Settings: its rows in five groups

Settings had grown to 21 rows in one list. It opens on five groups (This device, Display, GNSS and radio, Network, System); Enter opens one, Back returns to the groups, and Back from the groups leaves Settings. SettingsMenu holds the groups and which one is open (host-tested: every setting is in exactly one group). The guide, the how-tos, the README, the scripts' messages and the firmware's own name the new paths, such as "Settings > System > Firmware". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0162FokPdvY2KsS4NBfwyWPk
2026-10-10 00:11:52 +02:00
parent 37335b4829
commit 0c52613b72
43 changed files with 305 additions and 98 deletions
@@ -94,19 +94,19 @@ scripts/ota_keygen.sh                  # once: creates the signing key (see ADR
 scripts/flash.sh --ota 10.39.39.12     # build, sign and push; or set RORO_OTA_HOST
 ```

-The device shows the push address in **Settings → Firmware**. It installs a correctly signed update right away, restarts (waiting up to 60 s if you're typing), and runs the new firmware on **Probation**. If the new firmware crashes, or can't reconnect Wi-Fi within 3 minutes, it rolls back to the previous one and says so.
+The device shows the push address in **Settings → System → Firmware**. It installs a correctly signed update right away, restarts (waiting up to 60 s if you're typing), and runs the new firmware on **Probation**. If the new firmware crashes, or can't reconnect Wi-Fi within 3 minutes, it rolls back to the previous one and says so.

-To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).
+To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → System → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).

 **The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB. (CI signs releases with a copy kept as a repository secret, ADR 0008.)

 ### Updates from Gitea

-With no PC and no card, the device can install the project's releases itself (docs/milestones/R1.md). In **Settings → Firmware**:
+With no PC and no card, the device can install the project's releases itself (docs/milestones/R1.md). In **Settings → System → Firmware**:

 - **Latest release** checks the server (Enter, or `c`) and says `v0.11.0 (new)` or `(current)`. Enter again opens the release: its version, date, size and the tag's message, with **Install** when it's newer. The download goes straight into the inactive slot, so no card is needed; the signature is checked after the first 160 bytes, before anything is written, and the image's hash at the end. The new firmware then runs on Probation as for any update.
 - **Older releases** lists the last ten, newest first. Opening an older one offers to go back to it, with a different question.
- **Settings → Check for updates** (on by default): once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > Firmware`, once per version. It installs nothing by itself, and doesn't announce a version that already failed and rolled back on this device.
+- **Settings → System → Check for updates** (on by default): once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > System > Firmware`, once per version. It installs nothing by itself, and doesn't announce a version that already failed and rolled back on this device.

 The connection is checked against the two ISRG roots Let's Encrypt chains end in (ADR 0009), not the usual bundle of about 130 authorities. Whatever the connection, the Update File's own signature is what decides what gets installed.

@@ -116,7 +116,7 @@ The connection is checked against the two ISRG roots Let's Encrypt chains end in

 ## Networks without DHCP

-Each Saved Network gets its address automatically (DHCP) or has a Fixed one (docs/milestones/S1.md): in Settings > Wi-Fi, Enter on a network opens its page, where "IP address" switches between Automatic and Fixed, with an address, a prefix length (24 is 255.255.255.0) and an optional gateway. Switching to Fixed starts from what the network is giving the device at that moment. The setting is checked and applied when you leave the page. IPv4 only.
+Each Saved Network gets its address automatically (DHCP) or has a Fixed one (docs/milestones/S1.md): in Settings > Network > Wi-Fi, Enter on a network opens its page, where "IP address" switches between Automatic and Fixed, with an address, a prefix length (24 is 255.255.255.0) and an optional gateway. Switching to Fixed starts from what the network is giving the device at that moment. The setting is checked and applied when you leave the page. IPv4 only.

 "DNS and NTP" on the same screen holds two DNS servers (9.9.9.9 and 1.1.1.1 by default), used on Fixed networks, or on every network with "Always use my DNS"; and two NTP servers (pool.ntp.org and time.cloudflare.com), used after any the network's DHCP offers. Enter on "Status" shows what's in use and where each value came from.

@@ -140,7 +140,7 @@ On a page, `b` bookmarks it, `s` saves it to the SD card to read offline (a non-

 ## LoRa Scanner

-The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **never transmits**. The Sniffer lists what it hears, newest first: time, RSSI, SNR, and for Meshtastic packets the sender and receiver (their last 4 hex digits) and hops; for MeshCore packets what they are (an advert with the node's name, a message with the first byte of each node's key, a message on the public channel read, with the name its sender gives; any other channel message with the channel's byte) and the hops in their path. Enter shows a packet's details: what is never encrypted (the Meshtastic header; MeshCore's header, path and, in an advert, the node's name, kind, key and position; and a public channel message's sender, time and text, decrypted with the channel's published key) and a hex dump. `p` picks **MeshCore** (the default; its EU/UK Narrow setting: 869.618 MHz, 62.5 kHz, SF8, CR 4/8) or one of the 7 Meshtastic presets allowed in EU868, `c` starts or stops a Capture: a pcap file with LoRaTap headers in `/captures/lora/`, for Wireshark. A Capture keeps recording with the App closed; otherwise the radio sleeps when the App isn't open. Tab switches to **Sweep**: the signal strength across 863–870 MHz in 100 kHz steps, as bars with peak hold and a waterfall, with the Sniffer's frequency marked; the Sniffer is paused meanwhile and picks up where it was. The GNSS receiver on the same Cap raises the radio's noise floor by 8 dB while it runs: Settings > "Pause GNSS for LoRa" (off by default) puts it in standby while the radio listens, except during a Track. The Status Bar shows `L` while the radio listens (bright for a moment on each packet), `SW` while sweeping, and `CAP` while capturing.
+The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **never transmits**. The Sniffer lists what it hears, newest first: time, RSSI, SNR, and for Meshtastic packets the sender and receiver (their last 4 hex digits) and hops; for MeshCore packets what they are (an advert with the node's name, a message with the first byte of each node's key, a message on the public channel read, with the name its sender gives; any other channel message with the channel's byte) and the hops in their path. Enter shows a packet's details: what is never encrypted (the Meshtastic header; MeshCore's header, path and, in an advert, the node's name, kind, key and position; and a public channel message's sender, time and text, decrypted with the channel's published key) and a hex dump. `p` picks **MeshCore** (the default; its EU/UK Narrow setting: 869.618 MHz, 62.5 kHz, SF8, CR 4/8) or one of the 7 Meshtastic presets allowed in EU868, `c` starts or stops a Capture: a pcap file with LoRaTap headers in `/captures/lora/`, for Wireshark. A Capture keeps recording with the App closed; otherwise the radio sleeps when the App isn't open. Tab switches to **Sweep**: the signal strength across 863–870 MHz in 100 kHz steps, as bars with peak hold and a waterfall, with the Sniffer's frequency marked; the Sniffer is paused meanwhile and picks up where it was. The GNSS receiver on the same Cap raises the radio's noise floor by 8 dB while it runs: Settings > GNSS and radio > "Pause GNSS for LoRa" (off by default) puts it in standby while the radio listens, except during a Track. The Status Bar shows `L` while the radio listens (bright for a moment on each packet), `SW` while sweeping, and `CAP` while capturing.

 ## Storage

@@ -188,7 +188,7 @@ The terminal (`lib/term`, host-tested) understands what a shell, `less`, `top`,

 ## VPN

-A WireGuard tunnel (docs/milestones/N1.md), over whatever Wi-Fi the device is on: one peer, IPv4. Copy a client's `.conf` to the card as `/vpn/wg0.conf` and import it in Settings > VPN (or `vpn import`); the configuration, private key included, is then kept in the device and never shown, and Settings offers to delete the file. A switch brings the tunnel up until the next restart; "Start with Wi-Fi" does it every time. It waits for the clock, which WireGuard needs. `VPN` shows in the Status Bar, bright once the server has answered.
+A WireGuard tunnel (docs/milestones/N1.md), over whatever Wi-Fi the device is on: one peer, IPv4. Copy a client's `.conf` to the card as `/vpn/wg0.conf` and import it in Settings > Network > VPN (or `vpn import`); the configuration, private key included, is then kept in the device and never shown, and Settings offers to delete the file. A switch brings the tunnel up until the next restart; "Start with Wi-Fi" does it every time. It waits for the clock, which WireGuard needs. `VPN` shows in the Status Bar, bright once the server has answered.

 **What goes through it is one of two things:** everything, when AllowedIPs has `0.0.0.0/0` (and then nothing leaves the device while the server is silent), or the one subnet the device's tunnel address is in. A home network behind the server needs the first: lwIP routes by an interface's subnet or by default, nothing finer, and the import says how many ranges it can't reach. With the tunnel up the Debug Console and the Update Service answer on the tunnel address too, behind their token and their signature. It costs 63 KB of flash and under 2 KB of memory while up.

@@ -231,7 +231,7 @@ The Shell App (docs/milestones/S1.md) runs the commands below on the device's ow
 | `ls [folder]` / `du <path>` | Lists a folder of the SD card with sizes and dates, or counts the files and bytes under a path |
 | `screenshot [seconds]` | The screen as a PNG in `/screenshots` on the card, now or after a pause to get to the screen you want (240 x 135, about 33 KB). Over the Debug Console a bare `screenshot` sends the screen to the PC instead |
 | `cp [-f] <from> <to>` / `mv [-f] <from> <to>` / `rm [-r] [-f] <path>` / `mkdir <path>` / `cancel` | What the Storage App does, with its rules: copy (folders too), move or rename, delete (`rm -r` for a folder and what's in it, as Unix has it), new folder. `-f` replaces a file that's in the way; `*` and `?` in the last part of a path (`ls`, `du`, `rm`, `cp`, `mv`) run the command for each name matched, 64 at most; a tab separates paths that hold spaces; `cancel` stops a copy or a delete |
-| `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
+| `install <path>` | Update from SD with that `.ota` file, as Settings → System → Firmware does |
 | `update check` / `update list` / `update status` / `update install <tag>` | The project's releases on Gitea: look at the latest, list the last ten, say what's known, or download and install one |
 | `update pretend <version>` / `update probe <host>` / `update damage cut\|flip <n>` / `update daily` | Pretend to run another version (so a release counts as an update), see whether a server's certificate is accepted, cut or damage the next download, run the daily check again |
 | `lora probe` | Finds the radio: chip, oscillator, antenna switch, DIO1 interrupt, noise floor |
@@ -266,7 +266,7 @@ The Shell App (docs/milestones/S1.md) runs the commands below on the device's ow

 ### The Debug Console

-Every firmware has the Debug Console (ADR 0010): the serial console over Wi-Fi, on TCP 2323. It is **off** until you switch it on in **Settings → Debug Console**, which also makes its token and shows it. With the device on USB, `scripts/flash.sh --debug` flashes it, switches the console on and gives it the token in `~/.config/roro9stack/debug-token`, so nothing has to be typed. Then, with `RORO_OTA_HOST` set to the device's IP:
+Every firmware has the Debug Console (ADR 0010): the serial console over Wi-Fi, on TCP 2323. It is **off** until you switch it on in **Settings → System → Debug Console**, which also makes its token and shows it. With the device on USB, `scripts/flash.sh --debug` flashes it, switches the console on and gives it the token in `~/.config/roro9stack/debug-token`, so nothing has to be typed. Then, with `RORO_OTA_HOST` set to the device's IP:

 ```sh
 scripts/rdbg.py                 # interactive: the console backlog, live lines, and commands
@@ -119,3 +119,19 @@ Seven themes, each with a dark and a light side, chosen in **Settings > Theme**
 **Kept as they are:** the SSH terminal's 16 ANSI colours and its black background, the Sweep's waterfall scale, pictures, and the screen shown while the device powers off.

 **Not looked at:** the other 12 palettes beyond the Launcher, dialogs and Toasts in any theme but the default, the Setup screens. In Gruvbox light, the Sky view's GPS, GLONASS and BeiDou colours are three close shades of brown and red.
+
+## Settings in groups
+
+Settings had grown to 21 rows in one list. It now opens on five groups, each a short list of its own:
+
+| Group | Rows |
+|---|---|
+| This device | Long name, Short name, Region, Timezone, Sound & LED |
+| Display | Brightness, Dim after, Screen off after, Theme, Light or dark, Launcher |
+| GNSS and radio | GNSS, Pause GNSS for LoRa, Coordinates, Probe MACs |
+| Network | Wi-Fi, VPN |
+| System | Check for updates, Firmware, Debug Console, About |
+
+- Enter opens a group, Back returns to the groups with the selection on the one just left, and Back from the groups leaves Settings. An open group has its name over its rows.
+- `SettingsMenu` (`lib/apps_model`) holds the groups and which one is open; every index is into what is listed. Host-tested: every setting is in exactly one group, and no group has more rows than fit under its name.
+- The guide, the how-tos, the README, the scripts' messages and the firmware's own (the Toast for a new release, the GNSS App's hint) name the new paths: "Settings > System > Firmware". The milestone notes and the devlog keep the paths of their day.
@@ -16,19 +16,50 @@ struct RowDef {
    const char* label;
 };

-const RowDef kRows[] = {
-    {Row::LongName, Kind::Text, "Long name"},   {Row::ShortName, Kind::Text, "Short name"},
-    {Row::Region, Kind::Choice, "Region"},      {Row::Timezone, Kind::Choice, "Timezone"},
-    {Row::Brightness, Kind::Slider, "Brightness"}, {Row::DimTimeout, Kind::Choice, "Dim after"},
-    {Row::OffTimeout, Kind::Choice, "Screen off after"}, {Row::Launcher, Kind::Toggle, "Launcher"},
-    {Row::Theme, Kind::Choice, "Theme"}, {Row::ThemeLight, Kind::Toggle, "Light or dark"}, {Row::Sound, Kind::Toggle, "Sound & LED"},
-    {Row::Gnss, Kind::Toggle, "GNSS"}, {Row::GnssQuiet, Kind::Toggle, "Pause GNSS for LoRa"},
-    {Row::Coordinates, Kind::Toggle, "Coordinates"},
-    {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}, {Row::Wifi, Kind::Page, "Wi-Fi"},
-    {Row::CheckUpdates, Kind::Toggle, "Check for updates"}, {Row::Firmware, Kind::Page, "Firmware"},
-    {Row::Vpn, Kind::Page, "VPN"},
-    {Row::DebugConsole, Kind::Page, "Debug Console"}, {Row::About, Kind::Page, "About"},
+const RowDef kGroups[] = {
+    {Row::GroupDevice, Kind::Group, "This device"},  {Row::GroupDisplay, Kind::Group, "Display"},
+    {Row::GroupPosition, Kind::Group, "GNSS and radio"}, {Row::GroupNetwork, Kind::Group, "Network"},
+    {Row::GroupSystem, Kind::Group, "System"},
 };
+constexpr int kGroupCount = sizeof(kGroups) / sizeof(kGroups[0]);
+
+struct Member {
+    int group;  // an index into kGroups
+    RowDef def;
+};
+
+// In the order each group lists them.
+const Member kRows[] = {
+    {0, {Row::LongName, Kind::Text, "Long name"}},
+    {0, {Row::ShortName, Kind::Text, "Short name"}},
+    {0, {Row::Region, Kind::Choice, "Region"}},
+    {0, {Row::Timezone, Kind::Choice, "Timezone"}},
+    {0, {Row::Sound, Kind::Toggle, "Sound & LED"}},
+    {1, {Row::Brightness, Kind::Slider, "Brightness"}},
+    {1, {Row::DimTimeout, Kind::Choice, "Dim after"}},
+    {1, {Row::OffTimeout, Kind::Choice, "Screen off after"}},
+    {1, {Row::Theme, Kind::Choice, "Theme"}},
+    {1, {Row::ThemeLight, Kind::Toggle, "Light or dark"}},
+    {1, {Row::Launcher, Kind::Toggle, "Launcher"}},
+    {2, {Row::Gnss, Kind::Toggle, "GNSS"}},
+    {2, {Row::GnssQuiet, Kind::Toggle, "Pause GNSS for LoRa"}},
+    {2, {Row::Coordinates, Kind::Toggle, "Coordinates"}},
+    {2, {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}},
+    {3, {Row::Wifi, Kind::Page, "Wi-Fi"}},
+    {3, {Row::Vpn, Kind::Page, "VPN"}},
+    {4, {Row::CheckUpdates, Kind::Toggle, "Check for updates"}},
+    {4, {Row::Firmware, Kind::Page, "Firmware"}},
+    {4, {Row::DebugConsole, Kind::Page, "Debug Console"}},
+    {4, {Row::About, Kind::Page, "About"}},
+};
+
+// Row i of what is listed: a group, or the i-th row of the open one.
+const RowDef& at(int group, int i) {
+    if (group < 0) return kGroups[i < 0 || i >= kGroupCount ? 0 : i];
+    for (const Member& m : kRows)
+        if (m.group == group && i-- == 0) return m.def;
+    return kGroups[group];  // out of range: harmless
+}

 const int kDimSeconds[] = {10, 15, 30, 60, 120, 300};
 const int kOffSeconds[] = {30, 60, 120, 300, 600, 1800};
@@ -65,10 +96,42 @@ int indexOf(const int (&table)[N], int value) {

 }  // namespace

-int SettingsMenu::count() const { return sizeof(kRows) / sizeof(kRows[0]); }
-SettingsMenu::Row SettingsMenu::row(int i) const { return kRows[i].row; }
-SettingsMenu::Kind SettingsMenu::kind(int i) const { return kRows[i].kind; }
-std::string SettingsMenu::label(int i) const { return kRows[i].label; }
+bool SettingsMenu::open(int i) {
+    if (group_ >= 0 || i < 0 || i >= kGroupCount) return false;
+    group_ = lastGroup_ = i;
+    return true;
+}
+
+bool SettingsMenu::close() {
+    if (group_ < 0) return false;
+    group_ = -1;
+    return true;
+}
+
+std::string SettingsMenu::title() const { return group_ < 0 ? "" : kGroups[group_].label; }
+
+bool SettingsMenu::reveal(Row r, int& index) {
+    int seen[kGroupCount] = {};
+    for (const Member& m : kRows) {
+        if (m.def.row == r) {
+            group_ = lastGroup_ = m.group;
+            index = seen[m.group];
+            return true;
+        }
+        seen[m.group]++;
+    }
+    return false;
+}
+
+int SettingsMenu::count() const {
+    if (group_ < 0) return kGroupCount;
+    int n = 0;
+    for (const Member& m : kRows) n += m.group == group_;
+    return n;
+}
+SettingsMenu::Row SettingsMenu::row(int i) const { return at(group_, i).row; }
+SettingsMenu::Kind SettingsMenu::kind(int i) const { return at(group_, i).kind; }
+std::string SettingsMenu::label(int i) const { return at(group_, i).label; }

 std::string SettingsMenu::value(int i) const {
    switch (row(i)) {
@@ -7,15 +7,26 @@

 namespace roro {

-// What the Settings App lists: one row per user-facing setting (plus sub-pages), with readable
-// values, choice lists and validation messages. Rendering and navigation live in the App.
+// What the Settings App lists: the groups first, then, with one open, a row per user-facing setting
+// of that group (plus sub-pages), with readable values, choice lists and validation messages.
+// Rendering and navigation live in the App. Every index is into what is listed now.
 class SettingsMenu {
   public:
-    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Launcher, Theme, ThemeLight, Sound, Gnss, GnssQuiet, Coordinates, ProbeMacs, Wifi, CheckUpdates, Firmware, Vpn, DebugConsole, About };
-    enum class Kind { Text, Choice, Toggle, Slider, Page };
+    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Launcher, Theme, ThemeLight, Sound, Gnss, GnssQuiet, Coordinates, ProbeMacs, Wifi, CheckUpdates, Firmware, Vpn, DebugConsole, About,
+                     GroupDevice, GroupDisplay, GroupPosition, GroupNetwork, GroupSystem };
+    enum class Kind { Text, Choice, Toggle, Slider, Page, Group };

    explicit SettingsMenu(Settings& settings) : settings_(settings) {}

+    // The groups are listed until one is opened; close() lists them again.
+    bool open(int i);                // false when row i isn't a group
+    bool close();                    // false when the groups were listed already
+    bool inGroup() const { return group_ >= 0; }
+    std::string title() const;       // the open group's name, or ""
+    int groupIndex() const { return lastGroup_; }  // where the group last opened is among the groups
+    // Opens the group a row is in, and says where the row is in it. False for a row there isn't.
+    bool reveal(Row r, int& index);
+
    int count() const;
    Row row(int i) const;
    Kind kind(int i) const;
@@ -37,6 +48,7 @@ class SettingsMenu {

   private:
    Settings& settings_;
+    int group_ = -1, lastGroup_ = 0;
 };

 }  // namespace roro
@@ -414,8 +414,9 @@ inline constexpr KeyHelp kSystemSystem[] = {
 // settings: Settings
 inline constexpr KeyHelp kSettings[] = {
    {"; .", "up, down"},
-    {"Enter", "edit, or open the page"},
+    {"Enter", "open the group or the page, or edit"},
    {", /", "change a switch or a slider"},
+    {"`", "back to the groups"},
 };

 // settings-choice: Settings, a choice
@@ -6,7 +6,7 @@ namespace roro::gnss {

 // "50.86920° N": five decimals, about a metre.
 std::string formatDecimal(double degrees, bool latitude);
-// "50° 52' 09.1\" N" (Settings → Coordinates, Q64).
+// "50° 52' 09.1\" N" (Settings → GNSS and radio → Coordinates, Q64).
 std::string formatDms(double degrees, bool latitude);
 // The 6-character Maidenhead locator ("JO20ef"), as radio amateurs give their square.
 std::string maidenhead(double latitude, double longitude);
@@ -2,7 +2,7 @@
 # Flash the firmware over USB, then open the serial monitor.
 # Usage: scripts/flash.sh [--debug] [port]   USB (default: the first Espressif device found)
 #        scripts/flash.sh --ota [host]       Wi-Fi: build, sign and push a Firmware Update
-#                                            (host: the device's IP from Settings > Firmware, or $RORO_OTA_HOST)
+#                                            (host: the device's IP from Settings > System > Firmware, or $RORO_OTA_HOST)
 # --debug (USB only): once flashed, switches the Debug Console on and gives it the token in
 #   ~/.config/roro9stack/debug-token, over the serial port (ADR 0010, Q192), so scripts/rdbg.py works
 #   at once. The settings survive later updates: it is needed once for a device, not at each flash.
@@ -2,7 +2,7 @@
 """Pushes a signed Update File to a Cardputer over Wi-Fi (TCP 3232) and reports the result.

 Usage: scripts/ota_push.py <file.ota> <host>
-<host> is the device's IP (shown in Settings > Firmware).
+<host> is the device's IP (shown in Settings > System > Firmware).
 """
 import socket
 import sys
@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
-"""The Debug Console, over Wi-Fi (TCP 2323, see ADR 0010). Switch it on first: Settings > Debug Console.
+"""The Debug Console, over Wi-Fi (TCP 2323, see ADR 0010). Switch it on first: Settings > System > Debug Console.

 Usage: scripts/rdbg.py [-H host] [-t token] [-b] [command ...]
  no command   interactive: type commands, see every console line live; Ctrl-D or `quit` leaves
  command      runs it and prints what follows, until the console has been quiet for a moment
-  -H host      the device's IP (Settings > Debug Console), default $RORO_OTA_HOST
-  -t token     the device's token (also --token), as Settings > Debug Console shows it: dashes and
+  -H host      the device's IP (Settings > System > Debug Console), default $RORO_OTA_HOST
+  -t token     the device's token (also --token), as Settings > System > Debug Console shows it: dashes and
               case don't matter. Otherwise $RORO_DEBUG_TOKEN, otherwise ~/.config/roro9stack/debug-token
  -b           also print the backlog the device sends on connecting (boot messages and so on)

@@ -55,7 +55,7 @@ def find_token(given):
    token = tidy_token(token or "")
    if not token:
        sys.exit("No token: pass -t <token>, set RORO_DEBUG_TOKEN, or put it in " + TOKEN_FILE +
-                 "\n(the device shows it in Settings > Debug Console)")
+                 "\n(the device shows it in Settings > System > Debug Console)")
    return token


@@ -63,7 +63,7 @@ def log_in(sock, token):
    """Answers the device's challenge; returns the banner line, or exits saying what went wrong."""
    first = read_until(sock, b"\n", 10)
    if first is None:
-        sys.exit("device: nothing came back. Is the console switched on (Settings > Debug Console)?")
+        sys.exit("device: nothing came back. Is the console switched on (Settings > System > Debug Console)?")
    line = first.decode(errors="replace").strip()
    if line.startswith("locked"):
        sys.exit("device: closed for a minute after too many wrong tokens")
@@ -75,7 +75,7 @@ def log_in(sock, token):
    if banner is None:
        sys.exit("device: no answer")
    if banner.startswith(b"denied"):
-        sys.exit("device: wrong token (Settings > Debug Console shows the right one)")
+        sys.exit("device: wrong token (Settings > System > Debug Console shows the right one)")
    return banner


@@ -326,7 +326,7 @@ def main():
    try:
        sock = socket.create_connection((host, PORT), timeout=10)
    except OSError as e:
-        sys.exit(f"device: can't connect to {host}:{PORT} ({e}). Is the console switched on (Settings > Debug Console)?")
+        sys.exit(f"device: can't connect to {host}:{PORT} ({e}). Is the console switched on (Settings > System > Debug Console)?")
    with sock:
        banner = log_in(sock, token)
        show = sys.stdout if backlog or not args else None
@@ -47,7 +47,7 @@ PREVIOUS="$(git -C "$SRC" describe --tags --abbrev=0 "$VERSION^" 2>/dev/null ||
    echo
    echo "## Files"
    echo
-    echo "- \`$NAME.ota\`: the signed Update File. Copy it to \`/updates\` on the SD card and install it from Settings > Firmware or the Storage App, or push it over Wi-Fi with \`scripts/ota_push.py\`."
+    echo "- \`$NAME.ota\`: the signed Update File. Copy it to \`/updates\` on the SD card and install it from Settings > System > Firmware or the Storage App, or push it over Wi-Fi with \`scripts/ota_push.py\`."
    echo "- \`$NAME-factory.bin\`: the whole flash image, for a first install over USB at offset 0."
    echo "- \`$NAME.elf.gz\`: the symbols, to decode a crash report from this build."
    echo "- \`SHA256SUMS\`: checksums of the three."
@@ -2,7 +2,7 @@
 """Copies a file to the Cardputer's SD card over the USB serial console (the `sd put` command).

 Usage: scripts/sd_put.sh <file> [card path]
-The card path defaults to /updates/<file name>, where Settings > Firmware finds Update Files.
+The card path defaults to /updates/<file name>, where Settings > System > Firmware finds Update Files.
 The device acknowledges each chunk once it's on the card, checks the SHA-256 of the whole file,
 and only then renames <card path>.part to <card path>.
 """
@@ -36,19 +36,19 @@ scripts/ota_keygen.sh                  # once: creates the signing key (see ADR
 scripts/flash.sh --ota 10.39.39.12     # build, sign and push; or set RORO_OTA_HOST
 ```

-The device shows the push address in **Settings → Firmware**. It installs a correctly signed update right away, restarts (waiting up to 60 s if you're typing), and runs the new firmware on **Probation**. If the new firmware crashes, or can't reconnect Wi-Fi within 3 minutes, it rolls back to the previous one and says so.
+The device shows the push address in **Settings → System → Firmware**. It installs a correctly signed update right away, restarts (waiting up to 60 s if you're typing), and runs the new firmware on **Probation**. If the new firmware crashes, or can't reconnect Wi-Fi within 3 minutes, it rolls back to the previous one and says so.

-To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).
+To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → System → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).

 **The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB. (CI signs releases with a copy kept as a repository secret, ADR 0008.)

 ### Updates from Gitea

-With no PC and no card, the device can install the project's releases itself (docs/milestones/R1.md). In **Settings → Firmware**:
+With no PC and no card, the device can install the project's releases itself (docs/milestones/R1.md). In **Settings → System → Firmware**:

 - **Latest release** checks the server (Enter, or `c`) and says `v0.11.0 (new)` or `(current)`. Enter again opens the release: its version, date, size and the tag's message, with **Install** when it's newer. The download goes straight into the inactive slot, so no card is needed; the signature is checked after the first 160 bytes, before anything is written, and the image's hash at the end. The new firmware then runs on Probation as for any update.
 - **Older releases** lists the last ten, newest first. Opening an older one offers to go back to it, with a different question.
- **Settings → Check for updates** (on by default): once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > Firmware`, once per version. It installs nothing by itself, and doesn't announce a version that already failed and rolled back on this device.
+- **Settings → System → Check for updates** (on by default): once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > System > Firmware`, once per version. It installs nothing by itself, and doesn't announce a version that already failed and rolled back on this device.

 The connection is checked against the two ISRG roots Let's Encrypt chains end in (ADR 0009), not the usual bundle of about 130 authorities. Whatever the connection, the Update File's own signature is what decides what gets installed.

@@ -34,8 +34,8 @@ scripts/flash.sh --ota 10.39.39.12                     # builds, signs and pushe
 {{ diagram(src="ways-in.svg", min_width=580, caption="Every path ends at the same Update Service and the same signature check.") }}

 1. **Push over Wi-Fi** to TCP 3232: `scripts/flash.sh --ota`. The device always listens while Wi-Fi is connected.
-2. **From the SD card**: a `.ota` in `/updates`, installed from Settings → Firmware, from the Storage App, or with the `install <path>` command. Put it there by hand, with `scripts/rdbg.py put` over Wi-Fi, or with `scripts/sd_put.sh` over USB.
-3. **From the project's releases** on Gitea, which the device downloads itself over TLS (Settings → Firmware, or `update check` / `update install <tag>`): see [Flash and update](/dev/build/flash/).
+2. **From the SD card**: a `.ota` in `/updates`, installed from Settings → System → Firmware, from the Storage App, or with the `install <path>` command. Put it there by hand, with `scripts/rdbg.py put` over Wi-Fi, or with `scripts/sd_put.sh` over USB.
+3. **From the project's releases** on Gitea, which the device downloads itself over TLS (Settings → System → Firmware, or `update check` / `update install <tag>`): see [Flash and update](/dev/build/flash/).

 All three feed the same parser: the **header and signature are checked first**, the image is written to the **other app slot** while it is hashed, and the slot becomes the next boot **only if the hash matches**. Anything wrong ends in a Toast and **nothing changes**. A downgrade is allowed, and shows "older than the installed version".

@@ -21,7 +21,7 @@
    <rect class="wi-panel" x="288" y="176" width="200" height="88" rx="8"/>
    <text x="302" y="200" font-size="12" font-weight="600">SD card</text>
    <text x="302" y="219" font-size="11">/updates/*.ota</text>
-    <text x="302" y="238" font-size="11" class="wi-dim">Settings → Firmware,</text>
+    <text x="302" y="238" font-size="11" class="wi-dim">Settings → System → Firmware,</text>
    <text x="302" y="254" font-size="11" class="wi-dim">or install &lt;path&gt;</text>

    <rect class="wi-hot" x="536" y="32" width="208" height="158" rx="8"/>
@@ -45,8 +45,8 @@ ifconfig | arp | netstat   the interfaces (Wi-Fi and the VPN), their addresses,
 uname   the firmware, its version and the chip it is built for
 scp [-f] [-P port] <file on the card> user@host:path | scp [-f] [-P port] user@host:path <file on the card>   one file over SSH, with this device's key or, in the Shell, a password, to a server the SSH App already trusts; -f replaces a file on the card; `cancel` stops it
 ssh user@host[:port] | ssh status | ssh stop   a terminal on another machine, in the SSH App; the password is asked there, never here
-vpn status | vpn up [seconds] | vpn down | vpn import [path] | vpn forget | vpn auto on|off   the WireGuard tunnel (Settings > VPN); import reads /vpn/wg0.conf; with seconds, it goes down by itself
-debug status | debug off [seconds]   the Debug Console over Wi-Fi (Settings > Debug Console); with seconds, it comes back
+vpn status | vpn up [seconds] | vpn down | vpn import [path] | vpn forget | vpn auto on|off   the WireGuard tunnel (Settings > Network > VPN); import reads /vpn/wg0.conf; with seconds, it goes down by itself
+debug status | debug off [seconds]   the Debug Console over Wi-Fi (Settings > System > Debug Console); with seconds, it comes back
 debug on | debug token <16 to 64 characters> | debug token new   (USB serial only) switch it on, set its token
 crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)
 wifi ip ... try <seconds> | wifi ip keep   a trial IP setting: back to the previous one unless kept
@@ -97,7 +97,7 @@ In **Safe Mode** (see [Crashes and Safe Mode](/dev/debug/crashes/)) only a few r
 | `ls [folder]` / `du <path>` | Lists a folder of the SD card with sizes and dates, or counts the files and bytes under a path |
 | `screenshot [seconds]` | The screen as a PNG in `/screenshots` on the card, now or after a pause to get to the screen you want (240 x 135, about 33 KB). Over the Debug Console a bare `screenshot` sends the screen to the PC instead |
 | `cp [-f] <from> <to>` / `mv [-f] <from> <to>` / `rm [-r] [-f] <path>` / `mkdir <path>` / `cancel` | What the Storage App does, with its rules: copy (folders too), move or rename, delete (`rm -r` for a folder and what's in it, as Unix has it), new folder. `-f` replaces a file that's in the way; `*` and `?` in the last part of a path (`ls`, `du`, `rm`, `cp`, `mv`) run the command for each name matched, 64 at most; a tab separates paths that hold spaces; `cancel` stops a copy or a delete |
-| `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
+| `install <path>` | Update from SD with that `.ota` file, as Settings → System → Firmware does |
 | `update check` / `update list` / `update status` / `update install <tag>` | The project's releases on Gitea: look at the latest, list the last ten, say what's known, or download and install one |
 | `update pretend <version>` / `update probe <host>` / `update damage cut\|flip <n>` / `update daily` | Pretend to run another version (so a release counts as an update), see whether a server's certificate is accepted, cut or damage the next download, run the daily check again |
 | `lora probe` | Finds the radio: chip, oscillator, antenna switch, DIO1 interrupt, noise floor |
@@ -16,7 +16,7 @@ Before version 0.12 this was a separate *Debug Build* with a token compiled in f

 ## On the device

-**Settings → Debug Console:**
+**Settings → System → Debug Console:**

 | Row | Does |
 |---|---|
@@ -127,3 +127,19 @@ Seven themes, each with a dark and a light side, chosen in **Settings > Theme**
 **Kept as they are:** the SSH terminal's 16 ANSI colours and its black background, the Sweep's waterfall scale, pictures, and the screen shown while the device powers off.

 **Not looked at:** the other 12 palettes beyond the Launcher, dialogs and Toasts in any theme but the default, the Setup screens. In Gruvbox light, the Sky view's GPS, GLONASS and BeiDou colours are three close shades of brown and red.
+
+## Settings in groups
+
+Settings had grown to 21 rows in one list. It now opens on five groups, each a short list of its own:
+
+| Group | Rows |
+|---|---|
+| This device | Long name, Short name, Region, Timezone, Sound & LED |
+| Display | Brightness, Dim after, Screen off after, Theme, Light or dark, Launcher |
+| GNSS and radio | GNSS, Pause GNSS for LoRa, Coordinates, Probe MACs |
+| Network | Wi-Fi, VPN |
+| System | Check for updates, Firmware, Debug Console, About |
+
+- Enter opens a group, Back returns to the groups with the selection on the one just left, and Back from the groups leaves Settings. An open group has its name over its rows.
+- `SettingsMenu` (`lib/apps_model`) holds the groups and which one is open; every index is into what is listed. Host-tested: every setting is in exactly one group, and no group has more rows than fit under its name.
+- The guide, the how-tos, the README, the scripts' messages and the firmware's own (the Toast for a new release, the GNSS App's hint) name the new paths: "Settings > System > Firmware". The milestone notes and the devlog keep the paths of their day.
@@ -39,7 +39,7 @@ The browser flasher uses Web Serial, which Chrome and Edge have on desktop and F

 ## How do I update it?

-Three ways, all with the same signed update file: from the project's releases on the device itself (**Settings → Firmware**), from the SD card, or pushed over Wi-Fi from a PC. See [Updates](/guide/updates/) and [Install an update from the SD card](/howto/update-from-sd/).
+Three ways, all with the same signed update file: from the project's releases on the device itself (**Settings → System → Firmware**), from the SD card, or pushed over Wi-Fi from a PC. See [Updates](/guide/updates/) and [Install an update from the SD card](/howto/update-from-sd/).

 ## Is it safe to update? What if it goes wrong?

@@ -51,7 +51,7 @@ Yes: it is [open source](https://git.twis.la/twisla/roro9stack) (GPL-3.0). The d

 ## Does it phone home? What about privacy?

-**The firmware contacts the project's server once a day,** to see whether a new release exists: **Settings → Check for updates**, on by default, only when Wi-Fi is up and the clock is set. It installs nothing by itself, and you can switch it off. Besides that, the device talks to what you ask it to: the IRC server and Gemini capsules you open, DNS servers (9.9.9.9 and 1.1.1.1 by default) and time servers (pool.ntp.org and time.cloudflare.com by default), all of which you can change. There is no account, no analytics and no telemetry.
+**The firmware contacts the project's server once a day,** to see whether a new release exists: **Settings → System → Check for updates**, on by default, only when Wi-Fi is up and the clock is set. It installs nothing by itself, and you can switch it off. Besides that, the device talks to what you ask it to: the IRC server and Gemini capsules you open, DNS servers (9.9.9.9 and 1.1.1.1 by default) and time servers (pool.ntp.org and time.cloudflare.com by default), all of which you can change. There is no account, no analytics and no telemetry.

 **It listens on the network only for what you switched on:** the port that receives signed firmware updates, always; the Debug Console, the card shared with a browser and the VPN, only while you have them on. The SSH App connects out to the server you name and listens for nothing.

@@ -42,7 +42,7 @@ Left and right go through every App and wrap around; up and down stay in the col

 **An orange dot on an icon** says something is going on in that App: unread messages in IRC, a Track being recorded in GNSS, a Capture running in the LoRa Scanner, a session open in SSH.

-If you prefer the list of names the Launcher used to be, **Settings → Launcher** switches between **Grid** and **List**. In the list, a `*` on the right stands for the dot.
+If you prefer the list of names the Launcher used to be, **Settings → Display → Launcher** switches between **Grid** and **List**. In the list, a `*` on the right stands for the dot.

 ## The Status Bar

@@ -57,7 +57,7 @@ A strip at the top of every screen: the name of the App on the left, and on the
 | bars and `W` | Wi-Fi connected, with its signal; `W?` is searching; `MON` is the Wi-Fi radio in its monitoring mode, which pauses IRC |
 | `SSH` | An [SSH session](/guide/ssh/) is open, whatever App is in front |
 | `VPN` | The [WireGuard tunnel](/guide/vpn/) is wanted; brighter once the server has answered |
-| `DBG` | The Debug Console is switched on (Settings → Debug Console); brighter while a PC is connected to it |
+| `DBG` | The Debug Console is switched on (Settings → System → Debug Console); brighter while a PC is connected to it |
 | `REC` | A GNSS Track is being recorded |
 | `CAP` | A LoRa capture is being recorded |
 | `L` | The radio is listening; it lights up for a moment on each packet. `SW` while a Sweep runs |
@@ -7,13 +7,13 @@ tag = "GNSS"
 screens = ["sky.png"]
 +++

-GNSS needs the **Cap LoRa-1262**, an antenna with a view of the sky, and **Settings → GNSS** switched **On**. Otherwise the App says `GNSS is off` (or `paused`, when "Pause GNSS for LoRa" has put the receiver on standby while the radio listens). A first fix outdoors can take a while: the App says how long it has been searching.
+GNSS needs the **Cap LoRa-1262**, an antenna with a view of the sky, and **Settings → GNSS and radio → GNSS** switched **On**. Otherwise the App says `GNSS is off` (or `paused`, when "Pause GNSS for LoRa" has put the receiver on standby while the radio listens). A first fix outdoors can take a while: the App says how long it has been searching.

 ## Position

 The first view shows the fix (`No Fix`, `2D Fix` or `3D Fix`, and how many satellites it uses), then:

- **Lat** and **Lon**, in decimal degrees or degrees, minutes and seconds (**Settings → Coordinates**);
+- **Lat** and **Lon**, in decimal degrees or degrees, minutes and seconds (**Settings → GNSS and radio → Coordinates**);
 - the **Locator**, the Maidenhead grid square;
 - **Altitude**, **Speed** and the direction you are moving;
 - **HDOP**, the horizontal precision: a smaller number is better;
@@ -63,7 +63,7 @@ A capture records packets into a **pcap** file with LoRaTap headers in `/capture

 ## The GNSS receiver raises the noise

-The GNSS receiver on the same Cap makes the radio's noise floor about **8 dB** worse while it runs. **Settings → Pause GNSS for LoRa** (off by default) puts the receiver on standby while the radio listens, except while a Track is being recorded.
+The GNSS receiver on the same Cap makes the radio's noise floor about **8 dB** worse while it runs. **Settings → GNSS and radio → Pause GNSS for LoRa** (off by default) puts the receiver on standby while the radio listens, except while a Track is being recorded.

 ## The keys, as the device lists them

@@ -6,26 +6,51 @@ weight = 11
 tag = "Settings"
 +++

-Move with the arrows. On a toggle, a choice or a slider, left and right change the value; <kbd>Enter</kbd> opens a text field or a list of choices, or a page marked `>`. Back leaves.
+Settings opens on five **groups**. <kbd>Enter</kbd> opens a group, and Back returns to the groups; Back from the groups leaves Settings.
+
+Inside a group, move with the arrows. On a toggle, a choice or a slider, left and right change the value; <kbd>Enter</kbd> opens a text field or a list of choices, or a page marked `>`.
+
+### This device

 | Setting | What it is |
 |---|---|
 | **Long name**, **Short name** | The names you gave in the first-start Setup (up to 39 bytes, and up to 4 characters) |
 | **Region** | The regulatory region; EU868 |
 | **Timezone** | For the clock and the dates in file names |
+| **Sound & LED** | The beep and the flash on a [Toast](/guide/basics/) |
+
+### Display
+
+| Setting | What it is |
+|---|---|
 | **Brightness** | A slider |
 | **Dim after**, **Screen off after** | Screen timeouts. Dimming must come before the screen turns off |
-| **Launcher** | The home screen as a **Grid** of icons or a **List** of names (see [The basics](/guide/basics/#the-launcher)) |
 | **Theme** | The colours of every screen: **roro9stack** (the website's), **Catppuccin**, **Dracula**, **Nord**, **ANSI terminal**, **Gruvbox** or **Solarized** |
 | **Light or dark** | Which side of the theme: every one has both |
-| **Sound & LED** | The beep and the flash on a [Toast](/guide/basics/) |
+| **Launcher** | The home screen as a **Grid** of icons or a **List** of names (see [The basics](/guide/basics/#the-launcher)) |
+
+### GNSS and radio
+
+| Setting | What it is |
+|---|---|
 | **GNSS** | Switches the receiver on and off (see [GNSS](/guide/gnss/)) |
 | **Pause GNSS for LoRa** | Puts the receiver on standby while the radio listens (see [LoRa Scanner](/guide/lora-scanner/)) |
 | **Coordinates** | Decimal degrees, or degrees, minutes and seconds |
+| **Probe MACs** | Whether the Wi-Fi Tools' logs of probe requests keep the addresses as they are (**Raw**) or **Pseudonymised** |
+
+### Network
+
+| Setting | What it is |
+|---|---|
 | **Wi-Fi** | The page below |
+| **VPN** | A WireGuard tunnel: its switch, "Start with Wi-Fi", and importing its configuration from the card. See [VPN](/guide/vpn/) |
+
+### System
+
+| Setting | What it is |
+|---|---|
 | **Check for updates** | Once a day, see [Updates](/guide/updates/) |
 | **Firmware** | The page described in [Updates](/guide/updates/) |
-| **VPN** | A WireGuard tunnel: its switch, "Start with Wi-Fi", and importing its configuration from the card. See [VPN](/guide/vpn/) |
 | **Debug Console** | Off unless you switch it on. It lets a PC on the same network read the device's console and drive it, with a token shown on this page: see [the developer docs](/dev/debug/switch-it-on/). Leave it off if that means nothing to you |
 | **About** | The firmware version, the node number, battery, memory, uptime, clock and licence |

@@ -9,7 +9,7 @@ screens = ["update.png"]

 Every update is one **signed file** (`.ota`). The device installs only a file signed with the project's key, so it cannot be tricked into installing anything else, whichever way the file arrives.

-## Settings → Firmware
+## Settings → System → Firmware

 The page shows the **version** running, its **status**, the address to **push updates to** over Wi-Fi, and:

@@ -21,7 +21,7 @@ An install needs Wi-Fi if it is a download. The new firmware is checked before a

 ## Check for updates

-**Settings → Check for updates** is on by default. Once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > Firmware`, once per version. It installs **nothing** by itself, and it does not announce a version that already failed and rolled back on this device.
+**Settings → System → Check for updates** is on by default. Once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > System > Firmware`, once per version. It installs **nothing** by itself, and it does not announce a version that already failed and rolled back on this device.

 ## Probation and Rollback

@@ -15,14 +15,14 @@ You need a WireGuard server, yours or a provider's, and the configuration file i

 1. On the server, make a configuration for a new client, as you would for a phone.
 2. Copy the file to the SD card as **`/vpn/wg0.conf`**.
-3. On the device: **Settings → VPN → Import /vpn/wg0.conf**.
+3. On the device: **Settings → Network → VPN → Import /vpn/wg0.conf**.
 4. Say yes when it offers to **delete the file**: the configuration is now stored in the device, and the file on the card still holds the private key in clear.

 If the file can't be used, the page says which line and why. The key itself is never shown, anywhere, once imported.

 ## Using it

-**Settings → VPN** has a switch. `VPN` appears in the [Status Bar](/guide/basics/#the-status-bar) while the tunnel is wanted, and turns bright once the server has answered. The page shows the state, the server, this device's address in the tunnel, what goes through it, and how long ago the server was last heard.
+**Settings → Network → VPN** has a switch. `VPN` appears in the [Status Bar](/guide/basics/#the-status-bar) while the tunnel is wanted, and turns bright once the server has answered. The page shows the state, the server, this device's address in the tunnel, what goes through it, and how long ago the server was last heard.

 - **The switch is for now.** It doesn't survive a restart.
 - **Start with Wi-Fi**, off by default, starts the tunnel whenever Wi-Fi connects.
@@ -6,14 +6,14 @@ weight = 4
 tag = "Wi-Fi"
 +++

-1. **Add the network first.** In **Settings → Wi-Fi**, choose **Add a network**, pick it and type the password. (A hidden network has its own entry, which asks for the name first.)
+1. **Add the network first.** In **Settings → Network → Wi-Fi**, choose **Add a network**, pick it and type the password. (A hidden network has its own entry, which asks for the name first.)
 2. **Open the network's page:** <kbd>Enter</kbd> on it in the list of saved networks.
 3. **Set *IP address* to *Fixed*.** The address, the prefix and the gateway start from what the network is giving the device at that moment, so you only change what is wrong.
   - **Address:** four numbers, like `10.39.39.13`.
   - **Prefix:** 1 to 30. 24 is 255.255.255.0.
   - **Gateway:** optional; empty means none.
 4. **Leave the page.** The setting is checked and applied then; a bad address is refused with the reason.
-5. **Check it.** Back in **Settings → Wi-Fi**, <kbd>Enter</kbd> on **Status** shows the address, the mask, the gateway, the DNS and NTP servers, and where each came from.
+5. **Check it.** Back in **Settings → Network → Wi-Fi**, <kbd>Enter</kbd> on **Status** shows the address, the mask, the gateway, the DNS and NTP servers, and where each came from.

 ## DNS and time

@@ -8,7 +8,7 @@ tag = "GNSS"

 You need the **Cap LoRa-1262**, an **SD card**, and a place with a view of the sky.

-1. **Switch the receiver on:** **Settings → GNSS** to *On*. The Status Bar shows `G` once it is searching.
+1. **Switch the receiver on:** **Settings → GNSS and radio → GNSS** to *On*. The Status Bar shows `G` once it is searching.
 2. **Open the GNSS App** and wait for a fix. The first line says `Searching: n in view` and how long it has been, then `3D Fix, n of m satellites`. The first fix outdoors can take a while.
 3. **The clock must be set.** A fix sets it, and so does Wi-Fi. A Track will not start without one: the App says `Waiting for the time`.
 4. **Press <kbd>r</kbd>.** The bottom line says `REC`, with the number of points and how long it has been going, and the Status Bar shows `REC`. You can leave the App: the Track keeps recording.
@@ -14,5 +14,5 @@ tag = "Screen"

 - It needs an SD card.
 - The files are PNGs of 240 by 135 pixels, named by date and time.
- **It refuses on Settings → Debug Console**, the page that shows the console's token: a picture of it would be a copy of the token.
+- **It refuses on Settings → System → Debug Console**, the page that shows the console's token: a picture of it would be a copy of the token.
 - From the [Shell](/guide/shell/), `screenshot 5` takes the picture five seconds later, for a screen you can't press keys on.
@@ -8,7 +8,7 @@ tag = "Updates"

 1. **Get the update file.** On the [Downloads page](/downloads/), take the `.ota` file of the release you want: `roro9stack-<version>.ota`. Every release has one.
 2. **Copy it to `/updates`** on the SD card, from a computer. If the folder is not there, create it. (With the Cardputer on USB, a developer can also send it with `scripts/sd_put.sh`; see the [README](https://git.twis.la/twisla/roro9stack#firmware-updates-over-wi-fi-ota).)
-3. **Put the card in the Cardputer.** Open **Settings → Firmware.** Under *On the SD card* the file is listed. If it says `No .ota files in /updates`, the name or the folder is wrong.
+3. **Put the card in the Cardputer.** Open **Settings → System → Firmware.** Under *On the SD card* the file is listed. If it says `No .ota files in /updates`, the name or the folder is wrong.
 4. **Press Enter on the file,** then **Install**. The device checks the signature and the contents before it writes anything, installs, and restarts. It waits up to 60 seconds if you are typing.
 5. **After the restart** the new firmware is on **Probation**: if it crashes or cannot get Wi-Fi back within 3 minutes, the device goes back to the previous version by itself and says so.

@@ -12,7 +12,7 @@ You need a WireGuard server, and a **client configuration** made on it for the C
 2. On the Cardputer, open **Storage** and press <kbd>w</kbd>; open the page on the phone ([Move files with your phone](/howto/phone-files/)).
 3. In the page, tap **New folder**, name it `vpn`, go into it, and **upload `wg0.conf`**.
 4. On the Cardputer, press Back to stop sharing.
-5. Open **Settings → VPN → Import /vpn/wg0.conf**. You should see "Imported", and a question: **delete the file**. Say yes: the configuration is now in the device, and the file still holds the private key in clear.
+5. Open **Settings → Network → VPN → Import /vpn/wg0.conf**. You should see "Imported", and a question: **delete the file**. Say yes: the configuration is now in the device, and the file still holds the private key in clear.
 6. Switch **VPN** to On. `VPN` appears in the Status Bar, and turns bright once the server has answered, usually within seconds. The page says "It is up".
 7. To have it start by itself, switch on **Start with Wi-Fi**.

@@ -488,8 +488,9 @@ id = "settings"
 title = "Settings"
 rows = [
    ["; .", "up, down"],
-    ["Enter", "edit, or open the page"],
+    ["Enter", "open the group or the page, or edit"],
    [", /", "change a switch or a slider"],
+    ["`", "back to the groups"],
 ]

 [[scope]]
@@ -11,7 +11,7 @@
  </header>

  <div class="prose">
-    <p>Each release has a <strong>signed update file</strong> (<code>.ota</code>: copy it to <code>/updates</code> on the SD card and install it from Settings → Firmware or the Storage App, or push it over Wi-Fi), a <strong>factory image</strong> (<code>-factory.bin</code>, the whole flash at offset 0 for a first install over USB), the <strong>symbols</strong> (<code>.elf.gz</code>, to decode a crash report) and <code>SHA256SUMS</code>.</p>
+    <p>Each release has a <strong>signed update file</strong> (<code>.ota</code>: copy it to <code>/updates</code> on the SD card and install it from Settings → System → Firmware or the Storage App, or push it over Wi-Fi), a <strong>factory image</strong> (<code>-factory.bin</code>, the whole flash at offset 0 for a first install over USB), the <strong>symbols</strong> (<code>.elf.gz</code>, to decode a crash report) and <code>SHA256SUMS</code>.</p>
  </div>

  {% if releases %}
@@ -15,7 +15,7 @@

 namespace roro {

-// Settings → Debug Console (ADR 0010): the switch, where to connect, and the token, which is shown
+// Settings → System → Debug Console (ADR 0010): the switch, where to connect, and the token, which is shown
 // here and nowhere else. Switching on makes a token if there's none; a new one, or one typed by
 // hand, ends the connection of whoever holds the old one.
 class DebugConsolePage {
@@ -18,7 +18,7 @@

 namespace roro {

-// Settings → Firmware: the running version and its Probation, where to push Firmware Updates, the
+// Settings → System → Firmware: the running version and its Probation, where to push Firmware Updates, the
 // project's releases on Gitea (the latest, and the ten before it), and the Update Files on the SD
 // card (in /updates) to install from.
 class FirmwarePage {
@@ -76,7 +76,7 @@ void GnssApp::draw(Canvas& c) {
        c.drawString(held ? "GNSS is paused" : "GNSS is off", 4, area.y + 4);
        c.setFont(&fonts::body);
        c.setTextColor(theme::kMuted);
-        c.drawString(held ? "The LoRa radio is listening, and" : "Settings > GNSS turns it on.", 4, area.y + 22);
+        c.drawString(held ? "The LoRa radio is listening, and" : "On: Settings > GNSS and radio > GNSS", 4, area.y + 22);
        if (held) c.drawString("Settings pauses GNSS for it.", 4, area.y + 22 + theme::kLineHeight);
        return;
    }
@@ -11,7 +11,7 @@
 namespace roro {

 // Home screen: the visible Apps as a grid of icons, with the selected one's name under it, or as
-// a list of names (Settings > Launcher). Select opens one. An App with something going on has a
+// a list of names (Settings > Display > Launcher). Select opens one. An App with something going on has a
 // dot on its tile (App::badge, issue #9).
 class LauncherApp : public App {
   public:
@@ -15,7 +15,9 @@ using Row = SettingsMenu::Row;

 void SettingsApp::onEnter() {
    page_ = Page::Menu;
+    menu_.close();
    list_.setCount(menu_.count());
+    list_.select(0);
 }

 void SettingsApp::warn(const std::string& text) {
@@ -56,7 +58,12 @@ bool SettingsApp::onMenuKey(const KeyEvent& e) {
            if (menu_.kind(i) == Kind::Toggle) menu_.toggle(i);
            return true;
        case Key::Select: break;
-        default: return false;  // Back leaves Settings
+        case Key::Back:
+            if (!menu_.close()) return false;  // from the groups, Back leaves Settings
+            list_.setCount(menu_.count());
+            list_.select(menu_.groupIndex());
+            return true;
+        default: return false;
    }
    editingRow_ = i;
    switch (menu_.kind(i)) {
@@ -72,6 +79,11 @@ bool SettingsApp::onMenuKey(const KeyEvent& e) {
            break;
        case Kind::Toggle: menu_.toggle(i); break;
        case Kind::Slider: break;
+        case Kind::Group:
+            menu_.open(i);
+            list_.setCount(menu_.count());
+            list_.select(0);
+            break;
        case Kind::Page:
            switch (menu_.row(i)) {
                case Row::Wifi:
@@ -194,16 +206,27 @@ std::vector<std::string> SettingsApp::aboutLines() const {
 void SettingsApp::draw(Canvas& c) {
    const auto& area = theme::kContent;
    switch (page_) {
-        case Page::Menu:
+        case Page::Menu: {
+            // An open group has its name on a line of its own, over its rows.
+            theme::Rect rows = area;
+            if (menu_.inGroup()) {
+                c.setFont(&fonts::bold);
+                c.setTextDatum(top_left);
+                c.setTextColor(theme::kMuted);
+                c.drawString(menu_.title().c_str(), 4, area.y + 1);
+                rows.y += theme::kLineHeight;
+                rows.h -= theme::kLineHeight;
+            }
            widgets::list(
-                c, list_, area, [this](int i) { return menu_.label(i); },
+                c, list_, rows, [this](int i) { return menu_.label(i); },
                [this](int i) {
                    auto kind = menu_.kind(i);
-                    if (kind == Kind::Page) return std::string(">");
+                    if (kind == Kind::Page || kind == Kind::Group) return std::string(">");
                    if (kind == Kind::Slider) return "< " + menu_.value(i) + " >";
                    return menu_.value(i);
                });
            break;
+        }
        case Page::Text:
            c.setFont(&fonts::body);
            c.setTextColor(theme::kMuted);
@@ -35,7 +35,7 @@ struct SettingsAppDeps {
    VpnService& vpn;
 };

-// Settings: every user-facing setting, plus the Wi-Fi, Firmware, Debug Console and About pages.
+// Settings: every user-facing setting, in groups, plus the Wi-Fi, VPN, Firmware, Debug Console and About pages.
 class SettingsApp : public App {
   public:
    explicit SettingsApp(const SettingsAppDeps& deps)
@@ -16,7 +16,7 @@

 namespace roro {

-// Settings > VPN (issue #8): the switch, "Start with Wi-Fi", importing a `.conf` from the card
+// Settings > Network > VPN (issue #8): the switch, "Start with Wi-Fi", importing a `.conf` from the card
 // and forgetting it, and what the tunnel is doing. No key is ever on this page.
 class VpnPage {
   public:
@@ -17,7 +17,7 @@

 namespace roro {

-// Settings → Wi-Fi: the On/Off switch, the connection and its details, DNS and NTP servers, and
+// Settings → Network → Wi-Fi: the On/Off switch, the connection and its details, DNS and NTP servers, and
 // the Saved Networks: adding one from a scan or by name (hidden), and each one's own page with its
 // IP setting, Automatic or Fixed (docs/milestones/S1.md, Q113). Owned by the Settings App.
 class WifiSettingsPage {
@@ -703,8 +703,8 @@ static const char* const kHelp =
    "uname   the firmware, its version and the chip it is built for\n"
    "scp [-f] [-P port] <file on the card> user@host:path | scp [-f] [-P port] user@host:path <file on the card>   one file over SSH, with this device's key or, in the Shell, a password, to a server the SSH App already trusts; -f replaces a file on the card; `cancel` stops it\n"
    "ssh user@host[:port] | ssh status | ssh stop   a terminal on another machine, in the SSH App; the password is asked there, never here\n"
-    "vpn status | vpn up [seconds] | vpn down | vpn import [path] | vpn forget | vpn auto on|off   the WireGuard tunnel (Settings > VPN); import reads /vpn/wg0.conf; with seconds, it goes down by itself\n"
-    "debug status | debug off [seconds]   the Debug Console over Wi-Fi (Settings > Debug Console); with seconds, it comes back\n"
+    "vpn status | vpn up [seconds] | vpn down | vpn import [path] | vpn forget | vpn auto on|off   the WireGuard tunnel (Settings > Network > VPN); import reads /vpn/wg0.conf; with seconds, it goes down by itself\n"
+    "debug status | debug off [seconds]   the Debug Console over Wi-Fi (Settings > System > Debug Console); with seconds, it comes back\n"
    "debug on | debug token <16 to 64 characters> | debug token new   (USB serial only) switch it on, set its token\n"
    "crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)\n"
    "wifi ip ... try <seconds> | wifi ip keep   a trial IP setting: back to the previous one unless kept\n"
@@ -897,13 +897,13 @@ static void debugCommand(const String& args, bool fromSerial) {
        debugResumes = true;
        console.printf("debug: off for %lu s\n", (unsigned long)seconds);
    } else if (!fromSerial) {
-        console.println("debug: over USB serial only (or Settings > Debug Console)");
+        console.println("debug: over USB serial only (or Settings > System > Debug Console)");
    } else if (args == "on") {
        DebugConsole::switchOn(settings);
-        console.println("debug: on (the token is in Settings > Debug Console)");
+        console.println("debug: on (the token is in Settings > System > Debug Console)");
    } else if (args == "token new") {
        settings.setString(Setting::DebugToken, DebugConsole::freshToken());
-        console.println("debug: a new token (it is in Settings > Debug Console)");
+        console.println("debug: a new token (it is in Settings > System > Debug Console)");
    } else if (args.startsWith("token ")) {
        std::string token = debug::tidyToken(args.substring(6).c_str());
        bool ok = debug::validToken(token) && settings.setString(Setting::DebugToken, token);
@@ -1141,7 +1141,7 @@ static void runCommand(String line, bool fromSerial = false) {
        if (found) radioService->setPreset(p);
        console.printf("lora preset: %s\n", found ? p.name : "unknown (LongFast LongSlow MediumSlow MediumFast ShortSlow ShortFast LongMod MeshCore)");
    }
-    if (line == "gnss quiet on" || line == "gnss quiet off") {  // Settings > Pause GNSS for LoRa (issue #20)
+    if (line == "gnss quiet on" || line == "gnss quiet off") {  // Settings > GNSS and radio > Pause GNSS for LoRa (issue #20)
        settings.setBool(Setting::GnssQuietForLora, line.endsWith("on"));
        console.printf("gnss quiet: %s\n", line.endsWith("on") ? "GNSS pauses while the LoRa radio listens" : "GNSS stays on");
    }
@@ -16,7 +16,7 @@ namespace roro {

 // The GNSS receiver on the Cap LoRa-1262 (see CONTEXT.md and docs/milestones/M2.md): reads its
 // NMEA from the main loop's tick (about 450 bytes/s, so a 512-byte UART buffer covers a second),
-// holds the current Fix, and sets the clock from it. Settings → GNSS switches it on and off.
+// holds the current Fix, and sets the clock from it. Settings → GNSS and radio → GNSS switches it on and off.
 class GnssService : public Service {
   public:
    static constexpr int kRxPin = 15, kTxPin = 13;  // measured: M2 step 1
@@ -284,7 +284,7 @@ void UpdateService::serve() {
            if (r == Request::BackgroundCheck && gitea_.latest(latest) &&
                release::shouldAnnounce(latest, runningVersion(), failedVersion(), announced_)) {
                announced_ = latest.tag;
-                notify(latest.tag + " is out: see Settings > Firmware", NotificationLevel::Info);  // 48 bytes at most
+                notify(latest.tag + " is out: Settings > System > Firmware", NotificationLevel::Info);  // 48 bytes at most
            }
            break;
        }
@@ -12,10 +12,10 @@ struct Fixture {
    Settings settings{store, bus};
    SettingsMenu menu{settings};
    Fixture() { settings.load(); }
+    // Opens the group the row is in: the index is into that group.
    int row(SettingsMenu::Row r) {
-        for (int i = 0; i < menu.count(); i++)
-            if (menu.row(i) == r) return i;
-        return -1;
+        int i = -1;
+        return menu.reveal(r, i) ? i : -1;
    }
 };

@@ -28,6 +28,53 @@ void test_every_row_has_a_label() {
    for (int i = 0; i < f.menu.count(); i++) TEST_ASSERT_FALSE(f.menu.label(i).empty());
 }

+void test_the_groups_are_listed_first() {
+    Fixture f;
+    TEST_ASSERT_FALSE(f.menu.inGroup());
+    TEST_ASSERT_EQUAL(5, f.menu.count());
+    for (int i = 0; i < f.menu.count(); i++)
+        TEST_ASSERT_EQUAL(static_cast<int>(SettingsMenu::Kind::Group), static_cast<int>(f.menu.kind(i)));
+    TEST_ASSERT_EQUAL_STRING("This device", f.menu.label(0).c_str());
+    TEST_ASSERT_EQUAL_STRING("Display", f.menu.label(1).c_str());
+    TEST_ASSERT_FALSE(f.menu.close());  // nothing to close: Back leaves Settings
+}
+
+void test_a_group_opens_and_closes() {
+    Fixture f;
+    TEST_ASSERT_TRUE(f.menu.open(1));
+    TEST_ASSERT_TRUE(f.menu.inGroup());
+    TEST_ASSERT_EQUAL_STRING("Display", f.menu.title().c_str());
+    TEST_ASSERT_EQUAL(6, f.menu.count());
+    TEST_ASSERT_EQUAL_STRING("Brightness", f.menu.label(0).c_str());
+    TEST_ASSERT_EQUAL_STRING("Launcher", f.menu.label(5).c_str());
+    TEST_ASSERT_FALSE(f.menu.open(0));  // a row of a group isn't a group
+    TEST_ASSERT_TRUE(f.menu.close());
+    TEST_ASSERT_EQUAL(1, f.menu.groupIndex());  // where the selection goes back to
+    TEST_ASSERT_EQUAL(5, f.menu.count());
+    TEST_ASSERT_FALSE(f.menu.open(5));
+}
+
+void test_every_setting_is_in_one_group() {
+    Fixture f;
+    int total = 0;
+    for (int g = 0; g < 5; g++) {
+        TEST_ASSERT_TRUE(f.menu.open(g));
+        TEST_ASSERT_TRUE(f.menu.count() > 0 && f.menu.count() <= 8);  // a title and 8 rows fit the screen
+        for (int i = 0; i < f.menu.count(); i++) {
+            TEST_ASSERT_FALSE(f.menu.label(i).empty());
+            TEST_ASSERT_NOT_EQUAL(static_cast<int>(SettingsMenu::Kind::Group), static_cast<int>(f.menu.kind(i)));
+        }
+        total += f.menu.count();
+        f.menu.close();
+    }
+    TEST_ASSERT_EQUAL(21, total);
+    int i = -1;
+    TEST_ASSERT_TRUE(f.menu.reveal(SettingsMenu::Row::Vpn, i));
+    TEST_ASSERT_EQUAL_STRING("Network", f.menu.title().c_str());
+    TEST_ASSERT_EQUAL_STRING("VPN", f.menu.label(i).c_str());
+    TEST_ASSERT_FALSE(f.menu.reveal(SettingsMenu::Row::GroupDisplay, i));
+}
+
 void test_values_are_human_readable() {
    Fixture f;
    TEST_ASSERT_EQUAL_STRING("60%", f.menu.value(f.row(SettingsMenu::Row::Brightness)).c_str());
@@ -183,6 +230,9 @@ void test_gnss_and_coordinate_rows_toggle() {
 int main() {
    UNITY_BEGIN();
    RUN_TEST(test_every_row_has_a_label);
+    RUN_TEST(test_the_groups_are_listed_first);
+    RUN_TEST(test_a_group_opens_and_closes);
+    RUN_TEST(test_every_setting_is_in_one_group);
    RUN_TEST(test_values_are_human_readable);
    RUN_TEST(test_toggle_rows_flip_on_select);
    RUN_TEST(test_the_launcher_is_a_grid_or_a_list);