Merge branch 's1': the System App, and traffic counted per service

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

CONTEXT.md

@@ -20,6 +20,10 @@ _Avoid_: daemon, task, driver
 The Service that keeps the device participating in a mesh network at all times: receiving, relaying, and sending on behalf of Apps.
 _Avoid_: radio, LoRa app
 
+**Radio Service**:
+The Service that owns the LoRa radio on the Cap: it configures it, shares the SPI bus with the SD card, and receives in the background. The LoRa Scanner uses it directly; the Mesh Service sits on top of it.
+_Avoid_: LoRa driver, modem
+
 **Mesh Protocol**:
 One on-air language the Mesh Service can speak (Meshtastic first; others may follow). The Mesh Service speaks Mesh Protocols; Apps don't.
 _Avoid_: stack, mode
@@ -40,6 +44,14 @@ _Avoid_: DM (in docs), private message
 Rebroadcasting another Node's packet so it travels further across the mesh.
 _Avoid_: forwarding, repeating
 
+**Capsule**:
+A Gemini site: everything served by one host on Geminispace.
+_Avoid_: site, server (when the content is meant)
+
+**Saved Page**:
+A Gemini page kept on the SD card to read offline, with the URL it came from and when it was saved. Kept until the user deletes it; Storage Clean-up never offers it.
+_Avoid_: cache, download (a download is a non-text file saved from Gemini)
+
 **GNSS Service**:
 The Service that owns the GNSS receiver on the Cap: it reads its NMEA sentences in the background and holds the current Fix, position, time and satellites.
 _Avoid_: GPS (GPS is one constellation among several)
@@ -57,7 +69,7 @@ The Service that owns the Wi-Fi radio. It's always in exactly one mode: *Off*, *
 _Avoid_: network manager
 
 **Saved Network**:
-A Wi-Fi network the device may join on its own (name, password). When several are in range, the strongest wins.
+A Wi-Fi network the device may join on its own: its name, its password, and how it gets its address, *Automatic* (DHCP) or *Fixed* (an address, a prefix and an optional gateway typed in Settings). When several are in range, the strongest wins.
 _Avoid_: profile, known network
 
 **IRC Service**:
@@ -151,6 +163,7 @@ _Avoid_: telnet, remote shell
 - The **Mesh Service** speaks one or more **Mesh Protocols** and tracks the known **Nodes**.
 - The **Wi-Fi Service** is either Connected or Monitoring, never both. Monitoring pauses the **IRC Service**, which reconnects and rejoins its **Buffers** afterwards.
 - **Services** raise **Notifications**; the **Status Bar** summarises **Service** state.
+- The **Radio Service** owns the radio; the **Mesh Service** and the LoRa Scanner use it.
 - A **Sweep** pauses the **Mesh Service**; a **Sniffer** does not.
 - Every transmission is bounded by the **Region** and its **Duty Cycle Budget**.
 - Past 90% SD usage, **Logs** stop being written; the remaining space is kept for **Captures**. Nothing is deleted without the user's confirmation.

README.md

@@ -54,6 +54,34 @@ To install from the SD card instead, copy the `.ota` file from `.pio/build/cardp
 
 **The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB.
 
+## Networks without DHCP
+
+Each Saved Network gets its address automatically (DHCP) or has a Fixed one (docs/milestones/S1.md): in Settings > Wi-Fi, Enter on a network opens its page, where "IP address" switches between Automatic and Fixed, with an address, a prefix length (24 is 255.255.255.0) and an optional gateway. Switching to Fixed starts from what the network is giving the device at that moment. The setting is checked and applied when you leave the page. IPv4 only.
+
+"DNS and NTP" on the same screen holds two DNS servers (9.9.9.9 and 1.1.1.1 by default), used on Fixed networks, or on every network with "Always use my DNS"; and two NTP servers (pool.ntp.org and time.cloudflare.com), used after any the network's DHCP offers. Enter on "Status" shows what's in use and where each value came from.
+
+## System
+
+The System App (docs/milestones/S1.md) shows what the device is doing, live and read-only, in any build. Tab moves between five views:
+
+- **Overview:** each core's load, free memory, network traffic, battery, uptime and chip temperature, and both cores' load over the last two minutes.
+- **Tasks:** every FreeRTOS task with its core, its share of a core over the last second, and the least stack it ever had left (in the warning colour under 512 bytes). `s` sorts by share, stack or name.
+- **Memory:** free heap, the lowest since boot and the largest free block, with two minutes of free heap drawn against the three memory floors (55, 40 and 20 KB).
+- **Network:** the connection, then for IRC, Gemini, the Debug Console and Firmware Updates the bytes read and written since boot and what's moving now. For TLS connections these are the bytes the service sees, without the encryption overhead.
+- **System:** what `info` prints, plus the battery, the SD card with its write faults, the radio and the GNSS receiver.
+
+It samples once a second and keeps its history only while it's open.
+
+## Gemini
+
+The Gemini App browses Geminispace (docs/milestones/G1.md): Tab and Shift+Tab pick a link, Enter follows it, Back returns (to where the page was scrolled), Space pages down, `g` types an address. Certificates are trusted on first use; a changed one stops the page and asks.
+
+On a page, `b` bookmarks it, `s` saves it to the SD card to read offline (a non-text file goes to `/gemini/downloads/`), `S` saves it with the pages it links to on the same capsule (up to 30). The start page lists bookmarks and Saved Pages; inside a Saved Page, `r` refreshes it and `d` deletes it. With a card, every page streams through `/gemini/cache/` so a large one arrives whole even with IRC connected; what doesn't fit in memory stays on the card.
+
+## LoRa Scanner
+
+The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **never transmits**. The Sniffer lists what it hears, newest first: time, RSSI, SNR, and for Meshtastic packets the sender and receiver (their last 4 hex digits) and hops. Enter shows a packet's details: the Meshtastic header (which is never encrypted) and a hex dump. `p` picks one of the 7 Meshtastic presets allowed in EU868 (LongFast by default), `c` starts or stops a Capture: a pcap file with LoRaTap headers in `/captures/lora/`, for Wireshark. A Capture keeps recording with the App closed; otherwise the radio sleeps when the App isn't open. Tab switches to **Sweep**: the signal strength across 863–870 MHz in 100 kHz steps, as bars with peak hold and a waterfall, with the Sniffer's frequency marked; the Sniffer is paused meanwhile and picks up where it was. The Status Bar shows `L` while the radio listens (bright for a moment on each packet), `SW` while sweeping, and `CAP` while capturing.
+
 ## Development aids
 
 `scripts/serial_log.sh [seconds] [command…]` records the serial output, and can send commands to the firmware first. For example, `scripts/serial_log.sh 30 short sleep:12 burst` sets short screen timeouts, waits 12 s, then sends a burst of Toasts.
@@ -65,20 +93,33 @@ To install from the SD card instead, copy the `.ota` file from `.pio/build/cardp
 | `sound on` / `sound off` | Toggles the Sound setting (beep + LED) |
 | `short` / `normal` | Screen timeouts 5 s / 10 s, or 30 s / 60 s |
 | `wifi add <ssid><TAB><password>` | Adds a Saved Network (so credentials stay out of the repo) |
+| `wifi ip <ssid> dhcp` / `wifi ip <ssid> <address>/<prefix> [gateway]` | A Saved Network's IP setting: Automatic, or Fixed. Debug Builds: add `try <seconds>` to go back to the previous setting unless `wifi ip keep` follows |
+| `wifi dns <a> [b]` / `wifi dns always on\|off` / `wifi ntp <a> [b]` | DNS servers (used on Fixed networks, or always), and NTP servers |
 | `log <text>` | Appends a line to a test IRC Log (`/irc/dev/#test/<date>.log`) |
+| `sd card` | What the SD card says it is: type, size, and its identity register (maker, name, revision, serial, date) |
 | `sd list` | Lists the files of each Storage Clean-up category |
 | `cat <path>` | Prints the first ~1.2 KB of a file on the SD card |
 | `irc start` | Starts the IRC Service (normally done by opening the IRC App) |
 | `irc stop` | Stops it, as `/quit` does: QUIT if connected, no more retries, and the App stays disconnected until you type |
+| `gemini get <url>` | Fetches a Gemini page and prints its header, size, certificate fingerprint and heap use |
+| `gemini trust <host> <port> <sha256>` | Pins a certificate by hand (the Gemini App asks when one changes) |
 | `irc say <buffer> <text>` | Types into a Buffer, commands included (`irc say 0 /join #test`) |
 | `irc dump` | Prints IRC status, memory, and the last lines of each Buffer |
-| `wifi status` | Prints Wi-Fi state, network, signal, clock and free heap |
-| `info` | Firmware, uptime, last start reason, memory, Wi-Fi, and both app slots with their versions and OTA states |
-| `tasks` | FreeRTOS tasks: state, priority, lowest free stack, CPU share |
+| `wifi status` | Prints Wi-Fi state, network, signal, clock and free heap, then the address, gateway, DNS and NTP servers in use and where each came from |
+| `info` | Firmware, uptime, last start reason, memory, Wi-Fi, the SD card and its write faults since boot, and both app slots with their versions and OTA states |
+| `tasks` | FreeRTOS tasks over the next second: state, priority, lowest free stack, share of a core, and each core's load |
+| `net` | Bytes each network service has read and written since boot |
 | `reboot` / `boot other` | Restart, or restart into the other app slot (a manual Rollback) |
 | `log level <0-5>` | ESP-IDF log level |
 | `ls [folder]` / `rm <path>` | Lists a folder of the SD card, or deletes a file |
 | `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
+| `lora probe` | Finds the radio: chip, oscillator, antenna switch, DIO1 interrupt, noise floor |
+| `lora status` | Radio settings, who's listening, packet and error counters, noise floor, task stack |
+| `lora rx on` / `lora rx off` | Listens and prints each packet on the console |
+| `lora preset <name>` / `lora custom <MHz> <BW kHz> <SF> <CR> <sync hex> [preamble]` | Receive settings: a Meshtastic preset, or anything else (`lora custom 868.1 125 7 5 34 8` for LoRaWAN) |
+| `lora capture start` / `lora capture stop` | A LoRa Capture, as `c` in the App |
+| `lora sweep on [from MHz] [to MHz] [step kHz]` / `lora sweep off` / `lora sweep dump` | Sweep a band (863 870 100 by default), with a summary every 2 s (floor, strongest, peaks), or print the latest pass |
+| `lora inject <hex> [rssi] [snr]` | Debug Builds: a packet into the Scanner as if received (nothing is sent) |
 | `crash` | The last crash: which firmware, why, task, PC and backtrace (from the core dump in flash) |
 | `coredump erase` | Forgets the core dump |
 | `crash abort` / `crash wdt` | Debug Builds: crash on purpose, or hang the main loop until the watchdog fires |

docs/adr/0007-own-copy-of-the-sd-driver.md

@@ -0,0 +1,20 @@
+# Our own copy of the SD driver, for one missing byte
+
+Arduino-ESP32's `SD` library talks to the card over SPI through `sd_diskio.cpp`. That driver gives up on a write without saying why, and about once in 1,500 multi-block writes it gave up on one that had worked (issue #21). A 1.7 MB upload failed about three times in ten; before M3, the retry on top of it then filled the gap with zeros.
+
+The cause, measured with a driver that records where it stops: after the "Stop Tran" token that ends a multi-block write, a card takes about a byte of clock to signal busy. The driver deselects, selects again, and reads one byte to see whether the card is ready. Read too early, that byte is 0xFF, "ready"; the status check (CMD13) then goes out while the card is still programming, and its answer (0xFF, 0x1F) is taken for an error. Every failure seen was this one: all blocks accepted, then a status that isn't one. ChaN's reference driver, which FatFs ships as its example, sends a dummy byte after selecting the card for this reason. Arduino's doesn't.
+
+PlatformIO links the framework's library objects directly, so one file can't be replaced from `src`. A project library with the same name takes its place: **`lib/SD` is Arduino-ESP32 3.3.12's SD library (Apache-2.0), with `sd_diskio.cpp` changed** and the other files as they came. The changes are marked `roro:`:
+
+- A dummy byte after selecting the card, before the ready test, and one after Stop Tran.
+- Each place a write gives up records the step and the card's answer (`sd_fault.h`): `info` shows the count, and the Debug Console's `put` prints the detail.
+
+Halving the SPI clock to 10 MHz didn't change the failure rate, so the card stays at 20 MHz.
+
+## Consequences
+
+- 30 uploads of 1.7 MB in a row, each read back and compared by SHA-256, ten of them with the LoRa radio listening on the same bus: no write fault. Before: 3 failures in 10.
+- Every writer gains: Logs, Tracks, Gemini pages, Saved Pages, Captures and Update Files installed from the card all go through this driver, and none of them checked.
+- **The copy has to follow the framework.** When the platform is updated, compare `lib/SD` with the new `libraries/SD` and carry the `roro:` changes over. If upstream fixes the ready test, drop the copy. Reported as [arduino-esp32#12970](https://github.com/espressif/arduino-esp32/issues/12970); issue #39 follows it.
+- One more defect was read in the code and left alone, because nothing here exercises it: the driver tests the card's answer to a data block against 0x0A and 0x0C, values it can't take (accepted is 0x05, CRC error 0x0B, write error 0x0D), so a block rejected for a CRC error is never resent. No such rejection was seen in any failure. If `DataToken` faults ever show in `info`, that's the next fix.
+- A fault is now counted and explained instead of silent, so the next cause, if there is one, starts with evidence.

docs/milestones/G1.md

@@ -0,0 +1,61 @@
+# G1 — Gemini client
+
+**Status:** done, tagged v0.5.0. Every step was checked on the device; reading Saved Pages with Wi-Fi off was checked by hand (2026-10-05).
+
+**Goal:** browse Geminispace from the Cardputer: fetch and read gemtext over TLS, follow links, answer input prompts, keep bookmarks, and save pages to the SD card to read later, offline. A side milestone between M2 and M3, tagged v0.5.0 when done.
+
+Gemini (geminiprotocol.net): one request per TLS connection on port 1965, the request is the URL and CRLF, the response a `<status> <meta>` header line, then the body. Most capsules use self-signed certificates: trust on first use is the norm.
+
+## Decisions (design round 2026-10-05)
+
+| # | Decision |
+|---|---|
+| Q70 | A milestone of its own, **G1**, before M3: plan, tests first, measured on the device, tagged v0.5.0. |
+| Q71 | **TOFU:** the first certificate seen for a host is pinned (SHA-256, in NVS). If it changes, the page isn't shown; a dialog shows both fingerprints and asks whether to trust the new one. Self-signed or expired certificates are fine; only a change counts. |
+| Q72 | Responses: 1x input (11 hidden, for passwords), 2x content, up to 5 redirects (3x), 4x/5x errors with the server's message. 6x (client certificates): "not supported". |
+| Q73 | `text/gemini` is rendered, other `text/*` shown as plain text. Anything else can be saved to `/gemini/downloads/`, not shown. |
+| Q74 | Up to **64 KB on screen**, larger pages truncated with a notice. Saving streams to the card, so a larger page is saved whole. |
+| Q75 | Gemtext rendering: text wrapped to the 40-column screen; `#`/`##`/`###` headings in bold and accent; `*` lists with bullets; `>` quotes indented and muted; preformatted blocks unwrapped, Left/Right to scroll; `=>` links with their label, numbered. |
+| Q76 | Up/Down scroll; Tab and Shift+Tab move between links; Enter follows; Backspace goes back; `g` opens the address line. Links to other protocols show their URL and aren't followed. |
+| Q77 | Back history of 20 URLs in RAM, with scroll positions; going back refetches (or reopens a Saved Page). **Bookmarks** in `/gemini/bookmarks.gmi` (a gemtext page, shown on the start page); `b` adds the current page. Without a card, a built-in start page. |
+| Q78 | Start page: bookmarks, then Saved Pages, then defaults: geminiprotocol.net, a search engine (kennedy.gemi.dev), an aggregator (Cosmos; Antenna was down when measured). |
+| Q79 | UTF-8 decoded; characters outside the Latin-1 fonts shown as `?`. |
+| Q80 | IRC and Gemini can run together: each fetch opens one connection, reads and closes it. If there isn't memory for a second TLS connection, the fetch fails with a clear message and IRC is untouched. Measured in step 1. |
+| Q81 | Debug aid: `gemini get <url>` prints the status, MIME type, size, certificate fingerprint and the first lines. URL resolution (RFC 3986), the response header and gemtext parsing are host-tested. |
+| Q82 | `s` saves the page on screen as a **Saved Page**: `/gemini/saved/<host>/<path>.gmi`, the gemtext as received plus a first line with its URL and save date. Saving again replaces it, and says so. |
+| Q83 | `S` saves the page and the pages it links to, one level deep: gemtext only, same host only, at most 30 pages, in the background with a progress Toast. |
+| Q84 | The start page lists Saved Pages, newest first, grouped by capsule; they open with no network. In a Saved Page, a link to another Saved Page opens the saved copy; other links fetch online if Wi-Fi is up, or say "not saved, offline". A Saved Page shows when it was saved; `r` refreshes it. |
+| Q86 | *Decided after step 1, revised after Q88.* **Two floors:** free heap stays above 40 KB in steady state; a fetch refuses to start below **55 KB** free ("not enough memory: stop IRC or retry"). The firmware's own allocations during a fetch (a page in RAM, a window) keep 20 KB free. With IRC connected, the TLS connection itself can briefly take the heap lower, depending on the server's record sizes: measured 24, 19.5, 15.5 and **13 KB**. *Accepted:* about 12 KB for a moment during a fetch with IRC up, rather than refusing most fetches (a 70 KB start floor) or dropping IRC's connection for each page. |
+| Q87 | *Decided in step 3.* **With a card, every page streams to `/gemini/cache/page.gmi`** in 1 KB pieces while its TLS connection is open; once the connection closes and its ~45 KB is back, the page is loaded into RAM as far as the 40 KB floor allows. The whole page stays on the card (Saved Pages copy it). Without a card, the page goes straight to RAM under the same two floors. Pages are held as lines in 4 KB chunks, never one large block (the largest free block with IRC connected is about 31 KB). |
+| Q88 | *Added after step 6.* **A page bigger than memory allows is read from the card as you scroll.** Opening it, one pass over its file counts the lines, records where every 64th starts (and whether it's inside a preformatted block), and loads the first window. Scrolling near either end of the window reads the next or previous one in the background, keeping the line on top of the screen where it is; the scrollbar follows the whole page. Display pages alternate between two cache files, so the one on screen is never overwritten by the next fetch; background jobs use a third. |
+| Q85 | Saved Pages are deleted from the App only (`d`, with confirmation), never by Storage Clean-up's age rules, like Notes. |
+
+## Measured (step 1)
+
+- `gemini://geminiprotocol.net/`: `20 text/gemini`, 1,184 bytes, TLS handshake 0.7–1.1 s, whole fetch 0.7–1.1 s; kennedy.gemi.dev 1.9 s. The fetch task's stack peaks at about 3.6 KB of 6.
+- **Heap, Debug Build, IRC connected over TLS:** about 68 KB free before a fetch. After the handshake the fetch holds about 32 KB (36–40 KB left); the handshake itself (certificate chain parsed with the 16 KB receive buffer allocated) dips to about **24 KB** for a second or two. Nothing leaks: the heap after matches the heap before.
+- **Step 3, Cosmos (31.6 KB) with IRC connected:** first stopped at 4.6 KB (RAM only, the transfer's 20 KB floor). Streamed to the card: the whole page on the card, 20 KB of it loaded, lowest free heap 19.5 KB during the transfer and 43 KB once loaded. Without IRC: the whole page in RAM. Redirects (Cosmos `31`), input (`10`), not found (`51`) and a changed certificate (refused, both fingerprints shown) all checked on the device.
+- **Steps 4–6 on the device:** Project Gemini and its relative links, Back with the scroll restored, a refused YouTube link; `b` bookmarks, `s` saves (and says when it replaced an older copy), `S` saved 6 of 6 pages, the start page lists both; a Saved Page opens from the card with its origin, its saved links open saved copies, `r` refreshes, `d` asks first; Kennedy's input prompt sent "cardputer" and got 87 results; emoji drawn as `?`.
+- **A bug found there:** refreshing first loaded the whole Saved Page into RAM just to read its origin, next to the App's copy and a TLS connection: the heap fell to 436 bytes. Now only the first line is read, and every fetch (pages, saves, refreshes) checks the 55 KB start floor. Lowest since boot afterwards: 53.8 KB.
+- **Windowed pages (Q88), Cosmos with IRC connected:** 226 of 419 lines in memory at first; paging down loaded lines 192–419 in one window, scrolling back up loaded 64 onwards, then 0 onwards. Window budgets count the memory the old window gives back.
+- **Heap during a fetch with IRC connected:** lowest 13–15.5 KB in later runs (24 and 19.5 KB earlier), the TLS receive buffers varying with the server's records. Accepted (Q86, revised).
+- Antenna (`warmedal.se`) doesn't answer, from the PC either; the default aggregator becomes Cosmos (`gemini://skyjake.fi/~Cosmos/`, which redirects to `cosmos.skyjake.fi`).
+
+## Done when
+
+- `gemini get gemini://geminiprotocol.net/` prints the header, size and fingerprint on the console.
+- The Gemini App opens the start page, follows links (relative ones included), goes back, and follows redirects.
+- An input prompt (e.g. a search) takes a query and shows the results.
+- A changed certificate stops the page and asks.
+- `s` saves a page, `S` a page and its links; with Wi-Fi off, Saved Pages open and their saved links work.
+- Bookmarks are added with `b` and listed on the start page.
+- With IRC connected over TLS, a fetch still works, and the free heap stays above 40 KB.
+
+## Work breakdown
+
+1. **Two TLS connections:** measure the heap with IRC connected while a Gemini fetch runs.
+2. **Parsers** (host-tested): URL parsing and relative resolution, the response header, gemtext lines.
+3. **Fetch** on its own task, with TOFU and `gemini get`.
+4. **Gemini App:** rendering, scrolling, links, history, the address line.
+5. **Input prompts, redirects, bookmarks, downloads.**
+6. **Saved Pages,** then saving with linked pages.

docs/milestones/M3.md

@@ -0,0 +1,69 @@
+# M3 — Radio bring-up: the LoRa Scanner
+
+**Status:** done, tagged v0.6.0. Everything was checked on the device except one "Done when" item: Sweep was never tried against a known transmitter (see below). The listening hour heard nothing, so by Q104 **a reference Meshtastic node is a requirement for M4**.
+
+**Goal:** the LoRa radio on the Cap works, receive only: a Radio Service owns it and shares the SPI bus with the SD card safely, and a LoRa Scanner App shows what's on the air, either packets (Sniffer) or energy across the band (Sweep). Nothing in M3 can transmit. The mesh comes on top of this in M4 (receive) and M5 (transmit).
+
+**Hardware:** the Cap LoRa-1262 carries an SX1262 (868–923 MHz, +22 dBm) with an RP-SMA antenna. Pins, as in Meshtastic's board file for the Cardputer ADV: **NSS 5, RST 3, DIO1 (IRQ) 4, BUSY 6**, on the SPI bus shared with the microSD card (SCK 40, MISO 39, MOSI 14; card CS 12). Meshtastic uses DIO2 as the RF switch and DIO3 for a 1.8 V TCXO, marked optional. M5Stack's page adds an FM8625H antenna switch enabled by P0 of a PI4IOE5V6408 I/O expander on the internal I2C bus, address not given; Meshtastic doesn't mention it. Step 1 measures which is true.
+
+**No other LoRa device yet.** meshmap.net (2026-10-05) lists two Meshtastic nodes within 10 km of the desk and six within 30 km, with positions blurred by a few km; none is known to be in range. M3 needs none: it only receives.
+
+## Measured
+
+- **Internal I2C bus (8/9):** 0x18 (ES8311 codec), 0x34 (TCA8418 keyboard), **0x43 (PI4IOE5V6408, ID register 0xA2)**, 0x69 (BMI270 IMU).
+- **The SX1262 answers** on NSS 5, RST 3, DIO1 4, BUSY 6. Its version string reads `SX1261 V2D 2D02`, which SX1262 chips report too. **The 1.8 V TCXO works** on the first try; the radio is ready 38 ms after `begin`.
+- **The expander's P0 connects the antenna; it's required.** At power-on P0 is an input (direction 0x00, high-impedance 0xFF), and the receiver reads a flat **-111.9 dBm** at 869.525 MHz, BW 250 kHz: the chip's own floor, deaf. With P0 driven high, the noise floor is **-87 to -94 dBm**: the antenna hearing the room. So the Radio Service drives P0 high at boot (Q91).
+- **DIO2 doesn't change reception** (within ±2 dB over three runs, P0 high). It likely selects TX versus RX in the FM8625H; it stays the RF switch, as in Meshtastic.
+- **The noise floor at the desk is high** (-87 to -94 dBm, varying run to run), about 25 dB above thermal noise for 250 kHz. Something nearby is loud, possibly the Cardputer itself or the PC; Sweep (step 5) should show where it sits.
+- **Step 2:** presets, frequencies and the channel hash are checked against Meshtastic's source (`MeshRadio.h`, `RadioInterface.cpp`): LongFast and the default key give hash 8, MediumFast 31, as Meshtastic shows. Captures were checked with TShark 4.2.5: every LoRaTap field reads back. Wireshark ignores the spec's quarter-dB packet RSSI below 0 dB SNR, so packet RSSI is plain dBm.
+- **Step 3:** the DIO1 interrupt works (a 100 ms receive timeout wakes the task after 105 ms). While listening: four 1.7 MB uploads and Gemini pages to the card, no radio or card errors (the card refuses a write about once in five uploads with the radio asleep too; `put` now catches it, and issue #21 follows the cause). The ring takes 9.8 KB while listening; the radio task's stack peaks at 2.0 KB.
+- **No packets yet, and a loud desk.** Twenty minutes on LongFast and on LoRaWAN's three uplink frequencies (SF7, SF9, SF12): no packet and no header, valid or not. The noise floor reads -83 to -94 dBm, against -112 dBm with the antenna switched off: 20 to 30 dB lost to something nearby, not the screen and not the GNSS receiver. Preamble detections are false alarms at this noise level (more on an empty frequency, 869.0 MHz, than on LongFast).
+- **Step 4:** a Capture made on the device reads back in TShark field for field (time, frequency, SF, RSSI, SNR, payload). A Capture keeps the radio listening with the App closed; stopping it puts the radio back to sleep.
+- **Step 5:** a pass across 863–870 MHz (71 steps, the strongest of three RSSI readings at each, measured at 125 kHz) takes about 607 ms. At the desk the band is **flat at -100 to -102 dBm**, about 15 dB above the chip's own floor at 125 kHz, with a steady carrier at 863.2 MHz (-89 dBm at its strongest) and fainter lines elsewhere: broadband noise from nearby electronics rather than a transmitter. Sweep's waterfall takes 2.6 KB while shown; 91.9 KB free during a Sweep. The radio task's stack peaks at 1.9 KB.
+- **Outside, on battery (step 6).** The noise is no lower than at the desk: a Sweep floor of -96 to -99 dBm (median -97) with Wi-Fi on, -99 to -100 with Wi-Fi off, so Wi-Fi accounts for 2 or 3 dB. The same narrow peaks come back on every pass, at 863.2, 863.6, 864.4, 864.8, 865.9, 866.3, 867.8, 869.0 and 869.4 MHz (-88 to -91 dBm), several of them 400 kHz apart; 869.4 MHz is the lower edge of LongFast's channel. A source that follows the device outside and onto its battery is the device: **about 15 dB of the floor is the Cardputer's own** (issue #20). At SF11 that puts the weakest decodable packet near -114 dBm on LongFast, against about -130 dBm for a quiet receiver.
+- **The listening hour (step 6, Q104):** 20:33 to 21:34 on 2026-10-05, outside, on battery, LongFast, with a Capture running. **0 packets, 0 headers**, 0 radio errors; noise -85 to -87 dBm at 250 kHz throughout; 860 preamble detections, all false alarms. The Capture holds its 24-byte header and nothing else. No restart in 1 h 10 min.
+- **Floors (Q86):** with the radio listening, Wi-Fi and IRC connected over TLS, 52.6 KB free (lowest 22.7 KB during the TLS handshake, the dip accepted in G1). Without IRC, 93 KB.
+- **Receive only:** nothing in `src` or `lib` calls a transmit function.
+- **Cost:** RadioLib 7.8.1 and the probe add 23.6 KB of flash and 656 bytes of static RAM to the release firmware (1,679,843 bytes of 3,342,336). The whole milestone: 51.8 KB of flash (1,708,091 bytes), 365 tests (27 new).
+
+## Decisions (design round 2026-10-05)
+
+| # | Decision |
+|---|---|
+| Q89 | **M3 is the radio only:** Radio Service, Sniffer, Sweep. Notes and the File Browser (Q30) move out to issue #3 and a Notes issue, as a later side milestone. |
+| Q90 | **RadioLib**, pinned (ADR 0001). SX1262 on NSS 5, RST 3, DIO1 4, BUSY 6; DIO2 as RF switch; TCXO at 1.8 V tried first, falling back to the crystal (Meshtastic's `TCXO_OPTIONAL`). |
+| Q91 | Step 1 is `lora probe`: chip status and version, which oscillator setting worked, and an I2C scan of the internal bus for the PI4IOE5V6408. If present, its P0 is set high at boot (harmless) and DIO2 stays the switch. A wrong switch receives deaf, so compare noise floors. |
+| Q92 | A **Radio Service** owns the SX1262: driver, bus lock, IRQ task. The LoRa Scanner uses it in M3; the Mesh Service sits on top of it in M4. |
+| Q93 | Every radio transfer takes the shared bus lock (`SPI.beginTransaction`, as the card does). DIO1's interrupt only wakes the task; no SPI in the ISR. **Done when** a Gemini page streams to the card while the Sniffer receives, with no lost packets and no card errors (`lora status` counters). |
+| Q94 | **Receive only:** the Radio Service has no transmit function in M3. It doesn't exist, rather than being unused. |
+| Q95 | Sniffer defaults: **EU868 LongFast**, 869.525 MHz, BW 250 kHz, SF 11, CR 4/5, sync word 0x2B, preamble 16 (Q19). The other Meshtastic presets are offered, plus custom settings. |
+| Q96 | The Sniffer lists packets (time, RSSI, SNR, frequency error, length; hex dump on Enter) **and decodes the Meshtastic header**: the first 16 bytes are never encrypted (destination, sender, packet ID, hop limit and hop start, channel hash, next hop, relay node). Host-tested. Payload decryption is M4. |
+| Q97 | A Sniffer **Capture** is pcap with **LoRaTap** headers (link type 270), for Wireshark. Started by hand, Status Bar mark, its own Clean-up category, the 90% rule. |
+| Q98 | **Sweep** steps across the Region's band (863–870 MHz) in 100 kHz steps by default, reading instant RSSI: bars with peak hold, and a waterfall, Wi-Fi Tools style. Optionally CAD on the preset's frequency to tell LoRa traffic from noise. |
+| Q99 | Sweep takes the radio and pauses the Sniffer, visibly (Q18). From M4 it pauses the Mesh Service the same way. |
+| Q100 | The Sniffer runs while the App is open **or a Capture is recording**; otherwise the radio sleeps. From M4 the Mesh Service keeps it on. |
+| Q101 | **Status Bar:** a radio mark while receiving, flashing on each packet; muted during a Sweep. |
+| Q102 | Debug aids: `lora status` (settings, counters, last RSSI/SNR, noise floor), `lora probe`, `lora rx on/off` (packets on the consoles). Raw packets are never written to the card outside a Capture. |
+| Q103 | A ring of the **last 32 packets** in RAM (about 9 KB at full length); older ones are dropped unless capturing. IRQ task stack trimmed by measurement; RadioLib's flash and RAM measured in step 1 against the floors. |
+| Q104 | **Done when** (below) includes an hour of listening on LongFast by a window. Real packets heard become M4 test fixtures. If none are heard, M3 still closes, and a reference Meshtastic node (Q21) becomes a requirement for M4. |
+
+## Done when
+
+- `lora probe` reports the SX1262, its oscillator setting and the RF switch arrangement, and the result is written here.
+- The Sniffer receives on LongFast with the App open or a Capture running, and the radio sleeps otherwise.
+- Sweep shows the noise floor across 863–870 MHz, and a known signal (a remote key fob, a 868 MHz sensor, anything) stands out. *Half met: the floor and the device's own steady peaks show; no known transmitter was tried.*
+- The shared-bus test passes (Q93): a Gemini page to the card while the Sniffer receives, no lost packets, no card errors.
+- A Capture opens in Wireshark with LoRaTap fields.
+- The Status Bar mark follows Q101.
+- One hour of LongFast listening by a window has been run and its result recorded here. *Run outside, on battery.*
+- Free heap stays above the floors (Q86) with the Sniffer, Wi-Fi, IRC on TLS and the UI running.
+- Nothing in the firmware can transmit.
+
+## Work breakdown
+
+1. **Hardware check:** RadioLib in the build, `lora probe` (Q91), flash and RAM cost measured.
+2. **Meshtastic header and LoRaTap** (host-tested): header parsing, presets and their radio settings, pcap/LoRaTap writing.
+3. **Radio Service:** receive on its own task behind the bus lock, the packet ring, `lora status` and `lora rx`, the shared-bus test.
+4. **LoRa Scanner App, Sniffer:** the packet list, details, preset choice, Captures, Status Bar mark.
+5. **Sweep:** the RSSI sweep, bars and waterfall, pausing the Sniffer.
+6. **Listening hour** and the measurements above, recorded here.

docs/milestones/S1.md

@@ -0,0 +1,92 @@
+# S1 — System basics
+
+**Status:** the three planned items are done: the SD driver fix in v0.6.1 (issue #21, ADR 0007), fixed IPv4 settings in v0.7.0 (issue #7), the System App in v0.8.0 (issue #11). Still open in the milestone: #39, following the SD driver upstream, and #40, the main loop's CPU use.
+
+**Goal:** the device works on any network, the card can be trusted, and you can see what the system is doing. A side milestone, like G1.
+
+## Fixed IPv4, DNS and NTP (issue #7)
+
+Not every network has a DHCP server: a lab bench, a direct link to a router, a network where addresses are handed out by hand. Until now every Saved Network used DHCP, DNS always came from DHCP, and the NTP server was `pool.ntp.org`, hard-coded.
+
+**IPv4 only.** IPv6 isn't part of this, now or as a planned follow-up.
+
+### Decisions (design round 2026-10-05)
+
+| # | Decision |
+|---|---|
+| Q105 | The IP setting is **per Saved Network**: *Automatic* (DHCP, as before) or *Fixed*, with its own address, prefix and gateway. New networks start Automatic. |
+| Q106 | The subnet is entered as a **prefix length** (`24`), with the mask shown next to it. |
+| Q107 | The **gateway is optional**: left empty, the device talks to its own subnet only. |
+| Q108 | **DNS is global:** two servers in Settings, used on every Fixed network. On Automatic networks DHCP's DNS is used, unless **"Always use my DNS"** is on. |
+| Q109 | DNS defaults: **9.9.9.9** (Quad9), then **1.1.1.1** (Cloudflare). |
+| Q110 | **NTP is global:** two servers in Settings, names or addresses, defaulting to `pool.ntp.org` and `time.cloudflare.com`. NTP servers offered by DHCP are used first. GNSS still outranks NTP for the clock. |
+| Q111 | What's typed is checked, host-tested in `lib/wifi`: an address is four numbers from 0 to 255; a prefix is 1 to 30; the address isn't the subnet's network or broadcast address; the gateway is inside the subnet and isn't the device's own address. Refusals say why. |
+| Q112 | Addresses are typed in the line editor, limited to digits and dots. |
+| Q113 | Enter on a Saved Network opens **its page** (IP, Address, Prefix, Gateway, Forget) instead of asking to forget it. Settings > Wi-Fi gains DNS servers, "Always use my DNS" and NTP servers. The Status row opens **connection details**: address, mask, gateway, DNS and NTP in use, and where each came from. |
+| Q114 | A change applies **at once**: the network in use reconnects with the new settings. No automatic way back; the keyboard still works if Wi-Fi is cut. |
+| Q115 | Console: `wifi status` shows address, gateway, DNS, NTP and their sources; `wifi ip <ssid> dhcp`, `wifi ip <ssid> <address>/<prefix> [gateway]`, `wifi dns <a> [b]`, `wifi ntp <a> [b]`. Debug Builds: `wifi ip … try 60` goes back to the previous setting after 60 s unless confirmed with `wifi ip keep`. |
+| Q116 | Left out: checking whether the address is already taken, and per-network DNS. |
+
+The SDK already allows 3 NTP servers and 3 DNS servers and can take NTP servers from DHCP (`CONFIG_LWIP_SNTP_MAX_SERVERS=3`, `CONFIG_LWIP_DHCP_GET_NTP_SRV=y`), so the framework isn't rebuilt for this.
+
+### Done when
+
+- A Saved Network set to Fixed joins with that address, mask and gateway, and the device reaches the internet (IRC, Gemini, NTP) through the DNS servers from Settings.
+- Set back to Automatic, it gets its address from DHCP again.
+- With "Always use my DNS" on, an Automatic network resolves through the servers from Settings.
+- The NTP servers from Settings set the clock.
+- Wrong entries are refused with a reason, in Settings and on the console.
+- Connection details show what's in use and where it came from.
+- Tested on `knbg-guests` with 10.39.39.12 (the device's DHCP lease) and 10.39.39.13 (free: the device is alone on that network).
+
+### Measured (2026-10-05 and 06, on `knbg-guests`)
+
+The network is 10.39.39.0/24, gateway 10.39.39.1; DHCP gives 10.39.39.1 as DNS and offers no NTP server.
+
+- **Fixed 10.39.39.12/24** (the device's own lease) and **Fixed 10.39.39.13/24**, gateway 10.39.39.1: the device joins with that address, DNS is 9.9.9.9 and 1.1.1.1 from Settings, and a Gemini page loads (name resolution, routing, TLS). On .13, .12 no longer answers.
+- **A wrong gateway** (10.39.39.254) on a 60 s trial: the device stops answering from another subnet, and comes back by itself with the previous setting.
+- **Back to Automatic:** 10.39.39.12 by DHCP again, DNS 10.39.39.1 from DHCP.
+- **"Always use my DNS"** on an Automatic network: DNS becomes 9.9.9.9 and 1.1.1.1; switched off, the device joins again and has DHCP's DNS back.
+- **NTP:** `pool.ntp.org` answers; set to `time.cloudflare.com` alone, that one answers within 25 s.
+- **Refusals**, on the console and in Settings: the network's own address, a gateway outside the subnet, a prefix of 31 or 99, 10.39.39.300, an unknown network, a DNS name where an address is needed, a host name with an underscore.
+- **In Settings:** the network's page pre-fills Fixed with the address, prefix and gateway in use; leaving the page applies it; connection details show each value and where it came from.
+- **Not tested:** NTP servers offered by DHCP (this network offers none), and a Fixed network with no gateway.
+
+### Work breakdown
+
+1. **IPv4 logic** (host-tested): parsing and formatting addresses, prefix and mask, the checks of Q111.
+2. **Storage:** the IP setting in each Saved Network; DNS, "Always use my DNS" and NTP in Settings.
+3. **Wi-Fi Service:** apply it when joining; DNS and NTP; `wifi status` and the console commands.
+4. **Settings:** the network page, the DNS and NTP rows, connection details.
+5. **Tests on the device**, recorded here.
+
+## System Monitor (issue #11)
+
+Every milestone so far was driven by measurements, heap floors, stack sizes, TLS dips, that needed a Debug Build and a computer. The System App shows them on the device, in any build.
+
+### Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q117 | An App of its own, **System**, in release builds too. Read-only. |
+| Q118 | Four views, switched with Tab: **Overview** (CPU per core, memory, network, battery), **Tasks**, **Memory**, **System**. |
+| Q119 | Sampled once a second. A task's share is its run time over the last second; a core's load is 100 % minus its idle task's share. |
+| Q120 | **History only while the App is open:** two minutes at one sample a second, about 1 KB. The system already keeps what matters afterwards: the lowest free heap since boot and each task's lowest free stack. |
+| Q121 | **Bytes are counted per service:** IRC, Gemini, the Debug Console and Firmware Updates add what they read and write to a shared counter. The network view shows the connection details, each service's bytes in and out, and the signal strength. |
+| Q122 | Tasks: name, core, share, state and lowest free stack, sorted by share; `s` cycles the sort (share, stack, name). **Under 512 bytes of stack left shows in the warning colour.** |
+| Q123 | Memory: free heap, lowest since boot, largest free block, and a two-minute graph of free heap **with the floors of Q86 drawn as lines** (55, 40 and 20 KB). |
+| Q124 | System: uptime and why it last started, firmware and both app slots, chip temperature and CPU frequency, battery voltage and percentage, SD usage and write faults, the radio's and the GNSS receiver's state. |
+| Q125 | `info` and `tasks` are split into a **snapshot** that the console and the App share; the arithmetic (shares from two samples, sorting, the stack warning) is host-tested. |
+| Q126 | Left out: acting on tasks, an event log, exporting snapshots to the card. |
+| Q127 | The main loop uses about 81 % of a core. The App shows it; fixing it is issue #40, not part of #11. |
+
+The App has five views, not four: Q121's network view is one of its own (Overview, Tasks, Memory, Network, System).
+
+### Measured (2026-10-06)
+
+- **Traffic counters are exact.** A Gemini fetch of a 164,970-byte page counts 164,986 bytes in (the page and its 16-byte header line) and 42 out (the 40-character URL and CRLF). A 1,797,760-byte upload counts 1,798,123 in for the Debug Console, commands included.
+- **The Memory view shows a TLS dip as it happens.** Starting IRC and a 165 KB Gemini fetch together: free heap falls from about 100 KB through the three floors to a low of 12.1 KB, then settles near 50 KB. That's the dip accepted in G1 (Q86).
+- **A run-time counter only moves when its task is switched out.** FreeRTOS adds to a task's run time at the context switch. The main loop takes the samples, and with core 1 to itself it's never switched out: its counter said 2 % while the core's idle task had 0 %. So the task that samples gets what's left of its core. With that: **the main loop uses 100 % of core 1 at rest** (issue #40 said 81 %, an average since boot).
+- **`tasks` on the console** sampled twice inside one command at first, a quarter second apart, and showed the loop at 1 %: it was asleep in the command's own wait. It now samples, lets the loop run for a second, and prints.
+- **Low stack, flagged:** `IDLE0` (232 bytes left), `IDLE1` (328 to 352) and `spk_task` (256 to 264), all the framework's own tasks.
+- **Cost:** 15.6 KB of flash for the App and the counters (1,742,723 bytes, release). Nothing while it's closed; about 2 KB of history and samples while it's open.

lib/SD/library.json

@@ -0,0 +1,7 @@
+{
+  "name": "SD",
+  "version": "3.3.12",
+  "description": "roro9stack's copy of Arduino-ESP32's SD library (Apache-2.0), shadowing the framework's. Only sd_diskio.cpp is changed (marked \"roro:\"): it records why a write failed and resends a block the card rejects. See issue #21.",
+  "frameworks": "arduino",
+  "platforms": "espressif32"
+}

lib/SD/src/SD.cpp

@@ -0,0 +1,134 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "vfs_api.h"
+#include "sd_diskio.h"
+#include "ff.h"
+#include "FS.h"
+#include "SD.h"
+
+using namespace fs;
+
+SDFS::SDFS(FSImplPtr impl) : FS(impl), _pdrv(0xFF) {}
+
+SDFS::~SDFS() {
+  end();
+}
+
+bool SDFS::begin(uint8_t ssPin, SPIClass &spi, uint32_t frequency, const char *mountpoint, uint8_t max_files, bool format_if_empty) {
+  if (_pdrv != 0xFF) {
+    return true;
+  }
+
+  if (!spi.begin()) {
+    return false;
+  }
+
+  _pdrv = sdcard_init(ssPin, &spi, frequency);
+  if (_pdrv == 0xFF) {
+    return false;
+  }
+
+  if (!sdcard_mount(_pdrv, mountpoint, max_files, format_if_empty)) {
+    sdcard_unmount(_pdrv);
+    sdcard_uninit(_pdrv);
+    _pdrv = 0xFF;
+    return false;
+  }
+
+  _impl->mountpoint(mountpoint);
+  return true;
+}
+
+void SDFS::end() {
+  if (_pdrv != 0xFF) {
+    _impl->mountpoint(NULL);
+    sdcard_unmount(_pdrv);
+
+    sdcard_uninit(_pdrv);
+    _pdrv = 0xFF;
+  }
+}
+
+sdcard_type_t SDFS::cardType() {
+  if (_pdrv == 0xFF) {
+    return CARD_NONE;
+  }
+  return sdcard_type(_pdrv);
+}
+
+uint64_t SDFS::cardSize() {
+  if (_pdrv == 0xFF) {
+    return 0;
+  }
+  size_t sectors = sdcard_num_sectors(_pdrv);
+  size_t sectorSize = sdcard_sector_size(_pdrv);
+  return (uint64_t)sectors * sectorSize;
+}
+
+size_t SDFS::numSectors() {
+  if (_pdrv == 0xFF) {
+    return 0;
+  }
+  return sdcard_num_sectors(_pdrv);
+}
+
+size_t SDFS::sectorSize() {
+  if (_pdrv == 0xFF) {
+    return 0;
+  }
+  return sdcard_sector_size(_pdrv);
+}
+
+uint64_t SDFS::totalBytes() {
+  FATFS *fsinfo;
+  DWORD fre_clust;
+  char drv[3] = {(char)(48 + _pdrv), ':', 0};
+  if (f_getfree(drv, &fre_clust, &fsinfo) != 0) {
+    return 0;
+  }
+  uint64_t size = ((uint64_t)(fsinfo->csize)) * (fsinfo->n_fatent - 2)
+#if _MAX_SS != 512
+                  * (fsinfo->ssize);
+#else
+                  * 512;
+#endif
+  return size;
+}
+
+uint64_t SDFS::usedBytes() {
+  FATFS *fsinfo;
+  DWORD fre_clust;
+  char drv[3] = {(char)(48 + _pdrv), ':', 0};
+  if (f_getfree(drv, &fre_clust, &fsinfo) != 0) {
+    return 0;
+  }
+  uint64_t size = ((uint64_t)(fsinfo->csize)) * ((fsinfo->n_fatent - 2) - (fsinfo->free_clst))
+#if _MAX_SS != 512
+                  * (fsinfo->ssize);
+#else
+                  * 512;
+#endif
+  return size;
+}
+
+bool SDFS::readRAW(uint8_t *buffer, uint32_t sector) {
+  return sd_read_raw(_pdrv, buffer, sector);
+}
+
+bool SDFS::writeRAW(uint8_t *buffer, uint32_t sector) {
+  return sd_write_raw(_pdrv, buffer, sector);
+}
+
+SDFS SD = SDFS(FSImplPtr(new VFSImpl()));

lib/SD/src/SD.h

@@ -0,0 +1,55 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#ifndef _SD_H_
+#define _SD_H_
+
+#include "FS.h"
+#include "SPI.h"
+#include "sd_defines.h"
+
+namespace fs {
+
+class SDFS : public FS {
+protected:
+  uint8_t _pdrv;
+
+public:
+  SDFS(FSImplPtr impl);
+  ~SDFS();
+  bool begin(
+    uint8_t ssPin = SS, SPIClass &spi = SPI, uint32_t frequency = 4000000, const char *mountpoint = "/sd", uint8_t max_files = 5, bool format_if_empty = false
+  );
+  void end();
+  sdcard_type_t cardType();
+  uint64_t cardSize();
+  size_t numSectors();
+  size_t sectorSize();
+  uint64_t totalBytes();
+  uint64_t usedBytes();
+  bool readRAW(uint8_t *buffer, uint32_t sector);
+  bool writeRAW(uint8_t *buffer, uint32_t sector);
+};
+
+}  // namespace fs
+
+#if !defined(NO_GLOBAL_INSTANCES) && !defined(NO_GLOBAL_SD)
+extern fs::SDFS SD;
+#endif
+
+using namespace fs;
+typedef fs::File SDFile;
+typedef fs::SDFS SDFileSystemClass;
+#define SDFileSystem SD
+
+#endif /* _SD_H_ */

lib/SD/src/sd_defines.h

@@ -0,0 +1,25 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#ifndef _SD_DEFINES_H_
+#define _SD_DEFINES_H_
+
+typedef enum {
+  CARD_NONE,
+  CARD_MMC,
+  CARD_SD,
+  CARD_SDHC,
+  CARD_UNKNOWN
+} sdcard_type_t;
+
+#endif /* _SD_DISKIO_H_ */

lib/SD/src/sd_diskio.cpp

@@ -0,0 +1,949 @@
+// roro9stack's copy of the SD-over-SPI driver from Arduino-ESP32 3.3.12 (libraries/SD/src/
+// sd_diskio.cpp), linked instead of the framework's: defining every function the SD class needs
+// keeps the library's file out of the link. Changes are marked "roro:". Why (issue #21): the
+// original gives up on a write without saying why, and never resends a block the card rejects.
+//
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Disable the automatic pin remapping of the API calls in this file
+#define ARDUINO_CORE_BUILD
+
+#include "Arduino.h"
+#include "sd_diskio.h"
+#include "esp_system.h"
+#include "esp32-hal-periman.h"
+
+extern "C" {
+#include "ff.h"
+#include "diskio.h"
+#if ESP_IDF_VERSION_MAJOR > 3
+#include "diskio_impl.h"
+#endif
+//#include "esp_vfs.h"
+#include "esp_vfs_fat.h"
+
+char CRC7(const char *data, int length);
+unsigned short CRC16(const char *data, int length);
+}
+
+// roro: why the last write failed.
+#include "sd_fault.h"
+static roro::SdFault s_fault;
+static bool sdFault(roro::SdFault::Step step, uint8_t token = 0, uint32_t resp = 0) {
+  s_fault.step = step;
+  s_fault.token = token;
+  s_fault.resp = resp;
+  s_fault.count++;
+  return false;
+}
+namespace roro {
+SdFault sdLastFault() { return s_fault; }
+}  // namespace roro
+
+typedef enum {
+  GO_IDLE_STATE = 0,
+  SEND_OP_COND = 1,
+  SEND_CID = 2,
+  SEND_RELATIVE_ADDR = 3,
+  SEND_SWITCH_FUNC = 6,
+  SEND_IF_COND = 8,
+  SEND_CSD = 9,
+  STOP_TRANSMISSION = 12,
+  SEND_STATUS = 13,
+  SET_BLOCKLEN = 16,
+  READ_BLOCK_SINGLE = 17,
+  READ_BLOCK_MULTIPLE = 18,
+  SEND_NUM_WR_BLOCKS = 22,
+  SET_WR_BLK_ERASE_COUNT = 23,
+  WRITE_BLOCK_SINGLE = 24,
+  WRITE_BLOCK_MULTIPLE = 25,
+  APP_OP_COND = 41,
+  APP_CLR_CARD_DETECT = 42,
+  APP_CMD = 55,
+  READ_OCR = 58,
+  CRC_ON_OFF = 59
+} ardu_sdcard_command_t;
+
+// Align with ESP-IDF sdmmc SPI init (ACMD41 timeout must be >1s per SD spec)
+static constexpr uint32_t sd_go_idle_delay_ms = 20;
+static constexpr uint32_t sd_op_cond_timeout_ms = 3000;
+
+typedef struct {
+  uint8_t ssPin;
+  SPIClass *spi;
+  int frequency;
+  char *base_path;
+  sdcard_type_t type;
+  unsigned long sectors;
+  bool supports_crc;
+  int status;
+} ardu_sdcard_t;
+
+static ardu_sdcard_t *s_cards[FF_VOLUMES] = {NULL};
+
+#if ARDUHAL_LOG_LEVEL >= ARDUHAL_LOG_LEVEL_ERROR
+const char *fferr2str[] = {
+  "(0) Succeeded",
+  "(1) A hard error occurred in the low level disk I/O layer",
+  "(2) Assertion failed",
+  "(3) The physical drive cannot work",
+  "(4) Could not find the file",
+  "(5) Could not find the path",
+  "(6) The path name format is invalid",
+  "(7) Access denied due to prohibited access or directory full",
+  "(8) Access denied due to prohibited access",
+  "(9) The file/directory object is invalid",
+  "(10) The physical drive is write protected",
+  "(11) The logical drive number is invalid",
+  "(12) The volume has no work area",
+  "(13) There is no valid FAT volume",
+  "(14) The f_mkfs() aborted due to any problem",
+  "(15) Could not get a grant to access the volume within defined period",
+  "(16) The operation is rejected according to the file sharing policy",
+  "(17) LFN working buffer could not be allocated",
+  "(18) Number of open files > FF_FS_LOCK",
+  "(19) Given parameter is invalid"
+};
+#endif
+
+/*
+ * SD SPI
+ * */
+
+bool sdWait(uint8_t pdrv, int timeout) {
+  char resp;
+  uint32_t start = millis();
+
+  do {
+    resp = s_cards[pdrv]->spi->transfer(0xFF);
+  } while (resp == 0x00 && (millis() - start) < (unsigned int)timeout);
+
+  if (!resp) {
+    log_w("Wait Failed");
+  }
+  return (resp > 0x00);
+}
+
+void sdStop(uint8_t pdrv) {
+  s_cards[pdrv]->spi->write(0xFD);
+}
+
+void sdDeselectCard(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  digitalWrite(card->ssPin, HIGH);
+}
+
+bool sdSelectCard(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  digitalWrite(card->ssPin, LOW);
+  // roro: one dummy byte before asking whether the card is ready, as ChaN's reference driver does.
+  // A card that has just been given a write takes about a byte of clock to signal busy; without
+  // this, that first byte reads 0xFF, "ready", and the next command (the status check after a
+  // write) goes out while the card is still programming and comes back as garbage (#21).
+  card->spi->transfer(0xFF);
+  bool s = sdWait(pdrv, 500);
+  if (!s) {
+    log_e("Select Failed");
+    digitalWrite(card->ssPin, HIGH);
+    return false;
+  }
+  return true;
+}
+
+char sdCommand(uint8_t pdrv, char cmd, unsigned int arg, unsigned int *resp) {
+  char token;
+  ardu_sdcard_t *card = s_cards[pdrv];
+
+  for (int f = 0; f < 3; f++) {
+    if (cmd == SEND_NUM_WR_BLOCKS || cmd == SET_WR_BLK_ERASE_COUNT || cmd == APP_OP_COND || cmd == APP_CLR_CARD_DETECT) {
+      token = sdCommand(pdrv, APP_CMD, 0, NULL);
+      sdDeselectCard(pdrv);
+      if (token > 1) {
+        break;
+      }
+      if (!sdSelectCard(pdrv)) {
+        token = 0xFF;
+        break;
+      }
+    }
+
+    char cmdPacket[7];
+    cmdPacket[0] = cmd | 0x40;
+    cmdPacket[1] = arg >> 24;
+    cmdPacket[2] = arg >> 16;
+    cmdPacket[3] = arg >> 8;
+    cmdPacket[4] = arg;
+    if (card->supports_crc || cmd == GO_IDLE_STATE || cmd == SEND_IF_COND) {
+      cmdPacket[5] = (CRC7(cmdPacket, 5) << 1) | 0x01;
+    } else {
+      cmdPacket[5] = 0x01;
+    }
+    cmdPacket[6] = 0xFF;
+
+    card->spi->writeBytes((uint8_t *)cmdPacket, (cmd == STOP_TRANSMISSION) ? 7 : 6);
+
+    for (int i = 0; i < 9; i++) {
+      token = card->spi->transfer(0xFF);
+      if (!(token & 0x80)) {
+        break;
+      }
+    }
+
+    if (token == 0xFF) {
+      log_w("no token received");
+      sdDeselectCard(pdrv);
+      delay(100);
+      sdSelectCard(pdrv);
+      continue;
+    } else if (token & 0x08) {
+      log_w("crc error");
+      sdDeselectCard(pdrv);
+      delay(100);
+      sdSelectCard(pdrv);
+      continue;
+    } else if (token > 1) {
+      log_w("token error [%u] 0x%x", cmd, token);
+      break;
+    }
+
+    if (cmd == SEND_STATUS && resp) {
+      *resp = card->spi->transfer(0xFF);
+    } else if ((cmd == SEND_IF_COND || cmd == READ_OCR) && resp) {
+      *resp = card->spi->transfer32(0xFFFFFFFF);
+    }
+
+    break;
+  }
+  if (token == 0xFF) {
+    log_e("Card Failed! cmd: 0x%02x", cmd);
+    card->status = STA_NOINIT;
+  }
+  return token;
+}
+
+bool sdReadBytes(uint8_t pdrv, char *buffer, int length) {
+  char token;
+  unsigned short crc;
+  ardu_sdcard_t *card = s_cards[pdrv];
+
+  uint32_t start = millis();
+  do {
+    token = card->spi->transfer(0xFF);
+  } while (token == 0xFF && (millis() - start) < 500);
+
+  if (token != 0xFE) {
+    return false;
+  }
+
+  card->spi->transferBytes(NULL, (uint8_t *)buffer, length);
+  crc = card->spi->transfer16(0xFFFF);
+  return (!card->supports_crc || crc == CRC16(buffer, length));
+}
+
+char sdWriteBytes(uint8_t pdrv, const char *buffer, char token) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  unsigned short crc = (card->supports_crc) ? CRC16(buffer, 512) : 0xFFFF;
+  if (!sdWait(pdrv, 500)) {
+    return 0;
+  }
+
+  card->spi->write(token);
+  card->spi->writeBytes((uint8_t *)buffer, 512);
+  card->spi->write16(crc);
+  return (card->spi->transfer(0xFF) & 0x1F);
+}
+
+/*
+ * SPI SDCARD Communication
+ * */
+
+char sdTransaction(uint8_t pdrv, char cmd, unsigned int arg, unsigned int *resp) {
+  if (!sdSelectCard(pdrv)) {
+    return 0xFF;
+  }
+  char token = sdCommand(pdrv, cmd, arg, resp);
+  sdDeselectCard(pdrv);
+  return token;
+}
+
+bool sdReadSector(uint8_t pdrv, char *buffer, unsigned long long sector) {
+  for (int f = 0; f < 3; f++) {
+    if (!sdSelectCard(pdrv)) {
+      return false;
+    }
+    if (!sdCommand(pdrv, READ_BLOCK_SINGLE, (s_cards[pdrv]->type == CARD_SDHC) ? sector : sector << 9, NULL)) {
+      bool success = sdReadBytes(pdrv, buffer, 512);
+      sdDeselectCard(pdrv);
+      if (success) {
+        return true;
+      }
+    } else {
+      break;
+    }
+  }
+  sdDeselectCard(pdrv);
+  return false;
+}
+
+bool sdReadSectors(uint8_t pdrv, char *buffer, unsigned long long sector, int count) {
+  for (int f = 0; f < 3;) {
+    if (!sdSelectCard(pdrv)) {
+      return false;
+    }
+
+    if (!sdCommand(pdrv, READ_BLOCK_MULTIPLE, (s_cards[pdrv]->type == CARD_SDHC) ? sector : sector << 9, NULL)) {
+      do {
+        if (!sdReadBytes(pdrv, buffer, 512)) {
+          f++;
+          break;
+        }
+
+        sector++;
+        buffer += 512;
+        f = 0;
+      } while (--count);
+
+      if (sdCommand(pdrv, STOP_TRANSMISSION, 0, NULL)) {
+        log_e("command failed");
+        break;
+      }
+
+      sdDeselectCard(pdrv);
+      if (count == 0) {
+        return true;
+      }
+    } else {
+      break;
+    }
+  }
+  sdDeselectCard(pdrv);
+  return false;
+}
+
+bool sdWriteSector(uint8_t pdrv, const char *buffer, unsigned long long sector) {
+  using roro::SdFault;
+  for (int f = 0; f < 3; f++) {
+    if (!sdSelectCard(pdrv)) {
+      return sdFault(SdFault::Select);  // roro: say why
+    }
+    if (!sdCommand(pdrv, WRITE_BLOCK_SINGLE, (s_cards[pdrv]->type == CARD_SDHC) ? sector : sector << 9, NULL)) {
+      char token = sdWriteBytes(pdrv, buffer, 0xFE);
+      sdDeselectCard(pdrv);
+
+      if (token == 0x0A) {
+        continue;
+      } else if (token == 0x0C) {
+        return sdFault(SdFault::DataToken, token);
+      }
+
+      unsigned int resp;
+      char status = sdTransaction(pdrv, SEND_STATUS, 0, &resp);
+      if (status || resp) {
+        return token != 0x05 ? sdFault(SdFault::DataToken, token, resp) : sdFault(SdFault::Status, status, resp);
+      }
+      return true;
+    } else {
+      break;
+    }
+  }
+  sdDeselectCard(pdrv);
+  return sdFault(SdFault::Command);
+}
+
+bool sdWriteSectors(uint8_t pdrv, const char *buffer, unsigned long long sector, int count) {
+  using roro::SdFault;
+  char token;
+  const char *currentBuffer = buffer;
+  unsigned long long currentSector = sector;
+  int currentCount = count;
+  ardu_sdcard_t *card = s_cards[pdrv];
+  SdFault::Step why = SdFault::Command;  // roro: what stopped it, for the last return
+  uint8_t whyToken = 0;
+
+  for (int f = 0; f < 3;) {
+    if (card->type != CARD_MMC) {
+      char refused = sdTransaction(pdrv, SET_WR_BLK_ERASE_COUNT, currentCount, NULL);
+      if (refused) {
+        return sdFault(SdFault::EraseCount, refused);
+      }
+    }
+
+    if (!sdSelectCard(pdrv)) {
+      return sdFault(SdFault::Select);
+    }
+
+    if (!sdCommand(pdrv, WRITE_BLOCK_MULTIPLE, (card->type == CARD_SDHC) ? currentSector : currentSector << 9, NULL)) {
+      do {
+        token = sdWriteBytes(pdrv, currentBuffer, 0xFC);
+        if (token != 0x05) {
+          f++;
+          break;
+        }
+        currentBuffer += 512;
+        f = 0;
+      } while (--currentCount);
+
+      if (!sdWait(pdrv, 500)) {
+        why = SdFault::BusyAfter;
+        break;
+      }
+
+      if (currentCount == 0) {
+        sdStop(pdrv);
+        card->spi->transfer(0xFF);  // roro: the byte the card takes to go busy after Stop Tran (#21)
+        sdDeselectCard(pdrv);
+
+        unsigned int resp;
+        char status = sdTransaction(pdrv, SEND_STATUS, 0, &resp);
+        if (status || resp) {
+          return sdFault(SdFault::Status, status, resp);
+        }
+        return true;
+      } else {
+        if (sdCommand(pdrv, STOP_TRANSMISSION, 0, NULL)) {
+          why = SdFault::StopCommand;
+          whyToken = token;
+          break;
+        }
+
+        if (token == 0x0A) {
+          sdDeselectCard(pdrv);
+          unsigned int writtenBlocks = 0;
+          if (card->type != CARD_MMC && sdSelectCard(pdrv)) {
+            if (!sdCommand(pdrv, SEND_NUM_WR_BLOCKS, 0, NULL)) {
+              char acmdData[4];
+              if (sdReadBytes(pdrv, acmdData, 4)) {
+                writtenBlocks = acmdData[0] << 24;
+                writtenBlocks |= acmdData[1] << 16;
+                writtenBlocks |= acmdData[2] << 8;
+                writtenBlocks |= acmdData[3];
+              }
+            }
+            sdDeselectCard(pdrv);
+          }
+          currentBuffer = buffer + (writtenBlocks << 9);
+          currentSector = sector + writtenBlocks;
+          currentCount = count - writtenBlocks;
+          continue;
+        } else {
+          why = SdFault::DataToken;
+          whyToken = token;
+          break;
+        }
+      }
+    } else {
+      break;
+    }
+  }
+  sdDeselectCard(pdrv);
+  return sdFault(why, whyToken);
+}
+
+unsigned long sdGetSectorsCount(uint8_t pdrv) {
+  for (int f = 0; f < 3; f++) {
+    if (!sdSelectCard(pdrv)) {
+      return 0;
+    }
+
+    if (!sdCommand(pdrv, SEND_CSD, 0, NULL)) {
+      char csd[16];
+      bool success = sdReadBytes(pdrv, csd, 16);
+      sdDeselectCard(pdrv);
+      if (success) {
+        if ((csd[0] >> 6) == 0x01) {
+          unsigned long size = (((unsigned long)(csd[7] & 0x3F) << 16) | ((unsigned long)csd[8] << 8) | csd[9]) + 1;
+          return size << 10;
+        }
+        unsigned long size = (((unsigned long)(csd[6] & 0x03) << 10) | ((unsigned long)csd[7] << 2) | ((csd[8] & 0xC0) >> 6)) + 1;
+        size <<= ((((csd[9] & 0x03) << 1) | ((csd[10] & 0x80) >> 7)) + 2);
+        size <<= (csd[5] & 0x0F);
+        return size >> 9;
+      }
+    } else {
+      break;
+    }
+  }
+
+  sdDeselectCard(pdrv);
+  return 0;
+}
+
+namespace {
+
+struct AcquireSPI {
+  ardu_sdcard_t *card;
+  explicit AcquireSPI(ardu_sdcard_t *card) : card(card) {
+    card->spi->beginTransaction(SPISettings(card->frequency, MSBFIRST, SPI_MODE0));
+  }
+  AcquireSPI(ardu_sdcard_t *card, int frequency) : card(card) {
+    card->spi->beginTransaction(SPISettings(frequency, MSBFIRST, SPI_MODE0));
+  }
+  ~AcquireSPI() {
+    card->spi->endTransaction();
+  }
+
+private:
+  AcquireSPI(AcquireSPI const &);
+  AcquireSPI &operator=(AcquireSPI const &);
+};
+
+}  // namespace
+
+/*
+ * FATFS API
+ * */
+
+/**
+ * @brief Initialize an SD card for use with FatFs
+ *
+ * This function implements the complete SD card initialization sequence according to
+ * the SD card specification. It performs card detection, type identification,
+ * and configuration for SPI mode operation.
+ *
+ * The initialization sequence follows the SD card protocol (SPI mode, aligned with IDF):
+ * 1. Power-up sequence with 74+ clock cycles
+ * 2. Two GO_IDLE_STATE attempts to enter SPI mode
+ * 3. CRC_ON_OFF to enable CRC checking (with retry)
+ * 4. SEND_IF_COND to identify SDHC/SDXC cards
+ * 5. APP_OP_COND / SEND_OP_COND (SPI args; timeout >1s)
+ * 6. Card type detection (SD/SDHC/MMC)
+ * 7. Final configuration and sector count retrieval
+ *
+ * @param pdrv Physical drive number (0-9)
+ * @return DSTATUS Status of the initialization (0 = success, STA_NOINIT = failed)
+ */
+DSTATUS ff_sd_initialize(uint8_t pdrv) {
+  char token;
+  unsigned int resp;
+  unsigned int start;
+
+  // Get the card structure for the given drive number
+  ardu_sdcard_t *card = s_cards[pdrv];
+
+  // If the card is already initialized, return its current status
+  if (!(card->status & STA_NOINIT)) {
+    return card->status;
+  }
+
+  // Lock the SPI bus and set it to a low frequency (400kHz) for initialization
+  // Low frequency is required during initialization for reliable communication
+  AcquireSPI card_locked(card, 400000);
+
+  // Step 1: Power-up sequence - Send at least 74 clock cycles with CS high and MOSI high
+  // This is required by the SD card specification to ensure proper card state reset
+  // We send 20 bytes (160 clock cycles) to exceed the minimum requirement
+  digitalWrite(card->ssPin, HIGH);
+  for (uint8_t i = 0; i < 20; i++) {
+    card->spi->transfer(0XFF);
+  }
+
+  // Step 2: Perform two GO_IDLE_STATE (CMD0) attempts in SPI mode.
+  // Per SD Simplified Spec (figure 4-1) / IDF: some cards enter SD mode on the
+  // first attempt, so the first response may fail; the second must succeed.
+  // (sdCommand may also retry internally on no-token/CRC errors.)
+  // Fix mount issue - sdWait fail ignored before each CMD0 attempt
+  digitalWrite(card->ssPin, LOW);
+  if (!sdWait(pdrv, 500)) {
+    log_w("sdWait fail ignored, card initialize continues");
+  }
+  (void)sdCommand(pdrv, GO_IDLE_STATE, 0, NULL);
+  sdDeselectCard(pdrv);
+  delay(sd_go_idle_delay_ms);
+
+  digitalWrite(card->ssPin, LOW);
+  if (!sdWait(pdrv, 500)) {
+    log_w("sdWait fail ignored, card initialize continues");
+  }
+  if (sdCommand(pdrv, GO_IDLE_STATE, 0, NULL) != 1) {
+    sdDeselectCard(pdrv);
+    log_w("GO_IDLE_STATE failed");
+    goto unknown_card;
+  }
+  sdDeselectCard(pdrv);
+  delay(sd_go_idle_delay_ms);
+
+  // Step 3: Configure CRC checking
+  // Enable CRC for data transfers in SPI mode (required for reliable communication).
+  // Some cards reject the first CRC_ON_OFF; retry once (same as IDF).
+  token = sdTransaction(pdrv, CRC_ON_OFF, 1, NULL);
+  if (token != 1 && token != 0x5) {
+    delay(10);
+    token = sdTransaction(pdrv, CRC_ON_OFF, 1, NULL);
+  }
+  if (token == 0x5) {
+    // Old card that doesn't support CRC - disable CRC checking
+    card->supports_crc = false;
+  } else if (token != 1) {
+    log_w("CRC_ON_OFF failed: %u", token);
+    goto unknown_card;
+  }
+
+  // Step 4: Card type detection and initialization
+  // Try to identify SDHC/SDXC cards using SEND_IF_COND command
+  if (sdTransaction(pdrv, SEND_IF_COND, 0x1AA, &resp) == 1) {
+    // Card responded to SEND_IF_COND - likely SDHC/SDXC
+    if ((resp & 0xFFF) != 0x1AA) {
+      log_w("SEND_IF_COND failed: %03" PRIX32, (uint32_t)(resp & 0xFFF));
+      goto unknown_card;
+    }
+
+    // Read Operating Conditions Register to check card capabilities
+    if (sdTransaction(pdrv, READ_OCR, 0, &resp) != 1 || !(resp & (1 << 20))) {
+      log_w("READ_OCR failed: %X", resp);
+      goto unknown_card;
+    }
+
+    // Send APP_OP_COND to set operating conditions for SDHC/SDXC.
+    // In SPI mode only HCS (bit 30) is valid; voltage bits must be 0 (same as IDF).
+    // Timeout must be >1s per SD spec (IDF uses ~3s).
+    start = millis();
+    do {
+      token = sdTransaction(pdrv, APP_OP_COND, 0x40000000, NULL);
+    } while (token == 1 && (millis() - start) < sd_op_cond_timeout_ms);
+
+    if (token) {
+      log_w("APP_OP_COND failed: %u", token);
+      goto unknown_card;
+    }
+
+    // Determine if it's SDHC (high capacity) or regular SD
+    if (!sdTransaction(pdrv, READ_OCR, 0, &resp)) {
+      if (resp & (1 << 30)) {
+        card->type = CARD_SDHC;  // High capacity card (SDHC/SDXC)
+      } else {
+        card->type = CARD_SD;  // Standard capacity card
+      }
+    } else {
+      log_w("READ_OCR failed: %X", resp);
+      goto unknown_card;
+    }
+  } else {
+    // Card didn't respond to SEND_IF_COND - try SD or MMC initialization
+    if (sdTransaction(pdrv, READ_OCR, 0, &resp) != 1 || !(resp & (1 << 20))) {
+      log_w("READ_OCR failed: %X", resp);
+      goto unknown_card;
+    }
+
+    // Try SD card initialization first (SPI mode: ACMD41 arg must be 0)
+    start = millis();
+    do {
+      token = sdTransaction(pdrv, APP_OP_COND, 0, NULL);
+    } while (token == 0x01 && (millis() - start) < sd_op_cond_timeout_ms);
+
+    if (!token) {
+      card->type = CARD_SD;  // Standard SD card
+    } else {
+      // Try MMC card initialization (SPI mode: CMD1 arg must be 0)
+      start = millis();
+      do {
+        token = sdTransaction(pdrv, SEND_OP_COND, 0, NULL);
+      } while (token != 0x00 && (millis() - start) < sd_op_cond_timeout_ms);
+
+      if (token == 0x00) {
+        card->type = CARD_MMC;  // MMC card
+      } else {
+        log_w("SEND_OP_COND failed: %u", token);
+        goto unknown_card;
+      }
+    }
+  }
+
+  // Step 5: Clear card detection for SD cards (not needed for MMC)
+  if (card->type != CARD_MMC) {
+    if (sdTransaction(pdrv, APP_CLR_CARD_DETECT, 0, NULL)) {
+      log_w("APP_CLR_CARD_DETECT failed");
+      goto unknown_card;
+    }
+  }
+
+  // Step 6: Set block length for non-SDHC cards
+  // SDHC cards have fixed 512-byte blocks, others need explicit block length setting
+  if (card->type != CARD_SDHC) {
+    if (sdTransaction(pdrv, SET_BLOCKLEN, 512, NULL) != 0x00) {
+      log_w("SET_BLOCKLEN failed");
+      goto unknown_card;
+    }
+  }
+
+  // Step 7: Get card capacity and finalize initialization
+  card->sectors = sdGetSectorsCount(pdrv);
+
+  // Limit frequency to 25MHz for compatibility (SD spec maximum for non-UHS cards)
+  if (card->frequency > 25000000) {
+    card->frequency = 25000000;
+  }
+
+  // Mark card as initialized
+  card->status &= ~STA_NOINIT;
+  return card->status;
+
+unknown_card:
+  // Mark card as unknown type if initialization failed
+  card->type = CARD_UNKNOWN;
+  return card->status;
+}
+
+DSTATUS ff_sd_status(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  AcquireSPI lock(card);
+
+  if (sdTransaction(pdrv, SEND_STATUS, 0, NULL)) {
+    log_e("Check status failed");
+    return STA_NOINIT;
+  }
+  return s_cards[pdrv]->status;
+}
+
+DRESULT ff_sd_read(uint8_t pdrv, uint8_t *buffer, DWORD sector, UINT count) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (card->status & STA_NOINIT) {
+    return RES_NOTRDY;
+  }
+  DRESULT res = RES_OK;
+
+  AcquireSPI lock(card);
+
+  if (count > 1) {
+    res = sdReadSectors(pdrv, (char *)buffer, sector, count) ? RES_OK : RES_ERROR;
+  } else {
+    res = sdReadSector(pdrv, (char *)buffer, sector) ? RES_OK : RES_ERROR;
+  }
+  return res;
+}
+
+DRESULT ff_sd_write(uint8_t pdrv, const uint8_t *buffer, DWORD sector, UINT count) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (card->status & STA_NOINIT) {
+    return RES_NOTRDY;
+  }
+
+  if (card->status & STA_PROTECT) {
+    return RES_WRPRT;
+  }
+  DRESULT res = RES_OK;
+
+  AcquireSPI lock(card);
+
+  if (count > 1) {
+    res = sdWriteSectors(pdrv, (const char *)buffer, sector, count) ? RES_OK : RES_ERROR;
+  } else {
+    res = sdWriteSector(pdrv, (const char *)buffer, sector) ? RES_OK : RES_ERROR;
+  }
+  return res;
+}
+
+DRESULT ff_sd_ioctl(uint8_t pdrv, uint8_t cmd, void *buff) {
+  switch (cmd) {
+    case CTRL_SYNC:
+    {
+      AcquireSPI lock(s_cards[pdrv]);
+      if (sdSelectCard(pdrv)) {
+        sdDeselectCard(pdrv);
+        return RES_OK;
+      }
+    }
+      return RES_ERROR;
+    case GET_SECTOR_COUNT: *((unsigned long *)buff) = s_cards[pdrv]->sectors; return RES_OK;
+    case GET_SECTOR_SIZE:  *((WORD *)buff) = 512; return RES_OK;
+    case GET_BLOCK_SIZE:   *((uint32_t *)buff) = 1; return RES_OK;
+  }
+  return RES_PARERR;
+}
+
+bool sd_read_raw(uint8_t pdrv, uint8_t *buffer, DWORD sector) {
+  return ff_sd_read(pdrv, buffer, sector, 1) == ESP_OK;
+}
+
+bool sd_write_raw(uint8_t pdrv, uint8_t *buffer, DWORD sector) {
+  return ff_sd_write(pdrv, buffer, sector, 1) == ESP_OK;
+}
+
+/*
+ * Public methods
+ * */
+
+uint8_t sdcard_uninit(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (pdrv >= FF_VOLUMES || card == NULL) {
+    return 1;
+  }
+  {
+    AcquireSPI lock(card);
+    sdTransaction(pdrv, GO_IDLE_STATE, 0, NULL);
+  }  // lock is destructed here
+  ff_diskio_register(pdrv, NULL);
+  s_cards[pdrv] = NULL;
+  esp_err_t err = ESP_OK;
+  if (card->base_path) {
+    err = esp_vfs_fat_unregister_path(card->base_path);
+    free(card->base_path);
+  }
+  free(card);
+  return err;
+}
+
+uint8_t sdcard_init(uint8_t cs, SPIClass *spi, int hz) {
+
+  uint8_t pdrv = 0xFF;
+  if (ff_diskio_get_drive(&pdrv) != ESP_OK || pdrv == 0xFF) {
+    return pdrv;
+  }
+
+  ardu_sdcard_t *card = (ardu_sdcard_t *)malloc(sizeof(ardu_sdcard_t));
+  if (!card) {
+    return 0xFF;
+  }
+
+  card->base_path = NULL;
+  card->frequency = hz;
+  card->spi = spi;
+  card->ssPin = digitalPinToGPIONumber(cs);
+
+  card->supports_crc = true;
+  card->type = CARD_NONE;
+  card->status = STA_NOINIT;
+
+  pinMode(card->ssPin, OUTPUT);
+  digitalWrite(card->ssPin, HIGH);
+  perimanSetPinBusExtraType(card->ssPin, "SD_SS");
+
+  s_cards[pdrv] = card;
+
+  static const ff_diskio_impl_t sd_impl = {
+    .init = &ff_sd_initialize, .status = &ff_sd_status, .read = &ff_sd_read, .write = &ff_sd_write, .ioctl = &ff_sd_ioctl
+  };
+  ff_diskio_register(pdrv, &sd_impl);
+
+  return pdrv;
+}
+
+uint8_t sdcard_unmount(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (pdrv >= FF_VOLUMES || card == NULL) {
+    return 1;
+  }
+  card->status |= STA_NOINIT;
+  card->type = CARD_NONE;
+
+  char drv[3] = {(char)('0' + pdrv), ':', 0};
+  f_mount(NULL, drv, 0);
+  return 0;
+}
+
+bool sdcard_mount(uint8_t pdrv, const char *path, uint8_t max_files, bool format_if_empty) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (pdrv >= FF_VOLUMES || card == NULL) {
+    return false;
+  }
+
+  if (card->base_path) {
+    free(card->base_path);
+  }
+  card->base_path = strdup(path);
+
+  FATFS *fs;
+  char drv[3] = {(char)('0' + pdrv), ':', 0};
+
+#if ESP_IDF_VERSION < ESP_IDF_VERSION_VAL(6, 0, 0)
+  esp_err_t err = esp_vfs_fat_register(path, drv, max_files, &fs);
+#else
+  esp_vfs_fat_conf_t conf = {.base_path = path, .fat_drive = drv, .max_files = max_files};
+  esp_err_t err = esp_vfs_fat_register(&conf, &fs);
+#endif
+
+  if (err == ESP_ERR_INVALID_STATE) {
+    log_e("esp_vfs_fat_register failed 0x(%x): SD is registered.", err);
+    return false;
+  } else if (err != ESP_OK) {
+    log_e("esp_vfs_fat_register failed 0x(%x)", err);
+    return false;
+  }
+
+  FRESULT res = f_mount(fs, drv, 1);
+  if (res != FR_OK) {
+    log_e("f_mount failed: %s", fferr2str[res]);
+    if (res == 13 && format_if_empty) {
+      BYTE *work = (BYTE *)malloc(sizeof(BYTE) * FF_MAX_SS);
+      if (!work) {
+        log_e("alloc for f_mkfs failed");
+        return false;
+      }
+      //FRESULT f_mkfs (const TCHAR* path, const MKFS_PARM* opt, void* work, UINT len);
+      const MKFS_PARM opt = {(BYTE)FM_ANY, 0, 0, 0, 0};
+      res = f_mkfs(drv, &opt, work, sizeof(BYTE) * FF_MAX_SS);
+      free(work);
+      if (res != FR_OK) {
+        log_e("f_mkfs failed: %s", fferr2str[res]);
+        esp_vfs_fat_unregister_path(path);
+        return false;
+      }
+      res = f_mount(fs, drv, 1);
+      if (res != FR_OK) {
+        log_e("f_mount failed: %s", fferr2str[res]);
+        esp_vfs_fat_unregister_path(path);
+        return false;
+      }
+    } else {
+      esp_vfs_fat_unregister_path(path);
+      return false;
+    }
+  }
+  AcquireSPI lock(card);
+  card->sectors = sdGetSectorsCount(pdrv);
+  return true;
+}
+
+uint32_t sdcard_num_sectors(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (pdrv >= FF_VOLUMES || card == NULL) {
+    return 0;
+  }
+  return card->sectors;
+}
+
+uint32_t sdcard_sector_size(uint8_t pdrv) {
+  if (pdrv >= FF_VOLUMES || s_cards[pdrv] == NULL) {
+    return 0;
+  }
+  return 512;
+}
+
+// roro: the card's CID. CMD10 in SPI mode (the enum's SEND_CID, 2, is the SD-mode command).
+namespace roro {
+bool sdReadCid(uint8_t cid[16]) {
+  for (uint8_t pdrv = 0; pdrv < FF_VOLUMES; ++pdrv) {
+    ardu_sdcard_t *card = s_cards[pdrv];
+    if (!card) {
+      continue;
+    }
+    AcquireSPI lock(card);
+    if (!sdSelectCard(pdrv)) {
+      return false;
+    }
+    bool ok = !sdCommand(pdrv, 10, 0, NULL) && sdReadBytes(pdrv, (char *)cid, 16);
+    sdDeselectCard(pdrv);
+    return ok;
+  }
+  return false;
+}
+}  // namespace roro
+
+sdcard_type_t sdcard_type(uint8_t pdrv) {
+  ardu_sdcard_t *card = s_cards[pdrv];
+  if (pdrv >= FF_VOLUMES || card == NULL) {
+    return CARD_NONE;
+  }
+  return card->type;
+}

lib/SD/src/sd_diskio.h

@@ -0,0 +1,34 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#ifndef _SD_DISKIO_H_
+#define _SD_DISKIO_H_
+
+#include "Arduino.h"
+#include "SPI.h"
+#include "sd_defines.h"
+// #include "diskio.h"
+
+uint8_t sdcard_init(uint8_t cs, SPIClass *spi, int hz);
+uint8_t sdcard_uninit(uint8_t pdrv);
+
+bool sdcard_mount(uint8_t pdrv, const char *path, uint8_t max_files, bool format_if_empty);
+uint8_t sdcard_unmount(uint8_t pdrv);
+
+sdcard_type_t sdcard_type(uint8_t pdrv);
+uint32_t sdcard_num_sectors(uint8_t pdrv);
+uint32_t sdcard_sector_size(uint8_t pdrv);
+bool sd_read_raw(uint8_t pdrv, uint8_t *buffer, uint32_t sector);
+bool sd_write_raw(uint8_t pdrv, uint8_t *buffer, uint32_t sector);
+
+#endif /* _SD_DISKIO_H_ */

lib/SD/src/sd_diskio_crc.c

@@ -0,0 +1,61 @@
+/* SD/MMC File System Library
+ * Copyright (c) 2014 Neil Thiessen
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const char m_CRC7Table[] = {0x00, 0x09, 0x12, 0x1B, 0x24, 0x2D, 0x36, 0x3F, 0x48, 0x41, 0x5A, 0x53, 0x6C, 0x65, 0x7E, 0x77, 0x19, 0x10, 0x0B, 0x02, 0x3D, 0x34,
+                            0x2F, 0x26, 0x51, 0x58, 0x43, 0x4A, 0x75, 0x7C, 0x67, 0x6E, 0x32, 0x3B, 0x20, 0x29, 0x16, 0x1F, 0x04, 0x0D, 0x7A, 0x73, 0x68, 0x61,
+                            0x5E, 0x57, 0x4C, 0x45, 0x2B, 0x22, 0x39, 0x30, 0x0F, 0x06, 0x1D, 0x14, 0x63, 0x6A, 0x71, 0x78, 0x47, 0x4E, 0x55, 0x5C, 0x64, 0x6D,
+                            0x76, 0x7F, 0x40, 0x49, 0x52, 0x5B, 0x2C, 0x25, 0x3E, 0x37, 0x08, 0x01, 0x1A, 0x13, 0x7D, 0x74, 0x6F, 0x66, 0x59, 0x50, 0x4B, 0x42,
+                            0x35, 0x3C, 0x27, 0x2E, 0x11, 0x18, 0x03, 0x0A, 0x56, 0x5F, 0x44, 0x4D, 0x72, 0x7B, 0x60, 0x69, 0x1E, 0x17, 0x0C, 0x05, 0x3A, 0x33,
+                            0x28, 0x21, 0x4F, 0x46, 0x5D, 0x54, 0x6B, 0x62, 0x79, 0x70, 0x07, 0x0E, 0x15, 0x1C, 0x23, 0x2A, 0x31, 0x38, 0x41, 0x48, 0x53, 0x5A,
+                            0x65, 0x6C, 0x77, 0x7E, 0x09, 0x00, 0x1B, 0x12, 0x2D, 0x24, 0x3F, 0x36, 0x58, 0x51, 0x4A, 0x43, 0x7C, 0x75, 0x6E, 0x67, 0x10, 0x19,
+                            0x02, 0x0B, 0x34, 0x3D, 0x26, 0x2F, 0x73, 0x7A, 0x61, 0x68, 0x57, 0x5E, 0x45, 0x4C, 0x3B, 0x32, 0x29, 0x20, 0x1F, 0x16, 0x0D, 0x04,
+                            0x6A, 0x63, 0x78, 0x71, 0x4E, 0x47, 0x5C, 0x55, 0x22, 0x2B, 0x30, 0x39, 0x06, 0x0F, 0x14, 0x1D, 0x25, 0x2C, 0x37, 0x3E, 0x01, 0x08,
+                            0x13, 0x1A, 0x6D, 0x64, 0x7F, 0x76, 0x49, 0x40, 0x5B, 0x52, 0x3C, 0x35, 0x2E, 0x27, 0x18, 0x11, 0x0A, 0x03, 0x74, 0x7D, 0x66, 0x6F,
+                            0x50, 0x59, 0x42, 0x4B, 0x17, 0x1E, 0x05, 0x0C, 0x33, 0x3A, 0x21, 0x28, 0x5F, 0x56, 0x4D, 0x44, 0x7B, 0x72, 0x69, 0x60, 0x0E, 0x07,
+                            0x1C, 0x15, 0x2A, 0x23, 0x38, 0x31, 0x46, 0x4F, 0x54, 0x5D, 0x62, 0x6B, 0x70, 0x79};
+
+char CRC7(const char *data, int length) {
+  char crc = 0;
+  for (int i = 0; i < length; i++) {
+    crc = m_CRC7Table[(crc << 1) ^ data[i]];
+  }
+  return crc;
+}
+
+const unsigned short m_CRC16Table[256] = {
+  0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50A5, 0x60C6, 0x70E7, 0x8108, 0x9129, 0xA14A, 0xB16B, 0xC18C, 0xD1AD, 0xE1CE, 0xF1EF, 0x1231, 0x0210, 0x3273,
+  0x2252, 0x52B5, 0x4294, 0x72F7, 0x62D6, 0x9339, 0x8318, 0xB37B, 0xA35A, 0xD3BD, 0xC39C, 0xF3FF, 0xE3DE, 0x2462, 0x3443, 0x0420, 0x1401, 0x64E6, 0x74C7,
+  0x44A4, 0x5485, 0xA56A, 0xB54B, 0x8528, 0x9509, 0xE5EE, 0xF5CF, 0xC5AC, 0xD58D, 0x3653, 0x2672, 0x1611, 0x0630, 0x76D7, 0x66F6, 0x5695, 0x46B4, 0xB75B,
+  0xA77A, 0x9719, 0x8738, 0xF7DF, 0xE7FE, 0xD79D, 0xC7BC, 0x48C4, 0x58E5, 0x6886, 0x78A7, 0x0840, 0x1861, 0x2802, 0x3823, 0xC9CC, 0xD9ED, 0xE98E, 0xF9AF,
+  0x8948, 0x9969, 0xA90A, 0xB92B, 0x5AF5, 0x4AD4, 0x7AB7, 0x6A96, 0x1A71, 0x0A50, 0x3A33, 0x2A12, 0xDBFD, 0xCBDC, 0xFBBF, 0xEB9E, 0x9B79, 0x8B58, 0xBB3B,
+  0xAB1A, 0x6CA6, 0x7C87, 0x4CE4, 0x5CC5, 0x2C22, 0x3C03, 0x0C60, 0x1C41, 0xEDAE, 0xFD8F, 0xCDEC, 0xDDCD, 0xAD2A, 0xBD0B, 0x8D68, 0x9D49, 0x7E97, 0x6EB6,
+  0x5ED5, 0x4EF4, 0x3E13, 0x2E32, 0x1E51, 0x0E70, 0xFF9F, 0xEFBE, 0xDFDD, 0xCFFC, 0xBF1B, 0xAF3A, 0x9F59, 0x8F78, 0x9188, 0x81A9, 0xB1CA, 0xA1EB, 0xD10C,
+  0xC12D, 0xF14E, 0xE16F, 0x1080, 0x00A1, 0x30C2, 0x20E3, 0x5004, 0x4025, 0x7046, 0x6067, 0x83B9, 0x9398, 0xA3FB, 0xB3DA, 0xC33D, 0xD31C, 0xE37F, 0xF35E,
+  0x02B1, 0x1290, 0x22F3, 0x32D2, 0x4235, 0x5214, 0x6277, 0x7256, 0xB5EA, 0xA5CB, 0x95A8, 0x8589, 0xF56E, 0xE54F, 0xD52C, 0xC50D, 0x34E2, 0x24C3, 0x14A0,
+  0x0481, 0x7466, 0x6447, 0x5424, 0x4405, 0xA7DB, 0xB7FA, 0x8799, 0x97B8, 0xE75F, 0xF77E, 0xC71D, 0xD73C, 0x26D3, 0x36F2, 0x0691, 0x16B0, 0x6657, 0x7676,
+  0x4615, 0x5634, 0xD94C, 0xC96D, 0xF90E, 0xE92F, 0x99C8, 0x89E9, 0xB98A, 0xA9AB, 0x5844, 0x4865, 0x7806, 0x6827, 0x18C0, 0x08E1, 0x3882, 0x28A3, 0xCB7D,
+  0xDB5C, 0xEB3F, 0xFB1E, 0x8BF9, 0x9BD8, 0xABBB, 0xBB9A, 0x4A75, 0x5A54, 0x6A37, 0x7A16, 0x0AF1, 0x1AD0, 0x2AB3, 0x3A92, 0xFD2E, 0xED0F, 0xDD6C, 0xCD4D,
+  0xBDAA, 0xAD8B, 0x9DE8, 0x8DC9, 0x7C26, 0x6C07, 0x5C64, 0x4C45, 0x3CA2, 0x2C83, 0x1CE0, 0x0CC1, 0xEF1F, 0xFF3E, 0xCF5D, 0xDF7C, 0xAF9B, 0xBFBA, 0x8FD9,
+  0x9FF8, 0x6E17, 0x7E36, 0x4E55, 0x5E74, 0x2E93, 0x3EB2, 0x0ED1, 0x1EF0
+};
+
+unsigned short CRC16(const char *data, int length) {
+  unsigned short crc = 0;
+  for (int i = 0; i < length; i++) {
+    crc = (crc << 8) ^ m_CRC16Table[((crc >> 8) ^ data[i]) & 0x00FF];
+  }
+  return crc;
+}

lib/SD/src/sd_fault.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <cstdint>
+
+namespace roro {
+
+// Why the SD driver last gave up on a write (see sd_diskio.cpp, issue #21). The framework's driver
+// fails without saying why; ours records it.
+struct SdFault {
+    enum Step : uint8_t {
+        None,
+        EraseCount,   // ACMD23 before a multi-block write was refused
+        Select,       // the card stayed busy for 500 ms
+        Command,      // the write command itself was refused
+        DataToken,    // the card's answer to a data block: 0x0B CRC error, 0x0D write error
+        BusyAfter,    // still busy 500 ms after the last block
+        Status,       // CMD13 after the write reported an error (resp)
+        StopCommand,  // CMD12 after a rejected block was refused
+    };
+    Step step = None;
+    uint8_t token = 0;   // the driver's or the card's answer at that step
+    uint32_t resp = 0;   // CMD13's status bits, for Status
+    uint32_t count = 0;  // failed writes since boot
+    uint32_t retried = 0;  // blocks resent after a CRC error, since boot
+};
+
+SdFault sdLastFault();
+
+// The mounted card's identity register (CID, CMD10): who made it, its name, serial and date.
+// Call it where card access is allowed (the storage task).
+bool sdReadCid(uint8_t cid[16]);
+
+}  // namespace roro

lib/gemini/src/gemini_response.cpp

@@ -0,0 +1,59 @@
+#include "gemini_response.h"
+
+#include <cctype>
+
+namespace roro::gemini {
+
+namespace {
+std::string trim(const std::string& s) {
+    size_t a = s.find_first_not_of(" \t"), b = s.find_last_not_of(" \t");
+    return a == std::string::npos ? "" : s.substr(a, b - a + 1);
+}
+std::string lower(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+}  // namespace
+
+bool parseHeader(const std::string& line, Header& out) {
+    if (line.size() < 2 || !std::isdigit(static_cast<unsigned char>(line[0])) ||
+        !std::isdigit(static_cast<unsigned char>(line[1])))
+        return false;
+    if (line.size() > 2 && line[2] != ' ') return false;
+    std::string meta = line.size() > 3 ? line.substr(3) : "";
+    if (meta.size() > 1024) return false;
+    out.status = (line[0] - '0') * 10 + (line[1] - '0');
+    out.meta = meta;
+    return true;
+}
+
+Category Header::category() const {
+    switch (status / 10) {
+        case 1: return Category::Input;
+        case 2: return Category::Success;
+        case 3: return Category::Redirect;
+        case 4: return Category::TemporaryFailure;
+        case 5: return Category::PermanentFailure;
+        case 6: return Category::ClientCertificate;
+        default: return Category::Unknown;
+    }
+}
+
+std::string Header::mimeType() const {
+    std::string type = lower(trim(meta.substr(0, meta.find(';'))));
+    return type.empty() ? "text/gemini" : type;
+}
+
+std::string Header::parameter(const std::string& name) const {
+    size_t pos = meta.find(';');
+    while (pos != std::string::npos) {
+        size_t next = meta.find(';', pos + 1);
+        std::string item = trim(meta.substr(pos + 1, next == std::string::npos ? std::string::npos : next - pos - 1));
+        size_t eq = item.find('=');
+        if (eq != std::string::npos && lower(trim(item.substr(0, eq))) == lower(name)) return trim(item.substr(eq + 1));
+        pos = next;
+    }
+    return "";
+}
+
+}  // namespace roro::gemini

lib/gemini/src/gemini_response.h

@@ -0,0 +1,23 @@
+#pragma once
+
+#include <string>
+
+namespace roro::gemini {
+
+enum class Category { Input, Success, Redirect, TemporaryFailure, PermanentFailure, ClientCertificate, Unknown };
+
+// The response header: "<two digits> <meta>", at most 1024 bytes of meta.
+struct Header {
+    int status = 0;
+    std::string meta;
+
+    Category category() const;
+    bool sensitiveInput() const { return status == 11; }
+    // 2x: the MIME type, lower-cased, without parameters ("text/gemini" when meta is empty).
+    std::string mimeType() const;
+    std::string parameter(const std::string& name) const;  // e.g. "charset"
+};
+
+bool parseHeader(const std::string& line, Header& out);
+
+}  // namespace roro::gemini

lib/gemini/src/gemini_url.cpp

@@ -0,0 +1,215 @@
+#include "gemini_url.h"
+
+#include <cctype>
+#include <cstdio>
+#include <cstdlib>
+#include <vector>
+
+#include "storage_paths.h"
+
+namespace roro::gemini {
+
+namespace {
+
+// RFC 3986, appendix B: ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?
+struct Parts {
+    std::string scheme, authority, path, query, fragment;
+    bool hasScheme = false, hasAuthority = false, hasQuery = false, hasFragment = false;
+};
+
+Parts split(const std::string& s) {
+    Parts p;
+    size_t i = 0;
+    size_t colon = s.find(':');
+    size_t stop = s.find_first_of("/?#");
+    if (colon != std::string::npos && colon > 0 && (stop == std::string::npos || colon < stop)) {
+        p.scheme = s.substr(0, colon);
+        p.hasScheme = true;
+        i = colon + 1;
+    }
+    if (s.compare(i, 2, "//") == 0) {
+        size_t end = s.find_first_of("/?#", i + 2);
+        if (end == std::string::npos) end = s.size();
+        p.authority = s.substr(i + 2, end - i - 2);
+        p.hasAuthority = true;
+        i = end;
+    }
+    size_t end = s.find_first_of("?#", i);
+    if (end == std::string::npos) end = s.size();
+    p.path = s.substr(i, end - i);
+    i = end;
+    if (i < s.size() && s[i] == '?') {
+        end = s.find('#', i);
+        if (end == std::string::npos) end = s.size();
+        p.query = s.substr(i + 1, end - i - 1);
+        p.hasQuery = true;
+        i = end;
+    }
+    if (i < s.size() && s[i] == '#') {
+        p.fragment = s.substr(i + 1);
+        p.hasFragment = true;
+    }
+    return p;
+}
+
+std::string lower(std::string s) {
+    for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return s;
+}
+
+// RFC 3986, section 5.2.4.
+std::string removeDotSegments(std::string in) {
+    std::string out;
+    while (!in.empty()) {
+        if (in.compare(0, 3, "../") == 0) in.erase(0, 3);
+        else if (in.compare(0, 2, "./") == 0) in.erase(0, 2);
+        else if (in.compare(0, 3, "/./") == 0) in.replace(0, 3, "/");
+        else if (in == "/.") in = "/";
+        else if (in.compare(0, 4, "/../") == 0 || in == "/..") {
+            in = in == "/.." ? "/" : in.substr(3);
+            size_t slash = out.rfind('/');
+            out.erase(slash == std::string::npos ? 0 : slash);
+        } else if (in == "." || in == "..") in.clear();
+        else {
+            size_t next = in.find('/', in[0] == '/' ? 1 : 0);
+            if (next == std::string::npos) next = in.size();
+            out += in.substr(0, next);
+            in.erase(0, next);
+        }
+    }
+    return out;
+}
+
+// RFC 3986, section 5.2.3.
+std::string merge(const Parts& base, const std::string& refPath) {
+    if (base.hasAuthority && base.path.empty()) return "/" + refPath;
+    size_t slash = base.path.rfind('/');
+    return slash == std::string::npos ? refPath : base.path.substr(0, slash + 1) + refPath;
+}
+
+// RFC 3986, section 5.3.
+std::string recompose(const Parts& p) {
+    std::string out;
+    if (p.hasScheme) out += p.scheme + ":";
+    if (p.hasAuthority) out += "//" + p.authority;
+    out += p.path;
+    if (p.hasQuery) out += "?" + p.query;
+    if (p.hasFragment) out += "#" + p.fragment;
+    return out;
+}
+
+}  // namespace
+
+bool parseUrl(const std::string& text, Url& out) {
+    Parts p = split(text);
+    if (!p.hasScheme || !p.hasAuthority) return false;
+    out = Url();
+    out.scheme = lower(p.scheme);
+    out.authority = p.authority;
+    std::string hostPort = p.authority.substr(p.authority.find('@') == std::string::npos ? 0 : p.authority.find('@') + 1);
+    size_t colon = hostPort.rfind(':');
+    if (colon != std::string::npos && hostPort.find(']', colon) == std::string::npos) {
+        out.port = std::atoi(hostPort.c_str() + colon + 1);
+        hostPort = hostPort.substr(0, colon);
+    }
+    out.host = lower(hostPort);
+    if (out.host.empty()) return false;
+    out.path = p.path;
+    out.query = p.query;
+    out.fragment = p.fragment;
+    out.hasAuthority = true;
+    out.hasQuery = p.hasQuery;
+    out.hasFragment = p.hasFragment;
+    return true;
+}
+
+bool isGemini(const std::string& url) {
+    Parts p = split(url);
+    return p.hasScheme && lower(p.scheme) == "gemini";
+}
+
+std::string resolve(const std::string& baseText, const std::string& refText) {
+    Parts base = split(baseText), r = split(refText), t;
+    if (r.hasScheme) {
+        t = r;
+        t.path = removeDotSegments(r.path);
+    } else {
+        if (r.hasAuthority) {
+            t.authority = r.authority;
+            t.hasAuthority = true;
+            t.path = removeDotSegments(r.path);
+            t.query = r.query;
+            t.hasQuery = r.hasQuery;
+        } else {
+            if (r.path.empty()) {
+                t.path = base.path;
+                t.query = r.hasQuery ? r.query : base.query;
+                t.hasQuery = r.hasQuery || base.hasQuery;
+            } else {
+                t.path = removeDotSegments(r.path[0] == '/' ? r.path : merge(base, r.path));
+                t.query = r.query;
+                t.hasQuery = r.hasQuery;
+            }
+            t.authority = base.authority;
+            t.hasAuthority = base.hasAuthority;
+        }
+        t.scheme = base.scheme;
+        t.hasScheme = base.hasScheme;
+    }
+    t.fragment = r.fragment;
+    t.hasFragment = r.hasFragment;
+    return recompose(t);
+}
+
+std::string requestUrl(const std::string& url) {
+    Url u;
+    if (!parseUrl(url, u)) return url;
+    std::string out = u.scheme + "://" + u.host;
+    if (u.port > 0 && u.port != 1965) out += ":" + std::to_string(u.port);
+    out += u.path.empty() ? "/" : u.path;
+    if (u.hasQuery) out += "?" + u.query;
+    return out;
+}
+
+std::string encodeQuery(const std::string& text) {
+    std::string out;
+    for (unsigned char c : text) {
+        if (std::isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') out += static_cast<char>(c);
+        else {
+            char buf[4];
+            std::snprintf(buf, sizeof buf, "%%%02X", c);
+            out += buf;
+        }
+    }
+    return out;
+}
+
+std::string savedPath(const std::string& url) {
+    Url u;
+    if (!parseUrl(url, u)) return "/gemini/saved/unknown.gmi";
+    std::string out = "/gemini/saved/" + storage::sanitize(u.host + (u.port > 0 && u.port != 1965 ? "_" + std::to_string(u.port) : ""));
+    std::string path = u.path.empty() ? "/" : u.path;
+    std::vector<std::string> parts;
+    size_t start = 1;
+    while (start <= path.size()) {
+        size_t slash = path.find('/', start);
+        if (slash == std::string::npos) slash = path.size();
+        parts.push_back(path.substr(start, slash - start));
+        start = slash + 1;
+    }
+    if (parts.empty() || parts.back().empty()) {
+        if (!parts.empty()) parts.pop_back();
+        parts.push_back("index");
+    }
+    for (size_t i = 0; i < parts.size(); i++) {
+        std::string name = parts[i];
+        if (i + 1 == parts.size()) {
+            if (u.hasQuery) name += "~" + u.query;
+            if (name.size() < 4 || name.compare(name.size() - 4, 4, ".gmi") != 0) name += ".gmi";
+        }
+        out += "/" + storage::sanitize(name);
+    }
+    return out;
+}
+
+}  // namespace roro::gemini

lib/gemini/src/gemini_url.h

@@ -0,0 +1,28 @@
+#pragma once
+
+#include <string>
+
+namespace roro::gemini {
+
+// A URL split per RFC 3986 (appendix B). For Gemini, the host is lower-cased and the port
+// defaults to 1965.
+struct Url {
+    std::string scheme, authority, host, path, query, fragment;
+    int port = -1;
+    bool hasAuthority = false, hasQuery = false, hasFragment = false;
+    int portOrDefault() const { return port > 0 ? port : 1965; }
+};
+
+// False unless it has a scheme and a host: only absolute URLs are fetched.
+bool parseUrl(const std::string& text, Url& out);
+bool isGemini(const std::string& url);
+// `ref` against `base`, per RFC 3986 section 5.2 (dot segments included).
+std::string resolve(const std::string& base, const std::string& ref);
+// What goes on the wire: no fragment, lower-case host, never an empty path.
+std::string requestUrl(const std::string& url);
+// For input prompts: everything but unreserved characters percent-encoded (UTF-8 bytes).
+std::string encodeQuery(const std::string& text);
+// Where a Saved Page lives (Q82): /gemini/saved/<host>[_<port>]/<path>[~<query>].gmi
+std::string savedPath(const std::string& url);
+
+}  // namespace roro::gemini

lib/gemini/src/gemtext.cpp

@@ -0,0 +1,100 @@
+#include "gemtext.h"
+
+#include <cstdint>
+
+namespace roro::gemini {
+
+namespace {
+std::string trim(const std::string& s) {
+    size_t a = s.find_first_not_of(" \t"), b = s.find_last_not_of(" \t");
+    return a == std::string::npos ? "" : s.substr(a, b - a + 1);
+}
+}  // namespace
+
+GemLine parseGemLine(const std::string& line, bool& pre) {
+    GemLine g;
+    if (line.compare(0, 3, "```") == 0) {
+        g.type = LineType::PreToggle;
+        g.text = trim(line.substr(3));
+        pre = !pre;
+    } else if (pre) {
+        g.type = LineType::Preformatted;
+        g.text = line;
+    } else if (line.compare(0, 2, "=>") == 0) {
+        g.type = LineType::Link;
+        std::string rest = trim(line.substr(2));
+        size_t gap = rest.find_first_of(" \t");
+        g.url = rest.substr(0, gap);
+        g.text = gap == std::string::npos ? "" : trim(rest.substr(gap));
+        if (g.text.empty()) g.text = g.url;
+    } else if (line.compare(0, 3, "###") == 0) {
+        g.type = LineType::Heading3;
+        g.text = trim(line.substr(3));
+    } else if (line.compare(0, 2, "##") == 0) {
+        g.type = LineType::Heading2;
+        g.text = trim(line.substr(2));
+    } else if (line.compare(0, 1, "#") == 0) {
+        g.type = LineType::Heading1;
+        g.text = trim(line.substr(1));
+    } else if (line.compare(0, 2, "* ") == 0) {
+        g.type = LineType::ListItem;
+        g.text = trim(line.substr(2));
+    } else if (line.compare(0, 1, ">") == 0) {
+        g.type = LineType::Quote;
+        g.text = trim(line.substr(1));
+    } else {
+        g.text = line;
+    }
+    return g;
+}
+
+std::vector<GemLine> parseGemtext(const std::string& document) {
+    std::vector<GemLine> lines;
+    bool pre = false;
+    size_t start = 0;
+    while (start < document.size()) {
+        size_t end = document.find('\n', start);
+        if (end == std::string::npos) end = document.size();
+        std::string line = document.substr(start, end - start);
+        if (!line.empty() && line.back() == '\r') line.pop_back();
+        start = end + 1;
+        lines.push_back(parseGemLine(line, pre));
+    }
+    return lines;
+}
+
+std::string displayText(const std::string& s) {
+    std::string out;
+    size_t column = 0;
+    for (size_t i = 0; i < s.size();) {
+        unsigned char c = static_cast<unsigned char>(s[i]);
+        if (c == '\t') {
+            do out += ' ';
+            while (++column % 4);
+            i++;
+            continue;
+        }
+        if (c < 0x80) {
+            out += static_cast<char>(c);
+            i++;
+        } else {
+            int len = (c & 0xE0) == 0xC0 ? 2 : (c & 0xF0) == 0xE0 ? 3 : (c & 0xF8) == 0xF0 ? 4 : 0;
+            bool valid = len > 0 && i + len <= s.size();
+            for (int k = 1; valid && k < len; k++) valid = (static_cast<unsigned char>(s[i + k]) & 0xC0) == 0x80;
+            if (!valid) {
+                out += '?';
+                i++;
+            } else {
+                uint32_t cp = len == 2 ? (c & 0x1F) : len == 3 ? (c & 0x0F) : (c & 0x07);
+                for (int k = 1; k < len; k++) cp = (cp << 6) | (static_cast<unsigned char>(s[i + k]) & 0x3F);
+                if (cp <= 0xFF) out.append(s, i, len);  // Latin-1: the fonts have it
+                else out += '?';
+                i += len;
+            }
+        }
+        column++;
+    }
+    return out;
+}
+
+}  // namespace roro::gemini

lib/gemini/src/gemtext.h

@@ -0,0 +1,25 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+namespace roro::gemini {
+
+enum class LineType { Text, Link, Heading1, Heading2, Heading3, ListItem, Quote, PreToggle, Preformatted };
+
+// One gemtext line. Link: `url` and its label in `text` (the URL itself without a label).
+// PreToggle: the ``` line, with its alt text. Preformatted: kept exactly.
+struct GemLine {
+    LineType type = LineType::Text;
+    std::string text, url;
+};
+
+// One line; `preformatted` carries the ``` state from line to line (start with false).
+GemLine parseGemLine(const std::string& line, bool& preformatted);
+std::vector<GemLine> parseGemtext(const std::string& document);
+
+// For the Latin-1 fonts (Q79): valid UTF-8 up to U+00FF kept, anything else '?', and tabs
+// expanded to 4-column stops.
+std::string displayText(const std::string& utf8);
+
+}  // namespace roro::gemini

lib/gemini/src/text_buffer.cpp

@@ -0,0 +1,47 @@
+#include "text_buffer.h"
+
+#include <algorithm>
+
+namespace roro::gemini {
+
+void TextBuffer::append(const char* data, size_t len) {
+    bytes_ += len;
+    for (size_t i = 0; i < len; i++) {
+        if (data[i] == '\n') endLine();
+        else partial_ += data[i];
+    }
+}
+
+void TextBuffer::finish() {
+    if (!partial_.empty()) endLine();
+}
+
+void TextBuffer::endLine() {
+    if (!partial_.empty() && partial_.back() == '\r') partial_.pop_back();
+    size_t len = std::min<size_t>(partial_.size(), 0xFFFF);
+    // A line never spans two chunks: a new chunk when it doesn't fit (bigger if the line is).
+    if (chunks_.empty() || chunks_.back().size() + len > chunks_.back().capacity()) {
+        chunks_.emplace_back();
+        chunks_.back().reserve(std::max(kChunk, len));
+    }
+    std::string& chunk = chunks_.back();
+    lines_.push_back({static_cast<uint16_t>(chunks_.size() - 1), static_cast<uint16_t>(chunk.size()),
+                      static_cast<uint16_t>(len)});
+    chunk.append(partial_, 0, len);
+    partial_.clear();
+}
+
+std::string TextBuffer::line(size_t i) const {
+    if (i >= lines_.size()) return "";
+    const Ref& r = lines_[i];
+    return chunks_[r.chunk].substr(r.offset, r.length);
+}
+
+void TextBuffer::clear() {
+    chunks_.clear();
+    lines_.clear();
+    partial_.clear();
+    bytes_ = 0;
+}
+
+}  // namespace roro::gemini

lib/gemini/src/text_buffer.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::gemini {
+
+// A page's text, kept as lines in 4 KB chunks: no large contiguous block (with IRC connected the
+// largest free block is about 31 KB) and no copy when it grows. About 4 bytes per line on top of
+// the text itself. Bytes are fed as they arrive; lines end at LF, a CR before it is dropped.
+class TextBuffer {
+   public:
+    static constexpr size_t kChunk = 4096;
+
+    void append(const char* data, size_t len);
+    void finish();  // the last line, if it has no line end
+    size_t lineCount() const { return lines_.size(); }
+    std::string line(size_t i) const;
+    size_t bytes() const { return bytes_; }
+    void clear();
+
+   private:
+    struct Ref {
+        uint16_t chunk;
+        uint16_t offset;
+        uint16_t length;
+    };
+    void endLine();
+
+    std::vector<std::string> chunks_;
+    std::vector<Ref> lines_;
+    std::string partial_;  // the line being received
+    size_t bytes_ = 0;
+};
+
+}  // namespace roro::gemini

lib/lora/src/loratap.cpp

@@ -0,0 +1,64 @@
+#include "loratap.h"
+
+#include <algorithm>
+#include <cmath>
+#include <cstdio>
+#include <ctime>
+
+namespace roro::lora {
+
+static void le16(std::vector<uint8_t>& o, uint16_t v) { o.insert(o.end(), {uint8_t(v), uint8_t(v >> 8)}); }
+static void le32(std::vector<uint8_t>& o, uint32_t v) {
+    o.insert(o.end(), {uint8_t(v), uint8_t(v >> 8), uint8_t(v >> 16), uint8_t(v >> 24)});
+}
+
+// LoRaTap's dBm encoding: -139 dBm plus the byte, clamped to what a byte holds.
+static uint8_t dbmByte(float dbm) {
+    long v = std::lround(dbm + 139);
+    return static_cast<uint8_t>(std::clamp(v, 0L, 255L));
+}
+
+std::string capturePath(int64_t utcSeconds) {
+    time_t t = static_cast<time_t>(utcSeconds);
+    struct tm u;
+    gmtime_r(&t, &u);
+    char buf[48];
+    std::snprintf(buf, sizeof buf, "/captures/lora/%04d%02d%02d-%02d%02d%02d.pcap", u.tm_year + 1900, u.tm_mon + 1,
+                  u.tm_mday, u.tm_hour, u.tm_min, u.tm_sec);
+    return buf;
+}
+
+void appendPcapHeader(std::vector<uint8_t>& out) {
+    le32(out, 0xA1B2C3D4);
+    le16(out, 2);
+    le16(out, 4);
+    le32(out, 0);      // time zone
+    le32(out, 0);      // timestamp accuracy
+    le32(out, 65535);  // snap length
+    le32(out, 270);    // LINKTYPE_LORATAP
+}
+
+void appendRecord(std::vector<uint8_t>& out, uint32_t seconds, uint32_t micros, const RxInfo& rx, const uint8_t* data,
+                  size_t len) {
+    uint32_t captured = static_cast<uint32_t>(kLoraTapSize + len);
+    le32(out, seconds);
+    le32(out, micros);
+    le32(out, captured);
+    le32(out, captured);
+
+    uint32_t f = rx.frequencyHz;
+    // The spec puts packet RSSI in quarter dB below 0 dB SNR (an SX127x formula), but Wireshark
+    // reads it as -139 dBm plus the byte either way, and the SX1262 already gives dBm.
+    uint8_t packetRssi = dbmByte(rx.rssi);
+    long snr = std::clamp(std::lround(rx.snr * 4), -128L, 127L);
+    out.insert(out.end(), {
+                              0, 0, 0, uint8_t(kLoraTapSize),  // version 0, padding, length
+                              uint8_t(f >> 24), uint8_t(f >> 16), uint8_t(f >> 8), uint8_t(f),
+                              uint8_t(std::lround(rx.bandwidthKHz / 125)), rx.spreadingFactor,
+                              packetRssi, dbmByte(rx.rssi), dbmByte(rx.noiseFloor),
+                              static_cast<uint8_t>(static_cast<int8_t>(snr)), rx.syncWord,
+                          });
+    if (len) out.insert(out.end(), data, data + len);
+}
+
+}  // namespace roro::lora

lib/lora/src/loratap.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::lora {
+
+// What the radio knew about one received packet.
+struct RxInfo {
+    uint32_t frequencyHz = 0;
+    float bandwidthKHz = 0;
+    uint8_t spreadingFactor = 0;
+    float rssi = 0;        // dBm
+    float snr = 0;         // dB
+    float noiseFloor = 0;  // dBm, instantaneous RSSI just before the packet, when known
+    uint8_t syncWord = 0;
+};
+
+// A Capture file (M3, Q97): pcap with LoRaTap v0 headers (LINKTYPE_LORATAP, 270), which Wireshark
+// reads. pcap fields are little-endian, LoRaTap fields big-endian.
+void appendPcapHeader(std::vector<uint8_t>& out);
+void appendRecord(std::vector<uint8_t>& out, uint32_t seconds, uint32_t micros, const RxInfo& rx, const uint8_t* data,
+                  size_t len);
+
+// "/captures/lora/YYYYMMDD-HHMMSS.pcap" in UTC, dated like Tracks so Storage Clean-up can age it.
+std::string capturePath(int64_t utcSeconds);
+
+constexpr size_t kLoraTapSize = 15;
+constexpr size_t kRecordOverhead = 16 + kLoraTapSize;
+
+}  // namespace roro::lora

lib/lora/src/packet_view.cpp

@@ -0,0 +1,83 @@
+#include "packet_view.h"
+
+#include <cmath>
+#include <cstdio>
+
+#include "meshtastic_header.h"
+#include "meshtastic_presets.h"
+
+namespace roro::lora {
+
+using namespace meshtastic;
+
+std::string row(const PacketSummary& p, const std::string& time) {
+    char s[64];
+    int n = std::snprintf(s, sizeof s, "%s %ld %.1f ", time.c_str(), std::lround(p.rssi), p.snr);
+    std::string out(s, n);
+    PacketHeader h;
+    if (!p.crcOk) return out + "bad CRC, " + std::to_string(p.len) + " B";
+    if (!p.meshtastic || !parseHeader(p.data, p.len, h)) return out + std::to_string(p.len) + " B";
+    auto shortId = [](uint32_t node) {
+        if (node == kBroadcast) return std::string("all");
+        char id[8];
+        std::snprintf(id, sizeof id, "%04x", static_cast<unsigned>(node & 0xFFFF));
+        return std::string(id);
+    };
+    out += shortId(h.from) + ">" + shortId(h.to);
+    if (h.hopsAway() >= 0) out += " " + std::to_string(h.hopsAway()) + "/" + std::to_string(h.hopStart());
+    return out;
+}
+
+std::vector<std::string> hexDump(const uint8_t* data, size_t len) {
+    std::vector<std::string> lines;
+    for (size_t at = 0; at < len; at += 8) {
+        char s[48];
+        int n = std::snprintf(s, sizeof s, "%04x", static_cast<unsigned>(at));
+        std::string text;
+        for (size_t i = 0; i < 8; ++i) {
+            if (at + i < len) {
+                n += std::snprintf(s + n, sizeof s - n, " %02x", data[at + i]);
+                uint8_t b = data[at + i];
+                text += b >= 0x20 && b < 0x7F ? static_cast<char>(b) : '.';
+            } else {
+                n += std::snprintf(s + n, sizeof s - n, "   ");
+            }
+        }
+        lines.push_back(std::string(s, n) + " " + text);
+    }
+    return lines;
+}
+
+std::vector<std::string> headerLines(const uint8_t* data, size_t len) {
+    PacketHeader h;
+    if (!parseHeader(data, len, h)) return {};
+    char s[64];
+    std::vector<std::string> lines;
+    lines.push_back("From " + nodeId(h.from) + " to " + nodeId(h.to));
+    std::snprintf(s, sizeof s, "Packet %08x%s%s", static_cast<unsigned>(h.id), h.wantAck() ? ", wants an ack" : "",
+                  h.viaMqtt() ? ", via MQTT" : "");
+    lines.push_back(s);
+    if (h.hopsAway() >= 0)
+        std::snprintf(s, sizeof s, "Hops %d of %u, limit %u left", h.hopsAway(), h.hopStart(), h.hopLimit());
+    else
+        std::snprintf(s, sizeof s, "Hop limit %u left (old firmware)", h.hopLimit());
+    lines.push_back(s);
+    // Which preset's default Channel (named after it, with the public key) has this hash.
+    std::string channel;
+    for (size_t i = 0; i < kEu868PresetCount && channel.empty(); ++i)
+        if (channelHash(kEu868Presets[i].name, kDefaultKey, sizeof kDefaultKey) == h.channelHash)
+            channel = std::string(" (") + kEu868Presets[i].name + ", default key)";
+    std::snprintf(s, sizeof s, "Channel 0x%02x%s", h.channelHash, channel.c_str());
+    lines.push_back(s);
+    if (h.relayNode) {
+        std::snprintf(s, sizeof s, "Relayed by ..%02x", h.relayNode);
+        lines.push_back(s);
+    }
+    if (h.nextHop) {
+        std::snprintf(s, sizeof s, "Next hop ..%02x", h.nextHop);
+        lines.push_back(s);
+    }
+    return lines;
+}
+
+}  // namespace roro::lora

lib/lora/src/packet_view.h

@@ -0,0 +1,29 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::lora {
+
+// What the LoRa Scanner shows of one packet (M3, Q96).
+struct PacketSummary {
+    const uint8_t* data;
+    size_t len;
+    float rssi, snr;
+    bool crcOk;
+    bool meshtastic;  // received on Meshtastic settings (sync word 0x2B): read its clear header
+};
+
+// One list row, at most about 36 characters: "21:45:07 -97 6.2 5678>all 1/3". Nodes by their default
+// short name (the last 4 hex digits); headerLines() has the full numbers.
+std::string row(const PacketSummary& p, const std::string& time);
+
+// Eight bytes a line, with the printable ones: "0000 ff ff ff ff 78 56 34 12 ....xV4.".
+std::vector<std::string> hexDump(const uint8_t* data, size_t len);
+
+// The Meshtastic header, one field a line; empty when the packet is too short to have one.
+std::vector<std::string> headerLines(const uint8_t* data, size_t len);
+
+}  // namespace roro::lora

lib/lora/src/sweep_view.cpp

@@ -0,0 +1,48 @@
+#include "sweep_view.h"
+
+#include <algorithm>
+
+namespace roro::lora {
+
+namespace {
+constexpr int kPeakAboveFloorDb = 10;
+constexpr size_t kMaxPeaks = 3;
+}  // namespace
+
+SweepStats summarize(const int8_t* dbm, size_t steps, uint32_t fromHz, uint32_t stepHz) {
+    SweepStats s;
+    if (!steps) return s;
+    std::vector<int8_t> sorted(dbm, dbm + steps);
+    std::nth_element(sorted.begin(), sorted.begin() + steps / 2, sorted.end());
+    s.floor = sorted[steps / 2];
+    s.top = *std::max_element(dbm, dbm + steps);
+    for (size_t i = 0; i < steps; ++i) {
+        int v = dbm[i];
+        bool localMax = (i == 0 || v >= dbm[i - 1]) && (i + 1 == steps || v > dbm[i + 1]);
+        if (localMax && v >= s.floor + kPeakAboveFloorDb) s.peaks.push_back({fromHz + static_cast<uint32_t>(i) * stepHz, v});
+    }
+    std::stable_sort(s.peaks.begin(), s.peaks.end(), [](const SweepPeak& a, const SweepPeak& b) { return a.dbm > b.dbm; });
+    if (s.peaks.size() > kMaxPeaks) s.peaks.resize(kMaxPeaks);
+    return s;
+}
+
+uint8_t heatLevel(int dbm, int low, int high) {
+    if (dbm <= low) return 0;
+    if (dbm >= high) return 255;
+    return static_cast<uint8_t>((dbm - low) * 255 / (high - low) + ((dbm - low) * 255 % (high - low) ? 1 : 0));
+}
+
+uint16_t heatColor(uint8_t level) {
+    // Five segments of 51 steps each.
+    auto rgb = [](int r, int g, int b) { return static_cast<uint16_t>((r >> 3) << 11 | (g >> 2) << 5 | (b >> 3)); };
+    int seg = std::min(level / 51, 4), t = (level - seg * 51) * 255 / 51;
+    switch (seg) {
+        case 0: return rgb(0, 0, t);              // black to blue
+        case 1: return rgb(0, t, 255);            // blue to cyan
+        case 2: return rgb(0, 255, 255 - t);      // cyan to green
+        case 3: return rgb(t, 255, 0);            // green to yellow
+        default: return rgb(255, 255 - t, 0);     // yellow to red
+    }
+}
+
+}  // namespace roro::lora

lib/lora/src/sweep_view.h

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+namespace roro::lora {
+
+// What a Sweep pass says about the band (M3, Q98): one RSSI reading (dBm) per step.
+struct SweepPeak {
+    uint32_t hz;
+    int dbm;
+};
+struct SweepStats {
+    int floor = 0;  // the median: the band's noise floor, whatever a few signals do
+    int top = 0;    // the strongest reading
+    std::vector<SweepPeak> peaks;  // at most 3, strongest first, each a local maximum >= 10 dB above the floor
+};
+
+SweepStats summarize(const int8_t* dbm, size_t steps, uint32_t fromHz, uint32_t stepHz);
+
+// The waterfall's colours: a reading between `low` and `high` dBm as 0..255, then RGB565 along
+// black, blue, cyan, green, yellow, red.
+uint8_t heatLevel(int dbm, int low, int high);
+uint16_t heatColor(uint8_t level);
+
+}  // namespace roro::lora

lib/meshtastic/src/meshtastic_header.cpp

@@ -0,0 +1,28 @@
+#include "meshtastic_header.h"
+
+#include <cstdio>
+
+namespace roro::meshtastic {
+
+static uint32_t le32(const uint8_t* p) { return p[0] | p[1] << 8 | p[2] << 16 | static_cast<uint32_t>(p[3]) << 24; }
+
+bool parseHeader(const uint8_t* data, size_t len, PacketHeader& out) {
+    if (!data || len < kHeaderSize) return false;
+    out.to = le32(data);
+    out.from = le32(data + 4);
+    out.id = le32(data + 8);
+    out.flags = data[12];
+    out.channelHash = data[13];
+    out.nextHop = data[14];
+    out.relayNode = data[15];
+    return true;
+}
+
+std::string nodeId(uint32_t node) {
+    if (node == kBroadcast) return "all";
+    char s[10];
+    std::snprintf(s, sizeof s, "!%08x", static_cast<unsigned>(node));
+    return s;
+}
+
+}  // namespace roro::meshtastic

lib/meshtastic/src/meshtastic_header.h

@@ -0,0 +1,36 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace roro::meshtastic {
+
+constexpr uint32_t kBroadcast = 0xFFFFFFFF;
+
+// The 16 bytes every Meshtastic packet starts with, sent in clear (little-endian). The payload
+// after it is encrypted with the Channel's key.
+struct PacketHeader {
+    uint32_t to = 0, from = 0, id = 0;
+    uint8_t flags = 0;
+    uint8_t channelHash = 0;  // the Channel's name and key folded into a byte (see channelHash())
+    uint8_t nextHop = 0;      // last byte of the Node meant to relay it next; 0 when flooding
+    uint8_t relayNode = 0;    // last byte of the Node that relayed it to us
+
+    uint8_t hopLimit() const { return flags & 0x07; }
+    bool wantAck() const { return flags & 0x08; }
+    bool viaMqtt() const { return flags & 0x10; }
+    uint8_t hopStart() const { return flags >> 5; }
+    bool broadcast() const { return to == kBroadcast; }
+    // How many times it was relayed before we heard it; -1 when the sender didn't say (hop start 0).
+    int hopsAway() const { return hopStart() == 0 ? -1 : hopStart() - hopLimit(); }
+};
+
+constexpr size_t kHeaderSize = 16;
+
+bool parseHeader(const uint8_t* data, size_t len, PacketHeader& out);
+
+// "!12345678", as Meshtastic writes node numbers; "all" for broadcast.
+std::string nodeId(uint32_t node);
+
+}  // namespace roro::meshtastic

lib/meshtastic/src/meshtastic_presets.cpp

@@ -0,0 +1,47 @@
+#include "meshtastic_presets.h"
+
+#include <cmath>
+#include <cstring>
+
+namespace roro::meshtastic {
+
+const uint8_t kDefaultKey[16] = {0xd4, 0xf1, 0xbb, 0x3a, 0x20, 0x29, 0x07, 0x59,
+                                 0xf0, 0xbc, 0xff, 0xab, 0xcf, 0x4e, 0x69, 0x01};
+
+// firmware src/mesh/MeshRadio.h (modemPresetToParams) and RadioInterface.cpp (PRESETS_EU_868).
+const Preset kEu868Presets[] = {
+    {"LongFast", 250, 11, 5},  {"LongSlow", 125, 12, 8},  {"MediumSlow", 250, 10, 5}, {"MediumFast", 250, 9, 5},
+    {"ShortSlow", 250, 8, 5},  {"ShortFast", 250, 7, 5},  {"LongMod", 125, 11, 8},
+};
+const size_t kEu868PresetCount = sizeof kEu868Presets / sizeof kEu868Presets[0];
+
+const Preset* findPreset(const char* name) {
+    for (const Preset& p : kEu868Presets)
+        if (std::strcmp(p.name, name) == 0) return &p;
+    return nullptr;
+}
+
+uint32_t djb2(const char* s) {
+    uint32_t h = 5381;
+    for (; *s; ++s) h = (h << 5) + h + static_cast<unsigned char>(*s);
+    return h;
+}
+
+uint8_t channelHash(const char* name, const uint8_t* key, size_t keyLen) {
+    uint8_t h = 0;
+    for (; *name; ++name) h ^= static_cast<uint8_t>(*name);
+    for (size_t i = 0; i < keyLen; ++i) h ^= key[i];
+    return h;
+}
+
+uint32_t eu868FrequencyHz(const Preset& preset, const char* channelName) {
+    constexpr double kStartMHz = 869.4, kEndMHz = 869.65;
+    double slotMHz = preset.bwKHz / 1000.0;
+    uint32_t slots = static_cast<uint32_t>(std::lround((kEndMHz - kStartMHz) / slotMHz));
+    const char* name = channelName && *channelName ? channelName : preset.name;
+    uint32_t slot = slots ? djb2(name) % slots : 0;
+    double mhz = kStartMHz + slotMHz / 2 + slot * slotMHz;
+    return static_cast<uint32_t>(std::lround(mhz * 1e6));
+}
+
+}  // namespace roro::meshtastic

lib/meshtastic/src/meshtastic_presets.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace roro::meshtastic {
+
+// Radio settings shared by every Meshtastic preset (firmware src/mesh/RadioInterface.h).
+constexpr uint8_t kSyncWord = 0x2B;
+constexpr uint16_t kPreambleLength = 16;
+
+// The default Channel key ("AQ==", expanded): public, so the default Channel is readable by anyone.
+extern const uint8_t kDefaultKey[16];
+
+// A modem preset: bandwidth, spreading factor and coding rate (4/cr). Named as Meshtastic shows them.
+struct Preset {
+    const char* name;
+    float bwKHz;
+    uint8_t sf;
+    uint8_t cr;
+};
+
+// The presets Meshtastic allows in EU_868, its order, LongFast (the default) first.
+extern const Preset kEu868Presets[];
+extern const size_t kEu868PresetCount;
+const Preset* findPreset(const char* name);  // nullptr when EU_868 doesn't allow it
+
+// djb2, as Meshtastic hashes a Channel's name to pick a frequency slot.
+uint32_t djb2(const char* s);
+
+// The byte in every packet header naming its Channel: the name's bytes XORed with the key's.
+uint8_t channelHash(const char* name, const uint8_t* key, size_t keyLen);
+
+// EU_868 is 869.4 to 869.65 MHz: the slot comes from the Channel's name (the preset's name for
+// an unnamed Channel, which is the default).
+uint32_t eu868FrequencyHz(const Preset& preset, const char* channelName = nullptr);
+
+}  // namespace roro::meshtastic

lib/net/src/ipv4.cpp

@@ -0,0 +1,97 @@
+#include "ipv4.h"
+
+#include <cstdio>
+
+namespace roro::net {
+
+bool parseIpv4(const std::string& text, uint32_t& out) {
+    uint32_t value = 0;
+    int parts = 0, digits = 0, part = 0;
+    for (char c : text) {
+        if (c >= '0' && c <= '9') {
+            if (++digits > 3) return false;
+            part = part * 10 + (c - '0');
+            if (part > 255) return false;
+        } else if (c == '.') {
+            if (digits == 0 || ++parts > 3) return false;
+            value = value << 8 | part;
+            part = digits = 0;
+        } else {
+            return false;
+        }
+    }
+    if (digits == 0 || parts != 3) return false;
+    out = value << 8 | part;
+    return true;
+}
+
+std::string formatIpv4(uint32_t a) {
+    char s[16];
+    std::snprintf(s, sizeof s, "%u.%u.%u.%u", static_cast<unsigned>(a >> 24), static_cast<unsigned>(a >> 16 & 255),
+                  static_cast<unsigned>(a >> 8 & 255), static_cast<unsigned>(a & 255));
+    return s;
+}
+
+uint32_t maskOf(int prefix) { return prefix <= 0 ? 0 : prefix >= 32 ? 0xFFFFFFFFu : ~0u << (32 - prefix); }
+
+std::string checkFixed(const FixedIp& f) {
+    if (f.prefix < 1 || f.prefix > 30) return "The prefix must be 1 to 30";
+    if (f.address == 0) return "0.0.0.0 isn't an address a device can have";
+    uint32_t mask = maskOf(f.prefix), network = f.address & mask, broadcast = network | ~mask;
+    if (f.address == network) return formatIpv4(f.address) + " is the network's own address";
+    if (f.address == broadcast) return formatIpv4(f.address) + " is the broadcast address";
+    if (f.gateway == 0) return "";
+    if (f.gateway == f.address) return "The gateway can't be this device's address";
+    if ((f.gateway & mask) != network)
+        return "The gateway " + formatIpv4(f.gateway) + " isn't in " + formatIpv4(network) + "/" + std::to_string(f.prefix);
+    if (f.gateway == broadcast) return "The gateway " + formatIpv4(f.gateway) + " is the broadcast address";
+    if (f.gateway == network) return "The gateway " + formatIpv4(f.gateway) + " is the network's own address";
+    return "";
+}
+
+std::string parseFixed(const std::string& text, FixedIp& out) {
+    size_t slash = text.find('/');
+    if (slash == std::string::npos) return "Write it as address/prefix, then the gateway if there is one";
+    size_t space = text.find(' ', slash);
+    std::string address = text.substr(0, slash);
+    std::string prefix = text.substr(slash + 1, space == std::string::npos ? std::string::npos : space - slash - 1);
+    std::string gateway = space == std::string::npos ? "" : text.substr(space + 1);
+    FixedIp f;
+    if (!parseIpv4(address, f.address)) return address + " isn't an IPv4 address";
+    int p = 0;
+    if (prefix.empty() || prefix.size() > 2) return "The prefix must be 1 to 30";
+    for (char c : prefix) {
+        if (c < '0' || c > '9') return "The prefix must be 1 to 30";
+        p = p * 10 + (c - '0');
+    }
+    f.prefix = static_cast<uint8_t>(p);
+    if (!gateway.empty() && !parseIpv4(gateway, f.gateway)) return gateway + " isn't an IPv4 address";
+    std::string why = checkFixed(f);
+    if (why.empty()) out = f;
+    return why;
+}
+
+std::string formatFixed(const FixedIp& f) {
+    std::string s = formatIpv4(f.address) + "/" + std::to_string(f.prefix);
+    if (f.gateway) s += " " + formatIpv4(f.gateway);
+    return s;
+}
+
+bool validHost(const std::string& text) {
+    if (text.empty() || text.size() > 63) return false;
+    uint32_t ignored;
+    if (parseIpv4(text, ignored)) return true;
+    bool allNumeric = true;  // digits and dots only, but not an address: "1.2.3", "999.1.1.1"
+    char previous = '.';
+    for (char c : text) {
+        bool letter = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z'), digit = c >= '0' && c <= '9';
+        if (!letter && !digit && c != '-' && c != '.') return false;
+        if (c == '.' && (previous == '.' || previous == '-')) return false;  // empty label, or one ending in '-'
+        if (c == '-' && previous == '.') return false;                       // a label starting with '-'
+        if (letter || c == '-') allNumeric = false;
+        previous = c;
+    }
+    return previous != '.' && previous != '-' && !allNumeric;
+}
+
+}  // namespace roro::net

lib/net/src/ipv4.h

@@ -0,0 +1,30 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+namespace roro::net {
+
+// IPv4 addresses as 32-bit numbers, most significant byte first: 10.39.39.12 is 0x0A27270C.
+bool parseIpv4(const std::string& text, uint32_t& out);  // strict: four decimal numbers, 0 to 255
+std::string formatIpv4(uint32_t address);
+uint32_t maskOf(int prefix);  // 24 -> 255.255.255.0
+
+// A Saved Network's Fixed setting (S1, Q105 to Q107). gateway 0: none.
+struct FixedIp {
+    uint32_t address = 0;
+    uint8_t prefix = 24;
+    uint32_t gateway = 0;
+};
+
+// "" when a device can use it, otherwise why not, for a human (Q111).
+std::string checkFixed(const FixedIp& f);
+
+// "address/prefix [gateway]", as typed on the console and kept in flash. parseFixed() also checks.
+std::string parseFixed(const std::string& text, FixedIp& out);
+std::string formatFixed(const FixedIp& f);
+
+// An IPv4 address or a host name, as an NTP server may be (Q110).
+bool validHost(const std::string& text);
+
+}  // namespace roro::net

lib/net/src/traffic.cpp

@@ -0,0 +1,46 @@
+#include "traffic.h"
+
+#include <atomic>
+#include <cstdio>
+
+namespace roro::net {
+
+namespace {
+constexpr size_t kUsers = static_cast<size_t>(User::Count);
+std::atomic<uint32_t> in_[kUsers], out_[kUsers];
+}  // namespace
+
+const char* userName(User user) {
+    switch (user) {
+        case User::Irc: return "IRC";
+        case User::Gemini: return "Gemini";
+        case User::DebugConsole: return "Debug Console";
+        case User::Updates: return "Updates";
+        default: return "?";
+    }
+}
+
+void received(User user, size_t bytes) { in_[static_cast<size_t>(user)] += static_cast<uint32_t>(bytes); }
+void sent(User user, size_t bytes) { out_[static_cast<size_t>(user)] += static_cast<uint32_t>(bytes); }
+Traffic traffic(User user) { return {in_[static_cast<size_t>(user)], out_[static_cast<size_t>(user)]}; }
+
+void resetTraffic() {
+    for (size_t i = 0; i < kUsers; i++) in_[i] = out_[i] = 0;
+}
+
+uint32_t bytesPerSecond(uint32_t before, uint32_t now, uint32_t elapsedMs) {
+    if (!elapsedMs) return 0;
+    return static_cast<uint32_t>(static_cast<uint64_t>(now - before) * 1000 / elapsedMs);  // wraps with the counter
+}
+
+std::string formatTraffic(uint32_t bytes) {
+    char s[16];
+    if (bytes < 1000) std::snprintf(s, sizeof s, "%u B", static_cast<unsigned>(bytes));
+    else if (bytes < 10 * 1024) std::snprintf(s, sizeof s, "%.1f KB", bytes / 1024.0);
+    else if (bytes < 1000 * 1024) std::snprintf(s, sizeof s, "%u KB", static_cast<unsigned>(bytes / 1024));
+    else if (bytes < 10u * 1024 * 1024) std::snprintf(s, sizeof s, "%.1f MB", bytes / 1048576.0);
+    else std::snprintf(s, sizeof s, "%u MB", static_cast<unsigned>(bytes / 1048576));
+    return s;
+}
+
+}  // namespace roro::net

lib/net/src/traffic.h

@@ -0,0 +1,26 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace roro::net {
+
+// Bytes each network service has read and written since boot (S1, Q121), as the service sees
+// them: for TLS connections that's the plain text, without the handshake or record overhead.
+// Counted from the services' own tasks, read from the main loop.
+enum class User : uint8_t { Irc, Gemini, DebugConsole, Updates, Count };
+const char* userName(User user);
+
+struct Traffic {
+    uint32_t in = 0, out = 0;
+};
+void received(User user, size_t bytes);
+void sent(User user, size_t bytes);
+Traffic traffic(User user);
+void resetTraffic();  // for tests
+
+uint32_t bytesPerSecond(uint32_t before, uint32_t now, uint32_t elapsedMs);
+std::string formatTraffic(uint32_t bytes);  // "999 B", "1.5 KB", "12 KB", "1.7 MB"
+
+}  // namespace roro::net

lib/ota/src/file_receiver.cpp

@@ -94,6 +94,11 @@ void FileReceiver::chunkWritten(bool ok, uint32_t nowMs) {
     state_ = received_ == size_ ? State::Finishing : State::Receiving;
 }
 
+void FileReceiver::cardChecked(const uint8_t digest[32]) {
+    if (state_ != State::Finishing) return;
+    if (std::memcmp(digest, expected_, sizeof expected_) != 0) fail("the copy on the card differs");
+}
+
 void FileReceiver::finished(bool ok) {
     if (state_ != State::Finishing) return;
     if (!ok) return fail("rename failed");

lib/ota/src/file_receiver.h

@@ -34,6 +34,9 @@ class FileReceiver {
     // Takes bytes for the current chunk; returns how many were used (none while a chunk waits).
     size_t feed(const uint8_t* data, size_t len, uint32_t nowMs);
     void chunkWritten(bool ok, uint32_t nowMs);
+    // While Finishing: the SHA-256 of the file as read back from the card. The checksum on the
+    // received bytes doesn't prove the card kept them (a failed write can lose buffered data).
+    void cardChecked(const uint8_t digest[32]);
     void finished(bool ok);
     void tick(uint32_t nowMs);
     void reset() { *this = FileReceiver(); }

lib/services/src/settings.cpp

@@ -1,5 +1,7 @@
 #include "settings.h"
 
+#include "ipv4.h"
+
 namespace roro {
 
 namespace {
@@ -31,6 +33,12 @@ const Definition kDefinitions[] = {
     {"wifi_on", Kind::Bool, 1, nullptr, 0, 1},
     {"gnss_on", Kind::Bool, 1, nullptr, 0, 1},
     {"coord_dms", Kind::Bool, 0, nullptr, 0, 1},
+    {"lora_preset", Kind::Int, 0, nullptr, 0, 6},  // LongFast first
+    {"dns1", Kind::String, 0, "9.9.9.9", 7, 15},  // Quad9
+    {"dns2", Kind::String, 0, "1.1.1.1", 0, 15},  // Cloudflare
+    {"dns_always", Kind::Bool, 0, nullptr, 0, 1},
+    {"ntp1", Kind::String, 0, "pool.ntp.org", 1, 63},
+    {"ntp2", Kind::String, 0, "time.cloudflare.com", 0, 63},
 };
 static_assert(sizeof(kDefinitions) / sizeof(kDefinitions[0]) == static_cast<size_t>(Setting::Count),
               "every Setting needs a definition");
@@ -83,6 +91,11 @@ bool Settings::validString(Setting s, const std::string& value) const {
             if (value == region) return true;
         return false;
     }
+    uint32_t address;
+    if (s == Setting::Dns1) return net::parseIpv4(value, address);
+    if (s == Setting::Dns2) return value.empty() || net::parseIpv4(value, address);
+    if (s == Setting::Ntp1) return net::validHost(value);
+    if (s == Setting::Ntp2) return value.empty() || net::validHost(value);
     return true;
 }
 

lib/services/src/settings.h

@@ -23,6 +23,12 @@ enum class Setting : uint8_t {
     WifiEnabled,      // bool: the Wi-Fi Service stays Connected when a Saved Network is in range
     GnssEnabled,      // bool: the GNSS Service reads the receiver (M2, Q58)
     CoordinatesDms,   // bool: show degrees, minutes and seconds instead of decimal degrees (Q64)
+    LoraPreset,       // int: the LoRa Scanner's Meshtastic preset, an index into the EU868 list (M3, Q95)
+    Dns1,             // string: the first DNS server, an IPv4 address (S1, Q108, Q109)
+    Dns2,             // string: the second, or empty
+    DnsAlways,        // bool: use them on Automatic (DHCP) networks too, instead of DHCP's
+    Ntp1,             // string: the first NTP server, a host name or an IPv4 address (S1, Q110)
+    Ntp2,             // string: the second, or empty
     Count
 };
 

lib/storage_model/src/cleanup_plan.h

@@ -20,6 +20,7 @@ inline const CleanupCategory kCleanupCategories[] = {
     {"IRC logs", "/irc"},
     {"Wi-Fi scan logs", "/wifi/scans"},
     {"Wi-Fi captures", "/captures/wifi"},
+    {"LoRa captures", "/captures/lora"},
     {"GNSS tracks", "/gnss/tracks"},
 };
 

lib/storage_model/src/sd_card_id.cpp

@@ -0,0 +1,53 @@
+#include "sd_card_id.h"
+
+#include <cstdio>
+
+namespace roro {
+
+namespace {
+char printable(uint8_t b) { return b >= 0x20 && b < 0x7F ? static_cast<char>(b) : '?'; }
+}  // namespace
+
+SdCardId parseSdCid(const uint8_t cid[16]) {
+    SdCardId id;
+    id.manufacturer = cid[0];
+    for (int i = 0; i < 2; ++i) id.oem[i] = printable(cid[1 + i]);
+    for (int i = 0; i < 5; ++i) id.product[i] = printable(cid[3 + i]);
+    id.revisionMajor = cid[8] >> 4;
+    id.revisionMinor = cid[8] & 0x0F;
+    id.serial = static_cast<uint32_t>(cid[9]) << 24 | cid[10] << 16 | cid[11] << 8 | cid[12];
+    // 4 reserved bits, 8 bits of year since 2000, 4 bits of month.
+    id.year = 2000 + (((cid[13] & 0x0F) << 4) | (cid[14] >> 4));
+    id.month = cid[14] & 0x0F;
+    return id;
+}
+
+const char* sdManufacturerName(uint8_t id) {
+    switch (id) {
+        case 0x01: return "Panasonic";
+        case 0x02: return "Toshiba/Kioxia";
+        case 0x03: return "SanDisk";
+        case 0x1B: return "Samsung";
+        case 0x1D: return "ADATA";
+        case 0x27: return "Phison";
+        case 0x28: return "Lexar";
+        case 0x31: return "Silicon Power";
+        case 0x41: return "Kingston";
+        case 0x74: return "Transcend";
+        case 0x76: return "Patriot";
+        case 0x82: return "Sony";
+        case 0x9C: return "Angelbird/Hoodman";
+        case 0xAD: return "Longsys/Lexar";
+        default: return "unknown";
+    }
+}
+
+std::string sdCardSummary(const SdCardId& id) {
+    char s[112];
+    std::snprintf(s, sizeof s, "%s (0x%02X) \"%s\" \"%s\" rev %u.%u, serial %08x, made %04d-%02d",
+                  sdManufacturerName(id.manufacturer), id.manufacturer, id.oem, id.product, id.revisionMajor,
+                  id.revisionMinor, static_cast<unsigned>(id.serial), id.year, id.month);
+    return s;
+}
+
+}  // namespace roro

lib/storage_model/src/sd_card_id.h

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+namespace roro {
+
+// What an SD card says it is: its CID register, 16 bytes (SD Physical Layer spec, 5.2).
+struct SdCardId {
+    uint8_t manufacturer = 0;  // assigned by the SD Association; see sdManufacturerName()
+    char oem[3] = {};          // two characters
+    char product[6] = {};      // five characters
+    uint8_t revisionMajor = 0, revisionMinor = 0;
+    uint32_t serial = 0;
+    int year = 0, month = 0;  // manufactured
+};
+
+SdCardId parseSdCid(const uint8_t cid[16]);
+
+// The usual holder of a manufacturer ID. The SD Association doesn't publish its list: these are
+// the commonly reported ones, and resold or counterfeit cards carry whatever their maker chose.
+const char* sdManufacturerName(uint8_t id);
+
+// "SanDisk (0x03) "SD" "SU08G" rev 8.0, serial 1234abcd, made 2014-03".
+std::string sdCardSummary(const SdCardId& id);
+
+}  // namespace roro

lib/system/src/task_stats.cpp

@@ -0,0 +1,72 @@
+#include "task_stats.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstring>
+
+namespace roro {
+
+std::vector<TaskRow> taskRows(const std::vector<TaskSample>& before, uint32_t totalBefore,
+                              const std::vector<TaskSample>& now, uint32_t totalNow) {
+    uint32_t elapsed = totalNow - totalBefore;  // unsigned: right across one wrap
+    std::vector<TaskRow> rows;
+    rows.reserve(now.size());
+    for (const TaskSample& t : now) {
+        uint32_t ran = t.runtime;  // a task that wasn't there before ran all of it since
+        for (const TaskSample& b : before)
+            if (b.id == t.id) {
+                ran = t.runtime - b.runtime;
+                break;
+            }
+        TaskRow r;
+        r.name = t.name;
+        r.core = t.core;
+        r.state = t.state;
+        r.priority = t.priority;
+        r.stackFree = t.stackFree;
+        r.permille = elapsed ? static_cast<uint16_t>(std::min<uint64_t>(1000, static_cast<uint64_t>(ran) * 1000 / elapsed)) : 0;
+        r.lowStack = t.stackFree < kLowStackBytes;
+        r.idle = std::strncmp(t.name, "IDLE", 4) == 0;
+        rows.push_back(r);
+    }
+    // The task that took the sample is running, and FreeRTOS counts a task's time when it's
+    // switched out: with its core to itself it never was, and its counter hardly moved. Give it
+    // what's left of its core once the idle task and the other tasks pinned there are counted.
+    for (TaskRow& r : rows) {
+        if (r.state != 0 || r.idle || r.core < 0) continue;  // 0: eRunning
+        int others = 0;
+        bool idleSeen = false;
+        for (const TaskRow& o : rows) {
+            if (&o == &r || o.core != r.core) continue;
+            others += o.permille;
+            idleSeen |= o.idle;
+        }
+        if (idleSeen && elapsed && 1000 - others > r.permille) r.permille = static_cast<uint16_t>(std::max(0, 1000 - others));
+    }
+    return rows;
+}
+
+int coreLoad(const std::vector<TaskRow>& rows, int core) {
+    for (const TaskRow& r : rows)
+        if (r.idle && r.core == core) return 100 - (r.permille + 5) / 10;
+    return -1;
+}
+
+void sortTasks(std::vector<TaskRow>& rows, TaskSort by) {
+    auto lower = [](const std::string& s) {
+        std::string l = s;
+        for (char& c : l) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+        return l;
+    };
+    std::stable_sort(rows.begin(), rows.end(), [&](const TaskRow& a, const TaskRow& b) {
+        switch (by) {
+            case TaskSort::Share:
+                if (a.idle != b.idle) return !a.idle;  // idle tasks last
+                return a.permille > b.permille;
+            case TaskSort::Stack: return a.stackFree < b.stackFree;
+            default: return lower(a.name) < lower(b.name);
+        }
+    });
+}
+
+}  // namespace roro

lib/system/src/task_stats.h

@@ -0,0 +1,65 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+namespace roro {
+
+// One task as FreeRTOS reports it at one moment.
+struct TaskSample {
+    uint32_t id = 0;       // unique per task: a new task with an old name has another
+    char name[17] = {};
+    uint32_t runtime = 0;  // microseconds on a CPU since it started; 32 bits, so it wraps every 71 minutes
+    uint16_t stackFree = 0;  // the least it ever had left, bytes
+    int8_t core = -1;        // -1: not pinned
+    uint8_t state = 0;       // eTaskState
+    uint8_t priority = 0;
+};
+
+// What the System App and `tasks` show for a task (S1, Q119, Q122).
+struct TaskRow {
+    std::string name;
+    int core = -1;
+    uint8_t state = 0, priority = 0;
+    uint16_t stackFree = 0;
+    uint16_t permille = 0;  // share of one core over the interval, in tenths of a percent
+    bool lowStack = false;
+    bool idle = false;      // a core's idle task: what's left over
+};
+
+constexpr uint16_t kLowStackBytes = 512;
+
+// Shares from two samples: each task's run time between them over the time that passed. The
+// 32-bit counters may have wrapped once in between. The task that took the samples (the one
+// running) gets what's left of its core: see the .cpp.
+std::vector<TaskRow> taskRows(const std::vector<TaskSample>& before, uint32_t totalBefore,
+                              const std::vector<TaskSample>& now, uint32_t totalNow);
+
+// A core's load in percent: what its idle task didn't use. -1 without that task in the rows.
+int coreLoad(const std::vector<TaskRow>& rows, int core);
+
+enum class TaskSort : uint8_t { Share, Stack, Name };
+void sortTasks(std::vector<TaskRow>& rows, TaskSort by);
+
+// The last N samples, oldest first (Q120).
+template <typename T, size_t N>
+class History {
+   public:
+    void push(T value) {
+        values_[(first_ + size_) % N] = value;
+        if (size_ < N) size_++;
+        else first_ = (first_ + 1) % N;
+    }
+    size_t size() const { return size_; }
+    T at(size_t i) const { return values_[(first_ + i) % N]; }  // 0: the oldest kept
+    void clear() { first_ = size_ = 0; }
+
+   private:
+    T values_[N] = {};
+    size_t first_ = 0, size_ = 0;
+};
+
+}  // namespace roro

lib/wifi/src/saved_networks.cpp

@@ -17,6 +17,8 @@ void SavedNetworks::load() {
         int32_t hidden = 0;
         store_.getInt(key(i, "hid").c_str(), hidden);
         net.hidden = hidden != 0;
+        std::string ip;  // "address/prefix [gateway]", or empty for Automatic
+        net.fixed = store_.getString(key(i, "ip").c_str(), ip) && !ip.empty() && net::parseFixed(ip, net.ip).empty();
         networks_.push_back(net);
     }
 }
@@ -40,11 +42,30 @@ std::string SavedNetworks::add(const std::string& ssid, const std::string& passw
         }
     }
     if (count() >= kMax) return "Already 8 saved networks: forget one first";
-    networks_.push_back({ssid, password, hidden});
+    SavedNetwork added;
+    added.ssid = ssid;
+    added.password = password;
+    added.hidden = hidden;
+    networks_.push_back(added);
     save();
     return "";
 }
 
+std::string SavedNetworks::setIp(const std::string& ssid, const net::FixedIp* fixed) {
+    for (auto& n : networks_) {
+        if (n.ssid != ssid) continue;
+        if (fixed) {
+            std::string why = net::checkFixed(*fixed);
+            if (!why.empty()) return why;
+            n.ip = *fixed;
+        }
+        n.fixed = fixed != nullptr;
+        save();
+        return "";
+    }
+    return "Not a saved network";
+}
+
 void SavedNetworks::forget(const std::string& ssid) {
     for (auto it = networks_.begin(); it != networks_.end(); ++it) {
         if (it->ssid == ssid) {
@@ -60,6 +81,7 @@ void SavedNetworks::save() {
         store_.putString(key(i, "ssid").c_str(), networks_[i].ssid);
         store_.putString(key(i, "pass").c_str(), networks_[i].password);
         store_.putInt(key(i, "hid").c_str(), networks_[i].hidden ? 1 : 0);
+        store_.putString(key(i, "ip").c_str(), networks_[i].fixed ? net::formatFixed(networks_[i].ip) : "");
     }
     store_.putInt("net_count", count());
 }

lib/wifi/src/saved_networks.h

@@ -3,6 +3,7 @@
 #include <string>
 #include <vector>
 
+#include "ipv4.h"
 #include "key_value_store.h"
 
 namespace roro {
@@ -11,6 +12,8 @@ struct SavedNetwork {
     std::string ssid;
     std::string password;  // empty for an open network
     bool hidden = false;   // doesn't broadcast its name, so never shows up in scans
+    bool fixed = false;    // S1, Q105: Fixed address (`ip`), or Automatic (DHCP)
+    net::FixedIp ip;
 };
 
 // The Saved Networks the Wi-Fi Service may join (see CONTEXT.md), persisted in internal flash.
@@ -28,6 +31,8 @@ class SavedNetworks {
     // Adds, or updates the password of an existing SSID. Empty on success, otherwise why not.
     std::string add(const std::string& ssid, const std::string& password, bool hidden = false);
     void forget(const std::string& ssid);
+    // The IP setting: Fixed with these values, or Automatic (DHCP) for nullptr. Empty, or why not.
+    std::string setIp(const std::string& ssid, const net::FixedIp* fixed);
 
    private:
     void save();

platformio.ini

@@ -19,6 +19,7 @@ build_flags =
     -DARDUINO_USB_MODE=1
 lib_deps =
     m5stack/M5Cardputer @ 1.1.1
+    jgromes/RadioLib @ 7.8.1
 test_ignore = *
 ; Smaller TLS buffers (M2): the framework is rebuilt with these settings (pioarduino "hybrid
 ; compile"). Receive stays 16 KB (servers send full TLS records); send drops to 4 KB (IRC lines are

src/apps/gemini_app.cpp

@@ -0,0 +1,531 @@
+#include "gemini_app.h"
+
+#include <Arduino.h>
+
+#include <algorithm>
+
+#include "gemini_url.h"
+#include "text_wrap.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using namespace gemini;
+
+namespace {
+
+constexpr int kUrlBar = 10;  // the small line with the URL at the top
+constexpr int kMargin = 3;
+constexpr const char* kStartUrl = GeminiService::kStartUrl;
+constexpr size_t kMaxHistory = 20;  // Q77
+
+// How each line type looks: its prefix, the indent of its wrapped rows, font and colour.
+struct Style {
+    const char* prefix;
+    int indent;  // characters
+    const lgfx::U8g2font* font;
+    uint16_t color;
+};
+
+Style styleOf(LineType t) {
+    switch (t) {
+        case LineType::Heading1: return {"", 0, &fonts::bold, theme::kAccent};
+        case LineType::Heading2: return {"", 0, &fonts::bold, theme::kText};
+        case LineType::Heading3: return {"", 0, &fonts::bold, theme::kMuted};
+        case LineType::ListItem: return {"\xC2\xB7 ", 2, &fonts::body, theme::kText};  // ·
+        case LineType::Quote: return {"> ", 2, &fonts::body, theme::kMuted};
+        case LineType::Link: return {"\xC2\xBB ", 2, &fonts::body, theme::kAccent};    // »
+        case LineType::Preformatted: return {"", 0, &fonts::body, theme::kText};
+        default: return {"", 0, &fonts::body, theme::kText};
+    }
+}
+
+}  // namespace
+
+void GeminiApp::onEnter() {
+    if (page_.url.empty() && !loading_) navigate(kStartUrl, false);
+    requestRedraw();
+}
+
+// The page's first heading, for a bookmark's label.
+std::string GeminiApp::titleOf() const {
+    for (size_t i = 0; i < page_.text.lineCount() && i < 40; i++)
+        if (static_cast<LineType>(types_[i]) == LineType::Heading1) return lineAt(i).text;
+    return "";
+}
+
+void GeminiApp::follow(const std::string& link) {
+    std::string url = resolve(page_.base(), link);
+    navigate(url, true, isSaved());  // inside a Saved Page, its saved links open offline (Q84)
+}
+
+void GeminiApp::showMessage(const std::string& url, const std::string& gemtext) {
+    GeminiPage p;
+    p.outcome = GeminiPage::Outcome::Ok;
+    p.url = url;
+    p.header.status = 20;
+    p.text.append(gemtext.data(), gemtext.size());
+    p.text.finish();
+    show(std::move(p));
+}
+
+void GeminiApp::navigate(const std::string& target, bool remember, bool preferSaved) {
+    bool local = target == kStartUrl || target.rfind("file://", 0) == 0;
+    if (!isGemini(target) && !local) {
+        status_ = "Not Gemini: " + target;
+        statusMs_ = millis();
+        requestRedraw();
+        return;
+    }
+    if (!gemini_.fetch(target, preferSaved)) {
+        status_ = "Busy: try again in a moment";
+        statusMs_ = millis();
+        return;
+    }
+    if (remember && !page_.url.empty()) {
+        history_.push_back({page_.url, topRow_});
+        if (history_.size() > kMaxHistory) history_.erase(history_.begin());
+    }
+    loading_ = true;
+    loadingUrl_ = target;
+    status_.clear();
+    requestRedraw();
+}
+
+void GeminiApp::show(GeminiPage&& page) {
+    page_ = std::move(page);
+    windowLoading_ = false;
+    analyse();
+    topRow_ = hscroll_ = 0;
+    selected_ = -1;
+}
+
+void GeminiApp::analyse() {
+    // Sized exactly: the Service budgeted these bytes per line (kBytesPerLine), growth by
+    // doubling would take up to twice that.
+    std::vector<uint8_t>().swap(types_);
+    std::vector<uint32_t>().swap(links_);
+    types_.reserve(page_.text.lineCount());
+    // A window may start inside a preformatted block: the index says (bit 31).
+    size_t entry = page_.windowStart / GeminiService::kIndexEvery;
+    bool pre = page_.windowed && entry < page_.lineIndex.size() && (page_.lineIndex[entry] & 0x80000000u);
+    for (size_t i = 0; i < page_.text.lineCount(); i++) {
+        LineType t = parseGemLine(page_.text.line(i), pre).type;
+        if (page_.header.mimeType() != "text/gemini") t = LineType::Preformatted;  // other text/*: as is
+        types_.push_back(static_cast<uint8_t>(t));
+        if (t == LineType::Link) links_.push_back(i);
+    }
+    links_.shrink_to_fit();
+    layoutDirty_ = true;
+    requestRedraw();
+}
+
+size_t GeminiApp::topLine() const {
+    if (firstRow_.size() < 2) return page_.windowStart;
+    size_t i = std::upper_bound(firstRow_.begin(), firstRow_.end() - 1, static_cast<uint32_t>(topRow_)) - firstRow_.begin();
+    return page_.windowStart + (i > 0 ? i - 1 : 0);
+}
+
+void GeminiApp::requestWindow(size_t firstLine) {
+    if (windowLoading_ || !gemini_.loadWindow(page_, firstLine)) return;
+    windowLoading_ = true;
+    keepLine_ = static_cast<long>(topLine());
+    status_ = "Reading from the card...";
+    statusMs_ = millis();
+}
+
+// A new window of the same page: same URL, history and position, other lines.
+void GeminiApp::applyWindow(GeminiPage&& window) {
+    windowLoading_ = false;
+    status_.clear();
+    page_.text = std::move(window.text);
+    page_.windowStart = window.windowStart;
+    page_.lineIndex = std::move(window.lineIndex);
+    selected_ = -1;
+    analyse();
+}
+
+void GeminiApp::update(uint32_t nowMs) {
+    GeminiPage result;
+    bool got = gemini_.takeResult(result);
+    if (got && !result.windowOf.empty()) {
+        windowLoading_ = false;
+        if (result.windowOf == page_.backing) applyWindow(std::move(result));  // else: we've moved on
+    } else if (got) {
+        loading_ = false;
+        std::string url = result.url;
+        switch (result.outcome) {
+            case GeminiPage::Outcome::CertificateChanged:
+                pendingCert_ = std::move(result);
+                certDialog_.reset(new DialogModel({"Cancel", "Trust it"}));
+                break;
+            case GeminiPage::Outcome::Failed:
+                showMessage(url, "# Can't open this page\n" + result.error + "\n=> " + url + " Try again\n");
+                break;
+            case GeminiPage::Outcome::Ok:
+                switch (result.header.category()) {
+                    case Category::Success:
+                        if (result.header.mimeType().rfind("text/", 0) == 0) show(std::move(result));
+                        else {
+                            std::string mime = result.header.mimeType();
+                            showMessage(url, "# Not a text page\nThis is " + mime +
+                                                 ", which the Cardputer can't show. s saves it to the card, in "
+                                                 "/gemini/downloads.\n");
+                            page_.header.meta = mime;  // so s knows to download it
+                        }
+                        break;
+                    case Category::Input:
+                        // Q72: ask, then request the same URL with the answer as its query.
+                        inputOpen_ = true;
+                        inputSensitive_ = result.header.sensitiveInput();
+                        inputPrompt_ = result.header.meta;
+                        inputUrl_ = url;
+                        input_.setText("");
+                        break;
+                    default:
+                        showMessage(url, "# " + std::to_string(result.header.status) + " " + result.header.meta +
+                                             "\nThe server refused this page.\n=> " + url + " Try again\n");
+                        break;
+                }
+                break;
+        }
+        requestRedraw();
+    }
+    // Signed: statusMs_ may be a few ms ahead of this pass's nowMs (set by a key handled after it).
+    std::string message;
+    if (gemini_.takeMessage(message)) {
+        status_ = message;
+        statusMs_ = millis();
+        if (!reopen_.empty()) {  // a refreshed Saved Page: show the new copy
+            navigate(reopen_, false);
+            reopen_.clear();
+        } else if (message == "Deleted") navigate(kStartUrl, false);
+        requestRedraw();
+    }
+    if (!status_.empty() && static_cast<int32_t>(nowMs - statusMs_) > 4000) {
+        status_.clear();
+        requestRedraw();
+    }
+}
+
+int GeminiApp::rowsOnScreen() const { return (theme::kContent.h - kUrlBar) / theme::kLineHeight; }
+
+LineType typeOf(const std::vector<uint8_t>& types, size_t i) { return static_cast<LineType>(types[i]); }
+
+GemLine GeminiApp::lineAt(size_t i) const {
+    bool pre = typeOf(types_, i) == LineType::Preformatted;
+    GemLine g = parseGemLine(page_.text.line(i), pre);
+    if (typeOf(types_, i) == LineType::Preformatted) {
+        g.type = LineType::Preformatted;
+        g.text = page_.text.line(i);
+    }
+    return g;
+}
+
+// A line's rows, as drawn: prefix on the first, indent on the rest; preformatted lines don't wrap.
+std::vector<std::string> GeminiApp::rowsOf(Canvas& c, size_t i) const {
+    GemLine g = lineAt(i);
+    if (g.type == LineType::PreToggle) return {};
+    if (g.type == LineType::Preformatted) return {displayText(g.text)};
+    Style st = styleOf(g.type);
+    c.setFont(st.font);
+    MeasureText measure = [&c](const std::string& s) { return static_cast<int>(c.textWidth(s.c_str())); };
+    int width = theme::kWidth - 2 * kMargin;
+    std::string indent(st.indent, ' ');
+    std::vector<std::string> rows = wrapText(st.prefix + displayText(g.text), width, measure);
+    if (rows.empty()) rows.push_back("");
+    // Rows after the first: the exact rest of the text (wrapText keeps every space but the one it
+    // breaks at), wrapped again, narrower, behind the indent.
+    if (rows.size() > 1 && st.indent > 0) {
+        std::string full = st.prefix + displayText(g.text);
+        std::string rest = full.substr(rows[0].size());
+        if (!rest.empty() && rest[0] == ' ') rest.erase(0, 1);
+        std::vector<std::string> more = wrapText(rest, width - measure(indent), measure);
+        rows.resize(1);
+        for (auto& m : more) rows.push_back(indent + m);
+    }
+    return rows;
+}
+
+void GeminiApp::layout(Canvas& c) {
+    firstRow_.assign(page_.text.lineCount() + 1, 0);
+    uint32_t row = 0;
+    for (size_t i = 0; i < page_.text.lineCount(); i++) {
+        firstRow_[i] = row;
+        row += rowsOf(c, i).size();
+    }
+    firstRow_.back() = row;
+    layoutDirty_ = false;
+}
+
+void GeminiApp::scrollTo(int row) {
+    int total = firstRow_.empty() ? 0 : static_cast<int>(firstRow_.back());
+    // A windowed page: near either end of the window, read the next part from the card. The new
+    // window starts a block before the line on top, so what's on screen stays.
+    const size_t block = GeminiService::kIndexEvery;
+    if (row + rowsOnScreen() > total - 2 && moreBelow()) {
+        size_t line = topLine();
+        requestWindow(line >= block ? line - line % block : 0);
+    } else if (row < 0 && moreAbove()) {
+        size_t line = topLine();
+        size_t back = page_.text.lineCount() / 2;  // about half a window above
+        requestWindow(line > back ? line - back : 0);
+    }
+    topRow_ = std::max(0, std::min(row, std::max(0, total - rowsOnScreen())));
+    requestRedraw();
+}
+
+void GeminiApp::selectLink(int direction) {
+    // A windowed page: past the window's last (or first) link, page on instead of wrapping.
+    int last = static_cast<int>(links_.size()) - 1;
+    if ((direction > 0 && moreBelow() && (links_.empty() || selected_ == last)) ||
+        (direction < 0 && moreAbove() && (links_.empty() || selected_ == 0))) {
+        selected_ = -1;
+        scrollTo(topRow_ + direction * (rowsOnScreen() - 1));
+        return;
+    }
+    if (links_.empty()) return;
+    int count = static_cast<int>(links_.size());
+    if (selected_ < 0) {
+        // The first link on screen, or after it when going forward.
+        selected_ = direction > 0 ? 0 : count - 1;
+        for (int k = 0; k < count; k++)
+            if (static_cast<int>(firstRow_[links_[k]]) >= topRow_) {
+                selected_ = direction > 0 ? k : std::max(0, k - 1);
+                break;
+            }
+    } else selected_ = (selected_ + direction + count) % count;
+    int row = firstRow_[links_[selected_]];
+    if (row < topRow_ || row >= topRow_ + rowsOnScreen()) scrollTo(row - 1);
+    requestRedraw();
+}
+
+bool GeminiApp::onKey(const KeyEvent& e) {
+    requestRedraw();
+    if (certDialog_) {
+        certDialog_->onKey(e);
+        if (certDialog_->result() == DialogModel::kPending) return true;
+        if (certDialog_->result() == 1) {
+            gemini_.trust(pendingCert_.host, pendingCert_.port, pendingCert_.presented);
+            navigate(pendingCert_.requested, false);
+        }
+        certDialog_.reset();
+        return true;
+    }
+    if (deleteDialog_) {
+        deleteDialog_->onKey(e);
+        if (deleteDialog_->result() == DialogModel::kPending) return true;
+        if (deleteDialog_->result() == 1) gemini_.deleteSaved(savedPathOf());
+        deleteDialog_.reset();
+        return true;
+    }
+    if (inputOpen_) {
+        switch (e.key) {
+            case Key::Char: input_.insert(e.ch); break;
+            case Key::Delete: input_.backspace(); break;
+            case Key::Left: input_.left(); break;
+            case Key::Right: input_.right(); break;
+            case Key::Back: inputOpen_ = false; break;
+            case Key::Select:
+                inputOpen_ = false;
+                navigate(resolve(inputUrl_, "?" + encodeQuery(input_.text())));
+                break;
+            default: break;
+        }
+        return true;
+    }
+    if (addressOpen_) {
+        switch (e.key) {
+            case Key::Char: address_.insert(e.ch); break;
+            case Key::Delete: address_.backspace(); break;
+            case Key::Left: address_.left(); break;
+            case Key::Right: address_.right(); break;
+            case Key::Back: addressOpen_ = false; break;
+            case Key::Select: {
+                std::string url = address_.text();
+                if (url.find("://") == std::string::npos) url = "gemini://" + url;
+                addressOpen_ = false;
+                navigate(url);
+                break;
+            }
+            default: break;
+        }
+        return true;
+    }
+    switch (e.key) {
+        case Key::Up: scrollTo(topRow_ - 1); return true;
+        case Key::Down: scrollTo(topRow_ + 1); return true;
+        case Key::Left: hscroll_ = std::max(0, hscroll_ - 8); return true;
+        case Key::Right: hscroll_ += 8; return true;
+        case Key::Tab: selectLink(e.shift ? -1 : 1); return true;
+        case Key::Select:
+            if (selected_ >= 0) follow(lineAt(links_[selected_]).url);
+            return true;
+        case Key::Back:
+        case Key::Delete:
+            if (loading_) {
+                gemini_.cancel();
+                return true;
+            }
+            if (history_.empty()) return e.key == Key::Delete;  // Back leaves the App
+            {
+                Visit v = history_.back();
+                history_.pop_back();
+                navigate(v.url, false);
+                restoreRow_ = v.topRow;
+            }
+            return true;
+        case Key::Char:
+            switch (e.ch) {
+                case ' ': scrollTo(topRow_ + rowsOnScreen() - 1); break;
+                case 'g':
+                    address_.setText(page_.url == kStartUrl || isSaved() ? "" : page_.url);
+                    addressOpen_ = true;
+                    break;
+                case 'b':  // Q77
+                    if (isGemini(page_.base())) gemini_.addBookmark(page_.base(), titleOf());
+                    break;
+                case 's':  // Q82, Q73
+                    if (isSaved()) status_ = "Already saved; r refreshes it";
+                    else if (!isGemini(page_.url)) status_ = "Only Gemini pages can be saved";
+                    else if (page_.header.mimeType().rfind("text/", 0) == 0) gemini_.save(page_.url);
+                    else gemini_.download(page_.url);
+                    statusMs_ = millis();
+                    break;
+                case 'S': {  // Q83: this page and the gemtext it links to on the same capsule
+                    Url here;
+                    if (isSaved() || !parseUrl(page_.url, here)) break;
+                    std::vector<std::string> links;
+                    for (uint32_t i : links_) {
+                        std::string target = resolve(page_.url, lineAt(i).url);
+                        Url u;
+                        if (isGemini(target) && parseUrl(target, u) && u.host == here.host && target != page_.url &&
+                            std::find(links.begin(), links.end(), target) == links.end())
+                            links.push_back(target);
+                        if (static_cast<int>(links.size()) >= GeminiService::kMaxLinkedPages - 1) break;
+                    }
+                    gemini_.saveWithLinks(page_.url, links);
+                    break;
+                }
+                case 'r':  // Q84: a fresh copy of a Saved Page
+                    if (isSaved() && gemini_.refresh(savedPathOf())) reopen_ = page_.url;
+                    break;
+                case 'd':  // Q85
+                    if (isSaved()) deleteDialog_.reset(new DialogModel({"Keep", "Delete"}));
+                    break;
+                default: break;
+            }
+            return true;
+        default: return false;
+    }
+}
+
+void GeminiApp::draw(Canvas& c) {
+    const auto& area = theme::kContent;
+    if (layoutDirty_) {
+        layout(c);
+        if (restoreRow_ >= 0 && !loading_) {
+            scrollTo(restoreRow_);
+            restoreRow_ = -1;
+        }
+        if (keepLine_ >= 0 && !windowLoading_) {  // a new window: back to the line that was on top
+            long local = keepLine_ - static_cast<long>(page_.windowStart);
+            if (local >= 0 && local < static_cast<long>(page_.text.lineCount())) topRow_ = firstRow_[local];
+            keepLine_ = -1;
+        }
+    }
+
+    // The URL bar: what's shown, or what's loading, or a passing message.
+    c.setFont(&fonts::small);
+    c.setTextDatum(top_left);
+    std::string bar = loading_ ? "Loading " + loadingUrl_
+                      : !status_.empty() ? status_
+                      : isSaved() ? "saved " + page_.savedOn + ": " + page_.savedFrom
+                                  : page_.url;
+    c.setTextColor(loading_ || !status_.empty() ? theme::kWarning : theme::kMuted);
+    c.drawString(displayText(bar).substr(0, 47).c_str(), kMargin, area.y + 1);
+
+    int rows = rowsOnScreen(), y0 = area.y + kUrlBar;
+    // The first source line on screen: the last whose first row is at or above topRow_.
+    size_t i = std::upper_bound(firstRow_.begin(), firstRow_.end() - 1, static_cast<uint32_t>(topRow_)) -
+               firstRow_.begin();
+    i = i > 0 ? i - 1 : 0;
+    int row = topRow_;
+    while (i < page_.text.lineCount() && row < topRow_ + rows) {
+        int skip = row - static_cast<int>(firstRow_[i]);
+        int lineRows = static_cast<int>(firstRow_[i + 1] - firstRow_[i]);
+        if (lineRows > 0) {
+            drawLine(c, i, skip, y0 + (row - topRow_) * theme::kLineHeight, topRow_ + rows - row);
+            row += lineRows - skip;
+        }
+        i++;
+    }
+    if (page_.truncated && row < topRow_ + rows) {
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kWarning);
+        c.drawString(("Cut short: " + page_.truncatedWhy).substr(0, 47).c_str(), kMargin,
+                     y0 + (row - topRow_) * theme::kLineHeight + 2);
+    }
+    // Scroll position, on the right edge: over the whole page, also when only a window is in memory.
+    int total = static_cast<int>(firstRow_.back());
+    int h = area.h - kUrlBar;
+    if (page_.windowed && page_.totalLines > 0) {
+        int barH = std::max(6, static_cast<int>(h * page_.text.lineCount() / page_.totalLines / 3));
+        int y = static_cast<int>((h - barH) * topLine() / std::max<size_t>(1, page_.totalLines - 1));
+        c.fillRect(area.w - 2, y0 + y, 2, barH, theme::kMuted);
+    } else if (total > rows) {
+        int barH = std::max(6, h * rows / total);
+        c.fillRect(area.w - 2, y0 + (h - barH) * topRow_ / std::max(1, total - rows), 2, barH, theme::kMuted);
+    }
+
+    if (addressOpen_) {
+        theme::Rect box{2, area.y + area.h / 2 - 12, area.w - 4, theme::kLineHeight + 4};
+        c.fillRect(box.x - 2, box.y - 12, box.w + 4, box.h + 14, theme::kBackground);
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Go to (Enter, or ` to cancel)", box.x, box.y - 10);
+        widgets::lineEditor(c, address_, box);
+    }
+    if (inputOpen_) {
+        theme::Rect box{2, area.y + area.h / 2 - 4, area.w - 4, theme::kLineHeight + 4};
+        c.fillRect(0, box.y - 26, area.w, box.h + 28, theme::kBackground);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kText);
+        c.drawString(displayText(inputPrompt_).substr(0, 39).c_str(), box.x, box.y - 22);
+        c.setFont(&fonts::small);
+        c.setTextColor(theme::kMuted);
+        c.drawString(inputSensitive_ ? "(hidden) Enter sends, ` cancels" : "Enter sends, ` cancels", box.x, box.y - 9);
+        if (inputSensitive_) {
+            LineEditor masked(1024);
+            masked.setText(std::string(input_.text().size(), '*'));
+            widgets::lineEditor(c, masked, box);
+        } else widgets::lineEditor(c, input_, box);
+    }
+    if (deleteDialog_) widgets::dialog(c, "Delete this Saved Page?", page_.savedFrom, *deleteDialog_);
+    if (certDialog_)
+        widgets::dialog(c, "Certificate changed",
+                        pendingCert_.host + " now shows a different certificate. Was " + pendingCert_.pinned.substr(0, 16) +
+                            "..., now " + pendingCert_.presented.substr(0, 16) + "...",
+                        *certDialog_);
+}
+
+void GeminiApp::drawLine(Canvas& c, size_t i, int firstRow, int y, int rowsLeft) {
+    GemLine g = lineAt(i);
+    Style st = styleOf(g.type);
+    bool isSelected = selected_ >= 0 && links_[selected_] == i;
+    std::vector<std::string> rows = rowsOf(c, i);
+    c.setFont(st.font);
+    c.setTextDatum(top_left);
+    for (int r = firstRow; r < static_cast<int>(rows.size()) && r - firstRow < rowsLeft; r++) {
+        int ry = y + (r - firstRow) * theme::kLineHeight;
+        if (isSelected) c.fillRect(0, ry, theme::kWidth - 3, theme::kLineHeight, theme::kSelection);
+        c.setTextColor(isSelected ? theme::kText : st.color);
+        std::string text = rows[r];
+        if (g.type == LineType::Preformatted) text = hscroll_ < static_cast<int>(text.size()) ? text.substr(hscroll_) : "";
+        c.drawString(text.c_str(), kMargin, ry + 1);
+    }
+}
+
+}  // namespace roro

src/apps/gemini_app.h

@@ -0,0 +1,81 @@
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "dialog_model.h"
+#include "gemtext.h"
+#include "line_editor.h"
+#include "services/gemini_service.h"
+#include "ui/canvas.h"
+
+namespace roro {
+
+// Geminispace on the Cardputer (docs/milestones/G1.md). Pages come from the GeminiService as
+// lines; the App wraps them once (keeping only each line's first row), then wraps just the lines
+// on screen when it draws, so a long page costs 4 bytes a line on top of its text.
+class GeminiApp : public App {
+   public:
+    explicit GeminiApp(GeminiService& gemini) : gemini_(gemini) {}
+    void onEnter() override;
+    bool onKey(const KeyEvent& e) override;
+    bool textEntryActive() const override { return addressOpen_ || inputOpen_; }
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    struct Visit {
+        std::string url;
+        int topRow;
+    };
+
+    void navigate(const std::string& url, bool remember = true, bool preferSaved = false);
+    void follow(const std::string& link);
+    std::string titleOf() const;
+    bool isSaved() const { return !page_.savedFrom.empty(); }
+    std::string savedPathOf() const { return page_.url.substr(7); }  // file://…
+    void show(GeminiPage&& page);
+    void analyse();  // types and links of the lines in memory
+    void applyWindow(GeminiPage&& window);
+    void requestWindow(size_t firstLine);
+    size_t topLine() const;  // the source line (in the whole page) at the top of the screen
+    bool moreBelow() const { return page_.windowed && page_.windowStart + page_.text.lineCount() < page_.totalLines; }
+    bool moreAbove() const { return page_.windowed && page_.windowStart > 0; }
+    void showMessage(const std::string& url, const std::string& gemtext);
+    void layout(Canvas& c);
+    void drawLine(Canvas& c, size_t index, int firstRow, int y, int rows);
+    std::vector<std::string> rowsOf(Canvas& c, size_t index) const;
+    gemini::GemLine lineAt(size_t index) const;
+    int rowsOnScreen() const;
+    void selectLink(int direction);
+    void scrollTo(int row);
+
+    GeminiService& gemini_;
+    GeminiPage page_;
+    std::vector<uint8_t> types_;      // per source line: gemini::LineType
+    std::vector<uint32_t> firstRow_;  // per source line, plus the total at the end
+    std::vector<uint32_t> links_;     // source lines that are links
+    bool layoutDirty_ = true;
+    int topRow_ = 0, hscroll_ = 0;
+    int selected_ = -1;  // into links_
+    int restoreRow_ = -1;  // going back: where that page was scrolled to, applied after layout
+    bool windowLoading_ = false;
+    long keepLine_ = -1;   // a new window: the source line to keep at the top, applied after layout
+    std::vector<Visit> history_;
+    bool loading_ = false;
+    std::string loadingUrl_, status_;
+    uint32_t statusMs_ = 0;
+    bool addressOpen_ = false;
+    LineEditor address_{1024};
+    std::unique_ptr<DialogModel> certDialog_;
+    GeminiPage pendingCert_;
+    std::unique_ptr<DialogModel> deleteDialog_;
+    bool inputOpen_ = false, inputSensitive_ = false;
+    std::string inputPrompt_, inputUrl_;
+    LineEditor input_{1024};
+    std::string reopen_;  // after a refresh: the Saved Page to show again
+};
+
+}  // namespace roro

src/apps/lora_scanner_app.cpp

@@ -0,0 +1,340 @@
+#include "lora_scanner_app.h"
+
+#include <Arduino.h>
+
+#include <algorithm>
+#include <cstdio>
+#include <ctime>
+
+#include "meshtastic_presets.h"
+#include "packet_view.h"
+#include "sweep_view.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+namespace {
+constexpr uint32_t kMessageMs = 4000;
+}
+
+void LoraScannerApp::onEnter() {
+    int i = std::clamp<int>(settings_.getInt(Setting::LoraPreset), 0, meshtastic::kEu868PresetCount - 1);
+    const meshtastic::Preset& p = meshtastic::kEu868Presets[i];
+    if (std::string(radio_.config().name) != p.name) radio_.setPreset(p);
+    radio_.listen(RadioService::App, true);
+    view_ = View::Packets;
+    selectedSeq_ = 0;
+    followNewest_ = true;
+    shownSeq_ = 0;
+    requestRedraw();
+}
+
+void LoraScannerApp::onExit() {
+    showSweep(false);
+    radio_.listen(RadioService::App, false);
+}
+
+void LoraScannerApp::showSweep(bool on) {
+    if (on == (view_ == View::Sweep)) return;
+    radio_.sweep(on);
+    view_ = on ? View::Sweep : View::Packets;
+    peak_.clear();
+    std::vector<int8_t>().swap(waterfall_);  // its memory only while shown
+    sweepSteps_ = 0;
+    shownSweep_ = radio_.sweeps();
+    requestRedraw();
+}
+
+bool LoraScannerApp::meshtasticSettings() const { return radio_.config().syncWord == meshtastic::kSyncWord; }
+
+void LoraScannerApp::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+    requestRedraw();
+}
+
+bool LoraScannerApp::onKey(const KeyEvent& e) {
+    if (e.key == Key::Tab && (view_ == View::Packets || view_ == View::Sweep)) {
+        showSweep(view_ == View::Packets);
+        return true;
+    }
+    if (view_ == View::Sweep) {
+        if (e.key == Key::Back) {
+            showSweep(false);
+            return true;
+        }
+        return e.key != Key::Home;  // everything else stays here
+    }
+    if (view_ == View::Details) {
+        int last = std::max<int>(0, static_cast<int>(details_.size()) - 8);
+        if (e.key == Key::Up) detailsTop_ = std::max(0, detailsTop_ - 1);
+        else if (e.key == Key::Down) detailsTop_ = std::min(last, detailsTop_ + 1);
+        else if (e.key == Key::Back || e.key == Key::Select) view_ = View::Packets;
+        else return true;
+        requestRedraw();
+        return true;
+    }
+    if (view_ == View::Presets) {
+        if (e.key == Key::Up) presets_.up();
+        else if (e.key == Key::Down) presets_.down();
+        else if (e.key == Key::Select) {
+            int i = presets_.selected();
+            settings_.setInt(Setting::LoraPreset, i);
+            radio_.setPreset(meshtastic::kEu868Presets[i]);
+            say(std::string("Listening on ") + meshtastic::kEu868Presets[i].name);
+            view_ = View::Packets;
+        } else if (e.key == Key::Back) view_ = View::Packets;
+        else return true;
+        requestRedraw();
+        return true;
+    }
+    // The packet list.
+    if (e.key == Key::Up || e.key == Key::Down) {
+        e.key == Key::Up ? packets_.up() : packets_.down();
+        selectedSeq_ = packets_.selected() >= 0 ? radio_.received() - packets_.selected() : 0;
+        followNewest_ = packets_.selected() <= 0;
+        requestRedraw();
+        return true;
+    }
+    if (e.key == Key::Select) {
+        openDetails();
+        return true;
+    }
+    if (e.key == Key::Char && (e.ch == 'p' || e.ch == 'P')) {
+        presets_.setCount(meshtastic::kEu868PresetCount);
+        presets_.select(settings_.getInt(Setting::LoraPreset));
+        view_ = View::Presets;
+        requestRedraw();
+        return true;
+    }
+    if (e.key == Key::Char && (e.ch == 'c' || e.ch == 'C')) {
+        if (capture_.capturing()) capture_.stop();
+        else {
+            std::string why = capture_.start(millis());
+            if (!why.empty()) say(why);
+        }
+        requestRedraw();
+        return true;
+    }
+    return false;  // Back leaves the App
+}
+
+void LoraScannerApp::openDetails() {
+    RadioPacket p;
+    if (!selectedSeq_ || !radio_.packet(selectedSeq_, p)) return say("That packet has left the list");
+    details_.clear();
+    char line[64];
+    std::snprintf(line, sizeof line, "%s, %u bytes%s", timeOf(p).c_str(), p.len, p.crcOk ? "" : ", bad CRC");
+    details_.push_back(line);
+    std::snprintf(line, sizeof line, "%.0f dBm, SNR %.1f dB, noise %.0f", p.rx.rssi, p.rx.snr, p.rx.noiseFloor);
+    details_.push_back(line);
+    std::snprintf(line, sizeof line, "%.4f MHz, off by %.0f Hz", p.rx.frequencyHz / 1e6, p.frequencyError);
+    details_.push_back(line);
+    if (meshtasticSettings())
+        for (auto& l : lora::headerLines(p.data, p.len)) details_.push_back(l);
+    for (auto& l : lora::hexDump(p.data, p.len)) details_.push_back(l);
+    detailsTop_ = 0;
+    view_ = View::Details;
+    requestRedraw();
+}
+
+std::string LoraScannerApp::timeOf(const RadioPacket& p) const {
+    int64_t now = clock_.utcNow();
+    if (now < 0) {  // no Clock yet: how long ago
+        char ago[16];
+        std::snprintf(ago, sizeof ago, "-%lus", (unsigned long)((millis() - p.ms) / 1000));
+        return ago;
+    }
+    time_t t = static_cast<time_t>(now - static_cast<int64_t>((millis() - p.ms) / 1000));
+    struct tm local;
+    localtime_r(&t, &local);
+    char buf[12];
+    std::snprintf(buf, sizeof buf, "%02d:%02d:%02d", local.tm_hour, local.tm_min, local.tm_sec);
+    return buf;
+}
+
+void LoraScannerApp::update(uint32_t nowMs) {
+    if (view_ == View::Sweep) {
+        if (radio_.sweeps() != shownSweep_) requestRedraw();
+        return;
+    }
+    if (radio_.received() != shownSeq_ || nowMs - lastDrawMs_ >= 1000 ||
+        (!message_.empty() && nowMs - messageMs_ >= kMessageMs))
+        requestRedraw();
+}
+
+void LoraScannerApp::draw(Canvas& c) {
+    lastDrawMs_ = millis();
+    c.setTextDatum(top_left);
+    if (!radio_.present()) {
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kWarning);
+        c.drawString("No LoRa radio found", 4, theme::kContent.y + 4);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Is the Cap LoRa-1262 attached?", 4, theme::kContent.y + 22);
+        return;
+    }
+    switch (view_) {
+        case View::Packets: drawPackets(c); break;
+        case View::Details: drawDetails(c); break;
+        case View::Presets: drawPresets(c); break;
+        case View::Sweep: drawSweep(c); break;
+    }
+}
+
+void LoraScannerApp::drawPackets(Canvas& c) {
+    const auto& area = theme::kContent;
+    RadioService::Config cfg = radio_.config();
+    uint32_t newest = radio_.received();
+    shownSeq_ = newest;
+
+    // What it's listening to, and the noise floor.
+    char head[64];
+    std::snprintf(head, sizeof head, "%s %.3f MHz, noise %.0f", cfg.name, cfg.frequencyHz / 1e6, radio_.noiseFloor());
+    c.setFont(&fonts::small);
+    c.setTextColor(radio_.listening() ? theme::kMuted : theme::kWarning);
+    c.drawString(radio_.listening() ? head : "Starting the radio...", 4, area.y + 2);
+    if (capture_.capturing()) {
+        c.setTextDatum(top_right);
+        c.setTextColor(theme::kWarning);
+        c.drawString(("CAP " + std::to_string(capture_.packets())).c_str(), area.w - 3, area.y + 2);
+        c.setTextDatum(top_left);
+    }
+
+    // The list, newest first; the selection stays on its packet as new ones arrive.
+    int count = static_cast<int>(radio_.available());
+    packets_.setCount(count);
+    if (!followNewest_ && selectedSeq_ && newest >= selectedSeq_ && newest - selectedSeq_ < static_cast<uint32_t>(count))
+        packets_.select(static_cast<int>(newest - selectedSeq_));
+    else if (count > 0) {
+        followNewest_ = true;
+        packets_.select(0);
+        selectedSeq_ = newest;
+    }
+    theme::Rect list{area.x, area.y + 12, area.w, kListRows * theme::kLineHeight};
+    if (count == 0) {
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("No packets yet.", 4, list.y + 4);
+        c.drawString(meshtasticSettings() ? "Meshtastic nodes in range show here." : "Custom settings.", 4,
+                     list.y + 4 + theme::kLineHeight);
+    } else {
+        bool mesh = meshtasticSettings();
+        widgets::list(c, packets_, list, [&](int i) {
+            RadioPacket p;
+            if (!radio_.packet(newest - i, p)) return std::string("(gone)");
+            return lora::row({p.data, p.len, p.rx.rssi, p.rx.snr, p.crcOk, mesh}, timeOf(p));
+        });
+    }
+
+    // Footer: a message for a few seconds, or the keys.
+    c.setFont(&fonts::small);
+    bool showMessage = !message_.empty() && millis() - messageMs_ < kMessageMs;
+    c.setTextColor(showMessage ? theme::kWarning : theme::kMuted);
+    std::string keys = std::string("Enter: details  p: preset  Tab: sweep  c: ") + (capture_.capturing() ? "stop" : "capture");
+    c.drawString(showMessage ? message_.c_str() : keys.c_str(), 4, area.y + area.h - 9);
+}
+
+void LoraScannerApp::drawDetails(Canvas& c) {
+    const auto& area = theme::kContent;
+    widgets::textLines(c, details_, detailsTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 2});
+}
+
+void LoraScannerApp::drawPresets(Canvas& c) {
+    const auto& area = theme::kContent;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("Meshtastic presets allowed in EU868", 4, area.y + 2);
+    widgets::list(
+        c, presets_, {area.x, area.y + 12, area.w, (kListRows + 1) * theme::kLineHeight},
+        [](int i) { return std::string(meshtastic::kEu868Presets[i].name); },
+        [](int i) {
+            char v[24];
+            const auto& p = meshtastic::kEu868Presets[i];
+            std::snprintf(v, sizeof v, "SF%u %.0fk %.3f", p.sf, p.bwKHz, meshtastic::eu868FrequencyHz(p) / 1e6);
+            return std::string(v);
+        });
+}
+
+}  // namespace roro
+
+namespace roro {
+
+// Sweep (Q98): bars of the latest pass with peak hold, the waterfall underneath (newest at the
+// top), and where the Sniffer's preset sits in the band.
+void LoraScannerApp::drawSweep(Canvas& c) {
+    const auto& area = theme::kContent;
+    constexpr int kLow = -120, kHigh = -60;  // the scale, dBm: about the chip's floor to a near signal
+    SweepFrame f;
+    bool have = radio_.sweepFrame(f) && f.seq != 0;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("Sweep, the Sniffer is paused", 4, area.y + 2);
+    if (!have) {
+        c.drawString("Measuring...", 4, area.y + 20);
+        return;
+    }
+    // Keep peak hold and the waterfall for this band.
+    if (f.steps != sweepSteps_) {
+        sweepSteps_ = f.steps;
+        peak_.assign(f.steps, -127);
+        waterfall_.assign(static_cast<size_t>(kWaterfallRows) * f.steps, -127);
+    }
+    if (f.seq != shownSweep_) {
+        shownSweep_ = f.seq;
+        for (uint16_t i = 0; i < f.steps; ++i) peak_[i] = std::max(peak_[i], f.dbm[i]);
+        std::copy_backward(waterfall_.begin(), waterfall_.end() - f.steps, waterfall_.end());
+        std::copy(f.dbm, f.dbm + f.steps, waterfall_.begin());
+    }
+
+    // Layout: up to 3 px a step, left-aligned after the scale.
+    int x0 = 26, cell = std::max(1, std::min(3, (area.w - x0 - 2) / std::max<int>(1, f.steps)));
+    int barTop = area.y + 12, barH = 46, barBottom = barTop + barH;
+    auto height = [&](int dbm) { return std::clamp((dbm - kLow) * barH / (kHigh - kLow), 0, barH); };
+    c.setTextColor(theme::kMuted);
+    c.drawString("-60", 2, barTop - 1);
+    c.drawString("-120", 0, barBottom - 7);
+    for (uint16_t i = 0; i < f.steps; ++i) {
+        int x = x0 + i * cell, h = height(f.dbm[i]);
+        if (h > 0) c.fillRect(x, barBottom - h, std::max(1, cell - 1), h, theme::kAccent);
+        int ph = height(peak_[i]);
+        if (ph > 0) c.drawFastHLine(x, barBottom - ph, std::max(1, cell - 1), theme::kText);
+    }
+    // The Sniffer's frequency, when it's in the band.
+    uint32_t hz = radio_.config().frequencyHz;
+    if (hz >= f.fromHz && hz <= f.fromHz + (f.steps - 1) * f.stepHz) {
+        int x = x0 + static_cast<int>((hz - f.fromHz) / f.stepHz) * cell + cell / 2;
+        for (int y = barTop; y < barBottom; y += 3) c.drawPixel(x, y, theme::kMessage);
+    }
+
+    // The waterfall.
+    int wfTop = barBottom + 2;
+    for (int r = 0; r < kWaterfallRows; ++r)
+        for (uint16_t i = 0; i < f.steps; ++i) {
+            int8_t v = waterfall_[static_cast<size_t>(r) * f.steps + i];
+            if (v > -127) c.fillRect(x0 + i * cell, wfTop + r, cell, 1, lora::heatColor(lora::heatLevel(v, kLow, kHigh)));
+        }
+
+    // The band's edges, its floor and its strongest signal.
+    lora::SweepStats st = lora::summarize(f.dbm, f.steps, f.fromHz, f.stepHz);
+    char line[64];
+    int y = area.y + area.h - 9;
+    std::snprintf(line, sizeof line, "%.1f", f.fromHz / 1e6);
+    c.drawString(line, x0, wfTop + kWaterfallRows + 1);
+    std::snprintf(line, sizeof line, "%.1f MHz", (f.fromHz + (f.steps - 1) * f.stepHz) / 1e6);
+    c.setTextDatum(top_right);
+    c.drawString(line, x0 + f.steps * cell, wfTop + kWaterfallRows + 1);
+    c.setTextDatum(top_left);
+    if (st.peaks.empty())
+        std::snprintf(line, sizeof line, "floor %d dBm, nothing above it   Tab: sniffer", st.floor);
+    else
+        std::snprintf(line, sizeof line, "floor %d, %.1f MHz at %d dBm   Tab: sniffer", st.floor, st.peaks[0].hz / 1e6,
+                      st.peaks[0].dbm);
+    c.setTextColor(theme::kMuted);
+    c.drawString(line, 4, y);
+}
+
+}  // namespace roro

src/apps/lora_scanner_app.h

@@ -0,0 +1,67 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "list_model.h"
+#include "services/clock_service.h"
+#include "services/lora_capture_service.h"
+#include "services/radio_service.h"
+#include "settings.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// The LoRa Scanner (docs/milestones/M3.md). Sniffer: the packets the radio hears, newest first,
+// with the Meshtastic header read (Q96) and a hex dump on Enter; p picks the preset (Q95), c starts
+// or stops a Capture (Q97). The radio listens while the App is open (Q100). Tab: Sweep, the band's
+// RSSI as bars with peak hold and a waterfall (Q98); it pauses the Sniffer while shown (Q99).
+class LoraScannerApp : public App {
+   public:
+    LoraScannerApp(RadioService& radio, LoraCaptureService& capture, Settings& settings, ClockService& clock)
+        : radio_(radio), capture_(capture), settings_(settings), clock_(clock) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View { Packets, Details, Presets, Sweep };
+    static constexpr int kListRows = 7;
+
+    void drawPackets(Canvas& c);
+    void drawDetails(Canvas& c);
+    void drawPresets(Canvas& c);
+    void drawSweep(Canvas& c);
+    void showSweep(bool on);
+    void openDetails();
+    std::string timeOf(const RadioPacket& p) const;
+    bool meshtasticSettings() const;
+    void say(const std::string& text);  // a line in the footer for a few seconds
+
+    RadioService& radio_;
+    LoraCaptureService& capture_;
+    Settings& settings_;
+    ClockService& clock_;
+    View view_ = View::Packets;
+    ListModel packets_{kListRows};
+    ListModel presets_{kListRows + 1};
+    uint32_t shownSeq_ = 0;     // the newest packet at the last redraw
+    uint32_t selectedSeq_ = 0;  // what the selection points at, kept as packets arrive
+    bool followNewest_ = true;  // until the user moves the selection off the top
+    std::vector<std::string> details_;
+    int detailsTop_ = 0;
+    uint32_t lastDrawMs_ = 0;
+    std::string message_;
+    uint32_t messageMs_ = 0;
+    // Sweep, only while shown: peak hold per step, and the waterfall, newest row first.
+    static constexpr int kWaterfallRows = 36;
+    uint32_t shownSweep_ = 0;
+    std::vector<int8_t> peak_;
+    std::vector<int8_t> waterfall_;  // kWaterfallRows x steps
+    uint16_t sweepSteps_ = 0;
+};
+
+}  // namespace roro

src/apps/system_app.cpp

@@ -0,0 +1,361 @@
+#include "system_app.h"
+
+#include <Arduino.h>
+#include <SD.h>
+#include <esp_heap_caps.h>
+
+#include <algorithm>
+#include <cstdio>
+
+#include "cleanup_plan.h"
+#include "platform/system_info.h"
+#include "sd_fault.h"
+#include "services/gemini_service.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+namespace {
+
+constexpr size_t kUsers = static_cast<size_t>(net::User::Count);
+
+// Collects what the console's `info` prints, so the System view can't drift from it (Q125).
+class Lines : public Print {
+   public:
+    size_t write(uint8_t ch) override {
+        if (ch == '\n') {
+            lines.push_back(current_);
+            current_.clear();
+        } else if (ch != '\r') {
+            current_ += static_cast<char>(ch);
+        }
+        return 1;
+    }
+    std::vector<std::string> lines;
+
+   private:
+    std::string current_;
+};
+
+std::string duration(uint32_t seconds) {
+    char s[24];
+    if (seconds < 3600) std::snprintf(s, sizeof s, "%lu min %02lu s", (unsigned long)(seconds / 60), (unsigned long)(seconds % 60));
+    else std::snprintf(s, sizeof s, "%lu h %02lu min", (unsigned long)(seconds / 3600), (unsigned long)(seconds / 60 % 60));
+    return s;
+}
+
+// A filled bar for a percentage; the warning colour from 90 %.
+void bar(Canvas& c, int x, int y, int w, int percent) {
+    c.drawRect(x, y, w, 9, theme::kMuted);
+    int filled = std::clamp(percent, 0, 100) * (w - 2) / 100;
+    if (filled > 0) c.fillRect(x + 1, y + 1, filled, 7, percent >= 90 ? theme::kWarning : theme::kAccent);
+}
+
+}  // namespace
+
+void SystemApp::onEnter() {
+    view_ = View::Overview;
+    beforeTotal_ = system_info::sampleTasks(before_);
+    sampledMs_ = millis();
+    for (size_t i = 0; i < kUsers; i++) traffic_[i] = net::traffic(static_cast<net::User>(i));
+    requestRedraw();
+}
+
+void SystemApp::onExit() {  // nothing is kept while it's closed (Q120)
+    std::vector<TaskSample>().swap(before_);
+    std::vector<TaskRow>().swap(rows_);
+    std::vector<std::string>().swap(systemLines_);
+    for (auto& h : loadHistory_) h.clear();
+    heapHistory_.clear();
+    load_[0] = load_[1] = -1;
+}
+
+bool SystemApp::onKey(const KeyEvent& e) {
+    if (e.key == Key::Tab) {
+        int n = static_cast<int>(View::Count), v = static_cast<int>(view_);
+        view_ = static_cast<View>(e.shift ? (v + n - 1) % n : (v + 1) % n);
+        taskTop_ = systemTop_ = 0;
+        requestRedraw();
+        return true;
+    }
+    int step = e.key == Key::Up ? -1 : e.key == Key::Down ? 1 : 0;
+    if (step && view_ == View::Tasks) {
+        taskTop_ = std::clamp(taskTop_ + step, 0, std::max(0, static_cast<int>(rows_.size()) - kTaskRows));
+        requestRedraw();
+        return true;
+    }
+    if (step && view_ == View::System) {
+        systemTop_ = std::clamp(systemTop_ + step, 0, std::max(0, wrappedLines_ - 8));
+        requestRedraw();
+        return true;
+    }
+    if (view_ == View::Tasks && e.key == Key::Char && (e.ch == 's' || e.ch == 'S')) {  // Q122
+        sort_ = static_cast<TaskSort>((static_cast<int>(sort_) + 1) % 3);
+        sortTasks(rows_, sort_);
+        taskTop_ = 0;
+        requestRedraw();
+        return true;
+    }
+    return false;  // Back leaves the App
+}
+
+void SystemApp::update(uint32_t nowMs) {
+    if (nowMs - sampledMs_ >= 1000) sample(nowMs);
+}
+
+// Once a second (Q119): the tasks' shares over that second, the cores' load, the heap, the traffic.
+void SystemApp::sample(uint32_t nowMs) {
+    uint32_t elapsedMs = nowMs - sampledMs_;
+    sampledMs_ = nowMs;
+
+    std::vector<TaskSample> now;
+    uint32_t total = system_info::sampleTasks(now);
+    rows_ = taskRows(before_, beforeTotal_, now, total);
+    sortTasks(rows_, sort_);
+    before_.swap(now);
+    beforeTotal_ = total;
+    for (int core = 0; core < 2; core++) {
+        load_[core] = coreLoad(rows_, core);
+        loadHistory_[core].push(static_cast<uint8_t>(std::max(0, load_[core])));
+    }
+    heapHistory_.push(static_cast<uint16_t>(ESP.getFreeHeap() / 1024));
+
+    for (size_t i = 0; i < kUsers; i++) {
+        net::Traffic t = net::traffic(static_cast<net::User>(i));
+        rateIn_[i] = net::bytesPerSecond(traffic_[i].in, t.in, elapsedMs);
+        rateOut_[i] = net::bytesPerSecond(traffic_[i].out, t.out, elapsedMs);
+        traffic_[i] = t;
+    }
+
+    if (view_ == View::System) {  // the slow things: only while they're on screen
+        Lines out;
+        system_info::printSystem(out);
+        const BatteryEstimator& b = battery_.estimator();
+        if (b.hasReading()) out.printf("battery: %d %%, %d.%02d V\n", b.percent(), b.millivolts() / 1000, b.millivolts() % 1000 / 10);
+        StorageState card = storage_.state();
+        if (card.present)
+            out.printf("sd: %s of %s used, %u write faults\n", formatBytes(card.usedBytes).c_str(), formatBytes(card.totalBytes).c_str(),
+                       (unsigned)sdLastFault().count);
+        else out.println("sd: no card");
+        out.printf("radio: %s\n", !radio_.present() ? "none" : radio_.sweeping() ? "sweeping" : radio_.listening() ? "listening" : "asleep");
+        const auto& g = gnss_.state();
+        out.printf("gnss: %s, %d satellites used\n", !gnss_.on() ? "off" : gnss_.receiving(nowMs) ? "receiving" : "silent", g.satellitesUsed);
+        system_info::printSlots(out, store_);
+        systemLines_.swap(out.lines);
+    }
+    requestRedraw();
+}
+
+void SystemApp::footer(Canvas& c, const char* keys) {
+    const auto& area = theme::kContent;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(top_left);
+    c.drawString(keys, 4, area.y + area.h - 9);
+}
+
+void SystemApp::draw(Canvas& c) {
+    c.setTextDatum(top_left);
+    switch (view_) {
+        case View::Overview: drawOverview(c); break;
+        case View::Tasks: drawTasks(c); break;
+        case View::Memory: drawMemory(c); break;
+        case View::Network: drawNetwork(c); break;
+        case View::System: drawSystem(c); break;
+        default: break;
+    }
+}
+
+void SystemApp::drawOverview(Canvas& c) {
+    const auto& area = theme::kContent;
+    char line[72];
+    c.setFont(&fonts::body);
+    int y = area.y + 2;
+    for (int core = 0; core < 2; core++) {
+        c.setTextColor(theme::kMuted);
+        std::snprintf(line, sizeof line, "Core %d", core);
+        c.drawString(line, 4, y);
+        bar(c, 52, y + 2, 130, load_[core]);
+        c.setTextColor(theme::kText);
+        if (load_[core] >= 0) std::snprintf(line, sizeof line, "%d%%", load_[core]);
+        else std::snprintf(line, sizeof line, "...");
+        c.drawString(line, 190, y);
+        y += theme::kLineHeight;
+    }
+    auto row = [&](const char* label, const std::string& value) {
+        c.setTextColor(theme::kMuted);
+        c.drawString(label, 4, y);
+        c.setTextColor(theme::kText);
+        c.drawString(value.c_str(), 62, y);
+        y += theme::kLineHeight;
+    };
+    std::snprintf(line, sizeof line, "%u KB free, lowest %u", (unsigned)(ESP.getFreeHeap() / 1024), (unsigned)(ESP.getMinFreeHeap() / 1024));
+    row("Memory", line);
+    uint32_t in = 0, out = 0;
+    for (size_t i = 0; i < kUsers; i++) in += rateIn_[i], out += rateOut_[i];
+    if (wifi_.state() == WifiController::State::Connected)
+        std::snprintf(line, sizeof line, "%s/s in, %s/s out", net::formatTraffic(in).c_str(), net::formatTraffic(out).c_str());
+    else std::snprintf(line, sizeof line, "not connected");
+    row("Network", line);
+    const BatteryEstimator& b = battery_.estimator();
+    if (b.hasReading()) std::snprintf(line, sizeof line, "%d%%, %d.%02d V", b.percent(), b.millivolts() / 1000, b.millivolts() % 1000 / 10);
+    else std::snprintf(line, sizeof line, "...");
+    row("Battery", line);
+    std::snprintf(line, sizeof line, "%s, %.0f C", duration(millis() / 1000).c_str(), temperatureRead());
+    row("Uptime", line);
+
+    // Both cores over the last two minutes: core 0 in the accent colour, core 1 in green.
+    int gx = 4, gy = y + 3, gw = static_cast<int>(kHistory) * 2 - 8, gh = area.y + area.h - 12 - gy;
+    if (gh > 8) {
+        c.drawRect(gx, gy, gw + 2, gh + 2, theme::kMuted);
+        for (int core = 0; core < 2; core++) {
+            const auto& h = loadHistory_[core];
+            for (size_t i = 1; i < h.size(); i++) {
+                int x0 = gx + 1 + static_cast<int>((i - 1) * gw / kHistory), x1 = gx + 1 + static_cast<int>(i * gw / kHistory);
+                c.drawLine(x0, gy + gh - h.at(i - 1) * gh / 100, x1, gy + gh - h.at(i) * gh / 100, core ? theme::kMessage : theme::kAccent);
+            }
+        }
+    }
+    footer(c, "Tab: tasks, memory, network, system");
+}
+
+void SystemApp::drawTasks(Canvas& c) {
+    const auto& area = theme::kContent;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("task", 4, area.y + 2);
+    c.setTextDatum(top_right);
+    c.drawString("core", 128, area.y + 2);
+    c.drawString("cpu", 176, area.y + 2);
+    c.drawString("stack left", area.w - 4, area.y + 2);
+    c.setFont(&fonts::body);
+    char cell[16];
+    for (int i = 0; i < kTaskRows && taskTop_ + i < static_cast<int>(rows_.size()); i++) {
+        const TaskRow& r = rows_[taskTop_ + i];
+        int y = area.y + 12 + i * theme::kLineHeight;
+        c.setTextDatum(top_left);
+        c.setTextColor(r.idle ? theme::kMuted : theme::kText);
+        c.drawString(r.name.c_str(), 4, y);
+        c.setTextDatum(top_right);
+        c.setTextColor(theme::kMuted);
+        c.drawString(r.core < 0 ? "any" : std::to_string(r.core).c_str(), 128, y);
+        c.setTextColor(r.idle ? theme::kMuted : theme::kText);
+        std::snprintf(cell, sizeof cell, "%u.%u%%", r.permille / 10, r.permille % 10);
+        c.drawString(cell, 176, y);
+        c.setTextColor(r.lowStack ? theme::kWarning : theme::kMuted);  // Q122: under 512 bytes
+        c.drawString(std::to_string(r.stackFree).c_str(), area.w - 4, y);
+    }
+    c.setTextDatum(top_left);
+    std::string keys = std::string("s: by ") + (sort_ == TaskSort::Share ? "stack" : sort_ == TaskSort::Stack ? "name" : "cpu") +
+                       "   " + std::to_string(rows_.size()) + " tasks   Tab: memory";
+    footer(c, keys.c_str());
+}
+
+void SystemApp::drawMemory(Canvas& c) {
+    const auto& area = theme::kContent;
+    char line[72];
+    c.setFont(&fonts::body);
+    c.setTextColor(theme::kText);
+    std::snprintf(line, sizeof line, "%.1f KB free, lowest %.1f", ESP.getFreeHeap() / 1024.0, ESP.getMinFreeHeap() / 1024.0);
+    c.drawString(line, 4, area.y + 2);
+    c.setTextColor(theme::kMuted);
+    std::snprintf(line, sizeof line, "largest free block %.1f KB", heap_caps_get_largest_free_block(MALLOC_CAP_8BIT) / 1024.0);
+    c.drawString(line, 4, area.y + 2 + theme::kLineHeight);
+
+    // Free heap over two minutes, with the floors of Q86 as lines.
+    int gx = 26, gy = area.y + 32, gw = area.w - gx - 6, gh = area.y + area.h - 12 - gy;
+    uint16_t top = 128;  // KB at the top of the scale: more if the heap has been higher
+    for (size_t i = 0; i < heapHistory_.size(); i++) top = std::max<uint16_t>(top, heapHistory_.at(i) + 8);
+    auto yOf = [&](int kb) { return gy + gh - std::clamp(kb, 0, static_cast<int>(top)) * gh / top; };
+    c.drawRect(gx, gy, gw, gh + 1, theme::kMuted);
+    c.setFont(&fonts::small);
+    struct {
+        size_t bytes;
+        uint16_t color;
+    } floors[] = {{GeminiService::kStartFloor, theme::kMuted}, {GeminiService::kSteadyFloor, theme::kWarning}, {GeminiService::kTransientFloor, theme::kMessage}};
+    for (auto& f : floors) {
+        int kb = static_cast<int>(f.bytes / 1024), y = yOf(kb);
+        for (int x = gx + 1; x < gx + gw - 1; x += 4) c.drawPixel(x, y, f.color);
+        c.setTextColor(f.color);
+        c.setTextDatum(top_right);
+        c.drawString(std::to_string(kb).c_str(), gx - 3, y - 3);
+    }
+    c.setTextDatum(top_left);
+    for (size_t i = 1; i < heapHistory_.size(); i++) {
+        int x0 = gx + 1 + static_cast<int>((i - 1) * (gw - 2) / kHistory), x1 = gx + 1 + static_cast<int>(i * (gw - 2) / kHistory);
+        c.drawLine(x0, yOf(heapHistory_.at(i - 1)), x1, yOf(heapHistory_.at(i)), theme::kAccent);
+    }
+    footer(c, "KB free, 2 min, with the floors   Tab: network");
+}
+
+void SystemApp::drawNetwork(Canvas& c) {
+    const auto& area = theme::kContent;
+    char line[72];
+    c.setFont(&fonts::body);
+    WifiService::Connection n = wifi_.connection();
+    c.setTextColor(n.connected ? theme::kText : theme::kWarning);
+    if (n.connected) std::snprintf(line, sizeof line, "%s, %d dBm", wifi_.ssid().c_str(), wifi_.rssi());
+    else std::snprintf(line, sizeof line, "Wi-Fi isn't connected");
+    c.drawString(line, 4, area.y + 2);
+    if (n.connected) {
+        c.setTextColor(theme::kMuted);
+        std::snprintf(line, sizeof line, "%s/%d %s, gw %s", n.address.c_str(), n.prefix, n.fixed ? "fixed" : "DHCP",
+                      n.gateway.empty() ? "none" : n.gateway.c_str());
+        c.drawString(line, 4, area.y + 2 + theme::kLineHeight);
+    }
+    // Per service (Q121): totals since boot, and the last second.
+    int y = area.y + 32;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("service", 4, y);
+    c.setTextDatum(top_right);
+    c.drawString("in", 124, y);
+    c.drawString("out", 168, y);
+    c.drawString("now, /s", area.w - 4, y);
+    c.setFont(&fonts::body);
+    y += 10;
+    for (size_t i = 0; i < kUsers; i++) {
+        bool active = rateIn_[i] || rateOut_[i];
+        c.setTextDatum(top_left);
+        c.setTextColor(active ? theme::kMessage : theme::kText);
+        c.drawString(net::userName(static_cast<net::User>(i)), 4, y);
+        c.setTextDatum(top_right);
+        c.setTextColor(theme::kText);
+        c.drawString(net::formatTraffic(traffic_[i].in).c_str(), 124, y);
+        c.drawString(net::formatTraffic(traffic_[i].out).c_str(), 168, y);
+        c.setTextColor(active ? theme::kMessage : theme::kMuted);
+        c.drawString(active ? net::formatTraffic(rateIn_[i] + rateOut_[i]).c_str() : "-", area.w - 4, y);
+        y += theme::kLineHeight;
+    }
+    c.setTextDatum(top_left);
+    footer(c, "bytes since boot   Tab: system");
+}
+
+void SystemApp::drawSystem(Canvas& c) {
+    const auto& area = theme::kContent;
+    if (systemLines_.empty()) {
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Reading...", 4, area.y + 4);
+        return;
+    }
+    // The console's lines are longer than the screen: wrap them, continuation lines indented.
+    std::vector<std::string> wrapped;
+    auto measure = widgets::bodyMeasure(c);
+    for (const std::string& line : systemLines_) {
+        bool first = true;
+        for (const std::string& part : wrapText(line, area.w - 14, measure)) {
+            wrapped.push_back(first ? part : "  " + part);
+            first = false;
+        }
+    }
+    wrappedLines_ = static_cast<int>(wrapped.size());
+    systemTop_ = std::clamp(systemTop_, 0, std::max(0, wrappedLines_ - 8));
+    widgets::textLines(c, wrapped, systemTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 12});
+    footer(c, "Tab: overview");
+}
+
+}  // namespace roro

src/apps/system_app.h

@@ -0,0 +1,67 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "key_value_store.h"
+#include "services/battery_service.h"
+#include "services/gnss_service.h"
+#include "services/radio_service.h"
+#include "services/storage_service.h"
+#include "services/wifi_service.h"
+#include "task_stats.h"
+#include "traffic.h"
+
+namespace roro {
+
+// The System App (docs/milestones/S1.md, Q117 to Q127): what the device is doing, live and
+// read-only. Tab moves between Overview, Tasks, Memory, Network and System. It samples once a
+// second and keeps two minutes of history, only while it's open (Q120).
+class SystemApp : public App {
+   public:
+    SystemApp(WifiService& wifi, BatteryService& battery, StorageService& storage, RadioService& radio, GnssService& gnss,
+              KeyValueStore& store)
+        : wifi_(wifi), battery_(battery), storage_(storage), radio_(radio), gnss_(gnss), store_(store) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View : uint8_t { Overview, Tasks, Memory, Network, System, Count };
+    static constexpr size_t kHistory = 120;  // seconds
+    static constexpr int kTaskRows = 7;
+
+    void sample(uint32_t nowMs);
+    void drawOverview(Canvas& c);
+    void drawTasks(Canvas& c);
+    void drawMemory(Canvas& c);
+    void drawNetwork(Canvas& c);
+    void drawSystem(Canvas& c);
+    void footer(Canvas& c, const char* keys);
+
+    WifiService& wifi_;
+    BatteryService& battery_;
+    StorageService& storage_;
+    RadioService& radio_;
+    GnssService& gnss_;
+    KeyValueStore& store_;
+    View view_ = View::Overview;
+    uint32_t sampledMs_ = 0;
+    std::vector<TaskSample> before_;
+    uint32_t beforeTotal_ = 0;
+    std::vector<TaskRow> rows_;  // the last second, sorted
+    TaskSort sort_ = TaskSort::Share;
+    int taskTop_ = 0;
+    int load_[2] = {-1, -1};
+    History<uint8_t, kHistory> loadHistory_[2];
+    History<uint16_t, kHistory> heapHistory_;  // free heap, KB
+    net::Traffic traffic_[static_cast<size_t>(net::User::Count)];
+    uint32_t rateIn_[static_cast<size_t>(net::User::Count)] = {}, rateOut_[static_cast<size_t>(net::User::Count)] = {};
+    std::vector<std::string> systemLines_;
+    int systemTop_ = 0, wrappedLines_ = 0;
+};
+
+}  // namespace roro

src/apps/wifi_settings_page.cpp

@@ -1,5 +1,6 @@
 #include "wifi_settings_page.h"
 
+#include "ipv4.h"
 #include "ui/fonts.h"
 #include "ui/widgets.h"
 
@@ -15,6 +16,62 @@ void WifiSettingsPage::enter() {
 
 void WifiSettingsPage::refreshMain() { main_.setCount(kFixedRows + saved_.count()); }
 
+// With Automatic, a network's page shows only the IP row and Forget.
+WifiSettingsPage::NetworkRow WifiSettingsPage::networkRow(int i) const {
+    if (draftFixed_) return static_cast<NetworkRow>(i);
+    return i == 0 ? kIpMode : kForget;
+}
+
+void WifiSettingsPage::openNetwork(const SavedNetwork& n) {
+    netSsid_ = n.ssid;
+    draftFixed_ = n.fixed;
+    draftAddress_ = n.fixed ? net::formatIpv4(n.ip.address) : "";
+    draftPrefix_ = n.fixed ? std::to_string(n.ip.prefix) : "";
+    draftGateway_ = n.fixed && n.ip.gateway ? net::formatIpv4(n.ip.gateway) : "";
+    network_.setCount(draftFixed_ ? 5 : 2);
+    network_.select(0);
+    view_ = View::Network;
+}
+
+// Leaving a network's page applies its IP setting (Q114), if it passes the checks (Q111).
+bool WifiSettingsPage::leaveNetwork() {
+    const SavedNetwork* n = saved_.find(netSsid_);
+    if (!n) return true;  // forgotten meanwhile
+    std::string why;
+    if (draftFixed_) {
+        net::FixedIp fixed;
+        why = net::parseFixed(draftAddress_ + "/" + draftPrefix_ + (draftGateway_.empty() ? "" : " " + draftGateway_), fixed);
+        if (draftAddress_.empty()) why = "A Fixed setting needs an address";
+        if (!why.empty()) {
+            warn(why);
+            return false;
+        }
+        bool same = n->fixed && n->ip.address == fixed.address && n->ip.prefix == fixed.prefix && n->ip.gateway == fixed.gateway;
+        if (same) return true;
+        why = saved_.setIp(netSsid_, &fixed);
+        if (why.empty()) warn(netSsid_ + ": fixed, " + net::formatFixed(fixed), NotificationLevel::Info);
+    } else {
+        if (!n->fixed) return true;
+        why = saved_.setIp(netSsid_, nullptr);
+        if (why.empty()) warn(netSsid_ + ": automatic (DHCP)", NotificationLevel::Info);
+    }
+    if (!why.empty()) {
+        warn(why);
+        return false;
+    }
+    wifi_.ipSettingChanged(netSsid_);
+    return true;
+}
+
+void WifiSettingsPage::edit(Field field, const std::string& title, const std::string& value, View from) {
+    field_ = field;
+    editTitle_ = title;
+    editFrom_ = from;
+    editor_ = LineEditor(field == Field::Ntp1 || field == Field::Ntp2 ? 63 : 15);
+    for (char ch : value) editor_.insert(static_cast<uint8_t>(ch));
+    view_ = View::Edit;
+}
+
 void WifiSettingsPage::warn(const std::string& text, NotificationLevel level) {
     bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(level)));
 }
@@ -35,42 +92,22 @@ bool WifiSettingsPage::onKey(const KeyEvent& e) {
     if (forgetDialog_) {
         forgetDialog_->onKey(e);
         if (forgetDialog_->result() == 1) {
-            saved_.forget(saved_.at(main_.selected() - kFixedRows).ssid);
-            refreshMain();
+            saved_.forget(netSsid_);
+            wifi_.ipSettingChanged(netSsid_);  // it may be the one in use
+            enter();
         }
-        if (forgetDialog_->result() != DialogModel::kPending) forgetDialog_.reset();
+        if (forgetDialog_ && forgetDialog_->result() != DialogModel::kPending) forgetDialog_.reset();
         return true;
     }
 
     switch (view_) {
-        case View::Main:
-            switch (e.key) {
-                case Key::Up: main_.up(); return true;
-                case Key::Down: main_.down(); return true;
-                case Key::Back: return false;
-                case Key::Left:
-                case Key::Right:
-                    if (main_.selected() != kToggle) return true;
-                    [[fallthrough]];
-                case Key::Select:
-                    switch (main_.selected()) {
-                        case kToggle: settings_.setBool(Setting::WifiEnabled, !settings_.getBool(Setting::WifiEnabled)); break;
-                        case kStatus: break;
-                        case kAddScanned:
-                            wifi_.startListScan();
-                            scan_.setCount(0);
-                            view_ = View::Scan;
-                            break;
-                        case kAddHidden:
-                            newHidden_ = true;
-                            editor_ = LineEditor(32);
-                            view_ = View::Ssid;
-                            break;
-                        default: forgetDialog_.reset(new DialogModel({"Cancel", "Forget"})); break;
-                    }
-                    return true;
-                default: return true;
-            }
+        case View::Main: return mainKey(e);
+        case View::Servers: return serversKey(e);
+        case View::Network: return networkKey(e);
+        case View::Edit: return editKey(e);
+        case View::Details:
+            if (e.key == Key::Back || e.key == Key::Select) view_ = View::Main;
+            return true;
 
         case View::Scan: {
             std::vector<ScanEntry> found;
@@ -131,6 +168,159 @@ bool WifiSettingsPage::onKey(const KeyEvent& e) {
     return true;
 }
 
+bool WifiSettingsPage::mainKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Up: main_.up(); return true;
+        case Key::Down: main_.down(); return true;
+        case Key::Back: return false;
+        case Key::Left:
+        case Key::Right:
+            if (main_.selected() != kToggle) return true;
+            [[fallthrough]];
+        case Key::Select:
+            switch (main_.selected()) {
+                case kToggle: settings_.setBool(Setting::WifiEnabled, !settings_.getBool(Setting::WifiEnabled)); break;
+                case kStatus: view_ = View::Details; break;
+                case kServers:
+                    servers_.setCount(kServerRows);
+                    view_ = View::Servers;
+                    break;
+                case kAddScanned:
+                    wifi_.startListScan();
+                    scan_.setCount(0);
+                    view_ = View::Scan;
+                    break;
+                case kAddHidden:
+                    newHidden_ = true;
+                    editor_ = LineEditor(32);
+                    view_ = View::Ssid;
+                    break;
+                default: openNetwork(saved_.at(main_.selected() - kFixedRows)); break;
+            }
+            return true;
+        default: return true;
+    }
+}
+
+// DNS and NTP servers (Q108 to Q110).
+bool WifiSettingsPage::serversKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Up: servers_.up(); break;
+        case Key::Down: servers_.down(); break;
+        case Key::Back: view_ = View::Main; break;
+        case Key::Left:
+        case Key::Right:
+            if (servers_.selected() != kDnsAlways) break;
+            [[fallthrough]];
+        case Key::Select:
+            switch (servers_.selected()) {
+                case kDns1: edit(Field::Dns1, "First DNS server", settings_.getString(Setting::Dns1), View::Servers); break;
+                case kDns2: edit(Field::Dns2, "Second DNS server (or empty)", settings_.getString(Setting::Dns2), View::Servers); break;
+                case kDnsAlways:
+                    settings_.setBool(Setting::DnsAlways, !settings_.getBool(Setting::DnsAlways));
+                    wifi_.serversChanged();
+                    break;
+                case kNtp1: edit(Field::Ntp1, "First NTP server", settings_.getString(Setting::Ntp1), View::Servers); break;
+                case kNtp2: edit(Field::Ntp2, "Second NTP server (or empty)", settings_.getString(Setting::Ntp2), View::Servers); break;
+            }
+            break;
+        default: break;
+    }
+    return true;
+}
+
+bool WifiSettingsPage::networkKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Up: network_.up(); break;
+        case Key::Down: network_.down(); break;
+        case Key::Back:
+            if (leaveNetwork()) enter();
+            break;
+        case Key::Left:
+        case Key::Right:
+            if (networkRow(network_.selected()) != kIpMode) break;
+            [[fallthrough]];
+        case Key::Select:
+            switch (networkRow(network_.selected())) {
+                case kIpMode: {
+                    draftFixed_ = !draftFixed_;
+                    // Fixed for the first time: start from what the network gave us, if we're on it.
+                    WifiService::Connection now = wifi_.connection();
+                    if (draftFixed_ && draftAddress_.empty() && now.connected && wifi_.ssid() == netSsid_) {
+                        draftAddress_ = now.address;
+                        draftPrefix_ = std::to_string(now.prefix);
+                        draftGateway_ = now.gateway;
+                    }
+                    if (draftFixed_ && draftPrefix_.empty()) draftPrefix_ = "24";
+                    network_.setCount(draftFixed_ ? 5 : 2);
+                    network_.select(0);
+                    break;
+                }
+                case kAddress: edit(Field::Address, "Address", draftAddress_, View::Network); break;
+                case kPrefix: edit(Field::Prefix, "Prefix (1 to 30; 24 = 255.255.255.0)", draftPrefix_, View::Network); break;
+                case kGateway: edit(Field::Gateway, "Gateway (or empty for none)", draftGateway_, View::Network); break;
+                case kForget: forgetDialog_.reset(new DialogModel({"Cancel", "Forget"})); break;
+            }
+            break;
+        default: break;
+    }
+    return true;
+}
+
+// One field. Addresses take digits and dots only (Q112); what's typed is checked on Enter (Q111).
+bool WifiSettingsPage::editKey(const KeyEvent& e) {
+    bool name = field_ == Field::Ntp1 || field_ == Field::Ntp2;
+    switch (e.key) {
+        case Key::Char: {
+            bool digit = e.ch >= '0' && e.ch <= '9';
+            bool ok = name ? e.ch > ' ' && e.ch < 0x7F : field_ == Field::Prefix ? digit : digit || e.ch == '.';
+            if (ok) editor_.insert(e.ch);
+            break;
+        }
+        case Key::Delete: editor_.backspace(); break;
+        case Key::Left: editor_.left(); break;
+        case Key::Right: editor_.right(); break;
+        case Key::Back: view_ = editFrom_; break;
+        case Key::Select: {
+            std::string text = editor_.text(), why;
+            uint32_t address;
+            switch (field_) {
+                case Field::Address:
+                    if (!net::parseIpv4(text, address)) why = "Four numbers from 0 to 255, like 10.39.39.13";
+                    else draftAddress_ = text;
+                    break;
+                case Field::Prefix: {
+                    int p = text.empty() ? 0 : atoi(text.c_str());
+                    if (p < 1 || p > 30) why = "The prefix must be 1 to 30";
+                    else draftPrefix_ = std::to_string(p);
+                    break;
+                }
+                case Field::Gateway:
+                    if (!text.empty() && !net::parseIpv4(text, address)) why = "Four numbers from 0 to 255, or empty";
+                    else draftGateway_ = text;
+                    break;
+                case Field::Dns1:
+                case Field::Dns2:
+                    if (!settings_.setString(field_ == Field::Dns1 ? Setting::Dns1 : Setting::Dns2, text))
+                        why = field_ == Field::Dns1 ? "An IPv4 address, like 9.9.9.9" : "An IPv4 address, or empty";
+                    else wifi_.serversChanged();
+                    break;
+                case Field::Ntp1:
+                case Field::Ntp2:
+                    if (!settings_.setString(field_ == Field::Ntp1 ? Setting::Ntp1 : Setting::Ntp2, text))
+                        why = field_ == Field::Ntp1 ? "A host name or an IPv4 address" : "A host name, an IPv4 address, or empty";
+                    else wifi_.serversChanged();
+                    break;
+            }
+            if (why.empty()) view_ = editFrom_;
+            else warn(why);
+            break;
+        }
+        default: break;
+    }
+    return true;
+}
+
 void WifiSettingsPage::draw(Canvas& c) {
     const auto& area = theme::kContent;
     switch (view_) {
@@ -141,6 +331,7 @@ void WifiSettingsPage::draw(Canvas& c) {
                     switch (i) {
                         case kToggle: return "Wi-Fi";
                         case kStatus: return "Status";
+                        case kServers: return "DNS and NTP";
                         case kAddScanned: return "Add a network";
                         case kAddHidden: return "Add a hidden network";
                         default: {
@@ -153,14 +344,78 @@ void WifiSettingsPage::draw(Canvas& c) {
                     switch (i) {
                         case kToggle: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
                         case kStatus: return statusText();
+                        case kServers:
                         case kAddScanned:
                         case kAddHidden: return ">";
+                        default: return saved_.at(i - kFixedRows).fixed ? "fixed" : "";
+                    }
+                });
+            break;
+
+        case View::Details: drawDetails(c); break;
+
+        case View::Servers:
+            widgets::list(
+                c, servers_, area,
+                [](int i) -> std::string {
+                    switch (i) {
+                        case kDns1: return "DNS 1";
+                        case kDns2: return "DNS 2";
+                        case kDnsAlways: return "Always use my DNS";
+                        case kNtp1: return "NTP 1";
+                        default: return "NTP 2";
+                    }
+                },
+                [this](int i) -> std::string {
+                    switch (i) {
+                        case kDns1: return settings_.getString(Setting::Dns1);
+                        case kDns2: return settings_.getString(Setting::Dns2).empty() ? "none" : settings_.getString(Setting::Dns2);
+                        case kDnsAlways: return settings_.getBool(Setting::DnsAlways) ? "On" : "Off";
+                        case kNtp1: return settings_.getString(Setting::Ntp1);
+                        default: return settings_.getString(Setting::Ntp2).empty() ? "none" : settings_.getString(Setting::Ntp2);
+                    }
+                });
+            break;
+
+        case View::Network: {
+            c.setFont(&fonts::small);
+            c.setTextColor(theme::kMuted);
+            c.drawString(netSsid_.c_str(), 4, area.y + 2);
+            widgets::list(
+                c, network_, {area.x, area.y + 12, area.w, area.h - 12},
+                [this](int i) -> std::string {
+                    switch (networkRow(i)) {
+                        case kIpMode: return "IP address";
+                        case kAddress: return "  Address";
+                        case kPrefix: return "  Prefix";
+                        case kGateway: return "  Gateway";
+                        default: return "Forget this network";
+                    }
+                },
+                [this](int i) -> std::string {
+                    switch (networkRow(i)) {
+                        case kIpMode: return draftFixed_ ? "Fixed" : "Automatic";
+                        case kAddress: return draftAddress_.empty() ? "not set" : draftAddress_;
+                        case kPrefix: {
+                            int p = atoi(draftPrefix_.c_str());
+                            return draftPrefix_ + " (" + net::formatIpv4(net::maskOf(p)) + ")";
+                        }
+                        case kGateway: return draftGateway_.empty() ? "none" : draftGateway_;
                         default: return "";
                     }
                 });
-            if (forgetDialog_ && main_.selected() >= kFixedRows)
-                widgets::dialog(c, "Forget network?", saved_.at(main_.selected() - kFixedRows).ssid, *forgetDialog_);
+            if (forgetDialog_) widgets::dialog(c, "Forget network?", netSsid_, *forgetDialog_);
             break;
+        }
+
+        case View::Edit: {
+            c.setFont(&fonts::body);
+            c.setTextColor(theme::kMuted);
+            c.drawString(editTitle_.c_str(), 4, area.y + 4);
+            widgets::lineEditor(c, editor_, {4, area.y + 22, area.w - 8, 0});
+            c.drawString("Enter: save   `: cancel", 4, area.y + 44);
+            break;
+        }
 
         case View::Scan: {
             if (!wifi_.listScanDone()) {
@@ -195,4 +450,25 @@ void WifiSettingsPage::draw(Canvas& c) {
     }
 }
 
+// What the device is using and where each part came from (Q113).
+void WifiSettingsPage::drawDetails(Canvas& c) {
+    const auto& area = theme::kContent;
+    WifiService::Connection n = wifi_.connection();
+    std::vector<std::string> lines;
+    if (!n.connected) {
+        lines = {statusText(), "", "`: back"};
+    } else {
+        lines.push_back(wifi_.ssid() + ", " + std::to_string(wifi_.rssi()) + " dBm");
+        lines.push_back("Address " + n.address + "/" + std::to_string(n.prefix) + (n.fixed ? " (fixed)" : " (DHCP)"));
+        lines.push_back("Mask " + n.mask);
+        lines.push_back("Gateway " + (n.gateway.empty() ? std::string("none") : n.gateway));
+        std::string from = n.dnsFromSettings ? " (Settings)" : " (DHCP)";
+        lines.push_back("DNS " + (n.dns[0].empty() ? std::string("none") : n.dns[0] + from));
+        if (!n.dns[1].empty()) lines.push_back("DNS " + n.dns[1] + from);
+        for (int i = 0; i < n.ntpCount; i++)
+            lines.push_back("NTP " + n.ntp[i].server + (n.ntp[i].fromDhcp ? " (DHCP)" : "") + (n.ntp[i].answered ? ", answered" : ""));
+    }
+    widgets::textLines(c, lines, 0, {area.x + 2, area.y + 2, area.w - 2, area.h - 2});
+}
+
 }  // namespace roro

src/apps/wifi_settings_page.h

@@ -16,8 +16,9 @@
 
 namespace roro {
 
-// Settings → Wi-Fi: the On/Off switch, current connection, Saved Networks, and adding networks
-// from a scan or by name (hidden). Owned by the Settings App.
+// Settings → Wi-Fi: the On/Off switch, the connection and its details, DNS and NTP servers, and
+// the Saved Networks: adding one from a scan or by name (hidden), and each one's own page with its
+// IP setting, Automatic or Fixed (docs/milestones/S1.md, Q113). Owned by the Settings App.
 class WifiSettingsPage {
    public:
     WifiSettingsPage(Settings& settings, SavedNetworks& saved, WifiService& wifi, EventBus& bus)
@@ -25,17 +26,31 @@ class WifiSettingsPage {
 
     void enter();
     bool onKey(const KeyEvent& e);  // false: leave the page
-    bool textEntryActive() const { return view_ == View::Ssid || view_ == View::Password; }
-    bool live() const { return view_ == View::Main || view_ == View::Scan; }  // redraw periodically
+    bool textEntryActive() const { return view_ == View::Ssid || view_ == View::Password || view_ == View::Edit; }
+    // Redraw periodically: the status, a scan, the connection details.
+    bool live() const { return view_ == View::Main || view_ == View::Scan || view_ == View::Details; }
     void draw(Canvas& c);
 
    private:
-    enum class View { Main, Scan, Ssid, Password };
-    enum Fixed { kToggle, kStatus, kAddScanned, kAddHidden, kFixedRows };
+    enum class View { Main, Scan, Ssid, Password, Details, Servers, Network, Edit };
+    enum Fixed { kToggle, kStatus, kServers, kAddScanned, kAddHidden, kFixedRows };
+    enum ServerRow { kDns1, kDns2, kDnsAlways, kNtp1, kNtp2, kServerRows };
+    // A Saved Network's page: with Automatic, only kIpMode and kForget are shown.
+    enum NetworkRow { kIpMode, kAddress, kPrefix, kGateway, kForget };
+    enum class Field { Address, Prefix, Gateway, Dns1, Dns2, Ntp1, Ntp2 };
 
     void refreshMain();
     void warn(const std::string& text, NotificationLevel level = NotificationLevel::Warning);
     std::string statusText() const;
+    bool mainKey(const KeyEvent& e);
+    bool serversKey(const KeyEvent& e);
+    bool networkKey(const KeyEvent& e);
+    bool editKey(const KeyEvent& e);
+    void openNetwork(const SavedNetwork& n);
+    bool leaveNetwork();  // checks and applies the draft; false (with a Toast) when it's refused
+    NetworkRow networkRow(int i) const;
+    void edit(Field field, const std::string& title, const std::string& value, View from);
+    void drawDetails(Canvas& c);
 
     Settings& settings_;
     SavedNetworks& saved_;
@@ -44,10 +59,21 @@ class WifiSettingsPage {
     View view_ = View::Main;
     ListModel main_{theme::kContent.h / theme::kLineHeight};
     ListModel scan_{theme::kContent.h / theme::kLineHeight};
+    ListModel servers_{theme::kContent.h / theme::kLineHeight};
+    ListModel network_{theme::kContent.h / theme::kLineHeight - 1};
     LineEditor editor_{63};
     std::string newSsid_;
     bool newHidden_ = false;
     std::unique_ptr<DialogModel> forgetDialog_;
+    // The Saved Network whose page is open, and its IP setting as being typed (a draft: applied on
+    // leaving the page, so a half-typed address is never used).
+    std::string netSsid_;
+    bool draftFixed_ = false;
+    std::string draftAddress_, draftPrefix_, draftGateway_;
+    // The field being edited, and where Enter and Back return to.
+    Field field_ = Field::Address;
+    std::string editTitle_;
+    View editFrom_ = View::Main;
 };
 
 }  // namespace roro

src/main.cpp

@@ -8,27 +8,37 @@
 
 #include "app_manager.h"
 #include "apps/demo_app.h"
+#include "apps/gemini_app.h"
 #include "apps/gnss_app.h"
 #include "apps/irc_app.h"
 #include "apps/launcher_app.h"
+#include "apps/lora_scanner_app.h"
 #include "apps/settings_app.h"
+#include "apps/system_app.h"
 #include "apps/wifi_tools_app.h"
 #include "apps/setup_app.h"
 #include "event_bus.h"
 #include "file_receiver.h"
+#include "ipv4.h"
+#include "traffic.h"
 #include "key_mapper.h"
 #include "platform/console.h"
 #include "platform/crash_report.h"
 #include "platform/nvs_store.h"
 #include "platform/system_info.h"
+#include "sd_card_id.h"
+#include "sd_fault.h"
 #include "service_manager.h"
 #include "platform/identity.h"
 #include "services/battery_service.h"
 #include "services/irc_service.h"
 #include "services/clock_service.h"
 #include "services/debug_console.h"
+#include "services/gemini_service.h"
 #include "services/gnss_service.h"
 #include "services/power_service.h"
+#include "services/lora_capture_service.h"
+#include "services/radio_service.h"
 #include "services/storage_service.h"
 #include "services/update_service.h"
 #include "services/wifi_service.h"
@@ -54,6 +64,9 @@ static StorageService* storageService;
 static PowerService* power;
 static ClockService* clockService;
 static GnssService* gnssService;
+static RadioService* radioService;
+static LoraCaptureService* loraCapture;
+static GeminiService* geminiService;
 static SavedNetworks* savedNetworks;
 static WifiService* wifi;
 static IrcService* irc;
@@ -101,6 +114,12 @@ static StatusInfo currentStatus() {
         s.gnssSatellites = g.satellitesUsed;
         s.tracking = gnssService->tracking();
     }
+    if (radioService && radioService->sweeping()) s.radio = StatusInfo::Radio::Sweep;
+    else if (radioService && radioService->listening()) {
+        uint32_t last = radioService->lastPacketMs();
+        s.radio = last && millis() - last < 400 ? StatusInfo::Radio::Packet : StatusInfo::Radio::Listening;
+    }
+    s.capturing = loraCapture && loraCapture->capturing();
     using WifiState = WifiController::State;
     switch (wifi->state()) {
         case WifiState::Connected: {
@@ -145,7 +164,9 @@ void setup() {
     storageService = new StorageService(bus);
     power = new PowerService(settings);
     clockService = new ClockService(settings, bus);
+    geminiService = new GeminiService(nvs, *storageService, *clockService, bus);
     gnssService = new GnssService(settings, *clockService, *storageService, bus);
+    radioService = new RadioService();
     savedNetworks = new SavedNetworks(nvs);
     savedNetworks->load();
     wifi = new WifiService(settings, *savedNetworks, *clockService);
@@ -157,6 +178,9 @@ void setup() {
     services.add(*clockService);
     services.add(*battery);
     services.add(*gnssService);
+    services.add(*radioService);
+    loraCapture = new LoraCaptureService(*radioService, *storageService, *clockService, bus);
+    services.add(*loraCapture);
     services.add(*storageService);
     services.add(*wifi);
     services.add(*irc);
@@ -171,6 +195,10 @@ void setup() {
     apps->registerApp({"irc", "IRC", false, new IrcApp(*irc, *clockService, bus)});
     apps->registerApp({"wifi-tools", "Wi-Fi Tools", false, new WifiToolsApp(*wifi, *storageService, *clockService)});
     apps->registerApp({"gnss", "GNSS", false, new GnssApp(*gnssService, settings)});
+    apps->registerApp({"gemini", "Gemini", false, new GeminiApp(*geminiService)});
+    apps->registerApp({"lora", "LoRa Scanner", false, new LoraScannerApp(*radioService, *loraCapture, settings, *clockService)});
+    apps->registerApp({"system", "System", false,
+                       new SystemApp(*wifi, *battery, *storageService, *radioService, *gnssService, nvs)});
     apps->registerApp({"settings", "Settings", false,
                        new SettingsApp({settings, bus, *apps, *battery, *storageService, *clockService, *wifi, *savedNetworks, *update})});
     apps->registerApp({"demo", "Widget demo", true, new DemoApp(bus)});
@@ -336,22 +364,64 @@ static void uploadStep() {
     }
 }
 
+#ifdef RORO_DEBUG
+// `wifi ip ... try <seconds>`: a trial IP setting that reverts unless `wifi ip keep` arrives, so a
+// wrong address tried over Wi-Fi doesn't cut the device off for good.
+static struct {
+    bool active = false;
+    uint32_t untilMs = 0;
+    std::string ssid;
+    bool wasFixed = false;
+    net::FixedIp was;
+} ipTrial;
+
+static void ipTrialStep() {
+    if (!ipTrial.active || static_cast<int32_t>(millis() - ipTrial.untilMs) < 0) return;
+    ipTrial.active = false;
+    savedNetworks->setIp(ipTrial.ssid, ipTrial.wasFixed ? &ipTrial.was : nullptr);
+    console.printf("wifi ip: trial over, %s is back to %s\n", ipTrial.ssid.c_str(),
+                   ipTrial.wasFixed ? net::formatFixed(ipTrial.was).c_str() : "Automatic (DHCP)");
+    wifi->ipSettingChanged(ipTrial.ssid);
+}
+#endif
+
+// `tasks`: the first sample, and when to take the second and print.
+static std::vector<TaskSample> tasksBefore;
+static uint32_t tasksTotal = 0, tasksDueMs = 0;
+static bool tasksPending = false;
+
+static void tasksStep() {
+    if (!tasksPending || static_cast<int32_t>(millis() - tasksDueMs) < 0) return;
+    tasksPending = false;
+    system_info::printTasks(console, tasksBefore, tasksTotal);
+    std::vector<TaskSample>().swap(tasksBefore);
+}
+
 static const char* const kHelp =
     "info              firmware, uptime, memory, Wi-Fi, app slots\n"
-    "tasks             FreeRTOS tasks: state, priority, free stack, CPU\n"
+    "tasks             FreeRTOS tasks over the next second: state, priority, free stack, CPU share\n"    "net               bytes each network service has read and written since boot\n"
     "reboot            restart\n"
     "boot other        restart into the other app slot (manual Rollback)\n"
     "log level <0-5>   ESP-IDF log level (0 none ... 5 verbose)\n"
+    "lora probe | lora status | lora rx on|off | lora preset <name>   the LoRa radio, receive only\n"
+    "lora capture start|stop   a LoRa Capture to /captures/lora (pcap, LoRaTap)\n"
+    "lora sweep on [from MHz] [to MHz] [step kHz] | off | dump   RSSI across a band (863 870 100)\n"
+    "lora custom <MHz> <BW kHz> <SF> <CR 5-8> <sync hex> [preamble]   e.g. 868.1 125 7 5 34 8 (LoRaWAN)\n"
     "gnss status | gnss restart | gnss track start|stop | gnss nmea on|off | gnss send <sentence without $ and checksum>\n"
     "crash             the last crash: firmware, reason, task, backtrace\n"
     "coredump erase    forget the core dump in flash\n"
-    "key <name|char>   press a key: up down left right select back home del tab, or one character\n"
+    "key <name|char>   press a key: up down left right select back home del tab space, or one character\n"
     "wifi status | wifi add <ssid><TAB><password>\n"
+    "wifi ip <ssid> dhcp | wifi ip <ssid> <address>/<prefix> [gateway]   a Saved Network's IP setting\n"
+    "wifi dns <a> [b] | wifi dns always on|off | wifi ntp <a> [b]   DNS and NTP servers\n"
+    "gemini get <url>  fetch a Gemini page and report header, size, certificate, heap\n"
     "irc start | irc stop | irc dump | irc say <buffer> <text>\n"
     "ls [folder] | rm <path> | install <path.ota> (Update from SD)\n"
-    "sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
+    "sd card | sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
 #ifdef RORO_DEBUG
     "crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)\n"
+    "wifi ip ... try <seconds> | wifi ip keep   a trial IP setting: back to the previous one unless kept\n"
+    "lora inject <hex> [rssi] [snr]   a packet into the LoRa Scanner as if received (nothing is sent)\n"
     "coredump get      (Debug Console only) send the raw core dump: use scripts/rdbg.py coredump\n"
     "reset             (Debug Console only) restart at once, even if the main loop is stuck\n"
     "get <path> | put <path> <size> <sha256> | screenshot   (Debug Console only) binary, see rdbg.py\n"
@@ -361,7 +431,7 @@ static const char* const kHelp =
 
 // Commands that only touch what Safe Mode starts.
 static bool safeModeCommand(const String& line) {
-    return line == "help" || line == "info" || line == "tasks" || line == "reboot" || line == "boot other" ||
+    return line == "help" || line == "info" || line == "tasks" || line == "net" || line == "reboot" || line == "boot other" ||
            line.startsWith("log level ") || line.startsWith("crash") || line.startsWith("coredump") ||
            line == "wifi status" || line.startsWith("wifi add ");
 }
@@ -373,12 +443,23 @@ static void runCommand(String line) {
     if (line == "help") console.print(kHelp);
     if (line == "info") {
         system_info::printSystem(console);
-        console.printf("wifi: %s, ip %s, rssi %d | sd: %s\n", wifi->ssid().c_str(), wifi->ip().c_str(), wifi->rssi(),
-                       storageService->state().present ? "present" : "none");
+        console.printf("wifi: %s, ip %s, rssi %d | sd: %s, %u write faults\n", wifi->ssid().c_str(), wifi->ip().c_str(),
+                       wifi->rssi(), storageService->state().present ? "present" : "none", (unsigned)sdLastFault().count);
         console.printf("update: %s\n", update->onProbation() ? "on probation" : "confirmed");
         system_info::printSlots(console, nvs);
     }
-    if (line == "tasks") system_info::printTasks(console);
+    if (line == "tasks") {  // sampled now, printed a second later by tasksStep(): the loop must run in between
+        tasksTotal = system_info::sampleTasks(tasksBefore);
+        tasksDueMs = millis() + 1000;
+        tasksPending = true;
+    }
+    if (line == "net") {  // bytes each service has read and written since boot (S1, Q121)
+        for (int i = 0; i < static_cast<int>(net::User::Count); i++) {
+            net::Traffic t = net::traffic(static_cast<net::User>(i));
+            console.printf("net: %-14s in %10lu  out %10lu\n", net::userName(static_cast<net::User>(i)), (unsigned long)t.in,
+                           (unsigned long)t.out);
+        }
+    }
     if (line == "reboot") {
         console.println("restarting");
         delay(300);
@@ -404,6 +485,56 @@ static void runCommand(String line) {
         });
     }
     if (line.startsWith("install ")) update->installFromSd(line.substring(8).c_str());  // Update from SD
+    if (line == "lora probe" && radioService) radioService->probe(console);
+    if (line == "lora status" && radioService) radioService->printStatus(console);
+    if ((line == "lora rx on" || line == "lora rx off") && radioService) radioService->setEcho(line.endsWith("on"));
+    if (line.startsWith("lora sweep") && radioService) {  // on [from MHz] [to MHz] [step kHz] | off | dump
+        if (line == "lora sweep dump") radioService->printSweep(console);
+        else if (line == "lora sweep off") {
+            radioService->setSweepEcho(false);
+            radioService->sweep(false);
+        } else if (line.startsWith("lora sweep on")) {
+            double from = 863, to = 870, step = 100;
+            sscanf(line.c_str() + 13, "%lf %lf %lf", &from, &to, &step);
+            radioService->setSweepEcho(true);
+            radioService->sweep(true, from * 1e6 + 0.5, to * 1e6 + 0.5, step * 1e3 + 0.5);
+        }
+    }
+    if (line == "lora capture start" && loraCapture) {
+        std::string why = loraCapture->start(millis());
+        console.printf("lora capture: %s\n", why.empty() ? loraCapture->path().c_str() : why.c_str());
+    }
+    if (line == "lora capture stop" && loraCapture) loraCapture->stop();
+#ifdef RORO_DEBUG
+    if (line.startsWith("lora inject ") && radioService) {  // <hex> [rssi] [snr]: as if received
+        String hex = line.substring(12);
+        int space = hex.indexOf(' ');
+        float rssi = -100, snr = 5;
+        if (space > 0) sscanf(hex.c_str() + space + 1, "%f %f", &rssi, &snr), hex = hex.substring(0, space);
+        uint8_t data[255];
+        size_t n = 0;
+        for (size_t i = 0; i + 1 < hex.length() && n < sizeof data; i += 2) data[n++] = strtoul(hex.substring(i, i + 2).c_str(), nullptr, 16);
+        radioService->inject(data, n, rssi, snr);
+    }
+#endif
+    if (line.startsWith("lora custom ") && radioService) {
+        double mhz = 0, bw = 0;
+        unsigned sf = 0, cr = 0, sync = 0, preamble = 8;
+        int n = sscanf(line.c_str() + 12, "%lf %lf %u %u %x %u", &mhz, &bw, &sf, &cr, &sync, &preamble);
+        // Inside what the Cap's SX1262 tunes (868 to 923 MHz) and LoRa's own limits.
+        if (n < 5 || mhz < 863 || mhz > 928 || bw < 7 || bw > 500 || sf < 5 || sf > 12 || cr < 5 || cr > 8 || sync > 0xFF)
+            console.println("lora custom: usage: lora custom <MHz> <BW kHz> <SF 5-12> <CR 5-8> <sync hex> [preamble]");
+        else {
+            radioService->setConfig({static_cast<uint32_t>(mhz * 1e6 + 0.5), static_cast<float>(bw), static_cast<uint8_t>(sf),
+                                     static_cast<uint8_t>(cr), static_cast<uint8_t>(sync), static_cast<uint16_t>(preamble), "Custom"});
+            console.printf("lora custom: %.3f MHz, BW %.1f kHz, SF %u, CR 4/%u, sync 0x%02X, preamble %u\n", mhz, bw, sf, cr, sync, preamble);
+        }
+    }
+    if (line.startsWith("lora preset ") && radioService) {
+        const meshtastic::Preset* p = meshtastic::findPreset(line.substring(12).c_str());
+        if (p) radioService->setPreset(*p);
+        console.printf("lora preset: %s\n", p ? p->name : "unknown (LongFast LongSlow MediumSlow MediumFast ShortSlow ShortFast LongMod)");
+    }
     if (line == "gnss status" && gnssService) gnssService->printStatus(console, millis());
     if ((line == "gnss nmea on" || line == "gnss nmea off") && gnssService) gnssService->setEcho(line.endsWith("on"));
     if (line == "gnss restart" && gnssService) gnssService->restart(millis());
@@ -429,7 +560,9 @@ static void runCommand(String line) {
         Key key = k == "up" ? Key::Up : k == "down" ? Key::Down : k == "left" ? Key::Left
                 : k == "right" ? Key::Right : k == "back" ? Key::Back : k == "home" ? Key::Home
                 : k == "del" ? Key::Delete : k == "tab" ? Key::Tab : Key::Select;
-        KeyEvent ev = k.length() == 1 && k[0] > ' ' ? KeyEvent::character((unsigned char)k[0]) : KeyEvent::of(key);
+        KeyEvent ev = k == "space"                       ? KeyEvent::character(' ')
+                      : k.length() == 1 && k[0] > ' ' ? KeyEvent::character((unsigned char)k[0])
+                                                      : KeyEvent::of(key);
         if (!power->onKey(millis())) apps->handleKey(ev);
     }
     if (line.startsWith("wifi add ")) {  // wifi add <ssid>\t<password>: credentials never touch the repo
@@ -458,10 +591,29 @@ static void runCommand(String line) {
         }
     }
     if (line.startsWith("sd put ")) startUpload(line.substring(7));  // then raw bytes: see uploadStep()
+    if (line == "sd card") {  // what the card says it is, from its CID register
+        if (!storageService->state().present) return (void)console.println("sd card: no card");
+        storageService->runJob([]() {
+            uint8_t cid[16];
+            const char* type = SD.cardType() == CARD_SDHC ? "SDHC/SDXC" : SD.cardType() == CARD_SD ? "SDSC" : "MMC or unknown";
+            if (!sdReadCid(cid)) return (void)console.println("sd card: the card didn't answer");
+            console.printf("sd card: %s, %.1f GB, %s\n", type, SD.cardSize() / 1e9, sdCardSummary(parseSdCid(cid)).c_str());
+            console.printf("sd card: CID");
+            for (uint8_t b : cid) console.printf(" %02x", b);
+            console.println();
+        });
+    }
     if (line == "sd list") {
         storageService->requestListing();
         listingWanted = true;
     }
+    if (line.startsWith("gemini trust ")) {  // gemini trust <host> <port> <sha256>: accept a changed certificate
+        char host[96] = "", fp[80] = "";
+        int port = 1965;
+        if (geminiService && sscanf(line.substring(13).c_str(), "%95s %d %79s", host, &port, fp) == 3) geminiService->trust(host, port, fp);
+    }
+    if (line.startsWith("gemini get "))
+        if (!geminiService || !geminiService->fetchToConsole(line.substring(11).c_str())) console.println("gemini: busy, or unavailable in Safe Mode");
     if (line == "irc start") irc->connect();
     if (line == "irc stop") irc->disconnect();
     if (line.startsWith("irc say ")) {  // irc say <buffer index> <text>
@@ -488,11 +640,77 @@ static void runCommand(String line) {
             }
         });
     }
-    if (line == "wifi status")
+    if (line == "wifi status") {
         console.printf("wifi: state %d ssid '%s' rssi %d ip %s clock %s heap %u min %u | fw %s%s\n",
                        (int)wifi->state(), wifi->ssid().c_str(), wifi->rssi(), wifi->ip().c_str(),
                        clockService->displayTime().c_str(), ESP.getFreeHeap(), ESP.getMinFreeHeap(), versionString(),
                        update->onProbation() ? " (on probation)" : "");
+        WifiService::Connection c = wifi->connection();  // S1, Q115: what's in use and where it came from
+        if (c.connected) {
+            console.printf("wifi: address %s/%d (%s), gateway %s\n", c.address.c_str(), c.prefix, c.fixed ? "fixed" : "DHCP",
+                           c.gateway.empty() ? "none" : c.gateway.c_str());
+            console.printf("wifi: dns %s %s (%s)\n", c.dns[0].empty() ? "none" : c.dns[0].c_str(), c.dns[1].c_str(),
+                           c.dnsFromSettings ? "Settings" : "DHCP");
+            console.print("wifi: ntp");
+            for (int i = 0; i < c.ntpCount; i++) console.printf(" %s (%s%s)", c.ntp[i].server.c_str(), c.ntp[i].fromDhcp ? "DHCP" : "Settings", c.ntp[i].answered ? ", answered" : "");
+            console.println(c.ntpCount ? "" : " none");
+        }
+    }
+    if (line.startsWith("wifi ip ")) {  // wifi ip <ssid> dhcp | <address>/<prefix> [gateway]  (the SSID may hold spaces)
+        std::string rest = line.substring(8).c_str();
+#ifdef RORO_DEBUG
+        if (rest == "keep") {  // the trial setting stays
+            console.println(ipTrial.active ? "wifi ip: kept" : "wifi ip: no trial running");
+            ipTrial.active = false;
+            return;
+        }
+        uint32_t trialS = 0;
+        size_t tryAt = rest.rfind(" try ");
+        if (tryAt != std::string::npos) {
+            trialS = strtoul(rest.c_str() + tryAt + 5, nullptr, 10);
+            rest = rest.substr(0, tryAt);
+        }
+#endif
+        std::string ssid, why;
+        net::FixedIp fixed;
+        bool dhcp = rest.size() > 5 && rest.compare(rest.size() - 5, 5, " dhcp") == 0;
+        if (dhcp) ssid = rest.substr(0, rest.size() - 5);
+        else {
+            size_t slash = rest.rfind('/'), space = slash == std::string::npos ? slash : rest.rfind(' ', slash);
+            if (space == std::string::npos) why = "usage: wifi ip <ssid> dhcp | <address>/<prefix> [gateway]";
+            else {
+                ssid = rest.substr(0, space);
+                why = net::parseFixed(rest.substr(space + 1), fixed);
+            }
+        }
+        const SavedNetwork* before = why.empty() ? savedNetworks->find(ssid) : nullptr;
+#ifdef RORO_DEBUG
+        if (before && trialS) ipTrial = {true, millis() + trialS * 1000, ssid, before->fixed, before->ip};
+#endif
+        if (why.empty()) why = savedNetworks->setIp(ssid, dhcp ? nullptr : &fixed);
+        if (!why.empty()) return (void)console.printf("wifi ip: %s\n", why.c_str());
+        console.printf("wifi ip: %s is now %s\n", ssid.c_str(), dhcp ? "Automatic (DHCP)" : net::formatFixed(fixed).c_str());
+        wifi->ipSettingChanged(ssid);
+    }
+    if ((line.startsWith("wifi dns ") && !line.startsWith("wifi dns always")) || line.startsWith("wifi ntp ")) {  // <a> [b]
+        bool dns = line.startsWith("wifi dns ");
+        std::string rest = line.substring(9).c_str();
+        size_t space = rest.find(' ');
+        std::string first = rest.substr(0, space), second = space == std::string::npos ? "" : rest.substr(space + 1);
+        Setting a = dns ? Setting::Dns1 : Setting::Ntp1, b = dns ? Setting::Dns2 : Setting::Ntp2;
+        std::string oldFirst = settings.getString(a);
+        // Both or neither: a refused second entry leaves the first as it was.
+        bool ok = settings.setString(a, first) && (settings.setString(b, second) || (settings.setString(a, oldFirst), false));
+        if (!ok) console.printf("wifi %s: %s\n", dns ? "dns" : "ntp", dns ? "an IPv4 address, then a second one if you like" : "a host name or an IPv4 address, then a second one if you like");
+        else {
+            console.printf("wifi %s: %s %s\n", dns ? "dns" : "ntp", first.c_str(), second.c_str());
+            wifi->serversChanged();
+        }
+    }
+    if (line == "wifi dns always on" || line == "wifi dns always off") {
+        settings.setBool(Setting::DnsAlways, line.endsWith("on"));
+        wifi->serversChanged();
+    }
     if (line == "sound off") settings.setBool(Setting::Sound, false);
     if (line == "sound on") settings.setBool(Setting::Sound, true);
     if (line == "short") {
@@ -540,6 +758,7 @@ static void loopSafeMode() {
     uint32_t now = millis();
     serialCommands();
     remoteCommands();
+    tasksStep();
     services.tick(now);
     bus.dispatch();
     noteStableOnce(now);
@@ -571,6 +790,10 @@ void loop() {
 
     serialCommands();
     remoteCommands();
+    tasksStep();
+#ifdef RORO_DEBUG
+    ipTrialStep();
+#endif
     noteStableOnce(now);
     uploadStep();
     printListingWhenReady();

src/platform/counted_client.h

@@ -0,0 +1,40 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+#include "traffic.h"
+
+namespace roro {
+
+// A NetworkClient (or NetworkClientSecure) that adds what it reads and writes to its service's
+// traffic counters (S1, Q121). Only the two buffer calls are overridden: the single-byte ones,
+// print() and printf() all go through them, so every byte is counted once.
+template <class Base>
+class Counted : public Base {
+   public:
+    explicit Counted(net::User user) : user_(user) {}
+    Counted(const Base& accepted, net::User user) : Base(accepted), user_(user) {}
+
+    // Overriding the buffer calls hides the single-byte ones; these put them back. They end up in
+    // the buffer calls below, where the counting happens.
+    int read() override { return Base::read(); }
+    size_t write(uint8_t byte) override { return Base::write(byte); }
+
+    size_t write(const uint8_t* buf, size_t size) override {
+        size_t n = Base::write(buf, size);
+        net::sent(user_, n);
+        return n;
+    }
+
+    int read(uint8_t* buf, size_t size) override {
+        int n = Base::read(buf, size);
+        if (n > 0) net::received(user_, static_cast<size_t>(n));
+        return n;
+    }
+
+   private:
+    net::User user_;
+};
+
+}  // namespace roro

src/platform/pins.h

@@ -14,4 +14,9 @@ constexpr int kSpiMosi = 14;
 constexpr int kSdCs = 12;
 constexpr int kLoraCs = 5;
 
+// The SX1262 on the Cap (as in Meshtastic's board file for the Cardputer ADV).
+constexpr int kLoraReset = 3;
+constexpr int kLoraIrq = 4;  // DIO1
+constexpr int kLoraBusy = 6;
+
 }  // namespace roro::pins

src/platform/system_info.cpp

@@ -7,6 +7,8 @@
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 
+#include <algorithm>
+#include <cstdio>
 #include <string>
 #include <vector>
 
@@ -89,20 +91,40 @@ void printSlots(Print& out, KeyValueStore& store) {
     }
 }
 
-void printTasks(Print& out) {
+uint32_t sampleTasks(std::vector<TaskSample>& out) {
     UBaseType_t n = uxTaskGetNumberOfTasks();
     std::vector<TaskStatus_t> tasks(n + 4);
     uint32_t total = 0;
     n = uxTaskGetSystemState(tasks.data(), tasks.size(), &total);
-    out.printf("%-16s %-4s %3s %6s %5s %s\n", "task", "st", "pri", "stack", "cpu%", "core");
-    static const char kStates[] = "RrBSD";  // running, ready, blocked, suspended, deleted
+    out.clear();
+    out.reserve(n);
     for (UBaseType_t i = 0; i < n; i++) {
         const TaskStatus_t& t = tasks[i];
-        unsigned cpu = total ? (unsigned)((uint64_t)t.ulRunTimeCounter * 100 / total) : 0;
-        int core = t.xCoreID == tskNO_AFFINITY ? -1 : (int)t.xCoreID;
-        out.printf("%-16s %-4c %3u %6u %5u %d\n", t.pcTaskName, t.eCurrentState < 5 ? kStates[t.eCurrentState] : '?',
-                   (unsigned)t.uxCurrentPriority, (unsigned)t.usStackHighWaterMark, cpu, core);
+        TaskSample s;
+        s.id = t.xTaskNumber;
+        std::snprintf(s.name, sizeof s.name, "%s", t.pcTaskName);
+        s.runtime = t.ulRunTimeCounter;
+        s.stackFree = static_cast<uint16_t>(std::min<uint32_t>(t.usStackHighWaterMark, 0xFFFF));
+        s.core = t.xCoreID == tskNO_AFFINITY ? -1 : static_cast<int8_t>(t.xCoreID);
+        s.state = static_cast<uint8_t>(t.eCurrentState);
+        s.priority = static_cast<uint8_t>(t.uxCurrentPriority);
+        out.push_back(s);
     }
+    return total;
+}
+
+// Shares over the interval since `before`, not since boot: the counters wrap every 71 minutes.
+void printTasks(Print& out, const std::vector<TaskSample>& before, uint32_t beforeTotal) {
+    std::vector<TaskSample> now;
+    uint32_t t1 = sampleTasks(now);
+    std::vector<TaskRow> rows = taskRows(before, beforeTotal, now, t1);
+    sortTasks(rows, TaskSort::Share);
+    out.printf("%-16s %-4s %3s %6s %6s %s\n", "task", "st", "pri", "stack", "cpu%", "core");
+    static const char kStates[] = "RrBSD";  // running, ready, blocked, suspended, deleted
+    for (const TaskRow& r : rows)
+        out.printf("%-16s %-4c %3u %6u %4u.%u %d%s\n", r.name.c_str(), r.state < 5 ? kStates[r.state] : '?', r.priority,
+                   r.stackFree, r.permille / 10, r.permille % 10, r.core, r.lowStack ? "  low stack" : "");
+    out.printf("load: core 0 %d %%, core 1 %d %%\n", coreLoad(rows, 0), coreLoad(rows, 1));
 }
 
 const char* bootOtherSlot() {

src/platform/system_info.h

@@ -3,7 +3,10 @@
 #include <Print.h>
 #include <esp_partition.h>
 
+#include <vector>
+
 #include "key_value_store.h"
+#include "task_stats.h"
 
 namespace roro::system_info {
 
@@ -20,7 +23,12 @@ void printSlots(Print& out, KeyValueStore& store);
 // Remembers which version the running slot holds (call at boot), or the slot an update just wrote.
 void recordSlotVersion(KeyValueStore& store, const esp_partition_t* slot, const char* version);
 // FreeRTOS tasks: state, priority, lowest free stack, CPU share since boot.
-void printTasks(Print& out);
+// The tasks' shares since `before` was sampled (with its run-time clock). The caller lets the main
+// loop run in between: sampling twice inside one command would show the loop asleep.
+void printTasks(Print& out, const std::vector<TaskSample>& before, uint32_t beforeTotal);
+// Every task as FreeRTOS reports it now; returns the run-time clock (microseconds, 32 bits), to
+// pair with the samples. Two of these make the shares the System App and `tasks` show.
+uint32_t sampleTasks(std::vector<TaskSample>& out);
 
 // Boots the firmware in the other app slot if it holds a valid image (a manual Rollback).
 // Returns an error message; on success it restarts and doesn't return.

src/services/debug_console.cpp

@@ -15,7 +15,10 @@
 #include <memory>
 
 #include "file_receiver.h"
+#include "sha256.h"
 #include "platform/console.h"
+#include "platform/counted_client.h"
+#include "sd_fault.h"
 #include "version.h"
 
 namespace roro {
@@ -108,7 +111,7 @@ void DebugConsole::listen() {
             listening = false;
         }
         if (listening) {
-            NetworkClient client = server.accept();
+            Counted<NetworkClient> client(server.accept(), net::User::DebugConsole);
             if (client) {
                 client.setNoDelay(true);
                 if (authenticate(client)) serve(client);
@@ -187,29 +190,7 @@ bool DebugConsole::binaryCommand(NetworkClient& client, const std::string& line)
     return true;
 }
 
-bool DebugConsole::onStorage(std::function<void()> job) {
-    // Shared with the job, which outlives this wait if the card is missing and it never starts.
-    // Exactly one side wins the state change: the job (Queued -> Running) or the wait giving up
-    // (Queued -> Abandoned), so an abandoned job can never touch this stack frame.
-    enum : int { Queued, Running, Abandoned };
-    struct Run {
-        std::atomic<int> state{Queued};
-        SemaphoreHandle_t done = xSemaphoreCreateBinary();
-        ~Run() { vSemaphoreDelete(done); }
-    };
-    auto run = std::make_shared<Run>();
-    storage_.runJob([run, job]() {
-        int expected = Queued;
-        if (!run->state.compare_exchange_strong(expected, Running)) return;
-        job();
-        xSemaphoreGive(run->done);
-    });
-    for (int waited = 0; xSemaphoreTake(run->done, pdMS_TO_TICKS(500)) != pdTRUE; waited += 500) {
-        int expected = Queued;
-        if (waited >= 5000 && run->state.compare_exchange_strong(expected, Abandoned)) return false;
-    }
-    return true;
-}
+bool DebugConsole::onStorage(std::function<void()> job) { return storage_.runAndWait(std::move(job)); }
 
 void DebugConsole::get(NetworkClient& client, const std::string& path) {
     bool ran = onStorage([&]() {
@@ -253,13 +234,31 @@ void DebugConsole::put(NetworkClient& client, const std::string& args) {
         while (r.state() == S::Receiving || r.state() == S::Writing) {
             if (r.state() == S::Writing) {
                 const auto& c = r.chunk();
+                uint32_t t0 = millis();
                 bool ok = f.write(c.data(), c.size()) == c.size();
+                uint32_t took = millis() - t0;
+                // Why, from our copy of the SD driver (lib/SD, #21): the step that gave up and what
+                // the card answered. How long it took tells a 500 ms busy timeout from a refusal.
+                if (!ok) {
+                    SdFault sd = sdLastFault();
+                    console.printf("put: write failed at %u after %u ms: SD step %u, answer 0x%02X, status 0x%04X (%u so far)\n",
+                                   (unsigned)r.received(), (unsigned)took, sd.step, sd.token, (unsigned)sd.resp, (unsigned)sd.count);
+                }
                 // A card can fail one write and take the next. FATFS keeps a failed file in error,
-                // so: close, cut back to the last good byte, reopen, try again.
+                // so: close, cut back to the last good byte, reopen, try again. Earlier chunks may
+                // have been lost with the write buffer (M3: 3 KB came back as zeros): never extend
+                // the file to cover them; give up instead, as the sender can't resend them.
                 for (int retry = 1; !ok && retry <= 3; retry++) {
                     console.printf("put: write failed at %u, retry %d\n", (unsigned)r.received(), retry);
                     f.close();
                     delay(50 * retry);
+                    f = SD.open(part.c_str(), FILE_READ);
+                    size_t onCard = f ? f.size() : 0;
+                    if (f) f.close();
+                    if (onCard < r.received()) {
+                        console.printf("put: the card lost %u B written before\n", (unsigned)(r.received() - onCard));
+                        break;
+                    }
                     truncate(("/sd" + part).c_str(), r.received());
                     f = SD.open(part.c_str(), FILE_APPEND);
                     ok = f && f.size() == r.received() && f.write(c.data(), c.size()) == c.size();
@@ -276,6 +275,15 @@ void DebugConsole::put(NetworkClient& client, const std::string& args) {
             }
         }
         f.close();
+        if (r.state() == S::Finishing) {  // read it back: the received checksum doesn't cover the card
+            Sha256 sha;
+            f = SD.open(part.c_str(), FILE_READ);
+            for (int n; f && (n = f.read(buf, sizeof buf)) > 0;) sha.update(buf, n);
+            if (f) f.close();
+            uint8_t digest[32];
+            sha.finish(digest);
+            r.cardChecked(digest);
+        }
         if (r.state() == S::Finishing) {
             if (SD.exists(r.path().c_str())) SD.remove(r.path().c_str());
             r.finished(SD.rename(part.c_str(), r.path().c_str()));

src/services/gemini_service.cpp

@@ -0,0 +1,804 @@
+#include "services/gemini_service.h"
+
+#include <NetworkClientSecure.h>
+#include <SD.h>
+#include <WiFi.h>
+#include <esp_heap_caps.h>
+
+#include <algorithm>
+#include <map>
+
+#include "gemini_url.h"
+#include "gemtext.h"
+#include "platform/console.h"
+#include "sha256.h"
+#include "platform/counted_client.h"
+#include "storage_paths.h"
+
+namespace roro {
+
+using gemini::TextBuffer;
+
+namespace {
+
+constexpr uint32_t kIdleTimeoutMs = 15000;
+constexpr const char* kSavedRoot = "/gemini/saved";
+constexpr const char* kSavedMark = "> Saved from ";  // first line of a Saved Page (Q82)
+constexpr const char* kDefaults =
+    "## Start here\n"
+    "=> gemini://geminiprotocol.net/ Project Gemini\n"
+    "=> gemini://kennedy.gemi.dev/ Kennedy: search Geminispace\n"
+    "=> gemini://skyjake.fi/~Cosmos/ Cosmos: what's new on Geminispace\n"
+    "=> gemini://bbs.geminispace.org/ Bubble: a bulletin board\n";
+
+std::string hex(const uint8_t* data, size_t len) {
+    static const char* digits = "0123456789abcdef";
+    std::string out;
+    for (size_t i = 0; i < len; i++) {
+        out += digits[data[i] >> 4];
+        out += digits[data[i] & 15];
+    }
+    return out;
+}
+
+// Folders for a file path, one at a time (SD.mkdir makes one level).
+void makeParents(const std::string& path) {
+    for (size_t slash = path.find('/', 1); slash != std::string::npos; slash = path.find('/', slash + 1)) {
+        std::string dir = path.substr(0, slash);
+        if (!SD.exists(dir.c_str())) SD.mkdir(dir.c_str());
+    }
+}
+
+// Copies `from` to `to`, optionally after a first line. On the storage task.
+bool copyFile(const char* from, const std::string& to, const std::string& firstLine) {
+    File in = SD.open(from);
+    if (!in) return false;
+    makeParents(to);
+    File out = SD.open(to.c_str(), FILE_WRITE);
+    if (!out) return false;
+    bool ok = firstLine.empty() || out.print((firstLine + "\n").c_str()) > 0;
+    uint8_t buf[512];
+    int n;
+    while (ok && (n = in.read(buf, sizeof buf)) > 0) ok = out.write(buf, n) == static_cast<size_t>(n);
+    out.close();
+    in.close();
+    if (!ok) SD.remove(to.c_str());
+    return ok;
+}
+
+struct SavedEntry {
+    std::string path;  // /gemini/saved/host/…/name.gmi
+    time_t when;
+};
+
+void listSaved(const std::string& dir, std::vector<SavedEntry>& out) {
+    File d = SD.open(dir.c_str());
+    if (!d || !d.isDirectory()) return;
+    for (File f = d.openNextFile(); f && out.size() < 200; f = d.openNextFile()) {
+        std::string path = dir + "/" + f.name();
+        if (f.isDirectory()) listSaved(path, out);
+        else out.push_back({path, f.getLastWrite()});
+    }
+}
+
+}  // namespace
+
+const char* GeminiService::slotPath(int slot) {
+    static const char* const kPaths[] = {"/gemini/cache/page0.gmi", "/gemini/cache/page1.gmi", "/gemini/cache/work.gmi"};
+    return kPaths[slot];
+}
+
+const char* GeminiService::cacheOf(const std::string& url) const {
+    for (int s = 0; s < 3; s++)
+        if (!url.empty() && slotUrl_[s] == url) return slotPath(s);
+    return nullptr;
+}
+
+GeminiService::GeminiService(KeyValueStore& store, StorageService& storage, ClockService& clock, EventBus& bus)
+    : store_(store), storage_(storage), clock_(clock), bus_(bus), lock_(xSemaphoreCreateMutex()) {}
+
+// NVS keys are 15 characters at most: "gm" and 12 hex digits of SHA-256("host:port").
+std::string GeminiService::pinKey(const std::string& host, int port) const {
+    std::string id = host + ":" + std::to_string(port);
+    uint8_t digest[32];
+    Sha256::hash(reinterpret_cast<const uint8_t*>(id.data()), id.size(), digest);
+    return "gm" + hex(digest, 6);
+}
+
+void GeminiService::trust(const std::string& host, int port, const std::string& fingerprint) {
+    store_.putString(pinKey(host, port).c_str(), fingerprint);
+}
+
+std::string GeminiService::now() const {
+    int64_t t = clock_.utcNow();
+    return t < 0 ? "an unknown date" : ClockModel::formatLocalDate(t) + " " + ClockModel::formatLocalTime(t);
+}
+
+void GeminiService::notify(const std::string& text) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(NotificationLevel::Info)));
+}
+
+bool GeminiService::start(Job job) {
+    if (busy_) return false;
+    busy_ = true;
+    ready_ = messageReady_ = cancel_ = false;
+    job_ = job;
+    if (xTaskCreate(taskEntry, "gemini", 6144, this, 1, nullptr) != pdPASS) {  // peak 3.6 KB (step 1)
+        busy_ = false;
+        return false;
+    }
+    return true;
+}
+
+bool GeminiService::fetch(const std::string& url, bool preferSaved) {
+    if (busy_) return false;
+    arg_ = url;
+    preferSaved_ = preferSaved;
+    return start(Job::Fetch);
+}
+
+bool GeminiService::fetchToConsole(const std::string& url) {
+    if (busy_) return false;
+    toConsole_ = true;
+    if (!fetch(url)) {
+        toConsole_ = false;
+        return false;
+    }
+    return true;
+}
+
+bool GeminiService::save(const std::string& url) {
+    if (busy_) return false;
+    arg_ = url;
+    return start(Job::Save);
+}
+
+bool GeminiService::saveWithLinks(const std::string& url, std::vector<std::string> links) {
+    if (busy_) return false;
+    arg_ = url;
+    links_ = std::move(links);
+    return start(Job::SaveWithLinks);
+}
+
+bool GeminiService::refresh(const std::string& savedPath) {
+    if (busy_) return false;
+    arg_ = savedPath;
+    return start(Job::Refresh);
+}
+
+bool GeminiService::deleteSaved(const std::string& savedPath) {
+    if (busy_) return false;
+    arg_ = savedPath;
+    return start(Job::Delete);
+}
+
+bool GeminiService::addBookmark(const std::string& url, const std::string& title) {
+    if (busy_) return false;
+    arg_ = url;
+    arg2_ = title;
+    return start(Job::Bookmark);
+}
+
+bool GeminiService::download(const std::string& url) {
+    if (busy_) return false;
+    arg_ = url;
+    return start(Job::Download);
+}
+
+bool GeminiService::loadWindow(const GeminiPage& page, size_t firstLine) {
+    if (busy_ || page.backing.empty()) return false;
+    windowPage_ = GeminiPage();
+    windowPage_.backing = page.backing;
+    windowPage_.totalLines = page.totalLines;
+    windowPage_.lineIndex = page.lineIndex;
+    windowLine_ = firstLine;
+    // The App drops its current window once the new one is in: count that memory as coming back.
+    windowReleasing_ = page.text.bytes() + page.text.lineCount() * kBytesPerLine;
+    return start(Job::Window);
+}
+
+bool GeminiService::takeResult(GeminiPage& out) {
+    if (!ready_) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    out = std::move(result_);
+    result_ = GeminiPage();
+    ready_ = false;
+    xSemaphoreGive(lock_);
+    return true;
+}
+
+bool GeminiService::takeMessage(std::string& out) {
+    if (!messageReady_) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    out = std::move(message_);
+    messageReady_ = false;
+    xSemaphoreGive(lock_);
+    return true;
+}
+
+void GeminiService::finishWithMessage(const std::string& text) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    message_ = text;
+    messageReady_ = true;
+    xSemaphoreGive(lock_);
+}
+
+void GeminiService::taskEntry(void* self) {
+    static_cast<GeminiService*>(self)->run();
+    vTaskDelete(nullptr);
+}
+
+void GeminiService::run() {
+    switch (job_) {
+        case Job::Fetch: {
+            GeminiPage page;
+            runFetch(page);
+            if (!toConsole_) {
+                xSemaphoreTake(lock_, portMAX_DELAY);
+                result_ = std::move(page);
+                ready_ = true;
+                xSemaphoreGive(lock_);
+            }
+            toConsole_ = false;
+            break;
+        }
+        case Job::Save: {
+            std::string why = saveCached(arg_);
+            finishWithMessage(!why.empty() ? why : replaced_ ? "Saved again (replaced the older copy)" : "Saved for offline reading");
+            break;
+        }
+        case Job::SaveWithLinks: {
+            std::string why = saveCached(arg_);
+            if (!why.empty()) {
+                finishWithMessage(why);
+                break;
+            }
+            int saved = 1, failed = 0, total = static_cast<int>(links_.size()) + 1;
+            notify("Saving " + std::to_string(total) + " pages for offline reading");
+            for (const std::string& link : links_) {
+                if (cancel_) break;
+                GeminiPage page;
+                fetchFollowing(link, page, false, kWorkSlot);
+                bool text = page.outcome == GeminiPage::Outcome::Ok &&
+                            page.header.category() == gemini::Category::Success && page.header.mimeType() == "text/gemini";
+                if (text && saveCached(link).empty()) saved++;
+                else failed++;
+                if ((saved + failed) % 5 == 0) notify("Saved " + std::to_string(saved) + " of " + std::to_string(total));
+            }
+            std::string done = "Saved " + std::to_string(saved) + " of " + std::to_string(total) + " pages" +
+                               (failed ? " (" + std::to_string(failed) + " not gemtext or failed)" : "");
+            notify(done);
+            finishWithMessage(done);
+            break;
+        }
+        case Job::Refresh: {
+            // Only the first line: where it came from. (Loading the whole page here, next to the
+            // App's copy and a TLS connection, once took the heap down to 436 bytes.)
+            std::string from = savedFrom(arg_);
+            if (from.empty()) {
+                finishWithMessage("Not a Saved Page");
+                break;
+            }
+            GeminiPage page;
+            fetchFollowing(from, page, false, kWorkSlot);
+            std::string why = page.outcome != GeminiPage::Outcome::Ok ? page.error
+                              : page.header.category() != gemini::Category::Success ? page.header.meta
+                                                                                     : saveCached(from);
+            finishWithMessage(why.empty() ? "Refreshed" : "Not refreshed: " + why);
+            break;
+        }
+        case Job::Window: {
+            // Q86 both ways: old and new together above the transient floor for a moment, and the
+            // new one alone (once the old is dropped) leaving the steady floor.
+            size_t free = esp_get_free_heap_size();
+            size_t transient = free > kTransientFloor + TextBuffer::kChunk ? free - kTransientFloor - TextBuffer::kChunk : 0;
+            size_t steady = free + windowReleasing_ > kSteadyFloor + TextBuffer::kChunk
+                                ? free + windowReleasing_ - kSteadyFloor - TextBuffer::kChunk
+                                : 0;
+            size_t budget = std::min(transient, steady);
+            GeminiPage page = std::move(windowPage_);
+            page.windowStart = windowLine_ - windowLine_ % kIndexEvery;
+            page.windowed = true;
+            page.windowOf = page.backing;
+            page.outcome = GeminiPage::Outcome::Ok;
+            readWindow(page, page.windowStart, std::min(budget, kMaxBody));
+            console.printf("gemini: window from line %u: %u lines\n", (unsigned)page.windowStart,
+                           (unsigned)page.text.lineCount());
+            xSemaphoreTake(lock_, portMAX_DELAY);
+            result_ = std::move(page);
+            ready_ = true;
+            xSemaphoreGive(lock_);
+            break;
+        }
+        case Job::Delete: {
+            bool removed = false;
+            bool ran = storage_.runAndWait([&]() { removed = SD.remove(arg_.c_str()); });
+            finishWithMessage(!ran ? "No SD card" : removed ? "Deleted" : "Not deleted");
+            break;
+        }
+        case Job::Bookmark: {
+            std::string line = "=> " + arg_ + (arg2_.empty() ? "" : " " + arg2_), already;
+            bool ran = storage_.runAndWait([&]() {
+                File f = SD.open(kBookmarks);
+                while (f && f.available()) {
+                    String l = f.readStringUntil('\n');
+                    if (l.startsWith(("=> " + arg_ + " ").c_str()) || l == ("=> " + arg_).c_str()) already = "yes";
+                }
+                if (f) f.close();
+                if (!already.empty()) return;
+                makeParents(kBookmarks);
+                File out = SD.open(kBookmarks, FILE_APPEND);
+                if (out) {
+                    out.print((line + "\n").c_str());
+                    out.close();
+                }
+            });
+            finishWithMessage(!ran ? "No SD card" : !already.empty() ? "Already bookmarked" : "Bookmarked");
+            break;
+        }
+        case Job::Download: {
+            gemini::Url u;
+            std::string name = gemini::parseUrl(arg_, u) ? u.path.substr(u.path.rfind('/') + 1) : "";
+            if (name.empty()) name = "download";
+            std::string to = "/gemini/downloads/" + storage::sanitize(name);
+            bool copied = false;
+            if (const char* from = cacheOf(arg_)) storage_.runAndWait([&]() { copied = copyFile(from, to, ""); });
+            finishWithMessage(copied ? "Saved to " + to : "Not saved (no card, or the page is gone)");
+            break;
+        }
+    }
+    busy_ = false;
+}
+
+void GeminiService::runFetch(GeminiPage& page) {
+    page.requested = arg_;
+    size_t before = esp_get_free_heap_size();
+    lowest_ = before;
+    uint32_t started = millis();
+    const std::string& url = arg_;
+    if (url == kStartUrl) composeStart(page);
+    else if (url.rfind("file://", 0) == 0) openSaved(url.substr(7), page);
+    else {
+        // Inside a Saved Page, a link to another Saved Page opens the saved copy (Q84).
+        bool savedCopy = false;
+        if (preferSaved_) {
+            std::string path = gemini::savedPath(url);
+            storage_.runAndWait([&]() { savedCopy = SD.exists(path.c_str()); });
+            if (savedCopy) openSaved(path, page);
+        }
+        if (!savedCopy) {
+            if (preferSaved_ && !WiFi.isConnected()) {
+                page.url = url;
+                page.error = "Not saved, and offline";
+            } else
+            {
+                int slot = nextDisplay_;
+                fetchFollowing(url, page, true, slot);
+                if (page.outcome == GeminiPage::Outcome::Ok && !page.cachePath.empty())
+                    nextDisplay_ = 1 - slot;  // keep this one: it backs the page on screen
+            }
+        }
+    }
+    page.ms = millis() - started;
+    if (toConsole_) report(page, before, lowest_);
+}
+
+// One request, following up to kMaxRedirects redirects.
+void GeminiService::fetchFollowing(const std::string& first, GeminiPage& page, bool loadIntoRam, int slot) {
+    std::string url = first;
+    size_t free = esp_get_free_heap_size();
+    if (free < kStartFloor) {  // Q86, for every fetch: pages, saves, refreshes
+        page.url = url;
+        page.outcome = GeminiPage::Outcome::Failed;
+        page.error = "Not enough memory (" + std::to_string(free / 1024) + " KB free): stop IRC or retry";
+        return;
+    }
+    for (int hop = 0;; hop++) {
+        fetchOne(url, page, loadIntoRam, slot);
+        if (page.outcome != GeminiPage::Outcome::Ok || page.header.category() != gemini::Category::Redirect) break;
+        std::string next = gemini::resolve(url, page.header.meta);
+        if (!gemini::isGemini(next)) {
+            page.outcome = GeminiPage::Outcome::Failed;
+            page.error = "Redirect to another protocol: " + next;
+            break;
+        }
+        if (hop + 1 > kMaxRedirects) {
+            page.outcome = GeminiPage::Outcome::Failed;
+            page.error = "Too many redirects";
+            break;
+        }
+        url = next;
+    }
+    page.url = url;
+}
+
+// A Saved Page's first line: "> Saved from <url> on <date>" (Q82). Empty if it isn't one.
+std::string GeminiService::savedFirstLine(const std::string& path) {
+    std::string first;
+    storage_.runAndWait([&]() {
+        File f = SD.open(path.c_str());
+        if (!f) return;
+        char buf[600];
+        size_t n = f.readBytesUntil('\n', buf, sizeof buf - 1);
+        buf[n] = 0;
+        first = buf;
+        f.close();
+    });
+    if (!first.empty() && first.back() == '\r') first.pop_back();
+    return first.rfind(kSavedMark, 0) == 0 ? first : "";
+}
+
+std::string GeminiService::savedFrom(const std::string& path) {
+    std::string first = savedFirstLine(path);
+    if (first.empty()) return "";
+    std::string rest = first.substr(strlen(kSavedMark));
+    return rest.substr(0, rest.find(" on "));
+}
+
+// A Saved Page from the card, as far as memory allows; its first line says where it came from.
+void GeminiService::openSaved(const std::string& path, GeminiPage& page) {
+    page.url = "file://" + path;
+    page.header.status = 20;
+    page.header.meta = "text/gemini";
+    bool found = false;
+    storage_.runAndWait([&]() { found = SD.exists(path.c_str()); });
+    std::string first = found ? savedFirstLine(path) : "";
+    if (!found) {
+        page.error = "This Saved Page is gone";
+        return;
+    }
+    if (first.rfind(kSavedMark, 0) == 0) {
+        std::string rest = first.substr(strlen(kSavedMark));
+        size_t on = rest.find(" on ");
+        page.savedFrom = rest.substr(0, on);
+        page.savedOn = on == std::string::npos ? "" : rest.substr(on + 4);
+    }
+    loadFromCard(page, esp_get_free_heap_size(), path);
+    page.outcome = GeminiPage::Outcome::Ok;
+}
+
+// about:start (Q78, Q84): bookmarks, then Saved Pages by capsule, newest first, then defaults.
+void GeminiService::composeStart(GeminiPage& page) {
+    std::string doc = "# Gemini\nTab picks a link, Enter follows it, Back returns, g types an address. "
+                      "On a page: b bookmarks it, s saves it to read offline, S with the pages it links to.\n";
+    std::string bookmarks;
+    std::vector<SavedEntry> saved;
+    bool card = storage_.runAndWait([&]() {
+        File f = SD.open(kBookmarks);
+        while (f && f.available() && bookmarks.size() < 8192) {
+            String l = f.readStringUntil('\n');
+            if (l.startsWith("=>")) bookmarks += std::string(l.c_str()) + "\n";
+        }
+        if (f) f.close();
+        listSaved(kSavedRoot, saved);
+    });
+    doc += "## Bookmarks\n";
+    doc += !card ? "No SD card: bookmarks and Saved Pages live on it.\n"
+           : bookmarks.empty() ? "None yet: b on a page adds it here.\n" : bookmarks;
+    if (!saved.empty()) {
+        // Capsules ordered by their newest Saved Page, pages newest first within each.
+        std::sort(saved.begin(), saved.end(), [](const SavedEntry& a, const SavedEntry& b) { return a.when > b.when; });
+        std::vector<std::string> order;
+        std::map<std::string, std::string> byHost;
+        size_t root = strlen(kSavedRoot) + 1;
+        for (auto& e : saved) {
+            std::string rel = e.path.substr(root);
+            std::string host = rel.substr(0, rel.find('/'));
+            if (!byHost.count(host)) order.push_back(host);
+            std::string label = rel.substr(host.size() + 1);
+            if (label.size() > 4 && label.compare(label.size() - 4, 4, ".gmi") == 0) label.resize(label.size() - 4);
+            char day[24] = "";
+            if (e.when > 1000000000) {
+                struct tm t;
+                localtime_r(&e.when, &t);
+                strftime(day, sizeof day, " (%d %b)", &t);
+            }
+            byHost[host] += "=> file://" + e.path + " " + label + day + "\n";
+        }
+        doc += "## Saved pages\n";
+        for (auto& host : order) doc += "### " + host + "\n" + byHost[host];
+    }
+    doc += kDefaults;
+    page.url = kStartUrl;
+    page.header.status = 20;
+    page.header.meta = "text/gemini";
+    page.text.append(doc.data(), doc.size());
+    page.text.finish();
+    page.outcome = GeminiPage::Outcome::Ok;
+}
+
+// The cached body of `url` (fetched again if the cache holds something else) to its Saved Page.
+std::string GeminiService::saveCached(const std::string& url) {
+    if (!gemini::isGemini(url)) return "Only Gemini pages can be saved";
+    if (!storage_.state().present) return "No SD card";
+    const char* from = cacheOf(url);
+    if (!from) {
+        GeminiPage page;
+        fetchFollowing(url, page, false, kWorkSlot);
+        if (page.outcome != GeminiPage::Outcome::Ok) return page.error;
+        if (page.header.category() != gemini::Category::Success) return page.header.meta;
+        from = cacheOf(page.url);
+        if (!from) return "Not saved";
+    }
+    std::string to = gemini::savedPath(url);
+    bool existed = false, ok = false;
+    replaced_ = false;
+    std::string header = std::string(kSavedMark) + url + " on " + now();
+    storage_.runAndWait([&]() {
+        existed = SD.exists(to.c_str());
+        ok = copyFile(from, to, header);
+    });
+    if (!ok) return "Writing to the SD card failed";
+    replaced_ = existed;  // Q82: saving again replaces it, and says so
+    return "";
+}
+
+void GeminiService::fetchOne(const std::string& url, GeminiPage& page, bool loadIntoRam, int slot) {
+    page.outcome = GeminiPage::Outcome::Failed;
+    page.text.clear();
+    page.truncated = false;
+    gemini::Url u;
+    if (!gemini::parseUrl(url, u) || u.scheme != "gemini") {
+        page.error = "Not a Gemini URL: " + url;
+        return;
+    }
+    auto track = [this]() { lowest_ = std::min<size_t>(lowest_, esp_get_free_heap_size()); };
+
+    size_t freeBefore = esp_get_free_heap_size();  // what's left once the connection closes again
+    Counted<NetworkClientSecure> tls(net::User::Gemini);
+    tls.setInsecure();  // trust on first use: the pinned fingerprint is what counts (Q71)
+    tls.setTimeout(15);
+    if (!tls.connect(u.host.c_str(), u.portOrDefault())) {
+        page.error = "Cannot connect to " + u.host;
+        return;
+    }
+    track();
+    uint8_t sha[32];
+    if (!tls.getFingerprintSHA256(sha)) {
+        page.error = "No certificate from " + u.host;
+        return;
+    }
+    std::string presented = hex(sha, sizeof sha), pinned;
+    std::string key = pinKey(u.host, u.portOrDefault());
+    if (!store_.getString(key.c_str(), pinned)) store_.putString(key.c_str(), presented);  // first use
+    else if (pinned != presented) {
+        page.outcome = GeminiPage::Outcome::CertificateChanged;
+        page.host = u.host;
+        page.port = u.portOrDefault();
+        page.pinned = pinned;
+        page.presented = presented;
+        page.error = "The certificate of " + u.host + " changed";
+        return;
+    }
+
+    tls.print((gemini::requestUrl(url) + "\r\n").c_str());
+    std::string header;
+    bool inBody = false;
+    uint32_t last = millis();
+    char buf[512];
+    while (!cancel_) {
+        int n = tls.available() ? tls.read(reinterpret_cast<uint8_t*>(buf), sizeof buf) : 0;
+        if (n <= 0) {
+            if (!tls.connected()) break;
+            if (millis() - last > kIdleTimeoutMs) {
+                page.error = "Timed out";
+                return;
+            }
+            delay(5);
+            continue;
+        }
+        last = millis();
+        int i = 0;
+        while (!inBody && i < n) {
+            char c = buf[i++];
+            if (c == '\n') inBody = true;
+            else if (c != '\r') header += c;
+            if (header.size() > 1100) {
+                page.error = "Malformed response header";
+                return;
+            }
+        }
+        if (!inBody) continue;
+        if (!gemini::parseHeader(header, page.header)) {
+            page.error = "Malformed response header";
+            return;
+        }
+        if (page.header.category() != gemini::Category::Success) break;  // no body to read
+        // With a card, the body goes there while the connection is open (only 4 KB in RAM),
+        // and comes back into RAM once the connection's memory is free again.
+        if (storage_.state().present) {
+            slotUrl_[slot].clear();
+            if (!receiveToCard(tls, buf + i, n - i, page, slot)) return;
+            tls.stop();
+            slotUrl_[slot] = url;
+            if (loadIntoRam) loadFromCard(page, freeBefore, slotPath(slot));
+            page.outcome = GeminiPage::Outcome::Ok;
+            return;
+        }
+        // Q86, two floors: once the connection closes, its ~50 KB comes back, so the page may use
+        // what was free before minus the steady floor; meanwhile the heap must stay above the
+        // transient floor. Both counted with the next 4 KB chunk and the line index.
+        size_t take = std::min<size_t>(n - i, kMaxBody - page.text.bytes());
+        size_t pageCost = page.text.bytes() + page.text.lineCount() * kBytesPerLine + TextBuffer::kChunk + take;
+        if (take < static_cast<size_t>(n - i)) page.truncatedWhy = "longer than 64 KB";
+        else if (freeBefore < kSteadyFloor + pageCost) page.truncatedWhy = "not enough memory to keep it";
+        else if (esp_get_free_heap_size() < kTransientFloor + TextBuffer::kChunk + take)
+            page.truncatedWhy = "not enough memory while receiving";
+        if (!page.truncatedWhy.empty()) {
+            page.truncated = true;
+            break;
+        }
+        page.text.append(buf + i, take);
+        track();
+    }
+    if (cancel_) {
+        page.error = "Cancelled";
+        return;
+    }
+    if (!inBody && !gemini::parseHeader(header, page.header)) {  // a header with no line end
+        page.error = header.empty() ? "Empty response" : "Malformed response header";
+        return;
+    }
+    page.text.finish();
+    page.outcome = GeminiPage::Outcome::Ok;
+}
+
+// Streams the rest of the body to a cache file in 1 KB pieces, each written by the storage task:
+// with IRC's TLS connection and this one both open, every KB of RAM counts (Q86).
+
+bool GeminiService::receiveToCard(NetworkClientSecure& tls, const char* first, size_t len, GeminiPage& page, int slot) {
+    struct Cache {
+        File file;
+    };
+    auto cache = std::make_shared<Cache>();
+    bool opened = storage_.runAndWait([cache, slot]() {
+        SD.mkdir("/gemini");
+        SD.mkdir("/gemini/cache");
+        cache->file = SD.open(slotPath(slot), FILE_WRITE);
+    });
+    if (!opened || !cache->file) {
+        page.error = "Can't write to the SD card";
+        return false;
+    }
+    std::string pending(first, len);
+    constexpr size_t kPiece = 1024;
+    pending.reserve(kPiece + 512);
+    bool ok = true;
+    auto flush = [&]() {
+        if (pending.empty() || !ok) return;
+        ok = storage_.runAndWait([cache, &pending, &ok]() {
+            ok = cache->file.write(reinterpret_cast<const uint8_t*>(pending.data()), pending.size()) == pending.size();
+        }) && ok;
+        page.receivedBytes += pending.size();
+        pending.clear();
+    };
+    uint32_t last = millis();
+    char buf[512];
+    while (!cancel_ && ok) {
+        if (pending.size() >= kPiece) flush();
+        if (page.receivedBytes + pending.size() >= kMaxOnCard) {
+            page.truncated = true;
+            page.truncatedWhy = "longer than 1 MB";
+            break;
+        }
+        int n = tls.available() ? tls.read(reinterpret_cast<uint8_t*>(buf), sizeof buf) : 0;
+        if (n <= 0) {
+            if (!tls.connected()) break;
+            if (millis() - last > kIdleTimeoutMs) break;  // keep what came
+            delay(5);
+            continue;
+        }
+        last = millis();
+        pending.append(buf, n);
+        lowest_ = std::min<size_t>(lowest_, esp_get_free_heap_size());
+    }
+    flush();
+    storage_.runAndWait([cache]() { cache->file.close(); });
+    if (cancel_) page.error = "Cancelled";
+    else if (!ok) page.error = "Writing to the SD card failed";
+    else page.cachePath = slotPath(slot);
+    return !cancel_ && ok;
+}
+
+// Back into RAM, now that the connection's memory is free again: one pass over the file counts
+// its lines and indexes every kIndexEvery-th, and loads lines while the steady floor allows (Q86).
+// If they don't all fit, the page is windowed: the App asks for other windows as you scroll.
+void GeminiService::loadFromCard(GeminiPage& page, size_t freeBefore, const std::string& path) {
+    size_t budget = freeBefore > kSteadyFloor + TextBuffer::kChunk ? freeBefore - kSteadyFloor - TextBuffer::kChunk : 0;
+    budget = std::min(budget, kMaxBody);
+    page.backing = path;
+    page.lineIndex.clear();
+    page.totalLines = 0;
+    page.windowStart = 0;
+    bool loading = true;
+    storage_.runAndWait([&]() {
+        File f = SD.open(path.c_str());
+        if (!f) return;
+        std::string line;
+        uint32_t offset = 0, lineStart = 0;
+        bool pre = false;
+        auto endLine = [&]() {
+            if (page.totalLines % kIndexEvery == 0) page.lineIndex.push_back(lineStart | (pre ? 0x80000000u : 0));
+            if (line.compare(0, 3, "```") == 0) pre = !pre;
+            if (loading) {
+                if (page.text.bytes() + page.text.lineCount() * kBytesPerLine + line.size() + 1 > budget) loading = false;
+                else {
+                    line += '\n';
+                    page.text.append(line.data(), line.size());
+                }
+            }
+            page.totalLines++;
+            line.clear();
+        };
+        char buf[512];
+        int n;
+        while ((n = f.read(reinterpret_cast<uint8_t*>(buf), sizeof buf)) > 0) {
+            for (int i = 0; i < n; i++, offset++) {
+                if (buf[i] == '\n') {
+                    endLine();
+                    lineStart = offset + 1;
+                } else if (line.size() < kMaxLineBytes) line += buf[i];
+            }
+        }
+        if (!line.empty()) endLine();
+        f.close();
+    });
+    page.text.finish();
+    page.windowed = !loading;
+    if (page.windowed)
+        console.printf("gemini: %s is windowed: %u of %u lines in memory\n", path.c_str(),
+                       (unsigned)page.text.lineCount(), (unsigned)page.totalLines);
+}
+
+// Lines from `firstLine` on, from the page's file, as many as `budget` allows.
+void GeminiService::readWindow(GeminiPage& page, size_t firstLine, size_t budget) {
+    size_t entry = firstLine / kIndexEvery;
+    if (entry >= page.lineIndex.size()) return;
+    storage_.runAndWait([&]() {
+        File f = SD.open(page.backing.c_str());
+        if (!f || !f.seek(page.lineIndex[entry] & 0x7FFFFFFFu)) return;
+        size_t lineNo = entry * kIndexEvery;
+        std::string line;
+        char buf[512];
+        int n;
+        bool done = false;
+        while (!done && (n = f.read(reinterpret_cast<uint8_t*>(buf), sizeof buf)) > 0) {
+            for (int i = 0; i < n && !done; i++) {
+                if (buf[i] != '\n') {
+                    if (line.size() < kMaxLineBytes) line += buf[i];
+                    continue;
+                }
+                if (lineNo >= firstLine) {
+                    if (page.text.bytes() + page.text.lineCount() * kBytesPerLine + line.size() + 1 > budget) done = true;
+                    else {
+                        line += '\n';
+                        page.text.append(line.data(), line.size());
+                    }
+                }
+                lineNo++;
+                line.clear();
+            }
+        }
+        if (!done && !line.empty() && lineNo >= firstLine) page.text.append(line.data(), line.size());
+        f.close();
+    });
+    page.text.finish();
+}
+
+void GeminiService::report(const GeminiPage& page, size_t heapBefore, size_t heapLowest) {
+    console.printf("gemini: %s -> %s, %lu ms\n", page.requested.c_str(), page.url.c_str(), (unsigned long)page.ms);
+    if (page.outcome != GeminiPage::Outcome::Ok) console.printf("gemini: %s\n", page.error.c_str());
+    else console.printf("gemini: %d %s, %u bytes, %u lines%s\n", page.header.status, page.header.meta.c_str(),
+                        (unsigned)page.text.bytes(), (unsigned)page.text.lineCount(),
+                        page.truncated ? (" (truncated: " + page.truncatedWhy + ")").c_str() : "");
+    if (page.outcome == GeminiPage::Outcome::CertificateChanged)
+        console.printf("gemini: pinned %s\ngemini: now    %s\n", page.pinned.c_str(), page.presented.c_str());
+    for (size_t i = 0; i < page.text.lineCount() && i < 6; i++) console.printf("  %s\n", page.text.line(i).substr(0, 100).c_str());
+    if (!page.cachePath.empty())
+        console.printf("gemini: %u bytes on the card in %s\n", (unsigned)page.receivedBytes, page.cachePath.c_str());
+    console.printf("gemini: heap %u before, %u lowest seen, %u after\n", (unsigned)heapBefore, (unsigned)heapLowest,
+                   (unsigned)esp_get_free_heap_size());
+}
+
+
+}  // namespace roro

src/services/gemini_service.h

@@ -0,0 +1,147 @@
+#pragma once
+
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+
+#include <string>
+#include <vector>
+
+#include "event_bus.h"
+#include "gemini_response.h"
+#include "key_value_store.h"
+#include "services/clock_service.h"
+#include "services/storage_service.h"
+#include "text_buffer.h"
+
+class NetworkClientSecure;
+
+namespace roro {
+
+// What a fetch came back with.
+struct GeminiPage {
+    enum class Outcome { Ok, Failed, CertificateChanged };
+    Outcome outcome = Outcome::Failed;
+    std::string requested;    // what was asked for
+    std::string url;          // where it ended up, after redirects (file://… for a Saved Page)
+    gemini::Header header;    // the final response's header
+    gemini::TextBuffer text;  // 2x only: the body as lines, up to kMaxBody
+    bool truncated = false;   // the body was cut: see truncatedWhy
+    std::string truncatedWhy;
+    std::string error;        // Failed: why, for a human
+    std::string host;         // CertificateChanged: whose, and both fingerprints
+    int port = 1965;
+    std::string pinned, presented;
+    std::string cachePath;    // with a card: the whole body as received (Saved Pages copy it)
+    size_t receivedBytes = 0; // the whole body, which may be more than `text` holds
+    std::string savedFrom;    // a Saved Page: the URL it was saved from (links resolve against it)
+    std::string savedOn;      // and when, "2026-10-05 01:20"
+    uint32_t ms = 0;
+    // A page bigger than memory allows is read from its file as you scroll: `text` then holds
+    // lines [windowStart, windowStart + text.lineCount()) of totalLines. lineIndex has where every
+    // 64th line starts in the file (bit 31: inside a preformatted block there).
+    std::string backing;      // the file the page is in (a cache file or a Saved Page)
+    bool windowed = false;
+    size_t totalLines = 0, windowStart = 0;
+    std::vector<uint32_t> lineIndex;
+    std::string windowOf;     // a window result: the backing file it belongs to
+
+    // What relative links resolve against.
+    const std::string& base() const { return savedFrom.empty() ? url : savedFrom; }
+};
+
+// Gemini (docs/milestones/G1.md). Everything that touches the network or the SD card runs as one
+// job at a time on a short-lived task of its own: a TLS handshake or a missing card can block for
+// seconds, which the main loop's watchdog wouldn't allow, and an idle client should cost no stack.
+// Certificates are trusted on first use, per host and port (Q71).
+class GeminiService {
+   public:
+    static constexpr size_t kMaxBody = 64 * 1024;        // Q74
+    static constexpr size_t kStartFloor = 55 * 1024;     // Q86: no fetch below this
+    static constexpr size_t kSteadyFloor = 40 * 1024;    // Q86: what must be left once the page is in
+    static constexpr size_t kTransientFloor = 20 * 1024; // Q86: while the TLS connection is open
+    static constexpr int kMaxRedirects = 5;              // Q72
+    static constexpr size_t kMaxOnCard = 1024 * 1024;    // a text page larger than this is cut
+    static constexpr int kMaxLinkedPages = 30;           // Q83
+    static constexpr size_t kIndexEvery = 64;            // lines between lineIndex entries
+    static constexpr size_t kMaxLineBytes = 8192;        // longer lines are cut
+    // What a page costs per line on top of its text: TextBuffer's index (8) and the App's tables
+    // (type, first row, links: about 8). Counting only the first left the steady floor 1.5 to 3 KB
+    // short on a windowed page (found in M3).
+    static constexpr size_t kBytesPerLine = 16;
+    static constexpr const char* kBookmarks = "/gemini/bookmarks.gmi";
+    static constexpr const char* kStartUrl = "about:start";
+
+    GeminiService(KeyValueStore& store, StorageService& storage, ClockService& clock, EventBus& bus);
+
+    // Pages: gemini://…, about:start (bookmarks, Saved Pages, defaults) or file:///gemini/saved/….
+    // `preferSaved`: open the Saved Page of that URL if there is one (inside a Saved Page, Q84).
+    bool fetch(const std::string& url, bool preferSaved = false);
+    // Actions; each reports one line through takeMessage().
+    bool save(const std::string& url);                                  // s (Q82)
+    bool saveWithLinks(const std::string& url, std::vector<std::string> links);  // S (Q83)
+    bool refresh(const std::string& savedPath);                         // r on a Saved Page
+    bool deleteSaved(const std::string& savedPath);                     // d on a Saved Page (Q85)
+    bool addBookmark(const std::string& url, const std::string& title); // b (Q77)
+    bool download(const std::string& url);                              // s on a non-text page (Q73)
+    // The window of a big page starting at `firstLine` (a multiple of kIndexEvery), from its file.
+    bool loadWindow(const GeminiPage& page, size_t firstLine);
+
+    bool busy() const { return busy_; }
+    bool takeResult(GeminiPage& out);
+    bool takeMessage(std::string& out);
+    void cancel() { cancel_ = true; }
+    // After the user accepts a changed certificate.
+    void trust(const std::string& host, int port, const std::string& fingerprint);
+
+    // `gemini get <url>`: the same fetch, reported on the console instead of to the App.
+    bool fetchToConsole(const std::string& url);
+
+   private:
+    enum class Job { Fetch, Save, SaveWithLinks, Refresh, Delete, Bookmark, Download, Window };
+    // Cache files: two take turns for pages on screen (the one shown is never overwritten by the
+    // next), one for jobs (saving linked pages, refreshing).
+    static constexpr int kWorkSlot = 2;
+    static const char* slotPath(int slot);
+
+    bool start(Job job);
+    static void taskEntry(void* self);
+    void run();
+    void runFetch(GeminiPage& page);
+    void fetchFollowing(const std::string& url, GeminiPage& page, bool loadIntoRam, int slot);
+    void fetchOne(const std::string& url, GeminiPage& page, bool loadIntoRam, int slot);
+    bool receiveToCard(::NetworkClientSecure& tls, const char* first, size_t len, GeminiPage& page, int slot);
+    void loadFromCard(GeminiPage& page, size_t freeBefore, const std::string& path);
+    void readWindow(GeminiPage& page, size_t firstLine, size_t budget);
+    void openSaved(const std::string& path, GeminiPage& page);
+    std::string savedFirstLine(const std::string& path);
+    std::string savedFrom(const std::string& path);
+    void composeStart(GeminiPage& page);
+    std::string saveCached(const std::string& url);  // "" or what went wrong
+    const char* cacheOf(const std::string& url) const;  // the cache file holding url's body, or nullptr
+    void finishWithMessage(const std::string& text);
+    void notify(const std::string& text);
+    void report(const GeminiPage& page, size_t heapBefore, size_t heapLowest);
+    std::string pinKey(const std::string& host, int port) const;
+    std::string now() const;
+
+    KeyValueStore& store_;
+    StorageService& storage_;
+    ClockService& clock_;
+    EventBus& bus_;
+    SemaphoreHandle_t lock_;
+    Job job_ = Job::Fetch;
+    std::string arg_, arg2_;
+    std::vector<std::string> links_;
+    bool preferSaved_ = false;
+    GeminiPage result_;
+    std::string message_;
+    std::string slotUrl_[3];  // the URL whose body each cache file holds
+    int nextDisplay_ = 0;
+    size_t windowLine_ = 0, windowReleasing_ = 0;
+    GeminiPage windowPage_;
+    bool replaced_ = false;  // the last save replaced an older copy
+    volatile bool busy_ = false, ready_ = false, messageReady_ = false, cancel_ = false, toConsole_ = false;
+    size_t lowest_ = 0;
+};
+
+}  // namespace roro

src/services/irc_service.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <NetworkClientSecure.h>
+#include "platform/counted_client.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>
 
@@ -75,8 +76,8 @@ class IrcService : public Service {
     std::unique_ptr<IrcSession> session_;
     SemaphoreHandle_t lock_ = nullptr;
     TaskHandle_t task_ = nullptr;
-    NetworkClientSecure tlsClient_;
-    NetworkClient plainClient_;
+    Counted<NetworkClientSecure> tlsClient_{net::User::Irc};  // counted for the System App (S1, Q121)
+    Counted<NetworkClient> plainClient_{net::User::Irc};
     NetworkClient* conn_ = &tlsClient_;  // whichever the config asks for
     ReconnectPolicy backoff_;
     std::string partial_;

src/services/lora_capture_service.cpp

@@ -0,0 +1,62 @@
+#include "services/lora_capture_service.h"
+
+#include <vector>
+
+#include "loratap.h"
+#include "platform/console.h"
+
+namespace roro {
+
+std::string LoraCaptureService::start(uint32_t nowMs) {
+    if (capturing()) return "";
+    if (!radio_.present()) return "No LoRa radio";
+    StorageState card = storage_.state();
+    if (!card.present) return "No SD card";
+    if (!card.capturesAllowed) return "The SD card is full";
+    int64_t now = clock_.utcNow();
+    if (now < 0) return "Waiting for the time (GNSS or Wi-Fi)";
+    path_ = lora::capturePath(now);
+    std::vector<uint8_t> header;
+    lora::appendPcapHeader(header);
+    storage_.appendBytes(path_, std::string(header.begin(), header.end()), true);
+    startUtc_ = now;
+    startMs_ = nowMs;
+    written_ = radio_.received();  // from now on
+    packets_ = 0;
+    radio_.listen(RadioService::Capture, true);
+    console.printf("lora: Capture %s started\n", path_.c_str());
+    notify("LoRa Capture started");
+    return "";
+}
+
+void LoraCaptureService::stop() {
+    if (!capturing()) return;
+    radio_.listen(RadioService::Capture, false);
+    console.printf("lora: Capture %s stopped, %lu packets\n", path_.c_str(), (unsigned long)packets_);
+    notify("LoRa Capture stopped: " + std::to_string(packets_) + " packets");
+    path_.clear();
+}
+
+void LoraCaptureService::tick(uint32_t nowMs) {
+    (void)nowMs;
+    if (!capturing()) return;
+    uint32_t newest = radio_.received();
+    for (uint32_t seq = written_ + 1; seq <= newest; ++seq) {
+        RadioPacket p;
+        if (!radio_.packet(seq, p)) continue;  // already left the ring: too many at once
+        uint32_t sinceStart = p.ms - startMs_;
+        std::vector<uint8_t> record;
+        record.reserve(lora::kRecordOverhead + p.len);
+        lora::appendRecord(record, static_cast<uint32_t>(startUtc_ + sinceStart / 1000), (sinceStart % 1000) * 1000,
+                           p.rx, p.data, p.len);
+        storage_.appendBytes(path_, std::string(record.begin(), record.end()), true);
+        ++packets_;
+    }
+    written_ = newest;
+}
+
+void LoraCaptureService::notify(const std::string& text) {
+    bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(NotificationLevel::Info)));
+}
+
+}  // namespace roro

src/services/lora_capture_service.h

@@ -0,0 +1,44 @@
+#pragma once
+
+#include <string>
+
+#include "event_bus.h"
+#include "service.h"
+#include "services/clock_service.h"
+#include "services/radio_service.h"
+#include "services/storage_service.h"
+
+namespace roro {
+
+// A LoRa Sniffer Capture (CONTEXT.md: Capture; M3, Q97): every packet the radio receives, as pcap
+// with LoRaTap headers, in /captures/lora/. Started and stopped by hand; keeps the radio listening
+// and keeps recording whatever App is open (Q100).
+class LoraCaptureService : public Service {
+   public:
+    LoraCaptureService(RadioService& radio, StorageService& storage, ClockService& clock, EventBus& bus)
+        : radio_(radio), storage_(storage), clock_(clock), bus_(bus) {}
+    const char* name() const override { return "lora-capture"; }
+    uint32_t tickIntervalMs() const override { return 200; }
+    void tick(uint32_t nowMs) override;
+
+    std::string start(uint32_t nowMs);  // why it can't, or ""
+    void stop();
+    bool capturing() const { return !path_.empty(); }
+    const std::string& path() const { return path_; }
+    uint32_t packets() const { return packets_; }
+
+   private:
+    void notify(const std::string& text);
+
+    RadioService& radio_;
+    StorageService& storage_;
+    ClockService& clock_;
+    EventBus& bus_;
+    std::string path_;
+    uint32_t written_ = 0;  // the radio's seq last written
+    uint32_t packets_ = 0;
+    int64_t startUtc_ = 0;  // the Clock and millis() when it started: packet times follow from both
+    uint32_t startMs_ = 0;
+};
+
+}  // namespace roro

src/services/radio_service.cpp

@@ -0,0 +1,476 @@
+#include "services/radio_service.h"
+
+#include <M5Cardputer.h>
+#include <RadioLib.h>
+
+#include <algorithm>
+#include <new>
+
+#include "meshtastic_header.h"
+#include "sweep_view.h"
+#include "platform/console.h"
+#include "platform/pins.h"
+#include "platform/shared_spi.h"
+
+namespace roro {
+
+namespace {
+
+// The Cap's PI4IOE5V6408: its P0 connects the antenna; at power-on it's an input and the receiver
+// is deaf (M3 step 1, measured). Only touched from the main loop, which owns the I2C bus.
+constexpr uint8_t kExpander = 0x43;
+constexpr uint32_t kI2cFreq = 400000;
+enum ExpanderReg : uint8_t { kId = 0x01, kDirection = 0x03, kOutput = 0x05, kHighZ = 0x07, kInput = 0x0F };
+
+bool antennaOn() {
+    auto& i2c = M5.In_I2C;
+    if (!i2c.scanID(kExpander, kI2cFreq)) return false;
+    i2c.writeRegister8(kExpander, kOutput, i2c.readRegister8(kExpander, kOutput, kI2cFreq) | 1, kI2cFreq);
+    i2c.writeRegister8(kExpander, kHighZ, i2c.readRegister8(kExpander, kHighZ, kI2cFreq) & ~1, kI2cFreq);
+    i2c.writeRegister8(kExpander, kDirection, i2c.readRegister8(kExpander, kDirection, kI2cFreq) | 1, kI2cFreq);
+    return true;
+}
+
+// Below this the receiver hears only itself: the antenna path is open (step 1: -111.9 dBm).
+constexpr float kDeafBelow = -108.0f;
+
+}  // namespace
+
+RadioService* RadioService::instance_ = nullptr;
+
+RadioService::RadioService() : lock_(xSemaphoreCreateMutex()) {
+    const meshtastic::Preset& p = meshtastic::kEu868Presets[0];  // LongFast (Q95)
+    config_ = {meshtastic::eu868FrequencyHz(p), p.bwKHz, p.sf, p.cr, meshtastic::kSyncWord, meshtastic::kPreambleLength,
+               p.name};
+}
+
+void RadioService::start() {
+    instance_ = this;
+    expander_ = antennaOn();
+    // SPI transactions take the bus lock the SD card uses; the HAL doesn't re-begin the bus.
+    hal_.reset(new ArduinoHal(sharedSpi(), SPISettings(8000000, MSBFIRST, SPI_MODE0)));
+    module_.reset(new Module(hal_.get(), pins::kLoraCs, pins::kLoraIrq, pins::kLoraReset, pins::kLoraBusy));
+    radio_.reset(new SX1262(module_.get()));
+    // Above the main loop and the other Services' tasks, so a packet is read before the next.
+    xTaskCreatePinnedToCore(taskEntry, "radio", 4096, this, 2, &task_, 1);  // peak 2.0 KB (M3 step 3)
+}
+
+void RadioService::taskEntry(void* self) { static_cast<RadioService*>(self)->run(); }
+
+void IRAM_ATTR RadioService::onDio1() {
+    BaseType_t woken = pdFALSE;
+    if (instance_ && instance_->task_) xTaskNotifyFromISR(instance_->task_, kIrq, eSetBits, &woken);
+    portYIELD_FROM_ISR(woken);
+}
+
+void RadioService::wake(Notify why) {
+    if (task_) xTaskNotify(task_, why, eSetBits);
+}
+
+bool RadioService::beginRadio(Print* report) {
+    Config c = config();
+    float mhz = c.frequencyHz / 1e6f;
+    int16_t state = radio_->begin(mhz, c.bandwidthKHz, c.spreadingFactor, c.codingRate, c.syncWord, 0, c.preamble,
+                                  tcxo_, false);
+    if (state != RADIOLIB_ERR_NONE && tcxo_ > 0) {  // Meshtastic's TCXO_OPTIONAL: fall back to the crystal
+        if (report) report->printf("lora probe: begin with TCXO %.1f V: error %d, trying the crystal\n", tcxo_, state);
+        tcxo_ = 0;
+        state = radio_->begin(mhz, c.bandwidthKHz, c.spreadingFactor, c.codingRate, c.syncWord, 0, c.preamble, tcxo_,
+                              false);
+    }
+    if (state != RADIOLIB_ERR_NONE) {
+        if (report) report->printf("lora probe: error %d, no SX1262 found\n", state);
+        return false;
+    }
+    radio_->setDio2AsRfSwitch(true);       // DIO2 selects TX or RX in the switch, as in Meshtastic
+    radio_->setRxBoostedGainMode(true);    // about 2 dB more sensitivity for about 2 mA
+    return true;
+}
+
+void RadioService::run() {
+    present_ = beginRadio(nullptr);
+    if (present_) radio_->sleep();
+    console.printf("radio: %s\n", present_ ? (tcxo_ > 0 ? "SX1262 ready (TCXO), asleep" : "SX1262 ready (crystal), asleep")
+                                           : "no radio found");
+    for (;;) {
+        uint32_t bits = 0;
+        xTaskNotifyWait(0, UINT32_MAX, &bits,
+                        sweepWanted_ ? pdMS_TO_TICKS(20) : listening_ ? pdMS_TO_TICKS(kNoiseEveryMs) : portMAX_DELAY);
+        if (probeWanted_.exchange(false)) runProbe();
+        if (!present_) continue;
+        if (sweepWanted_) {  // a Sweep has the radio: the Sniffer waits, its packets kept (Q99)
+            sweepPass();
+            continue;
+        }
+        if (sweeping_) endSweep();
+        bool want = clients_ != 0;
+        if (want && !listening_) startListening();
+        else if (!want && listening_) stopListening();
+        if (listening_ && configChanged_.exchange(false)) startListening();  // again, with the new settings
+        if (listening_ && (bits & kIrq)) readPacket();
+        if (listening_ && millis() - lastNoiseMs_ >= kNoiseEveryMs) sampleNoise();
+    }
+}
+
+void RadioService::startListening() {
+    if (!ring_) {
+        ring_.reset(new (std::nothrow) RadioPacket[kRing]);
+        ringFirst_ = seq_ + 1;
+        if (!ring_) {
+            console.println("radio: not enough memory to listen");
+            clients_ = 0;
+            return;
+        }
+    }
+    // A full begin (with a reset) each time: the chip comes back from sleep with nothing assumed.
+    if (!beginRadio(nullptr)) {
+        ++radioErrors_;
+        return;
+    }
+    radio_->setPacketReceivedAction(onDio1);
+    int16_t state = receive();
+    if (state != RADIOLIB_ERR_NONE) {
+        ++radioErrors_;
+        console.printf("radio: can't receive (error %d)\n", state);
+        return;
+    }
+    if (!listening_) console.printf("radio: listening, %s\n", config().name);
+    listening_ = true;
+    lastNoiseMs_ = 0;
+}
+
+void RadioService::stopListening() {
+    radio_->clearPacketReceivedAction();
+    radio_->sleep();
+    listening_ = false;
+    noise_ = 0;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    ring_.reset();  // listening again starts a fresh list; idle costs nothing (Q100, Q103)
+    xSemaphoreGive(lock_);
+    console.println("radio: asleep");
+}
+
+void RadioService::readPacket() {
+    RadioPacket p;
+    size_t len = std::min<size_t>(radio_->getPacketLength(), sizeof p.data);
+    int16_t state = radio_->readData(p.data, len);
+    if (state == RADIOLIB_ERR_CRC_MISMATCH) {
+        p.crcOk = false;
+        ++crcErrors_;
+    } else if (state != RADIOLIB_ERR_NONE) {  // a header error or a timeout: nothing to keep
+        ++radioErrors_;
+        if (receive() != RADIOLIB_ERR_NONE) ++radioErrors_;
+        ++restarts_;
+        return;
+    }
+    Config c = config();
+    p.ms = millis();
+    p.len = static_cast<uint8_t>(len);
+    p.rx.frequencyHz = c.frequencyHz;
+    p.rx.bandwidthKHz = c.bandwidthKHz;
+    p.rx.spreadingFactor = c.spreadingFactor;
+    p.rx.syncWord = c.syncWord;
+    p.rx.rssi = radio_->getRSSI();
+    p.rx.snr = radio_->getSNR();
+    p.rx.noiseFloor = noise_;
+    p.frequencyError = radio_->getFrequencyError();
+    if (receive() != RADIOLIB_ERR_NONE) ++radioErrors_;
+    ++restarts_;
+
+    store(p);
+}
+
+void RadioService::store(RadioPacket& p) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    p.seq = seq_ + 1;
+    if (ring_) ring_[p.seq % kRing] = p;
+    seq_ = p.seq;
+    xSemaphoreGive(lock_);
+    ++packets_;
+    lastPacketMs_ = p.ms;
+}
+
+#ifdef RORO_DEBUG
+void RadioService::inject(const uint8_t* data, size_t len, float rssi, float snr) {
+    if (!listening_) return (void)console.println("lora inject: not listening");
+    RadioPacket p;
+    Config c = config();
+    p.ms = millis();
+    p.len = static_cast<uint8_t>(std::min(len, sizeof p.data));
+    std::copy(data, data + p.len, p.data);
+    p.rx = {c.frequencyHz, c.bandwidthKHz, c.spreadingFactor, rssi, snr, noise_, c.syncWord};
+    store(p);
+    console.printf("lora inject: #%lu, %u B\n", (unsigned long)p.seq, p.len);
+}
+#endif
+
+// Continuous receive. Only RX done raises DIO1; preambles and headers are only recorded in the
+// IRQ status, which sampleNoise() reads.
+int16_t RadioService::receive() {
+    return radio_->startReceive(RADIOLIB_SX126X_RX_TIMEOUT_INF,
+                                RADIOLIB_IRQ_RX_DEFAULT_FLAGS | (1UL << RADIOLIB_IRQ_PREAMBLE_DETECTED),
+                                RADIOLIB_IRQ_RX_DEFAULT_MASK, 0);
+}
+
+void RadioService::sampleNoise() {
+    lastNoiseMs_ = millis();
+    noise_ = radio_->getRSSI(false);
+    constexpr uint16_t kSeen =
+        RADIOLIB_SX126X_IRQ_PREAMBLE_DETECTED | RADIOLIB_SX126X_IRQ_HEADER_VALID | RADIOLIB_SX126X_IRQ_HEADER_ERR;
+    uint32_t flags = radio_->getIrqFlags();
+    if (flags & RADIOLIB_SX126X_IRQ_PREAMBLE_DETECTED) ++preambles_;
+    if (flags & RADIOLIB_SX126X_IRQ_HEADER_VALID) ++headers_;
+    if (flags & RADIOLIB_SX126X_IRQ_HEADER_ERR) ++headerErrors_;
+    if (flags & kSeen) radio_->clearIrqFlags(kSeen);  // never RX done: that one is the task's
+}
+
+bool RadioService::packet(uint32_t seq, RadioPacket& out) const {
+    if (seq == 0 || seq > seq_ || seq_ - seq >= kRing) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    bool ok = ring_ && ring_[seq % kRing].seq == seq;
+    if (ok) out = ring_[seq % kRing];
+    xSemaphoreGive(lock_);
+    return ok;
+}
+
+void RadioService::sweep(bool on, uint32_t fromHz, uint32_t toHz, uint32_t stepHz) {
+    if (on) {
+        stepHz = std::max<uint32_t>(stepHz, 10000);
+        toHz = std::max(toHz, fromHz);
+        toHz = std::min<uint32_t>(toHz, fromHz + stepHz * (SweepFrame::kMaxSteps - 1));
+        sweepFrom_ = fromHz, sweepTo_ = toHz, sweepStep_ = stepHz;
+    }
+    sweepWanted_ = on;
+    wake(kRequest);
+}
+
+bool RadioService::sweepFrame(SweepFrame& out) const {
+    if (!sweepSeq_) return false;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    out = frame_;
+    xSemaphoreGive(lock_);
+    return true;
+}
+
+// One pass across the band. The first one sets the radio up: the Sniffer is paused, not stopped.
+void RadioService::sweepPass() {
+    if (!sweeping_) {
+        if (listening_) {
+            radio_->clearPacketReceivedAction();
+            listening_ = false;  // paused; startListening() resumes on the same ring
+        }
+        if (!beginRadio(nullptr)) {
+            ++radioErrors_;
+            sweepWanted_ = false;
+            return;
+        }
+        radio_->setBandwidth(125);
+        radio_->setSpreadingFactor(7);
+        sweeping_ = true;
+        console.println("radio: sweeping, the Sniffer is paused");
+    }
+    uint32_t from = sweepFrom_, to = sweepTo_, step = sweepStep_;
+    uint16_t steps = static_cast<uint16_t>((to - from) / step + 1);
+    int8_t dbm[SweepFrame::kMaxSteps];
+    uint32_t t0 = millis();
+    for (uint16_t i = 0; i < steps && sweepWanted_; ++i) {
+        radio_->standby();
+        // Image calibration is per band and slow; one calibration covers EU868, so skip it per step.
+        radio_->setFrequency((from + i * step) / 1e6f, i != 0);
+        radio_->startReceive();
+        delayMicroseconds(1500);  // RSSI settles
+        float best = -200;
+        for (int k = 0; k < 3; ++k) {
+            best = std::max(best, radio_->getRSSI(false));
+            delayMicroseconds(300);
+        }
+        dbm[i] = static_cast<int8_t>(std::clamp(best, -127.0f, 0.0f));
+    }
+    radio_->standby();
+    if (!sweepWanted_) return;
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    frame_.seq = sweepSeq_ + 1;
+    frame_.fromHz = from;
+    frame_.stepHz = step;
+    frame_.steps = steps;
+    frame_.passMs = static_cast<uint16_t>(millis() - t0);
+    std::copy(dbm, dbm + steps, frame_.dbm);
+    xSemaphoreGive(lock_);
+    sweepSeq_ = frame_.seq;
+}
+
+void RadioService::endSweep() {
+    sweeping_ = false;
+    console.println("radio: sweep stopped");
+    if (clients_) startListening();  // the Sniffer again, with its settings and its packets
+    else {
+        radio_->sleep();
+        xSemaphoreTake(lock_, portMAX_DELAY);
+        ring_.reset();
+        xSemaphoreGive(lock_);
+    }
+}
+
+uint32_t RadioService::available() const {
+    uint32_t newest = seq_, first = ringFirst_;
+    if (!listening_ || newest < first) return 0;
+    return std::min<uint32_t>(newest - first + 1, kRing);
+}
+
+void RadioService::listen(Client client, bool on) {
+    if (on) clients_ |= client;
+    else clients_ &= ~client;
+    wake(kRequest);
+}
+
+RadioService::Config RadioService::config() const {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    Config c = config_;
+    xSemaphoreGive(lock_);
+    return c;
+}
+
+void RadioService::setPreset(const meshtastic::Preset& p) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    config_ = {meshtastic::eu868FrequencyHz(p), p.bwKHz, p.sf, p.cr, meshtastic::kSyncWord, meshtastic::kPreambleLength,
+               p.name};
+    xSemaphoreGive(lock_);
+    configChanged_ = true;
+    wake(kRequest);
+}
+
+void RadioService::setConfig(const Config& c) {
+    xSemaphoreTake(lock_, portMAX_DELAY);
+    config_ = c;
+    config_.name = "Custom";
+    xSemaphoreGive(lock_);
+    configChanged_ = true;
+    wake(kRequest);
+}
+
+void RadioService::setEcho(bool echo) {
+    echo_ = echo;
+    echoed_ = seq_;
+    listen(Console, echo);
+}
+
+void RadioService::tick(uint32_t nowMs) {
+    SweepFrame f;
+    if (sweepEcho_ && sweeping_ && nowMs - sweepEchoMs_ >= 2000 && sweepFrame(f)) {
+        sweepEchoMs_ = nowMs;
+        lora::SweepStats st = lora::summarize(f.dbm, f.steps, f.fromHz, f.stepHz);
+        console.printf("sweep: #%lu floor %d, top %d dBm", (unsigned long)f.seq, st.floor, st.top);
+        for (auto& p : st.peaks) console.printf(", %.1f MHz %d", p.hz / 1e6, p.dbm);
+        console.printf(" (%u ms a pass)\n", f.passMs);
+    }
+    if (!echo_) return;
+    for (uint32_t s = std::max(echoed_ + 1, seq_ > kRing ? seq_ - kRing + 1 : 1u); s <= seq_; ++s) {
+        RadioPacket p;
+        if (!packet(s, p)) continue;
+        console.printf("lora: #%lu %u B %.1f dBm SNR %.1f dB%s", (unsigned long)p.seq, p.len, p.rx.rssi, p.rx.snr,
+                       p.crcOk ? "" : " (bad CRC)");
+        meshtastic::PacketHeader h;
+        if (meshtastic::parseHeader(p.data, p.len, h))
+            console.printf(" | %s > %s, ch 0x%02X, hops %d/%u%s", meshtastic::nodeId(h.from).c_str(),
+                           meshtastic::nodeId(h.to).c_str(), h.channelHash, h.hopsAway(), h.hopStart(),
+                           h.viaMqtt() ? ", via MQTT" : "");
+        console.println();
+    }
+    echoed_ = seq_;
+}
+
+void RadioService::printSweep(Print& out) const {
+    SweepFrame f;
+    if (!sweepFrame(f)) return (void)out.println("sweep: none yet (lora sweep on)");
+    out.printf("sweep: #%lu, %u steps of %lu kHz from %.3f MHz, %u ms\n", (unsigned long)f.seq, f.steps,
+               (unsigned long)(f.stepHz / 1000), f.fromHz / 1e6, f.passMs);
+    for (uint16_t i = 0; i < f.steps; i += 8) {
+        out.printf("%8.3f", (f.fromHz + i * f.stepHz) / 1e6);
+        for (uint16_t k = i; k < f.steps && k < i + 8; ++k) out.printf(" %4d", f.dbm[k]);
+        out.println();
+    }
+}
+
+void RadioService::printStatus(Print& out) const {
+    Config c = config();
+    Counters n = counters();
+    out.printf("radio: %s, %s, antenna switch %s\n", present_ ? "SX1262" : "no radio",
+               tcxo_ > 0 ? "TCXO 1.8 V" : "crystal", expander_ ? "on (expander 0x43 P0)" : "expander missing");
+    out.printf("radio: %s, %s %.3f MHz, BW %.0f kHz, SF %u, CR 4/%u, sync 0x%02X, preamble %u\n",
+               sweeping_ ? "sweeping" : listening_ ? "listening" : "asleep", c.name, c.frequencyHz / 1e6, c.bandwidthKHz, c.spreadingFactor,
+               c.codingRate, c.syncWord, c.preamble);
+    out.printf("radio: clients%s%s%s%s\n", clients_ ? "" : " none", clients_ & App ? " App" : "",
+               clients_ & Capture ? " Capture" : "", clients_ & Console ? " Console" : "");
+    out.printf("radio: %lu packets, %lu bad CRC, %lu radio errors, %lu receive restarts\n", (unsigned long)n.packets,
+               (unsigned long)n.crcErrors, (unsigned long)n.radioErrors, (unsigned long)n.restarts);
+    out.printf("radio: activity (500 ms samples): %lu preambles, %lu headers, %lu bad headers\n",
+               (unsigned long)n.preambles, (unsigned long)n.headers, (unsigned long)n.headerErrors);
+    if (listening_)
+        out.printf("radio: noise floor %.1f dBm%s\n", noise_.load(),
+                   noise_ < kDeafBelow ? " (deaf? the antenna path looks open)" : "");
+    if (task_) out.printf("radio: task stack %u B free\n", (unsigned)uxTaskGetStackHighWaterMark(task_));
+}
+
+void RadioService::probe(Print& out) {
+    // The I2C part here, on the main loop; the radio part on the radio task.
+    bool found[120] = {};
+    M5.In_I2C.scanID(found, kI2cFreq);
+    out.print("lora probe: i2c (internal bus, 8/9):");
+    for (int a = 8; a < 120; ++a)
+        if (found[a]) out.printf(" 0x%02X", a);
+    out.println();
+    if (found[kExpander]) {
+        auto r = [](uint8_t reg) { return M5.In_I2C.readRegister8(kExpander, reg, kI2cFreq); };
+        out.printf("lora probe: expander 0x43 dir %02X out %02X highz %02X in %02X: antenna %s\n", r(kDirection),
+                   r(kOutput), r(kHighZ), r(kInput), r(kOutput) & 1 && r(kDirection) & 1 ? "on" : "OFF");
+    } else {
+        out.println("lora probe: no expander at 0x43: the antenna switch can't be enabled");
+    }
+    probeOut_ = &out;
+    probeWanted_ = true;
+    wake(kRequest);
+}
+
+void RadioService::runProbe() {
+    Print& out = *probeOut_;
+    uint32_t t0 = millis();
+    if (!beginRadio(&out)) return;
+    char version[17] = {};
+    module_->SPIreadRegisterBurst(RADIOLIB_SX126X_REG_VERSION_STRING, 16, reinterpret_cast<uint8_t*>(version));
+    out.printf("lora probe: %s, %s, ready in %u ms\n", version, tcxo_ > 0 ? "TCXO 1.8 V" : "crystal (no TCXO)",
+               (unsigned)(millis() - t0));
+    // DIO1 to the task, with no transmitter needed: a 100 ms receive timeout, routed to DIO1.
+    radio_->setPacketReceivedAction(onDio1);
+    uint32_t bits = 0;
+    xTaskNotifyWait(0, UINT32_MAX, &bits, 0);  // drop anything pending
+    uint32_t sent = millis();
+    radio_->startReceive(6400, RADIOLIB_IRQ_RX_DEFAULT_FLAGS,
+                         (1UL << RADIOLIB_IRQ_RX_DONE) | (1UL << RADIOLIB_IRQ_TIMEOUT), 0);  // 6400 x 15.625 us
+    bits = 0;
+    xTaskNotifyWait(0, UINT32_MAX, &bits, pdMS_TO_TICKS(500));
+    uint32_t flags = radio_->getIrqFlags();
+    if (bits & kIrq)
+        out.printf("lora probe: DIO1 interrupt works (receive timeout after %u ms)\n", (unsigned)(millis() - sent));
+    else
+        out.printf("lora probe: DIO1 interrupt never came (IRQ status 0x%04X)\n", (unsigned)flags);
+    radio_->standby();
+    radio_->clearIrqFlags(RADIOLIB_SX126X_IRQ_ALL);
+    if (!listening_) radio_->clearPacketReceivedAction();
+    receive();
+    delay(20);
+    float sum = 0, low = 0, high = -200;
+    for (int i = 0; i < 64; ++i) {
+        float r = radio_->getRSSI(false);
+        sum += r, low = std::min(low, r), high = std::max(high, r);
+        delay(3);
+    }
+    float mean = sum / 64;
+    out.printf("lora probe: noise %.1f dBm (%.1f to %.1f) at %.3f MHz: %s\n", mean, low, high, config().frequencyHz / 1e6,
+               mean < kDeafBelow ? "deaf, the antenna path looks open" : "the antenna is connected");
+    // Back to what it was doing.
+    if (listening_) startListening();
+    else radio_->sleep();
+    out.println("lora probe: done");
+}
+
+}  // namespace roro

src/services/radio_service.h

@@ -0,0 +1,151 @@
+#pragma once
+
+#include <Print.h>
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+#include <freertos/task.h>
+
+#include <atomic>
+#include <cstdint>
+#include <memory>
+
+#include "loratap.h"
+#include "meshtastic_presets.h"
+#include "service.h"
+
+class SX1262;
+class Module;
+class ArduinoHal;
+
+namespace roro {
+
+// One received packet, as the Radio Service keeps it.
+struct RadioPacket {
+    uint32_t seq = 0;  // 1, 2, 3… since boot
+    uint32_t ms = 0;  // millis() when it was read (the Clock is read on the main loop, not here)
+    lora::RxInfo rx;
+    float frequencyError = 0;  // Hz
+    bool crcOk = true;
+    uint8_t len = 0;
+    uint8_t data[255];
+};
+
+// One Sweep pass (M3, Q98): the strongest of three instantaneous RSSI readings at each step.
+struct SweepFrame {
+    static constexpr size_t kMaxSteps = 160;
+    uint32_t seq = 0;  // 1, 2, 3… per pass
+    uint32_t fromHz = 0, stepHz = 0;
+    uint16_t steps = 0;
+    uint16_t passMs = 0;  // how long the pass took
+    int8_t dbm[kMaxSteps];
+};
+
+// The LoRa radio on the Cap (CONTEXT.md: Radio Service; docs/milestones/M3.md). One task owns the
+// SX1262 and does all its SPI traffic, behind the bus lock the SD card uses (Q93); the main loop
+// only posts requests, and DIO1's interrupt only wakes the task. **Receive only (Q94): there is
+// no way to transmit.** The radio listens while someone asks it to (Q100) and sleeps otherwise.
+class RadioService : public Service {
+   public:
+    enum Client : uint8_t { App = 1, Capture = 2, Console = 4 };
+    static constexpr size_t kRing = 32;           // Q103
+    static constexpr uint32_t kNoiseEveryMs = 500;  // instantaneous RSSI while listening
+
+    struct Config {
+        uint32_t frequencyHz;
+        float bandwidthKHz;
+        uint8_t spreadingFactor, codingRate, syncWord;
+        uint16_t preamble;
+        const char* name;  // the preset's, or "Custom"
+    };
+    struct Counters {
+        uint32_t packets, crcErrors, radioErrors, restarts;
+        // Seen in the IRQ status at each noise sample (every 500 ms). Preamble detections include
+        // false alarms in noise (M3: more on an empty frequency than on LongFast); headers don't.
+        uint32_t preambles, headers, headerErrors;
+    };
+
+    RadioService();
+    const char* name() const override { return "radio"; }
+    uint32_t tickIntervalMs() const override { return 100; }
+    void start() override;
+    void tick(uint32_t nowMs) override;
+
+    bool present() const { return present_; }
+    bool listening() const { return listening_; }
+    void listen(Client client, bool on);
+    Config config() const;
+    void setPreset(const meshtastic::Preset& preset);
+    void setConfig(const Config& config);  // custom settings (Q95), named "Custom"
+
+    uint32_t received() const { return seq_; }  // seq of the newest packet
+    uint32_t lastPacketMs() const { return lastPacketMs_; }  // millis(), 0 before the first
+    bool packet(uint32_t seq, RadioPacket& out) const;  // false once it has left the ring
+    uint32_t available() const;  // packets in the ring: seqs received()-available()+1 to received()
+    float noiseFloor() const { return noise_; }
+    Counters counters() const {
+        return {packets_, crcErrors_, radioErrors_, restarts_, preambles_, headers_, headerErrors_};
+    }
+
+    // Sweep (Q98, Q99): takes the radio across a band, pausing the Sniffer (its packets are kept)
+    // until stopped. EU868 by default: 863 to 870 MHz in 100 kHz steps, measured at 125 kHz.
+    void sweep(bool on, uint32_t fromHz = 863000000, uint32_t toHz = 870000000, uint32_t stepHz = 100000);
+    bool sweeping() const { return sweeping_; }
+    bool sweepFrame(SweepFrame& out) const;  // the latest pass; false before the first
+    uint32_t sweeps() const { return sweepSeq_; }
+    void setSweepEcho(bool echo) { sweepEcho_ = echo; }  // a summary on the console every 2 s
+    void printSweep(Print& out) const;                   // `lora sweep dump`: the latest pass
+
+    // Debug aids (Q102).
+    void printStatus(Print& out) const;
+    void setEcho(bool echo);
+    void probe(Print& out);  // `lora probe`: runs on the radio task
+#ifdef RORO_DEBUG
+    // `lora inject`: a packet into the ring as if received, to test the App and Captures with no
+    // transmitter in range. Nothing goes on air.
+    void inject(const uint8_t* data, size_t len, float rssi, float snr);
+#endif
+
+   private:
+    enum Notify : uint32_t { kIrq = 1, kRequest = 2 };
+    static void taskEntry(void* self);
+    static void onDio1();
+    void run();
+    bool beginRadio(Print* report);
+    void applyConfig();
+    void startListening();
+    void stopListening();
+    int16_t receive();
+    void readPacket();
+    void store(RadioPacket& p);
+    void sampleNoise();
+    void runProbe();
+    void sweepPass();
+    void endSweep();
+    void wake(Notify why);
+
+    std::unique_ptr<ArduinoHal> hal_;
+    std::unique_ptr<Module> module_;
+    std::unique_ptr<SX1262> radio_;
+    TaskHandle_t task_ = nullptr;
+    mutable SemaphoreHandle_t lock_;  // the ring and the config
+    std::unique_ptr<RadioPacket[]> ring_;
+    Config config_;
+    bool present_ = false, expander_ = false;
+    float tcxo_ = 1.8f;
+    std::atomic<uint8_t> clients_{0};
+    std::atomic<bool> listening_{false}, configChanged_{false}, probeWanted_{false}, echo_{false};
+    std::atomic<uint32_t> seq_{0}, packets_{0}, crcErrors_{0}, radioErrors_{0}, restarts_{0};
+    std::atomic<uint32_t> preambles_{0}, headers_{0}, headerErrors_{0};
+    std::atomic<uint32_t> lastPacketMs_{0};
+    std::atomic<uint32_t> ringFirst_{1};  // the first seq the current ring can hold
+    std::atomic<bool> sweepWanted_{false}, sweeping_{false};
+    std::atomic<uint32_t> sweepFrom_{863000000}, sweepTo_{870000000}, sweepStep_{100000}, sweepSeq_{0};
+    SweepFrame frame_;  // under lock_
+    std::atomic<float> noise_{0};
+    uint32_t lastNoiseMs_ = 0, echoed_ = 0, sweepEchoMs_ = 0;
+    bool sweepEcho_ = false;
+    Print* probeOut_ = nullptr;
+    static RadioService* instance_;
+};
+
+}  // namespace roro

src/services/storage_service.cpp

@@ -5,6 +5,7 @@
 #include <sd_diskio.h>
 
 #include <algorithm>
+#include <atomic>
 #include <memory>
 
 #include "platform/pins.h"
@@ -33,12 +34,20 @@ StorageState StorageService::state() const {
 }
 
 void StorageService::appendLine(const std::string& path, const std::string& line, bool capture) {
+    append(path, line, capture, true);
+}
+
+void StorageService::appendBytes(const std::string& path, const std::string& bytes, bool capture) {
+    append(path, bytes, capture, false);
+}
+
+void StorageService::append(const std::string& path, const std::string& data, bool capture, bool newline) {
     lock();
-    size_t bytes = path.size() + line.size();
+    size_t bytes = path.size() + data.size();
     bool allowed = capture ? monitor_.state().capturesAllowed : monitor_.state().logsAllowed;
     bool accept = allowed && pendingBytes_ + bytes <= kMaxPendingBytes;
     if (accept) {
-        pending_.emplace_back(path, line);
+        pending_.push_back({path, data, newline});
         pendingBytes_ += bytes;
     } else {
         dropped_++;
@@ -82,6 +91,30 @@ void StorageService::runJob(std::function<void()> job) {
     if (task_) xTaskNotifyGive(task_);
 }
 
+bool StorageService::runAndWait(std::function<void()> job) {
+    // Shared with the job, which outlives this wait if the card is missing and it never starts.
+    // Exactly one side wins the state change: the job (Queued -> Running) or the wait giving up
+    // (Queued -> Abandoned), so an abandoned job can never touch this stack frame.
+    enum : int { Queued, Running, Abandoned };
+    struct Run {
+        std::atomic<int> state{Queued};
+        SemaphoreHandle_t done = xSemaphoreCreateBinary();
+        ~Run() { vSemaphoreDelete(done); }
+    };
+    auto run = std::make_shared<Run>();
+    runJob([run, job]() {
+        int expected = Queued;
+        if (!run->state.compare_exchange_strong(expected, Running)) return;
+        job();
+        xSemaphoreGive(run->done);
+    });
+    for (int waited = 0; xSemaphoreTake(run->done, pdMS_TO_TICKS(500)) != pdTRUE; waited += 500) {
+        int expected = Queued;
+        if (waited >= 5000 && run->state.compare_exchange_strong(expected, Abandoned)) return false;
+    }
+    return true;
+}
+
 bool StorageService::requestFormat() {
     if (formatRequested_ || !task_) return false;
     formatRequested_ = true;
@@ -133,7 +166,7 @@ void StorageService::format() {
     mounted_ = false;
 
     bool ok = false;
-    uint8_t pdrv = sdcard_init(pins::kSdCs, &sharedSpi(), 20000000);
+    uint8_t pdrv = sdcard_init(pins::kSdCs, &sharedSpi(), kSdHz);
     if (pdrv != 0xFF) {
         constexpr size_t kWorkSize = 4096;  // FF_MAX_SS
         std::unique_ptr<uint8_t[]> work(new uint8_t[kWorkSize]);
@@ -149,7 +182,7 @@ void StorageService::format() {
 }
 
 bool StorageService::mount() {
-    return SD.begin(pins::kSdCs, sharedSpi(), 20000000, "/sd", 5, false);
+    return SD.begin(pins::kSdCs, sharedSpi(), kSdHz, "/sd", 5, false);
 }
 
 void StorageService::poll() {
@@ -174,25 +207,25 @@ void StorageService::poll() {
 
 void StorageService::writePending() {
     lock();
-    std::deque<std::pair<std::string, std::string>> batch;
+    std::deque<Pending> batch;
     batch.swap(pending_);
     pendingBytes_ = 0;
     unlock();
     if (batch.empty() || !mounted_) return;
 
     // Keep each file's lines in order while opening each file once.
-    std::stable_sort(batch.begin(), batch.end(), [](const auto& a, const auto& b) { return a.first < b.first; });
+    std::stable_sort(batch.begin(), batch.end(), [](const auto& a, const auto& b) { return a.path < b.path; });
     File file;
     std::string openPath;
-    for (auto& [path, line] : batch) {
-        if (path != openPath) {
+    for (auto& p : batch) {
+        if (p.path != openPath) {
             if (file) file.close();
-            file = SD.open(path.c_str(), FILE_APPEND, true);  // true: create missing folders
-            openPath = path;
+            file = SD.open(p.path.c_str(), FILE_APPEND, true);  // true: create missing folders
+            openPath = p.path;
         }
         if (file) {
-            file.write(reinterpret_cast<const uint8_t*>(line.data()), line.size());
-            file.write('\n');
+            file.write(reinterpret_cast<const uint8_t*>(p.data.data()), p.data.size());
+            if (p.newline) file.write('\n');
         }
     }
     if (file) file.close();

src/services/storage_service.h

@@ -32,6 +32,8 @@ class StorageService : public Service {
     // paused (over 90 % full, or no card) or if too much is already waiting. A Capture (or a Track,
     // something the user started) keeps going past 90 %, until the card is full.
     void appendLine(const std::string& path, const std::string& line, bool capture = false);
+    // The same, for binary files (a pcap Capture): the bytes as they are, no newline.
+    void appendBytes(const std::string& path, const std::string& bytes, bool capture = false);
     uint32_t droppedLines() const { return dropped_; }
 
     // Storage Clean-up: list every file of every category, then delete a selection.
@@ -42,6 +44,9 @@ class StorageService : public Service {
 
     // Runs `job` on the storage task, where card access is safe (e.g. reading an Update File).
     void runJob(std::function<void()> job);
+    // The same, and waits for it (from another task, never the storage task itself). False if it
+    // never started within 5 s: no card mounted, and then it never will run.
+    bool runAndWait(std::function<void()> job);
 
     // Erases the whole card: one partition spanning the card, formatted FAT32.
     bool requestFormat();
@@ -51,6 +56,7 @@ class StorageService : public Service {
     static constexpr uint32_t kWakeMs = 1000;
     static constexpr uint32_t kPollEvery = 15;  // wake-ups between usage checks
     static constexpr size_t kMaxPendingBytes = 16 * 1024;
+    static constexpr uint32_t kSdHz = 20000000;  // the card's SPI clock; 10 MHz changed nothing (ADR 0007)
 
     static void taskEntry(void* self);
     void loop();
@@ -70,7 +76,12 @@ class StorageService : public Service {
     mutable SemaphoreHandle_t lock_ = nullptr;
 
     // Shared with other tasks, guarded by lock_.
-    std::deque<std::pair<std::string, std::string>> pending_;
+    struct Pending {
+        std::string path, data;
+        bool newline;
+    };
+    std::deque<Pending> pending_;
+    void append(const std::string& path, const std::string& data, bool capture, bool newline);
     size_t pendingBytes_ = 0;
     uint32_t dropped_ = 0;
     bool listingRequested_ = false;

src/services/update_service.cpp

@@ -1,4 +1,5 @@
 #include "update_service.h"
+#include "platform/counted_client.h"
 
 #include <SD.h>
 #include <WiFi.h>
@@ -208,7 +209,7 @@ void UpdateService::listen() {
             }
         }
         if (listening && phase_ == Phase::Idle) {
-            NetworkClient client = server.accept();
+            Counted<NetworkClient> client(server.accept(), net::User::Updates);
             if (client) {
                 client.setNoDelay(true);
                 NetSource src(client);

src/services/wifi_service.cpp

@@ -3,10 +3,121 @@
 #include <WiFi.h>
 #include <esp_sntp.h>
 #include <esp_wifi.h>
+#include <lwip/ip_addr.h>
+
+#include <cstring>
+
+#include "ipv4.h"
 
 namespace roro {
 
 
+namespace {
+IPAddress toIp(uint32_t a) { return IPAddress(a >> 24, a >> 16 & 255, a >> 8 & 255, a & 255); }
+IPAddress toIp(const std::string& text) {
+    uint32_t a = 0;
+    net::parseIpv4(text, a);
+    return toIp(a);
+}
+const IPAddress kNoAddress(static_cast<uint32_t>(0));
+// A slot lwIP filled from DHCP has an address and no name; ours are set by name.
+bool sntpSlotFromDhcp(int i) {
+    const ip_addr_t* a = esp_sntp_getserver(i);
+    return !esp_sntp_getservername(i) && a && !ip_addr_isany(a);
+}
+constexpr int kNtpSlots = 3;  // CONFIG_LWIP_SNTP_MAX_SERVERS
+constexpr uint32_t kServersEveryMs = 30000;
+}  // namespace
+
+// Joins a Saved Network with its IP setting (S1, Q105): Fixed, or DHCP.
+void WifiService::join(const std::string& ssid, const std::string& password) {
+    const SavedNetwork* n = saved_.find(ssid);
+    fixed_ = n && n->fixed;
+    if (fixed_) {
+        // Nothing comes from DHCP here: forget the NTP servers a previous network offered.
+        for (int i = 0; i < kNtpSlots; i++)
+            if (sntpSlotFromDhcp(i)) esp_sntp_setserver(i, nullptr);
+        WiFi.config(toIp(n->ip.address), toIp(n->ip.gateway), toIp(net::maskOf(n->ip.prefix)),
+                    toIp(settings_.getString(Setting::Dns1)), toIp(settings_.getString(Setting::Dns2)));
+    } else {
+        WiFi.config(kNoAddress, kNoAddress, kNoAddress);  // DHCP
+    }
+    WiFi.begin(ssid.c_str(), password.empty() ? nullptr : password.c_str());
+}
+
+void WifiService::ipSettingChanged(const std::string& ssid) {
+    if (controller_.state() != WifiController::State::Connected || controller_.ssid() != ssid) return;
+    WiFi.disconnect();
+    apply(controller_.disconnected(millis()));
+    controller_.retryNow(millis());
+}
+
+// DNS and NTP as decided in Q108 and Q110. Run when connected, when a setting changes, and now
+// and then: a DHCP renewal puts DHCP's DNS back and clears the NTP slots it didn't fill.
+void WifiService::applyServers(Why why) {
+    if (controller_.state() != WifiController::State::Connected) return;
+    serversCheckedMs_ = millis();
+    bool changed = why != Why::Check;
+
+    bool wasFromSettings = dnsFromSettings_;
+    dnsFromSettings_ = fixed_ || settings_.getBool(Setting::DnsAlways);
+    if (dnsFromSettings_) {
+        IPAddress dns1 = toIp(settings_.getString(Setting::Dns1)), dns2 = toIp(settings_.getString(Setting::Dns2));
+        if (WiFi.dnsIP(0) != dns1 || WiFi.dnsIP(1) != dns2) WiFi.setDNS(dns1, dns2);
+    } else if (why == Why::SettingsChanged && wasFromSettings) {
+        // "Always use my DNS" was switched off: only a new lease brings DHCP's servers back.
+        ipSettingChanged(controller_.ssid());
+        return;
+    }
+
+    // NTP: the servers DHCP offered stay first; ours follow.
+    int fromDhcp = 0;
+    while (!fixed_ && fromDhcp < kNtpSlots && sntpSlotFromDhcp(fromDhcp)) fromDhcp++;
+    std::string wanted[2] = {settings_.getString(Setting::Ntp1), settings_.getString(Setting::Ntp2)};
+    bool touched = false;
+    for (int i = fromDhcp, mine = 0; i < kNtpSlots; i++, mine++) {
+        const char* current = esp_sntp_getservername(i);
+        if (mine < 2 && !wanted[mine].empty()) {
+            if (current && wanted[mine] == current) continue;
+            ntpNames_[mine] = wanted[mine];
+            esp_sntp_setservername(i, ntpNames_[mine].c_str());
+            touched = true;
+        } else if (current || sntpSlotFromDhcp(i)) {
+            esp_sntp_setserver(i, nullptr);
+            touched = true;
+        }
+    }
+    if (!esp_sntp_enabled()) {
+        esp_sntp_setoperatingmode(ESP_SNTP_OPMODE_POLL);
+        esp_sntp_init();
+    } else if (touched || changed) {
+        esp_sntp_restart();
+    }
+    if (touched || changed) ntpWaiting_ = true;
+}
+
+WifiService::Connection WifiService::connection() const {
+    Connection c;
+    c.connected = controller_.state() == WifiController::State::Connected;
+    if (!c.connected) return c;
+    c.fixed = fixed_;
+    c.dnsFromSettings = dnsFromSettings_;
+    c.address = WiFi.localIP().toString().c_str();
+    c.mask = WiFi.subnetMask().toString().c_str();
+    c.prefix = WiFi.subnetCIDR();
+    IPAddress gateway = WiFi.gatewayIP();
+    if (gateway != kNoAddress) c.gateway = gateway.toString().c_str();
+    for (int i = 0; i < 2; i++)
+        if (WiFi.dnsIP(i) != kNoAddress) c.dns[i] = WiFi.dnsIP(i).toString().c_str();
+    for (int i = 0; i < kNtpSlots; i++) {
+        const char* name = esp_sntp_getservername(i);
+        bool answered = esp_sntp_getreachability(i) != 0;
+        if (name) c.ntp[c.ntpCount++] = {name, false, answered};
+        else if (sntpSlotFromDhcp(i)) c.ntp[c.ntpCount++] = {ipaddr_ntoa(esp_sntp_getserver(i)), true, answered};
+    }
+    return c;
+}
+
 std::string WifiService::ip() const {
     return controller_.state() == WifiController::State::Connected ? WiFi.localIP().toString().c_str() : "";
 }
@@ -20,6 +131,7 @@ void WifiService::startScan(int channel) {
         WiFi.mode(WIFI_STA);
         WiFi.setAutoReconnect(false);  // the controller decides when to reconnect
         esp_wifi_set_country_code("EU", true);
+        esp_sntp_servermode_dhcp(true);  // before DHCP runs: take the NTP servers it offers (Q110)
         radioInitialised_ = true;
     }
     if (scanRunning_) return;
@@ -87,13 +199,7 @@ void WifiService::finishScan(uint32_t nowMs) {
 
 void WifiService::startNtp() {
     // Not configTime(): it would overwrite the POSIX TZ the Clock applies.
-    if (!esp_sntp_enabled()) {
-        esp_sntp_setoperatingmode(ESP_SNTP_OPMODE_POLL);
-        esp_sntp_setservername(0, "pool.ntp.org");
-        esp_sntp_init();
-    } else {
-        esp_sntp_restart();
-    }
+    applyServers(Why::Joined);
     ntpWaiting_ = true;
 }
 
@@ -102,7 +208,7 @@ void WifiService::apply(const WifiController::Step& step) {
     switch (step.action) {
         case Action::None: break;
         case Action::StartScan: startScan(); break;
-        case Action::Connect: WiFi.begin(step.ssid.c_str(), step.password.empty() ? nullptr : step.password.c_str()); break;
+        case Action::Connect: join(step.ssid, step.password); break;
         case Action::Disconnect: WiFi.disconnect(); break;
         case Action::RadioOff:
             WiFi.disconnect(true);
@@ -143,6 +249,8 @@ void WifiService::tick(uint32_t nowMs) {
 
     apply(controller_.update(nowMs, settings_.getBool(Setting::WifiEnabled)));
 
+    if (controller_.state() == State::Connected && nowMs - serversCheckedMs_ >= kServersEveryMs) applyServers(Why::Check);
+
     if (ntpWaiting_ && sntp_get_sync_status() == SNTP_SYNC_STATUS_COMPLETED) {
         ntpWaiting_ = false;
         clock_.set(static_cast<int64_t>(time(nullptr)), TimeSource::Ntp);

src/services/wifi_service.h

@@ -36,6 +36,27 @@ class WifiService : public Service {
     // Done with list scans: switch the radio back off if Wi-Fi itself is off.
     void endListScans();
 
+    // What the device is using and where each part came from (S1, Q113).
+    struct Connection {
+        bool connected = false;
+        bool fixed = false;            // the address: Fixed, or from DHCP
+        bool dnsFromSettings = false;  // DNS: from Settings, or from DHCP
+        std::string address, mask, gateway;
+        int prefix = 0;
+        std::string dns[2];
+        struct Ntp {
+            std::string server;
+            bool fromDhcp = false;
+            bool answered = false;  // it has replied since the last (re)start
+        } ntp[3];
+        int ntpCount = 0;
+    };
+    Connection connection() const;
+    // A Saved Network's IP setting changed: if it's the one in use, join it again with it (Q114).
+    void ipSettingChanged(const std::string& ssid);
+    // The DNS or NTP settings changed: use them now.
+    void serversChanged() { applyServers(Why::SettingsChanged); }
+
     // A Saved Network was added: try it now rather than after the retry delay.
     void savedNetworksChanged() { controller_.retryNow(millis()); }
 
@@ -47,6 +68,9 @@ class WifiService : public Service {
     void startScan(int channel = 0);
     void finishScan(uint32_t nowMs);
     void startNtp();
+    void join(const std::string& ssid, const std::string& password);
+    enum class Why { Joined, SettingsChanged, Check };
+    void applyServers(Why why);  // DNS and NTP, as Settings and the network say
 
     Settings& settings_;
     SavedNetworks& saved_;
@@ -58,6 +82,10 @@ class WifiService : public Service {
     uint32_t listScanSeq_ = 0;
     bool ntpWaiting_ = false;
     bool radioInitialised_ = false;
+    bool fixed_ = false;           // the network in use has a Fixed address
+    bool dnsFromSettings_ = false;
+    std::string ntpNames_[2];      // lwIP keeps the pointers, so the names live here
+    uint32_t serversCheckedMs_ = 0;
 };
 
 }  // namespace roro

src/ui/widgets.cpp

@@ -49,6 +49,13 @@ void statusBar(Canvas& c, const StatusInfo& info) {
         case StatusInfo::Wifi::None: break;
     }
     if (info.tracking) right("REC", kWarning);
+    if (info.capturing) right("CAP", kWarning);
+    switch (info.radio) {  // Q101: muted while listening, bright for a moment on each packet
+        case StatusInfo::Radio::Listening: right("L", kMuted); break;
+        case StatusInfo::Radio::Packet: right("L", kAccent); break;
+        case StatusInfo::Radio::Sweep: right("SW", kMuted); break;  // the Sniffer is paused
+        case StatusInfo::Radio::None: break;
+    }
     switch (info.gnss) {  // Q61: muted while searching, normal with a Fix, the count with a 3D Fix
         case StatusInfo::Gnss::Searching: right("G", kMuted); break;
         case StatusInfo::Gnss::TwoD: right("G", kText); break;

src/ui/widgets.h

@@ -27,12 +27,14 @@ struct StatusInfo {
     enum class Gnss { None, Searching, TwoD, ThreeD } gnss = Gnss::None;  // None: GNSS off (Q61)
     int gnssSatellites = 0;  // used in the Fix
     bool tracking = false;   // a Track is recording (Q63)
+    enum class Radio { None, Listening, Packet, Sweep } radio = Radio::None;  // M3, Q101: Packet flashes
+    bool capturing = false;  // a LoRa Capture is recording (Q97)
 
     bool operator==(const StatusInfo& o) const {
         return title == o.title && batteryPercent == o.batteryPercent && clock == o.clock &&
                sdPresent == o.sdPresent && sdLevel == o.sdLevel && compose == o.compose && wifi == o.wifi &&
                wifiBars == o.wifiBars && unread == o.unread && gnss == o.gnss && gnssSatellites == o.gnssSatellites &&
-               tracking == o.tracking;
+               tracking == o.tracking && radio == o.radio && capturing == o.capturing;
     }
     bool operator!=(const StatusInfo& o) const { return !(*this == o); }
 };

test/test_file_receiver/test_file_receiver.cpp

@@ -184,6 +184,34 @@ void test_reset_returns_to_idle() {
     TEST_ASSERT_FALSE(r.active());
 }
 
+// The received bytes can be right and the card's copy wrong: read back, it must hash the same.
+void test_card_check() {
+    auto data = bytes(10);
+    FileReceiver r;
+    r.begin(args("/a.bin", data), 0);
+    r.feed(data.data(), data.size(), 0);
+    r.chunkWritten(true, 0);
+    TEST_ASSERT_TRUE(r.state() == FileReceiver::State::Finishing);
+    uint8_t good[32];
+    Sha256::hash(data.data(), data.size(), good);
+    r.cardChecked(good);
+    TEST_ASSERT_TRUE(r.state() == FileReceiver::State::Finishing);
+    r.finished(true);
+    TEST_ASSERT_TRUE(r.state() == FileReceiver::State::Done);
+
+    FileReceiver bad;
+    bad.begin(args("/a.bin", data), 0);
+    bad.feed(data.data(), data.size(), 0);
+    bad.chunkWritten(true, 0);
+    auto zeroed = data;
+    zeroed[4] = 0;
+    uint8_t wrong[32];
+    Sha256::hash(zeroed.data(), zeroed.size(), wrong);
+    bad.cardChecked(wrong);
+    TEST_ASSERT_TRUE(bad.state() == FileReceiver::State::Failed);
+    TEST_ASSERT_EQUAL_STRING("the copy on the card differs", bad.error().c_str());
+}
+
 int main() {
     UNITY_BEGIN();
     RUN_TEST(test_begin_accepts_path_size_and_checksum);
@@ -198,5 +226,6 @@ int main() {
     RUN_TEST(test_wanted_counts_down_within_a_chunk);
     RUN_TEST(test_a_rename_that_never_completes_times_out);
     RUN_TEST(test_reset_returns_to_idle);
+    RUN_TEST(test_card_check);
     return UNITY_END();
 }

test/test_gemini/test_gemini.cpp

@@ -0,0 +1,223 @@
+#include <unity.h>
+
+#include <string>
+
+#include "gemini_response.h"
+#include "gemini_url.h"
+#include "gemtext.h"
+#include "text_buffer.h"
+
+using namespace roro::gemini;
+
+void setUp() {}
+void tearDown() {}
+
+static void resolvesTo(const char* ref, const char* expected) {
+    TEST_ASSERT_EQUAL_STRING_MESSAGE(expected, resolve("gemini://a/b/c/d;p?q", ref).c_str(), ref);
+}
+
+// RFC 3986, section 5.4.1, with gemini:// for http://.
+void test_rfc3986_normal_examples() {
+    resolvesTo("g:h", "g:h");
+    resolvesTo("g", "gemini://a/b/c/g");
+    resolvesTo("./g", "gemini://a/b/c/g");
+    resolvesTo("g/", "gemini://a/b/c/g/");
+    resolvesTo("/g", "gemini://a/g");
+    resolvesTo("//g", "gemini://g");
+    resolvesTo("?y", "gemini://a/b/c/d;p?y");
+    resolvesTo("g?y", "gemini://a/b/c/g?y");
+    resolvesTo("#s", "gemini://a/b/c/d;p?q#s");
+    resolvesTo("g#s", "gemini://a/b/c/g#s");
+    resolvesTo("g?y#s", "gemini://a/b/c/g?y#s");
+    resolvesTo(";x", "gemini://a/b/c/;x");
+    resolvesTo("", "gemini://a/b/c/d;p?q");
+    resolvesTo(".", "gemini://a/b/c/");
+    resolvesTo("./", "gemini://a/b/c/");
+    resolvesTo("..", "gemini://a/b/");
+    resolvesTo("../", "gemini://a/b/");
+    resolvesTo("../g", "gemini://a/b/g");
+    resolvesTo("../..", "gemini://a/");
+    resolvesTo("../../", "gemini://a/");
+    resolvesTo("../../g", "gemini://a/g");
+}
+
+// Section 5.4.2.
+void test_rfc3986_abnormal_examples() {
+    resolvesTo("../../../g", "gemini://a/g");
+    resolvesTo("../../../../g", "gemini://a/g");
+    resolvesTo("/./g", "gemini://a/g");
+    resolvesTo("/../g", "gemini://a/g");
+    resolvesTo("g.", "gemini://a/b/c/g.");
+    resolvesTo(".g", "gemini://a/b/c/.g");
+    resolvesTo("./../g", "gemini://a/b/g");
+    resolvesTo("g/./h", "gemini://a/b/c/g/h");
+    resolvesTo("g/../h", "gemini://a/b/c/h");
+    resolvesTo("g;x=1/./y", "gemini://a/b/c/g;x=1/y");
+    resolvesTo("g;x=1/../y", "gemini://a/b/c/y");
+}
+
+void test_parse_a_gemini_url() {
+    Url u;
+    TEST_ASSERT_TRUE(parseUrl("gemini://Example.ORG:1966/a/b?c=d#e", u));
+    TEST_ASSERT_EQUAL_STRING("gemini", u.scheme.c_str());
+    TEST_ASSERT_EQUAL_STRING("example.org", u.host.c_str());  // hosts are case-insensitive
+    TEST_ASSERT_EQUAL(1966, u.port);
+    TEST_ASSERT_EQUAL_STRING("/a/b", u.path.c_str());
+    TEST_ASSERT_EQUAL_STRING("c=d", u.query.c_str());
+    TEST_ASSERT_EQUAL_STRING("e", u.fragment.c_str());
+    TEST_ASSERT_TRUE(parseUrl("gemini://example.org", u));
+    TEST_ASSERT_EQUAL(1965, u.portOrDefault());
+    TEST_ASSERT_FALSE(parseUrl("not a url", u));
+}
+
+void test_the_request_drops_the_fragment_and_never_has_an_empty_path() {
+    TEST_ASSERT_EQUAL_STRING("gemini://example.org/", requestUrl("gemini://example.org").c_str());
+    TEST_ASSERT_EQUAL_STRING("gemini://example.org/a?b", requestUrl("gemini://example.org/a?b#frag").c_str());
+    TEST_ASSERT_EQUAL_STRING("gemini://example.org:1966/", requestUrl("gemini://EXAMPLE.org:1966").c_str());
+}
+
+void test_other_schemes_are_recognised() {
+    TEST_ASSERT_TRUE(isGemini("gemini://a/"));
+    TEST_ASSERT_FALSE(isGemini("https://a/"));
+    TEST_ASSERT_FALSE(isGemini("gopher://a/"));
+    TEST_ASSERT_FALSE(isGemini("mailto:someone@example.org"));
+}
+
+void test_query_encoding() {
+    TEST_ASSERT_EQUAL_STRING("hello%20world", encodeQuery("hello world").c_str());
+    TEST_ASSERT_EQUAL_STRING("caf%C3%A9%3F%26", encodeQuery("caf\xC3\xA9?&").c_str());
+    TEST_ASSERT_EQUAL_STRING("a-b_c.d~e", encodeQuery("a-b_c.d~e").c_str());
+}
+
+void test_response_header() {
+    Header h;
+    TEST_ASSERT_TRUE(parseHeader("20 text/gemini; charset=utf-8; lang=en", h));
+    TEST_ASSERT_EQUAL(20, h.status);
+    TEST_ASSERT_EQUAL_STRING("text/gemini", h.mimeType().c_str());
+    TEST_ASSERT_EQUAL_STRING("utf-8", h.parameter("charset").c_str());
+    TEST_ASSERT_TRUE(h.category() == Category::Success);
+    TEST_ASSERT_TRUE(parseHeader("20", h));  // no MIME type: text/gemini by default
+    TEST_ASSERT_EQUAL_STRING("text/gemini", h.mimeType().c_str());
+    TEST_ASSERT_TRUE(parseHeader("31 gemini://cosmos.skyjake.fi/", h));
+    TEST_ASSERT_TRUE(h.category() == Category::Redirect);
+    TEST_ASSERT_EQUAL_STRING("gemini://cosmos.skyjake.fi/", h.meta.c_str());
+    TEST_ASSERT_TRUE(parseHeader("11 Password", h));
+    TEST_ASSERT_TRUE(h.category() == Category::Input);
+    TEST_ASSERT_TRUE(h.sensitiveInput());
+    TEST_ASSERT_TRUE(parseHeader("51 Not found", h));
+    TEST_ASSERT_TRUE(h.category() == Category::PermanentFailure);
+    TEST_ASSERT_TRUE(parseHeader("60 Certificate required", h));
+    TEST_ASSERT_TRUE(h.category() == Category::ClientCertificate);
+}
+
+void test_malformed_headers_are_refused() {
+    Header h;
+    TEST_ASSERT_FALSE(parseHeader("", h));
+    TEST_ASSERT_FALSE(parseHeader("2 text/gemini", h));
+    TEST_ASSERT_FALSE(parseHeader("ab text/gemini", h));
+    TEST_ASSERT_FALSE(parseHeader("20text/gemini", h));
+    TEST_ASSERT_FALSE(parseHeader("20 " + std::string(1025, 'x'), h));
+}
+
+void test_gemtext_line_types() {
+    auto lines = parseGemtext(
+        "# Title\n## Sub\n### Subsub\nPlain text\n* item\n> quoted\n=> gemini://a/b Label here\n=>/rel\n"
+        "```ascii art\n# not a heading\n=> not a link\n```\nafter\n");
+    TEST_ASSERT_EQUAL(13, static_cast<int>(lines.size()));
+    TEST_ASSERT_TRUE(lines[0].type == LineType::Heading1);
+    TEST_ASSERT_EQUAL_STRING("Title", lines[0].text.c_str());
+    TEST_ASSERT_TRUE(lines[1].type == LineType::Heading2);
+    TEST_ASSERT_TRUE(lines[2].type == LineType::Heading3);
+    TEST_ASSERT_TRUE(lines[3].type == LineType::Text);
+    TEST_ASSERT_TRUE(lines[4].type == LineType::ListItem);
+    TEST_ASSERT_EQUAL_STRING("item", lines[4].text.c_str());
+    TEST_ASSERT_TRUE(lines[5].type == LineType::Quote);
+    TEST_ASSERT_EQUAL_STRING("quoted", lines[5].text.c_str());
+    TEST_ASSERT_TRUE(lines[6].type == LineType::Link);
+    TEST_ASSERT_EQUAL_STRING("gemini://a/b", lines[6].url.c_str());
+    TEST_ASSERT_EQUAL_STRING("Label here", lines[6].text.c_str());
+    TEST_ASSERT_TRUE(lines[7].type == LineType::Link);
+    TEST_ASSERT_EQUAL_STRING("/rel", lines[7].url.c_str());
+    TEST_ASSERT_EQUAL_STRING("/rel", lines[7].text.c_str());  // no label: the URL is the label
+    TEST_ASSERT_TRUE(lines[8].type == LineType::PreToggle);
+    TEST_ASSERT_EQUAL_STRING("ascii art", lines[8].text.c_str());
+    TEST_ASSERT_TRUE(lines[9].type == LineType::Preformatted);
+    TEST_ASSERT_EQUAL_STRING("# not a heading", lines[9].text.c_str());
+    TEST_ASSERT_TRUE(lines[10].type == LineType::Preformatted);
+    TEST_ASSERT_TRUE(lines[11].type == LineType::PreToggle);
+    TEST_ASSERT_TRUE(lines[12].type == LineType::Text);
+}
+
+void test_gemtext_handles_crlf_and_a_missing_last_newline() {
+    auto lines = parseGemtext("one\r\n=>\tgemini://x/\t  spaced label \r\ntwo");
+    TEST_ASSERT_EQUAL(3, static_cast<int>(lines.size()));
+    TEST_ASSERT_EQUAL_STRING("one", lines[0].text.c_str());
+    TEST_ASSERT_EQUAL_STRING("gemini://x/", lines[1].url.c_str());
+    TEST_ASSERT_EQUAL_STRING("spaced label", lines[1].text.c_str());
+    TEST_ASSERT_EQUAL_STRING("two", lines[2].text.c_str());
+}
+
+void test_display_text_keeps_latin1_and_replaces_the_rest() {
+    TEST_ASSERT_EQUAL_STRING("caf\xC3\xA9", displayText("caf\xC3\xA9").c_str());   // é stays
+    TEST_ASSERT_EQUAL_STRING("? and ?", displayText("\xE2\x9C\x93 and \xF0\x9F\x99\x82").c_str());  // ✓ and 🙂
+    TEST_ASSERT_EQUAL_STRING("bad ? byte", displayText("bad \xFF byte").c_str());
+    TEST_ASSERT_EQUAL_STRING("a   b", displayText("a\tb").c_str());  // tab: three spaces here
+}
+
+void test_saved_page_paths() {
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved/example.org/index.gmi", savedPath("gemini://example.org/").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved/example.org/index.gmi", savedPath("gemini://example.org").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved/example.org/log/2026/post.gmi",
+                             savedPath("gemini://example.org/log/2026/post.gmi").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved/example.org/log/index.gmi", savedPath("gemini://example.org/log/").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved/example.org/about.gmi", savedPath("gemini://example.org/about").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved/example.org_1966/a~q_x.gmi",
+                             savedPath("gemini://example.org:1966/a?q:x#frag").c_str());
+}
+
+void test_text_buffer_keeps_lines_across_any_feed() {
+    TextBuffer b;
+    std::string doc = "# Title\r\nline two\n\nlast without end";
+    for (size_t i = 0; i < doc.size(); i += 3) b.append(doc.data() + i, std::min<size_t>(3, doc.size() - i));
+    b.finish();
+    TEST_ASSERT_EQUAL(4, static_cast<int>(b.lineCount()));
+    TEST_ASSERT_EQUAL_STRING("# Title", b.line(0).c_str());
+    TEST_ASSERT_EQUAL_STRING("line two", b.line(1).c_str());
+    TEST_ASSERT_EQUAL_STRING("", b.line(2).c_str());
+    TEST_ASSERT_EQUAL_STRING("last without end", b.line(3).c_str());
+    TEST_ASSERT_EQUAL(doc.size(), b.bytes());
+}
+
+void test_text_buffer_spreads_over_chunks_without_splitting_lines() {
+    TextBuffer b;
+    std::string line(1000, 'x');
+    for (int i = 0; i < 20; i++) {
+        std::string l = std::to_string(i) + line + "\n";
+        b.append(l.data(), l.size());
+    }
+    std::string big(6000, 'y');  // longer than a chunk
+    big += "\n";
+    b.append(big.data(), big.size());
+    TEST_ASSERT_EQUAL(21, static_cast<int>(b.lineCount()));
+    for (int i = 0; i < 20; i++) TEST_ASSERT_EQUAL_STRING((std::to_string(i) + line).c_str(), b.line(i).c_str());
+    TEST_ASSERT_EQUAL(6000, static_cast<int>(b.line(20).size()));
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_rfc3986_normal_examples);
+    RUN_TEST(test_rfc3986_abnormal_examples);
+    RUN_TEST(test_parse_a_gemini_url);
+    RUN_TEST(test_the_request_drops_the_fragment_and_never_has_an_empty_path);
+    RUN_TEST(test_other_schemes_are_recognised);
+    RUN_TEST(test_query_encoding);
+    RUN_TEST(test_response_header);
+    RUN_TEST(test_malformed_headers_are_refused);
+    RUN_TEST(test_gemtext_line_types);
+    RUN_TEST(test_gemtext_handles_crlf_and_a_missing_last_newline);
+    RUN_TEST(test_display_text_keeps_latin1_and_replaces_the_rest);
+    RUN_TEST(test_saved_page_paths);
+    RUN_TEST(test_text_buffer_keeps_lines_across_any_feed);
+    RUN_TEST(test_text_buffer_spreads_over_chunks_without_splitting_lines);
+    return UNITY_END();
+}

test/test_ipv4/test_ipv4.cpp

@@ -0,0 +1,101 @@
+#include <unity.h>
+
+#include <string>
+
+#include "ipv4.h"
+
+using namespace roro::net;
+
+void setUp() {}
+void tearDown() {}
+
+static uint32_t ip(const char* s) {
+    uint32_t a = 0;
+    TEST_ASSERT_TRUE_MESSAGE(parseIpv4(s, a), s);
+    return a;
+}
+
+void test_parse_and_format() {
+    TEST_ASSERT_EQUAL_HEX32(0x0A27270C, ip("10.39.39.12"));
+    TEST_ASSERT_EQUAL_HEX32(0x00000000, ip("0.0.0.0"));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFFFF, ip("255.255.255.255"));
+    TEST_ASSERT_EQUAL_STRING("10.39.39.12", formatIpv4(0x0A27270C).c_str());
+    TEST_ASSERT_EQUAL_STRING("192.168.1.254", formatIpv4(ip("192.168.1.254")).c_str());
+}
+
+void test_parse_refuses() {
+    uint32_t a;
+    for (const char* bad : {"", "10.39.39", "10.39.39.12.1", "10.39.39.256", "10..39.12", "10.39.39.", ".10.39.39",
+                            "10.39.39.1a", " 10.39.39.12", "10.39.39.12 ", "1.2.3.-4", "01234.1.1.1", "1.2.3.4/24"})
+        TEST_ASSERT_FALSE_MESSAGE(parseIpv4(bad, a), bad);
+}
+
+void test_prefix_and_mask() {
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFF00, maskOf(24));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFFFC, maskOf(30));
+    TEST_ASSERT_EQUAL_HEX32(0x80000000, maskOf(1));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFF0000, maskOf(16));
+    TEST_ASSERT_EQUAL_STRING("255.255.255.0", formatIpv4(maskOf(24)).c_str());
+}
+
+// Q111: what a Fixed setting must satisfy, and the reason given when it doesn't.
+void test_fixed_setting_accepted() {
+    TEST_ASSERT_EQUAL_STRING("", checkFixed({ip("10.39.39.13"), 24, ip("10.39.39.1")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("", checkFixed({ip("192.168.4.2"), 30, ip("192.168.4.1")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("", checkFixed({ip("10.0.0.5"), 8, 0}).c_str());  // Q107: no gateway is fine
+}
+
+void test_fixed_setting_refused() {
+    TEST_ASSERT_EQUAL_STRING("The prefix must be 1 to 30", checkFixed({ip("10.39.39.13"), 0, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The prefix must be 1 to 30", checkFixed({ip("10.39.39.13"), 31, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("10.39.39.0 is the network's own address", checkFixed({ip("10.39.39.0"), 24, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("10.39.39.255 is the broadcast address", checkFixed({ip("10.39.39.255"), 24, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway 10.39.40.1 isn't in 10.39.39.0/24",
+                             checkFixed({ip("10.39.39.13"), 24, ip("10.39.40.1")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway can't be this device's address",
+                             checkFixed({ip("10.39.39.13"), 24, ip("10.39.39.13")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway 10.39.39.255 is the broadcast address",
+                             checkFixed({ip("10.39.39.13"), 24, ip("10.39.39.255")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("0.0.0.0 isn't an address a device can have", checkFixed({0, 24, 0}).c_str());
+}
+
+// How a Fixed setting is typed on the console and kept in flash: "address/prefix [gateway]".
+void test_fixed_setting_as_text() {
+    FixedIp f;
+    TEST_ASSERT_EQUAL_STRING("", parseFixed("10.39.39.13/24 10.39.39.1", f).c_str());
+    TEST_ASSERT_EQUAL_HEX32(ip("10.39.39.13"), f.address);
+    TEST_ASSERT_EQUAL_UINT8(24, f.prefix);
+    TEST_ASSERT_EQUAL_HEX32(ip("10.39.39.1"), f.gateway);
+    TEST_ASSERT_EQUAL_STRING("10.39.39.13/24 10.39.39.1", formatFixed(f).c_str());
+
+    TEST_ASSERT_EQUAL_STRING("", parseFixed("192.168.4.2/30", f).c_str());
+    TEST_ASSERT_EQUAL_HEX32(0, f.gateway);
+    TEST_ASSERT_EQUAL_STRING("192.168.4.2/30", formatFixed(f).c_str());
+
+    TEST_ASSERT_EQUAL_STRING("Write it as address/prefix, then the gateway if there is one", parseFixed("10.39.39.13", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("10.39.39.300 isn't an IPv4 address", parseFixed("10.39.39.300/24", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("The prefix must be 1 to 30", parseFixed("10.39.39.13/abc", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("gw isn't an IPv4 address", parseFixed("10.39.39.13/24 gw", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway 10.39.40.1 isn't in 10.39.39.0/24", parseFixed("10.39.39.13/24 10.39.40.1", f).c_str());
+}
+
+// An NTP server is an address or a host name (Q110).
+void test_host_names() {
+    for (const char* good : {"pool.ntp.org", "time.cloudflare.com", "10.39.39.1", "ntp", "a-b.example", "0.be.pool.ntp.org"})
+        TEST_ASSERT_TRUE_MESSAGE(validHost(good), good);
+    for (const char* bad : {"", "pool .ntp.org", "-ntp.org", "ntp-.org", "ntp..org", ".ntp.org", "ntp.org.", "n_tp.org", "häst.se",
+                            "999.1.1.1", "1.2.3"})
+        TEST_ASSERT_FALSE_MESSAGE(validHost(bad), bad);
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_parse_and_format);
+    RUN_TEST(test_parse_refuses);
+    RUN_TEST(test_prefix_and_mask);
+    RUN_TEST(test_fixed_setting_accepted);
+    RUN_TEST(test_fixed_setting_refused);
+    RUN_TEST(test_fixed_setting_as_text);
+    RUN_TEST(test_host_names);
+    return UNITY_END();
+}

test/test_loratap/test_loratap.cpp

@@ -0,0 +1,98 @@
+#include <unity.h>
+
+#include <vector>
+
+#include "loratap.h"
+
+using namespace roro::lora;
+
+void setUp() {}
+void tearDown() {}
+
+static uint32_t le32(const std::vector<uint8_t>& b, size_t at) {
+    return b[at] | b[at + 1] << 8 | b[at + 2] << 16 | (uint32_t)b[at + 3] << 24;
+}
+
+void test_pcap_global_header() {
+    std::vector<uint8_t> out;
+    appendPcapHeader(out);
+    TEST_ASSERT_EQUAL_size_t(24, out.size());
+    TEST_ASSERT_EQUAL_HEX32(0xA1B2C3D4, le32(out, 0));  // microsecond timestamps, little-endian file
+    TEST_ASSERT_EQUAL_UINT8(2, out[4]);                 // version 2.4
+    TEST_ASSERT_EQUAL_UINT8(4, out[6]);
+    TEST_ASSERT_EQUAL_UINT32(65535, le32(out, 16));     // snap length
+    TEST_ASSERT_EQUAL_UINT32(270, le32(out, 20));       // LINKTYPE_LORATAP
+}
+
+void test_record_with_loratap_v0() {
+    RxInfo rx;
+    rx.frequencyHz = 869525000;
+    rx.bandwidthKHz = 250;
+    rx.spreadingFactor = 11;
+    rx.rssi = -97.0f;
+    rx.snr = 6.25f;
+    rx.noiseFloor = -110.0f;
+    rx.syncWord = 0x2B;
+    const uint8_t payload[] = {1, 2, 3};
+    std::vector<uint8_t> out;
+    appendRecord(out, 1791230400u, 250000u, rx, payload, sizeof payload);
+
+    TEST_ASSERT_EQUAL_size_t(16 + 15 + 3, out.size());
+    TEST_ASSERT_EQUAL_UINT32(1791230400u, le32(out, 0));
+    TEST_ASSERT_EQUAL_UINT32(250000u, le32(out, 4));
+    TEST_ASSERT_EQUAL_UINT32(18, le32(out, 8));  // captured: LoRaTap header + payload
+    TEST_ASSERT_EQUAL_UINT32(18, le32(out, 12));
+
+    const uint8_t* t = out.data() + 16;  // LoRaTap v0, big-endian
+    TEST_ASSERT_EQUAL_UINT8(0, t[0]);    // version
+    TEST_ASSERT_EQUAL_UINT8(0, t[1]);    // padding
+    TEST_ASSERT_EQUAL_UINT16(15, t[2] << 8 | t[3]);
+    TEST_ASSERT_EQUAL_UINT32(869525000u, (uint32_t)t[4] << 24 | t[5] << 16 | t[6] << 8 | t[7]);
+    TEST_ASSERT_EQUAL_UINT8(2, t[8]);    // bandwidth in 125 kHz steps
+    TEST_ASSERT_EQUAL_UINT8(11, t[9]);
+    TEST_ASSERT_EQUAL_UINT8(42, t[10]);  // packet RSSI: -139 + 42 = -97 dBm (SNR >= 0)
+    TEST_ASSERT_EQUAL_UINT8(42, t[11]);  // max RSSI: the packet's
+    TEST_ASSERT_EQUAL_UINT8(29, t[12]);  // current RSSI: the noise floor, -139 + 29 = -110 dBm
+    TEST_ASSERT_EQUAL_UINT8(25, t[13]);  // SNR in quarter dB
+    TEST_ASSERT_EQUAL_HEX8(0x2B, t[14]);
+    TEST_ASSERT_EQUAL_UINT8(3, t[17]);
+}
+
+// Below 0 dB SNR the spec says quarter dB, but Wireshark (checked with tshark 4.2) reads plain dBm.
+void test_negative_snr() {
+    RxInfo rx;
+    rx.bandwidthKHz = 125;
+    rx.rssi = -120.5f;
+    rx.snr = -7.5f;
+    std::vector<uint8_t> out;
+    appendRecord(out, 0, 0, rx, nullptr, 0);
+    const uint8_t* t = out.data() + 16;
+    TEST_ASSERT_EQUAL_UINT8(1, t[8]);
+    TEST_ASSERT_EQUAL_UINT8(19, t[10]);                     // -139 + 19 = -120 dBm (rounded half away)
+    TEST_ASSERT_EQUAL_INT8(-30, static_cast<int8_t>(t[13]));  // -7.5 dB
+}
+
+void test_rssi_clamped() {
+    RxInfo rx;
+    rx.rssi = -150.0f;  // below what LoRaTap can say
+    rx.snr = 1.0f;
+    rx.noiseFloor = 20.0f;
+    std::vector<uint8_t> out;
+    appendRecord(out, 0, 0, rx, nullptr, 0);
+    TEST_ASSERT_EQUAL_UINT8(0, out[16 + 10]);
+    TEST_ASSERT_EQUAL_UINT8(159, out[16 + 12]);
+}
+
+void test_capture_path() {
+    TEST_ASSERT_EQUAL_STRING("/captures/lora/20261005-200000.pcap", capturePath(1791230400).c_str());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_pcap_global_header);
+    RUN_TEST(test_record_with_loratap_v0);
+    RUN_TEST(test_negative_snr);
+    RUN_TEST(test_rssi_clamped);
+    RUN_TEST(test_capture_path);
+    return UNITY_END();
+}

test/test_meshtastic/test_meshtastic.cpp

@@ -0,0 +1,132 @@
+#include <unity.h>
+
+#include <cstring>
+#include <string>
+
+#include "meshtastic_header.h"
+#include "meshtastic_presets.h"
+
+using namespace roro::meshtastic;
+
+void setUp() {}
+void tearDown() {}
+
+// The 16 bytes every Meshtastic packet starts with, little-endian, never encrypted.
+static const uint8_t kHeader[] = {
+    0xFF, 0xFF, 0xFF, 0xFF,  // to: broadcast
+    0x78, 0x56, 0x34, 0x12,  // from: !12345678
+    0xEF, 0xBE, 0xAD, 0xDE,  // id
+    0x6B,                    // flags: hop start 3, want ack, hop limit 3
+    0x08,                    // channel hash: LongFast with the default key
+    0x00,                    // next hop: none
+    0x42,                    // relay node: last byte of the Node that relayed it
+};
+
+void test_header_fields() {
+    PacketHeader h;
+    TEST_ASSERT_TRUE(parseHeader(kHeader, sizeof kHeader, h));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFFFF, h.to);
+    TEST_ASSERT_EQUAL_HEX32(0x12345678, h.from);
+    TEST_ASSERT_EQUAL_HEX32(0xDEADBEEF, h.id);
+    TEST_ASSERT_EQUAL_UINT8(0x08, h.channelHash);
+    TEST_ASSERT_EQUAL_UINT8(0x00, h.nextHop);
+    TEST_ASSERT_EQUAL_UINT8(0x42, h.relayNode);
+    TEST_ASSERT_TRUE(h.broadcast());
+}
+
+void test_header_flags() {
+    PacketHeader h;
+    parseHeader(kHeader, sizeof kHeader, h);
+    TEST_ASSERT_EQUAL_UINT8(3, h.hopLimit());
+    TEST_ASSERT_EQUAL_UINT8(3, h.hopStart());
+    TEST_ASSERT_TRUE(h.wantAck());
+    TEST_ASSERT_FALSE(h.viaMqtt());
+    TEST_ASSERT_EQUAL_INT(0, h.hopsAway());
+
+    uint8_t relayed[16];
+    std::memcpy(relayed, kHeader, 16);
+    relayed[12] = 0xF1 | 0x10;  // hop start 7, via MQTT, hop limit 1
+    parseHeader(relayed, 16, h);
+    TEST_ASSERT_EQUAL_UINT8(1, h.hopLimit());
+    TEST_ASSERT_EQUAL_UINT8(7, h.hopStart());
+    TEST_ASSERT_TRUE(h.viaMqtt());
+    TEST_ASSERT_FALSE(h.wantAck());
+    TEST_ASSERT_EQUAL_INT(6, h.hopsAway());
+}
+
+void test_header_from_old_firmware_has_no_hop_start() {
+    uint8_t old[16];
+    std::memcpy(old, kHeader, 16);
+    old[12] = 0x02;  // hop limit 2, hop start 0: firmware before 2.3 didn't set it
+    PacketHeader h;
+    parseHeader(old, 16, h);
+    TEST_ASSERT_EQUAL_INT(-1, h.hopsAway());  // unknown, not "2 hops below zero"
+}
+
+void test_header_too_short() {
+    PacketHeader h;
+    TEST_ASSERT_FALSE(parseHeader(kHeader, 15, h));
+    TEST_ASSERT_FALSE(parseHeader(nullptr, 0, h));
+}
+
+void test_node_ids() {
+    TEST_ASSERT_EQUAL_STRING("!12345678", nodeId(0x12345678).c_str());
+    TEST_ASSERT_EQUAL_STRING("!0000abcd", nodeId(0xABCD).c_str());
+    TEST_ASSERT_EQUAL_STRING("all", nodeId(kBroadcast).c_str());
+}
+
+// Meshtastic shows these hashes for the default key ("AQ==").
+void test_channel_hash_with_default_key() {
+    TEST_ASSERT_EQUAL_UINT8(8, channelHash("LongFast", kDefaultKey, sizeof kDefaultKey));
+    TEST_ASSERT_EQUAL_UINT8(31, channelHash("MediumFast", kDefaultKey, sizeof kDefaultKey));
+}
+
+void test_djb2() {
+    TEST_ASSERT_EQUAL_UINT32(5381, djb2(""));
+    TEST_ASSERT_EQUAL_UINT32(130429955u, djb2("LongFast"));
+}
+
+void test_eu868_presets() {
+    TEST_ASSERT_EQUAL_size_t(7, kEu868PresetCount);
+    const Preset& lf = kEu868Presets[0];  // the default comes first
+    TEST_ASSERT_EQUAL_STRING("LongFast", lf.name);
+    TEST_ASSERT_EQUAL_FLOAT(250.0f, lf.bwKHz);
+    TEST_ASSERT_EQUAL_UINT8(11, lf.sf);
+    TEST_ASSERT_EQUAL_UINT8(5, lf.cr);
+    const Preset* ls = findPreset("LongSlow");
+    TEST_ASSERT_NOT_NULL(ls);
+    TEST_ASSERT_EQUAL_FLOAT(125.0f, ls->bwKHz);
+    TEST_ASSERT_EQUAL_UINT8(12, ls->sf);
+    TEST_ASSERT_EQUAL_UINT8(8, ls->cr);
+    TEST_ASSERT_NULL(findPreset("ShortTurbo"));  // 500 kHz doesn't fit the 250 kHz sub-band
+}
+
+// The frequency slot comes from the channel name's hash; an unnamed channel uses the preset's name.
+void test_eu868_frequencies() {
+    TEST_ASSERT_EQUAL_UINT32(869525000u, eu868FrequencyHz(*findPreset("LongFast")));
+    TEST_ASSERT_EQUAL_UINT32(869525000u, eu868FrequencyHz(*findPreset("MediumFast")));
+    TEST_ASSERT_EQUAL_UINT32(869462500u, eu868FrequencyHz(*findPreset("LongSlow")));
+    TEST_ASSERT_EQUAL_UINT32(869587500u, eu868FrequencyHz(*findPreset("LongMod")));
+    // A 250 kHz preset has one slot, whatever the channel's name.
+    TEST_ASSERT_EQUAL_UINT32(869525000u, eu868FrequencyHz(*findPreset("LongFast"), "Belgium"));
+}
+
+void test_radio_constants() {
+    TEST_ASSERT_EQUAL_HEX8(0x2B, kSyncWord);
+    TEST_ASSERT_EQUAL_UINT16(16, kPreambleLength);
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_header_fields);
+    RUN_TEST(test_header_flags);
+    RUN_TEST(test_header_from_old_firmware_has_no_hop_start);
+    RUN_TEST(test_header_too_short);
+    RUN_TEST(test_node_ids);
+    RUN_TEST(test_channel_hash_with_default_key);
+    RUN_TEST(test_djb2);
+    RUN_TEST(test_eu868_presets);
+    RUN_TEST(test_eu868_frequencies);
+    RUN_TEST(test_radio_constants);
+    return UNITY_END();
+}

test/test_packet_view/test_packet_view.cpp

@@ -0,0 +1,75 @@
+#include <unity.h>
+
+#include <string>
+#include <vector>
+
+#include "packet_view.h"
+
+using namespace roro::lora;
+
+void setUp() {}
+void tearDown() {}
+
+static const uint8_t kMeshtastic[] = {
+    0xFF, 0xFF, 0xFF, 0xFF, 0x78, 0x56, 0x34, 0x12, 0xEF, 0xBE, 0xAD, 0xDE,
+    0x62,  // hop start 3, hop limit 2: relayed once
+    0x08, 0x00, 0x42, 0x01, 0x02, 0x03,
+};
+
+void test_row_for_a_meshtastic_packet() {
+    PacketSummary p{kMeshtastic, sizeof kMeshtastic, -97.4f, 6.25f, true, true};
+    // Time, RSSI, SNR, then who sent it to whom (by default short name: the last 4 hex digits,
+    // as Meshtastic names a Node) and how far it came. Fits 40 columns with two node numbers.
+    TEST_ASSERT_EQUAL_STRING("21:45:07 -97 6.2 5678>all 1/3", row(p, "21:45:07").c_str());
+    const uint8_t direct[] = {0x0a, 0x0b, 0x0c, 0x0d, 0xc4, 0xd3, 0xb2, 0xa1, 1, 2, 3, 4, 0x6a, 8, 0, 0xaa};
+    PacketSummary d{direct, sizeof direct, -117.0f, -9.25f, true, true};
+    TEST_ASSERT_EQUAL_STRING("21:45:07 -117 -9.2 d3c4>0b0a 1/3", row(d, "21:45:07").c_str());
+    TEST_ASSERT_TRUE(row(d, "21:45:07").size() <= 38);
+}
+
+void test_row_for_something_else() {
+    const uint8_t data[] = {0x40, 0x01, 0x02};
+    PacketSummary p{data, sizeof data, -120.6f, -7.5f, true, false};
+    TEST_ASSERT_EQUAL_STRING("21:45:07 -121 -7.5 3 B", row(p, "21:45:07").c_str());
+}
+
+// Not on Meshtastic settings (LoRaWAN, say): the same bytes aren't read as a Meshtastic header.
+void test_row_not_meshtastic() {
+    PacketSummary p{kMeshtastic, sizeof kMeshtastic, -97.0f, 6.0f, true, false};
+    TEST_ASSERT_EQUAL_STRING("21:45:07 -97 6.0 19 B", row(p, "21:45:07").c_str());
+}
+
+void test_row_with_a_bad_crc() {
+    PacketSummary p{kMeshtastic, sizeof kMeshtastic, -97.0f, 6.0f, false, true};
+    TEST_ASSERT_EQUAL_STRING("21:45:07 -97 6.0 bad CRC, 19 B", row(p, "21:45:07").c_str());
+}
+
+void test_hex_dump() {
+    auto lines = hexDump(kMeshtastic, sizeof kMeshtastic);
+    TEST_ASSERT_EQUAL_size_t(3, lines.size());
+    TEST_ASSERT_EQUAL_STRING("0000 ff ff ff ff 78 56 34 12 ....xV4.", lines[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("0008 ef be ad de 62 08 00 42 ....b..B", lines[1].c_str());
+    TEST_ASSERT_EQUAL_STRING("0010 01 02 03                ...", lines[2].c_str());
+}
+
+void test_header_lines() {
+    auto lines = headerLines(kMeshtastic, sizeof kMeshtastic);
+    TEST_ASSERT_EQUAL_size_t(5, lines.size());
+    TEST_ASSERT_EQUAL_STRING("From !12345678 to all", lines[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("Packet deadbeef", lines[1].c_str());
+    TEST_ASSERT_EQUAL_STRING("Hops 1 of 3, limit 2 left", lines[2].c_str());
+    TEST_ASSERT_EQUAL_STRING("Channel 0x08 (LongFast, default key)", lines[3].c_str());
+    TEST_ASSERT_EQUAL_STRING("Relayed by ..42", lines[4].c_str());
+    TEST_ASSERT_EQUAL_size_t(0, headerLines(kMeshtastic, 12).size());  // too short to be Meshtastic
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_row_for_a_meshtastic_packet);
+    RUN_TEST(test_row_for_something_else);
+    RUN_TEST(test_row_not_meshtastic);
+    RUN_TEST(test_row_with_a_bad_crc);
+    RUN_TEST(test_hex_dump);
+    RUN_TEST(test_header_lines);
+    return UNITY_END();
+}

test/test_saved_networks/test_saved_networks.cpp

@@ -97,6 +97,76 @@ void test_find() {
     TEST_ASSERT_NULL(n.find("other"));
 }
 
+// S1, Q105: each Saved Network is Automatic (DHCP) or Fixed, and remembers which.
+void test_new_network_is_automatic() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("home", "password1");
+    TEST_ASSERT_FALSE(nets.find("home")->fixed);
+}
+
+void test_ip_setting_survives_reload() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("home", "password1");
+    nets.add("bench", "");
+    roro::net::FixedIp f;
+    TEST_ASSERT_EQUAL_STRING("", roro::net::parseFixed("10.39.39.13/24 10.39.39.1", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("", nets.setIp("bench", &f).c_str());
+
+    SavedNetworks again(store);
+    again.load();
+    TEST_ASSERT_FALSE(again.find("home")->fixed);
+    TEST_ASSERT_TRUE(again.find("bench")->fixed);
+    TEST_ASSERT_EQUAL_STRING("10.39.39.13/24 10.39.39.1", roro::net::formatFixed(again.find("bench")->ip).c_str());
+
+    TEST_ASSERT_EQUAL_STRING("", again.setIp("bench", nullptr).c_str());  // back to Automatic
+    SavedNetworks third(store);
+    third.load();
+    TEST_ASSERT_FALSE(third.find("bench")->fixed);
+}
+
+void test_ip_setting_is_checked() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("bench", "");
+    roro::net::FixedIp bad{0x0A272700, 24, 0};  // 10.39.39.0: the network's own address
+    TEST_ASSERT_EQUAL_STRING("10.39.39.0 is the network's own address", nets.setIp("bench", &bad).c_str());
+    TEST_ASSERT_FALSE(nets.find("bench")->fixed);
+    roro::net::FixedIp ok{0x0A27270D, 24, 0};
+    TEST_ASSERT_EQUAL_STRING("Not a saved network", nets.setIp("nowhere", &ok).c_str());
+}
+
+// Forgetting a network moves the ones after it: each keeps its own setting.
+void test_ip_setting_follows_its_network() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("a", "");
+    nets.add("b", "");
+    nets.add("c", "");
+    roro::net::FixedIp f{0x0A27270D, 24, 0};
+    nets.setIp("c", &f);
+    nets.forget("a");
+    SavedNetworks again(store);
+    again.load();
+    TEST_ASSERT_FALSE(again.find("b")->fixed);
+    TEST_ASSERT_TRUE(again.find("c")->fixed);
+    // And changing the password keeps it.
+    again.add("c", "password2");
+    TEST_ASSERT_TRUE(again.find("c")->fixed);
+}
+
+// A stored setting that no longer passes the checks falls back to Automatic.
+void test_bad_stored_ip_setting_is_ignored() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("bench", "");
+    store.strings["net0_ip"] = "10.39.39.13/99";
+    SavedNetworks again(store);
+    again.load();
+    TEST_ASSERT_FALSE(again.find("bench")->fixed);
+}
+
 int main() {
     UNITY_BEGIN();
     RUN_TEST(test_empty_store_has_no_networks);
@@ -107,5 +177,10 @@ int main() {
     RUN_TEST(test_validation_follows_wifi_limits);
     RUN_TEST(test_hidden_flag_survives_reload);
     RUN_TEST(test_find);
+    RUN_TEST(test_new_network_is_automatic);
+    RUN_TEST(test_ip_setting_survives_reload);
+    RUN_TEST(test_ip_setting_is_checked);
+    RUN_TEST(test_ip_setting_follows_its_network);
+    RUN_TEST(test_bad_stored_ip_setting_is_ignored);
     return UNITY_END();
 }

test/test_sd_card_id/test_sd_card_id.cpp

@@ -0,0 +1,54 @@
+#include <unity.h>
+
+#include "sd_card_id.h"
+
+using namespace roro;
+
+void setUp() {}
+void tearDown() {}
+
+// A SanDisk 8 GB card's CID: manufacturer 0x03, OEM "SD", product "SU08G", revision 8.0,
+// serial 0x1234ABCD, made in March 2014.
+static const uint8_t kSanDisk[16] = {0x03, 'S', 'D', 'S', 'U', '0', '8', 'G', 0x80,
+                                     0x12, 0x34, 0xAB, 0xCD, 0x00, 0xE3, 0xFF};
+
+void test_fields() {
+    SdCardId id = parseSdCid(kSanDisk);
+    TEST_ASSERT_EQUAL_HEX8(0x03, id.manufacturer);
+    TEST_ASSERT_EQUAL_STRING("SD", id.oem);
+    TEST_ASSERT_EQUAL_STRING("SU08G", id.product);
+    TEST_ASSERT_EQUAL_UINT8(8, id.revisionMajor);
+    TEST_ASSERT_EQUAL_UINT8(0, id.revisionMinor);
+    TEST_ASSERT_EQUAL_HEX32(0x1234ABCD, id.serial);
+    TEST_ASSERT_EQUAL_INT(2014, id.year);
+    TEST_ASSERT_EQUAL_INT(3, id.month);
+}
+
+// Clone cards put anything in the name: unprintable bytes mustn't reach the console.
+void test_unprintable_names() {
+    uint8_t cid[16] = {0x00, 0x00, 0x01, 'A', 0x00, 0xFF, 'B', ' ', 0x10};
+    SdCardId id = parseSdCid(cid);
+    TEST_ASSERT_EQUAL_STRING("??", id.oem);
+    TEST_ASSERT_EQUAL_STRING("A??B ", id.product);
+    TEST_ASSERT_EQUAL_UINT8(1, id.revisionMajor);
+}
+
+void test_manufacturer_names() {
+    TEST_ASSERT_EQUAL_STRING("SanDisk", sdManufacturerName(0x03));
+    TEST_ASSERT_EQUAL_STRING("Samsung", sdManufacturerName(0x1B));
+    TEST_ASSERT_EQUAL_STRING("unknown", sdManufacturerName(0xEE));
+}
+
+void test_summary_line() {
+    TEST_ASSERT_EQUAL_STRING("SanDisk (0x03) \"SD\" \"SU08G\" rev 8.0, serial 1234abcd, made 2014-03",
+                             sdCardSummary(parseSdCid(kSanDisk)).c_str());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_fields);
+    RUN_TEST(test_unprintable_names);
+    RUN_TEST(test_manufacturer_names);
+    RUN_TEST(test_summary_line);
+    return UNITY_END();
+}

test/test_settings/test_settings.cpp

@@ -28,6 +28,8 @@ void test_defaults_when_store_is_empty() {
     TEST_ASSERT_TRUE(s.getBool(Setting::WifiEnabled));
     TEST_ASSERT_TRUE(s.getBool(Setting::GnssEnabled));     // Q58: on by default
     TEST_ASSERT_FALSE(s.getBool(Setting::CoordinatesDms));  // Q64: decimal degrees
+    TEST_ASSERT_EQUAL_INT32(0, s.getInt(Setting::LoraPreset));  // Q95: LongFast
+    TEST_ASSERT_FALSE(s.setInt(Setting::LoraPreset, 7));        // seven EU868 presets
     TEST_ASSERT_EQUAL_STRING("EU868", s.getString(Setting::Region).c_str());
     TEST_ASSERT_EQUAL_STRING("CET-1CEST,M3.5.0,M10.5.0/3", s.getString(Setting::Timezone).c_str());
 }
@@ -152,6 +154,37 @@ void test_storage_keys_fit_nvs_limit() {
         TEST_ASSERT_TRUE(std::strlen(Settings::key(static_cast<Setting>(i))) <= 15);
 }
 
+// S1, Q108 to Q110: DNS and NTP servers, with public defaults.
+void test_dns_and_ntp_defaults() {
+    MemoryStore store;
+    EventBus bus;
+    Settings s(store, bus);
+    s.load();
+    TEST_ASSERT_EQUAL_STRING("9.9.9.9", s.getString(Setting::Dns1).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.1.1.1", s.getString(Setting::Dns2).c_str());
+    TEST_ASSERT_FALSE(s.getBool(Setting::DnsAlways));
+    TEST_ASSERT_EQUAL_STRING("pool.ntp.org", s.getString(Setting::Ntp1).c_str());
+    TEST_ASSERT_EQUAL_STRING("time.cloudflare.com", s.getString(Setting::Ntp2).c_str());
+}
+
+void test_dns_and_ntp_are_checked() {
+    MemoryStore store;
+    EventBus bus;
+    Settings s(store, bus);
+    s.load();
+    TEST_ASSERT_TRUE(s.setString(Setting::Dns1, "10.39.39.1"));
+    TEST_ASSERT_FALSE(s.setString(Setting::Dns1, "dns.example"));  // an address, not a name
+    TEST_ASSERT_FALSE(s.setString(Setting::Dns1, ""));             // the first one is required
+    TEST_ASSERT_EQUAL_STRING("10.39.39.1", s.getString(Setting::Dns1).c_str());
+    TEST_ASSERT_TRUE(s.setString(Setting::Dns2, ""));              // the second is optional
+    TEST_ASSERT_FALSE(s.setString(Setting::Dns2, "1.1.1"));
+    TEST_ASSERT_TRUE(s.setString(Setting::Ntp1, "10.39.39.1"));
+    TEST_ASSERT_TRUE(s.setString(Setting::Ntp1, "0.be.pool.ntp.org"));
+    TEST_ASSERT_FALSE(s.setString(Setting::Ntp1, "time server"));
+    TEST_ASSERT_FALSE(s.setString(Setting::Ntp1, ""));
+    TEST_ASSERT_TRUE(s.setString(Setting::Ntp2, ""));
+}
+
 int main() {
     UNITY_BEGIN();
     RUN_TEST(test_defaults_when_store_is_empty);
@@ -166,5 +199,7 @@ int main() {
     RUN_TEST(test_change_publishes_setting_changed_once);
     RUN_TEST(test_transmit_requires_confirmed_region);
     RUN_TEST(test_storage_keys_fit_nvs_limit);
+    RUN_TEST(test_dns_and_ntp_defaults);
+    RUN_TEST(test_dns_and_ntp_are_checked);
     return UNITY_END();
 }

test/test_sweep/test_sweep.cpp

@@ -0,0 +1,74 @@
+#include <unity.h>
+
+#include <vector>
+
+#include "sweep_view.h"
+
+using namespace roro::lora;
+
+void setUp() {}
+void tearDown() {}
+
+// 863.0 to 870.0 MHz in 100 kHz steps: 71 readings.
+static std::vector<int8_t> band(int8_t floor) { return std::vector<int8_t>(71, floor); }
+
+void test_floor_is_the_median() {
+    auto b = band(-95);
+    b[10] = -60;  // a few strong steps don't move the median
+    b[11] = -62;
+    b[50] = -70;
+    SweepStats s = summarize(b.data(), b.size(), 863000000, 100000);
+    TEST_ASSERT_EQUAL_INT(-95, s.floor);
+    TEST_ASSERT_EQUAL_INT(-60, s.top);
+}
+
+void test_peaks_strongest_first_and_merged() {
+    auto b = band(-95);
+    b[11] = -70;  // 864.1 MHz, with shoulders: one peak, not three
+    b[10] = -75;
+    b[12] = -78;
+    b[65] = -55;  // 869.5 MHz
+    b[30] = -90;  // only 5 dB above the floor: not a peak
+    SweepStats s = summarize(b.data(), b.size(), 863000000, 100000);
+    TEST_ASSERT_EQUAL_size_t(2, s.peaks.size());
+    TEST_ASSERT_EQUAL_UINT32(869500000u, s.peaks[0].hz);
+    TEST_ASSERT_EQUAL_INT(-55, s.peaks[0].dbm);
+    TEST_ASSERT_EQUAL_UINT32(864100000u, s.peaks[1].hz);
+}
+
+void test_at_most_three_peaks() {
+    auto b = band(-100);
+    for (int i = 5; i < 70; i += 10) b[i] = static_cast<int8_t>(-80 + i / 10);
+    SweepStats s = summarize(b.data(), b.size(), 863000000, 100000);
+    TEST_ASSERT_EQUAL_size_t(3, s.peaks.size());
+    TEST_ASSERT_EQUAL_INT(-74, s.peaks[0].dbm);  // the strongest three
+}
+
+void test_flat_band_has_no_peaks() {
+    auto b = band(-88);
+    SweepStats s = summarize(b.data(), b.size(), 863000000, 100000);
+    TEST_ASSERT_EQUAL_size_t(0, s.peaks.size());
+    TEST_ASSERT_EQUAL_INT(-88, s.floor);
+}
+
+// The waterfall's scale: dark at the bottom, through blue and green to red at the top.
+void test_heat_scale() {
+    TEST_ASSERT_EQUAL_UINT8(0, heatLevel(-130, -120, -60));
+    TEST_ASSERT_EQUAL_UINT8(0, heatLevel(-120, -120, -60));
+    TEST_ASSERT_EQUAL_UINT8(255, heatLevel(-60, -120, -60));
+    TEST_ASSERT_EQUAL_UINT8(255, heatLevel(-20, -120, -60));
+    TEST_ASSERT_EQUAL_UINT8(128, heatLevel(-90, -120, -60));
+    TEST_ASSERT_TRUE(heatColor(0) != heatColor(255));
+    TEST_ASSERT_EQUAL_HEX16(0x0000, heatColor(0));  // black
+    TEST_ASSERT_EQUAL_HEX16(0xF800, heatColor(255));  // red
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_floor_is_the_median);
+    RUN_TEST(test_peaks_strongest_first_and_merged);
+    RUN_TEST(test_at_most_three_peaks);
+    RUN_TEST(test_flat_band_has_no_peaks);
+    RUN_TEST(test_heat_scale);
+    return UNITY_END();
+}

test/test_task_stats/test_task_stats.cpp

@@ -0,0 +1,160 @@
+#include <unity.h>
+
+#include <vector>
+
+#include "task_stats.h"
+
+using namespace roro;
+
+void setUp() {}
+void tearDown() {}
+
+static TaskSample task(uint32_t id, const char* name, uint32_t runtime, uint16_t stackFree = 2000, int core = 1) {
+    TaskSample t;
+    t.id = id;
+    std::snprintf(t.name, sizeof t.name, "%s", name);
+    t.runtime = runtime;
+    t.stackFree = stackFree;
+    t.core = static_cast<int8_t>(core);
+    t.state = 2;  // blocked, unless a test says it's the one running
+    return t;
+}
+
+static const TaskRow* find(const std::vector<TaskRow>& rows, const char* name) {
+    for (auto& r : rows)
+        if (r.name == name) return &r;
+    return nullptr;
+}
+
+// Q119: a task's share is its run time over the interval between two samples, in tenths of a percent.
+void test_shares_over_the_interval() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 5000000), task(2, "IDLE1", 1000000), task(3, "IDLE0", 4000000, 240, 0),
+                                      task(4, "wifi", 900000, 4000, 0)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 5810000), task(2, "IDLE1", 1170000), task(3, "IDLE0", 4780000, 240, 0),
+                                   task(4, "wifi", 1090000, 4000, 0)};
+    auto rows = taskRows(before, 10000000, now, 11000000);  // one second later
+    TEST_ASSERT_EQUAL_size_t(4, rows.size());
+    TEST_ASSERT_EQUAL_UINT16(810, find(rows, "loopTask")->permille);
+    TEST_ASSERT_EQUAL_UINT16(170, find(rows, "IDLE1")->permille);
+    TEST_ASSERT_EQUAL_UINT16(780, find(rows, "IDLE0")->permille);
+    TEST_ASSERT_EQUAL_UINT16(190, find(rows, "wifi")->permille);
+    // A core's load is what its idle task didn't use.
+    TEST_ASSERT_EQUAL_INT(22, coreLoad(rows, 0));
+    TEST_ASSERT_EQUAL_INT(83, coreLoad(rows, 1));
+    TEST_ASSERT_EQUAL_INT(-1, coreLoad(rows, 2));
+}
+
+// FreeRTOS adds to a task's run time when it's switched out. The task doing the sampling is
+// running: if nothing else wanted its core, it was never switched out and its counter hardly
+// moved. Its real share is what's left of its core.
+void test_the_running_task_gets_what_is_left_of_its_core() {
+    auto running = [](TaskSample t) {
+        t.state = 0;  // eRunning
+        return t;
+    };
+    std::vector<TaskSample> before = {running(task(1, "loopTask", 5000000)), task(2, "IDLE1", 1000000), task(3, "radio", 100),
+                                      task(4, "IDLE0", 4000000, 240, 0), task(5, "wifi", 900000, 4000, 0)};
+    std::vector<TaskSample> now = {running(task(1, "loopTask", 5020000)), task(2, "IDLE1", 1000000), task(3, "radio", 30100),
+                                   task(4, "IDLE0", 4980000, 240, 0), task(5, "wifi", 910000, 4000, 0)};
+    auto rows = taskRows(before, 0, now, 1000000);
+    TEST_ASSERT_EQUAL_UINT16(970, find(rows, "loopTask")->permille);  // not the 2 % its counter says
+    TEST_ASSERT_EQUAL_UINT16(30, find(rows, "radio")->permille);
+    TEST_ASSERT_EQUAL_UINT16(10, find(rows, "wifi")->permille);  // another core: untouched
+    TEST_ASSERT_EQUAL_INT(100, coreLoad(rows, 1));
+    TEST_ASSERT_EQUAL_INT(2, coreLoad(rows, 0));
+}
+
+// When its counter did keep up (it was switched out often), nothing is added.
+void test_the_running_task_keeps_its_own_count_when_it_is_higher() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 0), task(2, "IDLE1", 0)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 600000), task(2, "IDLE1", 400000)};
+    now[0].state = before[0].state = 0;
+    auto rows = taskRows(before, 0, now, 1000000);
+    TEST_ASSERT_EQUAL_UINT16(600, find(rows, "loopTask")->permille);
+}
+
+// The counters are 32-bit microseconds: they wrap every 71 minutes.
+void test_counters_wrap() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 0xFFFFF000u)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 0x0007A120u - 0x1000u)};  // 500 ms of run time later
+    auto rows = taskRows(before, 0xFFFF0000u, now, 0xFFFF0000u + 1000000u);
+    TEST_ASSERT_EQUAL_UINT16(500, rows[0].permille);
+}
+
+void test_tasks_come_and_go() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 100), task(7, "gemini", 50000)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 400100), task(9, "gemini", 30000)};  // a new gemini task: another id
+    auto rows = taskRows(before, 0, now, 1000000);
+    TEST_ASSERT_EQUAL_size_t(2, rows.size());
+    TEST_ASSERT_EQUAL_UINT16(400, find(rows, "loopTask")->permille);
+    TEST_ASSERT_EQUAL_UINT16(30, find(rows, "gemini")->permille);  // all its run time is inside the interval
+}
+
+void test_no_time_passed() {
+    std::vector<TaskSample> one = {task(1, "loopTask", 100)};
+    auto rows = taskRows(one, 500, one, 500);
+    TEST_ASSERT_EQUAL_UINT16(0, rows[0].permille);
+    TEST_ASSERT_EQUAL_INT(-1, coreLoad(rows, 1));  // no idle task in the sample
+}
+
+// Q122: under 512 bytes of stack left is flagged.
+void test_low_stack() {
+    std::vector<TaskSample> s = {task(1, "spk_task", 0, 264), task(2, "IDLE0", 0, 240, 0), task(3, "radio", 0, 2360),
+                                 task(4, "edge", 0, 512)};
+    auto rows = taskRows(s, 0, s, 1000);
+    TEST_ASSERT_TRUE(find(rows, "spk_task")->lowStack);
+    TEST_ASSERT_TRUE(find(rows, "IDLE0")->lowStack);
+    TEST_ASSERT_FALSE(find(rows, "radio")->lowStack);
+    TEST_ASSERT_FALSE(find(rows, "edge")->lowStack);
+}
+
+void test_sorting() {
+    std::vector<TaskSample> before = {task(1, "wifi", 0, 4000), task(2, "loopTask", 0, 2800), task(3, "IDLE0", 0, 240),
+                                      task(4, "irc", 0, 3600)};
+    std::vector<TaskSample> now = {task(1, "wifi", 190000, 4000), task(2, "loopTask", 810000, 2800), task(3, "IDLE0", 780000, 240),
+                                   task(4, "irc", 0, 3600)};
+    auto rows = taskRows(before, 0, now, 1000000);
+    sortTasks(rows, TaskSort::Share);  // busiest first, idle tasks last: they're what's left over
+    TEST_ASSERT_EQUAL_STRING("loopTask", rows[0].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("wifi", rows[1].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("irc", rows[2].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("IDLE0", rows[3].name.c_str());
+    sortTasks(rows, TaskSort::Stack);  // least stack left first
+    TEST_ASSERT_EQUAL_STRING("IDLE0", rows[0].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("loopTask", rows[1].name.c_str());
+    sortTasks(rows, TaskSort::Name);  // letters only, whatever the case
+    TEST_ASSERT_EQUAL_STRING("IDLE0", rows[0].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("irc", rows[1].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("loopTask", rows[2].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("wifi", rows[3].name.c_str());
+}
+
+// Q120: two minutes of history, the oldest sample dropped first.
+void test_history() {
+    History<uint8_t, 4> h;
+    TEST_ASSERT_EQUAL_size_t(0, h.size());
+    for (uint8_t v : {10, 20, 30}) h.push(v);
+    TEST_ASSERT_EQUAL_size_t(3, h.size());
+    TEST_ASSERT_EQUAL_UINT8(10, h.at(0));
+    TEST_ASSERT_EQUAL_UINT8(30, h.at(2));
+    for (uint8_t v : {40, 50, 60}) h.push(v);
+    TEST_ASSERT_EQUAL_size_t(4, h.size());
+    TEST_ASSERT_EQUAL_UINT8(30, h.at(0));  // oldest kept
+    TEST_ASSERT_EQUAL_UINT8(60, h.at(3));  // newest
+    h.clear();
+    TEST_ASSERT_EQUAL_size_t(0, h.size());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_shares_over_the_interval);
+    RUN_TEST(test_the_running_task_gets_what_is_left_of_its_core);
+    RUN_TEST(test_the_running_task_keeps_its_own_count_when_it_is_higher);
+    RUN_TEST(test_counters_wrap);
+    RUN_TEST(test_tasks_come_and_go);
+    RUN_TEST(test_no_time_passed);
+    RUN_TEST(test_low_stack);
+    RUN_TEST(test_sorting);
+    RUN_TEST(test_history);
+    return UNITY_END();
+}

test/test_traffic/test_traffic.cpp

@@ -0,0 +1,54 @@
+#include <unity.h>
+
+#include "traffic.h"
+
+using namespace roro::net;
+
+void setUp() { resetTraffic(); }
+void tearDown() {}
+
+void test_counts_per_service() {
+    received(User::Irc, 100);
+    received(User::Irc, 20);
+    sent(User::Irc, 7);
+    sent(User::Gemini, 40);
+    TEST_ASSERT_EQUAL_UINT32(120, traffic(User::Irc).in);
+    TEST_ASSERT_EQUAL_UINT32(7, traffic(User::Irc).out);
+    TEST_ASSERT_EQUAL_UINT32(0, traffic(User::Gemini).in);
+    TEST_ASSERT_EQUAL_UINT32(40, traffic(User::Gemini).out);
+    TEST_ASSERT_EQUAL_UINT32(0, traffic(User::Updates).in);
+}
+
+void test_names() {
+    TEST_ASSERT_EQUAL_STRING("IRC", userName(User::Irc));
+    TEST_ASSERT_EQUAL_STRING("Gemini", userName(User::Gemini));
+    TEST_ASSERT_EQUAL_STRING("Debug Console", userName(User::DebugConsole));
+    TEST_ASSERT_EQUAL_STRING("Updates", userName(User::Updates));
+}
+
+// Bytes a second between two readings; the counter wraps at 4 GB like any uint32.
+void test_rate() {
+    TEST_ASSERT_EQUAL_UINT32(1000, bytesPerSecond(5000, 6000, 1000));
+    TEST_ASSERT_EQUAL_UINT32(500, bytesPerSecond(0, 1000, 2000));
+    TEST_ASSERT_EQUAL_UINT32(0, bytesPerSecond(7, 7, 1000));
+    TEST_ASSERT_EQUAL_UINT32(20, bytesPerSecond(0xFFFFFFF6u, 10, 1000));
+    TEST_ASSERT_EQUAL_UINT32(0, bytesPerSecond(1, 2, 0));
+}
+
+void test_sizes_for_humans() {
+    TEST_ASSERT_EQUAL_STRING("0 B", formatTraffic(0).c_str());
+    TEST_ASSERT_EQUAL_STRING("999 B", formatTraffic(999).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.5 KB", formatTraffic(1536).c_str());
+    TEST_ASSERT_EQUAL_STRING("12 KB", formatTraffic(12 * 1024 + 100).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.7 MB", formatTraffic(1774688).c_str());
+    TEST_ASSERT_EQUAL_STRING("48 MB", formatTraffic(48u * 1024 * 1024).c_str());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_counts_per_service);
+    RUN_TEST(test_names);
+    RUN_TEST(test_rate);
+    RUN_TEST(test_sizes_for_humans);
+    return UNITY_END();
+}