Merge branch 'm2': GNSS, and the memory back

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT
Rebuild the framework with smaller TLS buffers (ADR 0006)
2026-10-04 23:42:41 +02:00 · 2026-10-04 23:32:29 +02:00 · 2026-10-04 23:17:48 +02:00 · 2026-10-04 23:02:35 +02:00 · 2026-10-04 22:52:07 +02:00 · 2026-10-04 22:46:57 +02:00
133 changed files with 10360 additions and 119 deletions
@@ -1,3 +1,11 @@
 .pio/
 .vscode/
 *.pyc
+
+# Private signing keys never belong in the repository (ADR 0003)
+*key.pem
+
+# Generated by pioarduino's hybrid compile from custom_sdkconfig (platformio.ini)
+.dummy/
+managed_components/
+sdkconfig.*
@@ -40,10 +40,38 @@ _Avoid_: DM (in docs), private message
 Rebroadcasting another Node's packet so it travels further across the mesh.
 _Avoid_: forwarding, repeating

+**GNSS Service**:
+The Service that owns the GNSS receiver on the Cap: it reads its NMEA sentences in the background and holds the current Fix, position, time and satellites.
+_Avoid_: GPS (GPS is one constellation among several)
+
+**Fix**:
+What the receiver currently knows: none, 2D (position without altitude) or 3D (with altitude), from how many satellites, at what HDOP.
+_Avoid_: lock, signal
+
+**Track**:
+A route recorded from GNSS positions to a GPX file on the SD card, started and stopped by the user.
+_Avoid_: trace, log (a Log is recorded on its own)
+
 **Wi-Fi Service**:
-The Service that owns the Wi-Fi radio. It's always in exactly one mode: *Off*, *Connected* (joined to an access point) or *Monitoring* (passively observing). It's Off unless an App asks for another mode.
+The Service that owns the Wi-Fi radio. It's always in exactly one mode: *Off*, *Connected* (joined to a Saved Network) or *Monitoring* (passively observing). When Wi-Fi is enabled in Settings, it stays Connected whenever a Saved Network is in range. It goes Monitoring only while Wi-Fi Tools needs it, then reconnects.
 _Avoid_: network manager

+**Saved Network**:
+A Wi-Fi network the device may join on its own (name, password). When several are in range, the strongest wins.
+_Avoid_: profile, known network
+
+**IRC Service**:
+The Service that keeps the IRC connection alive in the background once the IRC App has started it, until the user stops it (`/quit`, or `irc stop` on the console). Once stopped by hand, opening the App again doesn't reconnect; typing a line does. It reconnects after drops, and pauses while the Wi-Fi Service is Monitoring. It does not start by itself after a reboot.
+_Avoid_: IRC client (that's the App)
+
+**Buffer**:
+One IRC conversation shown in the IRC App: the server, a channel, or a private chat with one nick. Each Buffer counts its unread messages.
+_Avoid_: window, tab, room
+
+**Mention**:
+An IRC message containing the user's nick, or any private message. Mentions raise Notifications; other traffic only counts as unread.
+_Avoid_: highlight, ping
+
 **Status Bar**:
 The strip shown on every screen with system state at a glance: battery, GNSS fix, mesh activity, Wi-Fi mode and unread count.
 _Avoid_: header, top bar
@@ -75,7 +103,7 @@ The `opt` key used as a dead key. Pressing it and then a base letter types an ac
 _Avoid_: modifier, alt

 **Log**:
-History the device records automatically in the background: mesh message history, IRC logs, probe-request logs.
+History the device records automatically in the background: mesh message history, IRC logs, Wi-Fi scan logs.
 _Avoid_: history file, dump

 **Capture**:
@@ -88,18 +116,49 @@ The Notification raised once per boot when the SD card passes 80% full. Selectin
 **Storage Clean-up**:
 The screen where the user deletes old Logs and Captures by category and age, with a preview of the space freed. Notes are never offered for deletion.

+**Firmware Update**:
+Installing a new firmware image without a USB cable: pushed over Wi-Fi from the developer's PC, or read from the SD card.
+_Avoid_: flash, upgrade (alone)
+
+**Update File**:
+One signed file (`.ota`) that carries a firmware version, its image and a signature. The same file works over Wi-Fi and from the SD card. Anything not signed with the project's key is refused.
+_Avoid_: binary, bin
+
+**Probation**:
+The state of newly installed firmware until it proves healthy: booted, UI drawn, Services started, 30 s without a crash, and Wi-Fi connected if it's configured. Then it's confirmed for good.
+_Avoid_: trial, test mode
+
+**Rollback**:
+Returning automatically to the previous firmware when new firmware resets or crashes during Probation.
+_Avoid_: revert, downgrade (a downgrade is installing an older version on purpose)
+
+**Safe Mode**:
+What the firmware starts instead of everything else after 3 crash restarts in a row: Wi-Fi and Firmware Updates (and the Debug Console in a Debug Build), so it can be fixed without a cable. A normal restart leaves it.
+_Avoid_: recovery mode, failsafe
+
+**Debug Build**:
+A firmware built with the remote debugging aids compiled in (`+debug` in its version). Release builds have none of them.
+_Avoid_: dev build, test build (a test build is one made to fail on purpose, such as a crashing update)
+
+**Debug Console**:
+The console of a Debug Build over Wi-Fi: live log lines and the serial commands, behind a token.
+_Avoid_: telnet, remote shell
+
 ## Relationships

 - The **Launcher** starts **Apps**. Exactly one **App** is in the foreground.
 - **Services** keep running underneath, regardless of which **App** is in the foreground.
 - The **Mesh Service** speaks one or more **Mesh Protocols** and tracks the known **Nodes**.
- The **Wi-Fi Service** serves one **App** at a time. Monitoring and Connected are mutually exclusive.
+- The **Wi-Fi Service** is either Connected or Monitoring, never both. Monitoring pauses the **IRC Service**, which reconnects and rejoins its **Buffers** afterwards.
 - **Services** raise **Notifications**; the **Status Bar** summarises **Service** state.
 - A **Sweep** pauses the **Mesh Service**; a **Sniffer** does not.
 - Every transmission is bounded by the **Region** and its **Duty Cycle Budget**.
 - Past 90% SD usage, **Logs** stop being written; the remaining space is kept for **Captures**. Nothing is deleted without the user's confirmation.
+- A **Firmware Update** installs an **Update File**; the new firmware runs on **Probation**, and fails back by **Rollback**.
+- **Rollback** covers new firmware; **Safe Mode** covers confirmed firmware that keeps crashing.
 - A **Node** may be in several **Channels**. A **Direct Message** targets exactly one **Node**.

 ## Flagged ambiguities

 - "LoRa" was used both for the radio and for the mesh. Resolved: say **Mesh Service** for the always-on participation and **Mesh Protocol** for the on-air format. The LoRa Scanner **App** uses the radio directly and doesn't speak a **Mesh Protocol**.
+- "Channel" has three meanings here. Resolved: an unqualified **Channel** is the mesh one. The others are always qualified as "IRC channel" (a kind of **Buffer**) and "Wi-Fi channel" (radio frequency, 1–13).
@@ -18,6 +18,8 @@ scripts/ci.sh

 This runs the host-side unit tests (`test/`, `native` environment), then builds the firmware. The output is `.pio/build/cardputer-adv/firmware.factory.bin`.

+The framework is rebuilt with the TLS settings in `platformio.ini` (`custom_sdkconfig`, ADR 0006), so the first build after a fresh checkout takes about 4 minutes; later builds take under a minute.
+
 ## Flash

 1. Connect the Cardputer by USB-C.
@@ -37,6 +39,21 @@ This runs the host-side unit tests (`test/`, `native` environment), then builds
 sudo usermod -aG dialout "$USER"
 ```

+## Firmware Updates over Wi-Fi (OTA)
+
+Once the Cardputer runs an OTA-capable firmware (flashed once over USB), updates can go over Wi-Fi:
+
+```sh
+scripts/ota_keygen.sh                  # once: creates the signing key (see ADR 0003)
+scripts/flash.sh --ota 10.39.39.12     # build, sign and push; or set RORO_OTA_HOST
+```
+
+The device shows the push address in **Settings → Firmware**. It installs a correctly signed update right away, restarts (waiting up to 60 s if you're typing), and runs the new firmware on **Probation**. If the new firmware crashes, or can't reconnect Wi-Fi within 3 minutes, it rolls back to the previous one and says so.
+
+To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).
+
+**The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB.
+
 ## Development aids

 `scripts/serial_log.sh [seconds] [command…]` records the serial output, and can send commands to the firmware first. For example, `scripts/serial_log.sh 30 short sleep:12 burst` sets short screen timeouts, waits 12 s, then sends a burst of Toasts.
@@ -44,8 +61,54 @@ sudo usermod -aG dialout "$USER"
 | Command | Effect |
 |---|---|
 | `burst` | Publishes 5 Notifications at once |
-| `key up\|down\|left\|right\|select\|back\|home` | Injects a logical key press |
+| `key up\|down\|left\|right\|select\|back\|home`, or `key <char>` | Injects a key press |
 | `sound on` / `sound off` | Toggles the Sound setting (beep + LED) |
 | `short` / `normal` | Screen timeouts 5 s / 10 s, or 30 s / 60 s |
+| `wifi add <ssid><TAB><password>` | Adds a Saved Network (so credentials stay out of the repo) |
+| `log <text>` | Appends a line to a test IRC Log (`/irc/dev/#test/<date>.log`) |
+| `sd list` | Lists the files of each Storage Clean-up category |
+| `cat <path>` | Prints the first ~1.2 KB of a file on the SD card |
+| `irc start` | Starts the IRC Service (normally done by opening the IRC App) |
+| `irc stop` | Stops it, as `/quit` does: QUIT if connected, no more retries, and the App stays disconnected until you type |
+| `irc say <buffer> <text>` | Types into a Buffer, commands included (`irc say 0 /join #test`) |
+| `irc dump` | Prints IRC status, memory, and the last lines of each Buffer |
+| `wifi status` | Prints Wi-Fi state, network, signal, clock and free heap |
+| `info` | Firmware, uptime, last start reason, memory, Wi-Fi, and both app slots with their versions and OTA states |
+| `tasks` | FreeRTOS tasks: state, priority, lowest free stack, CPU share |
+| `reboot` / `boot other` | Restart, or restart into the other app slot (a manual Rollback) |
+| `log level <0-5>` | ESP-IDF log level |
+| `ls [folder]` / `rm <path>` | Lists a folder of the SD card, or deletes a file |
+| `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
+| `crash` | The last crash: which firmware, why, task, PC and backtrace (from the core dump in flash) |
+| `coredump erase` | Forgets the core dump |
+| `crash abort` / `crash wdt` | Debug Builds: crash on purpose, or hang the main loop until the watchdog fires |
+| `help` | Lists the commands |

 `scripts/flash.sh` stops a running serial log first, since it would hold the port.
+
+### Debug Builds and the Debug Console
+
+`scripts/flash.sh --debug` (USB) or `scripts/flash.sh --debug --ota <ip>` (Wi-Fi) installs a Debug Build: the same firmware plus the Debug Console on TCP 2323 (ADR 0004). Then, with `RORO_OTA_HOST` set to the device's IP:
+
+```sh
+scripts/rdbg.py                 # interactive: the console backlog, live lines, and commands
+scripts/rdbg.py info            # one command and its reply
+scripts/rdbg.py -b tasks        # the same, after the backlog (boot messages and so on)
+```
+
+Every command above works there too, plus a few handled by the PC side or the console's own task:
+
+```sh
+scripts/rdbg.py crash           # the last crash, its backtrace decoded against that exact build's ELF
+scripts/rdbg.py coredump        # fetch the core dump and decode it all (registers, every task) with esp-coredump
+scripts/rdbg.py reset           # restart at once, even if the main loop is stuck
+scripts/rdbg.py screenshot      # the screen as a PNG (2x)
+scripts/rdbg.py put <file> [card path]    # to the SD card (default /updates/<name>), SHA-256 checked, ~300 KB/s
+scripts/rdbg.py get <card path> [file]    # from the SD card
+```
+
+So a Firmware Update can also go `rdbg.py put roro9stack-….ota` then `rdbg.py install /updates/roro9stack-….ota`: the Update from SD path, without touching the device.
+
+Every build keeps its ELF in `.pio/elves/` (version and digest in the name) for that; `scripts/decode_backtrace.sh <version|digest> <addresses>` decodes any backtrace by hand.
+
+After 3 crash restarts in a row the firmware starts in **Safe Mode** (ADR 0005): only Wi-Fi, Firmware Updates and the Debug Console, so a fix can be pushed as usual. `reboot` leaves it. The token is in `~/.config/roro9stack/debug-token`, made by the first build; keep developing on Debug Builds, so the firmware a Rollback returns to always has the console.
@@ -0,0 +1,7 @@
+# Name,   Type, SubType, Offset,  Size, Flags
+nvs,      data, nvs,     0x9000,  0x5000,
+otadata,  data, ota,     0xe000,  0x2000,
+app0,     app,  ota_0,   0x10000, 0x330000,
+app1,     app,  ota_1,   0x340000,0x330000,
+spiffs,   data, spiffs,  0x670000,0x180000,
+coredump, data, coredump,0x7F0000,0x10000,
@@ -9,3 +9,7 @@ A fork would give full compatibility on day one, but its architecture is built a
 - We accept partial Meshtastic compatibility at first: text on channels, Direct Messages, node list, position and relaying.
 - The phone-app (BLE) API and PKI-encrypted Direct Messages are deferred, and we must re-implement protocol details ourselves.
 - Multi-boot with stock Meshtastic via a launcher was rejected: it gives none of our own UX.
+
+## Note (2026-10-04, M2)
+
+NMEA is parsed by our own small, host-tested parser instead of TinyGPSPlus: the GNSS App's Sky view needs the satellite list (GSV) across several constellations, which TinyGPSPlus doesn't track. See docs/milestones/M2.md, Q66.
@@ -0,0 +1,12 @@
+# Signed Update Files checked by the firmware, not ESP32 Secure Boot
+
+Firmware Updates are accepted only when their Update File carries a valid ECDSA P-256 signature over the image's SHA-256. The firmware itself checks it, against a public key compiled into it, before switching the boot partition. The private key lives outside the repository, in `~/.config/roro9stack/ota-key.pem`.
+
+We chose this over the ESP32's hardware Secure Boot. Secure Boot is enforced by the chip, but it burns eFuses one-way: a mistake bricks the device, and the device can never run unsigned firmware again, which makes recovery over USB harder. On a single development device, a software check that refuses unsigned pushes is enough, and it stays reversible: a new firmware can carry a new public key.
+
+## Consequences
+
+- Someone with physical USB access can still flash anything. Only Wi-Fi and SD card updates are guarded.
+- **Losing the private key** means the next update has to go over USB, carrying a new public key.
+- P-256 rather than Ed25519, because the firmware's TLS library (mbedTLS) already verifies it, so it costs no extra code.
+- **Rollback: the bootloader first, the firmware as a second line.** Arduino-ESP32 marks a new image valid before `setup()` unless the sketch overrides `verifyRollbackLater()`, which once made every update look good and hid the bootloader's rollback (it had looked like the prebuilt bootloader ignored it). With the override, an image stays pending until Probation confirms it, and the bootloader reverts one that restarts unconfirmed, however early it crashes. The firmware also counts its own boots on Probation, very first thing in `setup()`, and reverts itself on the second unconfirmed start.
@@ -0,0 +1,23 @@
+# A Debug Console over Wi-Fi, in Debug Builds only
+
+The goal of Firmware Updates is to manage the device without a cable, and that includes finding out what went wrong. So a **Debug Build** (`cardputer-adv-debug`, `-DRORO_DEBUG`, version suffix `+debug`) adds a **Debug Console** on TCP 2323: the serial console, over Wi-Fi. A client sends a token as its first line, then gets the last 4 KB of console output (boot messages included), every new line live, and runs the same commands as the serial port, plus a few that only make sense remotely. ESP-IDF's own log lines are teed into it.
+
+It's compiled out of release builds entirely, rather than switched off by a setting. A console that runs commands is a remote control: in a release build, nothing listens.
+
+## How it fits
+
+- **Console, not Serial.** All human-readable output goes through `console`, which writes to the USB port and, in a Debug Build, to a ring buffer the Debug Console drains. Writes never wait for USB: a host that's attached but not reading used to stall the main loop for up to 2 s per line.
+- **Commands run on the main loop.** The socket lives on the Debug Console's own task, which only queues command lines. The main loop runs them, as it does serial commands, so they touch Apps and Services from the one task allowed to.
+- **The token** is 128 random bits in `~/.config/roro9stack/debug-token`, made by the first build and passed into the container. It's never committed; a Debug Build refuses to compile without one. Like the OTA key, it guards against the network, not against someone holding the device.
+- **One client at a time**, to keep memory flat (4 KB for the ring since M2, 6 KB of task stack).
+- **Binary commands are answered on the console's own task**, not queued: `get`/`put` (SD card files, run as one Storage Service job each so card access stays on the storage task, with TCP doing the flow control), `screenshot` (the 32 KB RGB332 frame the UI composes into, read as it stands, so it may tear), `coredump get` and `reset`. These keep working when the main loop is stuck. A failed `put` closes the connection, so the rest of the file is never read as commands.
+
+## Keep a Debug Build in the fallback slot
+
+Rollback returns to the previous firmware, whatever it is. As long as development goes through Debug Builds, the firmware a crash falls back to has the Debug Console, so a bad update never costs remote access. A release build pushed over a Debug Build leaves the Debug Build in the other slot until the next update overwrites it.
+
+## Consequences
+
+- Anyone on the same network with the token can read the console, inject keys and reboot the device. The console never prints stored secrets (Wi-Fi and IRC passwords), but the IRC traffic it shows is readable.
+- The TCP stream is plain text: fine on a home network, not across the internet.
+- `+debug` versions compare equal to their release counterparts, so moving between the two is never refused as a downgrade.
@@ -0,0 +1,13 @@
+# Safe Mode, crash reports and a watched main loop, in every build
+
+Rollback protects against new firmware that fails Probation. It does nothing for firmware that was confirmed and crashes later: a corrupt setting, a server that sends something unexpected, a bug that takes an hour to show. Without a cable, such a device would restart forever. Three measures, in release and Debug Builds alike, keep it reachable:
+
+- **Safe Mode.** The firmware counts starts that follow a crash (panic or watchdog) in NVS, first thing at boot. After 3 in a row, it starts only the clock, Wi-Fi, the Update Service and, in a Debug Build, the Debug Console: no Apps, no IRC, no SD card, and a screen that says so with the address to push an update to. Any normal restart (a `reboot`, an update), or a minute of uptime, resets the count.
+- **Crash reports.** The same boot record keeps which version was running, so after a crash the firmware knows which one crashed, even when a Rollback has switched slots since. ESP-IDF already writes a core dump to its flash partition on a panic; after the restart the firmware prints its summary (task, PC, reason, backtrace) and raises a Notification. The `crash` command shows it again later. In a Debug Build, `scripts/rdbg.py crash` decodes the backtrace and `scripts/rdbg.py coredump` fetches the whole dump for `esp-coredump`, against the ELF of that exact build (`.pio/elves/`, named by version and ELF digest).
+- **The main loop is watched.** Arduino-ESP32 subscribes only core 0's idle task to the task watchdog, and the main loop runs on core 1: a stuck loop used to hang the device for good, with the screen frozen and the Debug Console unable to run commands. `enableLoopWDT()` makes a loop stuck for 5 s a panic, with a core dump, counted towards Safe Mode. And an installed update no longer depends on the main loop: the Update Service restarts into it by itself after 90 s.
+
+## Consequences
+
+- Nothing in the main loop may block for 5 s. Network and card work already run on their own tasks.
+- Safe Mode can't help when Wi-Fi or the Update Service itself is what crashes; that still needs USB.
+- Three crashes within a minute of each restart are needed to reach Safe Mode, so a crash loop costs about half a minute before the device becomes reachable.
@@ -0,0 +1,19 @@
+# The framework is rebuilt with our own SDK settings, for smaller TLS buffers
+
+Arduino-ESP32 ships its ESP-IDF libraries prebuilt, with one `sdkconfig` for every ESP32-S3 board. Its TLS settings give every connection a 16 KB receive buffer and a 16 KB send buffer for its whole life. On a device with no PSRAM and about 340 KB of RAM, an IRC connection over TLS left a 12.6 KB low in M2, against a 40 KB floor.
+
+Those settings are compiled into the libraries, so changing them means rebuilding them. pioarduino supports this as a "hybrid compile": `custom_sdkconfig` in `platformio.ini` lists the settings, and the build regenerates the framework's libraries from ESP-IDF (the same 5.5.5 the prebuilt ones come from) before building the app. We set:
+
+- `MBEDTLS_ASYMMETRIC_CONTENT_LEN`, with 16 KB to receive (servers send full TLS records) and **4 KB to send** (IRC lines are short): 12 KB less per connection.
+- `MBEDTLS_DYNAMIC_BUFFER`, `DYNAMIC_FREE_CONFIG_DATA`, `DYNAMIC_FREE_CA_CERT`: buffers allocated when needed, and handshake-only data (the CA chain) freed once connected.
+
+The rebuild also follows the board definition instead of the generic one: PSRAM support is off (the Cardputer ADV has none) and the flash size is 8 MB.
+
+## Consequences
+
+- With IRC connected over TLS, a Debug Build has 78 KB free and a 59 KB low (it was 31 KB and 12.6 KB), and 46 KB at the lowest under the heaviest combined load measured (IRC, two refused installs, a 1.6 MB put and get).
+- The first build after a fresh checkout, or after changing `custom_sdkconfig`, takes about 4 minutes instead of 45 s: it downloads ESP-IDF into the PlatformIO volume and compiles it. Later builds reuse it.
+- Everything the firmware depends on was checked in the regenerated `sdkconfig`: app rollback, core dumps to flash (ELF), the 5 s task watchdog, FreeRTOS run-time stats, the certificate bundle.
+- The project now owns its partition table (`default_8MB.csv`, identical to the framework's), which the hybrid build requires. Changing it would break updates over the air: the app slots must stay where they are.
+- Generated files (`sdkconfig.*`, `managed_components/`, `.dummy/`) are ignored by git.
+- A TLS server that sends records over 16 KB would still fail, as before; one that needs us to send records over 4 KB would now fail. Neither happens with IRC.
@@ -0,0 +1,70 @@
+# M1 — Wi-Fi Service, Wi-Fi Tools, IRC
+
+**Status:** done on 2026-10-03, tagged `v0.2.0`.
+
+## Outcome
+
+The "Done when" items below work on the device, against irc.libera.chat over TLS, with the following changes.
+
+- **Changed:**
+  - **Wi-Fi Tools is built from ordinary scans only:** networks nearby, channel occupancy and a signal tracker. Monitoring-mode views and captures are deferred (revised Q42). The Monitoring mode stays in the Wi-Fi Service and the IRC pause logic, unused for now.
+  - **The frame buffer is 8-bit colour** (Q46), applied as soon as IRC on TLS measured a 51 KB low.
+- **Not done, carried over:**
+  - **Wi-Fi scan logs** (a CSV of the access points each scan sees) can be recorded from Wi-Fi Tools; monitoring-mode captures remain deferred.
+  - **IRC has no input history** (up-arrow recall). Each Buffer keeps only 50 lines in RAM; the full history is in the Logs.
+- **Measured on the device:**
+  - With Wi-Fi and IRC on TLS: about 92 KB free heap, about 77–81 KB at the lowest. The floor was 40 KB.
+  - 44% of the app flash used.
+  - 231 host tests.
+
+**Goal:** the device joins your Wi-Fi by itself, syncs its clock, keeps an IRC session alive in the background, and gives passive Wi-Fi diagnostics with full-frame captures.
+
+## Decisions (design round 2026-10-02)
+
+| # | Decision |
+|---|---|
+| Q40 | Up to 8 **Saved Networks**, joined strongest-first. Added from a scan or as a hidden network. Open networks are allowed; enterprise (802.1X) is not. |
+| Q41 / Q48 | The Wi-Fi Service stays **Connected** whenever enabled and a Saved Network is in range. Settings has a Wi-Fi On/Off switch. **Monitoring** happens only while Wi-Fi Tools is open; the device reconnects on exit. |
+| Q42 | *Revised 2026-10-02:* Wi-Fi Tools is built from ordinary scans only (access points, channel occupancy, signal tracker). Monitoring-mode views and captures are deferred, to be revisited later. |
+| Q43 | The signal tracker clicks faster as the signal gets stronger. On by default, mutable. |
+| Q44 | IRC shows one Buffer at a time; Tab cycles Buffers. Commands: `/join /part /msg /me /nick /topic /names /quit /raw`. Logs go to `/irc/<network>/<buffer>/YYYY-MM-DD.log`. |
+| Q45 | TLS verifies server certificates against the bundled certificate authorities. Per server, a self-signed certificate can be pinned on first use. |
+| Q46 | If RAM is short: switch the frame buffer to 8-bit colour. Keep the AtomS3 Wi-Fi co-processor in mind. |
+| Q47 | Passwords are stored in NVS without flash encryption (revisit before any public release). |
+| IRC | The **IRC Service** stays connected in the background once the App has started it, until `/quit` or disconnect. It does not start at boot. |
+| Q49 | Opening a Monitoring view while IRC is connected asks first. IRC then pauses, and reconnects and rejoins afterwards; its Buffers show the gap. |
+| Q50 | Reconnects after drops wait 5 s, 10 s, 30 s … up to 5 min. |
+| Q51 | Mentions and private messages raise Notifications. Other traffic only counts as unread (Status Bar shows the total). |
+| M0 | The **Storage Clean-up** screen lands here, once IRC Logs and Captures exist. |
+
+## Done when
+
+- Wi-Fi joins the strongest Saved Network at boot. The Status Bar shows Wi-Fi state, and the clock is set over NTP.
+- Settings → Wi-Fi: On/Off, scan and add a network (with password), add a hidden network, forget a network.
+- The IRC App configures one server (host, port, TLS, nick, SASL or NickServ, auto-join IRC channels). It connects and keeps running after you leave the App. Mentions notify.
+- IRC reconnects after Wi-Fi loss or a server drop, and rejoins its IRC channels. Logs are written to the SD card (and stop past 90% usage).
+- Wi-Fi Tools: access-point list, channel occupancy with the quietest of channels 1/6/11, and a signal tracker that clicks faster as the signal gets stronger. None of it interrupts the connection or IRC.
+- Settings → Storage → Clean-up deletes IRC Logs, probe Logs and Wi-Fi Captures older than a chosen age, with a preview of the space freed.
+- Free heap stays above about 40 KB with Wi-Fi, TLS-connected IRC and the UI running.
+
+## Work breakdown (proposed order)
+
+1. **Memory baseline:** measure the heap with Wi-Fi Connected plus one TLS connection. Switch the frame buffer to 8-bit if the margin is too thin.
+2. **Wi-Fi Service:**
+   - Saved Networks in NVS.
+   - Choosing the network (host-tested).
+   - The Off / Connecting / Connected / Monitoring state machine (host-tested).
+   - NTP → Clock.
+   - Status Bar indicator.
+   - Settings → Wi-Fi pages.
+3. **Log writing:** a Log writer that respects the Storage rules, daily files, and the Storage Clean-up screen (selection logic host-tested).
+4. **IRC Service** (host-tested core):
+   - message parser and serializer;
+   - registration, SASL PLAIN and NickServ;
+   - PING/PONG;
+   - Buffers with unread counts and Mention detection;
+   - reconnect backoff, and pause/resume around Monitoring.
+
+   Then the TLS transport with the certificate bundle.
+5. **IRC App:** Buffer view, input line, command parser (host-tested), server settings page.
+6. **Wi-Fi Tools App:** access-point list, channel occupancy and signal tracker from scans (occupancy and tracker logic host-tested). Monitoring mode is deferred.
@@ -0,0 +1,59 @@
+# M2 — GNSS
+
+**Status:** done on the device (branch `m2`): every "Done when" item below is met.
+
+## Measured
+
+- **Cold start** (`$PCAS10,2`) to a 3D Fix, by a window: **73 s**, 5 satellites used of 8 in view. A restart of the ESP32 alone keeps the receiver's Fix (the Cap stays powered).
+- By a window: 3D Fix from GPS, GLONASS, Galileo and BeiDou, up to 14 of 17 satellites used, HDOP 1.0–1.3.
+- **Heap, Debug Build, GNSS on, IRC on TLS** (floor 40 KB; v0.2.1 had a 79 KB low):
+
+  | | Free | Lowest |
+  |---|---|---|
+  | Start of M2 | 31 KB | 12.6 KB |
+  | Stacks and buffers trimmed by measurement | 46 KB | 18 KB |
+  | mDNS removed | 54 KB | 34 KB |
+  | Framework rebuilt with smaller TLS buffers (ADR 0006) | **78 KB** | **59 KB** |
+
+  Under the heaviest combined load measured (IRC, two refused installs, a 1.6 MB put and get), the low is 46 KB. The cost had come mostly from the OTA and Debug Build work, not GNSS. Stacks were set to measured peak plus about 2 KB (loop 6 KB, update 5, storage 6, irc 6); after a TLS handshake the irc task has 1.7 KB left. IRC can now be stopped by hand (`/quit` in any state, `irc stop`), which frees its TLS memory.
+
+**Goal:** the device knows where it is and what time it is without a network: a GNSS Service in the background, a GNSS App with the position and a sky view of the satellites, the clock set from satellites when there's no NTP, and Tracks recorded to the SD card.
+
+**Hardware:** the Cap LoRa-1262 carries an ATGM336H-6N (AT6668), multi-constellation (GPS, BeiDou, Galileo, GLONASS, QZSS), with a ceramic antenna. NMEA over UART, 115200 8N1. **Measured (step 1, `gnss probe`): RX GPIO 15, TX GPIO 13, 115200 8N1**, as in Meshtastic's board file; M5Stack's page names GPIO 8 and 9, which are the internal I2C bus the keyboard controller sits on. Output is NMEA 4.10 style: `GN` RMC, VTG and GGA, one GSA per constellation with the system ID (1 GPS, 2 GLONASS, 3 Galileo, 4 BeiDou, 5 QZSS) in its last field, and a GSV sequence per constellation and signal (`GP`, `GL`, `GA`, …) with the signal ID last. RMC carries a time even without a Fix (status `V`), so only a Fix makes it trustworthy.
+
+## Decisions (design round 2026-10-04)
+
+| # | Decision |
+|---|---|
+| Q58 | Settings has a GNSS On/Off switch, **On by default**. Off puts the receiver in standby. *Measured:* `$PCAS12,<seconds>` (CASIC) stops its output within a second, for up to at least 65535 s, and any command wakes it within a second; Off sends `PCAS12,65535` (renewed hourly), On sends a hot start, `PCAS10,0`. |
+| Q59 | The **GNSS App** has two views, switched with Tab. *Position*: latitude, longitude, altitude, speed, course, Fix (none / 2D / 3D), satellites used and in view, HDOP, UTC time. *Sky*: the satellites placed by azimuth and elevation, coloured by constellation, filled when used in the Fix. |
+| Q60 | "Radar" in M2 means the Sky view. A radar of other Nodes by distance and bearing needs the mesh: M4. |
+| Q61 | The **Status Bar** shows a GNSS mark: absent when off, muted while searching, normal with a 2D Fix, with the satellite count with a 3D Fix. |
+| Q62 | GNSS time **sets the clock once there's a Fix**, and refreshes it every 10 minutes. *Revised in step 3:* the clock's trust order from M0 (Mesh < NTP < GNSS) already ranks GNSS above NTP, which is right: GNSS time is at least as accurate. So GNSS also corrects a clock NTP set, not only an unset one. |
+| Q63 | A **Track** is started and stopped in the GNSS App. It's written as GPX to `/gnss/tracks/<YYYYMMDD-HHMMSS>.gpx`, a point every 5 s when the position moved more than 5 m. It keeps recording with the App closed, with a Toast on start and stop and a Status Bar mark, and gets its own Storage Clean-up category. |
+| Q64 | Coordinates in **decimal degrees plus the Maidenhead locator**; a Settings switch for degrees, minutes and seconds. Metric units only. |
+| Q65 | **The position never leaves the device in M2.** Sharing it over the mesh, and at what precision, is decided in M4. |
+| Q66 | **Our own NMEA parser**, host-tested: RMC, GGA, GSA and GSV, with each talker ID mapped to its constellation. TinyGPSPlus (named in ADR 0001) doesn't track the satellite list across constellations, which the Sky view needs. |
+| Q67 | The receiver keeps its **defaults** (all constellations, 1 Hz). No receiver settings. Time to first fix is measured and recorded here. |
+| Q68 | Debug aids: `gnss status`, and `gnss nmea on/off` to stream the raw sentences to the console (USB serial and Debug Console). Raw NMEA is never written to the card. |
+
+**Lesson (step 3):** the first probe also tried the pins swapped, driving the receiver's output line from the ESP32 for about a second. The receiver then went silent until a full power cycle (an ESP32 restart doesn't cut the Cap's power). Never drive GPIO 15.
+
+## Done when
+
+- The GNSS Service reads NMEA in the background whatever App is on screen, and a 3D Fix appears outdoors.
+- The GNSS App shows the Position and Sky views, both live.
+- The Status Bar shows the GNSS mark per Q61.
+- With no Wi-Fi, the clock is set from GNSS after the first Fix.
+- A Track records while the App is closed, survives the screen turning off, and opens as valid GPX on the PC.
+- Settings → GNSS Off stops it (and the Status Bar mark goes away); On brings it back.
+- Free heap stays above about 40 KB with GNSS, Wi-Fi, IRC on TLS and the UI running.
+
+## Work breakdown
+
+1. **Hardware check:** a `gnss probe` command reads the candidate UART pins and reports which carries NMEA, at what baud rate, and which talker IDs. Then the standby command (Q58) and a first time to first fix.
+2. **NMEA parser** (host-tested): checksum, RMC, GGA, GSA, GSV across constellations, merged into one GNSS state (Fix, position, time, satellites).
+3. **GNSS Service:** UART on its own task, the parser, `gnss status` and `gnss nmea`, Settings On/Off.
+4. **Clock from GNSS** (Q62), and the Status Bar mark (Q61).
+5. **GNSS App:** Position view, Maidenhead and coordinate formats (host-tested), then the Sky view.
+6. **Tracks:** the 5 s / 5 m rule and GPX writing (host-tested), background recording, Clean-up category.
@@ -0,0 +1,33 @@
+# OTA — Firmware Updates over Wi-Fi and from the SD card
+
+**Goal:** install new firmware without a USB cable. Push it from the PC over Wi-Fi, or drop it on the SD card. Unsigned images are refused, and a broken update rolls back by itself.
+
+## Decisions (design round 2026-10-03)
+
+| # | Decision |
+|---|---|
+| Q52 | Two sources: **push over Wi-Fi** from the PC, and **from the SD card**. Pulling from Gitea releases is deferred. |
+| Q53 | **Signed Update Files** (ECDSA P-256 over SHA-256). The private key stays in `~/.config/roro9stack/`, and the firmware embeds the public key (ADR 0003). |
+| Q54 | The device **always listens** for pushes on the LAN while Wi-Fi is Connected. *Revised in M2:* it was announced over mDNS as `roro9stack-<id>.local`; mDNS was removed to save RAM (it never crossed the dev box's routed network anyway). Pushes go to the IP shown in Settings → Firmware. |
+| Q55 | New firmware runs on **Probation**. It's confirmed once booted, UI drawn, Services started, 30 s without a crash, and Wi-Fi connected (if configured). Otherwise **Rollback**. A Toast reports either outcome. |
+| Q56 | **Downgrades are allowed**, with "older than the installed version" shown. |
+| Q57 | A valid push **installs right away**: progress screen, then reboot. The reboot waits for Text Entry to end, 60 s at most. |
+
+## Done when
+
+- `scripts/ota_keygen.sh` creates the key pair once. The public key is committed; the private key never is.
+- `scripts/flash.sh --ota` builds, signs and pushes to `roro9stack-<id>.local`. The device shows progress, reboots, and a Toast confirms the new version.
+- An Update File with a bad signature, a truncated or corrupted image, or no signature is refused, and the device keeps running.
+- Settings → About → **Update from SD** lists the `.ota` files in `/updates` and installs one.
+- A firmware that crashes during Probation rolls back to the previous version, and says so after the reboot.
+
+## Work breakdown
+
+1. **Update File format** (host-tested): header (magic, format, version, image size, SHA-256), signature, image. A streaming parser that hashes as it goes and decides accept / refuse / downgrade. The signature verifier sits behind an interface, so tests can inject one.
+2. **PC side:** key generation, `make_ota.py` (wraps `firmware.bin` into a signed `.ota`), and the push client. `flash.sh --ota` ties them together.
+3. **Device:** the Update Service.
+   - A listener on TCP 3232 plus mDNS.
+   - Writes the image to the inactive app slot, with the ECDSA check through mbedTLS.
+   - A progress screen, and a reboot that waits out Text Entry.
+4. **Probation and Rollback:** the health checks, confirming the image, and detecting a rollback after reboot to report it.
+5. **Update from SD:** the same parser, fed from the Storage Service's task (all card access stays there).
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIWzT07fvTpQxWjTdewMipYH6f42+
+mM8niHm+T8y+Mvjanb3H8hpYXg3VjuJGFtcHw/hFX0Q2f2AiSHMF0DhMbQ==
+-----END PUBLIC KEY-----
@@ -20,7 +20,10 @@ const RowDef kRows[] = {
    {Row::Region, Kind::Choice, "Region"},      {Row::Timezone, Kind::Choice, "Timezone"},
    {Row::Brightness, Kind::Slider, "Brightness"}, {Row::DimTimeout, Kind::Choice, "Dim after"},
    {Row::OffTimeout, Kind::Choice, "Screen off after"}, {Row::Sound, Kind::Toggle, "Sound & LED"},
-    {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}, {Row::Storage, Kind::Page, "Storage"},
+    {Row::Gnss, Kind::Toggle, "GNSS"}, {Row::Coordinates, Kind::Toggle, "Coordinates"},
+    {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}, {Row::Wifi, Kind::Page, "Wi-Fi"},
+    {Row::Storage, Kind::Page, "Storage"},
+    {Row::Firmware, Kind::Page, "Firmware"},
    {Row::About, Kind::Page, "About"},
 };

@@ -77,7 +80,10 @@ std::string SettingsMenu::value(int i) const {
        case Row::DimTimeout: return formatSeconds(settings_.getInt(Setting::DimTimeoutS));
        case Row::OffTimeout: return formatSeconds(settings_.getInt(Setting::OffTimeoutS));
        case Row::Sound: return settings_.getBool(Setting::Sound) ? "On" : "Off";
+        case Row::Gnss: return settings_.getBool(Setting::GnssEnabled) ? "On" : "Off";
+        case Row::Coordinates: return settings_.getBool(Setting::CoordinatesDms) ? "Deg min sec" : "Decimal";
        case Row::ProbeMacs: return settings_.getBool(Setting::ProbeMacRaw) ? "Raw" : "Pseudonymised";
+        case Row::Wifi: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
        default: return "";
    }
 }
@@ -119,6 +125,8 @@ std::string SettingsMenu::choose(int i, int c) {

 void SettingsMenu::toggle(int i) {
    if (row(i) == Row::Sound) settings_.setBool(Setting::Sound, !settings_.getBool(Setting::Sound));
+    if (row(i) == Row::Gnss) settings_.setBool(Setting::GnssEnabled, !settings_.getBool(Setting::GnssEnabled));
+    if (row(i) == Row::Coordinates) settings_.setBool(Setting::CoordinatesDms, !settings_.getBool(Setting::CoordinatesDms));
    if (row(i) == Row::ProbeMacs) settings_.setBool(Setting::ProbeMacRaw, !settings_.getBool(Setting::ProbeMacRaw));
 }

@@ -11,7 +11,7 @@ namespace roro {
 // values, choice lists and validation messages. Rendering and navigation live in the App.
 class SettingsMenu {
   public:
-    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, ProbeMacs, Storage, About };
+    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, Gnss, Coordinates, ProbeMacs, Wifi, Storage, Firmware, About };
    enum class Kind { Text, Choice, Toggle, Slider, Page };

    explicit SettingsMenu(Settings& settings) : settings_(settings) {}
@@ -0,0 +1,50 @@
+#include "geo_format.h"
+
+#include <cmath>
+#include <cstdio>
+
+namespace roro::gnss {
+
+namespace {
+const char* hemisphere(double degrees, bool latitude) {
+    return latitude ? (degrees < 0 ? "S" : "N") : (degrees < 0 ? "W" : "E");
+}
+}  // namespace
+
+std::string formatDecimal(double degrees, bool latitude) {
+    char buf[32];
+    std::snprintf(buf, sizeof buf, "%.5f\xC2\xB0 %s", std::fabs(degrees), hemisphere(degrees, latitude));
+    return buf;
+}
+
+std::string formatDms(double degrees, bool latitude) {
+    // Work in tenths of a second, so rounding carries into minutes and degrees.
+    long tenths = std::lround(std::fabs(degrees) * 36000.0);
+    long d = tenths / 36000, m = tenths / 600 % 60, s10 = tenths % 600;
+    char buf[40];
+    std::snprintf(buf, sizeof buf, "%ld\xC2\xB0 %02ld' %02ld.%ld\" %s", d, m, s10 / 10, s10 % 10,
+                  hemisphere(degrees, latitude));
+    return buf;
+}
+
+std::string maidenhead(double latitude, double longitude) {
+    double lon = std::fmin(std::fmax(longitude + 180.0, 0.0), 359.999999);
+    double lat = std::fmin(std::fmax(latitude + 90.0, 0.0), 179.999999);
+    std::string out;
+    out += static_cast<char>('A' + static_cast<int>(lon / 20));
+    out += static_cast<char>('A' + static_cast<int>(lat / 10));
+    out += static_cast<char>('0' + static_cast<int>(std::fmod(lon, 20) / 2));
+    out += static_cast<char>('0' + static_cast<int>(std::fmod(lat, 10)));
+    out += static_cast<char>('a' + static_cast<int>(std::fmod(lon, 2) * 12));
+    out += static_cast<char>('a' + static_cast<int>(std::fmod(lat, 1) * 24));
+    return out;
+}
+
+SkyPoint skyPosition(int azimuthDeg, int elevationDeg, int cx, int cy, int radius) {
+    int elevation = elevationDeg < 0 ? 0 : elevationDeg > 90 ? 90 : elevationDeg;
+    double r = radius * (90 - elevation) / 90.0;
+    double az = azimuthDeg * M_PI / 180.0;
+    return {cx + static_cast<int>(std::lround(r * std::sin(az))), cy - static_cast<int>(std::lround(r * std::cos(az)))};
+}
+
+}  // namespace roro::gnss
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <string>
+
+namespace roro::gnss {
+
+// "50.86920° N": five decimals, about a metre.
+std::string formatDecimal(double degrees, bool latitude);
+// "50° 52' 09.1\" N" (Settings → Coordinates, Q64).
+std::string formatDms(double degrees, bool latitude);
+// The 6-character Maidenhead locator ("JO20ef"), as radio amateurs give their square.
+std::string maidenhead(double latitude, double longitude);
+
+// Where a satellite goes on the Sky view: the zenith in the centre, the horizon on the circle,
+// north up and east right (as seen looking at the sky from above, like a map).
+struct SkyPoint {
+    int x, y;
+};
+SkyPoint skyPosition(int azimuthDeg, int elevationDeg, int cx, int cy, int radius);
+
+}  // namespace roro::gnss
@@ -0,0 +1,234 @@
+#include "nmea_parser.h"
+
+#include <cstdlib>
+
+namespace roro::gnss {
+
+namespace {
+
+constexpr double kKmhPerKnot = 1.852;
+
+int hexValue(char c) {
+    if (c >= '0' && c <= '9') return c - '0';
+    if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+    if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+    return -1;
+}
+
+Constellation fromTalker(const std::string& t) {
+    if (t == "GP") return Constellation::Gps;
+    if (t == "GL") return Constellation::Glonass;
+    if (t == "GA") return Constellation::Galileo;
+    if (t == "GB" || t == "BD") return Constellation::BeiDou;
+    if (t == "GQ" || t == "QZ") return Constellation::Qzss;
+    if (t == "GI") return Constellation::Navic;
+    return Constellation::Unknown;  // GN: combined
+}
+
+// GSA's system ID field (NMEA 4.10).
+Constellation fromSystemId(int id) {
+    switch (id) {
+        case 1: return Constellation::Gps;
+        case 2: return Constellation::Glonass;
+        case 3: return Constellation::Galileo;
+        case 4: return Constellation::BeiDou;
+        case 5: return Constellation::Qzss;
+        case 6: return Constellation::Navic;
+        default: return Constellation::Unknown;
+    }
+}
+
+bool number(const std::string& s, double& out) {
+    if (s.empty()) return false;
+    char* end;
+    out = std::strtod(s.c_str(), &end);
+    return *end == '\0';
+}
+
+int integer(const std::string& s, int fallback = 0) {
+    double v;
+    return number(s, v) ? static_cast<int>(v) : fallback;
+}
+
+// "ddmm.mmmm" / "dddmm.mmmm" with its hemisphere letter.
+bool coordinate(const std::string& value, const std::string& hemisphere, double& out) {
+    double raw;
+    if (!number(value, raw) || hemisphere.empty()) return false;
+    int degrees = static_cast<int>(raw / 100);
+    out = degrees + (raw - degrees * 100) / 60.0;
+    if (hemisphere == "S" || hemisphere == "W") out = -out;
+    return true;
+}
+
+// Days since 1970-01-01 for a civil date (Howard Hinnant's algorithm).
+int64_t daysFromCivil(int y, int m, int d) {
+    y -= m <= 2;
+    const int64_t era = (y >= 0 ? y : y - 399) / 400;
+    const unsigned yoe = static_cast<unsigned>(y - era * 400);
+    const unsigned doy = (153 * (m + (m > 2 ? -3 : 9)) + 2) / 5 + d - 1;
+    const unsigned doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    return era * 146097 + static_cast<int64_t>(doe) - 719468;
+}
+
+}  // namespace
+
+const char* constellationName(Constellation c) {
+    switch (c) {
+        case Constellation::Gps: return "GPS";
+        case Constellation::Glonass: return "GLONASS";
+        case Constellation::Galileo: return "Galileo";
+        case Constellation::BeiDou: return "BeiDou";
+        case Constellation::Qzss: return "QZSS";
+        case Constellation::Navic: return "NavIC";
+        default: return "?";
+    }
+}
+
+int64_t GnssState::utcSeconds() const {
+    return daysFromCivil(year, month, day) * 86400 + hour * 3600 + minute * 60 + second;
+}
+
+void NmeaParser::feed(const char* data, size_t len) {
+    for (size_t i = 0; i < len; i++) {
+        char c = data[i];
+        if (c == '\n') {
+            if (!overflow_ && !line_.empty()) {
+                if (onLine) onLine(line_);
+                sentence(line_);
+            }
+            line_.clear();
+            overflow_ = false;
+        } else if (c != '\r') {
+            if (line_.size() >= kMaxLine) overflow_ = true;
+            else line_ += c;
+        }
+    }
+}
+
+bool NmeaParser::sentence(const std::string& line) {
+    size_t star = line.rfind('*');
+    if (line.size() < 7 || line[0] != '$' || star == std::string::npos || star + 3 != line.size()) {
+        bad_++;
+        return false;
+    }
+    uint8_t sum = 0;
+    for (size_t i = 1; i < star; i++) sum ^= static_cast<uint8_t>(line[i]);
+    int hi = hexValue(line[star + 1]), lo = hexValue(line[star + 2]);
+    if (hi < 0 || lo < 0 || sum != (hi << 4 | lo)) {
+        bad_++;
+        return false;
+    }
+    good_++;
+
+    Fields f;
+    size_t start = 1;
+    for (size_t i = 1; i <= star; i++)
+        if (i == star || line[i] == ',') {
+            f.push_back(line.substr(start, i - start));
+            start = i + 1;
+        }
+    if (f[0].size() < 5) return true;
+    std::string talker = f[0].substr(0, 2), type = f[0].substr(f[0].size() - 3);
+    if (type == "RMC") rmc(f);
+    else if (type == "GGA") gga(f);
+    else if (type == "GSA") gsa(f, fromTalker(talker));
+    else if (type == "GSV") gsv(f, fromTalker(talker));
+    return true;
+}
+
+void NmeaParser::rmc(const Fields& f) {
+    if (f.size() < 10) return;
+    bool active = f[2] == "A";
+    double lat, lon;
+    state_.positionValid = active && coordinate(f[3], f[4], lat) && coordinate(f[5], f[6], lon);
+    if (state_.positionValid) {
+        state_.latitude = lat;
+        state_.longitude = lon;
+    }
+    double knots, course;
+    state_.speedKmh = active && number(f[7], knots) ? static_cast<float>(knots * kKmhPerKnot) : 0;
+    state_.courseValid = active && number(f[8], course);
+    if (state_.courseValid) state_.courseDeg = static_cast<float>(course);
+
+    const std::string &t = f[1], &d = f[9];
+    state_.timeValid = active && t.size() >= 6 && d.size() == 6;
+    if (state_.timeValid) {
+        state_.hour = integer(t.substr(0, 2));
+        state_.minute = integer(t.substr(2, 2));
+        state_.second = integer(t.substr(4, 2));
+        state_.day = integer(d.substr(0, 2));
+        state_.month = integer(d.substr(2, 2));
+        state_.year = 2000 + integer(d.substr(4, 2));
+    }
+}
+
+void NmeaParser::gga(const Fields& f) {
+    if (f.size() < 10) return;
+    int quality = integer(f[6]);
+    double lat, lon, hdop, alt;
+    state_.positionValid = quality > 0 && coordinate(f[2], f[3], lat) && coordinate(f[4], f[5], lon);
+    if (state_.positionValid) {
+        state_.latitude = lat;
+        state_.longitude = lon;
+    }
+    state_.satellitesUsed = integer(f[7]);
+    if (number(f[8], hdop)) state_.hdop = static_cast<float>(hdop);
+    state_.altitudeValid = quality > 0 && number(f[9], alt);
+    if (state_.altitudeValid) state_.altitudeM = static_cast<float>(alt);
+}
+
+void NmeaParser::gsa(const Fields& f, Constellation talker) {
+    if (f.size() < 18) return;
+    int mode = integer(f[2], 1);
+    state_.fix = mode == 3 ? FixType::ThreeD : mode == 2 ? FixType::TwoD : FixType::None;
+    Constellation system = f.size() > 18 ? fromSystemId(integer(f[18])) : talker;
+    if (system == Constellation::Unknown) return;  // can't tell whose satellites these are
+    std::set<int>& used = used_[static_cast<int>(system)];
+    used.clear();
+    for (size_t i = 3; i <= 14; i++)
+        if (!f[i].empty()) used.insert(integer(f[i]));
+    rebuildSatellites();
+}
+
+void NmeaParser::gsv(const Fields& f, Constellation talker) {
+    if (f.size() < 4 || talker == Constellation::Unknown) return;
+    int total = integer(f[1]), number = integer(f[2]);
+    size_t extra = f.size() - 4;
+    int signal = extra % 4 == 1 ? integer(f.back()) : 0;  // NMEA 4.10 signal ID, last
+    auto key = std::make_pair(static_cast<int>(talker), signal);
+    std::vector<Satellite>& pending = pending_[key];
+    if (number == 1) pending.clear();
+    for (size_t i = 4; i + 3 < f.size(); i += 4) {
+        Satellite s;
+        s.system = talker;
+        s.prn = integer(f[i]);
+        s.elevation = integer(f[i + 1]);
+        s.azimuth = integer(f[i + 2]);
+        s.snr = integer(f[i + 3], -1);
+        if (s.prn > 0) pending.push_back(s);
+    }
+    if (number == total) {
+        inView_[key] = pending;
+        pending.clear();
+        rebuildSatellites();
+    }
+}
+
+void NmeaParser::rebuildSatellites() {
+    std::vector<Satellite> merged;
+    for (auto& [key, list] : inView_)
+        for (const Satellite& s : list) {
+            Satellite* same = nullptr;
+            for (auto& m : merged)
+                if (m.system == s.system && m.prn == s.prn) same = &m;
+            if (!same) merged.push_back(s);
+            else if (s.snr > same->snr) same->snr = s.snr;
+        }
+    for (auto& s : merged) {
+        auto it = used_.find(static_cast<int>(s.system));
+        s.used = it != used_.end() && it->second.count(s.prn) > 0;
+    }
+    state_.satellites = std::move(merged);
+}
+
+}  // namespace roro::gnss
@@ -0,0 +1,82 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace roro::gnss {
+
+enum class Constellation : uint8_t { Unknown, Gps, Glonass, Galileo, BeiDou, Qzss, Navic };
+const char* constellationName(Constellation c);
+
+enum class FixType : uint8_t { None, TwoD, ThreeD };
+
+struct Satellite {
+    Constellation system = Constellation::Unknown;
+    int prn = 0;
+    int elevation = 0;  // degrees above the horizon
+    int azimuth = 0;    // degrees from north, clockwise
+    int snr = -1;       // dB-Hz; -1 when not tracked
+    bool used = false;  // part of the current Fix
+};
+
+// Everything the receiver has said, as of the last sentence (see CONTEXT.md: Fix).
+struct GnssState {
+    FixType fix = FixType::None;
+    bool positionValid = false;
+    double latitude = 0, longitude = 0;  // degrees, south and west negative
+    bool altitudeValid = false;
+    float altitudeM = 0;  // above mean sea level
+    float speedKmh = 0;
+    bool courseValid = false;
+    float courseDeg = 0;
+    int satellitesUsed = 0;
+    float hdop = 99.9f;
+    // UTC, trusted only with a Fix: the receiver reports a time without one, from its own clock.
+    bool timeValid = false;
+    int year = 0, month = 0, day = 0, hour = 0, minute = 0, second = 0;
+    std::vector<Satellite> satellites;  // in view, all constellations, one entry per satellite
+
+    int64_t utcSeconds() const;  // seconds since 1970-01-01 UTC; meaningful when timeValid
+};
+
+// NMEA 0183 (4.10 style, as the Cap's AT6668 sends it): RMC, GGA, GSA and GSV, with the
+// constellation taken from the talker ID or GSA's system ID field. Host-tested; no hardware here.
+class NmeaParser {
+   public:
+    // Raw bytes from the UART, in any chunks.
+    void feed(const char* data, size_t len);
+    // One sentence without its line end. False if malformed or its checksum is wrong.
+    bool sentence(const std::string& line);
+
+    // Called with every complete line fed in, valid or not (`gnss nmea on` echoes them).
+    std::function<void(const std::string&)> onLine;
+
+    const GnssState& state() const { return state_; }
+    uint32_t goodSentences() const { return good_; }
+    uint32_t badSentences() const { return bad_; }
+
+   private:
+    using Fields = std::vector<std::string>;
+    void rmc(const Fields& f);
+    void gga(const Fields& f);
+    void gsa(const Fields& f, Constellation talker);
+    void gsv(const Fields& f, Constellation talker);
+    void rebuildSatellites();
+
+    static constexpr size_t kMaxLine = 120;
+    std::string line_;
+    bool overflow_ = false;
+    uint32_t good_ = 0, bad_ = 0;
+    GnssState state_;
+    // GSV sequences per (constellation, signal): pending until their last message.
+    std::map<std::pair<int, int>, std::vector<Satellite>> pending_, inView_;
+    std::map<int, std::set<int>> used_;  // per constellation, from GSA
+};
+
+}  // namespace roro::gnss
@@ -0,0 +1,76 @@
+#include "track.h"
+
+#include <cmath>
+#include <cstdio>
+#include <ctime>
+
+namespace roro::gnss {
+
+namespace {
+
+constexpr double kEarthRadiusM = 6371000.0;
+
+double radians(double degrees) { return degrees * M_PI / 180.0; }
+
+// UTC fields from seconds since 1970 (gmtime_r works on the device and the PC alike).
+struct tm utc(int64_t seconds) {
+    time_t t = static_cast<time_t>(seconds);
+    struct tm out;
+    gmtime_r(&t, &out);
+    return out;
+}
+
+}  // namespace
+
+double distanceMeters(double lat1, double lon1, double lat2, double lon2) {
+    double dLat = radians(lat2 - lat1), dLon = radians(lon2 - lon1);
+    double h = std::sin(dLat / 2) * std::sin(dLat / 2) +
+               std::cos(radians(lat1)) * std::cos(radians(lat2)) * std::sin(dLon / 2) * std::sin(dLon / 2);
+    return 2 * kEarthRadiusM * std::asin(std::sqrt(h));
+}
+
+bool TrackRule::due(uint32_t nowMs, double lat, double lon) {
+    if (any_ && (nowMs - lastMs_ < kEveryMs || distanceMeters(lat_, lon_, lat, lon) < kMinMeters)) return false;
+    any_ = true;
+    lastMs_ = nowMs;
+    lat_ = lat;
+    lon_ = lon;
+    return true;
+}
+
+std::string trackPath(int64_t utcSeconds) {
+    struct tm t = utc(utcSeconds);
+    char buf[48];
+    std::snprintf(buf, sizeof buf, "/gnss/tracks/%04d%02d%02d-%02d%02d%02d.gpx", t.tm_year + 1900, t.tm_mon + 1,
+                  t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
+    return buf;
+}
+
+namespace gpx {
+
+std::string header(const std::string& name) {
+    return "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
+           "<gpx version=\"1.1\" creator=\"roro9stack\" xmlns=\"http://www.topografix.com/GPX/1/1\">\n"
+           "<trk><name>" + name + "</name><trkseg>";
+}
+
+std::string point(double lat, double lon, bool hasElevation, float elevationM, int64_t utcSeconds) {
+    struct tm t = utc(utcSeconds);
+    char buf[160], ele[32] = "";
+    if (hasElevation) std::snprintf(ele, sizeof ele, "<ele>%.1f</ele>", elevationM);
+    std::snprintf(buf, sizeof buf,
+                  "<trkpt lat=\"%.7f\" lon=\"%.7f\">%s<time>%04d-%02d-%02dT%02d:%02d:%02dZ</time></trkpt>", lat, lon,
+                  ele, t.tm_year + 1900, t.tm_mon + 1, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
+    return buf;
+}
+
+std::string footer() { return "</trkseg></trk></gpx>"; }
+
+bool finished(const std::string& tail) {
+    size_t end = tail.find_last_not_of(" \r\n\t");
+    return end != std::string::npos && end + 1 >= 6 && tail.compare(end + 1 - 6, 6, "</gpx>") == 0;
+}
+
+}  // namespace gpx
+
+}  // namespace roro::gnss
@@ -0,0 +1,40 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+namespace roro::gnss {
+
+// Great-circle distance in metres (haversine, mean Earth radius).
+double distanceMeters(double lat1, double lon1, double lat2, double lon2);
+
+// When a Track takes its next point (Q63): the first one always, then at least every 5 s and only
+// after moving at least 5 m, so standing still doesn't fill the card.
+class TrackRule {
+   public:
+    static constexpr uint32_t kEveryMs = 5000;
+    static constexpr double kMinMeters = 5.0;
+
+    // True if this position should be recorded (and is then remembered as the last point).
+    bool due(uint32_t nowMs, double lat, double lon);
+    void reset() { any_ = false; }
+
+   private:
+    bool any_ = false;
+    uint32_t lastMs_ = 0;
+    double lat_ = 0, lon_ = 0;
+};
+
+// "/gnss/tracks/YYYYMMDD-HHMMSS.gpx", from the UTC start time (Storage Clean-up reads its date).
+std::string trackPath(int64_t utcSeconds);
+
+// GPX 1.1, written a line at a time: the header when a Track starts, a point per line, the footer
+// when it stops. A file whose footer never came (power lost) is closed at the next boot.
+namespace gpx {
+std::string header(const std::string& name);
+std::string point(double lat, double lon, bool hasElevation, float elevationM, int64_t utcSeconds);
+std::string footer();
+bool finished(const std::string& tail);  // the end of a file: does it close the GPX?
+}  // namespace gpx
+
+}  // namespace roro::gnss
@@ -0,0 +1,31 @@
+#pragma once
+
+#include <string>
+
+namespace roro {
+
+inline std::string base64Encode(const std::string& in) {
+    static const char* kAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    std::string out;
+    size_t i = 0;
+    while (i + 2 < in.size()) {
+        uint32_t n = (static_cast<uint8_t>(in[i]) << 16) | (static_cast<uint8_t>(in[i + 1]) << 8) | static_cast<uint8_t>(in[i + 2]);
+        out += kAlphabet[n >> 18];
+        out += kAlphabet[(n >> 12) & 63];
+        out += kAlphabet[(n >> 6) & 63];
+        out += kAlphabet[n & 63];
+        i += 3;
+    }
+    size_t rest = in.size() - i;
+    if (rest) {
+        uint32_t n = static_cast<uint8_t>(in[i]) << 16;
+        if (rest == 2) n |= static_cast<uint8_t>(in[i + 1]) << 8;
+        out += kAlphabet[n >> 18];
+        out += kAlphabet[(n >> 12) & 63];
+        out += rest == 2 ? kAlphabet[(n >> 6) & 63] : '=';
+        out += '=';
+    }
+    return out;
+}
+
+}  // namespace roro
@@ -0,0 +1,84 @@
+#include "irc_config.h"
+
+#include <cctype>
+#include <cstring>
+
+namespace roro {
+
+namespace {
+bool validNick(const std::string& n) {
+    if (n.empty() || n.size() > 30) return false;
+    if (std::isdigit(static_cast<unsigned char>(n[0])) || n[0] == '-') return false;
+    for (char c : n)
+        if (!std::isalnum(static_cast<unsigned char>(c)) && !std::strchr("[]\\`_^{|}-", c)) return false;
+    return true;
+}
+}  // namespace
+
+void IrcConfig::load(const std::string& defaultNick) {
+    nick = defaultNick;
+    std::string s;
+    int32_t i;
+    if (store_.getString("irc_host", s)) host = s;
+    if (store_.getInt("irc_port", i)) port = i;
+    if (store_.getInt("irc_tls", i)) tls = i != 0;
+    if (store_.getInt("irc_selfsign", i)) allowSelfSigned = i != 0;
+    store_.getString("irc_pin", pinnedSha256);
+    if (store_.getString("irc_nick", s)) nick = s;
+    store_.getString("irc_sasl_user", saslUser);
+    store_.getString("irc_sasl_pass", saslPassword);
+    store_.getString("irc_ns_pass", nickservPassword);
+    if (store_.getString("irc_join", s)) autojoin = parseChannels(s);
+}
+
+std::string IrcConfig::validate() const {
+    if (host.empty() || host.size() > 63) return "Server must be 1 to 63 characters";
+    if (port < 1 || port > 65535) return "Port must be 1 to 65535";
+    if (!validNick(nick)) return "Nick: letters, digits and []\\`_^{|}- only, not starting with a digit";
+    for (auto& c : autojoin)
+        if (c.channel.size() < 2 || (c.channel[0] != '#' && c.channel[0] != '&'))
+            return "Auto-join: IRC channels start with # or &, each followed by its key if it has one";
+    return "";
+}
+
+std::string IrcConfig::save() {
+    std::string error = validate();
+    if (!error.empty()) return error;
+    store_.putString("irc_host", host);
+    store_.putInt("irc_port", port);
+    store_.putInt("irc_tls", tls ? 1 : 0);
+    store_.putInt("irc_selfsign", allowSelfSigned ? 1 : 0);
+    store_.putString("irc_pin", pinnedSha256);
+    store_.putString("irc_nick", nick);
+    store_.putString("irc_sasl_user", saslUser);
+    store_.putString("irc_sasl_pass", saslPassword);
+    store_.putString("irc_ns_pass", nickservPassword);
+    store_.putString("irc_join", formatChannels(autojoin));
+    return "";
+}
+
+std::vector<IrcChannel> IrcConfig::parseChannels(const std::string& text) {
+    std::vector<IrcChannel> out;
+    std::string word;
+    auto take = [&]() {
+        if (word.empty()) return;
+        bool channel = word[0] == '#' || word[0] == '&';
+        if (!channel && !out.empty() && out.back().key.empty()) out.back().key = word;
+        else out.push_back({word, ""});  // a stray word fails validation as a channel
+        word.clear();
+    };
+    for (char c : text) {
+        if (c == ' ' || c == ',') take();
+        else word += c;
+    }
+    take();
+    return out;
+}
+
+std::string IrcConfig::formatChannels(const std::vector<IrcChannel>& channels) {
+    std::string out;
+    for (auto& c : channels) out += (out.empty() ? "" : ", ") + c.channel + (c.key.empty() ? "" : " " + c.key);
+    return out;
+}
+
+}  // namespace roro
@@ -0,0 +1,58 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "key_value_store.h"
+
+namespace roro {
+
+struct IrcChannel {
+    std::string channel;  // "#roro"
+    std::string key;      // empty when the IRC channel has none
+};
+
+// The one IRC server the IRC Service connects to, persisted in internal flash.
+class IrcConfig {
+   public:
+    explicit IrcConfig(KeyValueStore& store) : store_(store) {}
+
+    std::string host = "irc.libera.chat";
+    int port = 6697;
+    bool tls = true;
+    bool allowSelfSigned = false;  // pin the certificate on first use instead of checking a CA
+    std::string pinnedSha256;      // hex fingerprint once pinned
+    std::string nick;
+    std::string saslUser, saslPassword;  // SASL PLAIN when both are set
+    std::string nickservPassword;        // otherwise IDENTIFY with NickServ, if set
+    std::vector<IrcChannel> autojoin;
+
+    // A copy is a draft the UI can edit freely; copySettingsFrom() applies one.
+    IrcConfig(const IrcConfig&) = default;
+    void copySettingsFrom(const IrcConfig& other) {
+        host = other.host;
+        port = other.port;
+        tls = other.tls;
+        allowSelfSigned = other.allowSelfSigned;
+        pinnedSha256 = other.pinnedSha256;
+        nick = other.nick;
+        saslUser = other.saslUser;
+        saslPassword = other.saslPassword;
+        nickservPassword = other.nickservPassword;
+        autojoin = other.autojoin;
+    }
+
+    void load(const std::string& defaultNick);
+    std::string save();  // empty on success, otherwise why it was refused
+    std::string validate() const;
+
+    // "#private key, #public": a word starting with # or & is an IRC channel, the word after it
+    // (if it doesn't) its key. Spaces or commas separate entries, so "#a #b" also reads.
+    static std::vector<IrcChannel> parseChannels(const std::string& text);
+    static std::string formatChannels(const std::vector<IrcChannel>& channels);
+
+   private:
+    KeyValueStore& store_;
+};
+
+}  // namespace roro
@@ -0,0 +1,43 @@
+#include "irc_message.h"
+
+namespace roro {
+
+IrcMessage IrcMessage::parse(const std::string& raw) {
+    IrcMessage m;
+    std::string line = raw;
+    while (!line.empty() && (line.back() == '\r' || line.back() == '\n')) line.pop_back();
+
+    size_t pos = 0;
+    auto word = [&]() {
+        size_t end = line.find(' ', pos);
+        std::string w = line.substr(pos, end == std::string::npos ? std::string::npos : end - pos);
+        pos = end == std::string::npos ? line.size() : end + 1;
+        while (pos < line.size() && line[pos] == ' ') pos++;
+        return w;
+    };
+    if (pos < line.size() && line[pos] == '@') word();
+    if (pos < line.size() && line[pos] == ':') m.prefix = word().substr(1);
+    m.command = word();
+    while (pos < line.size()) {
+        if (line[pos] == ':') {
+            m.params.push_back(line.substr(pos + 1));
+            break;
+        }
+        m.params.push_back(word());
+    }
+    return m;
+}
+
+std::string IrcMessage::serialize(const std::string& command, std::initializer_list<std::string> params) {
+    std::string out = command;
+    size_t i = 0;
+    for (auto& p : params) {
+        bool last = ++i == params.size();
+        out += ' ';
+        if (last && (p.empty() || p[0] == ':' || p.find(' ') != std::string::npos)) out += ':';
+        out += p;
+    }
+    return out;
+}
+
+}  // namespace roro
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <initializer_list>
+#include <string>
+#include <vector>
+
+namespace roro {
+
+// One IRC protocol line: [@tags] [:prefix] COMMAND params... [:trailing] (tags are ignored).
+struct IrcMessage {
+    std::string prefix;
+    std::string command;
+    std::vector<std::string> params;
+
+    std::string nick() const { return prefix.substr(0, prefix.find('!')); }
+    std::string param(size_t i) const { return i < params.size() ? params[i] : ""; }
+
+    static IrcMessage parse(const std::string& line);
+    // Builds a line; the last parameter gets a ':' when it needs one.
+    static std::string serialize(const std::string& command, std::initializer_list<std::string> params);
+};
+
+}  // namespace roro
@@ -0,0 +1,369 @@
+#include "irc_session.h"
+
+#include <algorithm>
+#include <cctype>
+
+#include "base64.h"
+
+namespace roro {
+
+namespace {
+
+const char kCtcp = '\x01';
+
+std::string lower(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+
+bool isChannel(const std::string& name) { return !name.empty() && (name[0] == '#' || name[0] == '&'); }
+
+bool nickChar(char c) { return std::isalnum(static_cast<unsigned char>(c)) || std::string("[]\\`_^{|}-").find(c) != std::string::npos; }
+
+std::string join(const std::vector<std::string>& params, size_t from) {
+    std::string out;
+    for (size_t i = from; i < params.size(); i++) out += (out.empty() ? "" : " ") + params[i];
+    return out;
+}
+
+// Splits "word rest of text" into the first word and the rest.
+std::pair<std::string, std::string> firstWord(const std::string& text) {
+    size_t space = text.find(' ');
+    if (space == std::string::npos) return {text, ""};
+    return {text.substr(0, space), text.substr(space + 1)};
+}
+
+}  // namespace
+
+IrcSession::IrcSession(const IrcConfig& config) : config_(config), nick_(config.nick) {
+    buffers_.push_back({config.host, IrcBuffer::Type::Server, {}, 0, false, true, ""});
+    for (auto& c : config.autojoin)
+        if (!c.key.empty()) keys_[lower(c.channel)] = c.key;
+}
+
+void IrcSession::tick(uint32_t nowMs) {
+    nowMs_ = nowMs;
+    if (joinsHeld_ && nowMs - heldSinceMs_ >= kNickservWaitMs) joinChannels();
+}
+
+int IrcSession::totalUnread() const {
+    int n = 0;
+    for (auto& b : buffers_) n += b.unread;
+    return n;
+}
+
+IrcEffects IrcSession::takeEffects() {
+    IrcEffects out;
+    std::swap(out, effects_);
+    return out;
+}
+
+int IrcSession::findBuffer(const std::string& name) const {
+    for (int i = 0; i < bufferCount(); i++)
+        if (lower(buffers_[i].name) == lower(name)) return i;
+    return -1;
+}
+
+int IrcSession::bufferFor(const std::string& name, IrcBuffer::Type type) {
+    int i = findBuffer(name);
+    if (i >= 0) return i;
+    if (bufferCount() >= kMaxBuffers) return 0;  // full: fall back to the server Buffer
+    buffers_.push_back({name, type, {}, 0, false, false, ""});
+    revision_++;
+    return bufferCount() - 1;
+}
+
+void IrcSession::setViewing(int buffer) {
+    viewing_ = buffer;
+    revision_++;
+    if (buffer >= 0 && buffer < bufferCount()) {
+        buffers_[buffer].unread = 0;
+        buffers_[buffer].mentioned = false;
+    }
+}
+
+bool IrcSession::mentionsMe(const std::string& text) const {
+    std::string hay = lower(text), needle = lower(nick_);
+    for (size_t pos = hay.find(needle); pos != std::string::npos; pos = hay.find(needle, pos + 1)) {
+        bool startOk = pos == 0 || !nickChar(hay[pos - 1]);
+        size_t end = pos + needle.size();
+        bool endOk = end >= hay.size() || !nickChar(hay[end]);
+        if (startOk && endOk) return true;
+    }
+    return false;
+}
+
+void IrcSession::add(int b, IrcLine::Kind kind, const std::string& nick, const std::string& text, int64_t utc,
+                     bool mention) {
+    IrcBuffer& buf = buffers_[b];
+    revision_++;
+    IrcLine line{utc, kind, nick, text};
+    buf.lines.push_back(line);
+    if (buf.lines.size() > kLinesPerBuffer) buf.lines.pop_front();
+    effects_.logs.push_back({buf.name, line});
+
+    bool fromOthers = kind == IrcLine::Kind::Message || kind == IrcLine::Kind::Action || kind == IrcLine::Kind::Notice;
+    if (b != viewing_ && fromOthers && buf.type != IrcBuffer::Type::Server) {
+        buf.unread++;
+        if (mention) {
+            buf.mentioned = true;
+            std::string where = buf.type == IrcBuffer::Type::Query ? nick : nick + " in " + buf.name;
+            effects_.notifications.push_back(where + ": " + text);
+        }
+    }
+}
+
+void IrcSession::connected(int64_t) {
+    registered_ = false;
+    joinsHeld_ = false;
+    saslFailed_ = false;
+    quit_ = false;
+    nick_ = config_.nick;
+    if (!config_.saslUser.empty() && !config_.saslPassword.empty()) send("CAP REQ :sasl");
+    send(IrcMessage::serialize("NICK", {nick_}));
+    send(IrcMessage::serialize("USER", {nick_, "0", "*", "roro9stack"}));
+}
+
+void IrcSession::disconnected(int64_t utc, const std::string& reason) {
+    registered_ = false;
+    quit_ = false;
+    rejoin_.clear();
+    for (int i = 0; i < bufferCount(); i++) {
+        if (buffers_[i].type == IrcBuffer::Type::Channel && buffers_[i].joined) rejoin_.push_back(buffers_[i].name);
+        if (buffers_[i].type == IrcBuffer::Type::Channel) buffers_[i].joined = false;
+        info(i, "-- " + reason + " --", utc);
+    }
+}
+
+void IrcSession::onWelcome(const IrcMessage& m, int64_t utc) {
+    registered_ = true;
+    nick_ = m.param(0);
+    info(0, "Connected to " + config_.host + " as " + nick_, utc);
+    // NickServ when it's the configured login, or as the fallback when SASL failed.
+    // The account is named explicitly: we may be on a fallback nick if a stale session holds ours.
+    bool sasl = !config_.saslUser.empty() && !config_.saslPassword.empty();
+    std::string account = sasl ? config_.saslUser : config_.nick;
+    std::string identify;
+    if (!config_.nickservPassword.empty() && (!sasl || saslFailed_)) identify = account + " " + config_.nickservPassword;
+    else if (sasl && saslFailed_) identify = account + " " + config_.saslPassword;
+    if (!identify.empty()) {
+        // IRC channels for registered users only would refuse us until NickServ has logged us in.
+        send(IrcMessage::serialize("PRIVMSG", {"NickServ", "IDENTIFY " + identify}));
+        joinsHeld_ = true;
+        heldSinceMs_ = nowMs_;
+        return;
+    }
+    joinChannels();
+}
+
+void IrcSession::joinChannels() {
+    joinsHeld_ = false;
+    std::vector<std::string> channels;
+    auto addOnce = [&](const std::string& c) {
+        for (auto& existing : channels)
+            if (lower(existing) == lower(c)) return;
+        channels.push_back(c);
+    };
+    for (auto& c : config_.autojoin) addOnce(c.channel);
+    for (auto& c : rejoin_) addOnce(c);
+    rejoin_.clear();
+    if (channels.empty()) return;
+
+    // JOIN #keyed,#open key: IRC pairs keys with the first channels listed.
+    std::string keyed, open, keys;
+    for (auto& c : channels) {
+        auto k = keys_.find(lower(c));
+        if (k != keys_.end()) {
+            keyed += (keyed.empty() ? "" : ",") + c;
+            keys += (keys.empty() ? "" : ",") + k->second;
+        } else {
+            open += (open.empty() ? "" : ",") + c;
+        }
+    }
+    std::string list = keyed + (!keyed.empty() && !open.empty() ? "," : "") + open;
+    send(keys.empty() ? IrcMessage::serialize("JOIN", {list}) : IrcMessage::serialize("JOIN", {list, keys}));
+}
+
+void IrcSession::receive(const std::string& raw, int64_t utc) {
+    IrcMessage m = IrcMessage::parse(raw);
+    const std::string& cmd = m.command;
+    bool fromMe = lower(m.nick()) == lower(nick_);
+
+    if (cmd == "PING") {
+        send(IrcMessage::serialize("PONG", {m.param(0)}));
+    } else if (cmd == "001") {
+        onWelcome(m, utc);
+    } else if (cmd == "433" && !registered_) {
+        nick_ += "_";
+        send(IrcMessage::serialize("NICK", {nick_}));
+    } else if (cmd == "CAP") {
+        std::string sub = m.param(1);
+        if (sub == "ACK" && m.param(2).find("sasl") != std::string::npos) send("AUTHENTICATE PLAIN");
+        else if (sub == "NAK") send("CAP END");
+    } else if (cmd == "AUTHENTICATE" && m.param(0) == "+") {
+        std::string user = config_.saslUser;
+        send("AUTHENTICATE " + base64Encode(user + '\0' + user + '\0' + config_.saslPassword));
+    } else if (cmd == "900") {
+        // Logged in. Take our nick back from a stale session, then join.
+        if (lower(nick_) != lower(config_.nick))
+            send(IrcMessage::serialize("PRIVMSG", {"NickServ", "REGAIN " + config_.nick}));
+        if (joinsHeld_) joinChannels();
+    } else if (cmd == "903") {
+        info(0, "SASL login succeeded", utc);
+        send("CAP END");
+    } else if (cmd == "904" || cmd == "905" || cmd == "906" || cmd == "902") {
+        info(0, "SASL login failed: " + m.param(m.params.size() - 1) + " (trying NickServ instead)", utc);
+        saslFailed_ = true;
+        send("CAP END");
+    } else if (cmd == "PRIVMSG" || cmd == "NOTICE") {
+        onPrivmsg(m, utc, cmd == "NOTICE");
+    } else if (cmd == "JOIN") {
+        if (fromMe) {
+            int b = bufferFor(m.param(0), IrcBuffer::Type::Channel);
+            buffers_[b].joined = true;
+            info(b, "Joined " + m.param(0), utc);
+        }
+    } else if (cmd == "PART") {
+        int b = findBuffer(m.param(0));
+        if (fromMe && b > 0) {
+            buffers_[b].joined = false;
+            info(b, "Left " + m.param(0), utc);
+        }
+    } else if (cmd == "KICK") {
+        int b = findBuffer(m.param(0));
+        if (lower(m.param(1)) == lower(nick_) && b > 0) {
+            buffers_[b].joined = false;
+            add(b, IrcLine::Kind::Notice, m.nick(), "kicked you: " + m.param(2), utc, true);
+        }
+    } else if (cmd == "NICK") {
+        if (fromMe) {
+            nick_ = m.param(0);
+            info(0, "You are now " + nick_, utc);
+        } else {
+            int b = findBuffer(m.nick());
+            if (b > 0) {
+                buffers_[b].name = m.param(0);
+                info(b, m.nick() + " is now " + m.param(0), utc);
+            }
+        }
+    } else if (cmd == "TOPIC") {
+        int b = findBuffer(m.param(0));
+        if (b > 0) {
+            buffers_[b].topic = m.param(1);
+            info(b, m.nick() + " set the topic: " + m.param(1), utc);
+        }
+    } else if (cmd == "332") {
+        int b = findBuffer(m.param(1));
+        if (b > 0) {
+            buffers_[b].topic = m.param(2);
+            info(b, "Topic: " + m.param(2), utc);
+        }
+    } else if (cmd == "353") {
+        std::string channel = m.param(2);
+        int b = findBuffer(channel);
+        if (namesRequested_.count(lower(channel)) && b >= 0) info(b, "Names: " + m.param(3), utc);
+    } else if (cmd == "366") {
+        namesRequested_.erase(lower(m.param(1)));
+    } else if (cmd == "ERROR") {
+        info(0, "Server: " + m.param(0), utc);
+    } else if (cmd.size() == 3 && std::isdigit(static_cast<unsigned char>(cmd[0])) && cmd != "333" && cmd != "353") {
+        info(0, join(m.params, 1), utc);  // other numerics, minus our own nick
+    }
+}
+
+void IrcSession::onPrivmsg(const IrcMessage& m, int64_t utc, bool notice) {
+    std::string target = m.param(0), text = m.param(1), from = m.nick();
+    bool toMe = lower(target) == lower(nick_);
+
+    // CTCP: ACTION is shown, VERSION answered, anything else ignored.
+    bool action = false;
+    if (!text.empty() && text[0] == kCtcp) {
+        std::string body = text.substr(1, text.size() >= 2 && text.back() == kCtcp ? text.size() - 2 : std::string::npos);
+        auto [verb, rest] = firstWord(body);
+        if (verb == "ACTION") {
+            action = true;
+            text = rest;
+        } else {
+            if (verb == "VERSION" && !notice) send(std::string("NOTICE ") + from + " :" + kCtcp + "VERSION roro9stack" + kCtcp);
+            return;
+        }
+    }
+
+    int b;
+    if (notice && (from.empty() || from.find('.') != std::string::npos || !registered_ || target == "*")) {
+        b = 0;  // server notices
+    } else if (toMe) {
+        b = notice ? (findBuffer(from) > 0 ? findBuffer(from) : 0) : bufferFor(from, IrcBuffer::Type::Query);
+    } else {
+        b = bufferFor(target, IrcBuffer::Type::Channel);
+    }
+    auto kind = notice ? IrcLine::Kind::Notice : action ? IrcLine::Kind::Action : IrcLine::Kind::Message;
+    bool mention = !notice && (toMe || mentionsMe(text));
+    add(b, kind, from, text, utc, mention);
+}
+
+void IrcSession::say(int b, const std::string& text, int64_t utc, bool action) {
+    const IrcBuffer& buf = buffers_[b];
+    if (buf.type == IrcBuffer::Type::Server) {
+        info(b, "This is the server Buffer: /join #name an IRC channel, or /msg nick text", utc);
+        return;
+    }
+    std::string payload = action ? std::string(1, kCtcp) + "ACTION " + text + kCtcp : text;
+    send(IrcMessage::serialize("PRIVMSG", {buf.name, payload}));
+    add(b, action ? IrcLine::Kind::OwnAction : IrcLine::Kind::Own, nick_, text, utc);
+}
+
+void IrcSession::input(int b, const std::string& text, int64_t utc) {
+    if (b < 0 || b >= bufferCount() || text.empty()) return;
+    if (text.size() >= 2 && text[0] == '/' && text[1] == '/') return say(b, text.substr(1), utc, false);
+    if (text[0] == '/') return command(b, text.substr(1), utc);
+    say(b, text, utc, false);
+}
+
+void IrcSession::command(int b, const std::string& text, int64_t utc) {
+    auto [verb, rest] = firstWord(text);
+    verb = lower(verb);
+    const IrcBuffer& buf = buffers_[b];
+    bool inChannel = buf.type == IrcBuffer::Type::Channel;
+
+    if (verb == "join" || verb == "j") {
+        auto [channel, key] = firstWord(rest);
+        if (channel.empty()) return info(b, "Usage: /join #channel", utc);
+        if (!isChannel(channel)) channel = "#" + channel;
+        if (!key.empty()) keys_[lower(channel)] = key;  // reused when rejoining
+        send(key.empty() ? IrcMessage::serialize("JOIN", {channel}) : IrcMessage::serialize("JOIN", {channel, key}));
+    } else if (verb == "part") {
+        std::string channel = inChannel ? buf.name : "";
+        std::string message = rest;
+        if (isChannel(rest)) std::tie(channel, message) = firstWord(rest);
+        if (channel.empty()) return info(b, "Usage: /part #channel", utc);
+        send(message.empty() ? IrcMessage::serialize("PART", {channel}) : IrcMessage::serialize("PART", {channel, message}));
+    } else if (verb == "msg" || verb == "query") {
+        auto [who, message] = firstWord(rest);
+        if (who.empty()) return info(b, "Usage: /msg nick text", utc);
+        int target = bufferFor(who, isChannel(who) ? IrcBuffer::Type::Channel : IrcBuffer::Type::Query);
+        if (!message.empty()) say(target, message, utc, false);
+    } else if (verb == "me") {
+        say(b, rest, utc, true);
+    } else if (verb == "nick") {
+        if (rest.empty()) return info(b, "Usage: /nick newnick", utc);
+        send(IrcMessage::serialize("NICK", {rest}));
+    } else if (verb == "topic") {
+        if (!inChannel) return info(b, "Use /topic in an IRC channel", utc);
+        send(rest.empty() ? IrcMessage::serialize("TOPIC", {buf.name}) : IrcMessage::serialize("TOPIC", {buf.name, rest}));
+    } else if (verb == "names") {
+        std::string channel = rest.empty() ? (inChannel ? buf.name : "") : rest;
+        if (channel.empty()) return info(b, "Usage: /names #channel", utc);
+        namesRequested_.insert(lower(channel));
+        send(IrcMessage::serialize("NAMES", {channel}));
+    } else if (verb == "quit") {
+        quit_ = true;
+        send(IrcMessage::serialize("QUIT", {rest.empty() ? "roro9stack" : rest}));
+    } else if (verb == "raw" || verb == "quote") {
+        if (!rest.empty()) send(rest);
+    } else {
+        info(b, "Unknown command /" + verb + " (try /join or /j, /part /msg /me /nick /topic /names /quit /raw)", utc);
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,114 @@
+#pragma once
+
+#include <cstdint>
+#include <deque>
+#include <map>
+#include <set>
+#include <string>
+#include <vector>
+
+#include "irc_config.h"
+#include "irc_message.h"
+
+namespace roro {
+
+struct IrcLine {
+    enum class Kind { Message, Action, Notice, Info, Own, OwnAction };
+    int64_t utc;  // -1 if the clock wasn't set
+    Kind kind;
+    std::string nick;
+    std::string text;
+};
+
+// One IRC conversation (see Buffer in CONTEXT.md).
+struct IrcBuffer {
+    enum class Type { Server, Channel, Query };
+    std::string name;
+    Type type;
+    std::deque<IrcLine> lines;  // the most recent kLinesPerBuffer; full history goes to Logs
+    int unread = 0;
+    bool mentioned = false;
+    bool joined = false;
+    std::string topic;
+};
+
+struct IrcLogEntry {
+    std::string buffer;
+    IrcLine line;
+};
+
+// What the session wants done: lines to send, Log entries, Notification texts.
+struct IrcEffects {
+    std::vector<std::string> send;
+    std::vector<IrcLogEntry> logs;
+    std::vector<std::string> notifications;
+};
+
+// The IRC protocol, without any networking: registration (SASL PLAIN or NickServ), Buffers,
+// unread counts, Mentions, the user's commands, and rejoining after a pause. The IRC Service
+// feeds it received lines and carries out the effects.
+class IrcSession {
+   public:
+    static constexpr size_t kLinesPerBuffer = 50;
+    static constexpr int kMaxBuffers = 12;
+
+    explicit IrcSession(const IrcConfig& config);
+
+    // Joins wait this long for NickServ to confirm a login before going ahead anyway.
+    static constexpr uint32_t kNickservWaitMs = 2000;
+
+    // Uptime in ms, called regularly: releases joins held back for NickServ.
+    void tick(uint32_t nowMs);
+
+    void connected(int64_t utc);
+    void disconnected(int64_t utc, const std::string& reason);
+    void receive(const std::string& raw, int64_t utc);
+    void input(int buffer, const std::string& text, int64_t utc);
+
+    // The Buffer the user is looking at (-1: none); it neither counts unread nor notifies.
+    void setViewing(int buffer);
+
+    bool registered() const { return registered_; }
+    bool quitRequested() const { return quit_; }
+    const std::string& nick() const { return nick_; }
+
+    int bufferCount() const { return static_cast<int>(buffers_.size()); }
+    const IrcBuffer& buffer(int i) const { return buffers_[i]; }
+    int totalUnread() const;
+    // Changes whenever a Buffer gains a line or changes, so a view knows when to redraw.
+    uint32_t revision() const { return revision_; }
+
+    IrcEffects takeEffects();
+
+   private:
+    void send(const std::string& line) { effects_.send.push_back(line); }
+    int findBuffer(const std::string& name) const;
+    int bufferFor(const std::string& name, IrcBuffer::Type type);  // creates if needed and possible
+    void add(int buffer, IrcLine::Kind kind, const std::string& nick, const std::string& text, int64_t utc,
+             bool countsAsMention = false);
+    void info(int buffer, const std::string& text, int64_t utc) { add(buffer, IrcLine::Kind::Info, "", text, utc); }
+    bool mentionsMe(const std::string& text) const;
+    void onPrivmsg(const IrcMessage& m, int64_t utc, bool notice);
+    void onWelcome(const IrcMessage& m, int64_t utc);
+    void joinChannels();
+    void command(int buffer, const std::string& text, int64_t utc);
+    void say(int buffer, const std::string& text, int64_t utc, bool action);
+
+    const IrcConfig& config_;
+    std::vector<IrcBuffer> buffers_;
+    std::string nick_;
+    bool registered_ = false;
+    bool quit_ = false;
+    int viewing_ = -1;
+    std::set<std::string> namesRequested_;
+    std::vector<std::string> rejoin_;  // IRC channels to join again after a reconnect
+    std::map<std::string, std::string> keys_;  // lower-case IRC channel -> key, from config and /join
+    bool joinsHeld_ = false;            // waiting for NickServ before joining
+    bool saslFailed_ = false;
+    uint32_t heldSinceMs_ = 0;
+    uint32_t nowMs_ = 0;
+    IrcEffects effects_;
+    uint32_t revision_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <cstdint>
+
+namespace roro {
+
+// Waits between IRC reconnection attempts: 5 s, 10 s, 30 s, 1 min, 2 min, then every 5 min.
+class ReconnectPolicy {
+   public:
+    uint32_t nextDelayMs() {
+        static const uint32_t kDelays[] = {5000, 10000, 30000, 60000, 120000, 300000};
+        const int n = sizeof(kDelays) / sizeof(kDelays[0]);
+        return kDelays[attempt_ < n ? attempt_++ : n - 1];
+    }
+    void reset() { attempt_ = 0; }
+
+   private:
+    int attempt_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,114 @@
+#include "file_receiver.h"
+
+#include <algorithm>
+#include <cstdlib>
+#include <cstring>
+
+namespace roro {
+
+namespace {
+
+int hexDigit(char c) {
+    if (c >= '0' && c <= '9') return c - '0';
+    if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+    if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+    return -1;
+}
+
+// Splits on spaces (no iostreams: they cost about 200 KB of flash on the device).
+std::vector<std::string> words(const std::string& s) {
+    std::vector<std::string> out;
+    size_t i = 0;
+    while (i < s.size()) {
+        if (s[i] == ' ') {
+            i++;
+            continue;
+        }
+        size_t end = s.find(' ', i);
+        if (end == std::string::npos) end = s.size();
+        out.push_back(s.substr(i, end - i));
+        i = end;
+    }
+    return out;
+}
+
+}  // namespace
+
+std::string FileReceiver::begin(const std::string& args, uint32_t nowMs) {
+    reset();
+    std::vector<std::string> w = words(args);
+    if (w.size() != 3) return "usage: sd put <path> <size> <sha256>";
+    const std::string &path = w[0], &size = w[1], &sha = w[2];
+    if (path.empty() || path[0] != '/' || path.size() > 128 || path.find("..") != std::string::npos)
+        return "the path must be absolute, without ..";
+    if (size.empty() || size.size() > 9 || size.find_first_not_of("0123456789") != std::string::npos)
+        return "bad size";
+    uint32_t bytes = static_cast<uint32_t>(std::strtoul(size.c_str(), nullptr, 10));
+    if (bytes == 0 || bytes > kMaxBytes) return "bad size";
+    if (sha.size() != 64) return "bad sha256";
+    for (size_t i = 0; i < 32; i++) {
+        int hi = hexDigit(sha[2 * i]), lo = hexDigit(sha[2 * i + 1]);
+        if (hi < 0 || lo < 0) return "bad sha256";
+        expected_[i] = static_cast<uint8_t>(hi << 4 | lo);
+    }
+    path_ = path;
+    size_ = bytes;
+    lastActivityMs_ = nowMs;
+    chunk_.reserve(kChunk);
+    state_ = State::Receiving;
+    return "";
+}
+
+size_t FileReceiver::wanted() const {
+    if (state_ != State::Receiving) return 0;
+    return std::min<size_t>(kChunk, size_ - received_) - chunk_.size();
+}
+
+size_t FileReceiver::feed(const uint8_t* data, size_t len, uint32_t nowMs) {
+    if (state_ != State::Receiving || len == 0) return 0;
+    size_t take = std::min(len, wanted());
+    chunk_.insert(chunk_.end(), data, data + take);
+    sha_.update(data, take);
+    lastActivityMs_ = nowMs;
+    if (wanted() > 0) return take;
+
+    if (received_ + chunk_.size() == size_) {
+        // The last chunk: refuse it before writing if the file arrived damaged.
+        uint8_t got[32];
+        sha_.finish(got);
+        if (std::memcmp(got, expected_, sizeof got) != 0) {
+            fail("checksum mismatch");
+            return take;
+        }
+    }
+    state_ = State::Writing;
+    return take;
+}
+
+void FileReceiver::chunkWritten(bool ok, uint32_t nowMs) {
+    if (state_ != State::Writing) return;
+    if (!ok) return fail("write failed");
+    received_ += static_cast<uint32_t>(chunk_.size());
+    chunk_.clear();
+    lastActivityMs_ = nowMs;
+    state_ = received_ == size_ ? State::Finishing : State::Receiving;
+}
+
+void FileReceiver::finished(bool ok) {
+    if (state_ != State::Finishing) return;
+    if (!ok) return fail("rename failed");
+    state_ = State::Done;
+}
+
+void FileReceiver::tick(uint32_t nowMs) {
+    if (state_ != State::Receiving && state_ != State::Writing && state_ != State::Finishing) return;
+    if (nowMs - lastActivityMs_ >= kTimeoutMs) fail(state_ == State::Receiving ? "timed out" : "card not writable");
+}
+
+void FileReceiver::fail(const char* why) {
+    error_ = why;
+    chunk_.clear();
+    state_ = State::Failed;
+}
+
+}  // namespace roro
@@ -0,0 +1,66 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "sha256.h"
+
+namespace roro {
+
+// One file sent over the USB serial console (scripts/sd_put.py), to put an Update File on the SD
+// card without taking the card out. The sender writes `sd put <path> <size> <sha256>`, then the raw
+// bytes, one chunk at a time, and waits for each chunk to be written before sending the next: the
+// serial driver drops bytes once its receive buffer is full. The file lands as `<path>.part` and is
+// renamed to `<path>` only once every byte has arrived and the checksum matches.
+class FileReceiver {
+   public:
+    static constexpr size_t kChunk = 1024;           // must stay below the serial receive buffer
+    static constexpr uint32_t kTimeoutMs = 5000;     // silence, or a card job that never completes
+    static constexpr uint32_t kMaxBytes = 8u << 20;  // larger than any app partition
+
+    enum class State {
+        Idle,
+        Receiving,  // waiting for bytes of the current chunk
+        Writing,    // chunk() is complete: write it to partPath(), then call chunkWritten()
+        Finishing,  // everything written and checked: rename partPath() to path(), then finished()
+        Done,
+        Failed,     // error() says why; partPath() should be removed
+    };
+
+    // Parses "<path> <size> <sha256 hex>". Returns "" when the transfer starts, or what's wrong.
+    std::string begin(const std::string& args, uint32_t nowMs);
+    // Takes bytes for the current chunk; returns how many were used (none while a chunk waits).
+    size_t feed(const uint8_t* data, size_t len, uint32_t nowMs);
+    void chunkWritten(bool ok, uint32_t nowMs);
+    void finished(bool ok);
+    void tick(uint32_t nowMs);
+    void reset() { *this = FileReceiver(); }
+
+    State state() const { return state_; }
+    bool active() const { return state_ != State::Idle; }
+    // Bytes still missing from the current chunk: read no more than this from the serial port.
+    size_t wanted() const;
+    const std::vector<uint8_t>& chunk() const { return chunk_; }
+    const std::string& path() const { return path_; }
+    std::string partPath() const { return path_ + ".part"; }
+    uint32_t size() const { return size_; }
+    uint32_t received() const { return received_; }
+    const std::string& error() const { return error_; }
+
+   private:
+    void fail(const char* why);
+
+    State state_ = State::Idle;
+    std::string path_;
+    uint32_t size_ = 0;
+    uint32_t received_ = 0;  // bytes in chunks already written
+    uint8_t expected_[32] = {};
+    Sha256 sha_;
+    std::vector<uint8_t> chunk_;
+    uint32_t lastActivityMs_ = 0;
+    std::string error_;
+};
+
+}  // namespace roro
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <cstdint>
+
+namespace roro {
+
+// Decides when new firmware on Probation (see CONTEXT.md) has proven healthy, or has failed in a
+// way that would leave no means to push a fix (Wi-Fi configured but never connecting).
+class Probation {
+   public:
+    enum class Verdict { Wait, Confirm, RollBack };
+    static constexpr uint32_t kHealthyAfterMs = 30000;
+    static constexpr uint32_t kWifiDeadlineMs = 180000;
+
+    // Checked first thing at boot, before anything that could crash. `attemptsBefore` counts earlier
+    // boots of this image on Probation; a second start means the first one died before confirming.
+    // (A second line behind the bootloader's own rollback, which aborts an image still pending.)
+    static bool rollBackAtBoot(bool onProbation, int attemptsBefore) { return onProbation && attemptsBefore >= 1; }
+
+    static Verdict judge(uint32_t uptimeMs, bool firstFrameDrawn, bool wifiConfigured, bool wifiConnected) {
+        if (wifiConfigured && !wifiConnected && uptimeMs >= kWifiDeadlineMs) return Verdict::RollBack;
+        if (uptimeMs < kHealthyAfterMs || !firstFrameDrawn) return Verdict::Wait;
+        if (wifiConfigured && !wifiConnected) return Verdict::Wait;
+        return Verdict::Confirm;
+    }
+};
+
+}  // namespace roro
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <cstdint>
+
+namespace roro {
+
+// Safe Mode (CONTEXT.md): after kCrashLimit starts in a row that ended in a crash, the firmware
+// starts only what it takes to be fixed over the air (Wi-Fi, Firmware Updates, the Debug Console).
+// Rollback covers new firmware; this covers firmware that was confirmed and crashes anyway.
+struct SafeMode {
+    static constexpr int kCrashLimit = 3;
+    static constexpr uint32_t kStableAfterMs = 60000;  // then the count starts over
+
+    // Called first thing at boot with the count so far; returns the new count.
+    static int countAtBoot(bool lastStartWasCrash, int crashesBefore) {
+        return lastStartWasCrash ? crashesBefore + 1 : 0;
+    }
+    static bool active(int crashes) { return crashes >= kCrashLimit; }
+};
+
+}  // namespace roro
@@ -0,0 +1,85 @@
+#include "sha256.h"
+
+#include <cstring>
+
+namespace roro {
+
+namespace {
+const uint32_t K[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
+
+inline uint32_t rotr(uint32_t x, int n) { return (x >> n) | (x << (32 - n)); }
+}  // namespace
+
+Sha256::Sha256() {
+    const uint32_t init[8] = {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+                              0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
+    std::memcpy(h_, init, sizeof(h_));
+}
+
+void Sha256::block(const uint8_t* p) {
+    uint32_t w[64];
+    for (int i = 0; i < 16; i++)
+        w[i] = (uint32_t(p[4 * i]) << 24) | (uint32_t(p[4 * i + 1]) << 16) | (uint32_t(p[4 * i + 2]) << 8) | p[4 * i + 3];
+    for (int i = 16; i < 64; i++) {
+        uint32_t s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3);
+        uint32_t s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10);
+        w[i] = w[i - 16] + s0 + w[i - 7] + s1;
+    }
+    uint32_t a = h_[0], b = h_[1], c = h_[2], d = h_[3], e = h_[4], f = h_[5], g = h_[6], h = h_[7];
+    for (int i = 0; i < 64; i++) {
+        uint32_t t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i];
+        uint32_t t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c));
+        h = g;
+        g = f;
+        f = e;
+        e = d + t1;
+        d = c;
+        c = b;
+        b = a;
+        a = t1 + t2;
+    }
+    h_[0] += a; h_[1] += b; h_[2] += c; h_[3] += d;
+    h_[4] += e; h_[5] += f; h_[6] += g; h_[7] += h;
+}
+
+void Sha256::update(const uint8_t* data, size_t len) {
+    bits_ += static_cast<uint64_t>(len) * 8;
+    while (len > 0) {
+        size_t take = 64 - used_ < len ? 64 - used_ : len;
+        std::memcpy(buf_ + used_, data, take);
+        used_ += take;
+        data += take;
+        len -= take;
+        if (used_ == 64) {
+            block(buf_);
+            used_ = 0;
+        }
+    }
+}
+
+void Sha256::finish(uint8_t out[32]) {
+    uint64_t bits = bits_;
+    uint8_t pad = 0x80;
+    update(&pad, 1);
+    uint8_t zero = 0;
+    while (used_ != 56) update(&zero, 1);
+    uint8_t len[8];
+    for (int i = 0; i < 8; i++) len[i] = static_cast<uint8_t>(bits >> (56 - 8 * i));
+    update(len, 8);
+    for (int i = 0; i < 8; i++) {
+        out[4 * i] = h_[i] >> 24;
+        out[4 * i + 1] = h_[i] >> 16;
+        out[4 * i + 2] = h_[i] >> 8;
+        out[4 * i + 3] = h_[i];
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,30 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace roro {
+
+// Plain SHA-256 (FIPS 180-4), streaming. Small and dependency-free, so the same code runs in the
+// PC tests and on the device.
+class Sha256 {
+   public:
+    Sha256();
+    void update(const uint8_t* data, size_t len);
+    void finish(uint8_t out[32]);
+
+    static void hash(const uint8_t* data, size_t len, uint8_t out[32]) {
+        Sha256 s;
+        s.update(data, len);
+        s.finish(out);
+    }
+
+   private:
+    void block(const uint8_t* p);
+    uint32_t h_[8];
+    uint8_t buf_[64];
+    size_t used_ = 0;
+    uint64_t bits_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,87 @@
+#include "update_parser.h"
+
+#include <cstring>
+
+#include "version_compare.h"
+
+namespace roro {
+
+namespace {
+uint16_t u16(const uint8_t* p) { return p[0] | (p[1] << 8); }
+uint32_t u32(const uint8_t* p) { return p[0] | (p[1] << 8) | (p[2] << 16) | (uint32_t(p[3]) << 24); }
+}  // namespace
+
+void UpdateParser::fail(const std::string& why) {
+    if (state_ == State::Image) sink_.abort();
+    state_ = State::Failed;
+    error_ = why;
+}
+
+void UpdateParser::parseHeader() {
+    const uint8_t* h = header_;
+    if (std::memcmp(h, update::kMagic, 8) != 0) return fail("not an update file");
+    if (u16(h + 8) != update::kFormat || u16(h + 10) != update::kHeaderSize) return fail("unsupported update format");
+    imageSize_ = u32(h + 12);
+    if (imageSize_ == 0 || imageSize_ > maxImage_) return fail("image doesn't fit the update slot");
+    std::memcpy(expectedHash_, h + 16, 32);
+    version_.assign(reinterpret_cast<const char*>(h + 48), strnlen(reinterpret_cast<const char*>(h + 48), 32));
+
+    size_t sigLen = u16(h + 80);
+    if (sigLen == 0 || sigLen > update::kMaxSignature) return fail("missing signature");
+    uint8_t digest[32];
+    Sha256::hash(h, update::kSignedBytes, digest);
+    if (!verifier_.verify(digest, h + 82, sigLen)) return fail("bad signature (wrong key)");
+
+    downgrade_ = versionOlder(version_, installed_);
+    if (!sink_.begin(imageSize_)) return fail("could not prepare the update slot");
+    state_ = State::Image;
+}
+
+void UpdateParser::feed(const uint8_t* data, size_t len) {
+    while (len > 0 && (state_ == State::Header || state_ == State::Image)) {
+        if (state_ == State::Header) {
+            size_t take = std::min(len, update::kHeaderSize - headerUsed_);
+            std::memcpy(header_ + headerUsed_, data, take);
+            headerUsed_ += take;
+            data += take;
+            len -= take;
+            if (headerUsed_ == update::kHeaderSize) parseHeader();
+        } else {
+            size_t take = std::min(len, imageSize_ - received_);
+            if (take == 0) return fail("data after the end of the image");
+            hash_.update(data, take);
+            if (!sink_.write(data, take)) return fail("writing the update failed");
+            received_ += take;
+            data += take;
+            len -= take;
+        }
+    }
+    if (len > 0 && state_ == State::Image) fail("data after the end of the image");
+}
+
+bool UpdateParser::end() {
+    if (state_ == State::Done) return true;
+    if (state_ != State::Image) {
+        if (state_ == State::Header) fail("update file too short");
+        return false;
+    }
+    if (received_ != imageSize_) {
+        fail("update file too short");
+        return false;
+    }
+    uint8_t got[32];
+    hash_.finish(got);
+    if (std::memcmp(got, expectedHash_, 32) != 0) {
+        fail("image corrupted (hash mismatch)");
+        return false;
+    }
+    if (!sink_.finish()) {
+        state_ = State::Failed;
+        error_ = "could not switch to the new image";
+        return false;
+    }
+    state_ = State::Done;
+    return true;
+}
+
+}  // namespace roro
@@ -0,0 +1,82 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+#include "sha256.h"
+
+namespace roro {
+
+// The Update File (see CONTEXT.md): a 160-byte header, then the firmware image. All integers are
+// little-endian.
+//   0  magic "RORO-OTA"     8  u16 format (1)    10 u16 header size (160)   12 u32 image size
+//  16  image SHA-256[32]   48  version, NUL-padded [32]
+//  80  u16 signature length   82  signature (DER, up to 72 bytes)   154 reserved
+// The signature covers SHA-256 of bytes 0..79, which include the image's hash, so a bad signature
+// is caught before anything is written, and a bad image when its hash is checked at the end.
+namespace update {
+constexpr char kMagic[] = "RORO-OTA";
+constexpr uint16_t kFormat = 1;
+constexpr size_t kHeaderSize = 160;
+constexpr size_t kSignedBytes = 80;
+constexpr size_t kMaxSignature = 72;
+}  // namespace update
+
+class SignatureVerifier {
+   public:
+    virtual ~SignatureVerifier() = default;
+    virtual bool verify(const uint8_t digest[32], const uint8_t* signature, size_t len) = 0;
+};
+
+// Where the image goes (the inactive app slot on the device).
+class UpdateSink {
+   public:
+    virtual ~UpdateSink() = default;
+    virtual bool begin(size_t imageSize) = 0;
+    virtual bool write(const uint8_t* data, size_t len) = 0;
+    virtual bool finish() = 0;  // make it the image to boot next
+    virtual void abort() = 0;
+};
+
+// Streams an Update File into a sink: checks the header and signature first, then hashes the image
+// as it passes through, and only finishes the sink if everything matches.
+class UpdateParser {
+   public:
+    enum class State { Header, Image, Done, Failed };
+
+    UpdateParser(SignatureVerifier& verifier, UpdateSink& sink, size_t maxImageSize, std::string installedVersion)
+        : verifier_(verifier), sink_(sink), maxImage_(maxImageSize), installed_(std::move(installedVersion)) {}
+
+    void feed(const uint8_t* data, size_t len);
+    bool end();  // no more data: true if the update was installed
+    // The whole image the header announced has arrived (the sender need not close the connection).
+    bool complete() const { return state_ == State::Image && received_ == imageSize_; }
+
+    State state() const { return state_; }
+    const std::string& error() const { return error_; }
+    const std::string& version() const { return version_; }
+    bool isDowngrade() const { return downgrade_; }
+    int percent() const { return imageSize_ ? static_cast<int>(received_ * 100 / imageSize_) : 0; }
+
+   private:
+    void parseHeader();
+    void fail(const std::string& why);
+
+    SignatureVerifier& verifier_;
+    UpdateSink& sink_;
+    size_t maxImage_;
+    std::string installed_;
+
+    State state_ = State::Header;
+    uint8_t header_[update::kHeaderSize];
+    size_t headerUsed_ = 0;
+    uint8_t expectedHash_[32];
+    size_t imageSize_ = 0;
+    size_t received_ = 0;
+    Sha256 hash_;
+    std::string version_, error_;
+    bool downgrade_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <cstdlib>
+#include <string>
+
+namespace roro {
+
+// True if `a` is an older release than `b`, comparing "vMAJOR.MINOR.PATCH" and ignoring any
+// git-describe suffix ("-3-gabc1234-dirty"). Anything that doesn't parse is never called older.
+inline bool parseVersion(const std::string& s, int out[3]) {
+    size_t pos = s.size() > 0 && s[0] == 'v' ? 1 : 0;
+    for (int i = 0; i < 3; i++) {
+        if (pos >= s.size() || s[pos] < '0' || s[pos] > '9') return false;
+        char* end;
+        out[i] = static_cast<int>(std::strtol(s.c_str() + pos, &end, 10));
+        pos = end - s.c_str();
+        if (i < 2) {
+            if (pos >= s.size() || s[pos] != '.') return false;
+            pos++;
+        }
+    }
+    return true;
+}
+
+inline bool versionOlder(const std::string& a, const std::string& b) {
+    int x[3], y[3];
+    if (!parseVersion(a, x) || !parseVersion(b, y)) return false;
+    for (int i = 0; i < 3; i++)
+        if (x[i] != y[i]) return x[i] < y[i];
+    return false;
+}
+
+}  // namespace roro
@@ -34,6 +34,15 @@ std::string ClockModel::formatLocalTime(int64_t utcSeconds) {
    return buf;
 }

+std::string ClockModel::formatLocalDate(int64_t utcSeconds) {
+    time_t t = static_cast<time_t>(utcSeconds);
+    struct tm local;
+    localtime_r(&t, &local);
+    char buf[12];
+    std::snprintf(buf, sizeof(buf), "%04d-%02d-%02d", local.tm_year + 1900, local.tm_mon + 1, local.tm_mday);
+    return buf;
+}
+
 std::string ClockModel::formatAge(int64_t seconds) {
    char buf[24];
    if (seconds < 60) return "now";
@@ -21,6 +21,7 @@ class ClockModel {

    static void applyTimezone(const char* posixTz);
    static std::string formatLocalTime(int64_t utcSeconds);  // "HH:MM"
+    static std::string formatLocalDate(int64_t utcSeconds);  // "YYYY-MM-DD"
    static std::string formatAge(int64_t seconds);           // "now", "5 min ago", "3 h ago", "2 d ago"

   private:
@@ -28,6 +28,9 @@ const Definition kDefinitions[] = {
    {"off_s", Kind::Int, 60, nullptr, 10, 3600},
    {"sound", Kind::Bool, 1, nullptr, 0, 1},
    {"probe_mac_raw", Kind::Bool, 1, nullptr, 0, 1},
+    {"wifi_on", Kind::Bool, 1, nullptr, 0, 1},
+    {"gnss_on", Kind::Bool, 1, nullptr, 0, 1},
+    {"coord_dms", Kind::Bool, 0, nullptr, 0, 1},
 };
 static_assert(sizeof(kDefinitions) / sizeof(kDefinitions[0]) == static_cast<size_t>(Setting::Count),
              "every Setting needs a definition");
@@ -20,6 +20,9 @@ enum class Setting : uint8_t {
    OffTimeoutS,      // int, 10..3600, above DimTimeoutS
    Sound,            // bool
    ProbeMacRaw,      // bool: probe-request Logs keep raw MAC addresses
+    WifiEnabled,      // bool: the Wi-Fi Service stays Connected when a Saved Network is in range
+    GnssEnabled,      // bool: the GNSS Service reads the receiver (M2, Q58)
+    CoordinatesDms,   // bool: show degrees, minutes and seconds instead of decimal degrees (Q64)
    Count
 };

@@ -0,0 +1,53 @@
+#include "cleanup_plan.h"
+
+#include <cstdio>
+
+#include "storage_paths.h"
+
+namespace roro {
+
+namespace {
+int maxAgeDays(CleanupAge age) {
+    switch (age) {
+        case CleanupAge::OneMonth: return 30;
+        case CleanupAge::ThreeMonths: return 91;
+        case CleanupAge::SixMonths: return 182;
+        case CleanupAge::OneYear: return 365;
+        default: return -1;
+    }
+}
+}  // namespace
+
+CleanupPlan CleanupPlan::make(const std::vector<StoredFile>& files, CleanupAge age, int todayDay) {
+    CleanupPlan plan;
+    for (auto& f : files) {
+        if (f.path.rfind("/notes", 0) == 0) continue;  // Notes are never cleaned up
+        bool selected = age == CleanupAge::Everything;
+        if (!selected) {
+            size_t slash = f.path.find_last_of('/');
+            int day = storage::fileDay(slash == std::string::npos ? f.path : f.path.substr(slash + 1));
+            selected = day >= 0 && todayDay - day > maxAgeDays(age);
+        }
+        if (selected) {
+            plan.paths.push_back(f.path);
+            plan.bytes += f.bytes;
+        }
+    }
+    return plan;
+}
+
+std::string formatBytes(uint64_t bytes) {
+    const char* units[] = {"B", "KB", "MB", "GB"};
+    double v = static_cast<double>(bytes);
+    int u = 0;
+    while (v >= 1024 && u < 3) {
+        v /= 1024;
+        u++;
+    }
+    char buf[16];
+    if (u == 0 || v >= 10) std::snprintf(buf, sizeof(buf), "%.0f %s", v, units[u]);
+    else std::snprintf(buf, sizeof(buf), "%.1f %s", v, units[u]);
+    return buf;
+}
+
+}  // namespace roro
@@ -0,0 +1,41 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro {
+
+struct StoredFile {
+    std::string path;
+    uint64_t bytes;
+};
+
+// What Storage Clean-up offers (see CONTEXT.md). Notes are deliberately absent.
+struct CleanupCategory {
+    const char* label;
+    const char* folder;
+};
+inline const CleanupCategory kCleanupCategories[] = {
+    {"IRC logs", "/irc"},
+    {"Wi-Fi scan logs", "/wifi/scans"},
+    {"Wi-Fi captures", "/captures/wifi"},
+    {"GNSS tracks", "/gnss/tracks"},
+};
+
+enum class CleanupAge { OneMonth, ThreeMonths, SixMonths, OneYear, Everything };
+inline const char* const kCleanupAgeLabels[] = {"Older than 1 month", "Older than 3 months", "Older than 6 months",
+                                                "Older than 1 year", "Everything"};
+
+// The files a clean-up would delete, and how much space that frees. Dates come from file names;
+// undated files are only removed by Everything.
+struct CleanupPlan {
+    std::vector<std::string> paths;
+    uint64_t bytes = 0;
+
+    static CleanupPlan make(const std::vector<StoredFile>& files, CleanupAge age, int todayDay);
+};
+
+std::string formatBytes(uint64_t bytes);
+
+}  // namespace roro
@@ -0,0 +1,67 @@
+#include "storage_paths.h"
+
+#include <cctype>
+
+namespace roro::storage {
+
+namespace {
+
+// Howard Hinnant's days_from_civil.
+int daysFromCivil(int y, int m, int d) {
+    y -= m <= 2;
+    int era = (y >= 0 ? y : y - 399) / 400;
+    int yoe = y - era * 400;
+    int doy = (153 * (m + (m > 2 ? -3 : 9)) + 2) / 5 + d - 1;
+    int doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    return era * 146097 + doe - 719468;
+}
+
+bool digits(const std::string& s, size_t pos, size_t n, int& out) {
+    if (pos + n > s.size()) return false;
+    out = 0;
+    for (size_t i = pos; i < pos + n; i++) {
+        if (!std::isdigit(static_cast<unsigned char>(s[i]))) return false;
+        out = out * 10 + (s[i] - '0');
+    }
+    return true;
+}
+
+int validDay(int y, int m, int d) {
+    static const int kDays[] = {31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
+    if (y < 1970 || m < 1 || m > 12 || d < 1 || d > kDays[m - 1]) return -1;
+    return daysFromCivil(y, m, d);
+}
+
+}  // namespace
+
+std::string sanitize(const std::string& name) {
+    std::string out;
+    for (char c : name) {
+        bool forbidden = c == '\\' || c == '/' || c == ':' || c == '*' || c == '?' || c == '"' || c == '<' ||
+                         c == '>' || c == '|' || static_cast<unsigned char>(c) < 0x20;
+        out += forbidden ? '_' : c;
+    }
+    if (out.empty() || out == ".") return "_";
+    if (out == "..") return "_.";
+    return out;
+}
+
+std::string dailyLogPath(std::initializer_list<std::string> folders, const std::string& date) {
+    std::string path;
+    for (auto& f : folders) path += "/" + sanitize(f);
+    return path + "/" + (date.empty() ? "undated" : date) + ".log";
+}
+
+int fileDay(const std::string& name) {
+    int y, m, d;
+    if (digits(name, 0, 4, y) && name.size() > 10 && name[4] == '-' && digits(name, 5, 2, m) && name[7] == '-' &&
+        digits(name, 8, 2, d))
+        return validDay(y, m, d);
+    if (digits(name, 0, 4, y) && digits(name, 4, 2, m) && digits(name, 6, 2, d) && name.size() > 8 && name[8] == '-')
+        return validDay(y, m, d);
+    return -1;
+}
+
+int dayFromUtc(int64_t utcSeconds) { return static_cast<int>(utcSeconds / 86400); }
+
+}  // namespace roro::storage
@@ -0,0 +1,22 @@
+#pragma once
+
+#include <cstdint>
+#include <initializer_list>
+#include <string>
+
+namespace roro::storage {
+
+// Makes one path component safe for FAT: forbidden characters become '_', never empty or a dot name.
+std::string sanitize(const std::string& name);
+
+// "/irc/libera/#roro/2026-10-02.log" from {"irc", "libera", "#roro"} and a local date
+// ("YYYY-MM-DD"); an empty date (clock not set yet) gives "undated.log".
+std::string dailyLogPath(std::initializer_list<std::string> folders, const std::string& date);
+
+// Day number (days since 1970-01-01) encoded in a Log ("2026-10-02.log") or Capture
+// ("20261002-144500.pcap") file name, or -1 if the name carries no valid date.
+int fileDay(const std::string& fileName);
+
+int dayFromUtc(int64_t utcSeconds);
+
+}  // namespace roro::storage
@@ -0,0 +1,50 @@
+#pragma once
+
+#include <deque>
+#include <string>
+
+namespace roro {
+
+// Lines already entered, browsed shell-style: up() goes back in time, down() forward, and past the
+// newest line the draft being typed comes back.
+class InputHistory {
+   public:
+    explicit InputHistory(size_t capacity) : capacity_(capacity) {}
+
+    void add(const std::string& line) {
+        browsing_ = -1;
+        if (line.empty() || (!lines_.empty() && lines_.back() == line)) return;
+        lines_.push_back(line);
+        if (lines_.size() > capacity_) lines_.pop_front();
+    }
+
+    // `current` is what the editor holds now (kept as the draft when browsing starts).
+    bool up(const std::string& current, std::string& out) {
+        if (lines_.empty() || browsing_ == 0) return false;
+        if (browsing_ < 0) {
+            draft_ = current;
+            browsing_ = static_cast<int>(lines_.size());
+        }
+        out = lines_[--browsing_];
+        return true;
+    }
+
+    bool down(std::string& out) {
+        if (browsing_ < 0) return false;
+        if (++browsing_ >= static_cast<int>(lines_.size())) {
+            browsing_ = -1;
+            out = draft_;
+        } else {
+            out = lines_[browsing_];
+        }
+        return true;
+    }
+
+   private:
+    size_t capacity_;
+    std::deque<std::string> lines_;
+    int browsing_ = -1;  // index being shown, -1 when editing the draft
+    std::string draft_;
+};
+
+}  // namespace roro
@@ -0,0 +1,35 @@
+#include "channel_occupancy.h"
+
+namespace roro {
+
+namespace {
+// -90 dBm (barely there) -> 0.1, -40 dBm and stronger -> 1.
+float weight(int rssi) {
+    float w = (rssi + 90) / 50.0f;
+    if (w < 0.1f) w = 0.1f;
+    if (w > 1.0f) w = 1.0f;
+    return w;
+}
+const float kSpill[] = {1.0f, 0.5f, 0.2f};  // same channel, one away, two away
+}  // namespace
+
+std::array<float, 14> channelLoad(const std::vector<ChannelSighting>& sightings) {
+    std::array<float, 14> load{};
+    for (auto& s : sightings) {
+        if (s.channel < 1 || s.channel > 13) continue;
+        for (int d = -2; d <= 2; d++) {
+            int ch = s.channel + d;
+            if (ch >= 1 && ch <= 13) load[ch] += weight(s.rssi) * kSpill[d < 0 ? -d : d];
+        }
+    }
+    return load;
+}
+
+int quietestChannel(const std::array<float, 14>& load) {
+    int best = 1;
+    for (int ch : {6, 11})
+        if (load[ch] < load[best]) best = ch;
+    return best;
+}
+
+}  // namespace roro
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <array>
+#include <vector>
+
+namespace roro {
+
+struct ChannelSighting {
+    int channel;
+    int rssi;
+};
+
+// How crowded each 2.4 GHz Wi-Fi channel (1..13) is, from the access points a scan saw. A 20 MHz
+// network spills onto the channels up to two away, less the further it is; a strong signal
+// counts more than a faint one. Index 0 is unused.
+std::array<float, 14> channelLoad(const std::vector<ChannelSighting>& sightings);
+
+// The least crowded of the non-overlapping channels 1, 6 and 11 (the lowest on a tie).
+int quietestChannel(const std::array<float, 14>& load);
+
+}  // namespace roro
@@ -0,0 +1,59 @@
+#include "network_list_view.h"
+
+#include <algorithm>
+#include <cctype>
+
+namespace roro {
+
+namespace {
+std::string lower(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+}  // namespace
+
+std::vector<int> orderNetworks(const std::vector<ScanEntry>& entries, WifiSort sort, const NetworkFilter& filter) {
+    std::vector<int> idx;
+    for (int i = 0; i < static_cast<int>(entries.size()); i++) {
+        const ScanEntry& e = entries[i];
+        if (filter.openOnly && !e.open) continue;
+        if (filter.hideHidden && e.ssid.empty()) continue;
+        if (e.rssi < filter.minRssi) continue;
+        idx.push_back(i);
+    }
+    std::stable_sort(idx.begin(), idx.end(), [&](int a, int b) {
+        const ScanEntry& x = entries[a];
+        const ScanEntry& y = entries[b];
+        switch (sort) {
+            case WifiSort::Signal: return x.rssi > y.rssi;  // strongest first
+            case WifiSort::Channel: return x.channel != y.channel ? x.channel < y.channel : x.rssi > y.rssi;
+            case WifiSort::Name: {
+                // Hidden networks (no name) sort to the end.
+                if (x.ssid.empty() != y.ssid.empty()) return y.ssid.empty();
+                return lower(x.ssid) < lower(y.ssid);
+            }
+        }
+        return false;
+    });
+    return idx;
+}
+
+const char* sortName(WifiSort sort) {
+    switch (sort) {
+        case WifiSort::Signal: return "signal";
+        case WifiSort::Channel: return "channel";
+        case WifiSort::Name: return "name";
+    }
+    return "";
+}
+
+WifiSort nextSort(WifiSort sort) {
+    switch (sort) {
+        case WifiSort::Signal: return WifiSort::Channel;
+        case WifiSort::Channel: return WifiSort::Name;
+        case WifiSort::Name: return WifiSort::Signal;
+    }
+    return WifiSort::Signal;
+}
+
+}  // namespace roro
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "scan_entry.h"
+
+namespace roro {
+
+enum class WifiSort { Signal, Channel, Name };
+
+struct NetworkFilter {
+    bool openOnly = false;
+    bool hideHidden = false;
+    int minRssi = -100;  // drop anything weaker
+};
+
+// The order and selection the network list shows: indices into `entries`, sorted and filtered.
+// Stable, so equal rows keep their scan order.
+std::vector<int> orderNetworks(const std::vector<ScanEntry>& entries, WifiSort sort, const NetworkFilter& filter);
+
+const char* sortName(WifiSort sort);
+WifiSort nextSort(WifiSort sort);
+
+}  // namespace roro
@@ -0,0 +1,67 @@
+#include "saved_networks.h"
+
+namespace roro {
+
+namespace {
+std::string key(int i, const char* field) { return "net" + std::to_string(i) + "_" + field; }
+}  // namespace
+
+void SavedNetworks::load() {
+    networks_.clear();
+    int32_t n = 0;
+    store_.getInt("net_count", n);
+    for (int i = 0; i < n && i < kMax; i++) {
+        SavedNetwork net;
+        if (!store_.getString(key(i, "ssid").c_str(), net.ssid)) break;
+        store_.getString(key(i, "pass").c_str(), net.password);
+        int32_t hidden = 0;
+        store_.getInt(key(i, "hid").c_str(), hidden);
+        net.hidden = hidden != 0;
+        networks_.push_back(net);
+    }
+}
+
+const SavedNetwork* SavedNetworks::find(const std::string& ssid) const {
+    for (auto& n : networks_)
+        if (n.ssid == ssid) return &n;
+    return nullptr;
+}
+
+std::string SavedNetworks::add(const std::string& ssid, const std::string& password, bool hidden) {
+    if (ssid.empty() || ssid.size() > 32) return "Network name must be 1 to 32 bytes";
+    if (!password.empty() && (password.size() < 8 || password.size() > 63))
+        return "Password must be 8 to 63 characters (or empty for an open network)";
+    for (auto& n : networks_) {
+        if (n.ssid == ssid) {
+            n.password = password;
+            n.hidden = hidden;
+            save();
+            return "";
+        }
+    }
+    if (count() >= kMax) return "Already 8 saved networks: forget one first";
+    networks_.push_back({ssid, password, hidden});
+    save();
+    return "";
+}
+
+void SavedNetworks::forget(const std::string& ssid) {
+    for (auto it = networks_.begin(); it != networks_.end(); ++it) {
+        if (it->ssid == ssid) {
+            networks_.erase(it);
+            save();
+            return;
+        }
+    }
+}
+
+void SavedNetworks::save() {
+    for (int i = 0; i < count(); i++) {
+        store_.putString(key(i, "ssid").c_str(), networks_[i].ssid);
+        store_.putString(key(i, "pass").c_str(), networks_[i].password);
+        store_.putInt(key(i, "hid").c_str(), networks_[i].hidden ? 1 : 0);
+    }
+    store_.putInt("net_count", count());
+}
+
+}  // namespace roro
@@ -0,0 +1,39 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "key_value_store.h"
+
+namespace roro {
+
+struct SavedNetwork {
+    std::string ssid;
+    std::string password;  // empty for an open network
+    bool hidden = false;   // doesn't broadcast its name, so never shows up in scans
+};
+
+// The Saved Networks the Wi-Fi Service may join (see CONTEXT.md), persisted in internal flash.
+class SavedNetworks {
+   public:
+    static constexpr int kMax = 8;
+
+    explicit SavedNetworks(KeyValueStore& store) : store_(store) {}
+
+    void load();
+    int count() const { return static_cast<int>(networks_.size()); }
+    const SavedNetwork& at(int i) const { return networks_[i]; }
+    const SavedNetwork* find(const std::string& ssid) const;
+
+    // Adds, or updates the password of an existing SSID. Empty on success, otherwise why not.
+    std::string add(const std::string& ssid, const std::string& password, bool hidden = false);
+    void forget(const std::string& ssid);
+
+   private:
+    void save();
+
+    KeyValueStore& store_;
+    std::vector<SavedNetwork> networks_;
+};
+
+}  // namespace roro
@@ -0,0 +1,18 @@
+#pragma once
+
+#include <string>
+
+namespace roro {
+
+// One access point an ordinary Wi-Fi scan reported (a network announcing itself). No client or
+// monitor-mode data: just what a beacon broadcasts.
+struct ScanEntry {
+    std::string ssid;   // empty for a hidden network
+    std::string bssid;  // the access point's own address, from its beacon
+    int channel;
+    int rssi;
+    bool open;
+    std::string security;  // "open", "WPA2", "WPA3"...
+};
+
+}  // namespace roro
@@ -0,0 +1,27 @@
+#include "scan_log.h"
+
+namespace roro::scanlog {
+
+std::string csvField(const std::string& value) {
+    bool needsQuote = false;
+    for (char c : value)
+        if (c == ',' || c == '"' || c == '\n' || c == '\r') needsQuote = true;
+    if (!needsQuote) return value;
+    std::string out = "\"";
+    for (char c : value) {
+        if (c == '"') out += '"';  // escape by doubling
+        out += c;
+    }
+    out += '"';
+    return out;
+}
+
+std::string header() { return "time,bssid,channel,rssi,security,ssid"; }
+
+std::string row(const std::string& timestamp, const ScanEntry& ap) {
+    return csvField(timestamp) + "," + csvField(ap.bssid) + "," + std::to_string(ap.channel) + "," +
+           std::to_string(ap.rssi) + "," + csvField(ap.security) + "," +
+           csvField(ap.ssid.empty() ? "(hidden)" : ap.ssid);
+}
+
+}  // namespace roro::scanlog
@@ -0,0 +1,43 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "scan_entry.h"
+
+namespace roro {
+
+// Writes what Wi-Fi Tools already sees (access points, channel, signal) to a CSV Log, so the user
+// can track their own Wi-Fi environment over time. One row per access point per logged scan.
+namespace scanlog {
+
+// A CSV field, quoted when it contains a comma, quote or newline.
+std::string csvField(const std::string& value);
+
+// The header row (no trailing newline).
+std::string header();
+
+// One data row for an access point seen at `timestamp` (a preformatted local time string).
+std::string row(const std::string& timestamp, const ScanEntry& ap);
+
+}  // namespace scanlog
+
+// Decides when to write a scan to the Log: at most once per interval.
+class ScanLogThrottle {
+   public:
+    explicit ScanLogThrottle(uint32_t intervalMs) : intervalMs_(intervalMs) {}
+    bool due(uint32_t nowMs) const { return !logged_ || nowMs - lastMs_ >= intervalMs_; }
+    void logged(uint32_t nowMs) {
+        lastMs_ = nowMs;
+        logged_ = true;
+    }
+    void reset() { logged_ = false; }
+
+   private:
+    uint32_t intervalMs_;
+    uint32_t lastMs_ = 0;
+    bool logged_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,52 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <deque>
+
+namespace roro {
+
+// Follows one access point's signal over repeated scans, for finding where it is.
+class SignalTracker {
+   public:
+    static constexpr int kNoSignal = -127;
+    static constexpr uint32_t kLostAfterMs = 5000;
+    static constexpr uint32_t kFastestClickMs = 60;
+    static constexpr uint32_t kSlowestClickMs = 1200;
+
+    explicit SignalTracker(size_t historySize) : size_(historySize) {}
+
+    void seen(int rssi, uint32_t nowMs) {
+        push(rssi);
+        latest_ = rssi;
+        lastSeenMs_ = nowMs;
+        everSeen_ = true;
+    }
+    void missed() { push(kNoSignal); }  // a scan that didn't see it
+
+    bool lost(uint32_t nowMs) const { return !everSeen_ || nowMs - lastSeenMs_ >= kLostAfterMs; }
+    int latest() const { return latest_; }
+    const std::deque<int>& history() const { return history_; }
+
+    // Time between clicks: fast when the signal is strong (close), slow when faint.
+    static uint32_t clickIntervalMs(int rssi) {
+        if (rssi >= -35) return kFastestClickMs;
+        if (rssi <= -95) return kSlowestClickMs;
+        float t = (rssi + 95) / 60.0f;  // 0 at -95 dBm, 1 at -35 dBm
+        return static_cast<uint32_t>(kSlowestClickMs - t * (kSlowestClickMs - kFastestClickMs));
+    }
+
+   private:
+    void push(int v) {
+        history_.push_back(v);
+        if (history_.size() > size_) history_.pop_front();
+    }
+
+    size_t size_;
+    std::deque<int> history_;
+    int latest_ = kNoSignal;
+    uint32_t lastSeenMs_ = 0;
+    bool everSeen_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,99 @@
+#include "wifi_controller.h"
+
+namespace roro {
+
+namespace {
+const uint32_t kRetryDelaysMs[] = {10000, 30000, 60000};
+const int kRetrySteps = sizeof(kRetryDelaysMs) / sizeof(kRetryDelaysMs[0]);
+}  // namespace
+
+WifiController::Step WifiController::wait(uint32_t nowMs) {
+    state_ = State::Waiting;
+    retryAtMs_ = nowMs + kRetryDelaysMs[retries_ < kRetrySteps ? retries_ : kRetrySteps - 1];
+    retries_++;
+    return act(Action::None);
+}
+
+WifiController::Step WifiController::update(uint32_t nowMs, bool enabled) {
+    if (state_ == State::Monitoring) return act(Action::None);
+    if (!enabled || saved_.count() == 0) {  // nothing to join: keep the radio off
+        if (state_ == State::Off) return act(Action::None);
+        state_ = State::Off;
+        ssid_.clear();
+        return act(Action::RadioOff);
+    }
+    switch (state_) {
+        case State::Off:
+            state_ = State::Scanning;
+            return act(Action::StartScan);
+        case State::Waiting:
+            if (static_cast<int32_t>(nowMs - retryAtMs_) < 0) return act(Action::None);
+            state_ = State::Scanning;
+            return act(Action::StartScan);
+        case State::Connecting:
+            if (nowMs - sinceMs_ < kConnectTimeoutMs) return act(Action::None);
+            wait(nowMs);
+            return act(Action::Disconnect);
+        default:
+            return act(Action::None);
+    }
+}
+
+WifiController::Step WifiController::scanDone(const std::vector<ScanResult>& results, uint32_t nowMs) {
+    if (state_ != State::Scanning) return act(Action::None);
+    const ScanResult* best = nullptr;
+    for (auto& r : results)
+        if (saved_.find(r.ssid) && (!best || r.rssi > best->rssi)) best = &r;
+    const SavedNetwork* net = best ? saved_.find(best->ssid) : nullptr;
+    if (!net) {
+        // Hidden networks never appear in scans: try them one at a time.
+        for (int i = 0; i < saved_.count() && !net; i++) {
+            const SavedNetwork& candidate = saved_.at((nextHidden_ + i) % saved_.count());
+            if (candidate.hidden) {
+                net = &candidate;
+                nextHidden_ = (nextHidden_ + i + 1) % saved_.count();
+            }
+        }
+    }
+    if (!net) return wait(nowMs);
+
+    state_ = State::Connecting;
+    ssid_ = net->ssid;
+    sinceMs_ = nowMs;
+    return Step{Action::Connect, net->ssid, net->password};
+}
+
+WifiController::Step WifiController::connected(uint32_t) {
+    if (state_ != State::Connecting) return act(Action::None);
+    state_ = State::Connected;
+    retries_ = 0;
+    return act(Action::None);
+}
+
+WifiController::Step WifiController::disconnected(uint32_t nowMs) {
+    if (state_ == State::Connected) {
+        state_ = State::Scanning;
+        return act(Action::StartScan);
+    }
+    if (state_ == State::Connecting) return wait(nowMs);  // e.g. wrong password
+    return act(Action::None);
+}
+
+WifiController::Step WifiController::requestMonitor() {
+    state_ = State::Monitoring;
+    ssid_.clear();
+    return act(Action::StartMonitor);
+}
+
+WifiController::Step WifiController::releaseMonitor(bool enabled) {
+    if (state_ != State::Monitoring) return act(Action::None);
+    retries_ = 0;
+    if (enabled) {
+        state_ = State::Scanning;
+        return act(Action::StopMonitorAndScan);
+    }
+    state_ = State::Off;
+    return act(Action::StopMonitorAndOff);
+}
+
+}  // namespace roro
@@ -0,0 +1,64 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "saved_networks.h"
+
+namespace roro {
+
+struct ScanResult {
+    std::string ssid;
+    int rssi;
+};
+
+// Decides what the Wi-Fi radio should do next. The Wi-Fi Service feeds it what happened (scan
+// results, connected, disconnected, Monitoring requests) and carries out the returned Action.
+// Stays Connected to the strongest Saved Network in range while enabled (radio off when there are
+// no Saved Networks); Monitoring overrides.
+class WifiController {
+   public:
+    enum class State { Off, Scanning, Connecting, Connected, Waiting, Monitoring };
+    enum class Action { None, StartScan, Connect, Disconnect, RadioOff, StartMonitor, StopMonitorAndScan, StopMonitorAndOff };
+
+    struct Step {
+        Action action = Action::None;
+        std::string ssid;
+        std::string password;
+    };
+
+    static constexpr uint32_t kConnectTimeoutMs = 15000;
+
+    explicit WifiController(const SavedNetworks& saved) : saved_(saved) {}
+
+    Step update(uint32_t nowMs, bool enabled);
+    Step scanDone(const std::vector<ScanResult>& results, uint32_t nowMs);
+    Step connected(uint32_t nowMs);
+    Step disconnected(uint32_t nowMs);
+    // A Saved Network was just added: stop waiting and scan now.
+    void retryNow(uint32_t nowMs) {
+        if (state_ == State::Waiting) retryAtMs_ = nowMs;
+        retries_ = 0;
+    }
+
+    Step requestMonitor();
+    Step releaseMonitor(bool enabled);
+
+    State state() const { return state_; }
+    const std::string& ssid() const { return ssid_; }  // network joined or being joined
+
+   private:
+    Step wait(uint32_t nowMs);
+    static Step act(Action a) { return Step{a, "", ""}; }
+
+    const SavedNetworks& saved_;
+    State state_ = State::Off;
+    std::string ssid_;
+    uint32_t sinceMs_ = 0;    // when Connecting started
+    uint32_t retryAtMs_ = 0;  // when Waiting ends
+    int retries_ = 0;
+    int nextHidden_ = 0;  // round-robin over hidden Saved Networks
+};
+
+}  // namespace roro
@@ -7,7 +7,6 @@ default_envs = cardputer-adv
 [env]
 extra_scripts = pre:scripts/version.py
 test_framework = unity
-lib_ldf_mode = deep+

 [env:cardputer-adv]
 platform = https://github.com/pioarduino/platform-espressif32/releases/download/55.03.312/platform-espressif32.zip
@@ -21,8 +20,28 @@ build_flags =
 lib_deps =
    m5stack/M5Cardputer @ 1.1.1
 test_ignore = *
+; Smaller TLS buffers (M2): the framework is rebuilt with these settings (pioarduino "hybrid
+; compile"). Receive stays 16 KB (servers send full TLS records); send drops to 4 KB (IRC lines are
+; short); buffers are allocated as needed and handshake-only data is freed once connected.
+custom_sdkconfig =
+    CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y
+    CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
+    CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
+    CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
+    CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
+    CONFIG_MBEDTLS_DYNAMIC_FREE_CA_CERT=y
+
+; Debug Build: the same firmware plus the Debug Console on TCP 2323 (see ADR 0004). The token comes
+; from ~/.config/roro9stack/debug-token, passed in by scripts/_docker.sh; it's never committed.
+[env:cardputer-adv-debug]
+extends = env:cardputer-adv
+extra_scripts = pre:scripts/version.py, pre:scripts/debug_flags.py
+build_flags =
+    ${env:cardputer-adv.build_flags}
+    -DRORO_DEBUG

 ; Host-side unit tests for pure logic (no hardware).
 [env:native]
 platform = native
+lib_ldf_mode = deep+
 build_flags = -std=gnu++17
@@ -4,9 +4,17 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

 docker build -q -t "$IMAGE" "$ROOT/docker" >/dev/null

+# The Debug Console token (ADR 0004): made once, kept with the OTA key, never committed.
+DEBUG_TOKEN_FILE="$HOME/.config/roro9stack/debug-token"
+if [ ! -s "$DEBUG_TOKEN_FILE" ]; then
+    mkdir -p "$(dirname "$DEBUG_TOKEN_FILE")"
+    (umask 077 && od -An -tx1 -N16 /dev/urandom | tr -d ' \n' > "$DEBUG_TOKEN_FILE")
+fi
+
 run_in_container() {
    docker run --rm \
        -u "$(id -u):$(id -g)" -e HOME=/tmp \
+        -e RORO_DEBUG_TOKEN="$(cat "$DEBUG_TOKEN_FILE")" \
        -v "$ROOT:/work" \
        -v roro9stack-pio:/pio \
        "${DOCKER_EXTRA[@]}" \
@@ -4,4 +4,4 @@ set -euo pipefail
 source "$(dirname "$0")/_docker.sh"
 DOCKER_EXTRA=()

-run_in_container bash -c 'git config --global --add safe.directory /work && pio test -e native && pio run -e cardputer-adv'
+run_in_container bash -c 'git config --global --add safe.directory /work && pio test -e native && pio run -e cardputer-adv -e cardputer-adv-debug'
@@ -0,0 +1,12 @@
+# Debug Builds only: compiles in the Debug Console token from $RORO_DEBUG_TOKEN (set by _docker.sh
+# from ~/.config/roro9stack/debug-token). Refuses to build without one rather than use a default.
+import os
+import re
+import sys
+
+Import("env")  # noqa: F821  (provided by PlatformIO)
+
+token = os.environ.get("RORO_DEBUG_TOKEN", "").strip()
+if not re.fullmatch(r"[0-9a-f]{32}", token):
+    sys.exit("debug build: RORO_DEBUG_TOKEN is missing; build through scripts/ci.sh or scripts/flash.sh --debug")
+env.Append(CPPDEFINES=[("RORO_DEBUG_TOKEN", '\\"%s\\"' % token)])  # noqa: F821
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Turns crash addresses into functions and source lines, using the archived ELF of the build that
+# crashed (.pio/elves/, kept by scripts/version.py).
+# Usage: scripts/decode_backtrace.sh <version or ELF sha256 prefix> <address>...
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+[ $# -ge 2 ] || { echo "Usage: scripts/decode_backtrace.sh <version|sha> <address>..." >&2; exit 1; }
+ELF="$(ls -t "$ROOT"/.pio/elves/*"$1"*.elf 2>/dev/null | head -1 || true)"
+[ -n "$ELF" ] || { echo "No archived ELF matches '$1' in .pio/elves/" >&2; exit 1; }
+echo "using ${ELF#$ROOT/}" >&2
+DOCKER_EXTRA=()
+run_in_container /pio/tools/toolchain-xtensa-esp-elf/bin/xtensa-esp32s3-elf-addr2line -pfiaC -e "/work/${ELF#$ROOT/}" "${@:2}"
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Full post-mortem of a core dump fetched with `scripts/rdbg.py coredump`: every task's backtrace,
+# registers and the crashed task's stack, via esp-coredump and GDB in the container.
+# Usage: scripts/decode_coredump.sh <core.bin> <version or ELF sha256 prefix>
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+[ $# -eq 2 ] || { echo "Usage: scripts/decode_coredump.sh <core.bin> <version|sha>" >&2; exit 1; }
+CORE="$(realpath "$1")"
+ELF="$(ls -t "$ROOT"/.pio/elves/*"$2"*.elf 2>/dev/null | head -1 || true)"
+[ -n "$ELF" ] || { echo "No archived ELF matches '$2' in .pio/elves/" >&2; exit 1; }
+echo "using ${ELF#$ROOT/}" >&2
+DOCKER_EXTRA=(-v "$(dirname "$CORE"):/core:ro")
+run_in_container /pio/penv/bin/esp-coredump --chip esp32s3 info_corefile -t raw \
+    -g /pio/tools/tool-xtensa-esp-elf-gdb/bin/xtensa-esp32s3-elf-gdb \
+    -c "/core/$(basename "$CORE")" "/work/${ELF#$ROOT/}"
@@ -1,11 +1,33 @@
 #!/usr/bin/env bash
 # Flash the firmware over USB, then open the serial monitor.
-# Usage: scripts/flash.sh [port]   (default: the first Espressif device found)
+# Usage: scripts/flash.sh [--debug] [port]        USB (default: the first Espressif device found)
+#        scripts/flash.sh [--debug] --ota [host]  Wi-Fi: build, sign and push a Firmware Update
+#                                                 (host: the device's IP from Settings > About, or $RORO_OTA_HOST)
+# --debug builds the Debug Build (cardputer-adv-debug): the Debug Console on TCP 2323, see ADR 0004.
 set -euo pipefail
+ENV=cardputer-adv
+if [ "${1:-}" = "--debug" ]; then
+    ENV=cardputer-adv-debug
+    shift
+fi
+
+if [ "${1:-}" = "--ota" ]; then
+    ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+    HOST="${2:-${RORO_OTA_HOST:-}}"
+    [ -n "$HOST" ] || { echo "Usage: scripts/flash.sh --ota <device IP> (or set RORO_OTA_HOST)" >&2; exit 1; }
+    source "$(dirname "$0")/_docker.sh"
+    DOCKER_EXTRA=()
+    run_in_container bash -c "git config --global --add safe.directory /work && pio run -e $ENV" | tail -3
+    VERSION="$(git -C "$ROOT" describe --tags --always --dirty)"
+    [ "$ENV" = cardputer-adv-debug ] && VERSION="$VERSION+debug"  # as scripts/version.py names it
+    OUT="$ROOT/.pio/build/$ENV/roro9stack-$VERSION.ota"
+    "$ROOT/scripts/make_ota.py" "$ROOT/.pio/build/$ENV/firmware.bin" "$VERSION" "$OUT"
+    exec "$ROOT/scripts/ota_push.py" "$OUT" "$HOST"
+fi
 PORT="${1:-$(readlink -f /dev/serial/by-id/*Espressif* 2>/dev/null | head -1)}"
 [ -n "$PORT" ] || { echo "No Cardputer found on USB (is it plugged in / attached to the VM?)" >&2; exit 1; }
 source "$(dirname "$0")/_docker.sh"
 docker rm -f roro9stack-serial >/dev/null 2>&1 || true  # a serial log would hold the port
 DOCKER_EXTRA=(--device "$PORT" --group-add "$(stat -c %g "$PORT")" -it)

-run_in_container bash -c "git config --global --add safe.directory /work && pio run -e cardputer-adv -t upload --upload-port $PORT && pio device monitor -p $PORT -b 115200"
+run_in_container bash -c "git config --global --add safe.directory /work && pio run -e $ENV -t upload --upload-port $PORT && pio device monitor -p $PORT -b 115200"
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Wraps a firmware image into a signed Update File (.ota). See lib/ota/src/update_parser.h.
+
+Usage: scripts/make_ota.py <firmware.bin> <version> <out.ota> [private key]
+Signs with openssl (ECDSA P-256 over SHA-256 of the header's first 80 bytes).
+"""
+import hashlib
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+
+HEADER_SIZE = 160
+SIGNED_BYTES = 80
+MAX_SIGNATURE = 72
+
+
+def main():
+    if len(sys.argv) < 4:
+        sys.exit(__doc__)
+    image_path, version, out_path = sys.argv[1:4]
+    key = sys.argv[4] if len(sys.argv) > 4 else os.environ.get(
+        "RORO_OTA_KEY", os.path.expanduser("~/.config/roro9stack/ota-key.pem"))
+    if not os.path.exists(key):
+        sys.exit(f"No signing key at {key}: run scripts/ota_keygen.sh first.")
+
+    image = open(image_path, "rb").read()
+    version_bytes = version.encode()[:31]
+    signed = (b"RORO-OTA" + struct.pack("<HHI", 1, HEADER_SIZE, len(image)) +
+              hashlib.sha256(image).digest() + version_bytes.ljust(32, b"\0"))
+    assert len(signed) == SIGNED_BYTES
+
+    with tempfile.NamedTemporaryFile() as f:
+        f.write(signed)
+        f.flush()
+        signature = subprocess.run(["openssl", "dgst", "-sha256", "-sign", key, f.name],
+                                   check=True, capture_output=True).stdout
+    if len(signature) > MAX_SIGNATURE:
+        sys.exit("unexpected signature size")
+
+    header = signed + struct.pack("<H", len(signature)) + signature
+    header = header.ljust(HEADER_SIZE, b"\0")
+    with open(out_path, "wb") as out:
+        out.write(header + image)
+    print(f"{out_path}: {version}, {len(image)} bytes, signed")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Creates the Firmware Update signing key pair, once (ADR 0003).
+# The private key stays in ~/.config/roro9stack/ and must never be committed; the public key is
+# written into the firmware source. Losing the private key means the next update goes over USB.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+KEY="${RORO_OTA_KEY:-$HOME/.config/roro9stack/ota-key.pem}"
+PUB_PEM="$ROOT/keys/ota-public.pem"
+PUB_H="$ROOT/src/platform/ota_public_key.h"
+
+if [ -e "$KEY" ]; then
+    echo "A signing key already exists at $KEY; not overwriting it." >&2
+    exit 1
+fi
+mkdir -p "$(dirname "$KEY")" "$ROOT/keys"
+( umask 077; openssl ecparam -name prime256v1 -genkey -noout -out "$KEY" )
+openssl ec -in "$KEY" -pubout -out "$PUB_PEM" 2>/dev/null
+
+{
+    echo "#pragma once"
+    echo ""
+    echo "// Public key that Firmware Updates must be signed for (ECDSA P-256). Generated by"
+    echo "// scripts/ota_keygen.sh; the private key is not in this repository (ADR 0003)."
+    echo "namespace roro {"
+    echo "inline constexpr char kOtaPublicKeyPem[] ="
+    sed 's/^/    "/; s/$/\\n"/' "$PUB_PEM"
+    echo "    ;"
+    echo "}  // namespace roro"
+} > "$PUB_H"
+echo "Private key: $KEY (keep it safe)"
+echo "Public key:  $PUB_PEM and $PUB_H (commit these)"
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Pushes a signed Update File to a Cardputer over Wi-Fi (TCP 3232) and reports the result.
+
+Usage: scripts/ota_push.py <file.ota> <host>
+<host> is the device's IP (shown in Settings > Firmware).
+"""
+import socket
+import sys
+
+PORT = 3232
+
+
+def main():
+    if len(sys.argv) < 3:
+        sys.exit(__doc__)
+    path, host = sys.argv[1:3]
+    data = open(path, "rb").read()
+    try:
+        reply = push(data, host)
+    except (ConnectionResetError, BrokenPipeError):
+        # The device checks the header first and hangs up on a refused update mid-transfer.
+        print()
+        print("device: refused the update and closed the connection (the reason is on its screen)")
+        sys.exit(1)
+    print(f"device: {reply or '(no answer)'}")
+    sys.exit(0 if reply.startswith("OK") else 1)
+
+
+def push(data, host):
+    with socket.create_connection((host, PORT), timeout=15) as s:
+        s.settimeout(60)
+        sent, last = 0, -1
+        while sent < len(data):
+            chunk = data[sent:sent + 4096]
+            s.sendall(chunk)
+            sent += len(chunk)
+            pct = sent * 100 // len(data)
+            if pct != last:
+                print(f"\rsending {pct:3d}%", end="", flush=True)
+                last = pct
+        # The header announces the image size, so current firmware answers once it has it all.
+        # Firmware from before that change only knows the file ended when we half-close.
+        reply = b""
+        s.settimeout(3)
+        try:
+            reply = s.recv(256)
+        except socket.timeout:
+            s.shutdown(socket.SHUT_WR)
+            s.settimeout(60)
+        while reply == b"" or not reply.endswith(b"\n"):
+            try:
+                part = s.recv(256)
+            except socket.timeout:
+                break
+            if not part:
+                break
+            reply += part
+    print()
+    return reply.decode(errors="replace").strip()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,281 @@
+#!/usr/bin/env python3
+"""The Debug Console of a Debug Build, over Wi-Fi (TCP 2323, see ADR 0004).
+
+Usage: scripts/rdbg.py [-H host] [-b] [command ...]
+  no command   interactive: type commands, see every console line live; Ctrl-D or `quit` leaves
+  command      runs it and prints what follows, until the console has been quiet for a moment
+  -H host      the device's IP (Settings > Firmware), default $RORO_OTA_HOST
+  -b           also print the backlog the device sends on connecting (boot messages and so on)
+
+Commands handled here as well as on the device:
+  crash                    the last crash, with its backtrace decoded (scripts/decode_backtrace.sh)
+  coredump [file]          fetch the core dump (default core-<date>.bin) and decode it with esp-coredump
+  get <card path> [file]   copy a file from the SD card
+  put <file> [card path]   copy a file to the SD card (default /updates/<name>), checked with SHA-256
+  screenshot [file.png]    what the screen shows (default screen-<date>.png), at 2x
+  reset                    restart at once, even if the main loop is stuck
+The token is read from ~/.config/roro9stack/debug-token (made by the first build).
+"""
+import hashlib
+import os
+import re
+import select
+import struct
+import subprocess
+import zlib
+import socket
+import sys
+import time
+
+PORT = 2323
+TOKEN_FILE = os.path.expanduser("~/.config/roro9stack/debug-token")
+
+
+def read_until(sock, marker, timeout):
+    """Everything up to and including `marker`, or None on a timeout or a closed connection."""
+    sock.settimeout(timeout)
+    data = b""
+    while marker not in data:
+        try:
+            chunk = sock.recv(4096)
+        except socket.timeout:
+            return None
+        if not chunk:
+            return None
+        data += chunk
+    return data
+
+
+def read_until_quiet(sock, quiet, out):
+    """Copies everything the device sends to `out` until nothing has arrived for `quiet` seconds."""
+    sock.settimeout(quiet)
+    while True:
+        try:
+            data = sock.recv(4096)
+        except socket.timeout:
+            return True
+        if not data:
+            return False
+        if out:
+            out.write(data.decode(errors="replace"))
+            out.flush()
+
+
+SCRIPTS = os.path.dirname(os.path.abspath(__file__))
+
+
+def run(sock, command, out=sys.stdout):
+    """Sends one command and returns its reply (also copied to `out`)."""
+    sock.sendall((command + "\n").encode())
+    # The main loop echoes "> command" when it runs it; the reply follows.
+    echoed = read_until(sock, f"> {command}\n".encode(), 15)
+    if echoed is None:
+        sys.exit("device: the command never ran")
+    reply = echoed.decode(errors="replace").split(f"> {command}\n", 1)[1]
+
+    class Tee:
+        def write(self, text):
+            nonlocal reply
+            reply += text
+            if out:
+                out.write(text)
+
+        def flush(self):
+            if out:
+                out.flush()
+
+    if out:
+        out.write(reply)
+    try:
+        read_until_quiet(sock, 1.5, Tee())
+    except BrokenPipeError:  # e.g. piped into head
+        pass
+    return reply
+
+
+def crash_firmware(reply):
+    """The archived-ELF key for the crashed firmware: its ELF digest, or else its version."""
+    sha = re.search(r"elf sha256 ([0-9a-f]{8,})", reply)
+    if sha:
+        return sha.group(1)
+    version = re.search(r"last one in (\S+)", reply)
+    return version.group(1) if version else None
+
+
+def crash(sock):
+    reply = run(sock, "crash")
+    trace = re.search(r"backtrace((?: 0x[0-9a-f]+)+)", reply)
+    key = crash_firmware(reply)
+    if trace and key:
+        print()
+        subprocess.call([os.path.join(SCRIPTS, "decode_backtrace.sh"), key] + trace.group(1).split())
+
+
+def coredump(sock, path):
+    info = run(sock, "crash", out=None)
+    sock.sendall(b"coredump get\n")
+    # One buffer throughout: the header, the size and the first bytes often share a packet.
+    buf = b""
+    sock.settimeout(15)
+    while b"coredump: none" not in buf and not re.search(rb"coredump: data (\d+)\n", buf):
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit("device: closed the connection")
+        buf += chunk
+    header = re.search(rb"coredump: data (\d+)\n", buf)
+    if not header:
+        sys.exit("device: no core dump in flash")
+    size = int(header.group(1))
+    data = buf[header.end():]
+    while len(data) < size:
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit(f"device: the connection closed after {len(data)} of {size} bytes")
+        data += chunk
+    data = data[:size]
+    path = path or time.strftime("core-%Y%m%d-%H%M%S.bin")
+    open(path, "wb").write(data)
+    print(f"saved {path} ({size} bytes)")
+    key = crash_firmware(info)
+    if key:
+        subprocess.call([os.path.join(SCRIPTS, "decode_coredump.sh"), path, key])
+
+
+def binary(sock, command, tag):
+    """Sends a binary command; returns (header words, payload) or exits with the device's error."""
+    sock.sendall((command + "\n").encode())
+    buf = b""
+    sock.settimeout(30)
+    pattern = re.compile(tag.encode() + rb": (data|ready|rgb332|error)([^\n]*)\n")
+    while not (m := pattern.search(buf)):
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit("device: closed the connection")
+        buf += chunk
+    if m.group(1) == b"error":
+        sys.exit(f"device: {tag}: error{m.group(2).decode()}")
+    return m.group(1).decode(), m.group(2).decode().split(), buf[m.end():]
+
+
+def receive(sock, have, size):
+    while len(have) < size:
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit(f"device: the connection closed after {len(have)} of {size} bytes")
+        have += chunk
+    return have[:size]
+
+
+def get(sock, remote, local):
+    _, words, rest = binary(sock, f"get {remote}", "get")
+    start, size = time.time(), int(words[0])
+    data = receive(sock, rest, size)
+    local = local or os.path.basename(remote)
+    open(local, "wb").write(data)
+    print(f"saved {local} ({size} bytes, {size / 1024 / max(time.time() - start, 0.001):.0f} KB/s)")
+
+
+def put(sock, local, remote):
+    data = open(local, "rb").read()
+    remote = remote or "/updates/" + os.path.basename(local)
+    digest = hashlib.sha256(data).hexdigest()
+    binary(sock, f"put {remote} {len(data)} {digest}", "put")
+    start = time.time()
+    sock.sendall(data)
+    answer = read_until(sock, b"\n", 30) or b"put: error no answer"
+    answer = answer.decode(errors="replace").strip().splitlines()[-1]
+    print(f"device: {answer} ({len(data) / 1024 / max(time.time() - start, 0.001):.0f} KB/s)")
+    if " error " in answer:
+        sys.exit(1)
+
+
+def png(path, width, height, rgb, scale):
+    rows = b""
+    for y in range(height):
+        row = b"".join(rgb[(y * width + x) * 3:(y * width + x) * 3 + 3] * scale for x in range(width))
+        rows += (b"\x00" + row) * scale
+    def chunk(kind, body):
+        return struct.pack(">I", len(body)) + kind + body + struct.pack(">I", zlib.crc32(kind + body))
+    header = struct.pack(">IIBBBBB", width * scale, height * scale, 8, 2, 0, 0, 0)
+    with open(path, "wb") as f:
+        f.write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", header) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b""))
+
+
+def screenshot(sock, path):
+    _, words, rest = binary(sock, "screenshot", "screenshot")
+    width, height = int(words[0]), int(words[1])
+    pixels = receive(sock, rest, width * height)
+    # RGB332, as M5GFX stores an 8-bit sprite: RRRGGGBB.
+    rgb = b"".join(bytes(((v >> 5) * 255 // 7, ((v >> 2) & 7) * 255 // 7, (v & 3) * 255 // 3)) for v in pixels)
+    path = path or time.strftime("screen-%Y%m%d-%H%M%S.png")
+    png(path, width, height, rgb, 2)
+    print(f"saved {path} ({width * 2}x{height * 2})")
+
+
+def interactive(sock):
+    sock.setblocking(False)
+    while True:
+        ready, _, _ = select.select([sock, sys.stdin], [], [])
+        if sock in ready:
+            data = sock.recv(4096)
+            if not data:
+                print("\n(connection closed)")
+                return
+            sys.stdout.write(data.decode(errors="replace"))
+            sys.stdout.flush()
+        if sys.stdin in ready:
+            line = sys.stdin.readline()
+            if not line:
+                return
+            sock.sendall(line.encode())
+
+
+def main():
+    args = sys.argv[1:]
+    host, backlog = os.environ.get("RORO_OTA_HOST"), False
+    while args and args[0].startswith("-"):
+        flag = args.pop(0)
+        if flag == "-H" and args:
+            host = args.pop(0)
+        elif flag == "-b":
+            backlog = True
+        else:
+            sys.exit(__doc__)
+    if not host:
+        sys.exit("No device: pass -H <ip> or set RORO_OTA_HOST\n\n" + __doc__)
+    token = open(TOKEN_FILE).read().strip()
+
+    with socket.create_connection((host, PORT), timeout=10) as sock:
+        sock.sendall((token + "\n").encode())
+        # The device may still be finishing a previous client: wait for this connection's banner.
+        banner = read_until(sock, b"Backlog follows.\n", 15)
+        if banner is None:
+            sys.exit("device: no banner (wrong token, or another client is connected)")
+        show = sys.stdout if backlog or not args else None
+        if show:
+            show.write(banner.decode(errors="replace"))
+        read_until_quiet(sock, 0.5, show)  # the backlog
+        if not args:
+            return interactive(sock)
+        if args == ["crash"]:
+            return crash(sock)
+        if args[0] == "get" and len(args) >= 2:
+            return get(sock, args[1], args[2] if len(args) > 2 else None)
+        if args[0] == "put" and len(args) >= 2:
+            return put(sock, args[1], args[2] if len(args) > 2 else None)
+        if args[0] == "screenshot":
+            return screenshot(sock, args[1] if len(args) > 1 else None)
+        if args == ["reset"]:  # answered by the console's own task, not the main loop
+            sock.sendall(b"reset\n")
+            print((read_until(sock, b"restarting now\n", 10) or b"device: no answer").decode().strip().splitlines()[-1])
+            return
+        if args[0] == "coredump" and args[1:2] != ["erase"]:
+            return coredump(sock, args[1] if len(args) > 1 else None)
+        run(sock, " ".join(args))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (ConnectionResetError, BrokenPipeError):
+        sys.exit("device: the connection dropped (restarting?)")
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Copies a file to the Cardputer's SD card over the USB serial console (the `sd put` command).
+
+Usage: scripts/sd_put.sh <file> [card path]
+The card path defaults to /updates/<file name>, where Settings > Firmware finds Update Files.
+The device acknowledges each chunk once it's on the card, checks the SHA-256 of the whole file,
+and only then renames <card path>.part to <card path>.
+"""
+import glob
+import hashlib
+import os
+import sys
+import time
+
+import serial
+
+DEBUG = bool(os.environ.get("SD_PUT_DEBUG"))  # also show the console lines in between
+
+
+def find_port():
+    ports = sorted(glob.glob("/dev/serial/by-id/*Espressif*"))
+    return os.path.realpath(ports[0]) if ports else None
+
+
+def reply(port, timeout):
+    """The next `sd put:` line from the device; everything else on the console is skipped."""
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        line = port.readline().decode(errors="replace").strip()
+        if line.startswith("sd put:"):
+            return line[len("sd put:"):].strip()
+        if line and DEBUG:
+            print(f"\n  console: {line}", file=sys.stderr)
+    return "error no answer from the device"
+
+
+def fail(answer):
+    print()
+    sys.exit(f"device: {answer}")
+
+
+def main():
+    if len(sys.argv) < 2:
+        sys.exit(__doc__)
+    path = sys.argv[1]
+    dest = sys.argv[2] if len(sys.argv) > 2 else "/updates/" + os.path.basename(path)
+    port_name = find_port()
+    if not port_name:
+        sys.exit("No Cardputer found on USB")
+    data = open(path, "rb").read()
+    sha = hashlib.sha256(data).hexdigest()
+
+    with serial.Serial(port_name, 115200, timeout=0.5) as port:
+        port.reset_input_buffer()
+        # The leading newline ends any half-typed command.
+        port.write(f"\nsd put {dest} {len(data)} {sha}\n".encode())
+        answer = reply(port, 10)
+        if not answer.startswith("ready "):
+            fail(answer)
+        chunk = int(answer.split()[1])
+
+        start, sent = time.time(), 0
+        while sent < len(data):
+            port.write(data[sent:sent + chunk])
+            sent = min(sent + chunk, len(data))
+            print(f"\rsending {sent * 100 // len(data):3d}%", end="", flush=True)
+            if sent < len(data):
+                answer = reply(port, 10)
+                if answer != f"ok {sent}":
+                    fail(answer)
+        answer = reply(port, 15)
+        if not answer.startswith("done "):
+            fail(answer)
+        seconds = time.time() - start
+        print(f"\rdevice: {answer}, {seconds:.1f} s ({len(data) / 1024 / seconds:.0f} KB/s)")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Copy a file to the Cardputer's SD card over USB serial, e.g. an Update File into /updates.
+# Usage: scripts/sd_put.sh <file> [card path]   (default card path: /updates/<file name>)
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+[ -f "${1:-}" ] || { echo "Usage: scripts/sd_put.sh <file> [card path]" >&2; exit 1; }
+docker rm -f roro9stack-serial >/dev/null 2>&1 || true  # a serial log would hold the port
+FILE="$(realpath "$1")"
+DOCKER_EXTRA=(-e SD_PUT_DEBUG="${SD_PUT_DEBUG:-}" --group-add "$(getent group dialout | cut -d: -f3)" --privileged -v /dev:/dev -v "$(dirname "$FILE"):/in:ro")
+run_in_container /pio/penv/bin/python scripts/sd_put.py "/in/$(basename "$FILE")" "${@:2}"
@@ -10,4 +10,24 @@ try:
 except Exception:
    version = "unknown"

+if env["PIOENV"].endswith("-debug"):  # noqa: F821
+    version += "+debug"  # a Debug Build says so wherever the version shows
+
 env.Append(CPPDEFINES=[("RORO_VERSION", '\\"%s\\"' % version)])  # noqa: F821
+
+
+# Keep every build's ELF, named by version and the first 16 hex digits of its SHA-256 (the core dump
+# names the crashed firmware by the same digest), so a crash can be decoded after later builds.
+def archive_elf(source, target, env):
+    import hashlib
+    import os
+    import shutil
+
+    elf = str(target[0])
+    digest = hashlib.sha256(open(elf, "rb").read()).hexdigest()[:16]
+    folder = os.path.join(env.subst("$PROJECT_DIR"), ".pio", "elves")
+    os.makedirs(folder, exist_ok=True)
+    shutil.copy(elf, os.path.join(folder, "%s.%s.elf" % (version, digest)))
+
+
+env.AddPostAction("$BUILD_DIR/${PROGNAME}.elf", archive_elf)  # noqa: F821
@@ -0,0 +1,101 @@
+#include "firmware_page.h"
+
+#include <SD.h>
+
+#include "ui/widgets.h"
+#include "version.h"
+
+namespace roro {
+
+namespace {
+constexpr const char* kUpdatesFolder = "/updates";
+
+bool endsWith(const std::string& s, const std::string& suffix) {
+    return s.size() >= suffix.size() && s.compare(s.size() - suffix.size(), suffix.size(), suffix) == 0;
+}
+}  // namespace
+
+void FirmwarePage::enter() {
+    confirm_.reset();
+    {
+        std::lock_guard<std::mutex> g(lock_);
+        files_.clear();
+        listed_ = false;
+    }
+    list_.setCount(kFixed);
+    storage_.runJob([this]() {
+        std::vector<std::string> found;
+        File dir = SD.open(kUpdatesFolder);
+        if (dir && dir.isDirectory())
+            for (File f = dir.openNextFile(); f; f = dir.openNextFile())
+                if (!f.isDirectory() && endsWith(f.name(), ".ota")) found.push_back(std::string(kUpdatesFolder) + "/" + f.name());
+        std::lock_guard<std::mutex> g(lock_);
+        files_ = found;
+        listed_ = true;
+    });
+}
+
+std::vector<std::string> FirmwarePage::files() {
+    std::lock_guard<std::mutex> g(lock_);
+    return files_;
+}
+
+bool FirmwarePage::onKey(const KeyEvent& e) {
+    auto found = files();
+    if (confirm_) {
+        confirm_->onKey(e);
+        int pick = list_.selected() - kFixed;
+        if (confirm_->result() == 1 && pick >= 0 && pick < static_cast<int>(found.size())) update_.installFromSd(found[pick]);
+        if (confirm_->result() != DialogModel::kPending) confirm_.reset();
+        return true;
+    }
+    list_.setCount(kFixed + static_cast<int>(found.size()));
+    switch (e.key) {
+        case Key::Up: list_.up(); break;
+        case Key::Down: list_.down(); break;
+        case Key::Back: return false;
+        case Key::Select:
+            if (list_.selected() >= kFixed) confirm_.reset(new DialogModel({"Cancel", "Install"}));
+            break;
+        default: break;
+    }
+    return true;
+}
+
+void FirmwarePage::draw(Canvas& c) {
+    auto found = files();
+    bool listed;
+    {
+        std::lock_guard<std::mutex> g(lock_);
+        listed = listed_;
+    }
+    list_.setCount(kFixed + static_cast<int>(found.size()));
+    std::string ip = wifi_.ip();
+    widgets::list(
+        c, list_, theme::kContent,
+        [&](int i) -> std::string {
+            switch (i) {
+                case kVersion: return "Version";
+                case kStatus: return "Status";
+                case kAddress: return "Push to";
+                case kSdHeader: return listed ? (found.empty() ? "No .ota files in /updates" : "On the SD card:") : "Looking on the SD card...";
+                default: return "  " + found[i - kFixed].substr(std::string(kUpdatesFolder).size() + 1);
+            }
+        },
+        [&](int i) -> std::string {
+            switch (i) {
+                case kVersion: return versionString();
+                case kStatus: return update_.onProbation() ? "on probation" : "confirmed";
+                case kAddress: return ip.empty() ? "Wi-Fi not connected" : ip + ":" + std::to_string(UpdateService::kPort);
+                case kSdHeader: return "";
+                default: return "install >";
+            }
+        });
+    if (confirm_) {
+        int pick = list_.selected() - kFixed;
+        std::string name = pick >= 0 && pick < static_cast<int>(found.size()) ? found[pick] : "";
+        widgets::dialog(c, "Install update?", name + " is checked before anything is written. The device restarts after.", *confirm_);
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,47 @@
+#pragma once
+
+#include <memory>
+#include <mutex>
+#include <string>
+#include <vector>
+
+#include "dialog_model.h"
+#include "key_event.h"
+#include "list_model.h"
+#include "services/storage_service.h"
+#include "services/update_service.h"
+#include "services/wifi_service.h"
+#include "ui/canvas.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Settings → Firmware: the running version and its Probation, where to push Firmware Updates, and
+// the Update Files on the SD card (in /updates) to install from.
+class FirmwarePage {
+   public:
+    FirmwarePage(UpdateService& update, WifiService& wifi, StorageService& storage)
+        : update_(update), wifi_(wifi), storage_(storage) {}
+
+    void enter();
+    bool onKey(const KeyEvent& e);  // false: leave the page
+    void draw(Canvas& c);
+
+   private:
+    enum Row { kVersion, kStatus, kAddress, kSdHeader, kFixed };
+
+    std::vector<std::string> files();
+
+    UpdateService& update_;
+    WifiService& wifi_;
+    StorageService& storage_;
+    ListModel list_{theme::kContent.h / theme::kLineHeight};
+    std::unique_ptr<DialogModel> confirm_;
+
+    // Filled on the storage task.
+    std::mutex lock_;
+    std::vector<std::string> files_;
+    bool listed_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,212 @@
+#include "gnss_app.h"
+
+#include <Arduino.h>
+
+#include <cmath>
+#include <cstdio>
+
+#include "geo_format.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+using namespace gnss;
+
+namespace {
+
+// One colour per constellation, readable in the 8-bit frame buffer.
+uint16_t colorOf(Constellation c) {
+    switch (c) {
+        case Constellation::Gps: return theme::kAccent;
+        case Constellation::Glonass: return 0xF8C8;  // red
+        case Constellation::Galileo: return theme::kMessage;
+        case Constellation::BeiDou: return 0xFEA0;   // yellow
+        case Constellation::Qzss: return 0xC99F;     // violet
+        default: return theme::kText;
+    }
+}
+
+const char* fixLabel(FixType f) { return f == FixType::ThreeD ? "3D Fix" : f == FixType::TwoD ? "2D Fix" : "No Fix"; }
+
+std::string duration(uint32_t ms) {
+    uint32_t s = ms / 1000;
+    char buf[24];
+    if (s < 60) std::snprintf(buf, sizeof buf, "%lu s", (unsigned long)s);
+    else std::snprintf(buf, sizeof buf, "%lu min %02lu s", (unsigned long)(s / 60), (unsigned long)(s % 60));
+    return buf;
+}
+
+}  // namespace
+
+bool GnssApp::onKey(const KeyEvent& e) {
+    if (e.key == Key::Tab) {
+        sky_ = !sky_;
+        requestRedraw();
+        return true;
+    }
+    if (e.key == Key::Char && (e.ch == 'r' || e.ch == 'R')) {  // record a Track, or stop it
+        if (gnss_.tracking()) gnss_.stopTrack();
+        else {
+            refusal_ = gnss_.startTrack(millis());
+            refusalMs_ = millis();
+        }
+        requestRedraw();
+        return true;
+    }
+    return false;  // Back leaves the App
+}
+
+void GnssApp::update(uint32_t nowMs) {
+    if (nowMs - lastDrawMs_ >= 1000) {  // the receiver reports once a second
+        lastDrawMs_ = nowMs;
+        requestRedraw();
+    }
+}
+
+void GnssApp::draw(Canvas& c) {
+    c.setTextDatum(top_left);
+    const auto& area = theme::kContent;
+    if (!gnss_.on()) {
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kText);
+        c.drawString("GNSS is off", 4, area.y + 4);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Settings > GNSS turns it on.", 4, area.y + 22);
+        return;
+    }
+    sky_ ? drawSky(c) : drawPosition(c);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(top_right);
+    c.drawString(sky_ ? "Tab: position" : "Tab: sky", area.w - 3, area.y + area.h - 9);
+    c.setTextDatum(top_left);
+}
+
+void GnssApp::drawPosition(Canvas& c) {
+    const auto& area = theme::kContent;
+    const GnssState& s = gnss_.state();
+    uint32_t now = millis();
+    int used = 0;
+    for (auto& sat : s.satellites) used += sat.used;
+    char line[64];
+
+    c.setFont(&fonts::bold);
+    c.setTextColor(s.fix == FixType::None ? theme::kWarning : theme::kMessage);
+    if (!gnss_.receiving(now)) std::snprintf(line, sizeof line, "No data from the receiver");
+    else if (s.fix == FixType::None)
+        std::snprintf(line, sizeof line, "Searching: %u in view, %s", (unsigned)s.satellites.size(),
+                      duration(now - gnss_.onSinceMs()).c_str());
+    else std::snprintf(line, sizeof line, "%s, %d of %u satellites", fixLabel(s.fix), s.satellitesUsed,
+                       (unsigned)s.satellites.size());
+    c.drawString(line, 4, area.y + 2);
+
+    c.setFont(&fonts::body);
+    int y = area.y + 19;
+    auto row = [&](const char* label, const std::string& value) {
+        c.setTextColor(theme::kMuted);
+        c.drawString(label, 4, y);
+        c.setTextColor(theme::kText);
+        c.drawString(value.c_str(), 64, y);
+        y += theme::kLineHeight;
+    };
+    bool dms = settings_.getBool(Setting::CoordinatesDms);
+    if (s.positionValid) {
+        row("Lat", dms ? formatDms(s.latitude, true) : formatDecimal(s.latitude, true));
+        row("Lon", dms ? formatDms(s.longitude, false) : formatDecimal(s.longitude, false));
+        row("Locator", maidenhead(s.latitude, s.longitude));
+        std::snprintf(line, sizeof line, s.altitudeValid ? "%.0f m" : "-", s.altitudeM);
+        row("Altitude", line);
+        if (s.courseValid && s.speedKmh >= 1.0f)
+            std::snprintf(line, sizeof line, "%.1f km/h, %.0f\xC2\xB0", s.speedKmh, s.courseDeg);
+        else std::snprintf(line, sizeof line, "%.1f km/h", s.speedKmh);
+        row("Speed", line);
+    } else {
+        row("Lat", "-");
+        row("Lon", "-");
+        y += theme::kLineHeight * 3;
+    }
+    std::snprintf(line, sizeof line, "%.1f", s.hdop);
+    row("HDOP", s.fix == FixType::None ? "-" : line);
+    if (s.timeValid) std::snprintf(line, sizeof line, "%02d:%02d:%02d UTC", s.hour, s.minute, s.second);
+    row("Time", s.timeValid ? line : "-");
+
+    // The Track line, at the bottom left.
+    c.setFont(&fonts::small);
+    if (gnss_.tracking()) {
+        c.setTextColor(theme::kWarning);
+        std::snprintf(line, sizeof line, "REC %d point%s, %s  r: stop", gnss_.trackPoints(),
+                      gnss_.trackPoints() == 1 ? "" : "s", duration(now - gnss_.trackStartMs()).c_str());
+    } else if (!refusal_.empty() && now - refusalMs_ < 4000) {
+        c.setTextColor(theme::kWarning);
+        std::snprintf(line, sizeof line, "%s", refusal_.c_str());
+    } else {
+        c.setTextColor(theme::kMuted);
+        std::snprintf(line, sizeof line, "r: record a Track");
+    }
+    c.drawString(line, 4, area.y + area.h - 9);
+}
+
+void GnssApp::drawSky(Canvas& c) {
+    const auto& area = theme::kContent;
+    const GnssState& s = gnss_.state();
+    const int radius = (area.h - 6) / 2, cx = 4 + radius, cy = area.y + area.h / 2;
+
+    // The sky from above: horizon, 30° and 60° elevation rings, north up.
+    c.drawCircle(cx, cy, radius, theme::kMuted);
+    c.drawCircle(cx, cy, radius * 2 / 3, 0x4208);
+    c.drawCircle(cx, cy, radius / 3, 0x4208);
+    c.drawFastHLine(cx - radius, cy, 2 * radius, 0x4208);
+    c.drawFastVLine(cx, cy - radius, 2 * radius, 0x4208);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(middle_center);
+    auto compass = [&](const char* letter, int x, int y) {
+        c.fillRect(x - 3, y - 4, 7, 9, theme::kBackground);  // off the lines, so it reads
+        c.drawString(letter, x, y);
+    };
+    compass("N", cx, cy - radius + 5);
+    compass("S", cx, cy + radius - 4);
+    compass("E", cx + radius - 4, cy);
+    compass("W", cx - radius + 4, cy);
+    c.setTextDatum(top_left);
+
+    int inView[8] = {}, usedBy[8] = {};
+    for (auto& sat : s.satellites) {
+        int k = static_cast<int>(sat.system);
+        inView[k]++;
+        usedBy[k] += sat.used;
+        SkyPoint p = skyPosition(sat.azimuth, sat.elevation, cx, cy, radius - 3);
+        uint16_t color = colorOf(sat.system);
+        if (sat.used) c.fillCircle(p.x, p.y, 3, color);
+        else c.drawCircle(p.x, p.y, 3, sat.snr < 0 ? theme::kMuted : color);
+    }
+
+    // Legend: used / in view per constellation, then the Fix.
+    int x = cx + radius + 12, y = area.y + 4;
+    c.setFont(&fonts::body);
+    for (int k = 1; k < 7; k++) {
+        if (!inView[k]) continue;
+        auto system = static_cast<Constellation>(k);
+        c.fillCircle(x + 3, y + 6, 3, colorOf(system));
+        char line[32];
+        std::snprintf(line, sizeof line, "%-8s%d/%d", constellationName(system), usedBy[k], inView[k]);
+        c.setTextColor(theme::kText);
+        c.drawString(line, x + 10, y);
+        y += theme::kLineHeight;
+    }
+    if (s.satellites.empty()) {
+        c.setTextColor(theme::kMuted);
+        c.drawString("No satellites", x, y);
+        y += theme::kLineHeight;
+    }
+    c.setTextColor(s.fix == FixType::None ? theme::kWarning : theme::kMessage);
+    c.drawString(fixLabel(s.fix), x, y + 4);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("filled: in use", x, area.y + area.h - 20);
+}
+
+}  // namespace roro
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <string>
+
+#include "app.h"
+#include "services/gnss_service.h"
+#include "settings.h"
+
+namespace roro {
+
+// GNSS (see docs/milestones/M2.md, Q59): the Position view, and the Sky view with every satellite
+// in view placed by direction and elevation. Tab switches between them.
+class GnssApp : public App {
+   public:
+    GnssApp(GnssService& gnss, const Settings& settings) : gnss_(gnss), settings_(settings) {}
+    void onEnter() override { requestRedraw(); }
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    void drawPosition(Canvas& c);
+    void drawSky(Canvas& c);
+
+    GnssService& gnss_;
+    const Settings& settings_;
+    bool sky_ = false;
+    uint32_t lastDrawMs_ = 0;
+    std::string refusal_;  // why a Track couldn't start, shown for a few seconds
+    uint32_t refusalMs_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,317 @@
+#include "irc_app.h"
+
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using Status = IrcService::Status;
+
+namespace {
+
+const char* statusText(Status s) {
+    switch (s) {
+        case Status::Stopped: return "disconnected";
+        case Status::WaitingForWifi: return "waiting for Wi-Fi";
+        case Status::Connecting: return "connecting...";
+        case Status::Registering: return "logging in...";
+        case Status::Online: return "";
+        case Status::Paused: return "paused (Wi-Fi monitoring)";
+        case Status::Retrying: return "retrying soon";
+    }
+    return "";
+}
+
+uint16_t lineColor(const IrcLine& l, bool mention) {
+    switch (l.kind) {
+        case IrcLine::Kind::Own:
+        case IrcLine::Kind::OwnAction: return theme::kAccent;
+        case IrcLine::Kind::Info:
+        case IrcLine::Kind::Notice: return theme::kMuted;
+        default: return mention ? theme::kMessage : theme::kText;
+    }
+}
+
+std::string lowered(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+
+}  // namespace
+
+void IrcApp::onEnter() {
+    page_ = Page::Chat;
+    editing_ = false;
+    if (!irc_.stoppedByUser()) irc_.connect();  // stopped by hand: stay stopped, typing reconnects
+    view(current_);
+}
+
+void IrcApp::onExit() {
+    irc_.withSession([](IrcSession& s) { s.setViewing(-1); });
+}
+
+void IrcApp::view(int buffer) {
+    irc_.withSession([&](IrcSession& s) {
+        if (buffer < 0 || buffer >= s.bufferCount()) buffer = 0;
+        current_ = buffer;
+        s.setViewing(buffer);
+    });
+    scroll_ = 0;
+    requestRedraw();
+}
+
+void IrcApp::warn(const std::string& text) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(NotificationLevel::Warning)));
+}
+
+void IrcApp::update(uint32_t) {
+    uint32_t revision = irc_.withSession([](IrcSession& s) { return s.revision(); });
+    Status status = irc_.status();
+    if (revision != seenRevision_ || status != seenStatus_) {
+        seenRevision_ = revision;
+        seenStatus_ = status;
+        requestRedraw();
+    }
+}
+
+bool IrcApp::onKey(const KeyEvent& e) {
+    requestRedraw();
+    return page_ == Page::Chat ? onChatKey(e) : onSettingsKey(e);
+}
+
+bool IrcApp::onChatKey(const KeyEvent& e) {
+    // Alt + ; / Alt + . scroll the Buffer; Up / Down (Fn + ; / Fn + .) recall sent lines.
+    if (e.key == Key::Char && e.alt && (e.ch == ';' || e.ch == '.')) {
+        if (e.ch == ';') scroll_++;  // older
+        else if (scroll_ > 0) scroll_--;
+        return true;
+    }
+    std::string recalled;
+    switch (e.key) {
+        case Key::Char: input_.insert(e.ch); break;
+        case Key::Delete: input_.backspace(); break;
+        case Key::Left: input_.left(); break;
+        case Key::Right: input_.right(); break;
+        case Key::Up:
+            if (history_.up(input_.text(), recalled)) input_.setText(recalled);
+            break;
+        case Key::Down:
+            if (history_.down(recalled)) input_.setText(recalled);
+            break;
+        case Key::Tab: {
+            int count = irc_.withSession([](IrcSession& s) { return s.bufferCount(); });
+            view((current_ + 1) % count);
+            break;
+        }
+        case Key::Select: {
+            std::string text = input_.text();
+            if (text.empty()) break;
+            history_.add(text);
+            input_.setText("");
+            scroll_ = 0;
+            if (lowered(text) == "/settings") {
+                draft_.reset(new IrcConfig(irc_.draftConfig()));
+                page_ = Page::Settings;
+                fields_.setCount(kFields);
+                break;
+            }
+            if (!irc_.running()) irc_.connect();  // e.g. typing after /quit reconnects
+            irc_.withSession([&](IrcSession& s) { s.input(current_, text, clock_.utcNow()); });
+            // /msg or /join may have opened a Buffer: follow a new private chat.
+            if (lowered(text).rfind("/msg ", 0) == 0) {
+                std::string who = text.substr(5, text.find(' ', 5) == std::string::npos ? std::string::npos : text.find(' ', 5) - 5);
+                irc_.withSession([&](IrcSession& s) {
+                    for (int i = 0; i < s.bufferCount(); i++)
+                        if (lowered(s.buffer(i).name) == lowered(who)) current_ = i;
+                    s.setViewing(current_);
+                });
+            }
+            break;
+        }
+        default: return false;  // Back leaves the App; IRC keeps running
+    }
+    return true;
+}
+
+std::string IrcApp::fieldLabel(int f) const {
+    static const char* labels[] = {"Server", "Port", "TLS", "Self-signed", "Nick", "SASL user", "SASL password",
+                                   "NickServ password", "Auto-join", "Save & reconnect"};
+    return labels[f];
+}
+
+std::string IrcApp::fieldValue(int f) const {
+    const IrcConfig& c = *draft_;
+    auto secret = [](const std::string& s) { return s.empty() ? std::string("-") : std::string("(set)"); };
+    switch (f) {
+        case kHost: return c.host;
+        case kPort: return std::to_string(c.port);
+        case kTls: return c.tls ? "On" : "Off";
+        case kSelfSigned: return c.allowSelfSigned ? (c.pinnedSha256.empty() ? "Pin on first use" : "Pinned") : "Off";
+        case kNick: return c.nick;
+        case kSaslUser: return c.saslUser.empty() ? "-" : c.saslUser;
+        case kSaslPass: return secret(c.saslPassword);
+        case kNickserv: return secret(c.nickservPassword);
+        case kAutojoin: return c.autojoin.empty() ? "-" : IrcConfig::formatChannels(c.autojoin);
+        default: return "";
+    }
+}
+
+void IrcApp::startEditing(int f) {
+    const IrcConfig& c = *draft_;
+    fieldEditor_ = LineEditor(f == kAutojoin ? 200 : 63);
+    switch (f) {
+        case kHost: fieldEditor_.setText(c.host); break;
+        case kPort: fieldEditor_.setText(std::to_string(c.port)); break;
+        case kNick: fieldEditor_.setText(c.nick); break;
+        case kSaslUser: fieldEditor_.setText(c.saslUser); break;
+        case kAutojoin: fieldEditor_.setText(IrcConfig::formatChannels(c.autojoin)); break;
+        default: break;  // passwords start empty
+    }
+    editing_ = true;
+}
+
+void IrcApp::finishEditing() {
+    IrcConfig& c = *draft_;
+    const std::string& v = fieldEditor_.text();
+    switch (fields_.selected()) {
+        case kHost: c.host = v; break;
+        case kPort: c.port = std::atoi(v.c_str()); break;
+        case kNick: c.nick = v; break;
+        case kSaslUser: c.saslUser = v; break;
+        case kSaslPass: c.saslPassword = v; break;
+        case kNickserv: c.nickservPassword = v; break;
+        case kAutojoin: c.autojoin = IrcConfig::parseChannels(v); break;
+    }
+    editing_ = false;
+}
+
+bool IrcApp::onSettingsKey(const KeyEvent& e) {
+    if (editing_) {
+        switch (e.key) {
+            case Key::Char: fieldEditor_.insert(e.ch); break;
+            case Key::Delete: fieldEditor_.backspace(); break;
+            case Key::Left: fieldEditor_.left(); break;
+            case Key::Right: fieldEditor_.right(); break;
+            case Key::Select: finishEditing(); break;
+            case Key::Back: editing_ = false; break;
+            default: break;
+        }
+        return true;
+    }
+    IrcConfig& c = *draft_;
+    switch (e.key) {
+        case Key::Up: fields_.up(); break;
+        case Key::Down: fields_.down(); break;
+        case Key::Back:
+            draft_.reset();  // discard unsaved edits
+            page_ = Page::Chat;
+            break;
+        case Key::Select:
+            switch (fields_.selected()) {
+                case kTls: c.tls = !c.tls; break;
+                case kSelfSigned:
+                    c.allowSelfSigned = !c.allowSelfSigned;
+                    c.pinnedSha256.clear();
+                    break;
+                case kSave: {
+                    std::string error = irc_.applyConfig(c);
+                    if (!error.empty()) {
+                        warn(error);
+                        break;
+                    }
+                    page_ = Page::Chat;
+                    view(0);
+                    break;
+                }
+                default: startEditing(fields_.selected()); break;
+            }
+            break;
+        default: break;
+    }
+    return true;
+}
+
+void IrcApp::draw(Canvas& c) {
+    if (page_ == Page::Chat) drawChat(c);
+    else drawSettings(c);
+}
+
+void IrcApp::drawChat(Canvas& c) {
+    const auto& area = theme::kContent;
+    const int inputH = theme::kLineHeight + 4;
+    const int headerH = 11;
+    const theme::Rect messages{area.x, area.y + headerH, area.w, area.h - headerH - inputH - 1};
+
+    std::vector<std::pair<std::string, uint16_t>> lines;  // wrapped, oldest first
+    std::string header;
+    irc_.withSession([&](IrcSession& s) {
+        if (current_ >= s.bufferCount()) current_ = 0;
+        const IrcBuffer& b = s.buffer(current_);
+        header = b.name + " " + std::to_string(current_ + 1) + "/" + std::to_string(s.bufferCount());
+        int others = s.totalUnread() - b.unread;
+        if (others > 0) header += " [" + std::to_string(others) + "]";
+        std::string state = statusText(irc_.status());
+        header += "  " + (state.empty() ? b.topic : state);
+
+        auto measure = widgets::bodyMeasure(c);
+        std::string me = lowered(s.nick());
+        for (const IrcLine& l : b.lines) {
+            std::string when = l.utc >= 0 ? ClockModel::formatLocalTime(l.utc) + " " : "";
+            std::string text;
+            switch (l.kind) {
+                case IrcLine::Kind::Action:
+                case IrcLine::Kind::OwnAction: text = "* " + l.nick + " " + l.text; break;
+                case IrcLine::Kind::Notice: text = "-" + l.nick + "- " + l.text; break;
+                case IrcLine::Kind::Info: text = l.text; break;
+                default: text = "<" + l.nick + "> " + l.text; break;
+            }
+            bool mention = l.kind == IrcLine::Kind::Message && lowered(l.text).find(me) != std::string::npos;
+            for (auto& w : wrapText(when + text, messages.w - 8, measure)) lines.push_back({w, lineColor(l, mention)});
+        }
+    });
+
+    // Header
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kAccent);
+    c.setClipRect(area.x, area.y, area.w, headerH);
+    c.drawString(header.c_str(), 3, area.y + 2);
+    c.clearClipRect();
+
+    // Messages, newest at the bottom, scrolled back by scroll_ lines.
+    int rows = messages.h / theme::kLineHeight;
+    int total = static_cast<int>(lines.size());
+    if (scroll_ > total - rows) scroll_ = total > rows ? total - rows : 0;
+    int first = total - rows - scroll_;
+    if (first < 0) first = 0;
+    c.setFont(&fonts::body);
+    c.setClipRect(messages.x, messages.y, messages.w, messages.h);
+    for (int r = 0; r < rows && first + r < total; r++) {
+        c.setTextColor(lines[first + r].second);
+        c.drawString(lines[first + r].first.c_str(), 4, messages.y + r * theme::kLineHeight + 1);
+    }
+    c.clearClipRect();
+    if (scroll_ > 0) {
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kWarning);
+        c.drawString(("^ " + std::to_string(scroll_)).c_str(), area.w - 30, messages.y + 1);
+    }
+
+    widgets::lineEditor(c, input_, {2, area.y + area.h - inputH, area.w - 4, 0});
+}
+
+void IrcApp::drawSettings(Canvas& c) {
+    const auto& area = theme::kContent;
+    if (editing_) {
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString(fieldLabel(fields_.selected()).c_str(), 4, area.y + 4);
+        widgets::lineEditor(c, fieldEditor_, {4, area.y + 22, area.w - 8, 0});
+        c.drawString(fields_.selected() == kAutojoin ? "e.g. #roro, #private key" : "Enter: OK   `: cancel", 4,
+                     area.y + 44);
+        return;
+    }
+    widgets::list(
+        c, fields_, area, [this](int i) { return fieldLabel(i); }, [this](int i) { return fieldValue(i); });
+}
+
+}  // namespace roro
@@ -0,0 +1,59 @@
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "app.h"
+#include "event_bus.h"
+#include "input_history.h"
+#include "line_editor.h"
+#include "list_model.h"
+#include "services/irc_service.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// IRC: one Buffer at a time with an input line; /settings opens the server form. Opening the App
+// starts the IRC Service, which keeps running after the App is left.
+class IrcApp : public App {
+   public:
+    IrcApp(IrcService& irc, ClockService& clock, EventBus& bus) : irc_(irc), clock_(clock), bus_(bus) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    bool textEntryActive() const override { return page_ == Page::Chat || editing_; }
+    void draw(Canvas& c) override;
+
+   private:
+    enum class Page { Chat, Settings };
+    enum Field { kHost, kPort, kTls, kSelfSigned, kNick, kSaslUser, kSaslPass, kNickserv, kAutojoin, kSave, kFields };
+
+    bool onChatKey(const KeyEvent& e);
+    bool onSettingsKey(const KeyEvent& e);
+    void view(int buffer);
+    void drawChat(Canvas& c);
+    void drawSettings(Canvas& c);
+    std::string fieldLabel(int f) const;
+    std::string fieldValue(int f) const;
+    void startEditing(int f);
+    void finishEditing();
+    void warn(const std::string& text);
+
+    IrcService& irc_;
+    ClockService& clock_;
+    EventBus& bus_;
+    Page page_ = Page::Chat;
+    int current_ = 0;
+    int scroll_ = 0;  // wrapped lines scrolled back from the bottom
+    uint32_t seenRevision_ = 0;
+    IrcService::Status seenStatus_ = IrcService::Status::Stopped;
+    LineEditor input_{400};
+    InputHistory history_{30};
+    ListModel fields_{theme::kContent.h / theme::kLineHeight};
+    bool editing_ = false;
+    LineEditor fieldEditor_{63};
+    std::unique_ptr<IrcConfig> draft_;  // the settings being edited, applied on Save
+};
+
+}  // namespace roro
@@ -14,7 +14,6 @@ using Row = SettingsMenu::Row;

 void SettingsApp::onEnter() {
    page_ = Page::Menu;
-    eraseDialog_.reset();
    list_.setCount(menu_.count());
 }

@@ -28,8 +27,16 @@ bool SettingsApp::onKey(const KeyEvent& e) {
        case Page::Menu: return onMenuKey(e);
        case Page::Text: return onTextKey(e);
        case Page::Choice: return onChoiceKey(e);
-        case Page::Storage: return onStorageKey(e);
+        case Page::Storage:
+            if (!storagePage_.onKey(e)) page_ = Page::Menu;
+            return true;
        case Page::About: return onAboutKey(e);
+        case Page::Wifi:
+            if (!wifiPage_.onKey(e)) page_ = Page::Menu;
+            return true;
+        case Page::Firmware:
+            if (!firmwarePage_.onKey(e)) page_ = Page::Menu;
+            return true;
    }
    return false;
 }
@@ -61,7 +68,23 @@ bool SettingsApp::onMenuKey(const KeyEvent& e) {
            break;
        case Kind::Toggle: menu_.toggle(i); break;
        case Kind::Slider: break;
-        case Kind::Page: page_ = menu_.row(i) == Row::Storage ? Page::Storage : Page::About; break;
+        case Kind::Page:
+            switch (menu_.row(i)) {
+                case Row::Storage:
+                    page_ = Page::Storage;
+                    storagePage_.enter();
+                    break;
+                case Row::Wifi:
+                    page_ = Page::Wifi;
+                    wifiPage_.enter();
+                    break;
+                case Row::Firmware:
+                    page_ = Page::Firmware;
+                    firmwarePage_.enter();
+                    break;
+                default: page_ = Page::About; break;
+            }
+            break;
    }
    return true;
 }
@@ -100,21 +123,6 @@ bool SettingsApp::onChoiceKey(const KeyEvent& e) {
    return true;
 }

-bool SettingsApp::onStorageKey(const KeyEvent& e) {
-    if (eraseDialog_) {
-        eraseDialog_->onKey(e);
-        if (eraseDialog_->result() == 1 && !d_.storage.requestFormat()) warn("A format is already running");
-        if (eraseDialog_->result() != DialogModel::kPending) eraseDialog_.reset();
-        return true;
-    }
-    if (e.key == Key::Select) {
-        if (d_.storage.state().present) eraseDialog_.reset(new DialogModel({"Cancel", "Erase"}));
-        else warn("No SD card");
-    }
-    if (e.key == Key::Back) page_ = Page::Menu;
-    return true;
-}
-
 bool SettingsApp::onAboutKey(const KeyEvent& e) {
    if (e.key == Key::Back) page_ = Page::Menu;
    if (e.key == Key::Char && e.ch == 'w') d_.apps.open("demo");  // hidden widget demo
@@ -123,31 +131,14 @@ bool SettingsApp::onAboutKey(const KeyEvent& e) {

 void SettingsApp::update(uint32_t nowMs) {
    // Live values on Storage and About.
-    if ((page_ == Page::Storage || page_ == Page::About) && nowMs - lastRefreshMs_ >= 1000) {
+    bool live = page_ == Page::Storage || page_ == Page::About || page_ == Page::Firmware ||
+                (page_ == Page::Wifi && wifiPage_.live());
+    if (live && nowMs - lastRefreshMs_ >= 500) {
        lastRefreshMs_ = nowMs;
        requestRedraw();
    }
 }

-std::vector<std::string> SettingsApp::storageLines() const {
-    auto s = d_.storage.state();
-    std::vector<std::string> lines;
-    char buf[64];
-    if (d_.storage.formatting()) {
-        lines.push_back("Erasing the SD card...");
-    } else if (!s.present) {
-        lines.push_back("No SD card inserted.");
-    } else {
-        snprintf(buf, sizeof(buf), "SD card: %u MB, %d%% used", static_cast<unsigned>(s.totalBytes >> 20), s.usedPercent);
-        lines.push_back(buf);
-        lines.push_back(s.logsAllowed ? "Logs: recording" : "Logs: paused (over 90%)");
-        lines.push_back(s.capturesAllowed ? "Captures: allowed" : "Captures: stopped (card full)");
-    }
-    lines.push_back("");
-    lines.push_back("Enter: erase SD card");
-    return lines;
-}
-
 std::vector<std::string> SettingsApp::aboutLines() const {
    std::vector<std::string> lines;
    char buf[64];
@@ -197,13 +188,10 @@ void SettingsApp::draw(Canvas& c) {
            widgets::list(c, choices_, area, [&](int i) { return (i == current ? "* " : "  ") + options[i]; });
            break;
        }
-        case Page::Storage:
-            widgets::textLines(c, storageLines(), 0, area);
-            if (eraseDialog_)
-                widgets::dialog(c, "Erase SD card?", "Everything on the card is deleted. It becomes one FAT32 partition.",
-                                *eraseDialog_);
-            break;
+        case Page::Storage: storagePage_.draw(c); break;
        case Page::About: widgets::textLines(c, aboutLines(), 0, area); break;
+        case Page::Wifi: wifiPage_.draw(c); break;
+        case Page::Firmware: firmwarePage_.draw(c); break;
    }
 }

@@ -13,6 +13,9 @@
 #include "services/battery_service.h"
 #include "services/clock_service.h"
 #include "services/storage_service.h"
+#include "apps/firmware_page.h"
+#include "apps/storage_page.h"
+#include "apps/wifi_settings_page.h"
 #include "settings_menu.h"
 #include "ui/theme.h"

@@ -25,37 +28,47 @@ struct SettingsAppDeps {
    BatteryService& battery;
    StorageService& storage;
    ClockService& clock;
+    WifiService& wifi;
+    SavedNetworks& savedNetworks;
+    UpdateService& update;
 };

 // Settings: every user-facing setting, plus the Storage and About pages.
 class SettingsApp : public App {
   public:
-    explicit SettingsApp(const SettingsAppDeps& deps) : d_(deps), menu_(deps.settings) {}
+    explicit SettingsApp(const SettingsAppDeps& deps)
+        : d_(deps),
+          menu_(deps.settings),
+          wifiPage_(deps.settings, deps.savedNetworks, deps.wifi, deps.bus),
+          storagePage_(deps.storage, deps.clock, deps.bus),
+          firmwarePage_(deps.update, deps.wifi, deps.storage) {}
    void onEnter() override;
    bool onKey(const KeyEvent& e) override;
    void update(uint32_t nowMs) override;
-    bool textEntryActive() const override { return page_ == Page::Text; }
+    bool textEntryActive() const override {
+        return page_ == Page::Text || (page_ == Page::Wifi && wifiPage_.textEntryActive());
+    }
    void draw(Canvas& c) override;

   private:
-    enum class Page { Menu, Text, Choice, Storage, About };
+    enum class Page { Menu, Text, Choice, Storage, About, Wifi, Firmware };

    bool onMenuKey(const KeyEvent& e);
    bool onTextKey(const KeyEvent& e);
    bool onChoiceKey(const KeyEvent& e);
-    bool onStorageKey(const KeyEvent& e);
    bool onAboutKey(const KeyEvent& e);
    void warn(const std::string& text);
-    std::vector<std::string> storageLines() const;
    std::vector<std::string> aboutLines() const;

    SettingsAppDeps d_;
    SettingsMenu menu_;
+    WifiSettingsPage wifiPage_;
+    StoragePage storagePage_;
+    FirmwarePage firmwarePage_;
    Page page_ = Page::Menu;
    ListModel list_{theme::kContent.h / theme::kLineHeight};
    ListModel choices_{theme::kContent.h / theme::kLineHeight};
    LineEditor editor_{39};
-    std::unique_ptr<DialogModel> eraseDialog_;
    int editingRow_ = 0;
    uint32_t lastRefreshMs_ = 0;
 };
@@ -0,0 +1,171 @@
+#include "storage_page.h"
+
+#include "ui/widgets.h"
+
+namespace roro {
+
+namespace {
+constexpr int kAges = sizeof(kCleanupAgeLabels) / sizeof(kCleanupAgeLabels[0]);
+constexpr int kCategories = sizeof(kCleanupCategories) / sizeof(kCleanupCategories[0]);
+}  // namespace
+
+void StoragePage::enter() {
+    view_ = View::Main;
+    dialog_.reset();
+    main_.setCount(kRows);
+    main_.select(kCleanUp);
+}
+
+void StoragePage::warn(const char* text) {
+    bus_.publish(Event::withText(EventType::Notification, text, static_cast<int32_t>(NotificationLevel::Warning)));
+}
+
+uint64_t StoragePage::categoryBytes(int category) const {
+    uint64_t sum = 0;
+    if (category < static_cast<int>(listing_.size()))
+        for (auto& f : listing_[category]) sum += f.bytes;
+    return sum;
+}
+
+CleanupPlan StoragePage::planFor(int age) const {
+    int today = clock_.today();
+    auto cutoff = static_cast<CleanupAge>(age);
+    // Without a clock only "Everything" can be judged.
+    if (today < 0 && cutoff != CleanupAge::Everything) return {};
+    return CleanupPlan::make(listing_[categories_.selected()], cutoff, today);
+}
+
+bool StoragePage::onKey(const KeyEvent& e) {
+    if (dialog_) {
+        dialog_->onKey(e);
+        int result = dialog_->result();
+        if (result == 1) {
+            if (view_ == View::Main) {
+                storage_.requestFormat();
+            } else {
+                storage_.requestDelete(pending_.paths);
+                enter();
+            }
+        }
+        if (result != DialogModel::kPending) dialog_.reset();
+        return true;
+    }
+
+    switch (view_) {
+        case View::Main:
+            switch (e.key) {
+                case Key::Up: main_.up(); break;
+                case Key::Down: main_.down(); break;
+                case Key::Back: return false;
+                case Key::Select:
+                    if (!storage_.state().present) {
+                        warn("No SD card");
+                    } else if (main_.selected() == kCleanUp) {
+                        storage_.requestListing();
+                        haveListing_ = false;
+                        categories_.setCount(kCategories);
+                        view_ = View::Categories;
+                    } else if (main_.selected() == kErase) {
+                        dialog_.reset(new DialogModel({"Cancel", "Erase"}));
+                    }
+                    break;
+                default: break;
+            }
+            return true;
+
+        case View::Categories:
+            switch (e.key) {
+                case Key::Up: categories_.up(); break;
+                case Key::Down: categories_.down(); break;
+                case Key::Back: view_ = View::Main; break;
+                case Key::Select:
+                    if (!haveListing_) break;
+                    if (listing_[categories_.selected()].empty()) {
+                        warn("Nothing to clean up here");
+                        break;
+                    }
+                    ages_.setCount(kAges);
+                    view_ = View::Ages;
+                    break;
+                default: break;
+            }
+            return true;
+
+        case View::Ages:
+            switch (e.key) {
+                case Key::Up: ages_.up(); break;
+                case Key::Down: ages_.down(); break;
+                case Key::Back: view_ = View::Categories; break;
+                case Key::Select:
+                    pending_ = planFor(ages_.selected());
+                    if (pending_.paths.empty()) warn(clock_.today() < 0 ? "Clock not set: only Everything works"
+                                                                        : "No files that old");
+                    else dialog_.reset(new DialogModel({"Cancel", "Delete"}));
+                    break;
+                default: break;
+            }
+            return true;
+    }
+    return true;
+}
+
+void StoragePage::draw(Canvas& c) {
+    const auto& area = theme::kContent;
+    if (!haveListing_ && storage_.listingReady()) {
+        listing_ = storage_.listing();
+        haveListing_ = true;
+    }
+
+    switch (view_) {
+        case View::Main: {
+            auto s = storage_.state();
+            widgets::list(
+                c, main_, area,
+                [](int i) -> std::string {
+                    const char* labels[] = {"SD card", "Logs", "Captures", "Clean up", "Erase SD card"};
+                    return labels[i];
+                },
+                [&](int i) -> std::string {
+                    if (storage_.formatting() && i == kCard) return "erasing...";
+                    if (!s.present) return i == kCard ? "none" : "";
+                    switch (i) {
+                        case kCard: return formatBytes(s.totalBytes) + ", " + std::to_string(s.usedPercent) + "% used";
+                        case kLogs: return s.logsAllowed ? "recording" : "paused (over 90%)";
+                        case kCaptures: return s.capturesAllowed ? "allowed" : "stopped (full)";
+                        default: return ">";
+                    }
+                });
+            if (dialog_)
+                widgets::dialog(c, "Erase SD card?", "Everything on the card is deleted. It becomes one FAT32 partition.",
+                                *dialog_);
+            break;
+        }
+        case View::Categories:
+            if (!haveListing_) {
+                widgets::textLines(c, {"Listing files..."}, 0, area);
+                break;
+            }
+            widgets::list(
+                c, categories_, area, [](int i) { return std::string(kCleanupCategories[i].label); },
+                [this](int i) {
+                    return std::to_string(listing_[i].size()) + " files, " + formatBytes(categoryBytes(i));
+                });
+            break;
+        case View::Ages:
+            widgets::list(
+                c, ages_, area, [](int i) { return std::string(kCleanupAgeLabels[i]); },
+                [this](int i) {
+                    auto plan = planFor(i);
+                    return plan.paths.empty() ? std::string("-") : formatBytes(plan.bytes);
+                });
+            if (dialog_) {
+                std::string message = "Delete " + std::to_string(pending_.paths.size()) + " files from " +
+                                      kCleanupCategories[categories_.selected()].label + ", freeing " +
+                                      formatBytes(pending_.bytes) + "?";
+                widgets::dialog(c, "Clean up", message, *dialog_);
+            }
+            break;
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,49 @@
+#pragma once
+
+#include <memory>
+#include <vector>
+
+#include "cleanup_plan.h"
+#include "dialog_model.h"
+#include "event_bus.h"
+#include "key_event.h"
+#include "list_model.h"
+#include "services/clock_service.h"
+#include "services/storage_service.h"
+#include "ui/canvas.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Settings → Storage: card usage, Storage Clean-up (category → age → confirm) and erasing the card.
+class StoragePage {
+   public:
+    StoragePage(StorageService& storage, ClockService& clock, EventBus& bus)
+        : storage_(storage), clock_(clock), bus_(bus) {}
+
+    void enter();
+    bool onKey(const KeyEvent& e);  // false: leave the page
+    void draw(Canvas& c);
+
+   private:
+    enum class View { Main, Categories, Ages };
+    enum Row { kCard, kLogs, kCaptures, kCleanUp, kErase, kRows };
+
+    CleanupPlan planFor(int age) const;
+    uint64_t categoryBytes(int category) const;
+    void warn(const char* text);
+
+    StorageService& storage_;
+    ClockService& clock_;
+    EventBus& bus_;
+    View view_ = View::Main;
+    ListModel main_{theme::kContent.h / theme::kLineHeight};
+    ListModel categories_{theme::kContent.h / theme::kLineHeight};
+    ListModel ages_{theme::kContent.h / theme::kLineHeight};
+    std::vector<std::vector<StoredFile>> listing_;
+    bool haveListing_ = false;
+    std::unique_ptr<DialogModel> dialog_;
+    CleanupPlan pending_;
+};
+
+}  // namespace roro
@@ -0,0 +1,198 @@
+#include "wifi_settings_page.h"
+
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using State = WifiController::State;
+
+void WifiSettingsPage::enter() {
+    view_ = View::Main;
+    forgetDialog_.reset();
+    refreshMain();
+}
+
+void WifiSettingsPage::refreshMain() { main_.setCount(kFixedRows + saved_.count()); }
+
+void WifiSettingsPage::warn(const std::string& text, NotificationLevel level) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(level)));
+}
+
+std::string WifiSettingsPage::statusText() const {
+    switch (wifi_.state()) {
+        case State::Off: return "Off";
+        case State::Scanning: return "Searching...";
+        case State::Waiting: return "No saved network in range";
+        case State::Connecting: return "Joining " + wifi_.ssid() + "...";
+        case State::Connected: return wifi_.ssid() + " (" + std::to_string(wifi_.rssi()) + " dBm)";
+        case State::Monitoring: return "Monitoring";
+    }
+    return "";
+}
+
+bool WifiSettingsPage::onKey(const KeyEvent& e) {
+    if (forgetDialog_) {
+        forgetDialog_->onKey(e);
+        if (forgetDialog_->result() == 1) {
+            saved_.forget(saved_.at(main_.selected() - kFixedRows).ssid);
+            refreshMain();
+        }
+        if (forgetDialog_->result() != DialogModel::kPending) forgetDialog_.reset();
+        return true;
+    }
+
+    switch (view_) {
+        case View::Main:
+            switch (e.key) {
+                case Key::Up: main_.up(); return true;
+                case Key::Down: main_.down(); return true;
+                case Key::Back: return false;
+                case Key::Left:
+                case Key::Right:
+                    if (main_.selected() != kToggle) return true;
+                    [[fallthrough]];
+                case Key::Select:
+                    switch (main_.selected()) {
+                        case kToggle: settings_.setBool(Setting::WifiEnabled, !settings_.getBool(Setting::WifiEnabled)); break;
+                        case kStatus: break;
+                        case kAddScanned:
+                            wifi_.startListScan();
+                            scan_.setCount(0);
+                            view_ = View::Scan;
+                            break;
+                        case kAddHidden:
+                            newHidden_ = true;
+                            editor_ = LineEditor(32);
+                            view_ = View::Ssid;
+                            break;
+                        default: forgetDialog_.reset(new DialogModel({"Cancel", "Forget"})); break;
+                    }
+                    return true;
+                default: return true;
+            }
+
+        case View::Scan: {
+            std::vector<ScanEntry> found;
+            for (auto& n : wifi_.listScan())
+                if (!n.ssid.empty()) found.push_back(n);
+            if (wifi_.listScanDone()) scan_.setCount(static_cast<int>(found.size()));
+            switch (e.key) {
+                case Key::Up: scan_.up(); break;
+                case Key::Down: scan_.down(); break;
+                case Key::Back: view_ = View::Main; break;
+                case Key::Select:
+                    if (scan_.selected() < 0) break;
+                    newSsid_ = found[scan_.selected()].ssid;
+                    newHidden_ = false;
+                    if (found[scan_.selected()].open) {
+                        std::string error = saved_.add(newSsid_, "", false);
+                        if (!error.empty()) warn(error);
+                        wifi_.savedNetworksChanged();
+                        enter();
+                    } else {
+                        editor_ = LineEditor(63);
+                        view_ = View::Password;
+                    }
+                    break;
+                default: break;
+            }
+            return true;
+        }
+
+        case View::Ssid:
+        case View::Password:
+            switch (e.key) {
+                case Key::Char: editor_.insert(e.ch); break;
+                case Key::Delete: editor_.backspace(); break;
+                case Key::Left: editor_.left(); break;
+                case Key::Right: editor_.right(); break;
+                case Key::Back: enter(); break;
+                case Key::Select:
+                    if (view_ == View::Ssid) {
+                        newSsid_ = editor_.text();
+                        editor_ = LineEditor(63);
+                        view_ = View::Password;
+                    } else {
+                        std::string error = saved_.add(newSsid_, editor_.text(), newHidden_);
+                        if (!error.empty()) {
+                            warn(error);
+                        } else {
+                            warn("Saved " + newSsid_, NotificationLevel::Info);
+                            wifi_.savedNetworksChanged();
+                            enter();
+                        }
+                    }
+                    break;
+                default: break;
+            }
+            return true;
+    }
+    return true;
+}
+
+void WifiSettingsPage::draw(Canvas& c) {
+    const auto& area = theme::kContent;
+    switch (view_) {
+        case View::Main:
+            widgets::list(
+                c, main_, area,
+                [this](int i) -> std::string {
+                    switch (i) {
+                        case kToggle: return "Wi-Fi";
+                        case kStatus: return "Status";
+                        case kAddScanned: return "Add a network";
+                        case kAddHidden: return "Add a hidden network";
+                        default: {
+                            const auto& n = saved_.at(i - kFixedRows);
+                            return "  " + n.ssid + (n.hidden ? " (hidden)" : "");
+                        }
+                    }
+                },
+                [this](int i) -> std::string {
+                    switch (i) {
+                        case kToggle: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
+                        case kStatus: return statusText();
+                        case kAddScanned:
+                        case kAddHidden: return ">";
+                        default: return "";
+                    }
+                });
+            if (forgetDialog_ && main_.selected() >= kFixedRows)
+                widgets::dialog(c, "Forget network?", saved_.at(main_.selected() - kFixedRows).ssid, *forgetDialog_);
+            break;
+
+        case View::Scan: {
+            if (!wifi_.listScanDone()) {
+                widgets::textLines(c, {"Scanning..."}, 0, area);
+                break;
+            }
+            std::vector<ScanEntry> found;
+            for (auto& n : wifi_.listScan())
+                if (!n.ssid.empty()) found.push_back(n);
+            if (scan_.count() != static_cast<int>(found.size())) scan_.setCount(static_cast<int>(found.size()));
+            if (found.empty()) {
+                widgets::textLines(c, {"No networks found.", "", "`: back"}, 0, area);
+                break;
+            }
+            widgets::list(
+                c, scan_, area, [&](int i) { return found[i].ssid + (found[i].open ? " (open)" : ""); },
+                [&](int i) { return std::to_string(found[i].rssi) + " dBm"; });
+            break;
+        }
+
+        case View::Ssid:
+        case View::Password: {
+            c.setFont(&fonts::body);
+            c.setTextColor(theme::kMuted);
+            std::string title = view_ == View::Ssid ? "Hidden network name" : "Password for " + newSsid_;
+            c.drawString(title.c_str(), 4, area.y + 4);
+            widgets::lineEditor(c, editor_, {4, area.y + 22, area.w - 8, 0});
+            c.drawString(view_ == View::Ssid ? "Enter: next   `: cancel" : "Enter: save (empty = open)   `: cancel", 4,
+                         area.y + 44);
+            break;
+        }
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,53 @@
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "dialog_model.h"
+#include "event_bus.h"
+#include "key_event.h"
+#include "line_editor.h"
+#include "list_model.h"
+#include "saved_networks.h"
+#include "services/wifi_service.h"
+#include "settings.h"
+#include "ui/canvas.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Settings → Wi-Fi: the On/Off switch, current connection, Saved Networks, and adding networks
+// from a scan or by name (hidden). Owned by the Settings App.
+class WifiSettingsPage {
+   public:
+    WifiSettingsPage(Settings& settings, SavedNetworks& saved, WifiService& wifi, EventBus& bus)
+        : settings_(settings), saved_(saved), wifi_(wifi), bus_(bus) {}
+
+    void enter();
+    bool onKey(const KeyEvent& e);  // false: leave the page
+    bool textEntryActive() const { return view_ == View::Ssid || view_ == View::Password; }
+    bool live() const { return view_ == View::Main || view_ == View::Scan; }  // redraw periodically
+    void draw(Canvas& c);
+
+   private:
+    enum class View { Main, Scan, Ssid, Password };
+    enum Fixed { kToggle, kStatus, kAddScanned, kAddHidden, kFixedRows };
+
+    void refreshMain();
+    void warn(const std::string& text, NotificationLevel level = NotificationLevel::Warning);
+    std::string statusText() const;
+
+    Settings& settings_;
+    SavedNetworks& saved_;
+    WifiService& wifi_;
+    EventBus& bus_;
+    View view_ = View::Main;
+    ListModel main_{theme::kContent.h / theme::kLineHeight};
+    ListModel scan_{theme::kContent.h / theme::kLineHeight};
+    LineEditor editor_{63};
+    std::string newSsid_;
+    bool newHidden_ = false;
+    std::unique_ptr<DialogModel> forgetDialog_;
+};
+
+}  // namespace roro
@@ -0,0 +1,263 @@
+#include "wifi_tools_app.h"
+
+#include <M5Cardputer.h>
+
+#include <algorithm>
+
+#include "channel_occupancy.h"
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+namespace {
+const char* const kMenu[] = {"Networks nearby", "Channel occupancy", "Signal tracker"};
+constexpr uint32_t kListRescanMs = 4000;
+constexpr uint32_t kTrackRescanMs = 400;
+constexpr int kWeakRssi = -75;
+}  // namespace
+
+void WifiToolsApp::onEnter() {
+    view_ = View::Menu;
+    menu_.setCount(3);
+}
+
+void WifiToolsApp::onExit() {
+    logging_ = false;  // logging only runs while this foreground App is scanning
+    wifi_.endListScans();
+}
+
+void WifiToolsApp::open(View v) {
+    view_ = v;
+    nextScanMs_ = 0;  // scan right away
+    requestRedraw();
+}
+
+void WifiToolsApp::refreshOrder() {
+    order_ = orderNetworks(wifi_.listScan(), sort_, filter_);
+    networks_.setCount(static_cast<int>(order_.size()));
+}
+
+bool WifiToolsApp::onKey(const KeyEvent& e) {
+    requestRedraw();
+    switch (view_) {
+        case View::Menu:
+            switch (e.key) {
+                case Key::Up: menu_.up(); return true;
+                case Key::Down: menu_.down(); return true;
+                case Key::Select: open(menu_.selected() == 1 ? View::Channels : View::Networks); return true;
+                default: return false;
+            }
+        case View::Networks:
+            switch (e.key) {
+                case Key::Up: networks_.up(); return true;
+                case Key::Down: networks_.down(); return true;
+                case Key::Back: view_ = View::Menu; return true;
+                case Key::Select: {
+                    if (networks_.selected() < 0 || networks_.selected() >= static_cast<int>(order_.size())) return true;
+                    const ScanEntry& ap = wifi_.listScan()[order_[networks_.selected()]];
+                    targetBssid_ = ap.bssid;
+                    targetName_ = ap.ssid.empty() ? "(hidden network)" : ap.ssid;
+                    targetChannel_ = ap.channel;
+                    tracker_ = SignalTracker(110);
+                    tracker_.seen(ap.rssi, millis());
+                    open(View::Tracker);
+                    return true;
+                }
+                case Key::Char:
+                    switch (e.ch) {
+                        case 's': sort_ = nextSort(sort_); break;
+                        case 'o': filter_.openOnly = !filter_.openOnly; break;
+                        case 'h': filter_.hideHidden = !filter_.hideHidden; break;
+                        case 'w': filter_.minRssi = filter_.minRssi == kWeakRssi ? -100 : kWeakRssi; break;
+                        case 'l':
+                            logging_ = !logging_;
+                            logThrottle_.reset();
+                            if (logging_) loggedRows_ = 0;
+                            break;
+                        default: return true;
+                    }
+                    refreshOrder();
+                    return true;
+                default: return true;
+            }
+        case View::Channels:
+            if (e.key == Key::Back) view_ = View::Menu;
+            return true;
+        case View::Tracker:
+            if (e.key == Key::Back) view_ = View::Networks;
+            if (e.key == Key::Char && (e.ch == 'm' || e.ch == 'M')) clicks_ = !clicks_;
+            return true;
+    }
+    return false;
+}
+
+void WifiToolsApp::logScan(uint32_t nowMs) {
+    std::string date = clock_.localDate();
+    if (date.empty()) return;  // no timestamp without a clock
+    if (!logThrottle_.due(nowMs)) return;
+    std::string path = "/wifi/scans/" + date + ".csv";
+    if (date != headerDate_) {
+        storage_.appendLine(path, scanlog::header());
+        headerDate_ = date;
+    }
+    std::string stamp = date + " " + clock_.displayTime();
+    for (auto& ap : wifi_.listScan()) {
+        storage_.appendLine(path, scanlog::row(stamp, ap));
+        loggedRows_++;
+    }
+    logThrottle_.logged(nowMs);
+}
+
+void WifiToolsApp::update(uint32_t nowMs) {
+    if (view_ == View::Menu) return;
+
+    if (wifi_.listScanSeq() != seenSeq_) {
+        seenSeq_ = wifi_.listScanSeq();
+        if (view_ == View::Tracker) {
+            bool found = false;
+            for (auto& ap : wifi_.listScan())
+                if (ap.bssid == targetBssid_) {
+                    tracker_.seen(ap.rssi, nowMs);
+                    targetChannel_ = ap.channel;
+                    found = true;
+                }
+            if (!found) tracker_.missed();
+        } else {
+            refreshOrder();
+            if (logging_) logScan(nowMs);
+        }
+        requestRedraw();
+    }
+
+    if (wifi_.listScanDone() && static_cast<int32_t>(nowMs - nextScanMs_) >= 0) {
+        bool tracking = view_ == View::Tracker;
+        wifi_.startListScan(tracking && !tracker_.lost(nowMs) ? targetChannel_ : 0);
+        nextScanMs_ = nowMs + (tracking ? kTrackRescanMs : kListRescanMs);
+    }
+
+    if (view_ == View::Tracker && clicks_ && !tracker_.lost(nowMs) && static_cast<int32_t>(nowMs - nextClickMs_) >= 0) {
+        M5Cardputer.Speaker.tone(2600, 8);
+        nextClickMs_ = nowMs + SignalTracker::clickIntervalMs(tracker_.latest());
+    }
+}
+
+void WifiToolsApp::draw(Canvas& c) {
+    switch (view_) {
+        case View::Menu:
+            widgets::list(c, menu_, theme::kContent, [](int i) { return std::string(kMenu[i]); });
+            break;
+        case View::Networks: drawNetworks(c); break;
+        case View::Channels: drawChannels(c); break;
+        case View::Tracker: drawTracker(c); break;
+    }
+}
+
+void WifiToolsApp::drawNetworks(Canvas& c) {
+    const auto& area = theme::kContent;
+    const auto& scan = wifi_.listScan();
+
+    // Status line: sort, filters, logging.
+    c.setFont(&fonts::small);
+    std::string top = std::string("sort:") + sortName(sort_);
+    if (filter_.openOnly) top += " open";
+    if (filter_.hideHidden) top += " !hid";
+    if (filter_.minRssi != -100) top += " strong";
+    c.setTextColor(theme::kMuted);
+    c.drawString(top.c_str(), 4, area.y + 1);
+    if (logging_) {
+        c.setTextColor(theme::kWarning);
+        c.setTextDatum(top_right);
+        c.drawString(("LOG " + std::to_string(loggedRows_)).c_str(), area.w - 4, area.y + 1);
+        c.setTextDatum(top_left);
+    }
+
+    theme::Rect list{area.x, area.y + 13, area.w, area.h - 13};
+    if (order_.empty()) {
+        bool any = !scan.empty();
+        widgets::textLines(c,
+                           {wifi_.listScanDone() ? (any ? "Nothing matches the filter." : "No networks found yet.")
+                                                 : "Scanning...",
+                            "", "s sort  o open  h hide-hidden  w strong  l log"},
+                           0, list);
+        return;
+    }
+    widgets::list(
+        c, networks_, list,
+        [&](int i) {
+            const ScanEntry& ap = scan[order_[i]];
+            return ap.ssid.empty() ? std::string("(hidden)") : ap.ssid;
+        },
+        [&](int i) {
+            const ScanEntry& ap = scan[order_[i]];
+            return "ch" + std::to_string(ap.channel) + " " + std::to_string(ap.rssi) + " " + ap.security;
+        });
+}
+
+void WifiToolsApp::drawChannels(Canvas& c) {
+    const auto& area = theme::kContent;
+    std::vector<ChannelSighting> sightings;
+    for (auto& ap : wifi_.listScan()) sightings.push_back({ap.channel, ap.rssi});
+    auto load = channelLoad(sightings);
+    int best = quietestChannel(load);
+    float maxLoad = 1.0f;
+    for (int ch = 1; ch <= 13; ch++) maxLoad = std::max(maxLoad, load[ch]);
+
+    c.setFont(&fonts::body);
+    c.setTextColor(theme::kText);
+    std::string summary = std::to_string(sightings.size()) + " networks. Quietest of 1/6/11: " + std::to_string(best);
+    c.drawString(summary.c_str(), 4, area.y + 2);
+
+    const int baseY = area.y + area.h - 14, barMaxH = area.h - 34, slot = 17, x0 = 10;
+    c.setFont(&fonts::small);
+    for (int ch = 1; ch <= 13; ch++) {
+        int x = x0 + (ch - 1) * slot;
+        int h = static_cast<int>(load[ch] / maxLoad * barMaxH);
+        uint16_t color = ch == best ? theme::kMessage : (ch == 1 || ch == 6 || ch == 11) ? theme::kAccent : theme::kMuted;
+        if (h > 0) c.fillRect(x, baseY - h, slot - 4, h, color);
+        c.setTextColor(ch == best ? theme::kMessage : theme::kText);
+        c.setTextDatum(top_center);
+        c.drawString(std::to_string(ch).c_str(), x + (slot - 4) / 2, baseY + 3);
+        c.setTextDatum(top_left);
+    }
+    c.drawFastHLine(x0 - 2, baseY, 13 * slot, theme::kMuted);
+}
+
+void WifiToolsApp::drawTracker(Canvas& c) {
+    const auto& area = theme::kContent;
+    uint32_t now = millis();
+    bool lost = tracker_.lost(now);
+
+    c.setFont(&fonts::bold);
+    c.setTextColor(theme::kText);
+    c.drawString(targetName_.c_str(), 4, area.y + 2);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    std::string sub = targetBssid_ + "  ch" + std::to_string(targetChannel_) + "  m: clicks " + (clicks_ ? "on" : "off");
+    c.drawString(sub.c_str(), 4, area.y + 17);
+
+    c.setFont(&fonts::bold);
+    c.setTextSize(2);
+    c.setTextColor(lost ? theme::kWarning : theme::kText);
+    std::string reading = lost ? "lost" : std::to_string(tracker_.latest()) + " dBm";
+    c.drawString(reading.c_str(), 4, area.y + 30);
+    c.setTextSize(1);
+
+    int strength = lost ? 0 : std::min(100, std::max(0, (tracker_.latest() + 95) * 100 / 60));
+    int barW = area.w - 8;
+    c.drawRect(4, area.y + 60, barW, 8, theme::kMuted);
+    c.fillRect(5, area.y + 61, (barW - 2) * strength / 100, 6, theme::kMessage);
+
+    const int gy = area.y + 74, gh = area.h - 76;
+    const auto& h = tracker_.history();
+    int n = static_cast<int>(h.size());
+    for (int i = 0; i < n; i++) {
+        int v = h[i];
+        if (v == SignalTracker::kNoSignal) continue;
+        int bh = std::min(gh, std::max(1, (v + 95) * gh / 60));
+        int x = area.w - 4 - (n - i) * 2;
+        c.fillRect(x, gy + gh - bh, 2, bh, theme::kAccent);
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,67 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "list_model.h"
+#include "network_list_view.h"
+#include "scan_log.h"
+#include "services/clock_service.h"
+#include "services/storage_service.h"
+#include "services/wifi_service.h"
+#include "signal_tracker.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Wi-Fi diagnostics from ordinary scans: nearby access points (sortable, filterable, optionally
+// logged to CSV), how crowded each channel is, and a signal tracker. None of it interrupts the
+// connection or IRC, and none of it captures anyone's traffic.
+class WifiToolsApp : public App {
+   public:
+    WifiToolsApp(WifiService& wifi, StorageService& storage, ClockService& clock)
+        : wifi_(wifi), storage_(storage), clock_(clock) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View { Menu, Networks, Channels, Tracker };
+
+    void open(View v);
+    void refreshOrder();
+    void logScan(uint32_t nowMs);
+    void drawNetworks(Canvas& c);
+    void drawChannels(Canvas& c);
+    void drawTracker(Canvas& c);
+
+    WifiService& wifi_;
+    StorageService& storage_;
+    ClockService& clock_;
+    View view_ = View::Menu;
+    ListModel menu_{theme::kContent.h / theme::kLineHeight};
+    ListModel networks_{(theme::kContent.h - 14) / theme::kLineHeight};
+    std::vector<int> order_;  // indices into the scan, after sort and filter
+    WifiSort sort_ = WifiSort::Signal;
+    NetworkFilter filter_;
+    uint32_t seenSeq_ = 0;
+    uint32_t nextScanMs_ = 0;
+
+    // Scan logging
+    bool logging_ = false;
+    ScanLogThrottle logThrottle_{30000};
+    std::string headerDate_;
+    uint32_t loggedRows_ = 0;
+
+    // Tracker
+    std::string targetBssid_, targetName_;
+    int targetChannel_ = 0;
+    SignalTracker tracker_{110};
+    bool clicks_ = true;
+    uint32_t nextClickMs_ = 0;
+};
+
+}  // namespace roro
@@ -1,20 +1,40 @@
 // roro9stack firmware entry point: wires Services, Apps and the UI loop together.
 #include <M5Cardputer.h>
+#include <SD.h>
+
+
+#include <atomic>
+#include <memory>

 #include "app_manager.h"
 #include "apps/demo_app.h"
+#include "apps/gnss_app.h"
+#include "apps/irc_app.h"
 #include "apps/launcher_app.h"
 #include "apps/settings_app.h"
+#include "apps/wifi_tools_app.h"
 #include "apps/setup_app.h"
 #include "event_bus.h"
+#include "file_receiver.h"
 #include "key_mapper.h"
+#include "platform/console.h"
+#include "platform/crash_report.h"
 #include "platform/nvs_store.h"
+#include "platform/system_info.h"
 #include "service_manager.h"
+#include "platform/identity.h"
 #include "services/battery_service.h"
+#include "services/irc_service.h"
 #include "services/clock_service.h"
+#include "services/debug_console.h"
+#include "services/gnss_service.h"
 #include "services/power_service.h"
 #include "services/storage_service.h"
+#include "services/update_service.h"
+#include "services/wifi_service.h"
+#include "safe_mode.h"
 #include "settings.h"
+#include "storage_paths.h"
 #include "ui/notifier.h"
 #include "ui/screen.h"
 #include "version.h"
@@ -30,12 +50,21 @@ static Screen screen;

 // Constructed in setup(), after the hardware and Settings are ready.
 static BatteryService* battery;
-static StorageService* storage;
+static StorageService* storageService;
 static PowerService* power;
 static ClockService* clockService;
+static GnssService* gnssService;
+static SavedNetworks* savedNetworks;
+static WifiService* wifi;
+static IrcService* irc;
+static UpdateService* update;
+#ifdef RORO_DEBUG
+static DebugConsole* debugConsole;
+#endif
 static Notifier* notifier;
 static LauncherApp launcher;
 static AppManager* apps;
+static bool safeMode = false;  // see SafeMode: only what it takes to be fixed over the air

 static RawKeys readKeys() {
    auto state = M5Cardputer.Keyboard.keysState();
@@ -58,51 +87,426 @@ static StatusInfo currentStatus() {
    if (apps->foregroundTitle()) s.title = apps->foregroundTitle();
    if (battery->estimator().hasReading()) s.batteryPercent = battery->estimator().percent();
    s.clock = clockService->displayTime();
-    auto storageState = storage->state();
+    auto storageState = storageService->state();
    s.sdPresent = storageState.present;
    s.sdLevel = storageState.level;
    s.compose = keyMapper.pendingCompose();
+    s.unread = irc->totalUnread();
+    if (gnssService && gnssService->on()) {
+        const auto& g = gnssService->state();
+        bool fresh = gnssService->receiving(millis());
+        s.gnss = !fresh || g.fix == gnss::FixType::None ? StatusInfo::Gnss::Searching
+                 : g.fix == gnss::FixType::TwoD        ? StatusInfo::Gnss::TwoD
+                                                       : StatusInfo::Gnss::ThreeD;
+        s.gnssSatellites = g.satellitesUsed;
+        s.tracking = gnssService->tracking();
+    }
+    using WifiState = WifiController::State;
+    switch (wifi->state()) {
+        case WifiState::Connected: {
+            s.wifi = StatusInfo::Wifi::Connected;
+            int rssi = wifi->rssi();
+            s.wifiBars = rssi >= -60 ? 3 : rssi >= -70 ? 2 : rssi >= -80 ? 1 : 0;
+            break;
+        }
+        case WifiState::Monitoring: s.wifi = StatusInfo::Wifi::Monitoring; break;
+        case WifiState::Off: s.wifi = StatusInfo::Wifi::None; break;
+        default: s.wifi = StatusInfo::Wifi::Searching; break;
+    }
    return s;
 }

+// Arduino-ESP32 marks a new image valid before setup() unless this returns true. Probation
+// (UpdateService::tick) decides instead, and an unconfirmed image stays PENDING_VERIFY.
+extern "C" bool verifyRollbackLater() { return true; }  // C linkage, or the weak default wins
+
+// The main loop's stack: Arduino's default is 8 KB; the measured peak is 3 KB (M2).
+size_t getArduinoLoopTaskStackSize() { return 6144; }
+
+static void setupSafeMode(int crashes);
+
 void setup() {
+    nvs.begin();
+    UpdateService::bootGuard(nvs);  // first: before anything that could crash on new firmware
+    int crashes = crash_report::noteBoot(nvs);
+    safeMode = SafeMode::active(crashes);
+    Serial.setRxBufferSize(2 * FileReceiver::kChunk);  // before the port opens; sd put sends 1 chunk at a time
+    Serial.setTxBufferSize(1024);  // the console skips Serial when it's full: room for a burst like `tasks`
+
    auto cfg = M5.config();
    M5Cardputer.begin(cfg, true);
    M5Cardputer.Display.setRotation(1);
    Serial.begin(115200);

-    nvs.begin();
    settings.load();
+    if (safeMode) return setupSafeMode(crashes);

    battery = new BatteryService(bus);
-    storage = new StorageService(bus);
+    storageService = new StorageService(bus);
    power = new PowerService(settings);
    clockService = new ClockService(settings, bus);
+    gnssService = new GnssService(settings, *clockService, *storageService, bus);
+    savedNetworks = new SavedNetworks(nvs);
+    savedNetworks->load();
+    wifi = new WifiService(settings, *savedNetworks, *clockService);
+    update = new UpdateService(nvs, *wifi, *savedNetworks, *storageService, bus, settings);
+    irc = new IrcService(nvs, "roro_" + identity::defaultShortName(), *wifi, *storageService, *clockService, bus);
    notifier = new Notifier(bus, settings);
    notifier->onShow = [](uint32_t now, uint32_t until) { power->onNotification(now, until); };
    services.add(*power);
    services.add(*clockService);
    services.add(*battery);
-    services.add(*storage);
+    services.add(*gnssService);
+    services.add(*storageService);
+    services.add(*wifi);
+    services.add(*irc);
+    services.add(*update);
+#ifdef RORO_DEBUG
+    debugConsole = new DebugConsole(*wifi, *storageService);
+    services.add(*debugConsole);
+#endif

    apps = new AppManager(launcher);
    launcher.setManager(*apps);
+    apps->registerApp({"irc", "IRC", false, new IrcApp(*irc, *clockService, bus)});
+    apps->registerApp({"wifi-tools", "Wi-Fi Tools", false, new WifiToolsApp(*wifi, *storageService, *clockService)});
+    apps->registerApp({"gnss", "GNSS", false, new GnssApp(*gnssService, settings)});
    apps->registerApp({"settings", "Settings", false,
-                       new SettingsApp({settings, bus, *apps, *battery, *storage, *clockService})});
+                       new SettingsApp({settings, bus, *apps, *battery, *storageService, *clockService, *wifi, *savedNetworks, *update})});
    apps->registerApp({"demo", "Widget demo", true, new DemoApp(bus)});
    apps->registerApp({"setup", "Setup", true, new SetupApp(settings, *apps)});

-    bus.subscribe(EventType::Notification, [](const Event& e) { Serial.printf("notification: %s\n", e.text); });
+    bus.subscribe(EventType::Notification, [](const Event& e) { console.printf("notification: %s\n", e.text); });

-    if (!screen.begin()) Serial.println("frame buffer allocation failed");
+    if (!screen.begin()) console.println("frame buffer allocation failed");
+#ifdef RORO_DEBUG
+    debugConsole->setFrame(screen.canvas());  // for `screenshot`
+#endif
    services.startAll(millis());
    apps->begin();
    if (!settings.getBool(Setting::SetupDone)) apps->openModal("setup");
-    Serial.printf("%s %s ready, free heap %u\n", kProductName, versionString(), ESP.getFreeHeap());
+    console.printf("%s %s ready, free heap %u, last start: %s\n", kProductName, versionString(), ESP.getFreeHeap(),
+                   system_info::resetReason());
+    if (system_info::resetWasCrash()) {
+        crash_report::print(console, nvs);
+        bus.publish(Event::withText(EventType::Notification, crash_report::headline().c_str(),
+                                    static_cast<int32_t>(NotificationLevel::Warning)));
+    }
+    // A main loop stuck for 5 s panics (and leaves a core dump) instead of hanging forever: Arduino
+    // only watches the idle task on core 0, and the loop runs on core 1.
+    enableLoopWDT();
+}
+
+// Safe Mode: Wi-Fi, the clock, Firmware Updates and (in a Debug Build) the Debug Console. No Apps,
+// no IRC, no SD card: whatever crashed three times in a row is most likely among them.
+static void setupSafeMode(int crashes) {
+    clockService = new ClockService(settings, bus);
+    savedNetworks = new SavedNetworks(nvs);
+    savedNetworks->load();
+    wifi = new WifiService(settings, *savedNetworks, *clockService);
+    storageService = new StorageService(bus);  // never started: no card access
+    update = new UpdateService(nvs, *wifi, *savedNetworks, *storageService, bus, settings);
+    services.add(*clockService);
+    services.add(*wifi);
+    services.add(*update);
+#ifdef RORO_DEBUG
+    debugConsole = new DebugConsole(*wifi, *storageService);
+    services.add(*debugConsole);
+#endif
+    bus.subscribe(EventType::Notification, [](const Event& e) { console.printf("notification: %s\n", e.text); });
+    screen.begin();
+#ifdef RORO_DEBUG
+    debugConsole->setFrame(screen.canvas());
+#endif
+    services.startAll(millis());
+    console.printf("%s %s in SAFE MODE: %d crash restarts in a row. Only Wi-Fi and Firmware Updates run.\n",
+                   kProductName, versionString(), crashes);
+    crash_report::print(console, nvs);
+    enableLoopWDT();
+}
+
+// Dev aid: commands to drive the UI without the keyboard, from the serial port or the Debug Console.
+static bool listingWanted = false;
+
+static void printListingWhenReady() {
+    if (!listingWanted || !storageService->listingReady()) return;
+    listingWanted = false;
+    auto listing = storageService->listing();
+    for (size_t i = 0; i < listing.size(); i++) {
+        uint64_t bytes = 0;
+        for (auto& f : listing[i]) bytes += f.bytes;
+        console.printf("sd list: %-20s %u files, %s\n", kCleanupCategories[i].label, (unsigned)listing[i].size(),
+                       formatBytes(bytes).c_str());
+        for (auto& f : listing[i]) console.printf("  %s (%u B)\n", f.path.c_str(), (unsigned)f.bytes);
+    }
+}
+
+// sd put: a file sent over serial by scripts/sd_put.py. The main loop reads the bytes; every card
+// access runs as a Storage Service job, which reports back through uploadResult.
+static FileReceiver upload;
+static std::atomic<int> uploadResult{-1};  // set by a job: 1 ok, 0 failed; -1 nothing new
+static bool uploadJobRunning = false;
+
+static void uploadJob(std::function<bool()> job) {
+    uploadJobRunning = true;
+    storageService->runJob([job]() { uploadResult = job() ? 1 : 0; });
+}
+
+static void startUpload(const String& args) {
+    if (upload.active() || uploadJobRunning) return (void)Serial.println("sd put: error busy");
+    std::string error = upload.begin(args.c_str(), millis());
+    StorageState card = storageService->state();
+    if (error.empty() && !card.present) error = "no SD card";
+    if (error.empty() && card.totalBytes - card.usedBytes < upload.size() + 64 * 1024) error = "not enough space";
+    if (!error.empty()) {
+        upload.reset();
+        return (void)Serial.printf("sd put: error %s\n", error.c_str());
+    }
+    std::string part = upload.partPath();
+    uploadJob([part]() {
+        for (size_t slash = part.find('/', 1); slash != std::string::npos; slash = part.find('/', slash + 1)) {
+            std::string dir = part.substr(0, slash);
+            if (!SD.exists(dir.c_str()) && !SD.mkdir(dir.c_str())) return false;
+        }
+        if (SD.exists(part.c_str())) SD.remove(part.c_str());
+        return true;
+    });
+}
+
+static void readUploadBytes() {
+    uint8_t buf[256];
+    size_t want;
+    while (!uploadJobRunning && (want = std::min(upload.wanted(), sizeof buf)) > 0 && Serial.available() > 0) {
+        size_t n = Serial.read(buf, std::min<size_t>(want, Serial.available()));
+        upload.feed(buf, n, millis());
+    }
+}
+
+static void uploadStep() {
+    using S = FileReceiver::State;
+    uint32_t now = millis();
+    int result = uploadResult.exchange(-1);
+    if (result >= 0) {
+        uploadJobRunning = false;
+        bool ok = result == 1;
+        switch (upload.state()) {
+            case S::Receiving:  // the folder job from startUpload: the sender may start
+                if (ok) Serial.printf("sd put: ready %u\n", (unsigned)FileReceiver::kChunk);
+                else {
+                    upload.reset();
+                    return (void)Serial.println("sd put: error card not writable");
+                }
+                break;
+            case S::Writing:
+                upload.chunkWritten(ok, now);
+                if (upload.state() == S::Receiving) Serial.printf("sd put: ok %u\n", (unsigned)upload.received());
+                break;
+            case S::Finishing: upload.finished(ok); break;
+            default: break;  // a job that finished after the transfer failed
+        }
+    }
+    if (!upload.active()) return;
+    upload.tick(now);
+    std::string path = upload.path(), part = upload.partPath();
+    if (upload.state() == S::Failed) {
+        // Reported even if a job never came back (no card: the storage task drops it).
+        Serial.printf("sd put: error %s\n", upload.error().c_str());
+        storageService->runJob([part]() { SD.remove(part.c_str()); });
+        upload.reset();
+        uploadJobRunning = false;
+        return;
+    }
+    if (uploadJobRunning) return;
+    if (upload.state() == S::Writing) {
+        auto chunk = std::make_shared<std::vector<uint8_t>>(upload.chunk());
+        uploadJob([chunk, part]() {
+            File f = SD.open(part.c_str(), FILE_APPEND);
+            bool ok = f && f.write(chunk->data(), chunk->size()) == chunk->size();
+            if (f) f.close();
+            return ok;
+        });
+    } else if (upload.state() == S::Finishing) {
+        uploadJob([path, part]() {
+            if (SD.exists(path.c_str())) SD.remove(path.c_str());
+            return SD.rename(part.c_str(), path.c_str());
+        });
+    } else if (upload.state() == S::Done) {
+        Serial.printf("sd put: done %s %u B\n", path.c_str(), (unsigned)upload.size());
+        upload.reset();
+    }
+}
+
+static const char* const kHelp =
+    "info              firmware, uptime, memory, Wi-Fi, app slots\n"
+    "tasks             FreeRTOS tasks: state, priority, free stack, CPU\n"
+    "reboot            restart\n"
+    "boot other        restart into the other app slot (manual Rollback)\n"
+    "log level <0-5>   ESP-IDF log level (0 none ... 5 verbose)\n"
+    "gnss status | gnss restart | gnss track start|stop | gnss nmea on|off | gnss send <sentence without $ and checksum>\n"
+    "crash             the last crash: firmware, reason, task, backtrace\n"
+    "coredump erase    forget the core dump in flash\n"
+    "key <name|char>   press a key: up down left right select back home del tab, or one character\n"
+    "wifi status | wifi add <ssid><TAB><password>\n"
+    "irc start | irc stop | irc dump | irc say <buffer> <text>\n"
+    "ls [folder] | rm <path> | install <path.ota> (Update from SD)\n"
+    "sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
+#ifdef RORO_DEBUG
+    "crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)\n"
+    "coredump get      (Debug Console only) send the raw core dump: use scripts/rdbg.py coredump\n"
+    "reset             (Debug Console only) restart at once, even if the main loop is stuck\n"
+    "get <path> | put <path> <size> <sha256> | screenshot   (Debug Console only) binary, see rdbg.py\n"
+    "quit              close the Debug Console connection\n"
+#endif
+    ;
+
+// Commands that only touch what Safe Mode starts.
+static bool safeModeCommand(const String& line) {
+    return line == "help" || line == "info" || line == "tasks" || line == "reboot" || line == "boot other" ||
+           line.startsWith("log level ") || line.startsWith("crash") || line.startsWith("coredump") ||
+           line == "wifi status" || line.startsWith("wifi add ");
+}
+
+static void runCommand(String line) {
+    line.trim();
+    if (line.isEmpty()) return;
+    if (safeMode && !safeModeCommand(line)) return (void)console.println("not available in Safe Mode");
+    if (line == "help") console.print(kHelp);
+    if (line == "info") {
+        system_info::printSystem(console);
+        console.printf("wifi: %s, ip %s, rssi %d | sd: %s\n", wifi->ssid().c_str(), wifi->ip().c_str(), wifi->rssi(),
+                       storageService->state().present ? "present" : "none");
+        console.printf("update: %s\n", update->onProbation() ? "on probation" : "confirmed");
+        system_info::printSlots(console, nvs);
+    }
+    if (line == "tasks") system_info::printTasks(console);
+    if (line == "reboot") {
+        console.println("restarting");
+        delay(300);
+        ESP.restart();
+    }
+    if (line == "boot other") console.printf("boot other: %s\n", system_info::bootOtherSlot());
+    if (line.startsWith("log level ")) {
+        int level = line.substring(10).toInt();
+        esp_log_level_set("*", static_cast<esp_log_level_t>(constrain(level, 0, 5)));
+        console.printf("log level: %d\n", constrain(level, 0, 5));
+    }
+    if (line == "ls" || line.startsWith("ls ") || line.startsWith("rm ")) {
+        if (!storageService->state().present) return (void)console.println("sd: no card");
+        bool list = !line.startsWith("rm ");
+        std::string path = line.length() > 3 ? line.substring(3).c_str() : "/";
+        storageService->runJob([list, path]() {  // card access stays on the storage task
+            if (!list) return (void)console.printf("rm: %s %s\n", path.c_str(), SD.remove(path.c_str()) ? "removed" : "failed");
+            File dir = SD.open(path.c_str());
+            if (!dir || !dir.isDirectory()) return (void)console.printf("ls: %s is not a folder\n", path.c_str());
+            for (File f = dir.openNextFile(); f; f = dir.openNextFile())
+                console.printf("%10u  %s%s\n", f.isDirectory() ? 0u : (unsigned)f.size(), f.name(), f.isDirectory() ? "/" : "");
+            console.printf("ls: end of %s\n", path.c_str());
+        });
+    }
+    if (line.startsWith("install ")) update->installFromSd(line.substring(8).c_str());  // Update from SD
+    if (line == "gnss status" && gnssService) gnssService->printStatus(console, millis());
+    if ((line == "gnss nmea on" || line == "gnss nmea off") && gnssService) gnssService->setEcho(line.endsWith("on"));
+    if (line == "gnss restart" && gnssService) gnssService->restart(millis());
+    if (line == "gnss track start" && gnssService) {
+        std::string why = gnssService->startTrack(millis());
+        console.printf("gnss track: %s\n", why.empty() ? "recording" : why.c_str());
+    }
+    if (line == "gnss track stop" && gnssService) gnssService->stopTrack();
+    if (line.startsWith("gnss send ") && gnssService)  // the checksum is added
+        console.println(gnssService->send(line.substring(10).c_str()) ? "gnss: sent" : "gnss: off");
+    if (line == "crash") crash_report::print(console, nvs);
+    if (line == "coredump erase") console.println(crash_report::erase() ? "coredump: erased" : "coredump: nothing to erase");
+#ifdef RORO_DEBUG
+    if (line == "crash abort") abort();
+    if (line == "crash wdt")
+        for (;;) {}  // the main loop never yields: the task watchdog fires
+#endif
+    if (line == "burst")
+        for (int i = 1; i <= 5; i++)
+            bus.publish(Event::withText(EventType::Notification, ("Burst " + String(i)).c_str(), 0));
+    if (line.startsWith("key ")) {  // key up|down|left|right|select|back|home|del|tab
+        String k = line.substring(4);
+        Key key = k == "up" ? Key::Up : k == "down" ? Key::Down : k == "left" ? Key::Left
+                : k == "right" ? Key::Right : k == "back" ? Key::Back : k == "home" ? Key::Home
+                : k == "del" ? Key::Delete : k == "tab" ? Key::Tab : Key::Select;
+        KeyEvent ev = k.length() == 1 && k[0] > ' ' ? KeyEvent::character((unsigned char)k[0]) : KeyEvent::of(key);
+        if (!power->onKey(millis())) apps->handleKey(ev);
+    }
+    if (line.startsWith("wifi add ")) {  // wifi add <ssid>\t<password>: credentials never touch the repo
+        int tab = line.indexOf('\t');
+        std::string ssid = (tab > 0 ? line.substring(9, tab) : line.substring(9)).c_str();
+        std::string pass = tab > 0 ? line.substring(tab + 1).c_str() : "";
+        std::string error = savedNetworks->add(ssid, pass);
+        console.printf("wifi add: %s\n", error.empty() ? "ok" : error.c_str());
+        wifi->savedNetworksChanged();
+    }
+    if (line.startsWith("log ") && !line.startsWith("log level ")) {  // appends to a test IRC Log
+        std::string path = storage::dailyLogPath({"irc", "dev", "#test"}, clockService->localDate());
+        storageService->appendLine(path, clockService->displayTime() + " " + line.substring(4).c_str());
+        console.printf("log: queued to %s\n", path.c_str());
+    }
+    if (line.startsWith("cat ")) {
+        std::string path = line.substring(4).c_str();
+        File f = SD.open(path.c_str());
+        if (!f) console.printf("cat: cannot open %s\n", path.c_str());
+        else {
+            console.printf("--- %s (%u B) ---\n", path.c_str(), (unsigned)f.size());
+            int shown = 0;
+            while (f.available() && shown < 1200) { console.write(f.read()); shown++; }
+            console.println("\n--- end ---");
+            f.close();
+        }
+    }
+    if (line.startsWith("sd put ")) startUpload(line.substring(7));  // then raw bytes: see uploadStep()
+    if (line == "sd list") {
+        storageService->requestListing();
+        listingWanted = true;
+    }
+    if (line == "irc start") irc->connect();
+    if (line == "irc stop") irc->disconnect();
+    if (line.startsWith("irc say ")) {  // irc say <buffer index> <text>
+        String rest = line.substring(8);
+        int space = rest.indexOf(' ');
+        int b = rest.substring(0, space).toInt();
+        std::string text = rest.substring(space + 1).c_str();
+        irc->withSession([&](IrcSession& s) { s.input(b, text, clockService->utcNow()); });
+    }
+    if (line == "irc dump") {
+        console.printf("irc: status %d, unread %d, heap %u min %u\n", (int)irc->status(), irc->totalUnread(),
+                       ESP.getFreeHeap(), ESP.getMinFreeHeap());
+        IrcConfig c = irc->draftConfig();  // which login is configured, never the secrets
+        console.printf("irc: nick %s, sasl %s, nickserv %s, autojoin %u channels\n", c.nick.c_str(),
+                       c.saslUser.empty() || c.saslPassword.empty() ? "off" : "on",
+                       c.nickservPassword.empty() ? "off" : "on", (unsigned)c.autojoin.size());
+        irc->withSession([](IrcSession& s) {
+            for (int i = 0; i < s.bufferCount(); i++) {
+                const auto& b = s.buffer(i);
+                console.printf("irc buffer %d %s unread %d%s\n", i, b.name.c_str(), b.unread, b.joined ? " joined" : "");
+                size_t from = 0;
+                for (size_t j = from; j < b.lines.size(); j++)
+                    console.printf("   <%s> %s\n", b.lines[j].nick.c_str(), b.lines[j].text.c_str());
+            }
+        });
+    }
+    if (line == "wifi status")
+        console.printf("wifi: state %d ssid '%s' rssi %d ip %s clock %s heap %u min %u | fw %s%s\n",
+                       (int)wifi->state(), wifi->ssid().c_str(), wifi->rssi(), wifi->ip().c_str(),
+                       clockService->displayTime().c_str(), ESP.getFreeHeap(), ESP.getMinFreeHeap(), versionString(),
+                       update->onProbation() ? " (on probation)" : "");
+    if (line == "sound off") settings.setBool(Setting::Sound, false);
+    if (line == "sound on") settings.setBool(Setting::Sound, true);
+    if (line == "short") {
+        settings.setInt(Setting::DimTimeoutS, 5);
+        settings.setInt(Setting::OffTimeoutS, 10);
+    }
+    if (line == "normal") {
+        settings.setInt(Setting::OffTimeoutS, 60);
+        settings.setInt(Setting::DimTimeoutS, 30);
+    }
 }

-// Dev aid: serial commands to drive the UI without the keyboard.
 static void serialCommands() {
+    if (upload.active()) return readUploadBytes();  // raw file bytes, not commands
    static String line;
    while (Serial.available()) {
        char c = Serial.read();
@@ -110,36 +514,66 @@ static void serialCommands() {
            line += c;
            continue;
        }
-        line.trim();
-        if (line == "burst")
-            for (int i = 1; i <= 5; i++)
-                bus.publish(Event::withText(EventType::Notification, ("Burst " + String(i)).c_str(), 0));
-        if (line.startsWith("key ")) {  // key up|down|left|right|select|back|home
-            String k = line.substring(4);
-            Key key = k == "up" ? Key::Up : k == "down" ? Key::Down : k == "left" ? Key::Left
-                    : k == "right" ? Key::Right : k == "back" ? Key::Back : k == "home" ? Key::Home : Key::Select;
-            if (!power->onKey(millis())) apps->handleKey(KeyEvent::of(key));
-        }
-        if (line == "sound off") settings.setBool(Setting::Sound, false);
-        if (line == "sound on") settings.setBool(Setting::Sound, true);
-        if (line == "short") {
-            settings.setInt(Setting::DimTimeoutS, 5);
-            settings.setInt(Setting::OffTimeoutS, 10);
-        }
-        if (line == "normal") {
-            settings.setInt(Setting::OffTimeoutS, 60);
-            settings.setInt(Setting::DimTimeoutS, 30);
-        }
+        runCommand(line);
        line = "";
    }
 }

+static void remoteCommands() {
+#ifdef RORO_DEBUG
+    for (std::string remote; debugConsole->takeCommand(remote);) {
+        console.printf("> %s\n", remote.c_str());  // so the transcript reads the same on both ends
+        runCommand(remote.c_str());
+    }
+#endif
+}
+
+// After a minute up, the crash streak is over (SafeMode counts starts that crash in a row).
+static void noteStableOnce(uint32_t now) {
+    static bool noted = false;
+    if (noted || now < SafeMode::kStableAfterMs) return;
+    noted = true;
+    crash_report::noteStable(nvs);
+}
+
+static void loopSafeMode() {
+    uint32_t now = millis();
+    serialCommands();
+    remoteCommands();
+    services.tick(now);
+    bus.dispatch();
+    noteStableOnce(now);
+    if (update->phase() == UpdateService::Phase::Installed) {
+        screen.renderUpdate("Restarting", "into " + update->incomingVersion(), -1);
+        delay(800);
+        ESP.restart();
+    }
+    static uint32_t lastDraw = 0;
+    if (update->phase() == UpdateService::Phase::Receiving) {
+        screen.renderUpdate("Firmware update", "Receiving " + update->incomingVersion(), update->percent());
+    } else if (now - lastDraw > 2000 || !lastDraw) {
+        lastDraw = now;
+        bool up = wifi->state() == WifiController::State::Connected;
+        screen.renderUpdate("Safe Mode", up ? "Updates: " + wifi->ip() + ":3232" : "Waiting for Wi-Fi", -1);
+    }
+    delay(10);
+}
+
 void loop() {
+    if (safeMode) return loopSafeMode();
+#ifdef RORO_TEST_CRASH
+    // Test builds only (never in a release): crash during Probation to exercise Rollback.
+    if (millis() > 5000) abort();
+#endif
    static StatusInfo lastStatus;
    static uint32_t lastLog = 0;
    uint32_t now = millis();

    serialCommands();
+    remoteCommands();
+    noteStableOnce(now);
+    uploadStep();
+    printListingWhenReady();
    M5Cardputer.update();
    if (M5Cardputer.Keyboard.isChange()) {
        bool swallow = M5Cardputer.Keyboard.isPressed() && power->onKey(now);  // only woke the screen
@@ -156,15 +590,43 @@ void loop() {

    if (now - lastLog > 10000) {
        lastLog = now;
-        Serial.printf("status: heap %u min %u\n", ESP.getFreeHeap(), ESP.getMinFreeHeap());
+        console.printf("status: heap %u min %u\n", ESP.getFreeHeap(), ESP.getMinFreeHeap());
+    }
+
+    // Firmware Update: its progress takes over the screen, then the device restarts when it's safe.
+    static int shownPercent = -1;
+    static uint32_t installedAt = 0;
+    static bool redrawAfterUpdate = false;
+    switch (update->phase()) {
+        case UpdateService::Phase::Receiving:
+            if (update->percent() != shownPercent) {
+                shownPercent = update->percent();
+                screen.renderUpdate("Firmware update", "Receiving " + update->incomingVersion(), shownPercent);
+            }
+            redrawAfterUpdate = true;
+            return;
+        case UpdateService::Phase::Installed:
+            if (!installedAt) installedAt = now;
+            // Don't pull the rug out from under someone typing, for up to a minute.
+            if (!apps->foreground().textEntryActive() || now - installedAt >= 60000) {
+                screen.renderUpdate("Restarting", "into " + update->incomingVersion(), -1);
+                delay(800);
+                ESP.restart();
+            }
+            break;
+        default:
+            shownPercent = -1;
+            break;
    }

    if (power->screen() == ScreenState::Off) return;
    StatusInfo status = currentStatus();
    const Toast* toast = notifier->toasts().current(now);
    bool toastChanged = notifier->toasts().takeChanged();
-    if (apps->takeRedraw() || toastChanged || status != lastStatus) {
+    if (apps->takeRedraw() || toastChanged || status != lastStatus || redrawAfterUpdate) {
        lastStatus = status;
+        redrawAfterUpdate = false;
        screen.render(*apps, status, toast);
+        update->firstFrameDrawn();
    }
 }
@@ -0,0 +1,86 @@
+#include "platform/console.h"
+
+#include <Arduino.h>
+
+#ifdef RORO_DEBUG
+#include <esp_log.h>
+#include <freertos/FreeRTOS.h>
+
+#include <algorithm>
+#include <cstdio>
+#endif
+
+namespace roro {
+
+Console console;
+
+#ifdef RORO_DEBUG
+namespace {
+
+// Any task may write (ESP-IDF logs come from everywhere), so the ring is behind a spinlock, held
+// only for the copy.
+portMUX_TYPE ringLock = portMUX_INITIALIZER_UNLOCKED;
+vprintf_like_t espLogNext = nullptr;
+
+int teeEspLog(const char* format, va_list args) {
+    char line[200];
+    va_list copy;
+    va_copy(copy, args);
+    int n = vsnprintf(line, sizeof line, format, copy);
+    va_end(copy);
+    if (n > 0) console.toRing(reinterpret_cast<const uint8_t*>(line), std::min<size_t>(n, sizeof line - 1));
+    return espLogNext ? espLogNext(format, args) : n;  // the serial port, as before
+}
+
+}  // namespace
+
+void Console::captureEspLogs() { espLogNext = esp_log_set_vprintf(teeEspLog); }
+
+void Console::toRing(const uint8_t* data, size_t len) {
+    if (len > kRingBytes) {
+        data += len - kRingBytes;  // only the tail can fit
+        len = kRingBytes;
+    }
+    portENTER_CRITICAL(&ringLock);
+    size_t at = head_ % kRingBytes;
+    size_t first = std::min(len, kRingBytes - at);
+    memcpy(ring_ + at, data, first);
+    memcpy(ring_, data + first, len - first);
+    head_ += len;
+    portEXIT_CRITICAL(&ringLock);
+}
+
+uint32_t Console::oldest() const {
+    portENTER_CRITICAL(&ringLock);
+    uint32_t pos = head_ > kRingBytes ? head_ - kRingBytes : 0;
+    portEXIT_CRITICAL(&ringLock);
+    return pos;
+}
+
+size_t Console::readSince(uint32_t& pos, uint8_t* out, size_t max, uint32_t& skipped) {
+    portENTER_CRITICAL(&ringLock);
+    uint32_t from = head_ > kRingBytes ? head_ - kRingBytes : 0;
+    skipped = pos < from ? from - pos : 0;
+    if (pos < from) pos = from;
+    size_t n = std::min<size_t>(max, head_ - pos);
+    size_t at = pos % kRingBytes;
+    size_t first = std::min(n, kRingBytes - at);
+    memcpy(out, ring_ + at, first);
+    memcpy(out + first, ring_, n - first);
+    pos += n;
+    portEXIT_CRITICAL(&ringLock);
+    return n;
+}
+#endif
+
+size_t Console::write(const uint8_t* data, size_t len) {
+#ifdef RORO_DEBUG
+    toRing(data, len);
+#endif
+    // Never wait for the USB host. One that's attached but not reading (a VM, a closed terminal)
+    // would stall the caller for up to 2 s per write while HWCDC retries; the ring keeps it anyway.
+    if (Serial.availableForWrite() >= static_cast<int>(len)) Serial.write(data, len);
+    return len;
+}
+
+}  // namespace roro
@@ -0,0 +1,40 @@
+#pragma once
+
+#include <Print.h>
+
+#include <cstddef>
+#include <cstdint>
+
+namespace roro {
+
+// Where the firmware's console output goes: the USB serial port, and in a Debug Build also a ring
+// buffer the Debug Console sends over Wi-Fi (with what came before the connection, so boot messages
+// aren't lost). Use `console` instead of Serial for anything a human should be able to read remotely.
+class Console : public Print {
+   public:
+    size_t write(uint8_t c) override { return write(&c, 1); }
+    size_t write(const uint8_t* data, size_t len) override;
+    using Print::write;
+
+#ifdef RORO_DEBUG
+    static constexpr size_t kRingBytes = 4096;
+
+    // Also copies ESP-IDF's own log lines into the ring (they still reach the serial port).
+    void captureEspLogs();
+    // Copies bytes written since `pos` into `out`, and advances `pos`. A reader that fell more than
+    // the ring behind gets the oldest bytes still there, and `skipped` says how many it missed.
+    size_t readSince(uint32_t& pos, uint8_t* out, size_t max, uint32_t& skipped);
+    // The position of the oldest byte still in the ring: a new reader starts there.
+    uint32_t oldest() const;
+    // The ring only, for output that already reaches the serial port another way.
+    void toRing(const uint8_t* data, size_t len);
+
+   private:
+    uint8_t ring_[kRingBytes];
+    uint32_t head_ = 0;  // total bytes ever written; the ring holds the last kRingBytes of them
+#endif
+};
+
+extern Console console;
+
+}  // namespace roro
@@ -0,0 +1,66 @@
+#include "platform/crash_report.h"
+
+#include <esp_core_dump.h>
+
+#include "platform/system_info.h"
+#include "safe_mode.h"
+#include "version.h"
+
+namespace roro::crash_report {
+
+int noteBoot(KeyValueStore& store) {
+    bool crashed = system_info::resetWasCrash();
+    std::string last;
+    store.getString("run_ver", last);
+    if (crashed) {
+        store.putString("crash_ver", last.empty() ? versionString() : last);
+        store.putString("crash_why", system_info::resetReason());
+    }
+    if (last != versionString()) store.putString("run_ver", versionString());
+
+    int32_t before = 0;
+    store.getInt("crash_boots", before);
+    int now = SafeMode::countAtBoot(crashed, before);
+    if (now != before) store.putInt("crash_boots", now);
+    return now;
+}
+
+void noteStable(KeyValueStore& store) {
+    int32_t n = 0;
+    if (store.getInt("crash_boots", n) && n != 0) store.putInt("crash_boots", 0);
+}
+
+void print(Print& out, KeyValueStore& store) {
+    std::string version, why;
+    store.getString("crash_ver", version);
+    store.getString("crash_why", why);
+    if (version.empty()) out.println("crash: none recorded");
+    else out.printf("crash: last one in %s (%s)\n", version.c_str(), why.c_str());
+
+    esp_core_dump_summary_t sum;
+    if (esp_core_dump_image_check() != ESP_OK || esp_core_dump_get_summary(&sum) != ESP_OK) {
+        out.println("crash: no core dump in flash");
+        return;
+    }
+    char reason[160] = "";
+    esp_core_dump_get_panic_reason(reason, sizeof reason);
+    out.printf("crash: task %s, pc 0x%08lx, cause %lu, address 0x%08lx\n", sum.exc_task, (unsigned long)sum.exc_pc,
+               (unsigned long)sum.ex_info.exc_cause, (unsigned long)sum.ex_info.exc_vaddr);
+    if (reason[0]) out.printf("crash: reason: %s\n", reason);
+    out.print("crash: backtrace");
+    for (uint32_t i = 0; i < sum.exc_bt_info.depth && i < 16; i++) out.printf(" 0x%08lx", (unsigned long)sum.exc_bt_info.bt[i]);
+    out.println(sum.exc_bt_info.corrupted ? " (corrupted)" : "");
+    out.printf("crash: elf sha256 %s\n", reinterpret_cast<const char*>(sum.app_elf_sha256));
+}
+
+std::string headline() {
+    esp_core_dump_summary_t sum;
+    std::string where = "";
+    if (esp_core_dump_image_check() == ESP_OK && esp_core_dump_get_summary(&sum) == ESP_OK)
+        where = std::string(" in ") + sum.exc_task;
+    return std::string("Restarted after a ") + system_info::resetReason() + where;
+}
+
+bool erase() { return esp_core_dump_image_erase() == ESP_OK; }
+
+}  // namespace roro::crash_report
@@ -0,0 +1,26 @@
+#pragma once
+
+#include <Print.h>
+
+#include <string>
+
+#include "key_value_store.h"
+
+namespace roro::crash_report {
+
+// First thing at boot: remembers which version runs, and after a crash restart, which version
+// crashed (the one that ran last time, even if a Rollback has switched slots since). Returns how
+// many starts in a row ended in a crash, for Safe Mode.
+int noteBoot(KeyValueStore& store);
+// The device has been up long enough: the crash streak is over.
+void noteStable(KeyValueStore& store);
+
+// The last crash: which firmware, why, and the task, PC and backtrace from the core dump in flash.
+// Decode the backtrace on the PC with scripts/decode_backtrace.sh <version> <addresses>.
+void print(Print& out, KeyValueStore& store);
+// One line for a Notification after a crash restart, e.g. "Restarted after a crash in loopTask".
+std::string headline();
+// Forgets the core dump, so the next crash's is the one kept.
+bool erase();
+
+}  // namespace roro::crash_report
@@ -0,0 +1,44 @@
+#include "ota_device.h"
+
+#include <cstring>
+
+#include "ota_public_key.h"
+
+namespace roro {
+
+EcdsaVerifier::EcdsaVerifier() {
+    mbedtls_pk_init(&key_);
+    // PEM parsing wants the terminating NUL counted in the length.
+    ready_ = mbedtls_pk_parse_public_key(&key_, reinterpret_cast<const unsigned char*>(kOtaPublicKeyPem),
+                                         std::strlen(kOtaPublicKeyPem) + 1) == 0;
+}
+
+EcdsaVerifier::~EcdsaVerifier() { mbedtls_pk_free(&key_); }
+
+bool EcdsaVerifier::verify(const uint8_t digest[32], const uint8_t* signature, size_t len) {
+    return ready_ && mbedtls_pk_verify(&key_, MBEDTLS_MD_SHA256, digest, 32, signature, len) == 0;
+}
+
+bool EspOtaSink::begin(size_t imageSize) {
+    if (!slot_) return false;
+    open_ = esp_ota_begin(slot_, imageSize, &handle_) == ESP_OK;
+    return open_;
+}
+
+bool EspOtaSink::write(const uint8_t* data, size_t len) {
+    return open_ && esp_ota_write(handle_, data, len) == ESP_OK;
+}
+
+bool EspOtaSink::finish() {
+    if (!open_) return false;
+    open_ = false;
+    // esp_ota_end() also validates the image structure (segments, checksum) for this chip.
+    return esp_ota_end(handle_) == ESP_OK && esp_ota_set_boot_partition(slot_) == ESP_OK;
+}
+
+void EspOtaSink::abort() {
+    if (open_) esp_ota_abort(handle_);
+    open_ = false;
+}
+
+}  // namespace roro
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <esp_ota_ops.h>
+#include <mbedtls/pk.h>
+
+#include "update_parser.h"
+
+namespace roro {
+
+// Checks Update File signatures against the public key compiled into the firmware (ADR 0003).
+class EcdsaVerifier : public SignatureVerifier {
+   public:
+    EcdsaVerifier();
+    ~EcdsaVerifier() override;
+    bool verify(const uint8_t digest[32], const uint8_t* signature, size_t len) override;
+
+   private:
+    mbedtls_pk_context key_;
+    bool ready_ = false;
+};
+
+// Writes the image to the app slot that isn't running, and makes it the next boot on finish().
+class EspOtaSink : public UpdateSink {
+   public:
+    EspOtaSink() : slot_(esp_ota_get_next_update_partition(nullptr)) {}
+    size_t capacity() const { return slot_ ? slot_->size : 0; }
+    bool begin(size_t imageSize) override;
+    bool write(const uint8_t* data, size_t len) override;
+    bool finish() override;
+    void abort() override;
+
+   private:
+    const esp_partition_t* slot_;
+    esp_ota_handle_t handle_ = 0;
+    bool open_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,12 @@
+#pragma once
+
+// Public key that Firmware Updates must be signed for (ECDSA P-256). Generated by
+// scripts/ota_keygen.sh; the private key is not in this repository (ADR 0003).
+namespace roro {
+inline constexpr char kOtaPublicKeyPem[] =
+    "-----BEGIN PUBLIC KEY-----\n"
+    "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIWzT07fvTpQxWjTdewMipYH6f42+\n"
+    "mM8niHm+T8y+Mvjanb3H8hpYXg3VjuJGFtcHw/hFX0Q2f2AiSHMF0DhMbQ==\n"
+    "-----END PUBLIC KEY-----\n"
+    ;
+}  // namespace roro
@@ -0,0 +1,118 @@
+#include "platform/system_info.h"
+
+#include <Arduino.h>
+#include <esp_heap_caps.h>
+#include <esp_ota_ops.h>
+#include <esp_system.h>
+#include <freertos/FreeRTOS.h>
+#include <freertos/task.h>
+
+#include <string>
+#include <vector>
+
+#include "version.h"
+
+namespace roro::system_info {
+
+const char* resetReason() {
+    switch (esp_reset_reason()) {
+        case ESP_RST_POWERON: return "power-on";
+        case ESP_RST_EXT: return "reset pin";
+        case ESP_RST_SW: return "restart";
+        case ESP_RST_PANIC: return "panic";
+        case ESP_RST_INT_WDT: return "interrupt watchdog";
+        case ESP_RST_TASK_WDT: return "task watchdog";
+        case ESP_RST_WDT: return "watchdog";
+        case ESP_RST_DEEPSLEEP: return "deep sleep";
+        case ESP_RST_BROWNOUT: return "brownout";
+        case ESP_RST_SDIO: return "sdio";
+        case ESP_RST_USB: return "usb";
+        case ESP_RST_JTAG: return "jtag";
+        default: return "unknown";
+    }
+}
+
+bool resetWasCrash() {
+    switch (esp_reset_reason()) {
+        case ESP_RST_PANIC:
+        case ESP_RST_INT_WDT:
+        case ESP_RST_TASK_WDT:
+        case ESP_RST_WDT: return true;
+        default: return false;
+    }
+}
+
+static const char* stateName(esp_ota_img_states_t s) {
+    switch (s) {
+        case ESP_OTA_IMG_NEW: return "new";
+        case ESP_OTA_IMG_PENDING_VERIFY: return "pending verify";
+        case ESP_OTA_IMG_VALID: return "valid";
+        case ESP_OTA_IMG_INVALID: return "invalid";
+        case ESP_OTA_IMG_ABORTED: return "aborted";
+        default: return "undefined";
+    }
+}
+
+void printSystem(Print& out) {
+    uint32_t s = millis() / 1000;
+    out.printf("firmware: %s %s\n", kProductName, versionString());
+    out.printf("uptime: %luh%02lum%02lus, last start: %s\n", (unsigned long)(s / 3600), (unsigned long)(s / 60 % 60),
+               (unsigned long)(s % 60), resetReason());
+    out.printf("heap: %u free, %u lowest, %u largest block\n", ESP.getFreeHeap(), ESP.getMinFreeHeap(),
+               (unsigned)heap_caps_get_largest_free_block(MALLOC_CAP_8BIT));
+    out.printf("chip: %s rev %d, %lu MHz, %.1f C\n", ESP.getChipModel(), ESP.getChipRevision(),
+               (unsigned long)ESP.getCpuFreqMHz(), temperatureRead());
+}
+
+static std::string slotKey(const esp_partition_t* slot) { return std::string("ver_") + slot->label; }
+
+void recordSlotVersion(KeyValueStore& store, const esp_partition_t* slot, const char* version) {
+    std::string known;
+    if (slot && !(store.getString(slotKey(slot).c_str(), known) && known == version))
+        store.putString(slotKey(slot).c_str(), version);
+}
+
+void printSlots(Print& out, KeyValueStore& store) {
+    const esp_partition_t* running = esp_ota_get_running_partition();
+    const esp_partition_t* next = esp_ota_get_boot_partition();
+    esp_partition_iterator_t it = esp_partition_find(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, nullptr);
+    for (; it; it = esp_partition_next(it)) {  // the last next() releases the iterator
+        const esp_partition_t* p = esp_partition_get(it);
+        esp_app_desc_t desc;
+        bool hasApp = esp_ota_get_partition_description(p, &desc) == ESP_OK;
+        std::string version = "(unknown version)";
+        store.getString(slotKey(p).c_str(), version);
+        esp_ota_img_states_t state;
+        bool hasState = esp_ota_get_state_partition(p, &state) == ESP_OK;
+        out.printf("slot %s: %s%s%s, %s\n", p->label, hasApp ? version.c_str() : "(empty)", p == running ? ", running" : "",
+                   p == next ? ", boots next" : "", hasState ? stateName(state) : "no OTA state");
+    }
+}
+
+void printTasks(Print& out) {
+    UBaseType_t n = uxTaskGetNumberOfTasks();
+    std::vector<TaskStatus_t> tasks(n + 4);
+    uint32_t total = 0;
+    n = uxTaskGetSystemState(tasks.data(), tasks.size(), &total);
+    out.printf("%-16s %-4s %3s %6s %5s %s\n", "task", "st", "pri", "stack", "cpu%", "core");
+    static const char kStates[] = "RrBSD";  // running, ready, blocked, suspended, deleted
+    for (UBaseType_t i = 0; i < n; i++) {
+        const TaskStatus_t& t = tasks[i];
+        unsigned cpu = total ? (unsigned)((uint64_t)t.ulRunTimeCounter * 100 / total) : 0;
+        int core = t.xCoreID == tskNO_AFFINITY ? -1 : (int)t.xCoreID;
+        out.printf("%-16s %-4c %3u %6u %5u %d\n", t.pcTaskName, t.eCurrentState < 5 ? kStates[t.eCurrentState] : '?',
+                   (unsigned)t.uxCurrentPriority, (unsigned)t.usStackHighWaterMark, cpu, core);
+    }
+}
+
+const char* bootOtherSlot() {
+    const esp_partition_t* other = esp_ota_get_next_update_partition(nullptr);
+    esp_app_desc_t desc;
+    if (!other || esp_ota_get_partition_description(other, &desc) != ESP_OK) return "the other slot is empty";
+    if (esp_ota_set_boot_partition(other) != ESP_OK) return "the other slot doesn't hold a valid image";
+    delay(200);
+    esp_restart();
+    return "";
+}
+
+}  // namespace roro::system_info
@@ -0,0 +1,29 @@
+#pragma once
+
+#include <Print.h>
+#include <esp_partition.h>
+
+#include "key_value_store.h"
+
+namespace roro::system_info {
+
+// Why the chip last started: "power-on", "panic", "task watchdog", "brownout"...
+const char* resetReason();
+// True if the last start was a crash or a watchdog, not a power-on or a deliberate restart.
+bool resetWasCrash();
+
+// Firmware, uptime and memory, one fact per line.
+void printSystem(Print& out);
+// Both app slots: which one runs, which boots next, and each one's version and OTA state. Versions
+// come from NVS ("ver_<slot>"): the prebuilt framework stamps every image with its own version.
+void printSlots(Print& out, KeyValueStore& store);
+// Remembers which version the running slot holds (call at boot), or the slot an update just wrote.
+void recordSlotVersion(KeyValueStore& store, const esp_partition_t* slot, const char* version);
+// FreeRTOS tasks: state, priority, lowest free stack, CPU share since boot.
+void printTasks(Print& out);
+
+// Boots the firmware in the other app slot if it holds a valid image (a manual Rollback).
+// Returns an error message; on success it restarts and doesn't return.
+const char* bootOtherSlot();
+
+}  // namespace roro::system_info
@@ -23,6 +23,14 @@ class ClockService : public Service {
    bool set(int64_t utcSeconds, TimeSource source) { return model_.set(utcSeconds, source, millis()); }
    const ClockModel& model() const { return model_; }

+    // UTC seconds, or -1 if the clock isn't set.
+    int64_t utcNow() const { return model_.isSet() ? model_.utcNow(millis()) : -1; }
+
+    // Local "YYYY-MM-DD" once set; otherwise empty (Logs then go to undated files).
+    std::string localDate() const { return model_.isSet() ? ClockModel::formatLocalDate(model_.utcNow(millis())) : ""; }
+    // Days since 1970-01-01 (UTC), or -1 if the clock isn't set.
+    int today() const { return model_.isSet() ? static_cast<int>(model_.utcNow(millis()) / 86400) : -1; }
+
    // "14:05" once set; otherwise "--:--".
    std::string displayTime() const {
        return model_.isSet() ? ClockModel::formatLocalTime(model_.utcNow(millis())) : "--:--";
@@ -0,0 +1,308 @@
+#ifdef RORO_DEBUG
+
+#include "services/debug_console.h"
+
+#include <WiFi.h>
+
+#include <algorithm>
+#include <esp_core_dump.h>
+#include <esp_flash.h>
+
+#include <SD.h>
+#include <unistd.h>
+
+#include <atomic>
+#include <memory>
+
+#include "file_receiver.h"
+#include "platform/console.h"
+#include "version.h"
+
+namespace roro {
+
+namespace {
+
+constexpr uint32_t kAuthTimeoutMs = 10000;
+constexpr size_t kMaxLine = 240;
+constexpr size_t kMaxQueued = 8;
+
+// Compares without stopping at the first difference, so timing says nothing about the token.
+bool sameToken(const std::string& a, const char* b) {
+    size_t n = strlen(b);
+    uint8_t diff = a.size() != n;
+    for (size_t i = 0; i < n; i++) diff |= (i < a.size() ? a[i] : 0) ^ b[i];
+    return diff == 0;
+}
+
+// Reads one line (without its \r\n) within `timeoutMs`; false on a timeout, a drop or an overlong line.
+bool readLine(NetworkClient& c, std::string& line, uint32_t timeoutMs) {
+    line.clear();
+    uint32_t since = millis();
+    while (c.connected() && millis() - since < timeoutMs) {
+        int ch = c.read();
+        if (ch < 0) {
+            delay(10);
+            continue;
+        }
+        if (ch == '\n') {
+            if (!line.empty() && line.back() == '\r') line.pop_back();
+            return true;
+        }
+        if (line.size() >= kMaxLine) return false;
+        line += static_cast<char>(ch);
+    }
+    return false;
+}
+
+// The raw core dump partition contents, as esp-coredump reads them ("-t raw").
+void sendCoreDump(NetworkClient& client) {
+    size_t addr = 0, size = 0;
+    if (esp_core_dump_image_check() != ESP_OK || esp_core_dump_image_get(&addr, &size) != ESP_OK) {
+        client.print("coredump: none\n");
+        return;
+    }
+    client.printf("coredump: data %u\n", (unsigned)size);
+    uint8_t buf[1024];
+    for (size_t off = 0; off < size;) {
+        size_t n = std::min(sizeof buf, size - off);
+        if (esp_flash_read(nullptr, buf, addr + off, n) != ESP_OK) break;  // the host sees a short file
+        if (client.write(buf, n) != n) return;
+        off += n;
+    }
+    client.print("coredump: end\n");
+}
+
+}  // namespace
+
+DebugConsole::DebugConsole(WifiService& wifi, StorageService& storage)
+    : wifi_(wifi), storage_(storage), lock_(xSemaphoreCreateMutex()) {}
+
+void DebugConsole::start() {
+    console.captureEspLogs();
+    if (!task_) xTaskCreate(taskEntry, "debug", 6144, this, 1, &task_);
+}
+
+bool DebugConsole::takeCommand(std::string& line) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    bool any = !commands_.empty();
+    if (any) {
+        line = std::move(commands_.front());
+        commands_.pop_front();
+    }
+    xSemaphoreGive(lock_);
+    return any;
+}
+
+void DebugConsole::taskEntry(void* self) { static_cast<DebugConsole*>(self)->listen(); }
+
+void DebugConsole::listen() {
+    NetworkServer server(kPort);
+    bool listening = false;
+    for (;;) {
+        bool up = wifi_.state() == WifiController::State::Connected;
+        if (up && !listening) {
+            server.begin();
+            listening = true;
+        } else if (!up && listening) {
+            server.end();
+            listening = false;
+        }
+        if (listening) {
+            NetworkClient client = server.accept();
+            if (client) {
+                client.setNoDelay(true);
+                if (authenticate(client)) serve(client);
+                client.stop();
+            }
+        }
+        vTaskDelay(pdMS_TO_TICKS(200));
+    }
+}
+
+bool DebugConsole::authenticate(NetworkClient& client) {
+    std::string token;
+    if (readLine(client, token, kAuthTimeoutMs) && sameToken(token, RORO_DEBUG_TOKEN)) return true;
+    console.printf("debug: refused a client from %s\n", client.remoteIP().toString().c_str());
+    delay(1000);  // no quick retries
+    client.print("denied\n");
+    return false;
+}
+
+void DebugConsole::serve(NetworkClient& client) {
+    console.printf("debug: client %s connected\n", client.remoteIP().toString().c_str());
+    client.printf("%s %s debug console. 'help' lists the commands. Backlog follows.\n", kProductName, versionString());
+    connected_ = true;
+    uint32_t pos = console.oldest();
+    uint8_t buf[512];
+    std::string line;
+    while (client.connected()) {
+        // Console output since last time, including the replies to this client's commands.
+        uint32_t skipped = 0;
+        size_t n;
+        while ((n = console.readSince(pos, buf, sizeof buf, skipped)) > 0) {
+            if (skipped) client.printf("\n[... %u bytes lost: the console ran faster than the network]\n", (unsigned)skipped);
+            if (client.write(buf, n) != n) break;
+        }
+        // Commands, one line at a time.
+        while (client.available()) {
+            int ch = client.read();
+            if (ch == '\r') continue;
+            if (ch != '\n') {
+                if (line.size() < kMaxLine) line += static_cast<char>(ch);
+                continue;
+            }
+            if (line == "quit" || line == "exit") {
+                client.stop();
+                break;
+            }
+            if (binaryCommand(client, line)) {
+                line.clear();
+                continue;
+            }
+            xSemaphoreTake(lock_, portMAX_DELAY);
+            bool full = commands_.size() >= kMaxQueued;
+            if (!full && !line.empty()) commands_.push_back(line);
+            xSemaphoreGive(lock_);
+            if (full) client.print("debug: busy, command dropped\n");
+            line.clear();
+        }
+        vTaskDelay(pdMS_TO_TICKS(20));
+    }
+    connected_ = false;
+    console.println("debug: client disconnected");
+}
+
+bool DebugConsole::binaryCommand(NetworkClient& client, const std::string& line) {
+    if (line == "reset") {  // works even when the main loop is stuck
+        client.print("debug: restarting now\n");
+        client.flush();
+        delay(200);
+        esp_restart();
+    }
+    if (line == "coredump get") sendCoreDump(client);
+    else if (line.rfind("get ", 0) == 0) get(client, line.substr(4));
+    else if (line.rfind("put ", 0) == 0) put(client, line.substr(4));
+    else if (line == "screenshot") screenshot(client);
+    else return false;
+    return true;
+}
+
+bool DebugConsole::onStorage(std::function<void()> job) {
+    // Shared with the job, which outlives this wait if the card is missing and it never starts.
+    // Exactly one side wins the state change: the job (Queued -> Running) or the wait giving up
+    // (Queued -> Abandoned), so an abandoned job can never touch this stack frame.
+    enum : int { Queued, Running, Abandoned };
+    struct Run {
+        std::atomic<int> state{Queued};
+        SemaphoreHandle_t done = xSemaphoreCreateBinary();
+        ~Run() { vSemaphoreDelete(done); }
+    };
+    auto run = std::make_shared<Run>();
+    storage_.runJob([run, job]() {
+        int expected = Queued;
+        if (!run->state.compare_exchange_strong(expected, Running)) return;
+        job();
+        xSemaphoreGive(run->done);
+    });
+    for (int waited = 0; xSemaphoreTake(run->done, pdMS_TO_TICKS(500)) != pdTRUE; waited += 500) {
+        int expected = Queued;
+        if (waited >= 5000 && run->state.compare_exchange_strong(expected, Abandoned)) return false;
+    }
+    return true;
+}
+
+void DebugConsole::get(NetworkClient& client, const std::string& path) {
+    bool ran = onStorage([&]() {
+        File f = SD.open(path.c_str());
+        if (!f || f.isDirectory()) return (void)client.printf("get: error cannot open %s\n", path.c_str());
+        size_t size = f.size();
+        client.printf("get: data %u\n", (unsigned)size);
+        uint8_t buf[1024];
+        for (size_t sent = 0; sent < size;) {
+            int n = f.read(buf, std::min(sizeof buf, size - sent));
+            if (n <= 0 || client.write(buf, n) != static_cast<size_t>(n)) break;  // the host sees it short
+            sent += n;
+        }
+        f.close();
+        client.print("get: end\n");
+    });
+    if (!ran) client.print("get: error no SD card\n");
+}
+
+// The same checks as `sd put` over serial (FileReceiver), but TCP does the flow control, so the
+// file is written in one job with the file kept open.
+void DebugConsole::put(NetworkClient& client, const std::string& args) {
+    FileReceiver r;
+    std::string error = r.begin(args, millis());
+    StorageState card = storage_.state();
+    if (error.empty() && !card.present) error = "no SD card";
+    if (error.empty() && card.totalBytes - card.usedBytes < r.size() + 64 * 1024) error = "not enough space";
+    if (!error.empty()) return (void)client.printf("put: error %s\n", error.c_str());
+
+    bool ran = onStorage([&]() {
+        std::string part = r.partPath();
+        for (size_t slash = part.find('/', 1); slash != std::string::npos; slash = part.find('/', slash + 1)) {
+            std::string dir = part.substr(0, slash);
+            if (!SD.exists(dir.c_str())) SD.mkdir(dir.c_str());
+        }
+        File f = SD.open(part.c_str(), FILE_WRITE);
+        if (!f) return (void)client.print("put: error card not writable\n");
+        client.printf("put: ready %u\n", (unsigned)r.size());
+        uint8_t buf[1024];
+        using S = FileReceiver::State;
+        while (r.state() == S::Receiving || r.state() == S::Writing) {
+            if (r.state() == S::Writing) {
+                const auto& c = r.chunk();
+                bool ok = f.write(c.data(), c.size()) == c.size();
+                // A card can fail one write and take the next. FATFS keeps a failed file in error,
+                // so: close, cut back to the last good byte, reopen, try again.
+                for (int retry = 1; !ok && retry <= 3; retry++) {
+                    console.printf("put: write failed at %u, retry %d\n", (unsigned)r.received(), retry);
+                    f.close();
+                    delay(50 * retry);
+                    truncate(("/sd" + part).c_str(), r.received());
+                    f = SD.open(part.c_str(), FILE_APPEND);
+                    ok = f && f.size() == r.received() && f.write(c.data(), c.size()) == c.size();
+                }
+                r.chunkWritten(ok, millis());
+                continue;
+            }
+            int n = client.read(buf, std::min(sizeof buf, r.wanted()));
+            if (n > 0) r.feed(buf, n, millis());
+            else if (!client.connected()) break;
+            else {
+                delay(2);
+                r.tick(millis());
+            }
+        }
+        f.close();
+        if (r.state() == S::Finishing) {
+            if (SD.exists(r.path().c_str())) SD.remove(r.path().c_str());
+            r.finished(SD.rename(part.c_str(), r.path().c_str()));
+        }
+        if (r.state() == S::Done) client.printf("put: done %s %u B\n", r.path().c_str(), (unsigned)r.size());
+        else {
+            SD.remove(part.c_str());
+            client.printf("put: error %s\n", r.error().empty() ? "connection lost" : r.error().c_str());
+            // The rest of the file is still on its way: never read it as commands.
+            client.flush();
+            client.stop();
+        }
+    });
+    if (!ran) client.print("put: error no SD card\n");
+}
+
+// The frame as composed off-screen (RGB332, one byte a pixel). Read while the UI may be drawing,
+// so it can tear; it's for looking, not for pixel-exact tests.
+void DebugConsole::screenshot(NetworkClient& client) {
+    const uint8_t* pixels = frame_ ? static_cast<const uint8_t*>(frame_->getBuffer()) : nullptr;
+    if (!pixels) return (void)client.print("screenshot: error no frame\n");
+    int w = frame_->width(), h = frame_->height();
+    client.printf("screenshot: rgb332 %d %d\n", w, h);
+    for (int y = 0; y < h; y += 16) client.write(pixels + y * w, w * std::min(16, h - y));
+    client.print("screenshot: end\n");
+}
+
+}  // namespace roro
+
+#endif
@@ -0,0 +1,67 @@
+#pragma once
+
+#ifdef RORO_DEBUG
+
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+
+#include <deque>
+#include <functional>
+#include <string>
+
+#include "service.h"
+#include "services/storage_service.h"
+#include "services/wifi_service.h"
+#include "ui/canvas.h"
+
+class NetworkClient;
+
+namespace roro {
+
+// Debug Builds only (ADR 0004): the console over Wi-Fi, on TCP 2323 while Wi-Fi is Connected. A
+// client sends the debug token as its first line, then gets the recent console backlog, every new
+// console line, and runs the same commands as the serial port. One client at a time.
+//
+// The socket lives on this Service's own task; commands are handed to the main loop (takeCommand),
+// which runs them where touching Apps and Services is safe. Their output reaches the client
+// through the console ring like everything else.
+class DebugConsole : public Service {
+   public:
+    static constexpr uint16_t kPort = 2323;
+
+    DebugConsole(WifiService& wifi, StorageService& storage);
+    // The off-screen frame the UI composes into: `screenshot` sends it as it stands.
+    void setFrame(Canvas& frame) { frame_ = &frame; }
+    const char* name() const override { return "debug"; }
+    void start() override;
+
+    // The next command line a client sent, for the main loop to run.
+    bool takeCommand(std::string& line);
+    bool clientConnected() const { return connected_; }
+
+   private:
+    static void taskEntry(void* self);
+    void listen();
+    void serve(::NetworkClient& client);
+    bool authenticate(::NetworkClient& client);
+    // Binary commands, answered on this task: true if `line` was one.
+    bool binaryCommand(::NetworkClient& client, const std::string& line);
+    // Runs `job` on the storage task (where card access is safe) and waits for it. False if the
+    // card isn't mounted, in which case the storage task never runs it.
+    bool onStorage(std::function<void()> job);
+    void get(::NetworkClient& client, const std::string& path);
+    void put(::NetworkClient& client, const std::string& args);
+    void screenshot(::NetworkClient& client);
+
+    WifiService& wifi_;
+    StorageService& storage_;
+    Canvas* frame_ = nullptr;
+    TaskHandle_t task_ = nullptr;
+    SemaphoreHandle_t lock_;
+    std::deque<std::string> commands_;
+    volatile bool connected_ = false;
+};
+
+}  // namespace roro
+
+#endif
--- a/Show More
+++ b/Show More