Reduce TLS memory requirements for KOReader sync

Split heap gate into separate free-memory (50KB) and largest-block (20KB) thresholds based on field measurements. Enable wolfSSL single-precision ECC to use fixed 256-bit arrays instead of heap-allocated fast-math bignums, reducing TLS handshake memory footprint. Reclaim ~7KB by right-sizing ESP timer task stacks and move WiFi code out of IRAM to free ~25-30KB for heap. Add memory audit landmarks for font and EPUB allocations.

.gitignore

@@ -23,3 +23,9 @@ lib/EpdFont/scripts/output/
 # (worktrees, scheduled-task locks, settings.local, scout CLEANUP.md) out.
 .claude/*
 !.claude/skills/
+/managed_components
+/.dummy
+dependencies.lock
+sdkconfig.default
+sdkconfig.defaults
+CMakeLists.txt

lib/EpdFont/FontDecompressor.cpp

@@ -369,6 +369,11 @@ int FontDecompressor::prewarmCache(const EpdFontData* fontData, const char* utf8
   }
   stats.pageBufferBytes += totalBytes;
   stats.pageGlyphsBytes += glyphCount * sizeof(PageGlyphEntry);
+  // MEMFIX-PORT: page-slot address landmark for the heap map; portable
+  // Landmark for the heap block map: page slots are the largest flash-font
+  // allocations and otherwise show up as anonymous ~4-20 KB used blocks.
+  LOG_DBG("FDC", "page slot buffer=%p bytes=%u glyphs=%u", static_cast<void*>(slot.buffer), (unsigned)totalBytes,
+          (unsigned)glyphCount);
 
   slot.fontData = fontData;
   slot.glyphCount = glyphCount;

lib/EpdFont/SdCardFont.cpp

@@ -68,6 +68,22 @@ bool collectUniqueCodepoints(const char* text, uint32_t* codepoints, uint32_t& c
 const char* asCStr(const std::string& s) { return s.c_str(); }
 const char* asCStr(const char* s) { return s; }
 
+// Keep-if-fits buffer reuse: only reallocate when the needed size exceeds the
+// current capacity. Freeing + reallocating slightly different sizes every page
+// turn punches non-coalescing holes in the heap (the freed block rarely fits the
+// next page's need), eroding the largest contiguous block all session. With
+// reuse, capacities converge on the book's max page after a few turns and page
+// turns stop touching the allocator. Only three small instantiations exist
+// (interval/glyph/byte arrays), so template bloat is negligible.
+template <typename T, typename CapT>
+bool ensureArrayCapacity(T*& buf, CapT& capacity, const uint32_t needed) {
+  if (buf && capacity >= needed) return true;
+  delete[] buf;
+  buf = new (std::nothrow) T[needed > 0 ? needed : 1];
+  capacity = buf ? static_cast<CapT>(needed) : 0;
+  return buf != nullptr;
+}
+
 }  // namespace
 
 SdCardFont::~SdCardFont() { freeAll(); }
@@ -83,6 +99,9 @@ void SdCardFont::freeStyleMiniData(PerStyle& s) {
   s.miniBitmap = nullptr;
   s.miniIntervalCount = 0;
   s.miniGlyphCount = 0;
+  s.miniIntervalCapacity = 0;
+  s.miniGlyphCapacity = 0;
+  s.miniBitmapCapacity = 0;
   freeStyleMiniKern(s);
   memset(&s.miniData, 0, sizeof(s.miniData));
   s.epdFont.data = &s.stubData;
@@ -109,6 +128,9 @@ void SdCardFont::freeStyleMiniKern(PerStyle& s) {
   s.miniKernRightEntryCount = 0;
   s.miniKernLeftClassCount = 0;
   s.miniKernRightClassCount = 0;
+  s.miniKernLeftCapacity = 0;
+  s.miniKernRightCapacity = 0;
+  s.miniKernMatrixCapacity = 0;
 }
 
 void SdCardFont::freeStyleAll(PerStyle& s) {
@@ -311,13 +333,13 @@ bool SdCardFont::buildMiniKernMatrix(PerStyle& s, const uint32_t* codepoints, ui
     if (miniLookupKernClass(s.kernRightClasses, s.header.kernRightEntryCount, codepoints[i]) != 0) miniRightCount++;
   }
 
-  // Step 4: allocate the three mini buffers. The matrix is <1KB in practice
-  // (<30 × <30 × 1 byte) so fragmentation is a non-issue.
+  // Step 4: size the three mini buffers (reused across pages when they fit; the
+  // per-page sizes vary by a few entries, which as free+realloc churn was punching
+  // non-coalescing holes in the heap every page turn).
   const uint32_t matrixBytes = static_cast<uint32_t>(numLeft) * numRight;
-  s.miniKernLeftClasses = new (std::nothrow) EpdKernClassEntry[miniLeftCount];
-  s.miniKernRightClasses = new (std::nothrow) EpdKernClassEntry[miniRightCount];
-  s.miniKernMatrix = new (std::nothrow) int8_t[matrixBytes];
-  if (!s.miniKernLeftClasses || !s.miniKernRightClasses || !s.miniKernMatrix) {
+  if (!ensureArrayCapacity(s.miniKernLeftClasses, s.miniKernLeftCapacity, miniLeftCount) ||
+      !ensureArrayCapacity(s.miniKernRightClasses, s.miniKernRightCapacity, miniRightCount) ||
+      !ensureArrayCapacity(s.miniKernMatrix, s.miniKernMatrixCapacity, matrixBytes)) {
     LOG_ERR("SDCF", "Failed to allocate mini kern (%u+%u+%u bytes)", miniLeftCount * 3u, miniRightCount * 3u,
             matrixBytes);
     freeStyleMiniKern(s);
@@ -793,12 +815,19 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
     return missed;
   }
 
-  // Build mini intervals from sorted codepoints
-  freeStyleMiniData(s);
+  // Build mini intervals from sorted codepoints. Reset counts and fall back to the
+  // stub until the rebuild completes, but KEEP the existing buffers (keep-if-fits
+  // reuse) — the free-and-realloc-per-page pattern here was a primary fragmenter.
+  s.miniIntervalCount = 0;
+  s.miniGlyphCount = 0;
+  s.miniKernLeftEntryCount = 0;
+  s.miniKernRightEntryCount = 0;
+  s.miniKernLeftClassCount = 0;
+  s.miniKernRightClassCount = 0;
+  memset(&s.miniData, 0, sizeof(s.miniData));
+  s.epdFont.data = &s.stubData;
 
-  uint32_t intervalCapacity = validCount;
-  s.miniIntervals = new (std::nothrow) EpdUnicodeInterval[intervalCapacity];
-  if (!s.miniIntervals) {
+  if (!ensureArrayCapacity(s.miniIntervals, s.miniIntervalCapacity, validCount)) {
     LOG_ERR("SDCF", "Failed to allocate mini intervals for style %u", styleIdx);
     delete[] mappings;
     return static_cast<int>(cpCount);
@@ -816,15 +845,14 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
     }
   }
 
-  // Allocate mini glyph array
-  s.miniGlyphCount = validCount;
-  s.miniGlyphs = new (std::nothrow) EpdGlyph[s.miniGlyphCount];
-  if (!s.miniGlyphs) {
+  // Mini glyph array (reused across pages when it fits)
+  if (!ensureArrayCapacity(s.miniGlyphs, s.miniGlyphCapacity, validCount)) {
     LOG_ERR("SDCF", "Failed to allocate mini glyphs for style %u", styleIdx);
     delete[] mappings;
     freeStyleMiniData(s);
     return static_cast<int>(cpCount);
   }
+  s.miniGlyphCount = validCount;
 
   // Build sorted read order for sequential I/O
   uint32_t* readOrder = new (std::nothrow) uint32_t[validCount];
@@ -891,8 +919,7 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
       totalBitmapSize += s.miniGlyphs[i].dataLength;
     }
 
-    s.miniBitmap = new (std::nothrow) uint8_t[totalBitmapSize > 0 ? totalBitmapSize : 1];
-    if (!s.miniBitmap) {
+    if (!ensureArrayCapacity(s.miniBitmap, s.miniBitmapCapacity, totalBitmapSize)) {
       LOG_ERR("SDCF", "Failed to allocate mini bitmap (%u bytes) for style %u", totalBitmapSize, styleIdx);
       delete[] readOrder;
       delete[] mappings;
@@ -1379,6 +1406,33 @@ const EpdGlyph* SdCardFont::onGlyphMiss(void* ctx, uint32_t codepoint) {
   return &self->overflow_[slot].glyph;
 }
 
+size_t SdCardFont::reportMemory() const {
+  size_t total = 0;
+  for (uint8_t si = 0; si < MAX_STYLES; ++si) {
+    const auto& s = styles_[si];
+    if (!s.present) continue;
+    size_t fixed = 0;  // loaded once per family: interval/kern/lig tables
+    if (s.fullIntervals) fixed += s.header.intervalCount * sizeof(EpdUnicodeInterval);
+    if (s.bmpIntervals) fixed += s.header.intervalCount * sizeof(PerStyle::BmpInterval16);
+    if (s.kernLeftClasses) fixed += s.header.kernLeftEntryCount * sizeof(EpdKernClassEntry);
+    if (s.kernRightClasses) fixed += s.header.kernRightEntryCount * sizeof(EpdKernClassEntry);
+    if (s.ligaturePairs) fixed += s.header.ligaturePairCount * sizeof(EpdLigaturePair);
+    // kept-if-fits mini arenas: capacity (not count) is what stays resident
+    size_t mini = s.miniIntervalCapacity * sizeof(EpdUnicodeInterval) + s.miniGlyphCapacity * sizeof(EpdGlyph) +
+                  s.miniBitmapCapacity + s.miniKernLeftCapacity * sizeof(EpdKernClassEntry) +
+                  s.miniKernRightCapacity * sizeof(EpdKernClassEntry) + s.miniKernMatrixCapacity;
+    const size_t adv = advanceTableSize_[si] * sizeof(AdvanceEntry);
+    LOG_DBG("SDCF", "mem style%u: fixed=%u mini=%u adv=%u", si, (unsigned)fixed, (unsigned)mini, (unsigned)adv);
+    total += fixed + mini + adv;
+  }
+  size_t overflowBytes = 0;
+  for (uint32_t i = 0; i < overflowCount_; ++i) {
+    if (overflow_[i].bitmap) overflowBytes += overflow_[i].glyph.dataLength;
+  }
+  total += overflowBytes + overflowCount_ * sizeof(OverflowEntry);
+  return total;
+}
+
 bool SdCardFont::isOverflowGlyph(const EpdGlyph* glyph) const {
   for (uint32_t i = 0; i < overflowCount_; i++) {
     if (&overflow_[i].glyph == glyph) return true;

lib/EpdFont/SdCardFont.h

@@ -104,6 +104,11 @@ class SdCardFont {
     uint32_t uniqueGlyphs = 0;
     uint32_t bitmapBytes = 0;
   };
+  // MEMFIX-PORT: SD font resident-bytes audit; portable
+  // Log per-style resident heap (full tables + kept-if-fits mini arenas +
+  // advance tables + overflow bitmaps) and return the total in bytes. Pure
+  // accounting — no allocation, no state change.
+  size_t reportMemory() const;
   void logStats(const char* label = "SDCF");
   void resetStats();
   const Stats& getStats() const { return stats_; }
@@ -168,13 +173,22 @@ class SdCardFont {
     // Stub EpdFontData returned when not prewarmed
     EpdFontData stubData{};
 
-    // Mini EpdFontData built during prewarm
+    // Mini EpdFontData built during prewarm. Buffers are kept-if-fits across pages
+    // (capacities below track allocated sizes): freeing and reallocating slightly
+    // different sizes on every page turn was a primary heap fragmenter — each page's
+    // freed hole rarely fit the next page's need, so maxAlloc eroded all session.
+    // After a few pages the capacities converge on the book's max and page turns
+    // stop allocating entirely. freeStyleMiniData() still releases everything (and
+    // zeroes capacities) for style eviction / font unload.
     EpdFontData miniData{};
     EpdUnicodeInterval* miniIntervals = nullptr;
     EpdGlyph* miniGlyphs = nullptr;
     uint8_t* miniBitmap = nullptr;
     uint32_t miniIntervalCount = 0;
     uint32_t miniGlyphCount = 0;
+    uint32_t miniIntervalCapacity = 0;
+    uint32_t miniGlyphCapacity = 0;
+    uint32_t miniBitmapCapacity = 0;
 
     // Per-page mini kern matrix (built by buildMiniKernMatrix on each full
     // prewarm). miniKernLeftClasses/miniKernRightClasses map ONLY the codepoints
@@ -189,6 +203,10 @@ class SdCardFont {
     uint8_t miniKernLeftClassCount = 0;
     uint8_t miniKernRightClassCount = 0;
     int8_t* miniKernMatrix = nullptr;
+    // Kept-if-fits capacities, same rationale as the mini glyph buffers above.
+    uint16_t miniKernLeftCapacity = 0;
+    uint16_t miniKernRightCapacity = 0;
+    uint32_t miniKernMatrixCapacity = 0;
 
     // The EpdFont whose data pointer we manage
     EpdFont epdFont{&stubData};

lib/EpdFont/SdCardFontManager.cpp

@@ -88,6 +88,14 @@ void SdCardFontManager::unloadAll(GfxRenderer& renderer) {
   loadedPointSize_ = 0;
 }
 
+size_t SdCardFontManager::reportMemory() const {
+  size_t total = 0;
+  for (const auto& lf : loaded_) {
+    if (lf.font) total += lf.font->reportMemory();
+  }
+  return total;
+}
+
 int SdCardFontManager::getFontId(const std::string& familyName) const {
   if (familyName != loadedFamilyName_ || loaded_.empty()) return 0;
   return loaded_.front().fontId;

lib/EpdFont/SdCardFontManager.h

@@ -32,6 +32,10 @@ class SdCardFontManager {
   // Get name of currently loaded family (empty if none).
   const std::string& currentFamilyName() const { return loadedFamilyName_; };
 
+  // MEMFIX-PORT: font manager audit passthrough; portable
+  // Sum of loaded fonts' resident heap (see SdCardFont::reportMemory).
+  size_t reportMemory() const;
+
   // Point size that was actually loaded.
   // 0 if nothing loaded.
   uint8_t currentPointSize() const { return loadedPointSize_; };

lib/Epub/Epub.h

@@ -44,6 +44,18 @@ class Epub {
   }
   ~Epub() = default;
   std::string& getBasePath() { return contentBasePath; }
+  // MEMFIX-PORT: epub resident-bytes audit accessor; portable
+  // Approximate resident heap of the open book (audit): path strings, the CSS
+  // file list, and the parsed stylesheet. BookMetadataCache is file-backed
+  // (counts + HalFile handles) and contributes little.
+  size_t residentBytes() const {
+    size_t total = sizeof(Epub) + tocNcxItem.capacity() + tocNavItem.capacity() + filepath.capacity() +
+                   contentBasePath.capacity() + cachePath.capacity();
+    for (const auto& f : cssFiles) total += sizeof(f) + (f.capacity() > 15 ? f.capacity() : 0);
+    if (cssParser) total += cssParser->residentBytes();
+    return total;
+  }
+  size_t cssRuleCount() const { return cssParser ? cssParser->ruleCount() : 0; }
   bool load(bool buildIfMissing = true, bool skipLoadingCss = false);
   bool clearCache() const;
   void setupCacheDir() const;

lib/Epub/Epub/Page.cpp

@@ -173,6 +173,10 @@ std::unique_ptr<Page> Page::deserialize(HalFile& file) {
 
   uint16_t count;
   serialization::readPod(file, count);
+  // Reserve up front: growth-by-doubling needs old + new capacity live at once and
+  // reallocates repeatedly — a field crash (bad_alloc -> abort under -fno-exceptions)
+  // hit exactly this append path on a heavily fragmented heap.
+  page->elements.reserve(count);
 
   for (uint16_t i = 0; i < count; i++) {
     uint8_t tag;

lib/Epub/Epub/Section.h

@@ -72,6 +72,7 @@ class Section {
   // Builds write here and are swapped over filePath only on commit, so a prior
   // partial/finalized file stays readable while a rebuild is in progress.
   std::string binTmpPath() const { return filePath + ".part"; }
+
   std::unique_ptr<Page> loadPageAt(int page) const;
   // Read a page already laid out by the in-progress build (page < build LUT size), from
   // the partially-written tmp .bin without disturbing the build's write cursor.
@@ -131,6 +132,20 @@ class Section {
   // (covers finalized sections and partials from a previous session).
   std::optional<uint16_t> findAnchor(const std::string& anchor) const;
 
+  // MEMFIX-PORT: section resident-bytes audit accessor; portable
+  // Approximate resident heap for the audit log. Steady state (no build) a
+  // Section holds little beyond itself; during a build the page LUT and path
+  // strings dominate (the parser's internal footprint is not walked here).
+  size_t residentBytes() const {
+    size_t total = sizeof(Section) + filePath.capacity();
+    if (build_) {
+      total += sizeof(BuildContext) + build_->lut.capacity() * sizeof(PageLutEntry) +
+               build_->parsePath.capacity() + build_->contentBase.capacity() + build_->imageBasePath.capacity() +
+               build_->htmlPath.capacity() + build_->tmpHtmlPath.capacity();
+    }
+    return total;
+  }
+
   // True if this spine's unzipped HTML is already cached, so a build won't pay the (multi-second on a
   // giant spine) zip inflation. Lets the reader skip the indexing popup on a fast reopen/rebuild.
   bool hasHtmlCache() const;

lib/Epub/Epub/css/CssParser.h

@@ -67,6 +67,20 @@ class CssParser {
    */
   [[nodiscard]] static CssStyle parseInlineStyle(std::string_view styleValue);
 
+  // MEMFIX-PORT: stylesheet resident-bytes audit accessor; portable
+  // Approximate resident heap of the parsed stylesheet, for the audit log.
+  // unordered_map cost model: bucket array + one node per rule (libstdc++ node
+  // overhead ~= 2 pointers + hash) + key string capacity when it exceeds SSO.
+  size_t residentBytes() const {
+    size_t total = rulesBySelector_.bucket_count() * sizeof(void*);
+    for (const auto& kv : rulesBySelector_) {
+      total += sizeof(void*) * 2 + sizeof(size_t);  // node overhead
+      total += sizeof(kv);
+      if (kv.first.capacity() > 15) total += kv.first.capacity();  // beyond SSO
+    }
+    return total;
+  }
+
   /**
    * Check if any rules have been loaded
    */

lib/GfxRenderer/FontCacheManager.cpp

@@ -62,7 +62,14 @@ void FontCacheManager::resetStats() {
 bool FontCacheManager::isScanning() const { return scanMode_ == ScanMode::Scanning; }
 
 void FontCacheManager::recordText(const char* text, int fontId, EpdFontFamily::Style style) {
-  scanText_ += text;
+  if (!text) return;
+  const size_t remaining = (scanTextLen_ < SCAN_TEXT_CAPACITY - 1) ? (SCAN_TEXT_CAPACITY - 1 - scanTextLen_) : 0;
+  if (remaining > 0) {
+    const size_t textLen = strnlen(text, remaining);
+    memcpy(scanText_ + scanTextLen_, text, textLen);
+    scanTextLen_ += textLen;
+    scanText_[scanTextLen_] = '\0';
+  }
   if (scanFontId_ < 0) scanFontId_ = fontId;
   const uint8_t baseStyle = static_cast<uint8_t>(style) & 0x03;
   const unsigned char* p = reinterpret_cast<const unsigned char*>(text);
@@ -80,15 +87,15 @@ FontCacheManager::PrewarmScope::PrewarmScope(FontCacheManager& manager) : manage
   manager_->scanMode_ = ScanMode::Scanning;
   manager_->clearCache();
   manager_->resetStats();
-  manager_->scanText_.clear();
-  manager_->scanText_.reserve(2048);  // Pre-allocate to avoid heap fragmentation from repeated concat
+  manager_->scanTextLen_ = 0;
+  manager_->scanText_[0] = '\0';
   memset(manager_->scanStyleCounts_, 0, sizeof(manager_->scanStyleCounts_));
   manager_->scanFontId_ = -1;
 }
 
 void FontCacheManager::PrewarmScope::endScanAndPrewarm() {
   manager_->scanMode_ = ScanMode::None;
-  if (manager_->scanText_.empty()) return;
+  if (manager_->scanTextLen_ == 0) return;
 
   // Build style bitmask from all styles that appeared during the scan
   uint8_t styleMask = 0;
@@ -97,11 +104,10 @@ void FontCacheManager::PrewarmScope::endScanAndPrewarm() {
   }
   if (styleMask == 0) styleMask = 1;  // default to regular
 
-  manager_->prewarmCache(manager_->scanFontId_, manager_->scanText_.c_str(), styleMask);
+  manager_->prewarmCache(manager_->scanFontId_, manager_->scanText_, styleMask);
 
-  // Free scan string memory
-  manager_->scanText_.clear();
-  manager_->scanText_.shrink_to_fit();
+  manager_->scanTextLen_ = 0;
+  manager_->scanText_[0] = '\0';
 }
 
 FontCacheManager::PrewarmScope::~PrewarmScope() {

lib/GfxRenderer/FontCacheManager.h

@@ -2,9 +2,9 @@
 
 #include <EpdFontFamily.h>
 
+#include <cstddef>
 #include <cstdint>
 #include <map>
-#include <string>
 
 class FontDecompressor;
 class SdCardFont;
@@ -51,7 +51,9 @@ class FontCacheManager {
 
   enum class ScanMode : uint8_t { None, Scanning };
   ScanMode scanMode_ = ScanMode::None;
-  std::string scanText_;
+  static constexpr size_t SCAN_TEXT_CAPACITY = 2048;
+  char scanText_[SCAN_TEXT_CAPACITY] = {};
+  size_t scanTextLen_ = 0;
   uint32_t scanStyleCounts_[4] = {};
   int scanFontId_ = -1;
 };

lib/GfxRenderer/GfxRenderer.cpp

@@ -1451,6 +1451,20 @@ void GfxRenderer::displayBuffer(const HalDisplay::RefreshMode refreshMode) const
   display.displayBuffer(refreshMode, fadingFix);
 }
 
+void GfxRenderer::displayBufferAsync(const HalDisplay::RefreshMode refreshMode) const {
+  // The async path has no turn-off-screen hook, which the sunlight fading fix
+  // relies on; keep those users on the blocking path.
+  if (fadingFix) {
+    display.displayBuffer(refreshMode, fadingFix);
+    return;
+  }
+  display.displayBufferAsync(refreshMode);
+}
+
+void GfxRenderer::waitRefreshComplete() const { display.waitRefreshComplete(); }
+
+bool GfxRenderer::supportsAsyncRefresh() const { return !fadingFix && display.supportsAsyncRefresh(); }
+
 std::string GfxRenderer::truncatedText(const int fontId, const char* text, const int maxWidth,
                                        const EpdFontFamily::Style style) const {
   if (!text || maxWidth <= 0) return "";

lib/GfxRenderer/GfxRenderer.h

@@ -135,6 +135,17 @@ class GfxRenderer {
   int getScreenWidth() const;
   int getScreenHeight() const;
   void displayBuffer(HalDisplay::RefreshMode refreshMode = HalDisplay::FAST_REFRESH) const;
+  // Non-blocking refresh: starts the waveform and returns so CPU work (e.g.
+  // grayscale strip rendering) can overlap the panel's refresh time. The
+  // framebuffer must stay untouched until waitRefreshComplete(). Falls back to
+  // a blocking refresh when fadingFix is enabled or the panel lacks deferral
+  // support. See HalDisplay::displayBufferAsync for the baseline contract.
+  void displayBufferAsync(HalDisplay::RefreshMode refreshMode = HalDisplay::FAST_REFRESH) const;
+  void waitRefreshComplete() const;
+  // True when displayBufferAsync() genuinely overlaps: panel defers and
+  // fadingFix isn't forcing the blocking path. Callers can skip overlap
+  // scaffolding (e.g. whole-plane grayscale buffers) when false.
+  bool supportsAsyncRefresh() const;
   // EXPERIMENTAL: Windowed update - display only a rectangular region
   // void displayWindow(int x, int y, int width, int height) const;
   void invertScreen() const;

lib/I18n/translations/english.yaml

@@ -295,6 +295,25 @@ STR_HW_BACK_LABEL: "Back (1st button)"
 STR_HW_CONFIRM_LABEL: "Confirm (2nd button)"
 STR_HW_LEFT_LABEL: "Left (3rd button)"
 STR_HW_RIGHT_LABEL: "Right (4th button)"
+STR_BLUETOOTH: "Bluetooth"
+STR_TOGGLE_BLUETOOTH: "Toggle Bluetooth"
+STR_BT_SCAN_PAIR: "Scan & Pair"
+STR_BT_NO_DEVICES: "No devices found"
+STR_BT_FREE_HINT1: "Set Free2/3 to Reader Mode and"
+STR_BT_FREE_HINT2: "Volume Function to pair"
+STR_BT_DISCONNECT: "Disconnect"
+STR_BT_CONNECTED_TO: "Connected: %s"
+STR_BT_NOT_CONNECTED: "Not connected"
+STR_BT_PAIRED_DEVICES: "Paired Devices"
+STR_BT_NO_PAIRED: "No paired devices"
+STR_BT_MAP_BUTTONS: "Map Remote Buttons"
+STR_BT_PRESS_REMOTE: "Press a button on your remote"
+STR_BT_CONNECTING_POPUP: "BT Connecting..."
+STR_BT_PAUSED_LOW_MEM_POPUP: "BT paused (low memory)"
+STR_STATE_PAUSED: "PAUSED"
+STR_BT_PAGE_FORWARD: "Page Forward"
+STR_BT_PAGE_BACK: "Page Back"
+STR_BT_FORGET_PROMPT: "Hold Confirm to forget"
 STR_GO_TO_PERCENT: "Go to %"
 STR_GO_HOME_BUTTON: "Go Home"
 STR_SYNC_PROGRESS: "Sync Progress"

lib/KOReaderSync/KOReaderSyncClient.cpp

@@ -22,7 +22,21 @@ constexpr char DEVICE_ID[] = "crosspoint-reader";
 // footprint is smaller than mbedTLS's old ~48KB peak, but keep a conservative
 // floor. Check both total free heap and largest contiguous block so fragmented
 // heap does not fall through into a failed TLS allocation path.
-constexpr uint32_t MIN_HEAP_FOR_TLS = 55000;
+// MEMFIX-PORT: TLS heap gate; portable
+// Field data (July 2026): launching sync from a reader session lands at
+// 51.9-58.2 KB free / 42-53 KB maxAlloc after WiFi comes up. wolfSSL handles
+// allocation failure by returning MEMORY_E (no abort under -fno-exceptions),
+// so an optimistic attempt degrades to the same clean "sync failed" as the
+// gate — the gate only needs to keep out states where a doomed handshake
+// would waste tens of seconds, not guarantee success.
+//
+// Free and largest-block have separate requirements: with SP ECC
+// (WOLFSSL_HAVE_SP_ECC) the handshake's crypto uses fixed 256-bit arrays, so
+// the largest single TLS allocation is the ~17 KB wolfSSL record buffer, not
+// a run of fast-math bignums. A handshake was measured succeeding inside a
+// 43 KB largest block; requiring 50 KB contiguous refused syncs that fit.
+constexpr uint32_t MIN_FREE_FOR_TLS = 50000;
+constexpr uint32_t MIN_BLOCK_FOR_TLS = 20000;
 
 // Apply the shared KOSync auth headers after begin(). x-auth-* is the native
 // KOSync scheme; Basic auth is added for Calibre-Web-Automated compatibility.
@@ -39,9 +53,9 @@ void applyAuthHeaders(freeink::SecureHttpClient& http) {
 bool insufficientHeap() {
   const uint32_t freeHeap = ESP.getFreeHeap();
   const uint32_t maxAllocHeap = ESP.getMaxAllocHeap();
-  if (freeHeap < MIN_HEAP_FOR_TLS || maxAllocHeap < MIN_HEAP_FOR_TLS) {
-    LOG_ERR("KOSync", "Insufficient heap for TLS handshake: %u bytes free, %u max alloc (need %u)", freeHeap,
-            maxAllocHeap, MIN_HEAP_FOR_TLS);
+  if (freeHeap < MIN_FREE_FOR_TLS || maxAllocHeap < MIN_BLOCK_FOR_TLS) {
+    LOG_ERR("KOSync", "Insufficient heap for TLS handshake: %u bytes free (need %u), %u max alloc (need %u)", freeHeap,
+            MIN_FREE_FOR_TLS, maxAllocHeap, MIN_BLOCK_FOR_TLS);
     return true;
   }
   return false;

lib/hal/HalDisplay.cpp

@@ -65,6 +65,18 @@ void HalDisplay::displayBuffer(HalDisplay::RefreshMode mode, bool turnOffScreen)
   einkDisplay.displayBuffer(convertRefreshMode(mode), turnOffScreen);
 }
 
+void HalDisplay::displayBufferAsync(HalDisplay::RefreshMode mode) {
+  if (gpio.deviceIsX3() && mode == RefreshMode::HALF_REFRESH) {
+    einkDisplay.requestResync(1);
+  }
+
+  einkDisplay.displayBufferAsyncNoShadow(convertRefreshMode(mode));
+}
+
+void HalDisplay::waitRefreshComplete() { einkDisplay.waitRefreshComplete(); }
+
+bool HalDisplay::supportsAsyncRefresh() const { return einkDisplay.supportsAsyncRefresh(); }
+
 void HalDisplay::refreshDisplay(HalDisplay::RefreshMode mode, bool turnOffScreen) {
   if (gpio.deviceIsX3() && mode == RefreshMode::HALF_REFRESH) {
     einkDisplay.requestResync(1);

lib/hal/HalDisplay.h

@@ -39,6 +39,17 @@ class HalDisplay {
                             bool fromProgmem = false) const;
 
   void displayBuffer(RefreshMode mode = RefreshMode::FAST_REFRESH, bool turnOffScreen = false);
+  // Non-blocking refresh (shadow-free): starts the panel waveform and returns
+  // while the panel refreshes on its own. The framebuffer must stay untouched
+  // until waitRefreshComplete(), and the caller must rebuild the differential
+  // baseline before the next differential update (the tiled grayscale cleanup
+  // does). Panels without deferral fall back to a blocking refresh.
+  void displayBufferAsync(RefreshMode mode = RefreshMode::FAST_REFRESH);
+  // Block until a pending deferred refresh completes (no-op when none is).
+  void waitRefreshComplete();
+  // True when displayBufferAsync() genuinely overlaps (panel driver defers);
+  // false where it falls back to a blocking refresh.
+  bool supportsAsyncRefresh() const;
   void refreshDisplay(RefreshMode mode = RefreshMode::FAST_REFRESH, bool turnOffScreen = false);
 
   // Power management

platformio.ini

@@ -13,7 +13,10 @@ framework = arduino
 monitor_speed = 115200
 upload_speed = 921600
 check_tool = cppcheck
-check_flags = --enable=all --suppress=missingIncludeSystem --suppress=unusedFunction --suppress=unmatchedSuppression --suppress=*:*/.pio/* --inline-suppr
+; missingInclude (project headers) is suppressed alongside missingIncludeSystem: on a
+; fresh CI checkout cppcheck has no resolved include paths, so it reports every
+; project header as missing (~470 information-level lines) and fails the job.
+check_flags = --enable=all --suppress=missingIncludeSystem --suppress=missingInclude --suppress=unusedFunction --suppress=unmatchedSuppression --suppress=*:*/.pio/* --inline-suppr
 check_skip_packages = yes
 
 board_upload.flash_size = 16MB
@@ -42,7 +45,14 @@ build_flags =
   -DWOLFSSL_OPTIONS_H
   -DWOLFSSL_CLIENT_EXAMPLE
   -DWOLFSSL_TLS13
-  -DWOLFSSL_SP_RISCV32
+# MEMFIX-PORT: single-precision ECC (sp_c32.c). Without it every P-256 operation
+# (TLS 1.3 key_share keygen, ECDHE, ECDSA cert verify) runs on fast-math bignums
+# that WOLFSSL_SMALL_STACK heap-allocates at FP_MAX_BITS size -- tens of KB of
+# temporaries, which OOMs (MP_MEM) at the ~50KB free heap a reading session
+# leaves. SP uses fixed 256-bit arrays: a few KB, and several times faster.
+# SP_SMALL trades the large precomputed point tables for smaller flash.
+  -DWOLFSSL_HAVE_SP_ECC
+  -DWOLFSSL_SP_SMALL
   -DHAVE_TLS_EXTENSIONS
   -DHAVE_SUPPORTED_CURVES
   -DHAVE_HKDF
@@ -53,6 +63,16 @@ build_flags =
   -Wno-bidi-chars
   -Wl,--wrap=panic_print_backtrace,--wrap=panic_abort,--wrap=bootloader_common_check_efuse_blk_validity
   -fno-exceptions
+# FreeInk panel profiles: compile both X3 (792x528/UC8253) and X4 (800x480/SSD1677);
+# the firmware picks the active one at runtime via HalDisplay setDisplayX3().
+  -DFREEINK_DEVICE_X3=1
+  -DFREEINK_DEVICE_X4=1
+# BLE HID page-turner host (BleKeyboardHost). NimBLE role/bond config is baked into
+# the prebuilt arduino-esp32 framework's sdkconfig.h, so we don't redefine it here
+# (doing so only warns and has no effect). The host only compiles when
+# FREEINK_CAP_BLE_HID_HOST is set on the env (below); with the capability off,
+# BleKeyboardHost links stubs and pulls in zero NimBLE code.
+  -DFREEINK_BLE_HID_SHOW_UNNAMED_DEVICES=0
 
 build_unflags =
   -std=gnu++11
@@ -63,6 +83,63 @@ board_build.flash_mode = dio
 board_build.flash_size = 16MB
 board_build.partitions = partitions.csv
 
+; Shrink the NimBLE footprint for a 1-connection HID host moving 3-6 byte reports.
+; Field-measured: begin() costs ~52 KB with these trims vs ~68 KB with the prebuilt
+; framework defaults — and that 15 KB is the difference between the stack landing
+; above the reader's render shed floor (stable coexistence) and below it (a
+; guaranteed shed/restart flap). Rebuilds the Arduino core libs on first build
+; (slower once, cached after; needs the CMake pin in platformio.local.ini on macOS).
+custom_sdkconfig =
+  CONFIG_BT_NIMBLE_ROLE_PERIPHERAL=n
+  CONFIG_BT_NIMBLE_ROLE_BROADCASTER=n
+  CONFIG_BT_NIMBLE_MAX_CONNECTIONS=1
+  CONFIG_BT_NIMBLE_MAX_CCCDS=2
+  CONFIG_BT_NIMBLE_ATT_PREFERRED_MTU=23
+  CONFIG_BT_NIMBLE_MSYS_1_BLOCK_COUNT=6
+  CONFIG_BT_NIMBLE_MSYS_2_BLOCK_COUNT=6      ; was 24 x 320 B
+  CONFIG_BT_NIMBLE_ACL_BUF_COUNT=6           ; was 24 x 255 B
+  CONFIG_BT_NIMBLE_HCI_EVT_HI_BUF_COUNT=12   ; was 30 x 70 B; only scan bursts need many
+  ; IDF 5.5 sizes the HCI transport pools under TRANSPORT_* names; pin both spellings.
+  CONFIG_BT_NIMBLE_TRANSPORT_ACL_FROM_LL_COUNT=6
+  CONFIG_BT_NIMBLE_TRANSPORT_EVT_COUNT=12
+  CONFIG_BT_NIMBLE_ATT_MAX_PREP_ENTRIES=4    ; was 64; a HID host never does prepared writes
+  CONFIG_BT_CTRL_BLE_MAX_ACT=3               ; was 6; need conn + scan + initiate only
+  CONFIG_BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_NUM=50   ; was 100; pairing-time scan only
+  CONFIG_BT_CTRL_ADV_DUP_FILT_MAX=10               ; was 30
+  ; MEMFIX-PORT: task stack right-sizing (~7 KB); NOTE develop has no
+  ; custom_sdkconfig block — port via sdkconfig.defaults or equivalent.
+  ; Task stack right-sizing from measured high-water marks (heap block map +
+  ; per-task stack audit, July 2026): esp_timer used ~0.8 KB of 8 KB across
+  ; every capture incl. BLE sessions; the FreeRTOS timer service used ~0.5 KB
+  ; of 4 KB. Neither runs TLS or app code. ~7 KB back to the heap.
+  CONFIG_ESP_TIMER_TASK_STACK_SIZE=4096
+  CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH=2560
+  ; Move the WiFi stack's non-critical hot paths out of IRAM into flash.
+  ; On the C3, IRAM and DRAM share one SRAM pool, so the ~25-30 KB this
+  ; frees lands directly in the heap — paid for with lower WiFi throughput
+  ; during transfers (occasional sync/OTA use, not streaming: acceptable).
+  ; IRAM cost is static, so the heap gain applies even with WiFi off.
+  CONFIG_ESP_WIFI_IRAM_OPT=n
+  CONFIG_ESP_WIFI_RX_IRAM_OPT=n
+  ; Keep the Arduino wrappers for the removed cloud components (below) out of
+  ; the core source list; all other bundled libraries default to enabled.
+  CONFIG_ARDUINO_SELECTIVE_COMPILATION=y
+  CONFIG_ARDUINO_SELECTIVE_RainMaker=n
+  CONFIG_ARDUINO_SELECTIVE_Insights=n
+
+; Drop unused cloud components from the core rebuild. esp_insights/rainmaker
+; require embedded server certs the lib builder can't generate
+; ("https_server.crt.S not found"); this firmware uses none of them.
+custom_component_remove =
+  espressif/esp_insights
+  espressif/esp_rainmaker
+  espressif/esp_diagnostics
+  espressif/esp_diag_data_store
+  espressif/esp_schedule
+  espressif/esp_rcp_update
+  espressif/esp_secure_cert_mgr
+  espressif/cbor
+
 extra_scripts =
   pre:scripts/patch_wolfssl.py
   pre:scripts/build_html.py
@@ -77,11 +154,16 @@ lib_deps =
   InputManager=symlink://freeink-sdk/libs/hardware/InputManager
   EInkDisplay=symlink://freeink-sdk/libs/display/FreeInkDisplay
   SDCardManager=symlink://freeink-sdk/libs/hardware/SDCardManager
+  ; FreeInk HAL support libs the above depend on (BoardConfig pin maps, etc.).
   BoardConfig=symlink://freeink-sdk/libs/hardware/BoardConfig
   PowerManager=symlink://freeink-sdk/libs/hardware/PowerManager
+  Rtc=symlink://freeink-sdk/libs/hardware/Rtc
+  Imu=symlink://freeink-sdk/libs/hardware/Imu
   SecureNet=symlink://freeink-sdk/libs/network/SecureNet
   FreeInkUI=symlink://freeink-sdk/libs/ui/FreeInkUI
   Icons=symlink://freeink-sdk/libs/assets/Icons
+  BleKeyboardHost=symlink://freeink-sdk/libs/network/BleKeyboardHost
+  h2zero/NimBLE-Arduino @ ^2.3.8
   bblanchon/ArduinoJson @ 7.4.2
   ricmoo/QRCode @ 0.0.1
   bitbank2/PNGdec @ 1.1.6
@@ -99,6 +181,9 @@ build_flags =
   ; CROSSPOINT_VERSION is set by scripts/git_branch.py (includes branch + short SHA)
   -DENABLE_SERIAL_LOG
   -DLOG_LEVEL=2 ; Set log level to debug for development builds
+  -DFREEINK_CAP_BLE_HID_HOST=1 ; BLE HID page-turner host (NimBLE)
+  -DFREEINK_BLE_HID_SCAN_DEBUG=1 ; verbose BLE scan lifecycle/advertisement logs for bring-up
+  -DFREEINK_BLE_HID_REPORT_DEBUG=1 ; raw HID report hex dumps + report-map hints (bring-up)
 
 
 [env:gh_release]
@@ -108,6 +193,7 @@ build_flags =
   -DCROSSPOINT_VERSION=\"${crosspoint.version}\"
   -DENABLE_SERIAL_LOG
   -DLOG_LEVEL=1 ; Set log level to info for release builds
+  -DFREEINK_CAP_BLE_HID_HOST=1 ; BLE HID page-turner host (NimBLE)
 
 [env:gh_release_rc]
 extends = base
@@ -116,6 +202,7 @@ build_flags =
   -DCROSSPOINT_VERSION=\"${crosspoint.version}-rc+${sysenv.CROSSPOINT_RC_HASH}\"
   -DENABLE_SERIAL_LOG
   -DLOG_LEVEL=1 ; Set log level to info for release candidate builds
+  -DFREEINK_CAP_BLE_HID_HOST=1 ; BLE HID page-turner host (NimBLE)
 
 [env:slim]
 extends = base

scripts/patch_wolfssl.py

@@ -12,8 +12,12 @@ OVERRIDES = f"""
 #ifndef HAVE_FFDHE_2048
 #define HAVE_FFDHE_2048
 #endif
+/* MEMFIX-PORT: 8192 handles up to RSA-4096 keys (the public-CA maximum,
+   ISRG Root X1 included) with half the per-bignum heap of 16384: with
+   WOLFSSL_SMALL_STACK each fast-math temp is FP_MAX_BITS/8 * 2 bytes on the
+   heap, and TLS cert verification allocates dozens at once. */
 #undef FP_MAX_BITS
-#define FP_MAX_BITS 16384
+#define FP_MAX_BITS 8192
 """
 
 

src/BleInput.cpp

@@ -0,0 +1,121 @@
+#include "BleInput.h"
+
+#include <GfxRenderer.h>
+#include <HalPowerManager.h>
+#include <I18n.h>
+
+#include <cstdio>
+#include <cstring>
+
+#include "MappedInputManager.h"
+#include "components/UITheme.h"
+
+namespace bleinput {
+
+namespace {
+volatile bool g_startInProgress = false;
+}
+
+// NimBLE controller init/deinit hang (interrupt WDT) if run at the 10 MHz low-power
+// frequency, so force normal CPU speed around both. Centralized here so every caller
+// (boot restore, settings toggle, reader toggle, sleep) is covered automatically.
+bool ensureStarted() {
+  g_startInProgress = true;
+  HalPowerManager::Lock powerLock;
+  const bool ok = BleHid.begin(kHostName);
+  g_startInProgress = false;
+  return ok;
+}
+
+bool startInProgress() { return g_startInProgress; }
+
+// Full teardown (NimBLE deinit), not just a link drop, so the BLE stack's RAM is
+// returned to the heap — otherwise memory-hungry work like EPUB inflate can't
+// allocate even after the user turns Bluetooth off.
+void stop() {
+  HalPowerManager::Lock powerLock;
+  BleHid.end();
+}
+
+bool encodeKey(const freeink::KeyEvent& ev, uint8_t& kind, uint8_t& value) {
+  if (ev.special != freeink::SpecialKey::None) {
+    kind = 0;
+    value = static_cast<uint8_t>(ev.special);
+    return true;
+  }
+  if (ev.keycode != 0) {
+    kind = 1;
+    value = ev.keycode;
+    return true;
+  }
+  return false;
+}
+
+namespace {
+const char* specialName(uint8_t value) {
+  switch (static_cast<freeink::SpecialKey>(value)) {
+    case freeink::SpecialKey::Enter:
+      return "Enter";
+    case freeink::SpecialKey::Backspace:
+      return "Backspace";
+    case freeink::SpecialKey::Tab:
+      return "Tab";
+    case freeink::SpecialKey::Escape:
+      return "Escape";
+    case freeink::SpecialKey::Delete:
+      return "Delete";
+    case freeink::SpecialKey::Left:
+      return "Left";
+    case freeink::SpecialKey::Right:
+      return "Right";
+    case freeink::SpecialKey::Up:
+      return "Up";
+    case freeink::SpecialKey::Down:
+      return "Down";
+    case freeink::SpecialKey::Home:
+      return "Home";
+    case freeink::SpecialKey::End:
+      return "End";
+    case freeink::SpecialKey::PageUp:
+      return "Page Up";
+    case freeink::SpecialKey::PageDown:
+      return "Page Down";
+    default:
+      return nullptr;
+  }
+}
+}  // namespace
+
+void showConnectingUntilLinked(const GfxRenderer& renderer, const MappedInputManager& input) {
+  if (!BleHid.isRunning() || BleHid.isConnected()) return;
+  // drawPopup refreshes the panel itself, so draw once and let e-ink hold it while we
+  // pump the host. Holds until the remote links, the user presses a button to bail, or
+  // a generous timeout (a remote that slept after a disconnect needs a button to wake).
+  GUI.drawPopup(renderer, tr(STR_BT_CONNECTING_POPUP));
+  const unsigned long deadline = millis() + 10000;
+  while (!BleHid.isConnected() && millis() < deadline) {
+    BleHid.poll();
+    input.update();
+    if (input.wasAnyPressed()) break;
+    delay(50);
+  }
+  // Note: the caller must redraw to clear the popup. For grayscale reader pages the
+  // caller should also request a ghost-cleanup (HALF) refresh first — a plain fast/
+  // partial refresh ghosts badly over the BW popup (see Activity::requestGhostCleanup).
+}
+
+void describeKey(uint8_t kind, uint8_t value, char* out, size_t outLen) {
+  if (!out || outLen == 0) return;
+  if (kind == 0) {
+    const char* name = specialName(value);
+    if (name) {
+      strncpy(out, name, outLen - 1);
+      out[outLen - 1] = '\0';
+      return;
+    }
+  }
+  // Printable ASCII usage handled as a generic key code; show the raw value.
+  snprintf(out, outLen, "Key 0x%02X", static_cast<unsigned>(value));
+}
+
+}  // namespace bleinput

src/BleInput.h

@@ -0,0 +1,62 @@
+#pragma once
+
+// CrossPoint <-> FreeInk BLE HID host glue.
+//
+// Thin, capability-safe helpers around freeink::BleKeyboardHost (the `BleHid`
+// singleton). When FREEINK_CAP_BLE_HID_HOST is compiled out the SDK links stubs,
+// so every call here is still valid and simply no-ops / returns false — callers
+// need no #ifdefs.
+//
+// The (kind, value) pair produced by encodeKey() is the stable identity stored in
+// CrossPointSettings::bleKeyMap. Page-turner remotes emit "special" keys
+// (PageUp/PageDown/arrows); plain keyboards emit usage codes. We deliberately
+// ignore modifiers and the printable char for matching (page turners don't use
+// modifiers), keeping the persisted entry a trivial two-byte comparison.
+
+#include <BleKeyboardHost.h>
+
+#include <cstdint>
+
+class GfxRenderer;
+class MappedInputManager;
+
+namespace bleinput {
+
+// Advertised central name shown to peripherals during pairing.
+inline constexpr const char* kHostName = "CrossPoint";
+
+// Heap floor for starting the NimBLE stack (measured begin() cost: ~52-57 KB).
+// The reader now lends the framebuffer to section builds, so BLE startup no
+// longer needs to reserve the old full build headroom. Keep a modest margin and
+// let the render/build shed paths handle genuinely tight moments.
+inline constexpr size_t kStartMinFreeHeap = 56 * 1024;
+
+// Lower floor for the Bluetooth settings screen, where the user has explicitly asked
+// for BLE right now (scanning/pairing is dead without the stack). No page renders or
+// section builds run there, so the reader-sized reserve above doesn't apply — only
+// NimBLE's own ~57 KB plus working margin.
+inline constexpr size_t kStartMinFreeHeapExplicit = 70 * 1024;
+
+// Start the BLE HID host (idempotent). Returns false if BLE is compiled out or
+// NimBLE init failed. Safe to call repeatedly.
+bool ensureStarted();
+bool startInProgress();
+
+// Drop the active link (e.g. before deep sleep or when the user disables BT).
+void stop();
+
+// Encode a decoded key event into the stable (kind, value) identity used by the
+// settings map. kind: 0 = SpecialKey, 1 = HID usage. Returns false when the event
+// carries no usable identity (no special key and no usage code).
+bool encodeKey(const freeink::KeyEvent& ev, uint8_t& kind, uint8_t& value);
+
+// Human-readable name for a stored (kind, value) identity, for the mapping UI.
+// Writes a null-terminated string into out (e.g. "Page Down", "Key 0x4B").
+void describeKey(uint8_t kind, uint8_t value, char* out, size_t outLen);
+
+// Draw a "BT Connecting..." popup and pump the BLE host until the bonded remote
+// links, the user presses a button to dismiss, or a timeout. No-op if BLE isn't
+// running or is already connected. The caller must redraw afterward to clear it.
+void showConnectingUntilLinked(const GfxRenderer& renderer, const MappedInputManager& input);
+
+}  // namespace bleinput

src/CrossPointSettings.h

@@ -225,6 +225,22 @@ class CrossPointSettings {
   uint8_t frontButtonConfirm = FRONT_HW_CONFIRM;
   uint8_t frontButtonLeft = FRONT_HW_LEFT;
   uint8_t frontButtonRight = FRONT_HW_RIGHT;
+  // --- Bluetooth (BLE HID page-turner) ---
+  // Master on/off for the BLE HID host. Persisted; auto-restored on boot/wake.
+  // Managed by BluetoothSettingsActivity and the in-reader "Toggle Bluetooth" menu item.
+  uint8_t bluetoothEnabled = 0;
+  // Remote-button mapping table: each slot binds a decoded BLE key identity to a
+  // logical MappedInputManager::Button. Fixed-capacity POD (no heap), persisted
+  // manually in JsonSettingsIO (like the front-button remap). 0xFF = empty/unassigned.
+  // Headroom for several buttons plus optional presets and rolling-code remotes
+  // (some buttons emit more than one code). Each entry is 3 bytes.
+  static constexpr uint8_t BLE_MAP_CAPACITY = 10;
+  struct BleKeyMapEntry {
+    uint8_t keyKind = 0xFF;  // 0 = SpecialKey, 1 = HID usage code; 0xFF = empty slot
+    uint8_t keyValue = 0;    // (uint8_t)freeink::SpecialKey, or the raw HID usage id
+    uint8_t button = 0xFF;   // (uint8_t)MappedInputManager::Button; 0xFF = unassigned
+  };
+  BleKeyMapEntry bleKeyMap[BLE_MAP_CAPACITY] = {};
   // Reader font settings
   uint8_t fontFamily = NOTOSERIF;
   uint8_t fontSize = MEDIUM;

src/HeapMap.cpp

@@ -0,0 +1,85 @@
+#include "HeapMap.h"
+
+#include <Arduino.h>
+#include <Logging.h>
+#include <Memory.h>
+#include <esp_heap_caps.h>
+
+#include <cstdio>
+
+#include "rom/ets_sys.h"
+
+// heap_caps_dump walks each heap inside a critical section (interrupts
+// masked), so its output can neither go through the UART-0 ROM path we can't
+// see nor be flow-controlled toward the CDC (the CDC ring drains in an
+// interrupt handler — waiting deadlocks into the interrupt WDT,
+// field-verified). Instead the ROM putc parses each line into a compact
+// record; the captured table is logged after the dump with interrupts live.
+namespace heapmap {
+namespace {
+struct BlockRec {
+  uint32_t addr;
+  uint32_t size;
+  bool free;
+};
+constexpr uint16_t kMaxRecs = 1400;
+BlockRec* g_recs = nullptr;  // borrowed buffer, valid only during capture
+uint16_t g_recCount = 0;
+bool g_overflowed = false;
+char g_line[96];
+uint8_t g_lineLen = 0;
+
+void captInterpolatePutc(char c) {
+  if (c != '\n') {
+    if (g_lineLen < sizeof(g_line) - 1) g_line[g_lineLen++] = c;
+    return;
+  }
+  g_line[g_lineLen] = '\0';
+  g_lineLen = 0;
+  // e.g. "Block 0x3fcc69bc data, size: 89424 bytes, Free: Yes"
+  unsigned addr = 0, size = 0;
+  char freeWord[4] = {0};
+  if (sscanf(g_line, "Block 0x%x data, size: %u bytes, Free: %3s", &addr, &size, freeWord) == 3) {
+    if (g_recs && g_recCount < kMaxRecs) {
+      g_recs[g_recCount++] = {addr, size, freeWord[0] == 'Y'};
+    } else {
+      g_overflowed = true;
+    }
+  }
+}
+}  // namespace
+
+void dump() {
+  auto recBuf = makeUniqueNoThrow<BlockRec[]>(kMaxRecs);
+  if (!recBuf) {
+    LOG_ERR("MEM", "heap map skipped: no room for capture buffer");
+    return;
+  }
+  g_recs = recBuf.get();
+  g_recCount = 0;
+  g_overflowed = false;
+  g_lineLen = 0;
+  // Capture (interrupts masked inside the dump): parse into records, never
+  // wait. Log the table afterward with the system live. NOTE: the capture
+  // buffer itself appears in the map as a used block of ~17.4 KB — it frees
+  // on return (observer effect, do not chase it as a leak/splitter).
+  ets_install_putc1(&captInterpolatePutc);
+  heap_caps_dump(MALLOC_CAP_8BIT);
+  ets_install_uart_printf();
+  g_recs = nullptr;
+
+  LOG_DBG("MEM", "---- heap block map: %u blocks%s ----", g_recCount, g_overflowed ? " (TRUNCATED)" : "");
+  uint32_t dustCount = 0, dustBytes = 0;
+  for (uint16_t i = 0; i < g_recCount; ++i) {
+    const auto& r = recBuf[i];
+    if (r.free || r.size >= 256) {
+      LOG_DBG("MEM", "%s 0x%08x %u", r.free ? "FREE" : "used", r.addr, r.size);
+    } else {
+      dustCount++;
+      dustBytes += r.size;
+    }
+  }
+  LOG_DBG("MEM", "dust: %u used blocks < 256B totaling %u bytes", dustCount, dustBytes);
+  LOG_DBG("MEM", "---- end heap block map ----");
+}
+}  // namespace heapmap

src/HeapMap.h

@@ -0,0 +1,10 @@
+#pragma once
+
+// MEMFIX-PORT: heap block map (on-demand via CMD:MEMMAP + reader one-shot); portable, no BLE dependency
+namespace heapmap {
+// Capture-and-log the DRAM heap block map (address/size/free per block,
+// sub-256B used blocks rolled up as "dust"). Safe to call from the main loop;
+// ~60-100 LOG_DBG lines. See HeapMap.cpp for why capture-then-log is the only
+// shape that works (heap_caps_dump runs with interrupts masked).
+void dump();
+}  // namespace heapmap

src/JsonSettingsIO.cpp

@@ -7,11 +7,13 @@
 
 #include <algorithm>
 #include <cstring>
+#include <iterator>
 #include <string>
 
 #include "BookmarkEntry.h"
 #include "CrossPointSettings.h"
 #include "CrossPointState.h"
+#include "MappedInputManager.h"
 #include "OpdsServerStore.h"
 #include "RecentBooksStore.h"
 #include "SettingsList.h"
@@ -143,6 +145,16 @@ bool JsonSettingsIO::saveSettings(const CrossPointSettings& s, const char* path)
   doc["frontButtonConfirm"] = s.frontButtonConfirm;
   doc["frontButtonLeft"] = s.frontButtonLeft;
   doc["frontButtonRight"] = s.frontButtonRight;
+  // Bluetooth — managed by BluetoothSettingsActivity, not in SettingsList.
+  doc["bluetoothEnabled"] = s.bluetoothEnabled;
+  JsonArray bleMap = doc["bleKeyMap"].to<JsonArray>();
+  for (const auto& e : s.bleKeyMap) {
+    if (e.keyKind == 0xFF || e.button == 0xFF) continue;  // skip empty/unassigned slots
+    JsonObject o = bleMap.add<JsonObject>();
+    o["k"] = e.keyKind;
+    o["v"] = e.keyValue;
+    o["b"] = e.button;
+  }
   // Font family — uses dynamic getter/setter in SettingsList so the generic loop skips it.
   doc["fontFamily"] = s.fontFamily;
   // SD card font family name — not in SettingsList, save manually
@@ -240,6 +252,23 @@ bool JsonSettingsIO::loadSettings(CrossPointSettings& s, const char* json, bool*
       clamp(doc["frontButtonRight"] | (uint8_t)S::FRONT_HW_RIGHT, S::FRONT_BUTTON_HARDWARE_COUNT, S::FRONT_HW_RIGHT);
   CrossPointSettings::validateFrontButtonMapping(s);
 
+  // Bluetooth — managed by BluetoothSettingsActivity, not in SettingsList.
+  s.bluetoothEnabled = clamp(doc["bluetoothEnabled"] | (uint8_t)0, 2, 0);
+  std::fill(std::begin(s.bleKeyMap), std::end(s.bleKeyMap), CrossPointSettings::BleKeyMapEntry{});  // reset to empty
+  JsonArrayConst bleMap = doc["bleKeyMap"];
+  if (!bleMap.isNull()) {
+    uint8_t slot = 0;
+    for (JsonObjectConst o : bleMap) {
+      if (slot >= CrossPointSettings::BLE_MAP_CAPACITY) break;
+      const uint8_t button = o["b"] | (uint8_t)0xFF;
+      if (button >= MappedInputManager::kButtonCount) continue;  // drop invalid mappings
+      s.bleKeyMap[slot].keyKind = o["k"] | (uint8_t)0xFF;
+      s.bleKeyMap[slot].keyValue = o["v"] | (uint8_t)0;
+      s.bleKeyMap[slot].button = button;
+      slot++;
+    }
+  }
+
   // Font family — uses dynamic getter/setter in SettingsList so the generic loop skips it.
   const uint8_t storedFontFamily = doc["fontFamily"] | (uint8_t)0;
   s.fontFamily = clamp(storedFontFamily, CrossPointSettings::BUILTIN_FONT_COUNT, 0);

src/MappedInputManager.cpp

@@ -2,6 +2,7 @@
 
 #include <GfxRenderer.h>
 
+#include "BleInput.h"
 #include "CrossPointSettings.h"
 
 bool MappedInputManager::isNavDirectionSwapped() const {
@@ -74,17 +75,105 @@ bool MappedInputManager::mapButton(const Button button, bool (HalGPIO::*fn)(uint
   return false;
 }
 
-bool MappedInputManager::wasPressed(const Button button) const { return mapButton(button, &HalGPIO::wasPressed); }
+bool MappedInputManager::bleEdge(const bool* arr, const Button button) const {
+  // Mirror mapButton()'s composite navigation handling so a BLE key bound to a
+  // physical direction also satisfies the derived NavNext / NavPrevious logical
+  // buttons (used by list navigation), respecting the orientation axis flip.
+  switch (button) {
+    case Button::NavNext:
+      return isNavDirectionSwapped() ? (arr[(int)Button::Up] || arr[(int)Button::Left])
+                                     : (arr[(int)Button::Down] || arr[(int)Button::Right]);
+    case Button::NavPrevious:
+      return isNavDirectionSwapped() ? (arr[(int)Button::Down] || arr[(int)Button::Right])
+                                     : (arr[(int)Button::Up] || arr[(int)Button::Left]);
+    default:
+      return arr[(int)button];
+  }
+}
 
-bool MappedInputManager::wasReleased(const Button button) const { return mapButton(button, &HalGPIO::wasReleased); }
+bool MappedInputManager::wasPressed(const Button button) const {
+  return mapButton(button, &HalGPIO::wasPressed) || bleEdge(blePressEdge, button);
+}
 
-bool MappedInputManager::isPressed(const Button button) const { return mapButton(button, &HalGPIO::isPressed); }
+bool MappedInputManager::wasReleased(const Button button) const {
+  return mapButton(button, &HalGPIO::wasReleased) || bleEdge(bleReleaseEdge, button);
+}
+
+bool MappedInputManager::isPressed(const Button button) const {
+  // A BLE tap is momentary: report "pressed" only on the press-edge frame.
+  return mapButton(button, &HalGPIO::isPressed) || bleEdge(blePressEdge, button);
+}
+
+void MappedInputManager::setBleCaptureMode(const bool on) {
+  bleCaptureMode = on;
+  bleHasCaptured = false;
+  if (on) {
+    // Clear any stale overlay so a held remote key doesn't leak into the UI.
+    for (uint8_t i = 0; i < kButtonCount; i++) {
+      blePressEdge[i] = false;
+      bleReleaseEdge[i] = false;
+    }
+  }
+}
+
+bool MappedInputManager::takeCapturedBleKey(uint8_t& kind, uint8_t& value) {
+  if (!bleHasCaptured) return false;
+  kind = bleCapturedKind;
+  value = bleCapturedValue;
+  bleHasCaptured = false;
+  return true;
+}
+
+void MappedInputManager::pollBle() {
+  bleActivityThisFrame = false;
+  // Age last frame's press edges into this frame's release edges (the FreeInk host
+  // surfaces presses + synthetic repeats but never releases), then clear presses. A
+  // pending release also counts as BLE activity this frame so getHeldTime() reports
+  // zero on the release frame too (page-turn handlers often fire on release).
+  for (uint8_t i = 0; i < kButtonCount; i++) {
+    bleReleaseEdge[i] = blePressEdge[i];
+    blePressEdge[i] = false;
+    if (bleReleaseEdge[i]) bleActivityThisFrame = true;
+  }
+
+  freeink::KeyEvent ev;
+  while (BleHid.popKey(ev)) {
+    uint8_t kind = 0xFF;
+    uint8_t value = 0;
+    if (!bleinput::encodeKey(ev, kind, value)) continue;
+
+    if (bleCaptureMode) {
+      bleCapturedKind = kind;
+      bleCapturedValue = value;
+      bleHasCaptured = true;
+      continue;
+    }
+
+    // Resolve the key identity against the persisted mapping table.
+    for (const auto& e : SETTINGS.bleKeyMap) {
+      if (e.button == 0xFF || e.keyKind != kind || e.keyValue != value) continue;
+      if (e.button < kButtonCount) {
+        blePressEdge[e.button] = true;
+        bleActivityThisFrame = true;
+      }
+      break;
+    }
+  }
+}
 
 bool MappedInputManager::wasAnyPressed() const { return gpio.wasAnyPressed(); }
 
 bool MappedInputManager::wasAnyReleased() const { return gpio.wasAnyReleased(); }
 
-unsigned long MappedInputManager::getHeldTime() const { return gpio.getHeldTime(); }
+unsigned long MappedInputManager::getHeldTime() const {
+  // A BLE-mapped key is a momentary tap with no physical hold (we don't model BLE
+  // press-and-hold). gpio.getHeldTime() returns the *last physical* button's hold
+  // duration, which is stale — if a BLE edge drove input this frame, reporting that
+  // stale value makes a tap look like a long-press (e.g. page tap -> chapter skip).
+  // Report zero in that case so BLE taps are always treated as short presses.
+  if (bleActivityThisFrame) return 0;
+  return gpio.getHeldTime();
+}
 
 MappedInputManager::Labels MappedInputManager::mapLabels(const char* back, const char* confirm, const char* previous,
                                                          const char* next) const {

src/MappedInputManager.h

@@ -7,6 +7,9 @@ class GfxRenderer;
 class MappedInputManager {
  public:
   enum class Button { Back, Confirm, Left, Right, Up, Down, Power, PageBack, PageForward, NavNext, NavPrevious };
+  // Number of values in Button (Back..NavPrevious). Used to size the BLE overlay and
+  // to clamp persisted BLE mappings. Keep in sync with the enum above.
+  static constexpr uint8_t kButtonCount = 11;
 
   struct Labels {
     const char* btn1;
@@ -28,6 +31,23 @@ class MappedInputManager {
   // Returns the raw front button index that was pressed this frame (or -1 if none).
   int getPressedFrontButton() const;
 
+  // --- BLE page-turner overlay -------------------------------------------------
+  // Drain decoded key events from the FreeInk BLE HID host and translate the ones
+  // bound in SETTINGS.bleKeyMap into per-frame logical-button edges that OR into
+  // wasPressed()/isPressed()/wasReleased(). Call once per main-loop iteration,
+  // right after gpio.update() and BleHid.poll(). No-ops when BLE is compiled out.
+  void pollBle();
+  // True when a mapped BLE key produced an edge this frame — keeps the inactivity
+  // / auto-sleep timer alive while a remote is the only input device in use.
+  bool bleHadActivityThisFrame() const { return bleActivityThisFrame; }
+  // Capture mode: while on, pollBle() stops mapping events and instead stashes the
+  // raw decoded key identity so the button-mapping UI can read it without racing the
+  // live mapping over the single popKey() queue.
+  void setBleCaptureMode(bool on);
+  // Pop a captured (kind, value) key identity grabbed while in capture mode.
+  // Returns false when nothing has been captured since the last call.
+  bool takeCapturedBleKey(uint8_t& kind, uint8_t& value);
+
   // True when the control axis is flipped relative to the physical buttons: the user opted into
   // orientation-following front buttons AND the screen is *currently rendered* rotated (INVERTED /
   // LANDSCAPE_CCW). Keyed on the live renderer orientation rather than the persisted reader setting,
@@ -44,4 +64,17 @@ class MappedInputManager {
   const GfxRenderer& renderer;
 
   bool mapButton(Button button, bool (HalGPIO::*fn)(uint8_t) const) const;
+  // OR-in the BLE overlay for a logical button, mirroring mapButton()'s composite
+  // handling of NavNext/NavPrevious so a remote key bound to Up/Down/Left/Right also
+  // drives list navigation.
+  bool bleEdge(const bool* arr, Button button) const;
+
+  // Per-frame BLE overlay, indexed by (uint8_t)Button.
+  bool blePressEdge[kButtonCount] = {};    // press edge this frame   -> wasPressed / isPressed
+  bool bleReleaseEdge[kButtonCount] = {};  // release edge this frame  -> wasReleased
+  bool bleActivityThisFrame = false;
+  bool bleCaptureMode = false;
+  bool bleHasCaptured = false;
+  uint8_t bleCapturedKind = 0xFF;
+  uint8_t bleCapturedValue = 0;
 };

src/SdCardFontSystem.h

@@ -32,6 +32,10 @@ class SdCardFontSystem {
   /// Non-const access to the registry (for FontInstaller).
   SdCardFontRegistry& registry() { return registry_; }
 
+  // MEMFIX-PORT: font system audit passthrough; portable
+  /// Resident heap held by loaded SD fonts (audit; see SdCardFont::reportMemory).
+  size_t reportFontMemory() const { return manager_.reportMemory(); }
+
   /// Mark the registry as needing re-discovery.
   /// Thread-safe: can be called from the web server task.
   void markRegistryDirty() { registryDirty_.store(true, std::memory_order_release); }

src/SilentRestart.h

@@ -6,3 +6,7 @@
 
 void silentRestart();          // home screen
 void silentRestartToReader();  // currently-open EPUB (APP_STATE.openEpubPath)
+// True when this boot itself came from a silent restart. Callers that restart
+// as a last-resort defrag must check this so a failure that survives the
+// restart degrades to an error instead of a reboot loop.
+bool bootWasSilentRestart();

src/activities/Activity.h

@@ -44,6 +44,17 @@ class Activity {
   virtual bool skipLoopDelay() { return false; }
   virtual bool preventAutoSleep() { return false; }
   virtual bool isReaderActivity() const { return false; }
+  // True if this activity needs the BLE stack resident (beyond the readers, which are
+  // covered by isReaderActivity()). The Bluetooth settings screen overrides this so
+  // pairing/scanning works there. Everywhere else BLE is torn down to free heap.
+  virtual bool keepsBluetoothAlive() const { return false; }
+  // True while the current activity is doing heap-heavy work that must finish
+  // before the BLE stack (~52 KB) may start.
+  virtual bool deferBluetoothStart() const { return false; }
+  // Ask the activity to make its next render a full ghost-cleanup (HALF) refresh rather
+  // than a fast/partial one. Used after drawing a transient popup over grayscale content
+  // (e.g. the "BT Connecting..." popup over a reader page) so it clears without ghosting.
+  virtual void requestGhostCleanup() {}
   virtual ScreenshotInfo getScreenshotInfo() const { return {}; }
 
   // Start a new activity without destroying the current one

src/activities/ActivityManager.cpp

@@ -256,6 +256,25 @@ bool ActivityManager::isReaderActivity() const {
          (currentActivity && currentActivity->isReaderActivity());
 }
 
+bool ActivityManager::currentKeepsBluetoothAlive() const {
+  return currentActivity && currentActivity->keepsBluetoothAlive();
+}
+
+void ActivityManager::requestGhostCleanup() {
+  if (currentActivity) currentActivity->requestGhostCleanup();
+}
+
+bool ActivityManager::bluetoothShouldBeActive() const {
+  const auto wants = [](const auto& activity) {
+    return activity && (activity->isReaderActivity() || activity->keepsBluetoothAlive());
+  };
+  return std::any_of(stackActivities.begin(), stackActivities.end(), wants) || wants(currentActivity);
+}
+
+bool ActivityManager::bluetoothStartDeferred() const {
+  return currentActivity && currentActivity->deferBluetoothStart();
+}
+
 bool ActivityManager::skipLoopDelay() const { return currentActivity && currentActivity->skipLoopDelay(); }
 
 ScreenshotInfo ActivityManager::getScreenshotInfo() const {

src/activities/ActivityManager.h

@@ -102,6 +102,16 @@ class ActivityManager {
 
   bool preventAutoSleep() const;
   bool isReaderActivity() const;
+  bool currentKeepsBluetoothAlive() const;
+  // True if BLE should be resident for the current context: any reader (page-turner
+  // input) or the Bluetooth settings screen (pairing) is on the stack.
+  bool bluetoothShouldBeActive() const;
+  // True while the CURRENT activity is mid heap-heavy work that must complete before
+  // NimBLE may start (see Activity::deferBluetoothStart). Current only, not the
+  // stack: a reader stacked under a menu has its loop() paused, so its build never
+  // advances — a stack-wide check would hold BLE off for as long as the menu stays
+  // open.
+  bool bluetoothStartDeferred() const;
   bool skipLoopDelay() const;
   ScreenshotInfo getScreenshotInfo() const;
 
@@ -109,6 +119,9 @@ class ActivityManager {
   // Otherwise, it will be deferred until the end of the current loop iteration.
   void requestUpdate(bool immediate = false);
 
+  // Ask the current activity to make its next render a ghost-cleanup (HALF) refresh.
+  void requestGhostCleanup();
+
   // Trigger a render and block until it completes.
   // Must NOT be called from the render task or while holding a RenderLock.
   void requestUpdateAndWait();

src/activities/network/CrossPointWebServerActivity.cpp

@@ -18,6 +18,8 @@
 #include "fontIds.h"
 #include "util/QrUtils.h"
 
+#include "BleInput.h"
+
 namespace {
 // AP Mode configuration
 constexpr const char* AP_SSID = "CrossPoint-Reader";
@@ -141,6 +143,12 @@ void CrossPointWebServerActivity::onNetworkModeSelected(const NetworkMode mode)
   if (mode == NetworkMode::JOIN_NETWORK) {
     // STA mode - launch WiFi selection
     LOG_DBG("WEBACT", "Turning on WiFi (STA mode)...");
+    // Free the BLE stack BEFORE bringing WiFi up (matches WifiSelectionActivity):
+    // the C3 shares one radio and heap between the stacks, and the WiFi driver
+    // sizes its RX/TX buffer pools at init — initializing it with NimBLE's ~50 KB
+    // still resident leaves WiFi permanently starved even after the lifecycle
+    // stops BLE a loop later. No-op when BLE is already off.
+    bleinput::stop();
     WiFi.mode(WIFI_STA);
 
     state = WebServerActivityState::WIFI_SELECTION;
@@ -193,6 +201,13 @@ void CrossPointWebServerActivity::startAccessPoint() {
   LOG_DBG("WEBACT", "Starting Access Point mode...");
   LOG_DBG("WEBACT", "Free heap before AP start: %d bytes", ESP.getFreeHeap());
 
+  // Free the BLE stack BEFORE bringing WiFi up (matches WifiSelectionActivity):
+  // the C3 shares one radio and heap between the stacks, and the WiFi driver
+  // sizes its RX/TX buffer pools at init — initializing it with NimBLE's ~50 KB
+  // still resident leaves WiFi permanently starved even after the lifecycle
+  // stops BLE a loop later. No-op when BLE is already off.
+  bleinput::stop();
+
   // Configure and start the AP
   WiFi.mode(WIFI_AP);
   delay(100);

src/activities/network/WifiSelectionActivity.cpp

@@ -8,6 +8,7 @@
 
 #include <algorithm>
 
+#include "BleInput.h"
 #include "CrossPointSettings.h"
 #include "MappedInputManager.h"
 #include "WifiCredentialStore.h"
@@ -97,6 +98,11 @@ void WifiSelectionActivity::startWifiScan(const bool autoScan) {
   networks.clear();
   requestUpdate();
 
+  // Free the BLE stack before bringing WiFi up: the C3 has one radio and the two
+  // stacks can't both fit in heap. Reachable from the reader via KOReader sync, where
+  // BLE is still resident; a no-op when BLE is already off (launched from Settings).
+  bleinput::stop();
+
   // Set WiFi mode to station
   WiFi.mode(WIFI_STA);
   WiFi.disconnect();
@@ -349,6 +355,7 @@ void WifiSelectionActivity::attemptConnection() {
   connectionError.clear();
   requestUpdate();
 
+  bleinput::stop();        // free the BLE stack before WiFi (shared C3 radio, tight heap)
   WiFi.persistent(false);  // Credentials are managed by WifiCredentialStore; suppress SDK NVS auto-connect
   WiFi.mode(WIFI_STA);
   WiFi.disconnect(true, true);  // Abort any in-progress SDK auto-connect and clear NVS-saved SSID

src/activities/reader/EpubReaderActivity.cpp

@@ -17,6 +17,7 @@
 #include <iterator>
 #include <limits>
 
+#include "BleInput.h"
 #include "BookmarkEntry.h"
 #include "CrossPointSettings.h"
 #include "CrossPointState.h"
@@ -32,10 +33,15 @@
 #include "QrDisplayActivity.h"
 #include "ReaderUtils.h"
 #include "RecentBooksStore.h"
+#include "SilentRestart.h"
 #include "components/UITheme.h"
 #include "fontIds.h"
 #include "util/BookmarkUtil.h"
 #include "util/ScreenshotUtil.h"
+#include "SdCardFontSystem.h"
+#include <esp_heap_caps.h>
+#include "rom/ets_sys.h"
+#include "HeapMap.h"
 
 namespace {
 // pagesPerRefresh now comes from SETTINGS.getRefreshFrequency()
@@ -65,6 +71,55 @@ bool isInReadFolder(const std::string& path) {
   return path.size() > n && path.compare(0, n, READ_FOLDER) == 0 && path[n] == '/';
 }
 
+class FrameBufferBuildLoan {
+ public:
+  explicit FrameBufferBuildLoan(GfxRenderer& renderer) : renderer_(renderer) {}
+  ~FrameBufferBuildLoan() {
+    if (active_ && !restore()) {
+      ESP.restart();
+    }
+  }
+
+  void release() {
+    if (active_ || !renderer_.hasFrameBuffer()) return;
+    if (bleinput::startInProgress()) {
+      LOG_INF("ERS", "Framebuffer loan waiting for BLE start to settle");
+      const uint32_t deadline = millis() + 1000;
+      while (bleinput::startInProgress() && millis() < deadline) {
+        delay(5);
+      }
+    }
+    renderer_.releaseFrameBufferForBuild();
+    active_ = true;
+    LOG_DBG("ERS", "Framebuffer lent for section build (ble=%u heap=%u maxAlloc=%u)", BleHid.isRunning() ? 1 : 0,
+            (unsigned)ESP.getFreeHeap(), (unsigned)ESP.getMaxAllocHeap());
+  }
+
+  bool restore() {
+    if (!active_) return true;
+    active_ = false;
+    if (renderer_.restoreFrameBufferAfterBuild()) {
+      LOG_DBG("ERS", "Framebuffer restored after section build");
+      return true;
+    }
+    if (BleHid.isRunning()) {
+      LOG_INF("ERS", "Framebuffer restore needs heap; freeing BLE and retrying (heap=%u maxAlloc=%u)",
+              (unsigned)ESP.getFreeHeap(), (unsigned)ESP.getMaxAllocHeap());
+      bleinput::stop();
+      if (renderer_.restoreFrameBufferAfterBuild()) {
+        LOG_DBG("ERS", "Framebuffer restored after freeing BLE");
+        return true;
+      }
+    }
+    LOG_ERR("ERS", "Framebuffer restore failed after section build");
+    return false;
+  }
+
+ private:
+  GfxRenderer& renderer_;
+  bool active_ = false;
+};
+
 struct ProgressRange {
   float start;
   float end;
@@ -157,6 +212,8 @@ void EpubReaderActivity::onEnter() {
 
   ImageBlock::clearSessionRenderFailures();
 
+  statusBarBleConnected = BleHid.isConnected();
+
   // Configure screen orientation based on settings
   // NOTE: This affects layout math and must be applied before any render calls.
   ReaderUtils::applyOrientation(renderer, SETTINGS.orientation);
@@ -257,6 +314,32 @@ void EpubReaderActivity::openReaderMenu() {
                          });
 }
 
+bool EpubReaderActivity::buildTickHeapGate() {
+  const size_t freeHeap = ESP.getFreeHeap();
+  const size_t maxBlock = ESP.getMaxAllocHeap();
+  if (freeHeap >= BACKGROUND_BUILD_MIN_FREE_HEAP && maxBlock >= BACKGROUND_BUILD_MIN_MAX_ALLOC) {
+    return true;
+  }
+  const size_t lendableFrameBuffer = renderer.hasFrameBuffer() ? renderer.getBufferSize() : 0;
+  if (lendableFrameBuffer > 0 && freeHeap + lendableFrameBuffer >= BACKGROUND_BUILD_MIN_FREE_HEAP &&
+      maxBlock + lendableFrameBuffer >= BACKGROUND_BUILD_MIN_MAX_ALLOC) {
+    return true;
+  }
+  // Below the floors. If the BLE stack is what's squeezing the heap, shed it — the
+  // established policy on this branch is that builds and resident BLE don't coexist,
+  // and this was the one build path without that protection (field crash: a tick's
+  // parse allocation aborted at maxAlloc ~11 KB with BLE resident). The lifecycle's
+  // build-pending deferral keeps BLE down until the window is caught up, then
+  // restarts it behind the start floor. Without BLE resident, just wait: page-turn
+  // transients free up between turns and the tick retries every loop pass.
+  if (BleHid.isRunning()) {
+    LOG_INF("ERS", "Background build needs heap (free=%u maxAlloc=%u); freeing BLE RAM", (unsigned)freeHeap,
+            (unsigned)maxBlock);
+    bleinput::stop();
+  }
+  return false;
+}
+
 void EpubReaderActivity::loop() {
   if (!epub) {
     // Should never happen
@@ -264,6 +347,48 @@ void EpubReaderActivity::loop() {
     return;
   }
 
+  // Swap the "BT connecting" status bar placeholder back to the chapter/book
+  // title the moment the connection completes (and back on disconnect). Skips
+  // while a render is in flight or the framebuffer is lent to a build; the
+  // next page render shows the right state anyway.
+  if (SETTINGS.bluetoothEnabled && section && renderer.hasFrameBuffer() && !RenderLock::peek()) {
+    const bool connected = BleHid.isConnected();
+    if (connected != statusBarBleConnected) {
+      statusBarBleConnected = connected;
+      renderStatusBar();
+      renderer.displayBuffer(HalDisplay::FAST_REFRESH);
+    }
+  }
+
+  // Idle glyph prewarm for the likely next page (currentPage + 1). The scan
+  // pass draws nothing (FCM scan mode suppresses pixels), so the displayed
+  // framebuffer is untouched; endScanAndPrewarm loads only glyphs not already
+  // cached. Debounced past rapid page-flipping, one attempt per position, and
+  // deferred while a render/build owns the CPU or the heap is at the render
+  // floor. Cross-chapter prewarm is deliberately out of scope (next spine's
+  // section isn't loaded).
+  constexpr unsigned long IDLE_PREWARM_DEBOUNCE_MS = 400;
+  if (section && !section->isBuilding() && !RenderLock::peek() && renderer.hasFrameBuffer() &&
+      lastRenderCompleteMs != 0 && millis() - lastRenderCompleteMs > IDLE_PREWARM_DEBOUNCE_MS &&
+      ESP.getFreeHeap() > RENDER_MIN_FREE_HEAP &&
+      (idlePrewarmSpine != currentSpineIndex || idlePrewarmPage != section->currentPage)) {
+    idlePrewarmSpine = currentSpineIndex;
+    idlePrewarmPage = section->currentPage;
+    const int nextPage = section->currentPage + 1;
+    if (nextPage < static_cast<int>(section->pageCount)) {
+      RenderLock lock;  // the page table must not change under the scan
+      if (const auto p = section->loadPage(nextPage)) {
+        if (auto* fcm = renderer.getFontCacheManager()) {
+          const auto t0 = millis();
+          auto scope = fcm->createPrewarmScope();
+          p->render(renderer, SETTINGS.getReaderFontId(), 0, 0);  // scan only, no pixels
+          scope.endScanAndPrewarm();
+          LOG_DBG("ERS", "Idle prewarm: page %d in %lums", nextPage, millis() - t0);
+        }
+      }
+    }
+  }
+
   // Lazily resume a partial's extension build once the reader nears its watermark. Far from
   // it the rebuild is all cost (whole-chapter re-layout from page 0) and no benefit this
   // session, so reopening a partial deliberately does NOT start it (see the deferral in
@@ -299,7 +424,8 @@ void EpubReaderActivity::loop() {
   // "far enough ahead" and stall the build at 0 pages -- then the first turn past the
   // watermark re-parses the whole chapter synchronously. Keep ticking until it finalizes.
   if (section && section->isBuilding() && !RenderLock::peek() &&
-      (section->isPartial() || static_cast<int>(section->pageCount) < section->currentPage + BUILD_WINDOW_AHEAD)) {
+      (section->isPartial() || static_cast<int>(section->pageCount) < section->currentPage + BUILD_WINDOW_AHEAD) &&
+      buildTickHeapGate()) {
     RenderLock lock;
     // Re-check under the lock: render() (which also holds the RenderLock) may have finalized the
     // build between the outer isBuilding() check and acquiring the lock here, in which case
@@ -307,6 +433,8 @@ void EpubReaderActivity::loop() {
     // mutation, so it flags this as always true.
     // cppcheck-suppress knownConditionTrueFalse
     if (section->isBuilding()) {
+      FrameBufferBuildLoan buildLoan(renderer);
+      buildLoan.release();
       if (!section->buildSomeMore(BACKGROUND_BUILD_PAGES_PER_TICK)) {
         LOG_ERR("ERS", "Background section build failed");
         section.reset();
@@ -316,6 +444,9 @@ void EpubReaderActivity::loop() {
         // real page count, so re-render at the remapped page. No-op for an unchanged resume.
         requestUpdate();
       }
+      if (!buildLoan.restore()) {
+        ESP.restart();
+      }
     }
   }
 
@@ -917,6 +1048,17 @@ void EpubReaderActivity::render(RenderLock&& lock) {
     return;
   }
 
+  FrameBufferBuildLoan buildLoan(renderer);
+
+  // If BLE leaves the reader below the render floor, lend the framebuffer before
+  // deserializing/loading the page instead of tearing BLE down immediately. The
+  // restore path still frees BLE if the framebuffer cannot be reallocated.
+  if (BleHid.isRunning() && ESP.getFreeHeap() < RENDER_MIN_FREE_HEAP) {
+    LOG_INF("ERS", "Render heap %u below floor %u; lending framebuffer", (unsigned)ESP.getFreeHeap(),
+            (unsigned)RENDER_MIN_FREE_HEAP);
+    buildLoan.release();
+  }
+
   const auto showPendingSyncSaveError = [this]() {
     if (!pendingSyncSaveError) return;
     pendingSyncSaveError = false;
@@ -926,7 +1068,11 @@ void EpubReaderActivity::render(RenderLock&& lock) {
   // A section build failure (e.g. an invalid/corrupt EPUB that fails XML parsing) leaves the
   // "Indexing" popup on screen with no way forward. Surface an explicit error instead of hanging.
   // clearScreen first so the error popup doesn't overlay the stale "Indexing" popup.
-  const auto showBuildError = [this]() {
+  const auto showBuildError = [this, &buildLoan]() {
+    if (!buildLoan.restore()) {
+      ESP.restart();
+      return;
+    }
     renderer.clearScreen();
     GUI.drawPopup(renderer, tr(STR_INDEX_FAILED));
     automaticPageTurnActive = false;
@@ -1011,6 +1157,44 @@ void EpubReaderActivity::render(RenderLock&& lock) {
         LOG_DBG("ERS", "Cache not found, building...");
       }
 
+      // The layout code (line-break DP arrays, CSS lookups, glyph buffers) allocates freely
+      // and abort()s on OOM under -fno-exceptions, so a starved heap must be handled BEFORE
+      // the build: pre-flight the floor and take the recovery path up front instead of
+      // crashing mid-parse. Field data: builds succeed at ~46 KB free with BLE resident;
+      // abort() observed at ~11 KB free.
+      const size_t lendableFrameBuffer = renderer.hasFrameBuffer() ? renderer.getBufferSize() : 0;
+      const bool heapTooLow = ESP.getFreeHeap() + lendableFrameBuffer < BUILD_MIN_FREE_HEAP;
+      if (heapTooLow) {
+        LOG_ERR("ERS", "Pre-build heap %u (+fb %u) below floor %u; entering build recovery",
+                (unsigned)ESP.getFreeHeap(), (unsigned)lendableFrameBuffer, (unsigned)BUILD_MIN_FREE_HEAP);
+      }
+
+      // Building a section needs a large contiguous inflate (deflate) window that the
+      // resident NimBLE stack fragments out of existence (~16 KB max block with BT on).
+      // On build failure (or a pre-flight floor miss) with BT enabled: free the BLE stack
+      // and retry. The chapter is cached afterwards, so this recovery runs at most once
+      // per uncached chapter.
+      // Deliberately do NOT restart BLE inline: this render still has its own allocations
+      // to make. The main-loop lifecycle restarts BLE later, behind its activity,
+      // render-lock, framebuffer, and heap gates.
+      const auto retryWithBleFreed = [&](auto&& buildFn) {
+        LOG_INF("ERS", "Section build needs heap; freeing BLE RAM and retrying");
+        bleinput::stop();
+        return buildFn();
+      };
+
+      // Even with BLE freed, the build can fail when this session's parse churn has
+      // fragmented the heap beyond in-place recovery. A silent restart is the only
+      // real defrag on this heap (no compaction); it resumes into this book and
+      // rebuilds the section on a fresh heap. Guarded by bootWasSilentRestart() so a
+      // build that fails again after the restart degrades to the error popup below
+      // instead of reboot-looping.
+      const auto silentRestartDefrag = [&]() {
+        if (bootWasSilentRestart()) return;
+        LOG_ERR("ERS", "Section build failed after BLE recovery; silent restart to defrag heap");
+        silentRestartToReader();
+      };
+
       // Jumps that need the final pagination or the anchor map -- explicit page jumps,
       // fragment anchors, percent jumps, and cross-setting progress repositioning -- can't
       // resolve their landing page until the whole chapter is laid out, so they take the full
@@ -1037,10 +1221,18 @@ void EpubReaderActivity::render(RenderLock&& lock) {
         // Lend the framebuffer's 48 KB to the blocking full build; restored
         // (white) at scope exit, and the page render below redraws everything.
         GfxRenderer::FrameBufferLoan loan(renderer);
-        if (!section->createSectionFile(SETTINGS.getReaderFontId(), SETTINGS.getReaderLineCompression(),
+        const auto buildSection = [&]() {
+          return section->createSectionFile(SETTINGS.getReaderFontId(), SETTINGS.getReaderLineCompression(),
                                             SETTINGS.extraParagraphSpacing, SETTINGS.paragraphAlignment, viewportWidth,
                                             viewportHeight, SETTINGS.hyphenationEnabled, SETTINGS.embeddedStyle,
-                                        SETTINGS.imageRendering, SETTINGS.focusReadingEnabled, popupFn)) {
+                                            SETTINGS.imageRendering, SETTINGS.focusReadingEnabled, popupFn);
+        };
+        bool built = !heapTooLow && buildSection();
+        if (!built && SETTINGS.bluetoothEnabled) {
+          built = retryWithBleFreed(buildSection);
+        }
+        if (!built) {
+          silentRestartDefrag();
           LOG_ERR("ERS", "Failed to persist page data to SD");
           section.reset();
           loan.end();  // restore before anything draws
@@ -1098,10 +1290,21 @@ void EpubReaderActivity::render(RenderLock&& lock) {
           // background buildSomeMore chunks in loop() do NOT get the loan: they
           // deliberately interleave with page renders. Restored before render.
           GfxRenderer::FrameBufferLoan loan(renderer);
-          if (!section->startBuild(SETTINGS.getReaderFontId(), SETTINGS.getReaderLineCompression(),
+          // startBuild does the zip inflate (the big contiguous allocation), so it gets
+          // the BLE free-and-retry fallback too; it cleans up fully on failure, making a
+          // retry safe.
+          const auto beginBuild = [&]() {
+            return section->startBuild(SETTINGS.getReaderFontId(), SETTINGS.getReaderLineCompression(),
                                        SETTINGS.extraParagraphSpacing, SETTINGS.paragraphAlignment, viewportWidth,
                                        viewportHeight, SETTINGS.hyphenationEnabled, SETTINGS.embeddedStyle,
-                                   SETTINGS.imageRendering, SETTINGS.focusReadingEnabled)) {
+                                       SETTINGS.imageRendering, SETTINGS.focusReadingEnabled);
+          };
+          bool started = !heapTooLow && beginBuild();
+          if (!started && SETTINGS.bluetoothEnabled) {
+            started = retryWithBleFreed(beginBuild);
+          }
+          if (!started) {
+            silentRestartDefrag();
             LOG_ERR("ERS", "Failed to start section build");
             section.reset();
             loan.end();  // restore before anything draws (showBuildError renders a popup)
@@ -1176,6 +1379,7 @@ void EpubReaderActivity::render(RenderLock&& lock) {
   }
   while (section->isPartial() && section->currentPage >= static_cast<int>(section->pageCount)) {
     // Start a build to extend a partial toward the requested page.
+    buildLoan.release();
     if (!section->isBuilding() &&
         !section->startBuild(SETTINGS.getReaderFontId(), SETTINGS.getReaderLineCompression(),
                              SETTINGS.extraParagraphSpacing, SETTINGS.paragraphAlignment, viewportWidth, viewportHeight,
@@ -1198,6 +1402,7 @@ void EpubReaderActivity::render(RenderLock&& lock) {
   }
   // For an in-progress incremental build, make sure the page we're about to show has been laid out.
   if (section->isBuilding()) {
+    buildLoan.release();
     while (!section->isBuildComplete() && section->currentPage >= static_cast<int>(section->pageCount)) {
       if (!section->buildSomeMore(BUILD_PAGES_PER_CHUNK)) {
         LOG_ERR("ERS", "Failed during incremental section build");
@@ -1208,6 +1413,14 @@ void EpubReaderActivity::render(RenderLock&& lock) {
     }
   }
 
+  const auto restoreFramebufferForDraw = [&buildLoan]() {
+    if (!buildLoan.restore()) {
+      ESP.restart();
+      return false;
+    }
+    return true;
+  };
+
   // The requested page is now as built as it will get. If it still lands past the end,
   // clamp to the last real page: the UINT16_MAX "last page" sentinel from backward chapter
   // navigation, an explicit jump beyond a finished chapter, or a stale saved position.
@@ -1222,10 +1435,10 @@ void EpubReaderActivity::render(RenderLock&& lock) {
   // a plain resume / unchanged pagination). If still building, this defers to loop() on completion.
   applyDeferredReposition();
 
-  renderer.clearScreen();
-
   if (section->pageCount == 0) {
     LOG_DBG("ERS", "No pages to render");
+    if (!restoreFramebufferForDraw()) return;
+    renderer.clearScreen();
     renderer.drawCenteredText(UI_12_FONT_ID, 300, tr(STR_EMPTY_CHAPTER), true, EpdFontFamily::BOLD);
     renderStatusBar();
     renderer.displayBuffer();
@@ -1236,6 +1449,8 @@ void EpubReaderActivity::render(RenderLock&& lock) {
 
   if (section->currentPage < 0 || section->currentPage >= section->pageCount) {
     LOG_DBG("ERS", "Page out of bounds: %d (max %d)", section->currentPage, section->pageCount);
+    if (!restoreFramebufferForDraw()) return;
+    renderer.clearScreen();
     renderer.drawCenteredText(UI_12_FONT_ID, 300, tr(STR_OUT_OF_BOUNDS), true, EpdFontFamily::BOLD);
     renderStatusBar();
     renderer.displayBuffer();
@@ -1264,6 +1479,7 @@ void EpubReaderActivity::render(RenderLock&& lock) {
       if (giveUp) {
         LOG_ERR("ERS", "Page load retry limit reached, aborting");
         pageLoadRetryCount = 0;  // Reset so a later user-initiated navigation can try afresh
+        if (!restoreFramebufferForDraw()) return;
         renderer.clearScreen();
         renderer.drawCenteredText(UI_12_FONT_ID, 300, tr(STR_PAGE_LOAD_ERROR), true, EpdFontFamily::BOLD);
         renderer.displayBuffer();
@@ -1279,9 +1495,48 @@ void EpubReaderActivity::render(RenderLock&& lock) {
     // Collect footnotes from the loaded page
     currentPageFootnotes = std::move(p->footnotes);
 
+    if (!restoreFramebufferForDraw()) return;
+    renderer.clearScreen();
+
     const auto start = millis();
     renderContents(std::move(p), orientedMarginTop, orientedMarginRight, orientedMarginBottom, orientedMarginLeft);
     LOG_DBG("ERS", "Rendered page in %dms", millis() - start);
+    lastRenderCompleteMs = millis();
+    // Fragmentation tracker: free vs largest block after every page. A falling
+    // maxAlloc/free ratio across pages points at whichever allocation pattern the
+    // preceding lines show (mini rebuilds, kern reloads, BLE churn).
+    LOG_DBG("MEM", "post-render: free=%u maxAlloc=%u", (unsigned)ESP.getFreeHeap(), (unsigned)ESP.getMaxAllocHeap());
+    {
+      // MEMFIX-PORT: per-render heap owner audit + one-shot block map; portable
+      // Heap audit: attribute resident heap to its owners so margin work is
+      // measurement-driven. `other` = IDF/Arduino baseline + SdFat + epub
+      // metadata + BLE (when on) + anything not yet instrumented.
+      const size_t fontBytes = sdFontSystem.reportFontMemory();
+      const size_t sectionBytes = section ? section->residentBytes() : 0;
+      const size_t epubBytes = epub ? epub->residentBytes() : 0;
+      const size_t fbBytes = renderer.hasFrameBuffer() ? renderer.getBufferSize() : 0;
+      const uint32_t heapTotal = ESP.getHeapSize();
+      const uint32_t heapFree = ESP.getFreeHeap();
+      LOG_DBG("MEM",
+              "audit: total=%u free=%u maxAlloc=%u fb=%u fonts=%u section=%u epub=%u cssRules=%u building=%d ble=%d "
+              "other=%d",
+              heapTotal, heapFree, (unsigned)ESP.getMaxAllocHeap(), (unsigned)fbBytes, (unsigned)fontBytes,
+              (unsigned)sectionBytes, (unsigned)epubBytes, (unsigned)(epub ? epub->cssRuleCount() : 0),
+              section && section->isBuilding() ? 1 : 0, BleHid.isRunning() ? 1 : 0,
+              (int)(heapTotal - heapFree - fbBytes - fontBytes - sectionBytes - epubBytes));
+      // One-shot heap block map for fragmentation analysis: dumps every block
+      // (address/size/free) once per boot, at the first settled (non-building)
+      // audit, so mid-heap long-lived allocations identify themselves. ~2-4 s
+      // of serial output; debug builds only.
+      static bool heapMapDumped = false;
+      if (!heapMapDumped && !(section && section->isBuilding())) {
+        heapMapDumped = true;
+        // Landmarks: known owners' addresses, so map blocks self-identify.
+        LOG_DBG("MEM", "landmark framebuffer=%p section=%p epub=%p activity=%p", renderer.getFrameBuffer(),
+                static_cast<void*>(section.get()), static_cast<void*>(epub.get()), static_cast<void*>(this));
+        heapmap::dump();
+      }
+    }
   }
   // Only persist when the position actually changed. render() also runs on menu,
   // bookmark and screenshot re-renders, and writeAtomic is several FAT ops for 6 bytes.
@@ -1351,6 +1606,11 @@ void EpubReaderActivity::renderContents(std::unique_ptr<Page> page, const int or
   const bool pageHasImagesNeedingDecode = pageHasImages && page->hasImagesNeedingDecode();
   const bool needsTextGrayscale = SETTINGS.textAntiAliasing;
   const bool needsAnyGrayscale = needsTextGrayscale || pageHasImages;
+  const bool tiledGrayscale = needsAnyGrayscale && renderer.supportsStripGrayscale();
+  // Whole-plane buffering only pays when the BW refresh genuinely runs async
+  // underneath it; on blocking panels it would just spend ~50 KB for the
+  // identical serial timing.
+  const bool overlapRefresh = tiledGrayscale && renderer.supportsAsyncRefresh();
   auto renderGrayscalePass = [&]() {
     if (needsTextGrayscale) {
       page->render(renderer, fontId, orientedMarginLeft, orientedMarginTop);
@@ -1396,28 +1656,93 @@ void EpubReaderActivity::renderContents(std::unique_ptr<Page> page, const int or
     // regardless of residue.
     pagesUntilFullRefresh = 1;
   } else {
-    ReaderUtils::displayWithRefreshCycle(renderer, pagesUntilFullRefresh);
+    // Deferred when a tiled grayscale pass follows: the plane rendering below
+    // then overlaps the panel's refresh time instead of following it.
+    ReaderUtils::displayWithRefreshCycle(renderer, pagesUntilFullRefresh, /*async=*/overlapRefresh);
   }
   const auto tDisplay = millis();
 
-  // Tiled grayscale: render each plane band-by-band into a small scratch and
-  // stream straight to the controller, leaving the BW framebuffer intact so no
-  // full-frame storeBwBuffer is needed; controller RAM is re-synced from the
-  // live framebuffer afterward. The page is re-rendered ceil(H/STRIP_ROWS) times
-  // per plane, but renderCharImpl culls out-of-band glyphs before decode so the
-  // cost stays close to one render. Both text (drawPixel) and images
-  // (DirectPixelWriter) honor the active strip target.
-  if (needsAnyGrayscale && renderer.supportsStripGrayscale()) {
+  // Tiled grayscale: render each plane band-by-band, leaving the BW
+  // framebuffer intact so no full-frame storeBwBuffer is needed; controller
+  // RAM is re-synced from the live framebuffer afterward. The page is
+  // re-rendered ceil(H/STRIP_ROWS) times per plane, but renderCharImpl culls
+  // out-of-band glyphs before decode so the cost stays close to one render.
+  // Both text (drawPixel) and images (DirectPixelWriter) honor the active
+  // strip target. When the BW refresh above went out async, the plane
+  // rendering below overlaps the panel's refresh time; only the controller
+  // RAM writes wait for BUSY.
+  if (tiledGrayscale) {
     constexpr int STRIP_ROWS = 80;
     const int gh = renderer.getDisplayHeight();
     const int gwBytes = renderer.getDisplayWidthBytes();
+    const size_t planeBytes = static_cast<size_t>(gwBytes) * gh;
 
+    // Render one plane band-by-band into a whole-plane buffer without touching
+    // the controller, so it can run while the refresh is still in flight.
+    auto renderPlaneToBuffer = [&](const bool lsbPlane, uint8_t* buf) {
+      renderer.setRenderMode(lsbPlane ? GfxRenderer::GRAYSCALE_LSB : GfxRenderer::GRAYSCALE_MSB);
+      for (int y = 0; y < gh; y += STRIP_ROWS) {
+        const int rows = (gh - y < STRIP_ROWS) ? (gh - y) : STRIP_ROWS;
+        renderer.beginStripTarget(buf + static_cast<size_t>(y) * gwBytes, y, rows);
+        renderer.clearScreen(0x00);
+        renderGrayscalePass();
+        renderer.endStripTarget();
+      }
+    };
+
+    // Tiered on heap pressure: two plane buffers hide both plane renders
+    // inside the refresh wait; one hides the LSB render (its buffer is reused
+    // for MSB after streaming); none falls back to the strip-scratch flow with
+    // no overlap. The MSB buffer is only attempted when it leaves ~60 KB free
+    // so the pass never starves concurrent allocations (BLE especially).
+    // Blocking panels skip the buffers entirely (nothing to overlap).
+    auto lsbPlaneBuf = overlapRefresh ? makeUniqueNoThrow<uint8_t[]>(planeBytes) : nullptr;
+    auto msbPlaneBuf = (lsbPlaneBuf && ESP.getFreeHeap() >= planeBytes + 60000)
+                           ? makeUniqueNoThrow<uint8_t[]>(planeBytes)
+                           : nullptr;
+
+    if (lsbPlaneBuf) {
+      renderPlaneToBuffer(true, lsbPlaneBuf.get());
+      if (msbPlaneBuf) renderPlaneToBuffer(false, msbPlaneBuf.get());
+      const auto tGrayRender = millis();
+
+      renderer.waitRefreshComplete();
+      const auto tWait = millis();
+
+      renderer.writeGrayscalePlaneStrip(true, lsbPlaneBuf.get(), 0, gh);
+      if (msbPlaneBuf) {
+        renderer.writeGrayscalePlaneStrip(false, msbPlaneBuf.get(), 0, gh);
+      } else {
+        renderPlaneToBuffer(false, lsbPlaneBuf.get());
+        renderer.writeGrayscalePlaneStrip(false, lsbPlaneBuf.get(), 0, gh);
+      }
+      const auto tGrayWrite = millis();
+
+      renderer.setRenderMode(GfxRenderer::BW);
+      renderer.displayGrayBuffer();
+      const auto tGrayDisplay = millis();
+
+      // BW framebuffer is intact; re-sync controller RAM for the next
+      // differential page turn directly from it.
+      renderer.cleanupGrayscaleWithFrameBuffer();
+      const auto tEnd = millis();
+
+      LOG_DBG("ERS",
+              "Page render (tiled async): prewarm=%lums bw_render=%lums display=%lums gray_render=%lums "
+              "wait=%lums gray_write=%lums gray_display=%lums cleanup=%lums total=%lums (planes buffered: %d)",
+              tPrewarm - t0, tBwRender - tPrewarm, tDisplay - tBwRender, tGrayRender - tDisplay, tWait - tGrayRender,
+              tGrayWrite - tWait, tGrayDisplay - tGrayWrite, tEnd - tGrayDisplay, tEnd - t0, msbPlaneBuf ? 2 : 1);
+    } else {
+      // Per-strip scratch tier: blocking panels and the OOM fallback. The
+      // strip writes below need the panel idle, so wait out any pending async
+      // refresh first (no-op on blocking panels).
       auto scratch = makeUniqueNoThrow<uint8_t[]>(static_cast<size_t>(gwBytes) * STRIP_ROWS);
+      renderer.waitRefreshComplete();
       if (!scratch) {
         LOG_ERR("ERS", "OOM: grayscale strip scratch (%d bytes); skipping AA this page", gwBytes * STRIP_ROWS);
       } else {
-      // Bands may be streamed in any order: X4 windows each via setRamArea, X3
-      // via PTL.
+        // Bands may be streamed in any order: X4 windows each via setRamArea,
+        // X3 via PTL.
         renderer.setRenderMode(GfxRenderer::GRAYSCALE_LSB);
         for (int y = 0; y < gh; y += STRIP_ROWS) {
           const int rows = (gh - y < STRIP_ROWS) ? (gh - y) : STRIP_ROWS;
@@ -1457,6 +1782,7 @@ void EpubReaderActivity::renderContents(std::unique_ptr<Page> page, const int or
                 tPrewarm - t0, tBwRender - tPrewarm, tDisplay - tBwRender, tGrayLsb - tDisplay, tGrayMsb - tGrayLsb,
                 tGrayDisplay - tGrayMsb, tCleanup - tGrayDisplay, tEnd - t0);
       }
+    }
   } else {
     // Fallback path for a controller without strip support. grayscale rendering
     // TODO: Only do this if font supports it
@@ -1543,8 +1869,15 @@ void EpubReaderActivity::renderStatusBar() const {
     title = epub->getTitle();
   }
 
+  if (SETTINGS.bluetoothEnabled && !BleHid.isConnected()) {
+    // Take over the title slot entirely while connecting; the watcher in
+    // loop() redraws the bar on the connect/disconnect flip, restoring the
+    // chapter/book title.
+    title = tr(STR_BT_CONNECTING_POPUP);
+  }
+
   GUI.drawStatusBar(renderer, bookProgress, currentPage, pageCount, title, 0, textYOffset, true, currentPageBookmarked,
-                    section->isBuilding());
+                    section->isBuilding(), BleHid.isConnected());
 }
 
 void EpubReaderActivity::navigateToHref(const std::string& hrefStr, const bool savePosition) {

src/activities/reader/EpubReaderActivity.h

@@ -41,6 +41,18 @@ class EpubReaderActivity final : public Activity {
   bool showBookmarkMessage = false;
   bool ignoreNextConfirmRelease = false;
   bool currentPageBookmarked = false;
+  // BLE connection state the status bar last rendered with; loop() watches for
+  // a flip and redraws the bar so the "BT connecting" placeholder swaps back
+  // to the chapter/book title the moment the connection completes (and
+  // returns on disconnect) instead of waiting for the next page turn.
+  bool statusBarBleConnected = false;
+  // Idle-time glyph prewarm: after a page settles, scan the LIKELY next page
+  // (scan mode draws nothing) and load its missing glyphs from SD during idle,
+  // so the next turn's in-render prewarm is a cache hit instead of ~100 ms of
+  // SD reads on the page-turn critical path. One attempt per position.
+  int idlePrewarmSpine = -1;
+  int idlePrewarmPage = -1;
+  unsigned long lastRenderCompleteMs = 0;
   bool bookmarkRemoved = false;  // true when last toggle removed (controls popup text)
   std::vector<BookmarkEntry> cachedBookmarks;
   // Tracks whether this book is currently removed from Recent Books by the
@@ -63,6 +75,21 @@ class EpubReaderActivity final : public Activity {
   SavedPosition savedPositions[MAX_FOOTNOTE_DEPTH] = {};
   int footnoteDepth = 0;
 
+  // Heap floor for entering a section build. The layout code allocates freely (line-break DP
+  // arrays sized by word count, CSS rule lookups, glyph buffers) and under -fno-exceptions an
+  // OOM there abort()s the firmware instead of failing cleanly -- so a starved heap must be
+  // handled *before* the build, not after. Field data: builds succeed at ~46 KB free with BLE
+  // resident; abort() observed at ~11 KB free. CSS styling already degrades below 48 KB
+  // (MIN_FREE_HEAP_FOR_CSS), so 40 KB trades a few early BLE teardowns for not crashing.
+  static constexpr size_t BUILD_MIN_FREE_HEAP = 40 * 1024;
+
+  // Heap floor for rendering a page at all. Page deserialization (TextBlock word
+  // vectors/strings) and glyph caching allocate through throwing paths that abort()
+  // on OOM; below this floor render() sheds the BLE stack (~52 KB back, and it
+  // restores a large contiguous block) before touching the page. Field data: a
+  // session with no shed ground to <2.2 KB free and aborted on a page load.
+  static constexpr size_t RENDER_MIN_FREE_HEAP = 24 * 1024;
+
   // Viewport of the last render(), captured so loop()'s lazy partial-extension start
   // builds with IDENTICAL layout parameters to the pages already rendered (a mismatch
   // would paginate differently than the partial being extended). 0 = no render yet.
@@ -86,6 +113,28 @@ class EpubReaderActivity final : public Activity {
   // background build chunk never noticeably delays input or a pending render.
   static constexpr int BUILD_PAGES_PER_CHUNK = 8;
   static constexpr int BACKGROUND_BUILD_PAGES_PER_TICK = 2;
+
+  // Skip background build ticks below this free-heap floor. The parse path grows
+  // word vectors of heap strings — throwing allocations that abort() on OOM under
+  // -fno-exceptions (field crash: bad_alloc in ParsedText::addWord during a
+  // background tick with the BLE stack resident). The tick is deferrable work:
+  // page-turn transients free up between turns and the build resumes; the render
+  // path still builds the page it actually needs regardless of this floor.
+  // Calibrated BETWEEN the measured states: steady reading with BLE resident runs at
+  // ~29.4 KB free / ~16.4 KB largest block (ticks are safe there — a 2-page parse
+  // transient is a few KB), while the field crash happened at 34.7 KB free with an
+  // ~11 KB largest block. A first cut at 32 KB/16 KB sat just ABOVE the healthy
+  // steady state, guaranteeing a pointless BLE shed the moment any build work was
+  // pending (the maxAlloc floor fired on a 12-byte shortfall).
+  static constexpr size_t BACKGROUND_BUILD_MIN_FREE_HEAP = 26 * 1024;
+  // Fragmentation floor for the same gate: free heap says how much memory exists;
+  // maxAlloc says whether any single allocation can actually have it.
+  static constexpr size_t BACKGROUND_BUILD_MIN_MAX_ALLOC = 13 * 1024;
+  // Gate for a background build tick: true when the heap can take parse allocations.
+  // When BLE is what's squeezing the heap, sheds it (build-pending deferral in the
+  // lifecycle then holds restarts off until the window is caught up) instead of
+  // stalling the build forever below the floors.
+  bool buildTickHeapGate();
   // How many pages to keep laid out ahead of the reader for a still-building section. A page
   // turn is ~1s on e-ink and a page builds in ~30ms, so the reader can't out-click the builder
   // -- a tiny buffer is enough. The background build stops once the watermark is this far
@@ -146,6 +195,7 @@ class EpubReaderActivity final : public Activity {
   // it from page 0. Reverts to normal power behavior the moment the build finishes.
   bool skipLoopDelay() override { return section && section->isBuilding(); }
   bool isReaderActivity() const override { return true; }
+  void requestGhostCleanup() override { pagesUntilFullRefresh = 1; }
   ScreenshotInfo getScreenshotInfo() const override;
   CrossPointPosition getCurrentPosition() const;
 };

src/activities/reader/EpubReaderMenuActivity.cpp

@@ -2,8 +2,12 @@
 
 #include <GfxRenderer.h>
 #include <I18n.h>
+#include <Logging.h>
 
+#include "BleInput.h"
+#include "CrossPointSettings.h"
 #include "MappedInputManager.h"
+#include "SilentRestart.h"
 #include "components/UITheme.h"
 #include "fontIds.h"
 
@@ -22,7 +26,7 @@ EpubReaderMenuActivity::EpubReaderMenuActivity(GfxRenderer& renderer, MappedInpu
 std::vector<EpubReaderMenuActivity::MenuItem> EpubReaderMenuActivity::buildMenuItems(bool hasFootnotes,
                                                                                      bool hasBookmarks) {
   std::vector<MenuItem> items;
-  items.reserve(12);
+  items.reserve(13);
   items.push_back({MenuAction::SELECT_CHAPTER, StrId::STR_SELECT_CHAPTER});
   if (hasFootnotes) {
     items.push_back({MenuAction::FOOTNOTES, StrId::STR_FOOTNOTES});
@@ -36,6 +40,7 @@ std::vector<EpubReaderMenuActivity::MenuItem> EpubReaderMenuActivity::buildMenuI
   items.push_back({MenuAction::GO_TO_PERCENT, StrId::STR_GO_TO_PERCENT});
   items.push_back({MenuAction::SCREENSHOT, StrId::STR_SCREENSHOT_BUTTON});
   items.push_back({MenuAction::DISPLAY_QR, StrId::STR_DISPLAY_QR});
+  items.push_back({MenuAction::TOGGLE_BLUETOOTH, StrId::STR_TOGGLE_BLUETOOTH});
   items.push_back({MenuAction::GO_HOME, StrId::STR_GO_HOME_BUTTON});
   items.push_back({MenuAction::SYNC, StrId::STR_SYNC_PROGRESS});
   items.push_back({MenuAction::DELETE_CACHE, StrId::STR_DELETE_CACHE});
@@ -85,6 +90,24 @@ void EpubReaderMenuActivity::loop() {
       return;
     }
 
+    if (selectedAction == MenuAction::TOGGLE_BLUETOOTH) {
+      // Just flip the preference and stay in the menu. The main-loop lifecycle check
+      // brings the BLE stack up/down to match, so start/stop has a single owner.
+      SETTINGS.bluetoothEnabled = SETTINGS.bluetoothEnabled ? 0 : 1;
+      SETTINGS.saveToFile();
+      // Turning BT on below the lifecycle's heap floor would otherwise wait
+      // until the heap happens to recover -- which a long session's fragmentation never
+      // gives back. The user asked for BT *now*: silent-restart into this book to
+      // defrag (fresh boot is ~118 KB free, comfortably above the floor), and BT
+      // auto-starts on the way back in.
+      if (SETTINGS.bluetoothEnabled && !BleHid.isRunning() && ESP.getFreeHeap() < bleinput::kStartMinFreeHeap) {
+        LOG_INF("ERM", "BT enabled below heap floor (%u); silent restart to defrag", ESP.getFreeHeap());
+        silentRestartToReader();
+      }
+      requestUpdate();
+      return;
+    }
+
     setResult(MenuResult{static_cast<int>(selectedAction), pendingOrientation, selectedPageTurnOption});
     finish();
     return;
@@ -136,6 +159,12 @@ void EpubReaderMenuActivity::render(RenderLock&&) {
         } else if (value == MenuAction::AUTO_PAGE_TURN) {
           // Render current page turn value on the right edge of the content area.
           return pageTurnLabels[selectedPageTurnOption];
+        } else if (value == MenuAction::TOGGLE_BLUETOOTH) {
+          if (SETTINGS.bluetoothEnabled) {
+            if (!BleHid.isRunning()) return tr(STR_CONNECTING);
+            return BleHid.isConnected() ? tr(STR_STATE_ON) : tr(STR_CONNECTING);
+          }
+          return tr(STR_STATE_OFF);
         } else {
           return "";
         }

src/activities/reader/EpubReaderMenuActivity.h

@@ -24,7 +24,8 @@ class EpubReaderMenuActivity final : public Activity {
     DISPLAY_QR,
     GO_HOME,
     SYNC,
-    DELETE_CACHE
+    DELETE_CACHE,
+    TOGGLE_BLUETOOTH
   };
 
   explicit EpubReaderMenuActivity(GfxRenderer& renderer, MappedInputManager& mappedInput, const std::string& title,

src/activities/reader/ReaderActivity.h

@@ -31,5 +31,6 @@ class ReaderActivity final : public Activity {
   explicit ReaderActivity(GfxRenderer& renderer, MappedInputManager& mappedInput, std::string initialBookPath)
       : Activity("Reader", renderer, mappedInput), initialBookPath(std::move(initialBookPath)) {}
   void onEnter() override;
-  bool isReaderActivity() const override { return true; }
+  bool isReaderActivity() const override { return false; }
+  bool deferBluetoothStart() const override { return true; }
 };

src/activities/reader/ReaderUtils.h

@@ -59,12 +59,21 @@ inline PageTurnResult detectPageTurn(const MappedInputManager& input) {
   return {prev, next, tiltPrev || tiltNext};
 }
 
-inline void displayWithRefreshCycle(const GfxRenderer& renderer, int& pagesUntilFullRefresh) {
+// One helper, blocking or deferred: the async form starts the refresh and
+// returns so the caller can overlap CPU work with the panel's refresh time.
+// Async callers must not touch the framebuffer until
+// renderer.waitRefreshComplete() and must rebuild the differential baseline
+// before the next page turn (the tiled grayscale cleanup does).
+inline void displayWithRefreshCycle(const GfxRenderer& renderer, int& pagesUntilFullRefresh, bool async = false) {
+  const auto mode = (pagesUntilFullRefresh <= 1) ? HalDisplay::HALF_REFRESH : HalDisplay::FAST_REFRESH;
+  if (async) {
+    renderer.displayBufferAsync(mode);
+  } else {
+    renderer.displayBuffer(mode);
+  }
   if (pagesUntilFullRefresh <= 1) {
-    renderer.displayBuffer(HalDisplay::HALF_REFRESH);
     pagesUntilFullRefresh = SETTINGS.getRefreshFrequency();
   } else {
-    renderer.displayBuffer();
     pagesUntilFullRefresh--;
   }
 }

src/activities/reader/TxtReaderActivity.h

@@ -49,5 +49,6 @@ class TxtReaderActivity final : public Activity {
   void loop() override;
   void render(RenderLock&&) override;
   bool isReaderActivity() const override { return true; }
+  void requestGhostCleanup() override { pagesUntilFullRefresh = 1; }
   ScreenshotInfo getScreenshotInfo() const override;
 };

src/activities/reader/XtcReaderActivity.h

@@ -46,5 +46,6 @@ class XtcReaderActivity final : public Activity {
   void loop() override;
   void render(RenderLock&&) override;
   bool isReaderActivity() const override { return true; }
+  void requestGhostCleanup() override { pagesUntilFullRefresh = 1; }
   ScreenshotInfo getScreenshotInfo() const override;
 };

src/activities/settings/BleButtonMapActivity.cpp

@@ -0,0 +1,167 @@
+#include "BleButtonMapActivity.h"
+
+#include <GfxRenderer.h>
+
+#include <algorithm>
+#include <cstdio>
+#include <iterator>
+
+#include "BleInput.h"
+#include "CrossPointSettings.h"
+#include "components/UITheme.h"
+#include "fontIds.h"
+
+// Logical functions offered for binding. Page navigation + confirm cover Free2 /
+// Free3; the directions are included so a remote can also drive menu navigation.
+const BleButtonMapActivity::Fn BleButtonMapActivity::kFunctions[] = {
+    {MappedInputManager::Button::PageForward, StrId::STR_BT_PAGE_FORWARD},
+    {MappedInputManager::Button::PageBack, StrId::STR_BT_PAGE_BACK},
+    {MappedInputManager::Button::Confirm, StrId::STR_CONFIRM},
+    {MappedInputManager::Button::Back, StrId::STR_BACK},
+    {MappedInputManager::Button::Up, StrId::STR_DIR_UP},
+    {MappedInputManager::Button::Down, StrId::STR_DIR_DOWN},
+    {MappedInputManager::Button::Left, StrId::STR_DIR_LEFT},
+    {MappedInputManager::Button::Right, StrId::STR_DIR_RIGHT},
+};
+const uint8_t BleButtonMapActivity::kFunctionCount = static_cast<uint8_t>(sizeof(kFunctions) / sizeof(kFunctions[0]));
+
+void BleButtonMapActivity::onEnter() {
+  Activity::onEnter();
+  step = Step::WaitForKey;
+  capturedKind = 0xFF;
+  functionIndex = 0;
+  // Start every mapping session from a clean slate: the user re-maps each remote
+  // button once, so a button can't be left bound to a stale action and there's no
+  // separate "clear mappings" step to remember.
+  std::fill(std::begin(SETTINGS.bleKeyMap), std::end(SETTINGS.bleKeyMap), CrossPointSettings::BleKeyMapEntry{});
+  SETTINGS.saveToFile();
+  mappedInput.setBleCaptureMode(true);
+  requestUpdate();
+}
+
+void BleButtonMapActivity::onExit() {
+  mappedInput.setBleCaptureMode(false);
+  Activity::onExit();
+}
+
+bool BleButtonMapActivity::assignCapturedKey(MappedInputManager::Button button) {
+  const uint8_t btn = static_cast<uint8_t>(button);
+  // Mutated via std::replace_if below and through `slot`; cppcheck's CI parse
+  // (no include paths) can't see the writes and suggests const.
+  // cppcheck-suppress constVariableReference
+  auto& map = SETTINGS.bleKeyMap;
+  using Entry = CrossPointSettings::BleKeyMapEntry;
+  const uint8_t kind = capturedKind;
+  const uint8_t value = capturedValue;
+
+  // One key per action: drop any other key currently bound to this action so the same
+  // action can't be triggered by two different remote buttons.
+  std::replace_if(
+      std::begin(map), std::end(map),
+      [&](const Entry& e) { return e.button == btn && !(e.keyKind == kind && e.keyValue == value); }, Entry{});
+
+  // Reuse the slot already bound to this key, else the first free slot.
+  auto* slot = std::find_if(std::begin(map), std::end(map), [&](const Entry& e) {
+    return e.button != 0xFF && e.keyKind == kind && e.keyValue == value;
+  });
+  if (slot == std::end(map)) {
+    slot = std::find_if(std::begin(map), std::end(map),
+                        [](const Entry& e) { return e.button == 0xFF || e.keyKind == 0xFF; });
+  }
+  if (slot == std::end(map)) return false;  // table full
+
+  slot->keyKind = kind;
+  slot->keyValue = value;
+  slot->button = btn;
+  SETTINGS.saveToFile();
+  return true;
+}
+
+void BleButtonMapActivity::loop() {
+  // Front Back button exits the mapping screen at any step.
+  if (mappedInput.wasPressed(MappedInputManager::Button::Back)) {
+    finish();
+    return;
+  }
+
+  if (step == Step::WaitForKey) {
+    uint8_t kind = 0xFF;
+    uint8_t value = 0;
+    if (mappedInput.takeCapturedBleKey(kind, value)) {
+      capturedKind = kind;
+      capturedValue = value;
+      functionIndex = 0;
+      step = Step::SelectFunction;
+      requestUpdate();
+    }
+    return;
+  }
+
+  // Step::SelectFunction — pick a logical function for the captured key.
+  buttonNavigator.onNext([this] {
+    functionIndex = ButtonNavigator::nextIndex(functionIndex, kFunctionCount);
+    requestUpdate();
+  });
+  buttonNavigator.onPrevious([this] {
+    functionIndex = ButtonNavigator::previousIndex(functionIndex, kFunctionCount);
+    requestUpdate();
+  });
+
+  if (mappedInput.wasPressed(MappedInputManager::Button::Confirm)) {
+    assignCapturedKey(kFunctions[functionIndex].button);
+    // Back to capturing so the user can map (or re-map) the next remote button.
+    step = Step::WaitForKey;
+    capturedKind = 0xFF;
+    requestUpdate();
+  }
+}
+
+void BleButtonMapActivity::render(RenderLock&&) {
+  renderer.clearScreen();
+
+  const auto& metrics = UITheme::getInstance().getMetrics();
+  const auto pageWidth = renderer.getScreenWidth();
+  const auto pageHeight = renderer.getScreenHeight();
+
+  GUI.drawHeader(renderer, Rect{0, metrics.topPadding, pageWidth, metrics.headerHeight}, tr(STR_BT_MAP_BUTTONS));
+
+  const int topOffset = metrics.topPadding + metrics.headerHeight + metrics.tabBarHeight + metrics.verticalSpacing;
+  const int contentHeight = pageHeight - topOffset - metrics.buttonHintsHeight - metrics.verticalSpacing;
+
+  if (step == Step::WaitForKey) {
+    GUI.drawSubHeader(renderer, Rect{0, metrics.topPadding + metrics.headerHeight, pageWidth, metrics.tabBarHeight},
+                      tr(STR_BT_PRESS_REMOTE));
+    // Show the current mappings so the user sees progress.
+    int row = 0;
+    for (const auto& e : SETTINGS.bleKeyMap) {
+      if (e.button == 0xFF) continue;
+      char keyName[24];
+      bleinput::describeKey(e.keyKind, e.keyValue, keyName, sizeof(keyName));
+      const char* fnName = "";
+      for (uint8_t i = 0; i < kFunctionCount; i++) {
+        if (static_cast<uint8_t>(kFunctions[i].button) == e.button) {
+          fnName = I18N.get(kFunctions[i].label);
+          break;
+        }
+      }
+      char line[64];
+      snprintf(line, sizeof(line), "%s  ->  %s", keyName, fnName);
+      GUI.drawHelpText(renderer, Rect{0, topOffset + row * 22, pageWidth, 20}, line);
+      row++;
+    }
+  } else {
+    char captured[24];
+    bleinput::describeKey(capturedKind, capturedValue, captured, sizeof(captured));
+    GUI.drawSubHeader(renderer, Rect{0, metrics.topPadding + metrics.headerHeight, pageWidth, metrics.tabBarHeight},
+                      captured);
+    GUI.drawList(
+        renderer, Rect{0, topOffset, pageWidth, contentHeight}, kFunctionCount, functionIndex,
+        [this](int i) { return std::string(I18N.get(kFunctions[i].label)); }, nullptr, nullptr, nullptr, false);
+  }
+
+  const char* confirm = step == Step::WaitForKey ? "" : tr(STR_SELECT);
+  const auto labels = mappedInput.mapLabels(tr(STR_BACK), confirm, tr(STR_DIR_UP), tr(STR_DIR_DOWN));
+  GUI.drawButtonHints(renderer, labels.btn1, labels.btn2, labels.btn3, labels.btn4);
+
+  renderer.displayBuffer();
+}

src/activities/settings/BleButtonMapActivity.h

@@ -0,0 +1,47 @@
+#pragma once
+
+#include <I18n.h>
+
+#include <cstdint>
+
+#include "MappedInputManager.h"
+#include "activities/Activity.h"
+#include "util/ButtonNavigator.h"
+
+// Capture-then-assign mapping for BLE page-turner buttons. The user presses a
+// button on the remote; we capture its decoded key identity (via the
+// MappedInputManager BLE capture mode) and let them bind it to a logical button.
+// Repeat to map each remote button; Back exits. Mirrors ButtonRemapActivity's
+// flow, but the input source is the BLE host instead of the front buttons.
+class BleButtonMapActivity final : public Activity {
+ public:
+  explicit BleButtonMapActivity(GfxRenderer& renderer, MappedInputManager& mappedInput)
+      : Activity("BleButtonMap", renderer, mappedInput) {}
+
+  void onEnter() override;
+  void onExit() override;
+  void loop() override;
+  void render(RenderLock&&) override;
+
+ private:
+  // Logical functions a remote button can be bound to.
+  struct Fn {
+    MappedInputManager::Button button;
+    StrId label;
+  };
+  static const Fn kFunctions[];
+  static const uint8_t kFunctionCount;
+
+  enum class Step { WaitForKey, SelectFunction };
+  Step step = Step::WaitForKey;
+
+  uint8_t capturedKind = 0xFF;
+  uint8_t capturedValue = 0;
+  int functionIndex = 0;
+
+  ButtonNavigator buttonNavigator;
+
+  // Bind the captured key to the chosen logical button in SETTINGS.bleKeyMap and
+  // persist. Returns false when the table is full and the key is new.
+  bool assignCapturedKey(MappedInputManager::Button button);
+};

src/activities/settings/BluetoothSettingsActivity.cpp

@@ -0,0 +1,314 @@
+#include "BluetoothSettingsActivity.h"
+
+#include <BleKeyboardHost.h>
+#include <GfxRenderer.h>
+#include <Logging.h>
+
+#include <cstdio>
+
+#include "BleButtonMapActivity.h"
+#include "BleInput.h"
+#include "CrossPointSettings.h"
+#include "MappedInputManager.h"
+#include "components/UITheme.h"
+#include "fontIds.h"
+
+namespace {
+constexpr unsigned long kBannerMs = 2000;
+constexpr uint32_t kScanMs = 8000;
+constexpr unsigned long kForgetHoldMs = 1200;  // hold Confirm this long in the Paired view to forget
+}  // namespace
+
+void BluetoothSettingsActivity::onEnter() {
+  Activity::onEnter();
+  view = View::Menu;
+  menuIndex = 0;
+  rebuildMenuRows();
+  requestUpdate();
+}
+
+void BluetoothSettingsActivity::onExit() {
+  if (BleHid.isScanning()) BleHid.stopScan();
+  Activity::onExit();
+}
+
+void BluetoothSettingsActivity::setBanner(const char* text) {
+  banner = text ? text : "";
+  bannerUntil = millis() + kBannerMs;
+}
+
+void BluetoothSettingsActivity::rebuildMenuRows() {
+  menuRows.clear();
+  menuRows.reserve(8);
+  menuRows.push_back({Action::ToggleBt, StrId::STR_BLUETOOTH});
+  if (SETTINGS.bluetoothEnabled) {
+    menuRows.push_back({Action::Scan, StrId::STR_BT_SCAN_PAIR});
+    if (BleHid.isConnected()) menuRows.push_back({Action::Disconnect, StrId::STR_BT_DISCONNECT});
+    menuRows.push_back({Action::PairedDevices, StrId::STR_BT_PAIRED_DEVICES});
+    menuRows.push_back({Action::MapButtons, StrId::STR_BT_MAP_BUTTONS});
+  }
+  if (menuIndex >= static_cast<int>(menuRows.size())) menuIndex = 0;
+}
+
+void BluetoothSettingsActivity::startScanView() {
+  LOG_INF("BLEUI", "scan view: begin running=%d scanning=%d devices=%u paired=%u", BleHid.isRunning(),
+          BleHid.isScanning(), BleHid.deviceCount(), BleHid.pairedCount());
+  view = View::Scan;
+  scanIndex = 0;
+  awaitingConnect = false;
+  lastLoggedScanState = false;
+  lastLoggedDeviceCount = 0xFF;
+  // The main-loop lifecycle owns steady-state start/stop, but a scan needs the stack
+  // this instant — entering this screen can precede the lifecycle's next tick, or its
+  // heap gate may have deferred the start. ensureStarted() is idempotent, and with
+  // this screen on top the lifecycle keeps the stack up (keepsBluetoothAlive).
+  if (!BleHid.isRunning() && !bleinput::ensureStarted()) {
+    LOG_ERR("BLEUI", "scan: BLE start failed (heap=%u)", ESP.getFreeHeap());
+  }
+  BleHid.startScan(kScanMs);
+  LOG_INF("BLEUI", "scan view: startScan requested scanning=%d devices=%u", BleHid.isScanning(), BleHid.deviceCount());
+  requestUpdate();
+}
+
+void BluetoothSettingsActivity::handleMenuConfirm() {
+  if (menuRows.empty()) return;
+  const Action action = menuRows[menuIndex].action;
+  switch (action) {
+    case Action::ToggleBt:
+      // Flip the preference only; the main-loop lifecycle check starts/stops the BLE
+      // stack to match (and shows the "BT Connecting..." popup). Single owner.
+      SETTINGS.bluetoothEnabled = SETTINGS.bluetoothEnabled ? 0 : 1;
+      SETTINGS.saveToFile();
+      rebuildMenuRows();
+      requestUpdate();
+      break;
+    case Action::Scan:
+      startScanView();
+      break;
+    case Action::Disconnect:
+      BleHid.disconnect();
+      setBanner(tr(STR_BT_NOT_CONNECTED));
+      rebuildMenuRows();
+      requestUpdate();
+      break;
+    case Action::PairedDevices:
+      view = View::Paired;
+      pairedIndex = 0;
+      requestUpdate();
+      break;
+    case Action::MapButtons:
+      startActivityForResult(std::make_unique<BleButtonMapActivity>(renderer, mappedInput),
+                             [this](const ActivityResult&) {
+                               rebuildMenuRows();
+                               requestUpdate();
+                             });
+      break;
+  }
+}
+
+void BluetoothSettingsActivity::loop() {
+  // Clear an expired status banner.
+  if (bannerUntil > 0 && millis() > bannerUntil) {
+    banner.clear();
+    bannerUntil = 0;
+    requestUpdate();
+  }
+
+  // Watch for an async connect result (from either the scan list or the paired list).
+  if (awaitingConnect) {
+    char reason[48];
+    if (BleHid.isConnected()) {
+      awaitingConnect = false;
+      BleHid.releaseScanResults();
+      view = View::Menu;
+      rebuildMenuRows();
+      char buf[64];
+      snprintf(buf, sizeof(buf), tr(STR_BT_CONNECTED_TO), BleHid.connectedName());
+      setBanner(buf);
+      requestUpdate();
+    } else if (BleHid.takeConnectFailure(reason, sizeof(reason))) {
+      awaitingConnect = false;
+      setBanner(reason);
+      requestUpdate();
+    }
+  }
+
+  // Back returns to the menu from a sub-view, or leaves the screen from the menu.
+  if (mappedInput.wasPressed(MappedInputManager::Button::Back)) {
+    if (view == View::Menu) {
+      finish();
+    } else {
+      if (BleHid.isScanning()) BleHid.stopScan();
+      view = View::Menu;
+      rebuildMenuRows();
+      requestUpdate();
+    }
+    return;
+  }
+
+  // Navigation within the active list.
+  const int count = view == View::Menu   ? static_cast<int>(menuRows.size())
+                    : view == View::Scan ? BleHid.deviceCount()
+                                         : BleHid.pairedCount();
+  int* idx = view == View::Menu ? &menuIndex : view == View::Scan ? &scanIndex : &pairedIndex;
+  buttonNavigator.onNext([this, count, idx] {
+    if (count > 0) *idx = ButtonNavigator::nextIndex(*idx, count);
+    requestUpdate();
+  });
+  buttonNavigator.onPrevious([this, count, idx] {
+    if (count > 0) *idx = ButtonNavigator::previousIndex(*idx, count);
+    requestUpdate();
+  });
+
+  // Paired view: tap Confirm to connect, hold Confirm to forget. Uses release for
+  // connect so a hold can fire forget without also connecting on the same press.
+  if (view == View::Paired) {
+    if (mappedInput.isPressed(MappedInputManager::Button::Confirm)) {
+      if (!pairedActionTaken && mappedInput.getHeldTime() >= kForgetHoldMs && pairedIndex < BleHid.pairedCount()) {
+        const auto& p = BleHid.paired(static_cast<uint8_t>(pairedIndex));
+        BleHid.forget(p.addr);
+        if (pairedIndex > 0) pairedIndex--;
+        setBanner(tr(STR_FORGET_BUTTON));
+        pairedActionTaken = true;
+        rebuildMenuRows();
+        requestUpdate();
+      }
+    } else if (mappedInput.wasReleased(MappedInputManager::Button::Confirm)) {
+      if (!pairedActionTaken && !awaitingConnect && pairedIndex < BleHid.pairedCount()) {
+        const auto& p = BleHid.paired(static_cast<uint8_t>(pairedIndex));
+        awaitingConnect = true;
+        setBanner(tr(STR_CONNECTING));
+        BleHid.connect(p.addr);
+        requestUpdate();
+      }
+      pairedActionTaken = false;
+    }
+    return;
+  }
+
+  if (mappedInput.wasPressed(MappedInputManager::Button::Confirm)) {
+    if (view == View::Menu) {
+      handleMenuConfirm();
+    } else if (view == View::Scan) {
+      const int scanCount = BleHid.deviceCount();
+      if (!awaitingConnect && scanCount == 0 && !BleHid.isScanning()) {
+        LOG_INF("BLEUI", "scan view: restart scan requested");
+        if (!BleHid.isRunning() && !bleinput::ensureStarted()) {
+          LOG_ERR("BLEUI", "scan restart: BLE start failed (heap=%u)", ESP.getFreeHeap());
+        }
+        BleHid.startScan(kScanMs);
+        LOG_INF("BLEUI", "scan view: restart scan state scanning=%d devices=%u", BleHid.isScanning(),
+                BleHid.deviceCount());
+        requestUpdate();
+      } else if (!awaitingConnect && scanIndex < scanCount) {
+        if (BleHid.isScanning()) BleHid.stopScan();
+        const auto& d = BleHid.device(static_cast<uint8_t>(scanIndex));
+        LOG_INF("BLEUI", "scan view: connect addr=%s name='%s' rssi=%d type=%u hid=%d conn=%d", d.addr, d.name, d.rssi,
+                d.addrType, d.hid, d.connectable);
+        awaitingConnect = true;
+        setBanner(tr(STR_CONNECTING));
+        BleHid.connect(d.addr);
+        requestUpdate();
+      }
+    }
+    return;
+  }
+
+  // The scan list changes as devices are discovered — keep repainting while active.
+  if (view == View::Scan) {
+    const bool scanning = BleHid.isScanning();
+    const uint8_t deviceCount = BleHid.deviceCount();
+    if (scanning != lastLoggedScanState || deviceCount != lastLoggedDeviceCount) {
+      LOG_INF("BLEUI", "scan view: state scanning=%d devices=%u", scanning, deviceCount);
+      lastLoggedScanState = scanning;
+      lastLoggedDeviceCount = deviceCount;
+    }
+    if (scanning) requestUpdate();
+  }
+}
+
+std::string BluetoothSettingsActivity::deviceLabel(int index) const {
+  if (index >= BleHid.deviceCount()) return "";
+  const auto& d = BleHid.device(static_cast<uint8_t>(index));
+  return std::string(d.name);
+}
+
+std::string BluetoothSettingsActivity::pairedLabel(int index) const {
+  if (index >= BleHid.pairedCount()) return "";
+  const auto& p = BleHid.paired(static_cast<uint8_t>(index));
+  return std::string(p.name);
+}
+
+void BluetoothSettingsActivity::render(RenderLock&&) {
+  renderer.clearScreen();
+
+  const auto& metrics = UITheme::getInstance().getMetrics();
+  const auto pageWidth = renderer.getScreenWidth();
+  const auto pageHeight = renderer.getScreenHeight();
+
+  const char* title = tr(STR_BLUETOOTH);
+  GUI.drawHeader(renderer, Rect{0, metrics.topPadding, pageWidth, metrics.headerHeight}, title);
+
+  // Sub-header: connection status.
+  const char* status = BleHid.isConnected() ? BleHid.connectedName() : tr(STR_BT_NOT_CONNECTED);
+  GUI.drawSubHeader(renderer, Rect{0, metrics.topPadding + metrics.headerHeight, pageWidth, metrics.tabBarHeight},
+                    status);
+
+  const int topOffset = metrics.topPadding + metrics.headerHeight + metrics.tabBarHeight + metrics.verticalSpacing;
+  const int contentHeight = pageHeight - topOffset - metrics.buttonHintsHeight - metrics.verticalSpacing;
+  const Rect listRect{0, topOffset, pageWidth, contentHeight};
+
+  if (view == View::Menu) {
+    GUI.drawList(
+        renderer, listRect, static_cast<int>(menuRows.size()), menuIndex,
+        [this](int i) { return std::string(I18N.get(menuRows[i].label)); }, nullptr, nullptr,
+        [this](int i) -> std::string {
+          if (menuRows[i].action == Action::ToggleBt)
+            return SETTINGS.bluetoothEnabled ? tr(STR_STATE_ON) : tr(STR_STATE_OFF);
+          return "";
+        },
+        true);
+  } else if (view == View::Scan) {
+    // Free2/3 remotes only advertise in the right slider mode — tell the user how.
+    GUI.drawHelpText(renderer, Rect{0, topOffset, pageWidth, 16}, tr(STR_BT_FREE_HINT1));
+    GUI.drawHelpText(renderer, Rect{0, topOffset + 16, pageWidth, 16}, tr(STR_BT_FREE_HINT2));
+    const int scanTop = topOffset + 38;
+    const int count = BleHid.deviceCount();
+    if (count == 0) {
+      GUI.drawHelpText(renderer, Rect{0, scanTop, pageWidth, 24},
+                       BleHid.isScanning() ? tr(STR_SCANNING) : tr(STR_BT_NO_DEVICES));
+    } else {
+      GUI.drawList(
+          renderer, Rect{0, scanTop, pageWidth, contentHeight - 38}, count, scanIndex,
+          [this](int i) { return deviceLabel(i); }, nullptr, nullptr, nullptr, false);
+    }
+  } else {  // Paired
+    const int count = BleHid.pairedCount();
+    if (count == 0) {
+      GUI.drawHelpText(renderer, Rect{0, topOffset + metrics.verticalSpacing, pageWidth, 24}, tr(STR_BT_NO_PAIRED));
+    } else {
+      GUI.drawList(
+          renderer, listRect, count, pairedIndex, [this](int i) { return pairedLabel(i); }, nullptr, nullptr, nullptr,
+          false);
+    }
+  }
+
+  // Transient banner above the hints.
+  if (!banner.empty()) {
+    GUI.drawHelpText(renderer, Rect{0, pageHeight - metrics.buttonHintsHeight - 22, pageWidth, 20}, banner.c_str());
+  }
+
+  // In the paired list, Confirm connects and a hold forgets — surface the hold hint.
+  if (view == View::Paired && BleHid.pairedCount() > 0 && banner.empty()) {
+    GUI.drawHelpText(renderer, Rect{0, pageHeight - metrics.buttonHintsHeight - 22, pageWidth, 20},
+                     tr(STR_BT_FORGET_PROMPT));
+  }
+
+  // Button hints differ by view (Menu selects; Scan and Paired both connect).
+  const bool scanCanRestart = view == View::Scan && BleHid.deviceCount() == 0 && !BleHid.isScanning();
+  const char* confirm = view == View::Menu ? tr(STR_SELECT) : scanCanRestart ? "Scan" : tr(STR_CONNECT);
+  const auto labels = mappedInput.mapLabels(tr(STR_BACK), confirm, tr(STR_DIR_UP), tr(STR_DIR_DOWN));
+  GUI.drawButtonHints(renderer, labels.btn1, labels.btn2, labels.btn3, labels.btn4);
+
+  renderer.displayBuffer();
+}

src/activities/settings/BluetoothSettingsActivity.h

@@ -0,0 +1,65 @@
+#pragma once
+
+#include <I18n.h>
+
+#include <string>
+#include <vector>
+
+#include "activities/Activity.h"
+#include "util/ButtonNavigator.h"
+
+// Bluetooth page-turner settings. One screen with three views:
+//   Menu   — enable/disable BT, scan & pair, disconnect, map buttons, presets.
+//   Scan   — live list of discovered BLE HID devices; Confirm connects.
+//   Paired — bonded devices; Confirm forgets the selected one.
+// All BLE access goes through the FreeInk BleHid singleton; everything no-ops
+// gracefully when BLE is compiled out (BleHid.begin() returns false).
+class BluetoothSettingsActivity final : public Activity {
+ public:
+  explicit BluetoothSettingsActivity(GfxRenderer& renderer, MappedInputManager& mappedInput)
+      : Activity("BluetoothSettings", renderer, mappedInput) {}
+
+  void onEnter() override;
+  void onExit() override;
+  void loop() override;
+  void render(RenderLock&&) override;
+  bool keepsBluetoothAlive() const override { return true; }
+
+ private:
+  enum class View { Menu, Scan, Paired };
+
+  // Menu row actions.
+  enum class Action { ToggleBt, Scan, Disconnect, MapButtons, PairedDevices };
+  struct MenuRow {
+    Action action;
+    StrId label;
+  };
+
+  View view = View::Menu;
+  std::vector<MenuRow> menuRows;
+  int menuIndex = 0;
+  int scanIndex = 0;
+  int pairedIndex = 0;
+
+  ButtonNavigator buttonNavigator;
+
+  // Transient status banner (connect result, forget confirmation, etc.).
+  std::string banner;
+  unsigned long bannerUntil = 0;
+
+  // Set when a connect() has been issued and we're waiting for the async result.
+  bool awaitingConnect = false;
+  // Guards the Paired view's hold-to-forget so it fires once per hold and suppresses
+  // the tap-to-connect on the same press.
+  bool pairedActionTaken = false;
+  bool lastLoggedScanState = false;
+  uint8_t lastLoggedDeviceCount = 0xFF;
+
+  void rebuildMenuRows();
+  void handleMenuConfirm();
+  void startScanView();
+  void setBanner(const char* text);
+
+  std::string deviceLabel(int index) const;  // scan list row text
+  std::string pairedLabel(int index) const;  // paired list row text
+};

src/activities/settings/FontDownloadActivity.cpp

@@ -17,6 +17,8 @@
 #include "fontIds.h"
 #include "network/HttpDownloader.h"
 
+#include "BleInput.h"
+
 FontDownloadActivity::FontDownloadActivity(GfxRenderer& renderer, MappedInputManager& mappedInput)
     : Activity("FontDownload", renderer, mappedInput), fontInstaller_(sdFontSystem.registry()) {}
 
@@ -24,6 +26,12 @@ FontDownloadActivity::FontDownloadActivity(GfxRenderer& renderer, MappedInputMan
 
 void FontDownloadActivity::onEnter() {
   Activity::onEnter();
+  // Free the BLE stack BEFORE bringing WiFi up (matches WifiSelectionActivity):
+  // the C3 shares one radio and heap between the stacks, and the WiFi driver
+  // sizes its RX/TX buffer pools at init — initializing it with NimBLE's ~50 KB
+  // still resident leaves WiFi permanently starved even after the lifecycle
+  // stops BLE a loop later. No-op when BLE is already off.
+  bleinput::stop();
   WiFi.mode(WIFI_STA);
   startActivityForResult(std::make_unique<WifiSelectionActivity>(renderer, mappedInput),
                          [this](const ActivityResult& result) { onWifiSelectionComplete(!result.isCancelled); });

src/activities/settings/OtaUpdateActivity.cpp

@@ -11,6 +11,8 @@
 #include "fontIds.h"
 #include "network/OtaUpdater.h"
 
+#include "BleInput.h"
+
 void OtaUpdateActivity::onWifiSelectionComplete(const bool success) {
   if (!success) {
     LOG_ERR("OTA", "WiFi connection failed, exiting");
@@ -56,6 +58,12 @@ void OtaUpdateActivity::onEnter() {
 
   // Turn on WiFi immediately
   LOG_DBG("OTA", "Turning on WiFi...");
+  // Free the BLE stack BEFORE bringing WiFi up (matches WifiSelectionActivity):
+  // the C3 shares one radio and heap between the stacks, and the WiFi driver
+  // sizes its RX/TX buffer pools at init — initializing it with NimBLE's ~50 KB
+  // still resident leaves WiFi permanently starved even after the lifecycle
+  // stops BLE a loop later. No-op when BLE is already off.
+  bleinput::stop();
   WiFi.mode(WIFI_STA);
 
   // Launch WiFi selection subactivity

src/activities/settings/SettingsActivity.cpp

@@ -7,6 +7,7 @@
 #include <cstdio>
 #include <cstring>
 
+#include "BluetoothSettingsActivity.h"
 #include "ButtonRemapActivity.h"
 #include "ClearCacheActivity.h"
 #include "CrossPointSettings.h"
@@ -59,6 +60,7 @@ void SettingsActivity::rebuildSettingsLists() {
   // Append device-only ACTION items
   controlsSettings.insert(controlsSettings.begin(),
                           SettingInfo::Action(StrId::STR_REMAP_FRONT_BUTTONS, SettingAction::RemapFrontButtons));
+  controlsSettings.push_back(SettingInfo::Action(StrId::STR_BLUETOOTH, SettingAction::Bluetooth));
   systemSettings.push_back(SettingInfo::Action(StrId::STR_WIFI_NETWORKS, SettingAction::Network));
   systemSettings.push_back(SettingInfo::Action(StrId::STR_KOREADER_SYNC, SettingAction::KOReaderSync));
   systemSettings.push_back(SettingInfo::Action(StrId::STR_OPDS_SERVERS, SettingAction::OPDSBrowser));
@@ -295,6 +297,9 @@ void SettingsActivity::toggleCurrentSetting() {
       case SettingAction::Language:
         startActivityForResult(std::make_unique<LanguageSelectActivity>(renderer, mappedInput), resultHandler);
         break;
+      case SettingAction::Bluetooth:
+        startActivityForResult(std::make_unique<BluetoothSettingsActivity>(renderer, mappedInput), resultHandler);
+        break;
       case SettingAction::None:
         // Do nothing
         break;

src/activities/settings/SettingsActivity.h

@@ -24,6 +24,7 @@ enum class SettingAction {
   SdFirmwareUpdate,
   Language,
   DownloadFonts,
+  Bluetooth,
 };
 
 struct SettingInfo {

src/components/icons/bluetooth.h

@@ -0,0 +1,7 @@
+#pragma once
+#include <cstdint>
+
+// size: 16x16, generated from Lucide bluetooth.svg with FreeInk's icon generator.
+static const uint8_t BluetoothStatusIcon[] = {0xFF, 0xFF, 0xFE, 0x7F, 0xFE, 0x3F, 0xFE, 0x1F, 0xF6, 0x4F, 0xFA,
+                                              0x5F, 0xFC, 0x3F, 0xFE, 0x7F, 0xFE, 0x7F, 0xFC, 0x3F, 0xFA, 0x5F,
+                                              0xF6, 0x4F, 0xFE, 0x1F, 0xFE, 0x3F, 0xFE, 0x7F, 0xFF, 0xFF};

src/components/themes/BaseTheme.cpp

@@ -13,6 +13,7 @@
 #include "I18n.h"
 #include "RecentBooksStore.h"
 #include "components/UITheme.h"
+#include "components/icons/bluetooth.h"
 #include "components/icons/bookmark.h"
 #include "fontIds.h"
 
@@ -23,8 +24,10 @@ constexpr int homeMarginTop = 30;
 constexpr int subtitleY = 738;
 constexpr int bookmarkStatusIconWidth = 16;
 constexpr int bookmarkStatusIconHeight = 14;
-constexpr int bookmarkStatusIconGap = 4;
 constexpr int bookmarkStatusIconTopCrop = 2;
+constexpr int bluetoothStatusIconWidth = 16;
+constexpr int bluetoothStatusIconHeight = 16;
+constexpr int statusIconGap = 4;
 
 bool statusBarTextLaneVisible() {
   return SETTINGS.statusBarChapterPageCount || SETTINGS.statusBarBookProgressPercentage ||
@@ -43,6 +46,17 @@ void drawBookmarkStatusIcon(const GfxRenderer& renderer, const int x, const int
   }
 }
 
+void drawBluetoothStatusIcon(const GfxRenderer& renderer, const int x, const int y) {
+  constexpr int bytesPerRow = bluetoothStatusIconWidth / 8;
+  for (int row = 0; row < bluetoothStatusIconHeight; ++row) {
+    for (int col = 0; col < bluetoothStatusIconWidth; ++col) {
+      const uint8_t byte = BluetoothStatusIcon[row * bytesPerRow + col / 8];
+      const uint8_t mask = 1U << (7 - (col % 8));
+      renderer.drawPixel(x + col, y + row, (byte & mask) == 0);
+    }
+  }
+}
+
 }  // namespace
 
 void BaseTheme::drawBatteryOutline(const GfxRenderer& renderer, int x, int y, int battWidth, int rectHeight) {
@@ -749,7 +763,8 @@ void BaseTheme::fillPopupProgress(const GfxRenderer& renderer, const Rect& layou
 
 void BaseTheme::drawStatusBar(GfxRenderer& renderer, const float bookProgress, const int currentPage,
                               const int pageCount, std::string title, const int paddingBottom, const int textYOffset,
-                              const bool fillMargin, const bool isPageBookmarked, const bool pageCountEstimated) const {
+                              const bool fillMargin, const bool isPageBookmarked, const bool pageCountEstimated,
+                              const bool bluetoothConnected) const {
   auto metrics = UITheme::getInstance().getMetrics();
   int orientedMarginTop, orientedMarginRight, orientedMarginBottom, orientedMarginLeft;
   renderer.getOrientedViewableTRBL(&orientedMarginTop, &orientedMarginRight, &orientedMarginBottom,
@@ -845,9 +860,17 @@ void BaseTheme::drawStatusBar(GfxRenderer& renderer, const float bookProgress, c
     }
   }
 
-  // Draw Bookmark
+  // Draw status icons
+  if (showStatusBarTextLane && bluetoothConnected) {
+    const int bluetoothGap = leftClusterWidth > 0 ? statusIconGap : 0;
+    const int bluetoothX = leftClusterX + leftClusterWidth + bluetoothGap;
+    const int bluetoothY = textY + 3;
+    drawBluetoothStatusIcon(renderer, bluetoothX, bluetoothY);
+    leftClusterWidth += bluetoothStatusIconWidth + bluetoothGap;
+  }
+
   if (showStatusBarTextLane && isPageBookmarked) {
-    const int bookmarkGap = leftClusterWidth > 0 ? bookmarkStatusIconGap : 0;
+    const int bookmarkGap = leftClusterWidth > 0 ? statusIconGap : 0;
     const int bookmarkX = leftClusterX + leftClusterWidth + bookmarkGap;
     const int bookmarkY = textY + 5;
     drawBookmarkStatusIcon(renderer, bookmarkX, bookmarkY);

src/components/themes/BaseTheme.h

@@ -238,7 +238,7 @@ class BaseTheme {
   void drawStatusBar(GfxRenderer& renderer, const float bookProgress, const int currentPage, const int pageCount,
                      std::string title, const int paddingBottom = 0, const int textYOffset = 0,
                      const bool fillMargin = true, const bool isPageBookmarked = false,
-                     const bool pageCountEstimated = false) const;
+                     const bool pageCountEstimated = false, const bool bluetoothConnected = false) const;
   void drawHelpText(const GfxRenderer& renderer, Rect rect, const char* label) const;
   virtual void drawTextField(const GfxRenderer& renderer, Rect rect, const int textWidth, bool cursorMode = false,
                              int contentStartX = 0, int contentWidth = 0) const;

src/main.cpp

@@ -18,6 +18,7 @@
 
 #include <cstring>
 
+#include "BleInput.h"
 #include "CrossPointSettings.h"
 #include "CrossPointState.h"
 #include "KOReaderCredentialStore.h"
@@ -33,6 +34,8 @@
 #include "images/LoadingIcon.h"
 #include "util/ButtonNavigator.h"
 #include "util/ScreenshotUtil.h"
+#include <Memory.h>
+#include "HeapMap.h"
 
 GfxRenderer renderer(display);
 MappedInputManager mappedInputManager(gpio, renderer);
@@ -127,6 +130,12 @@ enum class BootResume : uint8_t {
   QuickResume,  // wake from a quick-resume deep sleep (SD flag; survives power loss)
 };
 
+// Latched in setup() from the read-and-clear of the RTC flag, so the reboot-loop
+// guard in bootWasSilentRestart() has the answer for the whole session.
+static bool bootWasSilentRestartFlag = false;
+
+bool bootWasSilentRestart() { return bootWasSilentRestartFlag; }
+
 // Latched true once enterDeepSleep() commits to sleeping, before it tears down
 // the current activity. WiFi activities call silentRestart() in onExit() to
 // clear heap fragmentation on the way out, but deep sleep is a full chip reset
@@ -262,6 +271,10 @@ void enterDeepSleep(bool fromTimeout = false) {
     WiFi.mode(WIFI_OFF);
   }
 
+  // Drop any BLE HID link cleanly so the page-turner sees the disconnect promptly.
+  // bluetoothEnabled persists, so the setting is restored on the next wake.
+  bleinput::stop();
+
   halTiltSensor.deepSleep();
   display.deepSleep();
   LOG_DBG("MAIN", "Entering deep sleep");
@@ -325,6 +338,7 @@ void setup() {
       (isSilentReboot && silentRebootTarget <= SILENT_REBOOT_TARGET_READER) ? silentRebootTarget : 0;
   silentRebootMagic = 0;
   silentRebootTarget = 0;
+  bootWasSilentRestartFlag = isSilentReboot;
 
   gpio.begin();
   powerManager.begin();
@@ -478,6 +492,78 @@ void setup() {
   // Ensure we're not still holding the power button before leaving setup
   waitForPowerRelease();
   allowSleepAt = millis() + 2000;
+  // Bluetooth is started lazily by the lifecycle check in loop() once a reader or the
+  // Bluetooth settings screen is on the stack — not here at boot — so home/browser and
+  // WiFi activities keep the ~50 KB the BLE stack would otherwise hold.
+}
+
+// Bring the BLE stack up or down to match the current context. BLE is only resident
+// while a reader (page-turner input) or the Bluetooth settings screen (pairing) is on
+// the stack AND WiFi is off. Heap-heavy reader phases may stop BLE directly; this
+// lifecycle then restarts it only after the normal activity/render/heap gates pass.
+void updateBluetoothLifecycle() {
+  const bool wanted =
+      SETTINGS.bluetoothEnabled && activityManager.bluetoothShouldBeActive() && WiFi.getMode() == WIFI_MODE_NULL;
+  if (wanted && !BleHid.isRunning() && activityManager.bluetoothStartDeferred()) {
+    static uint32_t lastActivityDeferLogMs = 0;
+    if (millis() - lastActivityDeferLogMs > 10000) {
+      lastActivityDeferLogMs = millis();
+      LOG_INF("BLELC", "start deferred: activity busy heap=%u maxAlloc=%u", ESP.getFreeHeap(), ESP.getMaxAllocHeap());
+    }
+    return;
+  }
+  // Heap gate: NimBLE needs ~57 KB. If the reader cannot spare that yet, retry
+  // on the next loop without entering any separate BLE hold state.
+  // The BT settings screen is explicit user intent to run BLE right now (scan/pair is
+  // dead without the stack). Its floor only needs to cover NimBLE itself — the 100 KB
+  // reader floor reserves build/render headroom that never gets used there.
+  const bool explicitBtContext = activityManager.currentKeepsBluetoothAlive();
+  const size_t startFloor = explicitBtContext ? bleinput::kStartMinFreeHeapExplicit : bleinput::kStartMinFreeHeap;
+  if (wanted && !BleHid.isRunning() && activityManager.isReaderActivity() && !renderer.hasFrameBuffer()) {
+    static uint32_t lastFramebufferLoanDeferLogMs = 0;
+    if (millis() - lastFramebufferLoanDeferLogMs > 10000) {
+      lastFramebufferLoanDeferLogMs = millis();
+      LOG_INF("BLELC", "start deferred: framebuffer lent heap=%u maxAlloc=%u", ESP.getFreeHeap(),
+              ESP.getMaxAllocHeap());
+    }
+    return;
+  }
+  if (wanted && !BleHid.isRunning() && activityManager.isReaderActivity() && RenderLock::peek()) {
+    static uint32_t lastReaderRenderDeferLogMs = 0;
+    if (millis() - lastReaderRenderDeferLogMs > 10000) {
+      lastReaderRenderDeferLogMs = millis();
+      LOG_INF("BLELC", "start deferred: reader render in progress heap=%u maxAlloc=%u", ESP.getFreeHeap(),
+              ESP.getMaxAllocHeap());
+    }
+    return;
+  }
+  if (wanted && !BleHid.isRunning() && ESP.getFreeHeap() < startFloor) {
+    static uint32_t lastGateLogMs = 0;
+    if (millis() - lastGateLogMs > 10000) {
+      lastGateLogMs = millis();
+      LOG_INF("BLELC", "start deferred: heap %u floor %u", ESP.getFreeHeap(), (unsigned)startFloor);
+    }
+    return;
+  }
+  if (wanted && !BleHid.isRunning()) {
+    LOG_INF("BLELC", "start requested enabled=%u reader=%d settings=%d wifi=%d paired=%u heap=%u maxAlloc=%u",
+            SETTINGS.bluetoothEnabled, activityManager.isReaderActivity(), activityManager.currentKeepsBluetoothAlive(),
+            WiFi.getMode(), BleHid.pairedCount(), ESP.getFreeHeap(), ESP.getMaxAllocHeap());
+    // Start immediately once the lifecycle gates pass. Do not draw a reconnect
+    // popup here: that schedules a reader redraw while BLE has just consumed ~53 KB,
+    // which can immediately trip the render heap shed path and create a start/stop loop.
+    if (!bleinput::ensureStarted()) {
+      LOG_ERR("BLELC", "start failed heap=%u maxAlloc=%u", ESP.getFreeHeap(), ESP.getMaxAllocHeap());
+      return;
+    }
+    LOG_INF("BLELC", "started paired=%u heap=%u maxAlloc=%u", BleHid.pairedCount(), ESP.getFreeHeap(),
+            ESP.getMaxAllocHeap());
+  } else if (!wanted && BleHid.isRunning()) {
+    LOG_INF("BLELC", "stop requested enabled=%u active=%d wifi=%d heap=%u maxAlloc=%u", SETTINGS.bluetoothEnabled,
+            activityManager.bluetoothShouldBeActive(), WiFi.getMode(), ESP.getFreeHeap(), ESP.getMaxAllocHeap());
+    bleinput::stop();
+    LOG_INF("BLELC", "stopped heap=%u maxAlloc=%u", ESP.getFreeHeap(), ESP.getMaxAllocHeap());
+  }
 }
 
 void loop() {
@@ -486,6 +572,24 @@ void loop() {
   static unsigned long lastMemPrint = 0;
 
   gpio.update();
+  updateBluetoothLifecycle();  // bring BLE up/down for the current activity context
+  static bool lastBleConnected = false;
+  BleHid.poll();  // drive BLE auto-reconnect + key auto-repeat (no-op when BT off)
+  const bool bleConnected = BleHid.isConnected();
+  if (bleConnected && !lastBleConnected) {
+    LOG_INF("BLELC", "connected name=%s heap=%u maxAlloc=%u", BleHid.connectedName(), ESP.getFreeHeap(),
+            ESP.getMaxAllocHeap());
+    if (activityManager.isReaderActivity() && !activityManager.currentKeepsBluetoothAlive()) {
+      activityManager.requestUpdate();
+    }
+  } else if (!bleConnected && lastBleConnected) {
+    LOG_INF("BLELC", "disconnected heap=%u maxAlloc=%u", ESP.getFreeHeap(), ESP.getMaxAllocHeap());
+    if (activityManager.isReaderActivity() && !activityManager.currentKeepsBluetoothAlive()) {
+      activityManager.requestUpdate();
+    }
+  }
+  lastBleConnected = bleConnected;
+  mappedInputManager.pollBle();  // drain BLE keys -> logical-button overlay for this frame
   halTiltSensor.update(SETTINGS.tiltPageTurn, SETTINGS.orientation, activityManager.isReaderActivity());
 
   renderer.setFadingFix(SETTINGS.fadingFix);
@@ -494,6 +598,23 @@ void loop() {
     LOG_INF("MEM", "Free: %d bytes, Total: %d bytes, Min Free: %d bytes, MaxAlloc: %d bytes", ESP.getFreeHeap(),
             ESP.getHeapSize(), ESP.getMinFreeHeap(), ESP.getMaxAllocHeap());
     lastMemPrint = millis();
+    // MEMFIX-PORT: per-task stack high-water audit; portable
+    // Task stack audit (~once/min): name, stack base (matches blocks in the
+    // heap map), and high-water free bytes — the margin available for
+    // right-sizing each stack. TRACE_FACILITY is on in this sdkconfig.
+    static uint8_t memPrintCount = 0;
+    if (++memPrintCount >= 6) {
+      memPrintCount = 0;
+      const UBaseType_t taskCount = uxTaskGetNumberOfTasks();
+      auto taskStatus = makeUniqueNoThrow<TaskStatus_t[]>(taskCount + 2);
+      if (taskStatus) {
+        const UBaseType_t got = uxTaskGetSystemState(taskStatus.get(), taskCount + 2, nullptr);
+        for (UBaseType_t i = 0; i < got; ++i) {
+          LOG_DBG("MEM", "task %-20s stackBase=%p highWaterFree=%u", taskStatus[i].pcTaskName,
+                  taskStatus[i].pxStackBase, (unsigned)taskStatus[i].usStackHighWaterMark);
+        }
+      }
+    }
   }
 
   // Handle incoming serial commands,
@@ -509,6 +630,11 @@ void loop() {
         uint8_t* buf = display.getFrameBuffer();
         logSerial.write(buf, bufferSize);
         logSerial.printf("SCREENSHOT_END\n");
+      // MEMFIX-PORT: on-demand heap map serial command; portable
+      } else if (cmd == "MEMMAP") {
+        // On-demand heap block map: capture the heap exactly when it looks
+        // interesting (e.g. maxAlloc degraded mid-session) without a reboot.
+        heapmap::dump();
       }
     }
   }
@@ -516,7 +642,7 @@ void loop() {
   // Check for any user activity (button press or release) or active background work
   static unsigned long lastActivityTime = millis();
   if (gpio.wasAnyPressed() || gpio.wasAnyReleased() || halTiltSensor.hadActivity() ||
-      activityManager.preventAutoSleep()) {
+      mappedInputManager.bleHadActivityThisFrame() || activityManager.preventAutoSleep()) {
     lastActivityTime = millis();         // Reset inactivity timer
     powerManager.setPowerSaving(false);  // Restore normal CPU frequency on user activity
   }
@@ -597,11 +723,16 @@ void loop() {
     powerManager.setPowerSaving(false);  // Make sure we're at full performance when skipLoopDelay is requested
     yield();                             // Give FreeRTOS a chance to run tasks, but return immediately
   } else {
-    if (millis() - lastActivityTime >= HalPowerManager::IDLE_POWER_SAVING_MS) {
+    // The BLE controller cannot run at the 10 MHz low-power frequency — NimBLE's
+    // controller reset/maintenance hangs the radio and trips the interrupt WDT (the
+    // same reason WiFi force-disables power saving in HalPowerManager). Keep full CPU
+    // speed whenever the BLE stack is actually resident, regardless of input idleness.
+    if (!BleHid.isRunning() && millis() - lastActivityTime >= HalPowerManager::IDLE_POWER_SAVING_MS) {
       // If we've been inactive for a while, increase the delay to save power
       powerManager.setPowerSaving(true);  // Lower CPU frequency after extended inactivity
       delay(50);
     } else {
+      if (BleHid.isRunning()) powerManager.setPowerSaving(false);  // keep the BLE radio stable
       // Short delay to prevent tight loop while still being responsive
       delay(10);
     }

src/network/CrossPointWebServer.cpp

@@ -26,6 +26,7 @@
 #include "html/SettingsPageHtml.generated.h"
 #include "html/js/jszip_minJs.generated.h"
 #include "util/BookCacheUtils.h"
+#include <Memory.h>
 
 namespace {
 // Folders/files to hide from the web interface file browser
@@ -200,6 +201,14 @@ void CrossPointWebServer::begin() {
   udpActive = udp.begin(LOCAL_UDP_PORT);
   LOG_DBG("WEB", "Discovery UDP %s on port %d", udpActive ? "enabled" : "failed", LOCAL_UDP_PORT);
 
+  // All request handlers run on the task that calls handleClient(). Register
+  // that task before any handler can call esp_task_wdt_reset().
+  const esp_err_t watchdogResult = esp_task_wdt_add(nullptr);
+  watchdogTaskRegistered = watchdogResult == ESP_OK;
+  if (!watchdogTaskRegistered) {
+    LOG_ERR("WEB", "Failed to register web server task with watchdog: %s", esp_err_to_name(watchdogResult));
+  }
+
   running = true;
 
   LOG_DBG("WEB", "Web server started on port %d", port);
@@ -229,6 +238,10 @@ void CrossPointWebServer::abortWsUpload(const char* tag) {
 void CrossPointWebServer::stop() {
   if (!running || !server) {
     LOG_DBG("WEB", "stop() called but already stopped (running=%d, server=%p)", running, server.get());
+    if (watchdogTaskRegistered) {
+      esp_task_wdt_delete(nullptr);
+      watchdogTaskRegistered = false;
+    }
     return;
   }
 
@@ -269,6 +282,11 @@ void CrossPointWebServer::stop() {
   LOG_DBG("WEB", "Web server stopped and deleted");
   LOG_DBG("WEB", "[MEM] Free heap after delete server: %d bytes", ESP.getFreeHeap());
 
+  if (watchdogTaskRegistered) {
+    esp_task_wdt_delete(nullptr);
+    watchdogTaskRegistered = false;
+  }
+
   // Note: Static upload variables (uploadFileName, uploadPath, uploadError) are declared
   // later in the file and will be cleared when they go out of scope or on next upload
   LOG_DBG("WEB", "[MEM] Free heap final: %d bytes", ESP.getFreeHeap());
@@ -484,13 +502,33 @@ void CrossPointWebServer::handleFileListData() const {
 
   server->setContentLength(CONTENT_LENGTH_UNKNOWN);
   server->send(200, "application/json", "");
-  server->sendContent("[");
+
+  // Batch entries into ~one-TCP-segment flushes. One sendContent per entry
+  // means one chunked frame in its own TCP segment per file; the client's
+  // delayed ACK (~40-200 ms each) turns a large directory into tens of
+  // seconds. ~1.4 KB batches collapse that to a handful of segments.
+  constexpr size_t BATCH_CAPACITY = 1400;
+  auto batch = makeUniqueNoThrow<char[]>(BATCH_CAPACITY);
+  size_t batchLen = 0;
+  const auto flushBatch = [&]() {
+    if (batchLen == 0) return;
+    server->sendContent(batch.get(), batchLen);
+    batchLen = 0;
+  };
+
   char output[512];
   constexpr size_t outputSize = sizeof(output);
   bool seenFirst = false;
   JsonDocument doc;
 
-  scanFiles(currentPath.c_str(), [this, &output, &doc, seenFirst](const FileInfo& info) mutable {
+  if (batch) {
+    batch[batchLen++] = '[';
+  } else {
+    LOG_ERR("WEB", "OOM: file list batch buffer; falling back to per-entry sends");
+    server->sendContent("[");
+  }
+
+  scanFiles(currentPath.c_str(), [&](const FileInfo& info) {
     doc.clear();
     doc["name"] = info.name;
     doc["size"] = info.size;
@@ -504,14 +542,26 @@ void CrossPointWebServer::handleFileListData() const {
       return;
     }
 
-    if (seenFirst) {
-      server->sendContent(",");
+    const size_t need = written + (seenFirst ? 1 : 0);
+    if (batch) {
+      if (batchLen + need > BATCH_CAPACITY) flushBatch();
+      if (seenFirst) batch[batchLen++] = ',';
+      memcpy(batch.get() + batchLen, output, written);
+      batchLen += written;
     } else {
-      seenFirst = true;
-    }
+      if (seenFirst) server->sendContent(",");
       server->sendContent(output);
+    }
+    seenFirst = true;
   });
+
+  if (batch) {
+    if (batchLen + 1 > BATCH_CAPACITY) flushBatch();
+    batch[batchLen++] = ']';
+    flushBatch();
+  } else {
     server->sendContent("]");
+  }
   // End of streamed response, empty chunk to signal client
   server->sendContent("");
   LOG_DBG("WEB", "Served file listing page for path: %s", currentPath.c_str());

src/network/CrossPointWebServer.h

@@ -72,6 +72,7 @@ class CrossPointWebServer {
   std::unique_ptr<WebServer> server = nullptr;
   std::unique_ptr<WebSocketsServer> wsServer = nullptr;
   bool running = false;
+  bool watchdogTaskRegistered = false;
   bool apMode = false;  // true when running in AP mode, false for STA mode
   uint16_t port = 80;
   uint16_t wsPort = 81;  // WebSocket port