Site: security.txt, robots.txt, and favicon fallbacks (ICO, touch icon)

security.txt (RFC 9116) under .well-known with the mailbox as contact and an expiry in September 2027. robots.txt allows everything and points to the sitemap. The pixel 9 gets a favicon.ico (32 and 48 px) and an apple-touch-icon.png, drawn by tools/make_favicons.py from the same rectangles as favicon.svg. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT
Merge pull request 'Site: roro9stack.net phase 1 (home, Install with a browser flasher, Downloads), and a CI split for site changes' (#61 ) from site into main
2026-10-06 20:12:54 +02:00 · 2026-10-06 16:33:07 +00:00 · 2026-10-06 18:31:57 +02:00 · 2026-10-06 18:20:18 +02:00 · 2026-10-06 18:20:18 +02:00 · 2026-10-06 18:20:18 +02:00
102 changed files with 5752 additions and 13 deletions
@@ -0,0 +1,114 @@
+# CI and releases (docs/milestones/R1.md).
+#   A push to main:    the host tests, with their coverage of lib/, and the README's badges
+#                      published to the branch `badges`.
+#   A pull request:    the same tests and coverage, then the release firmware and the Debug Build.
+#                      A branch's pushes run nothing by themselves: its pull request runs, once.
+#   A tag v*:          all of it, then a Gitea release with the signed Update File.
+#   Run by hand:       the release of a tag that exists already (the ones from before CI).
+#
+# The job runs in a plain Python image, as scripts/ci.sh does on a developer's machine, with the
+# toolchains in a Docker volume the runner allows (container.valid_volumes: roro9stack-pio): that
+# volume is the cache. No JavaScript actions, so the image needs no Node: the checkout is git.
+name: CI
+on:
+  push:
+    branches: [main]  # other branches are tested by their pull request: one run, not two
+    tags: ['v*']
+    # A change that touches nothing but the site and the documents it is built from runs the Site
+    # workflow only (a tag always runs this one: Gitea doesn't apply path filters to tags).
+    paths-ignore: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md']
+  pull_request:
+    paths-ignore: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: An existing tag to build and publish as a release
+        required: true
+
+jobs:
+  build:
+    runs-on: ubuntu
+    # A pull request from a fork would run someone else's code on our runner: not without us (Q154).
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    container:
+      image: python:3.12-slim
+      volumes:
+        - roro9stack-pio:/pio
+    env:
+      PLATFORMIO_CORE_DIR: /pio
+      RORO_NO_DOCKER: 1
+    steps:
+      - name: Tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq --no-install-recommends git build-essential openssl >/dev/null
+          pip install -q --no-cache-dir --root-user-action=ignore platformio gcovr
+          pio --version; df -h /pio | tail -1; ls /pio | head
+
+      - name: Check out
+        run: |
+          find . -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git fetch -q --tags origin '+refs/heads/*:refs/remotes/origin/*' '+refs/pull/*/head:refs/remotes/pull/*'
+          git checkout -q --detach "${{ github.sha }}"
+          git describe --tags --always
+
+      - name: Host tests, and their coverage of lib/
+        if: github.event_name != 'workflow_dispatch'
+        run: scripts/coverage.sh
+
+      - name: The release firmware and the Debug Build
+        if: github.event_name == 'pull_request' || github.ref_type == 'tag'
+        run: scripts/ci.sh builds
+
+      # The README's badges are files on a branch of their own, replaced at each push to main and
+      # at each tag (the release badge says which tag is the latest)
+      - name: Publish the badges
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref_type == 'tag')
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          rm -rf /tmp/badges && mkdir /tmp/badges
+          cp .pio/coverage/coverage.svg .pio/coverage/summary.json /tmp/badges/
+          scripts/coverage_badge.py --plain release "$(git describe --tags --abbrev=0)" /tmp/badges/release.svg
+          cd /tmp/badges
+          git init -q -b badges .
+          git add .
+          git -c user.name="roro9stack CI" -c user.email="ci@git.twis.la" commit -q -m "Coverage of ${{ github.ref_name }} at ${{ github.sha }}"
+          git push -q --force "$(echo "${{ github.server_url }}" | sed "s#://#://ci:${GITEA_TOKEN}@#")/${{ github.repository }}.git" badges
+
+      - name: Which release
+        id: release
+        run: |
+          if [ "${{ github.event_name }}" = workflow_dispatch ]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          elif [ "${{ github.ref_type }}" = tag ]; then
+            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and sign the release
+        if: steps.release.outputs.tag != ''
+        env:
+          OTA_SIGNING_KEY: ${{ secrets.OTA_SIGNING_KEY }}
+        run: |
+          # The sources of the tag in a clone of their own; the tools are this commit's.
+          rm -rf /tmp/release-src dist
+          git clone -q . /tmp/release-src
+          git -C /tmp/release-src checkout -q --detach "refs/tags/${{ steps.release.outputs.tag }}"
+          # The key exists as a file only while this step runs, in a container that goes with the job.
+          umask 077
+          export RORO_OTA_KEY="$(mktemp)"
+          trap 'rm -f "$RORO_OTA_KEY"' EXIT
+          printf '%s\n' "$OTA_SIGNING_KEY" > "$RORO_OTA_KEY"
+          umask 022
+          scripts/release_build.sh /tmp/release-src dist
+
+      - name: Publish the release
+        if: steps.release.outputs.tag != ''
+        env:
+          GITEA_API: ${{ github.server_url }}/api/v1
+          GITEA_REPO: ${{ github.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: scripts/release_publish.py dist
@@ -0,0 +1,49 @@
+# The project site (docs/milestones/W1.md): built with Zola to see that it builds and that its pages
+# are sound. Publishing is the maintainer's: the web server pulls main and runs `zola build`.
+#
+# It runs when the site, or a document the site is built from, changes (a pull request, or a push to
+# main); the firmware workflow (ci.yml) skips a change that touches only these files. A change that
+# touches both runs both.
+name: Site
+on:
+  push:
+    branches: [main]
+    paths: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md', '.gitea/workflows/site.yml']
+  pull_request:
+    paths: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md', '.gitea/workflows/site.yml']
+
+jobs:
+  build:
+    runs-on: ubuntu
+    # A pull request from a fork would run someone else's code on our runner: not without us.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    container:
+      image: python:3.12-slim
+    steps:
+      - name: Tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq --no-install-recommends git ca-certificates curl >/dev/null
+          # Zola, pinned by its checksum.
+          curl -fsSL -o /tmp/zola.tgz https://github.com/getzola/zola/releases/download/v0.22.0/zola-v0.22.0-x86_64-unknown-linux-gnu.tar.gz
+          echo "f1d491f8956b94384c27d75cb6b2bf60d3916d1ade9564bcbfe7c03f0258aebf  /tmp/zola.tgz" | sha256sum -c -
+          tar xzf /tmp/zola.tgz -C /usr/local/bin zola
+          zola --version
+
+      - name: Check out
+        run: |
+          find . -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git fetch -q origin '+refs/heads/*:refs/remotes/origin/*' '+refs/pull/*/head:refs/remotes/pull/*'
+          git checkout -q --detach "${{ github.sha }}"
+
+      - name: Build the site
+        run: |
+          cd site
+          zola check --skip-external-links
+          zola build --output-dir /tmp/site-out
+
+      - name: Check the pages
+        run: python3 site/tools/check_site.py /tmp/site-out
@@ -9,3 +9,6 @@
 .dummy/
 managed_components/
 sdkconfig.*
+
+# The built site (site/config.toml sends it here)
+/public/
@@ -141,7 +141,10 @@ The part of the Storage App that deletes in bulk: the card's usage, Storage Clea
 _Avoid_: Settings > Storage

 **Firmware Update**:
-Installing a new firmware image without a USB cable: pushed over Wi-Fi from the developer's PC, or read from the SD card.
+Installing a new firmware image without a USB cable: pushed over Wi-Fi from the developer's PC, read from the SD card, or downloaded from the project's Gitea **Release**.
+
+**Release**:
+A tag `v*` on the project's Gitea with a signed **Update File**, a factory image for USB, the ELF to decode crashes and checksums, built and published by CI. The device reads them to look for updates. Debug Builds aren't published.
 _Avoid_: flash, upgrade (alone)

 **Update File**:
@@ -1,5 +1,7 @@
 # roro9stack

+[![CI](https://git.twis.la/twisla/roro9stack/actions/workflows/ci.yml/badge.svg?branch=main)](https://git.twis.la/twisla/roro9stack/actions?workflow=ci.yml) [![Coverage of lib/ by the host tests](https://git.twis.la/twisla/roro9stack/raw/branch/badges/coverage.svg)](#build-and-test-local-ci) [![Latest release](https://git.twis.la/twisla/roro9stack/raw/branch/badges/release.svg)](https://git.twis.la/twisla/roro9stack/releases/latest)
+
 A multi-app firmware for the **M5Stack Cardputer ADV** with the **Cap LoRa-1262**. It's a Meshtastic-compatible mesh messenger, plus Wi-Fi tools, IRC, GNSS and more. Licensed GPL-3.0.

 - Domain language: [CONTEXT.md](CONTEXT.md)
@@ -18,8 +20,27 @@ scripts/ci.sh

 This runs the host-side unit tests (`test/`, `native` environment), then builds the firmware. The output is `.pio/build/cardputer-adv/firmware.factory.bin`.

+`scripts/coverage.sh` runs the same tests with coverage counters and writes a line-by-line report to `.pio/coverage/index.html`. The badge above is its figure for `main`: the share of the lines of `lib/` that the host tests run. `lib/` is the logic that compiles on a PC; `lib/SD` (the card's driver) and `src/` (the Apps, the Services, everything that needs the device) have no host tests and aren't in that figure.
+
 The framework is rebuilt with the TLS settings in `platformio.ini` (`custom_sdkconfig`, ADR 0006), so the first build after a fresh checkout takes about 4 minutes; later builds take under a minute.

+## CI and releases
+
+Gitea Actions (`.gitea/workflows/ci.yml`, docs/milestones/R1.md) runs the host tests on every push to `main`, and on a pull request also builds the release firmware and the Debug Build: changes reach `main` through pull requests. Pushing a tag `v*` runs all of it and publishes a release on Gitea with:
+
+- `roro9stack-<version>.ota`, the signed Update File;
+- `roro9stack-<version>-factory.bin`, the whole flash image for a first install over USB;
+- `roro9stack-<version>.elf.gz`, to decode crash reports from that build;
+- `SHA256SUMS`.
+
+CI signs with the project's key, held as a repository secret (ADR 0008). Debug Builds are built but never published: each carries its builder's Debug Console token.
+
+`scripts/ota_verify.py <file.ota>` checks an Update File on a PC the way a device does. `scripts/release_build.sh` and `scripts/release_publish.py` are what the workflow runs; they work the same by hand.
+
+## The website
+
+The project's site, **roro9stack.net**, is built from `site/` with Zola (see `site/README.md`): the home page, an Install page that flashes a Cardputer from the browser, and every release. Changes under `site/`, `docs/`, `README.md` and `CONTEXT.md` run only the site's CI job, not the firmware tests and builds.
+
 ## Flash

 1. Connect the Cardputer by USB-C.
@@ -52,7 +73,21 @@ The device shows the push address in **Settings → Firmware**. It installs a co

 To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).

-**The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB.
+**The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB. (CI signs releases with a copy kept as a repository secret, ADR 0008.)
+
+### Updates from Gitea
+
+With no PC and no card, the device can install the project's releases itself (docs/milestones/R1.md). In **Settings → Firmware**:
+
+- **Latest release** checks the server (Enter, or `c`) and says `v0.11.0 (new)` or `(current)`. Enter again opens the release: its version, date, size and the tag's message, with **Install** when it's newer. The download goes straight into the inactive slot, so no card is needed; the signature is checked after the first 160 bytes, before anything is written, and the image's hash at the end. The new firmware then runs on Probation as for any update.
+- **Older releases** lists the last ten, newest first. Opening an older one offers to go back to it, with a different question.
+- **Settings → Check for updates** (on by default): once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > Firmware`, once per version. It installs nothing by itself, and doesn't announce a version that already failed and rolled back on this device.
+
+The connection is checked against the two ISRG roots Let's Encrypt chains end in (ADR 0009), not the usual bundle of about 130 authorities. Whatever the connection, the Update File's own signature is what decides what gets installed.
+
+**IRC steps aside.** A secure connection takes about 52 KB of memory at its peak, and IRC's own takes 40 KB of the 107 KB there is. A check or an install you ask for makes IRC disconnect for the few seconds it takes and reconnect afterwards. The daily check never does that: with IRC connected it waits for a moment when IRC isn't, so while IRC stays connected for days it doesn't run, and **Latest release** is the way to check.
+
+**A Debug Build** shows the latest release but doesn't install it: releases have no Debug Console (they aren't built with one, so that nobody's console token is published), and installing one would take it away. A Debug Build is updated from the PC with `scripts/flash.sh --debug --ota`.

 ## Networks without DHCP

@@ -150,6 +185,8 @@ A note holds up to 16 KB while it's edited. A bigger text file opens read-only i
 | `ls [folder]` / `du <path>` | Lists a folder of the SD card with sizes and dates, or counts the files and bytes under a path |
 | `cp [-f] <from> <to>` / `mv [-f] <from> <to>` / `rm <path>` / `mkdir <path>` / `cancel` | What the Storage App does, with its rules: copy (folders too), move or rename, delete (a folder with what's in it), new folder. `-f` replaces a file that's in the way; a tab separates paths that hold spaces; `cancel` stops a copy or a delete |
 | `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
+| `update check` / `update list` / `update status` / `update install <tag>` | The project's releases on Gitea: look at the latest, list the last ten, say what's known, or download and install one (not on a Debug Build) |
+| `update pretend <version>` / `update probe <host>` / `update damage cut\|flip <n>` / `update daily` | Debug Builds: pretend to run another version (so a release counts as an update), see whether a server's certificate is accepted, cut or damage the next download, run the daily check again |
 | `lora probe` | Finds the radio: chip, oscillator, antenna switch, DIO1 interrupt, noise floor |
 | `lora status` | Radio settings, who's listening, packet and error counters, noise floor, task stack |
 | `lora rx on` / `lora rx off` | Listens and prints each packet on the console |
@@ -5,7 +5,7 @@ RUN apt-get update \
 && apt-get install -y --no-install-recommends git build-essential \
 && rm -rf /var/lib/apt/lists/*

-RUN pip install --no-cache-dir platformio
+RUN pip install --no-cache-dir platformio gcovr

 # Toolchains and libraries are cached in a named volume mounted here.
 RUN mkdir -p /pio && chmod 777 /pio
@@ -0,0 +1,17 @@
+# CI signs releases with the project's key
+
+A tag `v*` is built, signed and published by Gitea Actions with nobody at a keyboard. The signing key of ADR 0003 is therefore held twice: in `~/.config/roro9stack/ota-key.pem` on the development machine, as before, and as the repository secret `OTA_SIGNING_KEY`, which the release step writes to a file for as long as it runs.
+
+We chose this over signing by hand after CI has built (a command per release, the key in one place), and over a second key for CI that the firmware would also trust. A release that needs a manual step isn't made on the day it's ready, and issue #6, the device installing releases by itself, needs releases that are always there and always signed.
+
+## What it costs
+
+- **Whoever can run a workflow in this repository can sign firmware every device accepts.** That means: anyone who can push to it, the runner's host and whoever administers it, and the Gitea instance with its database, where the secret is stored. Before, it took the development machine.
+- The runner executes jobs **on its own host**, not in a container, as a user who can use Docker. A workflow is not confined.
+- Pull requests from forks must never run with this secret. Gitea doesn't pass secrets to them; the workflow also only runs on pushes and by hand.
+
+## What limits it
+
+- The release step checks the signed file against the public key in the sources it built (`scripts/ota_verify.py`): a wrong or replaced secret stops the release instead of publishing a file no device takes.
+- ADR 0003's way out stays: a firmware release can carry a new public key. If the secret is ever in doubt, make a new pair, ship it in a release signed with the old key, and replace the secret.
+- A device still only installs what it's told to (until #6), keeps a new image on Probation, and rolls back one that doesn't hold.
@@ -0,0 +1,22 @@
+# The device trusts the two ISRG roots for what it fetches
+
+The firmware talks to the project's Gitea over HTTPS (issue #6, and #4 after it). A TLS client has to decide whose certificates it believes. Three ways were possible:
+
+- **The framework's bundle**, about 130 certificate authorities (about 60 KB of flash). Any of them could vouch for `git.twis.la`.
+- **Pin the server's certificate**, as the Gemini App does for capsules. The server's certificate is replaced every few months, so a pin would ask the question again at every renewal.
+- **Carry the roots the server's chain ends in:** `ISRG Root X1` (RSA 4096) and `ISRG Root X2` (ECDSA P-384), the Let's Encrypt roots, about 2.7 KB of flash (`src/platform/ca_roots.h`).
+
+We chose the third. The chain and the name are checked by mbedTLS during the handshake. It trusts one organisation's two roots, valid until 2035 and 2040, and a renewal changes nothing.
+
+## What it costs
+
+- **If the server moves to another CA, the device can no longer reach it**, and the next firmware, carrying that CA's root, has to come from the PC or the SD card. Both still work; they don't use TLS.
+- The roots are public data checked against the published fingerprints (listed in the file), refreshed by hand if Let's Encrypt ever changes them.
+
+## What it doesn't change
+
+The Update File's own signature (ADR 0003) is what decides what gets installed. A hijacked connection could hide a release, or serve an older signed one, but never make the device install firmware that isn't ours. The TLS check matters more for #4, where a token will travel over it.
+
+## Measured while building it
+
+A TLS connection to this server peaks at about 52 KB of heap, **the same whether the certificate is checked or not**, so skipping the check would have saved nothing. The cost is the connection itself (record buffers and handshake), not the trust decision.
@@ -0,0 +1,125 @@
+# R1 — Releases
+
+**Status:** in progress. CI and signed releases on Gitea (issue #5) are in place since 2026-10-06: every tag from v0.1.0 to v0.10.0 has its release. Updates from Gitea (issue #6) is built and checked on the device, on branch `gitea-updates`, not merged yet. The Issues App (#4) comes after.
+
+**Goal:** a tag is a release, built the same way every time and published where a device can find it.
+
+## CI and releases (issue #5)
+
+Until now the tests, the builds, the signing and the flashing all happened on one machine, through `scripts/ci.sh` and `scripts/flash.sh`. Nothing was published.
+
+### Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q151 | A push to `main`: the host tests (with their coverage). A push to another branch: nothing, its pull request is what runs (a branch with an open pull request ran twice, once for each). A pull request: the same and both builds; changes reach `main` through pull requests. A tag `v*`: all of it, then a release. (First: everything on every push, which rebuilt the firmware far more often than anyone looked at it.) |
+| Q152 | **CI signs.** The signing key is the repository secret `OTA_SIGNING_KEY`; a tag push makes a complete, signed release with no manual step (ADR 0008). |
+| Q153 | The Debug Build is built in CI with a token of the runner's own, to prove it compiles, and **isn't published**: it would hand everyone its Debug Console token. |
+| Q154 | Pull requests from forks don't start a run. |
+| Q155 | A release carries `roro9stack-<version>.ota` (signed), `-factory.bin` for USB, `.elf.gz` to decode crashes, and `SHA256SUMS`. |
+| Q156 | Its text is the tag's message, what the files are, and the commits since the tag before. |
+| Q157 | No cache service to begin with: measure first. |
+| Q158 | Reproducible builds aren't needed for signing any more (Q152); not pursued here. |
+| Q159 | **The tags from before CI get their releases too**, v0.1.0 to v0.10.0, built from each tag's own sources by running the workflow by hand. |
+| Q160 | Actions is switched on for the repository. |
+| Q161 | **Changes reach `main` through pull requests, merged as "rebase, then a merge commit"**, the only style the repository allows: the branch's commits keep their messages, the merge commit marks the pull request, and what CI tested is what lands. No squash, no fast-forward. |
+
+### As built
+
+- **One workflow, `.gitea/workflows/ci.yml`, one job**, on the runner `runner0` (label `ubuntu`). The job asks for a `python:3.12-slim` container, installs git, a compiler, openssl and PlatformIO, and runs the same scripts as a developer's machine. No Docker inside the job.
+- **The cache is a Docker volume**, `roro9stack-pio`, mounted at `/pio`; the runner's `config.yaml` allows it under `container.valid_volumes`. A first run downloads about 1 GB and rebuilds the framework. Measured from the jobs' own start and end times: the first full run on an empty cache took 11.4 minutes (tests and both builds); the first run in a container, 8.1; a pull request now takes about 8.7 (tests, coverage and both builds), a release build alone 5.5, and a push to `main` (tests and coverage) 1.1. (An earlier version of this note said 17 minutes: that was the waiting time, not the job's.)
+- **No JavaScript actions**, so the image needs no Node and nothing is fetched from GitHub: the checkout is four git commands.
+- **`scripts/_docker.sh`** runs the command in place when `RORO_NO_DOCKER` is set (a CI job is already in a build container), and in the project's image otherwise. The Debug Build's token is made on the spot in CI and goes with the container.
+- **`scripts/release_build.sh <checkout> <out>`** builds a tag's own sources with today's tools, signs, verifies against the public key in those sources, and writes the files and the release's text. **`scripts/release_publish.py`** creates the Gitea release or completes it; run twice, it replaces what's there. Both run the same on a developer's machine.
+- **`scripts/ota_verify.py`** checks an Update File as a device does, on a PC.
+- **The job's own token** (`secrets.GITEA_TOKEN`) is enough to create a release and upload its files.
+- **Old tags.** v0.1.0 to v0.3.0 are from before the framework was rebuilt with our settings (ADR 0006) and can't link against a rebuilt one left in the cache: the release build puts the stock framework libraries back for them. v0.1.0 to v0.2.1 have no public key in their sources (Firmware Updates came with v0.3.0); their files are checked against today's.
+
+### How it went
+
+- **The runner's label took three tries.** Registered as `ubuntu://docker:ubuntu:resolute` and then as `ubuntu::docker://...`, Gitea took the whole string for the label's name; with the first, jobs ran on the runner's host itself. The first version of the workflow was written for that (plain shell, `docker run` for the build) and published v0.10.0 that way. `ubuntu:docker://docker.gitea.com/runner-images:ubuntu-latest` is the form that works.
+- **Gitea 1.27's API can't cancel a run that isn't finished**, only delete a finished one; switching Actions off and on for the repository doesn't either. Runs queued for a label that no longer exists stay queued until cancelled in the web UI.
+- **CI's image isn't byte-identical to a local build of the same tag** (same size, different bytes). Not pursued (Q158).
+
+## Updates from Gitea (issue #6)
+
+The device looks at the project's Gitea for a newer release, says so, and installs it on request, with the same signed Update Files, Probation and rollback as a push from the PC or an install from the card.
+
+### What the server gives (checked 2026-10-06)
+
+- **Its certificate** is Let's Encrypt, all ECDSA: leaf `git.twis.la` (renewed every few months, next expiry 2026-12-14) under the intermediate YE2, Root YE and ISRG Root X2, which X1 cross-signs. Pinning the leaf would ask a question at every renewal.
+- **The API** answers over HTTP/1.1, chunked: `releases/latest` is 3.2 KB (about 350 bytes of it matter), a list of ten releases is 33 KB.
+- **A download** is a direct 200 with `Content-Length` and no redirect; ranges work.
+
+### Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q162 | **Trust:** the firmware carries ISRG Root X1 and X2 and checks the server's chain and name against them, not the framework's bundle of about 130 CAs (ADR 0009). Shared with #4. If the server moves to another CA, the next firmware comes from the PC. |
+| Q163 | The Update File's own signature stays the real guard. A hijacked connection could hide a release or offer an older signed one, never install firmware that isn't ours. |
+| Q164 | The source, `git.twis.la` and `twisla/roro9stack`, is a constant in the firmware. A fork changes it, and has its own key. |
+| Q165 | **When:** on request in Settings > Firmware, and once a day in the background while Wi-Fi is up and the Clock is set (certificate dates need it). A setting, **Check for updates**, on by default. It installs nothing by itself; it skips quietly below the memory floor and never runs during an install. |
+| Q166 | A Toast, "Update v0.11.0 available: see Settings > Firmware", once per version per boot. |
+| Q167 | **The download goes straight into the inactive slot,** no card needed. A truncated or tampered file is refused after 160 bytes or at its end, and the running firmware is untouched. A failed download starts over. |
+| Q168 | A version that failed (rolled back) isn't announced again by the background check until a newer one exists; it can still be installed by hand. |
+| Q169 | **Older releases:** a list of the last ten, newest first, the running one marked. Installing an older one asks with a stronger warning. |
+| Q170 | Enter on a release shows its version, date, size and the tag message, with Install. |
+| Q171 | **Debug Builds** check and show the latest release, but don't install it: it would replace the Debug Build and its console (Q153: Debug Builds aren't published). Their updates come from the PC. |
+| Q172 | **Memory, as measured:** a TLS connection peaks at about 52 KB of heap, with or without checking the certificate, so it starts with 80 KB free (Q86's 20 KB spare on top), not 55 KB. **A check, list or install someone asked for makes IRC step aside** and come back after; the daily check never does, and with IRC connected it waits. (First: 55 KB and nothing else. With IRC connected a check left 3 KB and a download 836 bytes.) |
+| Q173 | Left out, each with its issue: installing automatically (#52), a release channel (#53), resuming a download (#54). |
+| Q174 | Ships as **v0.11.0**. Tested on the device with the real signed releases; a Debug Build command pretends the device runs an older version, so v0.10.0 counts as an update. |
+
+### Done when
+
+- A check, by hand or daily, tells the right thing: up to date, newer available, no network, bad certificate, no clock, too little memory.
+- A newer release installs from the Firmware page with no card and no PC, and the device restarts into it and confirms it.
+- A tampered or truncated download is refused and the running firmware keeps running.
+- The Older releases list shows ten, and installing one asks first.
+- A release that rolled back isn't announced again.
+- A Debug Build shows the latest release and doesn't install it.
+- The daily check never runs below the memory floor, during an install, or without a clock.
+
+### Work breakdown
+
+1. **Model** (host-tested): a streaming JSON scanner, the release list read from it, HTTP response heads and chunked bodies, URLs, which release counts as an update.
+2. **The connection:** the root certificates, an HTTPS client, a check and a list from the Update Service's task; console commands to try them.
+3. **The download:** an HTTPS source for the existing install path.
+4. **The screens:** the Firmware page's release rows, the release page, Older releases, the setting, the daily check and its Toast.
+5. **Checks on the device**, recorded here.
+
+### As built
+
+- **`lib/release`** (host-tested): a streaming JSON scanner, the release reader built on it, HTTP heads and chunked bodies, URLs, and the decisions (which release is an update, whether to announce it, which download URLs are taken). A list of ten releases is 33 KB of JSON and costs a few hundred bytes of memory, because nothing is kept but the path.
+- **`HttpsGet`** (`src/platform`): one GET, the answer read as a stream, redirects not followed. **`GiteaReleases`** keeps the latest and the list. **The Update Service** serves the requests on its own task (about 5.4 KB of its 7 KB stack at the peak) and installs through the install path that already existed, with an HTTPS source in place of the card or the TCP port.
+- **The daily check** is scheduled from the Update Service's tick: Wi-Fi up, the Clock set, no Probation, nothing else going on, memory for a connection. The day it last succeeded is kept in flash.
+- **A version that failed** (rolled back) is remembered as `ota_failed`, and isn't announced again by the daily check.
+- **The screens:** the Firmware page's Latest release and Older releases rows, a release page with the tag's message, and the install dialog.
+- **Debug Builds** get knobs to try what can't be tried otherwise: `update pretend`, `probe`, `damage` and `daily`.
+- **The first message,** `... available: see Settings > Firmware`, was cut at 48 bytes by the notification's own limit; it now reads `v0.11.0 is out: see Settings > Firmware`.
+
+### Checks on the device (2026-10-06, Debug Builds of branch `gitea-updates`)
+
+| Check | Result |
+|---|---|
+| Host tests | 456 pass |
+| Check and list against the live server | The certificate is accepted against the two embedded roots; `releases/latest` read; a list of ten (33 KB) streamed |
+| Servers that must be refused | github.com, example.com, expired.badssl.com, self-signed.badssl.com, wrong.host.badssl.com, untrusted-root.badssl.com and the router: each "isn't accepted" or a TLS error |
+| A download cut short at 800,000 bytes | Refused, "update file too short"; the running firmware untouched |
+| One byte flipped in the signature | Refused after 160 bytes, "bad signature"; the image isn't read further |
+| One byte flipped in the image | Downloaded in full, refused at its end, "image corrupted (hash mismatch)" |
+| The real v0.10.0, from the console and then from the screen | Downloaded, restarted, confirmed on Probation: the slot table read `v0.10.0, valid` both times. The Debug Build was pushed back from the PC after each |
+| The screens | Latest release (checking, then `(current)` or `(new)`), the release page with the tag's message, Older releases with ten rows, the install dialog (Cancel by default, Back cancels), the progress screen at 28% |
+| IRC connected, before the hold | A check left 3 KB of heap; a full download, 836 bytes |
+| IRC connected, with the hold | The lowest free heap during a full download: 38 KB. IRC reconnected afterwards (its counters kept growing) |
+| The daily check | It ran by itself, announced `v0.10.0 is out: see Settings > Firmware` once; with IRC connected (68 KB free) it didn't run |
+| Speed | 1.9 MB in about 46 s, 40 KB/s, over the guest Wi-Fi at -65 dBm; not investigated further |
+
+**Not checked:** the certificate's **name** on its own. Connecting by IP makes the server end the handshake before it shows its certificate, so that test proved nothing; the library sets the name it verifies, and OpenSSL on the PC refused the wrong name against the same chain. A failed daily check retrying, the clock not being set, the release that failed before not being announced (host-tested, not on the device), and the hold when IRC isn't connected but Gemini holds memory.
+
+**Limits worth knowing:**
+- **With IRC connected for days, the daily check doesn't run.** It would have to take IRC down to make room. Opening Latest release does.
+- **A server that changes CA can't be reached** until a firmware carrying the new root comes from the PC (ADR 0009).
+- **No resuming:** a broken download starts over (#54).
+- **A key press during the hold:** Back on the Firmware page while a check is going doesn't cancel it.
+
+**Two slips during the checks:** a blind sequence of keys on the Firmware page opened the SD card's install dialog (the page keeps its selection between visits); it was cancelled with Back, nothing installed. And my port-polling while waiting for a restart took the Debug Console's only client slot, which made the first install attempt look like a failure.
@@ -0,0 +1,94 @@
+# W1: Website
+
+**Status:** phase 1 is built and checked in a browser (branch `site`, pull request to follow); the Install page works against the real server once Caddy allows the origin (below). Issue #12.
+
+**Goal:** a public home for the project at **roro9stack.net**, separate from the blog (stories) and from Gitea (developers): what it is, how to install it, how to use each App, and the docs.
+
+The home page was designed on a canvas in a Claude chat (a dark and a light theme, built on the device's own 256-colour palette, pixel-notched corners, DM Mono and Hanken Grotesk). It is the starting point, not the final copy: it has to say only what the firmware does today.
+
+## What was found while planning (2026-10-06)
+
+- `roro9stack.net` already points at the server that hosts Gitea. Plain HTTP redirects to HTTPS; HTTPS has no certificate yet, which is the server's side to set up.
+- **Release downloads from Gitea carry no CORS header,** so a browser can't fetch the factory image from another origin as things are. Gitea is behind Caddy, which can add the header (below).
+- Zola can read JSON from a URL at build time (`load_data`), so the home page's "latest version" can come from the Gitea API.
+- There is no Gitea wiki: the design's "Wiki" links would 404.
+- The blog is published by pulling its repository on the web server and running `zola build`. The site does the same.
+
+## Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q175 | The site lives in this repository, in `site/`, so the documentation is built from `docs/`, `CONTEXT.md` and the README instead of being copied. |
+| Q176 | **Zola,** like the blog. The design becomes a template, its tokens CSS custom properties. Dark and light follow the visitor's setting, with a visible switch. No JavaScript except the flasher's. |
+| Q177 | Domain: **roro9stack.net.** The blog stays at experiments.twis.la. |
+| Q178 | **Publishing is the blog's way:** the web server pulls `main` and runs `zola build`; that part is the maintainer's. Changes reach `main` through pull requests as everywhere. **CI is split:** a dedicated `site` job builds the site (`zola build`) when `site/`, `docs/`, `README.md` or `CONTEXT.md` change, and the firmware tests and builds skip a change that touches nothing else. A change that touches both runs both. |
+| Q179 | Phases, each its own pull request: **1.** the CI split, the home page, an Install page with the browser flasher, downloads and the changelog. **2.** a user guide page per App. **3.** how-tos and the FAQ. **4.** developer docs generated from the repository. |
+| Q180 | **A browser flasher** (ESP Web Tools), **without copying the firmware.** Caddy, in front of Gitea, adds `Access-Control-Allow-Origin: https://roro9stack.net` (and `Vary: Origin`) to GET and HEAD on `/twisla/roro9stack/releases/download/*` and `/api/v1/repos/twisla/roro9stack/releases*`: both are public already. The Install page asks the API for the latest release in the browser, finds the asset ending `-factory.bin`, and gives ESP Web Tools a manifest built on the spot, so it offers a new release as soon as it exists, with no rebuild. The library is **vendored** into `site/static/` (Apache-2.0), not loaded from a CDN. The file's SHA-256 is shown on the page. Chrome or Edge on a desktop only; other browsers, and visitors without JavaScript, get the `esptool` steps on the same page. |
+| Q181 | Docs for the latest version only. The changelog is the Gitea releases, read at build time. |
+| Q182 | English only. |
+| Q183 | The FAQ starts from real questions: the README, and issues labelled `kind/docs`. |
+| Q184 | Fonts are **self-hosted** (no request to a third party). The hero keeps the design's illustrations, labelled as illustrations, and a section of **real device screenshots** is added. |
+| Q185 | **The site says only what the firmware does today.** Planned features are marked as planned, with their milestone. The mesh messenger is **planned**: the LoRa Scanner listens, nothing is sent. |
+| Q186 | Left out, each with its issue: a Gemini capsule mirror (#57), French (#58), docs per version (#59), search (#60). |
+| Q187 | The site has no version of its own. Contact is **contact@roro9stack.net,** and the issue tracker. |
+
+## The design, reviewed
+
+Kept as designed: the layout, the tokens, the nine App cards (their facts check out against the code: Probation 3 minutes, Safe Mode after 3 crashes, 60 seconds of typing before an update restarts the device).
+
+Changed before it ships:
+
+- **Install, not Download, is the first action.** Downloads are for developers; a visitor wants to try it.
+- **A "what you need" strip:** Cardputer ADV, the Cap LoRa-1262 (only the radio needs it), a microSD card, Wi-Fi. And a plain status line: the version, and what isn't there yet.
+- **The mesh card and the hero** no longer promise sending and reading mesh messages.
+- **The latest version is read from the API,** not typed.
+- **"Wiki" is replaced by Docs.** The updates section gains what v0.11.0 added: the device installs releases from the project's server itself.
+- **An independence line:** not affiliated with or endorsed by M5Stack or Meshtastic.
+- **No cookies, no analytics, no third-party requests,** said on the page (fonts self-hosted).
+- **The keyboard focus ring** is invisible on the notched buttons: `clip-path` clips an outline. Another way to show focus is needed.
+- **The wordmark SVGs** carry an embedded C2PA content-credentials block: stripped from the site's copies.
+
+## Done when (phase 1)
+
+- Pushing a change under `site/` runs the `site` job and not the firmware tests; a firmware change runs the firmware jobs and not the site's.
+- The home page renders in both themes, at phone width, with the keyboard, and says nothing the firmware doesn't do.
+- The latest version on the page is the latest release.
+- The browser flasher installs the latest release on a Cardputer ADV from Chrome (tried by hand), the page shows the file's SHA-256, and the `esptool` steps are on the same page.
+- A release published after the site was built is the one the Install page offers.
+- The home and Downloads pages make no request to another origin, and the Install page only asks git.twis.la.
+
+## Work breakdown
+
+1. **CI split:** a `site` workflow, path filters on the firmware workflow.
+2. **The skeleton:** `site/` with the tokens, fonts, base template and the theme switch.
+3. **The home page,** from the design, with the changes above.
+4. **Install and downloads:** the flasher with its manifest built in the page, the `esptool` steps, the changelog. Needs the Caddy headers on the Gitea host (the maintainer's side); the page is tested against them once they're in.
+5. **Checks,** recorded here.
+
+## As built (phase 1)
+
+- **CI is split.** `ci.yml` (the firmware) has `paths-ignore: site/**, docs/**, README.md, CONTEXT.md` on pushes to `main` and on pull requests. `site.yml` runs `zola check` and `zola build` with a Zola pinned by its checksum, then `site/tools/check_site.py`, when those files change. Gitea's own source (v1.24, read, not run against the 1.27 server) shows that path filters count as matched for tag pushes, so a tag still releases. A change that touches both runs both.
+- **The build output** goes to `public/` at the root of the repository, not into `site/`: `output_dir = "../public"` in `site/config.toml`, so `zola build` in `site/` and `zola --root site build` from the root agree, and git ignores `/public/`.
+- **The site** is in `site/`: `config.toml`, templates (base, home, install, downloads, 404), `data/` for the App cards and the screenshots' captions, `static/` (stylesheet, theme switch, fonts, wordmark, icons, real screenshots, the vendored flasher). `site/README.md` says how to build it and what the server needs.
+- **The home page** follows the design. Changed from it: the hero and the mesh card promise nothing that isn't built (the mesh messenger is a "planned" card), an Install button first, a status box, a "what you need" row, a section of real screenshots, the updates section says the device installs releases itself, an independence line and a statement about cookies and third-party requests in the footer, the latest version read from the Gitea API at build time, and the nav's Wiki replaced. The two hero drawings are generated by `site/tools/make_illustrations.py` (a port of the design's scripted shapes) as inline SVG.
+- **The focus ring.** `clip-path` clips outlines, so a focused notched control drops its notches and shows square corners and its ring.
+- **The Install page** asks the API for the latest release in the browser, builds the ESP Web Tools manifest as a blob, shows the version, size and SHA-256, and only ever hands the flasher a download from the project's own server for this repository. The flasher library (ESP Web Tools 10.4.0, Apache-2.0) is vendored, trimmed to the ESP32-S3. Fonts (DM Mono, Hanken Grotesk, SIL OFL) are self-hosted.
+- **The Downloads page** lists the last 30 releases with their files, read at build time.
+- **The wordmark SVGs** from the design carried an embedded C2PA content-credentials block; it is removed from the site's copies.
+
+## Checks (2026-10-06)
+
+| Check | Result |
+|---|---|
+| The Site workflow's own commands, in a clean container with the pinned Zola | `zola check` clean, build and page checks pass |
+| `tools/check_site.py` | 4 pages, 0 problems: titles, descriptions, a language, every image with alt text, every local file referenced exists, nothing loaded from another origin |
+| Browser tests (Chromium, 16 checks) | All pass: no request to another origin from the home, Downloads and 404 pages; no horizontal scroll at 1280 and 390 px; a visible focus ring on a notched button; the Install page reads the latest release, shows its version, size and SHA-256, builds a blob manifest naming an ESP32-S3 factory image at offset 0, and loads only git.twis.la; a download on another host is refused; the real server (no CORS header today) makes the page fall back to the esptool steps |
+| The pages looked at | Home in dark and light, at desktop and phone width; Install; Downloads |
+| `esptool` against the real v0.11.0 factory image | An ESP32-S3 image, bootloader at 0x0, partition table at 0x8000: flashing at offset 0 is right. The command's syntax was checked, not a flash |
+
+**Not checked:**
+- **Flashing a real Cardputer from Chrome.** It needs the device on a machine with a browser; the page's flasher logic is tested, the flashing itself isn't.
+- **Caddy's headers** on the real server (not applied yet), and **HTTPS on roro9stack.net** (the name resolves, the certificate isn't there).
+- **The CI split on a change that touches only `site/` or `docs/`.** This pull request touches both the workflows and the site, so it runs both; the first docs-only pull request will show it.
+- Firefox and Safari rendering, screen readers, and a printed page.
+- The unverified wording in the Install text is kept to what's known: nothing about how long flashing takes, or what the screen shows in download mode.
@@ -23,7 +23,7 @@ const RowDef kRows[] = {
    {Row::Gnss, Kind::Toggle, "GNSS"}, {Row::GnssQuiet, Kind::Toggle, "Pause GNSS for LoRa"},
    {Row::Coordinates, Kind::Toggle, "Coordinates"},
    {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}, {Row::Wifi, Kind::Page, "Wi-Fi"},
-    {Row::Firmware, Kind::Page, "Firmware"},
+    {Row::CheckUpdates, Kind::Toggle, "Check for updates"}, {Row::Firmware, Kind::Page, "Firmware"},
    {Row::About, Kind::Page, "About"},
 };

@@ -82,6 +82,7 @@ std::string SettingsMenu::value(int i) const {
        case Row::Sound: return settings_.getBool(Setting::Sound) ? "On" : "Off";
        case Row::Gnss: return settings_.getBool(Setting::GnssEnabled) ? "On" : "Off";
        case Row::GnssQuiet: return settings_.getBool(Setting::GnssQuietForLora) ? "On" : "Off";
+        case Row::CheckUpdates: return settings_.getBool(Setting::CheckUpdates) ? "Daily" : "Off";
        case Row::Coordinates: return settings_.getBool(Setting::CoordinatesDms) ? "Deg min sec" : "Decimal";
        case Row::ProbeMacs: return settings_.getBool(Setting::ProbeMacRaw) ? "Raw" : "Pseudonymised";
        case Row::Wifi: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
@@ -128,6 +129,7 @@ void SettingsMenu::toggle(int i) {
    if (row(i) == Row::Sound) settings_.setBool(Setting::Sound, !settings_.getBool(Setting::Sound));
    if (row(i) == Row::Gnss) settings_.setBool(Setting::GnssEnabled, !settings_.getBool(Setting::GnssEnabled));
    if (row(i) == Row::GnssQuiet) settings_.setBool(Setting::GnssQuietForLora, !settings_.getBool(Setting::GnssQuietForLora));
+    if (row(i) == Row::CheckUpdates) settings_.setBool(Setting::CheckUpdates, !settings_.getBool(Setting::CheckUpdates));
    if (row(i) == Row::Coordinates) settings_.setBool(Setting::CoordinatesDms, !settings_.getBool(Setting::CoordinatesDms));
    if (row(i) == Row::ProbeMacs) settings_.setBool(Setting::ProbeMacRaw, !settings_.getBool(Setting::ProbeMacRaw));
 }
@@ -11,7 +11,7 @@ namespace roro {
 // values, choice lists and validation messages. Rendering and navigation live in the App.
 class SettingsMenu {
   public:
-    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, Gnss, GnssQuiet, Coordinates, ProbeMacs, Wifi, Firmware, About };
+    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, Gnss, GnssQuiet, Coordinates, ProbeMacs, Wifi, CheckUpdates, Firmware, About };
    enum class Kind { Text, Choice, Toggle, Slider, Page };

    explicit SettingsMenu(Settings& settings) : settings_(settings) {}
@@ -0,0 +1,158 @@
+#include "http_head.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstdlib>
+
+namespace roro::release {
+
+namespace {
+std::string lower(std::string s) {
+    for (char& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+}  // namespace
+
+size_t HttpHeadParser::feed(const char* data, size_t len) {
+    size_t used = 0;
+    while (used < len && !complete_ && !failed_) {
+        char c = data[used++];
+        total_++;
+        if (total_ > kMaxBytes) {
+            failed_ = true;
+            break;
+        }
+        if (c == '\n') {
+            if (!line_.empty() && line_.back() == '\r') line_.pop_back();
+            line();
+            line_.clear();
+        } else {
+            line_ += c;
+        }
+    }
+    return used;
+}
+
+void HttpHeadParser::line() {
+    if (first_) {  // "HTTP/1.1 200 OK"
+        first_ = false;
+        if (line_.compare(0, 5, "HTTP/") != 0) {
+            failed_ = true;
+            return;
+        }
+        size_t space = line_.find(' ');
+        head_.status = space == std::string::npos ? 0 : std::atoi(line_.c_str() + space + 1);
+        if (head_.status < 100 || head_.status > 599) failed_ = true;
+        return;
+    }
+    if (line_.empty()) {
+        complete_ = true;
+        return;
+    }
+    size_t colon = line_.find(':');
+    if (colon == std::string::npos) return;  // not a header: ignored
+    std::string name = lower(line_.substr(0, colon));
+    size_t from = line_.find_first_not_of(" \t", colon + 1);
+    std::string value = from == std::string::npos ? "" : line_.substr(from);
+    if (name == "content-length") head_.contentLength = std::atol(value.c_str());
+    else if (name == "transfer-encoding") head_.chunked = lower(value).find("chunked") != std::string::npos;
+    else if (name == "location") head_.location = value;
+    else if (name == "content-type") head_.contentType = value;
+}
+
+size_t ChunkedDecoder::decode(const uint8_t* in, size_t len, uint8_t* out) {
+    size_t written = 0;
+    for (size_t i = 0; i < len && !failed_ && state_ != State::Done; i++) {
+        uint8_t c = in[i];
+        switch (state_) {
+            case State::Size: {
+                int digit = c >= '0' && c <= '9' ? c - '0' : c >= 'a' && c <= 'f' ? c - 'a' + 10 : c >= 'A' && c <= 'F' ? c - 'A' + 10 : -1;
+                if (digit >= 0) {
+                    if (remaining_ > (SIZE_MAX >> 5)) failed_ = true;
+                    remaining_ = remaining_ * 16 + digit;
+                    anyDigit_ = true;
+                } else if (c == ';' && anyDigit_) {
+                    state_ = State::Extension;
+                } else if (c == '\r' && anyDigit_) {
+                    state_ = State::SizeLf;
+                } else {
+                    failed_ = true;
+                }
+                break;
+            }
+            case State::Extension:
+                if (c == '\r') state_ = State::SizeLf;
+                break;
+            case State::SizeLf:
+                if (c != '\n') {
+                    failed_ = true;
+                } else if (remaining_ == 0) {
+                    state_ = State::Trailer;
+                    trailerLine_ = 0;
+                } else {
+                    state_ = State::Data;
+                }
+                break;
+            case State::Data: {
+                size_t take = std::min(remaining_, len - i);
+                for (size_t k = 0; k < take; k++) out[written + k] = in[i + k];
+                written += take;
+                remaining_ -= take;
+                i += take - 1;
+                if (remaining_ == 0) state_ = State::DataCr;
+                break;
+            }
+            case State::DataCr:
+                if (c != '\r') failed_ = true;
+                else state_ = State::DataLf;
+                break;
+            case State::DataLf:
+                if (c != '\n') {
+                    failed_ = true;
+                } else {
+                    state_ = State::Size;
+                    anyDigit_ = false;
+                }
+                break;
+            case State::Trailer:  // header lines after the last chunk, until an empty one
+                if (c == '\n') {
+                    if (trailerLine_ == 0) state_ = State::Done;
+                    trailerLine_ = 0;
+                } else if (c != '\r') {
+                    trailerLine_++;
+                }
+                break;
+            case State::Done: break;
+        }
+    }
+    return written;
+}
+
+Url parseUrl(const std::string& url) {
+    Url u;
+    size_t scheme = url.find("://");
+    if (scheme == std::string::npos) return u;
+    std::string s = lower(url.substr(0, scheme));
+    if (s != "http" && s != "https") return u;
+    u.https = s == "https";
+    size_t hostStart = scheme + 3, pathStart = url.find('/', hostStart);
+    std::string authority = url.substr(hostStart, pathStart == std::string::npos ? std::string::npos : pathStart - hostStart);
+    u.path = pathStart == std::string::npos ? "/" : url.substr(pathStart);
+    if (authority.empty() || authority.find('@') != std::string::npos) return u;  // no credentials in a URL
+    size_t colon = authority.rfind(':');
+    u.port = u.https ? 443 : 80;
+    if (colon != std::string::npos) {
+        u.port = std::atoi(authority.c_str() + colon + 1);
+        authority.resize(colon);
+        if (u.port <= 0 || u.port > 65535) return u;
+    }
+    for (unsigned char c : authority)
+        if (!(std::isalnum(c) || c == '.' || c == '-')) return u;
+    for (unsigned char c : u.path)
+        if (c <= ' ' || c == 0x7F) return u;
+    u.host = lower(authority);
+    u.ok = !u.host.empty();
+    return u;
+}
+
+}  // namespace roro::release
@@ -0,0 +1,62 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace roro::release {
+
+// The status line and headers of an HTTP/1.1 response, read as bytes arrive.
+struct HttpHead {
+    int status = 0;
+    long contentLength = -1;  // -1: not given
+    bool chunked = false;
+    std::string location, contentType;
+};
+
+class HttpHeadParser {
+   public:
+    static constexpr size_t kMaxBytes = 4096;
+
+    // Takes bytes up to and including the blank line that ends the head; returns how many it used.
+    // What follows is the body.
+    size_t feed(const char* data, size_t len);
+    bool complete() const { return complete_; }
+    bool failed() const { return failed_; }
+    const HttpHead& head() const { return head_; }
+
+   private:
+    void line();
+
+    HttpHead head_;
+    std::string line_;
+    size_t total_ = 0;
+    bool first_ = true, complete_ = false, failed_ = false;
+};
+
+// Takes the chunks of "Transfer-Encoding: chunked" apart as they arrive.
+class ChunkedDecoder {
+   public:
+    // `out` has room for `len` bytes (the body is never longer than what carried it).
+    size_t decode(const uint8_t* in, size_t len, uint8_t* out);
+    bool done() const { return state_ == State::Done; }
+    bool failed() const { return failed_; }
+
+   private:
+    enum class State : uint8_t { Size, Extension, SizeLf, Data, DataCr, DataLf, Trailer, Done };
+    State state_ = State::Size;
+    size_t remaining_ = 0;
+    bool anyDigit_ = false, failed_ = false;
+    size_t trailerLine_ = 0;
+};
+
+// "https://git.twis.la/twisla/x/releases/download/v1/a.ota" taken apart. Only http and https.
+struct Url {
+    bool ok = false;
+    bool https = false;
+    std::string host, path;  // path from the first "/", with its query; "/" if none
+    int port = 0;
+};
+Url parseUrl(const std::string& url);
+
+}  // namespace roro::release
@@ -0,0 +1,202 @@
+#include "json_scan.h"
+
+namespace roro::release {
+
+namespace {
+bool space(char c) { return c == ' ' || c == '\t' || c == '\r' || c == '\n'; }
+bool continuation(char c) { return (static_cast<uint8_t>(c) & 0xC0) == 0x80; }
+}  // namespace
+
+void JsonScanner::feed(const char* data, size_t len) {
+    for (size_t i = 0; i < len && !failed_; i++) step(data[i]);
+}
+
+std::string JsonScanner::path() const {
+    std::string p;
+    for (const Frame& f : stack_) {
+        if (f.isObject) {
+            if (!p.empty()) p += '.';
+            p += f.key;
+        } else {
+            p += '[' + std::to_string(f.index) + ']';
+        }
+    }
+    return p;
+}
+
+void JsonScanner::append(const char* bytes, size_t n) {
+    if (text_.size() + n > max_) {
+        truncated_ = true;
+        return;
+    }
+    text_.append(bytes, n);
+}
+
+void JsonScanner::appendCodePoint(uint32_t cp) {
+    char b[4];
+    size_t n;
+    if (cp < 0x80) {
+        b[0] = static_cast<char>(cp);
+        n = 1;
+    } else if (cp < 0x800) {
+        b[0] = static_cast<char>(0xC0 | (cp >> 6));
+        b[1] = static_cast<char>(0x80 | (cp & 0x3F));
+        n = 2;
+    } else if (cp < 0x10000) {
+        b[0] = static_cast<char>(0xE0 | (cp >> 12));
+        b[1] = static_cast<char>(0x80 | ((cp >> 6) & 0x3F));
+        b[2] = static_cast<char>(0x80 | (cp & 0x3F));
+        n = 3;
+    } else {
+        b[0] = static_cast<char>(0xF0 | (cp >> 18));
+        b[1] = static_cast<char>(0x80 | ((cp >> 12) & 0x3F));
+        b[2] = static_cast<char>(0x80 | ((cp >> 6) & 0x3F));
+        b[3] = static_cast<char>(0x80 | (cp & 0x3F));
+        n = 4;
+    }
+    append(b, n);
+}
+
+void JsonScanner::startString(bool key) {
+    inString_ = true;
+    isKey_ = key;
+    escape_ = false;
+    unicodeLeft_ = 0;
+    highSurrogate_ = 0;
+    truncated_ = false;
+    text_.clear();
+}
+
+void JsonScanner::stringChar(char c) {
+    if (unicodeLeft_ > 0) {
+        int digit = c >= '0' && c <= '9' ? c - '0' : c >= 'a' && c <= 'f' ? c - 'a' + 10 : c >= 'A' && c <= 'F' ? c - 'A' + 10 : -1;
+        if (digit < 0) return fail();
+        unicode_ = unicode_ * 16 + digit;
+        if (--unicodeLeft_ == 0) {
+            if (unicode_ >= 0xD800 && unicode_ < 0xDC00) {
+                highSurrogate_ = unicode_;  // the low half comes next
+            } else if (unicode_ >= 0xDC00 && unicode_ < 0xE000 && highSurrogate_) {
+                appendCodePoint(0x10000 + ((highSurrogate_ - 0xD800) << 10) + (unicode_ - 0xDC00));
+                highSurrogate_ = 0;
+            } else {
+                appendCodePoint(unicode_);
+                highSurrogate_ = 0;
+            }
+        }
+        return;
+    }
+    if (escape_) {
+        escape_ = false;
+        switch (c) {
+            case 'n': append("\n", 1); break;
+            case 't': append("\t", 1); break;
+            case 'r': append("\r", 1); break;
+            case 'b': append("\b", 1); break;
+            case 'f': append("\f", 1); break;
+            case 'u': unicodeLeft_ = 4; unicode_ = 0; break;
+            default: append(&c, 1); break;  // \" \\ \/
+        }
+        return;
+    }
+    if (c == '\\') {
+        escape_ = true;
+    } else if (c == '"') {
+        endString();
+    } else {
+        append(&c, 1);
+    }
+}
+
+void JsonScanner::endString() {
+    inString_ = false;
+    // A cut can leave half a character at the end.
+    while (truncated_ && !text_.empty()) {
+        size_t k = text_.size();
+        while (k > 0 && continuation(text_[k - 1])) k--;
+        if (k == 0) break;
+        uint8_t lead = static_cast<uint8_t>(text_[k - 1]);
+        size_t want = lead >= 0xF0 ? 4 : lead >= 0xE0 ? 3 : lead >= 0xC0 ? 2 : 1;
+        if (text_.size() - (k - 1) < want) text_.resize(k - 1);
+        break;
+    }
+    if (isKey_) {
+        stack_.back().key = text_;
+        expect_ = Expect::Colon;
+        return;
+    }
+    sink_(path(), text_, true, truncated_);
+    valueDone();
+}
+
+void JsonScanner::endLiteral() {
+    inLiteral_ = false;
+    sink_(path(), text_, false, false);
+    valueDone();
+}
+
+void JsonScanner::valueDone() {
+    if (stack_.empty()) {
+        done_ = true;
+        return;
+    }
+    expect_ = Expect::CommaOrEnd;
+}
+
+void JsonScanner::step(char c) {
+    if (inString_) return stringChar(c);
+    if (inLiteral_) {
+        if (space(c) || c == ',' || c == '}' || c == ']') {
+            endLiteral();  // and the character that ended it is read again below
+        } else {
+            if (text_.size() < max_) text_ += c;
+            return;
+        }
+    }
+    if (space(c)) return;
+    switch (expect_) {
+        case Expect::Value:
+            if (c == '{') {
+                stack_.push_back({true, "", 0});
+                expect_ = Expect::KeyOrEnd;
+            } else if (c == '[') {
+                stack_.push_back({false, "", 0});
+                expect_ = Expect::Value;
+            } else if (c == ']' && !stack_.empty() && !stack_.back().isObject && stack_.back().index == 0) {
+                stack_.pop_back();  // an empty array
+                valueDone();
+            } else if (c == '"') {
+                startString(false);
+            } else if (c == '-' || (c >= '0' && c <= '9') || c == 't' || c == 'f' || c == 'n') {
+                inLiteral_ = true;
+                text_.assign(1, c);
+            } else {
+                fail();
+            }
+            return;
+        case Expect::KeyOrEnd:
+            if (c == '"') startString(true);
+            else if (c == '}') {
+                stack_.pop_back();
+                valueDone();
+            } else fail();
+            return;
+        case Expect::Colon:
+            if (c == ':') expect_ = Expect::Value;
+            else fail();
+            return;
+        case Expect::CommaOrEnd:
+            if (c == ',') {
+                if (stack_.back().isObject) expect_ = Expect::KeyOrEnd;
+                else {
+                    stack_.back().index++;
+                    expect_ = Expect::Value;
+                }
+            } else if ((c == '}' && stack_.back().isObject) || (c == ']' && !stack_.back().isObject)) {
+                stack_.pop_back();
+                valueDone();
+            } else fail();
+            return;
+    }
+}
+
+}  // namespace roro::release
@@ -0,0 +1,57 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <string>
+#include <vector>
+
+namespace roro::release {
+
+// Reads JSON as it arrives, a chunk at a time, and reports each plain value (a string, a number,
+// true, false, null) with where it was found: "tag_name", "assets[1].name", "[2].draft". Nothing
+// is kept but the path, so a 33 KB list of releases costs a few hundred bytes. A value longer than
+// `maxValueBytes` is cut (never in the middle of a character) and reported as truncated.
+// Meant for a server's answer, not for validating JSON: it only refuses what it can't follow.
+class JsonScanner {
+   public:
+    using Sink = std::function<void(const std::string& path, const std::string& value, bool isString, bool truncated)>;
+
+    explicit JsonScanner(Sink sink, size_t maxValueBytes = 300) : sink_(std::move(sink)), max_(maxValueBytes) {}
+
+    void feed(const char* data, size_t len);
+    bool failed() const { return failed_; }
+    bool done() const { return done_ && !failed_; }  // the top-level value is complete
+
+   private:
+    enum class Expect : uint8_t { Value, KeyOrEnd, Colon, CommaOrEnd };
+    struct Frame {
+        bool isObject;
+        std::string key;
+        int index;
+    };
+
+    void step(char c);
+    void startString(bool key);
+    void stringChar(char c);
+    void appendCodePoint(uint32_t cp);
+    void endString();
+    void endLiteral();
+    void valueDone();
+    void append(const char* bytes, size_t n);
+    std::string path() const;
+    void fail() { failed_ = true; }
+
+    Sink sink_;
+    size_t max_;
+    std::vector<Frame> stack_;
+    Expect expect_ = Expect::Value;
+    bool inString_ = false, isKey_ = false, escape_ = false, inLiteral_ = false;
+    int unicodeLeft_ = 0;
+    uint32_t unicode_ = 0, highSurrogate_ = 0;
+    bool truncated_ = false;
+    std::string text_;
+    bool failed_ = false, done_ = false;
+};
+
+}  // namespace roro::release
@@ -0,0 +1,80 @@
+#include "release_info.h"
+
+#include <cstdlib>
+
+namespace roro::release {
+
+namespace {
+bool endsWith(const std::string& s, const char* tail) {
+    size_t n = std::char_traits<char>::length(tail);
+    return s.size() >= n && s.compare(s.size() - n, n, tail) == 0;
+}
+}  // namespace
+
+std::string firstParagraph(const std::string& text, bool truncated) {
+    size_t end = text.find("\n\n");
+    size_t crlf = text.find("\r\n\r\n");
+    if (crlf != std::string::npos && (end == std::string::npos || crlf < end)) end = crlf;
+    std::string p = text.substr(0, end);
+    size_t first = p.find_first_not_of(" \t\r\n");
+    if (first == std::string::npos) return "";
+    p.erase(0, first);
+    while (!p.empty() && (p.back() == ' ' || p.back() == '\t' || p.back() == '\r' || p.back() == '\n')) p.pop_back();
+    if (truncated && end == std::string::npos) p += "...";
+    return p;
+}
+
+ReleaseReader::ReleaseReader(size_t maxReleases)
+    : scanner_([this](const std::string& path, const std::string& text, bool isString, bool truncated) {
+          value(path, text, isString, truncated);
+      }),
+      max_(maxReleases) {}
+
+void ReleaseReader::end() { flushAsset(); }
+
+void ReleaseReader::flushAsset() {
+    if (assetRelease_ >= 0 && assetRelease_ < static_cast<int>(releases_.size()) && endsWith(assetName_, ".ota") && !assetUrl_.empty()) {
+        releases_[assetRelease_].otaUrl = assetUrl_;
+        releases_[assetRelease_].otaSize = assetSize_;
+    }
+    assetRelease_ = assetIndex_ = -1;
+    assetName_.clear();
+    assetUrl_.clear();
+    assetSize_ = 0;
+}
+
+void ReleaseReader::value(const std::string& path, const std::string& text, bool isString, bool truncated) {
+    size_t index = 0;
+    std::string rest = path;
+    if (!path.empty() && path[0] == '[') {  // a list: "[2].tag_name"
+        char* end;
+        index = static_cast<size_t>(std::strtol(path.c_str() + 1, &end, 10));
+        rest = *end == ']' ? std::string(end + 1) : "";
+        if (!rest.empty() && rest[0] == '.') rest.erase(0, 1);
+    }
+    if (index >= max_) return;
+    if (releases_.size() <= index) releases_.resize(index + 1);
+    Release& r = releases_[index];
+
+    if (rest == "tag_name") r.tag = text;
+    else if (rest == "published_at") r.published = text;
+    else if (rest == "body") r.notes = firstParagraph(text, truncated);
+    else if (rest == "draft") r.draft = text == "true";
+    else if (rest == "prerelease") r.prerelease = text == "true";
+    else if (rest.compare(0, 7, "assets[") == 0) {
+        char* end;
+        int j = static_cast<int>(std::strtol(rest.c_str() + 7, &end, 10));
+        if (static_cast<int>(index) != assetRelease_ || j != assetIndex_) {
+            flushAsset();
+            assetRelease_ = static_cast<int>(index);
+            assetIndex_ = j;
+        }
+        std::string field = *end == ']' && end[1] == '.' ? std::string(end + 2) : "";
+        if (field == "name") assetName_ = text;
+        else if (field == "size") assetSize_ = static_cast<uint32_t>(std::strtoul(text.c_str(), nullptr, 10));
+        else if (field == "browser_download_url") assetUrl_ = text;
+    }
+    (void)isString;
+}
+
+}  // namespace roro::release
@@ -0,0 +1,52 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "json_scan.h"
+
+namespace roro::release {
+
+// What the device needs to know about one Gitea release (docs/milestones/R1.md, #6).
+struct Release {
+    std::string tag;        // "v0.10.0"
+    std::string published;  // "2026-10-06T08:11:31Z"
+    std::string notes;      // the first paragraph of the text: the tag's message
+    std::string otaUrl;     // where the signed Update File is
+    uint32_t otaSize = 0;
+    bool draft = false, prerelease = false;
+
+    // Something that can be installed and that the project meant to publish (drafts and
+    // pre-releases are left out for now: a release channel is #53).
+    bool usable() const { return !draft && !prerelease && !tag.empty() && !otaUrl.empty(); }
+    std::string date() const { return published.substr(0, 10); }  // "2026-10-06"
+};
+
+// Reads Gitea's answer as it arrives: `releases/latest` (one object) or `releases?limit=N` (a list).
+class ReleaseReader {
+   public:
+    explicit ReleaseReader(size_t maxReleases = 10);
+
+    void feed(const char* data, size_t len) { scanner_.feed(data, len); }
+    void end();  // after the last chunk
+    bool ok() const { return !scanner_.failed(); }
+    bool complete() const { return scanner_.done(); }
+    const std::vector<Release>& releases() const { return releases_; }
+
+   private:
+    void value(const std::string& path, const std::string& text, bool isString, bool truncated);
+    void flushAsset();
+
+    JsonScanner scanner_;
+    size_t max_;
+    std::vector<Release> releases_;
+    int assetRelease_ = -1, assetIndex_ = -1;
+    std::string assetName_, assetUrl_;
+    uint32_t assetSize_ = 0;
+};
+
+// The first paragraph of a release's text, trimmed; "..." if the text was cut before it ended.
+std::string firstParagraph(const std::string& text, bool truncated);
+
+}  // namespace roro::release
@@ -0,0 +1,15 @@
+#include "update_check.h"
+
+#include "http_head.h"
+
+namespace roro::release {
+
+bool trustedAssetUrl(const std::string& url, const std::string& host, const std::string& repo) {
+    Url u = parseUrl(url);
+    if (!u.ok || !u.https || u.port != 443 || u.host != host) return false;
+    std::string prefix = "/" + repo + "/releases/download/";
+    return u.path.compare(0, prefix.size(), prefix) == 0 && u.path.find("..") == std::string::npos &&
+           u.path.find('?') == std::string::npos && u.path.find('#') == std::string::npos;
+}
+
+}  // namespace roro::release
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <string>
+
+#include "release_info.h"
+#include "version_compare.h"
+
+namespace roro::release {
+
+// Where the project's releases are (Q164). A fork changes these, and its own signing key.
+constexpr const char* kGiteaHost = "git.twis.la";
+constexpr const char* kGiteaRepo = "twisla/roro9stack";
+
+inline bool versionNewer(const std::string& a, const std::string& b) { return versionOlder(b, a); }
+
+// "v0.10.0+debug": the Debug Build says so wherever the version shows (scripts/version.py).
+inline bool isDebugBuild(const std::string& version) {
+    static const std::string tail = "+debug";
+    return version.size() >= tail.size() && version.compare(version.size() - tail.size(), tail.size(), tail) == 0;
+}
+
+// Is `release` a newer one than what runs?
+inline bool isNewer(const Release& release, const std::string& running) {
+    return release.usable() && versionNewer(release.tag, running);
+}
+
+// Should the background check say so (Q166, Q168)? Not for a version that failed on this device
+// before (it rolled back), and not twice for the same one.
+inline bool shouldAnnounce(const Release& latest, const std::string& running, const std::string& failed, const std::string& announced) {
+    return isNewer(latest, running) && latest.tag != failed && latest.tag != announced;
+}
+
+// Is `url` a download this device takes from the project's server, for this repository? Whatever
+// the API says, the device only fetches from where it asked (a redirected or rewritten answer
+// can't send it elsewhere).
+bool trustedAssetUrl(const std::string& url, const std::string& host = kGiteaHost, const std::string& repo = kGiteaRepo);
+
+}  // namespace roro::release
@@ -40,6 +40,7 @@ const Definition kDefinitions[] = {
    {"ntp1", Kind::String, 0, "pool.ntp.org", 1, 63},
    {"ntp2", Kind::String, 0, "time.cloudflare.com", 0, 63},
    {"gnss_quiet", Kind::Bool, 0, nullptr, 0, 1},  // off: GNSS stays on, as decided in M2 (Q58)
+    {"check_updates", Kind::Bool, 1, nullptr, 0, 1},  // on: it only looks, and says so (R1, Q165)
 };
 static_assert(sizeof(kDefinitions) / sizeof(kDefinitions[0]) == static_cast<size_t>(Setting::Count),
              "every Setting needs a definition");
@@ -30,6 +30,7 @@ enum class Setting : uint8_t {
    Ntp1,             // string: the first NTP server, a host name or an IPv4 address (S1, Q110)
    Ntp2,             // string: the second, or empty
    GnssQuietForLora, // bool: put the GNSS receiver in standby while the LoRa radio listens (issue #20)
+    CheckUpdates,     // bool: look for a newer release on Gitea once a day (R1, Q165)
    Count
 };

@@ -46,3 +46,14 @@ build_flags =
 platform = native
 lib_ldf_mode = deep+
 build_flags = -std=gnu++17
+
+; The same tests, built to count which lines of lib/ they run (scripts/coverage.sh).
+[env:native-coverage]
+extends = env:native
+build_flags =
+    ${env:native.build_flags}
+    --coverage
+    -O0
+extra_scripts =
+    ${env.extra_scripts}
+    pre:scripts/coverage_link.py
@@ -1,8 +1,10 @@
 # Shared helper: run a command inside the roro9stack build container.
+# With RORO_NO_DOCKER set, the caller is in such a container already (a CI job): the command runs
+# right here, in the checkout.
 IMAGE=roro9stack-build
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

-docker build -q -t "$IMAGE" "$ROOT/docker" >/dev/null
+[ -n "${RORO_NO_DOCKER:-}" ] || docker build -q -t "$IMAGE" "$ROOT/docker" >/dev/null

 # The Debug Console token (ADR 0004): made once, kept with the OTA key, never committed.
 DEBUG_TOKEN_FILE="$HOME/.config/roro9stack/debug-token"
@@ -12,6 +14,10 @@ if [ ! -s "$DEBUG_TOKEN_FILE" ]; then
 fi

 run_in_container() {
+    if [ -n "${RORO_NO_DOCKER:-}" ]; then
+        (cd "$ROOT" && RORO_DEBUG_TOKEN="$(cat "$DEBUG_TOKEN_FILE")" "$@")
+        return
+    fi
    docker run --rm \
        -u "$(id -u):$(id -g)" -e HOME=/tmp \
        -e RORO_DEBUG_TOKEN="$(cat "$DEBUG_TOKEN_FILE")" \
@@ -1,7 +1,14 @@
 #!/usr/bin/env bash
 # Local CI: run host unit tests, then build the firmware.
+# Usage: scripts/ci.sh [tests|builds]   one half only; both by default
 set -euo pipefail
 source "$(dirname "$0")/_docker.sh"
 DOCKER_EXTRA=()

-run_in_container bash -c 'git config --global --add safe.directory /work && pio test -e native && pio run -e cardputer-adv -e cardputer-adv-debug'
+case "${1:-all}" in
+    tests) STEPS='pio test -e native' ;;
+    builds) STEPS='pio run -e cardputer-adv -e cardputer-adv-debug' ;;
+    all) STEPS='pio test -e native && pio run -e cardputer-adv -e cardputer-adv-debug' ;;
+    *) echo "Usage: scripts/ci.sh [tests|builds]" >&2; exit 1 ;;
+esac
+run_in_container bash -c 'git config --global --add safe.directory "$PWD" && '"$STEPS"
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Runs the host tests and says how much of lib/ they run: they're built with coverage counters.
+# Usage: scripts/coverage.sh [out folder, default .pio/coverage]
+# Out: summary.json (gcovr), coverage.svg (the README's badge), index.html (line by line).
+# What it measures: the lines of lib/ that compile on a PC. Not lib/SD (the card's driver) and not
+# src/ (the Apps, the Services, everything that needs the device): those have no host tests.
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+DOCKER_EXTRA=()
+OUT="${1:-.pio/coverage}"
+
+run_in_container bash -c '
+    set -eo pipefail  # a failing test fails this script, tail or not
+    git config --global --add safe.directory "$PWD"
+    rm -rf .pio/build/native-coverage "'"$OUT"'"
+    mkdir -p "'"$OUT"'"
+    pio test -e native-coverage | tail -1
+    gcovr -r . --filter "lib/" --object-directory .pio/build/native-coverage \
+        --json-summary "'"$OUT"'/summary.json" --html-details "'"$OUT"'/index.html" --print-summary | tail -4
+    python3 scripts/coverage_badge.py "'"$OUT"'/summary.json" "'"$OUT"'/coverage.svg"
+'
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Draws the README's coverage badge from gcovr's summary.
+
+Usage: scripts/coverage_badge.py <summary.json> <out.svg>
+       scripts/coverage_badge.py --plain <label> <value> <out.svg>   any other badge, in blue
+Also prints one line, and appends a short table to $GITHUB_STEP_SUMMARY when CI sets it.
+"""
+import json
+import os
+import sys
+
+
+def badge(label, value, color, title):
+    left, right = 6 * len(label) + 12, 7 * len(value) + 12
+    return f'''<svg xmlns="http://www.w3.org/2000/svg" width="{left + right}" height="20" role="img" aria-label="{label}: {value}">
+<title>{title}</title>
+<linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient>
+<clipPath id="r"><rect width="{left + right}" height="20" rx="3" fill="#fff"/></clipPath>
+<g clip-path="url(#r)"><rect width="{left}" height="20" fill="#555"/><rect x="{left}" width="{right}" height="20" fill="{color}"/><rect width="{left + right}" height="20" fill="url(#s)"/></g>
+<g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">
+<text x="{left / 2}" y="14">{label}</text><text x="{left + right / 2}" y="14">{value}</text></g></svg>
+'''
+
+
+def main():
+    if sys.argv[1] == "--plain":  # any other badge: --plain <label> <value> <out.svg>
+        label, value, out = sys.argv[2:5]
+        open(out, "w").write(badge(label, value, "#007ec6", f"{label}: {value}"))
+        return
+    summary = json.load(open(sys.argv[1]))
+    lines, branches = summary["line_percent"], summary["branch_percent"]
+    label, value = "lib coverage", f"{lines:.0f}%"
+    color = "#4c1" if lines >= 90 else "#a4a61d" if lines >= 75 else "#dfb317" if lines >= 60 else "#e05d44"
+    svg = badge(label, value, color, f"{label}: {value} of the lines of lib/ are run by the host tests")
+    open(sys.argv[2], "w").write(svg)
+    print(f"coverage of lib/: {lines:.1f}% of {summary['line_total']} lines, {branches:.1f}% of branches, {len(summary['files'])} files")
+    step = os.environ.get("GITHUB_STEP_SUMMARY")
+    if step:
+        worst = sorted((f["line_percent"], f["filename"]) for f in summary["files"] if f["line_total"] >= 10)[:5]
+        with open(step, "a") as out:
+            out.write(f"### Coverage of `lib/` by the host tests\n\n**{lines:.1f}%** of {summary['line_total']} lines, {branches:.1f}% of branches.\n\n")
+            out.write("| Least covered | Lines |\n|---|---|\n" + "".join(f"| `{name}` | {pct:.0f}% |\n" for pct, name in worst))
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,4 @@
+# The coverage build must also link with --coverage (build_flags only reaches the compiler).
+Import("env")  # noqa: F821  (provided by PlatformIO)
+
+env.Append(LINKFLAGS=["--coverage"])  # noqa: F821
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Checks an Update File (.ota) the way the device does, on a PC: header, signature, image hash.
+
+Usage: scripts/ota_verify.py <file.ota> [public key, default keys/ota-public.pem]
+Exits 0 and prints the version if a device would accept the file.
+"""
+import hashlib
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+
+HEADER_SIZE = 160
+SIGNED_BYTES = 80
+
+
+def main():
+    if len(sys.argv) < 2:
+        sys.exit(__doc__)
+    root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    key = sys.argv[2] if len(sys.argv) > 2 else os.path.join(root, "keys", "ota-public.pem")
+    data = open(sys.argv[1], "rb").read()
+    if len(data) < HEADER_SIZE or data[:8] != b"RORO-OTA":
+        sys.exit("not an update file")
+    fmt, header_size, image_size = struct.unpack("<HHI", data[8:16])
+    if fmt != 1 or header_size != HEADER_SIZE:
+        sys.exit("unsupported update format")
+    image = data[HEADER_SIZE:]
+    if len(image) != image_size:
+        sys.exit(f"the header announces {image_size} bytes of image, the file has {len(image)}")
+    if hashlib.sha256(image).digest() != data[16:48]:
+        sys.exit("image corrupted (hash mismatch)")
+    version = data[48:80].split(b"\0")[0].decode()
+    (sig_len,) = struct.unpack("<H", data[80:82])
+    with tempfile.NamedTemporaryFile() as signed, tempfile.NamedTemporaryFile() as sig:
+        signed.write(data[:SIGNED_BYTES])
+        signed.flush()
+        sig.write(data[82:82 + sig_len])
+        sig.flush()
+        ok = subprocess.run(["openssl", "dgst", "-sha256", "-verify", key, "-signature", sig.name, signed.name],
+                            capture_output=True).returncode == 0
+    if not ok:
+        sys.exit("bad signature (wrong key)")
+    print(f"{sys.argv[1]}: {version}, {image_size} bytes, signature good")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Builds what a release publishes, from a checkout of the repository at a tag (docs/milestones/R1.md).
+# Usage: scripts/release_build.sh <checkout> <out folder>
+#   <checkout>   a clone with its tags, at the commit to release: its own sources are built, with
+#                this copy's build image and signing tools, so an old tag can be released today.
+# The signing key is read from $RORO_OTA_KEY (a file), as scripts/make_ota.py does.
+# Out: roro9stack-<version>.ota (signed, checked), -factory.bin (USB), .elf.gz (to decode crashes),
+#      SHA256SUMS, and notes.md for the release's text.
+set -euo pipefail
+SRC="$(cd "$1" && pwd)"
+mkdir -p "$2"
+OUT="$(cd "$2" && pwd)"
+TOOLS="$(cd "$(dirname "$0")" && pwd)"
+
+VERSION="$(git -C "$SRC" describe --tags --always --dirty)"
+case "$VERSION" in
+    *-dirty) echo "release: $SRC has uncommitted changes ($VERSION)" >&2; exit 1 ;;
+esac
+git -C "$SRC" describe --tags --exact-match >/dev/null 2>&1 || { echo "release: $VERSION is not a tag" >&2; exit 1; }
+
+source "$TOOLS/_docker.sh"
+ROOT="$SRC"  # _docker.sh mounts $ROOT as /work: the checkout to build, not necessarily this copy
+DOCKER_EXTRA=()
+# A tag from before the framework was rebuilt with our settings (ADR 0006) can't link against a
+# rebuilt one left in the toolchain cache: it gets the framework's libraries as they come.
+if ! grep -q custom_sdkconfig "$SRC/platformio.ini"; then
+    run_in_container bash -c 'rm -rf "${PLATFORMIO_CORE_DIR:-/pio}/packages/framework-arduinoespressif32-libs"'
+fi
+run_in_container bash -c 'git config --global --add safe.directory "$PWD" && pio run -e cardputer-adv'
+
+BUILD="$SRC/.pio/build/cardputer-adv"
+NAME="roro9stack-$VERSION"
+"$TOOLS/make_ota.py" "$BUILD/firmware.bin" "$VERSION" "$OUT/$NAME.ota"
+# A wrong key must stop the release here, not on a device: checked against the public key the
+# sources being built carry (the tags from before Firmware Updates have none: today's, then).
+PUBLIC="$SRC/keys/ota-public.pem"
+[ -e "$PUBLIC" ] || PUBLIC="$TOOLS/../keys/ota-public.pem"
+"$TOOLS/ota_verify.py" "$OUT/$NAME.ota" "$PUBLIC"
+cp "$BUILD/firmware.factory.bin" "$OUT/$NAME-factory.bin"
+gzip -9 -c "$BUILD/firmware.elf" > "$OUT/$NAME.elf.gz"
+(cd "$OUT" && sha256sum "$NAME.ota" "$NAME-factory.bin" "$NAME.elf.gz" > SHA256SUMS)
+
+# The release's text: what the tag says, then what went in since the tag before.
+PREVIOUS="$(git -C "$SRC" describe --tags --abbrev=0 "$VERSION^" 2>/dev/null || true)"
+{
+    git -C "$SRC" tag -l --format='%(contents)' "$VERSION" | sed -e '/^-----BEGIN PGP/,$d'
+    echo
+    echo "## Files"
+    echo
+    echo "- \`$NAME.ota\`: the signed Update File. Copy it to \`/updates\` on the SD card and install it from Settings > Firmware or the Storage App, or push it over Wi-Fi with \`scripts/ota_push.py\`."
+    echo "- \`$NAME-factory.bin\`: the whole flash image, for a first install over USB at offset 0."
+    echo "- \`$NAME.elf.gz\`: the symbols, to decode a crash report from this build."
+    echo "- \`SHA256SUMS\`: checksums of the three."
+    if [ -n "$PREVIOUS" ]; then
+        echo
+        echo "## Changes since $PREVIOUS"
+        echo
+        git -C "$SRC" log --no-merges --format='- %s' "$PREVIOUS..$VERSION"
+    fi
+} > "$OUT/notes.md"
+echo "$VERSION" > "$OUT/version"
+ls -l "$OUT"
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""Creates or completes a Gitea release from what scripts/release_build.sh made.
+
+Usage: scripts/release_publish.py <folder>
+Environment: GITEA_API (https://host/api/v1), GITEA_REPO (owner/name), GITEA_TOKEN.
+Run again for the same version, it replaces the files and the text instead of failing.
+"""
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+API = os.environ.get("GITEA_API", "").rstrip("/")
+REPO = os.environ.get("GITEA_REPO", "")
+TOKEN = os.environ.get("GITEA_TOKEN", "")
+
+
+def call(method, path, body=None, raw=None, content_type="application/json"):
+    data = raw if raw is not None else (json.dumps(body).encode() if body is not None else None)
+    request = urllib.request.Request(f"{API}/repos/{REPO}{path}", data=data, method=method)
+    request.add_header("Authorization", f"token {TOKEN}")
+    if data is not None:
+        request.add_header("Content-Type", content_type)
+    try:
+        with urllib.request.urlopen(request, timeout=300) as response:
+            text = response.read()
+            return response.status, json.loads(text) if text else None
+    except urllib.error.HTTPError as e:
+        return e.code, e.read().decode(errors="replace")[:300]
+
+
+def main():
+    if len(sys.argv) != 2 or not (API and REPO and TOKEN):
+        sys.exit(__doc__)
+    folder = sys.argv[1]
+    version = open(os.path.join(folder, "version")).read().strip()
+    notes = open(os.path.join(folder, "notes.md")).read()
+    files = sorted(f for f in os.listdir(folder) if f not in ("version", "notes.md"))
+
+    status, release = call("GET", f"/releases/tags/{urllib.parse.quote(version)}")
+    fields = {"tag_name": version, "name": f"roro9stack {version}", "body": notes, "draft": False, "prerelease": False}
+    if status == 200:
+        status, release = call("PATCH", f"/releases/{release['id']}", fields)
+    else:
+        status, release = call("POST", "/releases", fields)
+    if status not in (200, 201):
+        sys.exit(f"release: Gitea answered {status}: {release}")
+
+    for asset in release.get("assets") or []:  # a second run replaces what the first uploaded
+        if asset["name"] in files:
+            call("DELETE", f"/releases/{release['id']}/assets/{asset['id']}")
+    for name in files:
+        with open(os.path.join(folder, name), "rb") as f:
+            status, answer = call("POST", f"/releases/{release['id']}/assets?name={urllib.parse.quote(name)}", raw=f.read(),
+                                  content_type="application/octet-stream")
+        if status != 201:
+            sys.exit(f"release: uploading {name}: Gitea answered {status}: {answer}")
+        print(f"uploaded {name} ({answer['size']} bytes)")
+    print(f"published {release['html_url']}")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,45 @@
+# The roro9stack site
+
+Source of https://roro9stack.net (docs/milestones/W1.md): a [Zola](https://www.getzola.org/) site. The home page, an Install page with a browser flasher, and the list of releases so far; the user guide, how-tos, FAQ and developer docs come next.
+
+```
+config.toml           base_url, the repository and API addresses
+content/              the pages (Markdown, with their template named in the front matter)
+templates/            base, home, install, downloads, 404; illustrations/ is generated
+data/                 the App cards and the screenshots' captions
+static/               css, js, fonts (self-hosted), img, screens (real screenshots), vendor/esp-web-tools
+tools/                make_illustrations.py, check_site.py
+```
+
+## Build and look
+
+```sh
+docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/repo" -w /repo/site ghcr.io/getzola/zola:v0.22.0 build   # writes ./public
+docker run --rm -u "$(id -u):$(id -g)" -p 1111:1111 -v "$PWD:/repo" -w /repo/site ghcr.io/getzola/zola:v0.22.0 serve --interface 0.0.0.0
+python3 site/tools/check_site.py public    # what the pages promise, kept
+```
+
+Or `zola build` with a Zola of your own, in `site/` (or `zola --root site build` from the root). **The output goes to `public/` at the root of the repository,** not into `site/`: `output_dir` in `config.toml`, and git ignores that directory. The build reads the latest release and the list of releases from the Gitea API (`load_data`); if the server can't be reached, the pages say so instead of failing.
+
+## Publishing
+
+The web server pulls `main` and runs `zola build`, as for the blog. CI (`.gitea/workflows/site.yml`) builds the site and runs the checks when `site/`, `docs/`, `README.md` or `CONTEXT.md` change; the firmware workflow skips a change that touches only those.
+
+## Things to know
+
+- **The Install page needs Caddy's help.** Gitea's release downloads carry no CORS header, so the page asks the API from the browser only if Caddy, in front of Gitea, allows this origin:
+
+  ```caddy
+  @releases {
+      method GET HEAD
+      path /twisla/roro9stack/releases/download/* /api/v1/repos/twisla/roro9stack/releases*
+  }
+  header @releases Access-Control-Allow-Origin "https://roro9stack.net"
+  header @releases Vary Origin
+  ```
+
+  Without it the page says it can't reach the release server and points to the esptool steps.
+- **No third-party requests.** Fonts and the flasher library are served from here; `tools/check_site.py` fails the build if a page loads anything from another origin.
+- **Illustrations.** `templates/illustrations/*.html` are generated by `tools/make_illustrations.py`; run it again rather than editing them.
+- **Updating the flasher library:** see `static/vendor/esp-web-tools/README.txt`.
+- **Fonts** are DM Mono and Hanken Grotesk, under the SIL Open Font License (the licences are in `static/fonts/`).
@@ -0,0 +1,26 @@
+# roro9stack.net (docs/milestones/W1.md). Build with `zola build`; the web server pulls main and does this.
+base_url = "https://roro9stack.net"
+title = "roro9stack"
+description = "Open firmware for the M5Stack Cardputer ADV with the Cap LoRa-1262: a LoRa scanner, GNSS, a Gemini browser, IRC, Wi-Fi tools, notes and more."
+default_language = "en"
+compile_sass = false
+build_search_index = false
+generate_feeds = false
+# The built site goes to public/ at the root of the repository (git ignores it), whether Zola is run
+# from site/ or from the root with `--root site`.
+output_dir = "../public"
+
+[markdown]
+smart_punctuation = false
+
+[markdown.highlighting]
+# Classes instead of inline colours; Zola 0.22 still wants a theme and writes giallo.css, which the
+# templates don't link.
+style = "class"
+theme = "nord"
+
+[extra]
+repo = "https://git.twis.la/twisla/roro9stack"
+api = "https://git.twis.la/api/v1/repos/twisla/roro9stack"
+blog = "https://experiments.twis.la"
+contact = "contact@roro9stack.net"
@@ -0,0 +1,4 @@
+++
+title = "roro9stack"
+template = "index.html"
+++
@@ -0,0 +1,5 @@
+++
+title = "Downloads"
+description = "Every release of roro9stack: the signed update file, the factory image for USB, and what changed."
+template = "downloads.html"
+++
@@ -0,0 +1,41 @@
+++
+title = "Install roro9stack"
+description = "Flash roro9stack onto an M5Stack Cardputer ADV from your browser, or with esptool."
+template = "install.html"
+++
+
+## Before you start
+
+- An **M5Stack Cardputer ADV**, and a **USB-C cable that carries data** (a charge-only cable won't show up).
+- **Chrome or Edge on a desktop computer.** Flashing from a page uses Web Serial, which Firefox and Safari don't have. Without it, use esptool below.
+- The **Cap LoRa-1262** is optional for the install: the LoRa Scanner and GNSS need it, the other Apps don't.
+
+## Flash it
+
+1. **Put the Cardputer in download mode.** Hold **G0**, the button next to the screen, while you plug in the USB-C cable.
+2. Press **Install roro9stack** above, choose the Cardputer in the list of serial ports (it's usually named after its chip, *ESP32-S3*, or *USB JTAG/serial debug unit*), and confirm.
+3. Wait for it to finish, and don't unplug it.
+4. The Cardputer restarts into a short **first-boot setup**: a name, a short name for the mesh, your region and your time zone. An interrupted setup simply starts again at the next boot.
+
+Flashing writes the firmware. What's on the SD card isn't touched.
+
+## Without Chrome: esptool
+
+Download the file ending in `-factory.bin` from [the downloads](/downloads/), put the Cardputer in download mode as above, and write it at offset 0:
+
+```sh
+pip install esptool
+esptool --chip esp32s3 write-flash 0x0 roro9stack-<version>-factory.bin
+```
+
+With esptool 4, the command is `esptool.py --chip esp32s3 write_flash 0x0 …`. On Linux your user needs access to the serial port: `sudo usermod -aG dialout "$USER"`, then log out and back in. The file's SHA-256 is listed above and in the release's `SHA256SUMS`.
+
+## After the first boot
+
+- **Wi-Fi:** Settings → Wi-Fi → add your network.
+- **Updates:** Settings → Firmware shows the latest release and installs it from the project's server, with no computer. It runs the new firmware on Probation and goes back by itself if it doesn't hold.
+- **Something went wrong:** hold G0 while plugging in USB, and flash again. A device that keeps crashing starts in Safe Mode, where Wi-Fi and updates still work.
+
+## Why this page loads from git.twis.la
+
+The flasher asks the project's own Gitea for the latest release and gives the browser that release's factory image. Nothing is copied to this site, and a new release appears here as soon as it exists.
@@ -0,0 +1,75 @@
+# The App cards on the home page. Each says what the firmware does today (docs/milestones/W1.md, Q185):
+# what isn't built is marked planned, with its milestone. `icon` is a cell of static/img/icons-*.svg.
+
+[[app]]
+num = "01"
+tag = "LoRa Scanner"
+title = "See what is on the air"
+text = "Lists every packet it hears with time, RSSI, SNR, sender and hops, reading the Meshtastic header. A Sweep shows signal strength from 863 to 870 MHz. Capture to a pcap for Wireshark."
+fact = "Only listens, never transmits"
+icon = 1
+
+[[app]]
+num = "02"
+tag = "GNSS"
+title = "Find your place in the sky"
+text = "Position and Sky views show where you are and which satellites you can see. Tracks save to the SD card as GPX, and the clock follows the fix."
+fact = "Sky view and GPX Tracks"
+icon = 2
+
+[[app]]
+num = "03"
+tag = "Gemini"
+title = "Browse Geminispace"
+text = "Follow links with Tab and Enter, go Back to where you were, bookmark pages and save them to the SD card to read offline."
+fact = "Certificates trusted on first use"
+icon = 4
+
+[[app]]
+num = "04"
+tag = "IRC"
+title = "Chat from the keyboard"
+text = "Join channels and type commands as you would anywhere, with daily logs written to the SD card."
+fact = "Logs to SD"
+icon = 5
+
+[[app]]
+num = "05"
+tag = "Wi-Fi tools"
+title = "Scan the air for networks"
+text = "See the networks around you, sort and filter the list, and log scans to a CSV file on the SD card."
+fact = "Scans log to CSV"
+icon = 3
+
+[[app]]
+num = "06"
+tag = "Notes"
+title = "Write it down"
+text = "Keep plain text notes on the SD card. There is no save key: the editor writes five seconds after you stop typing, through a temporary file, so a power cut never costs the note."
+fact = "Plain .txt files in /notes"
+icon = 6
+
+[[app]]
+num = "07"
+tag = "Storage"
+title = "Manage the SD card"
+text = "Browse, copy, cut, rename and delete with a clipboard. Copies run in the background and Back cancels one. Opens text, hex, captures, tracks and update files."
+fact = "Checks every copy by size"
+icon = 8
+
+[[app]]
+num = "08"
+tag = "System"
+title = "Watch it think"
+text = "Per-core load, every task and its spare stack, free heap, network traffic, battery and chip temperature, live."
+fact = "Live and read-only"
+icon = 7
+
+[[app]]
+num = "09"
+tag = "Planned"
+title = "A mesh messenger"
+text = "Sending and reading messages on a Meshtastic-compatible mesh. The radio listens today, in the LoRa Scanner; transmitting is the next step and waits for a second node to test with."
+fact = "Milestones M4 and M5 · not built yet"
+icon = 0
+planned = true
@@ -0,0 +1,40 @@
+# Real screenshots (the Debug Console's `screenshot` command, 240 x 135 pixels, shown at twice that).
+[[screen]]
+file = "sweep.png"
+alt = "The LoRa Scanner's Sweep view: bars of signal strength from 863.0 to 870.0 MHz with peak marks, a waterfall under them, and a footer reading floor -100, 863.2 MHz at -89 dBm"
+caption = "LoRa Scanner, Sweep"
+
+[[screen]]
+file = "sniffer.png"
+alt = "The LoRa Scanner's packet list on LongFast 869.525 MHz while a Capture is recording: three packets, each with its time, RSSI, SNR and Meshtastic sender and hops"
+caption = "LoRa Scanner, packets"
+
+[[screen]]
+file = "sky.png"
+alt = "The GNSS App's sky view: a circle with the satellites of four constellations as coloured dots, and a legend counting them: GPS 7 of 10, GLONASS 5 of 5, Galileo 1 of 1, BeiDou 4 of 5, 3D Fix"
+caption = "GNSS, sky"
+
+[[screen]]
+file = "gemini.png"
+alt = "The Gemini App on the page Project Gemini at geminiprotocol.net: a heading, then the start of the text, Gemini in 100 words"
+caption = "Gemini"
+
+[[screen]]
+file = "system.png"
+alt = "The System App's overview: Core 0 at 47 percent, Core 1 at 64 percent, memory 49 KB free, network, battery 97 percent, uptime, and a graph of both cores over two minutes"
+caption = "System"
+
+[[screen]]
+file = "notes.png"
+alt = "The Notes editor on shopping-list.txt, 66 bytes, saved: Shopping list, milk, and a longer line that wraps on the screen"
+caption = "Notes"
+
+[[screen]]
+file = "storage.png"
+alt = "The Storage App at the top of the SD card: the folders captures, gemini, gnss, irc, updates and wifi, and a Maintenance row, with 7.3 GB free"
+caption = "Storage"
+
+[[screen]]
+file = "update.png"
+alt = "The full-screen progress of a firmware update: Receiving v0.10.0, a bar at 28 percent"
+caption = "A firmware update"
@@ -0,0 +1,6 @@
+# Security contact for roro9stack.net and the roro9stack firmware (RFC 9116).
+# Please report vulnerabilities privately by email, not in the public issue tracker.
+Contact: mailto:contact@roro9stack.net
+Expires: 2027-09-30T00:00:00.000Z
+Preferred-Languages: en, fr
+Canonical: https://roro9stack.net/.well-known/security.txt
@@ -0,0 +1,234 @@
+/* roro9stack.net: the tokens and shapes of the design (docs/milestones/W1.md). Every colour is on the
+   device's RGB332 grid. Dark is the default; a visitor who prefers light gets light, and the switch
+   in the header overrides both. */
+
+@font-face { font-family: "DM Mono"; src: url(/fonts/DMMono-Regular.woff2) format("woff2"); font-weight: 400; font-style: normal; font-display: swap; }
+@font-face { font-family: "DM Mono"; src: url(/fonts/DMMono-Medium.woff2) format("woff2"); font-weight: 500; font-style: normal; font-display: swap; }
+@font-face { font-family: "Hanken Grotesk"; src: url(/fonts/HankenGrotesk.woff2) format("woff2"); font-weight: 100 900; font-style: normal; font-display: swap; }
+
+:root {
+  --mono: "DM Mono", ui-monospace, "SFMono-Regular", Menlo, Consolas, monospace;
+  --sans: "Hanken Grotesk", system-ui, -apple-system, "Segoe UI", sans-serif;
+
+  color-scheme: dark;
+  --s1: #494955; --s2: #000000; --s3: #6d6d55; --line: #6d6d55; --ls: #b6b6aa;
+  --ink: #ffffff; --muted: #b6dbff;
+  --cyan: #00dbff; --onfill: #000055; --cyandeep: #00dbff; --cyantext: #00dbff;
+  --mag: #ff00ff; --magtext: #ff92ff; --orange: #ff9200; --orangetext: #ffb655;
+  --icons: url(/img/icons-dark.svg);
+  --logo-dark: block; --logo-light: none;
+}
+@media (prefers-color-scheme: light) {
+  :root:not([data-theme="dark"]) {
+    color-scheme: light;
+    --s1: #ffffff; --s2: #dbffff; --s3: #b6dbff; --line: #92b6ff; --ls: #6d6daa;
+    --ink: #000055; --muted: #4949aa;
+    --cyandeep: #0092aa; --cyantext: #006daa; --magtext: #b600aa; --orangetext: #b64900;
+    --icons: url(/img/icons-light.svg);
+    --logo-dark: none; --logo-light: block;
+  }
+}
+:root[data-theme="light"] {
+  color-scheme: light;
+  --s1: #ffffff; --s2: #dbffff; --s3: #b6dbff; --line: #92b6ff; --ls: #6d6daa;
+  --ink: #000055; --muted: #4949aa;
+  --cyandeep: #0092aa; --cyantext: #006daa; --magtext: #b600aa; --orangetext: #b64900;
+  --icons: url(/img/icons-light.svg);
+  --logo-dark: none; --logo-light: block;
+}
+
+* { box-sizing: border-box; }
+html { -webkit-text-size-adjust: 100%; scroll-behavior: smooth; }
+@media (prefers-reduced-motion: reduce) { html { scroll-behavior: auto; } }
+body { margin: 0; background: var(--s1); color: var(--ink); font: 400 16px/24px var(--sans); }
+a { color: inherit; text-decoration: none; }
+a:hover { text-decoration: underline; text-underline-offset: 4px; }
+img { max-width: 100%; height: auto; }
+h1, h2, h3, p, ul, ol, figure, dl, dd { margin: 0; }
+ul, ol { padding: 0; list-style: none; }
+
+/* A focus ring must show. clip-path clips an outline along with everything else outside the shape,
+   so a focused notched control drops its notches and shows square corners and its ring. */
+:focus-visible { outline: 2px solid var(--cyandeep); outline-offset: 2px; }
+.n-sm:focus-visible, .n-md:focus-visible, .n-lg:focus-visible { clip-path: none; }
+
+.skip { position: absolute; left: 8px; top: -60px; z-index: 10; background: var(--cyan); color: var(--onfill); padding: 12px 16px; font: 500 14px/20px var(--mono); }
+.skip:focus { top: 8px; }
+
+/* Notched corners: whole steps on a 4px grid (the device draws no curves). */
+.n-sm { clip-path: polygon(0 4px,4px 4px,4px 0,calc(100% - 4px) 0,calc(100% - 4px) 4px,100% 4px,100% calc(100% - 4px),calc(100% - 4px) calc(100% - 4px),calc(100% - 4px) 100%,4px 100%,4px calc(100% - 4px),0 calc(100% - 4px)); }
+.n-md { clip-path: polygon(0 8px,4px 8px,4px 4px,8px 4px,8px 0,calc(100% - 8px) 0,calc(100% - 8px) 4px,calc(100% - 4px) 4px,calc(100% - 4px) 8px,100% 8px,100% calc(100% - 8px),calc(100% - 4px) calc(100% - 8px),calc(100% - 4px) calc(100% - 4px),calc(100% - 8px) calc(100% - 4px),calc(100% - 8px) 100%,8px 100%,8px calc(100% - 4px),4px calc(100% - 4px),4px calc(100% - 8px),0 calc(100% - 8px)); }
+.n-lg { clip-path: polygon(0 16px,8px 16px,8px 8px,16px 8px,16px 0,calc(100% - 16px) 0,calc(100% - 16px) 8px,calc(100% - 8px) 8px,calc(100% - 8px) 16px,100% 16px,100% calc(100% - 16px),calc(100% - 8px) calc(100% - 16px),calc(100% - 8px) calc(100% - 8px),calc(100% - 16px) calc(100% - 8px),calc(100% - 16px) 100%,16px 100%,16px calc(100% - 8px),8px calc(100% - 8px),8px calc(100% - 16px),0 calc(100% - 16px)); }
+
+.wrap { width: 100%; max-width: 1200px; margin: 0 auto; padding-left: 32px; padding-right: 32px; }
+.mono { font-family: var(--mono); }
+
+/* Header */
+.bar { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 16px; padding-top: 24px; padding-bottom: 24px; }
+.brand { display: flex; align-items: center; min-height: 44px; }
+.logo { height: 28px; width: auto; }
+.logo-dark { display: var(--logo-dark); }
+.logo-light { display: var(--logo-light); }
+.bar nav { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
+.bar nav a, .link-btn { display: inline-flex; align-items: center; min-height: 44px; padding: 0 12px; font: 400 14px/20px var(--mono); }
+.link-btn { background: none; border: 0; color: inherit; cursor: pointer; }
+.link-btn:hover { text-decoration: underline; text-underline-offset: 4px; }
+.js-only { display: none; }
+.js .js-only { display: inline-flex; }
+
+/* Buttons */
+.btn { display: inline-flex; align-items: center; justify-content: center; min-height: 48px; padding: 0 24px; font: 500 14px/20px var(--mono); border: 0; cursor: pointer; }
+.btn:hover { text-decoration: none; filter: brightness(1.08); }
+.btn-primary { background: var(--cyan); color: var(--onfill); }
+.btn-secondary { background: var(--s2); color: var(--ink); }
+.bar nav a.btn { min-height: 44px; padding: 0 20px; }
+.bar nav a.btn:hover { text-decoration: none; }
+
+/* Type */
+.eyebrow { font: 500 12px/16px var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--cyantext); }
+.eyebrow-row { display: flex; align-items: center; gap: 8px; }
+.eyebrow .v { text-transform: none; }
+.dot { width: 8px; height: 8px; background: var(--cyan); flex: none; }
+h1, h2 { font-family: var(--mono); font-weight: 500; }
+h1 { font-size: 64px; line-height: 64px; letter-spacing: -.02em; }
+h2 { font-size: 40px; line-height: 44px; letter-spacing: -.01em; }
+h3 { font-size: 24px; line-height: 30px; font-weight: 600; }
+.accent { color: var(--cyantext); }
+.lead { font-size: 18px; line-height: 28px; max-width: 520px; }
+.muted { color: var(--muted); }
+.small { font-size: 14px; line-height: 20px; }
+.caption { font: 400 12px/16px var(--mono); color: var(--muted); }
+code, .code { font-family: var(--mono); font-size: .9em; }
+
+section { padding-top: 64px; padding-bottom: 64px; }
+.section-head { display: flex; flex-direction: column; gap: 12px; max-width: 680px; }
+.stack { display: flex; flex-direction: column; gap: 24px; }
+
+/* Hero */
+.hero { padding-top: 48px; padding-bottom: 32px; display: flex; flex-direction: column; gap: 48px; }
+.hero-grid { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 32px 56px; }
+.hero-grid > div { flex: 1 1 360px; min-width: 0; display: flex; flex-direction: column; gap: 24px; }
+.hero-grid > div:first-child { flex-basis: 480px; }
+.actions { display: flex; flex-wrap: wrap; gap: 16px; }
+.facts { display: flex; flex-wrap: wrap; gap: 8px 24px; }
+.facts li { display: flex; align-items: center; gap: 8px; font: 400 14px/20px var(--mono); color: var(--muted); }
+.facts li::before { content: ""; width: 8px; height: 8px; background: var(--mag); display: block; }
+.slab { background: var(--cyan); padding: 40px; display: flex; flex-wrap: wrap; gap: 32px; }
+.slab .device { flex: 1 1 440px; min-width: 0; }
+.illustration { display: block; width: 100%; height: auto; }
+.illustration .mono { font-family: var(--mono); }
+.hero .caption { margin-top: -36px; }
+
+/* Panels */
+.panel { background: var(--s2); padding: 32px; }
+.status-box { background: var(--s2); padding: 24px 32px; display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px 24px; }
+.status-box .eyebrow { color: var(--orangetext); }
+.status-box p { flex: 1 1 420px; min-width: 0; }
+.status-box a, .prose a, .steps a, .need a { color: var(--cyantext); text-decoration: underline; text-underline-offset: 4px; }
+
+.need { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 24px; margin-top: 32px; }
+.need li { display: flex; flex-direction: column; gap: 4px; padding-left: 16px; border-left: 4px solid var(--cyan); }
+.need strong { font-weight: 600; }
+.need span { color: var(--muted); }
+
+/* App cards */
+.cards { display: flex; flex-wrap: wrap; gap: 24px; margin-top: 40px; }
+.card { flex: 1 1 320px; min-width: 0; background: var(--s2); padding: 32px; display: flex; flex-direction: column; gap: 16px; }
+.card-top { display: flex; justify-content: space-between; align-items: center; }
+.card .tag { font: 500 12px/16px var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--cyantext); }
+.card .num { font: 500 12px/16px var(--mono); letter-spacing: .08em; color: var(--muted); }
+.card p { color: var(--muted); }
+.card .fact { margin-top: auto; padding-top: 8px; display: flex; align-items: center; gap: 8px; font: 500 12px/16px var(--mono); letter-spacing: .04em; }
+.card .fact::before { content: ""; width: 8px; height: 8px; background: var(--cyan); flex: none; }
+.card.planned .tag { color: var(--orangetext); }
+.card.planned .fact::before { background: var(--orange); }
+.ic { width: 48px; height: 48px; flex: none; background-image: var(--icons); background-repeat: no-repeat; background-size: 144px 192px; image-rendering: pixelated; }
+.i0 { background-position: 0 0; } .i1 { background-position: -48px 0; } .i2 { background-position: -96px 0; }
+.i3 { background-position: 0 -48px; } .i4 { background-position: -48px -48px; } .i5 { background-position: -96px -48px; }
+.i6 { background-position: 0 -96px; } .i7 { background-position: -48px -96px; } .i8 { background-position: -96px -96px; }
+.i9 { background-position: 0 -144px; }
+.cards-note { margin-top: 24px; font-size: 14px; line-height: 20px; color: var(--muted); }
+
+/* Real screenshots */
+.shots { display: grid; grid-template-columns: repeat(auto-fill, minmax(260px, 1fr)); gap: 24px; margin-top: 40px; }
+.shot { background: var(--s2); padding: 16px; display: flex; flex-direction: column; gap: 12px; }
+.shot img { display: block; width: 100%; height: auto; }  /* shown at about half size: smoothed, not pixel-doubled */
+.shot figcaption { font: 500 12px/16px var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--muted); }
+
+/* Updates */
+.split { display: flex; flex-wrap: wrap; gap: 48px; }
+.split > div { flex: 1 1 380px; min-width: 0; display: flex; flex-direction: column; gap: 24px; }
+.split > .aside { flex-basis: 420px; justify-content: center; gap: 32px; }
+.updates { background: var(--s2); padding: 48px; }
+.terminal { background: var(--s1); padding: 16px 20px; font: 400 14px/20px var(--mono); overflow-x: auto; white-space: pre; }
+.terminal .p { color: var(--cyantext); }
+.terminal .c { color: var(--muted); }
+.num-row { display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px 24px; }
+.num-row .big { flex: none; min-width: 160px; font: 500 64px/64px var(--mono); letter-spacing: -.02em; }
+.num-row p { flex: 1 1 200px; min-width: 0; color: var(--muted); }
+.big.c1 { color: var(--cyantext); } .big.c2 { color: var(--magtext); }
+.split > .blocks { display: flex; flex-direction: column; gap: 4px; background: var(--s2); padding: 32px; font: 400 14px/20px var(--mono); overflow-x: auto; white-space: pre; }
+.split > .blocks .gap { height: 16px; }
+.split > .blocks .c { color: var(--muted); }
+.split > .blocks .p { color: var(--cyantext); }
+
+/* Call to action */
+.cta { background: var(--cyan); color: var(--onfill); padding: 48px; display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 40px; }
+.cta > div:not(.nine) { flex: 1 1 360px; min-width: 0; display: flex; flex-direction: column; gap: 20px; }
+.cta p { font-size: 18px; line-height: 28px; max-width: 480px; }
+.cta .btn { background: #000055; color: #ffffff; }
+.nine { display: grid; grid-template-columns: repeat(5, 24px); gap: 4px; }
+.nine i { display: block; width: 24px; height: 24px; }
+.nine i.on { background: var(--s1); }
+
+/* Footer */
+footer .wrap { padding-top: 32px; padding-bottom: 64px; display: flex; flex-direction: column; gap: 24px; }
+.foot-row { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 16px; }
+.foot-row span, footer small { font: 400 14px/20px var(--mono); color: var(--muted); }
+footer nav { display: flex; flex-wrap: wrap; gap: 8px; }
+footer nav a { display: inline-flex; align-items: center; min-height: 44px; padding: 0 12px; font: 400 14px/20px var(--mono); }
+footer small { display: block; max-width: 760px; }
+
+/* Pages: Install, Downloads, 404 */
+.page { padding-top: 32px; padding-bottom: 64px; display: flex; flex-direction: column; gap: 40px; }
+.page h1 { font-size: 48px; line-height: 52px; }
+.page h2 { font-size: 32px; line-height: 36px; }
+.prose { max-width: 720px; display: flex; flex-direction: column; gap: 16px; }
+.prose h2 { margin-top: 24px; }
+.prose ul { list-style: disc; padding-left: 24px; display: flex; flex-direction: column; gap: 8px; }
+.prose ol, .steps { list-style: decimal; padding-left: 24px; display: flex; flex-direction: column; gap: 12px; }
+.prose pre { margin: 0; padding: 16px 20px; background: var(--s2); font: 400 14px/20px var(--mono); overflow-x: auto; clip-path: polygon(0 8px,4px 8px,4px 4px,8px 4px,8px 0,calc(100% - 8px) 0,calc(100% - 8px) 4px,calc(100% - 4px) 4px,calc(100% - 4px) 8px,100% 8px,100% calc(100% - 8px),calc(100% - 4px) calc(100% - 8px),calc(100% - 4px) calc(100% - 4px),calc(100% - 8px) calc(100% - 4px),calc(100% - 8px) 100%,8px 100%,8px calc(100% - 4px),4px calc(100% - 4px),4px calc(100% - 8px),0 calc(100% - 8px)); }
+.prose pre code { font-size: 14px; }
+.prose :not(pre) > code { background: var(--s2); padding: 0 6px; }
+.prose table { border-collapse: collapse; width: 100%; }
+.prose th, .prose td { text-align: left; padding: 8px 12px; border-bottom: 1px solid var(--line); vertical-align: top; }
+
+.flasher { background: var(--s2); padding: 32px; display: flex; flex-direction: column; gap: 20px; max-width: 720px; }
+.flasher dl { display: grid; grid-template-columns: max-content 1fr; gap: 4px 20px; font: 400 14px/20px var(--mono); }
+.flasher dt { color: var(--muted); }
+.flasher dd { overflow-wrap: anywhere; }
+.flasher [hidden] { display: none !important; }
+.flasher .msg { color: var(--orangetext); }
+.hash { word-break: break-all; }
+
+.releases { display: flex; flex-direction: column; gap: 24px; }
+.release { background: var(--s2); padding: 24px 32px; display: flex; flex-direction: column; gap: 12px; max-width: 880px; }
+.release h2 { font-size: 28px; line-height: 32px; }
+.release .meta { font: 400 14px/20px var(--mono); color: var(--muted); }
+.release .files { display: flex; flex-wrap: wrap; gap: 8px 20px; font: 400 14px/20px var(--mono); }
+.release .files a { color: var(--cyantext); text-decoration: underline; text-underline-offset: 4px; }
+
+@media (max-width: 720px) {
+  h1 { font-size: 40px; line-height: 44px; }
+  h2 { font-size: 32px; line-height: 36px; }
+  .wrap { padding-left: 20px; padding-right: 20px; }
+  section { padding-top: 48px; padding-bottom: 48px; }
+  .slab, .updates, .cta { padding: 24px; }
+  .panel, .card { padding: 24px; }
+  .hero .caption { margin-top: -24px; }
+  .num-row .big { font-size: 48px; line-height: 48px; min-width: 120px; }
+}
+
+.accent-link { color: var(--cyantext); text-decoration: underline; text-underline-offset: 4px; }
+.page > header { display: flex; flex-direction: column; gap: 12px; }
+.page .lead { max-width: 720px; }
@@ -0,0 +1,93 @@
+Copyright 2020 The DM Mono Project Authors (https://www.github.com/googlefonts/dm-mono)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
@@ -0,0 +1,94 @@
+Copyright 2021 The Hanken Grotesk Project Authors (https://github.com/marcologous/hanken-grotesk)
+
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
@@ -0,0 +1,213 @@
+/*
+ * theme "nord" generated by giallo
+ */
+
+.z-code {
+  color: #D8DEE9;
+  background-color: #2E3440;
+}
+
+.z-hl {
+  background-color: #3B4252;
+}
+
+.giallo-ln {
+  color: #4C566A;
+}
+
+.z-emphasis { font-style: italic; }
+.z-strong { font-weight: bold; }
+.z-comment { color: #616E88; }
+.z-keyword { color: #81A1C1; }
+.z-punctuation { color: #ECEFF4; }
+.z-storage { color: #81A1C1; }
+.z-string { color: #A3BE8C; }
+.z-punctuation { color: #5E81AC; }
+.z-constant.z-character { color: #EBCB8B; }
+.z-constant.z-language { color: #81A1C1; }
+.z-constant.z-numeric { color: #B48EAD; }
+.z-constant.z-regexp { color: #EBCB8B; }
+.z-invalid.z-deprecated { color: #D8DEE9; background-color: #EBCB8B; }
+.z-invalid.z-illegal { color: #D8DEE9; background-color: #BF616A; }
+.z-keyword.z-operator { color: #81A1C1; }
+.z-markup.z-bold { font-weight: bold; }
+.z-markup.z-changed { color: #EBCB8B; }
+.z-markup.z-deleted { color: #BF616A; }
+.z-markup.z-inserted { color: #A3BE8C; }
+.z-meta.z-preprocessor { color: #5E81AC; }
+.z-punctuation.z-section { color: #ECEFF4; }
+.z-punctuation.z-terminator { color: #81A1C1; }
+.z-string.z-regexp { color: #EBCB8B; }
+.z-support.z-class { color: #8FBCBB; }
+.z-support.z-constant { color: #81A1C1; }
+.z-support.z-function { color: #88C0D0; }
+.z-support.z-type { color: #8FBCBB; }
+.z-token.z-debug-token { color: #B48EAD; }
+.z-token.z-error-token { color: #BF616A; }
+.z-token.z-info-token { color: #88C0D0; }
+.z-token.z-warn-token { color: #EBCB8B; }
+.z-variable.z-other { color: #D8DEE9; }
+.z-variable.z-language { color: #81A1C1; }
+.z-variable.z-parameter { color: #D8DEE9; }
+.z-markup.z-heading { color: #88C0D0; }
+.z-meta.z-property-value { color: #88C0D0; }
+.z-constant.z-other { color: #D8DEE9; }
+.z-storage.z-type { color: #8FBCBB; }
+.z-punctuation.z-decorator { color: #D08770; }
+.z-markup.z-italic { font-style: italic; }
+.z-markup.z-quote { color: #616E88; }
+.z-meta.z-function-call { color: #88C0D0; }
+.z-support.z-type { color: #88C0D0; }
+.z-meta.z-attribute { color: #5E81AC; }
+.z-variable.z-interpolation { color: #D8DEE9; font-style: italic; }
+.z-punctuation.z-decorator { color: #D08770; }
+.z-punctuation.z-decorator { color: #D08770; }
+.z-support.z-class { color: #8FBCBB; }
+.z-support.z-type { color: #8FBCBB; }
+.z-support.z-class { color: #8FBCBB; }
+.z-support.z-type { color: #8FBCBB; }
+.z-support.z-variable { color: #D8DEE9; }
+.z-support.z-variable { color: #D8DEE9; }
+.z-meta.z-method { color: #88C0D0; }
+.z-punctuation.z-definition { color: #8FBCBB; }
+.z-support.z-type { color: #D08770; }
+.z-keyword.z-operator { color: #5E81AC; }
+.z-constant.z-character.z-escape { color: #EBCB8B; }
+.z-entity.z-name.z-class { color: #8FBCBB; }
+.z-entity.z-name.z-function { color: #88C0D0; }
+.z-entity.z-name.z-tag { color: #81A1C1; }
+.z-entity.z-other.z-attribute-name { color: #8FBCBB; }
+.z-entity.z-other.z-inherited-class { color: #8FBCBB; font-weight: bold; }
+.z-keyword.z-other.z-new { color: #81A1C1; }
+.z-punctuation.z-definition.z-method-parameters { color: #ECEFF4; }
+.z-punctuation.z-definition.z-function-parameters { color: #ECEFF4; }
+.z-punctuation.z-definition.z-parameters { color: #ECEFF4; }
+.z-punctuation.z-definition.z-tag { color: #81A1C1; }
+.z-punctuation.z-definition.z-comment { color: #616E88; }
+.z-punctuation.z-definition.z-variable { color: #81A1C1; }
+.z-support.z-function.z-construct { color: #81A1C1; }
+.z-support.z-type.z-exception { color: #8FBCBB; }
+.z-meta.z-preprocessor.z-include { color: #8FBCBB; }
+.z-punctuation.z-definition.z-directive { color: #5E81AC; font-weight: bold; }
+.z-punctuation.z-definition.z-directive { color: #5E81AC; font-weight: bold; }
+.z-punctuation.z-definition.z-keyword { color: #81A1C1; }
+.z-support.z-type.z-property-name { color: #D8DEE9; }
+.z-punctuation.z-definition.z-from-file { color: #8FBCBB; }
+.z-punctuation.z-definition.z-range { color: #8FBCBB; }
+.z-punctuation.z-definition.z-separator { color: #81A1C1; }
+.z-keyword.z-other.z-documentation { color: #8FBCBB; }
+.z-storage.z-modifier.z-import { color: #8FBCBB; }
+.z-storage.z-modifier.z-package { color: #8FBCBB; }
+.z-storage.z-type.z-annotation { color: #D08770; }
+.z-storage.z-type.z-generic { color: #8FBCBB; }
+.z-storage.z-type.z-primitive { color: #81A1C1; }
+.z-meta.z-object-literal.z-key { color: #88C0D0; }
+.z-support.z-type.z-primitive { color: #81A1C1; }
+.z-variable.z-other.z-object { color: #D8DEE9; }
+.z-constant.z-other.z-inline-data { color: #D08770; font-style: italic; }
+.z-punctuation.z-definition.z-entity { color: #81A1C1; }
+.z-markup.z-fenced_code.z-block { color: #8FBCBB; }
+.z-markup.z-inline.z-raw { color: #8FBCBB; }
+.z-markup.z-underline.z-link { text-decoration: underline; }
+.z-punctuation.z-definition.z-heading { color: #81A1C1; }
+.z-punctuation.z-definition.z-constant { color: #81A1C1; }
+.z-punctuation.z-definition.z-string { color: #81A1C1; }
+.z-punctuation.z-definition.z-variable { color: #D8DEE9; }
+.z-meta.z-function-call.z-object { color: #88C0D0; }
+.z-meta.z-function-call.z-generic { color: #88C0D0; }
+.z-entity.z-name.z-type { color: #8FBCBB; }
+.z-punctuation.z-definition.z-interpolation { color: #EBCB8B; }
+.z-meta.z-object-literal.z-key { color: #D8DEE9; }
+.z-meta.z-object-literal.z-key { color: #D8DEE9; }
+.z-entity.z-name.z-type { color: #8FBCBB; }
+.z-entity.z-name.z-class { color: #8FBCBB; }
+.z-entity.z-name.z-type { color: #8FBCBB; }
+.z-entity.z-name.z-class { color: #8FBCBB; }
+.z-support.z-constant.z-math { color: #8FBCBB; }
+.z-support.z-constant.z-dom { color: #8FBCBB; }
+.z-support.z-constant.z-json { color: #8FBCBB; }
+.z-support.z-constant.z-math { color: #8FBCBB; }
+.z-support.z-constant.z-dom { color: #8FBCBB; }
+.z-support.z-constant.z-json { color: #8FBCBB; }
+.z-keyword.z-other.z-doctype { color: #5E81AC; }
+.z-string.z-unquoted.z-cdata { color: #D08770; font-style: italic; }
+.z-entity.z-name.z-tag { color: #8FBCBB; }
+.z-punctuation.z-definition.z-keyword { color: #D08770; }
+.z-variable.z-other.z-readwrite { color: #D08770; }
+.z-entity.z-name.z-function { color: #D08770; }
+.z-punctuation.z-definition.z-template-expression { color: #81A1C1; }
+.z-meta.z-method-call.z-with-arguments { color: #ECEFF4; }
+.z-meta.z-brace.z-square { color: #ECEFF4; }
+.z-meta.z-brace.z-round { color: #ECEFF4; }
+.z-meta.z-brace.z-square { color: #ECEFF4; }
+.z-meta.z-brace.z-round { color: #ECEFF4; }
+.z-punctuation.z-definition.z-raw { color: #8FBCBB; }
+.z-entity.z-name.z-function { color: #88C0D0; font-weight: bold; }
+.z-variable.z-other.z-readwrite { color: #D08770; }
+.z-entity.z-name.z-function { color: #D08770; }
+.z-variable.z-other.z-readwrite { color: #D08770; }
+.z-entity.z-name.z-function { color: #D08770; }
+.z-entity.z-name.z-function { color: #88C0D0; }
+.z-entity.z-name.z-function { color: #88C0D0; }
+.z-meta.z-brace.z-square { color: #ECEFF4; }
+.z-meta.z-brace.z-round { color: #ECEFF4; }
+.z-meta.z-brace.z-square { color: #ECEFF4; }
+.z-meta.z-brace.z-round { color: #ECEFF4; }
+.z-entity.z-name.z-tag { color: #5E81AC; }
+.z-punctuation.z-definition.z-string { color: #D08770; font-style: italic; }
+.z-support.z-variable.z-property { color: #D8DEE9; }
+.z-variable.z-other.z-object { color: #D8DEE9; }
+.z-entity.z-name.z-type.z-class { color: #8FBCBB; }
+.z-punctuation.z-end.z-definition.z-comment { color: #616E88; }
+.z-punctuation.z-start.z-definition.z-comment { color: #616E88; }
+.z-punctuation.z-section.z-embedded.z-begin { color: #81A1C1; }
+.z-punctuation.z-section.z-embedded.z-end { color: #81A1C1; }
+.z-punctuation.z-separator.z-pointer-access.z-c { color: #81A1C1; }
+.z-constant.z-other.z-symbol.z-elixir { color: #D8DEE9; font-weight: bold; }
+.z-variable.z-other.z-constant.z-elixir { color: #8FBCBB; }
+.z-keyword.z-control.z-directive.z-conditional { color: #5E81AC; font-weight: bold; }
+.z-keyword.z-control.z-directive.z-conditional { color: #5E81AC; font-weight: bold; }
+.z-constant.z-other.z-color.z-rgb-value { color: #B48EAD; }
+.z-keyword.z-control.z-at-rule.z-media { color: #D08770; }
+.z-meta.z-diff.z-range.z-context { color: #8FBCBB; }
+.z-meta.z-diff.z-header.z-from-file { color: #8FBCBB; }
+.z-constant.z-other.z-placeholder.z-go { color: #EBCB8B; }
+.z-keyword.z-other.z-documentation.z-directive { color: #8FBCBB; }
+.z-keyword.z-other.z-documentation.z-custom { color: #8FBCBB; }
+.z-punctuation.z-definition.z-keyword.z-javadoc { color: #8FBCBB; }
+.z-storage.z-type.z-class.z-jsdoc { color: #8FBCBB; }
+.z-variable.z-other.z-readwrite.z-alias { color: #8FBCBB; }
+.z-constant.z-character.z-entity.z-html { color: #EBCB8B; }
+.z-meta.z-tag.z-sgml.z-doctype { color: #5E81AC; }
+.z-punctuation.z-separator.z-key-value.z-ini { color: #81A1C1; }
+.z-beginning.z-punctuation.z-definition.z-list { color: #81A1C1; }
+.z-beginning.z-punctuation.z-definition.z-quote { color: #8FBCBB; }
+.z-constant.z-character.z-math.z-tex { color: #81A1C1; }
+.z-punctuation.z-definition.z-math.z-begin { color: #5E81AC; }
+.z-punctuation.z-definition.z-math.z-end { color: #5E81AC; }
+.z-punctuation.z-math.z-operator.z-latex { color: #81A1C1; }
+.z-constant.z-other.z-reference.z-link { color: #88C0D0; }
+.z-string.z-other.z-link.z-description { color: #88C0D0; }
+.z-string.z-other.z-link.z-title { color: #88C0D0; }
+.z-entity.z-name.z-function.z-decorator { color: #D08770; }
+.z-variable.z-parameter.z-function.z-language { color: #D8DEE9; }
+.z-entity.z-name.z-type.z-trait { font-weight: bold; }
+.z-entity.z-name.z-tag.z-namespace { color: #8FBCBB; }
+.z-punctuation.z-definition.z-entity.z-html { color: #81A1C1; }
+.z-punctuation.z-quasi.z-element.z-begin { color: #81A1C1; }
+.z-punctuation.z-quasi.z-element.z-end { color: #81A1C1; }
+.z-entity.z-name.z-type.z-module.z-elixir { color: #8FBCBB; }
+.z-variable.z-other.z-readwrite.z-module.z-elixir { color: #D8DEE9; font-weight: bold; }
+.z-string.z-quoted.z-other.z-lt-gt.z-include { color: #8FBCBB; }
+.z-keyword.z-other.z-documentation.z-author.z-javadoc { color: #8FBCBB; }
+.z-keyword.z-other.z-documentation.z-see.z-javadoc { color: #8FBCBB; }
+.z-meta.z-tag.z-template.z-link.z-javadoc { color: #8FBCBB; }
+.z-string.z-other.z-link.z-title.z-javadoc { color: #8FBCBB; }
+.z-meta.z-tag.z-template.z-value.z-javadoc { color: #88C0D0; }
+.z-punctuation.z-definition.z-tag.z-begin.z-javadoc { color: #616E88; }
+.z-punctuation.z-definition.z-tag.z-end.z-javadoc { color: #616E88; }
+.z-entity.z-name.z-section.z-group-title.z-ini { color: #88C0D0; }
+.z-punctuation.z-definition.z-function.z-math.z-tex { color: #88C0D0; }
+.z-punctuation.z-definition.z-interpolation.z-begin.z-bracket.z-curly { color: #81A1C1; }
+.z-punctuation.z-definition.z-interpolation.z-end.z-bracket.z-curly { color: #81A1C1; }
+.z-variable.z-parameter.z-function.z-language.z-special.z-self { color: #81A1C1; }
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 7 7" shape-rendering="crispEdges"><rect width="7" height="7" fill="#000055"/><g fill="#00dbff"><rect x="1" y="0" width="3" height="1"/><rect x="0" y="1" width="1" height="2"/><rect x="4" y="1" width="1" height="5"/><rect x="1" y="3" width="3" height="1"/><rect x="0" y="6" width="3" height="1"/></g></svg>
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-6.0 -78.0 612.0 85.2" role="img" aria-label="roro9stack"><path fill="#ffffff" d="M7.7 0V-9.2H19.8V-37.1Q19.8 -40.4 16.6 -40.4H8.7V-49.6H20.6Q24.7 -49.6 27.3 -47.2Q29.9 -44.9 29.9 -40.7V-39.5H30.4Q31.5 -45.1 35.2 -48Q38.8 -50.8 45.8 -50.8H53.5V-39.6H42.7Q36.8 -39.6 33.6 -35.5Q30.4 -31.4 30.4 -25.7V-9.2H45.8V0Z"></path><path fill="#ffffff" d="M90 1.2Q82.9 1.2 77.3 -2Q71.7 -5.2 68.5 -11.1Q65.3 -16.9 65.3 -24.8Q65.3 -32.7 68.5 -38.6Q71.7 -44.4 77.3 -47.6Q82.9 -50.8 90.1 -50.8Q97.3 -50.8 102.9 -47.6Q108.4 -44.4 111.6 -38.6Q114.7 -32.7 114.7 -24.8Q114.7 -16.9 111.5 -11.1Q108.3 -5.2 102.8 -2Q97.2 1.2 90 1.2ZM90 -8.9Q93.8 -8.9 97 -10.6Q100.2 -12.3 102.2 -15.9Q104.1 -19.4 104.1 -24.8Q104.1 -30.3 102.2 -33.8Q100.2 -37.3 97.1 -39Q93.9 -40.7 90.1 -40.7Q86.3 -40.7 83.1 -39Q79.9 -37.3 78 -33.8Q76 -30.3 76 -24.8Q76 -16.6 80.2 -12.8Q84.3 -8.9 90 -8.9Z"></path><path fill="#ffffff" d="M127.7 0V-9.2H139.8V-37.1Q139.8 -40.4 136.6 -40.4H128.7V-49.6H140.6Q144.7 -49.6 147.3 -47.2Q149.9 -44.9 149.9 -40.7V-39.5H150.4Q151.5 -45.1 155.2 -48Q158.8 -50.8 165.8 -50.8H173.5V-39.6H162.7Q156.8 -39.6 153.6 -35.5Q150.4 -31.4 150.4 -25.7V-9.2H165.8V0Z"></path><path fill="#ffffff" d="M210 1.2Q202.9 1.2 197.3 -2Q191.7 -5.2 188.5 -11.1Q185.3 -16.9 185.3 -24.8Q185.3 -32.7 188.5 -38.6Q191.7 -44.4 197.3 -47.6Q202.9 -50.8 210.1 -50.8Q217.3 -50.8 222.9 -47.6Q228.4 -44.4 231.6 -38.6Q234.7 -32.7 234.7 -24.8Q234.7 -16.9 231.5 -11.1Q228.3 -5.2 222.8 -2Q217.2 1.2 210 1.2ZM210 -8.9Q213.8 -8.9 217 -10.6Q220.2 -12.3 222.1 -15.9Q224.1 -19.4 224.1 -24.8Q224.1 -30.3 222.1 -33.8Q220.2 -37.3 217.1 -39Q213.9 -40.7 210.1 -40.7Q206.3 -40.7 203.1 -39Q199.9 -37.3 197.9 -33.8Q196 -30.3 196 -24.8Q196 -16.6 200.2 -12.8Q204.3 -8.9 210 -8.9Z"></path><path fill="#00dbff" d="M268.7 1.2Q262.1 1.2 257.1 -1.4Q252.1 -4 249.1 -8.4Q246.1 -12.9 245.5 -18.5H255.7Q256.7 -13.8 260.1 -11.1Q263.5 -8.4 268.7 -8.4Q276 -8.4 280.5 -14.8Q285 -21.1 285.7 -34.6H285Q282.5 -30.4 278.6 -27.7Q274.7 -25 267.5 -25Q261.5 -25 256.5 -27.9Q251.5 -30.7 248.5 -35.8Q245.5 -40.9 245.5 -47.6Q245.5 -54 248.4 -59.4Q251.3 -64.7 256.6 -68Q261.8 -71.2 269 -71.2Q278.2 -71.2 284.1 -67.1Q290 -62.9 292.9 -55.4Q295.7 -47.8 295.7 -37.5Q295.7 -25.9 292.5 -17.2Q289.4 -8.5 283.4 -3.6Q277.3 1.2 268.7 1.2ZM269.7 -34.5Q275.9 -34.5 279.6 -38.4Q283.4 -42.2 283.4 -48Q283.4 -53.9 279.6 -57.8Q275.9 -61.6 269.7 -61.6Q263.5 -61.6 259.8 -57.8Q256 -54 256 -48.1Q256 -42.2 259.8 -38.4Q263.5 -34.5 269.7 -34.5Z"></path><path fill="#ffffff" d="M330.4 1.2Q320.6 1.2 314.8 -3.4Q309 -8 308.2 -15.6H319.1Q319.7 -12.1 322.6 -9.9Q325.6 -7.7 330.5 -7.7Q335.2 -7.7 337.8 -9.7Q340.3 -11.6 340.3 -14.2Q340.3 -18 337.2 -19.4Q334.2 -20.8 328.3 -21.5Q323.2 -22.1 319 -23.9Q314.9 -25.6 312.5 -28.7Q310.1 -31.7 310.1 -36.3Q310.1 -42.8 315.2 -46.8Q320.3 -50.8 329.4 -50.8Q338.5 -50.8 343.5 -46.7Q348.5 -42.6 349.3 -35.5H339.1Q338.7 -38.5 336 -40.2Q333.3 -42 329.3 -42Q325.2 -42 322.8 -40.5Q320.4 -38.9 320.4 -36.4Q320.4 -31 332 -29.8Q337.5 -29.2 341.8 -27.8Q346.1 -26.3 348.6 -23.2Q351.1 -20.2 351.1 -14.7Q351.2 -10.2 348.5 -6.6Q345.9 -3 341.2 -0.9Q336.6 1.2 330.4 1.2Z"></path><path fill="#ffffff" d="M395.4 0Q388.1 0 383.8 -3.6Q379.5 -7.1 379.5 -16.2V-40.6H367V-49.6H374.4Q379.5 -49.6 380.4 -54.6L381.9 -62.6H390.1V-49.6H409.7V-40.6H390.1V-16.4Q390.1 -12.5 391.9 -10.9Q393.6 -9.4 397.9 -9.4H409.5V0Z"></path><path fill="#ffffff" d="M445.5 1.2Q439.6 1.2 435.6 -0.9Q431.6 -2.9 429.6 -6.4Q427.6 -9.8 427.6 -13.9Q427.6 -21.2 433 -25.3Q438.3 -29.4 448.1 -29.4H460.9V-30.5Q460.9 -41.7 450.5 -41.7Q446.2 -41.7 443.2 -39.9Q440.3 -38 439.3 -33.9H428.7Q429.5 -41.7 435.4 -46.2Q441.4 -50.8 450.5 -50.8Q461.5 -50.8 466.5 -45.4Q471.5 -40 471.5 -30.5V0H462.5L461.6 -7.3H460.9Q458.7 -3.8 455.4 -1.3Q452.1 1.2 445.5 1.2ZM447.5 -7.7Q454 -7.7 457.2 -11.7Q460.5 -15.6 460.8 -21.7H449.2Q443.5 -21.7 441.1 -19.9Q438.8 -18 438.8 -14.7Q438.8 -11.4 441.1 -9.6Q443.5 -7.7 447.5 -7.7Z"></path><path fill="#ffffff" d="M510.7 1.2Q503.8 1.2 498.4 -2Q492.9 -5.2 489.8 -11.1Q486.7 -16.9 486.7 -24.8Q486.7 -32.7 489.9 -38.5Q493 -44.3 498.4 -47.6Q503.8 -50.8 510.7 -50.8Q520.2 -50.8 526 -46.1Q531.9 -41.3 533.5 -33H522.4Q521.4 -36.6 518.3 -38.7Q515.3 -40.8 510.6 -40.8Q507.2 -40.8 504.1 -39Q501.1 -37.2 499.2 -33.7Q497.4 -30.1 497.4 -24.8Q497.4 -19.6 499.2 -16Q501.1 -12.4 504.1 -10.6Q507.2 -8.7 510.6 -8.7Q515.4 -8.7 518.3 -10.8Q521.2 -12.9 522.4 -16.6H533.5Q531.5 -8.4 525.7 -3.6Q519.9 1.2 510.7 1.2Z"></path><path fill="#ffffff" d="M549.8 0V-72H560.4V-28.8L579.4 -49.6H592.7L572 -27.6V-26.8L595.4 0H582.5L560.4 -25.5V0Z"></path></svg>
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-6.0 -78.0 612.0 85.2" role="img" aria-label="roro9stack"><path fill="#000055" d="M7.7 0V-9.2H19.8V-37.1Q19.8 -40.4 16.6 -40.4H8.7V-49.6H20.6Q24.7 -49.6 27.3 -47.2Q29.9 -44.9 29.9 -40.7V-39.5H30.4Q31.5 -45.1 35.2 -48Q38.8 -50.8 45.8 -50.8H53.5V-39.6H42.7Q36.8 -39.6 33.6 -35.5Q30.4 -31.4 30.4 -25.7V-9.2H45.8V0Z"></path><path fill="#000055" d="M90 1.2Q82.9 1.2 77.3 -2Q71.7 -5.2 68.5 -11.1Q65.3 -16.9 65.3 -24.8Q65.3 -32.7 68.5 -38.6Q71.7 -44.4 77.3 -47.6Q82.9 -50.8 90.1 -50.8Q97.3 -50.8 102.9 -47.6Q108.4 -44.4 111.6 -38.6Q114.7 -32.7 114.7 -24.8Q114.7 -16.9 111.5 -11.1Q108.3 -5.2 102.8 -2Q97.2 1.2 90 1.2ZM90 -8.9Q93.8 -8.9 97 -10.6Q100.2 -12.3 102.2 -15.9Q104.1 -19.4 104.1 -24.8Q104.1 -30.3 102.2 -33.8Q100.2 -37.3 97.1 -39Q93.9 -40.7 90.1 -40.7Q86.3 -40.7 83.1 -39Q79.9 -37.3 78 -33.8Q76 -30.3 76 -24.8Q76 -16.6 80.2 -12.8Q84.3 -8.9 90 -8.9Z"></path><path fill="#000055" d="M127.7 0V-9.2H139.8V-37.1Q139.8 -40.4 136.6 -40.4H128.7V-49.6H140.6Q144.7 -49.6 147.3 -47.2Q149.9 -44.9 149.9 -40.7V-39.5H150.4Q151.5 -45.1 155.2 -48Q158.8 -50.8 165.8 -50.8H173.5V-39.6H162.7Q156.8 -39.6 153.6 -35.5Q150.4 -31.4 150.4 -25.7V-9.2H165.8V0Z"></path><path fill="#000055" d="M210 1.2Q202.9 1.2 197.3 -2Q191.7 -5.2 188.5 -11.1Q185.3 -16.9 185.3 -24.8Q185.3 -32.7 188.5 -38.6Q191.7 -44.4 197.3 -47.6Q202.9 -50.8 210.1 -50.8Q217.3 -50.8 222.9 -47.6Q228.4 -44.4 231.6 -38.6Q234.7 -32.7 234.7 -24.8Q234.7 -16.9 231.5 -11.1Q228.3 -5.2 222.8 -2Q217.2 1.2 210 1.2ZM210 -8.9Q213.8 -8.9 217 -10.6Q220.2 -12.3 222.1 -15.9Q224.1 -19.4 224.1 -24.8Q224.1 -30.3 222.1 -33.8Q220.2 -37.3 217.1 -39Q213.9 -40.7 210.1 -40.7Q206.3 -40.7 203.1 -39Q199.9 -37.3 197.9 -33.8Q196 -30.3 196 -24.8Q196 -16.6 200.2 -12.8Q204.3 -8.9 210 -8.9Z"></path><path fill="#0092aa" d="M268.7 1.2Q262.1 1.2 257.1 -1.4Q252.1 -4 249.1 -8.4Q246.1 -12.9 245.5 -18.5H255.7Q256.7 -13.8 260.1 -11.1Q263.5 -8.4 268.7 -8.4Q276 -8.4 280.5 -14.8Q285 -21.1 285.7 -34.6H285Q282.5 -30.4 278.6 -27.7Q274.7 -25 267.5 -25Q261.5 -25 256.5 -27.9Q251.5 -30.7 248.5 -35.8Q245.5 -40.9 245.5 -47.6Q245.5 -54 248.4 -59.4Q251.3 -64.7 256.6 -68Q261.8 -71.2 269 -71.2Q278.2 -71.2 284.1 -67.1Q290 -62.9 292.9 -55.4Q295.7 -47.8 295.7 -37.5Q295.7 -25.9 292.5 -17.2Q289.4 -8.5 283.4 -3.6Q277.3 1.2 268.7 1.2ZM269.7 -34.5Q275.9 -34.5 279.6 -38.4Q283.4 -42.2 283.4 -48Q283.4 -53.9 279.6 -57.8Q275.9 -61.6 269.7 -61.6Q263.5 -61.6 259.8 -57.8Q256 -54 256 -48.1Q256 -42.2 259.8 -38.4Q263.5 -34.5 269.7 -34.5Z"></path><path fill="#000055" d="M330.4 1.2Q320.6 1.2 314.8 -3.4Q309 -8 308.2 -15.6H319.1Q319.7 -12.1 322.6 -9.9Q325.6 -7.7 330.5 -7.7Q335.2 -7.7 337.8 -9.7Q340.3 -11.6 340.3 -14.2Q340.3 -18 337.2 -19.4Q334.2 -20.8 328.3 -21.5Q323.2 -22.1 319 -23.9Q314.9 -25.6 312.5 -28.7Q310.1 -31.7 310.1 -36.3Q310.1 -42.8 315.2 -46.8Q320.3 -50.8 329.4 -50.8Q338.5 -50.8 343.5 -46.7Q348.5 -42.6 349.3 -35.5H339.1Q338.7 -38.5 336 -40.2Q333.3 -42 329.3 -42Q325.2 -42 322.8 -40.5Q320.4 -38.9 320.4 -36.4Q320.4 -31 332 -29.8Q337.5 -29.2 341.8 -27.8Q346.1 -26.3 348.6 -23.2Q351.1 -20.2 351.1 -14.7Q351.2 -10.2 348.5 -6.6Q345.9 -3 341.2 -0.9Q336.6 1.2 330.4 1.2Z"></path><path fill="#000055" d="M395.4 0Q388.1 0 383.8 -3.6Q379.5 -7.1 379.5 -16.2V-40.6H367V-49.6H374.4Q379.5 -49.6 380.4 -54.6L381.9 -62.6H390.1V-49.6H409.7V-40.6H390.1V-16.4Q390.1 -12.5 391.9 -10.9Q393.6 -9.4 397.9 -9.4H409.5V0Z"></path><path fill="#000055" d="M445.5 1.2Q439.6 1.2 435.6 -0.9Q431.6 -2.9 429.6 -6.4Q427.6 -9.8 427.6 -13.9Q427.6 -21.2 433 -25.3Q438.3 -29.4 448.1 -29.4H460.9V-30.5Q460.9 -41.7 450.5 -41.7Q446.2 -41.7 443.2 -39.9Q440.3 -38 439.3 -33.9H428.7Q429.5 -41.7 435.4 -46.2Q441.4 -50.8 450.5 -50.8Q461.5 -50.8 466.5 -45.4Q471.5 -40 471.5 -30.5V0H462.5L461.6 -7.3H460.9Q458.7 -3.8 455.4 -1.3Q452.1 1.2 445.5 1.2ZM447.5 -7.7Q454 -7.7 457.2 -11.7Q460.5 -15.6 460.8 -21.7H449.2Q443.5 -21.7 441.1 -19.9Q438.8 -18 438.8 -14.7Q438.8 -11.4 441.1 -9.6Q443.5 -7.7 447.5 -7.7Z"></path><path fill="#000055" d="M510.7 1.2Q503.8 1.2 498.4 -2Q492.9 -5.2 489.8 -11.1Q486.7 -16.9 486.7 -24.8Q486.7 -32.7 489.9 -38.5Q493 -44.3 498.4 -47.6Q503.8 -50.8 510.7 -50.8Q520.2 -50.8 526 -46.1Q531.9 -41.3 533.5 -33H522.4Q521.4 -36.6 518.3 -38.7Q515.3 -40.8 510.6 -40.8Q507.2 -40.8 504.1 -39Q501.1 -37.2 499.2 -33.7Q497.4 -30.1 497.4 -24.8Q497.4 -19.6 499.2 -16Q501.1 -12.4 504.1 -10.6Q507.2 -8.7 510.6 -8.7Q515.4 -8.7 518.3 -10.8Q521.2 -12.9 522.4 -16.6H533.5Q531.5 -8.4 525.7 -3.6Q519.9 1.2 510.7 1.2Z"></path><path fill="#000055" d="M549.8 0V-72H560.4V-28.8L579.4 -49.6H592.7L572 -27.6V-26.8L595.4 0H582.5L560.4 -25.5V0Z"></path></svg>
@@ -0,0 +1,69 @@
+// The Install page: asks the project's Gitea for the latest release, and gives ESP Web Tools a
+// manifest for its factory image, built here, so the page offers a new release as soon as it exists
+// and nothing is copied to this site (docs/milestones/W1.md, Q180). Gitea sits behind Caddy, which
+// allows this origin to read the release API and the downloads.
+(function () {
+  var box = document.getElementById("flasher");
+  if (!box) return;
+  var $ = function (id) { return document.getElementById(id); };
+  var status = $("flasher-status");
+  var apiOrigin = new URL(box.dataset.api).origin;
+  var downloads = box.dataset.releasesPath;
+
+  // A network error (which is also what a browser makes of a missing CORS header) and a release this
+  // page won't offer are different things to tell the visitor.
+  function fail(error) {
+    var unreachable = error instanceof TypeError;
+    status.textContent = (unreachable ? "Couldn't reach the release server (" + error.message + ")" : "This page can't offer the latest release (" + error.message + ")") +
+      ". Use the esptool steps below, or take the file from the downloads page.";
+    status.className = "msg";
+  }
+  function human(bytes) {
+    return bytes >= 1048576 ? (bytes / 1048576).toFixed(2) + " MB" : Math.round(bytes / 1024) + " KB";
+  }
+  // Only a download from the project's own server, for this repository, is ever handed to the flasher.
+  function trusted(url) {
+    try {
+      var u = new URL(url);
+      return u.origin === apiOrigin && u.pathname.indexOf(downloads) === 0 && u.pathname.indexOf("..") < 0 && !u.search;
+    } catch (e) { return false; }
+  }
+
+  fetch(box.dataset.api + "/releases/latest", { headers: { Accept: "application/json" } })
+    .then(function (r) {
+      if (!r.ok) throw new Error("answer " + r.status);
+      return r.json();
+    })
+    .then(function (rel) {
+      var assets = rel.assets || [];
+      var bin = assets.filter(function (a) { return /-factory\.bin$/.test(a.name); })[0];
+      if (!bin) throw new Error("the latest release has no factory image");
+      if (!trusted(bin.browser_download_url)) throw new Error("its download isn't on the project's server");
+      var sums = assets.filter(function (a) { return a.name === "SHA256SUMS" && trusted(a.browser_download_url); })[0];
+
+      $("f-version").textContent = rel.tag_name;
+      $("f-size").textContent = human(bin.size);
+      if (rel.html_url) $("f-link").href = rel.html_url;
+      var manifest = {
+        name: "roro9stack",
+        version: rel.tag_name,
+        builds: [{ chipFamily: "ESP32-S3", parts: [{ path: bin.browser_download_url, offset: 0 }] }]
+      };
+      var url = URL.createObjectURL(new Blob([JSON.stringify(manifest)], { type: "application/json" }));
+      var button = $("f-button");
+      button.setAttribute("manifest", url);
+      button.hidden = false;
+      $("flasher-info").hidden = false;
+      status.textContent = "Latest release: " + rel.tag_name + ".";
+
+      if (!sums) { $("f-sha").textContent = "not published"; return; }
+      return fetch(sums.browser_download_url)
+        .then(function (r) { return r.ok ? r.text() : ""; })
+        .then(function (text) {
+          var line = text.split("\n").filter(function (l) { return l.indexOf(bin.name) >= 0; })[0];
+          $("f-sha").textContent = line ? line.split(/\s+/)[0] : "not listed";
+        })
+        .catch(function () { $("f-sha").textContent = "unavailable"; });
+    })
+    .catch(fail);
+})();
@@ -0,0 +1,30 @@
+// The theme switch. Without JavaScript the page follows the visitor's setting (prefers-color-scheme);
+// this adds a button that overrides it, remembered in this browser only.
+(function () {
+  var root = document.documentElement;
+  root.classList.add("js");
+  try {
+    var saved = localStorage.getItem("theme");
+    if (saved === "dark" || saved === "light") root.setAttribute("data-theme", saved);
+  } catch (e) { /* storage blocked: the setting just isn't remembered */ }
+
+  document.addEventListener("DOMContentLoaded", function () {
+    var button = document.getElementById("theme-toggle");
+    if (!button) return;
+    function current() {
+      return root.getAttribute("data-theme") || (window.matchMedia("(prefers-color-scheme: light)").matches ? "light" : "dark");
+    }
+    function show() {
+      var next = current() === "dark" ? "light" : "dark";
+      button.textContent = next === "light" ? "Light" : "Dark";
+      button.setAttribute("aria-label", "Switch to the " + next + " theme");
+    }
+    button.addEventListener("click", function () {
+      var next = current() === "dark" ? "light" : "dark";
+      root.setAttribute("data-theme", next);
+      try { localStorage.setItem("theme", next); } catch (e) { /* see above */ }
+      show();
+    });
+    show();
+  });
+})();
@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://roro9stack.net/sitemap.xml
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -0,0 +1,9 @@
+ESP Web Tools 10.4.0 (https://github.com/esphome/esp-web-tools), Apache-2.0 (see LICENSE),
+vendored so the Install page makes no request to a CDN.
+
+Only the files an ESP32-S3 needs (the Cardputer ADV): install-button.js, its chunks, and the S3
+flasher stub. The other chip families' chunks are loaded only if such a chip is detected, which this
+page's manifest never asks for.
+
+Updating: `npm pack esp-web-tools`, then copy the same set from package/dist/web/ (the chunk file
+names carry a hash and change with the version) and update the references in this README.
@@ -0,0 +1 @@
+import{ESP32ROM as t}from"./esp32-DNPRK0Ay.js";import"./install-dialog-im156JnI.js";import"./styles-sT2V1cOw.js";class i extends t{constructor(){super(...arguments),this.CHIP_NAME="ESP32-S3",this.IMAGE_CHIP_ID=9,this.EFUSE_BASE=1610641408,this.MAC_EFUSE_REG=this.EFUSE_BASE+68,this.EFUSE_BLOCK1_ADDR=this.EFUSE_BASE+68,this.EFUSE_BLOCK2_ADDR=this.EFUSE_BASE+92,this.UART_CLKDIV_REG=1610612756,this.UART_CLKDIV_MASK=1048575,this.UART_DATE_REG_ADDR=1610612864,this.FLASH_WRITE_SIZE=1024,this.BOOTLOADER_FLASH_OFFSET=0,this.SPI_REG_BASE=1610620928,this.SPI_USR_OFFS=24,this.SPI_USR1_OFFS=28,this.SPI_USR2_OFFS=32,this.SPI_MOSI_DLEN_OFFS=36,this.SPI_MISO_DLEN_OFFS=40,this.SPI_W0_OFFS=88,this.USB_RAM_BLOCK=2048,this.UARTDEV_BUF_NO_USB=3,this.UARTDEV_BUF_NO=1070526796,this.IROM_MAP_START=1107296256,this.IROM_MAP_END=1140850688,this.MEMORY_MAP=[[0,65536,"PADDING"],[1006632960,1023410176,"DROM"],[1023410176,1040187392,"EXTRAM_DATA"],[1611653120,1611661312,"RTC_DRAM"],[1070104576,1070596096,"BYTE_ACCESSIBLE"],[1070104576,1077813248,"MEM_INTERNAL"],[1070104576,1070596096,"DRAM"],[1073741824,1073848576,"IROM_MASK"],[1077346304,1077805056,"IRAM"],[1611653120,1611661312,"RTC_IRAM"],[1107296256,1115684864,"IROM"],[1342177280,1342185472,"RTC_DATA"]]}async getChipDescription(t){const i=await this.getMajorChipVersion(t),s=await this.getMinorChipVersion(t);return`${{0:"ESP32-S3 (QFN56)",1:"ESP32-S3-PICO-1 (LGA56)"}[await this.getPkgVersion(t)]||"unknown ESP32-S3"} (revision v${i}.${s})`}async getPkgVersion(t){return await t.readReg(this.EFUSE_BLOCK1_ADDR+12)>>21&7}async getRawMinorChipVersion(t){return((await t.readReg(this.EFUSE_BLOCK1_ADDR+20)>>23&1)<<3)+(await t.readReg(this.EFUSE_BLOCK1_ADDR+12)>>18&7)}async getMinorChipVersion(t){const i=await this.getRawMinorChipVersion(t);return await this.isEco0(t,i)?0:this.getRawMinorChipVersion(t)}async getRawMajorChipVersion(t){return await t.readReg(this.EFUSE_BLOCK1_ADDR+20)>>24&3}async getMajorChipVersion(t){const i=await this.getRawMinorChipVersion(t);return await this.isEco0(t,i)?0:this.getRawMajorChipVersion(t)}async getBlkVersionMajor(t){return await t.readReg(this.EFUSE_BLOCK2_ADDR+16)>>0&3}async getBlkVersionMinor(t){return await t.readReg(this.EFUSE_BLOCK1_ADDR+12)>>24&7}async isEco0(t,i){return 0==(7&i)&&1===await this.getBlkVersionMajor(t)&&1===await this.getBlkVersionMinor(t)}async getFlashCap(t){const i=this.EFUSE_BASE+68+12;return await t.readReg(i)>>27&7}async getFlashVendor(t){const i=this.EFUSE_BASE+68+16;return{1:"XMC",2:"GD",3:"FM",4:"TT",5:"BY"}[await t.readReg(i)>>0&7]||""}async getPsramCap(t){const i=this.EFUSE_BASE+68+16;return await t.readReg(i)>>3&3}async getPsramVendor(t){const i=this.EFUSE_BASE+68+16;return{1:"AP_3v3",2:"AP_1v8"}[await t.readReg(i)>>7&3]||""}async getChipFeatures(t){const i=["Wi-Fi","BLE"],s=await this.getFlashCap(t),e=await this.getFlashVendor(t),a={0:null,1:"Embedded Flash 8MB",2:"Embedded Flash 4MB"}[s],r=void 0!==a?a:"Unknown Embedded Flash";null!==a&&i.push(`${r} (${e})`);const n=await this.getPsramCap(t),_=await this.getPsramVendor(t),h={0:null,1:"Embedded PSRAM 8MB",2:"Embedded PSRAM 2MB"}[n],E=void 0!==h?h:"Unknown Embedded PSRAM";return null!==h&&i.push(`${E} (${_})`),i}async getCrystalFreq(t){return 40}_d2h(t){const i=(+t).toString(16);return 1===i.length?"0"+i:i}async postConnect(t){const i=255&await t.readReg(this.UARTDEV_BUF_NO);t.debug("In _post_connect "+i),i==this.UARTDEV_BUF_NO_USB&&(t.ESP_RAM_BLOCK=this.USB_RAM_BLOCK)}async readMac(t){let i=await t.readReg(this.MAC_EFUSE_REG);i>>>=0;let s=await t.readReg(this.MAC_EFUSE_REG+4);s=s>>>0&65535;const e=new Uint8Array(6);return e[0]=s>>8&255,e[1]=255&s,e[2]=i>>24&255,e[3]=i>>16&255,e[4]=i>>8&255,e[5]=255&i,this._d2h(e[0])+":"+this._d2h(e[1])+":"+this._d2h(e[2])+":"+this._d2h(e[3])+":"+this._d2h(e[4])+":"+this._d2h(e[5])}getEraseSize(t,i){return i}}export{i as ESP32S3ROM};
@@ -0,0 +1,129 @@
+import{w as e,y as t,a as o,_ as i,t as l,i as n,x as a}from"./styles-sT2V1cOw.js";const s=e`
+  <svg
+    version="1.1"
+    id="Capa_1"
+    xmlns="http://www.w3.org/2000/svg"
+    xmlns:xlink="http://www.w3.org/1999/xlink"
+    x="0px"
+    y="0px"
+    viewBox="0 0 510.322 510.322"
+    xml:space="preserve"
+    style="width: 28px; vertical-align: middle;"
+  >
+    <g>
+      <path
+        style="fill:currentColor;"
+        d="M429.064,159.505c0-0.151,0.086-1.057,0.086-1.057c0-75.282-61.261-136.521-136.543-136.521    c-52.244,0-97.867,30.587-120.753,76.339c-11.67-9.081-25.108-15.682-40.273-15.682c-37.166,0-67.387,30.199-67.387,67.387    c0,0,0.453,3.279,0.798,5.824C27.05,168.716,0,203.423,0,244.516c0,25.389,9.901,49.268,27.848,67.171    c17.968,17.99,41.804,27.869,67.193,27.869h130.244v46.83h-54.66l97.694,102.008l95.602-102.008h-54.66v-46.83H419.25    c50.174,0,91.072-40.855,91.072-90.986C510.3,201.827,474.428,164.639,429.064,159.505z M419.207,312.744H309.26v-55.545h-83.975    v55.545H95.019c-18.184,0-35.333-7.075-48.211-19.996c-12.878-12.878-19.953-30.005-19.953-48.189    c0-32.68,23.21-60.808,55.264-66.956l12.511-2.394l-2.092-14.431l-1.488-10.785c0-22.347,18.184-40.51,40.531-40.51    c13.266,0,25.691,6.514,33.305,17.408l15.229,21.873l8.52-25.303c15.013-44.652,56.796-74.656,103.906-74.656    c60.506,0,109.709,49.203,109.709,109.644l-1.337,25.712l15.121,0.302l3.149-0.086c35.419,0,64.216,28.797,64.216,64.216    C483.401,283.969,454.604,312.744,419.207,312.744z"
+      />
+    </g>
+  </svg>
+`;let r=class extends n{render(){const e=(()=>{var e,t;const o=window.navigator.userAgent,i=(null===(t=null===(e=window.navigator)||void 0===e?void 0:e.userAgentData)||void 0===t?void 0:t.platform)||window.navigator.platform;return-1!==["macOS","Macintosh","MacIntel","MacPPC","Mac68K"].indexOf(i)?"Mac OS":-1!==["iPhone","iPad","iPod"].indexOf(i)?"iOS":-1!==["Win32","Win64","Windows","WinCE"].indexOf(i)?"Windows":/Android/.test(o)?"Android":/Linux/.test(i)?"Linux":null})();return a`
+      <ew-dialog open @closed=${this._handleClose}>
+        <div slot="headline">No port selected</div>
+        <div slot="content">
+          <div>
+            If you didn't select a port because you didn't see your device
+            listed, try the following steps:
+          </div>
+          <ol>
+            <li>
+              Make sure that the device is connected to this computer (the one
+              that runs the browser that shows this website)
+            </li>
+            <li>
+              Most devices have a tiny light when it is powered on. If yours has
+              one, make sure it is on.
+            </li>
+            <li>
+              Make sure that the USB cable you use can be used for data and is
+              not a power-only cable.
+            </li>
+            ${"Linux"===e?a`
+                  <li>
+                    If you are using a Linux flavor, make sure that your user is
+                    part of the <code>dialout</code> group so it has permission
+                    to access the device.
+                    <code class="block"
+                      >sudo usermod -a -G dialout YourUserName</code
+                    >
+                    You may need to log out & back in or reboot to activate the
+                    new group access.
+                  </li>
+                `:""}
+            <li>
+              Make sure you have the right drivers installed. Below are the
+              drivers for common chips used in ESP devices:
+              <ul>
+                <li>
+                  CP2102 drivers:
+                  <a
+                    href="https://www.silabs.com/developers/usb-to-uart-bridge-vcp-drivers"
+                    target="_blank"
+                    rel="noopener"
+                    >Windows & Mac</a
+                  >
+                </li>
+                <li>
+                  CH342, CH343, CH9102 drivers:
+                  <a
+                    href="https://www.wch.cn/downloads/CH343SER_ZIP.html"
+                    target="_blank"
+                    rel="noopener"
+                    >Windows</a
+                  >,
+                  <a
+                    href="https://www.wch.cn/downloads/CH34XSER_MAC_ZIP.html"
+                    target="_blank"
+                    rel="noopener"
+                    >Mac</a
+                  >
+                  <br />
+                  (download via blue button with ${s} icon)
+                </li>
+                <li>
+                  CH340, CH341 drivers:
+                  <a
+                    href="https://www.wch.cn/downloads/CH341SER_ZIP.html"
+                    target="_blank"
+                    rel="noopener"
+                    >Windows</a
+                  >,
+                  <a
+                    href="https://www.wch.cn/downloads/CH341SER_MAC_ZIP.html"
+                    target="_blank"
+                    rel="noopener"
+                    >Mac</a
+                  >
+                  <br />
+                  (download via blue button with ${s} icon)
+                </li>
+              </ul>
+            </li>
+          </ol>
+        </div>
+        <div slot="actions">
+          ${this.doTryAgain?a`
+                <ew-text-button @click=${this.close}>Cancel</ew-text-button>
+                <ew-text-button @click=${this.tryAgain}>
+                  Try Again
+                </ew-text-button>
+              `:a`
+                <ew-text-button @click=${this.close}>Close</ew-text-button>
+              `}
+        </div>
+      </ew-dialog>
+    `}tryAgain(){var e;this.close(),null===(e=this.doTryAgain)||void 0===e||e.call(this)}close(){this.shadowRoot.querySelector("ew-dialog").close()}async _handleClose(){this.parentNode.removeChild(this)}};r.styles=[t,o`
+      li + li,
+      li > ul {
+        margin-top: 8px;
+      }
+      ul,
+      ol {
+        margin-bottom: 0;
+        padding-left: 1.5em;
+      }
+      li code.block {
+        display: block;
+        margin: 0.5em 0;
+      }
+    `],r=i([l("ewt-no-port-picked-dialog")],r);const d=async e=>{const t=document.createElement("ewt-no-port-picked-dialog");return t.doTryAgain=e,document.body.append(t),!0};export{d as openNoPortPickedDialog};
@@ -0,0 +1 @@
+const e=async t=>{let o;import("./install-dialog-im156JnI.js").then((function(e){return e.i}));try{o=await navigator.serial.requestPort()}catch(o){return"NotFoundError"===o.name?void import("./index-Dt9w-IG1.js").then((o=>o.openNoPortPickedDialog((()=>e(t))))):void alert(`Error: ${o.message}`)}if(!o)return;try{await o.open({baudRate:115200,bufferSize:8192})}catch(e){return void alert(e.message)}const n=document.createElement("ewt-install-dialog");n.port=o,n.manifestPath=t.manifest||t.getAttribute("manifest"),n.overrides=t.overrides,n.addEventListener("closed",(()=>{o.close()}),{once:!0}),document.body.appendChild(n)};class t extends HTMLElement{connectedCallback(){if(this.renderRoot)return;if(this.renderRoot=this.attachShadow({mode:"open"}),!t.isSupported||!t.isAllowed)return this.toggleAttribute("install-unsupported",!0),void(this.renderRoot.innerHTML=t.isAllowed?"<slot name='unsupported'>Your browser does not support installing things on ESP devices. Use Mozilla Firefox, Google Chrome or Microsoft Edge.</slot>":"<slot name='not-allowed'>You can only install ESP devices on HTTPS websites or on the localhost.</slot>");this.toggleAttribute("install-supported",!0);const o=document.createElement("slot");o.addEventListener("click",(async t=>{t.preventDefault(),e(this)})),o.name="activate";const n=document.createElement("button");if(n.innerText="Connect",o.append(n),"adoptedStyleSheets"in Document.prototype&&"replaceSync"in CSSStyleSheet.prototype){const e=new CSSStyleSheet;e.replaceSync(t.style),this.renderRoot.adoptedStyleSheets=[e]}else{const e=document.createElement("style");e.innerText=t.style,this.renderRoot.append(e)}this.renderRoot.append(o)}}t.isSupported="serial"in navigator,t.isAllowed=window.isSecureContext,t.style='\n  button {\n    position: relative;\n    cursor: pointer;\n    font-size: 14px;\n    font-weight: 500;\n    padding: 10px 24px;\n    color: var(--esp-tools-button-text-color, #fff);\n    background-color: var(--esp-tools-button-color, #03a9f4);\n    border: none;\n    border-radius: var(--esp-tools-button-border-radius, 9999px);\n  }\n  button::before {\n    content: " ";\n    position: absolute;\n    top: 0;\n    bottom: 0;\n    left: 0;\n    right: 0;\n    opacity: 0.2;\n    border-radius: var(--esp-tools-button-border-radius, 9999px);\n  }\n  button:hover::before {\n    background-color: rgba(255,255,255,.8);\n  }\n  button:focus {\n    outline: none;\n  }\n  button:focus::before {\n    background-color: white;\n  }\n  button:active::before {\n    background-color: grey;\n  }\n  :host([active]) button {\n    color: rgba(0, 0, 0, 0.38);\n    background-color: rgba(0, 0, 0, 0.12);\n    box-shadow: none;\n    cursor: unset;\n    pointer-events: none;\n  }\n  .hidden {\n    display: none;\n  }',customElements.define("esp-web-install-button",t);
@@ -0,0 +1,8 @@
+{% extends "base.html" %}
+{% block title %}Not found: roro9stack{% endblock %}
+{% block main %}
+<div class="wrap page">
+  <h1>Not found.</h1>
+  <p class="prose">There's no page here. Try <a href="/">the home page</a>, <a href="/install/">Install</a> or <a href="/downloads/">Downloads</a>.</p>
+</div>
+{% endblock main %}
@@ -0,0 +1,61 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{% block title %}roro9stack: open firmware for the Cardputer ADV{% endblock %}</title>
+<meta name="description" content="{% block description %}{{ config.description }}{% endblock %}">
+<meta name="color-scheme" content="dark light">
+<meta name="author" content="Clément Martin">
+<meta name="copyright" content="© 2026 Clément Martin">
+{% if current_url %}<link rel="canonical" href="{{ current_url }}">{% endif %}
+<link rel="icon" href="/img/favicon.svg" type="image/svg+xml">
+<link rel="icon" href="/favicon.ico" sizes="32x32 48x48">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
+<link rel="preload" href="/fonts/DMMono-Medium.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="preload" href="/fonts/HankenGrotesk.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/css/site.css">
+<script src="/js/theme.js"></script>
+{% block head %}{% endblock %}
+</head>
+<body>
+<a class="skip" href="#main">Skip to the content</a>
+
+<header class="wrap bar">
+  <a class="brand" href="/" aria-label="roro9stack, home">
+    <img class="logo logo-dark" src="/img/logo-dark.svg" alt="roro9stack" width="201" height="28">
+    <img class="logo logo-light" src="/img/logo-light.svg" alt="" width="201" height="28">
+  </a>
+  <nav aria-label="Main">
+    <a href="/#apps">Apps</a>
+    <a href="/install/">Install</a>
+    <a href="/downloads/">Downloads</a>
+    <a href="{{ config.extra.blog }}">Blog</a>
+    <button class="link-btn js-only" id="theme-toggle" type="button">Light</button>
+    <a class="btn btn-primary n-md" href="{{ config.extra.repo }}">Source</a>
+  </nav>
+</header>
+
+<main id="main">
+{% block main %}{% endblock %}
+</main>
+
+<footer>
+  <div class="wrap">
+    <div class="foot-row">
+      <span>© 2026 Clément Martin · Licensed GPL-3.0</span>
+      <nav aria-label="Footer">
+        <a href="{{ config.extra.repo }}">Source</a>
+        <a href="{{ config.extra.repo }}/releases">Releases</a>
+        <a href="{{ config.extra.repo }}/src/branch/main/docs">Docs in the repository</a>
+        <a href="{{ config.extra.repo }}/issues">Issues</a>
+        <a href="{{ config.extra.blog }}">Blog</a>
+        <a href="mailto:{{ config.extra.contact }}">Contact</a>
+      </nav>
+    </div>
+    <small>roro9stack is an independent project. It isn't affiliated with or endorsed by M5Stack or Meshtastic: those names belong to their owners.</small>
+    <small>This site sets no cookies and has no analytics, and its pages load nothing from other sites. The Install page asks the project's own server, git.twis.la, for the latest release. Questions, corrections: <a href="mailto:{{ config.extra.contact }}">{{ config.extra.contact }}</a>, or the issue tracker.</small>
+  </div>
+</footer>
+</body>
+</html>
@@ -0,0 +1,34 @@
+{% extends "base.html" %}
+{% block title %}Downloads: roro9stack{% endblock %}
+{% block description %}{{ page.description }}{% endblock %}
+{% block main %}
+{% set releases = load_data(url=config.extra.api ~ "/releases?limit=30&draft=false&pre-release=false", format="json", required=false) %}
+<div class="wrap page">
+  <header>
+    <span class="eyebrow">Downloads</span>
+    <h1>{{ page.title }}</h1>
+    <p class="lead">{{ page.description }} To put one on a device, <a class="accent-link" href="/install/">install it from your browser</a>.</p>
+  </header>
+
+  <div class="prose">
+    <p>Each release has a <strong>signed update file</strong> (<code>.ota</code>: copy it to <code>/updates</code> on the SD card and install it from Settings → Firmware or the Storage App, or push it over Wi-Fi), a <strong>factory image</strong> (<code>-factory.bin</code>, the whole flash at offset 0 for a first install over USB), the <strong>symbols</strong> (<code>.elf.gz</code>, to decode a crash report) and <code>SHA256SUMS</code>. Debug Builds aren't published.</p>
+  </div>
+
+  {% if releases %}
+  <div class="releases">
+    {% for r in releases %}
+    <article class="release n-md">
+      <h2>{{ r.tag_name }}</h2>
+      <p class="meta">{{ r.published_at | date(format="%Y-%m-%d") }} · <a class="accent-link" href="{{ r.html_url }}">release notes</a></p>
+      <p>{{ r.body | split(pat="\n\n") | first }}</p>
+      <p class="files">
+        {% for a in r.assets %}<a href="{{ a.browser_download_url }}">{{ a.name }}</a> <span class="muted">({{ a.size | filesizeformat }})</span>{% endfor %}
+      </p>
+    </article>
+    {% endfor %}
+  </div>
+  {% else %}
+  <p class="prose">The list of releases couldn't be read when this page was built. They're all on <a class="accent-link" href="{{ config.extra.repo }}/releases">Gitea</a>.</p>
+  {% endif %}
+</div>
+{% endblock main %}
@@ -0,0 +1,139 @@
+{% extends "base.html" %}
+{% block main %}
+{% set latest = load_data(url=config.extra.api ~ "/releases/latest", format="json", required=false) %}
+{% set apps = load_data(path="data/apps.toml", format="toml") %}
+{% set screens = load_data(path="data/screens.toml", format="toml") %}
+{% set px = [0,1,1,1,0, 1,0,0,0,1, 1,0,0,0,1, 0,1,1,1,1, 0,0,0,0,1, 0,0,0,0,1, 0,1,1,1,0] %}
+
+<section class="wrap hero" aria-labelledby="hero-title">
+  <div class="hero-grid">
+    <div>
+      <div class="eyebrow-row"><span class="dot"></span><span class="eyebrow">Open firmware · GPL-3.0{% if latest %} · <span class="v">{{ latest.tag_name }}</span>{% endif %}</span></div>
+      <h1 id="hero-title">Open firmware for a <span class="accent">pocket computer.</span></h1>
+    </div>
+    <div>
+      <p class="lead">roro9stack is firmware for the M5Stack Cardputer ADV with the Cap LoRa-1262: a LoRa scanner that reads Meshtastic traffic, GNSS, IRC, a Gemini browser, Wi-Fi tools, notes and more.</p>
+      <div class="actions">
+        <a class="btn btn-primary n-md" href="/install/">Install{% if latest %} {{ latest.tag_name }}{% endif %}</a>
+        <a class="btn btn-secondary n-md" href="{{ config.extra.repo }}">Read the source</a>
+      </div>
+      <ul class="facts">
+        <li>GPL-3.0</li>
+        <li>Docker-only build</li>
+        <li>Signed updates</li>
+      </ul>
+    </div>
+  </div>
+  <div class="slab n-lg">
+    <div class="device">{% include "illustrations/sweep.html" %}</div>
+    <div class="device">{% include "illustrations/sky.html" %}</div>
+  </div>
+  <p class="caption">Drawings of the LoRa Scanner's Sweep view and the GNSS sky view, not screenshots: the real screens are further down.</p>
+</section>
+
+<section class="wrap" aria-labelledby="status-title">
+  <div class="status-box n-md">
+    <h2 id="status-title" class="eyebrow">Where it stands</h2>
+    <p>Early software{% if latest %}, {{ latest.tag_name }}{% endif %}. The radio listens; it doesn't transmit yet. Sending and reading mesh messages is planned and waits for a second node to test with. <a href="{{ config.extra.repo }}/milestones">The milestones</a> show what's done and what's next.</p>
+  </div>
+</section>
+
+<section class="wrap" id="need" aria-labelledby="need-title">
+  <div class="section-head">
+    <span class="eyebrow">Before you start</span>
+    <h2 id="need-title">What you need.</h2>
+  </div>
+  <ul class="need">
+    <li><strong>An M5Stack Cardputer ADV</strong><span>The handheld the firmware runs on.</span></li>
+    <li><strong>The Cap LoRa-1262</strong><span>The LoRa Scanner and GNSS need it. The other Apps don't use it.</span></li>
+    <li><strong>A microSD card</strong><span>For Notes, Storage, Logs, Captures and Tracks.</span></li>
+    <li><strong>Wi-Fi</strong><span>For IRC, Gemini and updates.</span></li>
+    <li><strong>A computer, for the first install</strong><span>Chrome or Edge, and a USB-C cable. After that the device updates itself.</span></li>
+  </ul>
+</section>
+
+<section class="wrap" id="apps" aria-labelledby="apps-title">
+  <div class="section-head">
+    <span class="eyebrow">What's inside</span>
+    <h2 id="apps-title">Apps for the radio, the web and the card.</h2>
+  </div>
+  <div class="cards">
+    {% for a in apps.app %}
+    <article class="card n-lg{% if a.planned %} planned{% endif %}">
+      <div class="ic i{{ a.icon }}" aria-hidden="true"></div>
+      <div class="card-top"><span class="tag">{{ a.tag }}</span><span class="num">{{ a.num }}</span></div>
+      <h3>{{ a.title }}</h3>
+      <p>{{ a.text }}</p>
+      <span class="fact">{{ a.fact }}</span>
+    </article>
+    {% endfor %}
+  </div>
+  <p class="cards-note">Plus Settings, with its Wi-Fi and Firmware pages.</p>
+</section>
+
+<section class="wrap" id="screens" aria-labelledby="screens-title">
+  <div class="section-head">
+    <span class="eyebrow">On the device</span>
+    <h2 id="screens-title">The real screens.</h2>
+  </div>
+  <div class="shots">
+    {% for s in screens.screen %}
+    <figure class="shot n-md">
+      <img src="/screens/{{ s.file }}" width="480" height="270" alt="{{ s.alt }}" loading="lazy">
+      <figcaption>{{ s.caption }}</figcaption>
+    </figure>
+    {% endfor %}
+  </div>
+</section>
+
+<section class="wrap" id="updates" aria-labelledby="updates-title">
+  <div class="updates n-lg split">
+    <div>
+      <span class="eyebrow">Updates</span>
+      <h2 id="updates-title">Update over Wi-Fi. It rolls back if it fails.</h2>
+      <p class="lead">Install a new release from the project's server in Settings, from the SD card, or push one from your computer. Every update is signed: the device checks the signature before it writes anything, restarts, and runs the new firmware on Probation. If it crashes, or can't reconnect Wi-Fi, it goes back to the previous firmware and says so.</p>
+      <div class="terminal n-md"><span class="p">$</span> scripts/flash.sh --ota 10.39.39.12</div>
+    </div>
+    <div class="aside">
+      <div class="num-row"><span class="big c1">60 s</span><p>The longest the device waits for you to stop typing before it restarts into an update.</p></div>
+      <div class="num-row"><span class="big c2">3 min</span><p>How long new firmware has to reconnect Wi-Fi on Probation before it rolls back.</p></div>
+      <div class="num-row"><span class="big c2">3</span><p>Crash restarts in a row, and it starts in Safe Mode: only Wi-Fi, updates and the Debug Console, so a fix can still be pushed.</p></div>
+    </div>
+  </div>
+</section>
+
+<section class="wrap split" id="build" aria-labelledby="build-title">
+  <div>
+    <span class="eyebrow">Build and flash</span>
+    <h2 id="build-title">Only Docker needed.</h2>
+    <p class="lead">PlatformIO and the ESP32 toolchain run in a container. The first build downloads about 1 GB; after that, builds take under a minute.</p>
+    <p class="muted">If the upload can't connect, hold G0, the button next to the screen, while plugging in USB, then retry.</p>
+    <p>Prefer a ready-made build? <a class="accent-link" href="/install/">Install it from your browser</a>, or take the factory image and the signed update file from <a class="accent-link" href="/downloads/">the downloads</a>.</p>
+  </div>
+  <div class="blocks n-lg">
+    <div class="c"># run the tests, then build</div>
+    <div><span class="p">$</span> scripts/ci.sh</div>
+    <div class="gap"></div>
+    <div class="c"># flash over USB-C</div>
+    <div><span class="p">$</span> scripts/flash.sh</div>
+    <div class="gap"></div>
+    <div class="c"># or update over Wi-Fi</div>
+    <div><span class="p">$</span> scripts/flash.sh --ota 10.39.39.12</div>
+  </div>
+</section>
+
+<section class="wrap" aria-labelledby="cta-title">
+  <div class="cta n-lg">
+    <div>
+      <h2 id="cta-title">Open source, GPL-3.0.</h2>
+      <p>Read the code, flash it, send a patch.</p>
+      <div class="actions">
+        <a class="btn n-md" href="{{ config.extra.repo }}">Source</a>
+        <a class="btn n-md" href="{{ config.extra.repo }}/releases">Releases</a>
+        <a class="btn n-md" href="{{ config.extra.repo }}/issues">Issues</a>
+      </div>
+    </div>
+    <div class="nine" aria-hidden="true">{% for v in px %}<i{% if v == 1 %} class="on"{% endif %}></i>{% endfor %}</div>
+  </div>
+</section>
+{% endblock main %}
@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+{% block title %}Install roro9stack: flash a Cardputer ADV from your browser{% endblock %}
+{% block description %}{{ page.description }}{% endblock %}
+{% block head %}
+<script type="module" src="/vendor/esp-web-tools/install-button.js"></script>
+<script src="/js/install.js" defer></script>
+{% endblock %}
+{% block main %}
+<div class="wrap page">
+  <header>
+    <span class="eyebrow">Install</span>
+    <h1>{{ page.title }}</h1>
+    <p class="lead">{{ page.description }}</p>
+  </header>
+
+  <div class="flasher n-lg" id="flasher" data-api="{{ config.extra.api }}" data-releases-path="/twisla/roro9stack/releases/download/">
+    <h2>Install from your browser</h2>
+    <p id="flasher-status" class="muted" role="status">Looking for the latest release…</p>
+    <dl id="flasher-info" hidden>
+      <dt>Version</dt><dd id="f-version"></dd>
+      <dt>Size</dt><dd id="f-size"></dd>
+      <dt>SHA-256</dt><dd id="f-sha" class="hash"></dd>
+      <dt>Release</dt><dd><a class="accent-link" id="f-link" href="{{ config.extra.repo }}/releases">release notes</a></dd>
+    </dl>
+    <esp-web-install-button id="f-button" hidden>
+      <button slot="activate" class="btn btn-primary n-md" type="button">Install roro9stack</button>
+      <span slot="unsupported" class="msg">This browser can't flash a device. Use Chrome or Edge on a desktop computer, or follow the esptool steps below.</span>
+      <span slot="not-allowed" class="msg">Flashing needs a secure (https) page.</span>
+    </esp-web-install-button>
+    <noscript><p class="msg">Flashing from this page needs JavaScript. Use the esptool steps below.</p></noscript>
+  </div>
+
+  <div class="prose">
+    {{ page.content | safe }}
+  </div>
+</div>
+{% endblock main %}
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Checks a built site (docs/milestones/W1.md): what the pages promise, kept.
+
+Usage: site/tools/check_site.py <built site folder>
+
+- No page loads anything from another origin: no script, stylesheet, image, font, frame or preload
+  from elsewhere (links a visitor follows are fine).
+- Every page has a title, a description and a language, and every image has an alt attribute.
+- Every file a page references on this site exists.
+"""
+import html.parser
+import os
+import re
+import sys
+import urllib.parse
+
+ROOT = sys.argv[1] if len(sys.argv) > 1 else "public"
+HERE = os.path.dirname(os.path.abspath(__file__))
+BASE = re.search(r'base_url\s*=\s*"([^"]+)"', open(os.path.join(HERE, "..", "config.toml")).read()).group(1)
+HOST = urllib.parse.urlparse(BASE).netloc
+
+
+class Page(html.parser.HTMLParser):
+    def __init__(self):
+        super().__init__()
+        self.title = False
+        self.has_title = False
+        self.has_description = False
+        self.lang = None
+        self.loads = []  # (tag, url) of everything the page fetches by itself
+        self.images_without_alt = 0
+
+    def handle_starttag(self, tag, attrs):
+        a = dict(attrs)
+        if tag == "html":
+            self.lang = a.get("lang")
+        if tag == "title":
+            self.title = True
+        if tag == "meta" and a.get("name") == "description" and a.get("content"):
+            self.has_description = True
+        if tag in ("script", "img", "iframe", "frame", "embed", "source", "video", "audio") and a.get("src"):
+            self.loads.append((tag, a["src"]))
+        if tag == "link" and a.get("href") and a.get("rel", "") in ("stylesheet", "preload", "icon", "modulepreload", "prefetch"):
+            self.loads.append(("link " + a["rel"], a["href"]))
+        if tag == "img" and "alt" not in a:
+            self.images_without_alt += 1
+
+    def handle_data(self, data):
+        if self.title and data.strip():
+            self.has_title = True
+
+    def handle_endtag(self, tag):
+        if tag == "title":
+            self.title = False
+
+
+problems = []
+pages = 0
+for folder, _, files in os.walk(ROOT):
+    for name in files:
+        if not name.endswith(".html"):
+            continue
+        path = os.path.join(folder, name)
+        shown = os.path.relpath(path, ROOT)
+        p = Page()
+        p.feed(open(path, encoding="utf-8").read())
+        pages += 1
+        if not p.has_title: problems.append(f"{shown}: no title")
+        if not p.has_description: problems.append(f"{shown}: no description")
+        if not p.lang: problems.append(f"{shown}: no language")
+        if p.images_without_alt: problems.append(f"{shown}: {p.images_without_alt} image(s) without alt")
+        for tag, url in p.loads:
+            u = urllib.parse.urlparse(url)
+            if u.netloc and u.netloc != HOST:
+                problems.append(f"{shown}: {tag} loads {url} from another origin")
+            elif not u.netloc and not u.scheme:
+                target = os.path.join(ROOT, u.path.lstrip("/")) if u.path.startswith("/") else os.path.join(folder, u.path)
+                if u.path and not os.path.exists(target):
+                    problems.append(f"{shown}: {tag} {url} does not exist")
+            elif u.netloc == HOST:
+                target = os.path.join(ROOT, u.path.lstrip("/"))
+                if not os.path.exists(target):
+                    problems.append(f"{shown}: {tag} {url} does not exist")
+
+if not pages:
+    problems.append(f"no pages found in {ROOT}")
+for p in problems:
+    print("site check:", p)
+print(f"site check: {pages} pages, {len(problems)} problem(s)")
+sys.exit(1 if problems else 0)
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Draw the pixel "9" of static/img/favicon.svg as PNGs and an ICO, with the standard library.
+
+    python3 site/tools/make_favicons.py
+
+Writes static/favicon.ico (32 and 48 px, PNG inside) and static/apple-touch-icon.png (180 px).
+The 9 is a 7x7 grid, scaled by a whole number and centred on the background colour."""
+import struct
+import zlib
+from pathlib import Path
+
+BG = (0x00, 0x00, 0x55)
+FG = (0x00, 0xDB, 0xFF)
+# x, y, w, h: the same rectangles as favicon.svg
+RECTS = [(1, 0, 3, 1), (0, 1, 1, 2), (4, 1, 1, 5), (1, 3, 3, 1), (0, 6, 3, 1)]
+GRID = 7
+
+STATIC = Path(__file__).resolve().parent.parent / "static"
+
+
+def cells():
+    on = set()
+    for x, y, w, h in RECTS:
+        on.update((x + i, y + j) for i in range(w) for j in range(h))
+    return on
+
+
+def png(size):
+    scale = size // GRID
+    pad = (size - scale * GRID) // 2
+    on = cells()
+    rows = bytearray()
+    for py in range(size):
+        rows.append(0)
+        for px in range(size):
+            cx, cy = (px - pad) // scale, (py - pad) // scale
+            inside = 0 <= px - pad < scale * GRID and 0 <= py - pad < scale * GRID
+            rows.extend(FG if inside and (cx, cy) in on else BG)
+
+    def chunk(kind, data):
+        body = kind + data
+        return struct.pack(">I", len(data)) + body + struct.pack(">I", zlib.crc32(body))
+
+    return (b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack(">IIBBBBB", size, size, 8, 2, 0, 0, 0)) +
+            chunk(b"IDAT", zlib.compress(bytes(rows), 9)) + chunk(b"IEND", b""))
+
+
+def ico(sizes):
+    images = [png(s) for s in sizes]
+    out = struct.pack("<HHH", 0, 1, len(images))
+    offset = 6 + 16 * len(images)
+    for s, data in zip(sizes, images):
+        out += struct.pack("<BBBBHHII", s, s, 0, 0, 1, 32, len(data), offset)
+        offset += len(data)
+    return out + b"".join(images)
+
+
+if __name__ == "__main__":
+    (STATIC / "favicon.ico").write_bytes(ico([32, 48]))
+    (STATIC / "apple-touch-icon.png").write_bytes(png(180))
+    print("wrote favicon.ico, apple-touch-icon.png")
@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Writes the two illustrations on the home page (templates/illustrations/sweep.html and sky.html, inline SVG for Zola to include).
+
+They are drawings of the LoRa Scanner's Sweep view and the GNSS App's sky view on the Cardputer,
+not screenshots, and the page says so. Every colour is one of the device's own (RGB332). The shapes
+come from a deterministic generator, so running this again gives the same files:
+
+    python3 site/tools/make_illustrations.py
+"""
+import math
+import os
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+OUT = os.path.join(HERE, "..", "templates", "illustrations")
+
+BLACK, SLATE, DIM, CYAN, MAG, WHITE, LABEL, ONFILL = "#000000", "#494955", "#6d6d55", "#00dbff", "#ff00ff", "#ffffff", "#b6dbff", "#000055"
+ORANGE = "#ff9200"
+
+
+def notch(x, y, w, h, n):
+    """A rectangle with its corners cut in two steps of n/2 (the site's .n-sm, .n-md and .n-lg)."""
+    a, b = n, n // 2
+    pts = [(0, a), (b, a), (b, b), (a, b), (a, 0), (w - a, 0), (w - a, b), (w - b, b), (w - b, a), (w, a), (w, h - a),
+           (w - b, h - a), (w - b, h - b), (w - a, h - b), (w - a, h), (a, h), (a, h - b), (b, h - b), (b, h - a), (0, h - a)]
+    return " ".join(f"{x + px:g},{y + py:g}" for px, py in pts)
+
+
+def rnd(n):
+    x = math.sin(n * 127.1 + 311.7) * 43758.5453
+    return x - math.floor(x)
+
+
+def jsround(v):
+    return math.floor(v + 0.5)
+
+
+SOURCES = [(5, 0.72, 0.9), (13.5, 0.58, 1.2), (22, 0.95, 1.0), (27, 0.42, 0.8)]
+
+
+def strength(i, r):
+    s = 0.05 + 0.1 * rnd(i * 7 + r * 13)
+    for k, (c, a, w) in enumerate(SOURCES):
+        if rnd(k * 10 + r) > 0.2:
+            g = math.exp(-((i - c) ** 2) / (2 * w * w))
+            s = max(s, a * g * (0.6 + 0.4 * rnd(i * 3 + r * 5 + k)))
+    return min(s, 1)
+
+
+def frame(parts, label):
+    keys_y = 306
+    kw = (480 - 13 * 4) / 14
+    keys = []
+    for row in range(4):
+        for col in range(14):
+            x, y = 20 + col * (kw + 4), keys_y + row * 26
+            keys.append(f'<polygon points="{notch(x, y, kw, 22, 4)}" fill="{SLATE}"/>')
+    return (
+        f'<svg xmlns="http://www.w3.org/2000/svg" class="illustration" viewBox="0 0 520 426" role="img" aria-label="{label}" shape-rendering="crispEdges">'
+        f'<polygon points="{notch(0, 0, 520, 426, 16)}" fill="{BLACK}"/>'
+        f'<polygon points="{notch(20, 20, 480, 270, 8)}" fill="{SLATE}"/>'
+        + "".join(parts) + "".join(keys) + "</svg>\n"
+    )
+
+
+def label(x, y, text, fill, anchor="start", weight=400, spacing=0.08):
+    return (f'<text x="{x:g}" y="{y:g}" fill="{fill}" text-anchor="{anchor}" font-size="11" font-weight="{weight}" '
+            f'letter-spacing="{spacing}em" class="mono">{text}</text>')
+
+
+def sweep():
+    p = []
+    # Tabs and Status Bar letters
+    p.append(label(40, 44, "SNIFFER", LABEL, weight=500))
+    p.append(f'<rect x="104" y="32" width="54" height="16" fill="{CYAN}"/>')
+    p.append(label(112, 44, "SWEEP", ONFILL, weight=500))
+    p.append(label(488, 44, "CAP", LABEL, "end", 500))
+    p.append(label(457, 44, "SW", CYAN, "end", 500))
+    p.append(label(434, 44, "L", CYAN, "end", 500))
+    # Bars with peak hold
+    p.append(f'<rect x="32" y="60" width="456" height="124" fill="{BLACK}"/>')
+    colw = (448 - 31 * 2) / 32
+    for i in range(32):
+        s = strength(i, 0)
+        h = max(4, jsround(s * 100 / 4) * 4)
+        gap = jsround(rnd(i * 11 + 3) * 3) * 4
+        gap = min(gap, 112 - h - 4 if 112 - h - 4 > 0 else 0)
+        x = 36 + i * (colw + 2)
+        p.append(f'<rect x="{x:.2f}" y="{180 - h}" width="{colw:.2f}" height="{h}" fill="{MAG if s > 0.6 else CYAN}"/>')
+        p.append(f'<rect x="{x:.2f}" y="{180 - h - gap - 4}" width="{colw:.2f}" height="4" fill="{WHITE}"/>')
+    # Waterfall, newest row on top
+    p.append(f'<rect x="32" y="192" width="456" height="66" fill="{BLACK}"/>')
+    for r in range(6):
+        for i in range(32):
+            s = strength(i, r + 1)
+            if s < 0.3:
+                continue
+            color = CYAN if s < 0.6 else MAG if s < 0.85 else WHITE
+            p.append(f'<rect x="{36 + i * (colw + 2):.2f}" y="{196 + r * 10}" width="{colw:.2f}" height="8" fill="{color}"/>')
+    p.append(label(32, 276, "863", LABEL, spacing=0))
+    p.append(label(260, 276, "866.5", LABEL, "middle", spacing=0))
+    p.append(label(488, 276, "870 MHz", LABEL, "end", spacing=0))
+    return frame(p, "Illustration of the Cardputer showing the LoRa Scanner's Sweep view: bars of signal strength from 863 to 870 MHz with peak marks, and a waterfall under them")
+
+
+def sky():
+    p = []
+    p.append(label(32, 44, "GNSS", WHITE, weight=500))
+    p.append(f'<rect x="449.5" y="32" width="38.5" height="16" fill="{CYAN}"/>')
+    p.append(label(457.5, 44, "SKY", ONFILL, weight=500))
+    p.append(label(445.5, 44, "POSITION", LABEL, "end", 500))
+    p.append(f'<rect x="32" y="60" width="456" height="218" fill="{BLACK}"/>')
+    ox, oy, CELL, NC, CC = 48, 86, 5, 33, 16
+    for y in range(NC):
+        for x in range(NC):
+            dx, dy = x - CC, y - CC
+            d = math.sqrt(dx * dx + dy * dy)
+            if any(abs(d - R) <= 0.5 for R in (15, 10, 5)):
+                color = DIM
+            elif (dx == 0 or dy == 0) and d < 15 and abs(dx + dy) % 2 == 0 and d > 0:
+                color = SLATE
+            else:
+                continue
+            p.append(f'<rect x="{ox + x * CELL}" y="{oy + y * CELL}" width="{CELL}" height="{CELL}" fill="{color}"/>')
+    cols = [CYAN, MAG, ORANGE, WHITE]
+    sats = [(20, 70, 0.8, 0), (75, 40, 0.6, 1), (130, 25, 0.35, 2), (160, 60, 0.9, 0), (210, 15, 0.25, 3), (250, 50, 0.7, 1),
+            (290, 30, 0.5, 0), (320, 75, 0.85, 2), (345, 35, 0.55, 1)]
+    for az, el, snr, ci in sats:
+        r = (90 - el) / 90 * 15
+        a = az * math.pi / 180
+        cx, cy = jsround(CC + r * math.sin(a)), jsround(CC - r * math.cos(a))
+        p.append(f'<rect x="{ox + cx * CELL - 4}" y="{oy + cy * CELL - 4}" width="14" height="14" fill="{BLACK}"/>')
+        p.append(f'<rect x="{ox + cx * CELL - 2}" y="{oy + cy * CELL - 2}" width="10" height="10" fill="{cols[ci]}"/>')
+    p.append(label(ox + 82.5, 80, "N", MAG, "middle", 500, 0))
+    p.append(label(ox + 82.5, 265, "S", LABEL, "middle", 500, 0))
+    p.append(label(ox - 14, 172, "W", LABEL, "start", 500, 0))
+    p.append(label(ox + 165 + 14, 172, "E", LABEL, "end", 500, 0))
+    # Signal strength of each satellite
+    p.append(label(237, 107, "SNR", LABEL, weight=500))
+    bw = (235 - 8 * 6) / 9
+    for i, (az, el, snr, ci) in enumerate(sats):
+        h = max(8, jsround(snr * 124 / 4) * 4)
+        p.append(f'<rect x="{237 + i * (bw + 6):.2f}" y="{243 - h}" width="{bw:.2f}" height="{h}" fill="{cols[ci]}"/>')
+    return frame(p, "Illustration of the GNSS App's sky view: the satellites' positions in a circle, and the signal strength of each as a bar")
+
+
+if __name__ == "__main__":
+    os.makedirs(OUT, exist_ok=True)
+    for name, svg in (("sweep.html", sweep()), ("sky.html", sky())):
+        with open(os.path.join(OUT, name), "w") as f:
+            f.write(svg)
+        print(name, len(svg), "bytes")
@@ -2,7 +2,14 @@

 #include <SD.h>

+#include <algorithm>
+
+#include "cleanup_plan.h"
+
+#include "text_wrap.h"
+#include "ui/fonts.h"
 #include "ui/widgets.h"
+#include "update_check.h"
 #include "version.h"

 namespace roro {
@@ -17,6 +24,9 @@ bool endsWith(const std::string& s, const std::string& suffix) {

 void FirmwarePage::enter() {
    confirm_.reset();
+    ask_ = Ask::None;
+    view_ = View::Main;
+    message_.clear();
    {
        std::lock_guard<std::mutex> g(lock_);
        files_.clear();
@@ -40,7 +50,76 @@ std::vector<std::string> FirmwarePage::files() {
    return files_;
 }

+void FirmwarePage::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+}
+
+// The row for the latest release: what's known, in a few words.
+std::string FirmwarePage::latestText(bool& warn) const {
+    warn = false;
+    GiteaReleases& g = update_.gitea();
+    if (update_.giteaBusy() || g.status() == GiteaReleases::Status::Busy) return "checking...";
+    release::Release r;
+    if (g.status() == GiteaReleases::Status::Failed && !g.latest(r)) {
+        warn = true;
+        return "failed: Enter retries";
+    }
+    if (!g.latest(r)) return "Enter: check";
+    return r.tag + (release::isNewer(r, update_.runningVersion()) ? " (new)" : " (current)");
+}
+
+void FirmwarePage::openRelease(const release::Release& r) {
+    shown_ = r;
+    shownTop_ = 0;
+    view_ = View::Release;
+}
+
+// Can the release on the page be installed from here, and if not, why (in words for the screen)?
+bool FirmwarePage::installable(std::string& why) const {
+    std::string running = update_.runningVersion();
+    if (!shown_.usable()) why = "Nothing to install in it";
+    else if (!release::versionNewer(shown_.tag, running) && !versionOlder(shown_.tag, running)) why = "That's the version running";
+    else if (release::isDebugBuild(running)) why = "Debug Build: update from the PC";  // it keeps its console (Q171)
+    else if (wifi_.state() != WifiController::State::Connected) why = "Not connected to Wi-Fi";
+    else return true;
+    return false;
+}
+
 bool FirmwarePage::onKey(const KeyEvent& e) {
+    if (view_ != View::Main) {
+        if (confirm_) {
+            confirm_->onKey(e);
+            if (confirm_->result() == 1 && ask_ == Ask::Release) {
+                std::string why = update_.requestInstall(shown_.tag);
+                if (!why.empty()) say(why);
+            }
+            if (confirm_->result() != DialogModel::kPending) confirm_.reset();
+            return true;
+        }
+        if (view_ == View::Release) {
+            if (e.key == Key::Back) view_ = olderReleases_.empty() || older_.count() == 0 ? View::Main : View::Older;
+            else if (e.key == Key::Up) shownTop_ = std::max(0, shownTop_ - 1);
+            else if (e.key == Key::Down) shownTop_++;  // clamped when drawn
+            else if (e.key == Key::Char && (e.ch == 'c' || e.ch == 'C') && !update_.giteaBusy()) update_.requestCheck();
+            else if (e.key == Key::Select) {
+                std::string why;
+                if (!installable(why)) return say(why), true;
+                ask_ = Ask::Release;
+                confirm_.reset(new DialogModel({"Cancel", "Install"}));
+            }
+            return true;
+        }
+        // The older releases.
+        if (e.key == Key::Back) view_ = View::Main;
+        else if (e.key == Key::Up) older_.up();
+        else if (e.key == Key::Down) older_.down();
+        else if (e.key == Key::Char && (e.ch == 'c' || e.ch == 'C') && !update_.giteaBusy()) update_.requestList();
+        else if (e.key == Key::Select && older_.selected() >= 0 && older_.selected() < static_cast<int>(olderReleases_.size()))
+            openRelease(olderReleases_[older_.selected()]);
+        return true;
+    }
+
    auto found = files();
    if (confirm_) {
        confirm_->onKey(e);
@@ -54,8 +133,22 @@ bool FirmwarePage::onKey(const KeyEvent& e) {
        case Key::Up: list_.up(); break;
        case Key::Down: list_.down(); break;
        case Key::Back: return false;
+        case Key::Char:
+            if ((e.ch == 'c' || e.ch == 'C') && !update_.giteaBusy()) update_.requestCheck();
+            break;
        case Key::Select:
-            if (list_.selected() >= kFixed) confirm_.reset(new DialogModel({"Cancel", "Install"}));
+            if (list_.selected() == kLatest) {
+                release::Release r;
+                if (update_.giteaBusy()) break;
+                if (update_.gitea().latest(r)) openRelease(r);
+                else update_.requestCheck();
+            } else if (list_.selected() == kOlder) {
+                view_ = View::Older;
+                if (olderReleases_.empty() && !update_.giteaBusy()) update_.requestList();
+            } else if (list_.selected() >= kFixed) {
+                ask_ = Ask::SdFile;
+                confirm_.reset(new DialogModel({"Cancel", "Install"}));
+            }
            break;
        default: break;
    }
@@ -63,6 +156,89 @@ bool FirmwarePage::onKey(const KeyEvent& e) {
 }

 void FirmwarePage::draw(Canvas& c) {
+    if (!message_.empty() && millis() - messageMs_ > 4000) message_.clear();
+    // What the last answer left: the list of older releases.
+    if (update_.gitea().seq() != olderSeq_ && !update_.giteaBusy()) {
+        olderSeq_ = update_.gitea().seq();
+        olderReleases_ = update_.gitea().list();
+        older_.setCount(static_cast<int>(olderReleases_.size()));
+    }
+    switch (view_) {
+        case View::Main: drawMain(c); break;
+        case View::Release: drawRelease(c); break;
+        case View::Older: drawOlder(c); break;
+    }
+    if (confirm_ && view_ != View::Main) {
+        std::string running = update_.runningVersion();
+        bool older = versionOlder(shown_.tag, running);
+        widgets::dialog(c, older ? "Go back?" : "Install update?",
+                        older ? shown_.tag + " is older than " + running + ". Install it anyway? The device restarts."
+                              : shown_.tag + " replaces " + running + ". The device restarts once it's written.",
+                        *confirm_);
+    }
+    if (!message_.empty() && !confirm_) {
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kWarning);
+        c.setTextDatum(top_left);
+        c.drawString(message_.c_str(), 4, theme::kContent.y + theme::kContent.h - 9);
+    }
+}
+
+void FirmwarePage::drawRelease(Canvas& c) {
+    const auto& area = theme::kContent;
+    std::string running = update_.runningVersion();
+    std::vector<std::string> lines;
+    lines.push_back(shown_.tag + (shown_.tag == running ? " (running)" : ""));
+    lines.push_back("Published " + shown_.date() + ", " + formatBytes(shown_.otaSize));
+    if (versionOlder(shown_.tag, running)) lines.push_back("Older than what's running");
+    auto measure = widgets::bodyMeasure(c);
+    lines.push_back("");
+    for (auto& l : wrapText(shown_.notes, area.w - 12, measure)) lines.push_back(l);
+    int rows = (area.h - 12) / theme::kLineHeight;
+    shownTop_ = std::clamp(shownTop_, 0, std::max(0, static_cast<int>(lines.size()) - rows));
+    widgets::textLines(c, lines, shownTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 12});
+
+    std::string why;
+    bool ok = installable(why);
+    c.setFont(&fonts::small);
+    c.setTextDatum(top_left);
+    c.setTextColor(theme::kMuted);
+    c.drawString(ok ? "Enter: install   c: check again" : (why + "   c: check").c_str(), 4, area.y + area.h - 9);
+}
+
+void FirmwarePage::drawOlder(Canvas& c) {
+    const auto& area = theme::kContent;
+    GiteaReleases& g = update_.gitea();
+    c.setTextDatum(top_left);
+    if (update_.giteaBusy() || g.status() == GiteaReleases::Status::Busy) {
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Looking at the server...", 4, area.y + 4);
+        return;
+    }
+    if (olderReleases_.empty()) {
+        c.setFont(&fonts::body);
+        c.setTextColor(g.status() == GiteaReleases::Status::Failed ? theme::kWarning : theme::kMuted);
+        c.drawString(g.status() == GiteaReleases::Status::Failed ? g.error().c_str() : "No releases known.", 4, area.y + 4);
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kMuted);
+        c.drawString("c: look again", 4, area.y + area.h - 9);
+        return;
+    }
+    std::string running = update_.runningVersion();
+    widgets::list(
+        c, older_, {area.x, area.y, area.w, area.h - 11},
+        [&](int i) {
+            const auto& r = olderReleases_[i];
+            return r.tag + (r.tag == running ? "  (running)" : release::versionNewer(r.tag, running) ? "  (new)" : "");
+        },
+        [&](int i) { return olderReleases_[i].date(); });
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("Enter: details   c: look again", 4, area.y + area.h - 9);
+}
+
+void FirmwarePage::drawMain(Canvas& c) {
    auto found = files();
    bool listed;
    {
@@ -78,6 +254,8 @@ void FirmwarePage::draw(Canvas& c) {
                case kVersion: return "Version";
                case kStatus: return "Status";
                case kAddress: return "Push to";
+                case kLatest: return "Latest release";
+                case kOlder: return "Older releases";
                case kSdHeader: return listed ? (found.empty() ? "No .ota files in /updates" : "On the SD card:") : "Looking on the SD card...";
                default: return "  " + found[i - kFixed].substr(std::string(kUpdatesFolder).size() + 1);
            }
@@ -87,6 +265,11 @@ void FirmwarePage::draw(Canvas& c) {
                case kVersion: return versionString();
                case kStatus: return update_.onProbation() ? "on probation" : "confirmed";
                case kAddress: return ip.empty() ? "Wi-Fi not connected" : ip + ":" + std::to_string(UpdateService::kPort);
+                case kLatest: {
+                    bool warn;
+                    return latestText(warn);
+                }
+                case kOlder: return ">";
                case kSdHeader: return "";
                default: return "install >";
            }
@@ -8,6 +8,7 @@
 #include "dialog_model.h"
 #include "key_event.h"
 #include "list_model.h"
+#include "release_info.h"
 #include "services/storage_service.h"
 #include "services/update_service.h"
 #include "services/wifi_service.h"
@@ -16,8 +17,9 @@

 namespace roro {

-// Settings → Firmware: the running version and its Probation, where to push Firmware Updates, and
-// the Update Files on the SD card (in /updates) to install from.
+// Settings → Firmware: the running version and its Probation, where to push Firmware Updates, the
+// project's releases on Gitea (the latest, and the ten before it), and the Update Files on the SD
+// card (in /updates) to install from.
 class FirmwarePage {
   public:
    FirmwarePage(UpdateService& update, WifiService& wifi, StorageService& storage)
@@ -28,15 +30,34 @@ class FirmwarePage {
    void draw(Canvas& c);

   private:
-    enum Row { kVersion, kStatus, kAddress, kSdHeader, kFixed };
+    enum Row { kVersion, kStatus, kAddress, kLatest, kOlder, kSdHeader, kFixed };
+    enum class View { Main, Release, Older };
+    enum class Ask { None, SdFile, Release };

    std::vector<std::string> files();
+    std::string latestText(bool& warn) const;
+    void openRelease(const release::Release& r);
+    bool installable(std::string& why) const;  // the shown release: can it be installed from here?
+    void drawMain(Canvas& c);
+    void drawRelease(Canvas& c);
+    void drawOlder(Canvas& c);
+    void say(const std::string& text);

    UpdateService& update_;
    WifiService& wifi_;
    StorageService& storage_;
    ListModel list_{theme::kContent.h / theme::kLineHeight};
+    ListModel older_{(theme::kContent.h - 11) / theme::kLineHeight};  // above the hint line
    std::unique_ptr<DialogModel> confirm_;
+    Ask ask_ = Ask::None;
+
+    View view_ = View::Main;
+    release::Release shown_;  // the release page
+    std::vector<release::Release> olderReleases_;
+    uint32_t olderSeq_ = 0;
+    int shownTop_ = 0;
+    std::string message_;
+    uint32_t messageMs_ = 0;

    // Filled on the storage task.
    std::mutex lock_;
@@ -16,7 +16,7 @@ const char* statusText(Status s) {
        case Status::Connecting: return "connecting...";
        case Status::Registering: return "logging in...";
        case Status::Online: return "";
-        case Status::Paused: return "paused (Wi-Fi monitoring)";
+        case Status::Paused: return "paused (Wi-Fi monitoring or an update)";
        case Status::Retrying: return "retrying soon";
    }
    return "";
@@ -38,6 +38,7 @@
 #include "services/clock_service.h"
 #include "services/debug_console.h"
 #include "services/file_ops.h"
+#include "update_check.h"
 #include "services/gemini_service.h"
 #include "services/gnss_service.h"
 #include "services/power_service.h"
@@ -182,6 +183,8 @@ void setup() {
    wifi = new WifiService(settings, *savedNetworks, *clockService);
    update = new UpdateService(nvs, *wifi, *savedNetworks, *storageService, bus, settings);
    fileOps = new FileOps(*storageService, filesInUse);
+    update->enableDailyCheck();
+    update->holdMemory = [](bool hold) { irc->holdForUpdate(hold); };  // see UpdateService::holdMemory
    irc = new IrcService(nvs, "roro_" + identity::defaultShortName(), *wifi, *storageService, *clockService, bus);
    notifier = new Notifier(bus, settings);
    notifier->onShow = [](uint32_t now, uint32_t until) { power->onNotification(now, until); };
@@ -441,6 +444,84 @@ static void fileOpsStep() {
    else console.printf("%s: ok\n", name);
 }

+// `update ...`: the project's releases on Gitea (R1, #6). The answers come from the Update Service's
+// task a moment later; updateStep() prints them.
+static int updateWatch = 0;  // 1: a check, 2: a list
+
+static void printReleases(bool list) {
+    GiteaReleases& g = update->gitea();
+    if (g.status() == GiteaReleases::Status::Failed) return (void)console.printf("update: %s\n", g.error().c_str());
+    std::string running = update->runningVersion();
+    if (!list) {
+        release::Release r;
+        if (!g.latest(r)) return (void)console.println("update: nothing known yet");
+        console.printf("update: latest %s of %s, %u bytes: %s (running %s)\n", r.tag.c_str(), r.date().c_str(), (unsigned)r.otaSize,
+                       release::isNewer(r, running) ? "newer" : "not newer", running.c_str());
+        console.printf("update: %s\n", r.notes.c_str());
+        return;
+    }
+    for (auto& r : g.list())
+        console.printf("update: %-8s %s %8u B  %s\n", r.tag.c_str(), r.date().c_str(), (unsigned)r.otaSize, r.notes.substr(0, 60).c_str());
+    console.println("update: end of list");
+}
+
+static void updateStep() {
+    if (!updateWatch || update->giteaBusy()) return;
+#ifdef RORO_DEBUG
+    if (updateWatch == 3) {
+        console.printf("update: probe: %s\n", update->probeResult().c_str());
+        updateWatch = 0;
+        return;
+    }
+#endif
+    printReleases(updateWatch == 2);
+    updateWatch = 0;
+}
+
+static void updateCommand(const String& args) {
+    if (args == "check" || args == "list") {
+        if (update->giteaBusy()) return (void)console.println("update: busy");
+        args == "check" ? update->requestCheck() : update->requestList();
+        updateWatch = args == "check" ? 1 : 2;
+    } else if (args == "status") {
+        GiteaReleases& g = update->gitea();
+        console.printf("update: running %s, failed here before: %s, daily check %s, heap %u\n", update->runningVersion().c_str(),
+                       update->failedVersion().empty() ? "none" : update->failedVersion().c_str(),
+                       settings.getBool(Setting::CheckUpdates) ? "on" : "off", (unsigned)ESP.getFreeHeap());
+        console.printf("update: gitea %s %s\n", g.status() == GiteaReleases::Status::Done ? "done" : g.status() == GiteaReleases::Status::Failed ? "failed" : g.status() == GiteaReleases::Status::Busy ? "busy" : "never asked", g.error().c_str());
+        printReleases(false);
+    } else if (args.startsWith("install ")) {
+        String rest = args.substring(8);
+        bool force = rest.endsWith(" force");
+        if (force) rest.remove(rest.length() - 6);
+#ifndef RORO_DEBUG
+        force = false;  // only the Debug Console may install on a Debug Build, which a release isn't
+#endif
+        std::string why = update->requestInstall(rest.c_str(), force);
+        console.printf("update: %s\n", why.empty() ? "installing" : why.c_str());
+#ifdef RORO_DEBUG
+    } else if (args.startsWith("probe ")) {  // update probe <host> [path]: is that server's certificate accepted?
+        String rest = args.substring(6);
+        int space = rest.indexOf(' ');
+        update->requestProbe((space < 0 ? rest : rest.substring(0, space)).c_str(), space < 0 ? "/" : rest.substring(space + 1).c_str());
+        updateWatch = 3;
+    } else if (args.startsWith("damage ")) {  // update damage cut <bytes> | flip <offset>: for the next download
+        long n = args.substring(args.lastIndexOf(' ') + 1).toInt();
+        args.startsWith("damage cut") ? update->damageNextDownload(n, -1) : update->damageNextDownload(-1, n);
+        console.printf("update: the next download will be %s at byte %ld\n", args.startsWith("damage cut") ? "cut" : "damaged", n);
+
+    } else if (args == "daily") {  // forget today's check: the daily one runs again at once, if it may
+        update->forgetToday();
+        console.println("update: the daily check will run at the next tick if Wi-Fi, the clock and memory allow");
+    } else if (args.startsWith("pretend ")) {  // update pretend v0.9.0 | off: what the comparisons take as running
+        update->pretendVersion(args.substring(8) == "off" ? "" : args.substring(8).c_str());
+        console.printf("update: running %s\n", update->runningVersion().c_str());
+#endif
+    } else {
+        console.println("update: check | list | status | install <tag>");
+    }
+}
+
 static void fileCommand(const String& line) {
    int space = line.indexOf(' ');
    std::string command = line.substring(0, space).c_str(), rest = line.substring(space + 1).c_str();
@@ -507,6 +588,7 @@ static const char* const kHelp =
    "gemini get <url>  fetch a Gemini page and report header, size, certificate, heap\n"
    "irc start | irc stop | irc dump | irc say <buffer> <text>\n"
    "install <path.ota>   Update from SD\n"
+    "update check | list | status | install <tag>   the project's releases on Gitea\n"
    "sd card | sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
 #ifdef RORO_DEBUG
    "crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)\n"
@@ -571,6 +653,7 @@ static void runCommand(String line) {
        esp_log_level_set("*", static_cast<esp_log_level_t>(constrain(level, 0, 5)));
        console.printf("log level: %d\n", constrain(level, 0, 5));
    }
+    if (line.startsWith("update ")) updateCommand(line.substring(7));
    if (line.startsWith("cp ") || line.startsWith("mv ") || line.startsWith("rm ") || line.startsWith("mkdir ") ||
        line.startsWith("du ") || line == "cancel")
        fileCommand(line);
@@ -1010,6 +1093,7 @@ static void loopPass() {
    if (noiseTest) noiseTest->step(now);
 #endif
    noteStableOnce(now);
+    updateStep();
    fileOpsStep();
    uploadStep();
    printListingWhenReady();
@@ -0,0 +1,62 @@
+#pragma once
+
+namespace roro {
+
+// The roots this device trusts for what it fetches over HTTPS (docs/milestones/R1.md, Q162): the two
+// ISRG roots Let's Encrypt chains end in, not the framework's bundle of about 130 CAs. Public
+// certificates, from https://letsencrypt.org/certs/ (SHA-256 fingerprints below).
+//
+//   ISRG Root X1  RSA 4096    valid until 2035-06-04
+//     96:BC:EC:06:26:49:76:F3:74:60:77:9A:CF:28:C5:A7:CF:E8:A3:C0:AA:E1:1A:8F:FC:EE:05:C0:BD:DF:08:C6
+//   ISRG Root X2  ECDSA P-384 valid until 2040-09-17
+//     69:72:9B:8E:15:A8:6E:FC:17:7A:57:AF:B7:17:1D:FC:64:AD:D2:8C:2F:CA:8C:F1:50:7E:34:45:3C:CB:14:70
+//
+// If the server's CA ever changes, the next firmware has to carry the new root and come from the PC.
+inline constexpr char kTrustedRootsPem[] =
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw\n"
+    "TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\n"
+    "cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4\n"
+    "WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu\n"
+    "ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY\n"
+    "MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc\n"
+    "h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+\n"
+    "0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U\n"
+    "A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW\n"
+    "T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH\n"
+    "B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC\n"
+    "B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv\n"
+    "KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn\n"
+    "OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn\n"
+    "jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw\n"
+    "qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI\n"
+    "rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV\n"
+    "HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq\n"
+    "hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL\n"
+    "ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ\n"
+    "3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK\n"
+    "NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5\n"
+    "ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur\n"
+    "TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC\n"
+    "jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc\n"
+    "oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq\n"
+    "4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA\n"
+    "mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d\n"
+    "emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=\n"
+    "-----END CERTIFICATE-----\n"
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw\n"
+    "CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg\n"
+    "R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00\n"
+    "MDA5MTcxNjAwMDBaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBT\n"
+    "ZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYw\n"
+    "EAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW\n"
+    "+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9\n"
+    "ItgKbppbd9/w+kHsOdx1ymgHDB/qo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T\n"
+    "AQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwCgYIKoZI\n"
+    "zj0EAwMDaAAwZQIwe3lORlCEwkSHRhtFcP9Ymd70/aTSVaYgLXTWNLxBo1BfASdW\n"
+    "tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1\n"
+    "/q4AaOeMSQ+2b1tbFfLn\n"
+    "-----END CERTIFICATE-----\n";
+
+}  // namespace roro
@@ -0,0 +1,111 @@
+#include "platform/https_get.h"
+
+#include <Arduino.h>
+#include <esp_heap_caps.h>
+
+#include <algorithm>
+#include <ctime>
+
+#include "platform/ca_roots.h"
+#include "version.h"
+
+namespace roro {
+
+namespace {
+constexpr time_t kClockSetAfter = 1700000000;  // 2023-11: anything earlier is the clock's default
+
+// What mbedTLS says in the way it says it, for the cases a person can act on.
+std::string whyNotConnected(NetworkClientSecure& tls, const std::string& host) {
+    char text[100] = "";
+    int err = tls.lastError(text, sizeof text);
+    std::string detail = text;
+    if (detail.find("X509") != std::string::npos || detail.find("certificate") != std::string::npos)
+        return "The certificate of " + host + " isn't accepted";
+    if (err != 0 && !detail.empty()) return "TLS to " + host + ": " + detail;
+    return "Can't connect to " + host;
+}
+}  // namespace
+
+std::string HttpsGet::open(const std::string& host, const std::string& path, const char* accept) {
+    close();
+    if (time(nullptr) < kClockSetAfter) return "The clock isn't set: can't check certificates";
+    if (esp_get_free_heap_size() < kNeedFree) return "Not enough memory for a secure connection";
+
+    tls_.setCACert(kTrustedRootsPem);
+    tls_.setTimeout(15);
+    if (!tls_.connect(host.c_str(), 443)) return whyNotConnected(tls_, host);
+
+    raw_.reset(new (std::nothrow) uint8_t[kRaw]);
+    if (!raw_) return "Not enough memory";
+    tls_.print(("GET " + path + " HTTP/1.1\r\nHost: " + host + "\r\nUser-Agent: roro9stack/" + versionString() +
+                "\r\nAccept: " + accept + "\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n")
+                   .c_str());
+
+    release::HttpHeadParser parser;
+    while (!parser.complete()) {
+        int n = readRaw(raw_.get(), kRaw);
+        if (n <= 0) return "The server " + host + " stopped answering";
+        size_t used = parser.feed(reinterpret_cast<const char*>(raw_.get()), n);
+        if (parser.failed()) return host + " didn't answer with HTTP";
+        if (parser.complete() && used < static_cast<size_t>(n)) early_.assign(reinterpret_cast<const char*>(raw_.get()) + used, n - used);
+    }
+    head_ = parser.head();
+    if (head_.status != 200) return host + " answered " + std::to_string(head_.status) + (head_.status / 100 == 3 ? " (a redirect)" : "");
+    left_ = head_.chunked ? -1 : head_.contentLength;
+    return "";
+}
+
+int HttpsGet::readRaw(uint8_t* into, size_t len) {
+    uint32_t since = millis();
+    while (!tls_.available()) {
+        if (!tls_.connected()) return 0;
+        if (millis() - since > kStallMs) return -1;
+        delay(5);
+    }
+    return tls_.read(into, len);
+}
+
+int HttpsGet::read(uint8_t* buf, size_t len) {
+    if (done_ || len == 0) return 0;
+    if (!head_.chunked && left_ == 0) return done_ = true, 0;
+
+    for (;;) {
+        // Raw bytes: first those that came with the head, then the connection's.
+        size_t want = head_.chunked ? std::min(len, kRaw) : len;
+        if (!head_.chunked && left_ > 0) want = std::min<size_t>(want, left_);
+        int n;
+        if (earlyAt_ < early_.size()) {
+            n = static_cast<int>(std::min(want, early_.size() - earlyAt_));
+            std::copy(early_.data() + earlyAt_, early_.data() + earlyAt_ + n, head_.chunked ? raw_.get() : buf);
+            earlyAt_ += n;
+        } else {
+            n = readRaw(head_.chunked ? raw_.get() : buf, want);
+        }
+        if (n < 0) return -1;
+        if (n == 0) {  // the server closed: the end, if it's where it said it would be
+            done_ = true;
+            bool whole = head_.chunked ? chunks_.done() : left_ <= 0;
+            return whole ? 0 : -1;
+        }
+        if (!head_.chunked) {
+            if (left_ > 0) left_ -= n;
+            return n;
+        }
+        size_t out = chunks_.decode(raw_.get(), n, buf);
+        if (chunks_.failed()) return -1;
+        if (out > 0) return static_cast<int>(out);
+        if (chunks_.done()) return done_ = true, 0;
+    }
+}
+
+void HttpsGet::close() {
+    tls_.stop();
+    raw_.reset();
+    std::string().swap(early_);
+    earlyAt_ = 0;
+    done_ = false;
+    head_ = release::HttpHead();
+    chunks_ = release::ChunkedDecoder();
+}
+
+}  // namespace roro
@@ -0,0 +1,51 @@
+#pragma once
+
+#include <NetworkClientSecure.h>
+
+#include <memory>
+#include <string>
+
+#include "http_head.h"
+#include "platform/counted_client.h"
+
+namespace roro {
+
+// One HTTPS GET, read as a stream: the connection checks the server's chain and name against the
+// roots in ca_roots.h, the head is parsed, and the body comes out whole whether the server sent it
+// with a length or in chunks. Used by the Update Service to read Gitea's answers and to download a
+// release. Redirects aren't followed: the device only goes where it was told to (Q163).
+class HttpsGet {
+   public:
+    // A TLS connection to Gitea peaks at about 52 KB of heap (measured: the same with or without
+    // checking the certificate); with Q86's 20 KB to spare, it starts with at least this much free.
+    static constexpr size_t kNeedFree = 80 * 1024;
+
+    explicit HttpsGet(net::User user) : tls_(user) {}
+    ~HttpsGet() { close(); }
+
+    // Connects and reads the head. "" when a 200 is on its way, or why not, in words for the screen.
+    std::string open(const std::string& host, const std::string& path, const char* accept);
+    long contentLength() const { return head_.contentLength; }  // -1: not known
+
+    // Body bytes into `buf`: how many, 0 at the end, -1 when the connection broke or stalled
+    // before the end.
+    int read(uint8_t* buf, size_t len);
+    void close();
+
+   private:
+    static constexpr size_t kRaw = 1024;
+    static constexpr uint32_t kStallMs = 10000;
+
+    int readRaw(uint8_t* into, size_t len);  // from the connection, waiting up to kStallMs
+
+    Counted<NetworkClientSecure> tls_;
+    release::HttpHead head_;
+    release::ChunkedDecoder chunks_;
+    std::unique_ptr<uint8_t[]> raw_;
+    std::string early_;  // body bytes that arrived with the head
+    size_t earlyAt_ = 0;
+    long left_ = -1;  // body bytes still to come, if the server said how many
+    bool done_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,137 @@
+#include "services/gitea_releases.h"
+
+#include <memory>
+
+#include "platform/https_get.h"
+#include "update_check.h"
+
+namespace roro {
+
+namespace {
+struct Guard {
+    explicit Guard(SemaphoreHandle_t l) : l_(l) { xSemaphoreTake(l_, portMAX_DELAY); }
+    ~Guard() { xSemaphoreGive(l_); }
+    SemaphoreHandle_t l_;
+};
+
+std::string api(const std::string& what) { return std::string("/api/v1/repos/") + release::kGiteaRepo + "/releases" + what; }
+}  // namespace
+
+bool GiteaReleases::fetch(const std::string& path, size_t max, std::vector<release::Release>& out) {
+    HttpsGet get(net::User::Updates);
+    std::string why = get.open(release::kGiteaHost, path, "application/json");
+    if (!why.empty()) {
+        finish(false, why);
+        return false;
+    }
+    release::ReleaseReader reader(max);
+    std::unique_ptr<uint8_t[]> buf(new (std::nothrow) uint8_t[512]);
+    if (!buf) {
+        finish(false, "Not enough memory");
+        return false;
+    }
+    for (;;) {
+        int n = get.read(buf.get(), 512);
+        if (n < 0) {
+            finish(false, "The connection broke off");
+            return false;
+        }
+        if (n == 0) break;
+        reader.feed(reinterpret_cast<const char*>(buf.get()), n);
+        if (!reader.ok()) break;
+    }
+    reader.end();
+    if (!reader.ok() || !reader.complete()) {
+        finish(false, "Gitea's answer isn't what was expected");
+        return false;
+    }
+    out = reader.releases();
+    return true;
+}
+
+void GiteaReleases::finish(bool ok, const std::string& error) {
+    Guard g(lock_);
+    status_ = ok ? Status::Done : Status::Failed;
+    error_ = error;
+    seq_++;
+}
+
+bool GiteaReleases::fetchLatest() {
+    {
+        Guard g(lock_);
+        status_ = Status::Busy;
+        error_.clear();
+    }
+    std::vector<release::Release> got;
+    if (!fetch(api("/latest"), 1, got)) return false;
+    if (got.empty() || !got[0].usable()) {
+        finish(false, "No release to install on the server");
+        return false;
+    }
+    {
+        Guard g(lock_);
+        latest_ = got[0];
+        haveLatest_ = true;
+    }
+    finish(true, "");
+    return true;
+}
+
+bool GiteaReleases::fetchList() {
+    {
+        Guard g(lock_);
+        status_ = Status::Busy;
+        error_.clear();
+    }
+    std::vector<release::Release> got;
+    if (!fetch(api("?limit=" + std::to_string(kListSize) + "&draft=false&pre-release=false"), kListSize, got)) return false;
+    std::vector<release::Release> usable;
+    for (auto& r : got)
+        if (r.usable()) usable.push_back(std::move(r));
+    {
+        Guard g(lock_);
+        list_ = std::move(usable);
+        if (!list_.empty() && (!haveLatest_ || release::versionNewer(list_[0].tag, latest_.tag))) {
+            latest_ = list_[0];
+            haveLatest_ = true;
+        }
+    }
+    finish(true, "");
+    return true;
+}
+
+GiteaReleases::Status GiteaReleases::status() const {
+    Guard g(lock_);
+    return status_;
+}
+
+std::string GiteaReleases::error() const {
+    Guard g(lock_);
+    return error_;
+}
+
+uint32_t GiteaReleases::seq() const {
+    Guard g(lock_);
+    return seq_;
+}
+
+bool GiteaReleases::latest(release::Release& out) const {
+    Guard g(lock_);
+    if (haveLatest_) out = latest_;
+    return haveLatest_;
+}
+
+std::vector<release::Release> GiteaReleases::list() const {
+    Guard g(lock_);
+    return list_;
+}
+
+bool GiteaReleases::find(const std::string& tag, release::Release& out) const {
+    Guard g(lock_);
+    for (const auto& r : list_)
+        if (r.tag == tag) return out = r, true;
+    if (haveLatest_ && latest_.tag == tag) return out = latest_, true;
+    return false;
+}
+
+}  // namespace roro
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+
+#include <string>
+#include <vector>
+
+#include "release_info.h"
+
+namespace roro {
+
+// What the device knows of the project's releases on Gitea (docs/milestones/R1.md, #6): the latest,
+// and a list of the last ten. The fetching runs on the Update Service's task; the screens read what
+// came out, from the main loop.
+class GiteaReleases {
+   public:
+    enum class Status : uint8_t { Never, Busy, Done, Failed };
+    static constexpr size_t kListSize = 10;
+
+    GiteaReleases() : lock_(xSemaphoreCreateMutex()) {}
+
+    // On the Update Service's task. True when the answer was read; otherwise error() says why.
+    bool fetchLatest();
+    bool fetchList();
+
+    void fail(const std::string& error) { finish(false, error); }  // something stopped it before it began
+    Status status() const;
+    std::string error() const;
+    uint32_t seq() const;  // grows with every answer that changed something
+    bool latest(release::Release& out) const;          // false: not fetched yet
+    std::vector<release::Release> list() const;
+    bool find(const std::string& tag, release::Release& out) const;  // in the list, or the latest
+
+   private:
+    bool fetch(const std::string& path, size_t max, std::vector<release::Release>& out);
+    void finish(bool ok, const std::string& error);
+
+    mutable SemaphoreHandle_t lock_;
+    Status status_ = Status::Never;
+    std::string error_;
+    uint32_t seq_ = 0;
+    bool haveLatest_ = false;
+    release::Release latest_;
+    std::vector<release::Release> list_;
+};
+
+}  // namespace roro
@@ -224,6 +224,14 @@ void IrcService::loop() {
        if (!wanted_) {
            if (open_) close("disconnected");
            status_ = Status::Stopped;
+        } else if (held_) {
+            if (open_) {
+                conn_->print("QUIT :updating\r\n");
+                vTaskDelay(pdMS_TO_TICKS(300));
+                close("paused while the device updates");
+            }
+            status_ = Status::Paused;
+            retryAtMs_ = now;  // back at once when released
        } else if (!wifiUp) {
            if (open_) close(monitoring ? "paused for Wi-Fi monitoring" : "Wi-Fi lost");
            status_ = monitoring ? Status::Paused : Status::WaitingForWifi;
@@ -38,6 +38,11 @@ class IrcService : public Service {
    void disconnect();
    bool running() const { return wanted_; }
    bool stoppedByUser() const { return stoppedByUser_; }
+
+    // A TLS connection to Gitea needs more memory than is left beside this one (#6, Q172): the
+    // Update Service asks IRC to step aside while it talks to the server, and to come back after.
+    // Unlike disconnect(), nothing is remembered as "stopped by the user".
+    void holdForUpdate(bool hold) { held_ = hold; }
    Status status() const { return status_; }

    // Read or act on the session while holding its lock: withSession([](IrcSession& s) { ... }).
@@ -86,6 +91,7 @@ class IrcService : public Service {
    volatile bool stopRequested_ = false;
    bool quitSent_ = false;  // /quit already queued its QUIT
    volatile bool restart_ = false;
+    volatile bool held_ = false;  // stepping aside for an update
    volatile Status status_ = Status::Stopped;
    bool open_ = false;
    uint32_t retryAtMs_ = 0;
@@ -7,6 +7,10 @@

 #include <memory>

+#include <ctime>
+
+#include "http_head.h"
+#include "platform/https_get.h"
 #include "platform/ota_device.h"
 #include "platform/system_info.h"
 #include "probation.h"
@@ -60,6 +64,25 @@ class FileSource : public UpdateSource {
    File& f_;
 };

+// A release being downloaded from Gitea: the same bytes a push or a card would give.
+class GiteaSource : public UpdateSource {
+   public:
+    GiteaSource(HttpsGet& get, long cutAfter, long flipAt) : get_(get), cut_(cutAfter), flip_(flipAt) {}
+    int read(uint8_t* buf, size_t len) override {
+        if (cut_ >= 0 && pos_ >= cut_) return -1;  // Debug Builds: the connection "breaks" here
+        int n = get_.read(buf, len);
+        if (n > 0 && flip_ >= pos_ && flip_ < pos_ + n) buf[flip_ - pos_] ^= 1;  // and a byte "arrives wrong"
+        if (n > 0) pos_ += n;
+        return n;
+    }
+
+   private:
+    HttpsGet& get_;
+    long cut_, flip_, pos_ = 0;
+};
+
+constexpr time_t kClockSetAfter = 1700000000;  // anything earlier is the clock's default
+
 }  // namespace

 UpdateService::UpdateService(KeyValueStore& store, WifiService& wifi, SavedNetworks& saved, StorageService& storage,
@@ -85,10 +108,11 @@ void UpdateService::start() {
    store_.getString("ota_from", from);
    if (!pending.empty() && pending != versionString()) {
        notify("Update to " + pending + " failed, back on " + versionString(), NotificationLevel::Warning);
+        store_.putString("ota_failed", pending);  // not announced again until there's a newer one (Q168)
        store_.putString("ota_pending", "");
    }

-    if (!task_) xTaskCreate(taskEntry, "update", 5120, this, 1, &task_);  // peak 3.4 KB (ECDSA check, M2)
+    if (!task_) xTaskCreate(taskEntry, "update", 7168, this, 1, &task_);  // peak 5.4 KB: TLS to Gitea and the signature check (#6)
 }

 void UpdateService::bootGuard(KeyValueStore& store) {
@@ -106,6 +130,7 @@ void UpdateService::bootGuard(KeyValueStore& store) {
 }

 void UpdateService::tick(uint32_t nowMs) {
+    scheduleDailyCheck(nowMs);
    if (!probation_) return;
    bool wifiConfigured = settings_.getBool(Setting::WifiEnabled) && saved_.count() > 0;
    bool wifiUp = wifi_.state() == WifiController::State::Connected;
@@ -184,6 +209,134 @@ void UpdateService::installFromSd(const std::string& path) {
    });
 }

+std::string UpdateService::failedVersion() const {
+    std::string failed;
+    store_.getString("ota_failed", failed);
+    return failed;
+}
+
+std::string UpdateService::requestInstall(const std::string& tag, bool force) {
+    if (phase_ != Phase::Idle || giteaBusy()) return "Busy with something else";
+    if (!force && release::isDebugBuild(runningVersion())) return "Debug Build: update from the PC";  // short: it is drawn in one line at the screen's foot
+    if (wifi_.state() != WifiController::State::Connected) return "No Wi-Fi";
+    release::Release r;
+    if (!gitea_.find(tag, r)) return "Look for releases first";
+    if (!release::trustedAssetUrl(r.otaUrl)) return "That download isn't on the project's server";
+    installTag_ = tag;
+    request_ = Request::Install;
+    return "";
+}
+
+// Once a day while Wi-Fi is up and the Clock is set (Q165). Skipped, and tried again later, when
+// something else is going on or memory is short; never during Probation or an install.
+void UpdateService::scheduleDailyCheck(uint32_t nowMs) {
+    if (!dailyCheck_ || !settings_.getBool(Setting::CheckUpdates)) return;
+    if (static_cast<int32_t>(nowMs - nextCheckMs_) < 0 || probation_ || phase_ != Phase::Idle || giteaBusy()) return;
+    if (wifi_.state() != WifiController::State::Connected) return;
+    time_t now = time(nullptr);
+    if (now < kClockSetAfter) return;
+    int32_t today = static_cast<int32_t>(now / 86400), last = 0;
+    store_.getInt("rel_day", last);
+    if (today == last) {
+        nextCheckMs_ = nowMs + 3600000;  // look again in an hour, in case the day has turned
+        return;
+    }
+    // Never at IRC's expense: with IRC connected there isn't the room (Q172), so this waits.
+    if (esp_get_free_heap_size() < HttpsGet::kNeedFree) {
+        nextCheckMs_ = nowMs + 600000;
+        return;
+    }
+    nextCheckMs_ = nowMs + 1800000;  // if this one fails
+    request_ = Request::BackgroundCheck;
+}
+
+// What a person asked for (a check, a list, an install) may take IRC offline for a few seconds:
+// a TLS connection needs about 80 KB and IRC's own holds 40 KB of what there is (R1, Q172).
+bool UpdateService::makeRoom() {
+    if (esp_get_free_heap_size() >= HttpsGet::kNeedFree) return true;
+    if (!holdMemory) return false;
+    held_ = true;
+    holdMemory(true);
+    for (int i = 0; i < 40 && esp_get_free_heap_size() < HttpsGet::kNeedFree; i++) delay(100);  // its TLS session goes
+    return esp_get_free_heap_size() >= HttpsGet::kNeedFree;
+}
+
+void UpdateService::serve() {
+    Request r = request_;
+    if (r == Request::None) return;
+    request_ = Request::None;
+    serving_ = true;
+    held_ = false;
+    if (r != Request::BackgroundCheck && r != Request::None) {
+        bool ok = makeRoom();
+        if (!ok) {
+            gitea_.fail("Not enough memory: close a Gemini page");
+            if (r == Request::Install) notify("Update refused: not enough memory", NotificationLevel::Warning);
+            r = Request::None;
+        }
+    }
+    switch (r) {
+        case Request::Check:
+        case Request::BackgroundCheck: {
+            if (!gitea_.fetchLatest()) break;
+            time_t now = time(nullptr);
+            if (now >= kClockSetAfter) store_.putInt("rel_day", static_cast<int32_t>(now / 86400));
+            release::Release latest;
+            if (r == Request::BackgroundCheck && gitea_.latest(latest) &&
+                release::shouldAnnounce(latest, runningVersion(), failedVersion(), announced_)) {
+                announced_ = latest.tag;
+                notify(latest.tag + " is out: see Settings > Firmware", NotificationLevel::Info);  // 48 bytes at most
+            }
+            break;
+        }
+        case Request::List: gitea_.fetchList(); break;
+        case Request::Install: {
+            release::Release release;
+            if (gitea_.find(installTag_, release)) installFromGitea(release);
+            break;
+        }
+#ifdef RORO_DEBUG
+        case Request::Probe: {
+            HttpsGet get(net::User::Updates);
+            std::string why = get.open(probeHost_, probePath_, "*/*");
+            probeResult_ = why.empty() ? "accepted, the server answered 200" : why;
+            break;
+        }
+#endif
+        case Request::None: break;
+    }
+    // A check or a list someone asked for that failed says so; the daily one stays quiet.
+    if ((r == Request::Check || r == Request::List) && gitea_.status() == GiteaReleases::Status::Failed)
+        notify(gitea_.error(), NotificationLevel::Warning);
+    // IRC comes back, unless the device is about to restart into an update.
+    if (held_ && phase_ != Phase::Installed && holdMemory) holdMemory(false);
+    held_ = false;
+    serving_ = false;
+}
+
+void UpdateService::installFromGitea(const release::Release& r) {
+    release::Url url = release::parseUrl(r.otaUrl);
+    incoming_ = r.tag;
+    percent_ = 0;
+    phase_ = Phase::Receiving;
+    HttpsGet get(net::User::Updates);
+    std::string why = get.open(url.host, url.path, "application/octet-stream");
+    if (why.empty() && r.otaSize && get.contentLength() >= 0 && static_cast<uint32_t>(get.contentLength()) != r.otaSize)
+        why = "The file isn't the size the server listed";
+    if (!why.empty()) {
+        phase_ = Phase::Idle;
+        notify("Update refused: " + why, NotificationLevel::Warning);
+        return;
+    }
+#ifdef RORO_DEBUG
+    GiteaSource source(get, damageCut_, damageFlip_);
+    damageCut_ = damageFlip_ = -1;
+#else
+    GiteaSource source(get, -1, -1);
+#endif
+    install(source, "Gitea");
+}
+
 void UpdateService::taskEntry(void* self) { static_cast<UpdateService*>(self)->listen(); }

 void UpdateService::listen() {
@@ -208,6 +361,7 @@ void UpdateService::listen() {
                esp_restart();
            }
        }
+        if (phase_ == Phase::Idle) serve();
        if (listening && phase_ == Phase::Idle) {
            Counted<NetworkClient> client(server.accept(), net::User::Updates);
            if (client) {
@@ -2,11 +2,16 @@

 #include <freertos/FreeRTOS.h>

+#include <functional>
 #include <string>

+#include "update_check.h"
+#include "version.h"
+
 #include "event_bus.h"
 #include "key_value_store.h"
 #include "service.h"
+#include "services/gitea_releases.h"
 #include "services/storage_service.h"
 #include "services/wifi_service.h"

@@ -39,12 +44,46 @@ class UpdateService : public Service {
    // Installs an Update File from the SD card (runs on the storage task).
    void installFromSd(const std::string& path);

+    // Updates from Gitea (docs/milestones/R1.md, #6). The requests are done on this Service's task;
+    // the answers are read from gitea().
+    GiteaReleases& gitea() { return gitea_; }
+    void requestCheck() { request_ = Request::Check; }
+    void requestList() { request_ = Request::List; }
+    // Downloads `tag` (a release known from the last check or list) into the inactive slot and
+    // installs it. "" when it started, or why not. A Debug Build doesn't install a release (Q171,
+    // it would take its Debug Console away) unless `force`, which only the Debug Console passes.
+    std::string requestInstall(const std::string& tag, bool force = false);
+    bool giteaBusy() const { return request_ != Request::None || serving_; }
+    // Asked to make room for a TLS connection (R1, Q172): IRC steps aside while the Update Service
+    // talks to Gitea. Set by the main loop; `true` to step aside, `false` to come back.
+    std::function<void(bool)> holdMemory;
+    // The daily check (Q165) only runs once the main loop says it may: not in Safe Mode.
+    void enableDailyCheck() { dailyCheck_ = true; }
+    // The version that counts as running for comparisons: a Debug Build can pretend to be older.
+    std::string runningVersion() const { return fakeVersion_.empty() ? versionString() : fakeVersion_; }
+    void pretendVersion(const std::string& v) { fakeVersion_ = v; }
+    std::string failedVersion() const;  // a release that rolled back here, "" if none
+#ifdef RORO_DEBUG
+    // Debug Builds only, to try the refusals on the real network path: one HTTPS GET to any host
+    // (is its certificate accepted?), and a download cut short or with one byte flipped.
+    void requestProbe(const std::string& host, const std::string& path) { probeHost_ = host; probePath_ = path; probeResult_ = "..."; request_ = Request::Probe; }
+    std::string probeResult() const { return probeResult_; }
+    void damageNextDownload(long cutAfter, long flipAt) { damageCut_ = cutAfter; damageFlip_ = flipAt; }
+    void forgetToday() { store_.putInt("rel_day", 0); nextCheckMs_ = 0; announced_.clear(); }  // the daily check runs at the next tick
+#endif
+
    // The main loop calls this once it has drawn a frame (part of Probation).
    void firstFrameDrawn() { firstFrame_ = true; }
    // True when an installed update is waiting to reboot; the main loop reboots when it's safe.
    bool rebootPending() const { return phase_ == Phase::Installed; }

   private:
+    enum class Request : uint8_t { None, Check, BackgroundCheck, List, Install, Probe };
+
+    void serve();                       // on this task: one request
+    bool makeRoom();                    // true when a TLS connection can start; may have asked holdMemory
+    void installFromGitea(const release::Release& release);
+    void scheduleDailyCheck(uint32_t nowMs);  // from tick()
    static void taskEntry(void* self);
    void listen();
    void install(class UpdateSource& source, const char* via);
@@ -62,6 +101,19 @@ class UpdateService : public Service {
    std::string incoming_;
    bool probation_ = false;
    volatile bool firstFrame_ = false;
+
+    GiteaReleases gitea_;
+    volatile Request request_ = Request::None;
+    volatile bool serving_ = false;
+    bool held_ = false;  // IRC was asked to step aside, on this task
+    std::string installTag_, fakeVersion_, announced_;
+    bool dailyCheck_ = false;
+    uint32_t nextCheckMs_ = 90000;  // not before the device has settled
+#ifdef RORO_DEBUG
+    std::string probeHost_, probePath_;
+    volatile long damageCut_ = -1, damageFlip_ = -1;
+    std::string probeResult_;
+#endif
 };

 }  // namespace roro
@@ -0,0 +1,121 @@
+#include <unity.h>
+
+#include <string>
+
+#include "http_head.h"
+
+using namespace roro::release;
+
+void setUp() {}
+void tearDown() {}
+
+void test_a_head_in_pieces() {
+    std::string response =
+        "HTTP/1.1 200 OK\r\nContent-Type: application/json;charset=utf-8\r\nTransfer-Encoding: chunked\r\n"
+        "X-Other: a: b\r\n\r\n5\r\nhello\r\n0\r\n\r\n";
+    for (size_t piece : {size_t(1), size_t(9), response.size()}) {
+        HttpHeadParser p;
+        size_t used = 0;
+        for (size_t at = 0; at < response.size() && !p.complete(); at += piece)
+            used += p.feed(response.data() + at, std::min(piece, response.size() - at));
+        TEST_ASSERT_TRUE(p.complete());
+        TEST_ASSERT_FALSE(p.failed());
+        TEST_ASSERT_EQUAL_INT(200, p.head().status);
+        TEST_ASSERT_TRUE(p.head().chunked);
+        TEST_ASSERT_EQUAL_STRING("application/json;charset=utf-8", p.head().contentType.c_str());
+        TEST_ASSERT_EQUAL(std::string("HTTP/1.1 200 OK\r\nContent-Type: application/json;charset=utf-8\r\nTransfer-Encoding: chunked\r\nX-Other: a: b\r\n\r\n").size(), used);
+    }
+}
+
+void test_a_download_head() {
+    std::string head = "HTTP/1.1 200 OK\r\ncontent-length: 1885712\r\nCONTENT-DISPOSITION: inline; filename=a.ota\r\n\r\n\x01\x02";
+    HttpHeadParser p;
+    size_t used = p.feed(head.data(), head.size());
+    TEST_ASSERT_EQUAL_size_t(head.size() - 2, used);  // the body isn't touched
+    TEST_ASSERT_EQUAL_INT(200, p.head().status);
+    TEST_ASSERT_EQUAL_INT(1885712, p.head().contentLength);
+    TEST_ASSERT_FALSE(p.head().chunked);
+    std::string redirect = "HTTP/1.1 302 Found\r\nLocation: https://elsewhere.example/x\r\n\r\n";
+    HttpHeadParser r;
+    r.feed(redirect.data(), redirect.size());
+    TEST_ASSERT_EQUAL_INT(302, r.head().status);
+    TEST_ASSERT_EQUAL_STRING("https://elsewhere.example/x", r.head().location.c_str());
+}
+
+void test_a_head_that_is_not_http() {
+    HttpHeadParser p;
+    std::string junk = "\x16\x03\x01 not http at all\r\n\r\n";
+    p.feed(junk.data(), junk.size());
+    TEST_ASSERT_TRUE(p.failed());
+    HttpHeadParser big;
+    std::string endless = "HTTP/1.1 200 OK\r\n" + std::string(5000, 'x');
+    big.feed(endless.data(), endless.size());
+    TEST_ASSERT_TRUE(big.failed());
+    HttpHeadParser odd;
+    std::string status = "HTTP/1.1 999 What\r\n\r\n";
+    odd.feed(status.data(), status.size());
+    TEST_ASSERT_TRUE(odd.failed());
+}
+
+static std::string unchunk(const std::string& in, size_t piece, bool* done = nullptr, bool* failed = nullptr) {
+    ChunkedDecoder d;
+    std::string out;
+    for (size_t at = 0; at < in.size(); at += piece) {
+        size_t n = std::min(piece, in.size() - at);
+        std::string buf(n, '\0');
+        size_t w = d.decode(reinterpret_cast<const uint8_t*>(in.data() + at), n, reinterpret_cast<uint8_t*>(&buf[0]));
+        out.append(buf, 0, w);
+    }
+    if (done) *done = d.done();
+    if (failed) *failed = d.failed();
+    return out;
+}
+
+void test_chunked_bodies() {
+    std::string body = "5\r\nhello\r\n6;ext=1\r\n, worl\r\n1\r\nd\r\n0\r\nTrailer: x\r\n\r\n";
+    for (size_t piece : {size_t(1), size_t(2), size_t(5), body.size()}) {
+        bool done, failed;
+        TEST_ASSERT_EQUAL_STRING("hello, world", unchunk(body, piece, &done, &failed).c_str());
+        TEST_ASSERT_TRUE(done);
+        TEST_ASSERT_FALSE(failed);
+    }
+    bool done;
+    TEST_ASSERT_EQUAL_STRING("abc12345", unchunk("3\r\nabc\r\nA\r\n12345", 4, &done).c_str());  // cut short: what came is given
+    TEST_ASSERT_FALSE(done);
+    std::string hex = "1F\r\n" + std::string(31, 'x') + "\r\n0\r\n\r\n";
+    TEST_ASSERT_EQUAL_size_t(31, unchunk(hex, 3).size());
+    bool failed;
+    unchunk("zz\r\n", 1, nullptr, &failed);
+    TEST_ASSERT_TRUE(failed);
+    unchunk("3\r\nabcXX", 1, nullptr, &failed);  // no CRLF after the data
+    TEST_ASSERT_TRUE(failed);
+    unchunk("FFFFFFFFFFFFFFFFFFFF\r\n", 1, nullptr, &failed);
+    TEST_ASSERT_TRUE(failed);
+}
+
+void test_urls() {
+    Url u = parseUrl("https://git.twis.la/api/v1/repos/x?limit=10");
+    TEST_ASSERT_TRUE(u.ok);
+    TEST_ASSERT_TRUE(u.https);
+    TEST_ASSERT_EQUAL_STRING("git.twis.la", u.host.c_str());
+    TEST_ASSERT_EQUAL_STRING("/api/v1/repos/x?limit=10", u.path.c_str());
+    TEST_ASSERT_EQUAL_INT(443, u.port);
+    u = parseUrl("http://Example.COM:8080");
+    TEST_ASSERT_TRUE(u.ok);
+    TEST_ASSERT_EQUAL_STRING("example.com", u.host.c_str());
+    TEST_ASSERT_EQUAL_STRING("/", u.path.c_str());
+    TEST_ASSERT_EQUAL_INT(8080, u.port);
+    for (const char* bad : {"", "git.twis.la/x", "ftp://a/b", "https:///x", "https://u:p@host/x", "https://host:0/x", "https://ho st/x", "https://host/a b",
+                            "https://host:99999/x", "https://ho_st/x"})
+        TEST_ASSERT_FALSE_MESSAGE(parseUrl(bad).ok, bad);
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_a_head_in_pieces);
+    RUN_TEST(test_a_download_head);
+    RUN_TEST(test_a_head_that_is_not_http);
+    RUN_TEST(test_chunked_bodies);
+    RUN_TEST(test_urls);
+    return UNITY_END();
+}
@@ -0,0 +1,125 @@
+#include <unity.h>
+
+#include <map>
+#include <string>
+#include <vector>
+
+#include "json_scan.h"
+
+using namespace roro::release;
+
+void setUp() {}
+void tearDown() {}
+
+struct Seen {
+    std::vector<std::string> paths;
+    std::map<std::string, std::string> values;
+    std::map<std::string, bool> strings, cut;
+};
+
+static Seen scan(const std::string& json, size_t piece, size_t max = 300, bool* failed = nullptr, bool* done = nullptr) {
+    Seen seen;
+    JsonScanner s(
+        [&](const std::string& path, const std::string& value, bool isString, bool truncated) {
+            seen.paths.push_back(path);
+            seen.values[path] = value;
+            seen.strings[path] = isString;
+            seen.cut[path] = truncated;
+        },
+        max);
+    for (size_t at = 0; at < json.size(); at += piece) s.feed(json.data() + at, std::min(piece, json.size() - at));
+    if (failed) *failed = s.failed();
+    if (done) *done = s.done();
+    return seen;
+}
+
+void test_paths_and_kinds() {
+    std::string json = R"({"tag_name":"v0.10.0","draft":false,"size":1885712,"ratio":-1.5e3,"none":null,
+        "assets":[{"name":"a.ota","size":12},{"name":"b.bin","size":3,"tags":[]},{"name":"c","nested":{"deep":[true,"x"]}}],
+        "empty":{},"last":"end"})";
+    for (size_t piece : {size_t(1), size_t(3), size_t(7), json.size()}) {
+        bool failed, done;
+        Seen s = scan(json, piece, 300, &failed, &done);
+        TEST_ASSERT_FALSE(failed);
+        TEST_ASSERT_TRUE(done);
+        TEST_ASSERT_EQUAL_STRING("v0.10.0", s.values["tag_name"].c_str());
+        TEST_ASSERT_TRUE(s.strings["tag_name"]);
+        TEST_ASSERT_EQUAL_STRING("false", s.values["draft"].c_str());
+        TEST_ASSERT_FALSE(s.strings["draft"]);
+        TEST_ASSERT_EQUAL_STRING("1885712", s.values["size"].c_str());
+        TEST_ASSERT_EQUAL_STRING("-1.5e3", s.values["ratio"].c_str());
+        TEST_ASSERT_EQUAL_STRING("null", s.values["none"].c_str());
+        TEST_ASSERT_EQUAL_STRING("a.ota", s.values["assets[0].name"].c_str());
+        TEST_ASSERT_EQUAL_STRING("3", s.values["assets[1].size"].c_str());
+        TEST_ASSERT_EQUAL_STRING("true", s.values["assets[2].nested.deep[0]"].c_str());
+        TEST_ASSERT_EQUAL_STRING("x", s.values["assets[2].nested.deep[1]"].c_str());
+        TEST_ASSERT_EQUAL_STRING("end", s.values["last"].c_str());
+        TEST_ASSERT_EQUAL_size_t(0, s.values.count("assets[1].tags"));  // empty containers report nothing
+        TEST_ASSERT_EQUAL_size_t(0, s.values.count("empty"));
+    }
+}
+
+void test_top_level_array_and_scalars() {
+    Seen s = scan(R"([{"a":1},{"a":2},"x"])", 4);
+    TEST_ASSERT_EQUAL_STRING("2", s.values["[1].a"].c_str());
+    TEST_ASSERT_EQUAL_STRING("x", s.values["[2]"].c_str());
+    bool done;
+    s = scan("42", 1, 300, nullptr, &done);  // a number ends only when something follows it
+    TEST_ASSERT_FALSE(done);
+    s = scan("42 ", 1, 300, nullptr, &done);
+    TEST_ASSERT_TRUE(done);
+    TEST_ASSERT_EQUAL_STRING("42", s.values[""].c_str());
+}
+
+void test_escapes_and_unicode() {
+    std::string json = R"({"s":"line1\nline2\t\"q\" \\ \/ caf\u00e9 \u20ac \ud83d\ude00 end"})";
+    for (size_t piece : {size_t(1), size_t(5), json.size()}) {
+        Seen s = scan(json, piece);
+        TEST_ASSERT_EQUAL_STRING("line1\nline2\t\"q\" \\ / caf\xC3\xA9 \xE2\x82\xAC \xF0\x9F\x98\x80 end", s.values["s"].c_str());
+    }
+    std::string key = R"({"a\"b":1})";
+    TEST_ASSERT_EQUAL_STRING("1", scan(key, 2).values["a\"b"].c_str());
+}
+
+void test_long_values_are_cut_on_a_character() {
+    std::string json = "{\"body\":\"" + std::string(20, 'a') + "\xC3\xA9\xC3\xA9\"}";  // 24 bytes
+    Seen s = scan(json, 3, 21);                                                         // room for 21: the é would be cut
+    TEST_ASSERT_EQUAL_STRING(std::string(20, 'a').c_str(), s.values["body"].c_str());
+    TEST_ASSERT_TRUE(s.cut["body"]);
+    s = scan(json, 3, 22);
+    TEST_ASSERT_EQUAL_size_t(22, s.values["body"].size());
+    s = scan(json, 3, 100);
+    TEST_ASSERT_FALSE(s.cut["body"]);
+    // What follows a cut value is still read.
+    s = scan(R"({"a":"0123456789","b":"ok"})", 2, 4);
+    TEST_ASSERT_EQUAL_STRING("0123", s.values["a"].c_str());
+    TEST_ASSERT_EQUAL_STRING("ok", s.values["b"].c_str());
+}
+
+void test_what_it_can_not_follow() {
+    bool failed;
+    scan("{\"a\" 1}", 1, 300, &failed);
+    TEST_ASSERT_TRUE(failed);
+    scan("{\"a\":1,,}", 1, 300, &failed);
+    TEST_ASSERT_TRUE(failed);
+    scan("[1,2}", 1, 300, &failed);
+    TEST_ASSERT_TRUE(failed);
+    scan("<html>not json</html>", 1, 300, &failed);
+    TEST_ASSERT_TRUE(failed);
+    scan("{\"a\":\"\\u12G4\"}", 1, 300, &failed);
+    TEST_ASSERT_TRUE(failed);
+    bool done;
+    scan("{\"a\":[1,2", 2, 300, &failed, &done);  // cut short: not an error, not done
+    TEST_ASSERT_FALSE(failed);
+    TEST_ASSERT_FALSE(done);
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_paths_and_kinds);
+    RUN_TEST(test_top_level_array_and_scalars);
+    RUN_TEST(test_escapes_and_unicode);
+    RUN_TEST(test_long_values_are_cut_on_a_character);
+    RUN_TEST(test_what_it_can_not_follow);
+    return UNITY_END();
+}
@@ -0,0 +1 @@
+{"id":18,"tag_name":"v0.10.0","target_commitish":"","name":"roro9stack v0.10.0","body":"v0.10.0: the Notes App (plain text notes in /notes, an editor that saves by itself, up to 16 KB); e in the Storage App's text viewer; keys sent through the Debug Console are no longer swallowed now and then\n\n\n## Files\n\n- `roro9stack-v0.10.0.ota`: the signed Update File. Copy it to `/updates` on the SD card and install it from Settings > Firmware or the Storage App, or push it over Wi-Fi with `scripts/ota_push.py`.\n- `roro9stack-v0.10.0-factory.bin`: the whole flash image, for a first install over USB at offset 0.\n- `roro9stack-v0.10.0.elf.gz`: the symbols, to decode a crash report from this build.\n- `SHA256SUMS`: checksums of the three.\n\n## Changes since v0.9.0\n\n- F1 plan: Notes ships as v0.10.0\n- Notes: plain text notes on the SD card, with an editor that saves by itself (#19)\n- A key sent through the Debug Console could turn the screen \"off\" for a tick\n- F1 plan: the Notes design round (Q141-Q150)\n","url":"https://git.twis.la/api/v1/repos/twisla/roro9stack/releases/18","html_url":"https://git.twis.la/twisla/roro9stack/releases/tag/v0.10.0","tarball_url":"https://git.twis.la/twisla/roro9stack/archive/v0.10.0.tar.gz","zipball_url":"https://git.twis.la/twisla/roro9stack/archive/v0.10.0.zip","upload_url":"https://git.twis.la/api/v1/repos/twisla/roro9stack/releases/18/assets","draft":false,"prerelease":false,"created_at":"2026-10-06T08:11:31Z","published_at":"2026-10-06T08:11:31Z","author":{"id":1,"login":"twisla","login_name":"","source_id":0,"full_name":"Cl\u00e9ment Martin","email":"1+twisla@noreply.git.twis.la","avatar_url":"https://git.twis.la/avatars/db0ad25f6a366bc836e69290433c81ec","html_url":"https://git.twis.la/twisla","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2021-08-17T07:22:50Z","restricted":false,"active":false,"prohibit_login":false,"location":"Earth","website":"https://git.twis.la","description":"Owner of this nice gitea instance.","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"twisla"},"assets":[{"id":2,"name":"SHA256SUMS","size":278,"download_count":2,"created_at":"2026-10-06T10:24:35Z","uuid":"b72c1ea7-af35-4563-917a-9ab56a649219","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/SHA256SUMS"},{"id":3,"name":"roro9stack-v0.10.0-factory.bin","size":1951088,"download_count":1,"created_at":"2026-10-06T10:24:35Z","uuid":"75163ae2-f495-4d5d-9883-ff773321c688","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/roro9stack-v0.10.0-factory.bin"},{"id":4,"name":"roro9stack-v0.10.0.elf.gz","size":14345572,"download_count":0,"created_at":"2026-10-06T10:24:35Z","uuid":"8b04e7fb-fee0-46bd-8be4-3bd67a8f8804","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/roro9stack-v0.10.0.elf.gz"},{"id":5,"name":"roro9stack-v0.10.0.ota","size":1885712,"download_count":2,"created_at":"2026-10-06T10:24:36Z","uuid":"4b827c6e-a57a-4436-b6e5-b8947e66d5ae","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/roro9stack-v0.10.0.ota"}]}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
twislaandClaude Sonnet 5.5	492d8bb187	Site: security.txt, robots.txt, and favicon fallbacks (ICO, touch icon) Site / build (pull_request) Successful in 9s Details security.txt (RFC 9116) under .well-known with the mailbox as contact and an expiry in September 2027. robots.txt allows everything and points to the sitemap. The pixel 9 gets a favicon.ico (32 and 48 px) and an apple-touch-icon.png, drawn by tools/make_favicons.py from the same rectangles as favicon.svg. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 20:12:54 +02:00
twisla	821949e3f8	Merge pull request 'Site: roro9stack.net phase 1 (home, Install with a browser flasher, Downloads), and a CI split for site changes' (#61 ) from site into main CI / build (push) Successful in 1m8s Details Site / build (push) Successful in 7s Details Reviewed-on: #61	2026-10-06 16:33:07 +00:00
twislaandClaude Sonnet 5.5	9415c62132	Site: the build goes to public/ at the repository root, which git ignores CI / build (pull_request) Canceled after 38s Details Site / build (pull_request) Successful in 8s Details output_dir in site/config.toml, so zola build in site/ and zola --root site build from the root both write ./public. The ignore is /public/, not site/public/. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 18:31:57 +02:00
twislaandClaude Sonnet 5.5	6680b752af	W1: what was built and checked in phase 1; the site in the README CI / build (pull_request) Successful in 8m27s Details Site / build (pull_request) Successful in 8s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 18:20:18 +02:00
twislaandClaude Sonnet 5.5	8f4b5e0ddc	Site: roro9stack.net, phase 1 (the home page, Install with a browser flasher, Downloads) A Zola site in site/, from the design: both themes on the device's palette, notched shapes, self-hosted fonts, the wordmark and icons, two generated hero drawings, nine App cards (the mesh messenger marked planned), real screenshots, the updates and build sections. The Install page builds ESP Web Tools' manifest in the browser from the Gitea API (it needs Caddy to allow the origin), refuses any download that isn't on the project's server, and falls back to the esptool steps. Downloads lists the releases. The focus ring shows on notched controls. A page checker fails the build if a page loads from another origin. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 18:20:18 +02:00
twislaandClaude Sonnet 5.5	b92fc6e2e5	CI: a Site workflow, and the firmware workflow skips changes that touch only the site and its documents site.yml builds the site with a Zola pinned by its checksum and checks the pages when site/, docs/, README.md or CONTEXT.md change. ci.yml gets paths-ignore for the same files on pushes to main and on pull requests; a tag always runs it (Gitea doesn't apply path filters to tags). A change touching both runs both. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 18:20:18 +02:00
twislaandClaude Sonnet 5.5	a0939bf741	W1 plan: the flasher reads the release from Gitea behind Caddy's CORS header, no firmware copy Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 17:54:02 +02:00
twislaandClaude Sonnet 5.5	748890deb8	W1 plan: the project website at roro9stack.net (issue #12 ), the design round Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 17:35:25 +02:00
twisla	4f0918ceae	Merge pull request 'v0.11.0 polish: the Debug Build message, the release badge on tags, the CI timings' (#56 ) from fix-release-polish into main CI / build (push) Successful in 1m10s Details Reviewed-on: #56	2026-10-06 15:21:42 +00:00
twislaandClaude Sonnet 5.5	12006bdf94	CI: the release badge follows a tag, not only a push to main CI / build (pull_request) Successful in 8m6s Details After v0.11.0 was published the badge still said v0.10.0 until the next push to main. Tag runs run the tests and coverage already; they now publish the badges too. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 17:01:04 +02:00
twislaandClaude Sonnet 5.5	148611ff4c	Updates: the Debug Build message fits on one line of the screen "A Debug Build keeps its console: update it from your PC" ran off the edge of the release page. It now reads "Debug Build: update from the PC". Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 17:01:04 +02:00
twislaandClaude Sonnet 5.5	325e7755ad	R1 plan: the CI timings, measured from the jobs' own start and end times The first full run took 11.4 minutes, not 17: that was the waiting time. A pull request takes about 8.7, a release build alone 5.5, a push to main 1.1. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 17:01:04 +02:00
twisla	df2aaddbc8	Merge pull request 'Updates from Gitea: check, list and install releases from the device (#6 )' (#55 ) from gitea-updates into main CI / build (push) Successful in 14m4s Details Reviewed-on: #55	2026-10-06 14:29:01 +00:00
twislaandClaude Sonnet 5.5	e2f00e93c2	CI: a branch's pushes run nothing, its pull request runs once CI / build (pull_request) Successful in 8m43s Details A branch with an open pull request ran twice per push: once for the push, once for the pull request. Pushes to main still run the tests and publish the badges; every other branch is tested by its pull request. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 16:17:52 +02:00
twislaandClaude Sonnet 5.5	d490a18b9a	Updates from Gitea, step 5: the daily check's announcement, the docs, ADR 0009 The announcement was cut at the notification's 48 bytes; it now reads "v0.11.0 is out: see Settings > Firmware". README: Updates from Gitea and its limits. ADR 0009: the device trusts the two ISRG roots. R1.md: what was built and the checks on the device, with what wasn't checked. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 16:16:32 +02:00
twislaandClaude Sonnet 5.5	4ef41347ab	Updates from Gitea, step 4: the Firmware page shows the project's releases Latest release (checked on Enter, or c), Older releases (the last ten, newest first), a release page with the tag's message, and an install dialog; going back to an older release asks differently. A failed check someone asked for shows a Toast. A Debug Build shows the latest release and says it can't install it: it would take its console away. Tried on the device: a check, the list, the release page, the dialog (Cancel is the default; Back cancels), and the install from the screen with its progress screen, then the restart into the release build and its confirmation. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 16:06:49 +02:00
twislaandClaude Sonnet 5.5	510ce42a99	Updates from Gitea, step 3: install from Gitea, and IRC steps aside for it A release downloads straight into the inactive slot through the existing install path: the signature is checked after 160 bytes, before anything is written, the hash at the end. Tried on the device against the real server: a download cut short, a flipped byte in the signature and one in the image are each refused with the running firmware untouched; the real v0.10.0 installed, restarted, and confirmed itself on Probation. A TLS connection to Gitea peaks at about 52 KB of heap whether or not the certificate is verified. With IRC connected (66 KB free) a check left 3 KB and a download 836 bytes. A check, list or install a person asks for now makes IRC step aside (holdForUpdate) and come back after: the lowest free heap during a full download with IRC connected is 38 KB. The daily check never interrupts IRC; with IRC up it waits. A TLS connection starts with 80 KB free (it was 55). Debug Builds get test knobs: update probe <host>, update damage cut\|flip, update pretend <version>. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 15:51:10 +02:00
twislaandClaude Sonnet 5.5	5754ae5b57	Updates from Gitea, step 2: the connection (check and list work on the device) The roots (ISRG X1 and X2), an HTTPS client that reads the answer as a stream, GiteaReleases (the latest and a list of ten), the Update Service's requests, install from Gitea through the existing install path, the daily check's schedule, the Check for updates setting, and console commands: update check \| list \| status \| install <tag>. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 15:20:58 +02:00
twislaandClaude Sonnet 5.5	b0e8226943	Updates from Gitea, step 1: the model (host-tested) A streaming JSON scanner (a 33 KB list of releases costs a few hundred bytes), the release reader built on it, HTTP response heads and chunked bodies, URLs, and the decisions: which release is an update, whether to announce it, and which download URLs the device takes. Tested against the real answers of git.twis.la. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 15:11:58 +02:00
twislaandClaude Sonnet 5.5	6b7e90765f	R1 plan: updates from Gitea, the design round (Q162-Q174) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 15:08:33 +02:00
twisla	3120c63b4b	Merge pull request 'CI: coverage and badges; tests on a push, builds on a pull request' (#51 ) from coverage into main CI / build (push) Successful in 1m7s Details Reviewed-on: #51	2026-10-06 12:39:25 +00:00
twislaandClaude Opus 5.5	873af31e21	R1 plan: pull requests, merged by rebase then a merge commit (Q161) CI / build (push) Successful in 1m6s Details CI / build (pull_request) Successful in 8m17s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 14:37:44 +02:00
twislaandClaude Opus 5.5	16345ed6b3	CI: the badges are published from main only CI / build (push) Successful in 1m5s Details CI / build (pull_request) Successful in 8m19s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 14:23:08 +02:00
twislaandClaude Opus 5.5	86ddb87f54	CI: a push runs the tests, a pull request also builds the firmware CI / build (push) Successful in 1m6s Details Rebuilding both firmwares on every push was more than anyone looked at. A push now runs the host tests with their coverage (under two minutes); a pull request adds the release firmware and the Debug Build, and is how changes reach main; a tag still does everything before it releases. Pull requests from forks don't run. scripts/ci.sh takes 'tests' or 'builds' for one half; coverage.sh now fails when a test fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 14:19:56 +02:00
twislaandClaude Opus 5.5	5ecd5d003f	Coverage of lib/ by the host tests, and badges in the README CI / build (push) Successful in 9m9s Details scripts/coverage.sh builds the host tests with coverage counters and reports with gcovr: 94.6% of the 3,193 lines of lib/ today (lib/SD and src/ have no host tests and aren't counted). CI runs it on every push, puts the figure in the job's summary, and on main publishes a coverage badge and a latest-release badge to the branch 'badges'. The README shows them next to Gitea's own badge for the workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 13:56:08 +02:00
twislaandClaude Opus 5.5	edc140e30c	Merge branch 'ci': CI on every push, a signed release on every tag CI / build (push) Successful in 8m10s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 13:51:19 +02:00
twislaandClaude Opus 5.5	6459ca5446	R1 plan: CI and releases are in place CI / build (push) Successful in 8m8s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 13:51:18 +02:00
twislaandClaude Opus 5.5	a94c14f000	R1 plan: CI as built on the container runner CI / build (push) Successful in 8m5s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 12:52:43 +02:00
twislaandClaude Opus 5.5	db7e6ccc18	CI: jobs run in a container, PlatformIO directly in it, the toolchains in a volume CI / build (push) Successful in 8m5s Details The runner now gives each job a container. The workflow asks for python:3.12-slim, installs git, a compiler and PlatformIO, and mounts the roro9stack-pio volume as the cache; the scripts skip their own docker run when RORO_NO_DOCKER says they're in the build container already. A tag from before the framework was rebuilt gets the stock framework libraries back before it builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 12:39:37 +02:00
twislaandClaude Opus 5.5	ababfaf993	Release build: tags from before Firmware Updates carry no public key to check against CI / build (push) Failing after 12m51s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 12:25:20 +02:00
twislaandClaude Opus 5.5	6b6bb975f5	R1 plan and ADR 0008: CI signs releases; README section on CI CI / build (push) Successful in 8m0s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 12:19:00 +02:00
twislaandClaude Opus 5.5	1fade6287b	CI: tests and builds on every push, a signed release on a tag (#5 ) CI / build (push) Successful in 11m26s Details The workflow runs on the runner's host and builds in the project's Docker image through scripts/ci.sh, as on a developer's machine. A tag v*, or a run by hand for an older tag, builds that tag's sources, signs the Update File with the key held in the repository's secrets, checks the signature against the public key in the sources, and publishes a Gitea release with the .ota, the factory image, the ELF and checksums. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 12:06:57 +02:00
twislaandClaude Opus 5.5	661227cd2d	CI: try the runner's label as it is registered CI / probe (push) Successful in 0s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 11:58:53 +02:00
twislaandClaude Opus 5.5	c481bb5191	CI: a first workflow, to see what the runner gives a job (#5 ) CI / probe (push) Successful in 19s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 11:56:10 +02:00
twislaandClaude Opus 5.5	9f65c75f01	Merge branch 'notes': the Notes App Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-06 10:11:31 +02:00
				`@@ -0,0 +1 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 7 7" shape-rendering="crispEdges"><rect width="7" height="7" fill="#000055"/><g fill="#00dbff"><rect x="1" y="0" width="3" height="1"/><rect x="0" y="1" width="1" height="2"/><rect x="4" y="1" width="1" height="5"/><rect x="1" y="3" width="3" height="1"/><rect x="0" y="6" width="3" height="1"/></g></svg>`
				`@@ -0,0 +1 @@`
				<svg xmlns="http://www.w3.org/2000/svg" viewBox="-6.0 -78.0 612.0 85.2" role="img" aria-label="roro9stack"><path fill="#ffffff" d="M7.7 0V-9.2H19.8V-37.1Q19.8 -40.4 16.6 -40.4H8.7V-49.6H20.6Q24.7 -49.6 27.3 -47.2Q29.9 -44.9 29.9 -40.7V-39.5H30.4Q31.5 -45.1 35.2 -48Q38.8 -50.8 45.8 -50.8H53.5V-39.6H42.7Q36.8 -39.6 33.6 -35.5Q30.4 -31.4 30.4 -25.7V-9.2H45.8V0Z"></path><path fill="#ffffff" d="M90 1.2Q82.9 1.2 77.3 -2Q71.7 -5.2 68.5 -11.1Q65.3 -16.9 65.3 -24.8Q65.3 -32.7 68.5 -38.6Q71.7 -44.4 77.3 -47.6Q82.9 -50.8 90.1 -50.8Q97.3 -50.8 102.9 -47.6Q108.4 -44.4 111.6 -38.6Q114.7 -32.7 114.7 -24.8Q114.7 -16.9 111.5 -11.1Q108.3 -5.2 102.8 -2Q97.2 1.2 90 1.2ZM90 -8.9Q93.8 -8.9 97 -10.6Q100.2 -12.3 102.2 -15.9Q104.1 -19.4 104.1 -24.8Q104.1 -30.3 102.2 -33.8Q100.2 -37.3 97.1 -39Q93.9 -40.7 90.1 -40.7Q86.3 -40.7 83.1 -39Q79.9 -37.3 78 -33.8Q76 -30.3 76 -24.8Q76 -16.6 80.2 -12.8Q84.3 -8.9 90 -8.9Z"></path><path fill="#ffffff" d="M127.7 0V-9.2H139.8V-37.1Q139.8 -40.4 136.6 -40.4H128.7V-49.6H140.6Q144.7 -49.6 147.3 -47.2Q149.9 -44.9 149.9 -40.7V-39.5H150.4Q151.5 -45.1 155.2 -48Q158.8 -50.8 165.8 -50.8H173.5V-39.6H162.7Q156.8 -39.6 153.6 -35.5Q150.4 -31.4 150.4 -25.7V-9.2H165.8V0Z"></path><path fill="#ffffff" d="M210 1.2Q202.9 1.2 197.3 -2Q191.7 -5.2 188.5 -11.1Q185.3 -16.9 185.3 -24.8Q185.3 -32.7 188.5 -38.6Q191.7 -44.4 197.3 -47.6Q202.9 -50.8 210.1 -50.8Q217.3 -50.8 222.9 -47.6Q228.4 -44.4 231.6 -38.6Q234.7 -32.7 234.7 -24.8Q234.7 -16.9 231.5 -11.1Q228.3 -5.2 222.8 -2Q217.2 1.2 210 1.2ZM210 -8.9Q213.8 -8.9 217 -10.6Q220.2 -12.3 222.1 -15.9Q224.1 -19.4 224.1 -24.8Q224.1 -30.3 222.1 -33.8Q220.2 -37.3 217.1 -39Q213.9 -40.7 210.1 -40.7Q206.3 -40.7 203.1 -39Q199.9 -37.3 197.9 -33.8Q196 -30.3 196 -24.8Q196 -16.6 200.2 -12.8Q204.3 -8.9 210 -8.9Z"></path><path fill="#00dbff" d="M268.7 1.2Q262.1 1.2 257.1 -1.4Q252.1 -4 249.1 -8.4Q246.1 -12.9 245.5 -18.5H255.7Q256.7 -13.8 260.1 -11.1Q263.5 -8.4 268.7 -8.4Q276 -8.4 280.5 -14.8Q285 -21.1 285.7 -34.6H285Q282.5 -30.4 278.6 -27.7Q274.7 -25 267.5 -25Q261.5 -25 256.5 -27.9Q251.5 -30.7 248.5 -35.8Q245.5 -40.9 245.5 -47.6Q245.5 -54 248.4 -59.4Q251.3 -64.7 256.6 -68Q261.8 -71.2 269 -71.2Q278.2 -71.2 284.1 -67.1Q290 -62.9 292.9 -55.4Q295.7 -47.8 295.7 -37.5Q295.7 -25.9 292.5 -17.2Q289.4 -8.5 283.4 -3.6Q277.3 1.2 268.7 1.2ZM269.7 -34.5Q275.9 -34.5 279.6 -38.4Q283.4 -42.2 283.4 -48Q283.4 -53.9 279.6 -57.8Q275.9 -61.6 269.7 -61.6Q263.5 -61.6 259.8 -57.8Q256 -54 256 -48.1Q256 -42.2 259.8 -38.4Q263.5 -34.5 269.7 -34.5Z"></path><path fill="#ffffff" d="M330.4 1.2Q320.6 1.2 314.8 -3.4Q309 -8 308.2 -15.6H319.1Q319.7 -12.1 322.6 -9.9Q325.6 -7.7 330.5 -7.7Q335.2 -7.7 337.8 -9.7Q340.3 -11.6 340.3 -14.2Q340.3 -18 337.2 -19.4Q334.2 -20.8 328.3 -21.5Q323.2 -22.1 319 -23.9Q314.9 -25.6 312.5 -28.7Q310.1 -31.7 310.1 -36.3Q310.1 -42.8 315.2 -46.8Q320.3 -50.8 329.4 -50.8Q338.5 -50.8 343.5 -46.7Q348.5 -42.6 349.3 -35.5H339.1Q338.7 -38.5 336 -40.2Q333.3 -42 329.3 -42Q325.2 -42 322.8 -40.5Q320.4 -38.9 320.4 -36.4Q320.4 -31 332 -29.8Q337.5 -29.2 341.8 -27.8Q346.1 -26.3 348.6 -23.2Q351.1 -20.2 351.1 -14.7Q351.2 -10.2 348.5 -6.6Q345.9 -3 341.2 -0.9Q336.6 1.2 330.4 1.2Z"></path><path fill="#ffffff" d="M395.4 0Q388.1 0 383.8 -3.6Q379.5 -7.1 379.5 -16.2V-40.6H367V-49.6H374.4Q379.5 -49.6 380.4 -54.6L381.9 -62.6H390.1V-49.6H409.7V-40.6H390.1V-16.4Q390.1 -12.5 391.9 -10.9Q393.6 -9.4 397.9 -9.4H409.5V0Z"></path><path fill="#ffffff" d="M445.5 1.2Q439.6 1.2 435.6 -0.9Q431.6 -2.9 429.6 -6.4Q427.6 -9.8 427.6 -13.9Q427.6 -21.2 433 -25.3Q438.3 -29.4 448.1 -29.4H460.9V-30.5Q460.9 -41.7 450.5 -41.7Q446.2 -41.7 443.2 -39.9Q440.3 -38 439.3 -33.9H428.7Q429.5 -41.7 435.4 -46.2Q441.4 -50.8 450.5 -50.8Q461.5 -50.8 466.5 -45.4Q471.5 -40 471.5 -30.5V0H462.5L461.6 -7.3H460.9Q458.7 -3.8 455.4 -1.3Q452.1 1.2 445.5 1.2ZM447.5 -7.7Q454 -7.7 457.2 -11.7Q460.5 -15.6 460.8 -21.7H449.2Q443.5 -21.7 441.1 -19.9Q438.8 -18 438.8 -14.7Q438.8 -11.4 441.1 -9.6Q443.5 -7.7 447.5 -7.7Z"></path><path fill="#ffffff" d="M510.7 1.2Q503.8 1.2 498.4 -2Q492.9 -5.2 489.8 -11.1Q486.7 -16.9 486.7 -24.8Q486.7 -32.7 489.9 -38.5Q493 -44.3 498.4 -47.6Q503.8 -50.8 510.7 -50.8Q520.2 -50.8 526 -46.1Q531.9 -41.3 533.5 -33H522.4Q521.4 -36.6 518.3 -38.7Q515.3 -40.8 510.6 -40.8Q507.2 -40.8 504.1 -39Q501.1 -37.2 499.2 -33.7Q497.4 -30.1 497.4 -24.8Q497.4 -19.6 499.2 -16Q501.1 -12.4 504.1 -10.6Q507.2 -8.7 510.6 -8.7Q515.4 -8.7 518.3 -10.8Q521.2 -12.9 522.4 -16.6H533.5Q531.5 -8.4 525.7 -3.6Q519.9 1.2 510.7 1.2Z"></path><path fill="#ffffff" d="M549.8 0V-72H560.4V-28.8L579.4 -49.6H592.7L572 -27.6V-26.8L595.4 0H582.5L560.4 -25.5V0Z"></path></svg>
				`@@ -0,0 +1 @@`
				import{ESP32ROM as t}from"./esp32-DNPRK0Ay.js";import"./install-dialog-im156JnI.js";import"./styles-sT2V1cOw.js";class i extends t{constructor(){super(...arguments),this.CHIP_NAME="ESP32-S3",this.IMAGE_CHIP_ID=9,this.EFUSE_BASE=1610641408,this.MAC_EFUSE_REG=this.EFUSE_BASE+68,this.EFUSE_BLOCK1_ADDR=this.EFUSE_BASE+68,this.EFUSE_BLOCK2_ADDR=this.EFUSE_BASE+92,this.UART_CLKDIV_REG=1610612756,this.UART_CLKDIV_MASK=1048575,this.UART_DATE_REG_ADDR=1610612864,this.FLASH_WRITE_SIZE=1024,this.BOOTLOADER_FLASH_OFFSET=0,this.SPI_REG_BASE=1610620928,this.SPI_USR_OFFS=24,this.SPI_USR1_OFFS=28,this.SPI_USR2_OFFS=32,this.SPI_MOSI_DLEN_OFFS=36,this.SPI_MISO_DLEN_OFFS=40,this.SPI_W0_OFFS=88,this.USB_RAM_BLOCK=2048,this.UARTDEV_BUF_NO_USB=3,this.UARTDEV_BUF_NO=1070526796,this.IROM_MAP_START=1107296256,this.IROM_MAP_END=1140850688,this.MEMORY_MAP=[[0,65536,"PADDING"],[1006632960,1023410176,"DROM"],[1023410176,1040187392,"EXTRAM_DATA"],[1611653120,1611661312,"RTC_DRAM"],[1070104576,1070596096,"BYTE_ACCESSIBLE"],[1070104576,1077813248,"MEM_INTERNAL"],[1070104576,1070596096,"DRAM"],[1073741824,1073848576,"IROM_MASK"],[1077346304,1077805056,"IRAM"],[1611653120,1611661312,"RTC_IRAM"],[1107296256,1115684864,"IROM"],[1342177280,1342185472,"RTC_DATA"]]}async getChipDescription(t){const i=await this.getMajorChipVersion(t),s=await this.getMinorChipVersion(t);return`${{0:"ESP32-S3 (QFN56)",1:"ESP32-S3-PICO-1 (LGA56)"}[await this.getPkgVersion(t)]\|\|"unknown ESP32-S3"} (revision v${i}.${s})`}async getPkgVersion(t){return await t.readReg(this.EFUSE_BLOCK1_ADDR+12)>>21&7}async getRawMinorChipVersion(t){return((await t.readReg(this.EFUSE_BLOCK1_ADDR+20)>>23&1)<<3)+(await t.readReg(this.EFUSE_BLOCK1_ADDR+12)>>18&7)}async getMinorChipVersion(t){const i=await this.getRawMinorChipVersion(t);return await this.isEco0(t,i)?0:this.getRawMinorChipVersion(t)}async getRawMajorChipVersion(t){return await t.readReg(this.EFUSE_BLOCK1_ADDR+20)>>24&3}async getMajorChipVersion(t){const i=await this.getRawMinorChipVersion(t);return await this.isEco0(t,i)?0:this.getRawMajorChipVersion(t)}async getBlkVersionMajor(t){return await t.readReg(this.EFUSE_BLOCK2_ADDR+16)>>0&3}async getBlkVersionMinor(t){return await t.readReg(this.EFUSE_BLOCK1_ADDR+12)>>24&7}async isEco0(t,i){return 0==(7&i)&&1===await this.getBlkVersionMajor(t)&&1===await this.getBlkVersionMinor(t)}async getFlashCap(t){const i=this.EFUSE_BASE+68+12;return await t.readReg(i)>>27&7}async getFlashVendor(t){const i=this.EFUSE_BASE+68+16;return{1:"XMC",2:"GD",3:"FM",4:"TT",5:"BY"}[await t.readReg(i)>>0&7]\|\|""}async getPsramCap(t){const i=this.EFUSE_BASE+68+16;return await t.readReg(i)>>3&3}async getPsramVendor(t){const i=this.EFUSE_BASE+68+16;return{1:"AP_3v3",2:"AP_1v8"}[await t.readReg(i)>>7&3]\|\|""}async getChipFeatures(t){const i=["Wi-Fi","BLE"],s=await this.getFlashCap(t),e=await this.getFlashVendor(t),a={0:null,1:"Embedded Flash 8MB",2:"Embedded Flash 4MB"}[s],r=void 0!==a?a:"Unknown Embedded Flash";null!==a&&i.push(`${r} (${e})`);const n=await this.getPsramCap(t),_=await this.getPsramVendor(t),h={0:null,1:"Embedded PSRAM 8MB",2:"Embedded PSRAM 2MB"}[n],E=void 0!==h?h:"Unknown Embedded PSRAM";return null!==h&&i.push(`${E} (${_})`),i}async getCrystalFreq(t){return 40}_d2h(t){const i=(+t).toString(16);return 1===i.length?"0"+i:i}async postConnect(t){const i=255&await t.readReg(this.UARTDEV_BUF_NO);t.debug("In _post_connect "+i),i==this.UARTDEV_BUF_NO_USB&&(t.ESP_RAM_BLOCK=this.USB_RAM_BLOCK)}async readMac(t){let i=await t.readReg(this.MAC_EFUSE_REG);i>>>=0;let s=await t.readReg(this.MAC_EFUSE_REG+4);s=s>>>0&65535;const e=new Uint8Array(6);return e[0]=s>>8&255,e[1]=255&s,e[2]=i>>24&255,e[3]=i>>16&255,e[4]=i>>8&255,e[5]=255&i,this._d2h(e[0])+":"+this._d2h(e[1])+":"+this._d2h(e[2])+":"+this._d2h(e[3])+":"+this._d2h(e[4])+":"+this._d2h(e[5])}getEraseSize(t,i){return i}}export{i as ESP32S3ROM};
				`@@ -0,0 +1 @@`
				const e=async t=>{let o;import("./install-dialog-im156JnI.js").then((function(e){return e.i}));try{o=await navigator.serial.requestPort()}catch(o){return"NotFoundError"===o.name?void import("./index-Dt9w-IG1.js").then((o=>o.openNoPortPickedDialog((()=>e(t))))):void alert(`Error: ${o.message}`)}if(!o)return;try{await o.open({baudRate:115200,bufferSize:8192})}catch(e){return void alert(e.message)}const n=document.createElement("ewt-install-dialog");n.port=o,n.manifestPath=t.manifest\|\|t.getAttribute("manifest"),n.overrides=t.overrides,n.addEventListener("closed",(()=>{o.close()}),{once:!0}),document.body.appendChild(n)};class t extends HTMLElement{connectedCallback(){if(this.renderRoot)return;if(this.renderRoot=this.attachShadow({mode:"open"}),!t.isSupported\|\|!t.isAllowed)return this.toggleAttribute("install-unsupported",!0),void(this.renderRoot.innerHTML=t.isAllowed?"<slot name='unsupported'>Your browser does not support installing things on ESP devices. Use Mozilla Firefox, Google Chrome or Microsoft Edge.</slot>":"<slot name='not-allowed'>You can only install ESP devices on HTTPS websites or on the localhost.</slot>");this.toggleAttribute("install-supported",!0);const o=document.createElement("slot");o.addEventListener("click",(async t=>{t.preventDefault(),e(this)})),o.name="activate";const n=document.createElement("button");if(n.innerText="Connect",o.append(n),"adoptedStyleSheets"in Document.prototype&&"replaceSync"in CSSStyleSheet.prototype){const e=new CSSStyleSheet;e.replaceSync(t.style),this.renderRoot.adoptedStyleSheets=[e]}else{const e=document.createElement("style");e.innerText=t.style,this.renderRoot.append(e)}this.renderRoot.append(o)}}t.isSupported="serial"in navigator,t.isAllowed=window.isSecureContext,t.style='\n button {\n position: relative;\n cursor: pointer;\n font-size: 14px;\n font-weight: 500;\n padding: 10px 24px;\n color: var(--esp-tools-button-text-color, #fff);\n background-color: var(--esp-tools-button-color, #03a9f4);\n border: none;\n border-radius: var(--esp-tools-button-border-radius, 9999px);\n }\n button::before {\n content: " ";\n position: absolute;\n top: 0;\n bottom: 0;\n left: 0;\n right: 0;\n opacity: 0.2;\n border-radius: var(--esp-tools-button-border-radius, 9999px);\n }\n button:hover::before {\n background-color: rgba(255,255,255,.8);\n }\n button:focus {\n outline: none;\n }\n button:focus::before {\n background-color: white;\n }\n button:active::before {\n background-color: grey;\n }\n :host([active]) button {\n color: rgba(0, 0, 0, 0.38);\n background-color: rgba(0, 0, 0, 0.12);\n box-shadow: none;\n cursor: unset;\n pointer-events: none;\n }\n .hidden {\n display: none;\n }',customElements.define("esp-web-install-button",t);
				`@@ -0,0 +1 @@`
				{"id":18,"tag_name":"v0.10.0","target_commitish":"","name":"roro9stack v0.10.0","body":"v0.10.0: the Notes App (plain text notes in /notes, an editor that saves by itself, up to 16 KB); e in the Storage App's text viewer; keys sent through the Debug Console are no longer swallowed now and then\n\n\n## Files\n\n- `roro9stack-v0.10.0.ota`: the signed Update File. Copy it to `/updates` on the SD card and install it from Settings > Firmware or the Storage App, or push it over Wi-Fi with `scripts/ota_push.py`.\n- `roro9stack-v0.10.0-factory.bin`: the whole flash image, for a first install over USB at offset 0.\n- `roro9stack-v0.10.0.elf.gz`: the symbols, to decode a crash report from this build.\n- `SHA256SUMS`: checksums of the three.\n\n## Changes since v0.9.0\n\n- F1 plan: Notes ships as v0.10.0\n- Notes: plain text notes on the SD card, with an editor that saves by itself (#19)\n- A key sent through the Debug Console could turn the screen \"off\" for a tick\n- F1 plan: the Notes design round (Q141-Q150)\n","url":"https://git.twis.la/api/v1/repos/twisla/roro9stack/releases/18","html_url":"https://git.twis.la/twisla/roro9stack/releases/tag/v0.10.0","tarball_url":"https://git.twis.la/twisla/roro9stack/archive/v0.10.0.tar.gz","zipball_url":"https://git.twis.la/twisla/roro9stack/archive/v0.10.0.zip","upload_url":"https://git.twis.la/api/v1/repos/twisla/roro9stack/releases/18/assets","draft":false,"prerelease":false,"created_at":"2026-10-06T08:11:31Z","published_at":"2026-10-06T08:11:31Z","author":{"id":1,"login":"twisla","login_name":"","source_id":0,"full_name":"Cl\u00e9ment Martin","email":"1+twisla@noreply.git.twis.la","avatar_url":"https://git.twis.la/avatars/db0ad25f6a366bc836e69290433c81ec","html_url":"https://git.twis.la/twisla","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2021-08-17T07:22:50Z","restricted":false,"active":false,"prohibit_login":false,"location":"Earth","website":"https://git.twis.la","description":"Owner of this nice gitea instance.","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"twisla"},"assets":[{"id":2,"name":"SHA256SUMS","size":278,"download_count":2,"created_at":"2026-10-06T10:24:35Z","uuid":"b72c1ea7-af35-4563-917a-9ab56a649219","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/SHA256SUMS"},{"id":3,"name":"roro9stack-v0.10.0-factory.bin","size":1951088,"download_count":1,"created_at":"2026-10-06T10:24:35Z","uuid":"75163ae2-f495-4d5d-9883-ff773321c688","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/roro9stack-v0.10.0-factory.bin"},{"id":4,"name":"roro9stack-v0.10.0.elf.gz","size":14345572,"download_count":0,"created_at":"2026-10-06T10:24:35Z","uuid":"8b04e7fb-fee0-46bd-8be4-3bd67a8f8804","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/roro9stack-v0.10.0.elf.gz"},{"id":5,"name":"roro9stack-v0.10.0.ota","size":1885712,"download_count":2,"created_at":"2026-10-06T10:24:36Z","uuid":"4b827c6e-a57a-4436-b6e5-b8947e66d5ae","browser_download_url":"https://git.twis.la/twisla/roro9stack/releases/download/v0.10.0/roro9stack-v0.10.0.ota"}]}