From 9ed5a7b19ba038151963026e9b90926301dd2240 Mon Sep 17 00:00:00 2001
From: frysee <frysee@googlemail.com>
Date: Sat, 3 Oct 2026 16:38:40 +0200
Subject: [PATCH 1/2] feat: replace nextui-updater-pak with native OTA in
 Settings.pak

---
 CONTRIBUTING.md                     |    2 +-
 DEBUGGING.md                        |  225 ++++++
 makefile                            |    3 +-
 tools/device-debug/inject.c         |  110 +++
 tools/device-debug/screenshot.py    |   39 +
 workspace/all/settings/makefile     |    4 +-
 workspace/all/settings/menu.cpp     |  185 ++++-
 workspace/all/settings/menu.hpp     |   14 +-
 workspace/all/settings/otamenu.cpp  | 1131 +++++++++++++++++++++++++++
 workspace/all/settings/otamenu.hpp  |   62 ++
 workspace/all/settings/settings.cpp |   23 +-
 11 files changed, 1789 insertions(+), 9 deletions(-)
 create mode 100644 DEBUGGING.md
 create mode 100644 tools/device-debug/inject.c
 create mode 100755 tools/device-debug/screenshot.py
 create mode 100644 workspace/all/settings/otamenu.cpp
 create mode 100644 workspace/all/settings/otamenu.hpp

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6bad66caf..07c5d4bef 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -21,7 +21,7 @@ Before opening an issue, search existing ones to avoid duplicates. When reportin
 
 1. Fork the repository and create a branch from `main`
 2. Keep changes focused — one fix or feature per PR
-3. Test your changes on hardware before submitting
+3. Test your changes on hardware before submitting (see [DEBUGGING.md](DEBUGGING.md))
 4. Write a clear PR description explaining what and why, not just what
 
 PRs that introduce large or unilateral changes without prior discussion may be closed. When in doubt, open an issue first.
diff --git a/DEBUGGING.md b/DEBUGGING.md
new file mode 100644
index 000000000..a8d4e7a36
--- /dev/null
+++ b/DEBUGGING.md
@@ -0,0 +1,225 @@
+# Debugging
+
+Two ways to run NextUI while developing:
+
+- **Desktop** (`PLATFORM=desktop`): the apps run natively on your Mac or Linux machine, in a
+  window, with the keyboard as the controller. Builds of a single app take well under a minute, there is nothing to deploy
+  and no input to inject. Use this for anything UI or logic related. Start here.
+- **On a device** over `adb`: needed for anything hardware specific (WiFi, Bluetooth, audio,
+  input quirks, performance, the real installer/boot flow) and as a final check before a PR.
+
+Written against the TrimUI Brick (`tg5040`) for the device part; other devices differ in the
+details noted below.
+
+## Desktop
+
+The desktop platform fakes an SD card at `/var/tmp/nextui/sdcard` and builds the apps with your
+host compiler. Hardware that does not exist on a PC is stubbed, so WiFi and Bluetooth menus
+are hidden (Settings checks the platform, see `DeviceInfo::hasWifi()`). The exception is
+About > OTA Update: it is shown on desktop and the host counts as online, so the whole flow
+(release scan, version picker, notes, download, extraction) can be tried locally. Updates are
+only staged in the fake card, nothing is installed and nothing reboots.
+
+### One time setup
+
+macOS (Homebrew):
+
+```sh
+brew install sdl2_image sdl2_ttf gcc make libsamplerate sqlite libzip
+```
+
+Linux: the equivalent SDL2, SDL2_image, SDL2_ttf, libsamplerate, sqlite and libzip dev packages.
+
+The makefiles call the compiler as `gcc`/`g++`, but Homebrew installs it with a version suffix
+(`gcc-16`). The repo ships a script that links them into `/usr/local/bin`
+(`sudo ./workspace/desktop/macos_create_gcc_symlinks.sh`). If you would rather not use `sudo`,
+make the links somewhere else and point `CROSS_COMPILE` at it:
+
+```sh
+mkdir -p /tmp/gccbin
+ln -sf $(ls /opt/homebrew/bin/gcc-[0-9]* | head -1) /tmp/gccbin/gcc
+ln -sf $(ls /opt/homebrew/bin/g++-[0-9]* | head -1) /tmp/gccbin/g++
+```
+
+Create the fake SD card (it does nothing if it exists, delete `/var/tmp/nextui/sdcard` to start
+over):
+
+```sh
+./workspace/desktop/prepare_fake_sd_root.sh
+```
+
+### Build and run a single app
+
+Example for Settings, takes about 30 seconds the first time:
+
+```sh
+cd workspace/all/settings
+env UNAME_S=Darwin PLATFORM=desktop UNION_PLATFORM=desktop CROSS_COMPILE=/tmp/gccbin/ \
+    PREFIX=/opt/homebrew PREFIX_LOCAL=/var/tmp/nextui make
+```
+
+(On Linux use `UNAME_S=Linux CROSS_COMPILE=/usr/bin/ PREFIX=/usr`. With the `sudo` symlinks use
+`CROSS_COMPILE=/usr/local/bin/`.) The result is `build/desktop/settings.elf`. Copy it into the
+fake card and run it with the environment the launcher would set up
+(`skeleton/SYSTEM/desktop/paks/MinUI.pak/launch.sh` has the full list):
+
+```sh
+PAK=/var/tmp/nextui/sdcard/Tools/desktop/Settings.pak
+cp build/desktop/settings.elf $PAK/
+
+export PLATFORM=desktop SDCARD_PATH=/var/tmp/nextui/sdcard IS_NEXT=yes
+export SYSTEM_PATH=$SDCARD_PATH/.system/$PLATFORM
+export USERDATA_PATH=$SDCARD_PATH/.userdata/$PLATFORM
+export SHARED_USERDATA_PATH=$SDCARD_PATH/.userdata/shared
+export BIOS_PATH=$SDCARD_PATH/Bios ROMS_PATH=$SDCARD_PATH/Roms SAVES_PATH=$SDCARD_PATH/Saves
+export CHEATS_PATH=$SDCARD_PATH/Cheats CORES_PATH=$SYSTEM_PATH/cores
+export LOGS_PATH=$USERDATA_PATH/logs HOOKS_PATH=$USERDATA_PATH/.hooks
+mkdir -p $USERDATA_PATH $LOGS_PATH $SHARED_USERDATA_PATH/.minui
+export DYLD_LIBRARY_PATH=$SYSTEM_PATH/lib:/var/tmp/nextui/lib   # LD_LIBRARY_PATH on Linux
+export PATH=$SYSTEM_PATH/bin:$PATH
+
+cd $PAK && ./settings.elf
+```
+
+Save the exports as a script if you do this often. Other apps (`nextui`, `minarch`, ...) build the
+same way from their folder under `workspace/all/`. A full desktop build of everything is
+`make setup common PLATFORM=desktop` from the repo root, see `makefile.native`.
+
+Keyboard map (also printed in the app's log on start):
+
+| Pad | Key | Pad | Key |
+|---|---|---|---|
+| D-pad | arrow keys | L1 | Tab |
+| A | S | R1 | B |
+| B | A | SELECT | ` |
+| X | W | START | Return |
+| Y | Q | MENU / POWER | Space / Backspace |
+
+Screenshots are a normal window grab (macOS: Cmd+Shift+4, then Space and click the window).
+Apps still write their log next to the binary, e.g. `Settings.pak/settings.log`.
+
+Things to keep in mind:
+
+- It is a different compiler, libc and screen size than the devices. Layout, input handling and
+  logic carry over, performance and timing do not. A change that builds here can still fail with
+  the device toolchain, so build for the device before you push.
+- The fake card lives outside the repo. Anything an app writes (settings, saves) stays in
+  `/var/tmp/nextui/sdcard` until you delete it.
+- Hardware backed code paths (WiFi, Bluetooth, rumble, LEDs, deep sleep) do nothing or are
+  skipped, `/dev/fb0: Operation not permitted` in the log is harmless.
+
+## On a device
+
+How to build, deploy, drive and screenshot NextUI on a handheld over `adb`.
+
+Needs `adb` on the host and the device connected over USB (debugging enabled in the stock OS).
+The SD card is mounted at `/mnt/SDCARD`.
+
+## Build and deploy one app
+
+Build in the platform toolchain container, then push the binary over the one on the card.
+Example for Settings:
+
+```sh
+docker run --rm -v $(pwd)/workspace:/root/workspace \
+  -e PLATFORM=tg5040 -e UNION_PLATFORM=tg5040 \
+  ghcr.io/loveretro/tg5040-toolchain:latest \
+  /bin/bash -c '. ~/.bashrc && export PLATFORM=tg5040 UNION_PLATFORM=tg5040 && cd /root/workspace/all/settings && make'
+
+adb push workspace/all/settings/build/tg5040/settings.elf /mnt/SDCARD/Tools/tg5040/Settings.pak/settings.elf
+```
+
+Back up the original first (`adb pull`) if you want to restore it. A full install (`MinUI.zip`)
+overwrites it again on the next update.
+
+## Launching an app (read this before killing anything)
+
+`MinUI.pak/launch.sh` runs a loop: start `nextui.elf`, and if it left a command in `/tmp/next`,
+run that, then go round again. The loop only continues while `/tmp/nextui_exec` exists.
+
+**`killall nextui.elf` is a shutdown request.** SIGTERM becomes an SDL quit, nextui handles it as
+power off, which creates `/tmp/poweroff` and deletes `/tmp/nextui_exec`. Whatever you launched
+runs, and when it exits the device powers off. Since the device is on USB power it then boots
+straight back up, which looks like a spontaneous reboot and drops adb for a minute.
+
+To launch an app by hand, set the target and kill nextui with SIGKILL, which has no handler:
+
+```sh
+adb shell "echo \"'/mnt/SDCARD/Tools/tg5040/Settings.pak/launch.sh'\" > /tmp/next; killall -9 nextui.elf"
+```
+
+You can prefix environment variables, they are passed through `eval`:
+
+```sh
+adb shell "echo \"MY_VAR=1 '/mnt/SDCARD/Tools/tg5040/Settings.pak/launch.sh'\" > /tmp/next; killall -9 nextui.elf"
+```
+
+When the app exits, nextui comes back. If you did kill it with plain `killall` and the app is still
+running, repair the loop before quitting the app:
+
+```sh
+adb shell 'rm -f /tmp/poweroff; touch /tmp/nextui_exec'
+```
+
+Check `ls /tmp/poweroff /tmp/reboot /tmp/nextui_exec` if the device does something unexpected.
+
+Other things that look like a dead device: auto sleep (an idle app lets the screen sleep and USB
+goes quiet, press power) and low battery. Keep it on a charger while testing.
+
+App logs: `Tools/<platform>/<Name>.pak/*.log`, `.userdata/<platform>/logs/`.
+
+## Screenshots
+
+The framebuffer is read straight from `/dev/fb0` (1024x768, 32bpp BGRA on the Brick):
+
+```sh
+tools/device-debug/screenshot.py shot.png     # needs Pillow
+```
+
+The script reads the geometry from sysfs, runs `dd` on the device and pulls the result. Use
+`screenshot.py shot.png 1` if you get a stale frame (the buffer is double paged). Overlays and
+the main UI both end up in the framebuffer, so everything is visible. Screenshots taken while the
+app is blocked in a syscall show the last presented frame.
+
+## Pressing buttons
+
+There is no input over adb, so `tools/device-debug/inject.c` creates a virtual gamepad that looks
+like the built-in one and presses buttons for you.
+
+```sh
+# build for the device
+docker run --rm -v $(pwd)/tools/device-debug:/inj ghcr.io/loveretro/tg5040-toolchain:latest \
+  /bin/bash -c '. ~/.bashrc; aarch64-nextui-linux-gnu-gcc -o /inj/inject /inj/inject.c'
+# do not link it statically, the device kernel is too old for the toolchain's static glibc
+# if Docker refuses to mount the folder (file sharing is limited to some paths on macOS),
+# copy inject.c somewhere it can, e.g. under workspace/, and build it there
+
+adb push tools/device-debug/inject /tmp/inject
+adb shell 'chmod +x /tmp/inject; mkfifo /tmp/inj'
+adb shell '/tmp/inject /tmp/inj'      # keep this session open, e.g. in the background
+```
+
+Then, from another shell:
+
+```sh
+adb shell 'echo "down down a" > /tmp/inj'
+```
+
+Tokens: `up down left right a b x y l1 r1 sleep quit`. Each press takes about 0.3s, `sleep` waits
+one second. Input sent while the app is blocked (for example during a network call) is
+swallowed, so wait for the screen to settle and screenshot between steps.
+
+Button numbers are the SDL joystick indices from `JOY_*` in `workspace/<platform>/platform/platform.h`.
+The tool is written for the Brick; for another device check the real pad with
+`cat /proc/bus/input/devices` and adjust the name, ids and button set to match.
+
+The virtual pad vanishes when the injector exits (use `quit`), and apps see that as an unplugged
+controller. Quit the app first.
+
+## Handy
+
+```sh
+adb shell 'cat /sys/class/power_supply/*/status'     # charging?
+adb shell 'ps | grep -E "nextui|settings"'           # who is running
+adb shell 'uptime'                                   # did it reboot?
+```
diff --git a/makefile b/makefile
index f1f6d49c7..6bcb70715 100644
--- a/makefile
+++ b/makefile
@@ -37,8 +37,7 @@ RELEASE_NAME ?= $(RELEASE_BASE)-$(RELEASE_DOT)
 # Extra paks to ship
 VENDOR_DEST := ./build/VENDOR/Tools
 PACKAGE_URL_MAPPINGS := \
-	"https://github.com/UncleJunVIP/nextui-pak-store/releases/latest/download/Pak.Store.pakz nextui.pak_store.pakz" \
-	"https://github.com/LoveRetro/nextui-updater-pak/releases/latest/download/nextui.updater.pakz nextui.updater.pakz"
+	"https://github.com/UncleJunVIP/nextui-pak-store/releases/latest/download/Pak.Store.pakz nextui.pak_store.pakz"
 	# add more URLs as needed
 
 ###########################################################
diff --git a/tools/device-debug/inject.c b/tools/device-debug/inject.c
new file mode 100644
index 000000000..dc00af16b
--- /dev/null
+++ b/tools/device-debug/inject.c
@@ -0,0 +1,110 @@
+// Virtual gamepad for driving NextUI over adb (TrimUI Brick / tg5040 layout).
+//
+// Creates a uinput device that looks like the built-in pad ("TRIMUI Player1",
+// Xbox-style: buttons + HAT0 d-pad) and presses buttons named in a FIFO.
+// Tokens: up down left right a b x y l1 r1 sleep quit; append :<ms> to hold, e.g. a:400
+// See DEBUGGING.md. Button indices must match JOY_* in workspace/<platform>/platform/platform.h.
+#include <fcntl.h>
+#include <linux/uinput.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+static int fd;
+
+static void ev(int type, int code, int value)
+{
+	struct input_event e;
+	memset(&e, 0, sizeof e);
+	e.type = type;
+	e.code = code;
+	e.value = value;
+	write(fd, &e, sizeof e);
+}
+
+static int hold_ms = 120;
+
+static void tap(int type, int code, int on)
+{
+	ev(type, code, on);
+	ev(EV_SYN, SYN_REPORT, 0);
+	usleep(hold_ms * 1000);
+	ev(type, code, 0);
+	ev(EV_SYN, SYN_REPORT, 0);
+	usleep(150000);
+}
+
+int main(int argc, char **argv)
+{
+	if (argc < 2) {
+		fprintf(stderr, "usage: %s <fifo>\n", argv[0]);
+		return 1;
+	}
+	fd = open("/dev/uinput", O_WRONLY);
+	if (fd < 0) {
+		perror("/dev/uinput");
+		return 1;
+	}
+
+	// xpad button codes in order: A B X Y TL TR SELECT START MODE THUMBL THUMBR.
+	// SDL numbers joystick buttons by that order, so JOY_B=0 is 0x130, JOY_A=1 is 0x131, ...
+	int keys[] = {0x130, 0x131, 0x133, 0x134, 0x136, 0x137, 0x13a, 0x13b, 0x13c, 0x13d, 0x13e};
+	int axes[] = {0, 1, 2, 3, 4, 5, 16, 17}; // sticks + HAT0X/HAT0Y
+
+	ioctl(fd, UI_SET_EVBIT, EV_KEY);
+	for (int i = 0; i < 11; i++)
+		ioctl(fd, UI_SET_KEYBIT, keys[i]);
+	ioctl(fd, UI_SET_EVBIT, EV_ABS);
+
+	struct uinput_user_dev d;
+	memset(&d, 0, sizeof d);
+	strcpy(d.name, "TRIMUI Player1");
+	d.id.bustype = 3;
+	d.id.vendor = 0x45e;
+	d.id.product = 0x28e;
+	d.id.version = 0x114;
+	for (int i = 0; i < 8; i++) {
+		ioctl(fd, UI_SET_ABSBIT, axes[i]);
+		d.absmin[axes[i]] = axes[i] >= 16 ? -1 : -32768;
+		d.absmax[axes[i]] = axes[i] >= 16 ? 1 : 32767;
+	}
+	write(fd, &d, sizeof d);
+	ioctl(fd, UI_DEV_CREATE);
+	sleep(1); // let the app notice the new joystick
+
+	FILE *f = fopen(argv[1], "r");
+	if (!f) {
+		perror(argv[1]);
+		return 1;
+	}
+	char tok[32];
+	while (1) {
+		if (fscanf(f, "%31s", tok) != 1) {
+			clearerr(f);
+			usleep(100000);
+			continue;
+		}
+		// "<button>:<ms>" holds the button down for that long, e.g. "a:400"
+		char *colon = strchr(tok, ':');
+		hold_ms = 120;
+		if (colon) {
+			hold_ms = atoi(colon + 1);
+			*colon = 0;
+		}
+		if (!strcmp(tok, "up")) tap(EV_ABS, 17, -1);
+		else if (!strcmp(tok, "down")) tap(EV_ABS, 17, 1);
+		else if (!strcmp(tok, "left")) tap(EV_ABS, 16, -1);
+		else if (!strcmp(tok, "right")) tap(EV_ABS, 16, 1);
+		else if (!strcmp(tok, "b")) tap(EV_KEY, 0x130, 1);
+		else if (!strcmp(tok, "a")) tap(EV_KEY, 0x131, 1);
+		else if (!strcmp(tok, "y")) tap(EV_KEY, 0x133, 1);
+		else if (!strcmp(tok, "x")) tap(EV_KEY, 0x134, 1);
+		else if (!strcmp(tok, "l1")) tap(EV_KEY, 0x136, 1);
+		else if (!strcmp(tok, "r1")) tap(EV_KEY, 0x137, 1);
+		else if (!strcmp(tok, "sleep")) sleep(1);
+		else if (!strcmp(tok, "quit")) break;
+	}
+	ioctl(fd, UI_DEV_DESTROY);
+	return 0;
+}
diff --git a/tools/device-debug/screenshot.py b/tools/device-debug/screenshot.py
new file mode 100755
index 000000000..ce2760518
--- /dev/null
+++ b/tools/device-debug/screenshot.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Grab a screenshot from a device's framebuffer over adb.
+
+usage: screenshot.py out.png [page]
+
+Needs Pillow. The geometry is read from the device (sysfs), the pixel format is
+assumed to be 32bpp BGRA, which is what the TrimUI devices use. The framebuffer is
+multi-page (double buffered); page 0 is usually fine, pass 1 if you get a stale frame.
+"""
+import re
+import subprocess
+import sys
+import tempfile
+
+from PIL import Image
+
+
+def adb(*args):
+    return subprocess.run(["adb", *args], check=True, capture_output=True, text=True).stdout.strip()
+
+
+def main():
+    out = sys.argv[1]
+    page = int(sys.argv[2]) if len(sys.argv) > 2 else 0
+
+    fb = "/sys/class/graphics/fb0/"
+    w, h = map(int, re.search(r"(\d+)x(\d+)", adb("shell", f"cat {fb}modes")).groups())
+    stride = int(adb("shell", f"cat {fb}stride"))
+    size = stride * h
+
+    # dd on the device and pull: `adb exec-out cat /dev/fb0` is unreliable here
+    adb("shell", f"dd if=/dev/fb0 of=/tmp/fb.raw bs={stride} skip={page * h} count={h} 2>/dev/null")
+    with tempfile.NamedTemporaryFile() as tmp:
+        adb("pull", "/tmp/fb.raw", tmp.name)
+        raw = open(tmp.name, "rb").read()[:size]
+    Image.frombuffer("RGBA", (stride // 4, h), raw, "raw", "BGRA", 0, 1).crop((0, 0, w, h)).convert("RGB").save(out)
+
+
+main()
diff --git a/workspace/all/settings/makefile b/workspace/all/settings/makefile
index 4c3f3c841..03f9ec2d9 100644
--- a/workspace/all/settings/makefile
+++ b/workspace/all/settings/makefile
@@ -22,7 +22,7 @@ SDL?=SDL
 TARGET = settings
 INCDIR = -I. -I../common/ -I../../$(PLATFORM)/platform/
 SOURCE = -c ../common/utils.c ../common/api.c ../common/config.c ../common/palette.c ../common/scaler.c ../common/http.c ../common/ra_auth.c ../common/ra_offline.c ../common/ra_sync.c ../common/ra_event_queue.c ../../$(PLATFORM)/platform/platform.c
-CXXSOURCE = $(TARGET).cpp menu.cpp colorpickermenu.cpp palettemenu.cpp fnbuttonmenu.cpp wifimenu.cpp btmenu.cpp keyboardprompt.cpp
+CXXSOURCE = $(TARGET).cpp menu.cpp otamenu.cpp colorpickermenu.cpp palettemenu.cpp fnbuttonmenu.cpp wifimenu.cpp btmenu.cpp keyboardprompt.cpp
 CXXSOURCE += build/$(PLATFORM)/utils.o build/$(PLATFORM)/api.o build/$(PLATFORM)/config.o build/$(PLATFORM)/palette.o build/$(PLATFORM)/scaler.o build/$(PLATFORM)/http.o build/$(PLATFORM)/ra_auth.o build/$(PLATFORM)/ra_offline.o build/$(PLATFORM)/ra_sync.o build/$(PLATFORM)/ra_event_queue.o build/$(PLATFORM)/platform.o
 
 CC = $(CROSS_COMPILE)gcc
@@ -31,7 +31,7 @@ CFLAGS += $(OPT)
 CFLAGS += $(INCDIR) -DPLATFORM=\"$(PLATFORM)\"
 CXXFLAGS += $(CFLAGS) -std=c++17
 CFLAGS += -fpermissive
-LDFLAGS +=  -lmsettings -lcrypto
+LDFLAGS +=  -lmsettings -lcrypto -lzip
 ifneq (,$(filter $(PLATFORM),tg5040 tg5050 h700))
 # drop as soon as we use btagent on all platforms
 CXXFLAGS += -DHAS_BTAGENT
diff --git a/workspace/all/settings/menu.cpp b/workspace/all/settings/menu.cpp
index b17a0cabb..a4d2485cd 100644
--- a/workspace/all/settings/menu.cpp
+++ b/workspace/all/settings/menu.cpp
@@ -596,12 +596,25 @@ void MenuList::draw(SDL_Surface *surface, const SDL_Rect &dst, const SDL_Rect &d
                 GFX_blitAssetCPP(ASSET_SCROLL_DOWN, {}, surface, {rect.x, rect.y + rect.h + (SCALE1(SCROLL_HEIGHT) / 2)});
         }
 
+        // item specific button hints, bottom left
+        int hintsRight = 0;
+        if (cur && !cur->getHints().empty())
+        {
+            char *pairs[5] = {nullptr};
+            const auto &hints = cur->getHints();
+            for (size_t i = 0; i < hints.size() && i < 4; i++)
+                pairs[i] = const_cast<char *>(hints[i].c_str());
+            hintsRight = SCALE1(PADDING) + GFX_blitButtonGroup(pairs, 0, surface, 0) + SCALE1(PADDING);
+        }
+
         if (cur && cur->getDesc().length() > 0)
         {
             int w, h;
             const auto description = cur->getDesc();
             GFX_sizeText(font.tiny, description.c_str(), SCALE1(FONT_SMALL), &w, &h);
-            GFX_blitTextCPP(font.tiny, description.c_str(), SCALE1(FONT_SMALL), uintToColour(THEME_COLOR4_255), surface, {(dst.x + dst.w - w) / 2, dst.y + dst.h - h, w, h});
+            // centered, unless the hints are in the way
+            int x = std::max((dst.x + dst.w - w) / 2, hintsRight);
+            GFX_blitTextCPP(font.tiny, description.c_str(), SCALE1(FONT_SMALL), uintToColour(THEME_COLOR4_255), surface, {x, dst.y + dst.h - h, w, h});
         }
     }
 
@@ -934,6 +947,170 @@ bool MenuList::isOverlayVisible()
     return overlayVisible;
 }
 
+// Greedy word wrap, hard breaks words that are wider than a line on their own.
+static std::vector<std::string> wrapText(TTF_Font *f, const std::string &text, int maxWidth)
+{
+    auto width = [&](const std::string &str) {
+        int w = 0;
+        TTF_SizeUTF8(f, str.c_str(), &w, nullptr);
+        return w;
+    };
+
+    std::vector<std::string> lines;
+    size_t pos = 0;
+    while (pos <= text.size())
+    {
+        size_t nl = text.find('\n', pos);
+        std::string para = text.substr(pos, nl == std::string::npos ? std::string::npos : nl - pos);
+        pos = nl == std::string::npos ? text.size() + 1 : nl + 1;
+
+        if (para.empty())
+        {
+            lines.push_back("");
+            continue;
+        }
+
+        // keep the paragraph's indentation for continuation lines out of it, simple wrap only
+        std::string cur;
+        size_t wp = 0;
+        while (wp < para.size())
+        {
+            size_t sp = para.find(' ', wp);
+            std::string word = para.substr(wp, sp == std::string::npos ? std::string::npos : sp - wp);
+            wp = sp == std::string::npos ? para.size() : sp + 1;
+            if (word.empty())
+                continue;
+
+            std::string trial = cur.empty() ? word : cur + " " + word;
+            if (width(trial) <= maxWidth)
+            {
+                cur = trial;
+                continue;
+            }
+            if (!cur.empty())
+                lines.push_back(cur);
+            cur.clear();
+            // a single word that does not fit, split it on character boundaries
+            while (width(word) > maxWidth && word.size() > 1)
+            {
+                size_t n = 1;
+                while (n < word.size())
+                {
+                    size_t next = n + 1;
+                    while (next < word.size() && (word[next] & 0xC0) == 0x80)
+                        next++;
+                    if (width(word.substr(0, next)) > maxWidth)
+                        break;
+                    n = next;
+                }
+                lines.push_back(word.substr(0, n));
+                word = word.substr(n);
+            }
+            cur = word;
+        }
+        lines.push_back(cur);
+    }
+    return lines;
+}
+
+void MenuList::showTextViewer(const std::string &title, const std::string &text)
+{
+    SDL_Surface *screen = nullptr;
+    {
+        ReadLock r(overlayLock);
+        screen = overlaySurface;
+    }
+    if (!screen)
+        return;
+
+    TTF_Font *f = font.small;
+    const int pad = SCALE1(PADDING);
+    const int lineH = TTF_FontHeight(f) + SCALE1(2);
+    SDL_Rect area;
+    // PADDING from the screen edge, then inset by the pill's text padding
+    const int inset = pad + SCALE1(BUTTON_PADDING);
+    area.x = inset;
+    area.y = pad + SCALE1(PILL_SIZE) + SCALE1(PADDING);
+    area.w = screen->w - inset * 2;
+    area.h = screen->h - area.y - pad - SCALE1(PILL_SIZE) - SCALE1(PADDING);
+
+    const auto lines = wrapText(f, text, area.w);
+    const int visible = std::max(1, area.h / lineH);
+    const int maxTop = std::max(0, (int)lines.size() - visible);
+    int top = 0;
+    bool dirty = true;
+
+    while (true)
+    {
+        GFX_startFrame();
+        PAD_poll();
+
+        if (PAD_justPressed(BTN_B) || PAD_justPressed(BTN_A))
+            break;
+
+        int old = top;
+        if (PAD_justRepeated(BTN_UP))
+            top--;
+        else if (PAD_justRepeated(BTN_DOWN))
+            top++;
+        else if (PAD_justRepeated(BTN_LEFT) || PAD_justRepeated(BTN_L1))
+            top -= visible - 1;
+        else if (PAD_justRepeated(BTN_RIGHT) || PAD_justRepeated(BTN_R1))
+            top += visible - 1;
+        top = std::max(0, std::min(maxTop, top));
+        if (top != old)
+            dirty = true;
+
+        if (!dirty)
+        {
+            GFX_sync();
+            continue;
+        }
+        dirty = false;
+
+        uint32_t bgc = CFG_getColor(COLOR_BACKGROUND);
+        SDL_FillRect(screen, NULL, SDL_MapRGBA(screen->format, (bgc >> 24) & 0xFF, (bgc >> 16) & 0xFF, (bgc >> 8) & 0xFF, bgc & 0xFF));
+
+        // title pill, same as the other full screen views
+        {
+            char display_name[256];
+            int pillW = GFX_truncateText(font.large, title.c_str(), display_name, screen->w - pad * 2, SCALE1(BUTTON_PADDING * 2));
+            SDL_Surface *t = TTF_RenderUTF8_Blended(font.large, display_name, uintToColour(THEME_COLOR6_255));
+            GFX_blitPillLightCPP(ASSET_WHITE_PILL, screen, {pad, pad, pillW, SCALE1(PILL_SIZE)});
+            SDL_BlitSurfaceCPP(t, {0, 0, pillW - SCALE1(BUTTON_PADDING * 2), t->h}, screen,
+                               {pad + SCALE1(BUTTON_PADDING), pad + (SCALE1(PILL_SIZE) - t->h + 1) / 2, 0, 0});
+            SDL_FreeSurface(t);
+        }
+
+        for (int i = 0; i < visible && top + i < (int)lines.size(); i++)
+        {
+            const std::string &line = lines[top + i];
+            if (line.empty())
+                continue;
+            SDL_Surface *t = TTF_RenderUTF8_Blended(f, line.c_str(), uintToColour(THEME_COLOR4_255));
+            if (!t)
+                continue;
+            SDL_BlitSurfaceCPP(t, {}, screen, {area.x, area.y + i * lineH, t->w, t->h});
+            SDL_FreeSurface(t);
+        }
+
+        if (maxTop > 0)
+        {
+            const int arrowX = (screen->w - SCALE1(24)) / 2;
+            if (top > 0)
+                GFX_blitAssetCPP(ASSET_SCROLL_UP, {}, screen, {arrowX, area.y - SCALE1(PADDING)});
+            if (top < maxTop)
+                GFX_blitAssetCPP(ASSET_SCROLL_DOWN, {}, screen, {arrowX, area.y + area.h});
+            char *scroll[] = {(char *)"U/D", (char *)"SCROLL", nullptr};
+            GFX_blitButtonGroup(scroll, 0, screen, 0);
+        }
+        char *back[] = {(char *)"B", (char *)"BACK", nullptr};
+        GFX_blitButtonGroup(back, 1, screen, 1);
+
+        GFX_flip(screen);
+    }
+}
+
 
 static void drawOverlayLocal(SDL_Surface* screen) {
     // ReadLock r(overlayLock); // Assumes caller held lock or is safe
@@ -964,6 +1141,12 @@ static void drawOverlayLocal(SDL_Surface* screen) {
         } else if (overlayDismissMode == OverlayDismissMode::DismissOnA) {
             char *hints[] = {(char *)("A"), (char *)("OK"), NULL};
             GFX_blitButtonGroup(hints, 1, screen, 1);
+        } else if (overlayDismissMode == OverlayDismissMode::CancelHint) {
+            char *hints[] = {(char *)("B"), (char *)("CANCEL"), NULL};
+            GFX_blitButtonGroup(hints, 1, screen, 1);
+        } else if (overlayDismissMode == OverlayDismissMode::AcceptOrReturn) {
+            char *hints[] = {(char *)("B"), (char *)("RETURN"), (char *)("A"), (char *)("ACCEPT"), NULL};
+            GFX_blitButtonGroup(hints, 1, screen, 1);
         }
     }
 }
diff --git a/workspace/all/settings/menu.hpp b/workspace/all/settings/menu.hpp
index 2e3b98181..75358f7cc 100644
--- a/workspace/all/settings/menu.hpp
+++ b/workspace/all/settings/menu.hpp
@@ -125,7 +125,11 @@ enum class OverlayDismissMode
 {
     None,
     DismissOnA,
-    DismissOnB
+    DismissOnB,
+    // Caller runs its own input loop and reads A (accept) / B (return)
+    AcceptOrReturn,
+    // Caller runs its own input loop and reads B (cancel), only shows the hint
+    CancelHint
 };
 
 class AbstractMenuItem;
@@ -155,6 +159,9 @@ class AbstractMenuItem
 
     MenuList *submenu{nullptr};
     bool deferred{false};
+    // secondary button hints shown bottom left while this item is selected,
+    // flat list of {button, label} pairs (two pairs at most)
+    std::vector<std::string> hints;
 
     virtual void initSelection() {}
     virtual bool nextValue() { return next(1); };
@@ -181,6 +188,8 @@ class AbstractMenuItem
     const std::string &getName() const { return name; }
     const std::string &getDesc() const { return desc; }
     void setDesc(const std::string &d) { desc = d; }
+    const std::vector<std::string> &getHints() const { return hints; }
+    void setHints(const std::vector<std::string> &h) { hints = h; }
     const ListItemType getType() const { return type; }
 
     virtual void drawCustomItem(SDL_Surface *surface, const SDL_Rect &dst, const AbstractMenuItem &item, bool selected) const {}
@@ -330,6 +339,9 @@ class MenuList
     static void showOverlay(const std::string& message, OverlayDismissMode dismissMode = OverlayDismissMode::None);
     static void hideOverlay();
     static bool isOverlayVisible();
+    // Full screen, scrollable read-only text. Blocks with its own input loop until the
+    // user closes it (B/A). Needs the list to have been drawn once.
+    static void showTextViewer(const std::string &title, const std::string &text);
 
     void performLayout(const SDL_Rect &dst);
     bool selectNext();
diff --git a/workspace/all/settings/otamenu.cpp b/workspace/all/settings/otamenu.cpp
new file mode 100644
index 000000000..368f06947
--- /dev/null
+++ b/workspace/all/settings/otamenu.cpp
@@ -0,0 +1,1131 @@
+#include "otamenu.hpp"
+
+#include <zip.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cctype>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <fstream>
+#include <functional>
+#include <map>
+#include <mutex>
+#include <regex>
+#include <set>
+#include <sstream>
+#include <thread>
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <spawn.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+extern char **environ;
+
+using namespace OTA;
+
+#define OTA_REPO "LoveRetro/NextUI"
+#define OTA_API "https://api.github.com/repos/" OTA_REPO
+
+// Shown when picking anything but the newest release. Same wording as the standalone updater.
+#define OTA_DOWNGRADE_WARNING                                  \
+    "WARNING\n\n"                                              \
+    "Downgrades are not fully\nsupported by NextUI!\n\n"        \
+    "Settings may be lost or unstable\nin old versions, and manual\nediting of settings or files may be required"
+
+namespace
+{
+    ///////////////////////////////////////////////////////////
+    // Minimal JSON reader, just enough for the GitHub API.
+
+    struct Json
+    {
+        enum Type { Null, Bool, Num, Str, Arr, Obj } type = Null;
+        double num = 0;
+        std::string str;
+        std::vector<Json> arr;
+        std::vector<std::pair<std::string, Json>> obj;
+
+        const Json *get(const char *key) const
+        {
+            for (const auto &kv : obj)
+                if (kv.first == key)
+                    return &kv.second;
+            return nullptr;
+        }
+        std::string string(const char *key) const
+        {
+            auto v = get(key);
+            return (v && v->type == Str) ? v->str : std::string();
+        }
+        uint64_t number(const char *key) const
+        {
+            auto v = get(key);
+            return (v && v->type == Num && v->num > 0) ? (uint64_t)v->num : 0;
+        }
+    };
+
+    class JsonParser
+    {
+        const char *p, *end;
+
+        void ws()
+        {
+            while (p < end && (*p == ' ' || *p == '\t' || *p == '\n' || *p == '\r'))
+                p++;
+        }
+
+        static void utf8(std::string &out, uint32_t cp)
+        {
+            if (cp < 0x80)
+                out += (char)cp;
+            else if (cp < 0x800)
+            {
+                out += (char)(0xC0 | (cp >> 6));
+                out += (char)(0x80 | (cp & 0x3F));
+            }
+            else if (cp < 0x10000)
+            {
+                out += (char)(0xE0 | (cp >> 12));
+                out += (char)(0x80 | ((cp >> 6) & 0x3F));
+                out += (char)(0x80 | (cp & 0x3F));
+            }
+            else
+            {
+                out += (char)(0xF0 | (cp >> 18));
+                out += (char)(0x80 | ((cp >> 12) & 0x3F));
+                out += (char)(0x80 | ((cp >> 6) & 0x3F));
+                out += (char)(0x80 | (cp & 0x3F));
+            }
+        }
+
+        bool hex4(uint32_t &out)
+        {
+            if (end - p < 4)
+                return false;
+            out = 0;
+            for (int i = 0; i < 4; i++, p++)
+            {
+                if (!isxdigit((unsigned char)*p))
+                    return false;
+                out = out * 16 + (isdigit((unsigned char)*p) ? *p - '0' : (tolower(*p) - 'a' + 10));
+            }
+            return true;
+        }
+
+        bool string(std::string &out)
+        {
+            if (p >= end || *p != '"')
+                return false;
+            p++;
+            while (p < end && *p != '"')
+            {
+                if (*p != '\\')
+                {
+                    out += *p++;
+                    continue;
+                }
+                if (++p >= end)
+                    return false;
+                switch (*p++)
+                {
+                case 'n': out += '\n'; break;
+                case 't': out += '\t'; break;
+                case 'r': out += '\r'; break;
+                case 'b': out += '\b'; break;
+                case 'f': out += '\f'; break;
+                case 'u':
+                {
+                    uint32_t cp;
+                    if (!hex4(cp))
+                        return false;
+                    if (cp >= 0xD800 && cp < 0xDC00 && end - p >= 6 && p[0] == '\\' && p[1] == 'u')
+                    {
+                        p += 2;
+                        uint32_t lo;
+                        if (!hex4(lo))
+                            return false;
+                        cp = 0x10000 + ((cp - 0xD800) << 10) + (lo - 0xDC00);
+                    }
+                    utf8(out, cp);
+                    break;
+                }
+                default: out += p[-1]; break; // " \ /
+                }
+            }
+            if (p >= end)
+                return false;
+            p++;
+            return true;
+        }
+
+        bool literal(const char *word)
+        {
+            size_t n = strlen(word);
+            if ((size_t)(end - p) < n || strncmp(p, word, n) != 0)
+                return false;
+            p += n;
+            return true;
+        }
+
+    public:
+        JsonParser(const std::string &s) : p(s.data()), end(s.data() + s.size()) {}
+
+        bool value(Json &out, int depth = 0)
+        {
+            if (depth > 32)
+                return false;
+            ws();
+            if (p >= end)
+                return false;
+            switch (*p)
+            {
+            case '{':
+            {
+                out.type = Json::Obj;
+                p++;
+                ws();
+                if (p < end && *p == '}')
+                    return ++p, true;
+                while (true)
+                {
+                    ws();
+                    std::string key;
+                    if (!string(key))
+                        return false;
+                    ws();
+                    if (p >= end || *p++ != ':')
+                        return false;
+                    out.obj.emplace_back(std::move(key), Json());
+                    if (!value(out.obj.back().second, depth + 1))
+                        return false;
+                    ws();
+                    if (p >= end)
+                        return false;
+                    if (*p == ',')
+                    {
+                        p++;
+                        continue;
+                    }
+                    return *p++ == '}';
+                }
+            }
+            case '[':
+            {
+                out.type = Json::Arr;
+                p++;
+                ws();
+                if (p < end && *p == ']')
+                    return ++p, true;
+                while (true)
+                {
+                    out.arr.emplace_back();
+                    if (!value(out.arr.back(), depth + 1))
+                        return false;
+                    ws();
+                    if (p >= end)
+                        return false;
+                    if (*p == ',')
+                    {
+                        p++;
+                        continue;
+                    }
+                    return *p++ == ']';
+                }
+            }
+            case '"':
+                out.type = Json::Str;
+                return string(out.str);
+            case 't':
+                out.type = Json::Bool;
+                return literal("true");
+            case 'f':
+                out.type = Json::Bool;
+                return literal("false");
+            case 'n':
+                out.type = Json::Null;
+                return literal("null");
+            default:
+            {
+                char *e = nullptr;
+                out.type = Json::Num;
+                out.num = strtod(p, &e);
+                if (e == p)
+                    return false;
+                p = e;
+                return true;
+            }
+            }
+        }
+    };
+
+    ///////////////////////////////////////////////////////////
+    // Helpers
+
+    bool startsWith(const std::string &s, const std::string &prefix)
+    {
+        return s.compare(0, prefix.size(), prefix) == 0;
+    }
+
+    bool endsWith(const std::string &s, const std::string &suffix)
+    {
+        return s.size() >= suffix.size() && s.compare(s.size() - suffix.size(), suffix.size(), suffix) == 0;
+    }
+
+    std::string lower(std::string s)
+    {
+        std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c) { return std::tolower(c); });
+        return s;
+    }
+
+    // Release notes are GitHub flavoured markdown. Reduce them to plain text for the
+    // viewer: keep the "What's Changed" list, drop links, formatting and emoji.
+    std::string cleanNotes(std::string md)
+    {
+        md.erase(std::remove(md.begin(), md.end(), '\r'), md.end());
+
+        // the part before the changelog is boilerplate (install links)
+        size_t changed = md.find("## What's Changed");
+        if (changed != std::string::npos)
+            md = md.substr(changed);
+
+        md = std::regex_replace(md, std::regex("\\[([^\\]]*)\\]\\([^)]*\\)"), "$1"); // [text](url)
+        md = std::regex_replace(md, std::regex("\\s+in\\s+https?://\\S+"), "");          // " in <pr url>"
+        md = std::regex_replace(md, std::regex("https?://\\S+"), "");
+        md = std::regex_replace(md, std::regex("(\\*\\*|__|`)"), "");
+
+        std::string out, line;
+        std::istringstream in(md);
+        int blanks = 0;
+        while (std::getline(in, line))
+        {
+            if (startsWith(line, "Full Changelog") || line.find("Full Changelog:") != std::string::npos)
+                continue;
+            line = std::regex_replace(line, std::regex("^#+\\s*"), "");
+            line = std::regex_replace(line, std::regex("^\\s*[*-]\\s+"), "- ");
+            // the UI font has no emoji, drop 4 byte sequences, joiners and variation selectors
+            std::string clean;
+            for (size_t i = 0; i < line.size(); i++)
+            {
+                unsigned char c = line[i];
+                if (c >= 0xF0)
+                {
+                    i += 3;
+                    continue;
+                }
+                if (line.compare(i, 3, "\xE2\x80\x8D") == 0 || line.compare(i, 3, "\xEF\xB8\x8F") == 0)
+                {
+                    i += 2;
+                    continue;
+                }
+                clean += line[i];
+            }
+            line = clean;
+            while (!line.empty() && (line.back() == ' ' || line.back() == '\t'))
+                line.pop_back();
+            if (line.empty())
+            {
+                if (!out.empty() && ++blanks == 1)
+                    out += "\n";
+                continue;
+            }
+            blanks = 0;
+            out += line + "\n";
+        }
+        while (!out.empty() && out.back() == '\n')
+            out.pop_back();
+        return out;
+    }
+
+    std::string formatMB(uint64_t bytes)
+    {
+        char buf[32];
+        snprintf(buf, sizeof(buf), "%.1f", bytes / (1024.0 * 1024.0));
+        return buf;
+    }
+
+    // Where updates get staged. Overridable so the flow can be exercised without
+    // touching the real card contents (and without rebooting).
+    const char *stagingRoot()
+    {
+        const char *root = getenv("NEXTUI_OTA_ROOT");
+        return (root && *root) ? root : SDCARD_PATH;
+    }
+
+    bool mkdirs(const std::string &path)
+    {
+        std::string cur;
+        for (size_t i = 0; i <= path.size(); i++)
+        {
+            if (i == path.size() || path[i] == '/')
+            {
+                if (!cur.empty() && mkdir(cur.c_str(), 0755) != 0 && errno != EEXIST)
+                    return false;
+            }
+            if (i < path.size())
+                cur += path[i];
+        }
+        return true;
+    }
+
+    void removeTree(const std::string &path)
+    {
+        std::string cmd = "rm -rf '" + path + "'";
+        if (system(cmd.c_str()) != 0)
+            LOG_error("OTA: failed to remove %s\n", path.c_str());
+    }
+
+    // What the running install looks like: release name on line 1, short commit sha on line 2.
+    void readInstalledVersion(std::string &name, std::string &sha)
+    {
+        std::ifstream f(ROOT_SYSTEM_PATH "/version.txt");
+        std::getline(f, name);
+        std::getline(f, sha);
+    }
+
+    // Run curl in a child process, writing the response to `dest`. `tick` is polled
+    // while it runs and returns true to cancel. A non-zero `maxSecs` is a hard limit on
+    // top of curl's own timeouts. Returns an empty string on success, kCancelled if
+    // cancelled, otherwise a user facing error.
+    //
+    // The child is started with posix_spawn rather than fork: this process is
+    // multithreaded and large, and a forked child would inherit our signal handlers,
+    // so it could not be reliably killed before it execs.
+    const char *const kCancelled = "Cancelled";
+
+    void killAndReap(pid_t pid)
+    {
+        kill(pid, SIGKILL);
+        // bounded, never block the UI on a child that refuses to die
+        for (int i = 0; i < 100; i++)
+        {
+            int status;
+            pid_t r = waitpid(pid, &status, WNOHANG);
+            if (r == pid || r < 0)
+                return;
+            usleep(10 * 1000);
+        }
+        LOG_error("OTA: curl (pid %d) did not exit\n", (int)pid);
+    }
+
+    std::string curlToFile(const std::string &url, const std::string &dest,
+                           const std::vector<std::string> &extraArgs,
+                           const std::function<bool()> &tick, unsigned pollUs, unsigned maxSecs = 0,
+                           int *curlExit = nullptr)
+    {
+        // HTTP/1.1 only, HTTP/2 stream errors (curl exit 92) were seen on retries
+        std::vector<std::string> args = {"curl", "-f", "-s", "-k", "-L", "--http1.1", "--connect-timeout", "15",
+                                         "-A", "NextUI", "-o", dest, url};
+        args.insert(args.begin() + 1, extraArgs.begin(), extraArgs.end());
+        std::vector<char *> argv;
+        for (auto &a : args)
+            argv.push_back(const_cast<char *>(a.c_str()));
+        argv.push_back(nullptr);
+
+        posix_spawn_file_actions_t actions;
+        posix_spawnattr_t attr;
+        posix_spawn_file_actions_init(&actions);
+        posix_spawnattr_init(&attr);
+        // quiet, curl errors surface through the exit code
+        posix_spawn_file_actions_addopen(&actions, STDOUT_FILENO, "/dev/null", O_WRONLY, 0);
+        posix_spawn_file_actions_addopen(&actions, STDERR_FILENO, "/dev/null", O_WRONLY, 0);
+        // default signal handling and an empty mask, whatever we have installed
+        sigset_t all, none;
+        sigfillset(&all);
+        sigemptyset(&none);
+        posix_spawnattr_setsigdefault(&attr, &all);
+        posix_spawnattr_setsigmask(&attr, &none);
+        posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETSIGDEF | POSIX_SPAWN_SETSIGMASK);
+
+        pid_t pid = 0;
+        int rc = posix_spawnp(&pid, "curl", &actions, &attr, argv.data(), environ);
+        posix_spawn_file_actions_destroy(&actions);
+        posix_spawnattr_destroy(&attr);
+        if (rc != 0)
+            return "Could not start curl";
+
+        const time_t started = time(nullptr);
+        int status = 0;
+        while (true)
+        {
+            pid_t r = waitpid(pid, &status, WNOHANG);
+            if (r == pid)
+                break;
+            if (r < 0)
+                return "Request failed";
+            if (tick())
+            {
+                killAndReap(pid);
+                unlink(dest.c_str());
+                return kCancelled;
+            }
+            if (maxSecs && (unsigned)(time(nullptr) - started) > maxSecs)
+            {
+                killAndReap(pid);
+                unlink(dest.c_str());
+                return "The request timed out";
+            }
+            if (pollUs)
+                usleep(pollUs);
+        }
+
+        if (curlExit)
+            *curlExit = WIFEXITED(status) ? WEXITSTATUS(status) : -1;
+        if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
+            return "";
+        unlink(dest.c_str());
+        if (!WIFEXITED(status))
+            return "Request aborted";
+        switch (WEXITSTATUS(status))
+        {
+        case 6:
+        case 7: return "Could not reach the server";
+        case 22: return "The server returned an error\n(GitHub rate limit?)";
+        case 28: return "The request timed out";
+        default: return "Request failed (curl exit " + std::to_string(WEXITSTATUS(status)) + ")";
+        }
+    }
+
+    std::string fetch(const std::string &url, std::string &out, const std::function<bool()> &tick)
+    {
+        const std::string tmp = "/tmp/nextui-ota-fetch.json";
+        std::string err;
+        // one automatic retry for connection level hiccups (reset, partial transfer, protocol errors)
+        for (int attempt = 0; attempt < 2; attempt++)
+        {
+            int code = 0;
+            err = curlToFile(url, tmp, {"--max-time", "30"}, tick, 0, 45, &code);
+            bool transient = code == 18 || code == 52 || code == 55 || code == 56 || code == 92;
+            if (err.empty() || !transient)
+                break;
+        }
+        if (!err.empty())
+            return err;
+        std::ifstream f(tmp, std::ios::binary);
+        std::stringstream buf;
+        buf << f.rdbuf();
+        out = buf.str();
+        unlink(tmp.c_str());
+        return out.empty() ? "Empty response" : "";
+    }
+
+    const Asset *pickAsset(const Release &release, bool full)
+    {
+        const char *kind = full ? "all" : "base";
+        for (const auto &a : release.assets)
+            if (endsWith(lower(a.name), std::string("-") + kind + ".zip"))
+                return &a;
+        for (const auto &a : release.assets)
+            if (lower(a.name).find(kind) != std::string::npos)
+                return &a;
+        return release.assets.empty() ? nullptr : &release.assets.front();
+    }
+
+    // Modal A/B prompt, returns true on A.
+    bool confirm(const std::string &message)
+    {
+        MenuList::showOverlay(message, OverlayDismissMode::AcceptOrReturn);
+        bool accepted = false;
+        while (true)
+        {
+            GFX_startFrame();
+            PAD_poll();
+            if (PAD_justPressed(BTN_A))
+            {
+                accepted = true;
+                break;
+            }
+            if (PAD_justPressed(BTN_B))
+                break;
+            GFX_sync();
+        }
+        MenuList::hideOverlay();
+        return accepted;
+    }
+
+    ///////////////////////////////////////////////////////////
+    // Install staging
+
+    // Everything in the base package that is user content rather than part of the
+    // boot payload. Base updates only stage what is left (MinUI.zip, boot folders).
+    bool isUserContent(const std::string &name)
+    {
+        static const std::set<std::string> roots = {
+            "Bios", "Roms", "Saves", "Shaders", "Overlays", "Emus", "Cheats", "Collections", "Tools", "README.txt"};
+        std::string first = name.substr(0, name.find('/'));
+        return roots.count(first) || endsWith(lower(first), ".pakz");
+    }
+
+    // Full updates unpack everything except Tools (that is carried by MinUI.zip, and
+    // we are running out of it) and Roms folders for systems the user already has.
+    class FullFilter
+    {
+        std::map<std::string, bool> decided;
+        std::regex tagRe{"\\((\\w+)\\)"};
+
+        bool romFolderExists(const std::string &folder)
+        {
+            std::smatch m;
+            if (!std::regex_search(folder, m, tagRe))
+                return false;
+            std::string needle = "(" + m[1].str() + ")";
+            std::string romsPath = std::string(stagingRoot()) + "/Roms";
+            DIR *d = opendir(romsPath.c_str());
+            if (!d)
+                return false;
+            bool found = false;
+            while (auto *e = readdir(d))
+            {
+                if (std::string(e->d_name).find(needle) != std::string::npos)
+                {
+                    found = true;
+                    break;
+                }
+            }
+            closedir(d);
+            return found;
+        }
+
+    public:
+        bool operator()(const std::string &name)
+        {
+            if (startsWith(name, "Tools/") || name == "Tools")
+                return false;
+            if (startsWith(name, "Roms/"))
+            {
+                std::string folder = name.substr(5, name.find('/', 5) == std::string::npos ? std::string::npos : name.find('/', 5) - 5);
+                if (folder.empty())
+                    return true;
+                auto it = decided.find(folder);
+                if (it == decided.end())
+                    it = decided.emplace(folder, !romFolderExists(folder)).first;
+                return it->second;
+            }
+            return true;
+        }
+    };
+
+    bool safeEntryName(const std::string &name)
+    {
+        if (name.empty() || name[0] == '/' || name.find('\\') != std::string::npos)
+            return false;
+        size_t pos = 0;
+        while (pos <= name.size())
+        {
+            size_t next = name.find('/', pos);
+            std::string part = name.substr(pos, next == std::string::npos ? std::string::npos : next - pos);
+            if (part == "..")
+                return false;
+            if (next == std::string::npos)
+                break;
+            pos = next + 1;
+        }
+        return true;
+    }
+
+    // Shared between the update thread and the UI loop.
+    struct Progress
+    {
+        std::mutex lock;
+        std::string message;
+        std::atomic<bool> cancel{false};
+        std::atomic<bool> cancellable{true};
+
+        void set(const std::string &msg)
+        {
+            std::lock_guard<std::mutex> l(lock);
+            message = msg;
+        }
+        std::string get()
+        {
+            std::lock_guard<std::mutex> l(lock);
+            return message;
+        }
+    };
+
+    // Returns an empty string on success.
+    std::string download(const Asset &asset, const std::string &dest, Progress &progress)
+    {
+        auto tick = [&]() {
+            struct stat st;
+            uint64_t got = (stat(dest.c_str(), &st) == 0) ? (uint64_t)st.st_size : 0;
+            char msg[256];
+            if (asset.size > 0)
+                snprintf(msg, sizeof(msg), "Downloading %s\n\n%d%%  (%s / %s MB)",
+                         asset.name.c_str(), (int)(got * 100 / asset.size),
+                         formatMB(got).c_str(), formatMB(asset.size).c_str());
+            else
+                snprintf(msg, sizeof(msg), "Downloading %s\n\n%s MB", asset.name.c_str(), formatMB(got).c_str());
+            progress.set(msg);
+            return progress.cancel.load();
+        };
+        std::string err = curlToFile(asset.url, dest, {"--speed-limit", "1024", "--speed-time", "30"}, tick, 250 * 1000);
+        if (!err.empty())
+            return err;
+
+        struct stat st;
+        if (stat(dest.c_str(), &st) != 0)
+            return "Download failed";
+        if (asset.size > 0 && (uint64_t)st.st_size != asset.size)
+            return "Download incomplete";
+        return "";
+    }
+
+    struct Entry
+    {
+        zip_uint64_t index;
+        std::string name;
+        zip_uint64_t size;
+        bool isDir;
+    };
+
+    std::string extract(const std::string &zipPath, bool full, const std::string &root, Progress &progress)
+    {
+        int zerr = 0;
+        zip_t *za = zip_open(zipPath.c_str(), ZIP_RDONLY, &zerr);
+        if (!za)
+            return "Could not open update package";
+
+        FullFilter fullFilter;
+        std::vector<Entry> entries;
+        uint64_t total = 0;
+        zip_int64_t count = zip_get_num_entries(za, 0);
+        for (zip_int64_t i = 0; i < count; i++)
+        {
+            zip_stat_t st;
+            if (zip_stat_index(za, i, 0, &st) != 0 || !(st.valid & ZIP_STAT_NAME))
+                continue;
+            std::string name = st.name;
+            if (!safeEntryName(name))
+                continue;
+            if (full ? !fullFilter(name) : isUserContent(name))
+                continue;
+            bool isDir = name.back() == '/';
+            zip_uint64_t size = (st.valid & ZIP_STAT_SIZE) ? st.size : 0;
+            entries.push_back({(zip_uint64_t)i, name, size, isDir});
+            total += size;
+        }
+        if (entries.empty())
+        {
+            zip_close(za);
+            return "Update package has no usable content";
+        }
+
+        // compressed packages (cores) can grow a lot, so check against the real size
+        struct statvfs vfs;
+        if (statvfs(root.c_str(), &vfs) == 0)
+        {
+            uint64_t avail = (uint64_t)vfs.f_bavail * vfs.f_frsize;
+            if (avail < total + 32 * 1024 * 1024)
+            {
+                zip_close(za);
+                return "Not enough free space\n(need " + formatMB(total) + " MB)";
+            }
+        }
+
+        // MinUI.zip is what the boot installer keys off, so it goes in last.
+        std::stable_partition(entries.begin(), entries.end(), [](const Entry &e) { return e.name != "MinUI.zip"; });
+
+        progress.cancellable = false;
+        uint64_t done = 0;
+        int lastPct = -1;
+        std::vector<char> buf(64 * 1024);
+
+        for (const auto &e : entries)
+        {
+            std::string dest = root + "/" + e.name;
+            if (e.isDir)
+            {
+                mkdirs(dest);
+                continue;
+            }
+            mkdirs(dest.substr(0, dest.rfind('/')));
+
+            zip_file_t *zf = zip_fopen_index(za, e.index, 0);
+            if (!zf)
+            {
+                zip_close(za);
+                return "Could not read " + e.name;
+            }
+            // write beside the target and rename, so an interrupted run never leaves a truncated file
+            std::string tmp = dest + ".part";
+            FILE *out = fopen(tmp.c_str(), "wb");
+            if (!out)
+            {
+                zip_fclose(zf);
+                zip_close(za);
+                return "Could not write " + e.name;
+            }
+            bool ok = true;
+            zip_int64_t n;
+            while ((n = zip_fread(zf, buf.data(), buf.size())) > 0)
+            {
+                if (fwrite(buf.data(), 1, n, out) != (size_t)n)
+                {
+                    ok = false;
+                    break;
+                }
+                done += n;
+                int pct = total ? (int)(done * 100 / total) : 100;
+                if (pct != lastPct)
+                {
+                    lastPct = pct;
+                    char msg[128];
+                    snprintf(msg, sizeof(msg), "Extracting update\n\n%d%%\n\nPlease wait...", pct);
+                    progress.set(msg);
+                }
+            }
+            ok = ok && n == 0;
+            ok = (fclose(out) == 0) && ok;
+            zip_fclose(zf);
+            if (!ok || rename(tmp.c_str(), dest.c_str()) != 0)
+            {
+                unlink(tmp.c_str());
+                zip_close(za);
+                return "Failed writing " + e.name + " (disk full?)";
+            }
+        }
+
+        zip_close(za);
+        return "";
+    }
+
+    // Download + extract. Returns an empty string on success.
+    std::string runUpdate(const Asset &asset, bool full, Progress &progress)
+    {
+        std::string root = stagingRoot();
+        std::string workDir = root + "/.ota";
+        std::string zipPath = workDir + "/update.zip";
+
+        removeTree(workDir);
+        if (!mkdirs(workDir))
+            return "Could not create staging folder";
+
+        // package plus its extracted contents need to fit at the same time
+        struct statvfs vfs;
+        if (statvfs(root.c_str(), &vfs) == 0)
+        {
+            uint64_t avail = (uint64_t)vfs.f_bavail * vfs.f_frsize;
+            if (asset.size > 0 && avail < asset.size * 2 + 32 * 1024 * 1024)
+            {
+                removeTree(workDir);
+                return "Not enough free space\n(need about " + formatMB(asset.size * 2) + " MB)";
+            }
+        }
+
+        std::string err = download(asset, zipPath, progress);
+        if (err.empty())
+        {
+            progress.set("Extracting update\n\n0%\n\nPlease wait...");
+            err = extract(zipPath, full, root, progress);
+        }
+        removeTree(workDir);
+        if (err.empty())
+            sync();
+        return err;
+    }
+}
+
+///////////////////////////////////////////////////////////
+
+namespace OTA
+{
+    // Left/right walks through releases (left = older). Moving away from the
+    // newest release requires accepting the downgrade warning once.
+    class VersionItem : public AbstractMenuItem
+    {
+        Menu &menu;
+
+    public:
+        VersionItem(Menu &menu)
+            : AbstractMenuItem(ListItemType::Generic, "Version", "", nullptr), menu(menu)
+        {
+            setHints({"L/R", "CHANGE", "X", "NOTES"});
+        }
+
+        const std::any getValue() const override { return getLabel(); }
+        const std::string getLabel() const override
+        {
+            if (menu.releases.empty())
+                return "-";
+            return menu.releases[menu.selected].tag + (menu.selected == 0 ? " (latest)" : "");
+        }
+
+        InputReactionHint handleInput(int &dirty) override
+        {
+            if (PAD_justPressed(BTN_X))
+            {
+                menu.showNotes();
+                dirty = 1;
+                return NoOp;
+            }
+
+            int step = 0;
+            if (PAD_justRepeated(BTN_LEFT))
+                step = 1;
+            else if (PAD_justRepeated(BTN_RIGHT))
+                step = -1;
+            if (!step)
+                return Unhandled;
+
+            int target = std::max(0, std::min((int)menu.releases.size() - 1, menu.selected + step));
+            if (menu.releases.empty() || target == menu.selected)
+                return NoOp;
+            if (target != 0 && !menu.confirmDowngrade())
+            {
+                dirty = 1;
+                return NoOp;
+            }
+            menu.selected = target;
+            menu.updateStatus();
+            dirty = 1;
+            return NoOp;
+        }
+    };
+
+    Menu::Menu() : MenuList(MenuItemType::Fixed, "OTA Update", {})
+    {
+        items.push_back(new StaticMenuItem(ListItemType::Generic, "Installed", "", [this]() -> std::any { return installedLabel(); }));
+        versionItem = new VersionItem(*this);
+        items.push_back(versionItem);
+        items.push_back(new MenuItem(ListItemType::Button, "Update (Base)", "Update MinUI.zip only",
+                                     [this](AbstractMenuItem &) { return startUpdate(false); }));
+        items.push_back(new MenuItem(ListItemType::Button, "Update (Full)", "Extract full zip files (base + extras)",
+                                     [this](AbstractMenuItem &) { return startUpdate(true); }));
+
+        MenuList::performLayout((SDL_Rect){0, 0, FIXED_WIDTH, FIXED_HEIGHT});
+        layout_called = false;
+    }
+
+    std::string Menu::installedLabel() const
+    {
+        if (installed >= 0)
+            return releases[installed].tag;
+        return installedName.empty() ? "Unknown" : installedName;
+    }
+
+    void Menu::showNotes()
+    {
+        if (releases.empty())
+            return;
+        const Release &release = releases[selected];
+        if (release.notes.empty())
+            MenuList::showOverlay("No release notes available\nfor " + release.tag, OverlayDismissMode::DismissOnA);
+        else
+            MenuList::showTextViewer(release.tag, release.notes);
+    }
+
+    // The Version row's description tells the user what the current selection means.
+    void Menu::updateStatus()
+    {
+        std::string status;
+        if (releases.empty())
+            status = "";
+        else if (installed == selected)
+            status = selected == 0 ? "Up to date" : "Currently installed";
+        else if (installed < 0)
+            status = selected == 0 ? "Update available" : "Older release";
+        else
+            status = selected < installed ? "Update available" : "Downgrade";
+        versionItem->setDesc(status);
+    }
+
+    bool Menu::refresh(std::string &error)
+    {
+        error.clear();
+        if (!(desktopBuild() || PWR_isOnline()))
+        {
+            error = "WiFi is not connected.\nConnect to a network first.";
+            return false;
+        }
+
+        ScopedOverlay overlay("Checking for updates...", OverlayDismissMode::CancelHint);
+        auto cancelled = []() {
+            GFX_startFrame();
+            PAD_poll();
+            bool b = PAD_justPressed(BTN_B);
+            GFX_sync();
+            return b;
+        };
+
+        std::string body, err;
+        err = fetch(OTA_API "/releases?per_page=100", body, cancelled);
+        if (err == kCancelled)
+            return false;
+        if (!err.empty())
+        {
+            error = "Fetching releases failed:\n" + err;
+            return false;
+        }
+
+        Json root;
+        if (!JsonParser(body).value(root) || root.type != Json::Arr)
+        {
+            error = "Fetching releases failed:\nunexpected response";
+            return false;
+        }
+
+        std::vector<Release> found;
+        for (const auto &r : root.arr)
+        {
+            Release rel;
+            rel.tag = r.string("tag_name");
+            rel.notes = cleanNotes(r.string("body"));
+            if (rel.tag.empty())
+                continue;
+            if (auto assets = r.get("assets"))
+            {
+                for (const auto &a : assets->arr)
+                {
+                    Asset asset;
+                    asset.name = a.string("name");
+                    asset.url = a.string("browser_download_url");
+                    asset.size = a.number("size");
+                    if (!asset.name.empty() && !asset.url.empty())
+                        rel.assets.push_back(std::move(asset));
+                }
+            }
+            if (!rel.assets.empty())
+                found.push_back(std::move(rel));
+        }
+        if (found.empty())
+        {
+            error = "No releases found";
+            return false;
+        }
+
+        // Match the installed build against release tags by commit sha. Best
+        // effort, a missing tag list only means we can't tell what is installed.
+        std::string instName, instSha;
+        readInstalledVersion(instName, instSha);
+        int instIdx = -1;
+        body.clear();
+        err = fetch(OTA_API "/tags?per_page=100", body, cancelled);
+        if (err == kCancelled)
+            return false;
+        if (err.empty())
+        {
+            Json tags;
+            if (JsonParser(body).value(tags) && tags.type == Json::Arr)
+            {
+                for (const auto &t : tags.arr)
+                {
+                    std::string name = t.string("name");
+                    auto commit = t.get("commit");
+                    std::string sha = commit ? commit->string("sha") : "";
+                    for (size_t i = 0; i < found.size(); i++)
+                    {
+                        if (found[i].tag != name)
+                            continue;
+                        found[i].sha = sha;
+                        if (instIdx < 0 && !instSha.empty() && startsWith(sha, instSha))
+                            instIdx = (int)i;
+                    }
+                }
+            }
+        }
+
+        releases = std::move(found);
+        installed = instIdx;
+        installedName = instName;
+        selected = 0;
+        warned = false;
+        updateStatus();
+        return true;
+    }
+
+    bool Menu::confirmDowngrade()
+    {
+        if (!warned)
+            warned = confirm(OTA_DOWNGRADE_WARNING);
+        return warned;
+    }
+
+    InputReactionHint Menu::startUpdate(bool full)
+    {
+        if (releases.empty())
+            return NoOp;
+        if (!(desktopBuild() || PWR_isOnline()))
+        {
+            MenuList::showOverlay("WiFi is not connected.", OverlayDismissMode::DismissOnA);
+            return NoOp;
+        }
+
+        const Release &release = releases[selected];
+        const Asset *asset = pickAsset(release, full);
+        if (!asset)
+        {
+            MenuList::showOverlay("No downloadable package found\nfor " + release.tag, OverlayDismissMode::DismissOnA);
+            return NoOp;
+        }
+
+        Progress progress;
+        progress.set("Preparing update...");
+        std::string result;
+        std::atomic<bool> done{false};
+
+        PWR_disableSleep();
+        std::thread worker([&]() {
+            result = runUpdate(*asset, full, progress);
+            done = true;
+        });
+
+        std::string shown;
+        bool shownCancellable = true;
+        MenuList::showOverlay(progress.get(), OverlayDismissMode::CancelHint);
+        while (!done)
+        {
+            GFX_startFrame();
+            PAD_poll();
+
+            if (progress.cancellable && PAD_justPressed(BTN_B))
+                progress.cancel = true;
+
+            std::string current = progress.get();
+            bool cancellable = progress.cancellable;
+            if (current != shown || cancellable != shownCancellable)
+            {
+                shown = current;
+                shownCancellable = cancellable;
+                MenuList::showOverlay(shown, cancellable ? OverlayDismissMode::CancelHint : OverlayDismissMode::None);
+            }
+            GFX_sync();
+        }
+        worker.join();
+        PWR_enableSleep();
+
+        if (!result.empty())
+        {
+            if (result == kCancelled)
+                MenuList::hideOverlay();
+            else
+                MenuList::showOverlay("Update failed:\n" + result, OverlayDismissMode::DismissOnA);
+            return NoOp;
+        }
+
+        // The standalone updater pak is superseded by this menu, offer to clean it up
+        const std::string oldUpdater = std::string(stagingRoot()) + "/Tools/" PLATFORM "/Updater.pak";
+        struct stat st;
+        if (stat(oldUpdater.c_str(), &st) == 0 &&
+            confirm("The standalone Updater pak is\nno longer needed.\n\nRemove it?"))
+            removeTree(oldUpdater);
+
+        if (getenv("NEXTUI_OTA_ROOT") || desktopBuild())
+        {
+            // staged somewhere other than a real card root, nothing to install
+            MenuList::showOverlay("Update staged in\n" + std::string(stagingRoot()), OverlayDismissMode::DismissOnA);
+            return NoOp;
+        }
+
+        MenuList::showOverlay("Update complete,\nrebooting...", OverlayDismissMode::None);
+        sleep(2);
+        PWR_powerOff(1);
+        return NoOp;
+    }
+}
diff --git a/workspace/all/settings/otamenu.hpp b/workspace/all/settings/otamenu.hpp
new file mode 100644
index 000000000..123950722
--- /dev/null
+++ b/workspace/all/settings/otamenu.hpp
@@ -0,0 +1,62 @@
+#pragma once
+
+#include "menu.hpp"
+#include <cstdint>
+#include <string>
+#include <vector>
+
+// Over-the-air updater. Fetches NextUI releases from GitHub, downloads the chosen
+// package and stages it on the SD card root the same way a manual update would
+// (MinUI.zip stays zipped, platform boot folders are extracted). The actual
+// install happens on the next boot, which is what lets us update Settings.pak
+// while it is running.
+namespace OTA
+{
+    // The desktop build has no WiFi status and nothing to reboot into. There the menu
+    // behaves like on a device, but the host counts as online and updates are only
+    // staged in the fake SD card.
+    inline bool desktopBuild() { return std::string(PLATFORM) == "desktop"; }
+
+    struct Asset
+    {
+        std::string name;
+        std::string url;
+        uint64_t size = 0;
+    };
+
+    struct Release
+    {
+        std::string tag;
+        std::string sha; // commit the tag points to, empty if unknown
+        std::string notes; // release notes, cleaned up for display
+        std::vector<Asset> assets;
+    };
+
+    class Menu : public MenuList
+    {
+        friend class VersionItem;
+
+        std::vector<Release> releases;
+        int selected = 0;      // index into releases, 0 is the newest
+        int installed = -1;    // index of the installed release, -1 if unknown
+        bool warned = false;   // downgrade warning accepted for this session
+        std::string installedName;
+
+        AbstractMenuItem *versionItem = nullptr;
+
+    public:
+        Menu();
+
+        // Fetch releases from GitHub, blocks while showing a cancelable overlay.
+        // Returns true on success. On failure `error` holds a user facing message,
+        // or stays empty if the user cancelled.
+        bool refresh(std::string &error);
+
+    private:
+        std::string installedLabel() const;
+        void updateStatus();
+        void showNotes();
+        bool confirmDowngrade();
+        InputReactionHint startUpdate(bool full);
+    };
+}
diff --git a/workspace/all/settings/settings.cpp b/workspace/all/settings/settings.cpp
index f9f740470..ac8e68259 100644
--- a/workspace/all/settings/settings.cpp
+++ b/workspace/all/settings/settings.cpp
@@ -27,6 +27,7 @@ extern "C"
 #include "colorpickermenu.hpp"
 #include "palettemenu.hpp"
 #include "fnbuttonmenu.hpp"
+#include "otamenu.hpp"
 
 #define BUSYBOX_STOCK_VERSION "1.27.2"
 
@@ -1111,7 +1112,7 @@ int main(int argc, char *argv[])
                 "reverting to clean stock firmware.",
                 OverlayDismissMode::DismissOnA);
 
-        auto aboutMenu = new MenuList(MenuItemType::Fixed, "About",
+        std::vector<AbstractMenuItem*> aboutItems =
         {
             new StaticMenuItem{ListItemType::Generic, "NextUI version", "",
             []() -> std::any {
@@ -1133,7 +1134,25 @@ int main(int argc, char *argv[])
             new StaticMenuItem{ListItemType::Generic, "Busybox version", "",
             [&]() -> std::any { return bbver; }
             },
-        });
+        };
+
+        if(deviceInfo.hasWifi() || OTA::desktopBuild())
+        {
+            auto otaMenu = new OTA::Menu();
+            aboutItems.push_back(new MenuItem{ListItemType::Button, "OTA Update", "Update NextUI over the air",
+            [otaMenu](AbstractMenuItem &item) -> InputReactionHint {
+                std::string err;
+                if (!otaMenu->refresh(err))
+                {
+                    if (!err.empty())
+                        MenuList::showOverlay(err, OverlayDismissMode::DismissOnA);
+                    return NoOp;
+                }
+                return DeferToSubmenu(item);
+            }, otaMenu});
+        }
+
+        auto aboutMenu = new MenuList(MenuItemType::Fixed, "About", aboutItems);
 
         MenuList *buttonMenu = buildFnButtonMenu(); // nullptr if this device has none
 

From d875b4bbfb3ac58858ebc92be8610c3ae6b0428a Mon Sep 17 00:00:00 2001
From: frysee <frysee@googlemail.com>
Date: Wed, 14 Oct 2026 00:12:54 +0200
Subject: [PATCH 2/2] feat: remove updateStatus method and related versionItem
 handling in OTA menu

---
 workspace/all/settings/otamenu.cpp | 20 +-------------------
 workspace/all/settings/otamenu.hpp |  3 ---
 2 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/workspace/all/settings/otamenu.cpp b/workspace/all/settings/otamenu.cpp
index 368f06947..3c8c60800 100644
--- a/workspace/all/settings/otamenu.cpp
+++ b/workspace/all/settings/otamenu.cpp
@@ -883,7 +883,6 @@ namespace OTA
                 return NoOp;
             }
             menu.selected = target;
-            menu.updateStatus();
             dirty = 1;
             return NoOp;
         }
@@ -892,8 +891,7 @@ namespace OTA
     Menu::Menu() : MenuList(MenuItemType::Fixed, "OTA Update", {})
     {
         items.push_back(new StaticMenuItem(ListItemType::Generic, "Installed", "", [this]() -> std::any { return installedLabel(); }));
-        versionItem = new VersionItem(*this);
-        items.push_back(versionItem);
+        items.push_back(new VersionItem(*this));
         items.push_back(new MenuItem(ListItemType::Button, "Update (Base)", "Update MinUI.zip only",
                                      [this](AbstractMenuItem &) { return startUpdate(false); }));
         items.push_back(new MenuItem(ListItemType::Button, "Update (Full)", "Extract full zip files (base + extras)",
@@ -921,21 +919,6 @@ namespace OTA
             MenuList::showTextViewer(release.tag, release.notes);
     }
 
-    // The Version row's description tells the user what the current selection means.
-    void Menu::updateStatus()
-    {
-        std::string status;
-        if (releases.empty())
-            status = "";
-        else if (installed == selected)
-            status = selected == 0 ? "Up to date" : "Currently installed";
-        else if (installed < 0)
-            status = selected == 0 ? "Update available" : "Older release";
-        else
-            status = selected < installed ? "Update available" : "Downgrade";
-        versionItem->setDesc(status);
-    }
-
     bool Menu::refresh(std::string &error)
     {
         error.clear();
@@ -1036,7 +1019,6 @@ namespace OTA
         installedName = instName;
         selected = 0;
         warned = false;
-        updateStatus();
         return true;
     }
 
diff --git a/workspace/all/settings/otamenu.hpp b/workspace/all/settings/otamenu.hpp
index 123950722..add4a42b9 100644
--- a/workspace/all/settings/otamenu.hpp
+++ b/workspace/all/settings/otamenu.hpp
@@ -42,8 +42,6 @@ namespace OTA
         bool warned = false;   // downgrade warning accepted for this session
         std::string installedName;
 
-        AbstractMenuItem *versionItem = nullptr;
-
     public:
         Menu();
 
@@ -54,7 +52,6 @@ namespace OTA
 
     private:
         std::string installedLabel() const;
-        void updateStatus();
         void showNotes();
         bool confirmDowngrade();
         InputReactionHint startUpdate(bool full);