@@ -60,19 +60,32 @@ hardware-touching part is isolated:
   a bedside clock — no movement at night); an optional 1 Hz blink is config-gated and derived
   from the wall clock, not a tick counter, so it can't drift.
 - [piclock/display.py](piclock/display.py) — the HT16K33 `smbus2` driver, plus a pure
-  `build_buffer()` (font/colon/sync-dot → 16-byte RAM; the NTP sync indicator is the
-  backpack's lower-left dot, sharing the colon's RAM byte) and a `NullDisplay` for off-Pi
+  `build_buffer()` (font/colon/indicator dots → 16-byte RAM; the NTP sync indicator is the
+  backpack's lower-left dot and the Wi-Fi indicator the upper-left dot, both sharing the
+  colon's RAM byte) and a `NullDisplay` for off-Pi
   runs. The
   driver skips redundant I2C writes when nothing changed. The hardware is wrapped in
   `ResilientDisplay`: if the display is absent or a connector is bumped, `show()` never
   raises — it logs once and retries the connection every ~10 s, so the service keeps running
   (no crash-loop) and the correct time appears the instant the display reconnects.
 - [piclock/timesync.py](piclock/timesync.py) — `is_ntp_synced()` via `timedatectl show -p
   NTPSynchronized`. Any error → treated as not-synced (pre-first-sync that means dashes —
-  never a bad time; post-sync it just darkens the sync dot). The loop polls it every 5 s
-  until the first sync, then every 60 s to track sync loss.
+  never a bad time). The loop polls it every 5 s until the first sync, then every 60 s.
+  Because NTPSynchronized is the kernel's maxerror estimate (it lags an NTP outage by
+  ~9 h), the *sync dot* additionally requires freshness: `last_sync_age()` stats
+  `/run/systemd/timesync/synchronized` (touched by timesyncd on every successful sync) and
+  the dot goes dark once the last success is older than `sync_fresh_seconds` (default
+  4500 s ≈ 2× timesyncd's max poll interval). No stamp file (dev machine, non-timesyncd
+  system) → freshness is assumed, falling back to NTPSynchronized alone. Sync loss never
+  brings the dashes back — that stays keyed on `is_ntp_synced()`/`ever_synced`.
+- [piclock/wifi.py](piclock/wifi.py) — `is_wifi_up()` reads
+  `/sys/class/net/<iface>/operstate` (an in-process ~140 µs file read, no subprocess, so
+  the loop polls it every tick). It feeds the **upper-left** indicator dot: lit while the
+  link is up, dark when the link drops or the interface disappears (e.g. firmware crash).
+  Any read error → down. `PICLOCK_WIFI_DOT` / `PICLOCK_WIFI_IFACE` configure it.
 - [piclock/config.py](piclock/config.py) — `Config` dataclass with `PICLOCK_*` env overrides
-  (brightness, schedule on/off + times + wake/night brightness, 24h, blink, sync dot, I2C
+  (brightness, schedule on/off + times + wake/night brightness, 24h, blink, sync dot +
+  freshness window, wifi dot + interface, I2C
   bus/address, tick, and `PICLOCK_DISPLAY=null` for dev). Validates its inputs at construction, including
   that the schedule edges are in daily order.
 - [piclock/schedule.py](piclock/schedule.py) — **pure** day/night schedule logic: wall-clock time →
 
@@ -24,10 +24,13 @@ The Pi has no battery-backed clock, so correctness comes from two things:
   Python's `zoneinfo` applies DST rules automatically. No offset math, ever.
 
 Before the clock has synced after a cold boot, the display shows `----` rather than a
-confidently wrong time. Once it has synced, the backpack's lower-left indicator dot stays
-lit as a sync indicator; if NTP is later lost the time keeps showing (the system clock
-free-runs and stays approximately right) and only the dot goes dark. (Sync-indicator idea
-borrowed from [tenox7/rpiclock](https://github.com/tenox7/rpiclock).)
+confidently wrong time. After that, the backpack's two left-edge indicator dots report
+health at a glance: the **upper-left dot** is Wi-Fi (lit while the link is up, checked
+every tick straight from sysfs) and the **lower-left dot** is NTP (lit while syncs keep
+arriving — dark within about an hour if they stop, e.g. the NTP server is unreachable).
+If sync is lost the time keeps showing (the system clock free-runs and stays
+approximately right); only the dots go dark. (Sync-indicator idea borrowed from
+[tenox7/rpiclock](https://github.com/tenox7/rpiclock).)
 
 ## Hardware
 
@@ -123,7 +126,10 @@ Set via environment variables (typically in the systemd unit):
 | `PICLOCK_WAKE_BRIGHTNESS` | `15` | Level the schedule's evening wake applies, `0`–`15` |
 | `PICLOCK_NIGHT_BRIGHTNESS` | `0` | Level the schedule's night dim applies, `0`–`15` (`0` is still lit) |
 | `PICLOCK_BLINK` | `0` | Blink the colon at 1 Hz (default: steady, no movement at night) |
-| `PICLOCK_SYNC_DOT` | `1` | Lower-left dot lit while NTP-synced, dark when free-running; `0` disables the dot |
+| `PICLOCK_SYNC_DOT` | `1` | Lower-left dot lit while NTP syncs keep arriving, dark when free-running; `0` disables the dot |
+| `PICLOCK_SYNC_FRESH` | `4500` | Seconds since the last successful sync before the sync dot goes dark (~2× timesyncd's max poll interval) |
+| `PICLOCK_WIFI_DOT` | `1` | Upper-left dot lit while the Wi-Fi link is up, dark when it drops; `0` disables the dot |
+| `PICLOCK_WIFI_IFACE` | `wlan0` | Interface the Wi-Fi dot watches |
 | `PICLOCK_I2C_BUS` | `1` | I2C bus number |
 | `PICLOCK_I2C_ADDRESS` | `0x70` | HT16K33 address |
 | `PICLOCK_TICK` | `0.2` | Loop period, seconds |
 
@@ -12,7 +12,7 @@
 import time
 from datetime import datetime
 
-from . import clock, ctl, schedule, timesync
+from . import clock, ctl, schedule, timesync, wifi
 from .config import Config
 from .control import DisplayControl
 from .display import make_display
@@ -57,6 +57,12 @@ def _handle_signal(signum, _frame):
     # keeps the (free-running, still approximately right) time on the display
     # and only the sync dot goes dark.
     ever_synced = False
+    # Whether syncs are still *arriving* (timesyncd's stamp file is recent).
+    # Distinct from `synced`, which is the kernel's is-the-clock-trustworthy
+    # estimate and lags an outage by ~9 hours: `synced` gates the dashes and
+    # the free-run warning, freshness only gates the sync dot. Starts True so
+    # the dot can't flicker before the first check.
+    sync_fresh = True
 
     # Display on/off + brightness state, shared by everything that controls the
     # display. The optional day/night schedule (evaluated below, in-process)
@@ -103,8 +109,12 @@ def _handle_signal(signum, _frame):
     try:
         while not stop.is_set():
             if time.monotonic() >= next_sync_check:
-                was_synced = synced
+                was_synced, was_fresh = synced, sync_fresh
                 synced = timesync.is_ntp_synced()
+                age = timesync.last_sync_age()
+                # No stamp file (no timesyncd, e.g. dev machine) -> fall back
+                # to NTPSynchronized alone rather than darkening the dot.
+                sync_fresh = age is None or age <= config.sync_fresh_seconds
                 next_sync_check = time.monotonic() + (
                     _SYNCED_POLL_SECONDS if synced else _SYNC_POLL_SECONDS
                 )
@@ -113,6 +123,12 @@ def _handle_signal(signum, _frame):
                     log.info("system clock synchronized")
                 elif was_synced and not synced:
                     log.warning("NTP sync lost; free-running until it returns")
+                if was_fresh and not sync_fresh:
+                    log.warning(
+                        "no successful NTP sync for %.0fs; sync dot dark", age
+                    )
+                elif sync_fresh and not was_fresh:
+                    log.info("NTP syncs arriving again")
 
             now = datetime.now()
 
@@ -171,15 +187,21 @@ def _handle_signal(signum, _frame):
                     blink=config.blink_colon,
                 )
                 text, colon = state.text, state.colon
-                sync_dot = state.sync_dot and config.sync_dot
+                sync_dot = state.sync_dot and config.sync_dot and sync_fresh
+                # Wi-Fi status is not a function of the time, so it joins here
+                # rather than passing through render(). Polled per tick: it is
+                # one sysfs read (~140 us), and per-second freshness is the
+                # point of the indicator.
+                wifi_dot = config.wifi_dot and wifi.is_wifi_up(config.wifi_iface)
             else:
-                text, colon, sync_dot = _BLANK_TEXT, False, False  # display off
+                # display off
+                text, colon, sync_dot, wifi_dot = _BLANK_TEXT, False, False, False
 
             # The display backend is fault-tolerant (see make_display): show()
             # never raises on I/O errors, it logs and reconnects on its own. So a
             # missing or bumped display can't crash the loop.
             display.set_brightness(control.brightness)  # deduped; cheap per-tick
-            display.show(text, colon, sync_dot)
+            display.show(text, colon, sync_dot, wifi_dot)
 
             stop.wait(config.tick_seconds)
     finally:
 
@@ -80,9 +80,23 @@ class Config:
     hour24: bool = True
     blink_colon: bool = False  # steady colon by default — no movement for a dark bedroom
     # The backpack's lower-left indicator dot shows NTP sync status: lit while
-    # the system clock is synced, dark while it free-runs. It dims with the
-    # rest of the display; switch it off if even that is too much at night.
+    # the system clock is synced *and* syncs are still arriving, dark while it
+    # free-runs. It dims with the rest of the display; switch it off if even
+    # that is too much at night.
     sync_dot: bool = True
+    # How recently (seconds) timesyncd must have completed a successful sync
+    # for the sync dot to stay lit. Default is ~2x timesyncd's max poll
+    # interval (34 min) plus margin, so one dropped poll can't flicker the
+    # dot. Checked via a stat() of timesyncd's stamp file — see
+    # piclock/timesync.py; on systems without the stamp the dot falls back to
+    # NTPSynchronized alone.
+    sync_fresh_seconds: float = 4500.0
+    # The backpack's upper-left indicator dot shows Wi-Fi link status: lit
+    # while the interface is up and associated, dark when the link drops (or
+    # the interface disappears entirely). Read from sysfs every tick — an
+    # in-process file read, no subprocess.
+    wifi_dot: bool = True
+    wifi_iface: str = "wlan0"
     tick_seconds: float = 0.2  # loop granularity; colon blink derives from wall clock
     backend: str = "ht16k33"  # "ht16k33" for hardware, "null" for off-Pi dev/testing
 
@@ -119,6 +133,15 @@ def __post_init__(self) -> None:
             level = getattr(self, name)
             if not 0 <= level <= 15:
                 raise ValueError(f"{name} must be 0-15, got {level!r}")
+        # A non-positive freshness window would permanently darken the sync
+        # dot, and an empty interface name would permanently darken the wifi
+        # dot — both look like outages, so reject them instead.
+        if self.sync_fresh_seconds <= 0:
+            raise ValueError(
+                f"sync_fresh_seconds must be > 0, got {self.sync_fresh_seconds!r}"
+            )
+        if self.wifi_dot and not self.wifi_iface:
+            raise ValueError("wifi_iface must be non-empty when wifi_dot is on")
         # The schedule logic (piclock/schedule.py) assumes the edges are in daily
         # order; a misordered schedule would silently pick wrong phases.
         if not (self.off_at < self.on_at < self.dim_at):
@@ -142,6 +165,11 @@ def from_env(cls) -> "Config":
             hour24=_env_bool("PICLOCK_24H", cls.hour24),
             blink_colon=_env_bool("PICLOCK_BLINK", cls.blink_colon),
             sync_dot=_env_bool("PICLOCK_SYNC_DOT", cls.sync_dot),
+            sync_fresh_seconds=_env_float(
+                "PICLOCK_SYNC_FRESH", cls.sync_fresh_seconds
+            ),
+            wifi_dot=_env_bool("PICLOCK_WIFI_DOT", cls.wifi_dot),
+            wifi_iface=os.environ.get("PICLOCK_WIFI_IFACE", cls.wifi_iface).strip(),
             tick_seconds=_env_float("PICLOCK_TICK", cls.tick_seconds),
             backend=os.environ.get("PICLOCK_DISPLAY", cls.backend).strip().lower(),
             ctl_socket=os.environ.get("PICLOCK_CTL_SOCKET", cls.ctl_socket),
 
@@ -14,8 +14,10 @@
     0x06  digit 2
     0x08  digit 3 (rightmost)
 
-The lower-left indicator dot doubles as the NTP-sync indicator: lit while the
-system clock is synced, dark while it free-runs.
+Two of the indicator dots double as status lights: the lower-left dot is the
+NTP-sync indicator (lit while syncs are arriving, dark while the clock
+free-runs) and the upper-left dot is the Wi-Fi indicator (lit while the link
+is up, dark when it drops).
 """
 
 from __future__ import annotations
@@ -46,15 +48,18 @@
 _COLON_ADDR = 4
 _COLON_BIT = 0x02
 _SYNC_DOT_BIT = 0x08  # lower-left indicator dot, shares the colon's RAM byte
+_WIFI_DOT_BIT = 0x04  # upper-left indicator dot, same byte
 
 # HT16K33 command bytes.
 _CMD_OSCILLATOR_ON = 0x21  # system setup: oscillator on
 _CMD_DISPLAY_ON = 0x81  # display setup: on, no blink
 _CMD_DIMMING = 0xE0  # | level (0-15)
 
 
-def build_buffer(text: str, colon: bool, sync_dot: bool = False) -> list[int]:
-    """Encode four characters + colon + sync dot into the 16-byte HT16K33 RAM buffer.
+def build_buffer(
+    text: str, colon: bool, sync_dot: bool = False, wifi_dot: bool = False
+) -> list[int]:
+    """Encode four characters + colon + indicator dots into the 16-byte HT16K33 RAM buffer.
 
     Pure and hardware-free so it can be unit-tested. Raises ValueError on a
     wrong-length string or an unsupported character.
@@ -67,14 +72,20 @@ def build_buffer(text: str, colon: bool, sync_dot: bool = False) -> list[int]:
             buf[_DIGIT_ADDR[i]] = _FONT[char]
         except KeyError:
             raise ValueError(f"unsupported character {char!r} in {text!r}") from None
-    buf[_COLON_ADDR] = (_COLON_BIT if colon else 0) | (_SYNC_DOT_BIT if sync_dot else 0)
+    buf[_COLON_ADDR] = (
+        (_COLON_BIT if colon else 0)
+        | (_SYNC_DOT_BIT if sync_dot else 0)
+        | (_WIFI_DOT_BIT if wifi_dot else 0)
+    )
     return buf
 
 
 class Display(Protocol):
     """Minimal display interface the app loop depends on."""
 
-    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None: ...
+    def show(
+        self, text: str, colon: bool, sync_dot: bool = False, wifi_dot: bool = False
+    ) -> None: ...
     def set_brightness(self, level: int) -> None: ...
     def clear(self) -> None: ...
     def close(self) -> None: ...
@@ -83,7 +94,9 @@ def close(self) -> None: ...
 class NullDisplay:
     """No-op display for development and tests off the Pi."""
 
-    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None:
+    def show(
+        self, text: str, colon: bool, sync_dot: bool = False, wifi_dot: bool = False
+    ) -> None:
         pass
 
     def set_brightness(self, level: int) -> None:
@@ -104,7 +117,7 @@ def __init__(self, bus_num: int = 1, address: int = 0x70, brightness: int = 3) -
 
         self._address = address
         self._bus = SMBus(bus_num)
-        self._last: tuple[str, bool, bool] | None = None
+        self._last: tuple[str, bool, bool, bool] | None = None
         self._last_brightness: int | None = None
 
         try:
@@ -122,12 +135,14 @@ def set_brightness(self, level: int) -> None:
         self._bus.write_byte(self._address, _CMD_DIMMING | level)
         self._last_brightness = level
 
-    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None:
-        key = (text, colon, sync_dot)
+    def show(
+        self, text: str, colon: bool, sync_dot: bool = False, wifi_dot: bool = False
+    ) -> None:
+        key = (text, colon, sync_dot, wifi_dot)
         if key == self._last:
             return  # avoid redundant I2C traffic (e.g. unchanged minute)
         self._bus.write_i2c_block_data(
-            self._address, 0x00, build_buffer(text, colon, sync_dot)
+            self._address, 0x00, build_buffer(text, colon, sync_dot, wifi_dot)
         )
         self._last = key
 
@@ -201,12 +216,14 @@ def _drop(self, exc: OSError) -> None:
             except Exception:  # best effort after an I/O failure
                 pass
 
-    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None:
+    def show(
+        self, text: str, colon: bool, sync_dot: bool = False, wifi_dot: bool = False
+    ) -> None:
         dev = self._connect()
         if dev is None:
             return
         try:
-            dev.show(text, colon, sync_dot)
+            dev.show(text, colon, sync_dot, wifi_dot)
         except OSError as exc:
             self._drop(exc)
 
 
@@ -7,6 +7,13 @@
 from __future__ import annotations
 
 import subprocess
+import time
+from pathlib import Path
+from typing import Callable
+
+#: Touched by systemd-timesyncd on every successful NTP exchange. Lives on
+#: tmpfs, so it also does not exist before the first sync of the current boot.
+SYNC_STAMP = Path("/run/systemd/timesync/synchronized")
 
 
 def is_ntp_synced() -> bool:
@@ -25,3 +32,23 @@ def is_ntp_synced() -> bool:
     except (OSError, subprocess.SubprocessError):
         return False
     return result.stdout.strip() == "yes"
+
+
+def last_sync_age(
+    stamp: Path = SYNC_STAMP, *, now: Callable[[], float] = time.time
+) -> float | None:
+    """Seconds since timesyncd's last *successful* NTP sync, or None if unknown.
+
+    NTPSynchronized answers "is the clock still trustworthy" with hours of
+    hysteresis (the kernel's maxerror estimate takes ~9 h to expire), which is
+    right for the dashes but useless for noticing that syncs have stopped. The
+    stamp file's mtime tracks NTP reachability directly: it stops advancing the
+    moment sync responses stop arriving. A single stat(), so it is cheap enough
+    to check on every sync poll. None (no timesyncd, e.g. a dev machine) tells
+    the caller to fall back to is_ntp_synced() alone.
+    """
+    try:
+        mtime = stamp.stat().st_mtime
+    except OSError:
+        return None
+    return max(0.0, now() - mtime)
@@ -0,0 +1,24 @@
+"""Wi-Fi link status for the wifi indicator dot.
+
+Reads the kernel's operstate file for the interface — a single in-process file
+read (~140 us on a Pi Zero 2 W), cheap enough to poll every tick with no
+subprocess. "up" means the link is administratively up and associated; a
+missing interface (e.g. a firmware crash took wlan0 away entirely) reads as
+down, which is exactly what the indicator should show.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+#: Where the kernel exposes per-interface link state.
+SYS_CLASS_NET = Path("/sys/class/net")
+
+
+def is_wifi_up(iface: str, *, sys_class_net: Path = SYS_CLASS_NET) -> bool:
+    """Return True while ``iface`` exists and its link is up."""
+    try:
+        state = (sys_class_net / iface / "operstate").read_text()
+    except OSError:
+        return False
+    return state.strip() == "up"