F1 plan: Notes ships as v0.10.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

CONTEXT.md

@@ -69,7 +69,7 @@ The Service that owns the Wi-Fi radio. It's always in exactly one mode: *Off*, *
 _Avoid_: network manager
 
 **Saved Network**:
-A Wi-Fi network the device may join on its own (name, password). When several are in range, the strongest wins.
+A Wi-Fi network the device may join on its own: its name, its password, and how it gets its address, *Automatic* (DHCP) or *Fixed* (an address, a prefix and an optional gateway typed in Settings). When several are in range, the strongest wins.
 _Avoid_: profile, known network
 
 **IRC Service**:
@@ -123,10 +123,22 @@ Data the user explicitly starts recording, such as Wi-Fi packet captures and LoR
 _Avoid_: dump, log
 
 **Storage Warning**:
-The Notification raised once per boot when the SD card passes 80% full. Selecting it opens Storage Clean-up.
+The Notification raised once per boot when the SD card passes 80% full. It points at the Storage App, where Maintenance holds Storage Clean-up.
 
 **Storage Clean-up**:
-The screen where the user deletes old Logs and Captures by category and age, with a preview of the space freed. Notes are never offered for deletion.
+The screen where the user deletes old Logs and Captures by category and age, with a preview of the space freed. Notes are never offered for deletion. It lives in the Storage App, under Maintenance.
+
+**Note**:
+A plain text file in `/notes`, written on the device in the Notes App. Listed by its first line. Saved without being asked; never offered by Storage Clean-up.
+_Avoid_: memo, document
+
+**Storage App**:
+The App that browses the SD card: folders and files, a clipboard for one item at a time (copy, cut, paste), rename, delete, new folder, and a viewer for each kind of file the firmware writes. The top-level folders, `/gemini/cache` and files being written are read-only.
+_Avoid_: file manager, Files, explorer
+
+**Maintenance**:
+The part of the Storage App that deletes in bulk: the card's usage, Storage Clean-up and erasing the card. Reached through a warning.
+_Avoid_: Settings > Storage
 
 **Firmware Update**:
 Installing a new firmware image without a USB cable: pushed over Wi-Fi from the developer's PC, or read from the SD card.

README.md

@@ -54,6 +54,24 @@ To install from the SD card instead, copy the `.ota` file from `.pio/build/cardp
 
 **The private key** lives in `~/.config/roro9stack/ota-key.pem` and must never be committed. If it's lost, generate a new pair and flash once over USB.
 
+## Networks without DHCP
+
+Each Saved Network gets its address automatically (DHCP) or has a Fixed one (docs/milestones/S1.md): in Settings > Wi-Fi, Enter on a network opens its page, where "IP address" switches between Automatic and Fixed, with an address, a prefix length (24 is 255.255.255.0) and an optional gateway. Switching to Fixed starts from what the network is giving the device at that moment. The setting is checked and applied when you leave the page. IPv4 only.
+
+"DNS and NTP" on the same screen holds two DNS servers (9.9.9.9 and 1.1.1.1 by default), used on Fixed networks, or on every network with "Always use my DNS"; and two NTP servers (pool.ntp.org and time.cloudflare.com), used after any the network's DHCP offers. Enter on "Status" shows what's in use and where each value came from.
+
+## System
+
+The System App (docs/milestones/S1.md) shows what the device is doing, live and read-only, in any build. Tab moves between five views:
+
+- **Overview:** each core's load, free memory, network traffic, battery, uptime and chip temperature, and both cores' load over the last two minutes.
+- **Tasks:** every FreeRTOS task with its core, its share of a core over the last second, and the least stack it ever had left (in the warning colour under 512 bytes). `s` sorts by share, stack or name.
+- **Memory:** free heap, the lowest since boot and the largest free block, with two minutes of free heap drawn against the three memory floors (55, 40 and 20 KB).
+- **Network:** the connection, then for IRC, Gemini, the Debug Console and Firmware Updates the bytes read and written since boot and what's moving now. For TLS connections these are the bytes the service sees, without the encryption overhead.
+- **System:** what `info` prints, plus the battery, the SD card with its write faults, the radio and the GNSS receiver.
+
+It samples once a second and keeps its history only while it's open.
+
 ## Gemini
 
 The Gemini App browses Geminispace (docs/milestones/G1.md): Tab and Shift+Tab pick a link, Enter follows it, Back returns (to where the page was scrolled), Space pages down, `g` types an address. Certificates are trusted on first use; a changed one stops the page and asks.
@@ -62,7 +80,42 @@ On a page, `b` bookmarks it, `s` saves it to the SD card to read offline (a non-
 
 ## LoRa Scanner
 
-The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **never transmits**. The Sniffer lists what it hears, newest first: time, RSSI, SNR, and for Meshtastic packets the sender and receiver (their last 4 hex digits) and hops. Enter shows a packet's details: the Meshtastic header (which is never encrypted) and a hex dump. `p` picks one of the 7 Meshtastic presets allowed in EU868 (LongFast by default), `c` starts or stops a Capture: a pcap file with LoRaTap headers in `/captures/lora/`, for Wireshark. A Capture keeps recording with the App closed; otherwise the radio sleeps when the App isn't open. Tab switches to **Sweep**: the signal strength across 863–870 MHz in 100 kHz steps, as bars with peak hold and a waterfall, with the Sniffer's frequency marked; the Sniffer is paused meanwhile and picks up where it was. The Status Bar shows `L` while the radio listens (bright for a moment on each packet), `SW` while sweeping, and `CAP` while capturing.
+The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **never transmits**. The Sniffer lists what it hears, newest first: time, RSSI, SNR, and for Meshtastic packets the sender and receiver (their last 4 hex digits) and hops. Enter shows a packet's details: the Meshtastic header (which is never encrypted) and a hex dump. `p` picks one of the 7 Meshtastic presets allowed in EU868 (LongFast by default), `c` starts or stops a Capture: a pcap file with LoRaTap headers in `/captures/lora/`, for Wireshark. A Capture keeps recording with the App closed; otherwise the radio sleeps when the App isn't open. Tab switches to **Sweep**: the signal strength across 863–870 MHz in 100 kHz steps, as bars with peak hold and a waterfall, with the Sniffer's frequency marked; the Sniffer is paused meanwhile and picks up where it was. The GNSS receiver on the same Cap raises the radio's noise floor by 8 dB while it runs: Settings > "Pause GNSS for LoRa" (off by default) puts it in standby while the radio listens, except during a Track. The Status Bar shows `L` while the radio listens (bright for a moment on each packet), `SW` while sweeping, and `CAP` while capturing.
+
+## Storage
+
+The Storage App (docs/milestones/F1.md) shows what's on the SD card: each folder's entries with their size and date, folders first. Enter opens a folder, Back goes up; `s` sorts by name, date or size. It works on one item at a time, with a clipboard:
+
+| Key | Does |
+|---|---|
+| `c` / `x` | Copies or cuts the selected file or folder; the footer shows what `v` would paste |
+| `v` | Pastes it into the folder shown. A copy next to its original is named `name (2).txt`; anything in the way is asked about first |
+| `r` | Renames |
+| `d` | Deletes, after saying what's inside: "Delete saved and its 42 files (1.2 MB)?" |
+| `n` | Makes a folder |
+| `i` | Details: type, exact size, date, and why an item is read-only if it is |
+
+A copy runs in the background of the card (about 400 KB a second) in short turns, so Logs and Captures keep being written; it shows its progress, Back cancels it and takes back what was copied, and each file's size is checked afterwards. Three things can't be changed: the top-level folders the firmware keeps its files in (what's inside them can), `/gemini/cache`, and any file being written right now (today's IRC Logs, a Track or a Capture being recorded). The App says why when it refuses. A folder with more than 256 entries shows the first 256 by name and says so.
+
+Enter on a file opens it by type; Tab switches to the same file as a hex dump or as text:
+
+- **Text** (`.txt`, `.log`, `.gmi`, `.csv`, and anything that looks like text): only the screen's worth is read from the card, so a file of any size opens at once. Logs open at the end. Up and Down move a line, Left and Right a page, `t` and `b` go to the top and the end, `e` edits it (up to 16 KB, see Notes).
+- **Captures** (`.pcap`): the packets as the LoRa Scanner lists them; Enter shows one with its Meshtastic header and bytes.
+- **Tracks** (`.gpx`): the number of points, the start, the duration and the distance.
+- **Update Files** (`.ota`): the version, and whether the file would install: it's checked as an install checks it (signature and contents) without writing anything. Enter then installs it.
+- **Anything else:** a hex dump.
+
+At the top of the card the last row, **Maintenance** (also `m`), holds the card's usage, Storage Clean-up and "Erase SD card", behind a warning: those delete for good. It replaces Settings > Storage.
+
+## Notes
+
+The Notes App (docs/milestones/F1.md) keeps plain text notes in `/notes` on the SD card. The list shows each note's first line and its date, newest first; `s` switches to by file name. `n` starts a note, Enter opens one, `r` renames its file, `d` deletes it after asking.
+
+In the editor, type. Enter starts a line, Del deletes backwards, Fn with the arrows moves the cursor through the wrapped text, Ctrl+A and Ctrl+E go to the start and the end of the line, Tab types two spaces, and the Compose Key gives accents as everywhere. **There's no save key:** the note is written five seconds after the last key, on Back, on leaving the App, when the screen turns off and before the device powers off. The top line says "typing" or "saved". Each save writes a temporary file and then puts it in the note's place, so a power cut costs a few seconds of typing and never the note; if a save was cut short, opening the note offers its copy back.
+
+A new note has no file until something is typed; its file is then named after its first line (`shopping-list.txt`), or `note-<date>-<time>.txt`.
+
+A note holds up to 16 KB while it's edited. A bigger text file opens read-only in the Storage App (editing any size is issue #47). The Storage App's text viewer has `e` to edit a file with the same editor, anywhere on the card, unless the file is read-only.
 
 ## Development aids
 
@@ -75,9 +128,12 @@ The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **neve
 | `sound on` / `sound off` | Toggles the Sound setting (beep + LED) |
 | `short` / `normal` | Screen timeouts 5 s / 10 s, or 30 s / 60 s |
 | `wifi add <ssid><TAB><password>` | Adds a Saved Network (so credentials stay out of the repo) |
+| `wifi ip <ssid> dhcp` / `wifi ip <ssid> <address>/<prefix> [gateway]` | A Saved Network's IP setting: Automatic, or Fixed. Debug Builds: add `try <seconds>` to go back to the previous setting unless `wifi ip keep` follows |
+| `wifi dns <a> [b]` / `wifi dns always on\|off` / `wifi ntp <a> [b]` | DNS servers (used on Fixed networks, or always), and NTP servers |
 | `log <text>` | Appends a line to a test IRC Log (`/irc/dev/#test/<date>.log`) |
 | `sd card` | What the SD card says it is: type, size, and its identity register (maker, name, revision, serial, date) |
 | `sd list` | Lists the files of each Storage Clean-up category |
+| `sd fill <folder> <count>` | Debug Builds: makes that many small files in a folder, to test a crowded one |
 | `cat <path>` | Prints the first ~1.2 KB of a file on the SD card |
 | `irc start` | Starts the IRC Service (normally done by opening the IRC App) |
 | `irc stop` | Stops it, as `/quit` does: QUIT if connected, no more retries, and the App stays disconnected until you type |
@@ -85,12 +141,14 @@ The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **neve
 | `gemini trust <host> <port> <sha256>` | Pins a certificate by hand (the Gemini App asks when one changes) |
 | `irc say <buffer> <text>` | Types into a Buffer, commands included (`irc say 0 /join #test`) |
 | `irc dump` | Prints IRC status, memory, and the last lines of each Buffer |
-| `wifi status` | Prints Wi-Fi state, network, signal, clock and free heap |
+| `wifi status` | Prints Wi-Fi state, network, signal, clock and free heap, then the address, gateway, DNS and NTP servers in use and where each came from |
 | `info` | Firmware, uptime, last start reason, memory, Wi-Fi, the SD card and its write faults since boot, and both app slots with their versions and OTA states |
-| `tasks` | FreeRTOS tasks: state, priority, lowest free stack, CPU share |
+| `tasks` | FreeRTOS tasks over the next second: state, priority, lowest free stack, share of a core, each core's load, and how many passes the main loop made |
+| `net` | Bytes each network service has read and written since boot |
 | `reboot` / `boot other` | Restart, or restart into the other app slot (a manual Rollback) |
 | `log level <0-5>` | ESP-IDF log level |
-| `ls [folder]` / `rm <path>` | Lists a folder of the SD card, or deletes a file |
+| `ls [folder]` / `du <path>` | Lists a folder of the SD card with sizes and dates, or counts the files and bytes under a path |
+| `cp [-f] <from> <to>` / `mv [-f] <from> <to>` / `rm <path>` / `mkdir <path>` / `cancel` | What the Storage App does, with its rules: copy (folders too), move or rename, delete (a folder with what's in it), new folder. `-f` replaces a file that's in the way; a tab separates paths that hold spaces; `cancel` stops a copy or a delete |
 | `install <path>` | Update from SD with that `.ota` file, as Settings → Firmware does |
 | `lora probe` | Finds the radio: chip, oscillator, antenna switch, DIO1 interrupt, noise floor |
 | `lora status` | Radio settings, who's listening, packet and error counters, noise floor, task stack |
@@ -98,9 +156,12 @@ The LoRa Scanner (docs/milestones/M3.md) listens with the Cap's radio and **neve
 | `lora preset <name>` / `lora custom <MHz> <BW kHz> <SF> <CR> <sync hex> [preamble]` | Receive settings: a Meshtastic preset, or anything else (`lora custom 868.1 125 7 5 34 8` for LoRaWAN) |
 | `lora capture start` / `lora capture stop` | A LoRa Capture, as `c` in the App |
 | `lora sweep on [from MHz] [to MHz] [step kHz]` / `lora sweep off` / `lora sweep dump` | Sweep a band (863 870 100 by default), with a summary every 2 s (floor, strongest, peaks), or print the latest pass |
+| `gnss quiet on` / `gnss quiet off` | The "Pause GNSS for LoRa" setting |
+| `lora noise test [gnss\|quiet]` / `lora noise report` | Debug Builds: Sweep under one changed condition at a time to find what raises the noise floor (Wi-Fi goes off for a few seconds); then the result |
 | `lora inject <hex> [rssi] [snr]` | Debug Builds: a packet into the Scanner as if received (nothing is sent) |
 | `crash` | The last crash: which firmware, why, task, PC and backtrace (from the core dump in flash) |
 | `coredump erase` | Forgets the core dump |
+| `loop spin on` / `loop spin off` | Debug Builds: make the main loop spin without resting, to compare load and radio noise |
 | `crash abort` / `crash wdt` | Debug Builds: crash on purpose, or hang the main loop until the watchdog fires |
 | `help` | Lists the commands |
 

docs/milestones/F1.md

@@ -0,0 +1,161 @@
+# F1 — Files and Notes
+
+**Status:** in progress. The Storage App (issue #3) shipped as **v0.9.0** on 2026-10-06. Notes (#19) shipped as **v0.10.0** the same day. The card as a USB drive (#1) comes after.
+
+**Goal:** get at what's on the SD card from the device itself: browse it, look inside the files the firmware writes, copy, move, rename and delete, and keep notes. A side milestone, like G1 and S1; Files and Notes were M3's original second half (Q30, Q89).
+
+## The Storage App (issue #3)
+
+Until now the card could be looked at only through the Debug Console (`ls`, `get`, `put`), and Settings > Storage could only delete whole categories by age.
+
+**On the card today:** six top-level folders, `irc`, `wifi`, `updates`, `gnss`, `gemini` and `captures`. No `notes` yet; settings are in flash, not on the card.
+
+### Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q128 | An App of its own, **Storage**, in the Launcher. **Settings > Storage goes away:** its usage figures, Storage Clean-up and "Erase SD card" move into the App, under **Maintenance**, behind a warning that these delete things for good. |
+| Q129 | A row shows the name, then the size or "folder", then the date modified. Folders first, then by name; `s` cycles the sort (name, date, size). The top line shows the path and the card's free space. |
+| Q130 | Nothing is hidden. **Read-only:** `/gemini/cache`; any file the firmware has open right now (today's IRC log, a Track or Capture being recorded, a file being received); and the top-level folders themselves, which can't be renamed or deleted though their contents can. **Everything else, the user's own data included, can be renamed, moved or deleted**, always after a confirmation. |
+| Q131 | One item at a time, with a clipboard: Enter opens; Back goes up, and leaves the App at the top; `c` copy, `x` cut, `v` paste into the current folder; `r` rename; `d` delete; `n` new folder; `i` details. |
+| Q132 | Copy, move and delete work on folders too, recursively. The confirmation says what's inside: "Delete *saved* and its 42 files?". |
+| Q133 | A copy is a job on the storage task in 4 KB pieces, with a progress Toast; Back cancels it. It checks free space first and asks before replacing anything. **Afterwards the sizes are compared**, not the contents: the driver is trusted since v0.6.1 (ADR 0007). A move within the card is a rename. |
+| Q134 | Viewers by type. **Text** (`.txt`, `.log`, `.gmi`, `.csv`, `.gpx`, and anything that looks like text): read from the card as you scroll, so size doesn't matter; logs open at the end. **`.pcap`:** the LoRa Scanner's packet list. **`.gpx`:** a summary (start, duration, points, distance), Tab for the text. **`.ota`:** version, size, whether the signature is valid; Enter installs through Update from SD. **Anything else:** a hex dump. |
+| Q135 | No editing: that comes with Notes (#19). |
+| Q136 | A listing holds **up to 256 entries**, packed, about 10 KB; a bigger folder shows the first 256 by name and says how many more there are. The App refuses to open below the memory floors (Q86). |
+| Q137 | **The Clock also sets the system time**, so files are dated correctly with GNSS alone and not only after NTP. A file dated before 2020 shows "-". |
+| Q138 | Console: `cp`, `mv` and `mkdir`, next to `ls` and `rm`. |
+| Q139 | Left out, each with its issue: selecting several items (#41), finding files by name (#42), opening a `.gmi` in the Gemini App (#43), a table view for `.csv` (#44), images (#45). |
+| Q140 | Ships as **v0.9.0** when done and checked. |
+
+### Done when
+
+- The Storage App lists any folder of the card with sizes and dates, sorted three ways, and says so when a folder has more than 256 entries.
+- A file can be copied, moved, renamed and deleted, and a folder too; a new folder can be made. Each destructive action asks first; a copy shows progress and can be cancelled.
+- The read-only rules of Q130 hold, with a reason given when something is refused.
+- Each viewer of Q134 opens its type, and a 1 MB text file scrolls without loading whole.
+- Maintenance shows the card's usage and does what Settings > Storage did, behind its warning; Settings no longer has a Storage row; the Storage Warning points at the Storage App.
+- A file written with only a GNSS Fix (no Wi-Fi) is dated correctly.
+- Free heap stays above the floors with the App open, Wi-Fi and IRC on TLS.
+
+### Work breakdown
+
+1. **Model** (host-tested): paths and names, the read-only rules, the packed listing and its sorts, file types, sizes and dates for display, the GPX summary.
+2. **Card operations:** listing a folder, copy, move, delete (recursive, counted), new folder, as storage jobs with progress and cancel; `cp`, `mv`, `mkdir`; the Clock sets the system time.
+3. **The App:** browsing, the clipboard, dialogs, details.
+4. **Maintenance:** usage, Clean-up and Erase moved in from Settings, with the warning.
+5. **Viewers:** text, hex, `.pcap`, `.gpx`, `.ota`.
+6. **Checks on the device**, recorded here.
+
+### As built
+
+- **`FileOps`** (`src/services/file_ops`) does the card's work for the App and for the console alike: list, count, copy, move, delete, new folder. One operation at a time on the storage task, **in turns of about 150 ms** that queue themselves again, so Log lines and a Capture are written in between. The rules of Q130 are checked there, whoever asks.
+- **A listing reads the folder straight from FatFs.** Through the Arduino `File`, every entry was looked up by name again for its size and again for its date: 329 entries took over two seconds. One pass now, and it's there before the screen has redrawn. Counting, copying and deleting still walk with `File`; they show progress and can be stopped.
+- **A copy shows its progress in a box in the App**, not a Toast (Q133): it has a bar and says Back cancels. A cancelled or failed copy deletes what it had written. The copy gets today's date, like `cp`.
+- **The viewers** (`src/apps/file_viewer`, models in `lib/files`): text through `TextPager`, which reads about a kilobyte around the screen and wraps at spaces, 38 columns; going back a line wraps the paragraph before again, so a file reads the same in both directions. A `.pcap`, a `.gpx` and an `.ota` are read through once by a storage job, in the same 150 ms turns. An Update File is fed to the installer's own parser with a sink that writes nothing, so "would it install" is the same answer an install gives.
+- **Tab** in a viewer shows the same file as hex, or as text (not in Q134).
+- **Maintenance** is the last row at the top of the card, and `m` anywhere in the App. It's the old Settings > Storage page behind a dialog.
+- **The Storage Warning** was only ever a Toast; "selecting it opens Storage Clean-up" (CONTEXT.md) was never built. It now reads "SD card over 80% full: see Storage".
+- **Console:** `cp`, `mv`, `mkdir` (Q138), and `rm` and `du` through the same code, so `rm` now takes folders and follows the rules; `ls` shows dates. Debug Builds: `sd fill <folder> <count>` makes test files.
+
+### Checks on the device (2026-10-06, v0.8.1-2 Debug Build)
+
+All in a scratch folder, `/f1test`, removed afterwards.
+
+| Check | Result |
+|---|---|
+| Host tests | 424 pass (411 before the viewers' models) |
+| Browsing | Folders first, sizes and dates, the three sorts; a 300-file and a 329-file folder show "first 256 of 300" and "of 329" |
+| New folder, rename, copy, cut and paste, delete | Each works on a file and on a folder; a copy next to its original is named `(2)`; a name in the way asks "Replace it?" |
+| A folder of 11 files, 8.4 MB, copied | 19.4 s, 435 KB/s, the bar moving; two Log lines queued meanwhile were written |
+| The same copy cancelled at 1.8 MB | "Cancelled: nothing was copied", and nothing was left behind |
+| Delete | 341 files in 9.7 s; the dialog had counted them first |
+| Read-only rules | `/irc`, `/gnss` (top-level folders), `/`, `/gemini/cache` and a folder made inside it, a folder into itself, a name with `:`; a Capture being recorded and the folder holding it; a folder under `/irc` while IRC runs. Each refused with its reason; the Capture could still be copied |
+| Text | A 1 MB log opens at its last line at once; top, pages, lines; a file without an extension that looks like text opens as text |
+| Hex | A 5 KB binary file; Tab from any other viewer |
+| `.pcap` | A LoRa Capture: 3 packets as the Scanner lists them, Enter shows the Meshtastic header and bytes |
+| `.gpx` | 400 points: start, 33 min 15 s, 4.68 km; Tab shows the text |
+| `.ota` | A signed file: version, "intact", "older than what's running", Enter asks to install (not confirmed). A tampered one: "image corrupted (hash mismatch)" |
+| Maintenance | The warning, then usage, Clean-up's categories and Erase (not run) |
+| Date with GNSS only | NTP pointed at an address that doesn't answer, restart: the Clock came from the Fix, and a folder made then is dated 2026-10-06 08:39. A Track from the day before, written the same way by v0.8.1, shows "-" |
+| Memory | IRC connected, the App open on 256 entries: 61 KB free (70 KB before opening). Lowest since boot 29.7 KB, during IRC's TLS handshake |
+| Stacks | `storage` 3.1 KB free of 6 KB at worst, `loopTask` 1.5 KB |
+
+**Not checked by hand:** how the keys feel on the device itself; everything above was driven through the Debug Console's `key` command and screenshots.
+
+**One slip during the checks:** a scripted key sequence ran in the wrong folder and renamed `/gemini/saved` to `saved2`, then copied it to the top of the card. Both were put right at once (renamed back, the copy deleted; 7 files, 53,798 bytes, as before).
+
+**Found on the way:** a panic at Wi-Fi join, there since v0.7.0 (SNTP started twice, issue #46). Fixed in v0.9.0.
+
+## Notes (issue #19)
+
+Plain text notes on the SD card, written on the device. Q30 settled the base: `.txt` files in `/notes`, created, edited and deleted from the device, never offered by Storage Clean-up.
+
+### Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q141 | A **Notes** App in the Launcher. One row per note: its first line as the title, then the date. Newest first; `s` switches to by name. `n` new, Enter opens, `d` deletes after a confirmation, `r` renames the file. |
+| Q142 | A new note's file name is never typed: it comes from the first line when the note is first saved (`shopping-list.txt`), or `note-20261006-0919.txt` if that line is empty. It doesn't change afterwards unless the note is renamed. |
+| Q143 | **Autosave, no "discard changes?" prompt:** five seconds after the last key, on leaving the note or the App, and when the screen turns off. A save writes a temporary file and renames it over the note, so a power cut loses the last few seconds at most. A temporary file left behind is offered back at the next open. |
+| Q144 | The whole note is in memory while it's edited, up to **16 KB**. A bigger text file opens read-only in the Storage App's viewer. The App refuses to open below the memory floors (Q86). **Editing files of any size must come in a later release: issue #47.** |
+| Q145 | The editor wraps at spaces, 38 columns by 8 rows, with a line for the name and the state. Enter is a new line, Del deletes backwards, Fn+arrows move (the Text Entry rule), Ctrl+A and Ctrl+E go to the start and the end of the line, Tab types two spaces, Back saves and returns. The Compose Key works as elsewhere. |
+| Q146 | The Storage App's text viewer gets `e`: edit this file with the same editor, for a text file up to 16 KB that isn't read-only. That lifts Q135 without Apps opening each other (#43 stays). |
+| Q147 | The list is flat: the files directly in `/notes`. Sub-folders are reached through the Storage App. |
+| Q148 | UTF-8, LF line ends; a file with CRLF is saved back with LF. Characters the font lacks are kept on save. |
+| Q149 | Left out, each with its issue: editing files of any size (#47), searching inside notes (#48), undo (#49), selecting and copying text (#50). |
+| Q150 | Ships as **v0.10.0** when built and checked on the device. |
+
+### Done when
+
+- A note can be started, typed with accents, left and found again in the list under its first line; renamed; deleted after a confirmation.
+- What's typed is on the card five seconds after the last key, and after Back, Home, or the screen turning off, without a prompt.
+- Pulling the power while typing loses a few seconds at most, and the note is never left empty or half-written.
+- The cursor moves by character and by line through wrapped text, and the screen follows it; a 16 KB note edits without lag.
+- A note at 16 KB refuses more text and says so; a bigger file opens read-only.
+- `e` in the Storage App's text viewer edits a file; a read-only one is refused with its reason.
+- Free heap stays above the floors with a 16 KB note open and IRC connected.
+
+### Work breakdown
+
+1. **Model** (host-tested): the text buffer with its cursor, wrapping and scrolling; file names from first lines.
+2. **The editor on the device:** loading, drawing, keys, autosave through a temporary file, recovery.
+3. **The Notes App:** the list with titles, new, rename, delete.
+4. **`e` in the Storage App.**
+5. **Checks on the device**, recorded here.
+
+### As built
+
+- **`NoteText`** (`lib/notes`, host-tested) is the text, its cursor and the screen around it. A line owns the space or the newline it ends with, so every byte is on exactly one line and the cursor has one place for each. **No index of lines is kept:** a note of newlines alone would need twice its own size for one. Where a line starts is worked out from the start of its paragraph.
+- **One buffer, 16 KB, for as long as the editor is open.** It's reserved when the note is opened, the file is read straight into it, and typing never makes it grow. On this device a failed allocation is an abort, and with IRC connected the largest free block is about 31 KB whatever the total says: the first version read the file into one string and copied it into another, and opening a full note with IRC connected restarted the device. The editor now also refuses to open without a free block of 24 KB.
+- **`NoteEditor`** (`src/apps/note_editor`) is shared by the Notes App and the Storage App's `e`. A save runs on the storage task while the main loop waits for it: no second copy of the note, and at 16 KB the wait is a fraction of a second at a moment when nobody has typed for five.
+- **A save** writes `<note>.tmp`, checks its size, deletes the note and renames the temporary file (FAT can't rename onto a file). A cut between the last two steps leaves only the `.tmp`: the Notes list puts such a file back under its name. A `.tmp` next to its note is an unfinished save: opening the note offers it.
+- **Titles** in the list are read from the card for the eight rows on screen, when the list moves.
+- **Before powering off**, the firmware now leaves the foreground App (`PowerService::beforePowerOff`), which makes the editor save.
+- Shift or Alt with Fn+Up and Fn+Down moves a page (not in Q145).
+
+### Found on the way
+
+- **The screen could go "off" for one tick after a key sent through the Debug Console**, and the next key was then swallowed as a wake-up: the `key` command stamps the power timer from `millis()`, the power tick compares with its pass's older time, and the unsigned difference read as 49 days idle. The same shape as #46. Fixed in `PowerPolicy::update` with a test. Keys from the keyboard were never affected. It explains remote keys "lost" in earlier sessions.
+- **`scripts/rdbg.py` held back piped lines** written while it was still connecting, until the next line came (a buffered `readline()` behind `select()`). Fixed.
+
+### Checks on the device (2026-10-06, Debug Build of branch `notes`)
+
+Test notes were made in `/notes` and removed afterwards; the folder is left, empty.
+
+| Check | Result |
+|---|---|
+| Host tests | 439 pass |
+| A first note | "No notes yet", `n`, typed three lines: the top line says "typing", then "saved" five seconds after the last key, under `shopping-list.txt`. 63 keys in a row all arrived |
+| Leaving | Back saves and returns to the list, which shows the note under its first line. Home in the middle of a new note saved it as `ideas.txt` |
+| The cursor | Down, Right, an insertion in the middle of a line; the screen scrolls through a note of about 230 lines |
+| A power cut | Typed, waited seven seconds, typed more and restarted the device at once (`reset`): the note has what was saved, whole, and not the last keys |
+| An unfinished save | A `.tmp` next to its note: "Unsaved copy... Keep the note / Use the copy"; using it brings its text back and saves it. A `.tmp` alone was put back under its name when the list opened |
+| 16 KB | A note of exactly 16,384 bytes opens and scrolls; one more character: "This note is full: 16 KB". A file of 16,398 bytes: "Too big to edit: 16 KB at most" |
+| Rename, delete, sort | `r` renamed `orphan.txt` to `orphan2.txt`; `d` asked, then deleted; `s` switched between newest first and by file name |
+| `e` in the Storage App | A note opened from the text viewer, edited, saved on Back; the listing shows its new size |
+| Memory | IRC connected, the full 16 KB note open: 55 KB free, largest block 31.7 KB (72 KB free before opening) |
+
+**Not checked:** accents through the Compose Key and Ctrl+A / Ctrl+E (the remote `key` command can't send them; the model's tests cover both), the power button's save (it needs a hand on the device), a missing card, and how typing feels on the keyboard itself.
+
+**One slip during the checks:** a key sequence sent right after a restart opened IRC instead of Notes, and the test letters went into IRC's input line. Nothing was sent: the line was cleared and the App left. IRC connected to Libera as it does when opened.

docs/milestones/S1.md

@@ -0,0 +1,138 @@
+# S1 — System basics
+
+**Status:** the three planned items are done: the SD driver fix in v0.6.1 (issue #21, ADR 0007), fixed IPv4 settings in v0.7.0 (issue #7), the System App in v0.8.0 (issue #11). v0.8.1 adds the resting main loop (issue #40) and the GNSS pause for the radio's noise (issue #20, still open for the 11 dB that remain). Still open in the milestone: #39, following the SD driver upstream.
+
+**Goal:** the device works on any network, the card can be trusted, and you can see what the system is doing. A side milestone, like G1.
+
+## Fixed IPv4, DNS and NTP (issue #7)
+
+Not every network has a DHCP server: a lab bench, a direct link to a router, a network where addresses are handed out by hand. Until now every Saved Network used DHCP, DNS always came from DHCP, and the NTP server was `pool.ntp.org`, hard-coded.
+
+**IPv4 only.** IPv6 isn't part of this, now or as a planned follow-up.
+
+### Decisions (design round 2026-10-05)
+
+| # | Decision |
+|---|---|
+| Q105 | The IP setting is **per Saved Network**: *Automatic* (DHCP, as before) or *Fixed*, with its own address, prefix and gateway. New networks start Automatic. |
+| Q106 | The subnet is entered as a **prefix length** (`24`), with the mask shown next to it. |
+| Q107 | The **gateway is optional**: left empty, the device talks to its own subnet only. |
+| Q108 | **DNS is global:** two servers in Settings, used on every Fixed network. On Automatic networks DHCP's DNS is used, unless **"Always use my DNS"** is on. |
+| Q109 | DNS defaults: **9.9.9.9** (Quad9), then **1.1.1.1** (Cloudflare). |
+| Q110 | **NTP is global:** two servers in Settings, names or addresses, defaulting to `pool.ntp.org` and `time.cloudflare.com`. NTP servers offered by DHCP are used first. GNSS still outranks NTP for the clock. |
+| Q111 | What's typed is checked, host-tested in `lib/wifi`: an address is four numbers from 0 to 255; a prefix is 1 to 30; the address isn't the subnet's network or broadcast address; the gateway is inside the subnet and isn't the device's own address. Refusals say why. |
+| Q112 | Addresses are typed in the line editor, limited to digits and dots. |
+| Q113 | Enter on a Saved Network opens **its page** (IP, Address, Prefix, Gateway, Forget) instead of asking to forget it. Settings > Wi-Fi gains DNS servers, "Always use my DNS" and NTP servers. The Status row opens **connection details**: address, mask, gateway, DNS and NTP in use, and where each came from. |
+| Q114 | A change applies **at once**: the network in use reconnects with the new settings. No automatic way back; the keyboard still works if Wi-Fi is cut. |
+| Q115 | Console: `wifi status` shows address, gateway, DNS, NTP and their sources; `wifi ip <ssid> dhcp`, `wifi ip <ssid> <address>/<prefix> [gateway]`, `wifi dns <a> [b]`, `wifi ntp <a> [b]`. Debug Builds: `wifi ip … try 60` goes back to the previous setting after 60 s unless confirmed with `wifi ip keep`. |
+| Q116 | Left out: checking whether the address is already taken, and per-network DNS. |
+
+The SDK already allows 3 NTP servers and 3 DNS servers and can take NTP servers from DHCP (`CONFIG_LWIP_SNTP_MAX_SERVERS=3`, `CONFIG_LWIP_DHCP_GET_NTP_SRV=y`), so the framework isn't rebuilt for this.
+
+### Done when
+
+- A Saved Network set to Fixed joins with that address, mask and gateway, and the device reaches the internet (IRC, Gemini, NTP) through the DNS servers from Settings.
+- Set back to Automatic, it gets its address from DHCP again.
+- With "Always use my DNS" on, an Automatic network resolves through the servers from Settings.
+- The NTP servers from Settings set the clock.
+- Wrong entries are refused with a reason, in Settings and on the console.
+- Connection details show what's in use and where it came from.
+- Tested on `knbg-guests` with 10.39.39.12 (the device's DHCP lease) and 10.39.39.13 (free: the device is alone on that network).
+
+### Measured (2026-10-05 and 06, on `knbg-guests`)
+
+The network is 10.39.39.0/24, gateway 10.39.39.1; DHCP gives 10.39.39.1 as DNS and offers no NTP server.
+
+- **Fixed 10.39.39.12/24** (the device's own lease) and **Fixed 10.39.39.13/24**, gateway 10.39.39.1: the device joins with that address, DNS is 9.9.9.9 and 1.1.1.1 from Settings, and a Gemini page loads (name resolution, routing, TLS). On .13, .12 no longer answers.
+- **A wrong gateway** (10.39.39.254) on a 60 s trial: the device stops answering from another subnet, and comes back by itself with the previous setting.
+- **Back to Automatic:** 10.39.39.12 by DHCP again, DNS 10.39.39.1 from DHCP.
+- **"Always use my DNS"** on an Automatic network: DNS becomes 9.9.9.9 and 1.1.1.1; switched off, the device joins again and has DHCP's DNS back.
+- **NTP:** `pool.ntp.org` answers; set to `time.cloudflare.com` alone, that one answers within 25 s.
+- **Refusals**, on the console and in Settings: the network's own address, a gateway outside the subnet, a prefix of 31 or 99, 10.39.39.300, an unknown network, a DNS name where an address is needed, a host name with an underscore.
+- **In Settings:** the network's page pre-fills Fixed with the address, prefix and gateway in use; leaving the page applies it; connection details show each value and where it came from.
+- **Not tested:** NTP servers offered by DHCP (this network offers none), and a Fixed network with no gateway.
+
+### Work breakdown
+
+1. **IPv4 logic** (host-tested): parsing and formatting addresses, prefix and mask, the checks of Q111.
+2. **Storage:** the IP setting in each Saved Network; DNS, "Always use my DNS" and NTP in Settings.
+3. **Wi-Fi Service:** apply it when joining; DNS and NTP; `wifi status` and the console commands.
+4. **Settings:** the network page, the DNS and NTP rows, connection details.
+5. **Tests on the device**, recorded here.
+
+## System Monitor (issue #11)
+
+Every milestone so far was driven by measurements, heap floors, stack sizes, TLS dips, that needed a Debug Build and a computer. The System App shows them on the device, in any build.
+
+### Decisions (design round 2026-10-06)
+
+| # | Decision |
+|---|---|
+| Q117 | An App of its own, **System**, in release builds too. Read-only. |
+| Q118 | Four views, switched with Tab: **Overview** (CPU per core, memory, network, battery), **Tasks**, **Memory**, **System**. |
+| Q119 | Sampled once a second. A task's share is its run time over the last second; a core's load is 100 % minus its idle task's share. |
+| Q120 | **History only while the App is open:** two minutes at one sample a second, about 1 KB. The system already keeps what matters afterwards: the lowest free heap since boot and each task's lowest free stack. |
+| Q121 | **Bytes are counted per service:** IRC, Gemini, the Debug Console and Firmware Updates add what they read and write to a shared counter. The network view shows the connection details, each service's bytes in and out, and the signal strength. |
+| Q122 | Tasks: name, core, share, state and lowest free stack, sorted by share; `s` cycles the sort (share, stack, name). **Under 512 bytes of stack left shows in the warning colour.** |
+| Q123 | Memory: free heap, lowest since boot, largest free block, and a two-minute graph of free heap **with the floors of Q86 drawn as lines** (55, 40 and 20 KB). |
+| Q124 | System: uptime and why it last started, firmware and both app slots, chip temperature and CPU frequency, battery voltage and percentage, SD usage and write faults, the radio's and the GNSS receiver's state. |
+| Q125 | `info` and `tasks` are split into a **snapshot** that the console and the App share; the arithmetic (shares from two samples, sorting, the stack warning) is host-tested. |
+| Q126 | Left out: acting on tasks, an event log, exporting snapshots to the card. |
+| Q127 | The main loop uses about 81 % of a core. The App shows it; fixing it is issue #40, not part of #11. |
+
+The App has five views, not four: Q121's network view is one of its own (Overview, Tasks, Memory, Network, System).
+
+### Measured (2026-10-06)
+
+- **Traffic counters are exact.** A Gemini fetch of a 164,970-byte page counts 164,986 bytes in (the page and its 16-byte header line) and 42 out (the 40-character URL and CRLF). A 1,797,760-byte upload counts 1,798,123 in for the Debug Console, commands included.
+- **The Memory view shows a TLS dip as it happens.** Starting IRC and a 165 KB Gemini fetch together: free heap falls from about 100 KB through the three floors to a low of 12.1 KB, then settles near 50 KB. That's the dip accepted in G1 (Q86).
+- **A run-time counter only moves when its task is switched out.** FreeRTOS adds to a task's run time at the context switch. The main loop takes the samples, and with core 1 to itself it's never switched out: its counter said 2 % while the core's idle task had 0 %. So the task that samples gets what's left of its core. With that: **the main loop uses 100 % of core 1 at rest** (issue #40 said 81 %, an average since boot).
+- **`tasks` on the console** sampled twice inside one command at first, a quarter second apart, and showed the loop at 1 %: it was asleep in the command's own wait. It now samples, lets the loop run for a second, and prints.
+- **Low stack, flagged:** `IDLE0` (232 bytes left), `IDLE1` (328 to 352) and `spk_task` (256 to 264), all the framework's own tasks.
+- **Cost:** 15.6 KB of flash for the App and the counters (1,742,723 bytes, release). Nothing while it's closed; about 2 KB of history and samples while it's open.
+
+## The main loop rests (issue #40)
+
+The loop polled the keyboard, ticked the Services, ran the consoles and redrew when needed, then came straight back: 50,000 passes a second, and core 1 100 % busy with the device idle and the screen off.
+
+Nothing needs that. The keyboard controller buffers key events; the consoles and the radio have their own tasks or interrupts; no Service asks for a tick more often than every 50 ms. So after each pass the loop now rests: **5 ms with the screen on, 20 ms with it off**, and not at all during a serial file transfer (`sd put`), which reads its bytes from the loop. Safe Mode's loop rests 5 ms too. Debug Builds have `loop spin on|off` to bring the old behaviour back for comparison.
+
+### Measured (2026-10-06, Debug Build, Wi-Fi connected, GNSS on, on USB power)
+
+| | Spinning | Resting |
+|---|---|---|
+| Passes a second, screen off | 50,160 | 50 |
+| Core 1 load, screen off | 100 % | 1 % |
+| Passes a second, screen on (Launcher) | 1,203 | 167 |
+| Core 1 load, screen on | 62 % | 10 % |
+| Chip temperature at rest, settled | 38.3 C | 34.3 C |
+| A 1.8 MB upload over the Debug Console | about 230 KB/s | 288 KB/s |
+
+- Still working at this pace: GNSS (a 3D Fix, 22 satellites), a Gemini fetch (52 KB), the upload read back by SHA-256, the Sweep (still 606 to 610 ms a pass), the radio's DIO1 interrupt.
+- **Not measured:** the current drawn (no meter on the battery line), and how typing feels on the real keyboard: a key now waits up to 5 ms for the loop, 20 ms if it's the one that wakes the screen.
+- **The radio's noise floor didn't move** (-97 to -99 dBm at 125 kHz either way): the spinning loop wasn't the source (issue #20).
+- **Not done:** real sleep. The framework is built without power management (`CONFIG_PM_ENABLE` is off), so an idle core only halts until the next interrupt. Automatic light sleep would need the framework rebuilt with it, Wi-Fi in modem sleep, and the USB serial port's behaviour checked. A next step if battery life calls for it.
+
+## The radio's noise: the GNSS receiver (issue #20)
+
+M3 found the LoRa radio's noise floor about 15 dB above what the chip hears alone, and that the source travels with the device. Which part? Debug Builds got a self-test, `lora noise test`: it changes one thing at a time, Sweeps the band eight passes (568 readings), records the median as the floor, and puts the thing back. It runs on the device by itself, because one condition switches Wi-Fi off, and `lora noise report` prints the result afterwards.
+
+### Measured (2026-10-06, indoors, on USB power, dBm at 125 kHz)
+
+| Condition | Floor |
+|---|---|
+| Antenna switched off (the chip alone) | -117 |
+| Antenna on, GNSS in standby | -106 |
+| Antenna on, GNSS running (as shipped) | -98 |
+
+- **The GNSS receiver, while it runs, raises the floor by 8 dB.** Three runs: -98 or -99 with it running, -106 in standby, every time. On LongFast (250 kHz) the Sniffer's own reading goes from about -93.5 to -101.5 dBm.
+- **It's the receiver working, not its serial line:** with one NMEA sentence a second instead of twenty (`PCAS03`), the receiver still tracking, the floor stays at -98.
+- **Nothing else moves it by more than 1 dB**, with GNSS running or in standby: the main loop spinning or resting, the CPU at 240, 160 or 80 MHz, Wi-Fi on or off, the screen on or off, the radio chip's regulator as DC-DC or LDO, its receive gain boosted or not.
+- **11 dB remain** between the antenna connected with GNSS quiet (-106) and the chip alone (-117). It comes in through the antenna and none of those switches changes it: the surroundings, or parts of the Cardputer that can't be switched off. Not separated: that needs another place, or the antenna on a cable away from the case.
+- M3's quick check had GNSS at "1 or 2 dB": it read one frequency for a few seconds, in a noisier spot. The median over the band is the better measure.
+
+### What the firmware does about it
+
+**Settings > Pause GNSS for LoRa**, off by default: while the LoRa radio listens or sweeps, the GNSS receiver waits in standby, and wakes when the radio goes back to sleep (a Fix again after about 7 s here). Never during a Track. The GNSS App says "GNSS is paused" meanwhile. `gnss quiet on|off` on the console.
+
+It's off by default because GNSS on by default was decided in M2 (Q58), and from M4 the radio listens all the time: then "pause while listening" means GNSS mostly off, which is a decision about position, the clock and Tracks, for M4's design round (issue #23).

lib/apps_model/src/settings_menu.cpp

@@ -20,9 +20,9 @@ const RowDef kRows[] = {
     {Row::Region, Kind::Choice, "Region"},      {Row::Timezone, Kind::Choice, "Timezone"},
     {Row::Brightness, Kind::Slider, "Brightness"}, {Row::DimTimeout, Kind::Choice, "Dim after"},
     {Row::OffTimeout, Kind::Choice, "Screen off after"}, {Row::Sound, Kind::Toggle, "Sound & LED"},
-    {Row::Gnss, Kind::Toggle, "GNSS"}, {Row::Coordinates, Kind::Toggle, "Coordinates"},
+    {Row::Gnss, Kind::Toggle, "GNSS"}, {Row::GnssQuiet, Kind::Toggle, "Pause GNSS for LoRa"},
+    {Row::Coordinates, Kind::Toggle, "Coordinates"},
     {Row::ProbeMacs, Kind::Toggle, "Probe MACs"}, {Row::Wifi, Kind::Page, "Wi-Fi"},
-    {Row::Storage, Kind::Page, "Storage"},
     {Row::Firmware, Kind::Page, "Firmware"},
     {Row::About, Kind::Page, "About"},
 };
@@ -81,6 +81,7 @@ std::string SettingsMenu::value(int i) const {
         case Row::OffTimeout: return formatSeconds(settings_.getInt(Setting::OffTimeoutS));
         case Row::Sound: return settings_.getBool(Setting::Sound) ? "On" : "Off";
         case Row::Gnss: return settings_.getBool(Setting::GnssEnabled) ? "On" : "Off";
+        case Row::GnssQuiet: return settings_.getBool(Setting::GnssQuietForLora) ? "On" : "Off";
         case Row::Coordinates: return settings_.getBool(Setting::CoordinatesDms) ? "Deg min sec" : "Decimal";
         case Row::ProbeMacs: return settings_.getBool(Setting::ProbeMacRaw) ? "Raw" : "Pseudonymised";
         case Row::Wifi: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
@@ -126,6 +127,7 @@ std::string SettingsMenu::choose(int i, int c) {
 void SettingsMenu::toggle(int i) {
     if (row(i) == Row::Sound) settings_.setBool(Setting::Sound, !settings_.getBool(Setting::Sound));
     if (row(i) == Row::Gnss) settings_.setBool(Setting::GnssEnabled, !settings_.getBool(Setting::GnssEnabled));
+    if (row(i) == Row::GnssQuiet) settings_.setBool(Setting::GnssQuietForLora, !settings_.getBool(Setting::GnssQuietForLora));
     if (row(i) == Row::Coordinates) settings_.setBool(Setting::CoordinatesDms, !settings_.getBool(Setting::CoordinatesDms));
     if (row(i) == Row::ProbeMacs) settings_.setBool(Setting::ProbeMacRaw, !settings_.getBool(Setting::ProbeMacRaw));
 }

lib/apps_model/src/settings_menu.h

@@ -11,7 +11,7 @@ namespace roro {
 // values, choice lists and validation messages. Rendering and navigation live in the App.
 class SettingsMenu {
    public:
-    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, Gnss, Coordinates, ProbeMacs, Wifi, Storage, Firmware, About };
+    enum class Row { LongName, ShortName, Region, Timezone, Brightness, DimTimeout, OffTimeout, Sound, Gnss, GnssQuiet, Coordinates, ProbeMacs, Wifi, Firmware, About };
     enum class Kind { Text, Choice, Toggle, Slider, Page };
 
     explicit SettingsMenu(Settings& settings) : settings_(settings) {}

lib/files/src/file_list.cpp

@@ -0,0 +1,137 @@
+#include "file_list.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstdio>
+#include <cstring>
+#include <ctime>
+
+namespace roro::files {
+
+namespace {
+
+// Names compare letters only, whatever the case; ties by the bytes, so the order is total.
+int compareNames(const char* a, const char* b) {
+    for (const char *x = a, *y = b;; ++x, ++y) {
+        int cx = std::tolower(static_cast<unsigned char>(*x)), cy = std::tolower(static_cast<unsigned char>(*y));
+        if (cx != cy) return cx < cy ? -1 : 1;
+        if (!cx) break;
+    }
+    return std::strcmp(a, b);
+}
+
+constexpr uint32_t kYear2020 = 1577836800;
+
+std::string sizeText(uint32_t bytes) {
+    char s[16];
+    if (bytes < 1024) std::snprintf(s, sizeof s, "%u B", static_cast<unsigned>(bytes));
+    else if (bytes < 10 * 1024) std::snprintf(s, sizeof s, "%.1f KB", bytes / 1024.0);
+    else if (bytes < 1024 * 1024) std::snprintf(s, sizeof s, "%u KB", static_cast<unsigned>(bytes / 1024));
+    else if (bytes < 10u * 1024 * 1024) std::snprintf(s, sizeof s, "%.1f MB", bytes / 1048576.0);
+    else if (bytes < 1024u * 1024 * 1024) std::snprintf(s, sizeof s, "%u MB", static_cast<unsigned>(bytes / 1048576));
+    else std::snprintf(s, sizeof s, "%.1f GB", bytes / 1073741824.0);
+    return s;
+}
+
+}  // namespace
+
+void FileList::clear() {
+    std::vector<Entry>().swap(entries_);
+    std::vector<uint16_t>().swap(order_);
+    std::vector<char>().swap(names_);
+    more_ = wasted_ = 0;
+}
+
+bool FileList::before(const Entry& a, const Entry& b, FileSort by) const {
+    if (a.folder != b.folder) return a.folder;
+    if (!a.folder) {
+        if (by == FileSort::Date && a.modified != b.modified) return a.modified > b.modified;
+        if (by == FileSort::Size && a.size != b.size) return a.size > b.size;
+    }
+    return compareNames(names_.data() + a.name, names_.data() + b.name) < 0;
+}
+
+void FileList::add(const char* name, uint32_t size, uint32_t modified, bool folder) {
+    size_t len = std::strlen(name) + 1;
+    if (entries_.size() >= kMax) {
+        // Full: the new entry takes the place of the one that sorts last by name, if it sorts
+        // before it. The old name's bytes stay in the buffer until there's enough waste to pack.
+        more_++;
+        size_t last = 0;
+        for (size_t i = 1; i < entries_.size(); i++)
+            if (before(entries_[last], entries_[i], FileSort::Name)) last = i;
+        Entry candidate{static_cast<uint32_t>(names_.size()), size, modified, folder};
+        names_.insert(names_.end(), name, name + len);
+        if (!before(candidate, entries_[last], FileSort::Name)) {
+            names_.resize(names_.size() - len);
+            return;
+        }
+        wasted_ += std::strlen(names_.data() + entries_[last].name) + 1;
+        entries_[last] = candidate;
+        if (wasted_ > 2048) compact();
+        return;
+    }
+    if (entries_.empty()) {
+        entries_.reserve(32);
+        names_.reserve(512);
+    }
+    entries_.push_back({static_cast<uint32_t>(names_.size()), size, modified, folder});
+    names_.insert(names_.end(), name, name + len);
+    order_.push_back(static_cast<uint16_t>(order_.size()));
+}
+
+void FileList::compact() {
+    std::vector<char> packed;
+    packed.reserve(names_.size() - wasted_);
+    for (Entry& e : entries_) {
+        const char* n = names_.data() + e.name;
+        e.name = static_cast<uint32_t>(packed.size());
+        packed.insert(packed.end(), n, n + std::strlen(n) + 1);
+    }
+    names_.swap(packed);
+    wasted_ = 0;
+}
+
+void FileList::sort(FileSort by) {
+    if (wasted_) compact();
+    names_.shrink_to_fit();
+    entries_.shrink_to_fit();
+    order_.resize(entries_.size());
+    for (size_t i = 0; i < order_.size(); i++) order_[i] = static_cast<uint16_t>(i);
+    std::sort(order_.begin(), order_.end(), [&](uint16_t a, uint16_t b) { return before(entries_[a], entries_[b], by); });
+}
+
+int FileList::find(const std::string& name) const {
+    for (size_t i = 0; i < order_.size(); i++)
+        if (name == this->name(i)) return static_cast<int>(i);
+    return -1;
+}
+
+size_t FileList::bytes() const {
+    return entries_.capacity() * sizeof(Entry) + order_.capacity() * sizeof(uint16_t) + names_.capacity();
+}
+
+std::string formatStamp(uint32_t modified) {
+    if (modified < kYear2020) return "-";
+    time_t t = static_cast<time_t>(modified);
+    struct tm local;
+    localtime_r(&t, &local);
+    char s[20];
+    std::snprintf(s, sizeof s, "%04d-%02d-%02d %02d:%02d", local.tm_year + 1900, local.tm_mon + 1, local.tm_mday, local.tm_hour,
+                  local.tm_min);
+    return s;
+}
+
+std::string rowDetail(bool folder, uint32_t size, uint32_t modified) {
+    if (folder) return "folder";
+    std::string stamp = formatStamp(modified);
+    return sizeText(size) + "  " + (stamp == "-" ? stamp : stamp.substr(0, 10));
+}
+
+std::string fitName(const std::string& name, size_t maxChars) {
+    if (name.size() <= maxChars || maxChars < 8) return name.substr(0, maxChars);
+    size_t tail = std::min<size_t>(6, maxChars / 3), head = maxChars - tail - 2;
+    return name.substr(0, head) + ".." + name.substr(name.size() - tail);
+}
+
+}  // namespace roro::files

lib/files/src/file_list.h

@@ -0,0 +1,55 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::files {
+
+enum class FileSort : uint8_t { Name, Date, Size };
+
+// A folder's entries for the Storage App (F1, Q129, Q136): 256 at most, the names packed into
+// one buffer, about 10 KB when full. A bigger folder keeps the first 256 by name, whatever order
+// the card lists them in, and counts the rest.
+class FileList {
+   public:
+    static constexpr size_t kMax = 256;
+
+    void clear();
+    void add(const char* name, uint32_t size, uint32_t modified, bool folder);
+    void sort(FileSort by);  // folders first, by name; then files by name, newest or biggest first
+
+    size_t count() const { return entries_.size(); }
+    size_t more() const { return more_; }  // entries that didn't fit
+    // By position after sort().
+    const char* name(size_t i) const { return names_.data() + entries_[order_[i]].name; }
+    uint32_t size(size_t i) const { return entries_[order_[i]].size; }
+    uint32_t modified(size_t i) const { return entries_[order_[i]].modified; }  // Unix time, 0 if unknown
+    bool folder(size_t i) const { return entries_[order_[i]].folder; }
+    int find(const std::string& name) const;  // position, or -1
+    size_t bytes() const;                     // memory held
+
+   private:
+    struct Entry {
+        uint32_t name;  // offset into names_
+        uint32_t size, modified;
+        bool folder;
+    };
+    bool before(const Entry& a, const Entry& b, FileSort by) const;
+    void compact();
+
+    std::vector<Entry> entries_;
+    std::vector<uint16_t> order_;
+    std::vector<char> names_;
+    size_t more_ = 0, wasted_ = 0;
+};
+
+// What a row shows on the right (Q129): "folder", or "1.2 KB  2026-10-05". A file dated before
+// 2020 was written before the clock was set: "-" (Q137). Local time.
+std::string rowDetail(bool folder, uint32_t size, uint32_t modified);
+std::string formatStamp(uint32_t modified);
+// A name cut to `maxChars` for a row, from the middle: the start and the extension stay readable.
+std::string fitName(const std::string& name, size_t maxChars);  // "2026-10-05 20:00", or "-"
+
+}  // namespace roro::files

lib/files/src/file_names.cpp

@@ -0,0 +1,99 @@
+#include "file_names.h"
+
+#include <cctype>
+
+namespace roro::files {
+
+const char* const kFirmwareFolders[] = {"/irc", "/wifi", "/updates", "/gnss", "/gemini", "/captures", "/notes"};
+const size_t kFirmwareFolderCount = sizeof kFirmwareFolders / sizeof kFirmwareFolders[0];
+
+std::string parentOf(const std::string& path) {
+    size_t slash = path.rfind('/');
+    return slash == std::string::npos || slash == 0 ? "/" : path.substr(0, slash);
+}
+
+std::string baseName(const std::string& path) {
+    size_t slash = path.rfind('/');
+    return slash == std::string::npos ? path : path.substr(slash + 1);
+}
+
+std::string joinPath(const std::string& folder, const std::string& name) {
+    return folder == "/" ? "/" + name : folder + "/" + name;
+}
+
+std::string extensionOf(const std::string& name) {
+    size_t dot = name.rfind('.');
+    if (dot == std::string::npos || dot == 0) return "";
+    std::string ext = name.substr(dot + 1);
+    for (char& c : ext) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+    return ext;
+}
+
+bool isInside(const std::string& path, const std::string& folder) {
+    if (folder == "/") return true;
+    if (path.compare(0, folder.size(), folder) != 0) return false;
+    return path.size() == folder.size() || path[folder.size()] == '/';
+}
+
+std::string checkName(const std::string& name) {
+    if (name.empty()) return "A name can't be empty";
+    if (name == "." || name == "..") return "\".\" and \"..\" aren't names";
+    if (name.size() > 64) return "A name can be 64 characters at most";
+    for (char c : name) {
+        if (static_cast<unsigned char>(c) < 0x20) return "A name can't contain control characters";
+        for (char bad : std::string("/\\:*?\"<>|"))
+            if (c == bad) return std::string("A name can't contain ") + c;
+    }
+    if (name.back() == '.' || name.back() == ' ') return "A name can't end with a dot or a space";
+    return "";
+}
+
+std::string whyReadOnly(const std::string& path, const std::vector<std::string>& inUse) {
+    if (path == "/" || path.empty()) return "That's the card itself";
+    if (isInside(path, kGeminiCache)) return std::string(kGeminiCache) + " is the Gemini App's working space";
+    for (const std::string& open : inUse) {
+        if (open == path) return "It's being written right now";
+        if (isInside(open, path)) return "It holds a file that's being written right now";
+    }
+    for (size_t i = 0; i < kFirmwareFolderCount; i++)
+        if (path == kFirmwareFolders[i]) return std::string("The firmware keeps its files in ") + path;
+    return "";
+}
+
+std::string whyNotInto(const std::string& source, const std::string& into) {
+    if (isInside(into, kGeminiCache)) return std::string(kGeminiCache) + " is the Gemini App's working space";
+    if (isInside(into, source)) return "A folder can't go inside itself";
+    if (parentOf(source) == into) return "It's already there";
+    return "";
+}
+
+std::string copyName(const std::string& name, int n) {
+    size_t dot = name.rfind('.');
+    std::string suffix = " (" + std::to_string(n) + ")";
+    if (dot == std::string::npos || dot == 0) return name + suffix;
+    return name.substr(0, dot) + suffix + name.substr(dot);
+}
+
+FileKind kindOf(const std::string& name) {
+    std::string ext = extensionOf(name);
+    if (ext == "gpx") return FileKind::Gpx;
+    if (ext == "pcap") return FileKind::Pcap;
+    if (ext == "ota") return FileKind::Ota;
+    for (const char* text : {"txt", "log", "gmi", "csv", "md", "json", "ini", "conf", "ir"})
+        if (ext == text) return FileKind::Text;
+    return FileKind::Unknown;
+}
+
+bool opensAtEnd(const std::string& name) { return extensionOf(name) == "log"; }
+
+bool looksLikeText(const uint8_t* data, size_t len) {
+    size_t odd = 0;
+    for (size_t i = 0; i < len; i++) {
+        uint8_t b = data[i];
+        if (b == 0) return false;
+        if (b < 0x20 && b != '\n' && b != '\r' && b != '\t') odd++;
+    }
+    return odd * 20 <= len;  // a stray control character or two is still text
+}
+
+}  // namespace roro::files

lib/files/src/file_names.h

@@ -0,0 +1,42 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::files {
+
+// Paths on the SD card are absolute and use '/': "/gemini/saved/index.gmi".
+std::string parentOf(const std::string& path);    // "/" for a top-level entry and for "/"
+std::string baseName(const std::string& path);    // "" for "/"
+std::string joinPath(const std::string& folder, const std::string& name);
+std::string extensionOf(const std::string& name);  // lower case, without the dot; "" if none
+bool isInside(const std::string& path, const std::string& folder);  // a folder is inside itself
+
+// A name typed for rename or a new folder (F1, Q131): "" if FAT and this App can take it, or why not.
+std::string checkName(const std::string& name);
+
+// The top-level folders the firmware keeps its files in. They can't be renamed or deleted;
+// what's in them can (Q130).
+extern const char* const kFirmwareFolders[];
+extern const size_t kFirmwareFolderCount;
+constexpr const char* kGeminiCache = "/gemini/cache";
+
+// Why `path` can't be renamed, moved or deleted, or "" if it can (Q130). `inUse`: the files the
+// firmware has open right now.
+std::string whyReadOnly(const std::string& path, const std::vector<std::string>& inUse);
+
+// Why `source` can't be copied or moved into the folder `into`, or "" if it can.
+std::string whyNotInto(const std::string& source, const std::string& into);
+
+// "a (2).gmi": the name of a copy made next to its original.
+std::string copyName(const std::string& name, int n);
+
+// Which viewer opens a file (Q134), from its name. Unknown: look at the first bytes.
+enum class FileKind : uint8_t { Text, Gpx, Pcap, Ota, Unknown };
+FileKind kindOf(const std::string& name);
+bool opensAtEnd(const std::string& name);  // logs
+bool looksLikeText(const uint8_t* data, size_t len);
+
+}  // namespace roro::files

lib/files/src/file_views.cpp

@@ -0,0 +1,143 @@
+#include "file_views.h"
+
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+#include "file_list.h"
+#include "track.h"
+
+namespace roro::files {
+
+std::string hexRow(uint32_t offset, const uint8_t* data, size_t len) {
+    char head[8];
+    std::snprintf(head, sizeof head, "%05X", static_cast<unsigned>(offset));
+    std::string row = head, text;
+    for (size_t i = 0; i < 8; i++) {
+        if (i % 2 == 0) row += ' ';
+        char hex[3] = "  ";
+        if (i < len) {
+            std::snprintf(hex, sizeof hex, "%02x", data[i]);
+            text += data[i] >= 0x20 && data[i] < 0x7F ? static_cast<char>(data[i]) : '.';
+        }
+        row += hex;
+    }
+    return row + "  " + text;
+}
+
+namespace {
+// Days since 1970-01-01 (Howard Hinnant's days_from_civil): no timegm() everywhere.
+int64_t daysFromCivil(int y, int m, int d) {
+    y -= m <= 2;
+    int64_t era = (y >= 0 ? y : y - 399) / 400;
+    int yoe = static_cast<int>(y - era * 400);
+    int doy = (153 * (m + (m > 2 ? -3 : 9)) + 2) / 5 + d - 1;
+    int doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    return era * 146097 + doe - 719468;
+}
+
+bool attribute(const std::string& element, const char* name, double& out) {
+    size_t at = element.find(name);
+    if (at == std::string::npos) return false;
+    const char* from = element.c_str() + at + std::strlen(name);
+    char* end = nullptr;
+    out = std::strtod(from, &end);
+    return end != from;
+}
+}  // namespace
+
+void GpxSummary::point(const std::string& element) {
+    double lat, lon;
+    if (!attribute(element, "lat=\"", lat) || !attribute(element, "lon=\"", lon)) return;
+    if (points_ > 0) meters_ += gnss::distanceMeters(lat_, lon_, lat, lon);
+    lat_ = lat;
+    lon_ = lon;
+    points_++;
+    size_t at = element.find("<time>");
+    int y, mo, d, h, mi, s;
+    if (at != std::string::npos && std::sscanf(element.c_str() + at + 6, "%d-%d-%dT%d:%d:%d", &y, &mo, &d, &h, &mi, &s) == 6) {
+        int64_t t = daysFromCivil(y, mo, d) * 86400 + h * 3600 + mi * 60 + s;
+        if (first_ == 0) first_ = t;
+        last_ = t;
+    }
+}
+
+void GpxSummary::feed(const char* data, size_t len) {
+    carry_.append(data, len);
+    size_t done = 0;
+    for (;;) {
+        size_t open = carry_.find("<trkpt", done);
+        if (open == std::string::npos) {
+            // Nothing begun, except perhaps the first letters of a tag at the very end.
+            done = carry_.size() > 6 ? carry_.size() - 6 : done;
+            break;
+        }
+        size_t close = carry_.find("</trkpt>", open);
+        size_t next = carry_.find("<trkpt", open + 6);  // a point with nothing inside: <trkpt .../>
+        if (close == std::string::npos && next == std::string::npos) {
+            done = open;
+            break;
+        }
+        size_t end = close != std::string::npos && (next == std::string::npos || close < next) ? close + 8 : next;
+        point(carry_.substr(open, end - open));
+        done = end;
+    }
+    carry_.erase(0, done);
+    if (carry_.size() > 2048) carry_.erase(0, carry_.size() - 6);  // not a GPX point: don't keep it
+}
+
+std::string formatDuration(int64_t seconds) {
+    char s[24];
+    if (seconds < 60) std::snprintf(s, sizeof s, "%d s", static_cast<int>(seconds));
+    else if (seconds < 3600) std::snprintf(s, sizeof s, "%d min %02d s", static_cast<int>(seconds / 60), static_cast<int>(seconds % 60));
+    else std::snprintf(s, sizeof s, "%d h %02d min", static_cast<int>(seconds / 3600), static_cast<int>(seconds % 3600 / 60));
+    return s;
+}
+
+std::vector<std::string> GpxSummary::lines() const {
+    std::vector<std::string> out;
+    out.push_back(std::to_string(points_) + (points_ == 1 ? " point" : " points"));
+    if (first_ > 0) {
+        out.push_back("Started " + formatStamp(static_cast<uint32_t>(first_)));
+        out.push_back("Lasted " + formatDuration(last_ - first_));
+    }
+    char s[32];
+    if (meters_ < 1000) std::snprintf(s, sizeof s, "Distance %.0f m", meters_);
+    else std::snprintf(s, sizeof s, "Distance %.2f km", meters_ / 1000);
+    out.push_back(s);
+    return out;
+}
+
+namespace {
+uint32_t le32(const uint8_t* p) { return p[0] | p[1] << 8 | p[2] << 16 | static_cast<uint32_t>(p[3]) << 24; }
+}  // namespace
+
+PcapHeader parsePcapHeader(const uint8_t* data, size_t len) {
+    PcapHeader h;
+    if (len < kPcapHeaderSize || le32(data) != 0xA1B2C3D4) return h;  // little-endian, microseconds: what we write
+    h.ok = true;
+    h.linkType = le32(data + 20);
+    return h;
+}
+
+bool parsePcapRecord(const uint8_t* data, size_t len, PcapRecord& out) {
+    if (len < kPcapRecordSize) return false;
+    out.seconds = le32(data);
+    out.micros = le32(data + 4);
+    out.length = le32(data + 8);
+    return out.length <= 65535;
+}
+
+bool parseLoraTap(const uint8_t* d, size_t len, lora::RxInfo& out) {
+    if (len < lora::kLoraTapSize || d[0] != 0) return false;
+    out.frequencyHz = static_cast<uint32_t>(d[4]) << 24 | d[5] << 16 | d[6] << 8 | d[7];
+    out.bandwidthKHz = d[8] * 125.0f;
+    out.spreadingFactor = d[9];
+    out.rssi = d[10] - 139.0f;
+    out.noiseFloor = d[12] - 139.0f;
+    out.snr = static_cast<int8_t>(d[13]) / 4.0f;
+    out.syncWord = d[14];
+    return true;
+}
+
+}  // namespace roro::files

lib/files/src/file_views.h

@@ -0,0 +1,57 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "loratap.h"
+
+namespace roro::files {
+
+// What the Storage App's viewers show of the files the firmware writes (F1, Q134).
+
+// One row of a hex dump, eight bytes: "00010 4865 6c6c 6f2c 2077  Hello, w".
+std::string hexRow(uint32_t offset, const uint8_t* data, size_t len);
+
+// A Track (.gpx) read a piece at a time: its points, when it started and ended, how far it went.
+class GpxSummary {
+   public:
+    void feed(const char* data, size_t len);
+
+    uint32_t points() const { return points_; }
+    int64_t start() const { return first_; }  // UTC seconds, 0 if no point carried a time
+    int64_t end() const { return last_; }
+    double meters() const { return meters_; }
+    std::vector<std::string> lines() const;  // for the screen
+
+   private:
+    void point(const std::string& element);
+
+    std::string carry_;  // the part of a point cut by the end of a piece
+    uint32_t points_ = 0;
+    int64_t first_ = 0, last_ = 0;
+    double meters_ = 0, lat_ = 0, lon_ = 0;
+};
+
+// "1 h 02 min", "4 min 10 s", "12 s".
+std::string formatDuration(int64_t seconds);
+
+// A Capture (.pcap): the file's header, then one record after another.
+struct PcapHeader {
+    bool ok = false;
+    uint32_t linkType = 0;  // 270: LoRaTap, what the LoRa Scanner writes
+};
+constexpr size_t kPcapHeaderSize = 24, kPcapRecordSize = 16;
+constexpr uint32_t kLinkLoraTap = 270;
+PcapHeader parsePcapHeader(const uint8_t* data, size_t len);
+
+struct PcapRecord {
+    uint32_t seconds = 0, micros = 0, length = 0;  // length: the bytes that follow in the file
+};
+bool parsePcapRecord(const uint8_t* data, size_t len, PcapRecord& out);  // false: not a record, stop there
+
+// The LoRaTap header a packet starts with; false if `len` is too short for one.
+bool parseLoraTap(const uint8_t* data, size_t len, lora::RxInfo& out);
+
+}  // namespace roro::files

lib/files/src/text_pager.cpp

@@ -0,0 +1,121 @@
+#include "text_pager.h"
+
+#include <algorithm>
+
+namespace roro::files {
+
+TextPager::TextPager(ReadAt read, uint32_t size, int cols, int rows)
+    : read_(std::move(read)), size_(size), cols_(std::max(1, cols)), rows_(std::max(1, rows)) {}
+
+const uint8_t* TextPager::bytes(uint32_t at, size_t& len) {
+    len = 0;
+    if (at >= size_) return nullptr;
+    bool cached = at >= cacheAt_ && at < cacheAt_ + cache_.size();
+    // Wanted: a line's worth ahead, unless the cache already reaches the end of the file.
+    size_t ahead = cached ? cacheAt_ + cache_.size() - at : 0;
+    if (!cached || (ahead < kBlock / 4 && cacheAt_ + cache_.size() < size_)) {
+        cacheAt_ = at - std::min<uint32_t>(at, kBlock / 2);  // room behind too: scrolling back is common
+        cache_.resize(std::min<uint32_t>(kBlock, size_ - cacheAt_));
+        cache_.resize(read_(cacheAt_, cache_.data(), cache_.size()));
+        if (at >= cacheAt_ + cache_.size()) return nullptr;  // the file got shorter, or the card failed
+    }
+    len = cacheAt_ + cache_.size() - at;
+    return cache_.data() + (at - cacheAt_);
+}
+
+int TextPager::byteAt(uint32_t at) {
+    size_t len;
+    const uint8_t* p = bytes(at, len);
+    return p ? *p : -1;
+}
+
+uint32_t TextPager::nextLine(uint32_t at, std::string* text) {
+    size_t len;
+    const uint8_t* p = bytes(at, len);
+    if (text) text->clear();
+    if (!p) return size_;
+    size_t end = len, next = len;  // the line is [0, end); the one after starts at `next`
+    int count = 0;
+    size_t lastSpace = 0;
+    for (size_t i = 0; i < len; i++) {
+        uint8_t b = p[i];
+        if (b == '\n') {
+            end = i;
+            next = i + 1;
+            break;
+        }
+        if ((b & 0xC0) == 0x80) continue;  // inside a UTF-8 character
+        if (count == cols_) {              // one character too many: wrap
+            if (b == ' ') end = i, next = i + 1;
+            else if (lastSpace > 0) end = lastSpace, next = lastSpace + 1;
+            else end = next = i;
+            break;
+        }
+        count++;
+        if (b == ' ') lastSpace = i;
+    }
+    if (text) {
+        size_t n = end > 0 && p[end - 1] == '\r' ? end - 1 : end;
+        text->reserve(n);
+        for (size_t i = 0; i < n; i++) text->push_back(p[i] == '\t' ? ' ' : (p[i] < 0x20 || p[i] == 0x7F) ? '.' : static_cast<char>(p[i]));
+    }
+    return at + static_cast<uint32_t>(std::max<size_t>(next, 1));
+}
+
+uint32_t TextPager::lineBefore(uint32_t at) {
+    if (at == 0) return 0;
+    at = std::min(at, size_);
+    // The paragraph the line before `at` belongs to starts after the newline before it. The byte
+    // just before `at` may be that line's own newline.
+    uint32_t from = at - 1;
+    if (from > 0 && byteAt(from) == '\n') from--;
+    uint32_t limit = at > kLookBack ? at - kLookBack : 0, start = limit;
+    for (uint32_t i = from + 1; i-- > limit;) {
+        if (byteAt(i) == '\n' && i < at - 1) {
+            start = i + 1;
+            break;
+        }
+    }
+    // No newline that near: any character boundary will do as a place to wrap from.
+    while (start > 0 && start < at && (byteAt(start) & 0xC0) == 0x80) start++;
+    for (uint32_t a = start;;) {
+        uint32_t next = nextLine(a, nullptr);
+        if (next >= at) return a;
+        a = next;
+    }
+}
+
+bool TextPager::atEnd() {
+    uint32_t a = top_;
+    for (int i = 0; i < rows_; i++) {
+        a = nextLine(a, nullptr);
+        if (a >= size_) return true;
+    }
+    return false;
+}
+
+void TextPager::down(int n) {
+    for (; n > 0 && !atEnd(); n--) top_ = nextLine(top_, nullptr);
+}
+
+void TextPager::up(int n) {
+    for (; n > 0 && top_ > 0; n--) top_ = lineBefore(top_);
+}
+
+void TextPager::toEnd() {
+    top_ = size_;
+    up(rows_);
+}
+
+std::vector<std::string> TextPager::lines() {
+    std::vector<std::string> out;
+    uint32_t a = top_;
+    for (int i = 0; i < rows_ && a < size_; i++) {
+        std::string text;
+        a = nextLine(a, &text);
+        out.push_back(std::move(text));
+    }
+    return out;
+}
+
+}  // namespace roro::files

lib/files/src/text_pager.h

@@ -0,0 +1,50 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <string>
+#include <vector>
+
+namespace roro::files {
+
+// A text file of any size, shown a screen at a time (F1, Q134): only the part on screen is read,
+// through `read`, about a kilobyte at once. Lines wrap at spaces, `cols` characters wide. Going
+// back a line means finding where the paragraph before started and wrapping it again, so a file
+// reads the same whichever way it was scrolled.
+class TextPager {
+   public:
+    // Reads up to `len` bytes at `offset`; returns how many it got.
+    using ReadAt = std::function<size_t(uint32_t offset, uint8_t* into, size_t len)>;
+
+    TextPager(ReadAt read, uint32_t size, int cols, int rows);
+
+    void toStart() { top_ = 0; }
+    void toEnd();  // the last line at the bottom of the screen
+    void down(int lines = 1);
+    void up(int lines = 1);
+
+    std::vector<std::string> lines();  // what's on screen: tabs as spaces, control characters as dots
+    uint32_t top() const { return top_; }
+    uint32_t size() const { return size_; }
+    bool atEnd();  // the file's last line is on screen
+    int percent() const { return size_ ? static_cast<int>(static_cast<uint64_t>(top_) * 100 / size_) : 0; }
+
+   private:
+    static constexpr size_t kBlock = 1024;       // read at once
+    static constexpr uint32_t kLookBack = 1024;  // how far back a paragraph's start is looked for
+
+    const uint8_t* bytes(uint32_t at, size_t& len);  // what's cached from `at` on
+    int byteAt(uint32_t at);                         // -1 past the end
+    uint32_t nextLine(uint32_t at, std::string* text);  // where the line after the one at `at` starts
+    uint32_t lineBefore(uint32_t at);
+
+    ReadAt read_;
+    uint32_t size_;
+    int cols_, rows_;
+    uint32_t top_ = 0;
+    std::vector<uint8_t> cache_;
+    uint32_t cacheAt_ = 0;
+};
+
+}  // namespace roro::files

lib/net/src/ipv4.cpp

@@ -0,0 +1,97 @@
+#include "ipv4.h"
+
+#include <cstdio>
+
+namespace roro::net {
+
+bool parseIpv4(const std::string& text, uint32_t& out) {
+    uint32_t value = 0;
+    int parts = 0, digits = 0, part = 0;
+    for (char c : text) {
+        if (c >= '0' && c <= '9') {
+            if (++digits > 3) return false;
+            part = part * 10 + (c - '0');
+            if (part > 255) return false;
+        } else if (c == '.') {
+            if (digits == 0 || ++parts > 3) return false;
+            value = value << 8 | part;
+            part = digits = 0;
+        } else {
+            return false;
+        }
+    }
+    if (digits == 0 || parts != 3) return false;
+    out = value << 8 | part;
+    return true;
+}
+
+std::string formatIpv4(uint32_t a) {
+    char s[16];
+    std::snprintf(s, sizeof s, "%u.%u.%u.%u", static_cast<unsigned>(a >> 24), static_cast<unsigned>(a >> 16 & 255),
+                  static_cast<unsigned>(a >> 8 & 255), static_cast<unsigned>(a & 255));
+    return s;
+}
+
+uint32_t maskOf(int prefix) { return prefix <= 0 ? 0 : prefix >= 32 ? 0xFFFFFFFFu : ~0u << (32 - prefix); }
+
+std::string checkFixed(const FixedIp& f) {
+    if (f.prefix < 1 || f.prefix > 30) return "The prefix must be 1 to 30";
+    if (f.address == 0) return "0.0.0.0 isn't an address a device can have";
+    uint32_t mask = maskOf(f.prefix), network = f.address & mask, broadcast = network | ~mask;
+    if (f.address == network) return formatIpv4(f.address) + " is the network's own address";
+    if (f.address == broadcast) return formatIpv4(f.address) + " is the broadcast address";
+    if (f.gateway == 0) return "";
+    if (f.gateway == f.address) return "The gateway can't be this device's address";
+    if ((f.gateway & mask) != network)
+        return "The gateway " + formatIpv4(f.gateway) + " isn't in " + formatIpv4(network) + "/" + std::to_string(f.prefix);
+    if (f.gateway == broadcast) return "The gateway " + formatIpv4(f.gateway) + " is the broadcast address";
+    if (f.gateway == network) return "The gateway " + formatIpv4(f.gateway) + " is the network's own address";
+    return "";
+}
+
+std::string parseFixed(const std::string& text, FixedIp& out) {
+    size_t slash = text.find('/');
+    if (slash == std::string::npos) return "Write it as address/prefix, then the gateway if there is one";
+    size_t space = text.find(' ', slash);
+    std::string address = text.substr(0, slash);
+    std::string prefix = text.substr(slash + 1, space == std::string::npos ? std::string::npos : space - slash - 1);
+    std::string gateway = space == std::string::npos ? "" : text.substr(space + 1);
+    FixedIp f;
+    if (!parseIpv4(address, f.address)) return address + " isn't an IPv4 address";
+    int p = 0;
+    if (prefix.empty() || prefix.size() > 2) return "The prefix must be 1 to 30";
+    for (char c : prefix) {
+        if (c < '0' || c > '9') return "The prefix must be 1 to 30";
+        p = p * 10 + (c - '0');
+    }
+    f.prefix = static_cast<uint8_t>(p);
+    if (!gateway.empty() && !parseIpv4(gateway, f.gateway)) return gateway + " isn't an IPv4 address";
+    std::string why = checkFixed(f);
+    if (why.empty()) out = f;
+    return why;
+}
+
+std::string formatFixed(const FixedIp& f) {
+    std::string s = formatIpv4(f.address) + "/" + std::to_string(f.prefix);
+    if (f.gateway) s += " " + formatIpv4(f.gateway);
+    return s;
+}
+
+bool validHost(const std::string& text) {
+    if (text.empty() || text.size() > 63) return false;
+    uint32_t ignored;
+    if (parseIpv4(text, ignored)) return true;
+    bool allNumeric = true;  // digits and dots only, but not an address: "1.2.3", "999.1.1.1"
+    char previous = '.';
+    for (char c : text) {
+        bool letter = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z'), digit = c >= '0' && c <= '9';
+        if (!letter && !digit && c != '-' && c != '.') return false;
+        if (c == '.' && (previous == '.' || previous == '-')) return false;  // empty label, or one ending in '-'
+        if (c == '-' && previous == '.') return false;                       // a label starting with '-'
+        if (letter || c == '-') allNumeric = false;
+        previous = c;
+    }
+    return previous != '.' && previous != '-' && !allNumeric;
+}
+
+}  // namespace roro::net

lib/net/src/ipv4.h

@@ -0,0 +1,30 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+namespace roro::net {
+
+// IPv4 addresses as 32-bit numbers, most significant byte first: 10.39.39.12 is 0x0A27270C.
+bool parseIpv4(const std::string& text, uint32_t& out);  // strict: four decimal numbers, 0 to 255
+std::string formatIpv4(uint32_t address);
+uint32_t maskOf(int prefix);  // 24 -> 255.255.255.0
+
+// A Saved Network's Fixed setting (S1, Q105 to Q107). gateway 0: none.
+struct FixedIp {
+    uint32_t address = 0;
+    uint8_t prefix = 24;
+    uint32_t gateway = 0;
+};
+
+// "" when a device can use it, otherwise why not, for a human (Q111).
+std::string checkFixed(const FixedIp& f);
+
+// "address/prefix [gateway]", as typed on the console and kept in flash. parseFixed() also checks.
+std::string parseFixed(const std::string& text, FixedIp& out);
+std::string formatFixed(const FixedIp& f);
+
+// An IPv4 address or a host name, as an NTP server may be (Q110).
+bool validHost(const std::string& text);
+
+}  // namespace roro::net

lib/net/src/traffic.cpp

@@ -0,0 +1,46 @@
+#include "traffic.h"
+
+#include <atomic>
+#include <cstdio>
+
+namespace roro::net {
+
+namespace {
+constexpr size_t kUsers = static_cast<size_t>(User::Count);
+std::atomic<uint32_t> in_[kUsers], out_[kUsers];
+}  // namespace
+
+const char* userName(User user) {
+    switch (user) {
+        case User::Irc: return "IRC";
+        case User::Gemini: return "Gemini";
+        case User::DebugConsole: return "Debug Console";
+        case User::Updates: return "Updates";
+        default: return "?";
+    }
+}
+
+void received(User user, size_t bytes) { in_[static_cast<size_t>(user)] += static_cast<uint32_t>(bytes); }
+void sent(User user, size_t bytes) { out_[static_cast<size_t>(user)] += static_cast<uint32_t>(bytes); }
+Traffic traffic(User user) { return {in_[static_cast<size_t>(user)], out_[static_cast<size_t>(user)]}; }
+
+void resetTraffic() {
+    for (size_t i = 0; i < kUsers; i++) in_[i] = out_[i] = 0;
+}
+
+uint32_t bytesPerSecond(uint32_t before, uint32_t now, uint32_t elapsedMs) {
+    if (!elapsedMs) return 0;
+    return static_cast<uint32_t>(static_cast<uint64_t>(now - before) * 1000 / elapsedMs);  // wraps with the counter
+}
+
+std::string formatTraffic(uint32_t bytes) {
+    char s[16];
+    if (bytes < 1000) std::snprintf(s, sizeof s, "%u B", static_cast<unsigned>(bytes));
+    else if (bytes < 10 * 1024) std::snprintf(s, sizeof s, "%.1f KB", bytes / 1024.0);
+    else if (bytes < 1000 * 1024) std::snprintf(s, sizeof s, "%u KB", static_cast<unsigned>(bytes / 1024));
+    else if (bytes < 10u * 1024 * 1024) std::snprintf(s, sizeof s, "%.1f MB", bytes / 1048576.0);
+    else std::snprintf(s, sizeof s, "%u MB", static_cast<unsigned>(bytes / 1048576));
+    return s;
+}
+
+}  // namespace roro::net

lib/net/src/traffic.h

@@ -0,0 +1,26 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace roro::net {
+
+// Bytes each network service has read and written since boot (S1, Q121), as the service sees
+// them: for TLS connections that's the plain text, without the handshake or record overhead.
+// Counted from the services' own tasks, read from the main loop.
+enum class User : uint8_t { Irc, Gemini, DebugConsole, Updates, Count };
+const char* userName(User user);
+
+struct Traffic {
+    uint32_t in = 0, out = 0;
+};
+void received(User user, size_t bytes);
+void sent(User user, size_t bytes);
+Traffic traffic(User user);
+void resetTraffic();  // for tests
+
+uint32_t bytesPerSecond(uint32_t before, uint32_t now, uint32_t elapsedMs);
+std::string formatTraffic(uint32_t bytes);  // "999 B", "1.5 KB", "12 KB", "1.7 MB"
+
+}  // namespace roro::net

lib/notes/src/note_text.cpp

@@ -0,0 +1,329 @@
+#include "note_text.h"
+
+#include <algorithm>
+
+namespace roro::notes {
+
+namespace {
+bool continuation(char c) { return (static_cast<uint8_t>(c) & 0xC0) == 0x80; }
+}  // namespace
+
+NoteText::NoteText(int cols, int rows) : cols_(std::max(1, cols)), rows_(std::max(1, rows)) { text_.reserve(kMaxBytes); }
+
+NoteText::NoteText(int cols, int rows, std::string&& text) : cols_(std::max(1, cols)), rows_(std::max(1, rows)), text_(std::move(text)) {
+    dropCarriageReturns();
+    if (text_.size() > kMaxBytes) text_.resize(kMaxBytes);  // the caller checks sizes: not reached
+    text_.reserve(kMaxBytes);
+}
+
+void NoteText::dropCarriageReturns() {
+    size_t kept = 0;
+    for (size_t i = 0; i < text_.size(); i++)
+        if (!(text_[i] == '\r' && i + 1 < text_.size() && text_[i + 1] == '\n')) text_[kept++] = text_[i];
+    text_.resize(kept);
+}
+
+bool NoteText::setText(const std::string& text) {
+    size_t kept = text.size();
+    for (size_t i = 0; i + 1 < text.size(); i++)
+        if (text[i] == '\r' && text[i + 1] == '\n') kept--;
+    if (kept > kMaxBytes) return false;
+    text_.assign(text);
+    dropCarriageReturns();
+    cursor_ = top_ = 0;
+    goal_ = -1;
+    revision_++;
+    return true;
+}
+
+size_t NoteText::nextLine(size_t start) const {
+    size_t size = text_.size();
+    int count = 0;
+    size_t lastSpace = 0;
+    bool space = false;
+    for (size_t i = start; i < size; i++) {
+        char c = text_[i];
+        if (c == '\n') return i + 1;
+        if (continuation(c)) continue;
+        if (count == cols_) {  // one character too many: wrap
+            if (c == ' ') return i + 1;       // the space stays at the end of this line
+            if (space) return lastSpace + 1;  // after the last space that fits
+            return i;                         // a word longer than the screen is cut
+        }
+        count++;
+        if (c == ' ') {
+            lastSpace = i;
+            space = true;
+        }
+    }
+    return size;
+}
+
+size_t NoteText::lineOf(size_t pos) const {
+    size_t size = text_.size();
+    pos = std::min(pos, size);
+    size_t a = pos;  // the start of the paragraph: after the newline before `pos`
+    while (a > 0 && text_[a - 1] != '\n') a--;
+    while (a < size) {
+        size_t n = nextLine(a);
+        if (n > pos) return a;
+        // The end of the text is on the last line, unless that line ended with a newline: then
+        // it's on an empty line of its own.
+        if (n == size && pos == size && text_[size - 1] != '\n') return a;
+        a = n;
+    }
+    return a;
+}
+
+bool NoteText::hasLineAfter(size_t start) const {
+    size_t n = nextLine(start), size = text_.size();
+    if (n < size) return true;
+    return start < size && lineOf(size) != start;  // the empty line after a final newline
+}
+
+size_t NoteText::lastSpot(size_t start) const {
+    size_t n = nextLine(start), size = text_.size();
+    if (n == start) return start;  // the empty line at the end
+    if (n == size && lineOf(size) == start) return size;
+    size_t p = n - 1;  // before the newline, the space or the last character the line ends with
+    while (p > start && continuation(text_[p])) p--;
+    return p;
+}
+
+int NoteText::columnOf(size_t start, size_t pos) const {
+    int col = 0;
+    for (size_t i = start; i < pos && i < text_.size(); i++)
+        if (!continuation(text_[i])) col++;
+    return col;
+}
+
+size_t NoteText::atColumn(size_t start, int col) const {
+    size_t last = lastSpot(start), p = start;
+    while (p < last && col > 0) {
+        p++;
+        while (p < last && continuation(text_[p])) p++;
+        col--;
+    }
+    return p;
+}
+
+void NoteText::moved(bool keepGoal) {
+    if (!keepGoal) goal_ = -1;
+}
+
+bool NoteText::insertText(const std::string& s) {
+    if (text_.size() + s.size() > kMaxBytes) return false;
+    text_.insert(cursor_, s);
+    cursor_ += s.size();
+    revision_++;
+    moved();
+    return true;
+}
+
+bool NoteText::insert(uint32_t cp) {
+    std::string s;
+    if (cp < 0x80) s += static_cast<char>(cp);
+    else if (cp < 0x800) {
+        s += static_cast<char>(0xC0 | (cp >> 6));
+        s += static_cast<char>(0x80 | (cp & 0x3F));
+    } else if (cp < 0x10000) {
+        s += static_cast<char>(0xE0 | (cp >> 12));
+        s += static_cast<char>(0x80 | ((cp >> 6) & 0x3F));
+        s += static_cast<char>(0x80 | (cp & 0x3F));
+    } else {
+        s += static_cast<char>(0xF0 | (cp >> 18));
+        s += static_cast<char>(0x80 | ((cp >> 12) & 0x3F));
+        s += static_cast<char>(0x80 | ((cp >> 6) & 0x3F));
+        s += static_cast<char>(0x80 | (cp & 0x3F));
+    }
+    return insertText(s);
+}
+
+void NoteText::backspace() {
+    if (cursor_ == 0) return;
+    size_t from = cursor_ - 1;
+    while (from > 0 && continuation(text_[from])) from--;
+    text_.erase(from, cursor_ - from);
+    cursor_ = from;
+    revision_++;
+    moved();
+}
+
+void NoteText::left() {
+    if (cursor_ == 0) return;
+    cursor_--;
+    while (cursor_ > 0 && continuation(text_[cursor_])) cursor_--;
+    moved();
+}
+
+void NoteText::right() {
+    if (cursor_ >= text_.size()) return;
+    cursor_++;
+    while (cursor_ < text_.size() && continuation(text_[cursor_])) cursor_++;
+    moved();
+}
+
+void NoteText::up() {
+    size_t line = lineOf(cursor_);
+    if (goal_ < 0) goal_ = columnOf(line, cursor_);
+    if (line == 0) return;
+    cursor_ = atColumn(lineOf(line - 1), goal_);
+    moved(true);
+}
+
+void NoteText::down() {
+    size_t line = lineOf(cursor_);
+    if (goal_ < 0) goal_ = columnOf(line, cursor_);
+    if (!hasLineAfter(line)) return;
+    size_t next = nextLine(line);
+    cursor_ = next >= text_.size() ? text_.size() : atColumn(next, goal_);
+    moved(true);
+}
+
+void NoteText::pageUp() {
+    for (int i = 1; i < rows_; i++) up();
+}
+
+void NoteText::pageDown() {
+    for (int i = 1; i < rows_; i++) down();
+}
+
+void NoteText::lineStart() {
+    cursor_ = lineOf(cursor_);
+    moved();
+}
+
+void NoteText::lineEnd() {
+    cursor_ = lastSpot(lineOf(cursor_));
+    moved();
+}
+
+void NoteText::toStart() {
+    cursor_ = 0;
+    moved();
+}
+
+void NoteText::toEnd() {
+    cursor_ = text_.size();
+    moved();
+}
+
+void NoteText::follow() {
+    size_t line = lineOf(cursor_);
+    top_ = lineOf(std::min(top_, text_.size()));  // an edit above may have moved where lines start
+    if (line < top_) {
+        top_ = line;
+        return;
+    }
+    size_t a = top_;
+    for (int i = 0; i < rows_; i++) {
+        if (a == line) return;  // on screen
+        if (!hasLineAfter(a)) return;
+        a = nextLine(a);
+    }
+    // Below the screen: the cursor's line becomes the last row.
+    top_ = line;
+    for (int i = 1; i < rows_ && top_ > 0; i++) top_ = lineOf(top_ - 1);
+}
+
+std::vector<std::string> NoteText::rows() {
+    follow();
+    std::vector<std::string> out;
+    size_t a = top_, size = text_.size();
+    for (int i = 0; i < rows_; i++) {
+        size_t n = nextLine(a);
+        std::string row = text_.substr(a, n - a);
+        if (!row.empty() && row.back() == '\n') row.pop_back();
+        for (char& c : row)
+            if (c == '\t') c = ' ';
+        out.push_back(std::move(row));
+        if (!hasLineAfter(a)) break;
+        a = n >= size ? size : n;
+    }
+    return out;
+}
+
+int NoteText::cursorRow() {
+    follow();
+    size_t line = lineOf(cursor_), a = top_;
+    for (int i = 0; i < rows_; i++) {
+        if (a == line) return i;
+        a = nextLine(a);
+    }
+    return rows_ - 1;
+}
+
+int NoteText::cursorCol() { return columnOf(lineOf(cursor_), cursor_); }
+
+// At most a screen's worth of it: a note that is one line of 16 KB must not be copied whole.
+std::string NoteText::firstLine() const { return text_.substr(0, std::min<size_t>(text_.find('\n'), 160)); }
+
+namespace {
+// U+00C0 to U+00FF as the plain letters a file name gets; 0: left out.
+const char kPlain[64] = {
+    'a', 'a', 'a', 'a', 'a', 'a', 0,   'c', 'e', 'e', 'e', 'e', 'i', 'i', 'i', 'i',   // À..Ï
+    0,   'n', 'o', 'o', 'o', 'o', 'o', 0,   'o', 'u', 'u', 'u', 'u', 'y', 0,   's',   // Ð..ß
+    'a', 'a', 'a', 'a', 'a', 'a', 0,   'c', 'e', 'e', 'e', 'e', 'i', 'i', 'i', 'i',   // à..ï
+    0,   'n', 'o', 'o', 'o', 'o', 'o', 0,   'o', 'u', 'u', 'u', 'u', 'y', 0,   'y'};  // ð..ÿ
+
+// Drops a character the end of the string cuts in two.
+void dropPartial(std::string& s) {
+    size_t k = s.size();
+    while (k > 0 && continuation(s[k - 1]) && s.size() - k < 3) k--;
+    if (k == 0) return;
+    uint8_t lead = static_cast<uint8_t>(s[k - 1]);
+    size_t want = lead >= 0xF0 ? 4 : lead >= 0xE0 ? 3 : lead >= 0xC0 ? 2 : 1;
+    if (s.size() - (k - 1) < want) s.resize(k - 1);
+}
+}  // namespace
+
+std::string nameFromFirstLine(const std::string& firstLine, const std::string& stamp) {
+    std::string out;
+    bool dash = false;
+    for (size_t i = 0; i < firstLine.size() && out.size() < 32; i++) {
+        uint8_t c = static_cast<uint8_t>(firstLine[i]);
+        char letter = 0;
+        if (c < 0x80) {
+            if (c >= 'A' && c <= 'Z') letter = static_cast<char>(c + 32);
+            else if ((c >= 'a' && c <= 'z') || (c >= '0' && c <= '9')) letter = static_cast<char>(c);
+        } else if (c == 0xC3 && i + 1 < firstLine.size()) {  // U+00C0..U+00FF
+            letter = kPlain[static_cast<uint8_t>(firstLine[++i]) & 0x3F];
+        } else {
+            while (i + 1 < firstLine.size() && continuation(firstLine[i + 1])) i++;  // anything else is left out
+        }
+        if (letter) {
+            if (dash && !out.empty()) out += '-';
+            dash = false;
+            out += letter;
+        } else {
+            dash = true;
+        }
+    }
+    return out.empty() ? "note-" + stamp : out;
+}
+
+std::string titleFrom(const std::string& head, size_t maxChars) {
+    for (size_t at = 0; at < head.size();) {
+        size_t end = head.find('\n', at);
+        bool cut = end == std::string::npos;  // the line goes on past what was read
+        if (cut) end = head.size();
+        std::string line = head.substr(at, end - at);
+        if (cut) dropPartial(line);
+        while (!line.empty() && (line.back() == '\r' || line.back() == ' ' || line.back() == '\t')) line.pop_back();
+        size_t first = line.find_first_not_of(" \t");
+        if (first != std::string::npos) {
+            line.erase(0, first);
+            size_t bytes = 0;
+            for (size_t chars = 0; bytes < line.size() && chars < maxChars; chars++) {
+                bytes++;
+                while (bytes < line.size() && continuation(line[bytes])) bytes++;
+            }
+            line.resize(bytes);
+            return line;
+        }
+        at = end + 1;
+    }
+    return "";
+}
+
+}  // namespace roro::notes

lib/notes/src/note_text.h

@@ -0,0 +1,81 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace roro::notes {
+
+// The text of a note while it's edited (F1, Q144, Q145): UTF-8 held whole in memory, a cursor, and
+// the part of it on screen. Lines wrap at spaces, `cols` characters wide; a line owns the space or
+// the newline it ends with, so every byte of the text belongs to exactly one line. No index of
+// lines is kept (a note of newlines alone would need twice its size): where a line starts is
+// worked out from the start of its paragraph, which is never far.
+class NoteText {
+   public:
+    static constexpr size_t kMaxBytes = 16 * 1024;
+
+    // Room for a full note is reserved once, so typing never has to find a bigger block of memory:
+    // on the device a failed allocation is the end. The second form takes over a string the
+    // caller filled (and reserved): a note is never in memory twice.
+    NoteText(int cols, int rows);
+    NoteText(int cols, int rows, std::string&& text);
+
+    // Copied into the buffer already held. CRLF becomes LF (Q148). False, and nothing changes, if
+    // it's over kMaxBytes.
+    bool setText(const std::string& text);
+    const std::string& text() const { return text_; }
+    size_t cursor() const { return cursor_; }
+    uint32_t revision() const { return revision_; }  // changes with every edit: is it saved?
+
+    bool insert(uint32_t codePoint);         // false: the note is full
+    bool insertText(const std::string& s);   // all of it or nothing
+    void backspace();
+    void left();
+    void right();
+    void up();
+    void down();
+    void pageUp();
+    void pageDown();
+    void lineStart();
+    void lineEnd();
+    void toStart();
+    void toEnd();
+
+    // The screen, kept around the cursor: its rows (tabs as spaces, the ending newline left out),
+    // and where the cursor is on it, in rows and characters.
+    std::vector<std::string> rows();
+    int cursorRow();
+    int cursorCol();
+    int percent() const { return text_.empty() ? 0 : static_cast<int>(top_ * 100 / text_.size()); }
+
+    std::string firstLine() const;  // without its newline, for the title and the file's name
+
+   private:
+    size_t nextLine(size_t start) const;       // where the line after the one at `start` starts
+    size_t lineOf(size_t pos) const;           // the start of the line `pos` is on
+    size_t lastSpot(size_t start) const;       // the last place the cursor can be on that line
+    size_t atColumn(size_t start, int col) const;
+    int columnOf(size_t start, size_t pos) const;
+    bool hasLineAfter(size_t start) const;
+    void moved(bool keepGoal = false);
+    void follow();  // scrolls so the cursor is on screen
+    void dropCarriageReturns();
+
+    int cols_, rows_;
+    std::string text_;
+    size_t cursor_ = 0, top_ = 0;
+    int goal_ = -1;  // the column Up and Down aim for, across short lines
+    uint32_t revision_ = 0;
+};
+
+// The file a new note is saved as (Q142): from its first line, "Shopping list!" -> "shopping-list",
+// or "note-<stamp>" when that gives nothing. No extension, no folder.
+std::string nameFromFirstLine(const std::string& firstLine, const std::string& stamp);
+
+// A row's title in the Notes list, from the first bytes of a file: its first line that isn't
+// blank, cut to `maxChars`; "" if there's none.
+std::string titleFrom(const std::string& head, size_t maxChars);
+
+}  // namespace roro::notes

lib/services/src/power_policy.cpp

@@ -10,7 +10,10 @@ bool PowerPolicy::activity(uint32_t nowMs) {
 }
 
 ScreenState PowerPolicy::update(uint32_t nowMs) {
-    uint32_t idle = nowMs - lastActivityMs_;
+    // Activity stamped from a clock read after this pass's nowMs (the Debug Console's `key`) is in
+    // the future, not 49 days ago: unsigned, the screen went off for a tick and ate the next key.
+    int32_t since = static_cast<int32_t>(nowMs - lastActivityMs_);
+    uint32_t idle = since < 0 ? 0 : static_cast<uint32_t>(since);
     state_ = idle >= offMs_ ? ScreenState::Off : idle >= dimMs_ ? ScreenState::Dimmed : ScreenState::On;
     if (notifying_) {
         if (static_cast<int32_t>(nowMs - notifyUntilMs_) >= 0)

lib/services/src/settings.cpp

@@ -1,5 +1,7 @@
 #include "settings.h"
 
+#include "ipv4.h"
+
 namespace roro {
 
 namespace {
@@ -32,6 +34,12 @@ const Definition kDefinitions[] = {
     {"gnss_on", Kind::Bool, 1, nullptr, 0, 1},
     {"coord_dms", Kind::Bool, 0, nullptr, 0, 1},
     {"lora_preset", Kind::Int, 0, nullptr, 0, 6},  // LongFast first
+    {"dns1", Kind::String, 0, "9.9.9.9", 7, 15},  // Quad9
+    {"dns2", Kind::String, 0, "1.1.1.1", 0, 15},  // Cloudflare
+    {"dns_always", Kind::Bool, 0, nullptr, 0, 1},
+    {"ntp1", Kind::String, 0, "pool.ntp.org", 1, 63},
+    {"ntp2", Kind::String, 0, "time.cloudflare.com", 0, 63},
+    {"gnss_quiet", Kind::Bool, 0, nullptr, 0, 1},  // off: GNSS stays on, as decided in M2 (Q58)
 };
 static_assert(sizeof(kDefinitions) / sizeof(kDefinitions[0]) == static_cast<size_t>(Setting::Count),
               "every Setting needs a definition");
@@ -84,6 +92,11 @@ bool Settings::validString(Setting s, const std::string& value) const {
             if (value == region) return true;
         return false;
     }
+    uint32_t address;
+    if (s == Setting::Dns1) return net::parseIpv4(value, address);
+    if (s == Setting::Dns2) return value.empty() || net::parseIpv4(value, address);
+    if (s == Setting::Ntp1) return net::validHost(value);
+    if (s == Setting::Ntp2) return value.empty() || net::validHost(value);
     return true;
 }
 

lib/services/src/settings.h

@@ -24,6 +24,12 @@ enum class Setting : uint8_t {
     GnssEnabled,      // bool: the GNSS Service reads the receiver (M2, Q58)
     CoordinatesDms,   // bool: show degrees, minutes and seconds instead of decimal degrees (Q64)
     LoraPreset,       // int: the LoRa Scanner's Meshtastic preset, an index into the EU868 list (M3, Q95)
+    Dns1,             // string: the first DNS server, an IPv4 address (S1, Q108, Q109)
+    Dns2,             // string: the second, or empty
+    DnsAlways,        // bool: use them on Automatic (DHCP) networks too, instead of DHCP's
+    Ntp1,             // string: the first NTP server, a host name or an IPv4 address (S1, Q110)
+    Ntp2,             // string: the second, or empty
+    GnssQuietForLora, // bool: put the GNSS receiver in standby while the LoRa radio listens (issue #20)
     Count
 };
 

lib/services/src/storage_monitor.cpp

@@ -24,7 +24,7 @@ void StorageMonitor::update(bool present, uint64_t totalBytes, uint64_t usedByte
 
     if (next.present && next.level >= 80 && !warned_) {
         warned_ = true;
-        bus_.publish(Event::withText(EventType::Notification, "SD card over 80% full",
+        bus_.publish(Event::withText(EventType::Notification, "SD card over 80% full: see Storage",
                                      static_cast<int32_t>(NotificationLevel::Warning)));
     }
 }

lib/system/src/task_stats.cpp

@@ -0,0 +1,72 @@
+#include "task_stats.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstring>
+
+namespace roro {
+
+std::vector<TaskRow> taskRows(const std::vector<TaskSample>& before, uint32_t totalBefore,
+                              const std::vector<TaskSample>& now, uint32_t totalNow) {
+    uint32_t elapsed = totalNow - totalBefore;  // unsigned: right across one wrap
+    std::vector<TaskRow> rows;
+    rows.reserve(now.size());
+    for (const TaskSample& t : now) {
+        uint32_t ran = t.runtime;  // a task that wasn't there before ran all of it since
+        for (const TaskSample& b : before)
+            if (b.id == t.id) {
+                ran = t.runtime - b.runtime;
+                break;
+            }
+        TaskRow r;
+        r.name = t.name;
+        r.core = t.core;
+        r.state = t.state;
+        r.priority = t.priority;
+        r.stackFree = t.stackFree;
+        r.permille = elapsed ? static_cast<uint16_t>(std::min<uint64_t>(1000, static_cast<uint64_t>(ran) * 1000 / elapsed)) : 0;
+        r.lowStack = t.stackFree < kLowStackBytes;
+        r.idle = std::strncmp(t.name, "IDLE", 4) == 0;
+        rows.push_back(r);
+    }
+    // The task that took the sample is running, and FreeRTOS counts a task's time when it's
+    // switched out: with its core to itself it never was, and its counter hardly moved. Give it
+    // what's left of its core once the idle task and the other tasks pinned there are counted.
+    for (TaskRow& r : rows) {
+        if (r.state != 0 || r.idle || r.core < 0) continue;  // 0: eRunning
+        int others = 0;
+        bool idleSeen = false;
+        for (const TaskRow& o : rows) {
+            if (&o == &r || o.core != r.core) continue;
+            others += o.permille;
+            idleSeen |= o.idle;
+        }
+        if (idleSeen && elapsed && 1000 - others > r.permille) r.permille = static_cast<uint16_t>(std::max(0, 1000 - others));
+    }
+    return rows;
+}
+
+int coreLoad(const std::vector<TaskRow>& rows, int core) {
+    for (const TaskRow& r : rows)
+        if (r.idle && r.core == core) return 100 - (r.permille + 5) / 10;
+    return -1;
+}
+
+void sortTasks(std::vector<TaskRow>& rows, TaskSort by) {
+    auto lower = [](const std::string& s) {
+        std::string l = s;
+        for (char& c : l) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
+        return l;
+    };
+    std::stable_sort(rows.begin(), rows.end(), [&](const TaskRow& a, const TaskRow& b) {
+        switch (by) {
+            case TaskSort::Share:
+                if (a.idle != b.idle) return !a.idle;  // idle tasks last
+                return a.permille > b.permille;
+            case TaskSort::Stack: return a.stackFree < b.stackFree;
+            default: return lower(a.name) < lower(b.name);
+        }
+    });
+}
+
+}  // namespace roro

lib/system/src/task_stats.h

@@ -0,0 +1,65 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+namespace roro {
+
+// One task as FreeRTOS reports it at one moment.
+struct TaskSample {
+    uint32_t id = 0;       // unique per task: a new task with an old name has another
+    char name[17] = {};
+    uint32_t runtime = 0;  // microseconds on a CPU since it started; 32 bits, so it wraps every 71 minutes
+    uint16_t stackFree = 0;  // the least it ever had left, bytes
+    int8_t core = -1;        // -1: not pinned
+    uint8_t state = 0;       // eTaskState
+    uint8_t priority = 0;
+};
+
+// What the System App and `tasks` show for a task (S1, Q119, Q122).
+struct TaskRow {
+    std::string name;
+    int core = -1;
+    uint8_t state = 0, priority = 0;
+    uint16_t stackFree = 0;
+    uint16_t permille = 0;  // share of one core over the interval, in tenths of a percent
+    bool lowStack = false;
+    bool idle = false;      // a core's idle task: what's left over
+};
+
+constexpr uint16_t kLowStackBytes = 512;
+
+// Shares from two samples: each task's run time between them over the time that passed. The
+// 32-bit counters may have wrapped once in between. The task that took the samples (the one
+// running) gets what's left of its core: see the .cpp.
+std::vector<TaskRow> taskRows(const std::vector<TaskSample>& before, uint32_t totalBefore,
+                              const std::vector<TaskSample>& now, uint32_t totalNow);
+
+// A core's load in percent: what its idle task didn't use. -1 without that task in the rows.
+int coreLoad(const std::vector<TaskRow>& rows, int core);
+
+enum class TaskSort : uint8_t { Share, Stack, Name };
+void sortTasks(std::vector<TaskRow>& rows, TaskSort by);
+
+// The last N samples, oldest first (Q120).
+template <typename T, size_t N>
+class History {
+   public:
+    void push(T value) {
+        values_[(first_ + size_) % N] = value;
+        if (size_ < N) size_++;
+        else first_ = (first_ + 1) % N;
+    }
+    size_t size() const { return size_; }
+    T at(size_t i) const { return values_[(first_ + i) % N]; }  // 0: the oldest kept
+    void clear() { first_ = size_ = 0; }
+
+   private:
+    T values_[N] = {};
+    size_t first_ = 0, size_ = 0;
+};
+
+}  // namespace roro

lib/wifi/src/saved_networks.cpp

@@ -17,6 +17,8 @@ void SavedNetworks::load() {
         int32_t hidden = 0;
         store_.getInt(key(i, "hid").c_str(), hidden);
         net.hidden = hidden != 0;
+        std::string ip;  // "address/prefix [gateway]", or empty for Automatic
+        net.fixed = store_.getString(key(i, "ip").c_str(), ip) && !ip.empty() && net::parseFixed(ip, net.ip).empty();
         networks_.push_back(net);
     }
 }
@@ -40,11 +42,30 @@ std::string SavedNetworks::add(const std::string& ssid, const std::string& passw
         }
     }
     if (count() >= kMax) return "Already 8 saved networks: forget one first";
-    networks_.push_back({ssid, password, hidden});
+    SavedNetwork added;
+    added.ssid = ssid;
+    added.password = password;
+    added.hidden = hidden;
+    networks_.push_back(added);
     save();
     return "";
 }
 
+std::string SavedNetworks::setIp(const std::string& ssid, const net::FixedIp* fixed) {
+    for (auto& n : networks_) {
+        if (n.ssid != ssid) continue;
+        if (fixed) {
+            std::string why = net::checkFixed(*fixed);
+            if (!why.empty()) return why;
+            n.ip = *fixed;
+        }
+        n.fixed = fixed != nullptr;
+        save();
+        return "";
+    }
+    return "Not a saved network";
+}
+
 void SavedNetworks::forget(const std::string& ssid) {
     for (auto it = networks_.begin(); it != networks_.end(); ++it) {
         if (it->ssid == ssid) {
@@ -60,6 +81,7 @@ void SavedNetworks::save() {
         store_.putString(key(i, "ssid").c_str(), networks_[i].ssid);
         store_.putString(key(i, "pass").c_str(), networks_[i].password);
         store_.putInt(key(i, "hid").c_str(), networks_[i].hidden ? 1 : 0);
+        store_.putString(key(i, "ip").c_str(), networks_[i].fixed ? net::formatFixed(networks_[i].ip) : "");
     }
     store_.putInt("net_count", count());
 }

lib/wifi/src/saved_networks.h

@@ -3,6 +3,7 @@
 #include <string>
 #include <vector>
 
+#include "ipv4.h"
 #include "key_value_store.h"
 
 namespace roro {
@@ -11,6 +12,8 @@ struct SavedNetwork {
     std::string ssid;
     std::string password;  // empty for an open network
     bool hidden = false;   // doesn't broadcast its name, so never shows up in scans
+    bool fixed = false;    // S1, Q105: Fixed address (`ip`), or Automatic (DHCP)
+    net::FixedIp ip;
 };
 
 // The Saved Networks the Wi-Fi Service may join (see CONTEXT.md), persisted in internal flash.
@@ -28,6 +31,8 @@ class SavedNetworks {
     // Adds, or updates the password of an existing SSID. Empty on success, otherwise why not.
     std::string add(const std::string& ssid, const std::string& password, bool hidden = false);
     void forget(const std::string& ssid);
+    // The IP setting: Fixed with these values, or Automatic (DHCP) for nullptr. Empty, or why not.
+    std::string setIp(const std::string& ssid, const net::FixedIp* fixed);
 
    private:
     void save();

scripts/rdbg.py

@@ -224,10 +224,15 @@ def interactive(sock):
             sys.stdout.write(data.decode(errors="replace"))
             sys.stdout.flush()
         if sys.stdin in ready:
-            line = sys.stdin.readline()
-            if not line:
+            # Straight from the descriptor: readline() takes every waiting line into Python's own
+            # buffer and hands over one, and select() then sees nothing more to read. Piped input
+            # written while we were still connecting got stuck until the next line came.
+            data = os.read(sys.stdin.fileno(), 4096)
+            if not data:
                 return
-            sock.sendall(line.encode())
+            sock.setblocking(True)
+            sock.sendall(data)
+            sock.setblocking(False)
 
 
 def main():

src/apps/file_viewer.cpp

@@ -0,0 +1,470 @@
+#include "file_viewer.h"
+
+#include <Arduino.h>
+#include <SD.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstdio>
+#include <ctime>
+
+#include "cleanup_plan.h"
+#include "file_list.h"
+#include "file_names.h"
+#include "file_views.h"
+#include "meshtastic_presets.h"
+#include "packet_view.h"
+#include "platform/ota_device.h"
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+#include "update_parser.h"
+#include "version.h"
+
+namespace roro {
+
+namespace {
+constexpr uint32_t kSliceMs = 150;      // like the Storage App's operations: the Logs get their turn
+constexpr size_t kPiece = 1024;
+constexpr size_t kMaxPackets = 1000;    // their places in the file, 4 KB
+constexpr size_t kMaxPacketBytes = 271;  // LoRaTap and the longest LoRa packet
+
+// Checks an Update File as an install would, writing nothing.
+struct NoSink : UpdateSink {
+    bool begin(size_t) override { return true; }
+    bool write(const uint8_t*, size_t) override { return true; }
+    bool finish() override { return true; }
+    void abort() override {}
+};
+
+std::string clockTime(uint32_t utcSeconds) {
+    time_t t = static_cast<time_t>(utcSeconds);
+    struct tm local;
+    localtime_r(&t, &local);
+    char s[12];
+    std::snprintf(s, sizeof s, "%02d:%02d:%02d", local.tm_hour, local.tm_min, local.tm_sec);
+    return s;
+}
+}  // namespace
+
+struct FileViewer::Scan {
+    std::atomic<bool> done{false}, stop{false};
+    std::atomic<int> percent{0};
+    Mode what = Mode::Gpx;
+    std::string path;
+    // Touched by the storage task until `done`, by the viewer after.
+    fs::File file;
+    bool opened = false;
+    uint32_t at = 0, size = 0;
+    std::string error;
+    files::GpxSummary gpx;
+    files::PcapHeader pcap;
+    std::vector<uint32_t> packets;  // where each record starts
+    bool morePackets = false;
+    std::unique_ptr<EcdsaVerifier> verifier;
+    NoSink sink;
+    std::unique_ptr<UpdateParser> parser;
+    std::string version;
+    bool genuine = false, older = false;
+
+    bool slice();  // true when there's nothing more to read
+    static void run(StorageService* storage, std::shared_ptr<Scan> self) {
+        bool over = self->stop || self->slice();
+        if (over) {
+            if (self->file) self->file.close();
+            self->parser.reset();
+            self->verifier.reset();
+            self->done = true;
+        } else {
+            storage->runJob([storage, self]() { run(storage, self); });
+        }
+    }
+};
+
+bool FileViewer::Scan::slice() {
+    uint32_t t0 = millis();
+    if (!opened) {
+        opened = true;
+        file = SD.open(path.c_str(), FILE_READ);
+        if (!file) {
+            error = "The card refused to open it";
+            return true;
+        }
+        size = static_cast<uint32_t>(file.size());
+        if (what == Mode::Ota) {
+            verifier.reset(new EcdsaVerifier());
+            parser.reset(new UpdateParser(*verifier, sink, EspOtaSink().capacity(), versionString()));
+        }
+    }
+    std::unique_ptr<uint8_t[]> piece(new uint8_t[kPiece]);
+    while (millis() - t0 < kSliceMs) {
+        if (stop) return true;
+        if (what == Mode::Pcap) {
+            if (at == 0) {
+                int n = file.read(piece.get(), files::kPcapHeaderSize);
+                pcap = files::parsePcapHeader(piece.get(), n < 0 ? 0 : n);
+                if (!pcap.ok) {
+                    error = "Not a pcap file this viewer reads";
+                    return true;
+                }
+                at = files::kPcapHeaderSize;
+            }
+            files::PcapRecord r;
+            if (!file.seek(at)) return true;
+            int n = file.read(piece.get(), files::kPcapRecordSize);
+            if (n < 0 || !files::parsePcapRecord(piece.get(), n, r) || at + files::kPcapRecordSize + r.length > size) return true;
+            if (packets.size() >= kMaxPackets) {
+                morePackets = true;
+                return true;
+            }
+            packets.push_back(at);
+            at += files::kPcapRecordSize + r.length;
+            continue;
+        }
+        int n = file.read(piece.get(), kPiece);
+        if (n <= 0) break;
+        at += n;
+        percent = size ? static_cast<int>(static_cast<uint64_t>(at) * 100 / size) : 100;
+        if (what == Mode::Gpx) {
+            gpx.feed(reinterpret_cast<const char*>(piece.get()), n);
+        } else {
+            parser->feed(piece.get(), n);
+            if (parser->state() == UpdateParser::State::Failed) break;
+        }
+    }
+    if (at < size && !(parser && parser->state() == UpdateParser::State::Failed) && millis() - t0 >= kSliceMs) return false;
+    if (parser) {
+        genuine = parser->end();
+        version = parser->version();
+        older = parser->isDowngrade();
+        error = parser->error();
+    }
+    return true;
+}
+
+size_t FileViewer::readAt(uint32_t offset, uint8_t* into, size_t len) {
+    size_t got = 0;
+    auto file = file_;
+    std::string path = path_;
+    storage_.runAndWait([&, file, path]() {
+        if (!*file) *file = SD.open(path.c_str(), FILE_READ);
+        if (!*file || !file->seek(offset)) return;
+        int n = file->read(into, len);
+        got = n < 0 ? 0 : n;
+    });
+    return got;
+}
+
+void FileViewer::open(const std::string& path, uint32_t size) {
+    close();
+    path_ = path;
+    size_ = size;
+    file_ = std::make_shared<fs::File>();
+    std::string name = files::baseName(path);
+    files::FileKind kind = files::kindOf(name);
+    if (kind == files::FileKind::Unknown) {  // what do its first bytes look like?
+        uint8_t head[256];
+        size_t n = readAt(0, head, sizeof head);
+        kind = files::looksLikeText(head, n) ? files::FileKind::Text : files::FileKind::Unknown;
+    }
+    switch (kind) {
+        case files::FileKind::Text: base_ = Mode::Text; break;
+        case files::FileKind::Gpx: base_ = Mode::Gpx; break;
+        case files::FileKind::Pcap: base_ = Mode::Pcap; break;
+        case files::FileKind::Ota: base_ = Mode::Ota; break;
+        default: base_ = Mode::Hex; break;
+    }
+    pager_.reset(new files::TextPager([this](uint32_t offset, uint8_t* into, size_t len) { return readAt(offset, into, len); }, size_,
+                                      kCols, kRows));
+    if (files::opensAtEnd(name)) pager_->toEnd();
+    hexTop_ = 0;
+    show(base_);
+    if (base_ == Mode::Gpx || base_ == Mode::Pcap || base_ == Mode::Ota) startScan(base_);
+}
+
+void FileViewer::startScan(Mode mode) {
+    scan_ = std::make_shared<Scan>();
+    scan_->what = mode;
+    scan_->path = path_;
+    scanShown_ = false;
+    shownPercent_ = -1;
+    auto scan = scan_;
+    StorageService* storage = &storage_;
+    storage_.runJob([storage, scan]() { Scan::run(storage, scan); });
+}
+
+void FileViewer::close() {
+    if (scan_) scan_->stop = true;  // its job ends at the next piece and frees itself
+    scan_.reset();
+    if (file_) {
+        auto file = file_;
+        storage_.runJob([file]() {
+            if (*file) file->close();
+        });
+    }
+    file_.reset();
+    pager_.reset();
+    confirm_.reset();
+    message_.clear();
+    std::vector<std::string>().swap(shown_);
+    std::vector<std::string>().swap(details_);
+    packets_.setCount(0);
+    rowsFrom_ = -1;
+}
+
+void FileViewer::show(Mode mode) {
+    mode_ = mode;
+    stale_ = true;
+    rowsFrom_ = -1;
+}
+
+void FileViewer::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+}
+
+std::string FileViewer::title() const { return files::fitName(files::baseName(path_), 24); }
+
+void FileViewer::scroll(int lines) {
+    if (mode_ == Mode::Text && pager_) {
+        if (lines > 0) pager_->down(lines);
+        else pager_->up(-lines);
+    } else if (mode_ == Mode::Hex) {
+        uint32_t rows = (size_ + 7) / 8, last = rows > static_cast<uint32_t>(kRows) ? rows - kRows : 0;
+        int64_t to = static_cast<int64_t>(hexTop_) + lines;
+        hexTop_ = static_cast<uint32_t>(std::clamp<int64_t>(to, 0, last));
+    }
+    stale_ = true;
+}
+
+void FileViewer::openPacket(int index) {
+    if (!scan_ || !scan_->done || index < 0 || index >= static_cast<int>(scan_->packets.size())) return;
+    uint8_t buf[files::kPcapRecordSize + kMaxPacketBytes];
+    size_t n = readAt(scan_->packets[index], buf, sizeof buf);
+    files::PcapRecord r;
+    if (!files::parsePcapRecord(buf, n, r)) return;
+    const uint8_t* body = buf + files::kPcapRecordSize;
+    size_t have = std::min<size_t>(r.length, n - files::kPcapRecordSize);
+    details_.clear();
+    char line[64];
+    lora::RxInfo rx;
+    bool tap = scan_->pcap.linkType == files::kLinkLoraTap && files::parseLoraTap(body, have, rx);
+    size_t skip = tap ? lora::kLoraTapSize : 0;
+    std::snprintf(line, sizeof line, "%s, %u bytes", clockTime(r.seconds).c_str(), static_cast<unsigned>(r.length - skip));
+    details_.push_back(line);
+    if (tap) {
+        std::snprintf(line, sizeof line, "%.0f dBm, SNR %.1f dB, noise %.0f", rx.rssi, rx.snr, rx.noiseFloor);
+        details_.push_back(line);
+        std::snprintf(line, sizeof line, "%.4f MHz, SF%u, %.0f kHz", rx.frequencyHz / 1e6, rx.spreadingFactor, rx.bandwidthKHz);
+        details_.push_back(line);
+        if (rx.syncWord == meshtastic::kSyncWord)
+            for (auto& l : lora::headerLines(body + skip, have - skip)) details_.push_back(l);
+    }
+    for (auto& l : lora::hexDump(body + skip, have - skip)) details_.push_back(l);
+    if (have < r.length) details_.push_back("(the first bytes only)");
+    detailsTop_ = 0;
+    mode_ = Mode::Packet;
+}
+
+bool FileViewer::onKey(const KeyEvent& e) {
+    if (confirm_) {
+        confirm_->onKey(e);
+        if (confirm_->result() == 1) update_.installFromSd(path_);
+        if (confirm_->result() != DialogModel::kPending) confirm_.reset();
+        return true;
+    }
+    if (mode_ == Mode::Packet) {
+        int last = std::max(0, static_cast<int>(details_.size()) - (kRows + 1));
+        if (e.key == Key::Up) detailsTop_ = std::max(0, detailsTop_ - 1);
+        else if (e.key == Key::Down) detailsTop_ = std::min(last, detailsTop_ + 1);
+        else if (e.key == Key::Back || e.key == Key::Select) mode_ = Mode::Pcap;
+        return true;
+    }
+    if (e.key == Key::Back) return false;
+    if (e.key == Key::Tab) {
+        // The file's own view, or what it's made of: text for a Track, bytes for the others.
+        if (mode_ != base_) show(base_);
+        else show(base_ == Mode::Hex || base_ == Mode::Gpx ? Mode::Text : Mode::Hex);
+        return true;
+    }
+    uint32_t ch = e.key == Key::Char ? e.ch : 0;
+    switch (mode_) {
+        case Mode::Text:
+        case Mode::Hex:
+            if (e.key == Key::Up) scroll(-1);
+            else if (e.key == Key::Down) scroll(1);
+            else if (e.key == Key::Left) scroll(-(kRows - 1));
+            else if (e.key == Key::Right) scroll(kRows - 1);
+            else if (ch == 't' || ch == 'T') {
+                if (pager_) pager_->toStart();
+                hexTop_ = 0;
+                stale_ = true;
+            } else if (ch == 'b' || ch == 'B') {
+                if (mode_ == Mode::Text && pager_) pager_->toEnd();
+                else scroll(INT32_MAX / 2);
+                stale_ = true;
+            }
+            break;
+        case Mode::Pcap:
+            if (e.key == Key::Up) packets_.up();
+            else if (e.key == Key::Down) packets_.down();
+            else if (e.key == Key::Left) packets_.pageUp();
+            else if (e.key == Key::Right) packets_.pageDown();
+            else if (e.key == Key::Select) openPacket(packets_.selected());
+            break;
+        case Mode::Ota:
+            if (e.key == Key::Select && scan_ && scan_->done && scan_->genuine) confirm_.reset(new DialogModel({"Cancel", "Install"}));
+            break;
+        default: break;
+    }
+    return true;
+}
+
+bool FileViewer::update(uint32_t) {
+    if (!message_.empty() && millis() - messageMs_ >= 4000) {
+        message_.clear();
+        return true;
+    }
+    if (!scan_) return false;
+    if (scan_->done && !scanShown_) {
+        scanShown_ = true;
+        if (scan_->what == Mode::Pcap) packets_.setCount(static_cast<int>(scan_->packets.size()));
+        return true;
+    }
+    int percent = scan_->percent;
+    if (!scan_->done && percent != shownPercent_) {
+        shownPercent_ = percent;
+        return true;
+    }
+    return false;
+}
+
+void FileViewer::refresh() {
+    if (mode_ == Mode::Text && stale_ && pager_) {
+        shown_ = pager_->lines();
+        stale_ = false;
+    } else if (mode_ == Mode::Hex && stale_) {
+        uint8_t buf[kRows * 8];
+        size_t n = readAt(hexTop_ * 8, buf, sizeof buf);
+        shown_.clear();
+        for (size_t at = 0; at < n; at += 8) shown_.push_back(files::hexRow(hexTop_ * 8 + at, buf + at, std::min<size_t>(8, n - at)));
+        stale_ = false;
+    } else if (mode_ == Mode::Pcap && scan_ && scan_->done && rowsFrom_ != packets_.firstVisible()) {
+        // The rows on screen, read from the card once each time the list moves.
+        rowsFrom_ = packets_.firstVisible();
+        shown_.clear();
+        bool tap = scan_->pcap.linkType == files::kLinkLoraTap;
+        for (int i = rowsFrom_; i < rowsFrom_ + kRows && i < static_cast<int>(scan_->packets.size()); i++) {
+            uint8_t buf[files::kPcapRecordSize + kMaxPacketBytes];
+            size_t n = readAt(scan_->packets[i], buf, sizeof buf);
+            files::PcapRecord r;
+            lora::RxInfo rx;
+            if (!files::parsePcapRecord(buf, n, r)) {
+                shown_.push_back("(unreadable)");
+                continue;
+            }
+            const uint8_t* body = buf + files::kPcapRecordSize;
+            size_t have = std::min<size_t>(r.length, n - files::kPcapRecordSize);
+            if (tap && files::parseLoraTap(body, have, rx)) {
+                shown_.push_back(lora::row({body + lora::kLoraTapSize, have - lora::kLoraTapSize, rx.rssi, rx.snr, true,
+                                            rx.syncWord == meshtastic::kSyncWord},
+                                           clockTime(r.seconds)));
+            } else {
+                shown_.push_back(clockTime(r.seconds) + "  " + std::to_string(r.length) + " bytes");
+            }
+        }
+    }
+}
+
+void FileViewer::draw(Canvas& c) {
+    const auto& area = theme::kContent;
+    refresh();
+    c.setTextDatum(top_left);
+    theme::Rect body{area.x, area.y + 10, area.w, kRows * theme::kLineHeight};
+    std::string right, keys = "Tab: hex";
+    bool scanning = scan_ && !scan_->done;
+
+    switch (mode_) {
+        case Mode::Text:
+        case Mode::Hex: {
+            c.setFont(&fonts::body);
+            c.setTextColor(size_ == 0 ? theme::kMuted : theme::kText);
+            if (size_ == 0) c.drawString("(empty)", 4, body.y + 1);
+            for (size_t i = 0; i < shown_.size(); i++) c.drawString(shown_[i].c_str(), 4, body.y + 1 + static_cast<int>(i) * theme::kLineHeight);
+            uint32_t at = mode_ == Mode::Text && pager_ ? pager_->top() : hexTop_ * 8;
+            if (size_ > 0) {  // where in the file the screen is
+                int barH = 12, barY = body.y + static_cast<int>(static_cast<uint64_t>(body.h - barH) * at / size_);
+                c.fillRect(area.w - 2, barY, 2, barH, theme::kMuted);
+            }
+            right = formatBytes(size_);
+            keys = std::string("Tab: ") + (mode_ != base_ ? "back" : mode_ == Mode::Text ? "hex" : "text") + "  t: top  b: end";
+            if (mode_ == Mode::Text) keys += "  e: edit";
+            break;
+        }
+        case Mode::Gpx: {
+            std::vector<std::string> lines;
+            if (scanning) lines.push_back("Reading the Track... " + std::to_string(scan_->percent.load()) + "%");
+            else if (scan_ && !scan_->error.empty()) lines.push_back(scan_->error);
+            else if (scan_) lines = scan_->gpx.lines();
+            widgets::textLines(c, lines, 0, body);
+            right = formatBytes(size_);
+            keys = "Tab: the file as text";
+            break;
+        }
+        case Mode::Pcap: {
+            c.setFont(&fonts::body);
+            c.setTextColor(theme::kMuted);
+            if (scanning) c.drawString("Reading the Capture...", 4, body.y + 1);
+            else if (scan_ && !scan_->error.empty()) c.drawString(scan_->error.c_str(), 4, body.y + 1);
+            else if (scan_ && scan_->packets.empty()) c.drawString("No packets in this Capture.", 4, body.y + 1);
+            else if (scan_) {
+                int from = rowsFrom_;
+                widgets::list(c, packets_, body, [&](int i) {
+                    size_t row = static_cast<size_t>(i - from);
+                    return row < shown_.size() ? shown_[row] : std::string();
+                });
+                right = std::to_string(scan_->packets.size()) + (scan_->morePackets ? "+ packets" : " packets");
+                keys = "Enter: the packet  Tab: hex";
+            }
+            break;
+        }
+        case Mode::Packet: widgets::textLines(c, details_, detailsTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 2}); return;
+        case Mode::Ota: {
+            std::vector<std::string> lines;
+            bool ok = scan_ && scan_->done && scan_->genuine;
+            if (scanning) {
+                lines.push_back("Checking it as an install would:");
+                lines.push_back("signature and contents, " + std::to_string(scan_->percent.load()) + "%");
+            } else if (scan_) {
+                if (!scan_->version.empty()) lines.push_back("Version " + scan_->version);
+                lines.push_back(std::string("Running ") + versionString());
+                if (ok) {
+                    lines.push_back("Signed with the project's key, intact.");
+                    if (scan_->older) lines.push_back("Older than what's running.");
+                } else {
+                    lines.push_back("Not installable:");
+                    lines.push_back(scan_->error.empty() ? "it ends too early" : scan_->error);
+                }
+            }
+            widgets::textLines(c, lines, 0, body);
+            right = formatBytes(size_);
+            keys = ok ? "Enter: install  Tab: hex" : "Tab: hex";
+            if (confirm_) {
+                widgets::dialog(c, "Install update?", "The device restarts into " + scan_->version + " once it's written.", *confirm_);
+                return;
+            }
+            break;
+        }
+    }
+
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(top_left);
+    c.drawString(title().c_str(), 4, area.y + 1);
+    c.setTextDatum(top_right);
+    c.drawString(right.c_str(), area.w - 3, area.y + 1);
+    c.setTextDatum(top_left);
+    if (!message_.empty()) c.setTextColor(theme::kWarning);
+    c.drawString(message_.empty() ? keys.c_str() : message_.c_str(), 4, area.y + area.h - 9);
+}
+
+}  // namespace roro

src/apps/file_viewer.h

@@ -0,0 +1,75 @@
+#pragma once
+
+#include <FS.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "dialog_model.h"
+#include "key_event.h"
+#include "list_model.h"
+#include "services/storage_service.h"
+#include "services/update_service.h"
+#include "text_pager.h"
+#include "ui/canvas.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Looks inside a file for the Storage App (F1, Q134), by type: text read as it's scrolled, a hex
+// dump, a Capture's packets, a Track's summary, an Update File's version and whether it's
+// genuine. Tab switches to the text or the hex of the same file. Nothing here changes a file.
+class FileViewer {
+   public:
+    FileViewer(StorageService& storage, UpdateService& update) : storage_(storage), update_(update) {}
+
+    void open(const std::string& path, uint32_t size);
+    void close();
+    bool onKey(const KeyEvent& e);  // false: leave the viewer
+    bool update(uint32_t nowMs);    // true: draw again
+    void draw(Canvas& c);
+
+    // For `e` in the Storage App: is this a text small enough to edit (Q146)? And a line to say why not.
+    bool showingText() const { return mode_ == Mode::Text; }
+    const std::string& path() const { return path_; }
+    uint32_t size() const { return size_; }
+    void say(const std::string& text);
+
+   private:
+    enum class Mode { Text, Hex, Gpx, Pcap, Packet, Ota };
+    static constexpr int kRows = 8;
+    static constexpr int kCols = 38;
+    struct Scan;  // what a storage job reads through a whole file for: shared with that job
+
+    size_t readAt(uint32_t offset, uint8_t* into, size_t len);
+    void show(Mode mode);
+    void startScan(Mode mode);
+    void refresh();  // reads what the screen shows, when it has moved
+    void openPacket(int index);
+    void scroll(int lines);
+    std::string title() const;
+
+    StorageService& storage_;
+    UpdateService& update_;
+    std::string path_;
+    uint32_t size_ = 0;
+    Mode mode_ = Mode::Text, base_ = Mode::Text;
+    std::shared_ptr<fs::File> file_;  // opened and read on the storage task only
+    std::unique_ptr<files::TextPager> pager_;
+    uint32_t hexTop_ = 0;  // in rows of eight bytes
+    std::vector<std::string> shown_;  // the rows on screen
+    bool stale_ = true;
+    std::shared_ptr<Scan> scan_;
+    bool scanShown_ = false;
+    int shownPercent_ = -1;
+    ListModel packets_{kRows};
+    int rowsFrom_ = -1;
+    std::vector<std::string> details_;
+    int detailsTop_ = 0;
+    std::unique_ptr<DialogModel> confirm_;
+    std::string message_;
+    uint32_t messageMs_ = 0;
+};
+
+}  // namespace roro

src/apps/gnss_app.cpp

@@ -71,10 +71,12 @@ void GnssApp::draw(Canvas& c) {
     if (!gnss_.on()) {
         c.setFont(&fonts::bold);
         c.setTextColor(theme::kText);
-        c.drawString("GNSS is off", 4, area.y + 4);
+        bool held = gnss_.heldForLora();
+        c.drawString(held ? "GNSS is paused" : "GNSS is off", 4, area.y + 4);
         c.setFont(&fonts::body);
         c.setTextColor(theme::kMuted);
-        c.drawString("Settings > GNSS turns it on.", 4, area.y + 22);
+        c.drawString(held ? "The LoRa radio is listening, and" : "Settings > GNSS turns it on.", 4, area.y + 22);
+        if (held) c.drawString("Settings pauses GNSS for it.", 4, area.y + 22 + theme::kLineHeight);
         return;
     }
     sky_ ? drawSky(c) : drawPosition(c);

src/apps/maintenance_page.cpp

@@ -1,4 +1,4 @@
-#include "storage_page.h"
+#include "maintenance_page.h"
 
 #include "ui/widgets.h"
 
@@ -9,25 +9,25 @@ constexpr int kAges = sizeof(kCleanupAgeLabels) / sizeof(kCleanupAgeLabels[0]);
 constexpr int kCategories = sizeof(kCleanupCategories) / sizeof(kCleanupCategories[0]);
 }  // namespace
 
-void StoragePage::enter() {
+void MaintenancePage::enter() {
     view_ = View::Main;
     dialog_.reset();
     main_.setCount(kRows);
     main_.select(kCleanUp);
 }
 
-void StoragePage::warn(const char* text) {
+void MaintenancePage::warn(const char* text) {
     bus_.publish(Event::withText(EventType::Notification, text, static_cast<int32_t>(NotificationLevel::Warning)));
 }
 
-uint64_t StoragePage::categoryBytes(int category) const {
+uint64_t MaintenancePage::categoryBytes(int category) const {
     uint64_t sum = 0;
     if (category < static_cast<int>(listing_.size()))
         for (auto& f : listing_[category]) sum += f.bytes;
     return sum;
 }
 
-CleanupPlan StoragePage::planFor(int age) const {
+CleanupPlan MaintenancePage::planFor(int age) const {
     int today = clock_.today();
     auto cutoff = static_cast<CleanupAge>(age);
     // Without a clock only "Everything" can be judged.
@@ -35,7 +35,7 @@ CleanupPlan StoragePage::planFor(int age) const {
     return CleanupPlan::make(listing_[categories_.selected()], cutoff, today);
 }
 
-bool StoragePage::onKey(const KeyEvent& e) {
+bool MaintenancePage::onKey(const KeyEvent& e) {
     if (dialog_) {
         dialog_->onKey(e);
         int result = dialog_->result();
@@ -109,7 +109,7 @@ bool StoragePage::onKey(const KeyEvent& e) {
     return true;
 }
 
-void StoragePage::draw(Canvas& c) {
+void MaintenancePage::draw(Canvas& c) {
     const auto& area = theme::kContent;
     if (!haveListing_ && storage_.listingReady()) {
         listing_ = storage_.listing();

src/apps/maintenance_page.h

@@ -15,10 +15,10 @@
 
 namespace roro {
 
-// Settings → Storage: card usage, Storage Clean-up (category → age → confirm) and erasing the card.
-class StoragePage {
+// Storage → Maintenance: card usage, Storage Clean-up (category → age → confirm) and erasing the card.
+class MaintenancePage {
    public:
-    StoragePage(StorageService& storage, ClockService& clock, EventBus& bus)
+    MaintenancePage(StorageService& storage, ClockService& clock, EventBus& bus)
         : storage_(storage), clock_(clock), bus_(bus) {}
 
     void enter();

src/apps/note_editor.cpp

@@ -0,0 +1,303 @@
+#include "note_editor.h"
+
+#include <Arduino.h>
+#include <SD.h>
+
+#include <ctime>
+
+#include "cleanup_plan.h"
+#include "file_list.h"
+#include "file_names.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using notes::NoteText;
+
+namespace {
+constexpr uint32_t kMessageMs = 4000;
+
+// One block the size of a full note, and something left: without it, nothing is opened. Free
+// memory in total isn't the measure: with IRC connected the largest free block is about 31 KB.
+constexpr size_t kRoomWanted = NoteText::kMaxBytes + 8 * 1024;
+const char* const kNoRoom = "Not enough memory to edit: close IRC or a Gemini page";
+
+// On the storage task. Reads a file of up to `limit` bytes into a string that has that capacity
+// already; false if it can't be read whole.
+bool readWhole(const std::string& path, std::string& into, size_t limit) {
+    File f = SD.open(path.c_str(), FILE_READ);
+    if (!f) return false;
+    size_t size = f.size();
+    if (size > limit) {
+        f.close();
+        return false;
+    }
+    into.resize(size);
+    size_t got = size ? f.read(reinterpret_cast<uint8_t*>(&into[0]), size) : 0;
+    f.close();
+    return got == size;
+}
+}  // namespace
+
+void NoteEditor::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+    redraw_ = true;
+}
+
+std::string NoteEditor::open(const std::string& path) {
+    close();
+    if (ESP.getMaxAllocHeap() < kRoomWanted) return kNoRoom;
+    std::string body, left, why;
+    body.reserve(NoteText::kMaxBytes);  // the note's own buffer from here on: read into, then handed over
+    bool ran = storage_.runAndWait([&]() {
+        File f = SD.open(path.c_str(), FILE_READ);
+        if (!f) {
+            why = "The card refused to open it";
+            return;
+        }
+        size_t size = f.size();
+        f.close();
+        if (size > NoteText::kMaxBytes) why = "Too big to edit: 16 KB at most";
+        else if (!readWhole(path, body, NoteText::kMaxBytes)) why = "The card refused to read it";
+        if (!why.empty()) return;
+        // A save that never finished: its temporary file is offered back (Q143), if there's the
+        // memory to look at it now. If not, it stays for the next time.
+        std::string tmp = path + ".tmp";
+        File t = SD.open(tmp.c_str(), FILE_READ);
+        if (!t) return;
+        size_t tmpSize = t.size();
+        t.close();
+        if (tmpSize > 0 && tmpSize <= NoteText::kMaxBytes && ESP.getMaxAllocHeap() < tmpSize + 8 * 1024) return;
+        left.reserve(tmpSize <= NoteText::kMaxBytes ? tmpSize : 0);
+        if (!readWhole(tmp, left, NoteText::kMaxBytes) || left == body || left.empty()) {
+            std::string().swap(left);
+            SD.remove(tmp.c_str());
+        }
+    });
+    if (!ran) return "No SD card";
+    if (!why.empty()) return why;
+    text_.reset(new NoteText(kCols, kRows, std::move(body)));
+    path_ = path;
+    folder_ = files::parentOf(path);
+    savedRevision_ = text_->revision();
+    problem_.clear();
+    message_.clear();
+    lastKeyMs_ = millis();
+    if (!left.empty()) {
+        recovered_ = std::move(left);
+        ask_ = Ask::Recover;
+        dialog_.reset(new DialogModel({"Keep the note", "Use the copy"}));
+    }
+    return "";
+}
+
+std::string NoteEditor::openNew(const std::string& folder) {
+    close();
+    if (ESP.getMaxAllocHeap() < kRoomWanted) return kNoRoom;
+    text_.reset(new NoteText(kCols, kRows));
+    path_.clear();
+    folder_ = folder;
+    savedRevision_ = text_->revision();
+    problem_.clear();
+    message_.clear();
+    lastKeyMs_ = millis();
+    return "";
+}
+
+void NoteEditor::close() {
+    if (dirty()) save();
+    text_.reset();
+    dialog_.reset();
+    ask_ = Ask::None;
+    std::string().swap(recovered_);
+}
+
+// On the main loop, waiting for the storage task: no second copy of the note is made, and at
+// 16 KB the wait is a fraction of a second, when nobody has typed for five.
+bool NoteEditor::save() {
+    if (!text_) return true;
+    lastTryMs_ = millis();
+    const std::string& body = text_->text();
+    if (path_.empty() && body.empty()) {  // a new note nothing was typed in: no file
+        savedRevision_ = text_->revision();
+        return true;
+    }
+    std::string path = path_, why;
+    if (path.empty()) {
+        char stamp[20] = "new";
+        int64_t now = clock_.utcNow();
+        if (now >= 0) {
+            time_t t = static_cast<time_t>(now);
+            struct tm local;
+            localtime_r(&t, &local);
+            std::snprintf(stamp, sizeof stamp, "%04d%02d%02d-%02d%02d", local.tm_year + 1900, local.tm_mon + 1, local.tm_mday, local.tm_hour,
+                          local.tm_min);
+        }
+        path = files::joinPath(folder_, notes::nameFromFirstLine(text_->firstLine(), stamp) + ".txt");
+    }
+    bool fresh = path_.empty();
+    bool ran = storage_.runAndWait([&]() {
+        if (!SD.exists(folder_.c_str()) && !SD.mkdir(folder_.c_str())) {
+            why = "the card refused to make " + folder_;
+            return;
+        }
+        if (fresh) {  // a name nothing has yet: "list (2).txt"
+            std::string name = files::baseName(path);
+            for (int n = 2; n < 100 && SD.exists(path.c_str()); n++) path = files::joinPath(folder_, files::copyName(name, n));
+        }
+        std::string tmp = path + ".tmp";
+        File f = SD.open(tmp.c_str(), FILE_WRITE);
+        if (!f) {
+            why = "the card refused to open a file";
+            return;
+        }
+        size_t wrote = body.empty() ? 0 : f.write(reinterpret_cast<const uint8_t*>(body.data()), body.size());
+        f.close();
+        File check = SD.open(tmp.c_str(), FILE_READ);
+        bool whole = wrote == body.size() && check && check.size() == body.size();
+        if (check) check.close();
+        if (!whole) {
+            SD.remove(tmp.c_str());
+            why = "the card refused a write";
+            return;
+        }
+        // FAT can't rename onto a file. Between these two lines only the temporary file exists:
+        // the Notes list puts such a file back under its name.
+        if (SD.exists(path.c_str())) SD.remove(path.c_str());
+        if (!SD.rename(tmp.c_str(), path.c_str())) why = "the card refused to rename the file";
+    });
+    if (!ran) why = "no SD card";
+    if (!why.empty()) {
+        if (problem_ != why) say("Not saved: " + why);
+        problem_ = why;
+        return false;
+    }
+    path_ = path;
+    problem_.clear();
+    savedRevision_ = text_->revision();
+    redraw_ = true;
+    return true;
+}
+
+bool NoteEditor::onKey(const KeyEvent& e) {
+    if (!text_) return false;
+    redraw_ = true;
+    if (dialog_) {
+        dialog_->onKey(e);
+        int result = dialog_->result();
+        if (result == DialogModel::kPending) return true;
+        Ask asked = ask_;
+        ask_ = Ask::None;
+        dialog_.reset();
+        if (asked == Ask::Recover) {
+            if (result == 1) {
+                if (text_->setText(recovered_)) say("The unsaved copy is back");  // different from the card: saved in five seconds
+                else say("That copy is too big to edit");
+            } else {
+                std::string tmp = path_ + ".tmp";
+                storage_.runJob([tmp]() { SD.remove(tmp.c_str()); });
+            }
+            std::string().swap(recovered_);
+            return true;
+        }
+        if (asked == Ask::LeaveUnsaved && result == 1) {
+            savedRevision_ = text_->revision();  // given up on
+            return false;
+        }
+        return true;
+    }
+    lastKeyMs_ = millis();
+    bool page = e.shift || e.alt;
+    switch (e.key) {
+        case Key::Char: {
+            uint32_t lower = e.ch >= 'A' && e.ch <= 'Z' ? e.ch + 32 : e.ch;
+            if (e.ctrl) {
+                if (lower == 'a') text_->lineStart();
+                else if (lower == 'e') text_->lineEnd();
+                break;
+            }
+            if (!text_->insert(e.ch)) say("This note is full: 16 KB");
+            break;
+        }
+        case Key::Select:
+            if (!text_->insert('\n')) say("This note is full: 16 KB");
+            break;
+        case Key::Tab:
+            if (!text_->insertText("  ")) say("This note is full: 16 KB");
+            break;
+        case Key::Delete: text_->backspace(); break;
+        case Key::Left: text_->left(); break;
+        case Key::Right: text_->right(); break;
+        case Key::Up: page ? text_->pageUp() : text_->up(); break;
+        case Key::Down: page ? text_->pageDown() : text_->down(); break;
+        case Key::Back:
+            if (!dirty() || save()) return false;
+            ask_ = Ask::LeaveUnsaved;
+            dialog_.reset(new DialogModel({"Stay", "Leave"}));
+            break;
+        default: break;
+    }
+    return true;
+}
+
+bool NoteEditor::update(uint32_t) {
+    if (!text_) return false;
+    uint32_t now = millis();
+    // A save that failed is tried again every five seconds, not at every pass.
+    if (dirty() && !dialog_ && now - lastTryMs_ >= kSaveAfterMs &&
+        (now - lastKeyMs_ >= kSaveAfterMs || power_.screen() == ScreenState::Off))
+        save();
+    if (!message_.empty() && now - messageMs_ >= kMessageMs) {
+        message_.clear();
+        redraw_ = true;
+    }
+    bool r = redraw_;
+    redraw_ = false;
+    return r;
+}
+
+void NoteEditor::draw(Canvas& c) {
+    if (!text_) return;
+    const auto& area = theme::kContent;
+    c.setTextDatum(top_left);
+
+    // The name, and whether the card has what's on screen.
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    std::string name = path_.empty() ? "New note" : files::fitName(files::baseName(path_), 26);
+    c.drawString(name.c_str(), 4, area.y + 1);
+    std::string state = formatBytes(text_->text().size()) + (dirty() ? (problem_.empty() ? ", typing" : ", NOT SAVED") : ", saved");
+    if (path_.empty() && !dirty()) state = "empty";
+    c.setTextDatum(top_right);
+    c.setTextColor(dirty() && !problem_.empty() ? theme::kWarning : theme::kMuted);
+    c.drawString(state.c_str(), area.w - 3, area.y + 1);
+    c.setTextDatum(top_left);
+
+    int top = area.y + 10;
+    auto rows = text_->rows();
+    c.setFont(&fonts::body);
+    c.setTextColor(theme::kText);
+    for (size_t i = 0; i < rows.size(); i++) c.drawString(rows[i].c_str(), 4, top + 1 + static_cast<int>(i) * theme::kLineHeight);
+    c.fillRect(3 + text_->cursorCol() * 6, top + text_->cursorRow() * theme::kLineHeight, 1, theme::kLineHeight, theme::kAccent);
+    if (text_->text().size() > static_cast<size_t>(kCols * kRows)) {  // more than a screen: where we are in it
+        int h = kRows * theme::kLineHeight, barH = 12;
+        c.fillRect(area.w - 2, top + (h - barH) * text_->percent() / 100, 2, barH, theme::kMuted);
+    }
+
+    c.setFont(&fonts::small);
+    bool showMessage = !message_.empty() && millis() - messageMs_ < kMessageMs;
+    c.setTextColor(showMessage ? theme::kWarning : theme::kMuted);
+    c.drawString(showMessage ? message_.c_str() : "Fn+arrows: move  Ctrl+A/E: line  Back: done", 4, area.y + area.h - 9);
+
+    if (dialog_ && ask_ == Ask::Recover)
+        widgets::dialog(c, "Unsaved copy", "A save of this note was cut short. Its copy has " + formatBytes(recovered_.size()) + ", the note " +
+                                               formatBytes(text_->text().size()) + ".",
+                        *dialog_);
+    else if (dialog_)
+        widgets::dialog(c, "Not saved", "The note couldn't be saved: " + problem_ + ". Leave and lose what was typed?", *dialog_);
+}
+
+}  // namespace roro

src/apps/note_editor.h

@@ -0,0 +1,60 @@
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "dialog_model.h"
+#include "key_event.h"
+#include "note_text.h"
+#include "services/clock_service.h"
+#include "services/power_service.h"
+#include "services/storage_service.h"
+#include "ui/canvas.h"
+
+namespace roro {
+
+// Edits one text file of up to 16 KB (F1, Q143-Q145): the Notes App's editor, and the Storage
+// App's for `e`. It saves by itself: five seconds after the last key, when the screen turns off,
+// and on close. A save writes `<file>.tmp`, then puts it in the note's place, so the note on the
+// card is always a whole one.
+class NoteEditor {
+   public:
+    static constexpr int kCols = 38, kRows = 8;
+    static constexpr uint32_t kSaveAfterMs = 5000;
+
+    NoteEditor(StorageService& storage, ClockService& clock, PowerService& power)
+        : storage_(storage), clock_(clock), power_(power) {}
+
+    std::string open(const std::string& path);  // "" or why it can't be edited
+    std::string openNew(const std::string& folder);  // the same; no file until there's something to save (Q142)
+    void close();                               // saves what isn't yet
+    bool isOpen() const { return static_cast<bool>(text_); }
+    const std::string& path() const { return path_; }  // "" for a new note nothing was typed in
+
+    bool onKey(const KeyEvent& e);  // false: done, and saved
+    bool update(uint32_t nowMs);    // true: draw again
+    void draw(Canvas& c);
+
+   private:
+    enum class Ask { None, Recover, LeaveUnsaved };
+
+    bool dirty() const { return text_ && text_->revision() != savedRevision_; }
+    bool save();  // true if the card has it now (or there was nothing to save)
+    void say(const std::string& text);
+
+    StorageService& storage_;
+    ClockService& clock_;
+    PowerService& power_;
+    std::unique_ptr<notes::NoteText> text_;
+    std::string path_, folder_;
+    uint32_t savedRevision_ = 0, lastKeyMs_ = 0, lastTryMs_ = 0;
+    std::string recovered_;  // what a temporary file left behind holds, until the user has chosen
+    Ask ask_ = Ask::None;
+    std::unique_ptr<DialogModel> dialog_;
+    std::string message_, problem_;
+    uint32_t messageMs_ = 0;
+    bool redraw_ = false;
+};
+
+}  // namespace roro

src/apps/notes_app.cpp

@@ -0,0 +1,346 @@
+#include "notes_app.h"
+
+#include <Arduino.h>
+#include <SD.h>
+
+#include <algorithm>
+#include <cstring>
+
+#include "file_names.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using files::baseName;
+using files::joinPath;
+
+namespace {
+constexpr uint32_t kMessageMs = 4000;
+constexpr size_t kTitleChars = 26;
+
+bool endsWith(const std::string& s, const char* tail) {
+    size_t n = std::strlen(tail);
+    return s.size() >= n && s.compare(s.size() - n, n, tail) == 0;
+}
+}  // namespace
+
+void NotesApp::onEnter() {
+    view_ = ESP.getFreeHeap() < kStartFloor ? View::NoMemory : View::List;
+    dialog_.reset();
+    message_.clear();
+    cardPresent_ = storage_.state().present;
+    mended_ = false;
+    if (view_ == View::List) reload();
+    requestRedraw();
+}
+
+void NotesApp::onExit() {
+    editor_.close();  // saves
+    if (wait_ == Wait::List) ops_.cancel();
+    wait_ = Wait::None;
+    wantList_ = loaded_ = false;
+    list_ = files::FileList();
+    std::vector<uint16_t>().swap(notes_);
+    std::vector<std::string>().swap(titles_);
+    titlesFrom_ = -1;
+    rows_.setCount(0);
+}
+
+void NotesApp::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+    requestRedraw();
+}
+
+void NotesApp::reload(const std::string& select) {
+    selectAfter_ = select;
+    wantList_ = true;
+}
+
+std::string NotesApp::selectedPath() const {
+    int i = rows_.selected();
+    if (!loaded_ || i < 0 || i >= static_cast<int>(notes_.size())) return "";
+    return joinPath(kFolder, list_.name(notes_[i]));
+}
+
+void NotesApp::leaveEditor() {
+    std::string path = editor_.path();
+    editor_.close();
+    view_ = View::List;
+    reload(path.empty() ? "" : baseName(path));
+}
+
+void NotesApp::update(uint32_t nowMs) {
+    bool present = storage_.state().present;
+    if (present != cardPresent_) {
+        cardPresent_ = present;
+        if (view_ == View::Name) view_ = View::List;
+        loaded_ = false;
+        wantList_ = present && view_ == View::List;
+        requestRedraw();
+    }
+    if (view_ == View::Edit) {
+        if (editor_.update(nowMs)) requestRedraw();
+        return;
+    }
+    if (wantList_ && present && wait_ == Wait::None && !ops_.busy() && ops_.list(kFolder).empty()) {
+        wantList_ = false;
+        wait_ = Wait::List;
+    }
+    FileOps::Status s;
+    if (wait_ != Wait::None && ops_.finished(s)) {
+        onFinished(s);
+        requestRedraw();
+    }
+    if (!message_.empty() && millis() - messageMs_ >= kMessageMs) {
+        message_.clear();
+        requestRedraw();
+    }
+}
+
+void NotesApp::onFinished(const FileOps::Status& s) {
+    Wait was = wait_;
+    wait_ = Wait::None;
+    if (was == Wait::Work) {
+        if (!s.error.empty()) say(s.error);
+        else say(s.op == FileOps::Op::Delete ? "Deleted" : "Renamed");
+        return reload(selectAfter_);
+    }
+    list_.clear();
+    notes_.clear();
+    if (s.error.empty()) {  // no /notes yet is an empty list, not an error
+        ops_.takeListing(list_);
+        list_.sort(sort_);
+    }
+    // A save cut between its two last steps left "x.txt.tmp" and no "x.txt": the whole note, under
+    // the wrong name. Put back once, then listed again.
+    std::vector<std::string> orphans;
+    for (size_t i = 0; i < list_.count(); i++) {
+        std::string name = list_.name(i);
+        if (list_.folder(i)) continue;
+        if (endsWith(name, ".tmp")) {
+            if (list_.find(name.substr(0, name.size() - 4)) < 0) orphans.push_back(name);
+            continue;
+        }
+        notes_.push_back(static_cast<uint16_t>(i));
+    }
+    if (!orphans.empty() && !mended_) {
+        mended_ = true;
+        storage_.runAndWait([&]() {
+            for (auto& name : orphans) {
+                std::string from = joinPath(kFolder, name);
+                SD.rename(from.c_str(), from.substr(0, from.size() - 4).c_str());
+            }
+        });
+        return reload(selectAfter_);
+    }
+    loaded_ = true;
+    titlesFrom_ = -1;
+    rows_.setCount(static_cast<int>(notes_.size()));
+    int at = -1;
+    for (size_t i = 0; i < notes_.size() && !selectAfter_.empty(); i++)
+        if (selectAfter_ == list_.name(notes_[i])) at = static_cast<int>(i);
+    rows_.select(at >= 0 ? at : selectIndex_);
+    selectAfter_.clear();
+    selectIndex_ = 0;
+}
+
+// The first line of each note on screen, read when the list moves: eight short reads.
+void NotesApp::readTitles() {
+    if (titlesFrom_ == rows_.firstVisible()) return;
+    titlesFrom_ = rows_.firstVisible();
+    titles_.clear();
+    std::vector<std::string> paths;
+    for (int i = titlesFrom_; i < titlesFrom_ + kRows && i < static_cast<int>(notes_.size()); i++) paths.push_back(joinPath(kFolder, list_.name(notes_[i])));
+    titles_.resize(paths.size());
+    storage_.runAndWait([&]() {
+        for (size_t i = 0; i < paths.size(); i++) {
+            File f = SD.open(paths[i].c_str(), FILE_READ);
+            if (!f) continue;
+            char head[120];
+            int n = f.read(reinterpret_cast<uint8_t*>(head), sizeof head);
+            f.close();
+            if (n > 0) titles_[i] = notes::titleFrom(std::string(head, n), kTitleChars);
+        }
+    });
+}
+
+std::string NotesApp::titleOf(int row) {
+    size_t i = static_cast<size_t>(row - titlesFrom_);
+    if (i < titles_.size() && !titles_[i].empty()) return titles_[i];
+    return files::fitName(list_.name(notes_[row]), kTitleChars);  // an empty note, or not a text
+}
+
+bool NotesApp::onKey(const KeyEvent& e) {
+    requestRedraw();
+    if (view_ == View::NoMemory) return false;
+    if (view_ == View::Edit) {
+        if (!editor_.onKey(e)) leaveEditor();
+        return true;
+    }
+    if (dialog_) {
+        dialog_->onKey(e);
+        int result = dialog_->result();
+        if (result == DialogModel::kPending) return true;
+        dialog_.reset();
+        if (result == 1) {
+            selectIndex_ = rows_.selected();
+            selectAfter_.clear();
+            std::string why = ops_.remove(target_, false);
+            if (why.empty()) wait_ = Wait::Work;
+            else say(why);
+        }
+        return true;
+    }
+    if (wantList_ || wait_ != Wait::None) return true;  // a moment
+    if (view_ == View::Name) return onNameKey(e);
+    return onListKey(e);
+}
+
+bool NotesApp::onNameKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Char: name_.insert(e.ch); break;
+        case Key::Delete: name_.backspace(); break;
+        case Key::Left: name_.left(); break;
+        case Key::Right: name_.right(); break;
+        case Key::Back: view_ = View::List; break;
+        case Key::Select: {
+            std::string name = name_.text() + ".txt";
+            std::string why = files::checkName(name);
+            if (why.empty() && name != baseName(target_)) {
+                why = ops_.move(target_, false, joinPath(kFolder, name));
+                if (why.empty()) {
+                    wait_ = Wait::Work;
+                    selectAfter_ = name;
+                }
+            }
+            if (why.empty()) view_ = View::List;
+            else say(why);
+            break;
+        }
+        default: break;
+    }
+    return true;
+}
+
+bool NotesApp::onListKey(const KeyEvent& e) {
+    if (e.key == Key::Back) return false;
+    if (!cardPresent_ || !loaded_) return true;
+    uint32_t ch = e.key == Key::Char ? (e.ch >= 'A' && e.ch <= 'Z' ? e.ch + 32 : e.ch) : 0;
+    std::string path = selectedPath();
+    switch (e.key) {
+        case Key::Up: rows_.up(); return true;
+        case Key::Down: rows_.down(); return true;
+        case Key::Left: rows_.pageUp(); return true;
+        case Key::Right: rows_.pageDown(); return true;
+        case Key::Select: {
+            if (path.empty()) return true;
+            std::string why = editor_.open(path);
+            if (why.empty()) view_ = View::Edit;
+            else say(why);
+            return true;
+        }
+        case Key::Delete: ch = 'd'; break;
+        default: break;
+    }
+    if (ch == 'n') {
+        std::string why = editor_.openNew(kFolder);
+        if (why.empty()) view_ = View::Edit;
+        else say(why);
+    } else if (ch == 's') {
+        sort_ = sort_ == files::FileSort::Date ? files::FileSort::Name : files::FileSort::Date;
+        std::string keep = path.empty() ? "" : baseName(path);
+        list_.sort(sort_);
+        notes_.clear();
+        for (size_t i = 0; i < list_.count(); i++)
+            if (!list_.folder(i) && !endsWith(list_.name(i), ".tmp")) notes_.push_back(static_cast<uint16_t>(i));
+        for (size_t i = 0; i < notes_.size(); i++)
+            if (keep == list_.name(notes_[i])) rows_.select(static_cast<int>(i));
+        titlesFrom_ = -1;
+        say(sort_ == files::FileSort::Date ? "Newest first" : "By file name");
+    } else if (path.empty()) {
+        // nothing selected: the keys below need a note
+    } else if (ch == 'd') {
+        target_ = path;
+        question_ = "Delete " + files::fitName(baseName(path), 22) + ", \"" + titleOf(rows_.selected()).substr(0, 20) + "\"? It can't be undone.";
+        dialog_.reset(new DialogModel({"Cancel", "Delete"}));
+    } else if (ch == 'r') {
+        target_ = path;
+        std::string name = baseName(path);
+        size_t dot = name.rfind('.');
+        name_.setText(dot == std::string::npos || dot == 0 ? name : name.substr(0, dot));
+        view_ = View::Name;
+    }
+    return true;
+}
+
+void NotesApp::draw(Canvas& c) {
+    lastDrawMs_ = millis();
+    const auto& area = theme::kContent;
+    c.setTextDatum(top_left);
+    if (view_ == View::NoMemory) {
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kWarning);
+        c.drawString("Not enough memory", 4, area.y + 4);
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Close what's running (IRC, a page", 4, area.y + 22);
+        c.drawString("in Gemini) and open Notes again.", 4, area.y + 22 + theme::kLineHeight);
+        return;
+    }
+    if (view_ == View::Edit) return editor_.draw(c);
+
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString(kFolder, 4, area.y + 1);
+    if (loaded_) {
+        std::string count = std::to_string(notes_.size()) + (notes_.size() == 1 ? " note" : " notes");
+        if (list_.more() > 0) count = "the first " + std::to_string(notes_.size()) + " notes";
+        c.setTextDatum(top_right);
+        c.drawString(count.c_str(), area.w - 3, area.y + 1);
+        c.setTextDatum(top_left);
+    }
+
+    theme::Rect rows{area.x, area.y + 10, area.w, kRows * theme::kLineHeight};
+    c.setFont(&fonts::body);
+    if (!storage_.state().present) {
+        c.setTextColor(theme::kWarning);
+        c.drawString("No SD card", 4, rows.y + 4);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Notes are kept on the card.", 4, rows.y + 4 + theme::kLineHeight);
+    } else if (!loaded_) {
+        // a moment
+    } else if (notes_.empty()) {
+        c.setTextColor(theme::kMuted);
+        c.drawString("No notes yet.", 4, rows.y + 4);
+        c.drawString("n starts one.", 4, rows.y + 4 + theme::kLineHeight);
+    } else {
+        readTitles();
+        widgets::list(
+            c, rows_, rows, [&](int i) { return titleOf(i); },
+            [&](int i) {
+                std::string stamp = files::formatStamp(list_.modified(notes_[i]));
+                return stamp.size() >= 10 ? stamp.substr(0, 10) : stamp;
+            });
+    }
+
+    c.setFont(&fonts::small);
+    bool showMessage = !message_.empty() && millis() - messageMs_ < kMessageMs;
+    c.setTextColor(showMessage ? theme::kWarning : theme::kMuted);
+    c.drawString(showMessage ? message_.c_str() : "n: new  Enter: open  r: name  d: del  s: sort", 4, area.y + area.h - 9);
+
+    if (view_ == View::Name) {
+        theme::Rect box{16, 44, theme::kWidth - 32, 48};
+        c.fillRect(box.x, box.y, box.w, box.h, theme::kBackground);
+        c.drawRect(box.x, box.y, box.w, box.h, theme::kAccent);
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kText);
+        c.drawString("File name (.txt)", box.x + 6, box.y + 4);
+        widgets::lineEditor(c, name_, {box.x + 6, box.y + 22, box.w - 12, theme::kLineHeight + 4});
+    }
+    if (dialog_) widgets::dialog(c, "Delete", question_, *dialog_);
+}
+
+}  // namespace roro

src/apps/notes_app.h

@@ -0,0 +1,71 @@
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "apps/note_editor.h"
+#include "dialog_model.h"
+#include "file_list.h"
+#include "line_editor.h"
+#include "list_model.h"
+#include "services/file_ops.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// Notes (docs/milestones/F1.md, Q141-Q150): plain text files in /notes, listed by their first line,
+// newest first. n starts one, Enter opens it in the editor, which saves by itself; r renames the
+// file, d deletes it after asking, s sorts by name or by date.
+class NotesApp : public App {
+   public:
+    NotesApp(FileOps& ops, StorageService& storage, ClockService& clock, PowerService& power)
+        : ops_(ops), storage_(storage), editor_(storage, clock, power) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    bool textEntryActive() const override { return view_ == View::Edit || view_ == View::Name; }
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View { List, Edit, Name, NoMemory };
+    enum class Wait { None, List, Work };
+    static constexpr int kRows = 8;
+    static constexpr size_t kStartFloor = 55 * 1024;  // Q86, Q144
+    static constexpr const char* kFolder = "/notes";
+
+    void reload(const std::string& select = "");
+    void onFinished(const FileOps::Status& s);
+    bool onListKey(const KeyEvent& e);
+    bool onNameKey(const KeyEvent& e);
+    void leaveEditor();
+    std::string selectedPath() const;  // "" in an empty list
+    std::string titleOf(int row);
+    void readTitles();
+    void say(const std::string& text);
+
+    FileOps& ops_;
+    StorageService& storage_;
+    NoteEditor editor_;
+
+    View view_ = View::List;
+    files::FileList list_;
+    std::vector<uint16_t> notes_;  // the entries of list_ that are notes
+    files::FileSort sort_ = files::FileSort::Date;
+    ListModel rows_{kRows};
+    bool wantList_ = false, loaded_ = false, cardPresent_ = false, mended_ = false;
+    std::string selectAfter_;
+    int selectIndex_ = 0;
+    Wait wait_ = Wait::None;
+    std::vector<std::string> titles_;  // of the rows on screen
+    int titlesFrom_ = -1;
+    std::unique_ptr<DialogModel> dialog_;
+    std::string target_, question_;
+    LineEditor name_{40};
+    std::string message_;
+    uint32_t messageMs_ = 0, lastDrawMs_ = 0;
+};
+
+}  // namespace roro

src/apps/settings_app.cpp

@@ -27,9 +27,6 @@ bool SettingsApp::onKey(const KeyEvent& e) {
         case Page::Menu: return onMenuKey(e);
         case Page::Text: return onTextKey(e);
         case Page::Choice: return onChoiceKey(e);
-        case Page::Storage:
-            if (!storagePage_.onKey(e)) page_ = Page::Menu;
-            return true;
         case Page::About: return onAboutKey(e);
         case Page::Wifi:
             if (!wifiPage_.onKey(e)) page_ = Page::Menu;
@@ -70,10 +67,6 @@ bool SettingsApp::onMenuKey(const KeyEvent& e) {
         case Kind::Slider: break;
         case Kind::Page:
             switch (menu_.row(i)) {
-                case Row::Storage:
-                    page_ = Page::Storage;
-                    storagePage_.enter();
-                    break;
                 case Row::Wifi:
                     page_ = Page::Wifi;
                     wifiPage_.enter();
@@ -130,8 +123,8 @@ bool SettingsApp::onAboutKey(const KeyEvent& e) {
 }
 
 void SettingsApp::update(uint32_t nowMs) {
-    // Live values on Storage and About.
-    bool live = page_ == Page::Storage || page_ == Page::About || page_ == Page::Firmware ||
+    // Live values on About and Firmware.
+    bool live = page_ == Page::About || page_ == Page::Firmware ||
                 (page_ == Page::Wifi && wifiPage_.live());
     if (live && nowMs - lastRefreshMs_ >= 500) {
         lastRefreshMs_ = nowMs;
@@ -188,7 +181,6 @@ void SettingsApp::draw(Canvas& c) {
             widgets::list(c, choices_, area, [&](int i) { return (i == current ? "* " : "  ") + options[i]; });
             break;
         }
-        case Page::Storage: storagePage_.draw(c); break;
         case Page::About: widgets::textLines(c, aboutLines(), 0, area); break;
         case Page::Wifi: wifiPage_.draw(c); break;
         case Page::Firmware: firmwarePage_.draw(c); break;

src/apps/settings_app.h

@@ -14,7 +14,6 @@
 #include "services/clock_service.h"
 #include "services/storage_service.h"
 #include "apps/firmware_page.h"
-#include "apps/storage_page.h"
 #include "apps/wifi_settings_page.h"
 #include "settings_menu.h"
 #include "ui/theme.h"
@@ -33,14 +32,13 @@ struct SettingsAppDeps {
     UpdateService& update;
 };
 
-// Settings: every user-facing setting, plus the Storage and About pages.
+// Settings: every user-facing setting, plus the Wi-Fi, Firmware and About pages.
 class SettingsApp : public App {
    public:
     explicit SettingsApp(const SettingsAppDeps& deps)
         : d_(deps),
           menu_(deps.settings),
           wifiPage_(deps.settings, deps.savedNetworks, deps.wifi, deps.bus),
-          storagePage_(deps.storage, deps.clock, deps.bus),
           firmwarePage_(deps.update, deps.wifi, deps.storage) {}
     void onEnter() override;
     bool onKey(const KeyEvent& e) override;
@@ -51,7 +49,7 @@ class SettingsApp : public App {
     void draw(Canvas& c) override;
 
    private:
-    enum class Page { Menu, Text, Choice, Storage, About, Wifi, Firmware };
+    enum class Page { Menu, Text, Choice, About, Wifi, Firmware };
 
     bool onMenuKey(const KeyEvent& e);
     bool onTextKey(const KeyEvent& e);
@@ -63,7 +61,6 @@ class SettingsApp : public App {
     SettingsAppDeps d_;
     SettingsMenu menu_;
     WifiSettingsPage wifiPage_;
-    StoragePage storagePage_;
     FirmwarePage firmwarePage_;
     Page page_ = Page::Menu;
     ListModel list_{theme::kContent.h / theme::kLineHeight};

src/apps/storage_app.cpp

@@ -0,0 +1,596 @@
+#include "storage_app.h"
+
+#include <Arduino.h>
+
+#include <algorithm>
+#include <cstdio>
+
+#include "cleanup_plan.h"
+#include "file_names.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+using files::baseName;
+using files::joinPath;
+using files::parentOf;
+
+namespace {
+constexpr uint32_t kMessageMs = 4000;
+constexpr uint32_t kQuietMs = 300;  // an operation shorter than this shows no progress
+
+const char* kindText(const std::string& name) {
+    switch (files::kindOf(name)) {
+        case files::FileKind::Text: return "Text";
+        case files::FileKind::Gpx: return "Track (GPX)";
+        case files::FileKind::Pcap: return "Capture (pcap)";
+        case files::FileKind::Ota: return "Update File";
+        default: return "File";
+    }
+}
+
+std::string plural(uint32_t n, const char* one) { return std::to_string(n) + " " + one + (n == 1 ? "" : "s"); }
+}  // namespace
+
+void StorageApp::onEnter() {
+    view_ = ESP.getFreeHeap() < kStartFloor ? View::NoMemory : View::Browse;
+    ask_ = Ask::None;
+    dialog_.reset();
+    message_.clear();
+    cardPresent_ = storage_.state().present;
+    // A copy left running is picked up where it is; anything else starts from a fresh listing.
+    if (wait_ != Wait::Work && view_ == View::Browse) open(cwd_);
+    else want_ = cwd_;
+    requestRedraw();
+}
+
+void StorageApp::onExit() {
+    if (wait_ != Wait::None && wait_ != Wait::Work) {
+        ops_.cancel();
+        wait_ = Wait::None;
+    }
+    noteEditor_.close();  // saves
+    viewer_.close();
+    wantList_ = false;
+    loaded_ = false;
+    list_ = files::FileList();  // its memory only while the App is open
+    rows_.setCount(0);
+    std::vector<std::string>().swap(details_);
+}
+
+void StorageApp::say(const std::string& text) {
+    message_ = text;
+    messageMs_ = millis();
+    requestRedraw();
+}
+
+// What's on screen stays, with its path, until the new listing is in: cwd_ changes then.
+void StorageApp::open(const std::string& folder, const std::string& select) {
+    want_ = folder;
+    selectAfter_ = select;
+    wantList_ = true;  // started from update(), once the card is free
+    waitSinceMs_ = millis();
+}
+
+StorageApp::Item StorageApp::selected() const {
+    int i = rows_.selected();
+    if (!loaded_ || i < 0 || i >= static_cast<int>(list_.count())) return {};
+    Item item;
+    item.path = joinPath(cwd_, list_.name(i));
+    item.folder = list_.folder(i);
+    return item;
+}
+
+bool StorageApp::work(const std::string& why, const std::string& selectAfter) {
+    if (!why.empty()) {
+        say(why);
+        return false;
+    }
+    wait_ = Wait::Work;
+    waitSinceMs_ = millis();
+    selectAfter_ = selectAfter;
+    return true;
+}
+
+void StorageApp::update(uint32_t nowMs) {
+    bool present = storage_.state().present;
+    if (present != cardPresent_) {  // taken out, put in, or erased: back to the top
+        cardPresent_ = present;
+        cwd_ = want_ = "/";
+        selectAfter_.clear();
+        loaded_ = false;
+        list_.clear();
+        rows_.setCount(0);
+        wantList_ = present;
+        clip_ = Item();
+        if (view_ == View::Viewer) viewer_.close();
+        if (view_ == View::Editor) noteEditor_.close();
+        if (view_ == View::Details || view_ == View::Name || view_ == View::Viewer || view_ == View::Editor) view_ = View::Browse;
+        requestRedraw();
+    }
+    if (wantList_ && present && wait_ == Wait::None && !ops_.busy() && ops_.list(want_).empty()) {
+        wantList_ = false;
+        wait_ = Wait::List;
+        waitSinceMs_ = nowMs;
+    }
+    if (view_ == View::Viewer && viewer_.update(nowMs)) requestRedraw();
+    if (view_ == View::Editor && noteEditor_.update(nowMs)) requestRedraw();
+    FileOps::Status s;
+    if (wait_ != Wait::None && ops_.finished(s)) {
+        onFinished(s);
+        requestRedraw();
+    }
+    // millis(), not nowMs: a message set by a key in this same pass is newer than the pass's own time.
+    uint32_t now = millis();
+    if ((wait_ != Wait::None || wantList_) && now - lastDrawMs_ >= 250) requestRedraw();
+    if (!message_.empty() && now - messageMs_ >= kMessageMs) {
+        message_.clear();
+        requestRedraw();
+    }
+    if (view_ == View::Maintenance && now - lastDrawMs_ >= 1000) requestRedraw();
+}
+
+void StorageApp::onFinished(const FileOps::Status& s) {
+    Wait was = wait_;
+    wait_ = Wait::None;
+    switch (was) {
+        case Wait::List: {
+            if (!s.error.empty()) {
+                say(s.error);
+                selectAfter_.clear();
+                // A folder that can't be opened leaves the screen as it is; if it's the one on
+                // screen that went away, back to the top.
+                if (want_ != cwd_ && loaded_) {
+                    want_ = cwd_;
+                    return;
+                }
+                if (want_ != "/") return open("/");
+                list_.clear();
+            } else {
+                ops_.takeListing(list_);
+                list_.sort(sort_);
+            }
+            cwd_ = want_;
+            loaded_ = true;
+            int count = static_cast<int>(list_.count()) + (cwd_ == "/" ? 1 : 0);
+            int at = selectAfter_.empty() ? -1 : list_.find(selectAfter_);
+            rows_.setCount(count);
+            rows_.select(at >= 0 ? at : selectIndex_);
+            selectAfter_.clear();
+            selectIndex_ = 0;
+            break;
+        }
+        case Wait::CountToDelete:
+            if (!s.error.empty()) say(s.error);
+            else if (!s.cancelled) askDelete(target_, s.files, s.bytes);
+            break;
+        case Wait::CountForDetails:
+            if (view_ != View::Details || details_.empty() || s.cancelled) break;
+            details_.back() = s.error.empty() ? plural(s.files, "file") + ", " + formatBytes(s.bytes) : s.error;
+            break;
+        case Wait::Work: {
+            std::string name = files::fitName(baseName(target_.path), 20);
+            if (s.exists && pasting_) {
+                question_ = name + " exists already in this folder. Replace it?";
+                ask_ = Ask::Replace;
+                dialog_.reset(new DialogModel({"Cancel", "Replace"}));
+                return;
+            }
+            if (!s.error.empty()) say(s.error);
+            else if (s.cancelled) say(s.op == FileOps::Op::Copy ? "Cancelled: nothing was copied" : "Cancelled after " + plural(s.files, "file"));
+            else {
+                switch (s.op) {
+                    case FileOps::Op::Copy: say(s.files == 1 ? "Copied " + name : "Copied " + plural(s.files, "file") + " to " + name); break;
+                    case FileOps::Op::Move: say((pasting_ ? "Moved " : "Renamed to ") + name); break;
+                    case FileOps::Op::Delete: say(s.files == 1 ? "Deleted " + name : "Deleted " + name + ", " + plural(s.files, "file")); break;
+                    default: say("Made " + name); break;
+                }
+                // The clipboard must not point at what has moved or gone.
+                bool gone = s.op == FileOps::Op::Delete || s.op == FileOps::Op::Move;
+                if (clip_ && gone && files::isInside(clip_.path, s.path)) clip_ = Item();
+            }
+            open(cwd_, selectAfter_);
+            break;
+        }
+        default: break;
+    }
+}
+
+void StorageApp::paste(bool replace) {
+    if (!clip_) return say("Nothing to paste: c copies, x cuts");
+    std::string name = baseName(clip_.path), why;
+    if (cut_) {
+        why = ops_.move(clip_.path, clip_.folder, joinPath(cwd_, name), replace);
+    } else {
+        // A copy next to its original: "a (2).txt", or the next number that's free.
+        if (parentOf(clip_.path) == cwd_)
+            for (int n = 2; n < 100 && list_.find(name) >= 0; n++) name = files::copyName(baseName(clip_.path), n);
+        why = ops_.copy(clip_.path, clip_.folder, cwd_, name, replace);
+    }
+    target_.path = joinPath(cwd_, name);
+    target_.folder = clip_.folder;
+    pasting_ = true;
+    selectIndex_ = rows_.selected();  // where to stay if nothing comes of it
+    work(why, name);
+}
+
+void StorageApp::askDelete(const Item& item, uint32_t count, uint32_t bytes) {
+    std::string name = files::fitName(baseName(item.path), 22);
+    if (!item.folder) question_ = "Delete " + name + " (" + formatBytes(bytes) + ")?";
+    else if (count == 0) question_ = "Delete the empty folder " + name + "?";
+    else question_ = "Delete " + name + " and its " + plural(count, "file") + " (" + formatBytes(bytes) + ")?";
+    question_ += " It can't be undone.";
+    target_ = item;
+    ask_ = Ask::Delete;
+    dialog_.reset(new DialogModel({"Cancel", "Delete"}));
+    requestRedraw();
+}
+
+void StorageApp::onAnswer(int button) {
+    Ask asked = ask_;
+    ask_ = Ask::None;
+    dialog_.reset();
+    if (button != 1) return;
+    switch (asked) {
+        case Ask::Delete:
+            selectIndex_ = rows_.selected();
+            pasting_ = false;
+            work(ops_.remove(target_.path, target_.folder), "");
+            break;
+        case Ask::Replace: paste(true); break;
+        case Ask::Maintenance:
+            view_ = View::Maintenance;
+            maintenance_.enter();
+            break;
+        default: break;
+    }
+}
+
+void StorageApp::showDetails(const Item& item) {
+    int i = rows_.selected();
+    std::string name = baseName(item.path);
+    details_.clear();
+    details_.push_back(name);
+    if (item.folder) details_.push_back("Folder");
+    else {
+        uint32_t size = list_.size(i);
+        std::string text = std::string(kindText(name)) + ", " + formatBytes(size);
+        if (size >= 1024) text += " (" + std::to_string(size) + " bytes)";
+        details_.push_back(text);
+    }
+    details_.push_back("Modified " + files::formatStamp(list_.modified(i)));
+    details_.push_back("In " + cwd_);
+    std::string why = ops_.whyReadOnly(item.path, item.folder);
+    if (!why.empty()) details_.push_back("Read-only: " + why);
+    if (item.folder) {
+        details_.push_back("Counting...");
+        if (ops_.count(item.path).empty()) wait_ = Wait::CountForDetails;
+        else details_.pop_back();
+    }
+    detailsTop_ = 0;
+    view_ = View::Details;
+}
+
+bool StorageApp::onKey(const KeyEvent& e) {
+    requestRedraw();
+    if (view_ == View::NoMemory) return false;
+    if (view_ == View::Maintenance) {
+        if (!maintenance_.onKey(e)) {
+            view_ = View::Browse;
+            open(cwd_);  // a Clean-up may have emptied what was shown
+        }
+        return true;
+    }
+    if (view_ == View::Editor) {
+        if (!noteEditor_.onKey(e)) {
+            std::string name = baseName(noteEditor_.path());
+            noteEditor_.close();
+            view_ = View::Browse;
+            open(cwd_, name);  // its size and date have changed
+        }
+        return true;
+    }
+    if (view_ == View::Viewer && viewer_.showingText() && e.key == Key::Char && (e.ch == 'e' || e.ch == 'E')) {
+        // Edit it (Q146), if the rules and its size allow.
+        std::string path = viewer_.path(), why = ops_.whyReadOnly(path, false);
+        if (why.empty() && viewer_.size() > notes::NoteText::kMaxBytes) why = "Too big to edit: 16 KB at most";
+        if (why.empty()) {
+            viewer_.close();
+            why = noteEditor_.open(path);
+            if (why.empty()) view_ = View::Editor;
+            else {
+                view_ = View::Browse;
+                say(why);
+            }
+        } else {
+            viewer_.say(why);
+        }
+        return true;
+    }
+    if (view_ == View::Viewer) {
+        if (!viewer_.onKey(e)) {
+            viewer_.close();
+            view_ = View::Browse;
+        }
+        return true;
+    }
+    if (dialog_) {
+        dialog_->onKey(e);
+        if (dialog_->result() != DialogModel::kPending) onAnswer(dialog_->result());
+        return true;
+    }
+    if (view_ == View::Details) {
+        if (e.key == Key::Up) detailsTop_ = std::max(0, detailsTop_ - 1);
+        else if (e.key == Key::Down) detailsTop_++;  // clamped when drawn
+        else if (e.key == Key::Back || e.key == Key::Select) {
+            if (wait_ == Wait::CountForDetails) ops_.cancel();
+            view_ = View::Browse;
+        }
+        return true;
+    }
+    // A copy, a delete or a count is running: Back stops it, nothing else gets through. The same
+    // while a folder is being read, which nothing stops.
+    if (wantList_) return true;
+    if (wait_ != Wait::None) {
+        if (e.key == Key::Back && wait_ != Wait::List) ops_.cancel();
+        return true;
+    }
+    if (view_ == View::Name) return onNameKey(e);
+    return onBrowseKey(e);
+}
+
+bool StorageApp::onNameKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Char: editor_.insert(e.ch); break;
+        case Key::Delete: editor_.backspace(); break;
+        case Key::Left: editor_.left(); break;
+        case Key::Right: editor_.right(); break;
+        case Key::Back: view_ = View::Browse; break;
+        case Key::Select: {
+            const std::string& name = editor_.text();
+            std::string why = files::checkName(name);
+            if (!why.empty()) {
+                say(why);
+                break;
+            }
+            pasting_ = false;
+            bool started = true;
+            if (!renaming_) {
+                target_.path = joinPath(cwd_, name);
+                target_.folder = true;
+                started = work(ops_.makeFolder(target_.path), name);
+            } else if (name != baseName(target_.path)) {
+                std::string to = joinPath(cwd_, name);
+                started = work(ops_.move(target_.path, target_.folder, to), name);
+                if (started) target_.path = to;
+            }
+            if (started) view_ = View::Browse;
+            break;
+        }
+        default: break;
+    }
+    return true;
+}
+
+bool StorageApp::onBrowseKey(const KeyEvent& e) {
+    auto askMaintenance = [this]() {
+        question_ = "Clean-up and Erase delete files for good: there is no undo.";
+        ask_ = Ask::Maintenance;
+        dialog_.reset(new DialogModel({"Back", "Go on"}));
+    };
+    if (e.key == Key::Back) {
+        if (cwd_ == "/" || !cardPresent_) return false;  // leaves the App
+        open(parentOf(cwd_), baseName(cwd_));
+        return true;
+    }
+    uint32_t ch = e.key == Key::Char ? (e.ch >= 'A' && e.ch <= 'Z' ? e.ch + 32 : e.ch) : 0;
+    if (ch == 'm') askMaintenance();
+    if (!cardPresent_ || !loaded_) return true;
+
+    Item item = selected();
+    switch (e.key) {
+        case Key::Up: rows_.up(); return true;
+        case Key::Down: rows_.down(); return true;
+        case Key::Left: rows_.pageUp(); return true;
+        case Key::Right: rows_.pageDown(); return true;
+        case Key::Select:
+            if (onMaintenanceRow()) askMaintenance();
+            else if (item && item.folder) open(item.path);
+            else if (item) {
+                viewer_.open(item.path, list_.size(rows_.selected()));
+                view_ = View::Viewer;
+            }
+            return true;
+        case Key::Delete: ch = 'd'; break;
+        default: break;
+    }
+    switch (ch) {
+        case 'v': paste(false); return true;
+        case 'n':
+            renaming_ = false;
+            editor_.setText("");
+            view_ = View::Name;
+            return true;
+        case 's': {
+            sort_ = sort_ == files::FileSort::Name ? files::FileSort::Date : sort_ == files::FileSort::Date ? files::FileSort::Size : files::FileSort::Name;
+            std::string keep = item ? baseName(item.path) : "";
+            bool onLast = onMaintenanceRow();
+            list_.sort(sort_);
+            if (!onLast) rows_.select(std::max(0, list_.find(keep)));
+            say(sort_ == files::FileSort::Name ? "Sorted by name" : sort_ == files::FileSort::Date ? "Sorted by date, newest first" : "Sorted by size, biggest first");
+            return true;
+        }
+        default: break;
+    }
+    if (!item || !(ch == 'c' || ch == 'x' || ch == 'r' || ch == 'd' || ch == 'i')) return true;
+
+    std::string name = files::fitName(baseName(item.path), 18);
+    if (ch == 'i') {
+        showDetails(item);
+        return true;
+    }
+    if (ch == 'c') {
+        clip_ = item;
+        cut_ = false;
+        say("v pastes a copy of " + name);
+        return true;
+    }
+    // Cut, rename and delete change the original: the rules of Q130 first.
+    std::string why = ops_.whyReadOnly(item.path, item.folder);
+    if (!why.empty()) {
+        say(why);
+        return true;
+    }
+    if (ch == 'x') {
+        clip_ = item;
+        cut_ = true;
+        say("v moves " + name + " here");
+    } else if (ch == 'r') {
+        target_ = item;
+        renaming_ = true;
+        editor_.setText(baseName(item.path));
+        view_ = View::Name;
+    } else if (item.folder) {  // 'd': what's inside is counted first (Q132)
+        target_ = item;
+        std::string busy = ops_.count(item.path);
+        if (!busy.empty()) say(busy);
+        else {
+            wait_ = Wait::CountToDelete;
+            waitSinceMs_ = millis();
+        }
+    } else {
+        askDelete(item, 1, list_.size(rows_.selected()));
+    }
+    return true;
+}
+
+void StorageApp::draw(Canvas& c) {
+    lastDrawMs_ = millis();
+    const auto& area = theme::kContent;
+    c.setTextDatum(top_left);
+    switch (view_) {
+        case View::NoMemory:
+            c.setFont(&fonts::bold);
+            c.setTextColor(theme::kWarning);
+            c.drawString("Not enough memory", 4, area.y + 4);
+            c.setFont(&fonts::body);
+            c.setTextColor(theme::kMuted);
+            c.drawString("Close what's running (IRC, a page", 4, area.y + 22);
+            c.drawString("in Gemini) and open Storage again.", 4, area.y + 22 + theme::kLineHeight);
+            return;
+        case View::Maintenance: maintenance_.draw(c); return;
+        case View::Viewer: viewer_.draw(c); return;
+        case View::Editor: noteEditor_.draw(c); return;
+        case View::Details: {
+            std::vector<std::string> lines;
+            auto measure = widgets::bodyMeasure(c);
+            for (auto& d : details_)
+                for (auto& l : wrapText(d, area.w - 12, measure)) lines.push_back(l);
+            int rows = (area.h - 2) / theme::kLineHeight;
+            detailsTop_ = std::clamp(detailsTop_, 0, std::max(0, static_cast<int>(lines.size()) - rows));
+            widgets::textLines(c, lines, detailsTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 2});
+            return;
+        }
+        default: break;
+    }
+    drawBrowse(c);
+    if (view_ == View::Name) {
+        theme::Rect box{16, 44, theme::kWidth - 32, 48};
+        c.fillRect(box.x, box.y, box.w, box.h, theme::kBackground);
+        c.drawRect(box.x, box.y, box.w, box.h, theme::kAccent);
+        c.setFont(&fonts::bold);
+        c.setTextColor(theme::kText);
+        c.drawString(renaming_ ? "Rename" : "New folder", box.x + 6, box.y + 4);
+        widgets::lineEditor(c, editor_, {box.x + 6, box.y + 22, box.w - 12, theme::kLineHeight + 4});
+    }
+    if (dialog_) {
+        const char* title = ask_ == Ask::Delete ? "Delete" : ask_ == Ask::Replace ? "Replace" : "Maintenance";
+        widgets::dialog(c, title, question_, *dialog_);
+    } else if ((wait_ == Wait::Work || wait_ == Wait::CountToDelete) && millis() - waitSinceMs_ >= kQuietMs) {
+        drawProgress(c);
+    }
+}
+
+void StorageApp::drawBrowse(Canvas& c) {
+    const auto& area = theme::kContent;
+    StorageState card = storage_.state();
+
+    // Where we are, and how much room is left (Q129).
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    std::string right;
+    if (card.present) {
+        right = formatBytes(card.totalBytes - card.usedBytes) + " free";
+        if (loaded_ && list_.more() > 0) right = "first " + std::to_string(list_.count()) + " of " + std::to_string(list_.count() + list_.more());
+    }
+    size_t room = static_cast<size_t>((area.w - 12) / 5) - right.size() - 1;
+    std::string path = cwd_.size() <= room ? cwd_ : ".." + cwd_.substr(cwd_.size() - (room - 2));
+    c.drawString(path.c_str(), 4, area.y + 1);
+    c.setTextDatum(top_right);
+    c.drawString(right.c_str(), area.w - 3, area.y + 1);
+    c.setTextDatum(top_left);
+
+    theme::Rect rows{area.x, area.y + 10, area.w, kRows * theme::kLineHeight};
+    c.setFont(&fonts::body);
+    if (!card.present) {
+        c.setTextColor(theme::kWarning);
+        c.drawString("No SD card", 4, rows.y + 4);
+    } else if (!loaded_) {
+        // Nothing yet: the footer says what's being read.
+    } else if (rows_.count() == 0) {
+        c.setTextColor(theme::kMuted);
+        c.drawString("Nothing in this folder.", 4, rows.y + 4);
+        c.drawString("n makes a folder, v pastes.", 4, rows.y + 4 + theme::kLineHeight);
+    } else {
+        int entries = static_cast<int>(list_.count());
+        auto value = [&](int i) {
+            return i >= entries ? std::string(">") : files::rowDetail(list_.folder(i), list_.size(i), list_.modified(i));
+        };
+        widgets::list(
+            c, rows_, rows,
+            [&](int i) {
+                if (i >= entries) return std::string("Maintenance");
+                size_t fits = static_cast<size_t>((area.w - 22) / 6) - value(i).size();
+                return files::fitName(list_.name(i), fits);
+            },
+            value);
+    }
+
+    // Footer: a message for a few seconds, what v would paste, or the keys.
+    c.setFont(&fonts::small);
+    bool showMessage = !message_.empty() && millis() - messageMs_ < kMessageMs;
+    c.setTextColor(showMessage ? theme::kWarning : theme::kMuted);
+    std::string keys = "c x v:paste r:name d:del n:new i:info s:sort";
+    if ((wantList_ || wait_ == Wait::List) && millis() - waitSinceMs_ >= kQuietMs) keys = "Reading " + files::fitName(want_, 30) + "...";
+    else if (clip_) keys = std::string("v: ") + (cut_ ? "move " : "copy ") + files::fitName(baseName(clip_.path), 20) + " here";
+    c.drawString(showMessage ? message_.c_str() : keys.c_str(), 4, area.y + area.h - 9);
+}
+
+void StorageApp::drawProgress(Canvas& c) {
+    FileOps::Status s = ops_.status();
+    theme::Rect box{20, 40, theme::kWidth - 40, 58};
+    c.fillRect(box.x, box.y, box.w, box.h, theme::kBackground);
+    c.drawRect(box.x, box.y, box.w, box.h, theme::kAccent);
+    c.setTextDatum(top_left);
+    c.setFont(&fonts::bold);
+    c.setTextColor(theme::kText);
+    const char* verb = s.op == FileOps::Op::Copy ? "Copying " : s.op == FileOps::Op::Delete ? "Deleting " : s.op == FileOps::Op::Count ? "Counting " : "Moving ";
+    c.drawString((verb + files::fitName(baseName(target_.path), 20)).c_str(), box.x + 6, box.y + 4);
+
+    c.setFont(&fonts::body);
+    c.setTextColor(theme::kMuted);
+    std::string line = plural(s.files, "file");
+    if (s.op == FileOps::Op::Copy && s.totalBytes > 0) {
+        int w = box.w - 12, done = static_cast<int>(static_cast<uint64_t>(s.doneBytes) * w / s.totalBytes);
+        c.drawRect(box.x + 6, box.y + 21, w, 7, theme::kMuted);
+        c.fillRect(box.x + 6, box.y + 21, std::min(done, w), 7, theme::kAccent);
+        line = formatBytes(s.doneBytes) + " of " + formatBytes(s.totalBytes);
+    }
+    c.drawString(line.c_str(), box.x + 6, box.y + 31);
+    c.setFont(&fonts::small);
+    c.drawString("Back: cancel", box.x + 6, box.y + box.h - 10);
+}
+
+}  // namespace roro

src/apps/storage_app.h

@@ -0,0 +1,98 @@
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "apps/file_viewer.h"
+#include "apps/maintenance_page.h"
+#include "apps/note_editor.h"
+#include "dialog_model.h"
+#include "event_bus.h"
+#include "file_list.h"
+#include "line_editor.h"
+#include "list_model.h"
+#include "services/clock_service.h"
+#include "services/file_ops.h"
+#include "services/storage_service.h"
+#include "ui/theme.h"
+
+namespace roro {
+
+// The Storage App (docs/milestones/F1.md): the SD card's folders and files, one item at a time
+// with a clipboard (Q131). Enter opens a folder, or a file in its viewer (Q134); Back goes up;
+// c copy, x cut, v paste here, r rename, d delete, n new folder, i details, s sort. At the top of the card, the last row is Maintenance:
+// usage, Storage Clean-up and erasing the card, behind a warning (Q128).
+class StorageApp : public App {
+   public:
+    StorageApp(FileOps& ops, StorageService& storage, ClockService& clock, UpdateService& update, PowerService& power, EventBus& bus)
+        : ops_(ops), storage_(storage), bus_(bus), maintenance_(storage, clock, bus), viewer_(storage, update), noteEditor_(storage, clock, power) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    bool textEntryActive() const override { return view_ == View::Name || view_ == View::Editor; }
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View { Browse, Details, Name, Viewer, Editor, Maintenance, NoMemory };
+    enum class Ask { None, Delete, Replace, Maintenance };
+    enum class Wait { None, List, CountToDelete, CountForDetails, Work };  // what the running operation is for
+    static constexpr int kRows = 8;
+    static constexpr size_t kStartFloor = 55 * 1024;  // Q86, Q136
+
+    struct Item {
+        std::string path;
+        bool folder = false;
+        explicit operator bool() const { return !path.empty(); }
+    };
+
+    void open(const std::string& folder, const std::string& select = "");
+    void onFinished(const FileOps::Status& s);
+    bool onBrowseKey(const KeyEvent& e);
+    bool onNameKey(const KeyEvent& e);
+    void onAnswer(int button);
+    Item selected() const;  // empty on the Maintenance row or in an empty folder
+    bool onMaintenanceRow() const { return cwd_ == "/" && rows_.selected() == static_cast<int>(list_.count()); }
+    void paste(bool replace);
+    void askDelete(const Item& item, uint32_t files, uint32_t bytes);
+    void showDetails(const Item& item);
+    bool work(const std::string& why, const std::string& selectAfter);  // an operation was asked for: did it start?
+    void say(const std::string& text);
+    void drawBrowse(Canvas& c);
+    void drawProgress(Canvas& c);
+
+    FileOps& ops_;
+    StorageService& storage_;
+    EventBus& bus_;
+    MaintenancePage maintenance_;
+    FileViewer viewer_;
+    NoteEditor noteEditor_;  // `e` in the text viewer (Q146)
+
+    View view_ = View::Browse;
+    std::string cwd_ = "/", want_ = "/";  // the folder on screen; the one being read
+    files::FileList list_;
+    files::FileSort sort_ = files::FileSort::Name;
+    ListModel rows_{kRows};
+    bool wantList_ = false, loaded_ = false, cardPresent_ = false;
+    std::string selectAfter_;  // after the next listing: the name to select, or else the row
+    int selectIndex_ = 0;
+
+    Wait wait_ = Wait::None;
+    uint32_t waitSinceMs_ = 0, lastDrawMs_ = 0;
+    Item clip_, target_;  // the clipboard; what a dialog, the editor or the details are about
+    bool cut_ = false;
+    Ask ask_ = Ask::None;
+    std::unique_ptr<DialogModel> dialog_;
+    std::string question_;
+    LineEditor editor_{60};
+    bool renaming_ = false;  // Name view: renaming target_, or else a new folder
+    bool pasting_ = false;   // the operation running came from v: it may ask to replace
+    std::vector<std::string> details_;
+    int detailsTop_ = 0;
+    std::string message_;
+    uint32_t messageMs_ = 0;
+};
+
+}  // namespace roro

src/apps/system_app.cpp

@@ -0,0 +1,361 @@
+#include "system_app.h"
+
+#include <Arduino.h>
+#include <SD.h>
+#include <esp_heap_caps.h>
+
+#include <algorithm>
+#include <cstdio>
+
+#include "cleanup_plan.h"
+#include "platform/system_info.h"
+#include "sd_fault.h"
+#include "services/gemini_service.h"
+#include "ui/canvas.h"
+#include "ui/fonts.h"
+#include "ui/theme.h"
+#include "ui/widgets.h"
+
+namespace roro {
+
+namespace {
+
+constexpr size_t kUsers = static_cast<size_t>(net::User::Count);
+
+// Collects what the console's `info` prints, so the System view can't drift from it (Q125).
+class Lines : public Print {
+   public:
+    size_t write(uint8_t ch) override {
+        if (ch == '\n') {
+            lines.push_back(current_);
+            current_.clear();
+        } else if (ch != '\r') {
+            current_ += static_cast<char>(ch);
+        }
+        return 1;
+    }
+    std::vector<std::string> lines;
+
+   private:
+    std::string current_;
+};
+
+std::string duration(uint32_t seconds) {
+    char s[24];
+    if (seconds < 3600) std::snprintf(s, sizeof s, "%lu min %02lu s", (unsigned long)(seconds / 60), (unsigned long)(seconds % 60));
+    else std::snprintf(s, sizeof s, "%lu h %02lu min", (unsigned long)(seconds / 3600), (unsigned long)(seconds / 60 % 60));
+    return s;
+}
+
+// A filled bar for a percentage; the warning colour from 90 %.
+void bar(Canvas& c, int x, int y, int w, int percent) {
+    c.drawRect(x, y, w, 9, theme::kMuted);
+    int filled = std::clamp(percent, 0, 100) * (w - 2) / 100;
+    if (filled > 0) c.fillRect(x + 1, y + 1, filled, 7, percent >= 90 ? theme::kWarning : theme::kAccent);
+}
+
+}  // namespace
+
+void SystemApp::onEnter() {
+    view_ = View::Overview;
+    beforeTotal_ = system_info::sampleTasks(before_);
+    sampledMs_ = millis();
+    for (size_t i = 0; i < kUsers; i++) traffic_[i] = net::traffic(static_cast<net::User>(i));
+    requestRedraw();
+}
+
+void SystemApp::onExit() {  // nothing is kept while it's closed (Q120)
+    std::vector<TaskSample>().swap(before_);
+    std::vector<TaskRow>().swap(rows_);
+    std::vector<std::string>().swap(systemLines_);
+    for (auto& h : loadHistory_) h.clear();
+    heapHistory_.clear();
+    load_[0] = load_[1] = -1;
+}
+
+bool SystemApp::onKey(const KeyEvent& e) {
+    if (e.key == Key::Tab) {
+        int n = static_cast<int>(View::Count), v = static_cast<int>(view_);
+        view_ = static_cast<View>(e.shift ? (v + n - 1) % n : (v + 1) % n);
+        taskTop_ = systemTop_ = 0;
+        requestRedraw();
+        return true;
+    }
+    int step = e.key == Key::Up ? -1 : e.key == Key::Down ? 1 : 0;
+    if (step && view_ == View::Tasks) {
+        taskTop_ = std::clamp(taskTop_ + step, 0, std::max(0, static_cast<int>(rows_.size()) - kTaskRows));
+        requestRedraw();
+        return true;
+    }
+    if (step && view_ == View::System) {
+        systemTop_ = std::clamp(systemTop_ + step, 0, std::max(0, wrappedLines_ - 8));
+        requestRedraw();
+        return true;
+    }
+    if (view_ == View::Tasks && e.key == Key::Char && (e.ch == 's' || e.ch == 'S')) {  // Q122
+        sort_ = static_cast<TaskSort>((static_cast<int>(sort_) + 1) % 3);
+        sortTasks(rows_, sort_);
+        taskTop_ = 0;
+        requestRedraw();
+        return true;
+    }
+    return false;  // Back leaves the App
+}
+
+void SystemApp::update(uint32_t nowMs) {
+    if (nowMs - sampledMs_ >= 1000) sample(nowMs);
+}
+
+// Once a second (Q119): the tasks' shares over that second, the cores' load, the heap, the traffic.
+void SystemApp::sample(uint32_t nowMs) {
+    uint32_t elapsedMs = nowMs - sampledMs_;
+    sampledMs_ = nowMs;
+
+    std::vector<TaskSample> now;
+    uint32_t total = system_info::sampleTasks(now);
+    rows_ = taskRows(before_, beforeTotal_, now, total);
+    sortTasks(rows_, sort_);
+    before_.swap(now);
+    beforeTotal_ = total;
+    for (int core = 0; core < 2; core++) {
+        load_[core] = coreLoad(rows_, core);
+        loadHistory_[core].push(static_cast<uint8_t>(std::max(0, load_[core])));
+    }
+    heapHistory_.push(static_cast<uint16_t>(ESP.getFreeHeap() / 1024));
+
+    for (size_t i = 0; i < kUsers; i++) {
+        net::Traffic t = net::traffic(static_cast<net::User>(i));
+        rateIn_[i] = net::bytesPerSecond(traffic_[i].in, t.in, elapsedMs);
+        rateOut_[i] = net::bytesPerSecond(traffic_[i].out, t.out, elapsedMs);
+        traffic_[i] = t;
+    }
+
+    if (view_ == View::System) {  // the slow things: only while they're on screen
+        Lines out;
+        system_info::printSystem(out);
+        const BatteryEstimator& b = battery_.estimator();
+        if (b.hasReading()) out.printf("battery: %d %%, %d.%02d V\n", b.percent(), b.millivolts() / 1000, b.millivolts() % 1000 / 10);
+        StorageState card = storage_.state();
+        if (card.present)
+            out.printf("sd: %s of %s used, %u write faults\n", formatBytes(card.usedBytes).c_str(), formatBytes(card.totalBytes).c_str(),
+                       (unsigned)sdLastFault().count);
+        else out.println("sd: no card");
+        out.printf("radio: %s\n", !radio_.present() ? "none" : radio_.sweeping() ? "sweeping" : radio_.listening() ? "listening" : "asleep");
+        const auto& g = gnss_.state();
+        out.printf("gnss: %s, %d satellites used\n", !gnss_.on() ? "off" : gnss_.receiving(nowMs) ? "receiving" : "silent", g.satellitesUsed);
+        system_info::printSlots(out, store_);
+        systemLines_.swap(out.lines);
+    }
+    requestRedraw();
+}
+
+void SystemApp::footer(Canvas& c, const char* keys) {
+    const auto& area = theme::kContent;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.setTextDatum(top_left);
+    c.drawString(keys, 4, area.y + area.h - 9);
+}
+
+void SystemApp::draw(Canvas& c) {
+    c.setTextDatum(top_left);
+    switch (view_) {
+        case View::Overview: drawOverview(c); break;
+        case View::Tasks: drawTasks(c); break;
+        case View::Memory: drawMemory(c); break;
+        case View::Network: drawNetwork(c); break;
+        case View::System: drawSystem(c); break;
+        default: break;
+    }
+}
+
+void SystemApp::drawOverview(Canvas& c) {
+    const auto& area = theme::kContent;
+    char line[72];
+    c.setFont(&fonts::body);
+    int y = area.y + 2;
+    for (int core = 0; core < 2; core++) {
+        c.setTextColor(theme::kMuted);
+        std::snprintf(line, sizeof line, "Core %d", core);
+        c.drawString(line, 4, y);
+        bar(c, 52, y + 2, 130, load_[core]);
+        c.setTextColor(theme::kText);
+        if (load_[core] >= 0) std::snprintf(line, sizeof line, "%d%%", load_[core]);
+        else std::snprintf(line, sizeof line, "...");
+        c.drawString(line, 190, y);
+        y += theme::kLineHeight;
+    }
+    auto row = [&](const char* label, const std::string& value) {
+        c.setTextColor(theme::kMuted);
+        c.drawString(label, 4, y);
+        c.setTextColor(theme::kText);
+        c.drawString(value.c_str(), 62, y);
+        y += theme::kLineHeight;
+    };
+    std::snprintf(line, sizeof line, "%u KB free, lowest %u", (unsigned)(ESP.getFreeHeap() / 1024), (unsigned)(ESP.getMinFreeHeap() / 1024));
+    row("Memory", line);
+    uint32_t in = 0, out = 0;
+    for (size_t i = 0; i < kUsers; i++) in += rateIn_[i], out += rateOut_[i];
+    if (wifi_.state() == WifiController::State::Connected)
+        std::snprintf(line, sizeof line, "%s/s in, %s/s out", net::formatTraffic(in).c_str(), net::formatTraffic(out).c_str());
+    else std::snprintf(line, sizeof line, "not connected");
+    row("Network", line);
+    const BatteryEstimator& b = battery_.estimator();
+    if (b.hasReading()) std::snprintf(line, sizeof line, "%d%%, %d.%02d V", b.percent(), b.millivolts() / 1000, b.millivolts() % 1000 / 10);
+    else std::snprintf(line, sizeof line, "...");
+    row("Battery", line);
+    std::snprintf(line, sizeof line, "%s, %.0f C", duration(millis() / 1000).c_str(), temperatureRead());
+    row("Uptime", line);
+
+    // Both cores over the last two minutes: core 0 in the accent colour, core 1 in green.
+    int gx = 4, gy = y + 3, gw = static_cast<int>(kHistory) * 2 - 8, gh = area.y + area.h - 12 - gy;
+    if (gh > 8) {
+        c.drawRect(gx, gy, gw + 2, gh + 2, theme::kMuted);
+        for (int core = 0; core < 2; core++) {
+            const auto& h = loadHistory_[core];
+            for (size_t i = 1; i < h.size(); i++) {
+                int x0 = gx + 1 + static_cast<int>((i - 1) * gw / kHistory), x1 = gx + 1 + static_cast<int>(i * gw / kHistory);
+                c.drawLine(x0, gy + gh - h.at(i - 1) * gh / 100, x1, gy + gh - h.at(i) * gh / 100, core ? theme::kMessage : theme::kAccent);
+            }
+        }
+    }
+    footer(c, "Tab: tasks, memory, network, system");
+}
+
+void SystemApp::drawTasks(Canvas& c) {
+    const auto& area = theme::kContent;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("task", 4, area.y + 2);
+    c.setTextDatum(top_right);
+    c.drawString("core", 128, area.y + 2);
+    c.drawString("cpu", 176, area.y + 2);
+    c.drawString("stack left", area.w - 4, area.y + 2);
+    c.setFont(&fonts::body);
+    char cell[16];
+    for (int i = 0; i < kTaskRows && taskTop_ + i < static_cast<int>(rows_.size()); i++) {
+        const TaskRow& r = rows_[taskTop_ + i];
+        int y = area.y + 12 + i * theme::kLineHeight;
+        c.setTextDatum(top_left);
+        c.setTextColor(r.idle ? theme::kMuted : theme::kText);
+        c.drawString(r.name.c_str(), 4, y);
+        c.setTextDatum(top_right);
+        c.setTextColor(theme::kMuted);
+        c.drawString(r.core < 0 ? "any" : std::to_string(r.core).c_str(), 128, y);
+        c.setTextColor(r.idle ? theme::kMuted : theme::kText);
+        std::snprintf(cell, sizeof cell, "%u.%u%%", r.permille / 10, r.permille % 10);
+        c.drawString(cell, 176, y);
+        c.setTextColor(r.lowStack ? theme::kWarning : theme::kMuted);  // Q122: under 512 bytes
+        c.drawString(std::to_string(r.stackFree).c_str(), area.w - 4, y);
+    }
+    c.setTextDatum(top_left);
+    std::string keys = std::string("s: by ") + (sort_ == TaskSort::Share ? "stack" : sort_ == TaskSort::Stack ? "name" : "cpu") +
+                       "   " + std::to_string(rows_.size()) + " tasks   Tab: memory";
+    footer(c, keys.c_str());
+}
+
+void SystemApp::drawMemory(Canvas& c) {
+    const auto& area = theme::kContent;
+    char line[72];
+    c.setFont(&fonts::body);
+    c.setTextColor(theme::kText);
+    std::snprintf(line, sizeof line, "%.1f KB free, lowest %.1f", ESP.getFreeHeap() / 1024.0, ESP.getMinFreeHeap() / 1024.0);
+    c.drawString(line, 4, area.y + 2);
+    c.setTextColor(theme::kMuted);
+    std::snprintf(line, sizeof line, "largest free block %.1f KB", heap_caps_get_largest_free_block(MALLOC_CAP_8BIT) / 1024.0);
+    c.drawString(line, 4, area.y + 2 + theme::kLineHeight);
+
+    // Free heap over two minutes, with the floors of Q86 as lines.
+    int gx = 26, gy = area.y + 32, gw = area.w - gx - 6, gh = area.y + area.h - 12 - gy;
+    uint16_t top = 128;  // KB at the top of the scale: more if the heap has been higher
+    for (size_t i = 0; i < heapHistory_.size(); i++) top = std::max<uint16_t>(top, heapHistory_.at(i) + 8);
+    auto yOf = [&](int kb) { return gy + gh - std::clamp(kb, 0, static_cast<int>(top)) * gh / top; };
+    c.drawRect(gx, gy, gw, gh + 1, theme::kMuted);
+    c.setFont(&fonts::small);
+    struct {
+        size_t bytes;
+        uint16_t color;
+    } floors[] = {{GeminiService::kStartFloor, theme::kMuted}, {GeminiService::kSteadyFloor, theme::kWarning}, {GeminiService::kTransientFloor, theme::kMessage}};
+    for (auto& f : floors) {
+        int kb = static_cast<int>(f.bytes / 1024), y = yOf(kb);
+        for (int x = gx + 1; x < gx + gw - 1; x += 4) c.drawPixel(x, y, f.color);
+        c.setTextColor(f.color);
+        c.setTextDatum(top_right);
+        c.drawString(std::to_string(kb).c_str(), gx - 3, y - 3);
+    }
+    c.setTextDatum(top_left);
+    for (size_t i = 1; i < heapHistory_.size(); i++) {
+        int x0 = gx + 1 + static_cast<int>((i - 1) * (gw - 2) / kHistory), x1 = gx + 1 + static_cast<int>(i * (gw - 2) / kHistory);
+        c.drawLine(x0, yOf(heapHistory_.at(i - 1)), x1, yOf(heapHistory_.at(i)), theme::kAccent);
+    }
+    footer(c, "KB free, 2 min, with the floors   Tab: network");
+}
+
+void SystemApp::drawNetwork(Canvas& c) {
+    const auto& area = theme::kContent;
+    char line[72];
+    c.setFont(&fonts::body);
+    WifiService::Connection n = wifi_.connection();
+    c.setTextColor(n.connected ? theme::kText : theme::kWarning);
+    if (n.connected) std::snprintf(line, sizeof line, "%s, %d dBm", wifi_.ssid().c_str(), wifi_.rssi());
+    else std::snprintf(line, sizeof line, "Wi-Fi isn't connected");
+    c.drawString(line, 4, area.y + 2);
+    if (n.connected) {
+        c.setTextColor(theme::kMuted);
+        std::snprintf(line, sizeof line, "%s/%d %s, gw %s", n.address.c_str(), n.prefix, n.fixed ? "fixed" : "DHCP",
+                      n.gateway.empty() ? "none" : n.gateway.c_str());
+        c.drawString(line, 4, area.y + 2 + theme::kLineHeight);
+    }
+    // Per service (Q121): totals since boot, and the last second.
+    int y = area.y + 32;
+    c.setFont(&fonts::small);
+    c.setTextColor(theme::kMuted);
+    c.drawString("service", 4, y);
+    c.setTextDatum(top_right);
+    c.drawString("in", 124, y);
+    c.drawString("out", 168, y);
+    c.drawString("now, /s", area.w - 4, y);
+    c.setFont(&fonts::body);
+    y += 10;
+    for (size_t i = 0; i < kUsers; i++) {
+        bool active = rateIn_[i] || rateOut_[i];
+        c.setTextDatum(top_left);
+        c.setTextColor(active ? theme::kMessage : theme::kText);
+        c.drawString(net::userName(static_cast<net::User>(i)), 4, y);
+        c.setTextDatum(top_right);
+        c.setTextColor(theme::kText);
+        c.drawString(net::formatTraffic(traffic_[i].in).c_str(), 124, y);
+        c.drawString(net::formatTraffic(traffic_[i].out).c_str(), 168, y);
+        c.setTextColor(active ? theme::kMessage : theme::kMuted);
+        c.drawString(active ? net::formatTraffic(rateIn_[i] + rateOut_[i]).c_str() : "-", area.w - 4, y);
+        y += theme::kLineHeight;
+    }
+    c.setTextDatum(top_left);
+    footer(c, "bytes since boot   Tab: system");
+}
+
+void SystemApp::drawSystem(Canvas& c) {
+    const auto& area = theme::kContent;
+    if (systemLines_.empty()) {
+        c.setFont(&fonts::body);
+        c.setTextColor(theme::kMuted);
+        c.drawString("Reading...", 4, area.y + 4);
+        return;
+    }
+    // The console's lines are longer than the screen: wrap them, continuation lines indented.
+    std::vector<std::string> wrapped;
+    auto measure = widgets::bodyMeasure(c);
+    for (const std::string& line : systemLines_) {
+        bool first = true;
+        for (const std::string& part : wrapText(line, area.w - 14, measure)) {
+            wrapped.push_back(first ? part : "  " + part);
+            first = false;
+        }
+    }
+    wrappedLines_ = static_cast<int>(wrapped.size());
+    systemTop_ = std::clamp(systemTop_, 0, std::max(0, wrappedLines_ - 8));
+    widgets::textLines(c, wrapped, systemTop_, {area.x + 2, area.y + 2, area.w - 2, area.h - 12});
+    footer(c, "Tab: overview");
+}
+
+}  // namespace roro

src/apps/system_app.h

@@ -0,0 +1,67 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "app.h"
+#include "key_value_store.h"
+#include "services/battery_service.h"
+#include "services/gnss_service.h"
+#include "services/radio_service.h"
+#include "services/storage_service.h"
+#include "services/wifi_service.h"
+#include "task_stats.h"
+#include "traffic.h"
+
+namespace roro {
+
+// The System App (docs/milestones/S1.md, Q117 to Q127): what the device is doing, live and
+// read-only. Tab moves between Overview, Tasks, Memory, Network and System. It samples once a
+// second and keeps two minutes of history, only while it's open (Q120).
+class SystemApp : public App {
+   public:
+    SystemApp(WifiService& wifi, BatteryService& battery, StorageService& storage, RadioService& radio, GnssService& gnss,
+              KeyValueStore& store)
+        : wifi_(wifi), battery_(battery), storage_(storage), radio_(radio), gnss_(gnss), store_(store) {}
+    void onEnter() override;
+    void onExit() override;
+    bool onKey(const KeyEvent& e) override;
+    void update(uint32_t nowMs) override;
+    void draw(Canvas& c) override;
+
+   private:
+    enum class View : uint8_t { Overview, Tasks, Memory, Network, System, Count };
+    static constexpr size_t kHistory = 120;  // seconds
+    static constexpr int kTaskRows = 7;
+
+    void sample(uint32_t nowMs);
+    void drawOverview(Canvas& c);
+    void drawTasks(Canvas& c);
+    void drawMemory(Canvas& c);
+    void drawNetwork(Canvas& c);
+    void drawSystem(Canvas& c);
+    void footer(Canvas& c, const char* keys);
+
+    WifiService& wifi_;
+    BatteryService& battery_;
+    StorageService& storage_;
+    RadioService& radio_;
+    GnssService& gnss_;
+    KeyValueStore& store_;
+    View view_ = View::Overview;
+    uint32_t sampledMs_ = 0;
+    std::vector<TaskSample> before_;
+    uint32_t beforeTotal_ = 0;
+    std::vector<TaskRow> rows_;  // the last second, sorted
+    TaskSort sort_ = TaskSort::Share;
+    int taskTop_ = 0;
+    int load_[2] = {-1, -1};
+    History<uint8_t, kHistory> loadHistory_[2];
+    History<uint16_t, kHistory> heapHistory_;  // free heap, KB
+    net::Traffic traffic_[static_cast<size_t>(net::User::Count)];
+    uint32_t rateIn_[static_cast<size_t>(net::User::Count)] = {}, rateOut_[static_cast<size_t>(net::User::Count)] = {};
+    std::vector<std::string> systemLines_;
+    int systemTop_ = 0, wrappedLines_ = 0;
+};
+
+}  // namespace roro

src/apps/wifi_settings_page.cpp

@@ -1,5 +1,6 @@
 #include "wifi_settings_page.h"
 
+#include "ipv4.h"
 #include "ui/fonts.h"
 #include "ui/widgets.h"
 
@@ -15,6 +16,62 @@ void WifiSettingsPage::enter() {
 
 void WifiSettingsPage::refreshMain() { main_.setCount(kFixedRows + saved_.count()); }
 
+// With Automatic, a network's page shows only the IP row and Forget.
+WifiSettingsPage::NetworkRow WifiSettingsPage::networkRow(int i) const {
+    if (draftFixed_) return static_cast<NetworkRow>(i);
+    return i == 0 ? kIpMode : kForget;
+}
+
+void WifiSettingsPage::openNetwork(const SavedNetwork& n) {
+    netSsid_ = n.ssid;
+    draftFixed_ = n.fixed;
+    draftAddress_ = n.fixed ? net::formatIpv4(n.ip.address) : "";
+    draftPrefix_ = n.fixed ? std::to_string(n.ip.prefix) : "";
+    draftGateway_ = n.fixed && n.ip.gateway ? net::formatIpv4(n.ip.gateway) : "";
+    network_.setCount(draftFixed_ ? 5 : 2);
+    network_.select(0);
+    view_ = View::Network;
+}
+
+// Leaving a network's page applies its IP setting (Q114), if it passes the checks (Q111).
+bool WifiSettingsPage::leaveNetwork() {
+    const SavedNetwork* n = saved_.find(netSsid_);
+    if (!n) return true;  // forgotten meanwhile
+    std::string why;
+    if (draftFixed_) {
+        net::FixedIp fixed;
+        why = net::parseFixed(draftAddress_ + "/" + draftPrefix_ + (draftGateway_.empty() ? "" : " " + draftGateway_), fixed);
+        if (draftAddress_.empty()) why = "A Fixed setting needs an address";
+        if (!why.empty()) {
+            warn(why);
+            return false;
+        }
+        bool same = n->fixed && n->ip.address == fixed.address && n->ip.prefix == fixed.prefix && n->ip.gateway == fixed.gateway;
+        if (same) return true;
+        why = saved_.setIp(netSsid_, &fixed);
+        if (why.empty()) warn(netSsid_ + ": fixed, " + net::formatFixed(fixed), NotificationLevel::Info);
+    } else {
+        if (!n->fixed) return true;
+        why = saved_.setIp(netSsid_, nullptr);
+        if (why.empty()) warn(netSsid_ + ": automatic (DHCP)", NotificationLevel::Info);
+    }
+    if (!why.empty()) {
+        warn(why);
+        return false;
+    }
+    wifi_.ipSettingChanged(netSsid_);
+    return true;
+}
+
+void WifiSettingsPage::edit(Field field, const std::string& title, const std::string& value, View from) {
+    field_ = field;
+    editTitle_ = title;
+    editFrom_ = from;
+    editor_ = LineEditor(field == Field::Ntp1 || field == Field::Ntp2 ? 63 : 15);
+    for (char ch : value) editor_.insert(static_cast<uint8_t>(ch));
+    view_ = View::Edit;
+}
+
 void WifiSettingsPage::warn(const std::string& text, NotificationLevel level) {
     bus_.publish(Event::withText(EventType::Notification, text.c_str(), static_cast<int32_t>(level)));
 }
@@ -35,42 +92,22 @@ bool WifiSettingsPage::onKey(const KeyEvent& e) {
     if (forgetDialog_) {
         forgetDialog_->onKey(e);
         if (forgetDialog_->result() == 1) {
-            saved_.forget(saved_.at(main_.selected() - kFixedRows).ssid);
-            refreshMain();
+            saved_.forget(netSsid_);
+            wifi_.ipSettingChanged(netSsid_);  // it may be the one in use
+            enter();
         }
-        if (forgetDialog_->result() != DialogModel::kPending) forgetDialog_.reset();
+        if (forgetDialog_ && forgetDialog_->result() != DialogModel::kPending) forgetDialog_.reset();
         return true;
     }
 
     switch (view_) {
-        case View::Main:
-            switch (e.key) {
-                case Key::Up: main_.up(); return true;
-                case Key::Down: main_.down(); return true;
-                case Key::Back: return false;
-                case Key::Left:
-                case Key::Right:
-                    if (main_.selected() != kToggle) return true;
-                    [[fallthrough]];
-                case Key::Select:
-                    switch (main_.selected()) {
-                        case kToggle: settings_.setBool(Setting::WifiEnabled, !settings_.getBool(Setting::WifiEnabled)); break;
-                        case kStatus: break;
-                        case kAddScanned:
-                            wifi_.startListScan();
-                            scan_.setCount(0);
-                            view_ = View::Scan;
-                            break;
-                        case kAddHidden:
-                            newHidden_ = true;
-                            editor_ = LineEditor(32);
-                            view_ = View::Ssid;
-                            break;
-                        default: forgetDialog_.reset(new DialogModel({"Cancel", "Forget"})); break;
-                    }
-                    return true;
-                default: return true;
-            }
+        case View::Main: return mainKey(e);
+        case View::Servers: return serversKey(e);
+        case View::Network: return networkKey(e);
+        case View::Edit: return editKey(e);
+        case View::Details:
+            if (e.key == Key::Back || e.key == Key::Select) view_ = View::Main;
+            return true;
 
         case View::Scan: {
             std::vector<ScanEntry> found;
@@ -131,6 +168,159 @@ bool WifiSettingsPage::onKey(const KeyEvent& e) {
     return true;
 }
 
+bool WifiSettingsPage::mainKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Up: main_.up(); return true;
+        case Key::Down: main_.down(); return true;
+        case Key::Back: return false;
+        case Key::Left:
+        case Key::Right:
+            if (main_.selected() != kToggle) return true;
+            [[fallthrough]];
+        case Key::Select:
+            switch (main_.selected()) {
+                case kToggle: settings_.setBool(Setting::WifiEnabled, !settings_.getBool(Setting::WifiEnabled)); break;
+                case kStatus: view_ = View::Details; break;
+                case kServers:
+                    servers_.setCount(kServerRows);
+                    view_ = View::Servers;
+                    break;
+                case kAddScanned:
+                    wifi_.startListScan();
+                    scan_.setCount(0);
+                    view_ = View::Scan;
+                    break;
+                case kAddHidden:
+                    newHidden_ = true;
+                    editor_ = LineEditor(32);
+                    view_ = View::Ssid;
+                    break;
+                default: openNetwork(saved_.at(main_.selected() - kFixedRows)); break;
+            }
+            return true;
+        default: return true;
+    }
+}
+
+// DNS and NTP servers (Q108 to Q110).
+bool WifiSettingsPage::serversKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Up: servers_.up(); break;
+        case Key::Down: servers_.down(); break;
+        case Key::Back: view_ = View::Main; break;
+        case Key::Left:
+        case Key::Right:
+            if (servers_.selected() != kDnsAlways) break;
+            [[fallthrough]];
+        case Key::Select:
+            switch (servers_.selected()) {
+                case kDns1: edit(Field::Dns1, "First DNS server", settings_.getString(Setting::Dns1), View::Servers); break;
+                case kDns2: edit(Field::Dns2, "Second DNS server (or empty)", settings_.getString(Setting::Dns2), View::Servers); break;
+                case kDnsAlways:
+                    settings_.setBool(Setting::DnsAlways, !settings_.getBool(Setting::DnsAlways));
+                    wifi_.serversChanged();
+                    break;
+                case kNtp1: edit(Field::Ntp1, "First NTP server", settings_.getString(Setting::Ntp1), View::Servers); break;
+                case kNtp2: edit(Field::Ntp2, "Second NTP server (or empty)", settings_.getString(Setting::Ntp2), View::Servers); break;
+            }
+            break;
+        default: break;
+    }
+    return true;
+}
+
+bool WifiSettingsPage::networkKey(const KeyEvent& e) {
+    switch (e.key) {
+        case Key::Up: network_.up(); break;
+        case Key::Down: network_.down(); break;
+        case Key::Back:
+            if (leaveNetwork()) enter();
+            break;
+        case Key::Left:
+        case Key::Right:
+            if (networkRow(network_.selected()) != kIpMode) break;
+            [[fallthrough]];
+        case Key::Select:
+            switch (networkRow(network_.selected())) {
+                case kIpMode: {
+                    draftFixed_ = !draftFixed_;
+                    // Fixed for the first time: start from what the network gave us, if we're on it.
+                    WifiService::Connection now = wifi_.connection();
+                    if (draftFixed_ && draftAddress_.empty() && now.connected && wifi_.ssid() == netSsid_) {
+                        draftAddress_ = now.address;
+                        draftPrefix_ = std::to_string(now.prefix);
+                        draftGateway_ = now.gateway;
+                    }
+                    if (draftFixed_ && draftPrefix_.empty()) draftPrefix_ = "24";
+                    network_.setCount(draftFixed_ ? 5 : 2);
+                    network_.select(0);
+                    break;
+                }
+                case kAddress: edit(Field::Address, "Address", draftAddress_, View::Network); break;
+                case kPrefix: edit(Field::Prefix, "Prefix (1 to 30; 24 = 255.255.255.0)", draftPrefix_, View::Network); break;
+                case kGateway: edit(Field::Gateway, "Gateway (or empty for none)", draftGateway_, View::Network); break;
+                case kForget: forgetDialog_.reset(new DialogModel({"Cancel", "Forget"})); break;
+            }
+            break;
+        default: break;
+    }
+    return true;
+}
+
+// One field. Addresses take digits and dots only (Q112); what's typed is checked on Enter (Q111).
+bool WifiSettingsPage::editKey(const KeyEvent& e) {
+    bool name = field_ == Field::Ntp1 || field_ == Field::Ntp2;
+    switch (e.key) {
+        case Key::Char: {
+            bool digit = e.ch >= '0' && e.ch <= '9';
+            bool ok = name ? e.ch > ' ' && e.ch < 0x7F : field_ == Field::Prefix ? digit : digit || e.ch == '.';
+            if (ok) editor_.insert(e.ch);
+            break;
+        }
+        case Key::Delete: editor_.backspace(); break;
+        case Key::Left: editor_.left(); break;
+        case Key::Right: editor_.right(); break;
+        case Key::Back: view_ = editFrom_; break;
+        case Key::Select: {
+            std::string text = editor_.text(), why;
+            uint32_t address;
+            switch (field_) {
+                case Field::Address:
+                    if (!net::parseIpv4(text, address)) why = "Four numbers from 0 to 255, like 10.39.39.13";
+                    else draftAddress_ = text;
+                    break;
+                case Field::Prefix: {
+                    int p = text.empty() ? 0 : atoi(text.c_str());
+                    if (p < 1 || p > 30) why = "The prefix must be 1 to 30";
+                    else draftPrefix_ = std::to_string(p);
+                    break;
+                }
+                case Field::Gateway:
+                    if (!text.empty() && !net::parseIpv4(text, address)) why = "Four numbers from 0 to 255, or empty";
+                    else draftGateway_ = text;
+                    break;
+                case Field::Dns1:
+                case Field::Dns2:
+                    if (!settings_.setString(field_ == Field::Dns1 ? Setting::Dns1 : Setting::Dns2, text))
+                        why = field_ == Field::Dns1 ? "An IPv4 address, like 9.9.9.9" : "An IPv4 address, or empty";
+                    else wifi_.serversChanged();
+                    break;
+                case Field::Ntp1:
+                case Field::Ntp2:
+                    if (!settings_.setString(field_ == Field::Ntp1 ? Setting::Ntp1 : Setting::Ntp2, text))
+                        why = field_ == Field::Ntp1 ? "A host name or an IPv4 address" : "A host name, an IPv4 address, or empty";
+                    else wifi_.serversChanged();
+                    break;
+            }
+            if (why.empty()) view_ = editFrom_;
+            else warn(why);
+            break;
+        }
+        default: break;
+    }
+    return true;
+}
+
 void WifiSettingsPage::draw(Canvas& c) {
     const auto& area = theme::kContent;
     switch (view_) {
@@ -141,6 +331,7 @@ void WifiSettingsPage::draw(Canvas& c) {
                     switch (i) {
                         case kToggle: return "Wi-Fi";
                         case kStatus: return "Status";
+                        case kServers: return "DNS and NTP";
                         case kAddScanned: return "Add a network";
                         case kAddHidden: return "Add a hidden network";
                         default: {
@@ -153,14 +344,78 @@ void WifiSettingsPage::draw(Canvas& c) {
                     switch (i) {
                         case kToggle: return settings_.getBool(Setting::WifiEnabled) ? "On" : "Off";
                         case kStatus: return statusText();
+                        case kServers:
                         case kAddScanned:
                         case kAddHidden: return ">";
+                        default: return saved_.at(i - kFixedRows).fixed ? "fixed" : "";
+                    }
+                });
+            break;
+
+        case View::Details: drawDetails(c); break;
+
+        case View::Servers:
+            widgets::list(
+                c, servers_, area,
+                [](int i) -> std::string {
+                    switch (i) {
+                        case kDns1: return "DNS 1";
+                        case kDns2: return "DNS 2";
+                        case kDnsAlways: return "Always use my DNS";
+                        case kNtp1: return "NTP 1";
+                        default: return "NTP 2";
+                    }
+                },
+                [this](int i) -> std::string {
+                    switch (i) {
+                        case kDns1: return settings_.getString(Setting::Dns1);
+                        case kDns2: return settings_.getString(Setting::Dns2).empty() ? "none" : settings_.getString(Setting::Dns2);
+                        case kDnsAlways: return settings_.getBool(Setting::DnsAlways) ? "On" : "Off";
+                        case kNtp1: return settings_.getString(Setting::Ntp1);
+                        default: return settings_.getString(Setting::Ntp2).empty() ? "none" : settings_.getString(Setting::Ntp2);
+                    }
+                });
+            break;
+
+        case View::Network: {
+            c.setFont(&fonts::small);
+            c.setTextColor(theme::kMuted);
+            c.drawString(netSsid_.c_str(), 4, area.y + 2);
+            widgets::list(
+                c, network_, {area.x, area.y + 12, area.w, area.h - 12},
+                [this](int i) -> std::string {
+                    switch (networkRow(i)) {
+                        case kIpMode: return "IP address";
+                        case kAddress: return "  Address";
+                        case kPrefix: return "  Prefix";
+                        case kGateway: return "  Gateway";
+                        default: return "Forget this network";
+                    }
+                },
+                [this](int i) -> std::string {
+                    switch (networkRow(i)) {
+                        case kIpMode: return draftFixed_ ? "Fixed" : "Automatic";
+                        case kAddress: return draftAddress_.empty() ? "not set" : draftAddress_;
+                        case kPrefix: {
+                            int p = atoi(draftPrefix_.c_str());
+                            return draftPrefix_ + " (" + net::formatIpv4(net::maskOf(p)) + ")";
+                        }
+                        case kGateway: return draftGateway_.empty() ? "none" : draftGateway_;
                         default: return "";
                     }
                 });
-            if (forgetDialog_ && main_.selected() >= kFixedRows)
-                widgets::dialog(c, "Forget network?", saved_.at(main_.selected() - kFixedRows).ssid, *forgetDialog_);
+            if (forgetDialog_) widgets::dialog(c, "Forget network?", netSsid_, *forgetDialog_);
             break;
+        }
+
+        case View::Edit: {
+            c.setFont(&fonts::body);
+            c.setTextColor(theme::kMuted);
+            c.drawString(editTitle_.c_str(), 4, area.y + 4);
+            widgets::lineEditor(c, editor_, {4, area.y + 22, area.w - 8, 0});
+            c.drawString("Enter: save   `: cancel", 4, area.y + 44);
+            break;
+        }
 
         case View::Scan: {
             if (!wifi_.listScanDone()) {
@@ -195,4 +450,25 @@ void WifiSettingsPage::draw(Canvas& c) {
     }
 }
 
+// What the device is using and where each part came from (Q113).
+void WifiSettingsPage::drawDetails(Canvas& c) {
+    const auto& area = theme::kContent;
+    WifiService::Connection n = wifi_.connection();
+    std::vector<std::string> lines;
+    if (!n.connected) {
+        lines = {statusText(), "", "`: back"};
+    } else {
+        lines.push_back(wifi_.ssid() + ", " + std::to_string(wifi_.rssi()) + " dBm");
+        lines.push_back("Address " + n.address + "/" + std::to_string(n.prefix) + (n.fixed ? " (fixed)" : " (DHCP)"));
+        lines.push_back("Mask " + n.mask);
+        lines.push_back("Gateway " + (n.gateway.empty() ? std::string("none") : n.gateway));
+        std::string from = n.dnsFromSettings ? " (Settings)" : " (DHCP)";
+        lines.push_back("DNS " + (n.dns[0].empty() ? std::string("none") : n.dns[0] + from));
+        if (!n.dns[1].empty()) lines.push_back("DNS " + n.dns[1] + from);
+        for (int i = 0; i < n.ntpCount; i++)
+            lines.push_back("NTP " + n.ntp[i].server + (n.ntp[i].fromDhcp ? " (DHCP)" : "") + (n.ntp[i].answered ? ", answered" : ""));
+    }
+    widgets::textLines(c, lines, 0, {area.x + 2, area.y + 2, area.w - 2, area.h - 2});
+}
+
 }  // namespace roro

src/apps/wifi_settings_page.h

@@ -16,8 +16,9 @@
 
 namespace roro {
 
-// Settings → Wi-Fi: the On/Off switch, current connection, Saved Networks, and adding networks
-// from a scan or by name (hidden). Owned by the Settings App.
+// Settings → Wi-Fi: the On/Off switch, the connection and its details, DNS and NTP servers, and
+// the Saved Networks: adding one from a scan or by name (hidden), and each one's own page with its
+// IP setting, Automatic or Fixed (docs/milestones/S1.md, Q113). Owned by the Settings App.
 class WifiSettingsPage {
    public:
     WifiSettingsPage(Settings& settings, SavedNetworks& saved, WifiService& wifi, EventBus& bus)
@@ -25,17 +26,31 @@ class WifiSettingsPage {
 
     void enter();
     bool onKey(const KeyEvent& e);  // false: leave the page
-    bool textEntryActive() const { return view_ == View::Ssid || view_ == View::Password; }
-    bool live() const { return view_ == View::Main || view_ == View::Scan; }  // redraw periodically
+    bool textEntryActive() const { return view_ == View::Ssid || view_ == View::Password || view_ == View::Edit; }
+    // Redraw periodically: the status, a scan, the connection details.
+    bool live() const { return view_ == View::Main || view_ == View::Scan || view_ == View::Details; }
     void draw(Canvas& c);
 
    private:
-    enum class View { Main, Scan, Ssid, Password };
-    enum Fixed { kToggle, kStatus, kAddScanned, kAddHidden, kFixedRows };
+    enum class View { Main, Scan, Ssid, Password, Details, Servers, Network, Edit };
+    enum Fixed { kToggle, kStatus, kServers, kAddScanned, kAddHidden, kFixedRows };
+    enum ServerRow { kDns1, kDns2, kDnsAlways, kNtp1, kNtp2, kServerRows };
+    // A Saved Network's page: with Automatic, only kIpMode and kForget are shown.
+    enum NetworkRow { kIpMode, kAddress, kPrefix, kGateway, kForget };
+    enum class Field { Address, Prefix, Gateway, Dns1, Dns2, Ntp1, Ntp2 };
 
     void refreshMain();
     void warn(const std::string& text, NotificationLevel level = NotificationLevel::Warning);
     std::string statusText() const;
+    bool mainKey(const KeyEvent& e);
+    bool serversKey(const KeyEvent& e);
+    bool networkKey(const KeyEvent& e);
+    bool editKey(const KeyEvent& e);
+    void openNetwork(const SavedNetwork& n);
+    bool leaveNetwork();  // checks and applies the draft; false (with a Toast) when it's refused
+    NetworkRow networkRow(int i) const;
+    void edit(Field field, const std::string& title, const std::string& value, View from);
+    void drawDetails(Canvas& c);
 
     Settings& settings_;
     SavedNetworks& saved_;
@@ -44,10 +59,21 @@ class WifiSettingsPage {
     View view_ = View::Main;
     ListModel main_{theme::kContent.h / theme::kLineHeight};
     ListModel scan_{theme::kContent.h / theme::kLineHeight};
+    ListModel servers_{theme::kContent.h / theme::kLineHeight};
+    ListModel network_{theme::kContent.h / theme::kLineHeight - 1};
     LineEditor editor_{63};
     std::string newSsid_;
     bool newHidden_ = false;
     std::unique_ptr<DialogModel> forgetDialog_;
+    // The Saved Network whose page is open, and its IP setting as being typed (a draft: applied on
+    // leaving the page, so a half-typed address is never used).
+    std::string netSsid_;
+    bool draftFixed_ = false;
+    std::string draftAddress_, draftPrefix_, draftGateway_;
+    // The field being edited, and where Enter and Back return to.
+    Field field_ = Field::Address;
+    std::string editTitle_;
+    View editFrom_ = View::Main;
 };
 
 }  // namespace roro

src/main.cpp

@@ -13,11 +13,16 @@
 #include "apps/irc_app.h"
 #include "apps/launcher_app.h"
 #include "apps/lora_scanner_app.h"
+#include "apps/notes_app.h"
 #include "apps/settings_app.h"
+#include "apps/storage_app.h"
+#include "apps/system_app.h"
 #include "apps/wifi_tools_app.h"
 #include "apps/setup_app.h"
 #include "event_bus.h"
 #include "file_receiver.h"
+#include "ipv4.h"
+#include "traffic.h"
 #include "key_mapper.h"
 #include "platform/console.h"
 #include "platform/crash_report.h"
@@ -27,14 +32,17 @@
 #include "sd_fault.h"
 #include "service_manager.h"
 #include "platform/identity.h"
+#include "file_names.h"
 #include "services/battery_service.h"
 #include "services/irc_service.h"
 #include "services/clock_service.h"
 #include "services/debug_console.h"
+#include "services/file_ops.h"
 #include "services/gemini_service.h"
 #include "services/gnss_service.h"
 #include "services/power_service.h"
 #include "services/lora_capture_service.h"
+#include "services/noise_test.h"
 #include "services/radio_service.h"
 #include "services/storage_service.h"
 #include "services/update_service.h"
@@ -58,11 +66,16 @@ static Screen screen;
 // Constructed in setup(), after the hardware and Settings are ready.
 static BatteryService* battery;
 static StorageService* storageService;
+static FileOps* fileOps;
+static std::vector<std::string> filesInUse(const std::string& path, bool folder);
 static PowerService* power;
 static ClockService* clockService;
 static GnssService* gnssService;
 static RadioService* radioService;
 static LoraCaptureService* loraCapture;
+#ifdef RORO_DEBUG
+static NoiseTest* noiseTest;
+#endif
 static GeminiService* geminiService;
 static SavedNetworks* savedNetworks;
 static WifiService* wifi;
@@ -168,6 +181,7 @@ void setup() {
     savedNetworks->load();
     wifi = new WifiService(settings, *savedNetworks, *clockService);
     update = new UpdateService(nvs, *wifi, *savedNetworks, *storageService, bus, settings);
+    fileOps = new FileOps(*storageService, filesInUse);
     irc = new IrcService(nvs, "roro_" + identity::defaultShortName(), *wifi, *storageService, *clockService, bus);
     notifier = new Notifier(bus, settings);
     notifier->onShow = [](uint32_t now, uint32_t until) { power->onNotification(now, until); };
@@ -177,6 +191,9 @@ void setup() {
     services.add(*gnssService);
     services.add(*radioService);
     loraCapture = new LoraCaptureService(*radioService, *storageService, *clockService, bus);
+#ifdef RORO_DEBUG
+    noiseTest = new NoiseTest(*radioService);
+#endif
     services.add(*loraCapture);
     services.add(*storageService);
     services.add(*wifi);
@@ -194,6 +211,12 @@ void setup() {
     apps->registerApp({"gnss", "GNSS", false, new GnssApp(*gnssService, settings)});
     apps->registerApp({"gemini", "Gemini", false, new GeminiApp(*geminiService)});
     apps->registerApp({"lora", "LoRa Scanner", false, new LoraScannerApp(*radioService, *loraCapture, settings, *clockService)});
+    apps->registerApp({"storage", "Storage", false, new StorageApp(*fileOps, *storageService, *clockService, *update, *power, bus)});
+    apps->registerApp({"notes", "Notes", false, new NotesApp(*fileOps, *storageService, *clockService, *power)});
+    // Leaving the foreground App makes it save: a note being typed, when the device is powered off.
+    power->beforePowerOff = []() { apps->home(); };
+    apps->registerApp({"system", "System", false,
+                       new SystemApp(*wifi, *battery, *storageService, *radioService, *gnssService, nvs)});
     apps->registerApp({"settings", "Settings", false,
                        new SettingsApp({settings, bus, *apps, *battery, *storageService, *clockService, *wifi, *savedNetworks, *update})});
     apps->registerApp({"demo", "Widget demo", true, new DemoApp(bus)});
@@ -359,28 +382,139 @@ static void uploadStep() {
     }
 }
 
+#ifdef RORO_DEBUG
+// `wifi ip ... try <seconds>`: a trial IP setting that reverts unless `wifi ip keep` arrives, so a
+// wrong address tried over Wi-Fi doesn't cut the device off for good.
+static struct {
+    bool active = false;
+    uint32_t untilMs = 0;
+    std::string ssid;
+    bool wasFixed = false;
+    net::FixedIp was;
+} ipTrial;
+
+static void ipTrialStep() {
+    if (!ipTrial.active || static_cast<int32_t>(millis() - ipTrial.untilMs) < 0) return;
+    ipTrial.active = false;
+    savedNetworks->setIp(ipTrial.ssid, ipTrial.wasFixed ? &ipTrial.was : nullptr);
+    console.printf("wifi ip: trial over, %s is back to %s\n", ipTrial.ssid.c_str(),
+                   ipTrial.wasFixed ? net::formatFixed(ipTrial.was).c_str() : "Automatic (DHCP)");
+    wifi->ipSettingChanged(ipTrial.ssid);
+}
+#endif
+
+// `tasks`: the first sample, and when to take the second and print.
+static std::vector<TaskSample> tasksBefore;
+static uint32_t tasksTotal = 0, tasksDueMs = 0;
+static bool tasksPending = false;
+
+// What the firmware is writing right now: the Storage App and the console leave those alone (Q130).
+static std::vector<std::string> filesInUse(const std::string& path, bool folder) {
+    std::vector<std::string> open;
+    if (gnssService->tracking()) open.push_back(gnssService->trackPath());
+    if (loraCapture->capturing()) open.push_back(loraCapture->path());
+    if (upload.active()) open.push_back(upload.partPath());
+    if (irc->running() && path != "/irc" && files::isInside(path, "/irc")) {
+        // Today's Logs, and any folder that may hold one: the IRC Service appends whenever a line comes.
+        std::string date = clockService->localDate();
+        std::string today = (date.empty() ? "undated" : date) + ".log";
+        if (folder) open.push_back(files::joinPath(path, today));
+        else if (files::baseName(path) == today) open.push_back(path);
+    }
+    return open;
+}
+
+// `cp`, `mv`, `rm`, `mkdir`, `du` run as the Storage App's operations do; the result prints here.
+static bool consoleFileOp = false;
+
+static void fileOpsStep() {
+    FileOps::Status s;
+    if (!consoleFileOp || !fileOps->finished(s)) return;
+    consoleFileOp = false;
+    static const char* const kNames[] = {"", "ls", "du", "cp", "mv", "rm", "mkdir"};
+    const char* name = kNames[static_cast<int>(s.op)];
+    if (!s.error.empty()) console.printf("%s: error %s\n", name, s.error.c_str());
+    else if (s.cancelled) console.printf("%s: cancelled\n", name);
+    else if (s.op == FileOps::Op::Count) console.printf("du: %s, %u files, %u bytes\n", s.path.c_str(), (unsigned)s.files, (unsigned)s.bytes);
+    else if (s.op == FileOps::Op::Copy) console.printf("cp: ok %u files, %u bytes in %.1f s\n", (unsigned)s.files, (unsigned)s.doneBytes, s.ms / 1000.0);
+    else if (s.op == FileOps::Op::Delete) console.printf("rm: ok %u files in %.1f s\n", (unsigned)s.files, s.ms / 1000.0);
+    else console.printf("%s: ok\n", name);
+}
+
+static void fileCommand(const String& line) {
+    int space = line.indexOf(' ');
+    std::string command = line.substring(0, space).c_str(), rest = line.substring(space + 1).c_str();
+    bool force = rest.rfind("-f ", 0) == 0;  // replace what's there
+    if (force) rest = rest.substr(3);
+    size_t split = rest.find('\t');  // two paths: a tab between them if either has a space
+    if (split == std::string::npos) split = rest.find(' ');
+    std::string a = rest.substr(0, split), b = split == std::string::npos ? "" : rest.substr(split + 1);
+    std::string why;
+    bool exists = false, folder = false;
+    if (command == "cancel") return fileOps->cancel();
+    if (!storageService->state().present) why = "no SD card";
+    else if (command == "du") why = fileOps->count(rest);
+    else if (command == "mkdir") why = fileOps->makeFolder(rest);
+    else if (command == "rm") {
+        folder = fileOps->isFolder(rest, exists);
+        why = exists ? fileOps->remove(rest, folder) : "It isn't there";
+    } else if (b.empty()) why = "two paths, please";
+    else {
+        folder = fileOps->isFolder(a, exists);
+        bool intoExists = false;
+        bool into = fileOps->isFolder(b, intoExists);  // `cp a /folder` keeps the name
+        if (!exists) why = "It isn't there";
+        else if (command == "cp") why = into ? fileOps->copy(a, folder, b, files::baseName(a), force) : fileOps->copy(a, folder, files::parentOf(b), files::baseName(b), force);
+        else why = fileOps->move(a, folder, into ? files::joinPath(b, files::baseName(a)) : b, force);
+    }
+    if (!why.empty()) return (void)console.printf("%s: error %s\n", command.c_str(), why.c_str());
+    consoleFileOp = true;
+}
+
+static uint32_t loopPasses = 0;  // counted in loop(), for `tasks` (issue #40)
+#ifdef RORO_DEBUG
+static bool loopSpin = false;  // `loop spin on`: no rest between passes, to compare load and radio noise
+#endif
+static uint32_t tasksPasses = 0;
+
+static void tasksStep() {
+    if (!tasksPending || static_cast<int32_t>(millis() - tasksDueMs) < 0) return;
+    tasksPending = false;
+    system_info::printTasks(console, tasksBefore, tasksTotal);
+    console.printf("loop: %lu passes in the last second, chip %.1f C\n", (unsigned long)(loopPasses - tasksPasses), temperatureRead());
+    std::vector<TaskSample>().swap(tasksBefore);
+}
+
 static const char* const kHelp =
     "info              firmware, uptime, memory, Wi-Fi, app slots\n"
-    "tasks             FreeRTOS tasks: state, priority, free stack, CPU\n"
+    "tasks             FreeRTOS tasks over the next second: state, priority, free stack, CPU share\n"    "net               bytes each network service has read and written since boot\n"
     "reboot            restart\n"
     "boot other        restart into the other app slot (manual Rollback)\n"
     "log level <0-5>   ESP-IDF log level (0 none ... 5 verbose)\n"
+    "ls [folder] | du <path> | mkdir <path> | rm <path> | cp [-f] <from> <to> | mv [-f] <from> <to> | cancel   the SD card, with the Storage App's rules\n"
     "lora probe | lora status | lora rx on|off | lora preset <name>   the LoRa radio, receive only\n"
     "lora capture start|stop   a LoRa Capture to /captures/lora (pcap, LoRaTap)\n"
     "lora sweep on [from MHz] [to MHz] [step kHz] | off | dump   RSSI across a band (863 870 100)\n"
     "lora custom <MHz> <BW kHz> <SF> <CR 5-8> <sync hex> [preamble]   e.g. 868.1 125 7 5 34 8 (LoRaWAN)\n"
+    "gnss quiet on|off   pause the GNSS receiver while the LoRa radio listens (it costs the radio 8 dB)\n"
     "gnss status | gnss restart | gnss track start|stop | gnss nmea on|off | gnss send <sentence without $ and checksum>\n"
     "crash             the last crash: firmware, reason, task, backtrace\n"
     "coredump erase    forget the core dump in flash\n"
     "key <name|char>   press a key: up down left right select back home del tab space, or one character\n"
     "wifi status | wifi add <ssid><TAB><password>\n"
+    "wifi ip <ssid> dhcp | wifi ip <ssid> <address>/<prefix> [gateway]   a Saved Network's IP setting\n"
+    "wifi dns <a> [b] | wifi dns always on|off | wifi ntp <a> [b]   DNS and NTP servers\n"
     "gemini get <url>  fetch a Gemini page and report header, size, certificate, heap\n"
     "irc start | irc stop | irc dump | irc say <buffer> <text>\n"
-    "ls [folder] | rm <path> | install <path.ota> (Update from SD)\n"
+    "install <path.ota>   Update from SD\n"
     "sd card | sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
 #ifdef RORO_DEBUG
     "crash abort|wdt   crash on purpose (to test crash reports and Safe Mode)\n"
+    "wifi ip ... try <seconds> | wifi ip keep   a trial IP setting: back to the previous one unless kept\n"
+    "loop spin on|off  make the main loop spin without resting, to compare load and radio noise\n"
+    "lora noise test [gnss|quiet] | lora noise report   Sweep under one changed condition at a time (Wi-Fi goes off for a moment)\n"
     "lora inject <hex> [rssi] [snr]   a packet into the LoRa Scanner as if received (nothing is sent)\n"
+    "sd fill <folder> <count>   makes that many small files there, to test a crowded folder\n"
     "coredump get      (Debug Console only) send the raw core dump: use scripts/rdbg.py coredump\n"
     "reset             (Debug Console only) restart at once, even if the main loop is stuck\n"
     "get <path> | put <path> <size> <sha256> | screenshot   (Debug Console only) binary, see rdbg.py\n"
@@ -390,7 +524,7 @@ static const char* const kHelp =
 
 // Commands that only touch what Safe Mode starts.
 static bool safeModeCommand(const String& line) {
-    return line == "help" || line == "info" || line == "tasks" || line == "reboot" || line == "boot other" ||
+    return line == "help" || line == "info" || line == "tasks" || line == "net" || line == "reboot" || line == "boot other" ||
            line.startsWith("log level ") || line.startsWith("crash") || line.startsWith("coredump") ||
            line == "wifi status" || line.startsWith("wifi add ");
 }
@@ -407,7 +541,25 @@ static void runCommand(String line) {
         console.printf("update: %s\n", update->onProbation() ? "on probation" : "confirmed");
         system_info::printSlots(console, nvs);
     }
-    if (line == "tasks") system_info::printTasks(console);
+#ifdef RORO_DEBUG
+    if (line == "loop spin on" || line == "loop spin off") {
+        loopSpin = line.endsWith("on");
+        console.printf("loop: %s\n", loopSpin ? "spinning, no rest" : "resting between passes");
+    }
+#endif
+    if (line == "tasks") {  // sampled now, printed a second later by tasksStep(): the loop must run in between
+        tasksTotal = system_info::sampleTasks(tasksBefore);
+        tasksDueMs = millis() + 1000;
+        tasksPasses = loopPasses;
+        tasksPending = true;
+    }
+    if (line == "net") {  // bytes each service has read and written since boot (S1, Q121)
+        for (int i = 0; i < static_cast<int>(net::User::Count); i++) {
+            net::Traffic t = net::traffic(static_cast<net::User>(i));
+            console.printf("net: %-14s in %10lu  out %10lu\n", net::userName(static_cast<net::User>(i)), (unsigned long)t.in,
+                           (unsigned long)t.out);
+        }
+    }
     if (line == "reboot") {
         console.println("restarting");
         delay(300);
@@ -419,23 +571,111 @@ static void runCommand(String line) {
         esp_log_level_set("*", static_cast<esp_log_level_t>(constrain(level, 0, 5)));
         console.printf("log level: %d\n", constrain(level, 0, 5));
     }
-    if (line == "ls" || line.startsWith("ls ") || line.startsWith("rm ")) {
+    if (line.startsWith("cp ") || line.startsWith("mv ") || line.startsWith("rm ") || line.startsWith("mkdir ") ||
+        line.startsWith("du ") || line == "cancel")
+        fileCommand(line);
+    if (line == "ls" || line.startsWith("ls ")) {
         if (!storageService->state().present) return (void)console.println("sd: no card");
-        bool list = !line.startsWith("rm ");
         std::string path = line.length() > 3 ? line.substring(3).c_str() : "/";
-        storageService->runJob([list, path]() {  // card access stays on the storage task
-            if (!list) return (void)console.printf("rm: %s %s\n", path.c_str(), SD.remove(path.c_str()) ? "removed" : "failed");
+        storageService->runJob([path]() {  // card access stays on the storage task
             File dir = SD.open(path.c_str());
             if (!dir || !dir.isDirectory()) return (void)console.printf("ls: %s is not a folder\n", path.c_str());
             for (File f = dir.openNextFile(); f; f = dir.openNextFile())
-                console.printf("%10u  %s%s\n", f.isDirectory() ? 0u : (unsigned)f.size(), f.name(), f.isDirectory() ? "/" : "");
+                console.printf("%10u  %-16s  %s%s\n", f.isDirectory() ? 0u : (unsigned)f.size(),
+                               files::formatStamp(static_cast<uint32_t>(f.getLastWrite())).c_str(), f.name(), f.isDirectory() ? "/" : "");
             console.printf("ls: end of %s\n", path.c_str());
         });
     }
     if (line.startsWith("install ")) update->installFromSd(line.substring(8).c_str());  // Update from SD
+#ifdef RORO_DEBUG
+    if (line.startsWith("sd fill ")) {  // sd fill <folder> <count>: small files, to test a crowded folder
+        int space = line.lastIndexOf(' ');
+        std::string folder = line.substring(8, space).c_str();
+        int count = constrain(line.substring(space + 1).toInt(), 0, 1000);
+        storageService->runJob([folder, count]() {
+            int made = 0;
+            for (int i = 1; i <= count; i++) {
+                char name[24];
+                snprintf(name, sizeof name, "file-%04d.txt", i);
+                File f = SD.open(files::joinPath(folder, name).c_str(), FILE_WRITE);
+                if (!f) break;
+                f.printf("file %d\n", i);
+                f.close();
+                made++;
+            }
+            console.printf("sd fill: %d files in %s\n", made, folder.c_str());
+        });
+    }
+#endif
     if (line == "lora probe" && radioService) radioService->probe(console);
     if (line == "lora status" && radioService) radioService->printStatus(console);
     if ((line == "lora rx on" || line == "lora rx off") && radioService) radioService->setEcho(line.endsWith("on"));
+#ifdef RORO_DEBUG
+    if (line == "lora noise report" && noiseTest) noiseTest->printReport(console);
+    if (line == "lora noise test" && noiseTest && !noiseTest->running()) {
+        // One thing changed at a time, each put back before the next (issue #20). Wi-Fi off cuts the
+        // Debug Console: the report prints when it's over, and `lora noise report` shows it again.
+        using C = NoiseTest::Condition;
+        auto radioOptions = [](bool ldo, bool boosted) { return [=]() { radioService->debugOptions(ldo, boosted); }; };
+        std::vector<C> conditions = {
+            {"as it is", nullptr, nullptr},
+            {"loop spinning", []() { loopSpin = true; }, []() { loopSpin = false; }},
+            {"GNSS in standby", []() { gnssService->send("PCAS12,30"); }, []() { gnssService->restart(millis()); }, 2500},
+            {"CPU at 160 MHz", []() { setCpuFrequencyMhz(160); }, []() { setCpuFrequencyMhz(240); }},
+            {"CPU at 80 MHz", []() { setCpuFrequencyMhz(80); }, []() { setCpuFrequencyMhz(240); }},
+            {"radio regulator: LDO", radioOptions(true, true), radioOptions(false, true)},
+            {"radio gain not boosted", radioOptions(false, false), radioOptions(false, true)},
+            {"as it is, again", nullptr, nullptr},
+            {"Wi-Fi off", []() { wifi->debugPause(true); }, []() { wifi->debugPause(false); }, 4000},
+            {"screen on", []() { power->onKey(millis()); }, nullptr, 1000},
+            {"as it is, at the end", nullptr, nullptr, 8000},
+        };
+        noiseTest->start(std::move(conditions));
+    }
+    if (line == "lora noise test quiet" && noiseTest && !noiseTest->running()) {
+        // The same conditions as the first test, with the GNSS receiver in standby throughout: with
+        // the loudest source out of the way, what else shows?
+        using C = NoiseTest::Condition;
+        auto radioOptions = [](bool ldo, bool boosted) { return [=]() { radioService->debugOptions(ldo, boosted); }; };
+        std::vector<C> conditions = {
+            {"GNSS on (reference)", nullptr, nullptr},
+            {"GNSS in standby", []() { gnssService->send("PCAS12,300"); }, nullptr, 2500},
+            {"+ loop spinning", []() { loopSpin = true; }, []() { loopSpin = false; }},
+            {"+ CPU at 160 MHz", []() { setCpuFrequencyMhz(160); }, []() { setCpuFrequencyMhz(240); }},
+            {"+ CPU at 80 MHz", []() { setCpuFrequencyMhz(80); }, []() { setCpuFrequencyMhz(240); }},
+            {"+ radio regulator: LDO", radioOptions(true, true), radioOptions(false, true)},
+            {"+ radio gain not boosted", radioOptions(false, false), radioOptions(false, true)},
+            {"GNSS in standby, again", nullptr, nullptr},
+            {"+ Wi-Fi off", []() { wifi->debugPause(true); }, []() { wifi->debugPause(false); }, 4000},
+            {"+ screen on", []() { power->onKey(millis()); }, nullptr, 1000},
+            {"+ antenna switched off", []() { radioService->debugAntenna(false); }, []() { radioService->debugAntenna(true); }},
+            {"+ antenna off, gain not boosted", []() { radioService->debugAntenna(false); radioService->debugOptions(false, false); },
+             []() { radioService->debugAntenna(true); radioService->debugOptions(false, true); }},
+            {"GNSS in standby, at the end", nullptr, []() { gnssService->restart(millis()); }, 8000},
+        };
+        noiseTest->start(std::move(conditions));
+    }
+    if (line == "lora noise test gnss" && noiseTest && !noiseTest->running()) {
+        // The first test pointed at the GNSS receiver. Is it the receiver working, or its serial
+        // line (about 20 sentences a second, next to the antenna)? Standby stops both; one sentence
+        // a second quietens the line and leaves the receiver tracking. PCAS03 picks the sentences:
+        // GGA, GLL, GSA, GSV, RMC, VTG, ZDA, ANT; all eight are on by default.
+        using C = NoiseTest::Condition;
+        auto standby = []() { gnssService->send("PCAS12,30"); };
+        auto wake = []() { gnssService->restart(millis()); };
+        std::vector<C> conditions = {
+            {"as it is", nullptr, nullptr},
+            {"GNSS in standby", standby, wake, 2500},
+            {"GNSS on again", nullptr, nullptr, 5000},
+            {"GNSS: RMC only", []() { gnssService->send("PCAS03,0,0,0,0,1,0,0,0,0,0,,,0,0"); },
+             []() { gnssService->send("PCAS03,1,1,1,1,1,1,1,1,0,0,,,0,0"); }, 2500},
+            {"GNSS: all sentences again", nullptr, nullptr, 3000},
+            {"GNSS in standby, again", standby, wake, 2500},
+            {"GNSS on again", nullptr, nullptr, 5000},
+        };
+        noiseTest->start(std::move(conditions));
+    }
+#endif
     if (line.startsWith("lora sweep") && radioService) {  // on [from MHz] [to MHz] [step kHz] | off | dump
         if (line == "lora sweep dump") radioService->printSweep(console);
         else if (line == "lora sweep off") {
@@ -483,6 +723,10 @@ static void runCommand(String line) {
         if (p) radioService->setPreset(*p);
         console.printf("lora preset: %s\n", p ? p->name : "unknown (LongFast LongSlow MediumSlow MediumFast ShortSlow ShortFast LongMod)");
     }
+    if (line == "gnss quiet on" || line == "gnss quiet off") {  // Settings > Pause GNSS for LoRa (issue #20)
+        settings.setBool(Setting::GnssQuietForLora, line.endsWith("on"));
+        console.printf("gnss quiet: %s\n", line.endsWith("on") ? "GNSS pauses while the LoRa radio listens" : "GNSS stays on");
+    }
     if (line == "gnss status" && gnssService) gnssService->printStatus(console, millis());
     if ((line == "gnss nmea on" || line == "gnss nmea off") && gnssService) gnssService->setEcho(line.endsWith("on"));
     if (line == "gnss restart" && gnssService) gnssService->restart(millis());
@@ -588,11 +832,77 @@ static void runCommand(String line) {
             }
         });
     }
-    if (line == "wifi status")
+    if (line == "wifi status") {
         console.printf("wifi: state %d ssid '%s' rssi %d ip %s clock %s heap %u min %u | fw %s%s\n",
                        (int)wifi->state(), wifi->ssid().c_str(), wifi->rssi(), wifi->ip().c_str(),
                        clockService->displayTime().c_str(), ESP.getFreeHeap(), ESP.getMinFreeHeap(), versionString(),
                        update->onProbation() ? " (on probation)" : "");
+        WifiService::Connection c = wifi->connection();  // S1, Q115: what's in use and where it came from
+        if (c.connected) {
+            console.printf("wifi: address %s/%d (%s), gateway %s\n", c.address.c_str(), c.prefix, c.fixed ? "fixed" : "DHCP",
+                           c.gateway.empty() ? "none" : c.gateway.c_str());
+            console.printf("wifi: dns %s %s (%s)\n", c.dns[0].empty() ? "none" : c.dns[0].c_str(), c.dns[1].c_str(),
+                           c.dnsFromSettings ? "Settings" : "DHCP");
+            console.print("wifi: ntp");
+            for (int i = 0; i < c.ntpCount; i++) console.printf(" %s (%s%s)", c.ntp[i].server.c_str(), c.ntp[i].fromDhcp ? "DHCP" : "Settings", c.ntp[i].answered ? ", answered" : "");
+            console.println(c.ntpCount ? "" : " none");
+        }
+    }
+    if (line.startsWith("wifi ip ")) {  // wifi ip <ssid> dhcp | <address>/<prefix> [gateway]  (the SSID may hold spaces)
+        std::string rest = line.substring(8).c_str();
+#ifdef RORO_DEBUG
+        if (rest == "keep") {  // the trial setting stays
+            console.println(ipTrial.active ? "wifi ip: kept" : "wifi ip: no trial running");
+            ipTrial.active = false;
+            return;
+        }
+        uint32_t trialS = 0;
+        size_t tryAt = rest.rfind(" try ");
+        if (tryAt != std::string::npos) {
+            trialS = strtoul(rest.c_str() + tryAt + 5, nullptr, 10);
+            rest = rest.substr(0, tryAt);
+        }
+#endif
+        std::string ssid, why;
+        net::FixedIp fixed;
+        bool dhcp = rest.size() > 5 && rest.compare(rest.size() - 5, 5, " dhcp") == 0;
+        if (dhcp) ssid = rest.substr(0, rest.size() - 5);
+        else {
+            size_t slash = rest.rfind('/'), space = slash == std::string::npos ? slash : rest.rfind(' ', slash);
+            if (space == std::string::npos) why = "usage: wifi ip <ssid> dhcp | <address>/<prefix> [gateway]";
+            else {
+                ssid = rest.substr(0, space);
+                why = net::parseFixed(rest.substr(space + 1), fixed);
+            }
+        }
+        const SavedNetwork* before = why.empty() ? savedNetworks->find(ssid) : nullptr;
+#ifdef RORO_DEBUG
+        if (before && trialS) ipTrial = {true, millis() + trialS * 1000, ssid, before->fixed, before->ip};
+#endif
+        if (why.empty()) why = savedNetworks->setIp(ssid, dhcp ? nullptr : &fixed);
+        if (!why.empty()) return (void)console.printf("wifi ip: %s\n", why.c_str());
+        console.printf("wifi ip: %s is now %s\n", ssid.c_str(), dhcp ? "Automatic (DHCP)" : net::formatFixed(fixed).c_str());
+        wifi->ipSettingChanged(ssid);
+    }
+    if ((line.startsWith("wifi dns ") && !line.startsWith("wifi dns always")) || line.startsWith("wifi ntp ")) {  // <a> [b]
+        bool dns = line.startsWith("wifi dns ");
+        std::string rest = line.substring(9).c_str();
+        size_t space = rest.find(' ');
+        std::string first = rest.substr(0, space), second = space == std::string::npos ? "" : rest.substr(space + 1);
+        Setting a = dns ? Setting::Dns1 : Setting::Ntp1, b = dns ? Setting::Dns2 : Setting::Ntp2;
+        std::string oldFirst = settings.getString(a);
+        // Both or neither: a refused second entry leaves the first as it was.
+        bool ok = settings.setString(a, first) && (settings.setString(b, second) || (settings.setString(a, oldFirst), false));
+        if (!ok) console.printf("wifi %s: %s\n", dns ? "dns" : "ntp", dns ? "an IPv4 address, then a second one if you like" : "a host name or an IPv4 address, then a second one if you like");
+        else {
+            console.printf("wifi %s: %s %s\n", dns ? "dns" : "ntp", first.c_str(), second.c_str());
+            wifi->serversChanged();
+        }
+    }
+    if (line == "wifi dns always on" || line == "wifi dns always off") {
+        settings.setBool(Setting::DnsAlways, line.endsWith("on"));
+        wifi->serversChanged();
+    }
     if (line == "sound off") settings.setBool(Setting::Sound, false);
     if (line == "sound on") settings.setBool(Setting::Sound, true);
     if (line == "short") {
@@ -640,6 +950,7 @@ static void loopSafeMode() {
     uint32_t now = millis();
     serialCommands();
     remoteCommands();
+    tasksStep();
     services.tick(now);
     bus.dispatch();
     noteStableOnce(now);
@@ -659,8 +970,30 @@ static void loopSafeMode() {
     delay(10);
 }
 
+// How long the main loop rests after a pass (issue #40). Spinning, it made 50,000 passes a
+// second and kept core 1 100 % busy for nothing: keys are buffered by the keyboard controller,
+// the consoles and the radio have their own tasks, and no Service asks for a tick more often than
+// every 50 ms. Shorter with the screen on, so a key or a redraw never waits long.
+constexpr uint32_t kLoopRestScreenOnMs = 5;
+constexpr uint32_t kLoopRestScreenOffMs = 20;
+static void loopPass();
+
 void loop() {
-    if (safeMode) return loopSafeMode();
+    loopPasses++;
+    if (safeMode) {
+        loopSafeMode();
+        delay(kLoopRestScreenOnMs);
+        return;
+    }
+    loopPass();
+#ifdef RORO_DEBUG
+    if (loopSpin) return;
+#endif
+    if (upload.active()) return;  // a serial file transfer: every byte is read promptly
+    delay(power->screen() == ScreenState::Off ? kLoopRestScreenOffMs : kLoopRestScreenOnMs);
+}
+
+static void loopPass() {
 #ifdef RORO_TEST_CRASH
     // Test builds only (never in a release): crash during Probation to exercise Rollback.
     if (millis() > 5000) abort();
@@ -671,7 +1004,13 @@ void loop() {
 
     serialCommands();
     remoteCommands();
+    tasksStep();
+#ifdef RORO_DEBUG
+    ipTrialStep();
+    if (noiseTest) noiseTest->step(now);
+#endif
     noteStableOnce(now);
+    fileOpsStep();
     uploadStep();
     printListingWhenReady();
     M5Cardputer.update();
@@ -683,6 +1022,10 @@ void loop() {
             for (auto& e : events) apps->handleKey(e);
     }
 
+    // Issue #20: the GNSS receiver costs the LoRa radio 8 dB while it runs. If the user chose so,
+    // it waits in standby while the radio listens or sweeps; never while a Track is recording.
+    gnssService->holdForLora(settings.getBool(Setting::GnssQuietForLora) && !gnssService->tracking() &&
+                             (radioService->listening() || radioService->sweeping()));
     services.tick(now);
     bus.dispatch();
     notifier->update(now);

src/platform/counted_client.h

@@ -0,0 +1,40 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+#include "traffic.h"
+
+namespace roro {
+
+// A NetworkClient (or NetworkClientSecure) that adds what it reads and writes to its service's
+// traffic counters (S1, Q121). Only the two buffer calls are overridden: the single-byte ones,
+// print() and printf() all go through them, so every byte is counted once.
+template <class Base>
+class Counted : public Base {
+   public:
+    explicit Counted(net::User user) : user_(user) {}
+    Counted(const Base& accepted, net::User user) : Base(accepted), user_(user) {}
+
+    // Overriding the buffer calls hides the single-byte ones; these put them back. They end up in
+    // the buffer calls below, where the counting happens.
+    int read() override { return Base::read(); }
+    size_t write(uint8_t byte) override { return Base::write(byte); }
+
+    size_t write(const uint8_t* buf, size_t size) override {
+        size_t n = Base::write(buf, size);
+        net::sent(user_, n);
+        return n;
+    }
+
+    int read(uint8_t* buf, size_t size) override {
+        int n = Base::read(buf, size);
+        if (n > 0) net::received(user_, static_cast<size_t>(n));
+        return n;
+    }
+
+   private:
+    net::User user_;
+};
+
+}  // namespace roro

src/platform/system_info.cpp

@@ -7,6 +7,8 @@
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 
+#include <algorithm>
+#include <cstdio>
 #include <string>
 #include <vector>
 
@@ -89,20 +91,40 @@ void printSlots(Print& out, KeyValueStore& store) {
     }
 }
 
-void printTasks(Print& out) {
+uint32_t sampleTasks(std::vector<TaskSample>& out) {
     UBaseType_t n = uxTaskGetNumberOfTasks();
     std::vector<TaskStatus_t> tasks(n + 4);
     uint32_t total = 0;
     n = uxTaskGetSystemState(tasks.data(), tasks.size(), &total);
-    out.printf("%-16s %-4s %3s %6s %5s %s\n", "task", "st", "pri", "stack", "cpu%", "core");
-    static const char kStates[] = "RrBSD";  // running, ready, blocked, suspended, deleted
+    out.clear();
+    out.reserve(n);
     for (UBaseType_t i = 0; i < n; i++) {
         const TaskStatus_t& t = tasks[i];
-        unsigned cpu = total ? (unsigned)((uint64_t)t.ulRunTimeCounter * 100 / total) : 0;
-        int core = t.xCoreID == tskNO_AFFINITY ? -1 : (int)t.xCoreID;
-        out.printf("%-16s %-4c %3u %6u %5u %d\n", t.pcTaskName, t.eCurrentState < 5 ? kStates[t.eCurrentState] : '?',
-                   (unsigned)t.uxCurrentPriority, (unsigned)t.usStackHighWaterMark, cpu, core);
+        TaskSample s;
+        s.id = t.xTaskNumber;
+        std::snprintf(s.name, sizeof s.name, "%s", t.pcTaskName);
+        s.runtime = t.ulRunTimeCounter;
+        s.stackFree = static_cast<uint16_t>(std::min<uint32_t>(t.usStackHighWaterMark, 0xFFFF));
+        s.core = t.xCoreID == tskNO_AFFINITY ? -1 : static_cast<int8_t>(t.xCoreID);
+        s.state = static_cast<uint8_t>(t.eCurrentState);
+        s.priority = static_cast<uint8_t>(t.uxCurrentPriority);
+        out.push_back(s);
     }
+    return total;
+}
+
+// Shares over the interval since `before`, not since boot: the counters wrap every 71 minutes.
+void printTasks(Print& out, const std::vector<TaskSample>& before, uint32_t beforeTotal) {
+    std::vector<TaskSample> now;
+    uint32_t t1 = sampleTasks(now);
+    std::vector<TaskRow> rows = taskRows(before, beforeTotal, now, t1);
+    sortTasks(rows, TaskSort::Share);
+    out.printf("%-16s %-4s %3s %6s %6s %s\n", "task", "st", "pri", "stack", "cpu%", "core");
+    static const char kStates[] = "RrBSD";  // running, ready, blocked, suspended, deleted
+    for (const TaskRow& r : rows)
+        out.printf("%-16s %-4c %3u %6u %4u.%u %d%s\n", r.name.c_str(), r.state < 5 ? kStates[r.state] : '?', r.priority,
+                   r.stackFree, r.permille / 10, r.permille % 10, r.core, r.lowStack ? "  low stack" : "");
+    out.printf("load: core 0 %d %%, core 1 %d %%\n", coreLoad(rows, 0), coreLoad(rows, 1));
 }
 
 const char* bootOtherSlot() {

src/platform/system_info.h

@@ -3,7 +3,10 @@
 #include <Print.h>
 #include <esp_partition.h>
 
+#include <vector>
+
 #include "key_value_store.h"
+#include "task_stats.h"
 
 namespace roro::system_info {
 
@@ -20,7 +23,12 @@ void printSlots(Print& out, KeyValueStore& store);
 // Remembers which version the running slot holds (call at boot), or the slot an update just wrote.
 void recordSlotVersion(KeyValueStore& store, const esp_partition_t* slot, const char* version);
 // FreeRTOS tasks: state, priority, lowest free stack, CPU share since boot.
-void printTasks(Print& out);
+// The tasks' shares since `before` was sampled (with its run-time clock). The caller lets the main
+// loop run in between: sampling twice inside one command would show the loop asleep.
+void printTasks(Print& out, const std::vector<TaskSample>& before, uint32_t beforeTotal);
+// Every task as FreeRTOS reports it now; returns the run-time clock (microseconds, 32 bits), to
+// pair with the samples. Two of these make the shares the System App and `tasks` show.
+uint32_t sampleTasks(std::vector<TaskSample>& out);
 
 // Boots the firmware in the other app slot if it holds a valid image (a manual Rollback).
 // Returns an error message; on success it restarts and doesn't return.

src/services/clock_service.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <Arduino.h>
+#include <sys/time.h>
 
 #include "clock_model.h"
 #include "event_bus.h"
@@ -20,7 +21,16 @@ class ClockService : public Service {
     const char* name() const override { return "clock"; }
     void start() override { applyTimezone(); }
 
-    bool set(int64_t utcSeconds, TimeSource source) { return model_.set(utcSeconds, source, millis()); }
+    bool set(int64_t utcSeconds, TimeSource source) {
+        if (!model_.set(utcSeconds, source, millis())) return false;
+        // The system's own clock too (F1, Q137): the card's files are dated from it, and NTP was
+        // the only thing setting it. NTP has just done so itself.
+        if (source != TimeSource::Ntp) {
+            timeval now = {static_cast<time_t>(utcSeconds), 0};
+            settimeofday(&now, nullptr);
+        }
+        return true;
+    }
     const ClockModel& model() const { return model_; }
 
     // UTC seconds, or -1 if the clock isn't set.

src/services/debug_console.cpp

@@ -17,6 +17,7 @@
 #include "file_receiver.h"
 #include "sha256.h"
 #include "platform/console.h"
+#include "platform/counted_client.h"
 #include "sd_fault.h"
 #include "version.h"
 
@@ -110,7 +111,7 @@ void DebugConsole::listen() {
             listening = false;
         }
         if (listening) {
-            NetworkClient client = server.accept();
+            Counted<NetworkClient> client(server.accept(), net::User::DebugConsole);
             if (client) {
                 client.setNoDelay(true);
                 if (authenticate(client)) serve(client);

src/services/file_ops.cpp

@@ -0,0 +1,492 @@
+#include "services/file_ops.h"
+
+#include <Arduino.h>
+#include <SD.h>
+
+#include <ctime>
+#include <memory>
+
+#include "file_names.h"
+
+namespace roro {
+
+using files::baseName;
+using files::joinPath;
+using files::parentOf;
+
+namespace {
+// The FatFs drive the card is mounted as: SDFS keeps it to itself.
+struct SdDrive : fs::SDFS {
+    static uint8_t of(fs::SDFS& sd) { return sd.*(&SdDrive::_pdrv); }
+};
+
+// A FAT date and time (local, as the firmware wrote them) as Unix time; 0 if there's none.
+uint32_t fatTime(uint16_t date, uint16_t time) {
+    if (date == 0) return 0;
+    struct tm t = {};
+    t.tm_year = (date >> 9) + 80;
+    t.tm_mon = ((date >> 5) & 15) - 1;
+    t.tm_mday = date & 31;
+    t.tm_hour = time >> 11;
+    t.tm_min = (time >> 5) & 63;
+    t.tm_sec = (time & 31) * 2;
+    t.tm_isdst = -1;
+    time_t at = mktime(&t);
+    return at < 0 ? 0 : static_cast<uint32_t>(at);
+}
+
+struct Guard {
+    explicit Guard(SemaphoreHandle_t l) : l_(l) { xSemaphoreTake(l_, portMAX_DELAY); }
+    ~Guard() { xSemaphoreGive(l_); }
+    SemaphoreHandle_t l_;
+};
+}  // namespace
+
+FileOps::FileOps(StorageService& storage, InUse inUse)
+    : storage_(storage), inUse_(std::move(inUse)), lock_(xSemaphoreCreateMutex()) {}
+
+FileOps::Status FileOps::status() const {
+    Guard g(lock_);
+    Status s = status_;
+    s.running = busy_;
+    s.doneBytes = doneBytes_;
+    s.files = files_;
+    return s;
+}
+
+bool FileOps::finished(Status& out) {
+    // The storage task drops its jobs when the card goes: nothing would ever end this one.
+    if (busy_ && !storage_.state().present) {
+        fail("The card went away");
+        busy_ = false;
+        done_ = true;
+    }
+    if (!done_.exchange(false)) return false;
+    out = status();
+    out.running = false;
+    return true;
+}
+
+void FileOps::takeListing(files::FileList& out) {
+    Guard g(lock_);
+    out = std::move(listing_);
+    listing_.clear();
+}
+
+bool FileOps::isFolder(const std::string& path, bool& exists) {
+    bool folder = false;
+    exists = false;
+    storage_.runAndWait([&]() {
+        fs::File f = SD.open(path.c_str());
+        exists = static_cast<bool>(f);
+        folder = f && f.isDirectory();
+    });
+    return folder;
+}
+
+std::string FileOps::whyReadOnly(const std::string& path, bool folder) const {
+    return files::whyReadOnly(path, inUse_(path, folder));
+}
+
+std::string FileOps::start(Op op, const std::string& path) {
+    if (busy_) return "The card is busy with something else";
+    if (!storage_.state().present) return "No SD card";
+    {
+        Guard g(lock_);
+        status_ = Status();
+        status_.op = op;
+        status_.path = path;
+    }
+    closeAll();  // only handles a vanished card left behind
+    listOpen_ = false;
+    op_ = op;
+    phase_ = 0;
+    undo_ = false;
+    cancel_ = false;
+    done_ = false;
+    doneBytes_ = 0;
+    files_ = 0;
+    countBytes_ = 0;
+    startMs_ = millis();
+    busy_ = true;
+    queue();
+    return "";
+}
+
+void FileOps::queue() {
+    storage_.runJob([this]() { slice(); });
+}
+
+std::string FileOps::list(const std::string& folder) {
+    from_ = folder;
+    return start(Op::List, folder);
+}
+
+std::string FileOps::count(const std::string& path) {
+    from_ = path;
+    return start(Op::Count, path);
+}
+
+std::string FileOps::copy(const std::string& from, bool folder, const std::string& intoFolder, const std::string& name, bool replace) {
+    if (busy_) return "The card is busy with something else";
+    std::string why = files::whyNotInto(from, intoFolder);
+    // A copy next to its original is fine: only the name must differ.
+    if (why == "It's already there" && name != baseName(from)) why.clear();
+    if (why.empty()) why = files::checkName(name);
+    if (!why.empty()) return why;
+    from_ = from;
+    to_ = joinPath(intoFolder, name);
+    replace_ = replace;
+    sourceIsFolder_ = folder;
+    return start(Op::Copy, from);
+}
+
+std::string FileOps::move(const std::string& from, bool folder, const std::string& to, bool replace) {
+    if (busy_) return "The card is busy with something else";
+    std::string why = files::whyReadOnly(from, inUse_(from, folder));
+    if (why.empty() && from == to) why = "It's already there";
+    if (why.empty() && parentOf(to) != parentOf(from)) why = files::whyNotInto(from, parentOf(to));
+    if (why.empty()) why = files::checkName(baseName(to));
+    if (!why.empty()) return why;
+    from_ = from;
+    to_ = to;
+    replace_ = replace;
+    sourceIsFolder_ = folder;
+    return start(Op::Move, from);
+}
+
+std::string FileOps::remove(const std::string& path, bool folder) {
+    if (busy_) return "The card is busy with something else";
+    std::string why = files::whyReadOnly(path, inUse_(path, folder));
+    if (!why.empty()) return why;
+    from_ = path;
+    sourceIsFolder_ = folder;
+    return start(Op::Delete, path);
+}
+
+std::string FileOps::makeFolder(const std::string& path) {
+    if (busy_) return "The card is busy with something else";
+    std::string why = files::checkName(baseName(path));
+    if (why.empty() && files::isInside(path, files::kGeminiCache)) why = std::string(files::kGeminiCache) + " is the Gemini App's working space";
+    if (!why.empty()) return why;
+    from_ = path;
+    return start(Op::MakeFolder, path);
+}
+
+void FileOps::fail(const std::string& why) {
+    Guard g(lock_);
+    if (status_.error.empty()) status_.error = why;
+}
+
+void FileOps::closeAll() {
+    if (in_) in_.close();
+    if (out_) out_.close();
+    for (auto& d : dirs_)
+        if (d) d.close();
+    dirs_.clear();
+    paths_.clear();
+}
+
+void FileOps::finish() {
+    if (listOpen_) f_closedir(&listDir_);
+    listOpen_ = false;
+    closeAll();
+    {
+        Guard g(lock_);
+        status_.cancelled = cancel_ && status_.error.empty() && (op_ == Op::Copy || op_ == Op::Delete || op_ == Op::Count);
+        status_.bytes = countBytes_;
+        status_.ms = millis() - startMs_;
+    }
+    op_ = Op::None;
+    busy_ = false;
+    done_ = true;
+}
+
+bool FileOps::enter(const std::string& path) {
+    fs::File d = SD.open(path.c_str());
+    if (!d || !d.isDirectory()) return false;
+    dirs_.push_back(d);
+    paths_.push_back(path);
+    return true;
+}
+
+// One slice on the storage task, then back in the queue behind whatever else is waiting.
+void FileOps::slice() {
+    if (!busy_) return;  // given up on: the card went away (finished())
+    bool over = true;
+    switch (op_) {
+        case Op::List: over = sliceList(); break;
+        case Op::Count: over = sliceCount(); break;
+        case Op::Copy: over = sliceCopy(); break;
+        case Op::Delete: over = sliceDelete(); break;
+        case Op::Move: {
+            if (!SD.exists(from_.c_str())) fail("It isn't there any more");
+            else if (SD.exists(to_.c_str()) && !replace_) {
+                Guard g(lock_);
+                status_.exists = true;
+                status_.error = baseName(to_) + " exists already";
+            } else {
+                if (SD.exists(to_.c_str())) SD.remove(to_.c_str());  // a file: a folder in the way makes the rename fail
+                if (!SD.rename(from_.c_str(), to_.c_str())) fail("The card refused to move it");
+                else files_ = 1;
+            }
+            break;
+        }
+        case Op::MakeFolder:
+            if (SD.exists(from_.c_str())) fail(baseName(from_) + " exists already");
+            else if (!SD.mkdir(from_.c_str())) fail("The card refused to make the folder");
+            break;
+        default: break;
+    }
+    if (over) finish();
+    else queue();
+}
+
+// Straight from FatFs, one pass over the folder: the Arduino File looks every entry up by name
+// again for its size and its date, which made 300 entries take over two seconds.
+bool FileOps::sliceList() {
+    uint32_t t0 = millis();
+    if (phase_ == 0) {
+        Guard g(lock_);
+        listing_.clear();
+        std::string path = std::string(1, static_cast<char>('0' + SdDrive::of(SD))) + ":" + from_;
+        if (f_opendir(&listDir_, path.c_str()) != FR_OK) {
+            status_.error = from_ + " isn't a folder";
+            return true;
+        }
+        listOpen_ = true;
+        phase_ = 1;
+    }
+    while (millis() - t0 < kSliceMs) {
+        if (cancel_) return true;
+        FILINFO info;
+        if (f_readdir(&listDir_, &info) != FR_OK || info.fname[0] == 0) return true;
+        bool folder = info.fattrib & AM_DIR;
+        Guard g(lock_);
+        listing_.add(info.fname, folder ? 0 : static_cast<uint32_t>(info.fsize), fatTime(info.fdate, info.ftime), folder);
+    }
+    return false;
+}
+
+// What's inside, for "Delete saved and its 42 files?" (Q132) and for a copy's total.
+bool FileOps::sliceCount() {
+    uint32_t t0 = millis();
+    if (phase_ == 0) {
+        phase_ = 1;
+        fs::File f = SD.open(from_.c_str());
+        if (!f) {
+            fail("It isn't there any more");
+            return true;
+        }
+        if (!f.isDirectory()) {
+            files_ = 1;
+            countBytes_ = static_cast<uint32_t>(f.size());
+            return true;
+        }
+        f.close();
+        enter(from_);
+    }
+    while (!dirs_.empty() && millis() - t0 < kSliceMs) {
+        if (cancel_) return true;
+        fs::File f = dirs_.back().openNextFile();
+        if (!f) {
+            dirs_.back().close();
+            dirs_.pop_back();
+            paths_.pop_back();
+        } else if (f.isDirectory()) {
+            std::string sub = joinPath(paths_.back(), f.name());
+            f.close();
+            enter(sub);
+        } else {
+            files_++;
+            countBytes_ += static_cast<uint32_t>(f.size());
+        }
+    }
+    return dirs_.empty();
+}
+
+// Deletes files as the walk meets them and each folder once it's empty. Also how a cancelled or
+// failed copy takes back what it had written (undo_).
+bool FileOps::sliceDelete() {
+    uint32_t t0 = millis();
+    if (phase_ == 0) {
+        phase_ = 1;
+        fs::File f = SD.open(from_.c_str());
+        if (!f) {
+            if (!undo_) fail("It isn't there any more");
+            return true;
+        }
+        bool folder = f.isDirectory();
+        f.close();
+        if (!folder) {
+            if (!SD.remove(from_.c_str())) fail("The card refused to delete it");
+            else if (!undo_) files_ = 1;
+            return true;
+        }
+        enter(from_);
+    }
+    while (!dirs_.empty() && millis() - t0 < kSliceMs) {
+        if (cancel_ && !undo_) return true;  // what's deleted stays deleted
+        fs::File f = dirs_.back().openNextFile();
+        if (!f) {
+            std::string done = paths_.back();
+            dirs_.back().close();
+            dirs_.pop_back();
+            paths_.pop_back();
+            if (!SD.rmdir(done.c_str())) {
+                fail("The card refused to delete " + baseName(done));
+                return true;
+            }
+        } else if (f.isDirectory()) {
+            std::string sub = joinPath(paths_.back(), f.name());
+            f.close();
+            if (!enter(sub)) {
+                fail("The card refused to open " + baseName(sub));
+                return true;
+            }
+        } else {
+            std::string path = joinPath(paths_.back(), f.name());
+            f.close();
+            if (!SD.remove(path.c_str())) {
+                fail("The card refused to delete " + baseName(path));
+                return true;
+            }
+            if (!undo_) files_++;
+        }
+    }
+    return dirs_.empty();
+}
+
+// Phases 0 and 1 count the source (the walk of Count), 2 checks and prepares, 3 copies, 4 takes
+// a failed or cancelled copy back.
+bool FileOps::sliceCopy() {
+    uint32_t t0 = millis();
+    if (phase_ <= 1) {
+        if (!sliceCount()) return false;
+        phase_ = 2;
+    }
+    if (phase_ == 2) {
+        {
+            Guard g(lock_);
+            if (!status_.error.empty()) return true;
+            status_.totalBytes = countBytes_;
+        }
+        if (cancel_) return true;
+        files_ = 0;
+        StorageState card = storage_.state();
+        if (card.totalBytes - card.usedBytes < static_cast<uint64_t>(countBytes_) + 64 * 1024) {
+            fail("Not enough room on the card");
+            return true;
+        }
+        if (SD.exists(to_.c_str())) {
+            if (!replace_) {
+                Guard g(lock_);
+                status_.exists = true;
+                status_.error = baseName(to_) + " exists already";
+                return true;
+            }
+            if (sourceIsFolder_) {
+                fail("A folder with that name is in the way");
+                return true;
+            }
+            SD.remove(to_.c_str());
+        }
+        if (sourceIsFolder_) {
+            if (!SD.mkdir(to_.c_str()) || !enter(from_)) {
+                fail("The card refused to make the folder");
+                return true;
+            }
+        } else {
+            in_ = SD.open(from_.c_str(), FILE_READ);
+            outPath_ = to_;
+            out_ = SD.open(outPath_.c_str(), FILE_WRITE);
+            fileBytes_ = 0;
+            fileSize_ = in_ ? static_cast<uint32_t>(in_.size()) : 0;
+            if (!in_ || !out_) {
+                fail("The card refused to open the files");
+                phase_ = 4;
+                return false;
+            }
+        }
+        phase_ = 3;
+    }
+    if (phase_ == 3) {
+        std::unique_ptr<uint8_t[]> piece(new uint8_t[kPiece]);
+        while (millis() - t0 < kSliceMs) {
+            if (cancel_) {
+                phase_ = 4;
+                return false;
+            }
+            if (in_) {  // a file in progress
+                int n = in_.read(piece.get(), kPiece);
+                if (n > 0 && out_.write(piece.get(), n) != static_cast<size_t>(n)) n = -1;
+                if (n < 0) {
+                    fail("The card refused a write");
+                    phase_ = 4;
+                    return false;
+                }
+                if (n > 0) {
+                    doneBytes_ += n;
+                    fileBytes_ += n;
+                    continue;
+                }
+                in_.close();
+                out_.close();
+                // Q133: the sizes are compared. A Log that grew meanwhile is copied as far as it went.
+                fs::File check = SD.open(outPath_.c_str(), FILE_READ);
+                bool same = check && static_cast<uint32_t>(check.size()) == fileBytes_ && fileBytes_ >= fileSize_;
+                if (check) check.close();
+                if (!same) {
+                    fail("The copy of " + baseName(outPath_) + " isn't the size of the original");
+                    phase_ = 4;
+                    return false;
+                }
+                files_++;
+                continue;
+            }
+            if (dirs_.empty()) return true;  // a single file, or the whole folder: done
+            fs::File f = dirs_.back().openNextFile();
+            // The copy sits where the original does, relative to the two roots.
+            auto target = [&](const std::string& source) { return to_ + source.substr(from_.size()); };
+            if (!f) {
+                dirs_.back().close();
+                dirs_.pop_back();
+                paths_.pop_back();
+            } else if (f.isDirectory()) {
+                std::string sub = joinPath(paths_.back(), f.name());
+                f.close();
+                if (!SD.mkdir(target(sub).c_str()) || !enter(sub)) {
+                    fail("The card refused to make " + baseName(sub));
+                    phase_ = 4;
+                    return false;
+                }
+            } else {
+                std::string source = joinPath(paths_.back(), f.name());
+                f.close();
+                in_ = SD.open(source.c_str(), FILE_READ);
+                outPath_ = target(source);
+                out_ = SD.open(outPath_.c_str(), FILE_WRITE);
+                fileBytes_ = 0;
+                fileSize_ = in_ ? static_cast<uint32_t>(in_.size()) : 0;
+                if (!in_ || !out_) {
+                    fail("The card refused to open " + baseName(source));
+                    phase_ = 4;
+                    return false;
+                }
+            }
+        }
+        return false;
+    }
+    // Phase 4: take it back. The copy never replaced a folder, so everything under to_ is ours.
+    if (!undo_) {
+        closeAll();
+        undo_ = true;
+        from_ = to_;
+        phase_ = 0;
+        op_ = Op::Delete;  // finish() reports it as the copy it was: status_.op stays Copy
+        return false;
+    }
+    return true;
+}
+
+}  // namespace roro

src/services/file_ops.h

@@ -0,0 +1,102 @@
+#pragma once
+
+#include <FS.h>
+#include <ff.h>
+#include <freertos/FreeRTOS.h>
+#include <freertos/semphr.h>
+
+#include <atomic>
+#include <functional>
+#include <string>
+#include <vector>
+
+#include "file_list.h"
+#include "services/storage_service.h"
+
+namespace roro {
+
+// What the Storage App does to the card (docs/milestones/F1.md): list a folder, count what's in
+// one, copy, move, delete, make a folder. One operation at a time, on the storage task like every
+// card access, **in slices of about 150 ms**: a long copy re-queues itself between slices, so IRC
+// Logs, a Gemini page streaming to the card or a Capture are written in between and nobody waits
+// long enough to give up. The read-only rules of Q130 are checked here, whoever asks.
+class FileOps {
+   public:
+    enum class Op : uint8_t { None, List, Count, Copy, Move, Delete, MakeFolder };
+    // The files the firmware has open right now that matter for `path` (a folder or not).
+    using InUse = std::function<std::vector<std::string>(const std::string& path, bool folder)>;
+
+    struct Status {
+        Op op = Op::None;
+        bool running = false;
+        bool cancelled = false;
+        bool exists = false;   // a copy or move found something with that name: ask, then `replace`
+        std::string error;     // why it failed, for a human; empty when it worked
+        uint32_t doneBytes = 0, totalBytes = 0;  // a copy's progress
+        uint32_t files = 0;    // files copied or deleted so far; counted, for Count
+        uint32_t bytes = 0;    // Count: their total size
+        std::string path;      // what it was about
+        uint32_t ms = 0;       // how long it took, once it has ended
+    };
+
+    FileOps(StorageService& storage, InUse inUse);
+
+    // Each returns "" when the operation started, or why it can't. One at a time.
+    std::string list(const std::string& folder);
+    std::string count(const std::string& path);
+    std::string copy(const std::string& from, bool folder, const std::string& intoFolder, const std::string& name, bool replace = false);
+    std::string move(const std::string& from, bool folder, const std::string& to, bool replace = false);
+    std::string remove(const std::string& path, bool folder);
+    std::string makeFolder(const std::string& path);
+    void cancel() { cancel_ = true; }
+    // Why `path` can't be renamed, moved or deleted, or "": asked before the confirmation.
+    std::string whyReadOnly(const std::string& path, bool folder) const;
+
+    bool busy() const { return busy_; }
+    Status status() const;        // while it runs
+    bool finished(Status& out);   // true once, when it has ended
+    void takeListing(files::FileList& out);  // after a List finished without error
+
+    // For the console, which has no listing to know from: is `path` a folder? Waits for the card.
+    bool isFolder(const std::string& path, bool& exists);
+
+   private:
+    static constexpr uint32_t kSliceMs = 150;
+    static constexpr size_t kPiece = 4096;  // Q133
+
+    std::string start(Op op, const std::string& path);
+    void queue();
+    void slice();              // on the storage task
+    bool sliceList();          // each: true when the operation is over
+    bool sliceCount();
+    bool sliceCopy();
+    bool sliceDelete();
+    void fail(const std::string& why);
+    void finish();
+    bool enter(const std::string& path);  // push a folder onto the walk
+    void closeAll();
+
+    StorageService& storage_;
+    InUse inUse_;
+    mutable SemaphoreHandle_t lock_;  // status_, listing_
+    Status status_;
+    files::FileList listing_;
+    std::atomic<bool> busy_{false}, done_{false}, cancel_{false};
+    std::atomic<uint32_t> doneBytes_{0}, files_{0};
+
+    // The operation in hand: only the storage task touches these while it runs.
+    Op op_ = Op::None;
+    std::string from_, to_;
+    bool replace_ = false, sourceIsFolder_ = false, undo_ = false;
+    int phase_ = 0;
+    std::vector<fs::File> dirs_;       // the folders being walked, outermost first
+    std::vector<std::string> paths_;   // their paths
+    FF_DIR listDir_;                   // List reads the folder straight from FatFs
+    bool listOpen_ = false;
+    fs::File in_, out_;                // the file being copied
+    std::string outPath_;
+    uint32_t countBytes_ = 0, startMs_ = 0;
+    uint32_t fileBytes_ = 0, fileSize_ = 0;  // copied of the file in hand; its size when opened
+};
+
+}  // namespace roro

src/services/gemini_service.cpp

@@ -12,6 +12,7 @@
 #include "gemtext.h"
 #include "platform/console.h"
 #include "sha256.h"
+#include "platform/counted_client.h"
 #include "storage_paths.h"
 
 namespace roro {
@@ -544,7 +545,7 @@ void GeminiService::fetchOne(const std::string& url, GeminiPage& page, bool load
     auto track = [this]() { lowest_ = std::min<size_t>(lowest_, esp_get_free_heap_size()); };
 
     size_t freeBefore = esp_get_free_heap_size();  // what's left once the connection closes again
-    NetworkClientSecure tls;
+    Counted<NetworkClientSecure> tls(net::User::Gemini);
     tls.setInsecure();  // trust on first use: the pinned fingerprint is what counts (Q71)
     tls.setTimeout(15);
     if (!tls.connect(u.host.c_str(), u.portOrDefault())) {

src/services/gnss_service.cpp

@@ -66,7 +66,7 @@ void GnssService::close() {
 
 void GnssService::tick(uint32_t nowMs) {
     if (!open_) open(nowMs);
-    bool wanted = settings_.getBool(Setting::GnssEnabled);
+    bool wanted = settings_.getBool(Setting::GnssEnabled) && !held_;
     if (wanted && !active_) wake(nowMs);
     if (!wanted && (active_ || !standbyMs_ || nowMs - standbyMs_ >= kStandbyRenewMs)) standby(nowMs);
 

src/services/gnss_service.h

@@ -35,6 +35,10 @@ class GnssService : public Service {
     void tick(uint32_t nowMs) override;
 
     bool on() const { return active_; }
+    // Standby while the LoRa radio listens, when the user chose that (issue #20): the receiver
+    // raises the radio's noise floor by 8 dB while it runs. Never asked for during a Track.
+    void holdForLora(bool hold) { held_ = hold; }
+    bool heldForLora() const { return held_ && !active_; }
     bool receiving(uint32_t nowMs) const { return active_ && lastLineMs_ && nowMs - lastLineMs_ < kSilentAfterMs; }
     const gnss::GnssState& state() const { return parser_.state(); }
     uint32_t onSinceMs() const { return openedMs_; }  // when the receiver was last woken
@@ -49,6 +53,7 @@ class GnssService : public Service {
     std::string startTrack(uint32_t nowMs);
     void stopTrack();
     bool tracking() const { return !trackPath_.empty(); }
+    const std::string& trackPath() const { return trackPath_; }
     int trackPoints() const { return trackPoints_; }
     uint32_t trackStartMs() const { return trackStartMs_; }
 
@@ -71,7 +76,7 @@ class GnssService : public Service {
     StorageService& storage_;
     EventBus& bus_;
     gnss::NmeaParser parser_;
-    bool open_ = false, active_ = false, echo_ = false;
+    bool open_ = false, active_ = false, echo_ = false, held_ = false;
     uint32_t bytes_ = 0, standbyMs_ = 0;
     uint32_t openedMs_ = 0, lastLineMs_ = 0, firstFixMs_ = 0, clockSetMs_ = 0;
     gnss::FixType lastFix_ = gnss::FixType::None;

src/services/irc_service.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <NetworkClientSecure.h>
+#include "platform/counted_client.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>
 
@@ -75,8 +76,8 @@ class IrcService : public Service {
     std::unique_ptr<IrcSession> session_;
     SemaphoreHandle_t lock_ = nullptr;
     TaskHandle_t task_ = nullptr;
-    NetworkClientSecure tlsClient_;
-    NetworkClient plainClient_;
+    Counted<NetworkClientSecure> tlsClient_{net::User::Irc};  // counted for the System App (S1, Q121)
+    Counted<NetworkClient> plainClient_{net::User::Irc};
     NetworkClient* conn_ = &tlsClient_;  // whichever the config asks for
     ReconnectPolicy backoff_;
     std::string partial_;

src/services/noise_test.cpp

@@ -0,0 +1,110 @@
+#ifdef RORO_DEBUG
+
+#include "services/noise_test.h"
+
+#include <Arduino.h>
+
+#include <algorithm>
+#include <cstdio>
+
+#include "platform/console.h"
+#include "sweep_view.h"
+
+namespace roro {
+
+void NoiseTest::start(std::vector<Condition> conditions, int passes) {
+    if (running()) return;
+    conditions_ = std::move(conditions);
+    results_.clear();
+    report_.clear();
+    passes_ = passes;
+    index_ = 0;
+    console.printf("noise test: %u conditions, %d passes each\n", (unsigned)conditions_.size(), passes_);
+    begin(millis());
+}
+
+void NoiseTest::begin(uint32_t nowMs) {
+    const Condition& c = conditions_[index_];
+    if (c.apply) c.apply();
+    radio_.sweep(true);  // sets the radio up again, with whatever the condition changed
+    std::fill(std::begin(lowest_), std::end(lowest_), 0);
+    std::fill(std::begin(counts_), std::end(counts_), 0);
+    seen_ = 0;
+    phase_ = Phase::Settle;
+    phaseMs_ = nowMs;
+}
+
+void NoiseTest::step(uint32_t nowMs) {
+    if (phase_ == Phase::Idle) return;
+    const Condition& c = conditions_[index_];
+    if (phase_ == Phase::Settle) {
+        if (nowMs - phaseMs_ < c.settleMs) return;
+        lastSeq_ = radio_.sweeps();
+        phase_ = Phase::Sweep;
+        phaseMs_ = nowMs;
+        return;
+    }
+    SweepFrame f;
+    if (radio_.sweeps() != lastSeq_ && radio_.sweepFrame(f)) {
+        lastSeq_ = f.seq;
+        fromHz_ = f.fromHz, stepHz_ = f.stepHz, steps_ = f.steps;
+        for (uint16_t i = 0; i < f.steps; i++) {
+            lowest_[i] = seen_ ? std::min(lowest_[i], f.dbm[i]) : f.dbm[i];
+            counts_[std::clamp<int>(-f.dbm[i], 0, 127)]++;
+        }
+        seen_++;
+    }
+    bool stuck = nowMs - phaseMs_ > 20000;  // the radio never swept: don't hang the test
+    if (seen_ < passes_ && !stuck) return;
+
+    Result r;
+    r.name = c.name;
+    if (seen_) {
+        // The floor: the median of every reading. The top and the peaks: from the lowest reading
+        // at each step, so a burst in one pass doesn't count and a steady carrier does.
+        uint32_t total = 0, half = static_cast<uint32_t>(seen_) * steps_ / 2;
+        for (int level = 127; level >= 0; level--) {
+            total += counts_[level];
+            if (total > half) {
+                r.floor = -level;
+                break;
+            }
+        }
+        lora::SweepStats st = lora::summarize(lowest_, steps_, fromHz_, stepHz_);
+        r.top = st.top;
+        char p[32];
+        for (auto& peak : st.peaks) {
+            std::snprintf(p, sizeof p, "%s%.1f %d", r.peaks.empty() ? "" : ", ", peak.hz / 1e6, peak.dbm);
+            r.peaks += p;
+        }
+    } else {
+        r.name += " (no sweep)";
+    }
+    results_.push_back(r);
+    radio_.sweep(false);
+    if (c.restore) c.restore();
+    if (++index_ < conditions_.size()) begin(nowMs);
+    else finish();
+}
+
+void NoiseTest::finish() {
+    phase_ = Phase::Idle;
+    char line[160];
+    report_.push_back("noise test: floor = median of every reading; top and peaks = steady (lowest of the passes), dBm at 125 kHz");
+    for (auto& r : results_) {
+        std::snprintf(line, sizeof line, "noise test: %-26s floor %4d  top %4d  %s", r.name.c_str(), r.floor, r.top,
+                      r.peaks.empty() ? "no steady peak" : r.peaks.c_str());
+        report_.push_back(line);
+    }
+    report_.push_back("noise test: done");
+    printReport(console);
+}
+
+void NoiseTest::printReport(Print& out) const {
+    if (report_.empty()) return (void)out.println(running() ? "noise test: still running" : "noise test: none run yet");
+    for (auto& l : report_) out.println(l.c_str());
+}
+
+}  // namespace roro
+
+#endif  // RORO_DEBUG

src/services/noise_test.h

@@ -0,0 +1,59 @@
+#pragma once
+
+#ifdef RORO_DEBUG
+
+#include <Print.h>
+
+#include <functional>
+#include <string>
+#include <vector>
+
+#include "services/radio_service.h"
+
+namespace roro {
+
+// `lora noise test` (Debug Builds, issue #20): which part of the Cardputer raises the radio's
+// noise floor? Applies one condition at a time, Sweeps the band a few passes, records the floor
+// and the steady peaks, and puts things back. It runs from the main loop on its own, because one
+// condition switches Wi-Fi off, and prints its report once the console can be reached again.
+class NoiseTest {
+   public:
+    struct Condition {
+        std::string name;
+        std::function<void()> apply, restore;  // either may be empty
+        uint32_t settleMs = 1500;
+    };
+
+    explicit NoiseTest(RadioService& radio) : radio_(radio) {}
+    void start(std::vector<Condition> conditions, int passes = 8);
+    void step(uint32_t nowMs);  // from the main loop
+    bool running() const { return phase_ != Phase::Idle; }
+    void printReport(Print& out) const;
+
+   private:
+    enum class Phase { Idle, Settle, Sweep };
+    struct Result {
+        std::string name;
+        int floor = 0, top = 0;
+        std::string peaks;  // steady ones: the lowest reading at each step over the passes
+    };
+    void begin(uint32_t nowMs);
+    void finish();
+
+    RadioService& radio_;
+    std::vector<Condition> conditions_;
+    std::vector<Result> results_;
+    size_t index_ = 0;
+    int passes_ = 8, seen_ = 0;
+    Phase phase_ = Phase::Idle;
+    uint32_t phaseMs_ = 0, lastSeq_ = 0;
+    int8_t lowest_[SweepFrame::kMaxSteps];
+    uint16_t counts_[128];  // how often each level (in -dBm) was read: for the median
+    uint32_t fromHz_ = 0, stepHz_ = 0;
+    uint16_t steps_ = 0;
+    std::vector<std::string> report_;
+};
+
+}  // namespace roro
+
+#endif  // RORO_DEBUG

src/services/power_service.cpp

@@ -42,6 +42,7 @@ void PowerService::applyScreen(ScreenState state) {
 }
 
 void PowerService::powerOff() {
+    if (beforePowerOff) beforePowerOff();
     auto& display = M5Cardputer.Display;
     display.wakeup();
     display.setBrightness(settings_.getInt(Setting::Brightness) * 255 / 100);

src/services/power_service.h

@@ -1,5 +1,7 @@
 #pragma once
 
+#include <functional>
+
 #include "power_policy.h"
 #include "service.h"
 #include "settings.h"
@@ -24,6 +26,9 @@ class PowerService : public Service {
 
     ScreenState screen() const { return applied_; }
 
+    // Run before the device powers off: the last chance to put on the card what's only in memory.
+    std::function<void()> beforePowerOff;
+
    private:
     void applyScreen(ScreenState state);
     void powerOff();

src/services/radio_service.cpp

@@ -71,19 +71,19 @@ bool RadioService::beginRadio(Print* report) {
     Config c = config();
     float mhz = c.frequencyHz / 1e6f;
     int16_t state = radio_->begin(mhz, c.bandwidthKHz, c.spreadingFactor, c.codingRate, c.syncWord, 0, c.preamble,
-                                  tcxo_, false);
+                                  tcxo_, ldo_);
     if (state != RADIOLIB_ERR_NONE && tcxo_ > 0) {  // Meshtastic's TCXO_OPTIONAL: fall back to the crystal
         if (report) report->printf("lora probe: begin with TCXO %.1f V: error %d, trying the crystal\n", tcxo_, state);
         tcxo_ = 0;
         state = radio_->begin(mhz, c.bandwidthKHz, c.spreadingFactor, c.codingRate, c.syncWord, 0, c.preamble, tcxo_,
-                              false);
+                              ldo_);
     }
     if (state != RADIOLIB_ERR_NONE) {
         if (report) report->printf("lora probe: error %d, no SX1262 found\n", state);
         return false;
     }
     radio_->setDio2AsRfSwitch(true);       // DIO2 selects TX or RX in the switch, as in Meshtastic
-    radio_->setRxBoostedGainMode(true);    // about 2 dB more sensitivity for about 2 mA
+    radio_->setRxBoostedGainMode(boostedGain_);  // about 2 dB more sensitivity for about 2 mA
     return true;
 }
 
@@ -191,6 +191,12 @@ void RadioService::store(RadioPacket& p) {
 }
 
 #ifdef RORO_DEBUG
+void RadioService::debugAntenna(bool on) {
+    auto& i2c = M5.In_I2C;
+    uint8_t out = i2c.readRegister8(kExpander, kOutput, kI2cFreq);
+    i2c.writeRegister8(kExpander, kOutput, on ? (out | 1) : (out & ~1), kI2cFreq);
+}
+
 void RadioService::inject(const uint8_t* data, size_t len, float rssi, float snr) {
     if (!listening_) return (void)console.println("lora inject: not listening");
     RadioPacket p;

src/services/radio_service.h

@@ -100,6 +100,15 @@ class RadioService : public Service {
     void setEcho(bool echo);
     void probe(Print& out);  // `lora probe`: runs on the radio task
 #ifdef RORO_DEBUG
+    // For the noise self-test (issue #20): the chip's regulator as an LDO instead of its DC-DC
+    // converter, and receive gain boosted or not. Used the next time the radio is set up.
+    void debugOptions(bool ldo, bool boostedGain) {
+        ldo_ = ldo;
+        boostedGain_ = boostedGain;
+    }
+    // The antenna switch (the Cap's expander, P0), for the reference "what the chip hears alone".
+    // From the main loop only, which owns the I2C bus.
+    void debugAntenna(bool on);
     // `lora inject`: a packet into the ring as if received, to test the App and Captures with no
     // transmitter in range. Nothing goes on air.
     void inject(const uint8_t* data, size_t len, float rssi, float snr);
@@ -132,6 +141,7 @@ class RadioService : public Service {
     Config config_;
     bool present_ = false, expander_ = false;
     float tcxo_ = 1.8f;
+    std::atomic<bool> ldo_{false}, boostedGain_{true};
     std::atomic<uint8_t> clients_{0};
     std::atomic<bool> listening_{false}, configChanged_{false}, probeWanted_{false}, echo_{false};
     std::atomic<uint32_t> seq_{0}, packets_{0}, crcErrors_{0}, radioErrors_{0}, restarts_{0};

src/services/update_service.cpp

@@ -1,4 +1,5 @@
 #include "update_service.h"
+#include "platform/counted_client.h"
 
 #include <SD.h>
 #include <WiFi.h>
@@ -208,7 +209,7 @@ void UpdateService::listen() {
             }
         }
         if (listening && phase_ == Phase::Idle) {
-            NetworkClient client = server.accept();
+            Counted<NetworkClient> client(server.accept(), net::User::Updates);
             if (client) {
                 client.setNoDelay(true);
                 NetSource src(client);

src/services/wifi_service.cpp

@@ -3,10 +3,124 @@
 #include <WiFi.h>
 #include <esp_sntp.h>
 #include <esp_wifi.h>
+#include <lwip/ip_addr.h>
+
+#include <cstring>
+
+#include "ipv4.h"
 
 namespace roro {
 
 
+namespace {
+IPAddress toIp(uint32_t a) { return IPAddress(a >> 24, a >> 16 & 255, a >> 8 & 255, a & 255); }
+IPAddress toIp(const std::string& text) {
+    uint32_t a = 0;
+    net::parseIpv4(text, a);
+    return toIp(a);
+}
+const IPAddress kNoAddress(static_cast<uint32_t>(0));
+// A slot lwIP filled from DHCP has an address and no name; ours are set by name.
+bool sntpSlotFromDhcp(int i) {
+    const ip_addr_t* a = esp_sntp_getserver(i);
+    return !esp_sntp_getservername(i) && a && !ip_addr_isany(a);
+}
+constexpr int kNtpSlots = 3;  // CONFIG_LWIP_SNTP_MAX_SERVERS
+constexpr uint32_t kServersEveryMs = 30000;
+}  // namespace
+
+// Joins a Saved Network with its IP setting (S1, Q105): Fixed, or DHCP.
+void WifiService::join(const std::string& ssid, const std::string& password) {
+    const SavedNetwork* n = saved_.find(ssid);
+    fixed_ = n && n->fixed;
+    if (fixed_) {
+        // Nothing comes from DHCP here: forget the NTP servers a previous network offered.
+        for (int i = 0; i < kNtpSlots; i++)
+            if (sntpSlotFromDhcp(i)) esp_sntp_setserver(i, nullptr);
+        WiFi.config(toIp(n->ip.address), toIp(n->ip.gateway), toIp(net::maskOf(n->ip.prefix)),
+                    toIp(settings_.getString(Setting::Dns1)), toIp(settings_.getString(Setting::Dns2)));
+    } else {
+        WiFi.config(kNoAddress, kNoAddress, kNoAddress);  // DHCP
+    }
+    WiFi.begin(ssid.c_str(), password.empty() ? nullptr : password.c_str());
+}
+
+void WifiService::ipSettingChanged(const std::string& ssid) {
+    if (controller_.state() != WifiController::State::Connected || controller_.ssid() != ssid) return;
+    WiFi.disconnect();
+    apply(controller_.disconnected(millis()));
+    controller_.retryNow(millis());
+}
+
+// DNS and NTP as decided in Q108 and Q110. Run when connected, when a setting changes, and now
+// and then: a DHCP renewal puts DHCP's DNS back and clears the NTP slots it didn't fill.
+void WifiService::applyServers(Why why) {
+    if (controller_.state() != WifiController::State::Connected) return;
+    serversCheckedMs_ = millis();
+    bool changed = why != Why::Check;
+
+    bool wasFromSettings = dnsFromSettings_;
+    dnsFromSettings_ = fixed_ || settings_.getBool(Setting::DnsAlways);
+    if (dnsFromSettings_) {
+        IPAddress dns1 = toIp(settings_.getString(Setting::Dns1)), dns2 = toIp(settings_.getString(Setting::Dns2));
+        if (WiFi.dnsIP(0) != dns1 || WiFi.dnsIP(1) != dns2) WiFi.setDNS(dns1, dns2);
+    } else if (why == Why::SettingsChanged && wasFromSettings) {
+        // "Always use my DNS" was switched off: only a new lease brings DHCP's servers back.
+        ipSettingChanged(controller_.ssid());
+        return;
+    }
+
+    // NTP: the servers DHCP offered stay first; ours follow.
+    int fromDhcp = 0;
+    while (!fixed_ && fromDhcp < kNtpSlots && sntpSlotFromDhcp(fromDhcp)) fromDhcp++;
+    std::string wanted[2] = {settings_.getString(Setting::Ntp1), settings_.getString(Setting::Ntp2)};
+    bool touched = false;
+    for (int i = fromDhcp, mine = 0; i < kNtpSlots; i++, mine++) {
+        const char* current = esp_sntp_getservername(i);
+        if (mine < 2 && !wanted[mine].empty()) {
+            if (current && wanted[mine] == current) continue;
+            ntpNames_[mine] = wanted[mine];
+            esp_sntp_setservername(i, ntpNames_[mine].c_str());
+            touched = true;
+        } else if (current || sntpSlotFromDhcp(i)) {
+            esp_sntp_setserver(i, nullptr);
+            touched = true;
+        }
+    }
+    // Our own flag, not esp_sntp_enabled(): starting is only queued for the network task, and a
+    // second call that looked before it ran would start SNTP twice, which ESP-IDF asserts on.
+    if (!sntpStarted_) {
+        sntpStarted_ = true;
+        esp_sntp_setoperatingmode(ESP_SNTP_OPMODE_POLL);
+        esp_sntp_init();
+    } else if (touched || changed) {
+        esp_sntp_restart();
+    }
+    if (touched || changed) ntpWaiting_ = true;
+}
+
+WifiService::Connection WifiService::connection() const {
+    Connection c;
+    c.connected = controller_.state() == WifiController::State::Connected;
+    if (!c.connected) return c;
+    c.fixed = fixed_;
+    c.dnsFromSettings = dnsFromSettings_;
+    c.address = WiFi.localIP().toString().c_str();
+    c.mask = WiFi.subnetMask().toString().c_str();
+    c.prefix = WiFi.subnetCIDR();
+    IPAddress gateway = WiFi.gatewayIP();
+    if (gateway != kNoAddress) c.gateway = gateway.toString().c_str();
+    for (int i = 0; i < 2; i++)
+        if (WiFi.dnsIP(i) != kNoAddress) c.dns[i] = WiFi.dnsIP(i).toString().c_str();
+    for (int i = 0; i < kNtpSlots; i++) {
+        const char* name = esp_sntp_getservername(i);
+        bool answered = esp_sntp_getreachability(i) != 0;
+        if (name) c.ntp[c.ntpCount++] = {name, false, answered};
+        else if (sntpSlotFromDhcp(i)) c.ntp[c.ntpCount++] = {ipaddr_ntoa(esp_sntp_getserver(i)), true, answered};
+    }
+    return c;
+}
+
 std::string WifiService::ip() const {
     return controller_.state() == WifiController::State::Connected ? WiFi.localIP().toString().c_str() : "";
 }
@@ -20,6 +134,7 @@ void WifiService::startScan(int channel) {
         WiFi.mode(WIFI_STA);
         WiFi.setAutoReconnect(false);  // the controller decides when to reconnect
         esp_wifi_set_country_code("EU", true);
+        esp_sntp_servermode_dhcp(true);  // before DHCP runs: take the NTP servers it offers (Q110)
         radioInitialised_ = true;
     }
     if (scanRunning_) return;
@@ -87,13 +202,7 @@ void WifiService::finishScan(uint32_t nowMs) {
 
 void WifiService::startNtp() {
     // Not configTime(): it would overwrite the POSIX TZ the Clock applies.
-    if (!esp_sntp_enabled()) {
-        esp_sntp_setoperatingmode(ESP_SNTP_OPMODE_POLL);
-        esp_sntp_setservername(0, "pool.ntp.org");
-        esp_sntp_init();
-    } else {
-        esp_sntp_restart();
-    }
+    applyServers(Why::Joined);
     ntpWaiting_ = true;
 }
 
@@ -102,7 +211,7 @@ void WifiService::apply(const WifiController::Step& step) {
     switch (step.action) {
         case Action::None: break;
         case Action::StartScan: startScan(); break;
-        case Action::Connect: WiFi.begin(step.ssid.c_str(), step.password.empty() ? nullptr : step.password.c_str()); break;
+        case Action::Connect: join(step.ssid, step.password); break;
         case Action::Disconnect: WiFi.disconnect(); break;
         case Action::RadioOff:
             WiFi.disconnect(true);
@@ -141,7 +250,12 @@ void WifiService::tick(uint32_t nowMs) {
         apply(controller_.disconnected(nowMs));
     }
 
-    apply(controller_.update(nowMs, settings_.getBool(Setting::WifiEnabled)));
+    apply(controller_.update(nowMs, settings_.getBool(Setting::WifiEnabled) && !paused_));
+
+    // Signed: serversCheckedMs_ can be newer than this pass's nowMs (set from millis() just above),
+    // and the unsigned difference then ran the check again at once, at every join.
+    if (controller_.state() == State::Connected && static_cast<int32_t>(nowMs - serversCheckedMs_) >= static_cast<int32_t>(kServersEveryMs))
+        applyServers(Why::Check);
 
     if (ntpWaiting_ && sntp_get_sync_status() == SNTP_SYNC_STATUS_COMPLETED) {
         ntpWaiting_ = false;

src/services/wifi_service.h

@@ -36,6 +36,32 @@ class WifiService : public Service {
     // Done with list scans: switch the radio back off if Wi-Fi itself is off.
     void endListScans();
 
+    // What the device is using and where each part came from (S1, Q113).
+    struct Connection {
+        bool connected = false;
+        bool fixed = false;            // the address: Fixed, or from DHCP
+        bool dnsFromSettings = false;  // DNS: from Settings, or from DHCP
+        std::string address, mask, gateway;
+        int prefix = 0;
+        std::string dns[2];
+        struct Ntp {
+            std::string server;
+            bool fromDhcp = false;
+            bool answered = false;  // it has replied since the last (re)start
+        } ntp[3];
+        int ntpCount = 0;
+    };
+    Connection connection() const;
+    // A Saved Network's IP setting changed: if it's the one in use, join it again with it (Q114).
+    void ipSettingChanged(const std::string& ssid);
+    // The DNS or NTP settings changed: use them now.
+    void serversChanged() { applyServers(Why::SettingsChanged); }
+#ifdef RORO_DEBUG
+    // The noise self-test switches the radio off for a few seconds. Not saved anywhere: a restart
+    // during the test brings Wi-Fi back, which a changed setting wouldn't.
+    void debugPause(bool paused) { paused_ = paused; }
+#endif
+
     // A Saved Network was added: try it now rather than after the retry delay.
     void savedNetworksChanged() { controller_.retryNow(millis()); }
 
@@ -47,6 +73,9 @@ class WifiService : public Service {
     void startScan(int channel = 0);
     void finishScan(uint32_t nowMs);
     void startNtp();
+    void join(const std::string& ssid, const std::string& password);
+    enum class Why { Joined, SettingsChanged, Check };
+    void applyServers(Why why);  // DNS and NTP, as Settings and the network say
 
     Settings& settings_;
     SavedNetworks& saved_;
@@ -57,7 +86,13 @@ class WifiService : public Service {
     std::vector<ScanEntry> listScan_;
     uint32_t listScanSeq_ = 0;
     bool ntpWaiting_ = false;
+    bool sntpStarted_ = false;
     bool radioInitialised_ = false;
+    bool paused_ = false;          // Debug Builds: off for a moment, whatever the setting says
+    bool fixed_ = false;           // the network in use has a Fixed address
+    bool dnsFromSettings_ = false;
+    std::string ntpNames_[2];      // lwIP keeps the pointers, so the names live here
+    uint32_t serversCheckedMs_ = 0;
 };
 
 }  // namespace roro

test/test_file_list/test_file_list.cpp

@@ -0,0 +1,117 @@
+#include <unity.h>
+
+#include <cstdlib>
+#include <ctime>
+#include <string>
+
+#include "file_list.h"
+
+using namespace roro::files;
+
+void setUp() {}
+void tearDown() {}
+
+void test_entries() {
+    FileList list;
+    TEST_ASSERT_EQUAL_size_t(0, list.count());
+    list.add("b.txt", 1200, 1791230400, false);
+    list.add("saved", 0, 1791230000, true);
+    TEST_ASSERT_EQUAL_size_t(2, list.count());
+    list.sort(FileSort::Name);
+    TEST_ASSERT_EQUAL_STRING("saved", list.name(0));  // folders first
+    TEST_ASSERT_TRUE(list.folder(0));
+    TEST_ASSERT_EQUAL_STRING("b.txt", list.name(1));
+    TEST_ASSERT_EQUAL_UINT32(1200, list.size(1));
+    TEST_ASSERT_EQUAL_UINT32(1791230400u, list.modified(1));
+}
+
+// Q129: folders first, then by name whatever the case; `s` cycles name, date, size.
+void test_sorting() {
+    FileList list;
+    list.add("zeta.log", 10, 300, false);
+    list.add("Alpha.log", 3000, 100, false);
+    list.add("beta.log", 200, 200, false);
+    list.add("tracks", 0, 50, true);
+    list.add("Captures", 0, 60, true);
+
+    list.sort(FileSort::Name);
+    const char* byName[] = {"Captures", "tracks", "Alpha.log", "beta.log", "zeta.log"};
+    for (int i = 0; i < 5; i++) TEST_ASSERT_EQUAL_STRING(byName[i], list.name(i));
+
+    list.sort(FileSort::Date);  // newest first, folders still first
+    const char* byDate[] = {"Captures", "tracks", "zeta.log", "beta.log", "Alpha.log"};
+    for (int i = 0; i < 5; i++) TEST_ASSERT_EQUAL_STRING(byDate[i], list.name(i));
+
+    list.sort(FileSort::Size);  // biggest first
+    const char* bySize[] = {"Captures", "tracks", "Alpha.log", "beta.log", "zeta.log"};
+    for (int i = 0; i < 5; i++) TEST_ASSERT_EQUAL_STRING(bySize[i], list.name(i));
+}
+
+// Q136: 256 entries at most. A bigger folder keeps the first 256 by name, whatever order the
+// card lists them in, and says how many more there are.
+void test_more_than_fits() {
+    FileList list;
+    char name[24];
+    for (int i = 399; i >= 0; i--) {  // the card's order: backwards
+        std::snprintf(name, sizeof name, "2026-%03d.log", i);
+        list.add(name, static_cast<uint32_t>(i), 1000 + i, false);
+    }
+    TEST_ASSERT_EQUAL_size_t(256, list.count());
+    TEST_ASSERT_EQUAL_size_t(144, list.more());
+    list.sort(FileSort::Name);
+    TEST_ASSERT_EQUAL_STRING("2026-000.log", list.name(0));
+    TEST_ASSERT_EQUAL_STRING("2026-255.log", list.name(255));
+    TEST_ASSERT_EQUAL_UINT32(255, list.size(255));
+    // And it stays small: 400 names went through, the memory is for 256.
+    TEST_ASSERT_TRUE(list.bytes() < 12 * 1024);
+}
+
+void test_folders_are_kept_before_files_when_full() {
+    FileList list;
+    char name[24];
+    for (int i = 0; i < 300; i++) {
+        std::snprintf(name, sizeof name, "a%03d.log", i);
+        list.add(name, 1, 1, false);
+    }
+    list.add("zz-folder", 0, 1, true);  // sorts first, so it's among the 256
+    list.sort(FileSort::Name);
+    TEST_ASSERT_EQUAL_STRING("zz-folder", list.name(0));
+    TEST_ASSERT_EQUAL_size_t(45, list.more());
+}
+
+void test_find_and_clear() {
+    FileList list;
+    list.add("a.txt", 1, 1, false);
+    list.add("b.txt", 2, 2, false);
+    list.sort(FileSort::Name);
+    TEST_ASSERT_EQUAL_INT(1, list.find("b.txt"));
+    TEST_ASSERT_EQUAL_INT(-1, list.find("c.txt"));
+    list.clear();
+    TEST_ASSERT_EQUAL_size_t(0, list.count());
+    TEST_ASSERT_EQUAL_size_t(0, list.more());
+}
+
+// Q129, Q137: what a row shows on the right. A date before 2020 was never set.
+void test_display() {
+    setenv("TZ", "UTC", 1);
+    tzset();
+    TEST_ASSERT_EQUAL_STRING("folder", rowDetail(true, 0, 0).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.2 KB  2026-10-05", rowDetail(false, 1200, 1791230400).c_str());
+    TEST_ASSERT_EQUAL_STRING("0 B  -", rowDetail(false, 0, 315532800).c_str());  // 1980-01-01, FAT's zero
+    TEST_ASSERT_EQUAL_STRING("2026-10-05 20:00", formatStamp(1791230400).c_str());
+    TEST_ASSERT_EQUAL_STRING("-", formatStamp(0).c_str());
+    TEST_ASSERT_EQUAL_STRING("notes.txt", fitName("notes.txt", 19).c_str());
+    TEST_ASSERT_EQUAL_STRING("20261005-18..2.pcap", fitName("20261005-180932.pcap", 19).c_str());
+    TEST_ASSERT_EQUAL_INT(19, fitName("a-very-long-folder-name-without-end", 19).size());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_entries);
+    RUN_TEST(test_sorting);
+    RUN_TEST(test_more_than_fits);
+    RUN_TEST(test_folders_are_kept_before_files_when_full);
+    RUN_TEST(test_find_and_clear);
+    RUN_TEST(test_display);
+    return UNITY_END();
+}

test/test_file_names/test_file_names.cpp

@@ -0,0 +1,118 @@
+#include <unity.h>
+
+#include <string>
+#include <vector>
+
+#include "file_names.h"
+
+using namespace roro::files;
+
+void setUp() {}
+void tearDown() {}
+
+void test_path_parts() {
+    TEST_ASSERT_EQUAL_STRING("/gemini/saved", parentOf("/gemini/saved/index.gmi").c_str());
+    TEST_ASSERT_EQUAL_STRING("/", parentOf("/gemini").c_str());
+    TEST_ASSERT_EQUAL_STRING("/", parentOf("/").c_str());
+    TEST_ASSERT_EQUAL_STRING("index.gmi", baseName("/gemini/saved/index.gmi").c_str());
+    TEST_ASSERT_EQUAL_STRING("", baseName("/").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/a.gmi", joinPath("/gemini", "a.gmi").c_str());
+    TEST_ASSERT_EQUAL_STRING("/a.gmi", joinPath("/", "a.gmi").c_str());
+    TEST_ASSERT_EQUAL_STRING("gmi", extensionOf("Index.GMI").c_str());
+    TEST_ASSERT_EQUAL_STRING("pcap", extensionOf("20261005-183340.pcap").c_str());
+    TEST_ASSERT_EQUAL_STRING("", extensionOf("README").c_str());
+    TEST_ASSERT_EQUAL_STRING("", extensionOf(".hidden").c_str());
+}
+
+void test_inside() {
+    TEST_ASSERT_TRUE(isInside("/gemini/cache/page0.gmi", "/gemini/cache"));
+    TEST_ASSERT_TRUE(isInside("/gemini/cache", "/gemini/cache"));
+    TEST_ASSERT_FALSE(isInside("/gemini/cached", "/gemini/cache"));  // a longer name isn't inside
+    TEST_ASSERT_TRUE(isInside("/irc/x.log", "/"));
+}
+
+// Q131: names typed for rename and new folder.
+void test_names_checked() {
+    TEST_ASSERT_EQUAL_STRING("", checkName("notes 2026.txt").c_str());
+    TEST_ASSERT_EQUAL_STRING("", checkName("#roro").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can't be empty", checkName("").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can't contain /", checkName("a/b").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can't contain :", checkName("12:30.txt").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can't contain ?", checkName("what?").c_str());
+    TEST_ASSERT_EQUAL_STRING("\".\" and \"..\" aren't names", checkName("..").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can't end with a dot or a space", checkName("notes.").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can't end with a dot or a space", checkName("notes ").c_str());
+    TEST_ASSERT_EQUAL_STRING("A name can be 64 characters at most", checkName(std::string(65, 'a')).c_str());
+    TEST_ASSERT_EQUAL_STRING("", checkName(std::string(64, 'a')).c_str());
+}
+
+// Q130: what can't be renamed, moved or deleted, and why.
+void test_read_only() {
+    std::vector<std::string> inUse = {"/irc/irc.libera.chat/#roro/2026-10-06.log", "/gnss/tracks/20261006-071500.gpx"};
+    TEST_ASSERT_EQUAL_STRING("", whyReadOnly("/gemini/saved/a.gmi", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("", whyReadOnly("/irc/irc.libera.chat/#roro/2026-10-05.log", inUse).c_str());  // yesterday's
+    TEST_ASSERT_EQUAL_STRING("", whyReadOnly("/updates/roro9stack-v0.8.1.ota", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("", whyReadOnly("/gemini/saved", inUse).c_str());  // a folder below the top level
+
+    TEST_ASSERT_EQUAL_STRING("It's being written right now", whyReadOnly("/gnss/tracks/20261006-071500.gpx", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("It holds a file that's being written right now", whyReadOnly("/gnss/tracks", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("It holds a file that's being written right now", whyReadOnly("/irc/irc.libera.chat", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/cache is the Gemini App's working space", whyReadOnly("/gemini/cache/page0.gmi", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/cache is the Gemini App's working space", whyReadOnly("/gemini/cache", inUse).c_str());
+    TEST_ASSERT_EQUAL_STRING("The firmware keeps its files in /irc", whyReadOnly("/irc", {}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The firmware keeps its files in /captures", whyReadOnly("/captures", {}).c_str());
+    TEST_ASSERT_EQUAL_STRING("That's the card itself", whyReadOnly("/", {}).c_str());
+    TEST_ASSERT_EQUAL_STRING("", whyReadOnly("/my stuff", {}).c_str());  // a top-level folder of the user's own
+}
+
+// Where something may be put (paste, new folder): not into the cache, not into itself.
+void test_destinations() {
+    TEST_ASSERT_EQUAL_STRING("", whyNotInto("/gemini/saved/a.gmi", "/notes").c_str());
+    TEST_ASSERT_EQUAL_STRING("", whyNotInto("/gemini/saved/a.gmi", "/").c_str());
+    TEST_ASSERT_EQUAL_STRING("/gemini/cache is the Gemini App's working space", whyNotInto("/notes/a.txt", "/gemini/cache").c_str());
+    TEST_ASSERT_EQUAL_STRING("A folder can't go inside itself", whyNotInto("/gemini/saved", "/gemini/saved/sub").c_str());
+    TEST_ASSERT_EQUAL_STRING("A folder can't go inside itself", whyNotInto("/gemini/saved", "/gemini/saved").c_str());
+    TEST_ASSERT_EQUAL_STRING("It's already there", whyNotInto("/gemini/saved/a.gmi", "/gemini/saved").c_str());
+}
+
+// A copy next to the original needs another name: "a (2).gmi".
+void test_copy_names() {
+    TEST_ASSERT_EQUAL_STRING("a (2).gmi", copyName("a.gmi", 2).c_str());
+    TEST_ASSERT_EQUAL_STRING("README (3)", copyName("README", 3).c_str());
+    TEST_ASSERT_EQUAL_STRING("archive.tar (2).gz", copyName("archive.tar.gz", 2).c_str());
+}
+
+// Q134: which viewer opens a file.
+void test_kinds() {
+    TEST_ASSERT_TRUE(kindOf("2026-10-06.log") == FileKind::Text);
+    TEST_ASSERT_TRUE(kindOf("index.gmi") == FileKind::Text);
+    TEST_ASSERT_TRUE(kindOf("2026-10-05.CSV") == FileKind::Text);
+    TEST_ASSERT_TRUE(kindOf("note.txt") == FileKind::Text);
+    TEST_ASSERT_TRUE(kindOf("20261006-071500.gpx") == FileKind::Gpx);
+    TEST_ASSERT_TRUE(kindOf("20261005-183340.pcap") == FileKind::Pcap);
+    TEST_ASSERT_TRUE(kindOf("roro9stack-v0.8.1.ota") == FileKind::Ota);
+    TEST_ASSERT_TRUE(kindOf("firmware.bin") == FileKind::Unknown);  // sniffed: text or a hex dump
+    TEST_ASSERT_TRUE(opensAtEnd("2026-10-06.log"));
+    TEST_ASSERT_FALSE(opensAtEnd("index.gmi"));
+}
+
+void test_looks_like_text() {
+    const char text[] = "line one\nline two with an \xC3\xA9\r\n\ttabbed";
+    TEST_ASSERT_TRUE(looksLikeText(reinterpret_cast<const uint8_t*>(text), sizeof text - 1));
+    const uint8_t binary[] = {0xE9, 0x05, 0x02, 0x00, 0x10, 0x00, 0x00, 0x40};
+    TEST_ASSERT_FALSE(looksLikeText(binary, sizeof binary));
+    TEST_ASSERT_TRUE(looksLikeText(nullptr, 0));  // an empty file reads as text
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_path_parts);
+    RUN_TEST(test_inside);
+    RUN_TEST(test_names_checked);
+    RUN_TEST(test_read_only);
+    RUN_TEST(test_destinations);
+    RUN_TEST(test_copy_names);
+    RUN_TEST(test_kinds);
+    RUN_TEST(test_looks_like_text);
+    return UNITY_END();
+}

test/test_file_views/test_file_views.cpp

@@ -0,0 +1,133 @@
+#include <unity.h>
+
+#include <cstdlib>
+#include <ctime>
+#include <string>
+#include <vector>
+
+#include "file_views.h"
+#include "loratap.h"
+#include "track.h"
+
+using namespace roro;
+using namespace roro::files;
+
+void setUp() {}
+void tearDown() {}
+
+void test_hex_row() {
+    const uint8_t d[] = {'H', 'e', 'l', 'l', 'o', ',', ' ', 'w', 0x00, 0xFF, 'x'};
+    TEST_ASSERT_EQUAL_STRING("00010 4865 6c6c 6f2c 2077  Hello, w", hexRow(0x10, d, 8).c_str());
+    TEST_ASSERT_EQUAL_STRING("00018 00ff 78              ..x", hexRow(0x18, d + 8, 3).c_str());
+    TEST_ASSERT_TRUE(hexRow(0xFFFFF, d, 8).size() <= 38);
+}
+
+// A Track as the GNSS Service writes it, fed in pieces of every size: the same summary each time.
+void test_gpx_summary() {
+    setenv("TZ", "UTC", 1);
+    tzset();
+    std::string file = gnss::gpx::header("test");
+    int64_t t0 = 1791230400;  // 2026-10-05 20:00:00 UTC
+    for (int i = 0; i < 50; i++) file += gnss::gpx::point(48.0 + i * 0.0001, 7.0, i % 2 == 0, 200, t0 + i * 5) + "\n";
+    file += gnss::gpx::footer();
+    for (size_t piece : {size_t(1), size_t(7), size_t(64), size_t(1000), file.size()}) {
+        GpxSummary s;
+        for (size_t at = 0; at < file.size(); at += piece) s.feed(file.data() + at, std::min(piece, file.size() - at));
+        TEST_ASSERT_EQUAL_UINT32(50, s.points());
+        TEST_ASSERT_EQUAL_INT64(t0, s.start());
+        TEST_ASSERT_EQUAL_INT64(t0 + 245, s.end());
+        TEST_ASSERT_FLOAT_WITHIN(1.0f, 49 * 11.12f, static_cast<float>(s.meters()));  // 0.0001 degree of latitude: 11.12 m
+    }
+    GpxSummary s;
+    s.feed(file.data(), file.size());
+    auto lines = s.lines();
+    TEST_ASSERT_EQUAL_size_t(4, lines.size());
+    TEST_ASSERT_EQUAL_STRING("50 points", lines[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("Started 2026-10-05 20:00", lines[1].c_str());
+    TEST_ASSERT_EQUAL_STRING("Lasted 4 min 05 s", lines[2].c_str());
+    TEST_ASSERT_EQUAL_STRING("Distance 545 m", lines[3].c_str());
+}
+
+void test_gpx_from_elsewhere_and_not_gpx() {
+    GpxSummary s;
+    std::string other = "<gpx><trk><trkseg><trkpt lon=\"7.0\" lat=\"48.0\"/><trkpt lat=\"48.01\" lon=\"7.0\">\n<ele>1</ele>\n</trkpt></trkseg></trk></gpx>";
+    s.feed(other.data(), other.size());
+    TEST_ASSERT_EQUAL_UINT32(2, s.points());
+    TEST_ASSERT_EQUAL_INT64(0, s.start());
+    TEST_ASSERT_FLOAT_WITHIN(5.0f, 1112.0f, static_cast<float>(s.meters()));
+    TEST_ASSERT_EQUAL_size_t(2, s.lines().size());  // no times: points and distance only
+    GpxSummary none;
+    std::string junk(10000, 'x');
+    none.feed(junk.data(), junk.size());
+    TEST_ASSERT_EQUAL_UINT32(0, none.points());
+}
+
+void test_durations() {
+    TEST_ASSERT_EQUAL_STRING("12 s", formatDuration(12).c_str());
+    TEST_ASSERT_EQUAL_STRING("4 min 10 s", formatDuration(250).c_str());
+    TEST_ASSERT_EQUAL_STRING("1 h 02 min", formatDuration(3725).c_str());
+}
+
+// What the LoRa Capture Service writes reads back the same.
+void test_pcap_round_trip() {
+    std::vector<uint8_t> file;
+    lora::appendPcapHeader(file);
+    lora::RxInfo rx;
+    rx.frequencyHz = 869525000;
+    rx.bandwidthKHz = 250;
+    rx.spreadingFactor = 11;
+    rx.rssi = -97;
+    rx.snr = -6.25f;
+    rx.noiseFloor = -106;
+    rx.syncWord = 0x2B;
+    const uint8_t payload[] = {1, 2, 3, 4, 5};
+    lora::appendRecord(file, 1791230400, 250000, rx, payload, sizeof payload);
+    lora::appendRecord(file, 1791230401, 0, rx, payload, 0);
+
+    PcapHeader h = parsePcapHeader(file.data(), file.size());
+    TEST_ASSERT_TRUE(h.ok);
+    TEST_ASSERT_EQUAL_UINT32(kLinkLoraTap, h.linkType);
+    size_t at = kPcapHeaderSize;
+    PcapRecord r;
+    TEST_ASSERT_TRUE(parsePcapRecord(file.data() + at, file.size() - at, r));
+    TEST_ASSERT_EQUAL_UINT32(1791230400, r.seconds);
+    TEST_ASSERT_EQUAL_UINT32(250000, r.micros);
+    TEST_ASSERT_EQUAL_UINT32(lora::kLoraTapSize + 5, r.length);
+    lora::RxInfo back;
+    TEST_ASSERT_TRUE(parseLoraTap(file.data() + at + kPcapRecordSize, r.length, back));
+    TEST_ASSERT_EQUAL_UINT32(869525000, back.frequencyHz);
+    TEST_ASSERT_EQUAL_FLOAT(250, back.bandwidthKHz);
+    TEST_ASSERT_EQUAL_UINT8(11, back.spreadingFactor);
+    TEST_ASSERT_EQUAL_FLOAT(-97, back.rssi);
+    TEST_ASSERT_EQUAL_FLOAT(-6.25f, back.snr);
+    TEST_ASSERT_EQUAL_FLOAT(-106, back.noiseFloor);
+    TEST_ASSERT_EQUAL_HEX8(0x2B, back.syncWord);
+    at += kPcapRecordSize + r.length;
+    TEST_ASSERT_TRUE(parsePcapRecord(file.data() + at, file.size() - at, r));
+    TEST_ASSERT_EQUAL_UINT32(lora::kLoraTapSize, r.length);
+    at += kPcapRecordSize + r.length;
+    TEST_ASSERT_EQUAL_size_t(file.size(), at);
+    TEST_ASSERT_FALSE(parsePcapRecord(file.data() + at, file.size() - at, r));  // the end
+}
+
+void test_not_a_pcap() {
+    const uint8_t junk[24] = {'n', 'o', 'p', 'e'};
+    TEST_ASSERT_FALSE(parsePcapHeader(junk, sizeof junk).ok);
+    TEST_ASSERT_FALSE(parsePcapHeader(junk, 10).ok);
+    const uint8_t huge[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF, 0xFF, 0x7F};
+    PcapRecord r;
+    TEST_ASSERT_FALSE(parsePcapRecord(huge, sizeof huge, r));
+    lora::RxInfo rx;
+    TEST_ASSERT_FALSE(parseLoraTap(junk, 10, rx));
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_hex_row);
+    RUN_TEST(test_gpx_summary);
+    RUN_TEST(test_gpx_from_elsewhere_and_not_gpx);
+    RUN_TEST(test_durations);
+    RUN_TEST(test_pcap_round_trip);
+    RUN_TEST(test_not_a_pcap);
+    return UNITY_END();
+}

test/test_ipv4/test_ipv4.cpp

@@ -0,0 +1,101 @@
+#include <unity.h>
+
+#include <string>
+
+#include "ipv4.h"
+
+using namespace roro::net;
+
+void setUp() {}
+void tearDown() {}
+
+static uint32_t ip(const char* s) {
+    uint32_t a = 0;
+    TEST_ASSERT_TRUE_MESSAGE(parseIpv4(s, a), s);
+    return a;
+}
+
+void test_parse_and_format() {
+    TEST_ASSERT_EQUAL_HEX32(0x0A27270C, ip("10.39.39.12"));
+    TEST_ASSERT_EQUAL_HEX32(0x00000000, ip("0.0.0.0"));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFFFF, ip("255.255.255.255"));
+    TEST_ASSERT_EQUAL_STRING("10.39.39.12", formatIpv4(0x0A27270C).c_str());
+    TEST_ASSERT_EQUAL_STRING("192.168.1.254", formatIpv4(ip("192.168.1.254")).c_str());
+}
+
+void test_parse_refuses() {
+    uint32_t a;
+    for (const char* bad : {"", "10.39.39", "10.39.39.12.1", "10.39.39.256", "10..39.12", "10.39.39.", ".10.39.39",
+                            "10.39.39.1a", " 10.39.39.12", "10.39.39.12 ", "1.2.3.-4", "01234.1.1.1", "1.2.3.4/24"})
+        TEST_ASSERT_FALSE_MESSAGE(parseIpv4(bad, a), bad);
+}
+
+void test_prefix_and_mask() {
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFF00, maskOf(24));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFFFFFC, maskOf(30));
+    TEST_ASSERT_EQUAL_HEX32(0x80000000, maskOf(1));
+    TEST_ASSERT_EQUAL_HEX32(0xFFFF0000, maskOf(16));
+    TEST_ASSERT_EQUAL_STRING("255.255.255.0", formatIpv4(maskOf(24)).c_str());
+}
+
+// Q111: what a Fixed setting must satisfy, and the reason given when it doesn't.
+void test_fixed_setting_accepted() {
+    TEST_ASSERT_EQUAL_STRING("", checkFixed({ip("10.39.39.13"), 24, ip("10.39.39.1")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("", checkFixed({ip("192.168.4.2"), 30, ip("192.168.4.1")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("", checkFixed({ip("10.0.0.5"), 8, 0}).c_str());  // Q107: no gateway is fine
+}
+
+void test_fixed_setting_refused() {
+    TEST_ASSERT_EQUAL_STRING("The prefix must be 1 to 30", checkFixed({ip("10.39.39.13"), 0, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The prefix must be 1 to 30", checkFixed({ip("10.39.39.13"), 31, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("10.39.39.0 is the network's own address", checkFixed({ip("10.39.39.0"), 24, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("10.39.39.255 is the broadcast address", checkFixed({ip("10.39.39.255"), 24, 0}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway 10.39.40.1 isn't in 10.39.39.0/24",
+                             checkFixed({ip("10.39.39.13"), 24, ip("10.39.40.1")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway can't be this device's address",
+                             checkFixed({ip("10.39.39.13"), 24, ip("10.39.39.13")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway 10.39.39.255 is the broadcast address",
+                             checkFixed({ip("10.39.39.13"), 24, ip("10.39.39.255")}).c_str());
+    TEST_ASSERT_EQUAL_STRING("0.0.0.0 isn't an address a device can have", checkFixed({0, 24, 0}).c_str());
+}
+
+// How a Fixed setting is typed on the console and kept in flash: "address/prefix [gateway]".
+void test_fixed_setting_as_text() {
+    FixedIp f;
+    TEST_ASSERT_EQUAL_STRING("", parseFixed("10.39.39.13/24 10.39.39.1", f).c_str());
+    TEST_ASSERT_EQUAL_HEX32(ip("10.39.39.13"), f.address);
+    TEST_ASSERT_EQUAL_UINT8(24, f.prefix);
+    TEST_ASSERT_EQUAL_HEX32(ip("10.39.39.1"), f.gateway);
+    TEST_ASSERT_EQUAL_STRING("10.39.39.13/24 10.39.39.1", formatFixed(f).c_str());
+
+    TEST_ASSERT_EQUAL_STRING("", parseFixed("192.168.4.2/30", f).c_str());
+    TEST_ASSERT_EQUAL_HEX32(0, f.gateway);
+    TEST_ASSERT_EQUAL_STRING("192.168.4.2/30", formatFixed(f).c_str());
+
+    TEST_ASSERT_EQUAL_STRING("Write it as address/prefix, then the gateway if there is one", parseFixed("10.39.39.13", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("10.39.39.300 isn't an IPv4 address", parseFixed("10.39.39.300/24", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("The prefix must be 1 to 30", parseFixed("10.39.39.13/abc", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("gw isn't an IPv4 address", parseFixed("10.39.39.13/24 gw", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("The gateway 10.39.40.1 isn't in 10.39.39.0/24", parseFixed("10.39.39.13/24 10.39.40.1", f).c_str());
+}
+
+// An NTP server is an address or a host name (Q110).
+void test_host_names() {
+    for (const char* good : {"pool.ntp.org", "time.cloudflare.com", "10.39.39.1", "ntp", "a-b.example", "0.be.pool.ntp.org"})
+        TEST_ASSERT_TRUE_MESSAGE(validHost(good), good);
+    for (const char* bad : {"", "pool .ntp.org", "-ntp.org", "ntp-.org", "ntp..org", ".ntp.org", "ntp.org.", "n_tp.org", "häst.se",
+                            "999.1.1.1", "1.2.3"})
+        TEST_ASSERT_FALSE_MESSAGE(validHost(bad), bad);
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_parse_and_format);
+    RUN_TEST(test_parse_refuses);
+    RUN_TEST(test_prefix_and_mask);
+    RUN_TEST(test_fixed_setting_accepted);
+    RUN_TEST(test_fixed_setting_refused);
+    RUN_TEST(test_fixed_setting_as_text);
+    RUN_TEST(test_host_names);
+    return UNITY_END();
+}

test/test_note_text/test_note_text.cpp

@@ -0,0 +1,288 @@
+#include <unity.h>
+
+#include <string>
+#include <vector>
+
+#include "note_text.h"
+
+using namespace roro::notes;
+
+void setUp() {}
+void tearDown() {}
+
+static void type(NoteText& t, const std::string& s) {
+    for (char c : s) TEST_ASSERT_TRUE(t.insert(static_cast<uint8_t>(c)));
+}
+
+void test_typing_and_rows() {
+    NoteText t(10, 4);
+    TEST_ASSERT_EQUAL_size_t(1, t.rows().size());  // an empty note has one empty row
+    type(t, "Hello\nworld");
+    auto rows = t.rows();
+    TEST_ASSERT_EQUAL_size_t(2, rows.size());
+    TEST_ASSERT_EQUAL_STRING("Hello", rows[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("world", rows[1].c_str());
+    TEST_ASSERT_EQUAL_INT(1, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(5, t.cursorCol());
+    t.insert('\n');
+    TEST_ASSERT_EQUAL_size_t(3, t.rows().size());  // the empty line the cursor is on
+    TEST_ASSERT_EQUAL_INT(2, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(0, t.cursorCol());
+    t.backspace();
+    t.backspace();
+    TEST_ASSERT_EQUAL_STRING("Hello\nworl", t.text().c_str());
+    TEST_ASSERT_EQUAL_STRING("Hello", t.firstLine().c_str());
+}
+
+void test_wrapping_at_spaces() {
+    NoteText t(10, 6);
+    type(t, "one two three four five");
+    auto rows = t.rows();
+    TEST_ASSERT_EQUAL_size_t(3, rows.size());
+    TEST_ASSERT_EQUAL_STRING("one two ", rows[0].c_str());  // a line owns the space it ends with
+    TEST_ASSERT_EQUAL_STRING("three four ", rows[1].c_str());  // ten characters and that space
+    TEST_ASSERT_EQUAL_STRING("five", rows[2].c_str());
+    TEST_ASSERT_EQUAL_INT(2, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(4, t.cursorCol());
+    // Every byte is on exactly one row.
+    std::string all;
+    for (auto& r : rows) all += r;
+    TEST_ASSERT_EQUAL_STRING(t.text().c_str(), all.c_str());
+}
+
+void test_a_long_word_is_cut() {
+    NoteText t(5, 6);
+    type(t, "abcdefghijkl");
+    auto rows = t.rows();
+    TEST_ASSERT_EQUAL_size_t(3, rows.size());
+    TEST_ASSERT_EQUAL_STRING("abcde", rows[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("fghij", rows[1].c_str());
+    TEST_ASSERT_EQUAL_STRING("kl", rows[2].c_str());
+}
+
+void test_left_right_over_accents() {
+    NoteText t(10, 4);
+    t.insert(0xE9);  // é
+    t.insert('t');
+    t.insert(0xE9);
+    TEST_ASSERT_EQUAL_STRING("\xC3\xA9t\xC3\xA9", t.text().c_str());
+    TEST_ASSERT_EQUAL_INT(3, t.cursorCol());
+    t.left();
+    TEST_ASSERT_EQUAL_size_t(3, t.cursor());
+    t.left();
+    t.left();
+    t.left();  // already at the start
+    TEST_ASSERT_EQUAL_size_t(0, t.cursor());
+    t.right();
+    TEST_ASSERT_EQUAL_size_t(2, t.cursor());
+    t.backspace();
+    TEST_ASSERT_EQUAL_STRING("t\xC3\xA9", t.text().c_str());
+    t.insert(0x20AC);  // €, three bytes
+    TEST_ASSERT_EQUAL_size_t(3, t.cursor());
+    t.backspace();
+    TEST_ASSERT_EQUAL_STRING("t\xC3\xA9", t.text().c_str());
+}
+
+void test_up_and_down_keep_their_column() {
+    NoteText t(20, 6);
+    TEST_ASSERT_TRUE(t.setText("a long first line\nab\n\nanother long line"));
+    t.lineEnd();
+    TEST_ASSERT_EQUAL_INT(17, t.cursorCol());
+    t.down();  // a short line: as far right as it goes
+    TEST_ASSERT_EQUAL_INT(1, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(2, t.cursorCol());
+    t.down();  // an empty one
+    TEST_ASSERT_EQUAL_INT(0, t.cursorCol());
+    t.down();  // and back out to the column it came from
+    TEST_ASSERT_EQUAL_INT(3, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(17, t.cursorCol());
+    t.down();  // the last line: stays
+    TEST_ASSERT_EQUAL_INT(3, t.cursorRow());
+    t.up();
+    t.up();
+    t.up();
+    TEST_ASSERT_EQUAL_INT(0, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(17, t.cursorCol());
+    t.up();  // the first line: stays
+    TEST_ASSERT_EQUAL_INT(0, t.cursorRow());
+    t.left();  // moving sideways forgets the column
+    t.down();
+    TEST_ASSERT_EQUAL_INT(2, t.cursorCol());
+    t.down();
+    t.down();
+    TEST_ASSERT_EQUAL_INT(16, t.cursorCol());
+}
+
+void test_up_and_down_through_wrapped_lines() {
+    NoteText t(10, 6);
+    TEST_ASSERT_TRUE(t.setText("one two three four five\nend"));
+    // "one two " / "three four " / "five" / "end"
+    t.toEnd();
+    TEST_ASSERT_EQUAL_INT(3, t.cursorRow());
+    t.up();
+    TEST_ASSERT_EQUAL_INT(2, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(3, t.cursorCol());
+    t.up();
+    TEST_ASSERT_EQUAL_INT(1, t.cursorRow());
+    t.lineEnd();  // on the space the line ends with, not past it
+    TEST_ASSERT_EQUAL_INT(1, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(10, t.cursorCol());
+    t.right();  // one more is the start of the next line
+    TEST_ASSERT_EQUAL_INT(2, t.cursorRow());
+    TEST_ASSERT_EQUAL_INT(0, t.cursorCol());
+    t.lineStart();
+    t.left();
+    TEST_ASSERT_EQUAL_INT(1, t.cursorRow());
+    t.lineStart();
+    TEST_ASSERT_EQUAL_INT(0, t.cursorCol());
+    TEST_ASSERT_EQUAL_size_t(8, t.cursor());
+}
+
+void test_a_final_newline_gives_a_last_empty_line() {
+    NoteText t(10, 6);
+    TEST_ASSERT_TRUE(t.setText("ab\n"));
+    TEST_ASSERT_EQUAL_size_t(2, t.rows().size());
+    t.down();
+    TEST_ASSERT_EQUAL_size_t(3, t.cursor());
+    TEST_ASSERT_EQUAL_INT(1, t.cursorRow());
+    t.down();
+    TEST_ASSERT_EQUAL_size_t(3, t.cursor());
+    t.up();
+    TEST_ASSERT_EQUAL_size_t(0, t.cursor());
+    t.lineEnd();
+    TEST_ASSERT_EQUAL_size_t(2, t.cursor());
+}
+
+void test_the_screen_follows_the_cursor() {
+    NoteText t(10, 3);
+    std::string text;
+    for (int i = 0; i < 20; i++) text += "line " + std::to_string(i) + "\n";
+    TEST_ASSERT_TRUE(t.setText(text));
+    TEST_ASSERT_EQUAL_STRING("line 0", t.rows()[0].c_str());
+    for (int i = 0; i < 5; i++) t.down();
+    auto rows = t.rows();
+    TEST_ASSERT_EQUAL_STRING("line 3", rows[0].c_str());  // scrolled a line at a time
+    TEST_ASSERT_EQUAL_STRING("line 5", rows[2].c_str());
+    TEST_ASSERT_EQUAL_INT(2, t.cursorRow());
+    t.up();
+    t.up();
+    t.up();
+    TEST_ASSERT_EQUAL_STRING("line 2", t.rows()[0].c_str());
+    TEST_ASSERT_EQUAL_INT(0, t.cursorRow());
+    t.toEnd();
+    rows = t.rows();
+    TEST_ASSERT_EQUAL_size_t(3, rows.size());
+    TEST_ASSERT_EQUAL_STRING("line 18", rows[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("", rows[2].c_str());
+    TEST_ASSERT_EQUAL_INT(2, t.cursorRow());
+    t.toStart();
+    TEST_ASSERT_EQUAL_STRING("line 0", t.rows()[0].c_str());
+    t.pageDown();
+    TEST_ASSERT_EQUAL_size_t(14, t.cursor());  // two lines down
+    t.pageUp();
+    TEST_ASSERT_EQUAL_size_t(0, t.cursor());
+    TEST_ASSERT_TRUE(t.percent() == 0);
+}
+
+// Deleting above the screen must not leave the screen starting in the middle of a line.
+void test_edits_keep_the_screen_on_line_starts() {
+    NoteText t(10, 3);
+    TEST_ASSERT_TRUE(t.setText("aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii jjjj"));
+    t.toEnd();
+    t.rows();
+    for (int i = 0; i < 30; i++) {
+        t.backspace();
+        auto rows = t.rows();
+        TEST_ASSERT_TRUE(rows.size() <= 3);
+        int row = t.cursorRow();
+        TEST_ASSERT_TRUE(row >= 0 && row < static_cast<int>(rows.size()));
+        std::string all;
+        for (auto& r : rows) all += r;
+        TEST_ASSERT_TRUE(t.text().size() >= all.size());
+        TEST_ASSERT_EQUAL_STRING(t.text().substr(t.text().size() - all.size()).c_str(), all.c_str());
+    }
+}
+
+void test_full_and_too_big() {
+    NoteText t(38, 8);
+    TEST_ASSERT_FALSE(t.setText(std::string(NoteText::kMaxBytes + 1, 'x')));
+    TEST_ASSERT_TRUE(t.setText(std::string(NoteText::kMaxBytes - 1, 'x')));
+    uint32_t before = t.revision();
+    t.toEnd();
+    TEST_ASSERT_FALSE(t.insert(0xE9));  // two bytes: one too many
+    TEST_ASSERT_FALSE(t.insertText("  "));
+    TEST_ASSERT_EQUAL_UINT32(before, t.revision());
+    TEST_ASSERT_TRUE(t.insert('y'));
+    TEST_ASSERT_FALSE(t.insert('z'));
+    TEST_ASSERT_TRUE(t.revision() != before);
+    // One paragraph of 16 KB: moving through it still works.
+    t.up();
+    t.up();
+    t.lineStart();
+    TEST_ASSERT_EQUAL_size_t((NoteText::kMaxBytes / 38 - 2) * 38, t.cursor());  // two rows of 38 above the last
+}
+
+void test_crlf_becomes_lf() {
+    NoteText t(38, 8);
+    TEST_ASSERT_TRUE(t.setText("a\r\nb\r\n\rc"));
+    TEST_ASSERT_EQUAL_STRING("a\nb\n\rc", t.text().c_str());
+}
+
+// The device hands over the string it read the file into: no second copy, and never a bigger
+// buffer afterwards, whatever is typed.
+void test_adopting_a_buffer_never_reallocates() {
+    std::string body;
+    body.reserve(NoteText::kMaxBytes);
+    body = "one\r\ntwo\r\n";
+    const char* buffer = body.data();
+    NoteText t(38, 8, std::move(body));
+    TEST_ASSERT_EQUAL_STRING("one\ntwo\n", t.text().c_str());
+    TEST_ASSERT_EQUAL_PTR(buffer, t.text().data());
+    t.toEnd();
+    while (t.insert('x')) {}
+    TEST_ASSERT_EQUAL_size_t(NoteText::kMaxBytes, t.text().size());
+    TEST_ASSERT_EQUAL_PTR(buffer, t.text().data());
+    TEST_ASSERT_TRUE(t.setText("replaced"));
+    TEST_ASSERT_EQUAL_PTR(buffer, t.text().data());
+    NoteText fresh(38, 8);
+    const char* own = fresh.text().data();
+    while (fresh.insert('y')) {}
+    TEST_ASSERT_EQUAL_PTR(own, fresh.text().data());
+}
+
+void test_names() {
+    TEST_ASSERT_EQUAL_STRING("shopping-list", nameFromFirstLine("Shopping list!", "x").c_str());
+    TEST_ASSERT_EQUAL_STRING("ete-a-la-plage-2026", nameFromFirstLine("  \xC3\x89t\xC3\xA9 \xC3\xA0 la plage (2026)", "x").c_str());
+    TEST_ASSERT_EQUAL_STRING("note-20261006-0919", nameFromFirstLine("", "20261006-0919").c_str());
+    TEST_ASSERT_EQUAL_STRING("note-20261006-0919", nameFromFirstLine("\xE2\x82\xAC ?!", "20261006-0919").c_str());
+    TEST_ASSERT_TRUE(nameFromFirstLine(std::string(100, 'a'), "x").size() <= 33);
+    TEST_ASSERT_EQUAL_STRING("strase", nameFromFirstLine("Stra\xC3\x9F" "e", "x").c_str());
+}
+
+void test_titles() {
+    TEST_ASSERT_EQUAL_STRING("Shopping list", titleFrom("\n  \r\n  Shopping list  \r\nmilk\n", 24).c_str());
+    TEST_ASSERT_EQUAL_STRING("abcde", titleFrom("abcdefgh", 5).c_str());
+    TEST_ASSERT_EQUAL_STRING("\xC3\xA9t", titleFrom("\xC3\xA9t\xC3", 24).c_str());  // a character cut by the end of what was read
+    TEST_ASSERT_EQUAL_STRING("\xC3\xA9", titleFrom("\xC3\xA9t\xC3\xA9", 1).c_str());
+    TEST_ASSERT_EQUAL_STRING("", titleFrom(" \n\n", 24).c_str());
+    TEST_ASSERT_EQUAL_STRING("", titleFrom("", 24).c_str());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_typing_and_rows);
+    RUN_TEST(test_wrapping_at_spaces);
+    RUN_TEST(test_a_long_word_is_cut);
+    RUN_TEST(test_left_right_over_accents);
+    RUN_TEST(test_up_and_down_keep_their_column);
+    RUN_TEST(test_up_and_down_through_wrapped_lines);
+    RUN_TEST(test_a_final_newline_gives_a_last_empty_line);
+    RUN_TEST(test_the_screen_follows_the_cursor);
+    RUN_TEST(test_edits_keep_the_screen_on_line_starts);
+    RUN_TEST(test_full_and_too_big);
+    RUN_TEST(test_crlf_becomes_lf);
+    RUN_TEST(test_adopting_a_buffer_never_reallocates);
+    RUN_TEST(test_names);
+    RUN_TEST(test_titles);
+    return UNITY_END();
+}

test/test_power/test_power.cpp

@@ -31,6 +31,15 @@ void test_key_on_off_screen_only_wakes() {
     TEST_ASSERT_EQUAL(static_cast<int>(ScreenState::On), static_cast<int>(p.update(70001)));
 }
 
+// A key stamped a few milliseconds after the time the same pass updates with must not read as
+// 49 days of idleness: the screen stays on, and the next key acts.
+void test_activity_stamped_after_the_pass_time_keeps_the_screen_on() {
+    PowerPolicy p(30000, 60000);
+    TEST_ASSERT_FALSE(p.activity(10003));
+    TEST_ASSERT_TRUE(p.update(10000) == ScreenState::On);
+    TEST_ASSERT_FALSE(p.activity(10050));
+}
+
 void test_new_timeouts_apply_immediately() {
     PowerPolicy p(30000, 60000);
     p.activity(0);
@@ -91,6 +100,7 @@ int main() {
     RUN_TEST(test_screen_dims_then_turns_off_after_inactivity);
     RUN_TEST(test_key_on_dimmed_screen_wakes_and_still_acts);
     RUN_TEST(test_key_on_off_screen_only_wakes);
+    RUN_TEST(test_activity_stamped_after_the_pass_time_keeps_the_screen_on);
     RUN_TEST(test_new_timeouts_apply_immediately);
     RUN_TEST(test_notification_lights_an_off_screen_dimmed_until_it_ends);
     RUN_TEST(test_notification_does_not_count_as_activity);

test/test_saved_networks/test_saved_networks.cpp

@@ -97,6 +97,76 @@ void test_find() {
     TEST_ASSERT_NULL(n.find("other"));
 }
 
+// S1, Q105: each Saved Network is Automatic (DHCP) or Fixed, and remembers which.
+void test_new_network_is_automatic() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("home", "password1");
+    TEST_ASSERT_FALSE(nets.find("home")->fixed);
+}
+
+void test_ip_setting_survives_reload() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("home", "password1");
+    nets.add("bench", "");
+    roro::net::FixedIp f;
+    TEST_ASSERT_EQUAL_STRING("", roro::net::parseFixed("10.39.39.13/24 10.39.39.1", f).c_str());
+    TEST_ASSERT_EQUAL_STRING("", nets.setIp("bench", &f).c_str());
+
+    SavedNetworks again(store);
+    again.load();
+    TEST_ASSERT_FALSE(again.find("home")->fixed);
+    TEST_ASSERT_TRUE(again.find("bench")->fixed);
+    TEST_ASSERT_EQUAL_STRING("10.39.39.13/24 10.39.39.1", roro::net::formatFixed(again.find("bench")->ip).c_str());
+
+    TEST_ASSERT_EQUAL_STRING("", again.setIp("bench", nullptr).c_str());  // back to Automatic
+    SavedNetworks third(store);
+    third.load();
+    TEST_ASSERT_FALSE(third.find("bench")->fixed);
+}
+
+void test_ip_setting_is_checked() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("bench", "");
+    roro::net::FixedIp bad{0x0A272700, 24, 0};  // 10.39.39.0: the network's own address
+    TEST_ASSERT_EQUAL_STRING("10.39.39.0 is the network's own address", nets.setIp("bench", &bad).c_str());
+    TEST_ASSERT_FALSE(nets.find("bench")->fixed);
+    roro::net::FixedIp ok{0x0A27270D, 24, 0};
+    TEST_ASSERT_EQUAL_STRING("Not a saved network", nets.setIp("nowhere", &ok).c_str());
+}
+
+// Forgetting a network moves the ones after it: each keeps its own setting.
+void test_ip_setting_follows_its_network() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("a", "");
+    nets.add("b", "");
+    nets.add("c", "");
+    roro::net::FixedIp f{0x0A27270D, 24, 0};
+    nets.setIp("c", &f);
+    nets.forget("a");
+    SavedNetworks again(store);
+    again.load();
+    TEST_ASSERT_FALSE(again.find("b")->fixed);
+    TEST_ASSERT_TRUE(again.find("c")->fixed);
+    // And changing the password keeps it.
+    again.add("c", "password2");
+    TEST_ASSERT_TRUE(again.find("c")->fixed);
+}
+
+// A stored setting that no longer passes the checks falls back to Automatic.
+void test_bad_stored_ip_setting_is_ignored() {
+    MemoryStore store;
+    SavedNetworks nets(store);
+    nets.add("bench", "");
+    store.strings["net0_ip"] = "10.39.39.13/99";
+    SavedNetworks again(store);
+    again.load();
+    TEST_ASSERT_FALSE(again.find("bench")->fixed);
+}
+
 int main() {
     UNITY_BEGIN();
     RUN_TEST(test_empty_store_has_no_networks);
@@ -107,5 +177,10 @@ int main() {
     RUN_TEST(test_validation_follows_wifi_limits);
     RUN_TEST(test_hidden_flag_survives_reload);
     RUN_TEST(test_find);
+    RUN_TEST(test_new_network_is_automatic);
+    RUN_TEST(test_ip_setting_survives_reload);
+    RUN_TEST(test_ip_setting_is_checked);
+    RUN_TEST(test_ip_setting_follows_its_network);
+    RUN_TEST(test_bad_stored_ip_setting_is_ignored);
     return UNITY_END();
 }

test/test_settings/test_settings.cpp

@@ -154,6 +154,37 @@ void test_storage_keys_fit_nvs_limit() {
         TEST_ASSERT_TRUE(std::strlen(Settings::key(static_cast<Setting>(i))) <= 15);
 }
 
+// S1, Q108 to Q110: DNS and NTP servers, with public defaults.
+void test_dns_and_ntp_defaults() {
+    MemoryStore store;
+    EventBus bus;
+    Settings s(store, bus);
+    s.load();
+    TEST_ASSERT_EQUAL_STRING("9.9.9.9", s.getString(Setting::Dns1).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.1.1.1", s.getString(Setting::Dns2).c_str());
+    TEST_ASSERT_FALSE(s.getBool(Setting::DnsAlways));
+    TEST_ASSERT_EQUAL_STRING("pool.ntp.org", s.getString(Setting::Ntp1).c_str());
+    TEST_ASSERT_EQUAL_STRING("time.cloudflare.com", s.getString(Setting::Ntp2).c_str());
+}
+
+void test_dns_and_ntp_are_checked() {
+    MemoryStore store;
+    EventBus bus;
+    Settings s(store, bus);
+    s.load();
+    TEST_ASSERT_TRUE(s.setString(Setting::Dns1, "10.39.39.1"));
+    TEST_ASSERT_FALSE(s.setString(Setting::Dns1, "dns.example"));  // an address, not a name
+    TEST_ASSERT_FALSE(s.setString(Setting::Dns1, ""));             // the first one is required
+    TEST_ASSERT_EQUAL_STRING("10.39.39.1", s.getString(Setting::Dns1).c_str());
+    TEST_ASSERT_TRUE(s.setString(Setting::Dns2, ""));              // the second is optional
+    TEST_ASSERT_FALSE(s.setString(Setting::Dns2, "1.1.1"));
+    TEST_ASSERT_TRUE(s.setString(Setting::Ntp1, "10.39.39.1"));
+    TEST_ASSERT_TRUE(s.setString(Setting::Ntp1, "0.be.pool.ntp.org"));
+    TEST_ASSERT_FALSE(s.setString(Setting::Ntp1, "time server"));
+    TEST_ASSERT_FALSE(s.setString(Setting::Ntp1, ""));
+    TEST_ASSERT_TRUE(s.setString(Setting::Ntp2, ""));
+}
+
 int main() {
     UNITY_BEGIN();
     RUN_TEST(test_defaults_when_store_is_empty);
@@ -168,5 +199,7 @@ int main() {
     RUN_TEST(test_change_publishes_setting_changed_once);
     RUN_TEST(test_transmit_requires_confirmed_region);
     RUN_TEST(test_storage_keys_fit_nvs_limit);
+    RUN_TEST(test_dns_and_ntp_defaults);
+    RUN_TEST(test_dns_and_ntp_are_checked);
     return UNITY_END();
 }

test/test_settings_menu/test_settings_menu.cpp

@@ -107,6 +107,19 @@ void test_names_are_text_rows_with_their_byte_limits() {
     TEST_ASSERT_EQUAL_STRING("RORO", f.menu.value(shortName).c_str());
 }
 
+// Issue #20: the GNSS receiver raises the LoRa radio's noise floor by 8 dB while it runs. Pausing
+// it while the radio listens is offered, and off unless chosen (GNSS on by default: M2, Q58).
+void test_pause_gnss_for_lora_is_off_by_default() {
+    Fixture f;
+    int quiet = f.row(SettingsMenu::Row::GnssQuiet);
+    TEST_ASSERT_EQUAL_STRING("Pause GNSS for LoRa", f.menu.label(quiet).c_str());
+    TEST_ASSERT_EQUAL_STRING("Off", f.menu.value(quiet).c_str());
+    f.menu.toggle(quiet);
+    TEST_ASSERT_TRUE(f.settings.getBool(Setting::GnssQuietForLora));
+    TEST_ASSERT_EQUAL_STRING("On", f.menu.value(quiet).c_str());
+    TEST_ASSERT_TRUE(f.settings.getBool(Setting::GnssEnabled));  // the GNSS switch itself is untouched
+}
+
 void test_gnss_and_coordinate_rows_toggle() {
     Fixture f;
     int gnss = f.row(SettingsMenu::Row::Gnss), coords = f.row(SettingsMenu::Row::Coordinates);
@@ -131,6 +144,7 @@ int main() {
     RUN_TEST(test_brightness_steps_with_left_right_within_bounds);
     RUN_TEST(test_wifi_is_a_page);
     RUN_TEST(test_names_are_text_rows_with_their_byte_limits);
+    RUN_TEST(test_pause_gnss_for_lora_is_off_by_default);
     RUN_TEST(test_gnss_and_coordinate_rows_toggle);
     return UNITY_END();
 }

test/test_task_stats/test_task_stats.cpp

@@ -0,0 +1,160 @@
+#include <unity.h>
+
+#include <vector>
+
+#include "task_stats.h"
+
+using namespace roro;
+
+void setUp() {}
+void tearDown() {}
+
+static TaskSample task(uint32_t id, const char* name, uint32_t runtime, uint16_t stackFree = 2000, int core = 1) {
+    TaskSample t;
+    t.id = id;
+    std::snprintf(t.name, sizeof t.name, "%s", name);
+    t.runtime = runtime;
+    t.stackFree = stackFree;
+    t.core = static_cast<int8_t>(core);
+    t.state = 2;  // blocked, unless a test says it's the one running
+    return t;
+}
+
+static const TaskRow* find(const std::vector<TaskRow>& rows, const char* name) {
+    for (auto& r : rows)
+        if (r.name == name) return &r;
+    return nullptr;
+}
+
+// Q119: a task's share is its run time over the interval between two samples, in tenths of a percent.
+void test_shares_over_the_interval() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 5000000), task(2, "IDLE1", 1000000), task(3, "IDLE0", 4000000, 240, 0),
+                                      task(4, "wifi", 900000, 4000, 0)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 5810000), task(2, "IDLE1", 1170000), task(3, "IDLE0", 4780000, 240, 0),
+                                   task(4, "wifi", 1090000, 4000, 0)};
+    auto rows = taskRows(before, 10000000, now, 11000000);  // one second later
+    TEST_ASSERT_EQUAL_size_t(4, rows.size());
+    TEST_ASSERT_EQUAL_UINT16(810, find(rows, "loopTask")->permille);
+    TEST_ASSERT_EQUAL_UINT16(170, find(rows, "IDLE1")->permille);
+    TEST_ASSERT_EQUAL_UINT16(780, find(rows, "IDLE0")->permille);
+    TEST_ASSERT_EQUAL_UINT16(190, find(rows, "wifi")->permille);
+    // A core's load is what its idle task didn't use.
+    TEST_ASSERT_EQUAL_INT(22, coreLoad(rows, 0));
+    TEST_ASSERT_EQUAL_INT(83, coreLoad(rows, 1));
+    TEST_ASSERT_EQUAL_INT(-1, coreLoad(rows, 2));
+}
+
+// FreeRTOS adds to a task's run time when it's switched out. The task doing the sampling is
+// running: if nothing else wanted its core, it was never switched out and its counter hardly
+// moved. Its real share is what's left of its core.
+void test_the_running_task_gets_what_is_left_of_its_core() {
+    auto running = [](TaskSample t) {
+        t.state = 0;  // eRunning
+        return t;
+    };
+    std::vector<TaskSample> before = {running(task(1, "loopTask", 5000000)), task(2, "IDLE1", 1000000), task(3, "radio", 100),
+                                      task(4, "IDLE0", 4000000, 240, 0), task(5, "wifi", 900000, 4000, 0)};
+    std::vector<TaskSample> now = {running(task(1, "loopTask", 5020000)), task(2, "IDLE1", 1000000), task(3, "radio", 30100),
+                                   task(4, "IDLE0", 4980000, 240, 0), task(5, "wifi", 910000, 4000, 0)};
+    auto rows = taskRows(before, 0, now, 1000000);
+    TEST_ASSERT_EQUAL_UINT16(970, find(rows, "loopTask")->permille);  // not the 2 % its counter says
+    TEST_ASSERT_EQUAL_UINT16(30, find(rows, "radio")->permille);
+    TEST_ASSERT_EQUAL_UINT16(10, find(rows, "wifi")->permille);  // another core: untouched
+    TEST_ASSERT_EQUAL_INT(100, coreLoad(rows, 1));
+    TEST_ASSERT_EQUAL_INT(2, coreLoad(rows, 0));
+}
+
+// When its counter did keep up (it was switched out often), nothing is added.
+void test_the_running_task_keeps_its_own_count_when_it_is_higher() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 0), task(2, "IDLE1", 0)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 600000), task(2, "IDLE1", 400000)};
+    now[0].state = before[0].state = 0;
+    auto rows = taskRows(before, 0, now, 1000000);
+    TEST_ASSERT_EQUAL_UINT16(600, find(rows, "loopTask")->permille);
+}
+
+// The counters are 32-bit microseconds: they wrap every 71 minutes.
+void test_counters_wrap() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 0xFFFFF000u)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 0x0007A120u - 0x1000u)};  // 500 ms of run time later
+    auto rows = taskRows(before, 0xFFFF0000u, now, 0xFFFF0000u + 1000000u);
+    TEST_ASSERT_EQUAL_UINT16(500, rows[0].permille);
+}
+
+void test_tasks_come_and_go() {
+    std::vector<TaskSample> before = {task(1, "loopTask", 100), task(7, "gemini", 50000)};
+    std::vector<TaskSample> now = {task(1, "loopTask", 400100), task(9, "gemini", 30000)};  // a new gemini task: another id
+    auto rows = taskRows(before, 0, now, 1000000);
+    TEST_ASSERT_EQUAL_size_t(2, rows.size());
+    TEST_ASSERT_EQUAL_UINT16(400, find(rows, "loopTask")->permille);
+    TEST_ASSERT_EQUAL_UINT16(30, find(rows, "gemini")->permille);  // all its run time is inside the interval
+}
+
+void test_no_time_passed() {
+    std::vector<TaskSample> one = {task(1, "loopTask", 100)};
+    auto rows = taskRows(one, 500, one, 500);
+    TEST_ASSERT_EQUAL_UINT16(0, rows[0].permille);
+    TEST_ASSERT_EQUAL_INT(-1, coreLoad(rows, 1));  // no idle task in the sample
+}
+
+// Q122: under 512 bytes of stack left is flagged.
+void test_low_stack() {
+    std::vector<TaskSample> s = {task(1, "spk_task", 0, 264), task(2, "IDLE0", 0, 240, 0), task(3, "radio", 0, 2360),
+                                 task(4, "edge", 0, 512)};
+    auto rows = taskRows(s, 0, s, 1000);
+    TEST_ASSERT_TRUE(find(rows, "spk_task")->lowStack);
+    TEST_ASSERT_TRUE(find(rows, "IDLE0")->lowStack);
+    TEST_ASSERT_FALSE(find(rows, "radio")->lowStack);
+    TEST_ASSERT_FALSE(find(rows, "edge")->lowStack);
+}
+
+void test_sorting() {
+    std::vector<TaskSample> before = {task(1, "wifi", 0, 4000), task(2, "loopTask", 0, 2800), task(3, "IDLE0", 0, 240),
+                                      task(4, "irc", 0, 3600)};
+    std::vector<TaskSample> now = {task(1, "wifi", 190000, 4000), task(2, "loopTask", 810000, 2800), task(3, "IDLE0", 780000, 240),
+                                   task(4, "irc", 0, 3600)};
+    auto rows = taskRows(before, 0, now, 1000000);
+    sortTasks(rows, TaskSort::Share);  // busiest first, idle tasks last: they're what's left over
+    TEST_ASSERT_EQUAL_STRING("loopTask", rows[0].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("wifi", rows[1].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("irc", rows[2].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("IDLE0", rows[3].name.c_str());
+    sortTasks(rows, TaskSort::Stack);  // least stack left first
+    TEST_ASSERT_EQUAL_STRING("IDLE0", rows[0].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("loopTask", rows[1].name.c_str());
+    sortTasks(rows, TaskSort::Name);  // letters only, whatever the case
+    TEST_ASSERT_EQUAL_STRING("IDLE0", rows[0].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("irc", rows[1].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("loopTask", rows[2].name.c_str());
+    TEST_ASSERT_EQUAL_STRING("wifi", rows[3].name.c_str());
+}
+
+// Q120: two minutes of history, the oldest sample dropped first.
+void test_history() {
+    History<uint8_t, 4> h;
+    TEST_ASSERT_EQUAL_size_t(0, h.size());
+    for (uint8_t v : {10, 20, 30}) h.push(v);
+    TEST_ASSERT_EQUAL_size_t(3, h.size());
+    TEST_ASSERT_EQUAL_UINT8(10, h.at(0));
+    TEST_ASSERT_EQUAL_UINT8(30, h.at(2));
+    for (uint8_t v : {40, 50, 60}) h.push(v);
+    TEST_ASSERT_EQUAL_size_t(4, h.size());
+    TEST_ASSERT_EQUAL_UINT8(30, h.at(0));  // oldest kept
+    TEST_ASSERT_EQUAL_UINT8(60, h.at(3));  // newest
+    h.clear();
+    TEST_ASSERT_EQUAL_size_t(0, h.size());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_shares_over_the_interval);
+    RUN_TEST(test_the_running_task_gets_what_is_left_of_its_core);
+    RUN_TEST(test_the_running_task_keeps_its_own_count_when_it_is_higher);
+    RUN_TEST(test_counters_wrap);
+    RUN_TEST(test_tasks_come_and_go);
+    RUN_TEST(test_no_time_passed);
+    RUN_TEST(test_low_stack);
+    RUN_TEST(test_sorting);
+    RUN_TEST(test_history);
+    return UNITY_END();
+}

test/test_text_pager/test_text_pager.cpp

@@ -0,0 +1,156 @@
+#include <unity.h>
+
+#include <algorithm>
+#include <cstring>
+#include <string>
+
+#include "text_pager.h"
+
+using namespace roro::files;
+
+void setUp() {}
+void tearDown() {}
+
+static int reads = 0;
+static size_t biggestRead = 0;
+
+static TextPager pagerFor(const std::string& text, int cols, int rows) {
+    return TextPager(
+        [&text](uint32_t offset, uint8_t* into, size_t len) {
+            reads++;
+            biggestRead = std::max(biggestRead, len);
+            if (offset >= text.size()) return static_cast<size_t>(0);
+            size_t n = std::min(len, text.size() - offset);
+            std::memcpy(into, text.data() + offset, n);
+            return n;
+        },
+        static_cast<uint32_t>(text.size()), cols, rows);
+}
+
+void test_lines_and_wrapping() {
+    std::string text = "one\r\ntwo words that are too long\n\nlast";
+    TextPager p = pagerFor(text, 10, 8);
+    auto lines = p.lines();
+    TEST_ASSERT_EQUAL_size_t(6, lines.size());
+    TEST_ASSERT_EQUAL_STRING("one", lines[0].c_str());  // the \r is dropped
+    TEST_ASSERT_EQUAL_STRING("two words", lines[1].c_str());
+    TEST_ASSERT_EQUAL_STRING("that are", lines[2].c_str());
+    TEST_ASSERT_EQUAL_STRING("too long", lines[3].c_str());
+    TEST_ASSERT_EQUAL_STRING("", lines[4].c_str());
+    TEST_ASSERT_EQUAL_STRING("last", lines[5].c_str());
+    TEST_ASSERT_TRUE(p.atEnd());
+}
+
+void test_a_word_too_long_is_cut_and_a_space_at_the_edge_is_eaten() {
+    std::string text = "abcdefghijklmno\nabcde fghij klm";
+    TextPager p = pagerFor(text, 5, 8);
+    auto lines = p.lines();
+    TEST_ASSERT_EQUAL_STRING("abcde", lines[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("fghij", lines[1].c_str());
+    TEST_ASSERT_EQUAL_STRING("klmno", lines[2].c_str());
+    TEST_ASSERT_EQUAL_STRING("abcde", lines[3].c_str());
+    TEST_ASSERT_EQUAL_STRING("fghij", lines[4].c_str());
+    TEST_ASSERT_EQUAL_STRING("klm", lines[5].c_str());
+}
+
+void test_accents_count_as_one_column_and_tabs_show_as_spaces() {
+    std::string text = "\xC3\xA9t\xC3\xA9 ici\n\ta\x01";
+    TextPager p = pagerFor(text, 3, 4);
+    auto lines = p.lines();
+    TEST_ASSERT_EQUAL_STRING("\xC3\xA9t\xC3\xA9", lines[0].c_str());
+    TEST_ASSERT_EQUAL_STRING("ici", lines[1].c_str());
+    TEST_ASSERT_EQUAL_STRING(" a.", lines[2].c_str());
+}
+
+// Scrolling down to the end and back up passes through the same line starts.
+void test_up_undoes_down() {
+    std::string text;
+    for (int i = 0; i < 300; i++) {
+        text += "line " + std::to_string(i) + " with some words to wrap around the edge of the screen";
+        text += i % 7 == 0 ? "\n\n" : "\n";
+    }
+    text += "a paragraph without any newline for a long while ";
+    for (int i = 0; i < 200; i++) text += "word" + std::to_string(i) + " ";
+    text += "\nthe end";
+    TextPager p = pagerFor(text, 38, 9);
+    std::vector<uint32_t> tops;
+    for (int guard = 0; guard < 5000 && !p.atEnd(); guard++) {
+        tops.push_back(p.top());
+        p.down();
+    }
+    TEST_ASSERT_TRUE(p.atEnd());
+    TEST_ASSERT_TRUE(tops.size() > 500);
+    TEST_ASSERT_EQUAL_STRING("the end", p.lines().back().c_str());
+    // Inside the long paragraph (further than the look-back from its start) lines may wrap from
+    // another place on the way up. Before it, every line start met on the way down is met again.
+    size_t paragraph = text.find("a paragraph without");
+    size_t expected = 0, met = 0;
+    for (uint32_t t : tops) expected += t <= paragraph;
+    for (int guard = 0; guard < 5000 && p.top() > 0; guard++) {
+        p.up();
+        if (p.top() > paragraph) continue;
+        TEST_ASSERT_TRUE(std::binary_search(tops.begin(), tops.end(), p.top()));
+        met++;
+    }
+    TEST_ASSERT_EQUAL_size_t(expected, met);
+    TEST_ASSERT_EQUAL_UINT32(0, p.top());
+    p.up();
+    TEST_ASSERT_EQUAL_UINT32(0, p.top());
+}
+
+void test_to_end_shows_the_last_lines() {
+    std::string text;
+    for (int i = 0; i < 100; i++) text += "20:0" + std::to_string(i % 10) + " <a> message " + std::to_string(i) + "\n";
+    TextPager p = pagerFor(text, 38, 9);
+    p.toEnd();
+    auto lines = p.lines();
+    TEST_ASSERT_EQUAL_size_t(9, lines.size());
+    TEST_ASSERT_EQUAL_STRING("20:09 <a> message 99", lines[8].c_str());
+    TEST_ASSERT_EQUAL_STRING("20:01 <a> message 91", lines[0].c_str());
+    TEST_ASSERT_TRUE(p.atEnd());
+    p.down();  // nowhere to go
+    TEST_ASSERT_EQUAL_STRING("20:01 <a> message 91", p.lines()[0].c_str());
+    TEST_ASSERT_TRUE(p.percent() > 80);
+}
+
+void test_a_megabyte_is_read_a_kilobyte_at_a_time() {
+    std::string text;
+    while (text.size() < 1024 * 1024) text += "2026-10-05 20:00:00 <someone> says something here\n";
+    reads = 0;
+    biggestRead = 0;
+    TextPager p = pagerFor(text, 38, 9);
+    p.toEnd();
+    TEST_ASSERT_EQUAL_size_t(9, p.lines().size());
+    p.up(20);
+    p.down(5);
+    TEST_ASSERT_TRUE(biggestRead <= 1024);
+    TEST_ASSERT_TRUE(reads < 20);
+    p.toStart();
+    TEST_ASSERT_EQUAL_STRING("2026-10-05 20:00:00 <someone> says", p.lines()[0].c_str());
+}
+
+void test_empty_and_short_files() {
+    std::string empty;
+    TextPager p = pagerFor(empty, 38, 9);
+    TEST_ASSERT_EQUAL_size_t(0, p.lines().size());
+    p.down();
+    p.up();
+    p.toEnd();
+    TEST_ASSERT_TRUE(p.atEnd());
+    std::string one = "no newline";
+    TextPager q = pagerFor(one, 38, 9);
+    q.toEnd();
+    TEST_ASSERT_EQUAL_STRING("no newline", q.lines()[0].c_str());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_lines_and_wrapping);
+    RUN_TEST(test_a_word_too_long_is_cut_and_a_space_at_the_edge_is_eaten);
+    RUN_TEST(test_accents_count_as_one_column_and_tabs_show_as_spaces);
+    RUN_TEST(test_up_undoes_down);
+    RUN_TEST(test_to_end_shows_the_last_lines);
+    RUN_TEST(test_a_megabyte_is_read_a_kilobyte_at_a_time);
+    RUN_TEST(test_empty_and_short_files);
+    return UNITY_END();
+}

test/test_traffic/test_traffic.cpp

@@ -0,0 +1,54 @@
+#include <unity.h>
+
+#include "traffic.h"
+
+using namespace roro::net;
+
+void setUp() { resetTraffic(); }
+void tearDown() {}
+
+void test_counts_per_service() {
+    received(User::Irc, 100);
+    received(User::Irc, 20);
+    sent(User::Irc, 7);
+    sent(User::Gemini, 40);
+    TEST_ASSERT_EQUAL_UINT32(120, traffic(User::Irc).in);
+    TEST_ASSERT_EQUAL_UINT32(7, traffic(User::Irc).out);
+    TEST_ASSERT_EQUAL_UINT32(0, traffic(User::Gemini).in);
+    TEST_ASSERT_EQUAL_UINT32(40, traffic(User::Gemini).out);
+    TEST_ASSERT_EQUAL_UINT32(0, traffic(User::Updates).in);
+}
+
+void test_names() {
+    TEST_ASSERT_EQUAL_STRING("IRC", userName(User::Irc));
+    TEST_ASSERT_EQUAL_STRING("Gemini", userName(User::Gemini));
+    TEST_ASSERT_EQUAL_STRING("Debug Console", userName(User::DebugConsole));
+    TEST_ASSERT_EQUAL_STRING("Updates", userName(User::Updates));
+}
+
+// Bytes a second between two readings; the counter wraps at 4 GB like any uint32.
+void test_rate() {
+    TEST_ASSERT_EQUAL_UINT32(1000, bytesPerSecond(5000, 6000, 1000));
+    TEST_ASSERT_EQUAL_UINT32(500, bytesPerSecond(0, 1000, 2000));
+    TEST_ASSERT_EQUAL_UINT32(0, bytesPerSecond(7, 7, 1000));
+    TEST_ASSERT_EQUAL_UINT32(20, bytesPerSecond(0xFFFFFFF6u, 10, 1000));
+    TEST_ASSERT_EQUAL_UINT32(0, bytesPerSecond(1, 2, 0));
+}
+
+void test_sizes_for_humans() {
+    TEST_ASSERT_EQUAL_STRING("0 B", formatTraffic(0).c_str());
+    TEST_ASSERT_EQUAL_STRING("999 B", formatTraffic(999).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.5 KB", formatTraffic(1536).c_str());
+    TEST_ASSERT_EQUAL_STRING("12 KB", formatTraffic(12 * 1024 + 100).c_str());
+    TEST_ASSERT_EQUAL_STRING("1.7 MB", formatTraffic(1774688).c_str());
+    TEST_ASSERT_EQUAL_STRING("48 MB", formatTraffic(48u * 1024 * 1024).c_str());
+}
+
+int main() {
+    UNITY_BEGIN();
+    RUN_TEST(test_counts_per_service);
+    RUN_TEST(test_names);
+    RUN_TEST(test_rate);
+    RUN_TEST(test_sizes_for_humans);
+    return UNITY_END();
+}