M3 done: the listening hour heard nothing; a reference node is needed for M4

Outside, on battery, an hour on LongFast with a Capture running: 0 packets, 0 headers. The noise is no lower than at the desk and its peaks follow the device, so about 15 dB of the floor is the Cardputer's own (issue #20). With IRC on TLS and the radio listening, 52.6 KB free. One "Done when" item is half met: Sweep was never tried against a known transmitter. The card's refused writes are issue #21. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT
M3 step 5: Sweep, the band's signal strength as bars and a waterfall
2026-10-05 21:40:30 +02:00 · 2026-10-05 20:28:46 +02:00 · 2026-10-05 20:14:58 +02:00 · 2026-10-05 19:49:46 +02:00 · 2026-10-05 19:19:52 +02:00 · 2026-10-05 19:13:25 +02:00
122 changed files with 9887 additions and 127 deletions
@@ -1,3 +1,11 @@
 .pio/
 .vscode/
 *.pyc
+
+# Private signing keys never belong in the repository (ADR 0003)
+*key.pem
+
+# Generated by pioarduino's hybrid compile from custom_sdkconfig (platformio.ini)
+.dummy/
+managed_components/
+sdkconfig.*
@@ -20,6 +20,10 @@ _Avoid_: daemon, task, driver
 The Service that keeps the device participating in a mesh network at all times: receiving, relaying, and sending on behalf of Apps.
 _Avoid_: radio, LoRa app

+**Radio Service**:
+The Service that owns the LoRa radio on the Cap: it configures it, shares the SPI bus with the SD card, and receives in the background. The LoRa Scanner uses it directly; the Mesh Service sits on top of it.
+_Avoid_: LoRa driver, modem
+
 **Mesh Protocol**:
 One on-air language the Mesh Service can speak (Meshtastic first; others may follow). The Mesh Service speaks Mesh Protocols; Apps don't.
 _Avoid_: stack, mode
@@ -40,6 +44,26 @@ _Avoid_: DM (in docs), private message
 Rebroadcasting another Node's packet so it travels further across the mesh.
 _Avoid_: forwarding, repeating

+**Capsule**:
+A Gemini site: everything served by one host on Geminispace.
+_Avoid_: site, server (when the content is meant)
+
+**Saved Page**:
+A Gemini page kept on the SD card to read offline, with the URL it came from and when it was saved. Kept until the user deletes it; Storage Clean-up never offers it.
+_Avoid_: cache, download (a download is a non-text file saved from Gemini)
+
+**GNSS Service**:
+The Service that owns the GNSS receiver on the Cap: it reads its NMEA sentences in the background and holds the current Fix, position, time and satellites.
+_Avoid_: GPS (GPS is one constellation among several)
+
+**Fix**:
+What the receiver currently knows: none, 2D (position without altitude) or 3D (with altitude), from how many satellites, at what HDOP.
+_Avoid_: lock, signal
+
+**Track**:
+A route recorded from GNSS positions to a GPX file on the SD card, started and stopped by the user.
+_Avoid_: trace, log (a Log is recorded on its own)
+
 **Wi-Fi Service**:
 The Service that owns the Wi-Fi radio. It's always in exactly one mode: *Off*, *Connected* (joined to a Saved Network) or *Monitoring* (passively observing). When Wi-Fi is enabled in Settings, it stays Connected whenever a Saved Network is in range. It goes Monitoring only while Wi-Fi Tools needs it, then reconnects.
 _Avoid_: network manager
@@ -49,7 +73,7 @@ A Wi-Fi network the device may join on its own (name, password). When several ar
 _Avoid_: profile, known network

 **IRC Service**:
-The Service that keeps the IRC connection alive in the background once the IRC App has started it, until the user disconnects. It reconnects after drops, and pauses while the Wi-Fi Service is Monitoring. It does not start by itself after a reboot.
+The Service that keeps the IRC connection alive in the background once the IRC App has started it, until the user stops it (`/quit`, or `irc stop` on the console). Once stopped by hand, opening the App again doesn't reconnect; typing a line does. It reconnects after drops, and pauses while the Wi-Fi Service is Monitoring. It does not start by itself after a reboot.
 _Avoid_: IRC client (that's the App)

 **Buffer**:
@@ -104,6 +128,34 @@ The Notification raised once per boot when the SD card passes 80% full. Selectin
 **Storage Clean-up**:
 The screen where the user deletes old Logs and Captures by category and age, with a preview of the space freed. Notes are never offered for deletion.

+**Firmware Update**:
+Installing a new firmware image without a USB cable: pushed over Wi-Fi from the developer's PC, or read from the SD card.
+_Avoid_: flash, upgrade (alone)
+
+**Update File**:
+One signed file (`.ota`) that carries a firmware version, its image and a signature. The same file works over Wi-Fi and from the SD card. Anything not signed with the project's key is refused.
+_Avoid_: binary, bin
+
+**Probation**:
+The state of newly installed firmware until it proves healthy: booted, UI drawn, Services started, 30 s without a crash, and Wi-Fi connected if it's configured. Then it's confirmed for good.
+_Avoid_: trial, test mode
+
+**Rollback**:
+Returning automatically to the previous firmware when new firmware resets or crashes during Probation.
+_Avoid_: revert, downgrade (a downgrade is installing an older version on purpose)
+
+**Safe Mode**:
+What the firmware starts instead of everything else after 3 crash restarts in a row: Wi-Fi and Firmware Updates (and the Debug Console in a Debug Build), so it can be fixed without a cable. A normal restart leaves it.
+_Avoid_: recovery mode, failsafe
+
+**Debug Build**:
+A firmware built with the remote debugging aids compiled in (`+debug` in its version). Release builds have none of them.
+_Avoid_: dev build, test build (a test build is one made to fail on purpose, such as a crashing update)
+
+**Debug Console**:
+The console of a Debug Build over Wi-Fi: live log lines and the serial commands, behind a token.
+_Avoid_: telnet, remote shell
+
 ## Relationships

 - The **Launcher** starts **Apps**. Exactly one **App** is in the foreground.
@@ -111,9 +163,12 @@ The screen where the user deletes old Logs and Captures by category and age, wit
 - The **Mesh Service** speaks one or more **Mesh Protocols** and tracks the known **Nodes**.
 - The **Wi-Fi Service** is either Connected or Monitoring, never both. Monitoring pauses the **IRC Service**, which reconnects and rejoins its **Buffers** afterwards.
 - **Services** raise **Notifications**; the **Status Bar** summarises **Service** state.
+- The **Radio Service** owns the radio; the **Mesh Service** and the LoRa Scanner use it.
 - A **Sweep** pauses the **Mesh Service**; a **Sniffer** does not.
 - Every transmission is bounded by the **Region** and its **Duty Cycle Budget**.
 - Past 90% SD usage, **Logs** stop being written; the remaining space is kept for **Captures**. Nothing is deleted without the user's confirmation.
+- A **Firmware Update** installs an **Update File**; the new firmware runs on **Probation**, and fails back by **Rollback**.
+- **Rollback** covers new firmware; **Safe Mode** covers confirmed firmware that keeps crashing.
 - A **Node** may be in several **Channels**. A **Direct Message** targets exactly one **Node**.

 ## Flagged ambiguities
@@ -18,6 +18,8 @@ scripts/ci.sh

 This runs the host-side unit tests (`test/`, `native` environment), then builds the firmware. The output is `.pio/build/cardputer-adv/firmware.factory.bin`.

+The framework is rebuilt with the TLS settings in `platformio.ini` (`custom_sdkconfig`, ADR 0006), so the first build after a fresh checkout takes about 4 minutes; later builds take under a minute.
+
 ## Flash

 1. Connect the Cardputer by USB-C.
@@ -37,6 +39,31 @@ This runs the host-side unit tests (`test/`, `native` environment), then builds
 sudo usermod -aG dialout "$USER"
 ```

+## Firmware Updates over Wi-Fi (OTA)
+
+Once the Cardputer runs an OTA-capable firmware (flashed once over USB), updates can go over Wi-Fi:
+
+```sh
+scripts/ota_keygen.sh                  # once: creates the signing key (see ADR 0003)
+scripts/flash.sh --ota 10.39.39.12     # build, sign and push; or set RORO_OTA_HOST
+```
+
+The device shows the push address in **Settings → Firmware**. It installs a correctly signed update right away, restarts (waiting up to 60 s if you're typing), and runs the new firmware on **Probation**. If the new firmware crashes, or can't reconnect Wi-Fi within 3 minutes, it rolls back to the previous one and says so.
+
+To install from the SD card instead, copy the `.ota` file from `.pio/build/cardputer-adv/` into `/updates` on the card, then use **Settings → Firmware**. With the Cardputer on USB, the card can stay in: `scripts/sd_put.sh <file.ota>` sends it over the serial console into `/updates` (about 30 s for 1.6 MB, checked with SHA-256 before it's renamed into place; `SD_PUT_DEBUG=1` shows the console while it runs).
+
+**The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB.
+
+## Gemini
+
+The Gemini App browses Geminispace (docs/milestones/G1.md): Tab and Shift+Tab pick a link, Enter follows it, Back returns (to where the page was scrolled), Space pages down, `g` types an address. Certificates are trusted on first use; a changed one stops the page and asks.
+
+On a page, `b` bookmarks it, `s` saves it to the SD card to read offline (a non-text file goes to `/gemini/downloads/`), `S` saves it with the pages it links to on the same capsule (up to 30). The start page lists bookmarks and Saved Pages; inside a Saved Page, `r` refreshes it and `d` deletes it. With a card, every page streams through `/gemini/cache/` so a large one arrives whole even with IRC connected; what doesn't fit in memory stays on the card.
+
+## LoRa Scanner
+
+The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **never transmits**. The Sniffer lists what it hears, newest first: time, RSSI, SNR, and for Meshtastic packets the sender and receiver (their last 4 hex digits) and hops. Enter shows a packet's details: the Meshtastic header (which is never encrypted) and a hex dump. `p` picks one of the 7 Meshtastic presets allowed in EU868 (LongFast by default), `c` starts or stops a Capture: a pcap file with LoRaTap headers in `/captures/lora/`, for Wireshark. A Capture keeps recording with the App closed; otherwise the radio sleeps when the App isn't open. Tab switches to **Sweep**: the signal strength across 863–870 MHz in 100 kHz steps, as bars with peak hold and a waterfall, with the Sniffer's frequency marked; the Sniffer is paused meanwhile and picks up where it was. The Status Bar shows `L` while the radio listens (bright for a moment on each packet), `SW` while sweeping, and `CAP` while capturing.
+
 ## Development aids

 `scripts/serial_log.sh [seconds] [command…]` records the serial output, and can send commands to the firmware first. For example, `scripts/serial_log.sh 30 short sleep:12 burst` sets short screen timeouts, waits 12 s, then sends a burst of Toasts.
@@ -52,8 +79,55 @@ sudo usermod -aG dialout "$USER"
 | `sd list` | Lists the files of each Storage Clean-up category |
 | `cat <path>` | Prints the first ~1.2 KB of a file on the SD card |
 | `irc start` | Starts the IRC Service (normally done by opening the IRC App) |
+| `irc stop` | Stops it, as `/quit` does: QUIT if connected, no more retries, and the App stays disconnected until you type |
+| `gemini get <url>` | Fetches a Gemini page and prints its header, size, certificate fingerprint and heap use |
+| `gemini trust <host> <port> <sha256>` | Pins a certificate by hand (the Gemini App asks when one changes) |
 | `irc say <buffer> <text>` | Types into a Buffer, commands included (`irc say 0 /join #test`) |
 | `irc dump` | Prints IRC status, memory, and the last lines of each Buffer |
 | `wifi status` | Prints Wi-Fi state, network, signal, clock and free heap |
+| `info` | Firmware, uptime, last start reason, memory, Wi-Fi, and both app slots with their versions and OTA states |
+| `tasks` | FreeRTOS tasks: state, priority, lowest free stack, CPU share |
+| `reboot` / `boot other` | Restart, or restart into the other app slot (a manual Rollback) |
+| `log level <0-5>` | ESP-IDF log level |
+| `ls [folder]` / `rm <path>` | Lists a folder of the SD card, or deletes a file |
+| `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
+| `lora probe` | Finds the radio: chip, oscillator, antenna switch, DIO1 interrupt, noise floor |
+| `lora status` | Radio settings, who's listening, packet and error counters, noise floor, task stack |
+| `lora rx on` / `lora rx off` | Listens and prints each packet on the console |
+| `lora preset <name>` / `lora custom <MHz> <BW kHz> <SF> <CR> <sync hex> [preamble]` | Receive settings: a Meshtastic preset, or anything else (`lora custom 868.1 125 7 5 34 8` for LoRaWAN) |
+| `lora capture start` / `lora capture stop` | A LoRa Capture, as `c` in the App |
+| `lora sweep on [from MHz] [to MHz] [step kHz]` / `lora sweep off` / `lora sweep dump` | Sweep a band (863 870 100 by default), with a summary every 2 s (floor, strongest, peaks), or print the latest pass |
+| `lora inject <hex> [rssi] [snr]` | Debug Builds: a packet into the Scanner as if received (nothing is sent) |
+| `crash` | The last crash: which firmware, why, task, PC and backtrace (from the core dump in flash) |
+| `coredump erase` | Forgets the core dump |
+| `crash abort` / `crash wdt` | Debug Builds: crash on purpose, or hang the main loop until the watchdog fires |
+| `help` | Lists the commands |

 `scripts/flash.sh` stops a running serial log first, since it would hold the port.
+
+### Debug Builds and the Debug Console
+
+`scripts/flash.sh --debug` (USB) or `scripts/flash.sh --debug --ota <ip>` (Wi-Fi) installs a Debug Build: the same firmware plus the Debug Console on TCP 2323 (ADR 0004). Then, with `RORO_OTA_HOST` set to the device's IP:
+
+```sh
+scripts/rdbg.py                 # interactive: the console backlog, live lines, and commands
+scripts/rdbg.py info            # one command and its reply
+scripts/rdbg.py -b tasks        # the same, after the backlog (boot messages and so on)
+```
+
+Every command above works there too, plus a few handled by the PC side or the console's own task:
+
+```sh
+scripts/rdbg.py crash           # the last crash, its backtrace decoded against that exact build's ELF
+scripts/rdbg.py coredump        # fetch the core dump and decode it all (registers, every task) with esp-coredump
+scripts/rdbg.py reset           # restart at once, even if the main loop is stuck
+scripts/rdbg.py screenshot      # the screen as a PNG (2x)
+scripts/rdbg.py put <file> [card path]    # to the SD card (default /updates/<name>), SHA-256 checked, ~300 KB/s
+scripts/rdbg.py get <card path> [file]    # from the SD card
+```
+
+So a Firmware Update can also go `rdbg.py put roro9stack-….ota` then `rdbg.py install /updates/roro9stack-….ota`: the Update from SD path, without touching the device.
+
+Every build keeps its ELF in `.pio/elves/` (version and digest in the name) for that; `scripts/decode_backtrace.sh <version|digest> <addresses>` decodes any backtrace by hand.
+
+After 3 crash restarts in a row the firmware starts in **Safe Mode** (ADR 0005): only Wi-Fi, Firmware Updates and the Debug Console, so a fix can be pushed as usual. `reboot` leaves it. The token is in `~/.config/roro9stack/debug-token`, made by the first build; keep developing on Debug Builds, so the firmware a Rollback returns to always has the console.
@@ -0,0 +1,7 @@
+# Name,   Type, SubType, Offset,  Size, Flags
+nvs,      data, nvs,     0x9000,  0x5000,
+otadata,  data, ota,     0xe000,  0x2000,
+app0,     app,  ota_0,   0x10000, 0x330000,
+app1,     app,  ota_1,   0x340000,0x330000,
+spiffs,   data, spiffs,  0x670000,0x180000,
+coredump, data, coredump,0x7F0000,0x10000,
@@ -9,3 +9,7 @@ A fork would give full compatibility on day one, but its architecture is built a
 - We accept partial Meshtastic compatibility at first: text on channels, Direct Messages, node list, position and relaying.
 - The phone-app (BLE) API and PKI-encrypted Direct Messages are deferred, and we must re-implement protocol details ourselves.
 - Multi-boot with stock Meshtastic via a launcher was rejected: it gives none of our own UX.
+
+## Note (2026-10-04, M2)
+
+NMEA is parsed by our own small, host-tested parser instead of TinyGPSPlus: the GNSS App's Sky view needs the satellite list (GSV) across several constellations, which TinyGPSPlus doesn't track. See docs/milestones/M2.md, Q66.
@@ -0,0 +1,12 @@
+# Signed Update Files checked by the firmware, not ESP32 Secure Boot
+
+Firmware Updates are accepted only when their Update File carries a valid ECDSA P-256 signature over the image's SHA-256. The firmware itself checks it, against a public key compiled into it, before switching the boot partition. The private key lives outside the repository, in `~/.config/roro9stack/ota-key.pem`.
+
+We chose this over the ESP32's hardware Secure Boot. Secure Boot is enforced by the chip, but it burns eFuses one-way: a mistake bricks the device, and the device can never run unsigned firmware again, which makes recovery over USB harder. On a single development device, a software check that refuses unsigned pushes is enough, and it stays reversible: a new firmware can carry a new public key.
+
+## Consequences
+
+- Someone with physical USB access can still flash anything. Only Wi-Fi and SD card updates are guarded.
+- **Losing the private key** means the next update has to go over USB, carrying a new public key.
+- P-256 rather than Ed25519, because the firmware's TLS library (mbedTLS) already verifies it, so it costs no extra code.
+- **Rollback: the bootloader first, the firmware as a second line.** Arduino-ESP32 marks a new image valid before `setup()` unless the sketch overrides `verifyRollbackLater()`, which once made every update look good and hid the bootloader's rollback (it had looked like the prebuilt bootloader ignored it). With the override, an image stays pending until Probation confirms it, and the bootloader reverts one that restarts unconfirmed, however early it crashes. The firmware also counts its own boots on Probation, very first thing in `setup()`, and reverts itself on the second unconfirmed start.
@@ -0,0 +1,23 @@
+# A Debug Console over Wi-Fi, in Debug Builds only
+
+The goal of Firmware Updates is to manage the device without a cable, and that includes finding out what went wrong. So a **Debug Build** (`cardputer-adv-debug`, `-DRORO_DEBUG`, version suffix `+debug`) adds a **Debug Console** on TCP 2323: the serial console, over Wi-Fi. A client sends a token as its first line, then gets the last 4 KB of console output (boot messages included), every new line live, and runs the same commands as the serial port, plus a few that only make sense remotely. ESP-IDF's own log lines are teed into it.
+
+It's compiled out of release builds entirely, rather than switched off by a setting. A console that runs commands is a remote control: in a release build, nothing listens.
+
+## How it fits
+
+- **Console, not Serial.** All human-readable output goes through `console`, which writes to the USB port and, in a Debug Build, to a ring buffer the Debug Console drains. Writes never wait for USB: a host that's attached but not reading used to stall the main loop for up to 2 s per line.
+- **Commands run on the main loop.** The socket lives on the Debug Console's own task, which only queues command lines. The main loop runs them, as it does serial commands, so they touch Apps and Services from the one task allowed to.
+- **The token** is 128 random bits in `~/.config/roro9stack/debug-token`, made by the first build and passed into the container. It's never committed; a Debug Build refuses to compile without one. Like the OTA key, it guards against the network, not against someone holding the device.
+- **One client at a time**, to keep memory flat (4 KB for the ring since M2, 6 KB of task stack).
+- **Binary commands are answered on the console's own task**, not queued: `get`/`put` (SD card files, run as one Storage Service job each so card access stays on the storage task, with TCP doing the flow control), `screenshot` (the 32 KB RGB332 frame the UI composes into, read as it stands, so it may tear), `coredump get` and `reset`. These keep working when the main loop is stuck. A failed `put` closes the connection, so the rest of the file is never read as commands.
+
+## Keep a Debug Build in the fallback slot
+
+Rollback returns to the previous firmware, whatever it is. As long as development goes through Debug Builds, the firmware a crash falls back to has the Debug Console, so a bad update never costs remote access. A release build pushed over a Debug Build leaves the Debug Build in the other slot until the next update overwrites it.
+
+## Consequences
+
+- Anyone on the same network with the token can read the console, inject keys and reboot the device. The console never prints stored secrets (Wi-Fi and IRC passwords), but the IRC traffic it shows is readable.
+- The TCP stream is plain text: fine on a home network, not across the internet.
+- `+debug` versions compare equal to their release counterparts, so moving between the two is never refused as a downgrade.
@@ -0,0 +1,13 @@
+# Safe Mode, crash reports and a watched main loop, in every build
+
+Rollback protects against new firmware that fails Probation. It does nothing for firmware that was confirmed and crashes later: a corrupt setting, a server that sends something unexpected, a bug that takes an hour to show. Without a cable, such a device would restart forever. Three measures, in release and Debug Builds alike, keep it reachable:
+
+- **Safe Mode.** The firmware counts starts that follow a crash (panic or watchdog) in NVS, first thing at boot. After 3 in a row, it starts only the clock, Wi-Fi, the Update Service and, in a Debug Build, the Debug Console: no Apps, no IRC, no SD card, and a screen that says so with the address to push an update to. Any normal restart (a `reboot`, an update), or a minute of uptime, resets the count.
+- **Crash reports.** The same boot record keeps which version was running, so after a crash the firmware knows which one crashed, even when a Rollback has switched slots since. ESP-IDF already writes a core dump to its flash partition on a panic; after the restart the firmware prints its summary (task, PC, reason, backtrace) and raises a Notification. The `crash` command shows it again later. In a Debug Build, `scripts/rdbg.py crash` decodes the backtrace and `scripts/rdbg.py coredump` fetches the whole dump for `esp-coredump`, against the ELF of that exact build (`.pio/elves/`, named by version and ELF digest).
+- **The main loop is watched.** Arduino-ESP32 subscribes only core 0's idle task to the task watchdog, and the main loop runs on core 1: a stuck loop used to hang the device for good, with the screen frozen and the Debug Console unable to run commands. `enableLoopWDT()` makes a loop stuck for 5 s a panic, with a core dump, counted towards Safe Mode. And an installed update no longer depends on the main loop: the Update Service restarts into it by itself after 90 s.
+
+## Consequences
+
+- Nothing in the main loop may block for 5 s. Network and card work already run on their own tasks.
+- Safe Mode can't help when Wi-Fi or the Update Service itself is what crashes; that still needs USB.
+- Three crashes within a minute of each restart are needed to reach Safe Mode, so a crash loop costs about half a minute before the device becomes reachable.
@@ -0,0 +1,19 @@
+# The framework is rebuilt with our own SDK settings, for smaller TLS buffers
+
+Arduino-ESP32 ships its ESP-IDF libraries prebuilt, with one `sdkconfig` for every ESP32-S3 board. Its TLS settings give every connection a 16 KB receive buffer and a 16 KB send buffer for its whole life. On a device with no PSRAM and about 340 KB of RAM, an IRC connection over TLS left a 12.6 KB low in M2, against a 40 KB floor.
+
+Those settings are compiled into the libraries, so changing them means rebuilding them. pioarduino supports this as a "hybrid compile": `custom_sdkconfig` in `platformio.ini` lists the settings, and the build regenerates the framework's libraries from ESP-IDF (the same 5.5.5 the prebuilt ones come from) before building the app. We set:
+
+- `MBEDTLS_ASYMMETRIC_CONTENT_LEN`, with 16 KB to receive (servers send full TLS records) and **4 KB to send** (IRC lines are short): 12 KB less per connection.
+- `MBEDTLS_DYNAMIC_BUFFER`, `DYNAMIC_FREE_CONFIG_DATA`, `DYNAMIC_FREE_CA_CERT`: buffers allocated when needed, and handshake-only data (the CA chain) freed once connected.
+
+The rebuild also follows the board definition instead of the generic one: PSRAM support is off (the Cardputer ADV has none) and the flash size is 8 MB.
+
+## Consequences
+
+- With IRC connected over TLS, a Debug Build has 78 KB free and a 59 KB low (it was 31 KB and 12.6 KB), and 46 KB at the lowest under the heaviest combined load measured (IRC, two refused installs, a 1.6 MB put and get).
+- The first build after a fresh checkout, or after changing `custom_sdkconfig`, takes about 4 minutes instead of 45 s: it downloads ESP-IDF into the PlatformIO volume and compiles it. Later builds reuse it.
+- Everything the firmware depends on was checked in the regenerated `sdkconfig`: app rollback, core dumps to flash (ELF), the 5 s task watchdog, FreeRTOS run-time stats, the certificate bundle.
+- The project now owns its partition table (`default_8MB.csv`, identical to the framework's), which the hybrid build requires. Changing it would break updates over the air: the app slots must stay where they are.
+- Generated files (`sdkconfig.*`, `managed_components/`, `.dummy/`) are ignored by git.
+- A TLS server that sends records over 16 KB would still fail, as before; one that needs us to send records over 4 KB would now fail. Neither happens with IRC.
@@ -0,0 +1,61 @@
+# G1 — Gemini client
+
+**Status:** done, tagged v0.5.0. Every step was checked on the device; reading Saved Pages with Wi-Fi off was checked by hand (2026-10-05).
+
+**Goal:** browse Geminispace from the Cardputer: fetch and read gemtext over TLS, follow links, answer input prompts, keep bookmarks, and save pages to the SD card to read later, offline. A side milestone between M2 and M3, tagged v0.5.0 when done.
+
+Gemini (geminiprotocol.net): one request per TLS connection on port 1965, the request is the URL and CRLF, the response a `<status> <meta>` header line, then the body. Most capsules use self-signed certificates: trust on first use is the norm.
+
+## Decisions (design round 2026-10-05)
+
+| # | Decision |
+|---|---|
+| Q70 | A milestone of its own, **G1**, before M3: plan, tests first, measured on the device, tagged v0.5.0. |
+| Q71 | **TOFU:** the first certificate seen for a host is pinned (SHA-256, in NVS). If it changes, the page isn't shown; a dialog shows both fingerprints and asks whether to trust the new one. Self-signed or expired certificates are fine; only a change counts. |
+| Q72 | Responses: 1x input (11 hidden, for passwords), 2x content, up to 5 redirects (3x), 4x/5x errors with the server's message. 6x (client certificates): "not supported". |
+| Q73 | `text/gemini` is rendered, other `text/*` shown as plain text. Anything else can be saved to `/gemini/downloads/`, not shown. |
+| Q74 | Up to **64 KB on screen**, larger pages truncated with a notice. Saving streams to the card, so a larger page is saved whole. |
+| Q75 | Gemtext rendering: text wrapped to the 40-column screen; `#`/`##`/`###` headings in bold and accent; `*` lists with bullets; `>` quotes indented and muted; preformatted blocks unwrapped, Left/Right to scroll; `=>` links with their label, numbered. |
+| Q76 | Up/Down scroll; Tab and Shift+Tab move between links; Enter follows; Backspace goes back; `g` opens the address line. Links to other protocols show their URL and aren't followed. |
+| Q77 | Back history of 20 URLs in RAM, with scroll positions; going back refetches (or reopens a Saved Page). **Bookmarks** in `/gemini/bookmarks.gmi` (a gemtext page, shown on the start page); `b` adds the current page. Without a card, a built-in start page. |
+| Q78 | Start page: bookmarks, then Saved Pages, then defaults: geminiprotocol.net, a search engine (kennedy.gemi.dev), an aggregator (Cosmos; Antenna was down when measured). |
+| Q79 | UTF-8 decoded; characters outside the Latin-1 fonts shown as `?`. |
+| Q80 | IRC and Gemini can run together: each fetch opens one connection, reads and closes it. If there isn't memory for a second TLS connection, the fetch fails with a clear message and IRC is untouched. Measured in step 1. |
+| Q81 | Debug aid: `gemini get <url>` prints the status, MIME type, size, certificate fingerprint and the first lines. URL resolution (RFC 3986), the response header and gemtext parsing are host-tested. |
+| Q82 | `s` saves the page on screen as a **Saved Page**: `/gemini/saved/<host>/<path>.gmi`, the gemtext as received plus a first line with its URL and save date. Saving again replaces it, and says so. |
+| Q83 | `S` saves the page and the pages it links to, one level deep: gemtext only, same host only, at most 30 pages, in the background with a progress Toast. |
+| Q84 | The start page lists Saved Pages, newest first, grouped by capsule; they open with no network. In a Saved Page, a link to another Saved Page opens the saved copy; other links fetch online if Wi-Fi is up, or say "not saved, offline". A Saved Page shows when it was saved; `r` refreshes it. |
+| Q86 | *Decided after step 1, revised after Q88.* **Two floors:** free heap stays above 40 KB in steady state; a fetch refuses to start below **55 KB** free ("not enough memory: stop IRC or retry"). The firmware's own allocations during a fetch (a page in RAM, a window) keep 20 KB free. With IRC connected, the TLS connection itself can briefly take the heap lower, depending on the server's record sizes: measured 24, 19.5, 15.5 and **13 KB**. *Accepted:* about 12 KB for a moment during a fetch with IRC up, rather than refusing most fetches (a 70 KB start floor) or dropping IRC's connection for each page. |
+| Q87 | *Decided in step 3.* **With a card, every page streams to `/gemini/cache/page.gmi`** in 1 KB pieces while its TLS connection is open; once the connection closes and its ~45 KB is back, the page is loaded into RAM as far as the 40 KB floor allows. The whole page stays on the card (Saved Pages copy it). Without a card, the page goes straight to RAM under the same two floors. Pages are held as lines in 4 KB chunks, never one large block (the largest free block with IRC connected is about 31 KB). |
+| Q88 | *Added after step 6.* **A page bigger than memory allows is read from the card as you scroll.** Opening it, one pass over its file counts the lines, records where every 64th starts (and whether it's inside a preformatted block), and loads the first window. Scrolling near either end of the window reads the next or previous one in the background, keeping the line on top of the screen where it is; the scrollbar follows the whole page. Display pages alternate between two cache files, so the one on screen is never overwritten by the next fetch; background jobs use a third. |
+| Q85 | Saved Pages are deleted from the App only (`d`, with confirmation), never by Storage Clean-up's age rules, like Notes. |
+
+## Measured (step 1)
+
+- `gemini://geminiprotocol.net/`: `20 text/gemini`, 1,184 bytes, TLS handshake 0.7–1.1 s, whole fetch 0.7–1.1 s; kennedy.gemi.dev 1.9 s. The fetch task's stack peaks at about 3.6 KB of 6.
+- **Heap, Debug Build, IRC connected over TLS:** about 68 KB free before a fetch. After the handshake the fetch holds about 32 KB (36–40 KB left); the handshake itself (certificate chain parsed with the 16 KB receive buffer allocated) dips to about **24 KB** for a second or two. Nothing leaks: the heap after matches the heap before.
+- **Step 3, Cosmos (31.6 KB) with IRC connected:** first stopped at 4.6 KB (RAM only, the transfer's 20 KB floor). Streamed to the card: the whole page on the card, 20 KB of it loaded, lowest free heap 19.5 KB during the transfer and 43 KB once loaded. Without IRC: the whole page in RAM. Redirects (Cosmos `31`), input (`10`), not found (`51`) and a changed certificate (refused, both fingerprints shown) all checked on the device.
+- **Steps 4–6 on the device:** Project Gemini and its relative links, Back with the scroll restored, a refused YouTube link; `b` bookmarks, `s` saves (and says when it replaced an older copy), `S` saved 6 of 6 pages, the start page lists both; a Saved Page opens from the card with its origin, its saved links open saved copies, `r` refreshes, `d` asks first; Kennedy's input prompt sent "cardputer" and got 87 results; emoji drawn as `?`.
+- **A bug found there:** refreshing first loaded the whole Saved Page into RAM just to read its origin, next to the App's copy and a TLS connection: the heap fell to 436 bytes. Now only the first line is read, and every fetch (pages, saves, refreshes) checks the 55 KB start floor. Lowest since boot afterwards: 53.8 KB.
+- **Windowed pages (Q88), Cosmos with IRC connected:** 226 of 419 lines in memory at first; paging down loaded lines 192–419 in one window, scrolling back up loaded 64 onwards, then 0 onwards. Window budgets count the memory the old window gives back.
+- **Heap during a fetch with IRC connected:** lowest 13–15.5 KB in later runs (24 and 19.5 KB earlier), the TLS receive buffers varying with the server's records. Accepted (Q86, revised).
+- Antenna (`warmedal.se`) doesn't answer, from the PC either; the default aggregator becomes Cosmos (`gemini://skyjake.fi/~Cosmos/`, which redirects to `cosmos.skyjake.fi`).
+
+## Done when
+
+- `gemini get gemini://geminiprotocol.net/` prints the header, size and fingerprint on the console.
+- The Gemini App opens the start page, follows links (relative ones included), goes back, and follows redirects.
+- An input prompt (e.g. a search) takes a query and shows the results.
+- A changed certificate stops the page and asks.
+- `s` saves a page, `S` a page and its links; with Wi-Fi off, Saved Pages open and their saved links work.
+- Bookmarks are added with `b` and listed on the start page.
+- With IRC connected over TLS, a fetch still works, and the free heap stays above 40 KB.
+
+## Work breakdown
+
+1. **Two TLS connections:** measure the heap with IRC connected while a Gemini fetch runs.
+2. **Parsers** (host-tested): URL parsing and relative resolution, the response header, gemtext lines.
+3. **Fetch** on its own task, with TOFU and `gemini get`.
+4. **Gemini App:** rendering, scrolling, links, history, the address line.
+5. **Input prompts, redirects, bookmarks, downloads.**
+6. **Saved Pages,** then saving with linked pages.
@@ -0,0 +1,59 @@
+# M2 — GNSS
+
+**Status:** done on the device (branch `m2`): every "Done when" item below is met.
+
+## Measured
+
+- **Cold start** (`$PCAS10,2`) to a 3D Fix, by a window: **73 s**, 5 satellites used of 8 in view. A restart of the ESP32 alone keeps the receiver's Fix (the Cap stays powered).
+- By a window: 3D Fix from GPS, GLONASS, Galileo and BeiDou, up to 14 of 17 satellites used, HDOP 1.0–1.3.
+- **Heap, Debug Build, GNSS on, IRC on TLS** (floor 40 KB; v0.2.1 had a 79 KB low):
+
+  | | Free | Lowest |
+  |---|---|---|
+  | Start of M2 | 31 KB | 12.6 KB |
+  | Stacks and buffers trimmed by measurement | 46 KB | 18 KB |
+  | mDNS removed | 54 KB | 34 KB |
+  | Framework rebuilt with smaller TLS buffers (ADR 0006) | **78 KB** | **59 KB** |
+
+  Under the heaviest combined load measured (IRC, two refused installs, a 1.6 MB put and get), the low is 46 KB. The cost had come mostly from the OTA and Debug Build work, not GNSS. Stacks were set to measured peak plus about 2 KB (loop 6 KB, update 5, storage 6, irc 6); after a TLS handshake the irc task has 1.7 KB left. IRC can now be stopped by hand (`/quit` in any state, `irc stop`), which frees its TLS memory.
+
+**Goal:** the device knows where it is and what time it is without a network: a GNSS Service in the background, a GNSS App with the position and a sky view of the satellites, the clock set from satellites when there's no NTP, and Tracks recorded to the SD card.
+
+**Hardware:** the Cap LoRa-1262 carries an ATGM336H-6N (AT6668), multi-constellation (GPS, BeiDou, Galileo, GLONASS, QZSS), with a ceramic antenna. NMEA over UART, 115200 8N1. **Measured (step 1, `gnss probe`): RX GPIO 15, TX GPIO 13, 115200 8N1**, as in Meshtastic's board file; M5Stack's page names GPIO 8 and 9, which are the internal I2C bus the keyboard controller sits on. Output is NMEA 4.10 style: `GN` RMC, VTG and GGA, one GSA per constellation with the system ID (1 GPS, 2 GLONASS, 3 Galileo, 4 BeiDou, 5 QZSS) in its last field, and a GSV sequence per constellation and signal (`GP`, `GL`, `GA`, …) with the signal ID last. RMC carries a time even without a Fix (status `V`), so only a Fix makes it trustworthy.
+
+## Decisions (design round 2026-10-04)
+
+| # | Decision |
+|---|---|
+| Q58 | Settings has a GNSS On/Off switch, **On by default**. Off puts the receiver in standby. *Measured:* `$PCAS12,<seconds>` (CASIC) stops its output within a second, for up to at least 65535 s, and any command wakes it within a second; Off sends `PCAS12,65535` (renewed hourly), On sends a hot start, `PCAS10,0`. |
+| Q59 | The **GNSS App** has two views, switched with Tab. *Position*: latitude, longitude, altitude, speed, course, Fix (none / 2D / 3D), satellites used and in view, HDOP, UTC time. *Sky*: the satellites placed by azimuth and elevation, coloured by constellation, filled when used in the Fix. |
+| Q60 | "Radar" in M2 means the Sky view. A radar of other Nodes by distance and bearing needs the mesh: M4. |
+| Q61 | The **Status Bar** shows a GNSS mark: absent when off, muted while searching, normal with a 2D Fix, with the satellite count with a 3D Fix. |
+| Q62 | GNSS time **sets the clock once there's a Fix**, and refreshes it every 10 minutes. *Revised in step 3:* the clock's trust order from M0 (Mesh < NTP < GNSS) already ranks GNSS above NTP, which is right: GNSS time is at least as accurate. So GNSS also corrects a clock NTP set, not only an unset one. |
+| Q63 | A **Track** is started and stopped in the GNSS App. It's written as GPX to `/gnss/tracks/<YYYYMMDD-HHMMSS>.gpx`, a point every 5 s when the position moved more than 5 m. It keeps recording with the App closed, with a Toast on start and stop and a Status Bar mark, and gets its own Storage Clean-up category. |
+| Q64 | Coordinates in **decimal degrees plus the Maidenhead locator**; a Settings switch for degrees, minutes and seconds. Metric units only. |
+| Q65 | **The position never leaves the device in M2.** Sharing it over the mesh, and at what precision, is decided in M4. |
+| Q66 | **Our own NMEA parser**, host-tested: RMC, GGA, GSA and GSV, with each talker ID mapped to its constellation. TinyGPSPlus (named in ADR 0001) doesn't track the satellite list across constellations, which the Sky view needs. |
+| Q67 | The receiver keeps its **defaults** (all constellations, 1 Hz). No receiver settings. Time to first fix is measured and recorded here. |
+| Q68 | Debug aids: `gnss status`, and `gnss nmea on/off` to stream the raw sentences to the console (USB serial and Debug Console). Raw NMEA is never written to the card. |
+
+**Lesson (step 3):** the first probe also tried the pins swapped, driving the receiver's output line from the ESP32 for about a second. The receiver then went silent until a full power cycle (an ESP32 restart doesn't cut the Cap's power). Never drive GPIO 15.
+
+## Done when
+
+- The GNSS Service reads NMEA in the background whatever App is on screen, and a 3D Fix appears outdoors.
+- The GNSS App shows the Position and Sky views, both live.
+- The Status Bar shows the GNSS mark per Q61.
+- With no Wi-Fi, the clock is set from GNSS after the first Fix.
+- A Track records while the App is closed, survives the screen turning off, and opens as valid GPX on the PC.
+- Settings → GNSS Off stops it (and the Status Bar mark goes away); On brings it back.
+- Free heap stays above about 40 KB with GNSS, Wi-Fi, IRC on TLS and the UI running.
+
+## Work breakdown
+
+1. **Hardware check:** a `gnss probe` command reads the candidate UART pins and reports which carries NMEA, at what baud rate, and which talker IDs. Then the standby command (Q58) and a first time to first fix.
+2. **NMEA parser** (host-tested): checksum, RMC, GGA, GSA, GSV across constellations, merged into one GNSS state (Fix, position, time, satellites).
+3. **GNSS Service:** UART on its own task, the parser, `gnss status` and `gnss nmea`, Settings On/Off.
+4. **Clock from GNSS** (Q62), and the Status Bar mark (Q61).
+5. **GNSS App:** Position view, Maidenhead and coordinate formats (host-tested), then the Sky view.
+6. **Tracks:** the 5 s / 5 m rule and GPX writing (host-tested), background recording, Clean-up category.
@@ -0,0 +1,69 @@
+# M3 — Radio bring-up: the LoRa Scanner
+
+**Status:** done, tagged v0.6.0. Everything was checked on the device except one "Done when" item: Sweep was never tried against a known transmitter (see below). The listening hour heard nothing, so by Q104 **a reference Meshtastic node is a requirement for M4**.
+
+**Goal:** the LoRa radio on the Cap works, receive only: a Radio Service owns it and shares the SPI bus with the SD card safely, and a LoRa Scanner App shows what's on the air, either packets (Sniffer) or energy across the band (Sweep). Nothing in M3 can transmit. The mesh comes on top of this in M4 (receive) and M5 (transmit).
+
+**Hardware:** the Cap LoRa-1262 carries an SX1262 (868–923 MHz, +22 dBm) with an RP-SMA antenna. Pins, as in Meshtastic's board file for the Cardputer ADV: **NSS 5, RST 3, DIO1 (IRQ) 4, BUSY 6**, on the SPI bus shared with the microSD card (SCK 40, MISO 39, MOSI 14; card CS 12). Meshtastic uses DIO2 as the RF switch and DIO3 for a 1.8 V TCXO, marked optional. M5Stack's page adds an FM8625H antenna switch enabled by P0 of a PI4IOE5V6408 I/O expander on the internal I2C bus, address not given; Meshtastic doesn't mention it. Step 1 measures which is true.
+
+**No other LoRa device yet.** meshmap.net (2026-10-05) lists two Meshtastic nodes within 10 km of the desk and six within 30 km, with positions blurred by a few km; none is known to be in range. M3 needs none: it only receives.
+
+## Measured
+
+- **Internal I2C bus (8/9):** 0x18 (ES8311 codec), 0x34 (TCA8418 keyboard), **0x43 (PI4IOE5V6408, ID register 0xA2)**, 0x69 (BMI270 IMU).
+- **The SX1262 answers** on NSS 5, RST 3, DIO1 4, BUSY 6. Its version string reads `SX1261 V2D 2D02`, which SX1262 chips report too. **The 1.8 V TCXO works** on the first try; the radio is ready 38 ms after `begin`.
+- **The expander's P0 connects the antenna; it's required.** At power-on P0 is an input (direction 0x00, high-impedance 0xFF), and the receiver reads a flat **-111.9 dBm** at 869.525 MHz, BW 250 kHz: the chip's own floor, deaf. With P0 driven high, the noise floor is **-87 to -94 dBm**: the antenna hearing the room. So the Radio Service drives P0 high at boot (Q91).
+- **DIO2 doesn't change reception** (within ±2 dB over three runs, P0 high). It likely selects TX versus RX in the FM8625H; it stays the RF switch, as in Meshtastic.
+- **The noise floor at the desk is high** (-87 to -94 dBm, varying run to run), about 25 dB above thermal noise for 250 kHz. Something nearby is loud, possibly the Cardputer itself or the PC; Sweep (step 5) should show where it sits.
+- **Step 2:** presets, frequencies and the channel hash are checked against Meshtastic's source (`MeshRadio.h`, `RadioInterface.cpp`): LongFast and the default key give hash 8, MediumFast 31, as Meshtastic shows. Captures were checked with TShark 4.2.5: every LoRaTap field reads back. Wireshark ignores the spec's quarter-dB packet RSSI below 0 dB SNR, so packet RSSI is plain dBm.
+- **Step 3:** the DIO1 interrupt works (a 100 ms receive timeout wakes the task after 105 ms). While listening: four 1.7 MB uploads and Gemini pages to the card, no radio or card errors (the card refuses a write about once in five uploads with the radio asleep too; `put` now catches it, and issue #21 follows the cause). The ring takes 9.8 KB while listening; the radio task's stack peaks at 2.0 KB.
+- **No packets yet, and a loud desk.** Twenty minutes on LongFast and on LoRaWAN's three uplink frequencies (SF7, SF9, SF12): no packet and no header, valid or not. The noise floor reads -83 to -94 dBm, against -112 dBm with the antenna switched off: 20 to 30 dB lost to something nearby, not the screen and not the GNSS receiver. Preamble detections are false alarms at this noise level (more on an empty frequency, 869.0 MHz, than on LongFast).
+- **Step 4:** a Capture made on the device reads back in TShark field for field (time, frequency, SF, RSSI, SNR, payload). A Capture keeps the radio listening with the App closed; stopping it puts the radio back to sleep.
+- **Step 5:** a pass across 863–870 MHz (71 steps, the strongest of three RSSI readings at each, measured at 125 kHz) takes about 607 ms. At the desk the band is **flat at -100 to -102 dBm**, about 15 dB above the chip's own floor at 125 kHz, with a steady carrier at 863.2 MHz (-89 dBm at its strongest) and fainter lines elsewhere: broadband noise from nearby electronics rather than a transmitter. Sweep's waterfall takes 2.6 KB while shown; 91.9 KB free during a Sweep. The radio task's stack peaks at 1.9 KB.
+- **Outside, on battery (step 6).** The noise is no lower than at the desk: a Sweep floor of -96 to -99 dBm (median -97) with Wi-Fi on, -99 to -100 with Wi-Fi off, so Wi-Fi accounts for 2 or 3 dB. The same narrow peaks come back on every pass, at 863.2, 863.6, 864.4, 864.8, 865.9, 866.3, 867.8, 869.0 and 869.4 MHz (-88 to -91 dBm), several of them 400 kHz apart; 869.4 MHz is the lower edge of LongFast's channel. A source that follows the device outside and onto its battery is the device: **about 15 dB of the floor is the Cardputer's own** (issue #20). At SF11 that puts the weakest decodable packet near -114 dBm on LongFast, against about -130 dBm for a quiet receiver.
+- **The listening hour (step 6, Q104):** 20:33 to 21:34 on 2026-10-05, outside, on battery, LongFast, with a Capture running. **0 packets, 0 headers**, 0 radio errors; noise -85 to -87 dBm at 250 kHz throughout; 860 preamble detections, all false alarms. The Capture holds its 24-byte header and nothing else. No restart in 1 h 10 min.
+- **Floors (Q86):** with the radio listening, Wi-Fi and IRC connected over TLS, 52.6 KB free (lowest 22.7 KB during the TLS handshake, the dip accepted in G1). Without IRC, 93 KB.
+- **Receive only:** nothing in `src` or `lib` calls a transmit function.
+- **Cost:** RadioLib 7.8.1 and the probe add 23.6 KB of flash and 656 bytes of static RAM to the release firmware (1,679,843 bytes of 3,342,336). The whole milestone: 51.8 KB of flash (1,708,091 bytes), 365 tests (27 new).
+
+## Decisions (design round 2026-10-05)
+
+| # | Decision |
+|---|---|
+| Q89 | **M3 is the radio only:** Radio Service, Sniffer, Sweep. Notes and the File Browser (Q30) move out to issue #3 and a Notes issue, as a later side milestone. |
+| Q90 | **RadioLib**, pinned (ADR 0001). SX1262 on NSS 5, RST 3, DIO1 4, BUSY 6; DIO2 as RF switch; TCXO at 1.8 V tried first, falling back to the crystal (Meshtastic's `TCXO_OPTIONAL`). |
+| Q91 | Step 1 is `lora probe`: chip status and version, which oscillator setting worked, and an I2C scan of the internal bus for the PI4IOE5V6408. If present, its P0 is set high at boot (harmless) and DIO2 stays the switch. A wrong switch receives deaf, so compare noise floors. |
+| Q92 | A **Radio Service** owns the SX1262: driver, bus lock, IRQ task. The LoRa Scanner uses it in M3; the Mesh Service sits on top of it in M4. |
+| Q93 | Every radio transfer takes the shared bus lock (`SPI.beginTransaction`, as the card does). DIO1's interrupt only wakes the task; no SPI in the ISR. **Done when** a Gemini page streams to the card while the Sniffer receives, with no lost packets and no card errors (`lora status` counters). |
+| Q94 | **Receive only:** the Radio Service has no transmit function in M3. It doesn't exist, rather than being unused. |
+| Q95 | Sniffer defaults: **EU868 LongFast**, 869.525 MHz, BW 250 kHz, SF 11, CR 4/5, sync word 0x2B, preamble 16 (Q19). The other Meshtastic presets are offered, plus custom settings. |
+| Q96 | The Sniffer lists packets (time, RSSI, SNR, frequency error, length; hex dump on Enter) **and decodes the Meshtastic header**: the first 16 bytes are never encrypted (destination, sender, packet ID, hop limit and hop start, channel hash, next hop, relay node). Host-tested. Payload decryption is M4. |
+| Q97 | A Sniffer **Capture** is pcap with **LoRaTap** headers (link type 270), for Wireshark. Started by hand, Status Bar mark, its own Clean-up category, the 90% rule. |
+| Q98 | **Sweep** steps across the Region's band (863–870 MHz) in 100 kHz steps by default, reading instant RSSI: bars with peak hold, and a waterfall, Wi-Fi Tools style. Optionally CAD on the preset's frequency to tell LoRa traffic from noise. |
+| Q99 | Sweep takes the radio and pauses the Sniffer, visibly (Q18). From M4 it pauses the Mesh Service the same way. |
+| Q100 | The Sniffer runs while the App is open **or a Capture is recording**; otherwise the radio sleeps. From M4 the Mesh Service keeps it on. |
+| Q101 | **Status Bar:** a radio mark while receiving, flashing on each packet; muted during a Sweep. |
+| Q102 | Debug aids: `lora status` (settings, counters, last RSSI/SNR, noise floor), `lora probe`, `lora rx on/off` (packets on the consoles). Raw packets are never written to the card outside a Capture. |
+| Q103 | A ring of the **last 32 packets** in RAM (about 9 KB at full length); older ones are dropped unless capturing. IRQ task stack trimmed by measurement; RadioLib's flash and RAM measured in step 1 against the floors. |
+| Q104 | **Done when** (below) includes an hour of listening on LongFast by a window. Real packets heard become M4 test fixtures. If none are heard, M3 still closes, and a reference Meshtastic node (Q21) becomes a requirement for M4. |
+
+## Done when
+
+- `lora probe` reports the SX1262, its oscillator setting and the RF switch arrangement, and the result is written here.
+- The Sniffer receives on LongFast with the App open or a Capture running, and the radio sleeps otherwise.
+- Sweep shows the noise floor across 863–870 MHz, and a known signal (a remote key fob, a 868 MHz sensor, anything) stands out. *Half met: the floor and the device's own steady peaks show; no known transmitter was tried.*
+- The shared-bus test passes (Q93): a Gemini page to the card while the Sniffer receives, no lost packets, no card errors.
+- A Capture opens in Wireshark with LoRaTap fields.
+- The Status Bar mark follows Q101.
+- One hour of LongFast listening by a window has been run and its result recorded here. *Run outside, on battery.*
+- Free heap stays above the floors (Q86) with the Sniffer, Wi-Fi, IRC on TLS and the UI running.
+- Nothing in the firmware can transmit.
+
+## Work breakdown
+
+1. **Hardware check:** RadioLib in the build, `lora probe` (Q91), flash and RAM cost measured.
+2. **Meshtastic header and LoRaTap** (host-tested): header parsing, presets and their radio settings, pcap/LoRaTap writing.
+3. **Radio Service:** receive on its own task behind the bus lock, the packet ring, `lora status` and `lora rx`, the shared-bus test.
+4. **LoRa Scanner App, Sniffer:** the packet list, details, preset choice, Captures, Status Bar mark.
+5. **Sweep:** the RSSI sweep, bars and waterfall, pausing the Sniffer.
+6. **Listening hour** and the measurements above, recorded here.
@@ -0,0 +1,33 @@
+# OTA — Firmware Updates over Wi-Fi and from the SD card
+
+**Goal:** install new firmware without a USB cable. Push it from the PC over Wi-Fi, or drop it on the SD card. Unsigned images are refused, and a broken update rolls back by itself.
+
+## Decisions (design round 2026-10-03)
+
+| # | Decision |
+|---|---|
+| Q52 | Two sources: **push over Wi-Fi** from the PC, and **from the SD card**. Pulling from Gitea releases is deferred. |
+| Q53 | **Signed Update Files** (ECDSA P-256 over SHA-256). The private key stays in `~/.config/roro9stack/`, and the firmware embeds the public key (ADR 0003). |
+| Q54 | The device **always listens** for pushes on the LAN while Wi-Fi is Connected. *Revised in M2:* it was announced over mDNS as `roro9stack-<id>.local`; mDNS was removed to save RAM (it never crossed the dev box's routed network anyway). Pushes go to the IP shown in Settings → Firmware. |
+| Q55 | New firmware runs on **Probation**. It's confirmed once booted, UI drawn, Services started, 30 s without a crash, and Wi-Fi connected (if configured). Otherwise **Rollback**. A Toast reports either outcome. |
+| Q56 | **Downgrades are allowed**, with "older than the installed version" shown. |
+| Q57 | A valid push **installs right away**: progress screen, then reboot. The reboot waits for Text Entry to end, 60 s at most. |
+
+## Done when
+
+- `scripts/ota_keygen.sh` creates the key pair once. The public key is committed; the private key never is.
+- `scripts/flash.sh --ota` builds, signs and pushes to `roro9stack-<id>.local`. The device shows progress, reboots, and a Toast confirms the new version.
+- An Update File with a bad signature, a truncated or corrupted image, or no signature is refused, and the device keeps running.
+- Settings → About → **Update from SD** lists the `.ota` files in `/updates` and installs one.
+- A firmware that crashes during Probation rolls back to the previous version, and says so after the reboot.
+
+## Work breakdown
+
+1. **Update File format** (host-tested): header (magic, format, version, image size, SHA-256), signature, image. A streaming parser that hashes as it goes and decides accept / refuse / downgrade. The signature verifier sits behind an interface, so tests can inject one.
+2. **PC side:** key generation, `make_ota.py` (wraps `firmware.bin` into a signed `.ota`), and the push client. `flash.sh --ota` ties them together.
+3. **Device:** the Update Service.
+   - A listener on TCP 3232 plus mDNS.
+   - Writes the image to the inactive app slot, with the ECDSA check through mbedTLS.
+   - A progress screen, and a reboot that waits out Text Entry.
+4. **Probation and Rollback:** the health checks, confirming the image, and detecting a rollback after reboot to report it.
+5. **Update from SD:** the same parser, fed from the Storage Service's task (all card access stays there).
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIWzT07fvTpQxWjTdewMipYH6f42+
+mM8niHm+T8y+Mvjanb3H8hpYXg3VjuJGFtcHw/hFX0Q2f2AiSHMF0DhMbQ==
+-----END PUBLIC KEY-----
@@ -20,8 +20,10 @@ const RowDef kRows[] = {
    {Row::Region, Kind::Choice, "Region"},      {Row::Timezone, Kind::Choice, "Timezone"},
    {Row::Brightness, Kind::Slider, "Brightness"}, {Row::DimTimeout, Kind::Choice, "Dim after"},
    {Row::OffTimeout, Kind::Choice, "Screen off after"}, {Row::Sound, Kind::Toggle, "Sound & LED"},
+    {Row::Gnss, Kind::Toggle, "GNSS"}, {Row::Coordinates, Kind::Toggle, "Coordinates"},
    {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}, {Row::Wifi, Kind::Page, "Wi-Fi"},
    {Row::Storage, Kind::Page, "Storage"},
+    {Row::Firmware, Kind::Page, "Firmware"},
    {Row::About, Kind::Page, "About"},
 };

@@ -78,6 +80,8 @@ std::string SettingsMenu::value(int i) const {
        case Row::DimTimeout: return formatSeconds(settings_.getInt(Setting::DimTimeoutS));
        case Row::OffTimeout: return formatSeconds(settings_.getInt(Setting::OffTimeoutS));
        case Row::Sound: return settings_.getBool(Setting::Sound) ? "On" : "Off";
+        case Row::Gnss: return settings_.getBool(Setting::GnssEnabled) ? "On" : "Off";
+        case Row::Coordinates: return settings_.getBool(Setting::CoordinatesDms) ? "Deg min sec" : "Decimal";
        case Row::ProbeMacs: return settings_.getBool(Setting::ProbeMacRaw) ? "Raw" : "Pseudonymised";
        case Row::Wifi: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
        default: return "";
@@ -121,6 +125,8 @@ std::string SettingsMenu::choose(int i, int c) {

 void SettingsMenu::toggle(int i) {
    if (row(i) == Row::Sound) settings_.setBool(Setting::Sound, !settings_.getBool(Setting::Sound));
+    if (row(i) == Row::Gnss) settings_.setBool(Setting::GnssEnabled, !settings_.getBool(Setting::GnssEnabled));
+    if (row(i) == Row::Coordinates) settings_.setBool(Setting::CoordinatesDms, !settings_.getBool(Setting::CoordinatesDms));
    if (row(i) == Row::ProbeMacs) settings_.setBool(Setting::ProbeMacRaw, !settings_.getBool(Setting::ProbeMacRaw));
 }

@@ -11,7 +11,7 @@ namespace roro {
 // values, choice lists and validation messages. Rendering and navigation live in the App.
 class SettingsMenu {
   public:
-    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, ProbeMacs, Wifi, Storage, About };
+    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, Gnss, Coordinates, ProbeMacs, Wifi, Storage, Firmware, About };
    enum class Kind { Text, Choice, Toggle, Slider, Page };

    explicit SettingsMenu(Settings& settings) : settings_(settings) {}
@@ -0,0 +1,59 @@
+#include "gemini_response.h"
+
+#include <cctype>
+
+namespace roro::gemini {
+
+namespace {
+std::string trim(const std::string& s) {
+    size_t a = s.find_first_not_of(" \t"), b = s.find_last_not_of(" \t");
+    return a == std::string::npos ? "" : s.substr(a, b - a + 1);
+}
+std::string lower(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+}  // namespace
+
+bool parseHeader(const std::string& line, Header& out) {
+    if (line.size() < 2 || !std::isdigit(static_cast<unsigned char>(line[0])) ||
+        !std::isdigit(static_cast<unsigned char>(line[1])))
+        return false;
+    if (line.size() > 2 && line[2] != ' ') return false;
+    std::string meta = line.size() > 3 ? line.substr(3) : "";
+    if (meta.size() > 1024) return false;
+    out.status = (line[0] - '0') * 10 + (line[1] - '0');
+    out.meta = meta;
+    return true;
+}
+
+Category Header::category() const {
+    switch (status / 10) {
+        case 1: return Category::Input;
+        case 2: return Category::Success;
+        case 3: return Category::Redirect;
+        case 4: return Category::TemporaryFailure;
+        case 5: return Category::PermanentFailure;
+        case 6: return Category::ClientCertificate;
+        default: return Category::Unknown;
+    }
+}
+
+std::string Header::mimeType() const {
+    std::string type = lower(trim(meta.substr(0, meta.find(';'))));
+    return type.empty() ? "text/gemini" : type;
+}
+
+std::string Header::parameter(const std::string& name) const {
+    size_t pos = meta.find(';');
+    while (pos != std::string::npos) {
+        size_t next = meta.find(';', pos + 1);
+        std::string item = trim(meta.substr(pos + 1, next == std::string::npos ? std::string::npos : next - pos - 1));
+        size_t eq = item.find('=');
+        if (eq != std::string::npos && lower(trim(item.substr(0, eq))) == lower(name)) return trim(item.substr(eq + 1));
+        pos = next;
+    }
+    return "";
+}
+
+}  // namespace roro::gemini
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <string>
+
+namespace roro::gemini {
+
+enum class Category { Input, Success, Redirect, TemporaryFailure, PermanentFailure, ClientCertificate, Unknown };
+
+// The response header: "<two digits> <meta>", at most 1024 bytes of meta.
+struct Header {
+    int status = 0;
+    std::string meta;
+
+    Category category() const;
+    bool sensitiveInput() const { return status == 11; }
+    // 2x: the MIME type, lower-cased, without parameters ("text/gemini" when meta is empty).
+    std::string mimeType() const;
+    std::string parameter(const std::string& name) const;  // e.g. "charset"
+};
+
+bool parseHeader(const std::string& line, Header& out);
+
+}  // namespace roro::gemini
@@ -0,0 +1,215 @@
+#include "gemini_url.h"
+
+#include <cctype>
+#include <cstdio>
+#include <cstdlib>
+#include <vector>
+
+#include "storage_paths.h"
+
+namespace roro::gemini {
+
+namespace {
+
+// RFC 3986, appendix B: ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?
+struct Parts {
+    std::string scheme, authority, path, query, fragment;
+    bool hasScheme = false, hasAuthority = false, hasQuery = false, hasFragment = false;
+};
+
+Parts split(const std::string& s) {
+    Parts p;
+    size_t i = 0;
+    size_t colon = s.find(':');
+    size_t stop = s.find_first_of("/?#");
+    if (colon != std::string::npos && colon > 0 && (stop == std::string::npos || colon < stop)) {
+        p.scheme = s.substr(0, colon);
+        p.hasScheme = true;
+        i = colon + 1;
+    }
+    if (s.compare(i, 2, "//") == 0) {
+        size_t end = s.find_first_of("/?#", i + 2);
+        if (end == std::string::npos) end = s.size();
+        p.authority = s.substr(i + 2, end - i - 2);
+        p.hasAuthority = true;
+        i = end;
+    }
+    size_t end = s.find_first_of("?#", i);
+    if (end == std::string::npos) end = s.size();
+    p.path = s.substr(i, end - i);
+    i = end;
+    if (i < s.size() && s[i] == '?') {
+        end = s.find('#', i);
+        if (end == std::string::npos) end = s.size();
+        p.query = s.substr(i + 1, end - i - 1);
+        p.hasQuery = true;
+        i = end;
+    }
+    if (i < s.size() && s[i] == '#') {
+        p.fragment = s.substr(i + 1);
+        p.hasFragment = true;
+    }
+    return p;
+}
+
+std::string lower(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+
+// RFC 3986, section 5.2.4.
+std::string removeDotSegments(std::string in) {
+    std::string out;
+    while (!in.empty()) {
+        if (in.compare(0, 3, "../") == 0) in.erase(0, 3);
+        else if (in.compare(0, 2, "./") == 0) in.erase(0, 2);
+        else if (in.compare(0, 3, "/./") == 0) in.replace(0, 3, "/");
+        else if (in == "/.") in = "/";
+        else if (in.compare(0, 4, "/../") == 0 || in == "/..") {
+            in = in == "/.." ? "/" : in.substr(3);
+            size_t slash = out.rfind('/');
+            out.erase(slash == std::string::npos ? 0 : slash);
+        } else if (in == "." || in == "..") in.clear();
+        else {
+            size_t next = in.find('/', in[0] == '/' ? 1 : 0);
+            if (next == std::string::npos) next = in.size();
+            out += in.substr(0, next);
+            in.erase(0, next);
+        }
+    }
+    return out;
+}
+
+// RFC 3986, section 5.2.3.
+std::string merge(const Parts& base, const std::string& refPath) {
+    if (base.hasAuthority && base.path.empty()) return "/" + refPath;
+    size_t slash = base.path.rfind('/');
+    return slash == std::string::npos ? refPath : base.path.substr(0, slash + 1) + refPath;
+}
+
+// RFC 3986, section 5.3.
+std::string recompose(const Parts& p) {
+    std::string out;
+    if (p.hasScheme) out += p.scheme + ":";
+    if (p.hasAuthority) out += "//" + p.authority;
+    out += p.path;
+    if (p.hasQuery) out += "?" + p.query;
+    if (p.hasFragment) out += "#" + p.fragment;
+    return out;
+}
+
+}  // namespace
+
+bool parseUrl(const std::string& text, Url& out) {
+    Parts p = split(text);
+    if (!p.hasScheme || !p.hasAuthority) return false;
+    out = Url();
+    out.scheme = lower(p.scheme);
+    out.authority = p.authority;
+    std::string hostPort = p.authority.substr(p.authority.find('@') == std::string::npos ? 0 : p.authority.find('@') + 1);
+    size_t colon = hostPort.rfind(':');
+    if (colon != std::string::npos && hostPort.find(']', colon) == std::string::npos) {
+        out.port = std::atoi(hostPort.c_str() + colon + 1);
+        hostPort = hostPort.substr(0, colon);
+    }
+    out.host = lower(hostPort);
+    if (out.host.empty()) return false;
+    out.path = p.path;
+    out.query = p.query;
+    out.fragment = p.fragment;
+    out.hasAuthority = true;
+    out.hasQuery = p.hasQuery;
+    out.hasFragment = p.hasFragment;
+    return true;
+}
+
+bool isGemini(const std::string& url) {
+    Parts p = split(url);
+    return p.hasScheme && lower(p.scheme) == "gemini";
+}
+
+std::string resolve(const std::string& baseText, const std::string& refText) {
+    Parts base = split(baseText), r = split(refText), t;
+    if (r.hasScheme) {
+        t = r;
+        t.path = removeDotSegments(r.path);
+    } else {
+        if (r.hasAuthority) {
+            t.authority = r.authority;
+            t.hasAuthority = true;
+            t.path = removeDotSegments(r.path);
+            t.query = r.query;
+            t.hasQuery = r.hasQuery;
+        } else {
+            if (r.path.empty()) {
+                t.path = base.path;
+                t.query = r.hasQuery ? r.query : base.query;
+                t.hasQuery = r.hasQuery || base.hasQuery;
+            } else {
+                t.path = removeDotSegments(r.path[0] == '/' ? r.path : merge(base, r.path));
+                t.query = r.query;
+                t.hasQuery = r.hasQuery;
+            }
+            t.authority = base.authority;
+            t.hasAuthority = base.hasAuthority;
+        }
+        t.scheme = base.scheme;
+        t.hasScheme = base.hasScheme;
+    }
+    t.fragment = r.fragment;
+    t.hasFragment = r.hasFragment;
+    return recompose(t);
+}
+
+std::string requestUrl(const std::string& url) {
+    Url u;
+    if (!parseUrl(url, u)) return url;
+    std::string out = u.scheme + "://" + u.host;
+    if (u.port > 0 && u.port != 1965) out += ":" + std::to_string(u.port);
+    out += u.path.empty() ? "/" : u.path;
+    if (u.hasQuery) out += "?" + u.query;
+    return out;
+}
+
+std::string encodeQuery(const std::string& text) {
+    std::string out;
+    for (unsigned char c : text) {
+        if (std::isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') out += static_cast<char>(c);
+        else {
+            char buf[4];
+            std::snprintf(buf, sizeof buf, "%%%02X", c);
+            out += buf;
+        }
+    }
+    return out;
+}
+
+std::string savedPath(const std::string& url) {
+    Url u;
+    if (!parseUrl(url, u)) return "/gemini/saved/unknown.gmi";
+    std::string out = "/gemini/saved/" + storage::sanitize(u.host + (u.port > 0 && u.port != 1965 ? "_" + std::to_string(u.port) : ""));
+    std::string path = u.path.empty() ? "/" : u.path;
+    std::vector<std::string> parts;
+    size_t start = 1;
+    while (start <= path.size()) {
+        size_t slash = path.find('/', start);
+        if (slash == std::string::npos) slash = path.size();
+        parts.push_back(path.substr(start, slash - start));
+        start = slash + 1;
+    }
+    if (parts.empty() || parts.back().empty()) {
+        if (!parts.empty()) parts.pop_back();
+        parts.push_back("index");
+    }
+    for (size_t i = 0; i < parts.size(); i++) {
+        std::string name = parts[i];
+        if (i + 1 == parts.size()) {
+            if (u.hasQuery) name += "~" + u.query;
+            if (name.size() < 4 || name.compare(name.size() - 4, 4, ".gmi") != 0) name += ".gmi";
+        }
+        out += "/" + storage::sanitize(name);
+    }
+    return out;
+}
+
+}  // namespace roro::gemini
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <string>
+
+namespace roro::gemini {
+
+// A URL split per RFC 3986 (appendix B). For Gemini, the host is lower-cased and the port
+// defaults to 1965.
+struct Url {
+    std::string scheme, authority, host, path, query, fragment;
+    int port = -1;
+    bool hasAuthority = false, hasQuery = false, hasFragment = false;
+    int portOrDefault() const { return port > 0 ? port : 1965; }
+};
+
+// False unless it has a scheme and a host: only absolute URLs are fetched.
+bool parseUrl(const std::string& text, Url& out);
+bool isGemini(const std::string& url);
+// `ref` against `base`, per RFC 3986 section 5.2 (dot segments included).
+std::string resolve(const std::string& base, const std::string& ref);
+// What goes on the wire: no fragment, lower-case host, never an empty path.
+std::string requestUrl(const std::string& url);
+// For input prompts: everything but unreserved characters percent-encoded (UTF-8 bytes).
+std::string encodeQuery(const std::string& text);
+// Where a Saved Page lives (Q82): /gemini/saved/<host>[_<port>]/<path>[~<query>].gmi
+std::string savedPath(const std::string& url);
+
+}  // namespace roro::gemini
@@ -0,0 +1,100 @@
+#include "gemtext.h"
+
+#include <cstdint>
+
+namespace roro::gemini {
+
+namespace {
+std::string trim(const std::string& s) {
+    size_t a = s.find_first_not_of(" \t"), b = s.find_last_not_of(" \t");
+    return a == std::string::npos ? "" : s.substr(a, b - a + 1);
+}
+}  // namespace
+
+GemLine parseGemLine(const std::string& line, bool& pre) {
+    GemLine g;
+    if (line.compare(0, 3, "```") == 0) {
+        g.type = LineType::PreToggle;
+        g.text = trim(line.substr(3));
+        pre = !pre;
+    } else if (pre) {
+        g.type = LineType::Preformatted;
+        g.text = line;
+    } else if (line.compare(0, 2, "=>") == 0) {
+        g.type = LineType::Link;
+        std::string rest = trim(line.substr(2));
+        size_t gap = rest.find_first_of(" \t");
+        g.url = rest.substr(0, gap);
+        g.text = gap == std::string::npos ? "" : trim(rest.substr(gap));
+        if (g.text.empty()) g.text = g.url;
+    } else if (line.compare(0, 3, "###") == 0) {
+        g.type = LineType::Heading3;
+        g.text = trim(line.substr(3));
+    } else if (line.compare(0, 2, "##") == 0) {
+        g.type = LineType::Heading2;
+        g.text = trim(line.substr(2));
+    } else if (line.compare(0, 1, "#") == 0) {
+        g.type = LineType::Heading1;
+        g.text = trim(line.substr(1));
+    } else if (line.compare(0, 2, "* ") == 0) {
+        g.type = LineType::ListItem;
+        g.text = trim(line.substr(2));
+    } else if (line.compare(0, 1, ">") == 0) {
+        g.type = LineType::Quote;
+        g.text = trim(line.substr(1));
+    } else {
+        g.text = line;
+    }
+    return g;
+}
+
+std::vector<GemLine> parseGemtext(const std::string& document) {
+    std::vector<GemLine> lines;
+    bool pre = false;
+    size_t start = 0;
+    while (start < document.size()) {
+        size_t end = document.find('\n', start);
+        if (end == std::string::npos) end = document.size();
+        std::string line = document.substr(start, end - start);
+        if (!line.empty() && line.back() == '\r') line.pop_back();
+        start = end + 1;
+        lines.push_back(parseGemLine(line, pre));
+    }
+    return lines;
+}
+
+std::string displayText(const std::string& s) {
+    std::string out;
+    size_t column = 0;
+    for (size_t i = 0; i < s.size();) {
+        unsigned char c = static_cast<unsigned char>(s[i]);
+        if (c == '\t') {
+            do out += ' ';
+            while (++column % 4);
+            i++;
+            continue;
+        }
+        if (c < 0x80) {
+            out += static_cast<char>(c);
+            i++;
+        } else {
+            int len = (c & 0xE0) == 0xC0 ? 2 : (c & 0xF0) == 0xE0 ? 3 : (c & 0xF8) == 0xF0 ? 4 : 0;
+            bool valid = len > 0 && i + len <= s.size();
+            for (int k = 1; valid && k < len; k++) valid = (static_cast<unsigned char>(s[i + k]) & 0xC0) == 0x80;
+            if (!valid) {
+                out += '?';
+                i++;
+            } else {
+                uint32_t cp = len == 2 ? (c & 0x1F) : len == 3 ? (c & 0x0F) : (c & 0x07);
+                for (int k = 1; k < len; k++) cp = (cp << 6) | (static_cast<unsigned char>(s[i + k]) & 0x3F);
+                if (cp <= 0xFF) out.append(s, i, len);  // Latin-1: the fonts have it
+                else out += '?';
+                i += len;
+            }
+        }
+        column++;
+    }
+    return out;
+}
+
+}  // namespace roro::gemini
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+namespace roro::gemini {
+
+enum class LineType { Text, Link, Heading1, Heading2, Heading3, ListItem, Quote, PreToggle, Preformatted };
+
+// One gemtext line. Link: `url` and its label in `text` (the URL itself without a label).
+// PreToggle: the ``` line, with its alt text. Preformatted: kept exactly.
+struct GemLine {
+    LineType type = LineType::Text;
+    std::string text, url;
+};
+
+// One line; `preformatted` carries the ``` state from line to line (start with false).
+GemLine parseGemLine(const std::string& line, bool& preformatted);
+std::vector<GemLine> parseGemtext(const std::string& document);
+
+// For the Latin-1 fonts (Q79): valid UTF-8 up to U+00FF kept, anything else '?', and tabs
+// expanded to 4-column stops.
+std::string displayText(const std::string& utf8);
+
+}  // namespace roro::gemini
@@ -0,0 +1,47 @@
+#include "text_buffer.h"
+
+#include <algorithm>
+
+namespace roro::gemini {
+
+void TextBuffer::append(const char* data, size_t len) {
+    bytes_ += len;
+    for (size_t i = 0; i < len; i++) {
+        if (data[i] == '\n') endLine();
+        else partial_ += data[i];
+    }
+}
+
+void TextBuffer::finish() {
+    if (!partial_.empty()) endLine();
+}
+
+void TextBuffer::endLine() {
+    if (!partial_.empty() && partial_.back() == '\r') partial_.pop_back();
+    size_t len = std::min<size_t>(partial_.size(), 0xFFFF);
+    // A line never spans two chunks: a new chunk when it doesn't fit (bigger if the line is).
+    if (chunks_.empty() || chunks_.back().size() + len > chunks_.back().capacity()) {
+        chunks_.emplace_back();
+        chunks_.back().reserve(std::max(kChunk, len));
+    }
+    std::string& chunk = chunks_.back();
+    lines_.push_back({static_cast<uint16_t>(chunks_.size() - 1), static_cast<uint16_t>(chunk.size()),
+                      static_cast<uint16_t>(len)});
+    chunk.append(partial_, 0, len);
+    partial_.clear();
+}
+
+std::string TextBuffer::line(size_t i) const {
+    if (i >= lines_.size()) return "";
+    const Ref& r = lines_[i];
+    return chunks_[r.chunk].substr(r.offset, r.length);
+}
+
+void TextBuffer::clear() {
+    chunks_.clear();
+    lines_.clear();
+    partial_.clear();
+    bytes_ = 0;
+}
+
+}  // namespace roro::gemini
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::gemini {
+
+// A page's text, kept as lines in 4 KB chunks: no large contiguous block (with IRC connected the
+// largest free block is about 31 KB) and no copy when it grows. About 4 bytes per line on top of
+// the text itself. Bytes are fed as they arrive; lines end at LF, a CR before it is dropped.
+class TextBuffer {
+   public:
+    static constexpr size_t kChunk = 4096;
+
+    void append(const char* data, size_t len);
+    void finish();  // the last line, if it has no line end
+    size_t lineCount() const { return lines_.size(); }
+    std::string line(size_t i) const;
+    size_t bytes() const { return bytes_; }
+    void clear();
+
+   private:
+    struct Ref {
+        uint16_t chunk;
+        uint16_t offset;
+        uint16_t length;
+    };
+    void endLine();
+
+    std::vector<std::string> chunks_;
+    std::vector<Ref> lines_;
+    std::string partial_;  // the line being received
+    size_t bytes_ = 0;
+};
+
+}  // namespace roro::gemini
@@ -0,0 +1,50 @@
+#include "geo_format.h"
+
+#include <cmath>
+#include <cstdio>
+
+namespace roro::gnss {
+
+namespace {
+const char* hemisphere(double degrees, bool latitude) {
+    return latitude ? (degrees < 0 ? "S" : "N") : (degrees < 0 ? "W" : "E");
+}
+}  // namespace
+
+std::string formatDecimal(double degrees, bool latitude) {
+    char buf[32];
+    std::snprintf(buf, sizeof buf, "%.5f\xC2\xB0 %s", std::fabs(degrees), hemisphere(degrees, latitude));
+    return buf;
+}
+
+std::string formatDms(double degrees, bool latitude) {
+    // Work in tenths of a second, so rounding carries into minutes and degrees.
+    long tenths = std::lround(std::fabs(degrees) * 36000.0);
+    long d = tenths / 36000, m = tenths / 600 % 60, s10 = tenths % 600;
+    char buf[40];
+    std::snprintf(buf, sizeof buf, "%ld\xC2\xB0 %02ld' %02ld.%ld\" %s", d, m, s10 / 10, s10 % 10,
+                  hemisphere(degrees, latitude));
+    return buf;
+}
+
+std::string maidenhead(double latitude, double longitude) {
+    double lon = std::fmin(std::fmax(longitude + 180.0, 0.0), 359.999999);
+    double lat = std::fmin(std::fmax(latitude + 90.0, 0.0), 179.999999);
+    std::string out;
+    out += static_cast<char>('A' + static_cast<int>(lon / 20));
+    out += static_cast<char>('A' + static_cast<int>(lat / 10));
+    out += static_cast<char>('0' + static_cast<int>(std::fmod(lon, 20) / 2));
+    out += static_cast<char>('0' + static_cast<int>(std::fmod(lat, 10)));
+    out += static_cast<char>('a' + static_cast<int>(std::fmod(lon, 2) * 12));
+    out += static_cast<char>('a' + static_cast<int>(std::fmod(lat, 1) * 24));
+    return out;
+}
+
+SkyPoint skyPosition(int azimuthDeg, int elevationDeg, int cx, int cy, int radius) {
+    int elevation = elevationDeg < 0 ? 0 : elevationDeg > 90 ? 90 : elevationDeg;
+    double r = radius * (90 - elevation) / 90.0;
+    double az = azimuthDeg * M_PI / 180.0;
+    return {cx + static_cast<int>(std::lround(r * std::sin(az))), cy - static_cast<int>(std::lround(r * std::cos(az)))};
+}
+
+}  // namespace roro::gnss
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <string>
+
+namespace roro::gnss {
+
+// "50.86920° N": five decimals, about a metre.
+std::string formatDecimal(double degrees, bool latitude);
+// "50° 52' 09.1\" N" (Settings → Coordinates, Q64).
+std::string formatDms(double degrees, bool latitude);
+// The 6-character Maidenhead locator ("JO20ef"), as radio amateurs give their square.
+std::string maidenhead(double latitude, double longitude);
+
+// Where a satellite goes on the Sky view: the zenith in the centre, the horizon on the circle,
+// north up and east right (as seen looking at the sky from above, like a map).
+struct SkyPoint {
+    int x, y;
+};
+SkyPoint skyPosition(int azimuthDeg, int elevationDeg, int cx, int cy, int radius);
+
+}  // namespace roro::gnss
@@ -0,0 +1,234 @@
+#include "nmea_parser.h"
+
+#include <cstdlib>
+
+namespace roro::gnss {
+
+namespace {
+
+constexpr double kKmhPerKnot = 1.852;
+
+int hexValue(char c) {
+    if (c >= '0' && c <= '9') return c - '0';
+    if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+    if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+    return -1;
+}
+
+Constellation fromTalker(const std::string& t) {
+    if (t == "GP") return Constellation::Gps;
+    if (t == "GL") return Constellation::Glonass;
+    if (t == "GA") return Constellation::Galileo;
+    if (t == "GB" || t == "BD") return Constellation::BeiDou;
+    if (t == "GQ" || t == "QZ") return Constellation::Qzss;
+    if (t == "GI") return Constellation::Navic;
+    return Constellation::Unknown;  // GN: combined
+}
+
+// GSA's system ID field (NMEA 4.10).
+Constellation fromSystemId(int id) {
+    switch (id) {
+        case 1: return Constellation::Gps;
+        case 2: return Constellation::Glonass;
+        case 3: return Constellation::Galileo;
+        case 4: return Constellation::BeiDou;
+        case 5: return Constellation::Qzss;
+        case 6: return Constellation::Navic;
+        default: return Constellation::Unknown;
+    }
+}
+
+bool number(const std::string& s, double& out) {
+    if (s.empty()) return false;
+    char* end;
+    out = std::strtod(s.c_str(), &end);
+    return *end == '\0';
+}
+
+int integer(const std::string& s, int fallback = 0) {
+    double v;
+    return number(s, v) ? static_cast<int>(v) : fallback;
+}
+
+// "ddmm.mmmm" / "dddmm.mmmm" with its hemisphere letter.
+bool coordinate(const std::string& value, const std::string& hemisphere, double& out) {
+    double raw;
+    if (!number(value, raw) || hemisphere.empty()) return false;
+    int degrees = static_cast<int>(raw / 100);
+    out = degrees + (raw - degrees * 100) / 60.0;
+    if (hemisphere == "S" || hemisphere == "W") out = -out;
+    return true;
+}
+
+// Days since 1970-01-01 for a civil date (Howard Hinnant's algorithm).
+int64_t daysFromCivil(int y, int m, int d) {
+    y -= m <= 2;
+    const int64_t era = (y >= 0 ? y : y - 399) / 400;
+    const unsigned yoe = static_cast<unsigned>(y - era * 400);
+    const unsigned doy = (153 * (m + (m > 2 ? -3 : 9)) + 2) / 5 + d - 1;
+    const unsigned doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    return era * 146097 + static_cast<int64_t>(doe) - 719468;
+}
+
+}  // namespace
+
+const char* constellationName(Constellation c) {
+    switch (c) {
+        case Constellation::Gps: return "GPS";
+        case Constellation::Glonass: return "GLONASS";
+        case Constellation::Galileo: return "Galileo";
+        case Constellation::BeiDou: return "BeiDou";
+        case Constellation::Qzss: return "QZSS";
+        case Constellation::Navic: return "NavIC";
+        default: return "?";
+    }
+}
+
+int64_t GnssState::utcSeconds() const {
+    return daysFromCivil(year, month, day) * 86400 + hour * 3600 + minute * 60 + second;
+}
+
+void NmeaParser::feed(const char* data, size_t len) {
+    for (size_t i = 0; i < len; i++) {
+        char c = data[i];
+        if (c == '\n') {
+            if (!overflow_ && !line_.empty()) {
+                if (onLine) onLine(line_);
+                sentence(line_);
+            }
+            line_.clear();
+            overflow_ = false;
+        } else if (c != '\r') {
+            if (line_.size() >= kMaxLine) overflow_ = true;
+            else line_ += c;
+        }
+    }
+}
+
+bool NmeaParser::sentence(const std::string& line) {
+    size_t star = line.rfind('*');
+    if (line.size() < 7 || line[0] != '$' || star == std::string::npos || star + 3 != line.size()) {
+        bad_++;
+        return false;
+    }
+    uint8_t sum = 0;
+    for (size_t i = 1; i < star; i++) sum ^= static_cast<uint8_t>(line[i]);
+    int hi = hexValue(line[star + 1]), lo = hexValue(line[star + 2]);
+    if (hi < 0 || lo < 0 || sum != (hi << 4 | lo)) {
+        bad_++;
+        return false;
+    }
+    good_++;
+
+    Fields f;
+    size_t start = 1;
+    for (size_t i = 1; i <= star; i++)
+        if (i == star || line[i] == ',') {
+            f.push_back(line.substr(start, i - start));
+            start = i + 1;
+        }
+    if (f[0].size() < 5) return true;
+    std::string talker = f[0].substr(0, 2), type = f[0].substr(f[0].size() - 3);
+    if (type == "RMC") rmc(f);
+    else if (type == "GGA") gga(f);
+    else if (type == "GSA") gsa(f, fromTalker(talker));
+    else if (type == "GSV") gsv(f, fromTalker(talker));
+    return true;
+}
+
+void NmeaParser::rmc(const Fields& f) {
+    if (f.size() < 10) return;
+    bool active = f[2] == "A";
+    double lat, lon;
+    state_.positionValid = active && coordinate(f[3], f[4], lat) && coordinate(f[5], f[6], lon);
+    if (state_.positionValid) {
+        state_.latitude = lat;
+        state_.longitude = lon;
+    }
+    double knots, course;
+    state_.speedKmh = active && number(f[7], knots) ? static_cast<float>(knots * kKmhPerKnot) : 0;
+    state_.courseValid = active && number(f[8], course);
+    if (state_.courseValid) state_.courseDeg = static_cast<float>(course);
+
+    const std::string &t = f[1], &d = f[9];
+    state_.timeValid = active && t.size() >= 6 && d.size() == 6;
+    if (state_.timeValid) {
+        state_.hour = integer(t.substr(0, 2));
+        state_.minute = integer(t.substr(2, 2));
+        state_.second = integer(t.substr(4, 2));
+        state_.day = integer(d.substr(0, 2));
+        state_.month = integer(d.substr(2, 2));
+        state_.year = 2000 + integer(d.substr(4, 2));
+    }
+}
+
+void NmeaParser::gga(const Fields& f) {
+    if (f.size() < 10) return;
+    int quality = integer(f[6]);
+    double lat, lon, hdop, alt;
+    state_.positionValid = quality > 0 && coordinate(f[2], f[3], lat) && coordinate(f[4], f[5], lon);
+    if (state_.positionValid) {
+        state_.latitude = lat;
+        state_.longitude = lon;
+    }
+    state_.satellitesUsed = integer(f[7]);
+    if (number(f[8], hdop)) state_.hdop = static_cast<float>(hdop);
+    state_.altitudeValid = quality > 0 && number(f[9], alt);
+    if (state_.altitudeValid) state_.altitudeM = static_cast<float>(alt);
+}
+
+void NmeaParser::gsa(const Fields& f, Constellation talker) {
+    if (f.size() < 18) return;
+    int mode = integer(f[2], 1);
+    state_.fix = mode == 3 ? FixType::ThreeD : mode == 2 ? FixType::TwoD : FixType::None;
+    Constellation system = f.size() > 18 ? fromSystemId(integer(f[18])) : talker;
+    if (system == Constellation::Unknown) return;  // can't tell whose satellites these are
+    std::set<int>& used = used_[static_cast<int>(system)];
+    used.clear();
+    for (size_t i = 3; i <= 14; i++)
+        if (!f[i].empty()) used.insert(integer(f[i]));
+    rebuildSatellites();
+}
+
+void NmeaParser::gsv(const Fields& f, Constellation talker) {
+    if (f.size() < 4 || talker == Constellation::Unknown) return;
+    int total = integer(f[1]), number = integer(f[2]);
+    size_t extra = f.size() - 4;
+    int signal = extra % 4 == 1 ? integer(f.back()) : 0;  // NMEA 4.10 signal ID, last
+    auto key = std::make_pair(static_cast<int>(talker), signal);
+    std::vector<Satellite>& pending = pending_[key];
+    if (number == 1) pending.clear();
+    for (size_t i = 4; i + 3 < f.size(); i += 4) {
+        Satellite s;
+        s.system = talker;
+        s.prn = integer(f[i]);
+        s.elevation = integer(f[i + 1]);
+        s.azimuth = integer(f[i + 2]);
+        s.snr = integer(f[i + 3], -1);
+        if (s.prn > 0) pending.push_back(s);
+    }
+    if (number == total) {
+        inView_[key] = pending;
+        pending.clear();
+        rebuildSatellites();
+    }
+}
+
+void NmeaParser::rebuildSatellites() {
+    std::vector<Satellite> merged;
+    for (auto& [key, list] : inView_)
+        for (const Satellite& s : list) {
+            Satellite* same = nullptr;
+            for (auto& m : merged)
+                if (m.system == s.system && m.prn == s.prn) same = &m;
+            if (!same) merged.push_back(s);
+            else if (s.snr > same->snr) same->snr = s.snr;
+        }
+    for (auto& s : merged) {
+        auto it = used_.find(static_cast<int>(s.system));
+        s.used = it != used_.end() && it->second.count(s.prn) > 0;
+    }
+    state_.satellites = std::move(merged);
+}
+
+}  // namespace roro::gnss
@@ -0,0 +1,82 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace roro::gnss {
+
+enum class Constellation : uint8_t { Unknown, Gps, Glonass, Galileo, BeiDou, Qzss, Navic };
+const char* constellationName(Constellation c);
+
+enum class FixType : uint8_t { None, TwoD, ThreeD };
+
+struct Satellite {
+    Constellation system = Constellation::Unknown;
+    int prn = 0;
+    int elevation = 0;  // degrees above the horizon
+    int azimuth = 0;    // degrees from north, clockwise
+    int snr = -1;       // dB-Hz; -1 when not tracked
+    bool used = false;  // part of the current Fix
+};
+
+// Everything the receiver has said, as of the last sentence (see CONTEXT.md: Fix).
+struct GnssState {
+    FixType fix = FixType::None;
+    bool positionValid = false;
+    double latitude = 0, longitude = 0;  // degrees, south and west negative
+    bool altitudeValid = false;
+    float altitudeM = 0;  // above mean sea level
+    float speedKmh = 0;
+    bool courseValid = false;
+    float courseDeg = 0;
+    int satellitesUsed = 0;
+    float hdop = 99.9f;
+    // UTC, trusted only with a Fix: the receiver reports a time without one, from its own clock.
+    bool timeValid = false;
+    int year = 0, month = 0, day = 0, hour = 0, minute = 0, second = 0;
+    std::vector<Satellite> satellites;  // in view, all constellations, one entry per satellite
+
+    int64_t utcSeconds() const;  // seconds since 1970-01-01 UTC; meaningful when timeValid
+};
+
+// NMEA 0183 (4.10 style, as the Cap's AT6668 sends it): RMC, GGA, GSA and GSV, with the
+// constellation taken from the talker ID or GSA's system ID field. Host-tested; no hardware here.
+class NmeaParser {
+   public:
+    // Raw bytes from the UART, in any chunks.
+    void feed(const char* data, size_t len);
+    // One sentence without its line end. False if malformed or its checksum is wrong.
+    bool sentence(const std::string& line);
+
+    // Called with every complete line fed in, valid or not (`gnss nmea on` echoes them).
+    std::function<void(const std::string&)> onLine;
+
+    const GnssState& state() const { return state_; }
+    uint32_t goodSentences() const { return good_; }
+    uint32_t badSentences() const { return bad_; }
+
+   private:
+    using Fields = std::vector<std::string>;
+    void rmc(const Fields& f);
+    void gga(const Fields& f);
+    void gsa(const Fields& f, Constellation talker);
+    void gsv(const Fields& f, Constellation talker);
+    void rebuildSatellites();
+
+    static constexpr size_t kMaxLine = 120;
+    std::string line_;
+    bool overflow_ = false;
+    uint32_t good_ = 0, bad_ = 0;
+    GnssState state_;
+    // GSV sequences per (constellation, signal): pending until their last message.
+    std::map<std::pair<int, int>, std::vector<Satellite>> pending_, inView_;
+    std::map<int, std::set<int>> used_;  // per constellation, from GSA
+};
+
+}  // namespace roro::gnss
@@ -0,0 +1,76 @@
+#include "track.h"
+
+#include <cmath>
+#include <cstdio>
+#include <ctime>
+
+namespace roro::gnss {
+
+namespace {
+
+constexpr double kEarthRadiusM = 6371000.0;
+
+double radians(double degrees) { return degrees * M_PI / 180.0; }
+
+// UTC fields from seconds since 1970 (gmtime_r works on the device and the PC alike).
+struct tm utc(int64_t seconds) {
+    time_t t = static_cast<time_t>(seconds);
+    struct tm out;
+    gmtime_r(&t, &out);
+    return out;
+}
+
+}  // namespace
+
+double distanceMeters(double lat1, double lon1, double lat2, double lon2) {
+    double dLat = radians(lat2 - lat1), dLon = radians(lon2 - lon1);
+    double h = std::sin(dLat / 2) * std::sin(dLat / 2) +
+               std::cos(radians(lat1)) * std::cos(radians(lat2)) * std::sin(dLon / 2) * std::sin(dLon / 2);
+    return 2 * kEarthRadiusM * std::asin(std::sqrt(h));
+}
+
+bool TrackRule::due(uint32_t nowMs, double lat, double lon) {
+    if (any_ && (nowMs - lastMs_ < kEveryMs || distanceMeters(lat_, lon_, lat, lon) < kMinMeters)) return false;
+    any_ = true;
+    lastMs_ = nowMs;
+    lat_ = lat;
+    lon_ = lon;
+    return true;
+}
+
+std::string trackPath(int64_t utcSeconds) {
+    struct tm t = utc(utcSeconds);
+    char buf[48];
+    std::snprintf(buf, sizeof buf, "/gnss/tracks/%04d%02d%02d-%02d%02d%02d.gpx", t.tm_year + 1900, t.tm_mon + 1,
+                  t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
+    return buf;
+}
+
+namespace gpx {
+
+std::string header(const std::string& name) {
+    return "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
+           "<gpx version=\"1.1\" creator=\"roro9stack\" xmlns=\"http://www.topografix.com/GPX/1/1\">\n"
+           "<trk><name>" + name + "</name><trkseg>";
+}
+
+std::string point(double lat, double lon, bool hasElevation, float elevationM, int64_t utcSeconds) {
+    struct tm t = utc(utcSeconds);
+    char buf[160], ele[32] = "";
+    if (hasElevation) std::snprintf(ele, sizeof ele, "<ele>%.1f</ele>", elevationM);
+    std::snprintf(buf, sizeof buf,
+                  "<trkpt lat=\"%.7f\" lon=\"%.7f\">%s<time>%04d-%02d-%02dT%02d:%02d:%02dZ</time></trkpt>", lat, lon,
+                  ele, t.tm_year + 1900, t.tm_mon + 1, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
+    return buf;
+}
+
+std::string footer() { return "</trkseg></trk></gpx>"; }
+
+bool finished(const std::string& tail) {
+    size_t end = tail.find_last_not_of(" \r\n\t");
+    return end != std::string::npos && end + 1 >= 6 && tail.compare(end + 1 - 6, 6, "</gpx>") == 0;
+}
+
+}  // namespace gpx
+
+}  // namespace roro::gnss
@@ -0,0 +1,40 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+namespace roro::gnss {
+
+// Great-circle distance in metres (haversine, mean Earth radius).
+double distanceMeters(double lat1, double lon1, double lat2, double lon2);
+
+// When a Track takes its next point (Q63): the first one always, then at least every 5 s and only
+// after moving at least 5 m, so standing still doesn't fill the card.
+class TrackRule {
+   public:
+    static constexpr uint32_t kEveryMs = 5000;
+    static constexpr double kMinMeters = 5.0;
+
+    // True if this position should be recorded (and is then remembered as the last point).
+    bool due(uint32_t nowMs, double lat, double lon);
+    void reset() { any_ = false; }
+
+   private:
+    bool any_ = false;
+    uint32_t lastMs_ = 0;
+    double lat_ = 0, lon_ = 0;
+};
+
+// "/gnss/tracks/YYYYMMDD-HHMMSS.gpx", from the UTC start time (Storage Clean-up reads its date).
+std::string trackPath(int64_t utcSeconds);
+
+// GPX 1.1, written a line at a time: the header when a Track starts, a point per line, the footer
+// when it stops. A file whose footer never came (power lost) is closed at the next boot.
+namespace gpx {
+std::string header(const std::string& name);
+std::string point(double lat, double lon, bool hasElevation, float elevationM, int64_t utcSeconds);
+std::string footer();
+bool finished(const std::string& tail);  // the end of a file: does it close the GPX?
+}  // namespace gpx
+
+}  // namespace roro::gnss
@@ -0,0 +1,64 @@
+#include "loratap.h"
+
+#include <algorithm>
+#include <cmath>
+#include <cstdio>
+#include <ctime>
+
+namespace roro::lora {
+
+static void le16(std::vector<uint8_t>& o, uint16_t v) { o.insert(o.end(), {uint8_t(v), uint8_t(v >> 8)}); }
+static void le32(std::vector<uint8_t>& o, uint32_t v) {
+    o.insert(o.end(), {uint8_t(v), uint8_t(v >> 8), uint8_t(v >> 16), uint8_t(v >> 24)});
+}
+
+// LoRaTap's dBm encoding: -139 dBm plus the byte, clamped to what a byte holds.
+static uint8_t dbmByte(float dbm) {
+    long v = std::lround(dbm + 139);
+    return static_cast<uint8_t>(std::clamp(v, 0L, 255L));
+}
+
+std::string capturePath(int64_t utcSeconds) {
+    time_t t = static_cast<time_t>(utcSeconds);
+    struct tm u;
+    gmtime_r(&t, &u);
+    char buf[48];
+    std::snprintf(buf, sizeof buf, "/captures/lora/%04d%02d%02d-%02d%02d%02d.pcap", u.tm_year + 1900, u.tm_mon + 1,
+                  u.tm_mday, u.tm_hour, u.tm_min, u.tm_sec);
+    return buf;
+}
+
+void appendPcapHeader(std::vector<uint8_t>& out) {
+    le32(out, 0xA1B2C3D4);
+    le16(out, 2);
+    le16(out, 4);
+    le32(out, 0);      // time zone
+    le32(out, 0);      // timestamp accuracy
+    le32(out, 65535);  // snap length
+    le32(out, 270);    // LINKTYPE_LORATAP
+}
+
+void appendRecord(std::vector<uint8_t>& out, uint32_t seconds, uint32_t micros, const RxInfo& rx, const uint8_t* data,
+                  size_t len) {
+    uint32_t captured = static_cast<uint32_t>(kLoraTapSize + len);
+    le32(out, seconds);
+    le32(out, micros);
+    le32(out, captured);
+    le32(out, captured);
+
+    uint32_t f = rx.frequencyHz;
+    // The spec puts packet RSSI in quarter dB below 0 dB SNR (an SX127x formula), but Wireshark
+    // reads it as -139 dBm plus the byte either way, and the SX1262 already gives dBm.
+    uint8_t packetRssi = dbmByte(rx.rssi);
+    long snr = std::clamp(std::lround(rx.snr * 4), -128L, 127L);
+    out.insert(out.end(), {
+                              0, 0, 0, uint8_t(kLoraTapSize),  // version 0, padding, length
+                              uint8_t(f >> 24), uint8_t(f >> 16), uint8_t(f >> 8), uint8_t(f),
+                              uint8_t(std::lround(rx.bandwidthKHz / 125)), rx.spreadingFactor,
+                              packetRssi, dbmByte(rx.rssi), dbmByte(rx.noiseFloor),
+                              static_cast<uint8_t>(static_cast<int8_t>(snr)), rx.syncWord,
+                          });
+    if (len) out.insert(out.end(), data, data + len);
+}
+
+}  // namespace roro::lora
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::lora {
+
+// What the radio knew about one received packet.
+struct RxInfo {
+    uint32_t frequencyHz = 0;
+    float bandwidthKHz = 0;
+    uint8_t spreadingFactor = 0;
+    float rssi = 0;        // dBm
+    float snr = 0;         // dB
+    float noiseFloor = 0;  // dBm, instantaneous RSSI just before the packet, when known
+    uint8_t syncWord = 0;
+};
+
+// A Capture file (M3, Q97): pcap with LoRaTap v0 headers (LINKTYPE_LORATAP, 270), which Wireshark
+// reads. pcap fields are little-endian, LoRaTap fields big-endian.
+void appendPcapHeader(std::vector<uint8_t>& out);
+void appendRecord(std::vector<uint8_t>& out, uint32_t seconds, uint32_t micros, const RxInfo& rx, const uint8_t* data,
+                  size_t len);
+
+// "/captures/lora/YYYYMMDD-HHMMSS.pcap" in UTC, dated like Tracks so Storage Clean-up can age it.
+std::string capturePath(int64_t utcSeconds);
+
+constexpr size_t kLoraTapSize = 15;
+constexpr size_t kRecordOverhead = 16 + kLoraTapSize;
+
+}  // namespace roro::lora
@@ -0,0 +1,83 @@
+#include "packet_view.h"
+
+#include <cmath>
+#include <cstdio>
+
+#include "meshtastic_header.h"
+#include "meshtastic_presets.h"
+
+namespace roro::lora {
+
+using namespace meshtastic;
+
+std::string row(const PacketSummary& p, const std::string& time) {
+    char s[64];
+    int n = std::snprintf(s, sizeof s, "%s %ld %.1f ", time.c_str(), std::lround(p.rssi), p.snr);
+    std::string out(s, n);
+    PacketHeader h;
+    if (!p.crcOk) return out + "bad CRC, " + std::to_string(p.len) + " B";
+    if (!p.meshtastic || !parseHeader(p.data, p.len, h)) return out + std::to_string(p.len) + " B";
+    auto shortId = [](uint32_t node) {
+        if (node == kBroadcast) return std::string("all");
+        char id[8];
+        std::snprintf(id, sizeof id, "%04x", static_cast<unsigned>(node & 0xFFFF));
+        return std::string(id);
+    };
+    out += shortId(h.from) + ">" + shortId(h.to);
+    if (h.hopsAway() >= 0) out += " " + std::to_string(h.hopsAway()) + "/" + std::to_string(h.hopStart());
+    return out;
+}
+
+std::vector<std::string> hexDump(const uint8_t* data, size_t len) {
+    std::vector<std::string> lines;
+    for (size_t at = 0; at < len; at += 8) {
+        char s[48];
+        int n = std::snprintf(s, sizeof s, "%04x", static_cast<unsigned>(at));
+        std::string text;
+        for (size_t i = 0; i < 8; ++i) {
+            if (at + i < len) {
+                n += std::snprintf(s + n, sizeof s - n, " %02x", data[at + i]);
+                uint8_t b = data[at + i];
+                text += b >= 0x20 && b < 0x7F ? static_cast<char>(b) : '.';
+            } else {
+                n += std::snprintf(s + n, sizeof s - n, "   ");
+            }
+        }
+        lines.push_back(std::string(s, n) + " " + text);
+    }
+    return lines;
+}
+
+std::vector<std::string> headerLines(const uint8_t* data, size_t len) {
+    PacketHeader h;
+    if (!parseHeader(data, len, h)) return {};
+    char s[64];
+    std::vector<std::string> lines;
+    lines.push_back("From " + nodeId(h.from) + " to " + nodeId(h.to));
+    std::snprintf(s, sizeof s, "Packet %08x%s%s", static_cast<unsigned>(h.id), h.wantAck() ? ", wants an ack" : "",
+                  h.viaMqtt() ? ", via MQTT" : "");
+    lines.push_back(s);
+    if (h.hopsAway() >= 0)
+        std::snprintf(s, sizeof s, "Hops %d of %u, limit %u left", h.hopsAway(), h.hopStart(), h.hopLimit());
+    else
+        std::snprintf(s, sizeof s, "Hop limit %u left (old firmware)", h.hopLimit());
+    lines.push_back(s);
+    // Which preset's default Channel (named after it, with the public key) has this hash.
+    std::string channel;
+    for (size_t i = 0; i < kEu868PresetCount && channel.empty(); ++i)
+        if (channelHash(kEu868Presets[i].name, kDefaultKey, sizeof kDefaultKey) == h.channelHash)
+            channel = std::string(" (") + kEu868Presets[i].name + ", default key)";
+    std::snprintf(s, sizeof s, "Channel 0x%02x%s", h.channelHash, channel.c_str());
+    lines.push_back(s);
+    if (h.relayNode) {
+        std::snprintf(s, sizeof s, "Relayed by ..%02x", h.relayNode);
+        lines.push_back(s);
+    }
+    if (h.nextHop) {
+        std::snprintf(s, sizeof s, "Next hop ..%02x", h.nextHop);
+        lines.push_back(s);
+    }
+    return lines;
+}
+
+}  // namespace roro::lora
@@ -0,0 +1,29 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::lora {
+
+// What the LoRa Scanner shows of one packet (M3, Q96).
+struct PacketSummary {
+    const uint8_t* data;
+    size_t len;
+    float rssi, snr;
+    bool crcOk;
+    bool meshtastic;  // received on Meshtastic settings (sync word 0x2B): read its clear header
+};
+
+// One list row, at most about 36 characters: "21:45:07 -97 6.2 5678>all 1/3". Nodes by their default
+// short name (the last 4 hex digits); headerLines() has the full numbers.
+std::string row(const PacketSummary& p, const std::string& time);
+
+// Eight bytes a line, with the printable ones: "0000 ff ff ff ff 78 56 34 12 ....xV4.".
+std::vector<std::string> hexDump(const uint8_t* data, size_t len);
+
+// The Meshtastic header, one field a line; empty when the packet is too short to have one.
+std::vector<std::string> headerLines(const uint8_t* data, size_t len);
+
+}  // namespace roro::lora
@@ -0,0 +1,48 @@
+#include "sweep_view.h"
+
+#include <algorithm>
+
+namespace roro::lora {
+
+namespace {
+constexpr int kPeakAboveFloorDb = 10;
+constexpr size_t kMaxPeaks = 3;
+}  // namespace
+
+SweepStats summarize(const int8_t* dbm, size_t steps, uint32_t fromHz, uint32_t stepHz) {
+    SweepStats s;
+    if (!steps) return s;
+    std::vector<int8_t> sorted(dbm, dbm + steps);
+    std::nth_element(sorted.begin(), sorted.begin() + steps / 2, sorted.end());
+    s.floor = sorted[steps / 2];
+    s.top = *std::max_element(dbm, dbm + steps);
+    for (size_t i = 0; i < steps; ++i) {
+        int v = dbm[i];
+        bool localMax = (i == 0 || v >= dbm[i - 1]) && (i + 1 == steps || v > dbm[i + 1]);
+        if (localMax && v >= s.floor + kPeakAboveFloorDb) s.peaks.push_back({fromHz + static_cast<uint32_t>(i) * stepHz, v});
+    }
+    std::stable_sort(s.peaks.begin(), s.peaks.end(), [](const SweepPeak& a, const SweepPeak& b) { return a.dbm > b.dbm; });
+    if (s.peaks.size() > kMaxPeaks) s.peaks.resize(kMaxPeaks);
+    return s;
+}
+
+uint8_t heatLevel(int dbm, int low, int high) {
+    if (dbm <= low) return 0;
+    if (dbm >= high) return 255;
+    return static_cast<uint8_t>((dbm - low) * 255 / (high - low) + ((dbm - low) * 255 % (high - low) ? 1 : 0));
+}
+
+uint16_t heatColor(uint8_t level) {
+    // Five segments of 51 steps each.
+    auto rgb = [](int r, int g, int b) { return static_cast<uint16_t>((r >> 3) << 11 | (g >> 2) << 5 | (b >> 3)); };
+    int seg = std::min(level / 51, 4), t = (level - seg * 51) * 255 / 51;
+    switch (seg) {
+        case 0: return rgb(0, 0, t);              // black to blue
+        case 1: return rgb(0, t, 255);            // blue to cyan
+        case 2: return rgb(0, 255, 255 - t);      // cyan to green
+        case 3: return rgb(t, 255, 0);            // green to yellow
+        default: return rgb(255, 255 - t, 0);     // yellow to red
+    }
+}
+
+}  // namespace roro::lora
@@ -0,0 +1,27 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+namespace roro::lora {
+
+// What a Sweep pass says about the band (M3, Q98): one RSSI reading (dBm) per step.
+struct SweepPeak {
+    uint32_t hz;
+    int dbm;
+};
+struct SweepStats {
+    int floor = 0;  // the median: the band's noise floor, whatever a few signals do
+    int top = 0;    // the strongest reading
+    std::vector<SweepPeak> peaks;  // at most 3, strongest first, each a local maximum >= 10 dB above the floor
+};
+
+SweepStats summarize(const int8_t* dbm, size_t steps, uint32_t fromHz, uint32_t stepHz);
+
+// The waterfall's colours: a reading between `low` and `high` dBm as 0..255, then RGB565 along
+// black, blue, cyan, green, yellow, red.
+uint8_t heatLevel(int dbm, int low, int high);
+uint16_t heatColor(uint8_t level);
+
+}  // namespace roro::lora
@@ -0,0 +1,28 @@
+#include "meshtastic_header.h"
+
+#include <cstdio>
+
+namespace roro::meshtastic {
+
+static uint32_t le32(const uint8_t* p) { return p[0] | p[1] << 8 | p[2] << 16 | static_cast<uint32_t>(p[3]) << 24; }
+
+bool parseHeader(const uint8_t* data, size_t len, PacketHeader& out) {
+    if (!data || len < kHeaderSize) return false;
+    out.to = le32(data);
+    out.from = le32(data + 4);
+    out.id = le32(data + 8);
+    out.flags = data[12];
+    out.channelHash = data[13];
+    out.nextHop = data[14];
+    out.relayNode = data[15];
+    return true;
+}
+
+std::string nodeId(uint32_t node) {
+    if (node == kBroadcast) return "all";
+    char s[10];
+    std::snprintf(s, sizeof s, "!%08x", static_cast<unsigned>(node));
+    return s;
+}
+
+}  // namespace roro::meshtastic
@@ -0,0 +1,36 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace roro::meshtastic {
+
+constexpr uint32_t kBroadcast = 0xFFFFFFFF;
+
+// The 16 bytes every Meshtastic packet starts with, sent in clear (little-endian). The payload
+// after it is encrypted with the Channel's key.
+struct PacketHeader {
+    uint32_t to = 0, from = 0, id = 0;
+    uint8_t flags = 0;
+    uint8_t channelHash = 0;  // the Channel's name and key folded into a byte (see channelHash())
+    uint8_t nextHop = 0;      // last byte of the Node meant to relay it next; 0 when flooding
+    uint8_t relayNode = 0;    // last byte of the Node that relayed it to us
+
+    uint8_t hopLimit() const { return flags & 0x07; }
+    bool wantAck() const { return flags & 0x08; }
+    bool viaMqtt() const { return flags & 0x10; }
+    uint8_t hopStart() const { return flags >> 5; }
+    bool broadcast() const { return to == kBroadcast; }
+    // How many times it was relayed before we heard it; -1 when the sender didn't say (hop start 0).
+    int hopsAway() const { return hopStart() == 0 ? -1 : hopStart() - hopLimit(); }
+};
+
+constexpr size_t kHeaderSize = 16;
+
+bool parseHeader(const uint8_t* data, size_t len, PacketHeader& out);
+
+// "!12345678", as Meshtastic writes node numbers; "all" for broadcast.
+std::string nodeId(uint32_t node);
+
+}  // namespace roro::meshtastic
@@ -0,0 +1,47 @@
+#include "meshtastic_presets.h"
+
+#include <cmath>
+#include <cstring>
+
+namespace roro::meshtastic {
+
+const uint8_t kDefaultKey[16] = {0xd4, 0xf1, 0xbb, 0x3a, 0x20, 0x29, 0x07, 0x59,
+                                 0xf0, 0xbc, 0xff, 0xab, 0xcf, 0x4e, 0x69, 0x01};
+
+// firmware src/mesh/MeshRadio.h (modemPresetToParams) and RadioInterface.cpp (PRESETS_EU_868).
+const Preset kEu868Presets[] = {
+    {"LongFast", 250, 11, 5},  {"LongSlow", 125, 12, 8},  {"MediumSlow", 250, 10, 5}, {"MediumFast", 250, 9, 5},
+    {"ShortSlow", 250, 8, 5},  {"ShortFast", 250, 7, 5},  {"LongMod", 125, 11, 8},
+};
+const size_t kEu868PresetCount = sizeof kEu868Presets / sizeof kEu868Presets[0];
+
+const Preset* findPreset(const char* name) {
+    for (const Preset& p : kEu868Presets)
+        if (std::strcmp(p.name, name) == 0) return &p;
+    return nullptr;
+}
+
+uint32_t djb2(const char* s) {
+    uint32_t h = 5381;
+    for (; *s; ++s) h = (h << 5) + h + static_cast<unsigned char>(*s);
+    return h;
+}
+
+uint8_t channelHash(const char* name, const uint8_t* key, size_t keyLen) {
+    uint8_t h = 0;
+    for (; *name; ++name) h ^= static_cast<uint8_t>(*name);
+    for (size_t i = 0; i < keyLen; ++i) h ^= key[i];
+    return h;
+}
+
+uint32_t eu868FrequencyHz(const Preset& preset, const char* channelName) {
+    constexpr double kStartMHz = 869.4, kEndMHz = 869.65;
+    double slotMHz = preset.bwKHz / 1000.0;
+    uint32_t slots = static_cast<uint32_t>(std::lround((kEndMHz - kStartMHz) / slotMHz));
+    const char* name = channelName && *channelName ? channelName : preset.name;
+    uint32_t slot = slots ? djb2(name) % slots : 0;
+    double mhz = kStartMHz + slotMHz / 2 + slot * slotMHz;
+    return static_cast<uint32_t>(std::lround(mhz * 1e6));
+}
+
+}  // namespace roro::meshtastic
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace roro::meshtastic {
+
+// Radio settings shared by every Meshtastic preset (firmware src/mesh/RadioInterface.h).
+constexpr uint8_t kSyncWord = 0x2B;
+constexpr uint16_t kPreambleLength = 16;
+
+// The default Channel key ("AQ==", expanded): public, so the default Channel is readable by anyone.
+extern const uint8_t kDefaultKey[16];
+
+// A modem preset: bandwidth, spreading factor and coding rate (4/cr). Named as Meshtastic shows them.
+struct Preset {
+    const char* name;
+    float bwKHz;
+    uint8_t sf;
+    uint8_t cr;
+};
+
+// The presets Meshtastic allows in EU_868, its order, LongFast (the default) first.
+extern const Preset kEu868Presets[];
+extern const size_t kEu868PresetCount;
+const Preset* findPreset(const char* name);  // nullptr when EU_868 doesn't allow it
+
+// djb2, as Meshtastic hashes a Channel's name to pick a frequency slot.
+uint32_t djb2(const char* s);
+
+// The byte in every packet header naming its Channel: the name's bytes XORed with the key's.
+uint8_t channelHash(const char* name, const uint8_t* key, size_t keyLen);
+
+// EU_868 is 869.4 to 869.65 MHz: the slot comes from the Channel's name (the preset's name for
+// an unnamed Channel, which is the default).
+uint32_t eu868FrequencyHz(const Preset& preset, const char* channelName = nullptr);
+
+}  // namespace roro::meshtastic
@@ -0,0 +1,119 @@
+#include "file_receiver.h"
+
+#include <algorithm>
+#include <cstdlib>
+#include <cstring>
+
+namespace roro {
+
+namespace {
+
+int hexDigit(char c) {
+    if (c >= '0' && c <= '9') return c - '0';
+    if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+    if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+    return -1;
+}
+
+// Splits on spaces (no iostreams: they cost about 200 KB of flash on the device).
+std::vector<std::string> words(const std::string& s) {
+    std::vector<std::string> out;
+    size_t i = 0;
+    while (i < s.size()) {
+        if (s[i] == ' ') {
+            i++;
+            continue;
+        }
+        size_t end = s.find(' ', i);
+        if (end == std::string::npos) end = s.size();
+        out.push_back(s.substr(i, end - i));
+        i = end;
+    }
+    return out;
+}
+
+}  // namespace
+
+std::string FileReceiver::begin(const std::string& args, uint32_t nowMs) {
+    reset();
+    std::vector<std::string> w = words(args);
+    if (w.size() != 3) return "usage: sd put <path> <size> <sha256>";
+    const std::string &path = w[0], &size = w[1], &sha = w[2];
+    if (path.empty() || path[0] != '/' || path.size() > 128 || path.find("..") != std::string::npos)
+        return "the path must be absolute, without ..";
+    if (size.empty() || size.size() > 9 || size.find_first_not_of("0123456789") != std::string::npos)
+        return "bad size";
+    uint32_t bytes = static_cast<uint32_t>(std::strtoul(size.c_str(), nullptr, 10));
+    if (bytes == 0 || bytes > kMaxBytes) return "bad size";
+    if (sha.size() != 64) return "bad sha256";
+    for (size_t i = 0; i < 32; i++) {
+        int hi = hexDigit(sha[2 * i]), lo = hexDigit(sha[2 * i + 1]);
+        if (hi < 0 || lo < 0) return "bad sha256";
+        expected_[i] = static_cast<uint8_t>(hi << 4 | lo);
+    }
+    path_ = path;
+    size_ = bytes;
+    lastActivityMs_ = nowMs;
+    chunk_.reserve(kChunk);
+    state_ = State::Receiving;
+    return "";
+}
+
+size_t FileReceiver::wanted() const {
+    if (state_ != State::Receiving) return 0;
+    return std::min<size_t>(kChunk, size_ - received_) - chunk_.size();
+}
+
+size_t FileReceiver::feed(const uint8_t* data, size_t len, uint32_t nowMs) {
+    if (state_ != State::Receiving || len == 0) return 0;
+    size_t take = std::min(len, wanted());
+    chunk_.insert(chunk_.end(), data, data + take);
+    sha_.update(data, take);
+    lastActivityMs_ = nowMs;
+    if (wanted() > 0) return take;
+
+    if (received_ + chunk_.size() == size_) {
+        // The last chunk: refuse it before writing if the file arrived damaged.
+        uint8_t got[32];
+        sha_.finish(got);
+        if (std::memcmp(got, expected_, sizeof got) != 0) {
+            fail("checksum mismatch");
+            return take;
+        }
+    }
+    state_ = State::Writing;
+    return take;
+}
+
+void FileReceiver::chunkWritten(bool ok, uint32_t nowMs) {
+    if (state_ != State::Writing) return;
+    if (!ok) return fail("write failed");
+    received_ += static_cast<uint32_t>(chunk_.size());
+    chunk_.clear();
+    lastActivityMs_ = nowMs;
+    state_ = received_ == size_ ? State::Finishing : State::Receiving;
+}
+
+void FileReceiver::cardChecked(const uint8_t digest[32]) {
+    if (state_ != State::Finishing) return;
+    if (std::memcmp(digest, expected_, sizeof expected_) != 0) fail("the copy on the card differs");
+}
+
+void FileReceiver::finished(bool ok) {
+    if (state_ != State::Finishing) return;
+    if (!ok) return fail("rename failed");
+    state_ = State::Done;
+}
+
+void FileReceiver::tick(uint32_t nowMs) {
+    if (state_ != State::Receiving && state_ != State::Writing && state_ != State::Finishing) return;
+    if (nowMs - lastActivityMs_ >= kTimeoutMs) fail(state_ == State::Receiving ? "timed out" : "card not writable");
+}
+
+void FileReceiver::fail(const char* why) {
+    error_ = why;
+    chunk_.clear();
+    state_ = State::Failed;
+}
+
+}  // namespace roro
@@ -0,0 +1,69 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "sha256.h"
+
+namespace roro {
+
+// One file sent over the USB serial console (scripts/sd_put.py), to put an Update File on the SD
+// card without taking the card out. The sender writes `sd put <path> <size> <sha256>`, then the raw
+// bytes, one chunk at a time, and waits for each chunk to be written before sending the next: the
+// serial driver drops bytes once its receive buffer is full. The file lands as `<path>.part` and is
+// renamed to `<path>` only once every byte has arrived and the checksum matches.
+class FileReceiver {
+   public:
+    static constexpr size_t kChunk = 1024;           // must stay below the serial receive buffer
+    static constexpr uint32_t kTimeoutMs = 5000;     // silence, or a card job that never completes
+    static constexpr uint32_t kMaxBytes = 8u << 20;  // larger than any app partition
+
+    enum class State {
+        Idle,
+        Receiving,  // waiting for bytes of the current chunk
+        Writing,    // chunk() is complete: write it to partPath(), then call chunkWritten()
+        Finishing,  // everything written and checked: rename partPath() to path(), then finished()
+        Done,
+        Failed,     // error() says why; partPath() should be removed
+    };
+
+    // Parses "<path> <size> <sha256 hex>". Returns "" when the transfer starts, or what's wrong.
+    std::string begin(const std::string& args, uint32_t nowMs);
+    // Takes bytes for the current chunk; returns how many were used (none while a chunk waits).
+    size_t feed(const uint8_t* data, size_t len, uint32_t nowMs);
+    void chunkWritten(bool ok, uint32_t nowMs);
+    // While Finishing: the SHA-256 of the file as read back from the card. The checksum on the
+    // received bytes doesn't prove the card kept them (a failed write can lose buffered data).
+    void cardChecked(const uint8_t digest[32]);
+    void finished(bool ok);
+    void tick(uint32_t nowMs);
+    void reset() { *this = FileReceiver(); }
+
+    State state() const { return state_; }
+    bool active() const { return state_ != State::Idle; }
+    // Bytes still missing from the current chunk: read no more than this from the serial port.
+    size_t wanted() const;
+    const std::vector<uint8_t>& chunk() const { return chunk_; }
+    const std::string& path() const { return path_; }
+    std::string partPath() const { return path_ + ".part"; }
+    uint32_t size() const { return size_; }
+    uint32_t received() const { return received_; }
+    const std::string& error() const { return error_; }
+
+   private:
+    void fail(const char* why);
+
+    State state_ = State::Idle;
+    std::string path_;
+    uint32_t size_ = 0;
+    uint32_t received_ = 0;  // bytes in chunks already written
+    uint8_t expected_[32] = {};
+    Sha256 sha_;
+    std::vector<uint8_t> chunk_;
+    uint32_t lastActivityMs_ = 0;
+    std::string error_;
+};
+
+}  // namespace roro
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <cstdint>
+
+namespace roro {
+
+// Decides when new firmware on Probation (see CONTEXT.md) has proven healthy, or has failed in a
+// way that would leave no means to push a fix (Wi-Fi configured but never connecting).
+class Probation {
+   public:
+    enum class Verdict { Wait, Confirm, RollBack };
+    static constexpr uint32_t kHealthyAfterMs = 30000;
+    static constexpr uint32_t kWifiDeadlineMs = 180000;
+
+    // Checked first thing at boot, before anything that could crash. `attemptsBefore` counts earlier
+    // boots of this image on Probation; a second start means the first one died before confirming.
+    // (A second line behind the bootloader's own rollback, which aborts an image still pending.)
+    static bool rollBackAtBoot(bool onProbation, int attemptsBefore) { return onProbation && attemptsBefore >= 1; }
+
+    static Verdict judge(uint32_t uptimeMs, bool firstFrameDrawn, bool wifiConfigured, bool wifiConnected) {
+        if (wifiConfigured && !wifiConnected && uptimeMs >= kWifiDeadlineMs) return Verdict::RollBack;
+        if (uptimeMs < kHealthyAfterMs || !firstFrameDrawn) return Verdict::Wait;
+        if (wifiConfigured && !wifiConnected) return Verdict::Wait;
+        return Verdict::Confirm;
+    }
+};
+
+}  // namespace roro
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <cstdint>
+
+namespace roro {
+
+// Safe Mode (CONTEXT.md): after kCrashLimit starts in a row that ended in a crash, the firmware
+// starts only what it takes to be fixed over the air (Wi-Fi, Firmware Updates, the Debug Console).
+// Rollback covers new firmware; this covers firmware that was confirmed and crashes anyway.
+struct SafeMode {
+    static constexpr int kCrashLimit = 3;
+    static constexpr uint32_t kStableAfterMs = 60000;  // then the count starts over
+
+    // Called first thing at boot with the count so far; returns the new count.
+    static int countAtBoot(bool lastStartWasCrash, int crashesBefore) {
+        return lastStartWasCrash ? crashesBefore + 1 : 0;
+    }
+    static bool active(int crashes) { return crashes >= kCrashLimit; }
+};
+
+}  // namespace roro
@@ -0,0 +1,85 @@
+#include "sha256.h"
+
+#include <cstring>
+
+namespace roro {
+
+namespace {
+const uint32_t K[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
+
+inline uint32_t rotr(uint32_t x, int n) { return (x >> n) | (x << (32 - n)); }
+}  // namespace
+
+Sha256::Sha256() {
+    const uint32_t init[8] = {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+                              0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
+    std::memcpy(h_, init, sizeof(h_));
+}
+
+void Sha256::block(const uint8_t* p) {
+    uint32_t w[64];
+    for (int i = 0; i < 16; i++)
+        w[i] = (uint32_t(p[4 * i]) << 24) | (uint32_t(p[4 * i + 1]) << 16) | (uint32_t(p[4 * i + 2]) << 8) | p[4 * i + 3];
+    for (int i = 16; i < 64; i++) {
+        uint32_t s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3);
+        uint32_t s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10);
+        w[i] = w[i - 16] + s0 + w[i - 7] + s1;
+    }
+    uint32_t a = h_[0], b = h_[1], c = h_[2], d = h_[3], e = h_[4], f = h_[5], g = h_[6], h = h_[7];
+    for (int i = 0; i < 64; i++) {
+        uint32_t t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i];
+        uint32_t t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c));
+        h = g;
+        g = f;
+        f = e;
+        e = d + t1;
+        d = c;
+        c = b;
+        b = a;
+        a = t1 + t2;
+    }
+    h_[0] += a; h_[1] += b; h_[2] += c; h_[3] += d;
+    h_[4] += e; h_[5] += f; h_[6] += g; h_[7] += h;
+}
+
+void Sha256::update(const uint8_t* data, size_t len) {
+    bits_ += static_cast<uint64_t>(len) * 8;
+    while (len > 0) {
+        size_t take = 64 - used_ < len ? 64 - used_ : len;
+        std::memcpy(buf_ + used_, data, take);
+        used_ += take;
+        data += take;
+        len -= take;
+        if (used_ == 64) {
+            block(buf_);
+            used_ = 0;
+        }
+    }
+}
+
+void Sha256::finish(uint8_t out[32]) {
+    uint64_t bits = bits_;
+    uint8_t pad = 0x80;
+    update(&pad, 1);
+    uint8_t zero = 0;
+    while (used_ != 56) update(&zero, 1);
+    uint8_t len[8];
+    for (int i = 0; i < 8; i++) len[i] = static_cast<uint8_t>(bits >> (56 - 8 * i));
+    update(len, 8);
+    for (int i = 0; i < 8; i++) {
+        out[4 * i] = h_[i] >> 24;
+        out[4 * i + 1] = h_[i] >> 16;
+        out[4 * i + 2] = h_[i] >> 8;
+        out[4 * i + 3] = h_[i];
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,30 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace roro {
+
+// Plain SHA-256 (FIPS 180-4), streaming. Small and dependency-free, so the same code runs in the
+// PC tests and on the device.
+class Sha256 {
+   public:
+    Sha256();
+    void update(const uint8_t* data, size_t len);
+    void finish(uint8_t out[32]);
+
+    static void hash(const uint8_t* data, size_t len, uint8_t out[32]) {
+        Sha256 s;
+        s.update(data, len);
+        s.finish(out);
+    }
+
+   private:
+    void block(const uint8_t* p);
+    uint32_t h_[8];
+    uint8_t buf_[64];
+    size_t used_ = 0;
+    uint64_t bits_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,87 @@
+#include "update_parser.h"
+
+#include <cstring>
+
+#include "version_compare.h"
+
+namespace roro {
+
+namespace {
+uint16_t u16(const uint8_t* p) { return p[0] | (p[1] << 8); }
+uint32_t u32(const uint8_t* p) { return p[0] | (p[1] << 8) | (p[2] << 16) | (uint32_t(p[3]) << 24); }
+}  // namespace
+
+void UpdateParser::fail(const std::string& why) {
+    if (state_ == State::Image) sink_.abort();
+    state_ = State::Failed;
+    error_ = why;
+}
+
+void UpdateParser::parseHeader() {
+    const uint8_t* h = header_;
+    if (std::memcmp(h, update::kMagic, 8) != 0) return fail("not an update file");
+    if (u16(h + 8) != update::kFormat || u16(h + 10) != update::kHeaderSize) return fail("unsupported update format");
+    imageSize_ = u32(h + 12);
+    if (imageSize_ == 0 || imageSize_ > maxImage_) return fail("image doesn't fit the update slot");
+    std::memcpy(expectedHash_, h + 16, 32);
+    version_.assign(reinterpret_cast<const char*>(h + 48), strnlen(reinterpret_cast<const char*>(h + 48), 32));
+
+    size_t sigLen = u16(h + 80);
+    if (sigLen == 0 || sigLen > update::kMaxSignature) return fail("missing signature");
+    uint8_t digest[32];
+    Sha256::hash(h, update::kSignedBytes, digest);
+    if (!verifier_.verify(digest, h + 82, sigLen)) return fail("bad signature (wrong key)");
+
+    downgrade_ = versionOlder(version_, installed_);
+    if (!sink_.begin(imageSize_)) return fail("could not prepare the update slot");
+    state_ = State::Image;
+}
+
+void UpdateParser::feed(const uint8_t* data, size_t len) {
+    while (len > 0 && (state_ == State::Header || state_ == State::Image)) {
+        if (state_ == State::Header) {
+            size_t take = std::min(len, update::kHeaderSize - headerUsed_);
+            std::memcpy(header_ + headerUsed_, data, take);
+            headerUsed_ += take;
+            data += take;
+            len -= take;
+            if (headerUsed_ == update::kHeaderSize) parseHeader();
+        } else {
+            size_t take = std::min(len, imageSize_ - received_);
+            if (take == 0) return fail("data after the end of the image");
+            hash_.update(data, take);
+            if (!sink_.write(data, take)) return fail("writing the update failed");
+            received_ += take;
+            data += take;
+            len -= take;
+        }
+    }
+    if (len > 0 && state_ == State::Image) fail("data after the end of the image");
+}
+
+bool UpdateParser::end() {
+    if (state_ == State::Done) return true;
+    if (state_ != State::Image) {
+        if (state_ == State::Header) fail("update file too short");
+        return false;
+    }
+    if (received_ != imageSize_) {
+        fail("update file too short");
+        return false;
+    }
+    uint8_t got[32];
+    hash_.finish(got);
+    if (std::memcmp(got, expectedHash_, 32) != 0) {
+        fail("image corrupted (hash mismatch)");
+        return false;
+    }
+    if (!sink_.finish()) {
+        state_ = State::Failed;
+        error_ = "could not switch to the new image";
+        return false;
+    }
+    state_ = State::Done;
+    return true;
+}
+
+}  // namespace roro
@@ -0,0 +1,82 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+#include "sha256.h"
+
+namespace roro {
+
+// The Update File (see CONTEXT.md): a 160-byte header, then the firmware image. All integers are
+// little-endian.
+//   0  magic "RORO-OTA"     8  u16 format (1)    10 u16 header size (160)   12 u32 image size
+//  16  image SHA-256[32]   48  version, NUL-padded [32]
+//  80  u16 signature length   82  signature (DER, up to 72 bytes)   154 reserved
+// The signature covers SHA-256 of bytes 0..79, which include the image's hash, so a bad signature
+// is caught before anything is written, and a bad image when its hash is checked at the end.
+namespace update {
+constexpr char kMagic[] = "RORO-OTA";
+constexpr uint16_t kFormat = 1;
+constexpr size_t kHeaderSize = 160;
+constexpr size_t kSignedBytes = 80;
+constexpr size_t kMaxSignature = 72;
+}  // namespace update
+
+class SignatureVerifier {
+   public:
+    virtual ~SignatureVerifier() = default;
+    virtual bool verify(const uint8_t digest[32], const uint8_t* signature, size_t len) = 0;
+};
+
+// Where the image goes (the inactive app slot on the device).
+class UpdateSink {
+   public:
+    virtual ~UpdateSink() = default;
+    virtual bool begin(size_t imageSize) = 0;
+    virtual bool write(const uint8_t* data, size_t len) = 0;
+    virtual bool finish() = 0;  // make it the image to boot next
+    virtual void abort() = 0;
+};
+
+// Streams an Update File into a sink: checks the header and signature first, then hashes the image
+// as it passes through, and only finishes the sink if everything matches.
+class UpdateParser {
+   public:
+    enum class State { Header, Image, Done, Failed };
+
+    UpdateParser(SignatureVerifier& verifier, UpdateSink& sink, size_t maxImageSize, std::string installedVersion)
+        : verifier_(verifier), sink_(sink), maxImage_(maxImageSize), installed_(std::move(installedVersion)) {}
+
+    void feed(const uint8_t* data, size_t len);
+    bool end();  // no more data: true if the update was installed
+    // The whole image the header announced has arrived (the sender need not close the connection).
+    bool complete() const { return state_ == State::Image && received_ == imageSize_; }
+
+    State state() const { return state_; }
+    const std::string& error() const { return error_; }
+    const std::string& version() const { return version_; }
+    bool isDowngrade() const { return downgrade_; }
+    int percent() const { return imageSize_ ? static_cast<int>(received_ * 100 / imageSize_) : 0; }
+
+   private:
+    void parseHeader();
+    void fail(const std::string& why);
+
+    SignatureVerifier& verifier_;
+    UpdateSink& sink_;
+    size_t maxImage_;
+    std::string installed_;
+
+    State state_ = State::Header;
+    uint8_t header_[update::kHeaderSize];
+    size_t headerUsed_ = 0;
+    uint8_t expectedHash_[32];
+    size_t imageSize_ = 0;
+    size_t received_ = 0;
+    Sha256 hash_;
+    std::string version_, error_;
+    bool downgrade_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <cstdlib>
+#include <string>
+
+namespace roro {
+
+// True if `a` is an older release than `b`, comparing "vMAJOR.MINOR.PATCH" and ignoring any
+// git-describe suffix ("-3-gabc1234-dirty"). Anything that doesn't parse is never called older.
+inline bool parseVersion(const std::string& s, int out[3]) {
+    size_t pos = s.size() > 0 && s[0] == 'v' ? 1 : 0;
+    for (int i = 0; i < 3; i++) {
+        if (pos >= s.size() || s[pos] < '0' || s[pos] > '9') return false;
+        char* end;
+        out[i] = static_cast<int>(std::strtol(s.c_str() + pos, &end, 10));
+        pos = end - s.c_str();
+        if (i < 2) {
+            if (pos >= s.size() || s[pos] != '.') return false;
+            pos++;
+        }
+    }
+    return true;
+}
+
+inline bool versionOlder(const std::string& a, const std::string& b) {
+    int x[3], y[3];
+    if (!parseVersion(a, x) || !parseVersion(b, y)) return false;
+    for (int i = 0; i < 3; i++)
+        if (x[i] != y[i]) return x[i] < y[i];
+    return false;
+}
+
+}  // namespace roro
@@ -29,6 +29,9 @@ const Definition kDefinitions[] = {
    {"sound", Kind::Bool, 1, nullptr, 0, 1},
    {"probe_mac_raw", Kind::Bool, 1, nullptr, 0, 1},
    {"wifi_on", Kind::Bool, 1, nullptr, 0, 1},
+    {"gnss_on", Kind::Bool, 1, nullptr, 0, 1},
+    {"coord_dms", Kind::Bool, 0, nullptr, 0, 1},
+    {"lora_preset", Kind::Int, 0, nullptr, 0, 6},  // LongFast first
 };
 static_assert(sizeof(kDefinitions) / sizeof(kDefinitions[0]) == static_cast<size_t>(Setting::Count),
              "every Setting needs a definition");
@@ -21,6 +21,9 @@ enum class Setting : uint8_t {
    Sound,            // bool
    ProbeMacRaw,      // bool: probe-request Logs keep raw MAC addresses
    WifiEnabled,      // bool: the Wi-Fi Service stays Connected when a Saved Network is in range
+    GnssEnabled,      // bool: the GNSS Service reads the receiver (M2, Q58)
+    CoordinatesDms,   // bool: show degrees, minutes and seconds instead of decimal degrees (Q64)
+    LoraPreset,       // int: the LoRa Scanner's Meshtastic preset, an index into the EU868 list (M3, Q95)
    Count
 };

@@ -20,6 +20,8 @@ inline const CleanupCategory kCleanupCategories[] = {
    {"IRC logs", "/irc"},
    {"Wi-Fi scan logs", "/wifi/scans"},
    {"Wi-Fi captures", "/captures/wifi"},
+    {"LoRa captures", "/captures/lora"},
+    {"GNSS tracks", "/gnss/tracks"},
 };

 enum class CleanupAge { OneMonth, ThreeMonths, SixMonths, OneYear, Everything };
@@ -19,7 +19,27 @@ build_flags =
    -DARDUINO_USB_MODE=1
 lib_deps =
    m5stack/M5Cardputer @ 1.1.1
+    jgromes/RadioLib @ 7.8.1
 test_ignore = *
+; Smaller TLS buffers (M2): the framework is rebuilt with these settings (pioarduino "hybrid
+; compile"). Receive stays 16 KB (servers send full TLS records); send drops to 4 KB (IRC lines are
+; short); buffers are allocated as needed and handshake-only data is freed once connected.
+custom_sdkconfig =
+    CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y
+    CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
+    CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
+    CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
+    CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
+    CONFIG_MBEDTLS_DYNAMIC_FREE_CA_CERT=y
+
+; Debug Build: the same firmware plus the Debug Console on TCP 2323 (see ADR 0004). The token comes
+; from ~/.config/roro9stack/debug-token, passed in by scripts/_docker.sh; it's never committed.
+[env:cardputer-adv-debug]
+extends = env:cardputer-adv
+extra_scripts = pre:scripts/version.py, pre:scripts/debug_flags.py
+build_flags =
+    ${env:cardputer-adv.build_flags}
+    -DRORO_DEBUG

 ; Host-side unit tests for pure logic (no hardware).
 [env:native]
@@ -4,9 +4,17 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

 docker build -q -t "$IMAGE" "$ROOT/docker" >/dev/null

+# The Debug Console token (ADR 0004): made once, kept with the OTA key, never committed.
+DEBUG_TOKEN_FILE="$HOME/.config/roro9stack/debug-token"
+if [ ! -s "$DEBUG_TOKEN_FILE" ]; then
+    mkdir -p "$(dirname "$DEBUG_TOKEN_FILE")"
+    (umask 077 && od -An -tx1 -N16 /dev/urandom | tr -d ' \n' > "$DEBUG_TOKEN_FILE")
+fi
+
 run_in_container() {
    docker run --rm \
        -u "$(id -u):$(id -g)" -e HOME=/tmp \
+        -e RORO_DEBUG_TOKEN="$(cat "$DEBUG_TOKEN_FILE")" \
        -v "$ROOT:/work" \
        -v roro9stack-pio:/pio \
        "${DOCKER_EXTRA[@]}" \
@@ -4,4 +4,4 @@ set -euo pipefail
 source "$(dirname "$0")/_docker.sh"
 DOCKER_EXTRA=()

-run_in_container bash -c 'git config --global --add safe.directory /work && pio test -e native && pio run -e cardputer-adv'
+run_in_container bash -c 'git config --global --add safe.directory /work && pio test -e native && pio run -e cardputer-adv -e cardputer-adv-debug'
@@ -0,0 +1,12 @@
+# Debug Builds only: compiles in the Debug Console token from $RORO_DEBUG_TOKEN (set by _docker.sh
+# from ~/.config/roro9stack/debug-token). Refuses to build without one rather than use a default.
+import os
+import re
+import sys
+
+Import("env")  # noqa: F821  (provided by PlatformIO)
+
+token = os.environ.get("RORO_DEBUG_TOKEN", "").strip()
+if not re.fullmatch(r"[0-9a-f]{32}", token):
+    sys.exit("debug build: RORO_DEBUG_TOKEN is missing; build through scripts/ci.sh or scripts/flash.sh --debug")
+env.Append(CPPDEFINES=[("RORO_DEBUG_TOKEN", '\\"%s\\"' % token)])  # noqa: F821
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Turns crash addresses into functions and source lines, using the archived ELF of the build that
+# crashed (.pio/elves/, kept by scripts/version.py).
+# Usage: scripts/decode_backtrace.sh <version or ELF sha256 prefix> <address>...
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+[ $# -ge 2 ] || { echo "Usage: scripts/decode_backtrace.sh <version|sha> <address>..." >&2; exit 1; }
+ELF="$(ls -t "$ROOT"/.pio/elves/*"$1"*.elf 2>/dev/null | head -1 || true)"
+[ -n "$ELF" ] || { echo "No archived ELF matches '$1' in .pio/elves/" >&2; exit 1; }
+echo "using ${ELF#$ROOT/}" >&2
+DOCKER_EXTRA=()
+run_in_container /pio/tools/toolchain-xtensa-esp-elf/bin/xtensa-esp32s3-elf-addr2line -pfiaC -e "/work/${ELF#$ROOT/}" "${@:2}"
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Full post-mortem of a core dump fetched with `scripts/rdbg.py coredump`: every task's backtrace,
+# registers and the crashed task's stack, via esp-coredump and GDB in the container.
+# Usage: scripts/decode_coredump.sh <core.bin> <version or ELF sha256 prefix>
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+[ $# -eq 2 ] || { echo "Usage: scripts/decode_coredump.sh <core.bin> <version|sha>" >&2; exit 1; }
+CORE="$(realpath "$1")"
+ELF="$(ls -t "$ROOT"/.pio/elves/*"$2"*.elf 2>/dev/null | head -1 || true)"
+[ -n "$ELF" ] || { echo "No archived ELF matches '$2' in .pio/elves/" >&2; exit 1; }
+echo "using ${ELF#$ROOT/}" >&2
+DOCKER_EXTRA=(-v "$(dirname "$CORE"):/core:ro")
+run_in_container /pio/penv/bin/esp-coredump --chip esp32s3 info_corefile -t raw \
+    -g /pio/tools/tool-xtensa-esp-elf-gdb/bin/xtensa-esp32s3-elf-gdb \
+    -c "/core/$(basename "$CORE")" "/work/${ELF#$ROOT/}"
@@ -1,11 +1,33 @@
 #!/usr/bin/env bash
 # Flash the firmware over USB, then open the serial monitor.
-# Usage: scripts/flash.sh [port]   (default: the first Espressif device found)
+# Usage: scripts/flash.sh [--debug] [port]        USB (default: the first Espressif device found)
+#        scripts/flash.sh [--debug] --ota [host]  Wi-Fi: build, sign and push a Firmware Update
+#                                                 (host: the device's IP from Settings > About, or $RORO_OTA_HOST)
+# --debug builds the Debug Build (cardputer-adv-debug): the Debug Console on TCP 2323, see ADR 0004.
 set -euo pipefail
+ENV=cardputer-adv
+if [ "${1:-}" = "--debug" ]; then
+    ENV=cardputer-adv-debug
+    shift
+fi
+
+if [ "${1:-}" = "--ota" ]; then
+    ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+    HOST="${2:-${RORO_OTA_HOST:-}}"
+    [ -n "$HOST" ] || { echo "Usage: scripts/flash.sh --ota <device IP> (or set RORO_OTA_HOST)" >&2; exit 1; }
+    source "$(dirname "$0")/_docker.sh"
+    DOCKER_EXTRA=()
+    run_in_container bash -c "git config --global --add safe.directory /work && pio run -e $ENV" | tail -3
+    VERSION="$(git -C "$ROOT" describe --tags --always --dirty)"
+    [ "$ENV" = cardputer-adv-debug ] && VERSION="$VERSION+debug"  # as scripts/version.py names it
+    OUT="$ROOT/.pio/build/$ENV/roro9stack-$VERSION.ota"
+    "$ROOT/scripts/make_ota.py" "$ROOT/.pio/build/$ENV/firmware.bin" "$VERSION" "$OUT"
+    exec "$ROOT/scripts/ota_push.py" "$OUT" "$HOST"
+fi
 PORT="${1:-$(readlink -f /dev/serial/by-id/*Espressif* 2>/dev/null | head -1)}"
 [ -n "$PORT" ] || { echo "No Cardputer found on USB (is it plugged in / attached to the VM?)" >&2; exit 1; }
 source "$(dirname "$0")/_docker.sh"
 docker rm -f roro9stack-serial >/dev/null 2>&1 || true  # a serial log would hold the port
 DOCKER_EXTRA=(--device "$PORT" --group-add "$(stat -c %g "$PORT")" -it)

-run_in_container bash -c "git config --global --add safe.directory /work && pio run -e cardputer-adv -t upload --upload-port $PORT && pio device monitor -p $PORT -b 115200"
+run_in_container bash -c "git config --global --add safe.directory /work && pio run -e $ENV -t upload --upload-port $PORT && pio device monitor -p $PORT -b 115200"
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Wraps a firmware image into a signed Update File (.ota). See lib/ota/src/update_parser.h.
+
+Usage: scripts/make_ota.py <firmware.bin> <version> <out.ota> [private key]
+Signs with openssl (ECDSA P-256 over SHA-256 of the header's first 80 bytes).
+"""
+import hashlib
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+
+HEADER_SIZE = 160
+SIGNED_BYTES = 80
+MAX_SIGNATURE = 72
+
+
+def main():
+    if len(sys.argv) < 4:
+        sys.exit(__doc__)
+    image_path, version, out_path = sys.argv[1:4]
+    key = sys.argv[4] if len(sys.argv) > 4 else os.environ.get(
+        "RORO_OTA_KEY", os.path.expanduser("~/.config/roro9stack/ota-key.pem"))
+    if not os.path.exists(key):
+        sys.exit(f"No signing key at {key}: run scripts/ota_keygen.sh first.")
+
+    image = open(image_path, "rb").read()
+    version_bytes = version.encode()[:31]
+    signed = (b"RORO-OTA" + struct.pack("<HHI", 1, HEADER_SIZE, len(image)) +
+              hashlib.sha256(image).digest() + version_bytes.ljust(32, b"\0"))
+    assert len(signed) == SIGNED_BYTES
+
+    with tempfile.NamedTemporaryFile() as f:
+        f.write(signed)
+        f.flush()
+        signature = subprocess.run(["openssl", "dgst", "-sha256", "-sign", key, f.name],
+                                   check=True, capture_output=True).stdout
+    if len(signature) > MAX_SIGNATURE:
+        sys.exit("unexpected signature size")
+
+    header = signed + struct.pack("<H", len(signature)) + signature
+    header = header.ljust(HEADER_SIZE, b"\0")
+    with open(out_path, "wb") as out:
+        out.write(header + image)
+    print(f"{out_path}: {version}, {len(image)} bytes, signed")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Creates the Firmware Update signing key pair, once (ADR 0003).
+# The private key stays in ~/.config/roro9stack/ and must never be committed; the public key is
+# written into the firmware source. Losing the private key means the next update goes over USB.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+KEY="${RORO_OTA_KEY:-$HOME/.config/roro9stack/ota-key.pem}"
+PUB_PEM="$ROOT/keys/ota-public.pem"
+PUB_H="$ROOT/src/platform/ota_public_key.h"
+
+if [ -e "$KEY" ]; then
+    echo "A signing key already exists at $KEY; not overwriting it." >&2
+    exit 1
+fi
+mkdir -p "$(dirname "$KEY")" "$ROOT/keys"
+( umask 077; openssl ecparam -name prime256v1 -genkey -noout -out "$KEY" )
+openssl ec -in "$KEY" -pubout -out "$PUB_PEM" 2>/dev/null
+
+{
+    echo "#pragma once"
+    echo ""
+    echo "// Public key that Firmware Updates must be signed for (ECDSA P-256). Generated by"
+    echo "// scripts/ota_keygen.sh; the private key is not in this repository (ADR 0003)."
+    echo "namespace roro {"
+    echo "inline constexpr char kOtaPublicKeyPem[] ="
+    sed 's/^/    "/; s/$/\\n"/' "$PUB_PEM"
+    echo "    ;"
+    echo "}  // namespace roro"
+} > "$PUB_H"
+echo "Private key: $KEY (keep it safe)"
+echo "Public key:  $PUB_PEM and $PUB_H (commit these)"
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Pushes a signed Update File to a Cardputer over Wi-Fi (TCP 3232) and reports the result.
+
+Usage: scripts/ota_push.py <file.ota> <host>
+<host> is the device's IP (shown in Settings > Firmware).
+"""
+import socket
+import sys
+
+PORT = 3232
+
+
+def main():
+    if len(sys.argv) < 3:
+        sys.exit(__doc__)
+    path, host = sys.argv[1:3]
+    data = open(path, "rb").read()
+    try:
+        reply = push(data, host)
+    except (ConnectionResetError, BrokenPipeError):
+        # The device checks the header first and hangs up on a refused update mid-transfer.
+        print()
+        print("device: refused the update and closed the connection (the reason is on its screen)")
+        sys.exit(1)
+    print(f"device: {reply or '(no answer)'}")
+    sys.exit(0 if reply.startswith("OK") else 1)
+
+
+def push(data, host):
+    with socket.create_connection((host, PORT), timeout=15) as s:
+        s.settimeout(60)
+        sent, last = 0, -1
+        while sent < len(data):
+            chunk = data[sent:sent + 4096]
+            s.sendall(chunk)
+            sent += len(chunk)
+            pct = sent * 100 // len(data)
+            if pct != last:
+                print(f"\rsending {pct:3d}%", end="", flush=True)
+                last = pct
+        # The header announces the image size, so current firmware answers once it has it all.
+        # Firmware from before that change only knows the file ended when we half-close.
+        reply = b""
+        s.settimeout(3)
+        try:
+            reply = s.recv(256)
+        except socket.timeout:
+            s.shutdown(socket.SHUT_WR)
+            s.settimeout(60)
+        while reply == b"" or not reply.endswith(b"\n"):
+            try:
+                part = s.recv(256)
+            except socket.timeout:
+                break
+            if not part:
+                break
+            reply += part
+    print()
+    return reply.decode(errors="replace").strip()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,281 @@
+#!/usr/bin/env python3
+"""The Debug Console of a Debug Build, over Wi-Fi (TCP 2323, see ADR 0004).
+
+Usage: scripts/rdbg.py [-H host] [-b] [command ...]
+  no command   interactive: type commands, see every console line live; Ctrl-D or `quit` leaves
+  command      runs it and prints what follows, until the console has been quiet for a moment
+  -H host      the device's IP (Settings > Firmware), default $RORO_OTA_HOST
+  -b           also print the backlog the device sends on connecting (boot messages and so on)
+
+Commands handled here as well as on the device:
+  crash                    the last crash, with its backtrace decoded (scripts/decode_backtrace.sh)
+  coredump [file]          fetch the core dump (default core-<date>.bin) and decode it with esp-coredump
+  get <card path> [file]   copy a file from the SD card
+  put <file> [card path]   copy a file to the SD card (default /updates/<name>), checked with SHA-256
+  screenshot [file.png]    what the screen shows (default screen-<date>.png), at 2x
+  reset                    restart at once, even if the main loop is stuck
+The token is read from ~/.config/roro9stack/debug-token (made by the first build).
+"""
+import hashlib
+import os
+import re
+import select
+import struct
+import subprocess
+import zlib
+import socket
+import sys
+import time
+
+PORT = 2323
+TOKEN_FILE = os.path.expanduser("~/.config/roro9stack/debug-token")
+
+
+def read_until(sock, marker, timeout):
+    """Everything up to and including `marker`, or None on a timeout or a closed connection."""
+    sock.settimeout(timeout)
+    data = b""
+    while marker not in data:
+        try:
+            chunk = sock.recv(4096)
+        except socket.timeout:
+            return None
+        if not chunk:
+            return None
+        data += chunk
+    return data
+
+
+def read_until_quiet(sock, quiet, out):
+    """Copies everything the device sends to `out` until nothing has arrived for `quiet` seconds."""
+    sock.settimeout(quiet)
+    while True:
+        try:
+            data = sock.recv(4096)
+        except socket.timeout:
+            return True
+        if not data:
+            return False
+        if out:
+            out.write(data.decode(errors="replace"))
+            out.flush()
+
+
+SCRIPTS = os.path.dirname(os.path.abspath(__file__))
+
+
+def run(sock, command, out=sys.stdout):
+    """Sends one command and returns its reply (also copied to `out`)."""
+    sock.sendall((command + "\n").encode())
+    # The main loop echoes "> command" when it runs it; the reply follows.
+    echoed = read_until(sock, f"> {command}\n".encode(), 15)
+    if echoed is None:
+        sys.exit("device: the command never ran")
+    reply = echoed.decode(errors="replace").split(f"> {command}\n", 1)[1]
+
+    class Tee:
+        def write(self, text):
+            nonlocal reply
+            reply += text
+            if out:
+                out.write(text)
+
+        def flush(self):
+            if out:
+                out.flush()
+
+    if out:
+        out.write(reply)
+    try:
+        read_until_quiet(sock, 1.5, Tee())
+    except BrokenPipeError:  # e.g. piped into head
+        pass
+    return reply
+
+
+def crash_firmware(reply):
+    """The archived-ELF key for the crashed firmware: its ELF digest, or else its version."""
+    sha = re.search(r"elf sha256 ([0-9a-f]{8,})", reply)
+    if sha:
+        return sha.group(1)
+    version = re.search(r"last one in (\S+)", reply)
+    return version.group(1) if version else None
+
+
+def crash(sock):
+    reply = run(sock, "crash")
+    trace = re.search(r"backtrace((?: 0x[0-9a-f]+)+)", reply)
+    key = crash_firmware(reply)
+    if trace and key:
+        print()
+        subprocess.call([os.path.join(SCRIPTS, "decode_backtrace.sh"), key] + trace.group(1).split())
+
+
+def coredump(sock, path):
+    info = run(sock, "crash", out=None)
+    sock.sendall(b"coredump get\n")
+    # One buffer throughout: the header, the size and the first bytes often share a packet.
+    buf = b""
+    sock.settimeout(15)
+    while b"coredump: none" not in buf and not re.search(rb"coredump: data (\d+)\n", buf):
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit("device: closed the connection")
+        buf += chunk
+    header = re.search(rb"coredump: data (\d+)\n", buf)
+    if not header:
+        sys.exit("device: no core dump in flash")
+    size = int(header.group(1))
+    data = buf[header.end():]
+    while len(data) < size:
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit(f"device: the connection closed after {len(data)} of {size} bytes")
+        data += chunk
+    data = data[:size]
+    path = path or time.strftime("core-%Y%m%d-%H%M%S.bin")
+    open(path, "wb").write(data)
+    print(f"saved {path} ({size} bytes)")
+    key = crash_firmware(info)
+    if key:
+        subprocess.call([os.path.join(SCRIPTS, "decode_coredump.sh"), path, key])
+
+
+def binary(sock, command, tag):
+    """Sends a binary command; returns (header words, payload) or exits with the device's error."""
+    sock.sendall((command + "\n").encode())
+    buf = b""
+    sock.settimeout(30)
+    pattern = re.compile(tag.encode() + rb": (data|ready|rgb332|error)([^\n]*)\n")
+    while not (m := pattern.search(buf)):
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit("device: closed the connection")
+        buf += chunk
+    if m.group(1) == b"error":
+        sys.exit(f"device: {tag}: error{m.group(2).decode()}")
+    return m.group(1).decode(), m.group(2).decode().split(), buf[m.end():]
+
+
+def receive(sock, have, size):
+    while len(have) < size:
+        chunk = sock.recv(65536)
+        if not chunk:
+            sys.exit(f"device: the connection closed after {len(have)} of {size} bytes")
+        have += chunk
+    return have[:size]
+
+
+def get(sock, remote, local):
+    _, words, rest = binary(sock, f"get {remote}", "get")
+    start, size = time.time(), int(words[0])
+    data = receive(sock, rest, size)
+    local = local or os.path.basename(remote)
+    open(local, "wb").write(data)
+    print(f"saved {local} ({size} bytes, {size / 1024 / max(time.time() - start, 0.001):.0f} KB/s)")
+
+
+def put(sock, local, remote):
+    data = open(local, "rb").read()
+    remote = remote or "/updates/" + os.path.basename(local)
+    digest = hashlib.sha256(data).hexdigest()
+    binary(sock, f"put {remote} {len(data)} {digest}", "put")
+    start = time.time()
+    sock.sendall(data)
+    answer = read_until(sock, b"\n", 30) or b"put: error no answer"
+    answer = answer.decode(errors="replace").strip().splitlines()[-1]
+    print(f"device: {answer} ({len(data) / 1024 / max(time.time() - start, 0.001):.0f} KB/s)")
+    if " error " in answer:
+        sys.exit(1)
+
+
+def png(path, width, height, rgb, scale):
+    rows = b""
+    for y in range(height):
+        row = b"".join(rgb[(y * width + x) * 3:(y * width + x) * 3 + 3] * scale for x in range(width))
+        rows += (b"\x00" + row) * scale
+    def chunk(kind, body):
+        return struct.pack(">I", len(body)) + kind + body + struct.pack(">I", zlib.crc32(kind + body))
+    header = struct.pack(">IIBBBBB", width * scale, height * scale, 8, 2, 0, 0, 0)
+    with open(path, "wb") as f:
+        f.write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", header) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b""))
+
+
+def screenshot(sock, path):
+    _, words, rest = binary(sock, "screenshot", "screenshot")
+    width, height = int(words[0]), int(words[1])
+    pixels = receive(sock, rest, width * height)
+    # RGB332, as M5GFX stores an 8-bit sprite: RRRGGGBB.
+    rgb = b"".join(bytes(((v >> 5) * 255 // 7, ((v >> 2) & 7) * 255 // 7, (v & 3) * 255 // 3)) for v in pixels)
+    path = path or time.strftime("screen-%Y%m%d-%H%M%S.png")
+    png(path, width, height, rgb, 2)
+    print(f"saved {path} ({width * 2}x{height * 2})")
+
+
+def interactive(sock):
+    sock.setblocking(False)
+    while True:
+        ready, _, _ = select.select([sock, sys.stdin], [], [])
+        if sock in ready:
+            data = sock.recv(4096)
+            if not data:
+                print("\n(connection closed)")
+                return
+            sys.stdout.write(data.decode(errors="replace"))
+            sys.stdout.flush()
+        if sys.stdin in ready:
+            line = sys.stdin.readline()
+            if not line:
+                return
+            sock.sendall(line.encode())
+
+
+def main():
+    args = sys.argv[1:]
+    host, backlog = os.environ.get("RORO_OTA_HOST"), False
+    while args and args[0].startswith("-"):
+        flag = args.pop(0)
+        if flag == "-H" and args:
+            host = args.pop(0)
+        elif flag == "-b":
+            backlog = True
+        else:
+            sys.exit(__doc__)
+    if not host:
+        sys.exit("No device: pass -H <ip> or set RORO_OTA_HOST\n\n" + __doc__)
+    token = open(TOKEN_FILE).read().strip()
+
+    with socket.create_connection((host, PORT), timeout=10) as sock:
+        sock.sendall((token + "\n").encode())
+        # The device may still be finishing a previous client: wait for this connection's banner.
+        banner = read_until(sock, b"Backlog follows.\n", 15)
+        if banner is None:
+            sys.exit("device: no banner (wrong token, or another client is connected)")
+        show = sys.stdout if backlog or not args else None
+        if show:
+            show.write(banner.decode(errors="replace"))
+        read_until_quiet(sock, 0.5, show)  # the backlog
+        if not args:
+            return interactive(sock)
+        if args == ["crash"]:
+            return crash(sock)
+        if args[0] == "get" and len(args) >= 2:
+            return get(sock, args[1], args[2] if len(args) > 2 else None)
+        if args[0] == "put" and len(args) >= 2:
+            return put(sock, args[1], args[2] if len(args) > 2 else None)
+        if args[0] == "screenshot":
+            return screenshot(sock, args[1] if len(args) > 1 else None)
+        if args == ["reset"]:  # answered by the console's own task, not the main loop
+            sock.sendall(b"reset\n")
+            print((read_until(sock, b"restarting now\n", 10) or b"device: no answer").decode().strip().splitlines()[-1])
+            return
+        if args[0] == "coredump" and args[1:2] != ["erase"]:
+            return coredump(sock, args[1] if len(args) > 1 else None)
+        run(sock, " ".join(args))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (ConnectionResetError, BrokenPipeError):
+        sys.exit("device: the connection dropped (restarting?)")
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Copies a file to the Cardputer's SD card over the USB serial console (the `sd put` command).
+
+Usage: scripts/sd_put.sh <file> [card path]
+The card path defaults to /updates/<file name>, where Settings > Firmware finds Update Files.
+The device acknowledges each chunk once it's on the card, checks the SHA-256 of the whole file,
+and only then renames <card path>.part to <card path>.
+"""
+import glob
+import hashlib
+import os
+import sys
+import time
+
+import serial
+
+DEBUG = bool(os.environ.get("SD_PUT_DEBUG"))  # also show the console lines in between
+
+
+def find_port():
+    ports = sorted(glob.glob("/dev/serial/by-id/*Espressif*"))
+    return os.path.realpath(ports[0]) if ports else None
+
+
+def reply(port, timeout):
+    """The next `sd put:` line from the device; everything else on the console is skipped."""
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        line = port.readline().decode(errors="replace").strip()
+        if line.startswith("sd put:"):
+            return line[len("sd put:"):].strip()
+        if line and DEBUG:
+            print(f"\n  console: {line}", file=sys.stderr)
+    return "error no answer from the device"
+
+
+def fail(answer):
+    print()
+    sys.exit(f"device: {answer}")
+
+
+def main():
+    if len(sys.argv) < 2:
+        sys.exit(__doc__)
+    path = sys.argv[1]
+    dest = sys.argv[2] if len(sys.argv) > 2 else "/updates/" + os.path.basename(path)
+    port_name = find_port()
+    if not port_name:
+        sys.exit("No Cardputer found on USB")
+    data = open(path, "rb").read()
+    sha = hashlib.sha256(data).hexdigest()
+
+    with serial.Serial(port_name, 115200, timeout=0.5) as port:
+        port.reset_input_buffer()
+        # The leading newline ends any half-typed command.
+        port.write(f"\nsd put {dest} {len(data)} {sha}\n".encode())
+        answer = reply(port, 10)
+        if not answer.startswith("ready "):
+            fail(answer)
+        chunk = int(answer.split()[1])
+
+        start, sent = time.time(), 0
+        while sent < len(data):
+            port.write(data[sent:sent + chunk])
+            sent = min(sent + chunk, len(data))
+            print(f"\rsending {sent * 100 // len(data):3d}%", end="", flush=True)
+            if sent < len(data):
+                answer = reply(port, 10)
+                if answer != f"ok {sent}":
+                    fail(answer)
+        answer = reply(port, 15)
+        if not answer.startswith("done "):
+            fail(answer)
+        seconds = time.time() - start
+        print(f"\rdevice: {answer}, {seconds:.1f} s ({len(data) / 1024 / seconds:.0f} KB/s)")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Copy a file to the Cardputer's SD card over USB serial, e.g. an Update File into /updates.
+# Usage: scripts/sd_put.sh <file> [card path]   (default card path: /updates/<file name>)
+set -euo pipefail
+source "$(dirname "$0")/_docker.sh"
+[ -f "${1:-}" ] || { echo "Usage: scripts/sd_put.sh <file> [card path]" >&2; exit 1; }
+docker rm -f roro9stack-serial >/dev/null 2>&1 || true  # a serial log would hold the port
+FILE="$(realpath "$1")"
+DOCKER_EXTRA=(-e SD_PUT_DEBUG="${SD_PUT_DEBUG:-}" --group-add "$(getent group dialout | cut -d: -f3)" --privileged -v /dev:/dev -v "$(dirname "$FILE"):/in:ro")
+run_in_container /pio/penv/bin/python scripts/sd_put.py "/in/$(basename "$FILE")" "${@:2}"
@@ -10,4 +10,24 @@ try:
 except Exception:
    version = "unknown"

+if env["PIOENV"].endswith("-debug"):  # noqa: F821
+    version += "+debug"  # a Debug Build says so wherever the version shows
+
 env.Append(CPPDEFINES=[("RORO_VERSION", '\\"%s\\"' % version)])  # noqa: F821
+
+
+# Keep every build's ELF, named by version and the first 16 hex digits of its SHA-256 (the core dump
+# names the crashed firmware by the same digest), so a crash can be decoded after later builds.
+def archive_elf(source, target, env):
+    import hashlib
+    import os
+    import shutil
+
+    elf = str(target[0])
+    digest = hashlib.sha256(open(elf, "rb").read()).hexdigest()[:16]
+    folder = os.path.join(env.subst("$PROJECT_DIR"), ".pio", "elves")
+    os.makedirs(folder, exist_ok=True)
+    shutil.copy(elf, os.path.join(folder, "%s.%s.elf" % (version, digest)))
+
+
+env.AddPostAction("$BUILD_DIR/${PROGNAME}.elf", archive_elf)  # noqa: F821
@@ -0,0 +1,101 @@
+#include "firmware_page.h"
+
+#include <SD.h>
+
+#include "ui/widgets.h"
+#include "version.h"
+
+namespace roro {
+
+namespace {
+constexpr const char* kUpdatesFolder = "/updates";
+
+bool endsWith(const std::string& s, const std::string& suffix) {
+    return s.size() >= suffix.size() && s.compare(s.size() - suffix.size(), suffix.size(), suffix) == 0;
+}
+}  // namespace
+
+void FirmwarePage::enter() {
+    confirm_.reset();
+    {
+        std::lock_guard<std::mutex> g(lock_);
+        files_.clear();
+        listed_ = false;
+    }
+    list_.setCount(kFixed);
+    storage_.runJob([this]() {
+        std::vector<std::string> found;
+        File dir = SD.open(kUpdatesFolder);
+        if (dir && dir.isDirectory())
+            for (File f = dir.openNextFile(); f; f = dir.openNextFile())
+                if (!f.isDirectory() && endsWith(f.name(), ".ota")) found.push_back(std::string(kUpdatesFolder) + "/" + f.name());
+        std::lock_guard<std::mutex> g(lock_);
+        files_ = found;
+        listed_ = true;
+    });
+}
+
+std::vector<std::string> FirmwarePage::files() {
+    std::lock_guard<std::mutex> g(lock_);
+    return files_;
+}
+
+bool FirmwarePage::onKey(const KeyEvent& e) {
+    auto found = files();
+    if (confirm_) {
+        confirm_->onKey(e);
+        int pick = list_.selected() - kFixed;
+        if (confirm_->result() == 1 && pick >= 0 && pick < static_cast<int>(found.size())) update_.installFromSd(found[pick]);
+        if (confirm_->result() != DialogModel::kPending) confirm_.reset();
+        return true;
+    }
+    list_.setCount(kFixed + static_cast<int>(found.size()));
+    switch (e.key) {
+        case Key::Up: list_.up(); break;
+        case Key::Down: list_.down(); break;
+        case Key::Back: return false;
+        case Key::Select:
+            if (list_.selected() >= kFixed) confirm_.reset(new DialogModel({"Cancel", "Install"}));
+            break;
+        default: break;
+    }
+    return true;
+}
+
+void FirmwarePage::draw(Canvas& c) {
+    auto found = files();
+    bool listed;
+    {
+        std::lock_guard<std::mutex> g(lock_);
+        listed = listed_;
+    }
+    list_.setCount(kFixed + static_cast<int>(found.size()));
+    std::string ip = wifi_.ip();
+    widgets::list(
+        c, list_, theme::kContent,
+        [&](int i) -> std::string {
+            switch (i) {
+                case kVersion: return "Version";
+                case kStatus: return "Status";
+                case kAddress: return "Push to";
+                case kSdHeader: return listed ? (found.empty() ? "No .ota files in /updates" : "On the SD card:") : "Looking on the SD card...";
+                default: return "  " + found[i - kFixed].substr(std::string(kUpdatesFolder).size() + 1);
+            }
+        },
+        [&](int i) -> std::string {
+            switch (i) {
+                case kVersion: return versionString();
+                case kStatus: return update_.onProbation() ? "on probation" : "confirmed";
+                case kAddress: return ip.empty() ? "Wi-Fi not connected" : ip + ":" + std::to_string(UpdateService::kPort);
+                case kSdHeader: return "";
+                default: return "install >";
+            }
+        });
+    if (confirm_) {
+        int pick = list_.selected() - kFixed;
+        std::string name = pick >= 0 && pick < static_cast<int>(found.size()) ? found[pick] : "";
+        widgets::dialog(c, "Install update?", name + " is checked before anything is written. The device restarts after.", *confirm_);
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,47 @@
+#pragma once
+
+#include <memory>
+#include <mutex>
+#include <string>
+#include <vector>
+
+#include "dialog_model.h"
+#include "key_event.h"
+#include "list_model.h"
+#include "services/storage_service.h"
+#include "services/update_service.h"
+#include "services/wifi_service.h"
+#include "ui/canvas.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Settings → Firmware: the running version and its Probation, where to push Firmware Updates, and
+// the Update Files on the SD card (in /updates) to install from.
+class FirmwarePage {
+   public:
+    FirmwarePage(UpdateService& update, WifiService& wifi, StorageService& storage)
+        : update_(update), wifi_(wifi), storage_(storage) {}
+
+    void enter();
+    bool onKey(const KeyEvent& e);  // false: leave the page
+    void draw(Canvas& c);
+
+   private:
+    enum Row { kVersion, kStatus, kAddress, kSdHeader, kFixed };
+
+    std::vector<std::string> files();
+
+    UpdateService& update_;
+    WifiService& wifi_;
+    StorageService& storage_;
+    ListModel list_{theme::kContent.h / theme::kLineHeight};
+    std::unique_ptr<DialogModel> confirm_;
+
+    // Filled on the storage task.
+    std::mutex lock_;
+    std::vector<std::string> files_;
+    bool listed_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,531 @@
+#include "gemini_app.h"
+
+#include <Arduino.h>
+
+#include <algorithm>
+
+#include "gemini_url.h"
+#include "text_wrap.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using namespace gemini;
+
+namespace {
+
+constexpr int kUrlBar = 10;  // the small line with the URL at the top
+constexpr int kMargin = 3;
+constexpr const char* kStartUrl = GeminiService::kStartUrl;
+constexpr size_t kMaxHistory = 20;  // Q77
+
+// How each line type looks: its prefix, the indent of its wrapped rows, font and colour.
+struct Style {
+    const char* prefix;
+    int indent;  // characters
+    const lgfx::U8g2font* font;
+    uint16_t color;
+};
+
+Style styleOf(LineType t) {
+    switch (t) {
+        case LineType::Heading1: return {"", 0, &fonts::bold, theme::kAccent};
+        case LineType::Heading2: return {"", 0, &fonts::bold, theme::kText};
+        case LineType::Heading3: return {"", 0, &fonts::bold, theme::kMuted};
+        case LineType::ListItem: return {"\xC2\xB7 ", 2, &fonts::body, theme::kText};  // ·
+        case LineType::Quote: return {"> ", 2, &fonts::body, theme::kMuted};
+        case LineType::Link: return {"\xC2\xBB ", 2, &fonts::body, theme::kAccent};    // »
+        case LineType::Preformatted: return {"", 0, &fonts::body, theme::kText};
+        default: return {"", 0, &fonts::body, theme::kText};
+    }
+}
+
+}  // namespace
+
+void GeminiApp::onEnter() {
+    if (page_.url.empty() && !loading_) navigate(kStartUrl, false);
+    requestRedraw();
+}
+
+// The page's first heading, for a bookmark's label.
+std::string GeminiApp::titleOf() const {
+    for (size_t i = 0; i < page_.text.lineCount() && i < 40; i++)
+        if (static_cast<LineType>(types_[i]) == LineType::Heading1) return lineAt(i).text;
+    return "";
+}
+
+void GeminiApp::follow(const std::string& link) {
+    std::string url = resolve(page_.base(), link);
+    navigate(url, true, isSaved());  // inside a Saved Page, its saved links open offline (Q84)
+}
+
+void GeminiApp::showMessage(const std::string& url, const std::string& gemtext) {
+    GeminiPage p;
+    p.outcome = GeminiPage::Outcome::Ok;
+    p.url = url;
+    p.header.status = 20;
+    p.text.append(gemtext.data(), gemtext.size());
+    p.text.finish();
+    show(std::move(p));
+}
+
+void GeminiApp::navigate(const std::string& target, bool remember, bool preferSaved) {
+    bool local = target == kStartUrl || target.rfind("file://", 0) == 0;
+    if (!isGemini(target) && !local) {
+        status_ = "Not Gemini: " + target;
+        statusMs_ = millis();
+        requestRedraw();
+        return;
+    }
+    if (!gemini_.fetch(target, preferSaved)) {
+        status_ = "Busy: try again in a moment";
+        statusMs_ = millis();
+        return;
+    }
+    if (remember && !page_.url.empty()) {
+        history_.push_back({page_.url, topRow_});
+        if (history_.size() > kMaxHistory) history_.erase(history_.begin());
+    }
+    loading_ = true;
+    loadingUrl_ = target;
+    status_.clear();
+    requestRedraw();
+}
+
+void GeminiApp::show(GeminiPage&& page) {
+    page_ = std::move(page);
+    windowLoading_ = false;
+    analyse();
+    topRow_ = hscroll_ = 0;
+    selected_ = -1;
+}
+
+void GeminiApp::analyse() {
+    // Sized exactly: the Service budgeted these bytes per line (kBytesPerLine), growth by
+    // doubling would take up to twice that.
+    std::vector<uint8_t>().swap(types_);
+    std::vector<uint32_t>().swap(links_);
+    types_.reserve(page_.text.lineCount());
+    // A window may start inside a preformatted block: the index says (bit 31).
+    size_t entry = page_.windowStart / GeminiService::kIndexEvery;
+    bool pre = page_.windowed && entry < page_.lineIndex.size() && (page_.lineIndex[entry] & 0x80000000u);
+    for (size_t i = 0; i < page_.text.lineCount(); i++) {
+        LineType t = parseGemLine(page_.text.line(i), pre).type;
+        if (page_.header.mimeType() != "text/gemini") t = LineType::Preformatted;  // other text/*: as is
+        types_.push_back(static_cast<uint8_t>(t));
+        if (t == LineType::Link) links_.push_back(i);
+    }
+    links_.shrink_to_fit();
+    layoutDirty_ = true;
+    requestRedraw();
+}
+
+size_t GeminiApp::topLine() const {
+    if (firstRow_.size() < 2) return page_.windowStart;
+    size_t i = std::upper_bound(firstRow_.begin(), firstRow_.end() - 1, static_cast<uint32_t>(topRow_)) - firstRow_.begin();
+    return page_.windowStart + (i > 0 ? i - 1 : 0);
+}
+
+void GeminiApp::requestWindow(size_t firstLine) {
+    if (windowLoading_ || !gemini_.loadWindow(page_, firstLine)) return;
+    windowLoading_ = true;
+    keepLine_ = static_cast<long>(topLine());
+    status_ = "Reading from the card...";
+    statusMs_ = millis();
+}
+
+// A new window of the same page: same URL, history and position, other lines.
+void GeminiApp::applyWindow(GeminiPage&& window) {
+    windowLoading_ = false;
+    status_.clear();
+    page_.text = std::move(window.text);
+    page_.windowStart = window.windowStart;
+    page_.lineIndex = std::move(window.lineIndex);
+    selected_ = -1;
+    analyse();
+}
+
+void GeminiApp::update(uint32_t nowMs) {
+    GeminiPage result;
+    bool got = gemini_.takeResult(result);
+    if (got && !result.windowOf.empty()) {
+        windowLoading_ = false;
+        if (result.windowOf == page_.backing) applyWindow(std::move(result));  // else: we've moved on
+    } else if (got) {
+        loading_ = false;
+        std::string url = result.url;
+        switch (result.outcome) {
+            case GeminiPage::Outcome::CertificateChanged:
+                pendingCert_ = std::move(result);
+                certDialog_.reset(new DialogModel({"Cancel", "Trust it"}));
+                break;
+            case GeminiPage::Outcome::Failed:
+                showMessage(url, "# Can't open this page\n" + result.error + "\n=> " + url + " Try again\n");
+                break;
+            case GeminiPage::Outcome::Ok:
+                switch (result.header.category()) {
+                    case Category::Success:
+                        if (result.header.mimeType().rfind("text/", 0) == 0) show(std::move(result));
+                        else {
+                            std::string mime = result.header.mimeType();
+                            showMessage(url, "# Not a text page\nThis is " + mime +
+                                                 ", which the Cardputer can't show. s saves it to the card, in "
+                                                 "/gemini/downloads.\n");
+                            page_.header.meta = mime;  // so s knows to download it
+                        }
+                        break;
+                    case Category::Input:
+                        // Q72: ask, then request the same URL with the answer as its query.
+                        inputOpen_ = true;
+                        inputSensitive_ = result.header.sensitiveInput();
+                        inputPrompt_ = result.header.meta;
+                        inputUrl_ = url;
+                        input_.setText("");
+                        break;
+                    default:
+                        showMessage(url, "# " + std::to_string(result.header.status) + " " + result.header.meta +
+                                             "\nThe server refused this page.\n=> " + url + " Try again\n");
+                        break;
+                }
+                break;
+        }
+        requestRedraw();
+    }
+    // Signed: statusMs_ may be a few ms ahead of this pass's nowMs (set by a key handled after it).
+    std::string message;
+    if (gemini_.takeMessage(message)) {
+        status_ = message;
+        statusMs_ = millis();
+        if (!reopen_.empty()) {  // a refreshed Saved Page: show the new copy
+            navigate(reopen_, false);
+            reopen_.clear();
+        } else if (message == "Deleted") navigate(kStartUrl, false);
+        requestRedraw();
+    }
+    if (!status_.empty() && static_cast<int32_t>(nowMs - statusMs_) > 4000) {
+        status_.clear();
+        requestRedraw();
+    }
+}
+
+int GeminiApp::rowsOnScreen() const { return (theme::kContent.h - kUrlBar) / theme::kLineHeight; }
+
+LineType typeOf(const std::vector<uint8_t>& types, size_t i) { return static_cast<LineType>(types[i]); }
+
+GemLine GeminiApp::lineAt(size_t i) const {
+    bool pre = typeOf(types_, i) == LineType::Preformatted;
+    GemLine g = parseGemLine(page_.text.line(i), pre);
+    if (typeOf(types_, i) == LineType::Preformatted) {
+        g.type = LineType::Preformatted;
+        g.text = page_.text.line(i);
+    }
+    return g;
+}
+
+// A line's rows, as drawn: prefix on the first, indent on the rest; preformatted lines don't wrap.
+std::vector<std::string> GeminiApp::rowsOf(Canvas& c, size_t i) const {
+    GemLine g = lineAt(i);
+    if (g.type == LineType::PreToggle) return {};
+    if (g.type == LineType::Preformatted) return {displayText(g.text)};
+    Style st = styleOf(g.type);
+    c.setFont(st.font);
+    MeasureText measure = [&c](const std::string& s) { return static_cast<int>(c.textWidth(s.c_str())); };
+    int width = theme::kWidth - 2 * kMargin;
+    std::string indent(st.indent, ' ');
+    std::vector<std::string> rows = wrapText(st.prefix + displayText(g.text), width, measure);
+    if (rows.empty()) rows.push_back("");
+    // Rows after the first: the exact rest of the text (wrapText keeps every space but the one it
+    // breaks at), wrapped again, narrower, behind the indent.
+    if (rows.size() > 1 && st.indent > 0) {
+        std::string full = st.prefix + displayText(g.text);
+        std::string rest = full.substr(rows[0].size());
+        if (!rest.empty() && rest[0] == ' ') rest.erase(0, 1);
+        std::vector<std::string> more = wrapText(rest, width - measure(indent), measure);
+        rows.resize(1);
+        for (auto& m : more) rows.push_back(indent + m);
+    }
+    return rows;
+}
+
+void GeminiApp::layout(Canvas& c) {
+    firstRow_.assign(page_.text.lineCount() + 1, 0);
+    uint32_t row = 0;
+    for (size_t i = 0; i < page_.text.lineCount(); i++) {
+        firstRow_[i] = row;
+        row += rowsOf(c, i).size();
+    }
+    firstRow_.back() = row;
+    layoutDirty_ = false;
+}
+
+void GeminiApp::scrollTo(int row) {
+    int total = firstRow_.empty() ? 0 : static_cast<int>(firstRow_.back());
+    // A windowed page: near either end of the window, read the next part from the card. The new
+    // window starts a block before the line on top, so what's on screen stays.
+    const size_t block = GeminiService::kIndexEvery;
+    if (row + rowsOnScreen() > total - 2 && moreBelow()) {
+        size_t line = topLine();
+        requestWindow(line >= block ? line - line % block : 0);
+    } else if (row < 0 && moreAbove()) {
+        size_t line = topLine();
+        size_t back = page_.text.lineCount() / 2;  // about half a window above
+        requestWindow(line > back ? line - back : 0);
+    }
+    topRow_ = std::max(0, std::min(row, std::max(0, total - rowsOnScreen())));
+    requestRedraw();
+}
+
+void GeminiApp::selectLink(int direction) {
+    // A windowed page: past the window's last (or first) link, page on instead of wrapping.
+    int last = static_cast<int>(links_.size()) - 1;
+    if ((direction > 0 && moreBelow() && (links_.empty() || selected_ == last)) ||
+        (direction < 0 && moreAbove() && (links_.empty() || selected_ == 0))) {
+        selected_ = -1;
+        scrollTo(topRow_ + direction * (rowsOnScreen() - 1));
+        return;
+    }
+    if (links_.empty()) return;
+    int count = static_cast<int>(links_.size());
+    if (selected_ < 0) {
+        // The first link on screen, or after it when going forward.
+        selected_ = direction > 0 ? 0 : count - 1;
+        for (int k = 0; k < count; k++)
+            if (static_cast<int>(firstRow_[links_[k]]) >= topRow_) {
+                selected_ = direction > 0 ? k : std::max(0, k - 1);
+                break;
+            }
+    } else selected_ = (selected_ + direction + count) % count;
+    int row = firstRow_[links_[selected_]];
+    if (row < topRow_ || row >= topRow_ + rowsOnScreen()) scrollTo(row - 1);
+    requestRedraw();
+}
+
+bool GeminiApp::onKey(const KeyEvent& e) {
+    requestRedraw();
+    if (certDialog_) {
+        certDialog_->onKey(e);
+        if (certDialog_->result() == DialogModel::kPending) return true;
+        if (certDialog_->result() == 1) {
+            gemini_.trust(pendingCert_.host, pendingCert_.port, pendingCert_.presented);
+            navigate(pendingCert_.requested, false);
+        }
+        certDialog_.reset();
+        return true;
+    }
+    if (deleteDialog_) {
+        deleteDialog_->onKey(e);
+        if (deleteDialog_->result() == DialogModel::kPending) return true;
+        if (deleteDialog_->result() == 1) gemini_.deleteSaved(savedPathOf());
+        deleteDialog_.reset();
+        return true;
+    }
+    if (inputOpen_) {
+        switch (e.key) {
+            case Key::Char: input_.insert(e.ch); break;
+            case Key::Delete: input_.backspace(); break;
+            case Key::Left: input_.left(); break;
+            case Key::Right: input_.right(); break;
+            case Key::Back: inputOpen_ = false; break;
+            case Key::Select:
+                inputOpen_ = false;
+                navigate(resolve(inputUrl_, "?" + encodeQuery(input_.text())));
+                break;
+            default: break;
+        }
+        return true;
+    }
+    if (addressOpen_) {
+        switch (e.key) {
+            case Key::Char: address_.insert(e.ch); break;
+            case Key::Delete: address_.backspace(); break;
+            case Key::Left: address_.left(); break;
+            case Key::Right: address_.right(); break;
+            case Key::Back: addressOpen_ = false; break;
+            case Key::Select: {
+                std::string url = address_.text();
+                if (url.find("://") == std::string::npos) url = "gemini://" + url;
+                addressOpen_ = false;
+                navigate(url);
+                break;
+            }
+            default: break;
+        }
+        return true;
+    }
+    switch (e.key) {
+        case Key::Up: scrollTo(topRow_ - 1); return true;
+        case Key::Down: scrollTo(topRow_ + 1); return true;
+        case Key::Left: hscroll_ = std::max(0, hscroll_ - 8); return true;
+        case Key::Right: hscroll_ += 8; return true;
+        case Key::Tab: selectLink(e.shift ? -1 : 1); return true;
+        case Key::Select:
+            if (selected_ >= 0) follow(lineAt(links_[selected_]).url);
+            return true;
+        case Key::Back:
+        case Key::Delete:
+            if (loading_) {
+                gemini_.cancel();
+                return true;
+            }
+            if (history_.empty()) return e.key == Key::Delete;  // Back leaves the App
+            {
+                Visit v = history_.back();
+                history_.pop_back();
+                navigate(v.url, false);
+                restoreRow_ = v.topRow;
+            }
+            return true;
+        case Key::Char:
+            switch (e.ch) {
+                case ' ': scrollTo(topRow_ + rowsOnScreen() - 1); break;
+                case 'g':
+                    address_.setText(page_.url == kStartUrl || isSaved() ? "" : page_.url);
+                    addressOpen_ = true;
+                    break;
+                case 'b':  // Q77
+                    if (isGemini(page_.base())) gemini_.addBookmark(page_.base(), titleOf());
+                    break;
+                case 's':  // Q82, Q73
+                    if (isSaved()) status_ = "Already saved; r refreshes it";
+                    else if (!isGemini(page_.url)) status_ = "Only Gemini pages can be saved";
+                    else if (page_.header.mimeType().rfind("text/", 0) == 0) gemini_.save(page_.url);
+                    else gemini_.download(page_.url);
+                    statusMs_ = millis();
+                    break;
+                case 'S': {  // Q83: this page and the gemtext it links to on the same capsule
+                    Url here;
+                    if (isSaved() || !parseUrl(page_.url, here)) break;
+                    std::vector<std::string> links;
+                    for (uint32_t i : links_) {
+                        std::string target = resolve(page_.url, lineAt(i).url);
+                        Url u;
+                        if (isGemini(target) && parseUrl(target, u) && u.host == here.host && target != page_.url &&
+                            std::find(links.begin(), links.end(), target) == links.end())
+                            links.push_back(target);
+                        if (static_cast<int>(links.size()) >= GeminiService::kMaxLinkedPages - 1) break;
+                    }
+                    gemini_.saveWithLinks(page_.url, links);
+                    break;
+                }
+                case 'r':  // Q84: a fresh copy of a Saved Page
+                    if (isSaved() && gemini_.refresh(savedPathOf())) reopen_ = page_.url;
+                    break;
+                case 'd':  // Q85
+                    if (isSaved()) deleteDialog_.reset(new DialogModel({"Keep", "Delete"}));
+                    break;
+                default: break;
+            }
+            return true;
+        default: return false;
+    }
+}
+
+void GeminiApp::draw(Canvas& c) {
+    const auto& area = theme::kContent;
+    if (layoutDirty_) {
+        layout(c);
+        if (restoreRow_ >= 0 && !loading_) {
+            scrollTo(restoreRow_);
+            restoreRow_ = -1;
+        }
+        if (keepLine_ >= 0 && !windowLoading_) {  // a new window: back to the line that was on top
+            long local = keepLine_ - static_cast<long>(page_.windowStart);
+            if (local >= 0 && local < static_cast<long>(page_.text.lineCount())) topRow_ = firstRow_[local];
+            keepLine_ = -1;
+        }
+    }
+
+    // The URL bar: what's shown, or what's loading, or a passing message.
+    c.setFont(&fonts::small);
+    c.setTextDatum(top_left);
+    std::string bar = loading_ ? "Loading " + loadingUrl_
+                      : !status_.empty() ? status_
+                      : isSaved() ? "saved " + page_.savedOn + ": " + page_.savedFrom
+                                  : page_.url;
+    c.setTextColor(loading_ || !status_.empty() ? theme::kWarning : theme::kMuted);
+    c.drawString(displayText(bar).substr(0, 47).c_str(), kMargin, area.y + 1);
+
+    int rows = rowsOnScreen(), y0 = area.y + kUrlBar;
+    // The first source line on screen: the last whose first row is at or above topRow_.
+    size_t i = std::upper_bound(firstRow_.begin(), firstRow_.end() - 1, static_cast<uint32_t>(topRow_)) -
+               firstRow_.begin();
+    i = i > 0 ? i - 1 : 0;
+    int row = topRow_;
+    while (i < page_.text.lineCount() && row < topRow_ + rows) {
+        int skip = row - static_cast<int>(firstRow_[i]);
+        int lineRows = static_cast<int>(firstRow_[i + 1] - firstRow_[i]);
+        if (lineRows > 0) {
+            drawLine(c, i, skip, y0 + (row - topRow_) * theme::kLineHeight, topRow_ + rows - row);
+            row += lineRows - skip;
+        }
+        i++;
+    }
+    if (page_.truncated && row < topRow_ + rows) {
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kWarning);
+        c.drawString(("Cut short: " + page_.truncatedWhy).substr(0, 47).c_str(), kMargin,
+                     y0 + (row - topRow_) * theme::kLineHeight + 2);
+    }
+    // Scroll position, on the right edge: over the whole page, also when only a window is in memory.
+    int total = static_cast<int>(firstRow_.back());
+    int h = area.h - kUrlBar;
+    if (page_.windowed && page_.totalLines > 0) {
+        int barH = std::max(6, static_cast<int>(h * page_.text.lineCount() / page_.totalLines / 3));
+        int y = static_cast<int>((h - barH) * topLine() / std::max<size_t>(1, page_.totalLines - 1));
+        c.fillRect(area.w - 2, y0 + y, 2, barH, theme::kMuted);
+    } else if (total > rows) {
+        int barH = std::max(6, h * rows / total);
+        c.fillRect(area.w - 2, y0 + (h - barH) * topRow_ / std::max(1, total - rows), 2, barH, theme::kMuted);
+    }
+
+    if (addressOpen_) {
+        theme::Rect box{2, area.y + area.h / 2 - 12, area.w - 4, theme::kLineHeight + 4};
+        c.fillRect(box.x - 2, box.y - 12, box.w + 4, box.h + 14, theme::kBackground);
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Go to (Enter, or ` to cancel)", box.x, box.y - 10);
+        widgets::lineEditor(c, address_, box);
+    }
+    if (inputOpen_) {
+        theme::Rect box{2, area.y + area.h / 2 - 4, area.w - 4, theme::kLineHeight + 4};
+        c.fillRect(0, box.y - 26, area.w, box.h + 28, theme::kBackground);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kText);
+        c.drawString(displayText(inputPrompt_).substr(0, 39).c_str(), box.x, box.y - 22);
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kMuted);
+        c.drawString(inputSensitive_ ? "(hidden) Enter sends, ` cancels" : "Enter sends, ` cancels", box.x, box.y - 9);
+        if (inputSensitive_) {
+            LineEditor masked(1024);
+            masked.setText(std::string(input_.text().size(), '*'));
+            widgets::lineEditor(c, masked, box);
+        } else widgets::lineEditor(c, input_, box);
+    }
+    if (deleteDialog_) widgets::dialog(c, "Delete this Saved Page?", page_.savedFrom, *deleteDialog_);
+    if (certDialog_)
+        widgets::dialog(c, "Certificate changed",
+                        pendingCert_.host + " now shows a different certificate. Was " + pendingCert_.pinned.substr(0, 16) +
+                            "..., now " + pendingCert_.presented.substr(0, 16) + "...",
+                        *certDialog_);
+}
+
+void GeminiApp::drawLine(Canvas& c, size_t i, int firstRow, int y, int rowsLeft) {
+    GemLine g = lineAt(i);
+    Style st = styleOf(g.type);
+    bool isSelected = selected_ >= 0 && links_[selected_] == i;
+    std::vector<std::string> rows = rowsOf(c, i);
+    c.setFont(st.font);
+    c.setTextDatum(top_left);
+    for (int r = firstRow; r < static_cast<int>(rows.size()) && r - firstRow < rowsLeft; r++) {
+        int ry = y + (r - firstRow) * theme::kLineHeight;
+        if (isSelected) c.fillRect(0, ry, theme::kWidth - 3, theme::kLineHeight, theme::kSelection);
+        c.setTextColor(isSelected ? theme::kText : st.color);
+        std::string text = rows[r];
+        if (g.type == LineType::Preformatted) text = hscroll_ < static_cast<int>(text.size()) ? text.substr(hscroll_) : "";
+        c.drawString(text.c_str(), kMargin, ry + 1);
+    }
+}
+
+}  // namespace roro
@@ -0,0 +1,81 @@
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "dialog_model.h"
+#include "gemtext.h"
+#include "line_editor.h"
+#include "services/gemini_service.h"
+#include "ui/canvas.h"
+
+namespace roro {
+
+// Geminispace on the Cardputer (docs/milestones/G1.md). Pages come from the GeminiService as
+// lines; the App wraps them once (keeping only each line's first row), then wraps just the lines
+// on screen when it draws, so a long page costs 4 bytes a line on top of its text.
+class GeminiApp : public App {
+   public:
+    explicit GeminiApp(GeminiService& gemini) : gemini_(gemini) {}
+    void onEnter() override;
+    bool onKey(const KeyEvent& e) override;
+    bool textEntryActive() const override { return addressOpen_ || inputOpen_; }
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    struct Visit {
+        std::string url;
+        int topRow;
+    };
+
+    void navigate(const std::string& url, bool remember = true, bool preferSaved = false);
+    void follow(const std::string& link);
+    std::string titleOf() const;
+    bool isSaved() const { return !page_.savedFrom.empty(); }
+    std::string savedPathOf() const { return page_.url.substr(7); }  // file://…
+    void show(GeminiPage&& page);
+    void analyse();  // types and links of the lines in memory
+    void applyWindow(GeminiPage&& window);
+    void requestWindow(size_t firstLine);
+    size_t topLine() const;  // the source line (in the whole page) at the top of the screen
+    bool moreBelow() const { return page_.windowed && page_.windowStart + page_.text.lineCount() < page_.totalLines; }
+    bool moreAbove() const { return page_.windowed && page_.windowStart > 0; }
+    void showMessage(const std::string& url, const std::string& gemtext);
+    void layout(Canvas& c);
+    void drawLine(Canvas& c, size_t index, int firstRow, int y, int rows);
+    std::vector<std::string> rowsOf(Canvas& c, size_t index) const;
+    gemini::GemLine lineAt(size_t index) const;
+    int rowsOnScreen() const;
+    void selectLink(int direction);
+    void scrollTo(int row);
+
+    GeminiService& gemini_;
+    GeminiPage page_;
+    std::vector<uint8_t> types_;      // per source line: gemini::LineType
+    std::vector<uint32_t> firstRow_;  // per source line, plus the total at the end
+    std::vector<uint32_t> links_;     // source lines that are links
+    bool layoutDirty_ = true;
+    int topRow_ = 0, hscroll_ = 0;
+    int selected_ = -1;  // into links_
+    int restoreRow_ = -1;  // going back: where that page was scrolled to, applied after layout
+    bool windowLoading_ = false;
+    long keepLine_ = -1;   // a new window: the source line to keep at the top, applied after layout
+    std::vector<Visit> history_;
+    bool loading_ = false;
+    std::string loadingUrl_, status_;
+    uint32_t statusMs_ = 0;
+    bool addressOpen_ = false;
+    LineEditor address_{1024};
+    std::unique_ptr<DialogModel> certDialog_;
+    GeminiPage pendingCert_;
+    std::unique_ptr<DialogModel> deleteDialog_;
+    bool inputOpen_ = false, inputSensitive_ = false;
+    std::string inputPrompt_, inputUrl_;
+    LineEditor input_{1024};
+    std::string reopen_;  // after a refresh: the Saved Page to show again
+};
+
+}  // namespace roro
@@ -0,0 +1,212 @@
+#include "gnss_app.h"
+
+#include <Arduino.h>
+
+#include <cmath>
+#include <cstdio>
+
+#include "geo_format.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+using namespace gnss;
+
+namespace {
+
+// One colour per constellation, readable in the 8-bit frame buffer.
+uint16_t colorOf(Constellation c) {
+    switch (c) {
+        case Constellation::Gps: return theme::kAccent;
+        case Constellation::Glonass: return 0xF8C8;  // red
+        case Constellation::Galileo: return theme::kMessage;
+        case Constellation::BeiDou: return 0xFEA0;   // yellow
+        case Constellation::Qzss: return 0xC99F;     // violet
+        default: return theme::kText;
+    }
+}
+
+const char* fixLabel(FixType f) { return f == FixType::ThreeD ? "3D Fix" : f == FixType::TwoD ? "2D Fix" : "No Fix"; }
+
+std::string duration(uint32_t ms) {
+    uint32_t s = ms / 1000;
+    char buf[24];
+    if (s < 60) std::snprintf(buf, sizeof buf, "%lu s", (unsigned long)s);
+    else std::snprintf(buf, sizeof buf, "%lu min %02lu s", (unsigned long)(s / 60), (unsigned long)(s % 60));
+    return buf;
+}
+
+}  // namespace
+
+bool GnssApp::onKey(const KeyEvent& e) {
+    if (e.key == Key::Tab) {
+        sky_ = !sky_;
+        requestRedraw();
+        return true;
+    }
+    if (e.key == Key::Char && (e.ch == 'r' || e.ch == 'R')) {  // record a Track, or stop it
+        if (gnss_.tracking()) gnss_.stopTrack();
+        else {
+            refusal_ = gnss_.startTrack(millis());
+            refusalMs_ = millis();
+        }
+        requestRedraw();
+        return true;
+    }
+    return false;  // Back leaves the App
+}
+
+void GnssApp::update(uint32_t nowMs) {
+    if (nowMs - lastDrawMs_ >= 1000) {  // the receiver reports once a second
+        lastDrawMs_ = nowMs;
+        requestRedraw();
+    }
+}
+
+void GnssApp::draw(Canvas& c) {
+    c.setTextDatum(top_left);
+    const auto& area = theme::kContent;
+    if (!gnss_.on()) {
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kText);
+        c.drawString("GNSS is off", 4, area.y + 4);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Settings > GNSS turns it on.", 4, area.y + 22);
+        return;
+    }
+    sky_ ? drawSky(c) : drawPosition(c);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(top_right);
+    c.drawString(sky_ ? "Tab: position" : "Tab: sky", area.w - 3, area.y + area.h - 9);
+    c.setTextDatum(top_left);
+}
+
+void GnssApp::drawPosition(Canvas& c) {
+    const auto& area = theme::kContent;
+    const GnssState& s = gnss_.state();
+    uint32_t now = millis();
+    int used = 0;
+    for (auto& sat : s.satellites) used += sat.used;
+    char line[64];
+
+    c.setFont(&fonts::bold);
+    c.setTextColor(s.fix == FixType::None ? theme::kWarning : theme::kMessage);
+    if (!gnss_.receiving(now)) std::snprintf(line, sizeof line, "No data from the receiver");
+    else if (s.fix == FixType::None)
+        std::snprintf(line, sizeof line, "Searching: %u in view, %s", (unsigned)s.satellites.size(),
+                      duration(now - gnss_.onSinceMs()).c_str());
+    else std::snprintf(line, sizeof line, "%s, %d of %u satellites", fixLabel(s.fix), s.satellitesUsed,
+                       (unsigned)s.satellites.size());
+    c.drawString(line, 4, area.y + 2);
+
+    c.setFont(&fonts::body);
+    int y = area.y + 19;
+    auto row = [&](const char* label, const std::string& value) {
+        c.setTextColor(theme::kMuted);
+        c.drawString(label, 4, y);
+        c.setTextColor(theme::kText);
+        c.drawString(value.c_str(), 64, y);
+        y += theme::kLineHeight;
+    };
+    bool dms = settings_.getBool(Setting::CoordinatesDms);
+    if (s.positionValid) {
+        row("Lat", dms ? formatDms(s.latitude, true) : formatDecimal(s.latitude, true));
+        row("Lon", dms ? formatDms(s.longitude, false) : formatDecimal(s.longitude, false));
+        row("Locator", maidenhead(s.latitude, s.longitude));
+        std::snprintf(line, sizeof line, s.altitudeValid ? "%.0f m" : "-", s.altitudeM);
+        row("Altitude", line);
+        if (s.courseValid && s.speedKmh >= 1.0f)
+            std::snprintf(line, sizeof line, "%.1f km/h, %.0f\xC2\xB0", s.speedKmh, s.courseDeg);
+        else std::snprintf(line, sizeof line, "%.1f km/h", s.speedKmh);
+        row("Speed", line);
+    } else {
+        row("Lat", "-");
+        row("Lon", "-");
+        y += theme::kLineHeight * 3;
+    }
+    std::snprintf(line, sizeof line, "%.1f", s.hdop);
+    row("HDOP", s.fix == FixType::None ? "-" : line);
+    if (s.timeValid) std::snprintf(line, sizeof line, "%02d:%02d:%02d UTC", s.hour, s.minute, s.second);
+    row("Time", s.timeValid ? line : "-");
+
+    // The Track line, at the bottom left.
+    c.setFont(&fonts::small);
+    if (gnss_.tracking()) {
+        c.setTextColor(theme::kWarning);
+        std::snprintf(line, sizeof line, "REC %d point%s, %s  r: stop", gnss_.trackPoints(),
+                      gnss_.trackPoints() == 1 ? "" : "s", duration(now - gnss_.trackStartMs()).c_str());
+    } else if (!refusal_.empty() && now - refusalMs_ < 4000) {
+        c.setTextColor(theme::kWarning);
+        std::snprintf(line, sizeof line, "%s", refusal_.c_str());
+    } else {
+        c.setTextColor(theme::kMuted);
+        std::snprintf(line, sizeof line, "r: record a Track");
+    }
+    c.drawString(line, 4, area.y + area.h - 9);
+}
+
+void GnssApp::drawSky(Canvas& c) {
+    const auto& area = theme::kContent;
+    const GnssState& s = gnss_.state();
+    const int radius = (area.h - 6) / 2, cx = 4 + radius, cy = area.y + area.h / 2;
+
+    // The sky from above: horizon, 30° and 60° elevation rings, north up.
+    c.drawCircle(cx, cy, radius, theme::kMuted);
+    c.drawCircle(cx, cy, radius * 2 / 3, 0x4208);
+    c.drawCircle(cx, cy, radius / 3, 0x4208);
+    c.drawFastHLine(cx - radius, cy, 2 * radius, 0x4208);
+    c.drawFastVLine(cx, cy - radius, 2 * radius, 0x4208);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(middle_center);
+    auto compass = [&](const char* letter, int x, int y) {
+        c.fillRect(x - 3, y - 4, 7, 9, theme::kBackground);  // off the lines, so it reads
+        c.drawString(letter, x, y);
+    };
+    compass("N", cx, cy - radius + 5);
+    compass("S", cx, cy + radius - 4);
+    compass("E", cx + radius - 4, cy);
+    compass("W", cx - radius + 4, cy);
+    c.setTextDatum(top_left);
+
+    int inView[8] = {}, usedBy[8] = {};
+    for (auto& sat : s.satellites) {
+        int k = static_cast<int>(sat.system);
+        inView[k]++;
+        usedBy[k] += sat.used;
+        SkyPoint p = skyPosition(sat.azimuth, sat.elevation, cx, cy, radius - 3);
+        uint16_t color = colorOf(sat.system);
+        if (sat.used) c.fillCircle(p.x, p.y, 3, color);
+        else c.drawCircle(p.x, p.y, 3, sat.snr < 0 ? theme::kMuted : color);
+    }
+
+    // Legend: used / in view per constellation, then the Fix.
+    int x = cx + radius + 12, y = area.y + 4;
+    c.setFont(&fonts::body);
+    for (int k = 1; k < 7; k++) {
+        if (!inView[k]) continue;
+        auto system = static_cast<Constellation>(k);
+        c.fillCircle(x + 3, y + 6, 3, colorOf(system));
+        char line[32];
+        std::snprintf(line, sizeof line, "%-8s%d/%d", constellationName(system), usedBy[k], inView[k]);
+        c.setTextColor(theme::kText);
+        c.drawString(line, x + 10, y);
+        y += theme::kLineHeight;
+    }
+    if (s.satellites.empty()) {
+        c.setTextColor(theme::kMuted);
+        c.drawString("No satellites", x, y);
+        y += theme::kLineHeight;
+    }
+    c.setTextColor(s.fix == FixType::None ? theme::kWarning : theme::kMessage);
+    c.drawString(fixLabel(s.fix), x, y + 4);
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("filled: in use", x, area.y + area.h - 20);
+}
+
+}  // namespace roro
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <string>
+
+#include "app.h"
+#include "services/gnss_service.h"
+#include "settings.h"
+
+namespace roro {
+
+// GNSS (see docs/milestones/M2.md, Q59): the Position view, and the Sky view with every satellite
+// in view placed by direction and elevation. Tab switches between them.
+class GnssApp : public App {
+   public:
+    GnssApp(GnssService& gnss, const Settings& settings) : gnss_(gnss), settings_(settings) {}
+    void onEnter() override { requestRedraw(); }
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    void drawPosition(Canvas& c);
+    void drawSky(Canvas& c);
+
+    GnssService& gnss_;
+    const Settings& settings_;
+    bool sky_ = false;
+    uint32_t lastDrawMs_ = 0;
+    std::string refusal_;  // why a Track couldn't start, shown for a few seconds
+    uint32_t refusalMs_ = 0;
+};
+
+}  // namespace roro
@@ -42,7 +42,7 @@ std::string lowered(std::string s) {
 void IrcApp::onEnter() {
    page_ = Page::Chat;
    editing_ = false;
-    irc_.connect();
+    if (!irc_.stoppedByUser()) irc_.connect();  // stopped by hand: stay stopped, typing reconnects
    view(current_);
 }

@@ -0,0 +1,340 @@
+#include "lora_scanner_app.h"
+
+#include <Arduino.h>
+
+#include <algorithm>
+#include <cstdio>
+#include <ctime>
+
+#include "meshtastic_presets.h"
+#include "packet_view.h"
+#include "sweep_view.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+namespace {
+constexpr uint32_t kMessageMs = 4000;
+}
+
+void LoraScannerApp::onEnter() {
+    int i = std::clamp<int>(settings_.getInt(Setting::LoraPreset), 0, meshtastic::kEu868PresetCount - 1);
+    const meshtastic::Preset& p = meshtastic::kEu868Presets[i];
+    if (std::string(radio_.config().name) != p.name) radio_.setPreset(p);
+    radio_.listen(RadioService::App, true);
+    view_ = View::Packets;
+    selectedSeq_ = 0;
+    followNewest_ = true;
+    shownSeq_ = 0;
+    requestRedraw();
+}
+
+void LoraScannerApp::onExit() {
+    showSweep(false);
+    radio_.listen(RadioService::App, false);
+}
+
+void LoraScannerApp::showSweep(bool on) {
+    if (on == (view_ == View::Sweep)) return;
+    radio_.sweep(on);
+    view_ = on ? View::Sweep : View::Packets;
+    peak_.clear();
+    std::vector<int8_t>().swap(waterfall_);  // its memory only while shown
+    sweepSteps_ = 0;
+    shownSweep_ = radio_.sweeps();
+    requestRedraw();
+}
+
+bool LoraScannerApp::meshtasticSettings() const { return radio_.config().syncWord == meshtastic::kSyncWord; }
+
+void LoraScannerApp::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+    requestRedraw();
+}
+
+bool LoraScannerApp::onKey(const KeyEvent& e) {
+    if (e.key == Key::Tab && (view_ == View::Packets || view_ == View::Sweep)) {
+        showSweep(view_ == View::Packets);
+        return true;
+    }
+    if (view_ == View::Sweep) {
+        if (e.key == Key::Back) {
+            showSweep(false);
+            return true;
+        }
+        return e.key != Key::Home;  // everything else stays here
+    }
+    if (view_ == View::Details) {
+        int last = std::max<int>(0, static_cast<int>(details_.size()) - 8);
+        if (e.key == Key::Up) detailsTop_ = std::max(0, detailsTop_ - 1);
+        else if (e.key == Key::Down) detailsTop_ = std::min(last, detailsTop_ + 1);
+        else if (e.key == Key::Back || e.key == Key::Select) view_ = View::Packets;
+        else return true;
+        requestRedraw();
+        return true;
+    }
+    if (view_ == View::Presets) {
+        if (e.key == Key::Up) presets_.up();
+        else if (e.key == Key::Down) presets_.down();
+        else if (e.key == Key::Select) {
+            int i = presets_.selected();
+            settings_.setInt(Setting::LoraPreset, i);
+            radio_.setPreset(meshtastic::kEu868Presets[i]);
+            say(std::string("Listening on ") + meshtastic::kEu868Presets[i].name);
+            view_ = View::Packets;
+        } else if (e.key == Key::Back) view_ = View::Packets;
+        else return true;
+        requestRedraw();
+        return true;
+    }
+    // The packet list.
+    if (e.key == Key::Up || e.key == Key::Down) {
+        e.key == Key::Up ? packets_.up() : packets_.down();
+        selectedSeq_ = packets_.selected() >= 0 ? radio_.received() - packets_.selected() : 0;
+        followNewest_ = packets_.selected() <= 0;
+        requestRedraw();
+        return true;
+    }
+    if (e.key == Key::Select) {
+        openDetails();
+        return true;
+    }
+    if (e.key == Key::Char && (e.ch == 'p' || e.ch == 'P')) {
+        presets_.setCount(meshtastic::kEu868PresetCount);
+        presets_.select(settings_.getInt(Setting::LoraPreset));
+        view_ = View::Presets;
+        requestRedraw();
+        return true;
+    }
+    if (e.key == Key::Char && (e.ch == 'c' || e.ch == 'C')) {
+        if (capture_.capturing()) capture_.stop();
+        else {
+            std::string why = capture_.start(millis());
+            if (!why.empty()) say(why);
+        }
+        requestRedraw();
+        return true;
+    }
+    return false;  // Back leaves the App
+}
+
+void LoraScannerApp::openDetails() {
+    RadioPacket p;
+    if (!selectedSeq_ || !radio_.packet(selectedSeq_, p)) return say("That packet has left the list");
+    details_.clear();
+    char line[64];
+    std::snprintf(line, sizeof line, "%s, %u bytes%s", timeOf(p).c_str(), p.len, p.crcOk ? "" : ", bad CRC");
+    details_.push_back(line);
+    std::snprintf(line, sizeof line, "%.0f dBm, SNR %.1f dB, noise %.0f", p.rx.rssi, p.rx.snr, p.rx.noiseFloor);
+    details_.push_back(line);
+    std::snprintf(line, sizeof line, "%.4f MHz, off by %.0f Hz", p.rx.frequencyHz / 1e6, p.frequencyError);
+    details_.push_back(line);
+    if (meshtasticSettings())
+        for (auto& l : lora::headerLines(p.data, p.len)) details_.push_back(l);
+    for (auto& l : lora::hexDump(p.data, p.len)) details_.push_back(l);
+    detailsTop_ = 0;
+    view_ = View::Details;
+    requestRedraw();
+}
+
+std::string LoraScannerApp::timeOf(const RadioPacket& p) const {
+    int64_t now = clock_.utcNow();
+    if (now < 0) {  // no Clock yet: how long ago
+        char ago[16];
+        std::snprintf(ago, sizeof ago, "-%lus", (unsigned long)((millis() - p.ms) / 1000));
+        return ago;
+    }
+    time_t t = static_cast<time_t>(now - static_cast<int64_t>((millis() - p.ms) / 1000));
+    struct tm local;
+    localtime_r(&t, &local);
+    char buf[12];
+    std::snprintf(buf, sizeof buf, "%02d:%02d:%02d", local.tm_hour, local.tm_min, local.tm_sec);
+    return buf;
+}
+
+void LoraScannerApp::update(uint32_t nowMs) {
+    if (view_ == View::Sweep) {
+        if (radio_.sweeps() != shownSweep_) requestRedraw();
+        return;
+    }
+    if (radio_.received() != shownSeq_ || nowMs - lastDrawMs_ >= 1000 ||
+        (!message_.empty() && nowMs - messageMs_ >= kMessageMs))
+        requestRedraw();
+}
+
+void LoraScannerApp::draw(Canvas& c) {
+    lastDrawMs_ = millis();
+    c.setTextDatum(top_left);
+    if (!radio_.present()) {
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kWarning);
+        c.drawString("No LoRa radio found", 4, theme::kContent.y + 4);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Is the Cap LoRa-1262 attached?", 4, theme::kContent.y + 22);
+        return;
+    }
+    switch (view_) {
+        case View::Packets: drawPackets(c); break;
+        case View::Details: drawDetails(c); break;
+        case View::Presets: drawPresets(c); break;
+        case View::Sweep: drawSweep(c); break;
+    }
+}
+
+void LoraScannerApp::drawPackets(Canvas& c) {
+    const auto& area = theme::kContent;
+    RadioService::Config cfg = radio_.config();
+    uint32_t newest = radio_.received();
+    shownSeq_ = newest;
+
+    // What it's listening to, and the noise floor.
+    char head[64];
+    std::snprintf(head, sizeof head, "%s %.3f MHz, noise %.0f", cfg.name, cfg.frequencyHz / 1e6, radio_.noiseFloor());
+    c.setFont(&fonts::small);
+    c.setTextColor(radio_.listening() ? theme::kMuted : theme::kWarning);
+    c.drawString(radio_.listening() ? head : "Starting the radio...", 4, area.y + 2);
+    if (capture_.capturing()) {
+        c.setTextDatum(top_right);
+        c.setTextColor(theme::kWarning);
+        c.drawString(("CAP " + std::to_string(capture_.packets())).c_str(), area.w - 3, area.y + 2);
+        c.setTextDatum(top_left);
+    }
+
+    // The list, newest first; the selection stays on its packet as new ones arrive.
+    int count = static_cast<int>(radio_.available());
+    packets_.setCount(count);
+    if (!followNewest_ && selectedSeq_ && newest >= selectedSeq_ && newest - selectedSeq_ < static_cast<uint32_t>(count))
+        packets_.select(static_cast<int>(newest - selectedSeq_));
+    else if (count > 0) {
+        followNewest_ = true;
+        packets_.select(0);
+        selectedSeq_ = newest;
+    }
+    theme::Rect list{area.x, area.y + 12, area.w, kListRows * theme::kLineHeight};
+    if (count == 0) {
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("No packets yet.", 4, list.y + 4);
+        c.drawString(meshtasticSettings() ? "Meshtastic nodes in range show here." : "Custom settings.", 4,
+                     list.y + 4 + theme::kLineHeight);
+    } else {
+        bool mesh = meshtasticSettings();
+        widgets::list(c, packets_, list, [&](int i) {
+            RadioPacket p;
+            if (!radio_.packet(newest - i, p)) return std::string("(gone)");
+            return lora::row({p.data, p.len, p.rx.rssi, p.rx.snr, p.crcOk, mesh}, timeOf(p));
+        });
+    }
+
+    // Footer: a message for a few seconds, or the keys.
+    c.setFont(&fonts::small);
+    bool showMessage = !message_.empty() && millis() - messageMs_ < kMessageMs;
+    c.setTextColor(showMessage ? theme::kWarning : theme::kMuted);
+    std::string keys = std::string("Enter: details  p: preset  Tab: sweep  c: ") + (capture_.capturing() ? "stop" : "capture");
+    c.drawString(showMessage ? message_.c_str() : keys.c_str(), 4, area.y + area.h - 9);
+}
+
+void LoraScannerApp::drawDetails(Canvas& c) {
+    const auto& area = theme::kContent;
+    widgets::textLines(c, details_, detailsTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 2});
+}
+
+void LoraScannerApp::drawPresets(Canvas& c) {
+    const auto& area = theme::kContent;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("Meshtastic presets allowed in EU868", 4, area.y + 2);
+    widgets::list(
+        c, presets_, {area.x, area.y + 12, area.w, (kListRows + 1) * theme::kLineHeight},
+        [](int i) { return std::string(meshtastic::kEu868Presets[i].name); },
+        [](int i) {
+            char v[24];
+            const auto& p = meshtastic::kEu868Presets[i];
+            std::snprintf(v, sizeof v, "SF%u %.0fk %.3f", p.sf, p.bwKHz, meshtastic::eu868FrequencyHz(p) / 1e6);
+            return std::string(v);
+        });
+}
+
+}  // namespace roro
+
+namespace roro {
+
+// Sweep (Q98): bars of the latest pass with peak hold, the waterfall underneath (newest at the
+// top), and where the Sniffer's preset sits in the band.
+void LoraScannerApp::drawSweep(Canvas& c) {
+    const auto& area = theme::kContent;
+    constexpr int kLow = -120, kHigh = -60;  // the scale, dBm: about the chip's floor to a near signal
+    SweepFrame f;
+    bool have = radio_.sweepFrame(f) && f.seq != 0;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("Sweep, the Sniffer is paused", 4, area.y + 2);
+    if (!have) {
+        c.drawString("Measuring...", 4, area.y + 20);
+        return;
+    }
+    // Keep peak hold and the waterfall for this band.
+    if (f.steps != sweepSteps_) {
+        sweepSteps_ = f.steps;
+        peak_.assign(f.steps, -127);
+        waterfall_.assign(static_cast<size_t>(kWaterfallRows) * f.steps, -127);
+    }
+    if (f.seq != shownSweep_) {
+        shownSweep_ = f.seq;
+        for (uint16_t i = 0; i < f.steps; ++i) peak_[i] = std::max(peak_[i], f.dbm[i]);
+        std::copy_backward(waterfall_.begin(), waterfall_.end() - f.steps, waterfall_.end());
+        std::copy(f.dbm, f.dbm + f.steps, waterfall_.begin());
+    }
+
+    // Layout: up to 3 px a step, left-aligned after the scale.
+    int x0 = 26, cell = std::max(1, std::min(3, (area.w - x0 - 2) / std::max<int>(1, f.steps)));
+    int barTop = area.y + 12, barH = 46, barBottom = barTop + barH;
+    auto height = [&](int dbm) { return std::clamp((dbm - kLow) * barH / (kHigh - kLow), 0, barH); };
+    c.setTextColor(theme::kMuted);
+    c.drawString("-60", 2, barTop - 1);
+    c.drawString("-120", 0, barBottom - 7);
+    for (uint16_t i = 0; i < f.steps; ++i) {
+        int x = x0 + i * cell, h = height(f.dbm[i]);
+        if (h > 0) c.fillRect(x, barBottom - h, std::max(1, cell - 1), h, theme::kAccent);
+        int ph = height(peak_[i]);
+        if (ph > 0) c.drawFastHLine(x, barBottom - ph, std::max(1, cell - 1), theme::kText);
+    }
+    // The Sniffer's frequency, when it's in the band.
+    uint32_t hz = radio_.config().frequencyHz;
+    if (hz >= f.fromHz && hz <= f.fromHz + (f.steps - 1) * f.stepHz) {
+        int x = x0 + static_cast<int>((hz - f.fromHz) / f.stepHz) * cell + cell / 2;
+        for (int y = barTop; y < barBottom; y += 3) c.drawPixel(x, y, theme::kMessage);
+    }
+
+    // The waterfall.
+    int wfTop = barBottom + 2;
+    for (int r = 0; r < kWaterfallRows; ++r)
+        for (uint16_t i = 0; i < f.steps; ++i) {
+            int8_t v = waterfall_[static_cast<size_t>(r) * f.steps + i];
+            if (v > -127) c.fillRect(x0 + i * cell, wfTop + r, cell, 1, lora::heatColor(lora::heatLevel(v, kLow, kHigh)));
+        }
+
+    // The band's edges, its floor and its strongest signal.
+    lora::SweepStats st = lora::summarize(f.dbm, f.steps, f.fromHz, f.stepHz);
+    char line[64];
+    int y = area.y + area.h - 9;
+    std::snprintf(line, sizeof line, "%.1f", f.fromHz / 1e6);
+    c.drawString(line, x0, wfTop + kWaterfallRows + 1);
+    std::snprintf(line, sizeof line, "%.1f MHz", (f.fromHz + (f.steps - 1) * f.stepHz) / 1e6);
+    c.setTextDatum(top_right);
+    c.drawString(line, x0 + f.steps * cell, wfTop + kWaterfallRows + 1);
+    c.setTextDatum(top_left);
+    if (st.peaks.empty())
+        std::snprintf(line, sizeof line, "floor %d dBm, nothing above it   Tab: sniffer", st.floor);
+    else
+        std::snprintf(line, sizeof line, "floor %d, %.1f MHz at %d dBm   Tab: sniffer", st.floor, st.peaks[0].hz / 1e6,
+                      st.peaks[0].dbm);
+    c.setTextColor(theme::kMuted);
+    c.drawString(line, 4, y);
+}
+
+}  // namespace roro
@@ -0,0 +1,67 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "list_model.h"
+#include "services/clock_service.h"
+#include "services/lora_capture_service.h"
+#include "services/radio_service.h"
+#include "settings.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// The LoRa Scanner (docs/milestones/M3.md). Sniffer: the packets the radio hears, newest first,
+// with the Meshtastic header read (Q96) and a hex dump on Enter; p picks the preset (Q95), c starts
+// or stops a Capture (Q97). The radio listens while the App is open (Q100). Tab: Sweep, the band's
+// RSSI as bars with peak hold and a waterfall (Q98); it pauses the Sniffer while shown (Q99).
+class LoraScannerApp : public App {
+   public:
+    LoraScannerApp(RadioService& radio, LoraCaptureService& capture, Settings& settings, ClockService& clock)
+        : radio_(radio), capture_(capture), settings_(settings), clock_(clock) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View { Packets, Details, Presets, Sweep };
+    static constexpr int kListRows = 7;
+
+    void drawPackets(Canvas& c);
+    void drawDetails(Canvas& c);
+    void drawPresets(Canvas& c);
+    void drawSweep(Canvas& c);
+    void showSweep(bool on);
+    void openDetails();
+    std::string timeOf(const RadioPacket& p) const;
+    bool meshtasticSettings() const;
+    void say(const std::string& text);  // a line in the footer for a few seconds
+
+    RadioService& radio_;
+    LoraCaptureService& capture_;
+    Settings& settings_;
+    ClockService& clock_;
+    View view_ = View::Packets;
+    ListModel packets_{kListRows};
+    ListModel presets_{kListRows + 1};
+    uint32_t shownSeq_ = 0;     // the newest packet at the last redraw
+    uint32_t selectedSeq_ = 0;  // what the selection points at, kept as packets arrive
+    bool followNewest_ = true;  // until the user moves the selection off the top
+    std::vector<std::string> details_;
+    int detailsTop_ = 0;
+    uint32_t lastDrawMs_ = 0;
+    std::string message_;
+    uint32_t messageMs_ = 0;
+    // Sweep, only while shown: peak hold per step, and the waterfall, newest row first.
+    static constexpr int kWaterfallRows = 36;
+    uint32_t shownSweep_ = 0;
+    std::vector<int8_t> peak_;
+    std::vector<int8_t> waterfall_;  // kWaterfallRows x steps
+    uint16_t sweepSteps_ = 0;
+};
+
+}  // namespace roro
@@ -34,6 +34,9 @@ bool SettingsApp::onKey(const KeyEvent& e) {
        case Page::Wifi:
            if (!wifiPage_.onKey(e)) page_ = Page::Menu;
            return true;
+        case Page::Firmware:
+            if (!firmwarePage_.onKey(e)) page_ = Page::Menu;
+            return true;
    }
    return false;
 }
@@ -75,6 +78,10 @@ bool SettingsApp::onMenuKey(const KeyEvent& e) {
                    page_ = Page::Wifi;
                    wifiPage_.enter();
                    break;
+                case Row::Firmware:
+                    page_ = Page::Firmware;
+                    firmwarePage_.enter();
+                    break;
                default: page_ = Page::About; break;
            }
            break;
@@ -124,7 +131,8 @@ bool SettingsApp::onAboutKey(const KeyEvent& e) {

 void SettingsApp::update(uint32_t nowMs) {
    // Live values on Storage and About.
-    bool live = page_ == Page::Storage || page_ == Page::About || (page_ == Page::Wifi && wifiPage_.live());
+    bool live = page_ == Page::Storage || page_ == Page::About || page_ == Page::Firmware ||
+                (page_ == Page::Wifi && wifiPage_.live());
    if (live && nowMs - lastRefreshMs_ >= 500) {
        lastRefreshMs_ = nowMs;
        requestRedraw();
@@ -183,6 +191,7 @@ void SettingsApp::draw(Canvas& c) {
        case Page::Storage: storagePage_.draw(c); break;
        case Page::About: widgets::textLines(c, aboutLines(), 0, area); break;
        case Page::Wifi: wifiPage_.draw(c); break;
+        case Page::Firmware: firmwarePage_.draw(c); break;
    }
 }

@@ -13,6 +13,7 @@
 #include "services/battery_service.h"
 #include "services/clock_service.h"
 #include "services/storage_service.h"
+#include "apps/firmware_page.h"
 #include "apps/storage_page.h"
 #include "apps/wifi_settings_page.h"
 #include "settings_menu.h"
@@ -29,6 +30,7 @@ struct SettingsAppDeps {
    ClockService& clock;
    WifiService& wifi;
    SavedNetworks& savedNetworks;
+    UpdateService& update;
 };

 // Settings: every user-facing setting, plus the Storage and About pages.
@@ -38,7 +40,8 @@ class SettingsApp : public App {
        : d_(deps),
          menu_(deps.settings),
          wifiPage_(deps.settings, deps.savedNetworks, deps.wifi, deps.bus),
-          storagePage_(deps.storage, deps.clock, deps.bus) {}
+          storagePage_(deps.storage, deps.clock, deps.bus),
+          firmwarePage_(deps.update, deps.wifi, deps.storage) {}
    void onEnter() override;
    bool onKey(const KeyEvent& e) override;
    void update(uint32_t nowMs) override;
@@ -48,7 +51,7 @@ class SettingsApp : public App {
    void draw(Canvas& c) override;

   private:
-    enum class Page { Menu, Text, Choice, Storage, About, Wifi };
+    enum class Page { Menu, Text, Choice, Storage, About, Wifi, Firmware };

    bool onMenuKey(const KeyEvent& e);
    bool onTextKey(const KeyEvent& e);
@@ -61,6 +64,7 @@ class SettingsApp : public App {
    SettingsMenu menu_;
    WifiSettingsPage wifiPage_;
    StoragePage storagePage_;
+    FirmwarePage firmwarePage_;
    Page page_ = Page::Menu;
    ListModel list_{theme::kContent.h / theme::kLineHeight};
    ListModel choices_{theme::kContent.h / theme::kLineHeight};
@@ -2,24 +2,42 @@
 #include <M5Cardputer.h>
 #include <SD.h>

+
+#include <atomic>
+#include <memory>
+
 #include "app_manager.h"
 #include "apps/demo_app.h"
+#include "apps/gemini_app.h"
+#include "apps/gnss_app.h"
 #include "apps/irc_app.h"
 #include "apps/launcher_app.h"
+#include "apps/lora_scanner_app.h"
 #include "apps/settings_app.h"
 #include "apps/wifi_tools_app.h"
 #include "apps/setup_app.h"
 #include "event_bus.h"
+#include "file_receiver.h"
 #include "key_mapper.h"
+#include "platform/console.h"
+#include "platform/crash_report.h"
 #include "platform/nvs_store.h"
+#include "platform/system_info.h"
 #include "service_manager.h"
 #include "platform/identity.h"
 #include "services/battery_service.h"
 #include "services/irc_service.h"
 #include "services/clock_service.h"
+#include "services/debug_console.h"
+#include "services/gemini_service.h"
+#include "services/gnss_service.h"
 #include "services/power_service.h"
+#include "services/lora_capture_service.h"
+#include "services/radio_service.h"
 #include "services/storage_service.h"
+#include "services/update_service.h"
 #include "services/wifi_service.h"
+#include "safe_mode.h"
 #include "settings.h"
 #include "storage_paths.h"
 #include "ui/notifier.h"
@@ -40,12 +58,21 @@ static BatteryService* battery;
 static StorageService* storageService;
 static PowerService* power;
 static ClockService* clockService;
+static GnssService* gnssService;
+static RadioService* radioService;
+static LoraCaptureService* loraCapture;
+static GeminiService* geminiService;
 static SavedNetworks* savedNetworks;
 static WifiService* wifi;
 static IrcService* irc;
+static UpdateService* update;
+#ifdef RORO_DEBUG
+static DebugConsole* debugConsole;
+#endif
 static Notifier* notifier;
 static LauncherApp launcher;
 static AppManager* apps;
+static bool safeMode = false;  // see SafeMode: only what it takes to be fixed over the air

 static RawKeys readKeys() {
    auto state = M5Cardputer.Keyboard.keysState();
@@ -73,6 +100,21 @@ static StatusInfo currentStatus() {
    s.sdLevel = storageState.level;
    s.compose = keyMapper.pendingCompose();
    s.unread = irc->totalUnread();
+    if (gnssService && gnssService->on()) {
+        const auto& g = gnssService->state();
+        bool fresh = gnssService->receiving(millis());
+        s.gnss = !fresh || g.fix == gnss::FixType::None ? StatusInfo::Gnss::Searching
+                 : g.fix == gnss::FixType::TwoD        ? StatusInfo::Gnss::TwoD
+                                                       : StatusInfo::Gnss::ThreeD;
+        s.gnssSatellites = g.satellitesUsed;
+        s.tracking = gnssService->tracking();
+    }
+    if (radioService && radioService->sweeping()) s.radio = StatusInfo::Radio::Sweep;
+    else if (radioService && radioService->listening()) {
+        uint32_t last = radioService->lastPacketMs();
+        s.radio = last && millis() - last < 400 ? StatusInfo::Radio::Packet : StatusInfo::Radio::Listening;
+    }
+    s.capturing = loraCapture && loraCapture->capturing();
    using WifiState = WifiController::State;
    switch (wifi->state()) {
        case WifiState::Connected: {
@@ -88,51 +130,123 @@ static StatusInfo currentStatus() {
    return s;
 }

+// Arduino-ESP32 marks a new image valid before setup() unless this returns true. Probation
+// (UpdateService::tick) decides instead, and an unconfirmed image stays PENDING_VERIFY.
+extern "C" bool verifyRollbackLater() { return true; }  // C linkage, or the weak default wins
+
+// The main loop's stack: Arduino's default is 8 KB; the measured peak is 3 KB (M2).
+size_t getArduinoLoopTaskStackSize() { return 6144; }
+
+static void setupSafeMode(int crashes);
+
 void setup() {
+    nvs.begin();
+    UpdateService::bootGuard(nvs);  // first: before anything that could crash on new firmware
+    int crashes = crash_report::noteBoot(nvs);
+    safeMode = SafeMode::active(crashes);
+    Serial.setRxBufferSize(2 * FileReceiver::kChunk);  // before the port opens; sd put sends 1 chunk at a time
+    Serial.setTxBufferSize(1024);  // the console skips Serial when it's full: room for a burst like `tasks`
+
    auto cfg = M5.config();
    M5Cardputer.begin(cfg, true);
    M5Cardputer.Display.setRotation(1);
    Serial.begin(115200);

-    nvs.begin();
    settings.load();
+    if (safeMode) return setupSafeMode(crashes);

    battery = new BatteryService(bus);
    storageService = new StorageService(bus);
    power = new PowerService(settings);
    clockService = new ClockService(settings, bus);
+    geminiService = new GeminiService(nvs, *storageService, *clockService, bus);
+    gnssService = new GnssService(settings, *clockService, *storageService, bus);
+    radioService = new RadioService();
    savedNetworks = new SavedNetworks(nvs);
    savedNetworks->load();
    wifi = new WifiService(settings, *savedNetworks, *clockService);
+    update = new UpdateService(nvs, *wifi, *savedNetworks, *storageService, bus, settings);
    irc = new IrcService(nvs, "roro_" + identity::defaultShortName(), *wifi, *storageService, *clockService, bus);
    notifier = new Notifier(bus, settings);
    notifier->onShow = [](uint32_t now, uint32_t until) { power->onNotification(now, until); };
    services.add(*power);
    services.add(*clockService);
    services.add(*battery);
+    services.add(*gnssService);
+    services.add(*radioService);
+    loraCapture = new LoraCaptureService(*radioService, *storageService, *clockService, bus);
+    services.add(*loraCapture);
    services.add(*storageService);
    services.add(*wifi);
    services.add(*irc);
+    services.add(*update);
+#ifdef RORO_DEBUG
+    debugConsole = new DebugConsole(*wifi, *storageService);
+    services.add(*debugConsole);
+#endif

    apps = new AppManager(launcher);
    launcher.setManager(*apps);
    apps->registerApp({"irc", "IRC", false, new IrcApp(*irc, *clockService, bus)});
    apps->registerApp({"wifi-tools", "Wi-Fi Tools", false, new WifiToolsApp(*wifi, *storageService, *clockService)});
+    apps->registerApp({"gnss", "GNSS", false, new GnssApp(*gnssService, settings)});
+    apps->registerApp({"gemini", "Gemini", false, new GeminiApp(*geminiService)});
+    apps->registerApp({"lora", "LoRa Scanner", false, new LoraScannerApp(*radioService, *loraCapture, settings, *clockService)});
    apps->registerApp({"settings", "Settings", false,
-                       new SettingsApp({settings, bus, *apps, *battery, *storageService, *clockService, *wifi, *savedNetworks})});
+                       new SettingsApp({settings, bus, *apps, *battery, *storageService, *clockService, *wifi, *savedNetworks, *update})});
    apps->registerApp({"demo", "Widget demo", true, new DemoApp(bus)});
    apps->registerApp({"setup", "Setup", true, new SetupApp(settings, *apps)});

-    bus.subscribe(EventType::Notification, [](const Event& e) { Serial.printf("notification: %s\n", e.text); });
+    bus.subscribe(EventType::Notification, [](const Event& e) { console.printf("notification: %s\n", e.text); });

-    if (!screen.begin()) Serial.println("frame buffer allocation failed");
+    if (!screen.begin()) console.println("frame buffer allocation failed");
+#ifdef RORO_DEBUG
+    debugConsole->setFrame(screen.canvas());  // for `screenshot`
+#endif
    services.startAll(millis());
    apps->begin();
    if (!settings.getBool(Setting::SetupDone)) apps->openModal("setup");
-    Serial.printf("%s %s ready, free heap %u\n", kProductName, versionString(), ESP.getFreeHeap());
+    console.printf("%s %s ready, free heap %u, last start: %s\n", kProductName, versionString(), ESP.getFreeHeap(),
+                   system_info::resetReason());
+    if (system_info::resetWasCrash()) {
+        crash_report::print(console, nvs);
+        bus.publish(Event::withText(EventType::Notification, crash_report::headline().c_str(),
+                                    static_cast<int32_t>(NotificationLevel::Warning)));
+    }
+    // A main loop stuck for 5 s panics (and leaves a core dump) instead of hanging forever: Arduino
+    // only watches the idle task on core 0, and the loop runs on core 1.
+    enableLoopWDT();
 }

-// Dev aid: serial commands to drive the UI without the keyboard.
+// Safe Mode: Wi-Fi, the clock, Firmware Updates and (in a Debug Build) the Debug Console. No Apps,
+// no IRC, no SD card: whatever crashed three times in a row is most likely among them.
+static void setupSafeMode(int crashes) {
+    clockService = new ClockService(settings, bus);
+    savedNetworks = new SavedNetworks(nvs);
+    savedNetworks->load();
+    wifi = new WifiService(settings, *savedNetworks, *clockService);
+    storageService = new StorageService(bus);  // never started: no card access
+    update = new UpdateService(nvs, *wifi, *savedNetworks, *storageService, bus, settings);
+    services.add(*clockService);
+    services.add(*wifi);
+    services.add(*update);
+#ifdef RORO_DEBUG
+    debugConsole = new DebugConsole(*wifi, *storageService);
+    services.add(*debugConsole);
+#endif
+    bus.subscribe(EventType::Notification, [](const Event& e) { console.printf("notification: %s\n", e.text); });
+    screen.begin();
+#ifdef RORO_DEBUG
+    debugConsole->setFrame(screen.canvas());
+#endif
+    services.startAll(millis());
+    console.printf("%s %s in SAFE MODE: %d crash restarts in a row. Only Wi-Fi and Firmware Updates run.\n",
+                   kProductName, versionString(), crashes);
+    crash_report::print(console, nvs);
+    enableLoopWDT();
+}
+
+// Dev aid: commands to drive the UI without the keyboard, from the serial port or the Debug Console.
 static bool listingWanted = false;

 static void printListingWhenReady() {
@@ -142,13 +256,343 @@ static void printListingWhenReady() {
    for (size_t i = 0; i < listing.size(); i++) {
        uint64_t bytes = 0;
        for (auto& f : listing[i]) bytes += f.bytes;
-        Serial.printf("sd list: %-20s %u files, %s\n", kCleanupCategories[i].label, (unsigned)listing[i].size(),
-                      formatBytes(bytes).c_str());
-        for (auto& f : listing[i]) Serial.printf("  %s (%u B)\n", f.path.c_str(), (unsigned)f.bytes);
+        console.printf("sd list: %-20s %u files, %s\n", kCleanupCategories[i].label, (unsigned)listing[i].size(),
+                       formatBytes(bytes).c_str());
+        for (auto& f : listing[i]) console.printf("  %s (%u B)\n", f.path.c_str(), (unsigned)f.bytes);
+    }
+}
+
+// sd put: a file sent over serial by scripts/sd_put.py. The main loop reads the bytes; every card
+// access runs as a Storage Service job, which reports back through uploadResult.
+static FileReceiver upload;
+static std::atomic<int> uploadResult{-1};  // set by a job: 1 ok, 0 failed; -1 nothing new
+static bool uploadJobRunning = false;
+
+static void uploadJob(std::function<bool()> job) {
+    uploadJobRunning = true;
+    storageService->runJob([job]() { uploadResult = job() ? 1 : 0; });
+}
+
+static void startUpload(const String& args) {
+    if (upload.active() || uploadJobRunning) return (void)Serial.println("sd put: error busy");
+    std::string error = upload.begin(args.c_str(), millis());
+    StorageState card = storageService->state();
+    if (error.empty() && !card.present) error = "no SD card";
+    if (error.empty() && card.totalBytes - card.usedBytes < upload.size() + 64 * 1024) error = "not enough space";
+    if (!error.empty()) {
+        upload.reset();
+        return (void)Serial.printf("sd put: error %s\n", error.c_str());
+    }
+    std::string part = upload.partPath();
+    uploadJob([part]() {
+        for (size_t slash = part.find('/', 1); slash != std::string::npos; slash = part.find('/', slash + 1)) {
+            std::string dir = part.substr(0, slash);
+            if (!SD.exists(dir.c_str()) && !SD.mkdir(dir.c_str())) return false;
+        }
+        if (SD.exists(part.c_str())) SD.remove(part.c_str());
+        return true;
+    });
+}
+
+static void readUploadBytes() {
+    uint8_t buf[256];
+    size_t want;
+    while (!uploadJobRunning && (want = std::min(upload.wanted(), sizeof buf)) > 0 && Serial.available() > 0) {
+        size_t n = Serial.read(buf, std::min<size_t>(want, Serial.available()));
+        upload.feed(buf, n, millis());
+    }
+}
+
+static void uploadStep() {
+    using S = FileReceiver::State;
+    uint32_t now = millis();
+    int result = uploadResult.exchange(-1);
+    if (result >= 0) {
+        uploadJobRunning = false;
+        bool ok = result == 1;
+        switch (upload.state()) {
+            case S::Receiving:  // the folder job from startUpload: the sender may start
+                if (ok) Serial.printf("sd put: ready %u\n", (unsigned)FileReceiver::kChunk);
+                else {
+                    upload.reset();
+                    return (void)Serial.println("sd put: error card not writable");
+                }
+                break;
+            case S::Writing:
+                upload.chunkWritten(ok, now);
+                if (upload.state() == S::Receiving) Serial.printf("sd put: ok %u\n", (unsigned)upload.received());
+                break;
+            case S::Finishing: upload.finished(ok); break;
+            default: break;  // a job that finished after the transfer failed
+        }
+    }
+    if (!upload.active()) return;
+    upload.tick(now);
+    std::string path = upload.path(), part = upload.partPath();
+    if (upload.state() == S::Failed) {
+        // Reported even if a job never came back (no card: the storage task drops it).
+        Serial.printf("sd put: error %s\n", upload.error().c_str());
+        storageService->runJob([part]() { SD.remove(part.c_str()); });
+        upload.reset();
+        uploadJobRunning = false;
+        return;
+    }
+    if (uploadJobRunning) return;
+    if (upload.state() == S::Writing) {
+        auto chunk = std::make_shared<std::vector<uint8_t>>(upload.chunk());
+        uploadJob([chunk, part]() {
+            File f = SD.open(part.c_str(), FILE_APPEND);
+            bool ok = f && f.write(chunk->data(), chunk->size()) == chunk->size();
+            if (f) f.close();
+            return ok;
+        });
+    } else if (upload.state() == S::Finishing) {
+        uploadJob([path, part]() {
+            if (SD.exists(path.c_str())) SD.remove(path.c_str());
+            return SD.rename(part.c_str(), path.c_str());
+        });
+    } else if (upload.state() == S::Done) {
+        Serial.printf("sd put: done %s %u B\n", path.c_str(), (unsigned)upload.size());
+        upload.reset();
+    }
+}
+
+static const char* const kHelp =
+    "info              firmware, uptime, memory, Wi-Fi, app slots\n"
+    "tasks             FreeRTOS tasks: state, priority, free stack, CPU\n"
+    "reboot            restart\n"
+    "boot other        restart into the other app slot (manual Rollback)\n"
+    "log level <0-5>   ESP-IDF log level (0 none ... 5 verbose)\n"
+    "lora probe | lora status | lora rx on|off | lora preset <name>   the LoRa radio, receive only\n"
+    "lora capture start|stop   a LoRa Capture to /captures/lora (pcap, LoRaTap)\n"
+    "lora sweep on [from MHz] [to MHz] [step kHz] | off | dump   RSSI across a band (863 870 100)\n"
+    "lora custom <MHz> <BW kHz> <SF> <CR 5-8> <sync hex> [preamble]   e.g. 868.1 125 7 5 34 8 (LoRaWAN)\n"
+    "gnss status | gnss restart | gnss track start|stop | gnss nmea on|off | gnss send <sentence without $ and checksum>\n"
+    "crash             the last crash: firmware, reason, task, backtrace\n"
+    "coredump erase    forget the core dump in flash\n"
+    "key <name|char>   press a key: up down left right select back home del tab space, or one character\n"
+    "wifi status | wifi add <ssid><TAB><password>\n"
+    "gemini get <url>  fetch a Gemini page and report header, size, certificate, heap\n"
+    "irc start | irc stop | irc dump | irc say <buffer> <text>\n"
+    "ls [folder] | rm <path> | install <path.ota> (Update from SD)\n"
+    "sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
+#ifdef RORO_DEBUG
+    "crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)\n"
+    "lora inject <hex> [rssi] [snr]   a packet into the LoRa Scanner as if received (nothing is sent)\n"
+    "coredump get      (Debug Console only) send the raw core dump: use scripts/rdbg.py coredump\n"
+    "reset             (Debug Console only) restart at once, even if the main loop is stuck\n"
+    "get <path> | put <path> <size> <sha256> | screenshot   (Debug Console only) binary, see rdbg.py\n"
+    "quit              close the Debug Console connection\n"
+#endif
+    ;
+
+// Commands that only touch what Safe Mode starts.
+static bool safeModeCommand(const String& line) {
+    return line == "help" || line == "info" || line == "tasks" || line == "reboot" || line == "boot other" ||
+           line.startsWith("log level ") || line.startsWith("crash") || line.startsWith("coredump") ||
+           line == "wifi status" || line.startsWith("wifi add ");
+}
+
+static void runCommand(String line) {
+    line.trim();
+    if (line.isEmpty()) return;
+    if (safeMode && !safeModeCommand(line)) return (void)console.println("not available in Safe Mode");
+    if (line == "help") console.print(kHelp);
+    if (line == "info") {
+        system_info::printSystem(console);
+        console.printf("wifi: %s, ip %s, rssi %d | sd: %s\n", wifi->ssid().c_str(), wifi->ip().c_str(), wifi->rssi(),
+                       storageService->state().present ? "present" : "none");
+        console.printf("update: %s\n", update->onProbation() ? "on probation" : "confirmed");
+        system_info::printSlots(console, nvs);
+    }
+    if (line == "tasks") system_info::printTasks(console);
+    if (line == "reboot") {
+        console.println("restarting");
+        delay(300);
+        ESP.restart();
+    }
+    if (line == "boot other") console.printf("boot other: %s\n", system_info::bootOtherSlot());
+    if (line.startsWith("log level ")) {
+        int level = line.substring(10).toInt();
+        esp_log_level_set("*", static_cast<esp_log_level_t>(constrain(level, 0, 5)));
+        console.printf("log level: %d\n", constrain(level, 0, 5));
+    }
+    if (line == "ls" || line.startsWith("ls ") || line.startsWith("rm ")) {
+        if (!storageService->state().present) return (void)console.println("sd: no card");
+        bool list = !line.startsWith("rm ");
+        std::string path = line.length() > 3 ? line.substring(3).c_str() : "/";
+        storageService->runJob([list, path]() {  // card access stays on the storage task
+            if (!list) return (void)console.printf("rm: %s %s\n", path.c_str(), SD.remove(path.c_str()) ? "removed" : "failed");
+            File dir = SD.open(path.c_str());
+            if (!dir || !dir.isDirectory()) return (void)console.printf("ls: %s is not a folder\n", path.c_str());
+            for (File f = dir.openNextFile(); f; f = dir.openNextFile())
+                console.printf("%10u  %s%s\n", f.isDirectory() ? 0u : (unsigned)f.size(), f.name(), f.isDirectory() ? "/" : "");
+            console.printf("ls: end of %s\n", path.c_str());
+        });
+    }
+    if (line.startsWith("install ")) update->installFromSd(line.substring(8).c_str());  // Update from SD
+    if (line == "lora probe" && radioService) radioService->probe(console);
+    if (line == "lora status" && radioService) radioService->printStatus(console);
+    if ((line == "lora rx on" || line == "lora rx off") && radioService) radioService->setEcho(line.endsWith("on"));
+    if (line.startsWith("lora sweep") && radioService) {  // on [from MHz] [to MHz] [step kHz] | off | dump
+        if (line == "lora sweep dump") radioService->printSweep(console);
+        else if (line == "lora sweep off") {
+            radioService->setSweepEcho(false);
+            radioService->sweep(false);
+        } else if (line.startsWith("lora sweep on")) {
+            double from = 863, to = 870, step = 100;
+            sscanf(line.c_str() + 13, "%lf %lf %lf", &from, &to, &step);
+            radioService->setSweepEcho(true);
+            radioService->sweep(true, from * 1e6 + 0.5, to * 1e6 + 0.5, step * 1e3 + 0.5);
+        }
+    }
+    if (line == "lora capture start" && loraCapture) {
+        std::string why = loraCapture->start(millis());
+        console.printf("lora capture: %s\n", why.empty() ? loraCapture->path().c_str() : why.c_str());
+    }
+    if (line == "lora capture stop" && loraCapture) loraCapture->stop();
+#ifdef RORO_DEBUG
+    if (line.startsWith("lora inject ") && radioService) {  // <hex> [rssi] [snr]: as if received
+        String hex = line.substring(12);
+        int space = hex.indexOf(' ');
+        float rssi = -100, snr = 5;
+        if (space > 0) sscanf(hex.c_str() + space + 1, "%f %f", &rssi, &snr), hex = hex.substring(0, space);
+        uint8_t data[255];
+        size_t n = 0;
+        for (size_t i = 0; i + 1 < hex.length() && n < sizeof data; i += 2) data[n++] = strtoul(hex.substring(i, i + 2).c_str(), nullptr, 16);
+        radioService->inject(data, n, rssi, snr);
+    }
+#endif
+    if (line.startsWith("lora custom ") && radioService) {
+        double mhz = 0, bw = 0;
+        unsigned sf = 0, cr = 0, sync = 0, preamble = 8;
+        int n = sscanf(line.c_str() + 12, "%lf %lf %u %u %x %u", &mhz, &bw, &sf, &cr, &sync, &preamble);
+        // Inside what the Cap's SX1262 tunes (868 to 923 MHz) and LoRa's own limits.
+        if (n < 5 || mhz < 863 || mhz > 928 || bw < 7 || bw > 500 || sf < 5 || sf > 12 || cr < 5 || cr > 8 || sync > 0xFF)
+            console.println("lora custom: usage: lora custom <MHz> <BW kHz> <SF 5-12> <CR 5-8> <sync hex> [preamble]");
+        else {
+            radioService->setConfig({static_cast<uint32_t>(mhz * 1e6 + 0.5), static_cast<float>(bw), static_cast<uint8_t>(sf),
+                                     static_cast<uint8_t>(cr), static_cast<uint8_t>(sync), static_cast<uint16_t>(preamble), "Custom"});
+            console.printf("lora custom: %.3f MHz, BW %.1f kHz, SF %u, CR 4/%u, sync 0x%02X, preamble %u\n", mhz, bw, sf, cr, sync, preamble);
+        }
+    }
+    if (line.startsWith("lora preset ") && radioService) {
+        const meshtastic::Preset* p = meshtastic::findPreset(line.substring(12).c_str());
+        if (p) radioService->setPreset(*p);
+        console.printf("lora preset: %s\n", p ? p->name : "unknown (LongFast LongSlow MediumSlow MediumFast ShortSlow ShortFast LongMod)");
+    }
+    if (line == "gnss status" && gnssService) gnssService->printStatus(console, millis());
+    if ((line == "gnss nmea on" || line == "gnss nmea off") && gnssService) gnssService->setEcho(line.endsWith("on"));
+    if (line == "gnss restart" && gnssService) gnssService->restart(millis());
+    if (line == "gnss track start" && gnssService) {
+        std::string why = gnssService->startTrack(millis());
+        console.printf("gnss track: %s\n", why.empty() ? "recording" : why.c_str());
+    }
+    if (line == "gnss track stop" && gnssService) gnssService->stopTrack();
+    if (line.startsWith("gnss send ") && gnssService)  // the checksum is added
+        console.println(gnssService->send(line.substring(10).c_str()) ? "gnss: sent" : "gnss: off");
+    if (line == "crash") crash_report::print(console, nvs);
+    if (line == "coredump erase") console.println(crash_report::erase() ? "coredump: erased" : "coredump: nothing to erase");
+#ifdef RORO_DEBUG
+    if (line == "crash abort") abort();
+    if (line == "crash wdt")
+        for (;;) {}  // the main loop never yields: the task watchdog fires
+#endif
+    if (line == "burst")
+        for (int i = 1; i <= 5; i++)
+            bus.publish(Event::withText(EventType::Notification, ("Burst " + String(i)).c_str(), 0));
+    if (line.startsWith("key ")) {  // key up|down|left|right|select|back|home|del|tab
+        String k = line.substring(4);
+        Key key = k == "up" ? Key::Up : k == "down" ? Key::Down : k == "left" ? Key::Left
+                : k == "right" ? Key::Right : k == "back" ? Key::Back : k == "home" ? Key::Home
+                : k == "del" ? Key::Delete : k == "tab" ? Key::Tab : Key::Select;
+        KeyEvent ev = k == "space"                       ? KeyEvent::character(' ')
+                      : k.length() == 1 && k[0] > ' ' ? KeyEvent::character((unsigned char)k[0])
+                                                      : KeyEvent::of(key);
+        if (!power->onKey(millis())) apps->handleKey(ev);
+    }
+    if (line.startsWith("wifi add ")) {  // wifi add <ssid>\t<password>: credentials never touch the repo
+        int tab = line.indexOf('\t');
+        std::string ssid = (tab > 0 ? line.substring(9, tab) : line.substring(9)).c_str();
+        std::string pass = tab > 0 ? line.substring(tab + 1).c_str() : "";
+        std::string error = savedNetworks->add(ssid, pass);
+        console.printf("wifi add: %s\n", error.empty() ? "ok" : error.c_str());
+        wifi->savedNetworksChanged();
+    }
+    if (line.startsWith("log ") && !line.startsWith("log level ")) {  // appends to a test IRC Log
+        std::string path = storage::dailyLogPath({"irc", "dev", "#test"}, clockService->localDate());
+        storageService->appendLine(path, clockService->displayTime() + " " + line.substring(4).c_str());
+        console.printf("log: queued to %s\n", path.c_str());
+    }
+    if (line.startsWith("cat ")) {
+        std::string path = line.substring(4).c_str();
+        File f = SD.open(path.c_str());
+        if (!f) console.printf("cat: cannot open %s\n", path.c_str());
+        else {
+            console.printf("--- %s (%u B) ---\n", path.c_str(), (unsigned)f.size());
+            int shown = 0;
+            while (f.available() && shown < 1200) { console.write(f.read()); shown++; }
+            console.println("\n--- end ---");
+            f.close();
+        }
+    }
+    if (line.startsWith("sd put ")) startUpload(line.substring(7));  // then raw bytes: see uploadStep()
+    if (line == "sd list") {
+        storageService->requestListing();
+        listingWanted = true;
+    }
+    if (line.startsWith("gemini trust ")) {  // gemini trust <host> <port> <sha256>: accept a changed certificate
+        char host[96] = "", fp[80] = "";
+        int port = 1965;
+        if (geminiService && sscanf(line.substring(13).c_str(), "%95s %d %79s", host, &port, fp) == 3) geminiService->trust(host, port, fp);
+    }
+    if (line.startsWith("gemini get "))
+        if (!geminiService || !geminiService->fetchToConsole(line.substring(11).c_str())) console.println("gemini: busy, or unavailable in Safe Mode");
+    if (line == "irc start") irc->connect();
+    if (line == "irc stop") irc->disconnect();
+    if (line.startsWith("irc say ")) {  // irc say <buffer index> <text>
+        String rest = line.substring(8);
+        int space = rest.indexOf(' ');
+        int b = rest.substring(0, space).toInt();
+        std::string text = rest.substring(space + 1).c_str();
+        irc->withSession([&](IrcSession& s) { s.input(b, text, clockService->utcNow()); });
+    }
+    if (line == "irc dump") {
+        console.printf("irc: status %d, unread %d, heap %u min %u\n", (int)irc->status(), irc->totalUnread(),
+                       ESP.getFreeHeap(), ESP.getMinFreeHeap());
+        IrcConfig c = irc->draftConfig();  // which login is configured, never the secrets
+        console.printf("irc: nick %s, sasl %s, nickserv %s, autojoin %u channels\n", c.nick.c_str(),
+                       c.saslUser.empty() || c.saslPassword.empty() ? "off" : "on",
+                       c.nickservPassword.empty() ? "off" : "on", (unsigned)c.autojoin.size());
+        irc->withSession([](IrcSession& s) {
+            for (int i = 0; i < s.bufferCount(); i++) {
+                const auto& b = s.buffer(i);
+                console.printf("irc buffer %d %s unread %d%s\n", i, b.name.c_str(), b.unread, b.joined ? " joined" : "");
+                size_t from = 0;
+                for (size_t j = from; j < b.lines.size(); j++)
+                    console.printf("   <%s> %s\n", b.lines[j].nick.c_str(), b.lines[j].text.c_str());
+            }
+        });
+    }
+    if (line == "wifi status")
+        console.printf("wifi: state %d ssid '%s' rssi %d ip %s clock %s heap %u min %u | fw %s%s\n",
+                       (int)wifi->state(), wifi->ssid().c_str(), wifi->rssi(), wifi->ip().c_str(),
+                       clockService->displayTime().c_str(), ESP.getFreeHeap(), ESP.getMinFreeHeap(), versionString(),
+                       update->onProbation() ? " (on probation)" : "");
+    if (line == "sound off") settings.setBool(Setting::Sound, false);
+    if (line == "sound on") settings.setBool(Setting::Sound, true);
+    if (line == "short") {
+        settings.setInt(Setting::DimTimeoutS, 5);
+        settings.setInt(Setting::OffTimeoutS, 10);
+    }
+    if (line == "normal") {
+        settings.setInt(Setting::OffTimeoutS, 60);
+        settings.setInt(Setting::DimTimeoutS, 30);
    }
 }

 static void serialCommands() {
+    if (upload.active()) return readUploadBytes();  // raw file bytes, not commands
    static String line;
    while (Serial.available()) {
        char c = Serial.read();
@@ -156,95 +600,65 @@ static void serialCommands() {
            line += c;
            continue;
        }
-        line.trim();
-        if (line == "burst")
-            for (int i = 1; i <= 5; i++)
-                bus.publish(Event::withText(EventType::Notification, ("Burst " + String(i)).c_str(), 0));
-        if (line.startsWith("key ")) {  // key up|down|left|right|select|back|home
-            String k = line.substring(4);
-            Key key = k == "up" ? Key::Up : k == "down" ? Key::Down : k == "left" ? Key::Left
-                    : k == "right" ? Key::Right : k == "back" ? Key::Back : k == "home" ? Key::Home : Key::Select;
-            KeyEvent ev = k.length() == 1 && k[0] > ' ' ? KeyEvent::character((unsigned char)k[0]) : KeyEvent::of(key);
-            if (!power->onKey(millis())) apps->handleKey(ev);
-        }
-        if (line.startsWith("wifi add ")) {  // wifi add <ssid>\t<password>: credentials never touch the repo
-            int tab = line.indexOf('\t');
-            std::string ssid = (tab > 0 ? line.substring(9, tab) : line.substring(9)).c_str();
-            std::string pass = tab > 0 ? line.substring(tab + 1).c_str() : "";
-            std::string error = savedNetworks->add(ssid, pass);
-            Serial.printf("wifi add: %s\n", error.empty() ? "ok" : error.c_str());
-            wifi->savedNetworksChanged();
-        }
-        if (line.startsWith("log ")) {  // appends to a test IRC Log
-            std::string path = storage::dailyLogPath({"irc", "dev", "#test"}, clockService->localDate());
-            storageService->appendLine(path, clockService->displayTime() + " " + line.substring(4).c_str());
-            Serial.printf("log: queued to %s\n", path.c_str());
-        }
-        if (line.startsWith("cat ")) {
-            std::string path = line.substring(4).c_str();
-            File f = SD.open(path.c_str());
-            if (!f) Serial.printf("cat: cannot open %s\n", path.c_str());
-            else {
-                Serial.printf("--- %s (%u B) ---\n", path.c_str(), (unsigned)f.size());
-                int shown = 0;
-                while (f.available() && shown < 1200) { Serial.write(f.read()); shown++; }
-                Serial.println("\n--- end ---");
-                f.close();
-            }
-        }
-        if (line == "sd list") {
-            storageService->requestListing();
-            listingWanted = true;
-        }
-        if (line == "irc start") irc->connect();
-        if (line.startsWith("irc say ")) {  // irc say <buffer index> <text>
-            String rest = line.substring(8);
-            int space = rest.indexOf(' ');
-            int b = rest.substring(0, space).toInt();
-            std::string text = rest.substring(space + 1).c_str();
-            irc->withSession([&](IrcSession& s) { s.input(b, text, clockService->utcNow()); });
-        }
-        if (line == "irc dump") {
-            Serial.printf("irc: status %d, unread %d, heap %u min %u\n", (int)irc->status(), irc->totalUnread(),
-                          ESP.getFreeHeap(), ESP.getMinFreeHeap());
-            IrcConfig c = irc->draftConfig();  // which login is configured, never the secrets
-            Serial.printf("irc: nick %s, sasl %s, nickserv %s, autojoin %u channels\n", c.nick.c_str(),
-                          c.saslUser.empty() || c.saslPassword.empty() ? "off" : "on",
-                          c.nickservPassword.empty() ? "off" : "on", (unsigned)c.autojoin.size());
-            irc->withSession([](IrcSession& s) {
-                for (int i = 0; i < s.bufferCount(); i++) {
-                    const auto& b = s.buffer(i);
-                    Serial.printf("irc buffer %d %s unread %d%s\n", i, b.name.c_str(), b.unread, b.joined ? " joined" : "");
-                    size_t from = 0;
-                    for (size_t j = from; j < b.lines.size(); j++)
-                        Serial.printf("   <%s> %s\n", b.lines[j].nick.c_str(), b.lines[j].text.c_str());
-                }
-            });
-        }
-        if (line == "wifi status")
-            Serial.printf("wifi: state %d ssid '%s' rssi %d clock %s heap %u min %u\n", (int)wifi->state(),
-                          wifi->ssid().c_str(), wifi->rssi(), clockService->displayTime().c_str(), ESP.getFreeHeap(),
-                          ESP.getMinFreeHeap());
-        if (line == "sound off") settings.setBool(Setting::Sound, false);
-        if (line == "sound on") settings.setBool(Setting::Sound, true);
-        if (line == "short") {
-            settings.setInt(Setting::DimTimeoutS, 5);
-            settings.setInt(Setting::OffTimeoutS, 10);
-        }
-        if (line == "normal") {
-            settings.setInt(Setting::OffTimeoutS, 60);
-            settings.setInt(Setting::DimTimeoutS, 30);
-        }
+        runCommand(line);
        line = "";
    }
 }

+static void remoteCommands() {
+#ifdef RORO_DEBUG
+    for (std::string remote; debugConsole->takeCommand(remote);) {
+        console.printf("> %s\n", remote.c_str());  // so the transcript reads the same on both ends
+        runCommand(remote.c_str());
+    }
+#endif
+}
+
+// After a minute up, the crash streak is over (SafeMode counts starts that crash in a row).
+static void noteStableOnce(uint32_t now) {
+    static bool noted = false;
+    if (noted || now < SafeMode::kStableAfterMs) return;
+    noted = true;
+    crash_report::noteStable(nvs);
+}
+
+static void loopSafeMode() {
+    uint32_t now = millis();
+    serialCommands();
+    remoteCommands();
+    services.tick(now);
+    bus.dispatch();
+    noteStableOnce(now);
+    if (update->phase() == UpdateService::Phase::Installed) {
+        screen.renderUpdate("Restarting", "into " + update->incomingVersion(), -1);
+        delay(800);
+        ESP.restart();
+    }
+    static uint32_t lastDraw = 0;
+    if (update->phase() == UpdateService::Phase::Receiving) {
+        screen.renderUpdate("Firmware update", "Receiving " + update->incomingVersion(), update->percent());
+    } else if (now - lastDraw > 2000 || !lastDraw) {
+        lastDraw = now;
+        bool up = wifi->state() == WifiController::State::Connected;
+        screen.renderUpdate("Safe Mode", up ? "Updates: " + wifi->ip() + ":3232" : "Waiting for Wi-Fi", -1);
+    }
+    delay(10);
+}
+
 void loop() {
+    if (safeMode) return loopSafeMode();
+#ifdef RORO_TEST_CRASH
+    // Test builds only (never in a release): crash during Probation to exercise Rollback.
+    if (millis() > 5000) abort();
+#endif
    static StatusInfo lastStatus;
    static uint32_t lastLog = 0;
    uint32_t now = millis();

    serialCommands();
+    remoteCommands();
+    noteStableOnce(now);
+    uploadStep();
    printListingWhenReady();
    M5Cardputer.update();
    if (M5Cardputer.Keyboard.isChange()) {
@@ -262,15 +676,43 @@ void loop() {

    if (now - lastLog > 10000) {
        lastLog = now;
-        Serial.printf("status: heap %u min %u\n", ESP.getFreeHeap(), ESP.getMinFreeHeap());
+        console.printf("status: heap %u min %u\n", ESP.getFreeHeap(), ESP.getMinFreeHeap());
+    }
+
+    // Firmware Update: its progress takes over the screen, then the device restarts when it's safe.
+    static int shownPercent = -1;
+    static uint32_t installedAt = 0;
+    static bool redrawAfterUpdate = false;
+    switch (update->phase()) {
+        case UpdateService::Phase::Receiving:
+            if (update->percent() != shownPercent) {
+                shownPercent = update->percent();
+                screen.renderUpdate("Firmware update", "Receiving " + update->incomingVersion(), shownPercent);
+            }
+            redrawAfterUpdate = true;
+            return;
+        case UpdateService::Phase::Installed:
+            if (!installedAt) installedAt = now;
+            // Don't pull the rug out from under someone typing, for up to a minute.
+            if (!apps->foreground().textEntryActive() || now - installedAt >= 60000) {
+                screen.renderUpdate("Restarting", "into " + update->incomingVersion(), -1);
+                delay(800);
+                ESP.restart();
+            }
+            break;
+        default:
+            shownPercent = -1;
+            break;
    }

    if (power->screen() == ScreenState::Off) return;
    StatusInfo status = currentStatus();
    const Toast* toast = notifier->toasts().current(now);
    bool toastChanged = notifier->toasts().takeChanged();
-    if (apps->takeRedraw() || toastChanged || status != lastStatus) {
+    if (apps->takeRedraw() || toastChanged || status != lastStatus || redrawAfterUpdate) {
        lastStatus = status;
+        redrawAfterUpdate = false;
        screen.render(*apps, status, toast);
+        update->firstFrameDrawn();
    }
 }
@@ -0,0 +1,86 @@
+#include "platform/console.h"
+
+#include <Arduino.h>
+
+#ifdef RORO_DEBUG
+#include <esp_log.h>
+#include <freertos/FreeRTOS.h>
+
+#include <algorithm>
+#include <cstdio>
+#endif
+
+namespace roro {
+
+Console console;
+
+#ifdef RORO_DEBUG
+namespace {
+
+// Any task may write (ESP-IDF logs come from everywhere), so the ring is behind a spinlock, held
+// only for the copy.
+portMUX_TYPE ringLock = portMUX_INITIALIZER_UNLOCKED;
+vprintf_like_t espLogNext = nullptr;
+
+int teeEspLog(const char* format, va_list args) {
+    char line[200];
+    va_list copy;
+    va_copy(copy, args);
+    int n = vsnprintf(line, sizeof line, format, copy);
+    va_end(copy);
+    if (n > 0) console.toRing(reinterpret_cast<const uint8_t*>(line), std::min<size_t>(n, sizeof line - 1));
+    return espLogNext ? espLogNext(format, args) : n;  // the serial port, as before
+}
+
+}  // namespace
+
+void Console::captureEspLogs() { espLogNext = esp_log_set_vprintf(teeEspLog); }
+
+void Console::toRing(const uint8_t* data, size_t len) {
+    if (len > kRingBytes) {
+        data += len - kRingBytes;  // only the tail can fit
+        len = kRingBytes;
+    }
+    portENTER_CRITICAL(&ringLock);
+    size_t at = head_ % kRingBytes;
+    size_t first = std::min(len, kRingBytes - at);
+    memcpy(ring_ + at, data, first);
+    memcpy(ring_, data + first, len - first);
+    head_ += len;
+    portEXIT_CRITICAL(&ringLock);
+}
+
+uint32_t Console::oldest() const {
+    portENTER_CRITICAL(&ringLock);
+    uint32_t pos = head_ > kRingBytes ? head_ - kRingBytes : 0;
+    portEXIT_CRITICAL(&ringLock);
+    return pos;
+}
+
+size_t Console::readSince(uint32_t& pos, uint8_t* out, size_t max, uint32_t& skipped) {
+    portENTER_CRITICAL(&ringLock);
+    uint32_t from = head_ > kRingBytes ? head_ - kRingBytes : 0;
+    skipped = pos < from ? from - pos : 0;
+    if (pos < from) pos = from;
+    size_t n = std::min<size_t>(max, head_ - pos);
+    size_t at = pos % kRingBytes;
+    size_t first = std::min(n, kRingBytes - at);
+    memcpy(out, ring_ + at, first);
+    memcpy(out + first, ring_, n - first);
+    pos += n;
+    portEXIT_CRITICAL(&ringLock);
+    return n;
+}
+#endif
+
+size_t Console::write(const uint8_t* data, size_t len) {
+#ifdef RORO_DEBUG
+    toRing(data, len);
+#endif
+    // Never wait for the USB host. One that's attached but not reading (a VM, a closed terminal)
+    // would stall the caller for up to 2 s per write while HWCDC retries; the ring keeps it anyway.
+    if (Serial.availableForWrite() >= static_cast<int>(len)) Serial.write(data, len);
+    return len;
+}
+
+}  // namespace roro
@@ -0,0 +1,40 @@
+#pragma once
+
+#include <Print.h>
+
+#include <cstddef>
+#include <cstdint>
+
+namespace roro {
+
+// Where the firmware's console output goes: the USB serial port, and in a Debug Build also a ring
+// buffer the Debug Console sends over Wi-Fi (with what came before the connection, so boot messages
+// aren't lost). Use `console` instead of Serial for anything a human should be able to read remotely.
+class Console : public Print {
+   public:
+    size_t write(uint8_t c) override { return write(&c, 1); }
+    size_t write(const uint8_t* data, size_t len) override;
+    using Print::write;
+
+#ifdef RORO_DEBUG
+    static constexpr size_t kRingBytes = 4096;
+
+    // Also copies ESP-IDF's own log lines into the ring (they still reach the serial port).
+    void captureEspLogs();
+    // Copies bytes written since `pos` into `out`, and advances `pos`. A reader that fell more than
+    // the ring behind gets the oldest bytes still there, and `skipped` says how many it missed.
+    size_t readSince(uint32_t& pos, uint8_t* out, size_t max, uint32_t& skipped);
+    // The position of the oldest byte still in the ring: a new reader starts there.
+    uint32_t oldest() const;
+    // The ring only, for output that already reaches the serial port another way.
+    void toRing(const uint8_t* data, size_t len);
+
+   private:
+    uint8_t ring_[kRingBytes];
+    uint32_t head_ = 0;  // total bytes ever written; the ring holds the last kRingBytes of them
+#endif
+};
+
+extern Console console;
+
+}  // namespace roro
@@ -0,0 +1,66 @@
+#include "platform/crash_report.h"
+
+#include <esp_core_dump.h>
+
+#include "platform/system_info.h"
+#include "safe_mode.h"
+#include "version.h"
+
+namespace roro::crash_report {
+
+int noteBoot(KeyValueStore& store) {
+    bool crashed = system_info::resetWasCrash();
+    std::string last;
+    store.getString("run_ver", last);
+    if (crashed) {
+        store.putString("crash_ver", last.empty() ? versionString() : last);
+        store.putString("crash_why", system_info::resetReason());
+    }
+    if (last != versionString()) store.putString("run_ver", versionString());
+
+    int32_t before = 0;
+    store.getInt("crash_boots", before);
+    int now = SafeMode::countAtBoot(crashed, before);
+    if (now != before) store.putInt("crash_boots", now);
+    return now;
+}
+
+void noteStable(KeyValueStore& store) {
+    int32_t n = 0;
+    if (store.getInt("crash_boots", n) && n != 0) store.putInt("crash_boots", 0);
+}
+
+void print(Print& out, KeyValueStore& store) {
+    std::string version, why;
+    store.getString("crash_ver", version);
+    store.getString("crash_why", why);
+    if (version.empty()) out.println("crash: none recorded");
+    else out.printf("crash: last one in %s (%s)\n", version.c_str(), why.c_str());
+
+    esp_core_dump_summary_t sum;
+    if (esp_core_dump_image_check() != ESP_OK || esp_core_dump_get_summary(&sum) != ESP_OK) {
+        out.println("crash: no core dump in flash");
+        return;
+    }
+    char reason[160] = "";
+    esp_core_dump_get_panic_reason(reason, sizeof reason);
+    out.printf("crash: task %s, pc 0x%08lx, cause %lu, address 0x%08lx\n", sum.exc_task, (unsigned long)sum.exc_pc,
+               (unsigned long)sum.ex_info.exc_cause, (unsigned long)sum.ex_info.exc_vaddr);
+    if (reason[0]) out.printf("crash: reason: %s\n", reason);
+    out.print("crash: backtrace");
+    for (uint32_t i = 0; i < sum.exc_bt_info.depth && i < 16; i++) out.printf(" 0x%08lx", (unsigned long)sum.exc_bt_info.bt[i]);
+    out.println(sum.exc_bt_info.corrupted ? " (corrupted)" : "");
+    out.printf("crash: elf sha256 %s\n", reinterpret_cast<const char*>(sum.app_elf_sha256));
+}
+
+std::string headline() {
+    esp_core_dump_summary_t sum;
+    std::string where = "";
+    if (esp_core_dump_image_check() == ESP_OK && esp_core_dump_get_summary(&sum) == ESP_OK)
+        where = std::string(" in ") + sum.exc_task;
+    return std::string("Restarted after a ") + system_info::resetReason() + where;
+}
+
+bool erase() { return esp_core_dump_image_erase() == ESP_OK; }
+
+}  // namespace roro::crash_report
@@ -0,0 +1,26 @@
+#pragma once
+
+#include <Print.h>
+
+#include <string>
+
+#include "key_value_store.h"
+
+namespace roro::crash_report {
+
+// First thing at boot: remembers which version runs, and after a crash restart, which version
+// crashed (the one that ran last time, even if a Rollback has switched slots since). Returns how
+// many starts in a row ended in a crash, for Safe Mode.
+int noteBoot(KeyValueStore& store);
+// The device has been up long enough: the crash streak is over.
+void noteStable(KeyValueStore& store);
+
+// The last crash: which firmware, why, and the task, PC and backtrace from the core dump in flash.
+// Decode the backtrace on the PC with scripts/decode_backtrace.sh <version> <addresses>.
+void print(Print& out, KeyValueStore& store);
+// One line for a Notification after a crash restart, e.g. "Restarted after a crash in loopTask".
+std::string headline();
+// Forgets the core dump, so the next crash's is the one kept.
+bool erase();
+
+}  // namespace roro::crash_report
@@ -0,0 +1,44 @@
+#include "ota_device.h"
+
+#include <cstring>
+
+#include "ota_public_key.h"
+
+namespace roro {
+
+EcdsaVerifier::EcdsaVerifier() {
+    mbedtls_pk_init(&key_);
+    // PEM parsing wants the terminating NUL counted in the length.
+    ready_ = mbedtls_pk_parse_public_key(&key_, reinterpret_cast<const unsigned char*>(kOtaPublicKeyPem),
+                                         std::strlen(kOtaPublicKeyPem) + 1) == 0;
+}
+
+EcdsaVerifier::~EcdsaVerifier() { mbedtls_pk_free(&key_); }
+
+bool EcdsaVerifier::verify(const uint8_t digest[32], const uint8_t* signature, size_t len) {
+    return ready_ && mbedtls_pk_verify(&key_, MBEDTLS_MD_SHA256, digest, 32, signature, len) == 0;
+}
+
+bool EspOtaSink::begin(size_t imageSize) {
+    if (!slot_) return false;
+    open_ = esp_ota_begin(slot_, imageSize, &handle_) == ESP_OK;
+    return open_;
+}
+
+bool EspOtaSink::write(const uint8_t* data, size_t len) {
+    return open_ && esp_ota_write(handle_, data, len) == ESP_OK;
+}
+
+bool EspOtaSink::finish() {
+    if (!open_) return false;
+    open_ = false;
+    // esp_ota_end() also validates the image structure (segments, checksum) for this chip.
+    return esp_ota_end(handle_) == ESP_OK && esp_ota_set_boot_partition(slot_) == ESP_OK;
+}
+
+void EspOtaSink::abort() {
+    if (open_) esp_ota_abort(handle_);
+    open_ = false;
+}
+
+}  // namespace roro
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <esp_ota_ops.h>
+#include <mbedtls/pk.h>
+
+#include "update_parser.h"
+
+namespace roro {
+
+// Checks Update File signatures against the public key compiled into the firmware (ADR 0003).
+class EcdsaVerifier : public SignatureVerifier {
+   public:
+    EcdsaVerifier();
+    ~EcdsaVerifier() override;
+    bool verify(const uint8_t digest[32], const uint8_t* signature, size_t len) override;
+
+   private:
+    mbedtls_pk_context key_;
+    bool ready_ = false;
+};
+
+// Writes the image to the app slot that isn't running, and makes it the next boot on finish().
+class EspOtaSink : public UpdateSink {
+   public:
+    EspOtaSink() : slot_(esp_ota_get_next_update_partition(nullptr)) {}
+    size_t capacity() const { return slot_ ? slot_->size : 0; }
+    bool begin(size_t imageSize) override;
+    bool write(const uint8_t* data, size_t len) override;
+    bool finish() override;
+    void abort() override;
+
+   private:
+    const esp_partition_t* slot_;
+    esp_ota_handle_t handle_ = 0;
+    bool open_ = false;
+};
+
+}  // namespace roro
@@ -0,0 +1,12 @@
+#pragma once
+
+// Public key that Firmware Updates must be signed for (ECDSA P-256). Generated by
+// scripts/ota_keygen.sh; the private key is not in this repository (ADR 0003).
+namespace roro {
+inline constexpr char kOtaPublicKeyPem[] =
+    "-----BEGIN PUBLIC KEY-----\n"
+    "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIWzT07fvTpQxWjTdewMipYH6f42+\n"
+    "mM8niHm+T8y+Mvjanb3H8hpYXg3VjuJGFtcHw/hFX0Q2f2AiSHMF0DhMbQ==\n"
+    "-----END PUBLIC KEY-----\n"
+    ;
+}  // namespace roro
@@ -14,4 +14,9 @@ constexpr int kSpiMosi = 14;
 constexpr int kSdCs = 12;
 constexpr int kLoraCs = 5;

+// The SX1262 on the Cap (as in Meshtastic's board file for the Cardputer ADV).
+constexpr int kLoraReset = 3;
+constexpr int kLoraIrq = 4;  // DIO1
+constexpr int kLoraBusy = 6;
+
 }  // namespace roro::pins
@@ -0,0 +1,118 @@
+#include "platform/system_info.h"
+
+#include <Arduino.h>
+#include <esp_heap_caps.h>
+#include <esp_ota_ops.h>
+#include <esp_system.h>
+#include <freertos/FreeRTOS.h>
+#include <freertos/task.h>
+
+#include <string>
+#include <vector>
+
+#include "version.h"
+
+namespace roro::system_info {
+
+const char* resetReason() {
+    switch (esp_reset_reason()) {
+        case ESP_RST_POWERON: return "power-on";
+        case ESP_RST_EXT: return "reset pin";
+        case ESP_RST_SW: return "restart";
+        case ESP_RST_PANIC: return "panic";
+        case ESP_RST_INT_WDT: return "interrupt watchdog";
+        case ESP_RST_TASK_WDT: return "task watchdog";
+        case ESP_RST_WDT: return "watchdog";
+        case ESP_RST_DEEPSLEEP: return "deep sleep";
+        case ESP_RST_BROWNOUT: return "brownout";
+        case ESP_RST_SDIO: return "sdio";
+        case ESP_RST_USB: return "usb";
+        case ESP_RST_JTAG: return "jtag";
+        default: return "unknown";
+    }
+}
+
+bool resetWasCrash() {
+    switch (esp_reset_reason()) {
+        case ESP_RST_PANIC:
+        case ESP_RST_INT_WDT:
+        case ESP_RST_TASK_WDT:
+        case ESP_RST_WDT: return true;
+        default: return false;
+    }
+}
+
+static const char* stateName(esp_ota_img_states_t s) {
+    switch (s) {
+        case ESP_OTA_IMG_NEW: return "new";
+        case ESP_OTA_IMG_PENDING_VERIFY: return "pending verify";
+        case ESP_OTA_IMG_VALID: return "valid";
+        case ESP_OTA_IMG_INVALID: return "invalid";
+        case ESP_OTA_IMG_ABORTED: return "aborted";
+        default: return "undefined";
+    }
+}
+
+void printSystem(Print& out) {
+    uint32_t s = millis() / 1000;
+    out.printf("firmware: %s %s\n", kProductName, versionString());
+    out.printf("uptime: %luh%02lum%02lus, last start: %s\n", (unsigned long)(s / 3600), (unsigned long)(s / 60 % 60),
+               (unsigned long)(s % 60), resetReason());
+    out.printf("heap: %u free, %u lowest, %u largest block\n", ESP.getFreeHeap(), ESP.getMinFreeHeap(),
+               (unsigned)heap_caps_get_largest_free_block(MALLOC_CAP_8BIT));
+    out.printf("chip: %s rev %d, %lu MHz, %.1f C\n", ESP.getChipModel(), ESP.getChipRevision(),
+               (unsigned long)ESP.getCpuFreqMHz(), temperatureRead());
+}
+
+static std::string slotKey(const esp_partition_t* slot) { return std::string("ver_") + slot->label; }
+
+void recordSlotVersion(KeyValueStore& store, const esp_partition_t* slot, const char* version) {
+    std::string known;
+    if (slot && !(store.getString(slotKey(slot).c_str(), known) && known == version))
+        store.putString(slotKey(slot).c_str(), version);
+}
+
+void printSlots(Print& out, KeyValueStore& store) {
+    const esp_partition_t* running = esp_ota_get_running_partition();
+    const esp_partition_t* next = esp_ota_get_boot_partition();
+    esp_partition_iterator_t it = esp_partition_find(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, nullptr);
+    for (; it; it = esp_partition_next(it)) {  // the last next() releases the iterator
+        const esp_partition_t* p = esp_partition_get(it);
+        esp_app_desc_t desc;
+        bool hasApp = esp_ota_get_partition_description(p, &desc) == ESP_OK;
+        std::string version = "(unknown version)";
+        store.getString(slotKey(p).c_str(), version);
+        esp_ota_img_states_t state;
+        bool hasState = esp_ota_get_state_partition(p, &state) == ESP_OK;
+        out.printf("slot %s: %s%s%s, %s\n", p->label, hasApp ? version.c_str() : "(empty)", p == running ? ", running" : "",
+                   p == next ? ", boots next" : "", hasState ? stateName(state) : "no OTA state");
+    }
+}
+
+void printTasks(Print& out) {
+    UBaseType_t n = uxTaskGetNumberOfTasks();
+    std::vector<TaskStatus_t> tasks(n + 4);
+    uint32_t total = 0;
+    n = uxTaskGetSystemState(tasks.data(), tasks.size(), &total);
+    out.printf("%-16s %-4s %3s %6s %5s %s\n", "task", "st", "pri", "stack", "cpu%", "core");
+    static const char kStates[] = "RrBSD";  // running, ready, blocked, suspended, deleted
+    for (UBaseType_t i = 0; i < n; i++) {
+        const TaskStatus_t& t = tasks[i];
+        unsigned cpu = total ? (unsigned)((uint64_t)t.ulRunTimeCounter * 100 / total) : 0;
+        int core = t.xCoreID == tskNO_AFFINITY ? -1 : (int)t.xCoreID;
+        out.printf("%-16s %-4c %3u %6u %5u %d\n", t.pcTaskName, t.eCurrentState < 5 ? kStates[t.eCurrentState] : '?',
+                   (unsigned)t.uxCurrentPriority, (unsigned)t.usStackHighWaterMark, cpu, core);
+    }
+}
+
+const char* bootOtherSlot() {
+    const esp_partition_t* other = esp_ota_get_next_update_partition(nullptr);
+    esp_app_desc_t desc;
+    if (!other || esp_ota_get_partition_description(other, &desc) != ESP_OK) return "the other slot is empty";
+    if (esp_ota_set_boot_partition(other) != ESP_OK) return "the other slot doesn't hold a valid image";
+    delay(200);
+    esp_restart();
+    return "";
+}
+
+}  // namespace roro::system_info
@@ -0,0 +1,29 @@
+#pragma once
+
+#include <Print.h>
+#include <esp_partition.h>
+
+#include "key_value_store.h"
+
+namespace roro::system_info {
+
+// Why the chip last started: "power-on", "panic", "task watchdog", "brownout"...
+const char* resetReason();
+// True if the last start was a crash or a watchdog, not a power-on or a deliberate restart.
+bool resetWasCrash();
+
+// Firmware, uptime and memory, one fact per line.
+void printSystem(Print& out);
+// Both app slots: which one runs, which boots next, and each one's version and OTA state. Versions
+// come from NVS ("ver_<slot>"): the prebuilt framework stamps every image with its own version.
+void printSlots(Print& out, KeyValueStore& store);
+// Remembers which version the running slot holds (call at boot), or the slot an update just wrote.
+void recordSlotVersion(KeyValueStore& store, const esp_partition_t* slot, const char* version);
+// FreeRTOS tasks: state, priority, lowest free stack, CPU share since boot.
+void printTasks(Print& out);
+
+// Boots the firmware in the other app slot if it holds a valid image (a manual Rollback).
+// Returns an error message; on success it restarts and doesn't return.
+const char* bootOtherSlot();
+
+}  // namespace roro::system_info
@@ -0,0 +1,305 @@
+#ifdef RORO_DEBUG
+
+#include "services/debug_console.h"
+
+#include <WiFi.h>
+
+#include <algorithm>
+#include <esp_core_dump.h>
+#include <esp_flash.h>
+
+#include <SD.h>
+#include <unistd.h>
+
+#include <atomic>
+#include <memory>
+
+#include "file_receiver.h"
+#include "sha256.h"
+#include "platform/console.h"
+#include "version.h"
+
+namespace roro {
+
+namespace {
+
+constexpr uint32_t kAuthTimeoutMs = 10000;
+constexpr size_t kMaxLine = 240;
+constexpr size_t kMaxQueued = 8;
+
+// Compares without stopping at the first difference, so timing says nothing about the token.
+bool sameToken(const std::string& a, const char* b) {
+    size_t n = strlen(b);
+    uint8_t diff = a.size() != n;
+    for (size_t i = 0; i < n; i++) diff |= (i < a.size() ? a[i] : 0) ^ b[i];
+    return diff == 0;
+}
+
+// Reads one line (without its \r\n) within `timeoutMs`; false on a timeout, a drop or an overlong line.
+bool readLine(NetworkClient& c, std::string& line, uint32_t timeoutMs) {
+    line.clear();
+    uint32_t since = millis();
+    while (c.connected() && millis() - since < timeoutMs) {
+        int ch = c.read();
+        if (ch < 0) {
+            delay(10);
+            continue;
+        }
+        if (ch == '\n') {
+            if (!line.empty() && line.back() == '\r') line.pop_back();
+            return true;
+        }
+        if (line.size() >= kMaxLine) return false;
+        line += static_cast<char>(ch);
+    }
+    return false;
+}
+
+// The raw core dump partition contents, as esp-coredump reads them ("-t raw").
+void sendCoreDump(NetworkClient& client) {
+    size_t addr = 0, size = 0;
+    if (esp_core_dump_image_check() != ESP_OK || esp_core_dump_image_get(&addr, &size) != ESP_OK) {
+        client.print("coredump: none\n");
+        return;
+    }
+    client.printf("coredump: data %u\n", (unsigned)size);
+    uint8_t buf[1024];
+    for (size_t off = 0; off < size;) {
+        size_t n = std::min(sizeof buf, size - off);
+        if (esp_flash_read(nullptr, buf, addr + off, n) != ESP_OK) break;  // the host sees a short file
+        if (client.write(buf, n) != n) return;
+        off += n;
+    }
+    client.print("coredump: end\n");
+}
+
+}  // namespace
+
+DebugConsole::DebugConsole(WifiService& wifi, StorageService& storage)
+    : wifi_(wifi), storage_(storage), lock_(xSemaphoreCreateMutex()) {}
+
+void DebugConsole::start() {
+    console.captureEspLogs();
+    if (!task_) xTaskCreate(taskEntry, "debug", 6144, this, 1, &task_);
+}
+
+bool DebugConsole::takeCommand(std::string& line) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    bool any = !commands_.empty();
+    if (any) {
+        line = std::move(commands_.front());
+        commands_.pop_front();
+    }
+    xSemaphoreGive(lock_);
+    return any;
+}
+
+void DebugConsole::taskEntry(void* self) { static_cast<DebugConsole*>(self)->listen(); }
+
+void DebugConsole::listen() {
+    NetworkServer server(kPort);
+    bool listening = false;
+    for (;;) {
+        bool up = wifi_.state() == WifiController::State::Connected;
+        if (up && !listening) {
+            server.begin();
+            listening = true;
+        } else if (!up && listening) {
+            server.end();
+            listening = false;
+        }
+        if (listening) {
+            NetworkClient client = server.accept();
+            if (client) {
+                client.setNoDelay(true);
+                if (authenticate(client)) serve(client);
+                client.stop();
+            }
+        }
+        vTaskDelay(pdMS_TO_TICKS(200));
+    }
+}
+
+bool DebugConsole::authenticate(NetworkClient& client) {
+    std::string token;
+    if (readLine(client, token, kAuthTimeoutMs) && sameToken(token, RORO_DEBUG_TOKEN)) return true;
+    console.printf("debug: refused a client from %s\n", client.remoteIP().toString().c_str());
+    delay(1000);  // no quick retries
+    client.print("denied\n");
+    return false;
+}
+
+void DebugConsole::serve(NetworkClient& client) {
+    console.printf("debug: client %s connected\n", client.remoteIP().toString().c_str());
+    client.printf("%s %s debug console. 'help' lists the commands. Backlog follows.\n", kProductName, versionString());
+    connected_ = true;
+    uint32_t pos = console.oldest();
+    uint8_t buf[512];
+    std::string line;
+    while (client.connected()) {
+        // Console output since last time, including the replies to this client's commands.
+        uint32_t skipped = 0;
+        size_t n;
+        while ((n = console.readSince(pos, buf, sizeof buf, skipped)) > 0) {
+            if (skipped) client.printf("\n[... %u bytes lost: the console ran faster than the network]\n", (unsigned)skipped);
+            if (client.write(buf, n) != n) break;
+        }
+        // Commands, one line at a time.
+        while (client.available()) {
+            int ch = client.read();
+            if (ch == '\r') continue;
+            if (ch != '\n') {
+                if (line.size() < kMaxLine) line += static_cast<char>(ch);
+                continue;
+            }
+            if (line == "quit" || line == "exit") {
+                client.stop();
+                break;
+            }
+            if (binaryCommand(client, line)) {
+                line.clear();
+                continue;
+            }
+            xSemaphoreTake(lock_, portMAX_DELAY);
+            bool full = commands_.size() >= kMaxQueued;
+            if (!full && !line.empty()) commands_.push_back(line);
+            xSemaphoreGive(lock_);
+            if (full) client.print("debug: busy, command dropped\n");
+            line.clear();
+        }
+        vTaskDelay(pdMS_TO_TICKS(20));
+    }
+    connected_ = false;
+    console.println("debug: client disconnected");
+}
+
+bool DebugConsole::binaryCommand(NetworkClient& client, const std::string& line) {
+    if (line == "reset") {  // works even when the main loop is stuck
+        client.print("debug: restarting now\n");
+        client.flush();
+        delay(200);
+        esp_restart();
+    }
+    if (line == "coredump get") sendCoreDump(client);
+    else if (line.rfind("get ", 0) == 0) get(client, line.substr(4));
+    else if (line.rfind("put ", 0) == 0) put(client, line.substr(4));
+    else if (line == "screenshot") screenshot(client);
+    else return false;
+    return true;
+}
+
+bool DebugConsole::onStorage(std::function<void()> job) { return storage_.runAndWait(std::move(job)); }
+
+void DebugConsole::get(NetworkClient& client, const std::string& path) {
+    bool ran = onStorage([&]() {
+        File f = SD.open(path.c_str());
+        if (!f || f.isDirectory()) return (void)client.printf("get: error cannot open %s\n", path.c_str());
+        size_t size = f.size();
+        client.printf("get: data %u\n", (unsigned)size);
+        uint8_t buf[1024];
+        for (size_t sent = 0; sent < size;) {
+            int n = f.read(buf, std::min(sizeof buf, size - sent));
+            if (n <= 0 || client.write(buf, n) != static_cast<size_t>(n)) break;  // the host sees it short
+            sent += n;
+        }
+        f.close();
+        client.print("get: end\n");
+    });
+    if (!ran) client.print("get: error no SD card\n");
+}
+
+// The same checks as `sd put` over serial (FileReceiver), but TCP does the flow control, so the
+// file is written in one job with the file kept open.
+void DebugConsole::put(NetworkClient& client, const std::string& args) {
+    FileReceiver r;
+    std::string error = r.begin(args, millis());
+    StorageState card = storage_.state();
+    if (error.empty() && !card.present) error = "no SD card";
+    if (error.empty() && card.totalBytes - card.usedBytes < r.size() + 64 * 1024) error = "not enough space";
+    if (!error.empty()) return (void)client.printf("put: error %s\n", error.c_str());
+
+    bool ran = onStorage([&]() {
+        std::string part = r.partPath();
+        for (size_t slash = part.find('/', 1); slash != std::string::npos; slash = part.find('/', slash + 1)) {
+            std::string dir = part.substr(0, slash);
+            if (!SD.exists(dir.c_str())) SD.mkdir(dir.c_str());
+        }
+        File f = SD.open(part.c_str(), FILE_WRITE);
+        if (!f) return (void)client.print("put: error card not writable\n");
+        client.printf("put: ready %u\n", (unsigned)r.size());
+        uint8_t buf[1024];
+        using S = FileReceiver::State;
+        while (r.state() == S::Receiving || r.state() == S::Writing) {
+            if (r.state() == S::Writing) {
+                const auto& c = r.chunk();
+                bool ok = f.write(c.data(), c.size()) == c.size();
+                // A card can fail one write and take the next. FATFS keeps a failed file in error,
+                // so: close, cut back to the last good byte, reopen, try again. Earlier chunks may
+                // have been lost with the write buffer (M3: 3 KB came back as zeros): never extend
+                // the file to cover them; give up instead, as the sender can't resend them.
+                for (int retry = 1; !ok && retry <= 3; retry++) {
+                    console.printf("put: write failed at %u, retry %d\n", (unsigned)r.received(), retry);
+                    f.close();
+                    delay(50 * retry);
+                    f = SD.open(part.c_str(), FILE_READ);
+                    size_t onCard = f ? f.size() : 0;
+                    if (f) f.close();
+                    if (onCard < r.received()) {
+                        console.printf("put: the card lost %u B written before\n", (unsigned)(r.received() - onCard));
+                        break;
+                    }
+                    truncate(("/sd" + part).c_str(), r.received());
+                    f = SD.open(part.c_str(), FILE_APPEND);
+                    ok = f && f.size() == r.received() && f.write(c.data(), c.size()) == c.size();
+                }
+                r.chunkWritten(ok, millis());
+                continue;
+            }
+            int n = client.read(buf, std::min(sizeof buf, r.wanted()));
+            if (n > 0) r.feed(buf, n, millis());
+            else if (!client.connected()) break;
+            else {
+                delay(2);
+                r.tick(millis());
+            }
+        }
+        f.close();
+        if (r.state() == S::Finishing) {  // read it back: the received checksum doesn't cover the card
+            Sha256 sha;
+            f = SD.open(part.c_str(), FILE_READ);
+            for (int n; f && (n = f.read(buf, sizeof buf)) > 0;) sha.update(buf, n);
+            if (f) f.close();
+            uint8_t digest[32];
+            sha.finish(digest);
+            r.cardChecked(digest);
+        }
+        if (r.state() == S::Finishing) {
+            if (SD.exists(r.path().c_str())) SD.remove(r.path().c_str());
+            r.finished(SD.rename(part.c_str(), r.path().c_str()));
+        }
+        if (r.state() == S::Done) client.printf("put: done %s %u B\n", r.path().c_str(), (unsigned)r.size());
+        else {
+            SD.remove(part.c_str());
+            client.printf("put: error %s\n", r.error().empty() ? "connection lost" : r.error().c_str());
+            // The rest of the file is still on its way: never read it as commands.
+            client.flush();
+            client.stop();
+        }
+    });
+    if (!ran) client.print("put: error no SD card\n");
+}
+
+// The frame as composed off-screen (RGB332, one byte a pixel). Read while the UI may be drawing,
+// so it can tear; it's for looking, not for pixel-exact tests.
+void DebugConsole::screenshot(NetworkClient& client) {
+    const uint8_t* pixels = frame_ ? static_cast<const uint8_t*>(frame_->getBuffer()) : nullptr;
+    if (!pixels) return (void)client.print("screenshot: error no frame\n");
+    int w = frame_->width(), h = frame_->height();
+    client.printf("screenshot: rgb332 %d %d\n", w, h);
+    for (int y = 0; y < h; y += 16) client.write(pixels + y * w, w * std::min(16, h - y));
+    client.print("screenshot: end\n");
+}
+
+}  // namespace roro
+
+#endif
@@ -0,0 +1,67 @@
+#pragma once
+
+#ifdef RORO_DEBUG
+
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+
+#include <deque>
+#include <functional>
+#include <string>
+
+#include "service.h"
+#include "services/storage_service.h"
+#include "services/wifi_service.h"
+#include "ui/canvas.h"
+
+class NetworkClient;
+
+namespace roro {
+
+// Debug Builds only (ADR 0004): the console over Wi-Fi, on TCP 2323 while Wi-Fi is Connected. A
+// client sends the debug token as its first line, then gets the recent console backlog, every new
+// console line, and runs the same commands as the serial port. One client at a time.
+//
+// The socket lives on this Service's own task; commands are handed to the main loop (takeCommand),
+// which runs them where touching Apps and Services is safe. Their output reaches the client
+// through the console ring like everything else.
+class DebugConsole : public Service {
+   public:
+    static constexpr uint16_t kPort = 2323;
+
+    DebugConsole(WifiService& wifi, StorageService& storage);
+    // The off-screen frame the UI composes into: `screenshot` sends it as it stands.
+    void setFrame(Canvas& frame) { frame_ = &frame; }
+    const char* name() const override { return "debug"; }
+    void start() override;
+
+    // The next command line a client sent, for the main loop to run.
+    bool takeCommand(std::string& line);
+    bool clientConnected() const { return connected_; }
+
+   private:
+    static void taskEntry(void* self);
+    void listen();
+    void serve(::NetworkClient& client);
+    bool authenticate(::NetworkClient& client);
+    // Binary commands, answered on this task: true if `line` was one.
+    bool binaryCommand(::NetworkClient& client, const std::string& line);
+    // Runs `job` on the storage task (where card access is safe) and waits for it. False if the
+    // card isn't mounted, in which case the storage task never runs it.
+    bool onStorage(std::function<void()> job);
+    void get(::NetworkClient& client, const std::string& path);
+    void put(::NetworkClient& client, const std::string& args);
+    void screenshot(::NetworkClient& client);
+
+    WifiService& wifi_;
+    StorageService& storage_;
+    Canvas* frame_ = nullptr;
+    TaskHandle_t task_ = nullptr;
+    SemaphoreHandle_t lock_;
+    std::deque<std::string> commands_;
+    volatile bool connected_ = false;
+};
+
+}  // namespace roro
+
+#endif
@@ -0,0 +1,803 @@
+#include "services/gemini_service.h"
+
+#include <NetworkClientSecure.h>
+#include <SD.h>
+#include <WiFi.h>
+#include <esp_heap_caps.h>
+
+#include <algorithm>
+#include <map>
+
+#include "gemini_url.h"
+#include "gemtext.h"
+#include "platform/console.h"
+#include "sha256.h"
+#include "storage_paths.h"
+
+namespace roro {
+
+using gemini::TextBuffer;
+
+namespace {
+
+constexpr uint32_t kIdleTimeoutMs = 15000;
+constexpr const char* kSavedRoot = "/gemini/saved";
+constexpr const char* kSavedMark = "> Saved from ";  // first line of a Saved Page (Q82)
+constexpr const char* kDefaults =
+    "## Start here\n"
+    "=> gemini://geminiprotocol.net/ Project Gemini\n"
+    "=> gemini://kennedy.gemi.dev/ Kennedy: search Geminispace\n"
+    "=> gemini://skyjake.fi/~Cosmos/ Cosmos: what's new on Geminispace\n"
+    "=> gemini://bbs.geminispace.org/ Bubble: a bulletin board\n";
+
+std::string hex(const uint8_t* data, size_t len) {
+    static const char* digits = "0123456789abcdef";
+    std::string out;
+    for (size_t i = 0; i < len; i++) {
+        out += digits[data[i] >> 4];
+        out += digits[data[i] & 15];
+    }
+    return out;
+}
+
+// Folders for a file path, one at a time (SD.mkdir makes one level).
+void makeParents(const std::string& path) {
+    for (size_t slash = path.find('/', 1); slash != std::string::npos; slash = path.find('/', slash + 1)) {
+        std::string dir = path.substr(0, slash);
+        if (!SD.exists(dir.c_str())) SD.mkdir(dir.c_str());
+    }
+}
+
+// Copies `from` to `to`, optionally after a first line. On the storage task.
+bool copyFile(const char* from, const std::string& to, const std::string& firstLine) {
+    File in = SD.open(from);
+    if (!in) return false;
+    makeParents(to);
+    File out = SD.open(to.c_str(), FILE_WRITE);
+    if (!out) return false;
+    bool ok = firstLine.empty() || out.print((firstLine + "\n").c_str()) > 0;
+    uint8_t buf[512];
+    int n;
+    while (ok && (n = in.read(buf, sizeof buf)) > 0) ok = out.write(buf, n) == static_cast<size_t>(n);
+    out.close();
+    in.close();
+    if (!ok) SD.remove(to.c_str());
+    return ok;
+}
+
+struct SavedEntry {
+    std::string path;  // /gemini/saved/host/…/name.gmi
+    time_t when;
+};
+
+void listSaved(const std::string& dir, std::vector<SavedEntry>& out) {
+    File d = SD.open(dir.c_str());
+    if (!d || !d.isDirectory()) return;
+    for (File f = d.openNextFile(); f && out.size() < 200; f = d.openNextFile()) {
+        std::string path = dir + "/" + f.name();
+        if (f.isDirectory()) listSaved(path, out);
+        else out.push_back({path, f.getLastWrite()});
+    }
+}
+
+}  // namespace
+
+const char* GeminiService::slotPath(int slot) {
+    static const char* const kPaths[] = {"/gemini/cache/page0.gmi", "/gemini/cache/page1.gmi", "/gemini/cache/work.gmi"};
+    return kPaths[slot];
+}
+
+const char* GeminiService::cacheOf(const std::string& url) const {
+    for (int s = 0; s < 3; s++)
+        if (!url.empty() && slotUrl_[s] == url) return slotPath(s);
+    return nullptr;
+}
+
+GeminiService::GeminiService(KeyValueStore& store, StorageService& storage, ClockService& clock, EventBus& bus)
+    : store_(store), storage_(storage), clock_(clock), bus_(bus), lock_(xSemaphoreCreateMutex()) {}
+
+// NVS keys are 15 characters at most: "gm" and 12 hex digits of SHA-256("host:port").
+std::string GeminiService::pinKey(const std::string& host, int port) const {
+    std::string id = host + ":" + std::to_string(port);
+    uint8_t digest[32];
+    Sha256::hash(reinterpret_cast<const uint8_t*>(id.data()), id.size(), digest);
+    return "gm" + hex(digest, 6);
+}
+
+void GeminiService::trust(const std::string& host, int port, const std::string& fingerprint) {
+    store_.putString(pinKey(host, port).c_str(), fingerprint);
+}
+
+std::string GeminiService::now() const {
+    int64_t t = clock_.utcNow();
+    return t < 0 ? "an unknown date" : ClockModel::formatLocalDate(t) + " " + ClockModel::formatLocalTime(t);
+}
+
+void GeminiService::notify(const std::string& text) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(NotificationLevel::Info)));
+}
+
+bool GeminiService::start(Job job) {
+    if (busy_) return false;
+    busy_ = true;
+    ready_ = messageReady_ = cancel_ = false;
+    job_ = job;
+    if (xTaskCreate(taskEntry, "gemini", 6144, this, 1, nullptr) != pdPASS) {  // peak 3.6 KB (step 1)
+        busy_ = false;
+        return false;
+    }
+    return true;
+}
+
+bool GeminiService::fetch(const std::string& url, bool preferSaved) {
+    if (busy_) return false;
+    arg_ = url;
+    preferSaved_ = preferSaved;
+    return start(Job::Fetch);
+}
+
+bool GeminiService::fetchToConsole(const std::string& url) {
+    if (busy_) return false;
+    toConsole_ = true;
+    if (!fetch(url)) {
+        toConsole_ = false;
+        return false;
+    }
+    return true;
+}
+
+bool GeminiService::save(const std::string& url) {
+    if (busy_) return false;
+    arg_ = url;
+    return start(Job::Save);
+}
+
+bool GeminiService::saveWithLinks(const std::string& url, std::vector<std::string> links) {
+    if (busy_) return false;
+    arg_ = url;
+    links_ = std::move(links);
+    return start(Job::SaveWithLinks);
+}
+
+bool GeminiService::refresh(const std::string& savedPath) {
+    if (busy_) return false;
+    arg_ = savedPath;
+    return start(Job::Refresh);
+}
+
+bool GeminiService::deleteSaved(const std::string& savedPath) {
+    if (busy_) return false;
+    arg_ = savedPath;
+    return start(Job::Delete);
+}
+
+bool GeminiService::addBookmark(const std::string& url, const std::string& title) {
+    if (busy_) return false;
+    arg_ = url;
+    arg2_ = title;
+    return start(Job::Bookmark);
+}
+
+bool GeminiService::download(const std::string& url) {
+    if (busy_) return false;
+    arg_ = url;
+    return start(Job::Download);
+}
+
+bool GeminiService::loadWindow(const GeminiPage& page, size_t firstLine) {
+    if (busy_ || page.backing.empty()) return false;
+    windowPage_ = GeminiPage();
+    windowPage_.backing = page.backing;
+    windowPage_.totalLines = page.totalLines;
+    windowPage_.lineIndex = page.lineIndex;
+    windowLine_ = firstLine;
+    // The App drops its current window once the new one is in: count that memory as coming back.
+    windowReleasing_ = page.text.bytes() + page.text.lineCount() * kBytesPerLine;
+    return start(Job::Window);
+}
+
+bool GeminiService::takeResult(GeminiPage& out) {
+    if (!ready_) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    out = std::move(result_);
+    result_ = GeminiPage();
+    ready_ = false;
+    xSemaphoreGive(lock_);
+    return true;
+}
+
+bool GeminiService::takeMessage(std::string& out) {
+    if (!messageReady_) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    out = std::move(message_);
+    messageReady_ = false;
+    xSemaphoreGive(lock_);
+    return true;
+}
+
+void GeminiService::finishWithMessage(const std::string& text) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    message_ = text;
+    messageReady_ = true;
+    xSemaphoreGive(lock_);
+}
+
+void GeminiService::taskEntry(void* self) {
+    static_cast<GeminiService*>(self)->run();
+    vTaskDelete(nullptr);
+}
+
+void GeminiService::run() {
+    switch (job_) {
+        case Job::Fetch: {
+            GeminiPage page;
+            runFetch(page);
+            if (!toConsole_) {
+                xSemaphoreTake(lock_, portMAX_DELAY);
+                result_ = std::move(page);
+                ready_ = true;
+                xSemaphoreGive(lock_);
+            }
+            toConsole_ = false;
+            break;
+        }
+        case Job::Save: {
+            std::string why = saveCached(arg_);
+            finishWithMessage(!why.empty() ? why : replaced_ ? "Saved again (replaced the older copy)" : "Saved for offline reading");
+            break;
+        }
+        case Job::SaveWithLinks: {
+            std::string why = saveCached(arg_);
+            if (!why.empty()) {
+                finishWithMessage(why);
+                break;
+            }
+            int saved = 1, failed = 0, total = static_cast<int>(links_.size()) + 1;
+            notify("Saving " + std::to_string(total) + " pages for offline reading");
+            for (const std::string& link : links_) {
+                if (cancel_) break;
+                GeminiPage page;
+                fetchFollowing(link, page, false, kWorkSlot);
+                bool text = page.outcome == GeminiPage::Outcome::Ok &&
+                            page.header.category() == gemini::Category::Success && page.header.mimeType() == "text/gemini";
+                if (text && saveCached(link).empty()) saved++;
+                else failed++;
+                if ((saved + failed) % 5 == 0) notify("Saved " + std::to_string(saved) + " of " + std::to_string(total));
+            }
+            std::string done = "Saved " + std::to_string(saved) + " of " + std::to_string(total) + " pages" +
+                               (failed ? " (" + std::to_string(failed) + " not gemtext or failed)" : "");
+            notify(done);
+            finishWithMessage(done);
+            break;
+        }
+        case Job::Refresh: {
+            // Only the first line: where it came from. (Loading the whole page here, next to the
+            // App's copy and a TLS connection, once took the heap down to 436 bytes.)
+            std::string from = savedFrom(arg_);
+            if (from.empty()) {
+                finishWithMessage("Not a Saved Page");
+                break;
+            }
+            GeminiPage page;
+            fetchFollowing(from, page, false, kWorkSlot);
+            std::string why = page.outcome != GeminiPage::Outcome::Ok ? page.error
+                              : page.header.category() != gemini::Category::Success ? page.header.meta
+                                                                                     : saveCached(from);
+            finishWithMessage(why.empty() ? "Refreshed" : "Not refreshed: " + why);
+            break;
+        }
+        case Job::Window: {
+            // Q86 both ways: old and new together above the transient floor for a moment, and the
+            // new one alone (once the old is dropped) leaving the steady floor.
+            size_t free = esp_get_free_heap_size();
+            size_t transient = free > kTransientFloor + TextBuffer::kChunk ? free - kTransientFloor - TextBuffer::kChunk : 0;
+            size_t steady = free + windowReleasing_ > kSteadyFloor + TextBuffer::kChunk
+                                ? free + windowReleasing_ - kSteadyFloor - TextBuffer::kChunk
+                                : 0;
+            size_t budget = std::min(transient, steady);
+            GeminiPage page = std::move(windowPage_);
+            page.windowStart = windowLine_ - windowLine_ % kIndexEvery;
+            page.windowed = true;
+            page.windowOf = page.backing;
+            page.outcome = GeminiPage::Outcome::Ok;
+            readWindow(page, page.windowStart, std::min(budget, kMaxBody));
+            console.printf("gemini: window from line %u: %u lines\n", (unsigned)page.windowStart,
+                           (unsigned)page.text.lineCount());
+            xSemaphoreTake(lock_, portMAX_DELAY);
+            result_ = std::move(page);
+            ready_ = true;
+            xSemaphoreGive(lock_);
+            break;
+        }
+        case Job::Delete: {
+            bool removed = false;
+            bool ran = storage_.runAndWait([&]() { removed = SD.remove(arg_.c_str()); });
+            finishWithMessage(!ran ? "No SD card" : removed ? "Deleted" : "Not deleted");
+            break;
+        }
+        case Job::Bookmark: {
+            std::string line = "=> " + arg_ + (arg2_.empty() ? "" : " " + arg2_), already;
+            bool ran = storage_.runAndWait([&]() {
+                File f = SD.open(kBookmarks);
+                while (f && f.available()) {
+                    String l = f.readStringUntil('\n');
+                    if (l.startsWith(("=> " + arg_ + " ").c_str()) || l == ("=> " + arg_).c_str()) already = "yes";
+                }
+                if (f) f.close();
+                if (!already.empty()) return;
+                makeParents(kBookmarks);
+                File out = SD.open(kBookmarks, FILE_APPEND);
+                if (out) {
+                    out.print((line + "\n").c_str());
+                    out.close();
+                }
+            });
+            finishWithMessage(!ran ? "No SD card" : !already.empty() ? "Already bookmarked" : "Bookmarked");
+            break;
+        }
+        case Job::Download: {
+            gemini::Url u;
+            std::string name = gemini::parseUrl(arg_, u) ? u.path.substr(u.path.rfind('/') + 1) : "";
+            if (name.empty()) name = "download";
+            std::string to = "/gemini/downloads/" + storage::sanitize(name);
+            bool copied = false;
+            if (const char* from = cacheOf(arg_)) storage_.runAndWait([&]() { copied = copyFile(from, to, ""); });
+            finishWithMessage(copied ? "Saved to " + to : "Not saved (no card, or the page is gone)");
+            break;
+        }
+    }
+    busy_ = false;
+}
+
+void GeminiService::runFetch(GeminiPage& page) {
+    page.requested = arg_;
+    size_t before = esp_get_free_heap_size();
+    lowest_ = before;
+    uint32_t started = millis();
+    const std::string& url = arg_;
+    if (url == kStartUrl) composeStart(page);
+    else if (url.rfind("file://", 0) == 0) openSaved(url.substr(7), page);
+    else {
+        // Inside a Saved Page, a link to another Saved Page opens the saved copy (Q84).
+        bool savedCopy = false;
+        if (preferSaved_) {
+            std::string path = gemini::savedPath(url);
+            storage_.runAndWait([&]() { savedCopy = SD.exists(path.c_str()); });
+            if (savedCopy) openSaved(path, page);
+        }
+        if (!savedCopy) {
+            if (preferSaved_ && !WiFi.isConnected()) {
+                page.url = url;
+                page.error = "Not saved, and offline";
+            } else
+            {
+                int slot = nextDisplay_;
+                fetchFollowing(url, page, true, slot);
+                if (page.outcome == GeminiPage::Outcome::Ok && !page.cachePath.empty())
+                    nextDisplay_ = 1 - slot;  // keep this one: it backs the page on screen
+            }
+        }
+    }
+    page.ms = millis() - started;
+    if (toConsole_) report(page, before, lowest_);
+}
+
+// One request, following up to kMaxRedirects redirects.
+void GeminiService::fetchFollowing(const std::string& first, GeminiPage& page, bool loadIntoRam, int slot) {
+    std::string url = first;
+    size_t free = esp_get_free_heap_size();
+    if (free < kStartFloor) {  // Q86, for every fetch: pages, saves, refreshes
+        page.url = url;
+        page.outcome = GeminiPage::Outcome::Failed;
+        page.error = "Not enough memory (" + std::to_string(free / 1024) + " KB free): stop IRC or retry";
+        return;
+    }
+    for (int hop = 0;; hop++) {
+        fetchOne(url, page, loadIntoRam, slot);
+        if (page.outcome != GeminiPage::Outcome::Ok || page.header.category() != gemini::Category::Redirect) break;
+        std::string next = gemini::resolve(url, page.header.meta);
+        if (!gemini::isGemini(next)) {
+            page.outcome = GeminiPage::Outcome::Failed;
+            page.error = "Redirect to another protocol: " + next;
+            break;
+        }
+        if (hop + 1 > kMaxRedirects) {
+            page.outcome = GeminiPage::Outcome::Failed;
+            page.error = "Too many redirects";
+            break;
+        }
+        url = next;
+    }
+    page.url = url;
+}
+
+// A Saved Page's first line: "> Saved from <url> on <date>" (Q82). Empty if it isn't one.
+std::string GeminiService::savedFirstLine(const std::string& path) {
+    std::string first;
+    storage_.runAndWait([&]() {
+        File f = SD.open(path.c_str());
+        if (!f) return;
+        char buf[600];
+        size_t n = f.readBytesUntil('\n', buf, sizeof buf - 1);
+        buf[n] = 0;
+        first = buf;
+        f.close();
+    });
+    if (!first.empty() && first.back() == '\r') first.pop_back();
+    return first.rfind(kSavedMark, 0) == 0 ? first : "";
+}
+
+std::string GeminiService::savedFrom(const std::string& path) {
+    std::string first = savedFirstLine(path);
+    if (first.empty()) return "";
+    std::string rest = first.substr(strlen(kSavedMark));
+    return rest.substr(0, rest.find(" on "));
+}
+
+// A Saved Page from the card, as far as memory allows; its first line says where it came from.
+void GeminiService::openSaved(const std::string& path, GeminiPage& page) {
+    page.url = "file://" + path;
+    page.header.status = 20;
+    page.header.meta = "text/gemini";
+    bool found = false;
+    storage_.runAndWait([&]() { found = SD.exists(path.c_str()); });
+    std::string first = found ? savedFirstLine(path) : "";
+    if (!found) {
+        page.error = "This Saved Page is gone";
+        return;
+    }
+    if (first.rfind(kSavedMark, 0) == 0) {
+        std::string rest = first.substr(strlen(kSavedMark));
+        size_t on = rest.find(" on ");
+        page.savedFrom = rest.substr(0, on);
+        page.savedOn = on == std::string::npos ? "" : rest.substr(on + 4);
+    }
+    loadFromCard(page, esp_get_free_heap_size(), path);
+    page.outcome = GeminiPage::Outcome::Ok;
+}
+
+// about:start (Q78, Q84): bookmarks, then Saved Pages by capsule, newest first, then defaults.
+void GeminiService::composeStart(GeminiPage& page) {
+    std::string doc = "# Gemini\nTab picks a link, Enter follows it, Back returns, g types an address. "
+                      "On a page: b bookmarks it, s saves it to read offline, S with the pages it links to.\n";
+    std::string bookmarks;
+    std::vector<SavedEntry> saved;
+    bool card = storage_.runAndWait([&]() {
+        File f = SD.open(kBookmarks);
+        while (f && f.available() && bookmarks.size() < 8192) {
+            String l = f.readStringUntil('\n');
+            if (l.startsWith("=>")) bookmarks += std::string(l.c_str()) + "\n";
+        }
+        if (f) f.close();
+        listSaved(kSavedRoot, saved);
+    });
+    doc += "## Bookmarks\n";
+    doc += !card ? "No SD card: bookmarks and Saved Pages live on it.\n"
+           : bookmarks.empty() ? "None yet: b on a page adds it here.\n" : bookmarks;
+    if (!saved.empty()) {
+        // Capsules ordered by their newest Saved Page, pages newest first within each.
+        std::sort(saved.begin(), saved.end(), [](const SavedEntry& a, const SavedEntry& b) { return a.when > b.when; });
+        std::vector<std::string> order;
+        std::map<std::string, std::string> byHost;
+        size_t root = strlen(kSavedRoot) + 1;
+        for (auto& e : saved) {
+            std::string rel = e.path.substr(root);
+            std::string host = rel.substr(0, rel.find('/'));
+            if (!byHost.count(host)) order.push_back(host);
+            std::string label = rel.substr(host.size() + 1);
+            if (label.size() > 4 && label.compare(label.size() - 4, 4, ".gmi") == 0) label.resize(label.size() - 4);
+            char day[24] = "";
+            if (e.when > 1000000000) {
+                struct tm t;
+                localtime_r(&e.when, &t);
+                strftime(day, sizeof day, " (%d %b)", &t);
+            }
+            byHost[host] += "=> file://" + e.path + " " + label + day + "\n";
+        }
+        doc += "## Saved pages\n";
+        for (auto& host : order) doc += "### " + host + "\n" + byHost[host];
+    }
+    doc += kDefaults;
+    page.url = kStartUrl;
+    page.header.status = 20;
+    page.header.meta = "text/gemini";
+    page.text.append(doc.data(), doc.size());
+    page.text.finish();
+    page.outcome = GeminiPage::Outcome::Ok;
+}
+
+// The cached body of `url` (fetched again if the cache holds something else) to its Saved Page.
+std::string GeminiService::saveCached(const std::string& url) {
+    if (!gemini::isGemini(url)) return "Only Gemini pages can be saved";
+    if (!storage_.state().present) return "No SD card";
+    const char* from = cacheOf(url);
+    if (!from) {
+        GeminiPage page;
+        fetchFollowing(url, page, false, kWorkSlot);
+        if (page.outcome != GeminiPage::Outcome::Ok) return page.error;
+        if (page.header.category() != gemini::Category::Success) return page.header.meta;
+        from = cacheOf(page.url);
+        if (!from) return "Not saved";
+    }
+    std::string to = gemini::savedPath(url);
+    bool existed = false, ok = false;
+    replaced_ = false;
+    std::string header = std::string(kSavedMark) + url + " on " + now();
+    storage_.runAndWait([&]() {
+        existed = SD.exists(to.c_str());
+        ok = copyFile(from, to, header);
+    });
+    if (!ok) return "Writing to the SD card failed";
+    replaced_ = existed;  // Q82: saving again replaces it, and says so
+    return "";
+}
+
+void GeminiService::fetchOne(const std::string& url, GeminiPage& page, bool loadIntoRam, int slot) {
+    page.outcome = GeminiPage::Outcome::Failed;
+    page.text.clear();
+    page.truncated = false;
+    gemini::Url u;
+    if (!gemini::parseUrl(url, u) || u.scheme != "gemini") {
+        page.error = "Not a Gemini URL: " + url;
+        return;
+    }
+    auto track = [this]() { lowest_ = std::min<size_t>(lowest_, esp_get_free_heap_size()); };
+
+    size_t freeBefore = esp_get_free_heap_size();  // what's left once the connection closes again
+    NetworkClientSecure tls;
+    tls.setInsecure();  // trust on first use: the pinned fingerprint is what counts (Q71)
+    tls.setTimeout(15);
+    if (!tls.connect(u.host.c_str(), u.portOrDefault())) {
+        page.error = "Cannot connect to " + u.host;
+        return;
+    }
+    track();
+    uint8_t sha[32];
+    if (!tls.getFingerprintSHA256(sha)) {
+        page.error = "No certificate from " + u.host;
+        return;
+    }
+    std::string presented = hex(sha, sizeof sha), pinned;
+    std::string key = pinKey(u.host, u.portOrDefault());
+    if (!store_.getString(key.c_str(), pinned)) store_.putString(key.c_str(), presented);  // first use
+    else if (pinned != presented) {
+        page.outcome = GeminiPage::Outcome::CertificateChanged;
+        page.host = u.host;
+        page.port = u.portOrDefault();
+        page.pinned = pinned;
+        page.presented = presented;
+        page.error = "The certificate of " + u.host + " changed";
+        return;
+    }
+
+    tls.print((gemini::requestUrl(url) + "\r\n").c_str());
+    std::string header;
+    bool inBody = false;
+    uint32_t last = millis();
+    char buf[512];
+    while (!cancel_) {
+        int n = tls.available() ? tls.read(reinterpret_cast<uint8_t*>(buf), sizeof buf) : 0;
+        if (n <= 0) {
+            if (!tls.connected()) break;
+            if (millis() - last > kIdleTimeoutMs) {
+                page.error = "Timed out";
+                return;
+            }
+            delay(5);
+            continue;
+        }
+        last = millis();
+        int i = 0;
+        while (!inBody && i < n) {
+            char c = buf[i++];
+            if (c == '\n') inBody = true;
+            else if (c != '\r') header += c;
+            if (header.size() > 1100) {
+                page.error = "Malformed response header";
+                return;
+            }
+        }
+        if (!inBody) continue;
+        if (!gemini::parseHeader(header, page.header)) {
+            page.error = "Malformed response header";
+            return;
+        }
+        if (page.header.category() != gemini::Category::Success) break;  // no body to read
+        // With a card, the body goes there while the connection is open (only 4 KB in RAM),
+        // and comes back into RAM once the connection's memory is free again.
+        if (storage_.state().present) {
+            slotUrl_[slot].clear();
+            if (!receiveToCard(tls, buf + i, n - i, page, slot)) return;
+            tls.stop();
+            slotUrl_[slot] = url;
+            if (loadIntoRam) loadFromCard(page, freeBefore, slotPath(slot));
+            page.outcome = GeminiPage::Outcome::Ok;
+            return;
+        }
+        // Q86, two floors: once the connection closes, its ~50 KB comes back, so the page may use
+        // what was free before minus the steady floor; meanwhile the heap must stay above the
+        // transient floor. Both counted with the next 4 KB chunk and the line index.
+        size_t take = std::min<size_t>(n - i, kMaxBody - page.text.bytes());
+        size_t pageCost = page.text.bytes() + page.text.lineCount() * kBytesPerLine + TextBuffer::kChunk + take;
+        if (take < static_cast<size_t>(n - i)) page.truncatedWhy = "longer than 64 KB";
+        else if (freeBefore < kSteadyFloor + pageCost) page.truncatedWhy = "not enough memory to keep it";
+        else if (esp_get_free_heap_size() < kTransientFloor + TextBuffer::kChunk + take)
+            page.truncatedWhy = "not enough memory while receiving";
+        if (!page.truncatedWhy.empty()) {
+            page.truncated = true;
+            break;
+        }
+        page.text.append(buf + i, take);
+        track();
+    }
+    if (cancel_) {
+        page.error = "Cancelled";
+        return;
+    }
+    if (!inBody && !gemini::parseHeader(header, page.header)) {  // a header with no line end
+        page.error = header.empty() ? "Empty response" : "Malformed response header";
+        return;
+    }
+    page.text.finish();
+    page.outcome = GeminiPage::Outcome::Ok;
+}
+
+// Streams the rest of the body to a cache file in 1 KB pieces, each written by the storage task:
+// with IRC's TLS connection and this one both open, every KB of RAM counts (Q86).
+
+bool GeminiService::receiveToCard(NetworkClientSecure& tls, const char* first, size_t len, GeminiPage& page, int slot) {
+    struct Cache {
+        File file;
+    };
+    auto cache = std::make_shared<Cache>();
+    bool opened = storage_.runAndWait([cache, slot]() {
+        SD.mkdir("/gemini");
+        SD.mkdir("/gemini/cache");
+        cache->file = SD.open(slotPath(slot), FILE_WRITE);
+    });
+    if (!opened || !cache->file) {
+        page.error = "Can't write to the SD card";
+        return false;
+    }
+    std::string pending(first, len);
+    constexpr size_t kPiece = 1024;
+    pending.reserve(kPiece + 512);
+    bool ok = true;
+    auto flush = [&]() {
+        if (pending.empty() || !ok) return;
+        ok = storage_.runAndWait([cache, &pending, &ok]() {
+            ok = cache->file.write(reinterpret_cast<const uint8_t*>(pending.data()), pending.size()) == pending.size();
+        }) && ok;
+        page.receivedBytes += pending.size();
+        pending.clear();
+    };
+    uint32_t last = millis();
+    char buf[512];
+    while (!cancel_ && ok) {
+        if (pending.size() >= kPiece) flush();
+        if (page.receivedBytes + pending.size() >= kMaxOnCard) {
+            page.truncated = true;
+            page.truncatedWhy = "longer than 1 MB";
+            break;
+        }
+        int n = tls.available() ? tls.read(reinterpret_cast<uint8_t*>(buf), sizeof buf) : 0;
+        if (n <= 0) {
+            if (!tls.connected()) break;
+            if (millis() - last > kIdleTimeoutMs) break;  // keep what came
+            delay(5);
+            continue;
+        }
+        last = millis();
+        pending.append(buf, n);
+        lowest_ = std::min<size_t>(lowest_, esp_get_free_heap_size());
+    }
+    flush();
+    storage_.runAndWait([cache]() { cache->file.close(); });
+    if (cancel_) page.error = "Cancelled";
+    else if (!ok) page.error = "Writing to the SD card failed";
+    else page.cachePath = slotPath(slot);
+    return !cancel_ && ok;
+}
+
+// Back into RAM, now that the connection's memory is free again: one pass over the file counts
+// its lines and indexes every kIndexEvery-th, and loads lines while the steady floor allows (Q86).
+// If they don't all fit, the page is windowed: the App asks for other windows as you scroll.
+void GeminiService::loadFromCard(GeminiPage& page, size_t freeBefore, const std::string& path) {
+    size_t budget = freeBefore > kSteadyFloor + TextBuffer::kChunk ? freeBefore - kSteadyFloor - TextBuffer::kChunk : 0;
+    budget = std::min(budget, kMaxBody);
+    page.backing = path;
+    page.lineIndex.clear();
+    page.totalLines = 0;
+    page.windowStart = 0;
+    bool loading = true;
+    storage_.runAndWait([&]() {
+        File f = SD.open(path.c_str());
+        if (!f) return;
+        std::string line;
+        uint32_t offset = 0, lineStart = 0;
+        bool pre = false;
+        auto endLine = [&]() {
+            if (page.totalLines % kIndexEvery == 0) page.lineIndex.push_back(lineStart | (pre ? 0x80000000u : 0));
+            if (line.compare(0, 3, "```") == 0) pre = !pre;
+            if (loading) {
+                if (page.text.bytes() + page.text.lineCount() * kBytesPerLine + line.size() + 1 > budget) loading = false;
+                else {
+                    line += '\n';
+                    page.text.append(line.data(), line.size());
+                }
+            }
+            page.totalLines++;
+            line.clear();
+        };
+        char buf[512];
+        int n;
+        while ((n = f.read(reinterpret_cast<uint8_t*>(buf), sizeof buf)) > 0) {
+            for (int i = 0; i < n; i++, offset++) {
+                if (buf[i] == '\n') {
+                    endLine();
+                    lineStart = offset + 1;
+                } else if (line.size() < kMaxLineBytes) line += buf[i];
+            }
+        }
+        if (!line.empty()) endLine();
+        f.close();
+    });
+    page.text.finish();
+    page.windowed = !loading;
+    if (page.windowed)
+        console.printf("gemini: %s is windowed: %u of %u lines in memory\n", path.c_str(),
+                       (unsigned)page.text.lineCount(), (unsigned)page.totalLines);
+}
+
+// Lines from `firstLine` on, from the page's file, as many as `budget` allows.
+void GeminiService::readWindow(GeminiPage& page, size_t firstLine, size_t budget) {
+    size_t entry = firstLine / kIndexEvery;
+    if (entry >= page.lineIndex.size()) return;
+    storage_.runAndWait([&]() {
+        File f = SD.open(page.backing.c_str());
+        if (!f || !f.seek(page.lineIndex[entry] & 0x7FFFFFFFu)) return;
+        size_t lineNo = entry * kIndexEvery;
+        std::string line;
+        char buf[512];
+        int n;
+        bool done = false;
+        while (!done && (n = f.read(reinterpret_cast<uint8_t*>(buf), sizeof buf)) > 0) {
+            for (int i = 0; i < n && !done; i++) {
+                if (buf[i] != '\n') {
+                    if (line.size() < kMaxLineBytes) line += buf[i];
+                    continue;
+                }
+                if (lineNo >= firstLine) {
+                    if (page.text.bytes() + page.text.lineCount() * kBytesPerLine + line.size() + 1 > budget) done = true;
+                    else {
+                        line += '\n';
+                        page.text.append(line.data(), line.size());
+                    }
+                }
+                lineNo++;
+                line.clear();
+            }
+        }
+        if (!done && !line.empty() && lineNo >= firstLine) page.text.append(line.data(), line.size());
+        f.close();
+    });
+    page.text.finish();
+}
+
+void GeminiService::report(const GeminiPage& page, size_t heapBefore, size_t heapLowest) {
+    console.printf("gemini: %s -> %s, %lu ms\n", page.requested.c_str(), page.url.c_str(), (unsigned long)page.ms);
+    if (page.outcome != GeminiPage::Outcome::Ok) console.printf("gemini: %s\n", page.error.c_str());
+    else console.printf("gemini: %d %s, %u bytes, %u lines%s\n", page.header.status, page.header.meta.c_str(),
+                        (unsigned)page.text.bytes(), (unsigned)page.text.lineCount(),
+                        page.truncated ? (" (truncated: " + page.truncatedWhy + ")").c_str() : "");
+    if (page.outcome == GeminiPage::Outcome::CertificateChanged)
+        console.printf("gemini: pinned %s\ngemini: now    %s\n", page.pinned.c_str(), page.presented.c_str());
+    for (size_t i = 0; i < page.text.lineCount() && i < 6; i++) console.printf("  %s\n", page.text.line(i).substr(0, 100).c_str());
+    if (!page.cachePath.empty())
+        console.printf("gemini: %u bytes on the card in %s\n", (unsigned)page.receivedBytes, page.cachePath.c_str());
+    console.printf("gemini: heap %u before, %u lowest seen, %u after\n", (unsigned)heapBefore, (unsigned)heapLowest,
+                   (unsigned)esp_get_free_heap_size());
+}
+
+
+}  // namespace roro
@@ -0,0 +1,147 @@
+#pragma once
+
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+
+#include <string>
+#include <vector>
+
+#include "event_bus.h"
+#include "gemini_response.h"
+#include "key_value_store.h"
+#include "services/clock_service.h"
+#include "services/storage_service.h"
+#include "text_buffer.h"
+
+class NetworkClientSecure;
+
+namespace roro {
+
+// What a fetch came back with.
+struct GeminiPage {
+    enum class Outcome { Ok, Failed, CertificateChanged };
+    Outcome outcome = Outcome::Failed;
+    std::string requested;    // what was asked for
+    std::string url;          // where it ended up, after redirects (file://… for a Saved Page)
+    gemini::Header header;    // the final response's header
+    gemini::TextBuffer text;  // 2x only: the body as lines, up to kMaxBody
+    bool truncated = false;   // the body was cut: see truncatedWhy
+    std::string truncatedWhy;
+    std::string error;        // Failed: why, for a human
+    std::string host;         // CertificateChanged: whose, and both fingerprints
+    int port = 1965;
+    std::string pinned, presented;
+    std::string cachePath;    // with a card: the whole body as received (Saved Pages copy it)
+    size_t receivedBytes = 0; // the whole body, which may be more than `text` holds
+    std::string savedFrom;    // a Saved Page: the URL it was saved from (links resolve against it)
+    std::string savedOn;      // and when, "2026-10-05 01:20"
+    uint32_t ms = 0;
+    // A page bigger than memory allows is read from its file as you scroll: `text` then holds
+    // lines [windowStart, windowStart + text.lineCount()) of totalLines. lineIndex has where every
+    // 64th line starts in the file (bit 31: inside a preformatted block there).
+    std::string backing;      // the file the page is in (a cache file or a Saved Page)
+    bool windowed = false;
+    size_t totalLines = 0, windowStart = 0;
+    std::vector<uint32_t> lineIndex;
+    std::string windowOf;     // a window result: the backing file it belongs to
+
+    // What relative links resolve against.
+    const std::string& base() const { return savedFrom.empty() ? url : savedFrom; }
+};
+
+// Gemini (docs/milestones/G1.md). Everything that touches the network or the SD card runs as one
+// job at a time on a short-lived task of its own: a TLS handshake or a missing card can block for
+// seconds, which the main loop's watchdog wouldn't allow, and an idle client should cost no stack.
+// Certificates are trusted on first use, per host and port (Q71).
+class GeminiService {
+   public:
+    static constexpr size_t kMaxBody = 64 * 1024;        // Q74
+    static constexpr size_t kStartFloor = 55 * 1024;     // Q86: no fetch below this
+    static constexpr size_t kSteadyFloor = 40 * 1024;    // Q86: what must be left once the page is in
+    static constexpr size_t kTransientFloor = 20 * 1024; // Q86: while the TLS connection is open
+    static constexpr int kMaxRedirects = 5;              // Q72
+    static constexpr size_t kMaxOnCard = 1024 * 1024;    // a text page larger than this is cut
+    static constexpr int kMaxLinkedPages = 30;           // Q83
+    static constexpr size_t kIndexEvery = 64;            // lines between lineIndex entries
+    static constexpr size_t kMaxLineBytes = 8192;        // longer lines are cut
+    // What a page costs per line on top of its text: TextBuffer's index (8) and the App's tables
+    // (type, first row, links: about 8). Counting only the first left the steady floor 1.5 to 3 KB
+    // short on a windowed page (found in M3).
+    static constexpr size_t kBytesPerLine = 16;
+    static constexpr const char* kBookmarks = "/gemini/bookmarks.gmi";
+    static constexpr const char* kStartUrl = "about:start";
+
+    GeminiService(KeyValueStore& store, StorageService& storage, ClockService& clock, EventBus& bus);
+
+    // Pages: gemini://…, about:start (bookmarks, Saved Pages, defaults) or file:///gemini/saved/….
+    // `preferSaved`: open the Saved Page of that URL if there is one (inside a Saved Page, Q84).
+    bool fetch(const std::string& url, bool preferSaved = false);
+    // Actions; each reports one line through takeMessage().
+    bool save(const std::string& url);                                  // s (Q82)
+    bool saveWithLinks(const std::string& url, std::vector<std::string> links);  // S (Q83)
+    bool refresh(const std::string& savedPath);                         // r on a Saved Page
+    bool deleteSaved(const std::string& savedPath);                     // d on a Saved Page (Q85)
+    bool addBookmark(const std::string& url, const std::string& title); // b (Q77)
+    bool download(const std::string& url);                              // s on a non-text page (Q73)
+    // The window of a big page starting at `firstLine` (a multiple of kIndexEvery), from its file.
+    bool loadWindow(const GeminiPage& page, size_t firstLine);
+
+    bool busy() const { return busy_; }
+    bool takeResult(GeminiPage& out);
+    bool takeMessage(std::string& out);
+    void cancel() { cancel_ = true; }
+    // After the user accepts a changed certificate.
+    void trust(const std::string& host, int port, const std::string& fingerprint);
+
+    // `gemini get <url>`: the same fetch, reported on the console instead of to the App.
+    bool fetchToConsole(const std::string& url);
+
+   private:
+    enum class Job { Fetch, Save, SaveWithLinks, Refresh, Delete, Bookmark, Download, Window };
+    // Cache files: two take turns for pages on screen (the one shown is never overwritten by the
+    // next), one for jobs (saving linked pages, refreshing).
+    static constexpr int kWorkSlot = 2;
+    static const char* slotPath(int slot);
+
+    bool start(Job job);
+    static void taskEntry(void* self);
+    void run();
+    void runFetch(GeminiPage& page);
+    void fetchFollowing(const std::string& url, GeminiPage& page, bool loadIntoRam, int slot);
+    void fetchOne(const std::string& url, GeminiPage& page, bool loadIntoRam, int slot);
+    bool receiveToCard(::NetworkClientSecure& tls, const char* first, size_t len, GeminiPage& page, int slot);
+    void loadFromCard(GeminiPage& page, size_t freeBefore, const std::string& path);
+    void readWindow(GeminiPage& page, size_t firstLine, size_t budget);
+    void openSaved(const std::string& path, GeminiPage& page);
+    std::string savedFirstLine(const std::string& path);
+    std::string savedFrom(const std::string& path);
+    void composeStart(GeminiPage& page);
+    std::string saveCached(const std::string& url);  // "" or what went wrong
+    const char* cacheOf(const std::string& url) const;  // the cache file holding url's body, or nullptr
+    void finishWithMessage(const std::string& text);
+    void notify(const std::string& text);
+    void report(const GeminiPage& page, size_t heapBefore, size_t heapLowest);
+    std::string pinKey(const std::string& host, int port) const;
+    std::string now() const;
+
+    KeyValueStore& store_;
+    StorageService& storage_;
+    ClockService& clock_;
+    EventBus& bus_;
+    SemaphoreHandle_t lock_;
+    Job job_ = Job::Fetch;
+    std::string arg_, arg2_;
+    std::vector<std::string> links_;
+    bool preferSaved_ = false;
+    GeminiPage result_;
+    std::string message_;
+    std::string slotUrl_[3];  // the URL whose body each cache file holds
+    int nextDisplay_ = 0;
+    size_t windowLine_ = 0, windowReleasing_ = 0;
+    GeminiPage windowPage_;
+    bool replaced_ = false;  // the last save replaced an older copy
+    volatile bool busy_ = false, ready_ = false, messageReady_ = false, cancel_ = false, toConsole_ = false;
+    size_t lowest_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,203 @@
+#include "services/gnss_service.h"
+
+#include <Arduino.h>
+#include <SD.h>
+
+#include <algorithm>
+#include <cstdio>
+
+#include "platform/console.h"
+
+namespace roro {
+
+namespace {
+const char* fixName(gnss::FixType f) {
+    return f == gnss::FixType::ThreeD ? "3D" : f == gnss::FixType::TwoD ? "2D" : "none";
+}
+}  // namespace
+
+GnssService::GnssService(const Settings& settings, ClockService& clock, StorageService& storage, EventBus& bus)
+    : settings_(settings), clock_(clock), storage_(storage), bus_(bus) {
+    parser_.onLine = [this](const std::string& line) {
+        lastLineMs_ = millis();
+        if (echo_) console.printf("nmea: %s\n", line.c_str());
+    };
+}
+
+void GnssService::start() {
+    open(millis());
+    storage_.runJob([this]() { closeUnfinishedTracks(); });
+}
+
+void GnssService::stop() { close(); }
+
+void GnssService::open(uint32_t nowMs) {
+    Serial1.setRxBufferSize(512);  // before begin(): over a second of NMEA, read every 50 ms
+    Serial1.begin(kBaud, SERIAL_8N1, kRxPin, kTxPin);
+    open_ = true;
+    active_ = false;  // tick() wakes it or puts it to sleep, per the setting
+    standbyMs_ = 0;
+}
+
+void GnssService::wake(uint32_t nowMs) {
+    send("PCAS10,0");  // hot start: ends a standby, keeps what the receiver knows
+    active_ = true;
+    openedMs_ = nowMs;
+    firstFixMs_ = 0;
+    lastLineMs_ = 0;
+    lastFix_ = gnss::FixType::None;
+    console.println("gnss: on");
+}
+
+void GnssService::standby(uint32_t nowMs) {
+    if (tracking()) stopTrack();
+    send("PCAS12,65535");
+    if (active_) console.println("gnss: off (receiver in standby)");
+    active_ = false;
+    standbyMs_ = nowMs;
+}
+
+void GnssService::close() {
+    if (!open_) return;
+    Serial1.end();
+    open_ = active_ = false;
+    lastLineMs_ = 0;
+}
+
+void GnssService::tick(uint32_t nowMs) {
+    if (!open_) open(nowMs);
+    bool wanted = settings_.getBool(Setting::GnssEnabled);
+    if (wanted && !active_) wake(nowMs);
+    if (!wanted && (active_ || !standbyMs_ || nowMs - standbyMs_ >= kStandbyRenewMs)) standby(nowMs);
+
+    char buf[128];
+    for (int avail; (avail = Serial1.available()) > 0;) {
+        size_t n = Serial1.read(reinterpret_cast<uint8_t*>(buf), std::min<size_t>(avail, sizeof buf));
+        if (n == 0) break;
+        bytes_ += n;
+        if (active_) parser_.feed(buf, n);  // in standby: the last lines before it, discarded
+    }
+
+    if (!active_) return;
+    const gnss::GnssState& s = parser_.state();
+    if (s.fix != lastFix_) {
+        if (s.fix != gnss::FixType::None && !firstFixMs_) {
+            firstFixMs_ = nowMs - openedMs_;
+            console.printf("gnss: first Fix after %lu s\n", (unsigned long)(firstFixMs_ / 1000));
+        }
+        console.printf("gnss: Fix %s, %d satellites used\n", fixName(s.fix), s.satellitesUsed);
+        lastFix_ = s.fix;
+    }
+    recordPoint(nowMs);
+    // GNSS time is the most trusted source (ClockModel): set it with a Fix, then now and then.
+    if (s.timeValid && s.fix != gnss::FixType::None && (!clockSetMs_ || nowMs - clockSetMs_ >= kClockEveryMs)) {
+        if (clock_.set(s.utcSeconds(), TimeSource::Gnss) && !clockSetMs_) console.println("gnss: clock set");
+        clockSetMs_ = nowMs;
+    }
+}
+
+void GnssService::notify(const std::string& text) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(NotificationLevel::Info)));
+}
+
+std::string GnssService::startTrack(uint32_t nowMs) {
+    if (tracking()) return "";
+    if (!active_) return "GNSS is off";
+    if (!storage_.state().present) return "No SD card";
+    int64_t now = clock_.utcNow();
+    if (now < 0) return "Waiting for the time (a Fix or Wi-Fi)";
+    trackPath_ = gnss::trackPath(now);
+    std::string name = trackPath_.substr(trackPath_.rfind('/') + 1);
+    name = name.substr(0, name.size() - 4);  // without ".gpx"
+    storage_.appendLine(trackPath_, gnss::gpx::header(name), true);
+    trackPoints_ = 0;
+    trackStartMs_ = nowMs;
+    trackRule_.reset();
+    console.printf("gnss: Track %s started\n", trackPath_.c_str());
+    notify("Track started");
+    return "";
+}
+
+void GnssService::stopTrack() {
+    if (!tracking()) return;
+    storage_.appendLine(trackPath_, gnss::gpx::footer(), true);
+    console.printf("gnss: Track %s saved, %d points\n", trackPath_.c_str(), trackPoints_);
+    notify("Track saved: " + std::to_string(trackPoints_) + (trackPoints_ == 1 ? " point" : " points"));
+    trackPath_.clear();
+}
+
+void GnssService::recordPoint(uint32_t nowMs) {
+    const gnss::GnssState& s = parser_.state();
+    if (!tracking() || !s.positionValid || !s.timeValid) return;
+    if (!trackRule_.due(nowMs, s.latitude, s.longitude)) return;
+    storage_.appendLine(trackPath_,
+                        gnss::gpx::point(s.latitude, s.longitude, s.altitudeValid, s.altitudeM, s.utcSeconds()), true);
+    trackPoints_++;
+}
+
+// A Track cut short by a power loss or a crash has no footer: GPX readers refuse it. Close it.
+void GnssService::closeUnfinishedTracks() {
+    File dir = SD.open("/gnss/tracks");
+    if (!dir || !dir.isDirectory()) return;
+    int closed = 0;
+    for (File f = dir.openNextFile(); f; f = dir.openNextFile()) {
+        std::string name = f.name();
+        if (f.isDirectory() || name.size() < 4 || name.compare(name.size() - 4, 4, ".gpx") != 0) continue;
+        char tail[32] = {};
+        size_t size = f.size();
+        f.seek(size > sizeof tail - 1 ? size - (sizeof tail - 1) : 0);
+        f.read(reinterpret_cast<uint8_t*>(tail), sizeof tail - 1);
+        f.close();
+        if (gnss::gpx::finished(tail)) continue;
+        File out = SD.open(("/gnss/tracks/" + name).c_str(), FILE_APPEND);
+        if (out) {
+            out.print(("\n" + gnss::gpx::footer() + "\n").c_str());
+            out.close();
+            closed++;
+        }
+    }
+    if (closed) console.printf("gnss: closed %d unfinished Track(s)\n", closed);
+}
+
+bool GnssService::send(const std::string& body) {
+    if (!open_) return false;
+    uint8_t sum = 0;
+    for (char c : body) sum ^= static_cast<uint8_t>(c);
+    char tail[8];
+    std::snprintf(tail, sizeof tail, "*%02X\r\n", sum);
+    std::string line = "$" + body + tail;
+    Serial1.write(reinterpret_cast<const uint8_t*>(line.data()), line.size());
+    return true;
+}
+
+void GnssService::printStatus(Print& out, uint32_t nowMs) const {
+    if (!active_) return (void)out.println("gnss: off (receiver in standby)");
+    const gnss::GnssState& s = parser_.state();
+    out.printf("gnss: %s, Fix %s, %d used, %u in view, HDOP %.1f\n",
+               receiving(nowMs) ? "receiving" : "silent", fixName(s.fix), s.satellitesUsed,
+               (unsigned)s.satellites.size(), s.hdop);
+    if (s.positionValid)
+        out.printf("gnss: %.6f %.6f, %s%.0f m, %.1f km/h\n", s.latitude, s.longitude,
+                   s.altitudeValid ? "" : "altitude unknown ", s.altitudeM, s.speedKmh);
+    if (s.timeValid)
+        out.printf("gnss: %04d-%02d-%02d %02d:%02d:%02d UTC\n", s.year, s.month, s.day, s.hour, s.minute, s.second);
+    int perSystem[8] = {}, usedPerSystem[8] = {};
+    for (auto& sat : s.satellites) {
+        perSystem[static_cast<int>(sat.system)]++;
+        if (sat.used) usedPerSystem[static_cast<int>(sat.system)]++;
+    }
+    out.print("gnss: in view (used)");
+    for (int c = 1; c < 7; c++)
+        if (perSystem[c])
+            out.printf(" %s %d (%d)", gnss::constellationName(static_cast<gnss::Constellation>(c)), perSystem[c],
+                       usedPerSystem[c]);
+    out.println();
+    if (tracking())
+        out.printf("gnss: recording %s, %d points, %lu s\n", trackPath_.c_str(), trackPoints_,
+                   (unsigned long)((nowMs - trackStartMs_) / 1000));
+    out.printf("gnss: up %lu s, first Fix %s, %lu bytes, %lu sentences, %lu bad\n", (unsigned long)((nowMs - openedMs_) / 1000),
+               firstFixMs_ ? (std::to_string(firstFixMs_ / 1000) + " s").c_str() : "not yet", (unsigned long)bytes_,
+               (unsigned long)parser_.goodSentences(), (unsigned long)parser_.badSentences());
+}
+
+}  // namespace roro
@@ -0,0 +1,84 @@
+#pragma once
+
+#include <Print.h>
+
+#include <string>
+
+#include "event_bus.h"
+#include "nmea_parser.h"
+#include "service.h"
+#include "services/clock_service.h"
+#include "services/storage_service.h"
+#include "settings.h"
+#include "track.h"
+
+namespace roro {
+
+// The GNSS receiver on the Cap LoRa-1262 (see CONTEXT.md and docs/milestones/M2.md): reads its
+// NMEA from the main loop's tick (about 450 bytes/s, so a 512-byte UART buffer covers a second),
+// holds the current Fix, and sets the clock from it. Settings → GNSS switches it on and off.
+class GnssService : public Service {
+   public:
+    static constexpr int kRxPin = 15, kTxPin = 13;  // measured: M2 step 1
+    static constexpr uint32_t kBaud = 115200;
+    static constexpr uint32_t kSilentAfterMs = 3000;  // no sentence for this long: receiver silent
+    static constexpr uint32_t kClockEveryMs = 600000; // refresh the clock from the Fix this often
+    // Off (Q58, measured): "$PCAS12,<s>" puts the receiver in standby for that long, and any
+    // command wakes it. Standby is renewed while off, in case the duration is clamped.
+    static constexpr uint32_t kStandbyRenewMs = 3600000;
+
+    GnssService(const Settings& settings, ClockService& clock, StorageService& storage, EventBus& bus);
+    const char* name() const override { return "gnss"; }
+    uint32_t tickIntervalMs() const override { return 50; }
+    void start() override;
+    void stop() override;
+    void tick(uint32_t nowMs) override;
+
+    bool on() const { return active_; }
+    bool receiving(uint32_t nowMs) const { return active_ && lastLineMs_ && nowMs - lastLineMs_ < kSilentAfterMs; }
+    const gnss::GnssState& state() const { return parser_.state(); }
+    uint32_t onSinceMs() const { return openedMs_; }  // when the receiver was last woken
+
+    // Debug aids (Q68): raw sentences to the console, a status report, and sending a command
+    // ("PCAS10,0" becomes "$PCAS10,0*1C\r\n").
+    void setEcho(bool echo) { echo_ = echo; }
+    void printStatus(Print& out, uint32_t nowMs) const;
+    bool send(const std::string& body);
+    // Tracks (Q63): GPX on the SD card, a point every 5 s once moved 5 m, recorded in the
+    // background whatever App is open. startTrack() returns why it can't, or "".
+    std::string startTrack(uint32_t nowMs);
+    void stopTrack();
+    bool tracking() const { return !trackPath_.empty(); }
+    int trackPoints() const { return trackPoints_; }
+    uint32_t trackStartMs() const { return trackStartMs_; }
+
+    void restart(uint32_t nowMs) {
+        close();
+        open(nowMs);
+    }
+
+   private:
+    void open(uint32_t nowMs);  // the UART; the receiver's state follows the setting in tick()
+    void close();
+    void wake(uint32_t nowMs);
+    void recordPoint(uint32_t nowMs);
+    void closeUnfinishedTracks();  // on the storage task
+    void notify(const std::string& text);
+    void standby(uint32_t nowMs);
+
+    const Settings& settings_;
+    ClockService& clock_;
+    StorageService& storage_;
+    EventBus& bus_;
+    gnss::NmeaParser parser_;
+    bool open_ = false, active_ = false, echo_ = false;
+    uint32_t bytes_ = 0, standbyMs_ = 0;
+    uint32_t openedMs_ = 0, lastLineMs_ = 0, firstFixMs_ = 0, clockSetMs_ = 0;
+    gnss::FixType lastFix_ = gnss::FixType::None;
+    std::string trackPath_;
+    int trackPoints_ = 0;
+    uint32_t trackStartMs_ = 0;
+    gnss::TrackRule trackRule_;
+};
+
+}  // namespace roro
@@ -33,16 +33,23 @@ IrcService::IrcService(KeyValueStore& store, const std::string& defaultNick, Wif
 void IrcService::start() {
    if (task_) return;
    lock_ = xSemaphoreCreateMutex();
-    xTaskCreate(taskEntry, "irc", 8192, this, 1, &task_);
+    xTaskCreate(taskEntry, "irc", 6144, this, 1, &task_);  // peak 4.0 KB (TLS handshake, M2)
 }

 void IrcService::connect() {
+    stoppedByUser_ = false;
    if (wanted_) return;
    retryAtMs_ = millis();
    backoff_.reset();
    wanted_ = true;
 }

+void IrcService::disconnect() {
+    stoppedByUser_ = true;
+    stopRequested_ = true;  // the IRC task says QUIT and closes; nothing to do if it never started
+    if (!task_) wanted_ = false;
+}
+
 int IrcService::totalUnread() {
    Lock l(lock_);
    return session_->totalUnread();
@@ -176,13 +183,10 @@ void IrcService::flushEffects() {
        status_ = Status::Online;
        backoff_.reset();
    }
-    if (quit && open_) {
-        delay(300);  // let QUIT reach the server
-        close("");
-        wanted_ = false;
-        status_ = Status::Stopped;
-        Lock l(lock_);
-        session_->disconnected(clock_.utcNow(), "disconnected");
+    if (quit) {  // /quit: QUIT is already on its way if connected; stop in any state
+        stoppedByUser_ = true;
+        stopRequested_ = true;
+        quitSent_ = true;
    }
 }

@@ -192,6 +196,19 @@ void IrcService::loop() {
        bool wifiUp = wifi_.state() == WifiController::State::Connected;
        bool monitoring = wifi_.state() == WifiController::State::Monitoring;

+        if (stopRequested_) {
+            stopRequested_ = false;
+            if (open_) {
+                if (!quitSent_) conn_->print("QUIT :roro9stack\r\n");
+                vTaskDelay(pdMS_TO_TICKS(300));  // let QUIT reach the server
+                close("");
+            }
+            quitSent_ = false;
+            wanted_ = false;
+            status_ = Status::Stopped;
+            Lock l(lock_);
+            session_->disconnected(clock_.utcNow(), "disconnected (Enter reconnects)");
+        }
        if (restart_) {
            restart_ = false;
            if (open_) {
@@ -31,9 +31,12 @@ class IrcService : public Service {
    const char* name() const override { return "irc"; }
    void start() override;

-    // Starts the session (the IRC App does this when opened); /quit stops it.
+    // Starts the session (the IRC App does this when opened, unless you stopped it).
    void connect();
+    // Stops it, from any state: says QUIT if connected, and stops retrying. /quit, `irc stop`.
+    void disconnect();
    bool running() const { return wanted_; }
+    bool stoppedByUser() const { return stoppedByUser_; }
    Status status() const { return status_; }

    // Read or act on the session while holding its lock: withSession([](IrcSession& s) { ... }).
@@ -78,6 +81,9 @@ class IrcService : public Service {
    ReconnectPolicy backoff_;
    std::string partial_;
    volatile bool wanted_ = false;
+    volatile bool stoppedByUser_ = false;  // a manual stop: opening the App doesn't reconnect
+    volatile bool stopRequested_ = false;
+    bool quitSent_ = false;  // /quit already queued its QUIT
    volatile bool restart_ = false;
    volatile Status status_ = Status::Stopped;
    bool open_ = false;
@@ -0,0 +1,62 @@
+#include "services/lora_capture_service.h"
+
+#include <vector>
+
+#include "loratap.h"
+#include "platform/console.h"
+
+namespace roro {
+
+std::string LoraCaptureService::start(uint32_t nowMs) {
+    if (capturing()) return "";
+    if (!radio_.present()) return "No LoRa radio";
+    StorageState card = storage_.state();
+    if (!card.present) return "No SD card";
+    if (!card.capturesAllowed) return "The SD card is full";
+    int64_t now = clock_.utcNow();
+    if (now < 0) return "Waiting for the time (GNSS or Wi-Fi)";
+    path_ = lora::capturePath(now);
+    std::vector<uint8_t> header;
+    lora::appendPcapHeader(header);
+    storage_.appendBytes(path_, std::string(header.begin(), header.end()), true);
+    startUtc_ = now;
+    startMs_ = nowMs;
+    written_ = radio_.received();  // from now on
+    packets_ = 0;
+    radio_.listen(RadioService::Capture, true);
+    console.printf("lora: Capture %s started\n", path_.c_str());
+    notify("LoRa Capture started");
+    return "";
+}
+
+void LoraCaptureService::stop() {
+    if (!capturing()) return;
+    radio_.listen(RadioService::Capture, false);
+    console.printf("lora: Capture %s stopped, %lu packets\n", path_.c_str(), (unsigned long)packets_);
+    notify("LoRa Capture stopped: " + std::to_string(packets_) + " packets");
+    path_.clear();
+}
+
+void LoraCaptureService::tick(uint32_t nowMs) {
+    (void)nowMs;
+    if (!capturing()) return;
+    uint32_t newest = radio_.received();
+    for (uint32_t seq = written_ + 1; seq <= newest; ++seq) {
+        RadioPacket p;
+        if (!radio_.packet(seq, p)) continue;  // already left the ring: too many at once
+        uint32_t sinceStart = p.ms - startMs_;
+        std::vector<uint8_t> record;
+        record.reserve(lora::kRecordOverhead + p.len);
+        lora::appendRecord(record, static_cast<uint32_t>(startUtc_ + sinceStart / 1000), (sinceStart % 1000) * 1000,
+                           p.rx, p.data, p.len);
+        storage_.appendBytes(path_, std::string(record.begin(), record.end()), true);
+        ++packets_;
+    }
+    written_ = newest;
+}
+
+void LoraCaptureService::notify(const std::string& text) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(NotificationLevel::Info)));
+}
+
+}  // namespace roro
@@ -0,0 +1,44 @@
+#pragma once
+
+#include <string>
+
+#include "event_bus.h"
+#include "service.h"
+#include "services/clock_service.h"
+#include "services/radio_service.h"
+#include "services/storage_service.h"
+
+namespace roro {
+
+// A LoRa Sniffer Capture (CONTEXT.md: Capture; M3, Q97): every packet the radio receives, as pcap
+// with LoRaTap headers, in /captures/lora/. Started and stopped by hand; keeps the radio listening
+// and keeps recording whatever App is open (Q100).
+class LoraCaptureService : public Service {
+   public:
+    LoraCaptureService(RadioService& radio, StorageService& storage, ClockService& clock, EventBus& bus)
+        : radio_(radio), storage_(storage), clock_(clock), bus_(bus) {}
+    const char* name() const override { return "lora-capture"; }
+    uint32_t tickIntervalMs() const override { return 200; }
+    void tick(uint32_t nowMs) override;
+
+    std::string start(uint32_t nowMs);  // why it can't, or ""
+    void stop();
+    bool capturing() const { return !path_.empty(); }
+    const std::string& path() const { return path_; }
+    uint32_t packets() const { return packets_; }
+
+   private:
+    void notify(const std::string& text);
+
+    RadioService& radio_;
+    StorageService& storage_;
+    ClockService& clock_;
+    EventBus& bus_;
+    std::string path_;
+    uint32_t written_ = 0;  // the radio's seq last written
+    uint32_t packets_ = 0;
+    int64_t startUtc_ = 0;  // the Clock and millis() when it started: packet times follow from both
+    uint32_t startMs_ = 0;
+};
+
+}  // namespace roro
@@ -0,0 +1,476 @@
+#include "services/radio_service.h"
+
+#include <M5Cardputer.h>
+#include <RadioLib.h>
+
+#include <algorithm>
+#include <new>
+
+#include "meshtastic_header.h"
+#include "sweep_view.h"
+#include "platform/console.h"
+#include "platform/pins.h"
+#include "platform/shared_spi.h"
+
+namespace roro {
+
+namespace {
+
+// The Cap's PI4IOE5V6408: its P0 connects the antenna; at power-on it's an input and the receiver
+// is deaf (M3 step 1, measured). Only touched from the main loop, which owns the I2C bus.
+constexpr uint8_t kExpander = 0x43;
+constexpr uint32_t kI2cFreq = 400000;
+enum ExpanderReg : uint8_t { kId = 0x01, kDirection = 0x03, kOutput = 0x05, kHighZ = 0x07, kInput = 0x0F };
+
+bool antennaOn() {
+    auto& i2c = M5.In_I2C;
+    if (!i2c.scanID(kExpander, kI2cFreq)) return false;
+    i2c.writeRegister8(kExpander, kOutput, i2c.readRegister8(kExpander, kOutput, kI2cFreq) | 1, kI2cFreq);
+    i2c.writeRegister8(kExpander, kHighZ, i2c.readRegister8(kExpander, kHighZ, kI2cFreq) & ~1, kI2cFreq);
+    i2c.writeRegister8(kExpander, kDirection, i2c.readRegister8(kExpander, kDirection, kI2cFreq) | 1, kI2cFreq);
+    return true;
+}
+
+// Below this the receiver hears only itself: the antenna path is open (step 1: -111.9 dBm).
+constexpr float kDeafBelow = -108.0f;
+
+}  // namespace
+
+RadioService* RadioService::instance_ = nullptr;
+
+RadioService::RadioService() : lock_(xSemaphoreCreateMutex()) {
+    const meshtastic::Preset& p = meshtastic::kEu868Presets[0];  // LongFast (Q95)
+    config_ = {meshtastic::eu868FrequencyHz(p), p.bwKHz, p.sf, p.cr, meshtastic::kSyncWord, meshtastic::kPreambleLength,
+               p.name};
+}
+
+void RadioService::start() {
+    instance_ = this;
+    expander_ = antennaOn();
+    // SPI transactions take the bus lock the SD card uses; the HAL doesn't re-begin the bus.
+    hal_.reset(new ArduinoHal(sharedSpi(), SPISettings(8000000, MSBFIRST, SPI_MODE0)));
+    module_.reset(new Module(hal_.get(), pins::kLoraCs, pins::kLoraIrq, pins::kLoraReset, pins::kLoraBusy));
+    radio_.reset(new SX1262(module_.get()));
+    // Above the main loop and the other Services' tasks, so a packet is read before the next.
+    xTaskCreatePinnedToCore(taskEntry, "radio", 4096, this, 2, &task_, 1);  // peak 2.0 KB (M3 step 3)
+}
+
+void RadioService::taskEntry(void* self) { static_cast<RadioService*>(self)->run(); }
+
+void IRAM_ATTR RadioService::onDio1() {
+    BaseType_t woken = pdFALSE;
+    if (instance_ && instance_->task_) xTaskNotifyFromISR(instance_->task_, kIrq, eSetBits, &woken);
+    portYIELD_FROM_ISR(woken);
+}
+
+void RadioService::wake(Notify why) {
+    if (task_) xTaskNotify(task_, why, eSetBits);
+}
+
+bool RadioService::beginRadio(Print* report) {
+    Config c = config();
+    float mhz = c.frequencyHz / 1e6f;
+    int16_t state = radio_->begin(mhz, c.bandwidthKHz, c.spreadingFactor, c.codingRate, c.syncWord, 0, c.preamble,
+                                  tcxo_, false);
+    if (state != RADIOLIB_ERR_NONE && tcxo_ > 0) {  // Meshtastic's TCXO_OPTIONAL: fall back to the crystal
+        if (report) report->printf("lora probe: begin with TCXO %.1f V: error %d, trying the crystal\n", tcxo_, state);
+        tcxo_ = 0;
+        state = radio_->begin(mhz, c.bandwidthKHz, c.spreadingFactor, c.codingRate, c.syncWord, 0, c.preamble, tcxo_,
+                              false);
+    }
+    if (state != RADIOLIB_ERR_NONE) {
+        if (report) report->printf("lora probe: error %d, no SX1262 found\n", state);
+        return false;
+    }
+    radio_->setDio2AsRfSwitch(true);       // DIO2 selects TX or RX in the switch, as in Meshtastic
+    radio_->setRxBoostedGainMode(true);    // about 2 dB more sensitivity for about 2 mA
+    return true;
+}
+
+void RadioService::run() {
+    present_ = beginRadio(nullptr);
+    if (present_) radio_->sleep();
+    console.printf("radio: %s\n", present_ ? (tcxo_ > 0 ? "SX1262 ready (TCXO), asleep" : "SX1262 ready (crystal), asleep")
+                                           : "no radio found");
+    for (;;) {
+        uint32_t bits = 0;
+        xTaskNotifyWait(0, UINT32_MAX, &bits,
+                        sweepWanted_ ? pdMS_TO_TICKS(20) : listening_ ? pdMS_TO_TICKS(kNoiseEveryMs) : portMAX_DELAY);
+        if (probeWanted_.exchange(false)) runProbe();
+        if (!present_) continue;
+        if (sweepWanted_) {  // a Sweep has the radio: the Sniffer waits, its packets kept (Q99)
+            sweepPass();
+            continue;
+        }
+        if (sweeping_) endSweep();
+        bool want = clients_ != 0;
+        if (want && !listening_) startListening();
+        else if (!want && listening_) stopListening();
+        if (listening_ && configChanged_.exchange(false)) startListening();  // again, with the new settings
+        if (listening_ && (bits & kIrq)) readPacket();
+        if (listening_ && millis() - lastNoiseMs_ >= kNoiseEveryMs) sampleNoise();
+    }
+}
+
+void RadioService::startListening() {
+    if (!ring_) {
+        ring_.reset(new (std::nothrow) RadioPacket[kRing]);
+        ringFirst_ = seq_ + 1;
+        if (!ring_) {
+            console.println("radio: not enough memory to listen");
+            clients_ = 0;
+            return;
+        }
+    }
+    // A full begin (with a reset) each time: the chip comes back from sleep with nothing assumed.
+    if (!beginRadio(nullptr)) {
+        ++radioErrors_;
+        return;
+    }
+    radio_->setPacketReceivedAction(onDio1);
+    int16_t state = receive();
+    if (state != RADIOLIB_ERR_NONE) {
+        ++radioErrors_;
+        console.printf("radio: can't receive (error %d)\n", state);
+        return;
+    }
+    if (!listening_) console.printf("radio: listening, %s\n", config().name);
+    listening_ = true;
+    lastNoiseMs_ = 0;
+}
+
+void RadioService::stopListening() {
+    radio_->clearPacketReceivedAction();
+    radio_->sleep();
+    listening_ = false;
+    noise_ = 0;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    ring_.reset();  // listening again starts a fresh list; idle costs nothing (Q100, Q103)
+    xSemaphoreGive(lock_);
+    console.println("radio: asleep");
+}
+
+void RadioService::readPacket() {
+    RadioPacket p;
+    size_t len = std::min<size_t>(radio_->getPacketLength(), sizeof p.data);
+    int16_t state = radio_->readData(p.data, len);
+    if (state == RADIOLIB_ERR_CRC_MISMATCH) {
+        p.crcOk = false;
+        ++crcErrors_;
+    } else if (state != RADIOLIB_ERR_NONE) {  // a header error or a timeout: nothing to keep
+        ++radioErrors_;
+        if (receive() != RADIOLIB_ERR_NONE) ++radioErrors_;
+        ++restarts_;
+        return;
+    }
+    Config c = config();
+    p.ms = millis();
+    p.len = static_cast<uint8_t>(len);
+    p.rx.frequencyHz = c.frequencyHz;
+    p.rx.bandwidthKHz = c.bandwidthKHz;
+    p.rx.spreadingFactor = c.spreadingFactor;
+    p.rx.syncWord = c.syncWord;
+    p.rx.rssi = radio_->getRSSI();
+    p.rx.snr = radio_->getSNR();
+    p.rx.noiseFloor = noise_;
+    p.frequencyError = radio_->getFrequencyError();
+    if (receive() != RADIOLIB_ERR_NONE) ++radioErrors_;
+    ++restarts_;
+
+    store(p);
+}
+
+void RadioService::store(RadioPacket& p) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    p.seq = seq_ + 1;
+    if (ring_) ring_[p.seq % kRing] = p;
+    seq_ = p.seq;
+    xSemaphoreGive(lock_);
+    ++packets_;
+    lastPacketMs_ = p.ms;
+}
+
+#ifdef RORO_DEBUG
+void RadioService::inject(const uint8_t* data, size_t len, float rssi, float snr) {
+    if (!listening_) return (void)console.println("lora inject: not listening");
+    RadioPacket p;
+    Config c = config();
+    p.ms = millis();
+    p.len = static_cast<uint8_t>(std::min(len, sizeof p.data));
+    std::copy(data, data + p.len, p.data);
+    p.rx = {c.frequencyHz, c.bandwidthKHz, c.spreadingFactor, rssi, snr, noise_, c.syncWord};
+    store(p);
+    console.printf("lora inject: #%lu, %u B\n", (unsigned long)p.seq, p.len);
+}
+#endif
+
+// Continuous receive. Only RX done raises DIO1; preambles and headers are only recorded in the
+// IRQ status, which sampleNoise() reads.
+int16_t RadioService::receive() {
+    return radio_->startReceive(RADIOLIB_SX126X_RX_TIMEOUT_INF,
+                                RADIOLIB_IRQ_RX_DEFAULT_FLAGS | (1UL << RADIOLIB_IRQ_PREAMBLE_DETECTED),
+                                RADIOLIB_IRQ_RX_DEFAULT_MASK, 0);
+}
+
+void RadioService::sampleNoise() {
+    lastNoiseMs_ = millis();
+    noise_ = radio_->getRSSI(false);
+    constexpr uint16_t kSeen =
+        RADIOLIB_SX126X_IRQ_PREAMBLE_DETECTED | RADIOLIB_SX126X_IRQ_HEADER_VALID | RADIOLIB_SX126X_IRQ_HEADER_ERR;
+    uint32_t flags = radio_->getIrqFlags();
+    if (flags & RADIOLIB_SX126X_IRQ_PREAMBLE_DETECTED) ++preambles_;
+    if (flags & RADIOLIB_SX126X_IRQ_HEADER_VALID) ++headers_;
+    if (flags & RADIOLIB_SX126X_IRQ_HEADER_ERR) ++headerErrors_;
+    if (flags & kSeen) radio_->clearIrqFlags(kSeen);  // never RX done: that one is the task's
+}
+
+bool RadioService::packet(uint32_t seq, RadioPacket& out) const {
+    if (seq == 0 || seq > seq_ || seq_ - seq >= kRing) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    bool ok = ring_ && ring_[seq % kRing].seq == seq;
+    if (ok) out = ring_[seq % kRing];
+    xSemaphoreGive(lock_);
+    return ok;
+}
+
+void RadioService::sweep(bool on, uint32_t fromHz, uint32_t toHz, uint32_t stepHz) {
+    if (on) {
+        stepHz = std::max<uint32_t>(stepHz, 10000);
+        toHz = std::max(toHz, fromHz);
+        toHz = std::min<uint32_t>(toHz, fromHz + stepHz * (SweepFrame::kMaxSteps - 1));
+        sweepFrom_ = fromHz, sweepTo_ = toHz, sweepStep_ = stepHz;
+    }
+    sweepWanted_ = on;
+    wake(kRequest);
+}
+
+bool RadioService::sweepFrame(SweepFrame& out) const {
+    if (!sweepSeq_) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    out = frame_;
+    xSemaphoreGive(lock_);
+    return true;
+}
+
+// One pass across the band. The first one sets the radio up: the Sniffer is paused, not stopped.
+void RadioService::sweepPass() {
+    if (!sweeping_) {
+        if (listening_) {
+            radio_->clearPacketReceivedAction();
+            listening_ = false;  // paused; startListening() resumes on the same ring
+        }
+        if (!beginRadio(nullptr)) {
+            ++radioErrors_;
+            sweepWanted_ = false;
+            return;
+        }
+        radio_->setBandwidth(125);
+        radio_->setSpreadingFactor(7);
+        sweeping_ = true;
+        console.println("radio: sweeping, the Sniffer is paused");
+    }
+    uint32_t from = sweepFrom_, to = sweepTo_, step = sweepStep_;
+    uint16_t steps = static_cast<uint16_t>((to - from) / step + 1);
+    int8_t dbm[SweepFrame::kMaxSteps];
+    uint32_t t0 = millis();
+    for (uint16_t i = 0; i < steps && sweepWanted_; ++i) {
+        radio_->standby();
+        // Image calibration is per band and slow; one calibration covers EU868, so skip it per step.
+        radio_->setFrequency((from + i * step) / 1e6f, i != 0);
+        radio_->startReceive();
+        delayMicroseconds(1500);  // RSSI settles
+        float best = -200;
+        for (int k = 0; k < 3; ++k) {
+            best = std::max(best, radio_->getRSSI(false));
+            delayMicroseconds(300);
+        }
+        dbm[i] = static_cast<int8_t>(std::clamp(best, -127.0f, 0.0f));
+    }
+    radio_->standby();
+    if (!sweepWanted_) return;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    frame_.seq = sweepSeq_ + 1;
+    frame_.fromHz = from;
+    frame_.stepHz = step;
+    frame_.steps = steps;
+    frame_.passMs = static_cast<uint16_t>(millis() - t0);
+    std::copy(dbm, dbm + steps, frame_.dbm);
+    xSemaphoreGive(lock_);
+    sweepSeq_ = frame_.seq;
+}
+
+void RadioService::endSweep() {
+    sweeping_ = false;
+    console.println("radio: sweep stopped");
+    if (clients_) startListening();  // the Sniffer again, with its settings and its packets
+    else {
+        radio_->sleep();
+        xSemaphoreTake(lock_, portMAX_DELAY);
+        ring_.reset();
+        xSemaphoreGive(lock_);
+    }
+}
+
+uint32_t RadioService::available() const {
+    uint32_t newest = seq_, first = ringFirst_;
+    if (!listening_ || newest < first) return 0;
+    return std::min<uint32_t>(newest - first + 1, kRing);
+}
+
+void RadioService::listen(Client client, bool on) {
+    if (on) clients_ |= client;
+    else clients_ &= ~client;
+    wake(kRequest);
+}
+
+RadioService::Config RadioService::config() const {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    Config c = config_;
+    xSemaphoreGive(lock_);
+    return c;
+}
+
+void RadioService::setPreset(const meshtastic::Preset& p) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    config_ = {meshtastic::eu868FrequencyHz(p), p.bwKHz, p.sf, p.cr, meshtastic::kSyncWord, meshtastic::kPreambleLength,
+               p.name};
+    xSemaphoreGive(lock_);
+    configChanged_ = true;
+    wake(kRequest);
+}
+
+void RadioService::setConfig(const Config& c) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    config_ = c;
+    config_.name = "Custom";
+    xSemaphoreGive(lock_);
+    configChanged_ = true;
+    wake(kRequest);
+}
+
+void RadioService::setEcho(bool echo) {
+    echo_ = echo;
+    echoed_ = seq_;
+    listen(Console, echo);
+}
+
+void RadioService::tick(uint32_t nowMs) {
+    SweepFrame f;
+    if (sweepEcho_ && sweeping_ && nowMs - sweepEchoMs_ >= 2000 && sweepFrame(f)) {
+        sweepEchoMs_ = nowMs;
+        lora::SweepStats st = lora::summarize(f.dbm, f.steps, f.fromHz, f.stepHz);
+        console.printf("sweep: #%lu floor %d, top %d dBm", (unsigned long)f.seq, st.floor, st.top);
+        for (auto& p : st.peaks) console.printf(", %.1f MHz %d", p.hz / 1e6, p.dbm);
+        console.printf(" (%u ms a pass)\n", f.passMs);
+    }
+    if (!echo_) return;
+    for (uint32_t s = std::max(echoed_ + 1, seq_ > kRing ? seq_ - kRing + 1 : 1u); s <= seq_; ++s) {
+        RadioPacket p;
+        if (!packet(s, p)) continue;
+        console.printf("lora: #%lu %u B %.1f dBm SNR %.1f dB%s", (unsigned long)p.seq, p.len, p.rx.rssi, p.rx.snr,
+                       p.crcOk ? "" : " (bad CRC)");
+        meshtastic::PacketHeader h;
+        if (meshtastic::parseHeader(p.data, p.len, h))
+            console.printf(" | %s > %s, ch 0x%02X, hops %d/%u%s", meshtastic::nodeId(h.from).c_str(),
+                           meshtastic::nodeId(h.to).c_str(), h.channelHash, h.hopsAway(), h.hopStart(),
+                           h.viaMqtt() ? ", via MQTT" : "");
+        console.println();
+    }
+    echoed_ = seq_;
+}
+
+void RadioService::printSweep(Print& out) const {
+    SweepFrame f;
+    if (!sweepFrame(f)) return (void)out.println("sweep: none yet (lora sweep on)");
+    out.printf("sweep: #%lu, %u steps of %lu kHz from %.3f MHz, %u ms\n", (unsigned long)f.seq, f.steps,
+               (unsigned long)(f.stepHz / 1000), f.fromHz / 1e6, f.passMs);
+    for (uint16_t i = 0; i < f.steps; i += 8) {
+        out.printf("%8.3f", (f.fromHz + i * f.stepHz) / 1e6);
+        for (uint16_t k = i; k < f.steps && k < i + 8; ++k) out.printf(" %4d", f.dbm[k]);
+        out.println();
+    }
+}
+
+void RadioService::printStatus(Print& out) const {
+    Config c = config();
+    Counters n = counters();
+    out.printf("radio: %s, %s, antenna switch %s\n", present_ ? "SX1262" : "no radio",
+               tcxo_ > 0 ? "TCXO 1.8 V" : "crystal", expander_ ? "on (expander 0x43 P0)" : "expander missing");
+    out.printf("radio: %s, %s %.3f MHz, BW %.0f kHz, SF %u, CR 4/%u, sync 0x%02X, preamble %u\n",
+               sweeping_ ? "sweeping" : listening_ ? "listening" : "asleep", c.name, c.frequencyHz / 1e6, c.bandwidthKHz, c.spreadingFactor,
+               c.codingRate, c.syncWord, c.preamble);
+    out.printf("radio: clients%s%s%s%s\n", clients_ ? "" : " none", clients_ & App ? " App" : "",
+               clients_ & Capture ? " Capture" : "", clients_ & Console ? " Console" : "");
+    out.printf("radio: %lu packets, %lu bad CRC, %lu radio errors, %lu receive restarts\n", (unsigned long)n.packets,
+               (unsigned long)n.crcErrors, (unsigned long)n.radioErrors, (unsigned long)n.restarts);
+    out.printf("radio: activity (500 ms samples): %lu preambles, %lu headers, %lu bad headers\n",
+               (unsigned long)n.preambles, (unsigned long)n.headers, (unsigned long)n.headerErrors);
+    if (listening_)
+        out.printf("radio: noise floor %.1f dBm%s\n", noise_.load(),
+                   noise_ < kDeafBelow ? " (deaf? the antenna path looks open)" : "");
+    if (task_) out.printf("radio: task stack %u B free\n", (unsigned)uxTaskGetStackHighWaterMark(task_));
+}
+
+void RadioService::probe(Print& out) {
+    // The I2C part here, on the main loop; the radio part on the radio task.
+    bool found[120] = {};
+    M5.In_I2C.scanID(found, kI2cFreq);
+    out.print("lora probe: i2c (internal bus, 8/9):");
+    for (int a = 8; a < 120; ++a)
+        if (found[a]) out.printf(" 0x%02X", a);
+    out.println();
+    if (found[kExpander]) {
+        auto r = [](uint8_t reg) { return M5.In_I2C.readRegister8(kExpander, reg, kI2cFreq); };
+        out.printf("lora probe: expander 0x43 dir %02X out %02X highz %02X in %02X: antenna %s\n", r(kDirection),
+                   r(kOutput), r(kHighZ), r(kInput), r(kOutput) & 1 && r(kDirection) & 1 ? "on" : "OFF");
+    } else {
+        out.println("lora probe: no expander at 0x43: the antenna switch can't be enabled");
+    }
+    probeOut_ = &out;
+    probeWanted_ = true;
+    wake(kRequest);
+}
+
+void RadioService::runProbe() {
+    Print& out = *probeOut_;
+    uint32_t t0 = millis();
+    if (!beginRadio(&out)) return;
+    char version[17] = {};
+    module_->SPIreadRegisterBurst(RADIOLIB_SX126X_REG_VERSION_STRING, 16, reinterpret_cast<uint8_t*>(version));
+    out.printf("lora probe: %s, %s, ready in %u ms\n", version, tcxo_ > 0 ? "TCXO 1.8 V" : "crystal (no TCXO)",
+               (unsigned)(millis() - t0));
+    // DIO1 to the task, with no transmitter needed: a 100 ms receive timeout, routed to DIO1.
+    radio_->setPacketReceivedAction(onDio1);
+    uint32_t bits = 0;
+    xTaskNotifyWait(0, UINT32_MAX, &bits, 0);  // drop anything pending
+    uint32_t sent = millis();
+    radio_->startReceive(6400, RADIOLIB_IRQ_RX_DEFAULT_FLAGS,
+                         (1UL << RADIOLIB_IRQ_RX_DONE) | (1UL << RADIOLIB_IRQ_TIMEOUT), 0);  // 6400 x 15.625 us
+    bits = 0;
+    xTaskNotifyWait(0, UINT32_MAX, &bits, pdMS_TO_TICKS(500));
+    uint32_t flags = radio_->getIrqFlags();
+    if (bits & kIrq)
+        out.printf("lora probe: DIO1 interrupt works (receive timeout after %u ms)\n", (unsigned)(millis() - sent));
+    else
+        out.printf("lora probe: DIO1 interrupt never came (IRQ status 0x%04X)\n", (unsigned)flags);
+    radio_->standby();
+    radio_->clearIrqFlags(RADIOLIB_SX126X_IRQ_ALL);
+    if (!listening_) radio_->clearPacketReceivedAction();
+    receive();
+    delay(20);
+    float sum = 0, low = 0, high = -200;
+    for (int i = 0; i < 64; ++i) {
+        float r = radio_->getRSSI(false);
+        sum += r, low = std::min(low, r), high = std::max(high, r);
+        delay(3);
+    }
+    float mean = sum / 64;
+    out.printf("lora probe: noise %.1f dBm (%.1f to %.1f) at %.3f MHz: %s\n", mean, low, high, config().frequencyHz / 1e6,
+               mean < kDeafBelow ? "deaf, the antenna path looks open" : "the antenna is connected");
+    // Back to what it was doing.
+    if (listening_) startListening();
+    else radio_->sleep();
+    out.println("lora probe: done");
+}
+
+}  // namespace roro
@@ -0,0 +1,151 @@
+#pragma once
+
+#include <Print.h>
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+#include <freertos/task.h>
+
+#include <atomic>
+#include <cstdint>
+#include <memory>
+
+#include "loratap.h"
+#include "meshtastic_presets.h"
+#include "service.h"
+
+class SX1262;
+class Module;
+class ArduinoHal;
+
+namespace roro {
+
+// One received packet, as the Radio Service keeps it.
+struct RadioPacket {
+    uint32_t seq = 0;  // 1, 2, 3… since boot
+    uint32_t ms = 0;  // millis() when it was read (the Clock is read on the main loop, not here)
+    lora::RxInfo rx;
+    float frequencyError = 0;  // Hz
+    bool crcOk = true;
+    uint8_t len = 0;
+    uint8_t data[255];
+};
+
+// One Sweep pass (M3, Q98): the strongest of three instantaneous RSSI readings at each step.
+struct SweepFrame {
+    static constexpr size_t kMaxSteps = 160;
+    uint32_t seq = 0;  // 1, 2, 3… per pass
+    uint32_t fromHz = 0, stepHz = 0;
+    uint16_t steps = 0;
+    uint16_t passMs = 0;  // how long the pass took
+    int8_t dbm[kMaxSteps];
+};
+
+// The LoRa radio on the Cap (CONTEXT.md: Radio Service; docs/milestones/M3.md). One task owns the
+// SX1262 and does all its SPI traffic, behind the bus lock the SD card uses (Q93); the main loop
+// only posts requests, and DIO1's interrupt only wakes the task. **Receive only (Q94): there is
+// no way to transmit.** The radio listens while someone asks it to (Q100) and sleeps otherwise.
+class RadioService : public Service {
+   public:
+    enum Client : uint8_t { App = 1, Capture = 2, Console = 4 };
+    static constexpr size_t kRing = 32;           // Q103
+    static constexpr uint32_t kNoiseEveryMs = 500;  // instantaneous RSSI while listening
+
+    struct Config {
+        uint32_t frequencyHz;
+        float bandwidthKHz;
+        uint8_t spreadingFactor, codingRate, syncWord;
+        uint16_t preamble;
+        const char* name;  // the preset's, or "Custom"
+    };
+    struct Counters {
+        uint32_t packets, crcErrors, radioErrors, restarts;
+        // Seen in the IRQ status at each noise sample (every 500 ms). Preamble detections include
+        // false alarms in noise (M3: more on an empty frequency than on LongFast); headers don't.
+        uint32_t preambles, headers, headerErrors;
+    };
+
+    RadioService();
+    const char* name() const override { return "radio"; }
+    uint32_t tickIntervalMs() const override { return 100; }
+    void start() override;
+    void tick(uint32_t nowMs) override;
+
+    bool present() const { return present_; }
+    bool listening() const { return listening_; }
+    void listen(Client client, bool on);
+    Config config() const;
+    void setPreset(const meshtastic::Preset& preset);
+    void setConfig(const Config& config);  // custom settings (Q95), named "Custom"
+
+    uint32_t received() const { return seq_; }  // seq of the newest packet
+    uint32_t lastPacketMs() const { return lastPacketMs_; }  // millis(), 0 before the first
+    bool packet(uint32_t seq, RadioPacket& out) const;  // false once it has left the ring
+    uint32_t available() const;  // packets in the ring: seqs received()-available()+1 to received()
+    float noiseFloor() const { return noise_; }
+    Counters counters() const {
+        return {packets_, crcErrors_, radioErrors_, restarts_, preambles_, headers_, headerErrors_};
+    }
+
+    // Sweep (Q98, Q99): takes the radio across a band, pausing the Sniffer (its packets are kept)
+    // until stopped. EU868 by default: 863 to 870 MHz in 100 kHz steps, measured at 125 kHz.
+    void sweep(bool on, uint32_t fromHz = 863000000, uint32_t toHz = 870000000, uint32_t stepHz = 100000);
+    bool sweeping() const { return sweeping_; }
+    bool sweepFrame(SweepFrame& out) const;  // the latest pass; false before the first
+    uint32_t sweeps() const { return sweepSeq_; }
+    void setSweepEcho(bool echo) { sweepEcho_ = echo; }  // a summary on the console every 2 s
+    void printSweep(Print& out) const;                   // `lora sweep dump`: the latest pass
+
+    // Debug aids (Q102).
+    void printStatus(Print& out) const;
+    void setEcho(bool echo);
+    void probe(Print& out);  // `lora probe`: runs on the radio task
+#ifdef RORO_DEBUG
+    // `lora inject`: a packet into the ring as if received, to test the App and Captures with no
+    // transmitter in range. Nothing goes on air.
+    void inject(const uint8_t* data, size_t len, float rssi, float snr);
+#endif
+
+   private:
+    enum Notify : uint32_t { kIrq = 1, kRequest = 2 };
+    static void taskEntry(void* self);
+    static void onDio1();
+    void run();
+    bool beginRadio(Print* report);
+    void applyConfig();
+    void startListening();
+    void stopListening();
+    int16_t receive();
+    void readPacket();
+    void store(RadioPacket& p);
+    void sampleNoise();
+    void runProbe();
+    void sweepPass();
+    void endSweep();
+    void wake(Notify why);
+
+    std::unique_ptr<ArduinoHal> hal_;
+    std::unique_ptr<Module> module_;
+    std::unique_ptr<SX1262> radio_;
+    TaskHandle_t task_ = nullptr;
+    mutable SemaphoreHandle_t lock_;  // the ring and the config
+    std::unique_ptr<RadioPacket[]> ring_;
+    Config config_;
+    bool present_ = false, expander_ = false;
+    float tcxo_ = 1.8f;
+    std::atomic<uint8_t> clients_{0};
+    std::atomic<bool> listening_{false}, configChanged_{false}, probeWanted_{false}, echo_{false};
+    std::atomic<uint32_t> seq_{0}, packets_{0}, crcErrors_{0}, radioErrors_{0}, restarts_{0};
+    std::atomic<uint32_t> preambles_{0}, headers_{0}, headerErrors_{0};
+    std::atomic<uint32_t> lastPacketMs_{0};
+    std::atomic<uint32_t> ringFirst_{1};  // the first seq the current ring can hold
+    std::atomic<bool> sweepWanted_{false}, sweeping_{false};
+    std::atomic<uint32_t> sweepFrom_{863000000}, sweepTo_{870000000}, sweepStep_{100000}, sweepSeq_{0};
+    SweepFrame frame_;  // under lock_
+    std::atomic<float> noise_{0};
+    uint32_t lastNoiseMs_ = 0, echoed_ = 0, sweepEchoMs_ = 0;
+    bool sweepEcho_ = false;
+    Print* probeOut_ = nullptr;
+    static RadioService* instance_;
+};
+
+}  // namespace roro
--- a/Show More
+++ b/Show More