[Rovey]

Why

Before 0.4.9 the changes since v0.4.8 (#62, #65, #66) got a correctness review, the updater and elevation got a security review, and the whole repo got an over-engineering audit. This PR fixes what they found that is safe to fix without a hardware test. A second review of this branch found that the first restart fix did not work (an elevated process gets no UAC prompt for "runas"); the last commit replaces it.

What

Bugs (all in code that is not released yet)

• After one Abort, every later run in the session had no Abort button. follow_run now forgets the Abort when it follows a new run. Test added.
• All in one: every way out after the card was touched ends at stock and says so. The window used to claim "The card is back at stock." without checking when the overclock failed, its save failed, or the run was aborted in step 2 or 3.
• An Abort in All in one step 2 shows the calm "Stopped" page, not a red fault.
• An aborted driver retest whose reset to stock failed says so (unless the earlier tune was put back after all).
• Tray Re-apply / Revert balloons kept working only until the session had 100 notes.
• The Dashboard hint "click Apply saved tune" shows only where that button is; during the app's own run the offsets under test are not called "Set by another program".
• The several-GPU refusal at logon was in the log twice; links in log lines get a line of their own.

Security

• An elevated copy that is not in Program Files never starts itself again (after an update or a driver fault): in the unzip folder any program of the user could have swapped the exe, and the new copy would inherit the rights without a prompt. After an update it asks the user to start it again; after a fault it writes that to boot.log and closes. The Program Files copy (apply at logon) and unelevated copies restart as before.
• pdh.dll and bcrypt.dll are delay-loaded like the other non-KnownDLLs, so they resolve from System32 only (checked with dumpbin /dependents). Both executables share one gao_exe_link target for these link options.
• An update unpacks only gao.exe and GpuAutoOptimizer.exe.

Cleanup

• Removed stock_point_for (no caller), kIconStop, the dead tray WM_COMMAND cases, and two tests that checked a literal against itself and std::function.
• One kTrayWindowClass; --curve-flatten uses kAlreadyRunning; --optimize parses its preset with preset_from_name.

Not in this PR

• Merging the run set-up that run_optimize and run_undervolt copy (their crash paths have drifted): it needs a dxcap -forcetdr check under both runs.
• A signature on release zips (the GitHub account is the only trust root of the updater); "immutable releases" in the repo settings is the quick step.

Tests

• cmake --workflow --preset ci: builds with /W4 /WX; core_tests and app_tests pass.
• gao --status and GpuAutoOptimizer.exe --demo start (delay-loaded DLLs resolve).
• Not tried yet: an update from 0.4.8 to a 0.4.9 rc (unpacking only the two exes), and the restart rules after an update and after a driver fault. These belong in the rc's hardware checks.

Added after the first review round

• The update download gives up after five minutes in all (security finding 5).
• One saved_tune_for() for --apply, the window's Apply and the undervolt on the saved tune; one own_exe() / runas_self(); shared CLI hooks; Objectives::power removed (audit 4, 8, 9, 10).
• The About page names api.github.com; docs/development.md states when an elevated copy does not restart.

🤖 Generated with Claude Code