterwards — and OpsLog carried on without waiting, so everything meant for the uplink went nowhere: it was never tuned (it sat at the 435.100 it was created with), never got its sideband, its antenna or its CTCSS tone, and never became the transmitter, leaving the radio transmitting on the DOWNLINK slice. Arming now waits for both slices, adopts one that the radio announces without a reply of its own, and gives a late-arriving uplink everything it was owed."
+    ],
+    "fr": [
+      "Si OpsLog s’apprête à créer une base de réglages neuve et vide dans un dossier qui en contient déjà une pleine, il le dit — dans le journal de démarrage et à l’écran — au lieu de s’ouvrir sans bruit comme si rien n’était configuré. Rien n’est supprimé et rien n’est deviné : le message nomme l’autre fichier, là où vos réglages sont toujours.",
+      "config.json — le seul fichier qui note OÙ se trouve votre base — est désormais écrit de façon atomique, avec une copie de la version précédente conservée à côté. Il était écrit en tronquant le fichier puis en le remplissant : un processus interrompu entre les deux (plantage, coupure de courant, mise à jour fermant l’ancienne instance) le laissait vide. OpsLog lisait alors « aucune base choisie », en ouvrait une neuve et vide, et démarrait en ayant tout oublié. Un config.json illisible est maintenant restauré depuis sa sauvegarde, et celui qu’on ne peut pas restaurer est CONSERVÉ sous le nom config.json.broken au lieu d’être remplacé en silence.",
+      "L’affichage de l’antenne ne clignote plus pendant un passage. Le rotor est interrogé toutes les trois secondes, mais l’état du suivi était reconstruit de zéro chaque seconde et perdait la réponse entre-temps — l’antenne apparaissait donc une seconde sur trois, ce qui se lit comme un rotor qui se déconnecte sans arrêt.",
+      "Pendant le suivi, les deux fréquences et le cap de l’antenne sont affichés à côté du bouton Tracking. Pendant un passage, on regarde la radio et l’antenne, pas une colonne à l’autre bout de la fenêtre — et c’est la première chose qu’on masque pour avoir la carte en pleine largeur. La boussole tourne tant que l’antenne est en mouvement : un pylône met des dizaines de secondes à traverser un passage, et distinguer « en route » de « bloqué » est toute la raison de la regarder.",
+      "Les fréquences satellite sont affichées à la centaine de hertz au lieu du hertz. Le Doppler se déplace d’environ soixante hertz par seconde en 70 cm : les deux derniers chiffres changeaient à chaque tick et l’affichage était une bouillie de chiffres illisible et inutile. La radio reçoit toujours la valeur complète — il ne s’agit que de ce qui vaut la peine d’être mis sous vos yeux. Le décalage à côté indique désormais « +9,7 kHz » plutôt que « +9741 Hz ».",
+      "Rotator Genius : OpsLog n’écrête plus une consigne à 360° et lit les limites que le Genius rapporte, de façon à exploiter un recouvrement quand le contrôleur en offre un. Dans les faits, le Rotator Genius est un contrôleur 360° — ses champs Limits indiquent où se trouve la butée mécanique dans un tour, pas la course du pylône — donc un rotor 450° n’en donne que 360, et cette limite est celle du contrôleur, pas d’OpsLog. L’amplitude du rotor n’est donc pas proposée pour lui : un réglage que le boîtier ne pourra que refuser est pire que pas de réglage du tout.",
+      "FlexRadio, satellite : la tranche de montée est correctement armée. Créer une tranche est asynchrone — la radio annonce son numéro ensuite — et OpsLog continuait sans attendre : tout ce qui était destiné à la montée partait dans le vide. Elle n’était jamais accordée (elle restait sur le 435,100 de sa création), ne recevait ni sa bande latérale, ni son antenne, ni sa tonalité CTCSS, et ne devenait jamais l’émettrice — la radio émettait donc sur la tranche de DESCENTE. L’armement attend maintenant les deux tranches, adopte celle que la radio annonce sans réponse propre, et donne à une montée arrivée en retard tout ce qui lui était dû."
+    ]
+  },
   {
     "version": "0.27.21",
     "date": "",

dbpointer_test.go

@@ -0,0 +1,118 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// config.json is the only record of WHERE the database is. Losing it moves an
+// operator's whole station back to an empty default, and it has happened twice.
+// These are the two ways it was lost.
+
+// A half-written file must never be publishable. os.WriteFile truncates and
+// then fills, so a process that stops in between leaves an empty pointer; the
+// rename cannot.
+func TestWriteBootstrapIsAtomicAndKeepsABackup(t *testing.T) {
+	dir := t.TempDir()
+	// Absolute and OUTSIDE the application folder, so portablePath stores them
+	// verbatim — the round trip is what is under test, not the re-rooting.
+	first := filepath.Join(t.TempDir(), "first", "one.db")
+	second := filepath.Join(t.TempDir(), "second", "two.db")
+	if err := writeBootstrap(dir, dbPointer{DBPath: first}); err != nil {
+		t.Fatal(err)
+	}
+	if err := writeBootstrap(dir, dbPointer{DBPath: second}); err != nil {
+		t.Fatal(err)
+	}
+	// No temporary left lying around to be mistaken for the real thing.
+	if _, err := os.Stat(dbPointerPath(dir) + ".tmp"); err == nil {
+		t.Error("the temporary file was left behind")
+	}
+	// The previous contents are still there.
+	var prev dbPointer
+	b, err := os.ReadFile(dbPointerPath(dir) + ".bak")
+	if err != nil {
+		t.Fatalf("no backup was kept: %v", err)
+	}
+	if err := json.Unmarshal(b, &prev); err != nil {
+		t.Fatalf("the backup does not parse: %v", err)
+	}
+	if prev.DBPath != first {
+		t.Errorf("the backup holds %q, want the previous pointer", prev.DBPath)
+	}
+	if got := readBootstrap(dir); got.DBPath != second {
+		t.Errorf("read back %q, want the current pointer", got.DBPath)
+	}
+}
+
+// A pointer that EXISTS and cannot be read is not the same thing as no pointer.
+// Treating it as one is what opened an empty database and presented an operator
+// with a program that had forgotten them.
+func TestReadBootstrapRecoversFromABrokenPointer(t *testing.T) {
+	dir := t.TempDir()
+	mine := filepath.Join(t.TempDir(), "mine", "station.db")
+	if err := writeBootstrap(dir, dbPointer{DBPath: mine}); err != nil {
+		t.Fatal(err)
+	}
+	// Two writes, so there is a backup of the good one to fall back to.
+	if err := writeBootstrap(dir, dbPointer{DBPath: mine}); err != nil {
+		t.Fatal(err)
+	}
+	// Now truncate it, exactly as an interrupted write would.
+	if err := os.WriteFile(dbPointerPath(dir), nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got := readBootstrap(dir)
+	if got.DBPath != mine {
+		t.Fatalf("read %q — the database the operator chose was lost", got.DBPath)
+	}
+	// And it is put back, so the next launch does not have to recover again.
+	if again := readBootstrap(dir); again.DBPath != mine {
+		t.Errorf("the restored pointer did not stick: %q", again.DBPath)
+	}
+}
+
+// With nothing to restore from, the broken file is KEPT. It is evidence, and it
+// may still be readable by hand.
+func TestReadBootstrapKeepsAnUnrecoverablePointer(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(dbPointerPath(dir), []byte("{oops"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := readBootstrap(dir); got.DBPath != "" {
+		t.Errorf("invented a path out of a broken file: %q", got.DBPath)
+	}
+	if _, err := os.Stat(dbPointerPath(dir) + ".broken"); err != nil {
+		t.Errorf("the broken pointer was not kept: %v", err)
+	}
+}
+
+// The warning that turns a silent loss into a sentence: a new empty database
+// about to be created in a folder that already holds a full one.
+func TestOtherDatabasesInSpotsTheFullOneNextDoor(t *testing.T) {
+	dir := t.TempDir()
+	full := filepath.Join(dir, "opslog.db")
+	if err := os.WriteFile(full, []byte("not empty"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	chosen := filepath.Join(dir, "settings.db")
+	if got := otherDatabasesIn(dir, chosen); len(got) != 1 || got[0] != "opslog.db" {
+		t.Errorf("got %v, want the full database next door", got)
+	}
+	// A zero-byte file is not a lost configuration.
+	if err := os.WriteFile(full, nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := otherDatabasesIn(dir, chosen); len(got) != 0 {
+		t.Errorf("an empty file was reported as a database: %v", got)
+	}
+	// And the one being opened is never reported against itself.
+	if err := os.WriteFile(chosen, []byte("in use"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := otherDatabasesIn(dir, chosen); len(got) != 0 {
+		t.Errorf("the chosen database was reported as another: %v", got)
+	}
+}

frontend/src/App.tsx

@@ -3530,6 +3530,11 @@ export default function App() {
       try {
         const st = await GetStartupStatus();
         if (!st.ok) { setError(`Startup failed: ${st.err}\nDB path: ${st.db_path}`); return; }
+        // Started, but somewhere that deserves saying out loud — a new, empty
+        // settings database opened beside a full one. An operator who is not
+        // told this concludes their configuration was thrown away, when the
+        // file holding it is sitting right there.
+        if (st.warn) setError(st.warn);
         // First launch (or a never-configured profile): collect the mandatory
         // station identity before anything else.
         try {

frontend/src/components/SatellitePanel.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import L from 'leaflet';
 import 'leaflet/dist/leaflet.css';
-import { Satellite as SatIcon, Radio, ArrowUp, ArrowDown, PanelRightClose, PanelRightOpen, Radar } from 'lucide-react';
+import { Satellite as SatIcon, Radio, ArrowUp, ArrowDown, PanelRightClose, PanelRightOpen, Radar, Compass } from 'lucide-react';
 import {
   GetSatelliteBirds, GetSatellitePositions, GetSatellitePasses, GetSatelliteTuning,
   GetSatelliteGroundTrack, GetSatelliteTLEInfo, GetSatelliteNextPass, GetSatelliteSkyTrack,
@@ -74,11 +74,28 @@ const SIDE_SHOWN_KEY = 'opslog.satSideShown';
 const SIDE_W_DEFAULT = 336, SIDE_W_MIN = 240, SIDE_W_MAX = 720;
 const SKY_SHOWN_KEY = 'opslog.satSkyShown';
 
+// Four decimals — a hundred hertz, which is what a linear transponder is
+// actually tuned to.
+//
+// It used to be six, and the last two digits changed every tick: the Doppler
+// moves about sixty hertz a second on 70 cm, so the display was a blur of
+// numbers nobody could read and nobody needed. The RADIO still gets the whole
+// figure — the correction is computed and sent to the hertz — this is only how
+// much of it is worth putting in front of an operator. The shift beside it, in
+// kilohertz, is where the fine movement shows.
 const fmtHz = (hz: number) => {
   if (!hz) return '—';
-  // Six decimals: a linear transponder is tuned to the hundred hertz, and the
-  // Doppler correction moves the last three digits every second.
-  return (hz / 1e6).toFixed(6).replace(/(\d)(?=(\d{3})+\.)/g, '$1 ');
+  return (hz / 1e6).toFixed(4).replace(/(\d)(?=(\d{3})+\.)/g, '$1 ');
+};
+
+// The Doppler shift, as an operator would say it: hertz while it is small
+// enough to say in hertz, kilohertz once it is not. "+9741 Hz" is four digits
+// of precision on a number that is only ever read as "about ten kilohertz".
+const fmtShift = (hz: number) => {
+  const sign = hz > 0 ? '+' : '−';
+  const a = Math.abs(hz);
+  if (a < 1000) return `${sign}${Math.round(a)} Hz`;
+  return `${sign}${(a / 1000).toFixed(1)} kHz`;
 };
 const fmtDeg = (d: number) => `${d.toFixed(1)}°`;
 const fmtKm = (km: number) => `${Math.round(km).toLocaleString()} km`;
@@ -619,6 +636,14 @@ export function SatellitePanel({ myGrid }: { myGrid: string }) {
 
   // The pass, as a countdown and a bar. Both derived here from two timestamps,
   // so they move every second without asking Go anything.
+  // Is the antenna still on its way? The rotator is asked where it is every
+  // three seconds and a mast takes tens of seconds to cross a pass, so a
+  // difference between where it is and where the satellite is means it is
+  // moving — which is exactly what a number alone cannot show, and the
+  // difference between "on its way" and "stuck" is the whole reason to look.
+  const antennaMoving = !!tracking?.rot_on && !!tracking.rot_live &&
+    Math.abs(((tracking.az - tracking.rot_az + 540) % 360) - 180) > 3;
+
   const aosMs = pass?.has_pass ? Date.parse(pass.aos) : 0;
   const losMs = pass?.has_pass ? Date.parse(pass.los) : 0;
   const inPass = !!pass?.has_pass && now >= aosMs && now < losMs;
@@ -687,6 +712,40 @@ export function SatellitePanel({ myGrid }: { myGrid: string }) {
         {tracking?.on && tracking.radio === 'downlink-only' && (
           <span className="text-[11px] text-warning">{t('sat.downlinkOnly')}</span>
         )}
+
+        {/* What the station is actually doing, beside the button that started
+            it. During a pass an operator watches the radio and the antenna, not
+            a column on the far side of the window — and that column is the
+            first thing they hide to get the map full width. */}
+        {tracking?.on && (
+          <div className="flex items-center gap-2.5 rounded-md border border-border bg-card/60 px-2 py-0.5 text-xs tabular-nums">
+            <span className="flex items-center gap-1" title={t('sat.down')}>
+              <ArrowDown className="size-3 text-muted-foreground" />
+              <span className="font-medium">{fmtHz(tracking.down_hz)}</span>
+            </span>
+            {!!tracking.up_hz && (
+              <span className="flex items-center gap-1" title={t('sat.up')}>
+                <ArrowUp className="size-3 text-muted-foreground" />
+                <span className="font-medium">{fmtHz(tracking.up_hz)}</span>
+              </span>
+            )}
+            {tracking.rot_on && (
+              <span className={cn('flex items-center gap-1 border-l border-border pl-2.5',
+                antennaMoving && 'text-caution')} title={t('sat.antenna')}>
+                {/* The needle spins while the antenna is slewing. A rotator
+                    takes tens of seconds to cross a pass, and the difference
+                    between "on its way" and "stuck" is the whole reason to look
+                    at it — a number alone cannot show movement. */}
+                <Compass className={cn('size-3', antennaMoving ? 'animate-spin' : 'text-muted-foreground')}
+                  style={antennaMoving ? { animationDuration: '3s' } : undefined} />
+                <span className="font-medium">
+                  {Math.round(tracking.rot_az)}°
+                  {!tracking.rot_az_only && ` / ${Math.round(tracking.rot_el)}°`}
+                </span>
+              </span>
+            )}
+          </div>
+        )}
         <div className="flex-1" />
         {/* Elements are maintenance, so only their AGE is here — and only when
             it has become a reason the panel might be wrong. */}
@@ -1031,9 +1090,7 @@ function FreqRow({ label, hz, nominal }: { label: string; hz: number; nominal: n
       <span className="w-10 text-[10px] uppercase tracking-wide text-muted-foreground">{label}</span>
       <span className="text-base font-semibold tabular-nums">{fmtHz(hz)}</span>
       {!!shift && (
-        <span className="text-[10px] tabular-nums text-muted-foreground">
-          {shift > 0 ? '+' : '−'}{Math.abs(Math.round(shift))} Hz
-        </span>
+        <span className="text-[10px] tabular-nums text-muted-foreground">{fmtShift(shift)}</span>
       )}
     </div>
   );

frontend/src/components/SettingsModal.tsx

@@ -5135,6 +5135,15 @@ function SettingsModalImpl({ onClose, onSaved, initialSection, onMainPaneChanged
             // controller. PstRotator knows which machine is on the other end and
             // does its own overlap; two programs each deciding to go the long
             // way round is how an antenna unwinds mid-pass.
+            //
+            // NOT offered for a Rotator Genius. Its manual is plain — "you will
+            // not be able to give it a target beyond the limits" — and its
+            // Limits fields say where the mechanical stop sits within ONE turn
+            // ("5 to 4" is a dead zone at four and a half degrees), not how far
+            // the mast travels. Offering 450° there would be offering a setting
+            // that can only ever be refused by the box. Whether the overlap is
+            // used is decided from what the Genius itself reports, in
+            // rotgeniusGoTo, and needs no setting at all.
             const ownsOverlap = isERC || isEasycomm;
             return (
               <div key={dev.id || i} className="rounded-xl border border-border bg-card/40 p-3 space-y-3">

frontend/src/version.ts

@@ -1,6 +1,6 @@
 // Single source of truth for the app version shown in the UI (header + About).
 // Bump this on a release (the release script updates it alongside telemetry.go).
-export const APP_VERSION = '0.27.21';
+export const APP_VERSION = '0.27.22';
 
 // Author / credits, shown in Help -> About.
 export const APP_AUTHOR = 'F4BPO';

frontend/wailsjs/go/models.ts

@@ -4578,6 +4578,7 @@ export namespace main {
 	    ok: boolean;
 	    err: string;
 	    db_path: string;
+	    warn: string;
 	
 	    static createFrom(source: any = {}) {
 	        return new StartupStatus(source);
@@ -4588,6 +4589,7 @@ export namespace main {
 	        this.ok = source["ok"];
 	        this.err = source["err"];
 	        this.db_path = source["db_path"];
+	        this.warn = source["warn"];
 	    }
 	}
 	export class StationDevice {

internal/cat/flex.go

@@ -13,6 +13,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"hamlog/internal/applog"
 )
 
 // Flex is a native FlexRadio (SmartSDR) CAT backend. It speaks the radio's TCP
@@ -69,10 +71,18 @@ type Flex struct {
 	// Satellite pair: slice A is the downlink, slice B the uplink. -1 when not
 	// armed. satCreatedTX marks an uplink slice OpsLog opened, and is the only
 	// one it will close again.
-	satOn           bool
-	satRX           int
-	satTX           int
-	satCreatedTX    bool
+	satOn        bool
+	satRX        int
+	satTX        int
+	satCreatedTX bool
+	// What the uplink slice is owed, kept so it can be given to a slice that
+	// turns up LATE. Arming, the antennas, the tone and the mode all happen
+	// before the radio has necessarily reported the slice it was asked to
+	// create; without this they were applied to an index of -1 and never again.
+	satUpMode       string
+	satRXAnt        string
+	satTXAnt        string
+	satTone         float64
 	spotCall        map[int]string // spot index → callsign (to fill the call on a panadapter click)
 	spotMode        map[int]string // spot index → ADIF mode, so a click can also set the slice mode (SmartSDR tunes the spot's freq but not its mode)
 	spotFreq        map[int]int64  // spot index → Hz, so a click can report where it was (the trigger message carries only the index)
@@ -1034,7 +1044,29 @@ func (f *Flex) handleStatus(payload string) {
 			s.filterHi = atoiDefault(val, s.filterHi)
 		}
 	}
+	// A satellite uplink slice that arrived without our hearing about it.
+	//
+	// satCreate correlates the "slice create" reply by sequence number, and when
+	// that correlation misses, the slice exists on the radio and OpsLog does not
+	// know its index. Everything then silently does nothing: the uplink is never
+	// tuned, never gets its mode, never gets its antenna or its CTCSS tone, and
+	// — worst — never becomes the transmitter, so the radio goes on transmitting
+	// on the DOWNLINK slice. Seen on the air: slice B sitting at the 435.100000
+	// it was created with, both slices in USB, and the red TX badge on the 2 m
+	// downlink.
+	//
+	// The status message needs no correlation. If satellite mode is armed, the
+	// uplink is still unknown, and a slice is in use that is not the downlink,
+	// that is the slice — the radio is telling us plainly.
+	adopt := -1
+	if f.satOn && f.satTX < 0 && idx != f.satRX && s.inUse {
+		adopt = idx
+	}
 	f.mu.Unlock()
+	if adopt >= 0 {
+		applog.Printf("flex: adopting slice %d as the satellite uplink from its status — the create reply never came back", adopt)
+		f.adoptSatSlice("tx", adopt)
+	}
 }
 
 // defInt returns v, or def when v is zero (so sliders show sane defaults before

internal/cat/flexsat.go

@@ -3,6 +3,7 @@ package cat
 import (
 	"fmt"
 	"strings"
+	"time"
 
 	"hamlog/internal/applog"
 )
@@ -65,10 +66,41 @@ func (f *Flex) SetSatellite(on bool) error {
 	} else {
 		f.send(fmt.Sprintf("slice s %d tx=1", txIdx))
 	}
+	// WAIT for the slices before saying the pair is armed.
+	//
+	// Creating a slice is asynchronous: the index comes back in a later reply.
+	// Returning before it arrives meant everything downstream ran against an
+	// uplink of -1 — no antenna, no CTCSS tone, no mode, never tuned, and never
+	// made the transmitter, so the radio went on transmitting on the DOWNLINK.
+	// Seen on the air, and it is the one failure here that can put a signal
+	// somewhere it must not go.
+	rxIdx, txIdx = f.awaitSatSlices(3 * time.Second)
+	if rxIdx < 0 || txIdx < 0 {
+		applog.Printf("flex: satellite armed but the radio did not report both slices (rx %d, tx %d) — "+
+			"the uplink will be picked up when it does", rxIdx, txIdx)
+		return nil
+	}
 	applog.Printf("flex: satellite armed (rx slice %d, tx slice %d)", rxIdx, txIdx)
 	return nil
 }
 
+// awaitSatSlices waits for both slice indices to be known, and returns whatever
+// it has when the time is up. Polled rather than signalled: the indices arrive
+// on the reader goroutine by two different routes — the create reply and the
+// slice status — and a poll is indifferent to which of them got there first.
+func (f *Flex) awaitSatSlices(d time.Duration) (rx, tx int) {
+	deadline := time.Now().Add(d)
+	for {
+		f.mu.Lock()
+		rx, tx = f.satRX, f.satTX
+		f.mu.Unlock()
+		if (rx >= 0 && tx >= 0) || time.Now().After(deadline) {
+			return rx, tx
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+}
+
 func (f *Flex) satDisarm() error {
 	f.mu.Lock()
 	rx, tx, created := f.satRX, f.satTX, f.satCreatedTX
@@ -118,6 +150,24 @@ func (f *Flex) adoptSatSlice(role string, idx int) {
 	f.mu.Unlock()
 	if role == "tx" {
 		f.send(fmt.Sprintf("slice s %d tx=1", idx))
+		// Everything this slice was owed while nobody knew where it was. Set
+		// here rather than left to the next Doppler step, because the mode, the
+		// antenna and the tone are all sent ONCE — the step only re-sends
+		// frequencies.
+		f.mu.Lock()
+		mode, ant, tone := f.satUpMode, f.satTXAnt, f.satTone
+		f.mu.Unlock()
+		if strings.TrimSpace(ant) != "" {
+			f.send(fmt.Sprintf("slice s %d txant=%s", idx, ant))
+			f.send(fmt.Sprintf("slice s %d rxant=%s", idx, ant))
+		}
+		if strings.TrimSpace(mode) != "" {
+			f.satMode(idx, mode, 0)
+		}
+		if tone > 0 {
+			f.send(fmt.Sprintf("slice s %d fm_tone_value=%.1f", idx, tone))
+			f.send(fmt.Sprintf("slice s %d fm_tone_mode=CTCSS_TX", idx))
+		}
 	}
 	applog.Printf("flex: satellite %s slice is %d", role, idx)
 }
@@ -146,6 +196,11 @@ func (f *Flex) TuneSatellite(downHz, upHz int64, downMode, upMode string) error
 		f.send(fmt.Sprintf("slice t %d %.6f", rx, float64(downHz)/1e6))
 		f.satMode(rx, downMode, downHz)
 	}
+	if strings.TrimSpace(upMode) != "" {
+		f.mu.Lock()
+		f.satUpMode = upMode
+		f.mu.Unlock()
+	}
 	if tx >= 0 && upHz > 0 {
 		f.send(fmt.Sprintf("slice t %d %.6f", tx, float64(upHz)/1e6))
 		f.satMode(tx, upMode, upHz)
@@ -223,6 +278,8 @@ func (f *Flex) SatAntennas(rxAnt, txAnt string) error {
 	f.mu.Lock()
 	rx, tx := f.satRX, f.satTX
 	connected := f.conn != nil
+	// Remembered so a slice that is reported late still gets its antenna.
+	f.satRXAnt, f.satTXAnt = rxAnt, txAnt
 	f.mu.Unlock()
 	if !connected {
 		return fmt.Errorf("flex: not connected")
@@ -256,6 +313,7 @@ func (f *Flex) SatTone(hz float64) error {
 	f.mu.Lock()
 	tx := f.satTX
 	connected := f.conn != nil
+	f.satTone = hz
 	f.mu.Unlock()
 	if !connected {
 		return fmt.Errorf("flex: not connected")

internal/rotgenius/rotgenius.go

@@ -33,10 +33,16 @@ const (
 
 // Status is one rotator's live state parsed from a |h reply.
 type Status struct {
-	Azimuth   int  // current heading in degrees (0..360)
+	Azimuth   int  // current heading in degrees (0..450 on an overlap rotator)
 	Connected bool // false when the sensor reports 999 (not connected)
 	Moving    int  // 0 not moving, 1 CW, 2 CCW
 	Target    int  // target azimuth when moving (else -1)
+	// The soft limits the Genius itself is configured with, as it reports them.
+	// Read rather than assumed: an operator with a 450° mast has told the
+	// Genius so, and that is the authority on how far it will go — OpsLog
+	// asking for 400° on a box configured for 360 is a command it will refuse.
+	LimitCW  int
+	LimitCCW int
 }
 
 // Client is a stateless connector: each call opens a short-lived TCP connection,
@@ -128,15 +134,30 @@ func (c *Client) Read(rotator int) (Status, error) {
 	cur := atoiField(string(p[base : base+3]))
 	moving := atoiField(string(p[base+10 : base+11]))
 	target := atoiField(string(p[base+15 : base+18]))
-	st := Status{Azimuth: cur, Moving: moving, Connected: cur != 999, Target: -1}
+	st := Status{
+		Azimuth: cur, Moving: moving, Connected: cur != 999, Target: -1,
+		LimitCW:  atoiField(string(p[base+3 : base+6])),
+		LimitCCW: atoiField(string(p[base+6 : base+9])),
+	}
 	if target != 999 {
 		st.Target = target
 	}
 	return st, nil
 }
 
-// GoTo moves the rotator to az (0..360). The reply's status byte is 'K' on
-// accept, 'F' on reject.
+// GoTo moves the rotator to az. The reply's status byte is 'K' on accept, 'F'
+// on reject.
+//
+// The ceiling is 450 and not 360, which is the whole point: a rotator with an
+// overlap can be asked for 010° as either 10 or 370, and only the second reaches
+// it without unwinding the cable back through north. The command carries three
+// digits, so the range was never the protocol's — it was ours, and it left an
+// operator with a 450° mast clicking "clockwise" by hand every time a bearing
+// crossed north.
+//
+// A Genius configured for a 360° rotator refuses a target beyond its own limit,
+// which is the correct place for that decision: it knows what is bolted to the
+// tower, and OpsLog does not.
 func (c *Client) GoTo(rotator, az int) error {
 	if rotator != 1 && rotator != 2 {
 		rotator = 1
@@ -144,8 +165,8 @@ func (c *Client) GoTo(rotator, az int) error {
 	if az < 0 {
 		az = 0
 	}
-	if az > 360 {
-		az = 360
+	if az > 450 {
+		az = 450
 	}
 	reply, err := c.exchange(fmt.Sprintf("|A%d%03d", rotator, az), 8)
 	if err != nil {

telemetry.go

@@ -21,7 +21,7 @@ import (
 
 const (
 	// appVersion is stamped on every heartbeat (and could feed the About box).
-	appVersion = "0.27.21"
+	appVersion = "0.27.22"
 
 	// posthogHost is the PostHog ingestion endpoint. EU cloud by default; change
 	// to https://us.i.posthog.com for a US project.