diff --git a/avr/devices/c03/README b/avr/devices/c03/README
index e6b5828..5caaa38 100644
--- a/avr/devices/c03/README
+++ b/avr/devices/c03/README
@@ -14,5 +14,5 @@ C03
 SetLimits:
 aqhome-tool setdata -N nodes/xxxxxxxx/CO2_LIMIT_CRIT -v "LOWER:UPPER"
 aqhome-tool setdata -N nodes/xxxxxxxx/CO2_LIMIT_WARN -v "LOWER:UPPER"
-
+aqhome-tool setdata -N nodes/80861341/CO2_SOURCE -v "0:0:10:10"
 
diff --git a/avr/devices/c03/test/main.asm b/avr/devices/c03/test/main.asm
index f2d9914..4db095c 100644
--- a/avr/devices/c03/test/main.asm
+++ b/avr/devices/c03/test/main.asm
@@ -199,9 +199,9 @@ onSystemStart:
 ; Called on every message received
 
 onMessageReceived:
-;  lds yl, guiApp
-;  lds yh, guiApp+1
-;  bigcall GuiApp_MsgReceived
+  lds yl, guiApp
+  lds yh, guiApp+1
+  bigcall GuiApp_MsgReceived
   clc
   ret
 ; @end
diff --git a/avr/devices/c03/test/w_climate.asm b/avr/devices/c03/test/w_climate.asm
index 23e91d7..2193681 100644
--- a/avr/devices/c03/test/w_climate.asm
+++ b/avr/devices/c03/test/w_climate.asm
@@ -92,8 +92,12 @@ climateWinCreateSensorWatches:
   ; CO2 sensor watch
   push xl    ; HLayout
     push xh
-      ldi r16, (1<<OBJECT_OPTS_TIMER_BIT) | (1<<WIDGET_OPTS_INPUT_BIT) | (1<<WIDGET_OPTS_BORDER_BIT)     ; OPTS
-      ldi r17, (WIDGET_PACK_BEGIN<<WIDGET_PACK_HSELF0_BIT) | (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) ; PACK
+      ldi r16, (1<<OBJECT_OPTS_TIMER_BIT) | \
+               (1<<WIDGET_OPTS_INPUT_BIT) | \
+               (1<<WIDGET_OPTS_BORDER_BIT) | \
+               (1<<OBJECT_OPTS_MSGRECV_BIT)                    ; OPTS
+      ldi r17, (WIDGET_PACK_BEGIN<<WIDGET_PACK_HSELF0_BIT) | \
+               (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT)     ; PACK
       ldi r20, VALUE_ID_SENSOR_CO2_BASE
       ldi r21, C03_EEID_SENSOR_CO2
       ldi r22, SENSORWATCH_TYPE_CO2
@@ -105,8 +109,12 @@ climateWinCreateSensorWatches:
   ; temp sensor watch
   push xl    ; HLayout
     push xh
-      ldi r16, (1<<OBJECT_OPTS_TIMER_BIT) | (1<<WIDGET_OPTS_INPUT_BIT) | (1<<WIDGET_OPTS_BORDER_BIT)     ; OPTS
-      ldi r17, (WIDGET_PACK_BEGIN<<WIDGET_PACK_HSELF0_BIT) | (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) ; PACK
+      ldi r16, (1<<OBJECT_OPTS_TIMER_BIT) | \
+               (1<<WIDGET_OPTS_INPUT_BIT) | \
+               (1<<WIDGET_OPTS_BORDER_BIT) | \
+               (1<<OBJECT_OPTS_MSGRECV_BIT); OPTS
+      ldi r17, (WIDGET_PACK_BEGIN<<WIDGET_PACK_HSELF0_BIT) | \
+               (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) ; PACK
       ldi r20, VALUE_ID_SENSOR_TEMP_BASE
       ldi r21, C03_EEID_SENSOR_TEMP
       ldi r22, SENSORWATCH_TYPE_TEMP
@@ -118,8 +126,12 @@ climateWinCreateSensorWatches:
   ; humidity sensor watch
   push xl    ; HLayout
     push xh
-      ldi r16, (1<<OBJECT_OPTS_TIMER_BIT) | (1<<WIDGET_OPTS_INPUT_BIT) | (1<<WIDGET_OPTS_BORDER_BIT)     ; OPTS
-      ldi r17, (WIDGET_PACK_BEGIN<<WIDGET_PACK_HSELF0_BIT) | (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) ; PACK
+      ldi r16, (1<<OBJECT_OPTS_TIMER_BIT) | \
+               (1<<WIDGET_OPTS_INPUT_BIT) | \
+               (1<<WIDGET_OPTS_BORDER_BIT) | \
+               (1<<OBJECT_OPTS_MSGRECV_BIT); OPTS
+      ldi r17, (WIDGET_PACK_BEGIN<<WIDGET_PACK_HSELF0_BIT) | \
+               (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) ; PACK
       ldi r20, VALUE_ID_SENSOR_HUM_BASE
       ldi r21, C03_EEID_SENSOR_HUM
       ldi r22, SENSORWATCH_TYPE_HUM
diff --git a/avr/modules/lcd2/gui2/aqhome/sensorwatch.asm b/avr/modules/lcd2/gui2/aqhome/sensorwatch.asm
index 97a5626..8b72b64 100644
--- a/avr/modules/lcd2/gui2/aqhome/sensorwatch.asm
+++ b/avr/modules/lcd2/gui2/aqhome/sensorwatch.asm
@@ -32,22 +32,39 @@
 .equ SENSORWATCH_OFFS_TYPE                = SENSORWATCH_OFFS_BEGIN+14
 .equ SENSORWATCH_SIZE                     = SENSORWATCH_OFFS_BEGIN+15
 
-
+; values (not used for now)
 .equ SENSORWATCH_VALUE          = WIDGET_VALUE_NEXTFREE+0
 .equ SENSORWATCH_VALUE_NEXTFREE = SENSORWATCH_VALUE+1
 
-
+; sensor types
 .equ SENSORWATCH_TYPE_CO2       = 1
 .equ SENSORWATCH_TYPE_TEMP      = 2
 .equ SENSORWATCH_TYPE_HUM       = 3
 .equ SENSORWATCH_TYPE_NEXTFREE  = 4
 
+; indices of child widgets
+.equ SENSORWATCH_CHILDIDX_TITLE      = 0
+.equ SENSORWATCH_CHILDIDX_IMAGEVIEW  = 1
+.equ SENSORWATCH_CHILDIDX_VALUELABEL = 2
 
 ; descriptors
 .equ SENSORWATCH_DESCR_OFFS_TITLERES        = 0
 .equ SENSORWATCH_DESCR_OFFS_IMGRES          = 2
 .equ SENSORWATCH_DESCR_OFFS_POSTKOMMADIGITS = 4
 
+; EEPROM data for SensorWatch
+.equ SENSORWATCH_EE_OFFS_NODEADDR            = 0
+.equ SENSORWATCH_EE_OFFS_VALUEID             = 1
+.equ SENSORWATCH_EE_OFFS_UPPER_LIMIT_WARN_LO = 2
+.equ SENSORWATCH_EE_OFFS_UPPER_LIMIT_WARN_HI = 3
+.equ SENSORWATCH_EE_OFFS_LOWER_LIMIT_WARN_LO = 4
+.equ SENSORWATCH_EE_OFFS_LOWER_LIMIT_WARN_HI = 5
+.equ SENSORWATCH_EE_OFFS_UPPER_LIMIT_CRIT_LO = 6
+.equ SENSORWATCH_EE_OFFS_UPPER_LIMIT_CRIT_HI = 7
+.equ SENSORWATCH_EE_OFFS_LOWER_LIMIT_CRIT_LO = 8
+.equ SENSORWATCH_EE_OFFS_LOWER_LIMIT_CRIT_HI = 9
+.equ SENSORWATCH_EE_SIZE                     = 10
+
 
 
 ; ***************************************************************************
@@ -128,6 +145,8 @@ SensorWatch_Init:
   rcall sensorWatchCreateImageViewer
   rcall sensorWatchCreateValueLabel
 
+  rcall sensorWatchReadFromEeprom  ; (R16, R18, X)
+
   ret
 ; @end
 
@@ -275,7 +294,7 @@ sensorWatchCreateValueLabel:
       mov xl, yl
       mov xh, yh
       ldi r16, 0
-      ldi r17, (WIDGET_PACK_CENTER<<WIDGET_PACK_HSELF0_BIT)     | (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) | \
+      ldi r17, (WIDGET_PACK_FILLED<<WIDGET_PACK_HSELF0_BIT)     | (WIDGET_PACK_BEGIN<<WIDGET_PACK_VSELF0_BIT) | \
                (WIDGET_PACK_CENTER <<WIDGET_PACK_HCONTENT0_BIT) | (WIDGET_PACK_CENTER<<WIDGET_PACK_VCONTENT0_BIT)
       bigcall ValueLabel_new
     pop yh
@@ -285,6 +304,330 @@ sensorWatchCreateValueLabel:
 
 
 
+; ---------------------------------------------------------------------------
+; @routine SensorWatch_GetImageView @global
+;
+; @param Y pointer to widget
+; @return CFLAG set if widget found, cleared otherwise
+; @return R19:R18 byte address pointer to image view (for LPM!)
+; @clobbers R16
+
+SensorWatch_GetImageView:
+  ldi r16, SENSORWATCH_CHILDIDX_IMAGEVIEW
+  bigcall OBJ_GetChildAt
+  ret
+; @end
+
+
+
+; ---------------------------------------------------------------------------
+; @routine SensorWatch_GetValueLabel @global
+;
+; @param Y pointer to widget
+; @return CFLAG set if widget found, cleared otherwise
+; @return R19:R18 byte address pointer to image view (for LPM!)
+; @clobbers R16
+
+SensorWatch_GetValueLabel:
+  ldi r16, SENSORWATCH_CHILDIDX_VALUELABEL
+  bigcall OBJ_GetChildAt
+  ret
+; @end
+
+
+
+; ---------------------------------------------------------------------------
+; @routine SensorWatch_OnRecvReport @global
+;
+; @param Y  pointer to widget
+; @param X  pointer to message
+
+SensorWatch_OnRecvReport:
+  bigcall NETMSG_ValueRead                        ; R17=valueId, R22=nodeAddr R19:R18=value (none)
+  ; check node addr
+  ldd r16, Y+SENSORWATCH_OFFS_NODEADDR
+  cp r16, r22
+  brne SensorWatch_OnRecvReport_ret
+  ; check value id
+  ldd r16, Y+SENSORWATCH_OFFS_VALUEID
+  cp r16, r17
+  brne SensorWatch_OnRecvReport_ret
+  ; store value
+  std Y+SENSORWATCH_OFFS_VALUE_LO, r18
+  std Y+SENSORWATCH_OFFS_VALUE_HI, r19
+
+  ; setup background color
+  push xl
+    push xh
+      rcall sensorWatchSetColor                       ; (any, !Y)
+      rcall sensorWatchSetValueLabel                  ; (any, !Y)
+    pop xh
+  pop xl
+SensorWatch_OnRecvReport_ret:
+  clc
+  ret
+; @end
+
+
+
+; ---------------------------------------------------------------------------
+; @routine SensorWatch_OnRecvSet @global
+;
+; @param Y  pointer to widget
+; @param X  pointer to message
+
+SensorWatch_OnRecvSet:
+  bigcall NETMSG_ValueRead                        ; R17=valueId, R22=nodeAddr R19:R18=value (none)
+  ldd r16, Y+SENSORWATCH_OFFS_BASEVALUEID
+  sub r17, r16
+  brcs SensorWatch_OnRecvSet_clcRet
+  cpi r17, 0
+  breq SensorWatch_OnRecvSet_setSource
+  cpi r17, 1
+  breq SensorWatch_OnRecvSet_setLimWarn
+  cpi r17, 2
+  breq SensorWatch_OnRecvSet_setLimCrit
+  rjmp SensorWatch_OnRecvSet_clcRet
+SensorWatch_OnRecvSet_setSource:
+  std Y+SENSORWATCH_OFFS_NODEADDR, r18
+  std Y+SENSORWATCH_OFFS_VALUEID, r19
+  rjmp SensorWatch_OnRecvSet_sendACK
+SensorWatch_OnRecvSet_setLimWarn:
+  std Y+SENSORWATCH_OFFS_LOWER_LIMIT_WARN_LO, r18
+  std Y+SENSORWATCH_OFFS_LOWER_LIMIT_WARN_HI, r19
+  std Y+SENSORWATCH_OFFS_UPPER_LIMIT_WARN_LO, r20
+  std Y+SENSORWATCH_OFFS_UPPER_LIMIT_WARN_HI, r21
+  rjmp SensorWatch_OnRecvSet_sendACK
+SensorWatch_OnRecvSet_setLimCrit:
+  std Y+SENSORWATCH_OFFS_LOWER_LIMIT_CRIT_LO, r18
+  std Y+SENSORWATCH_OFFS_LOWER_LIMIT_CRIT_HI, r19
+  std Y+SENSORWATCH_OFFS_UPPER_LIMIT_CRIT_LO, r20
+  std Y+SENSORWATCH_OFFS_UPPER_LIMIT_CRIT_HI, r21
+SensorWatch_OnRecvSet_sendACK:
+  add r17, r16                                                  ; restore valueId
+  push xl
+    push xh
+      push yl
+        push yh
+          ldi r23, NETMSG_CMD_VALUE_SET_ACK
+          bigcall Main_SendValueResponse                        ; (clobbers all except Z)
+        pop yh
+      pop yl
+      rcall sensorWatchSetColor                                 ; (any, !Y)
+      rcall sensorWatchWriteToEeprom                            ; (R16, R17, R18, R20, R21, X)
+    pop xh
+  pop xl
+  sec
+  rjmp SensorWatch_OnRecvSet_ret
+SensorWatch_OnRecvSet_clcRet:
+  clc
+SensorWatch_OnRecvSet_ret:
+  ret
+; @end
+
+
+
+; ---------------------------------------------------------------------------
+; @routine sensorWatchSetValueLabel
+;
+; @param Z byte address of widget object (for LPM!)
+; @param Y pointer to SDRAM data
+; @clobbers any, !Y, !Z
+
+sensorWatchSetValueLabel:
+  rcall SensorWatch_GetValueLabel         ; (none)
+  brcc sensorWatchSetValueLabel_ret
+  push yl
+    push yh
+      ldd xl, Y+SENSORWATCH_OFFS_VALUE_LO
+      ldd xh, Y+SENSORWATCH_OFFS_VALUE_HI
+      mov yl, r18
+      mov yh, r19
+      ldi r17, VLABEL_VALUE
+      bigcall Widget_SetValue                     ; (any, !Y)
+    pop yh
+  pop yl
+sensorWatchSetValueLabel_ret:
+  ret
+; @end
+
+
+
+; ---------------------------------------------------------------------------
+; @routine sensorWatchSetColor
+;
+; @param Y pointer to widget
+; @clobbers any, !Y
+
+sensorWatchSetColor:
+  ; default color is green
+  ldi xl, LOW(DISPLAY_COLOR_DARKGREEN)
+  ldi xh, HIGH(DISPLAY_COLOR_DARKGREEN)
+  ldd r20, Y+SENSORWATCH_OFFS_VALUE_LO
+  ldd r21, Y+SENSORWATCH_OFFS_VALUE_HI
+  mov r16, r20
+  or r16, r21
+  breq sensorWatchSetColor_ret                   ; do nothing
+    
+ ; check against critical limits
+  mov zl, yl
+  mov zh, yh
+  adiw zh:zl, SENSORWATCH_OFFS_UPPER_LIMIT_CRIT_LO
+  rcall sensorWatchCheckAgainstLimit                   ; (r16, r17, r22, r23)
+  brcs sensorWatchSetColor_setRed
+
+  ; check against warning limits
+  mov zl, yl
+  mov zh, yh
+  adiw zh:zl, SENSORWATCH_OFFS_UPPER_LIMIT_WARN_LO
+  rcall sensorWatchCheckAgainstLimit                   ; (r16, r17, r22, r23)
+  brcs sensorWatchSetColor_setYellow
+    
+  ; set green background
+  rjmp sensorWatchSetColor_setColor
+
+sensorWatchSetColor_setRed:
+  ldi xl, LOW(DISPLAY_COLOR_RED)
+  ldi xh, HIGH(DISPLAY_COLOR_RED)
+  rjmp sensorWatchSetColor_setColor
+  
+sensorWatchSetColor_setYellow:
+  ldi xl, LOW(DISPLAY_COLOR_YELLOW)
+  ldi xh, HIGH(DISPLAY_COLOR_YELLOW)
+  
+sensorWatchSetColor_setColor:
+  rcall SensorWatch_GetImageView                  ; (r16)
+  brcc sensorWatchSetColor_ret
+  push yl
+    push yh
+      mov yl, r18
+      mov yh, r19
+      ldi r17, IMAGEVIEW_VALUE_BGCOL
+      bigcall Widget_SetValue                     ; (any, !Y)
+    pop yh
+  pop yl
+sensorWatchSetColor_ret:
+  ret
+; @end
+
+
+
+
+
+; ---------------------------------------------------------------------------
+; @routine sensorWatchCheckAgainstLimit
+;
+; @param R21:R20 value to check against limit
+; @param Z points to upper limit (lo/hi), followed by lower limit (lo/hi)
+; @return CFLAG set if limit triggered, cleared if between upper and lower limit
+; @clobbers r16, r17, r22, r23
+
+sensorWatchCheckAgainstLimit:
+  ; check against upper limit (if any)
+  ld r22, Z+
+  ld r23, Z+
+  mov r16, r22
+  or r16, r23                              ; zero?
+  breq sensorWatchCheckAgainstLimit_checkLower
+  ; r23:r22=upper limit
+  cp r20, r22                                ; upper limit > value?
+  cpc r21, r23
+  brcc sensorWatchCheckAgainstLimit_secRet   ; no, upper limit breached
+
+sensorWatchCheckAgainstLimit_checkLower:
+  ; check against lower limit (if any)
+  ld r22, Z+
+  ld r23, Z+
+  mov r16, r22
+  or r16, r23                              ; zero?
+  clc
+  breq sensorWatchCheckAgainstLimit_ret    ; yes, jmp
+
+  cp r20, r22                              ; value below lower limit?
+  cpc r21, r23
+  brcs sensorWatchCheckAgainstLimit_secRet ; yes -> lower limit breached
+  
+  clc                                      ; limit not breached
+  rjmp sensorWatchCheckAgainstLimit_ret
+sensorWatchCheckAgainstLimit_secRet:
+  sec
+sensorWatchCheckAgainstLimit_ret:
+  ret
+; @end
+
+
+
+
+; ---------------------------------------------------------------------------
+; @routine sensorWatchWriteToEeprom
+;
+; @param Y pointer to widget
+; @return CFLAG set if data found and read, cleared on error
+; @clobbers R16, R17, R18, R20, R21, X
+
+sensorWatchWriteToEeprom:
+  ldd r16, Y+SENSORWATCH_OFFS_EEPROMID
+  tst r16
+  clc
+  breq sensorWatchWriteToEeprom_ret
+  push r16
+    bigcall EepromTlv_FindFirst                    ; (R18)
+  pop r16
+  brcs sensorWatchWriteToEeprom_write
+  ldi r17, SENSORWATCH_EE_SIZE
+  bigcall EepromTlv_AddTlv                       ; X=pointer to EEPROM data (R16, R18, R20, R21)
+  brcc sensorWatchWriteToEeprom_ret
+sensorWatchWriteToEeprom_write:
+  push yl
+    push yh
+      adiw yh:yl, SENSORWATCH_OFFS_NODEADDR
+      ldi r18, SENSORWATCH_EE_SIZE
+sensorWatchWriteToEeprom_loop:
+        ld r16, Y+
+        bigcall Eeprom_WriteByteIfChanged            ; (R17)
+        brcc sensorWatchWriteToEeprom_loopEnd
+        adiw xh:xl, 1
+        dec r18
+      brne sensorWatchWriteToEeprom_loop
+      sec
+sensorWatchWriteToEeprom_loopEnd:
+    pop yh
+  pop yl
+sensorWatchWriteToEeprom_ret:
+  ret
+; @end
+
+
+
+; ---------------------------------------------------------------------------
+; @routine sensorWatchReadFromEeprom
+;
+; @param Y pointer to widget
+; @return CFLAG set if data found and read, cleared on error
+; @clobbers R16, R18, X
+
+sensorWatchReadFromEeprom:
+  ldd r16, Y+SENSORWATCH_OFFS_EEPROMID
+  bigcall EepromTlv_FindFirst                    ; (R18)
+  brcc sensorWatchReadFromEeprom_ret
+  push yl
+    push yh
+      adiw yh:yl, SENSORWATCH_OFFS_NODEADDR
+      ldi r18, SENSORWATCH_EE_SIZE
+sensorWatchReadFromEeprom_loop:
+        bigcall Eeprom_ReadByte                      ; R16=byte (none)
+        brcc sensorWatchReadFromEeprom_loopEnd
+        st Y+, r16
+        adiw xh:xl, 1
+        dec r18
+      brne sensorWatchReadFromEeprom_loop
+      sec
+sensorWatchReadFromEeprom_loopEnd:
+    pop yh
+  pop yl  
+sensorWatchReadFromEeprom_ret:
+  ret
+; @end
 
 
 
@@ -301,6 +644,8 @@ SensorWatch_DefaultSignalmap:
   .dw VLayout_DefaultSignalmap*2  ; next table to use
   ; entries
   .db 0,                           WIDGET_SIGNAL_DRAW,     LOW(Widget_OnDraw),              HIGH(Widget_OnDraw)
+  .db NETMSG_CMD_VALUE_REPORT,     OBJECT_SIGNAL_RECVMSG,  LOW(SensorWatch_OnRecvReport),   HIGH(SensorWatch_OnRecvReport)
+  .db NETMSG_CMD_VALUE_SET,        OBJECT_SIGNAL_RECVMSG,  LOW(SensorWatch_OnRecvSet),      HIGH(SensorWatch_OnRecvSet)
   .db 0, 0, 0, 0  ; end of table
 
 
diff --git a/avr/modules/lcd2/gui2/base/guiapp.asm b/avr/modules/lcd2/gui2/base/guiapp.asm
index 98a2190..63d73b3 100644
--- a/avr/modules/lcd2/gui2/base/guiapp.asm
+++ b/avr/modules/lcd2/gui2/base/guiapp.asm
@@ -683,7 +683,9 @@ guiAppSendTouchEvents_done:
 
 guiAppSendRootMsgEvents:
   ldi r16, OBJECT_SIGNAL_RECVMSG
-  clr r17
+  adiw xh:xl, NETMSG_OFFS_CMD
+  ld r17, X
+  sbiw xh:xl, NETMSG_OFFS_CMD
   ldi r20, (1<<OBJECT_OPTS_MSGRECV_BIT)
   ldi r21, (1<<OBJECT_OPTS_MSGRECV_BIT)
   rcall guiAppSendRootEventsIfOpts
@@ -762,9 +764,10 @@ GuiApp_DefaultSignalmap:
   ; header
   .dw Object_DefaultSignalmap*2  ; next table to use
   ; entries
-  .db 0, OBJECT_SIGNAL_TIMER,   LOW(GuiApp_OnTimer),   HIGH(GuiApp_OnTimer)
-  .db 0, WIDGET_SIGNAL_TOUCH,   LOW(GuiApp_OnTouch),   HIGH(GuiApp_OnTouch)
-  .db 0, OBJECT_SIGNAL_DESTROY, LOW(GuiApp_OnDestroy), HIGH(GuiApp_OnDestroy)
+  .db 0, OBJECT_SIGNAL_TIMER,   LOW(GuiApp_OnTimer),       HIGH(GuiApp_OnTimer)
+  .db 0, OBJECT_SIGNAL_RECVMSG, LOW(GuiApp_OnMsgReceived), HIGH(GuiApp_OnMsgReceived)
+  .db 0, WIDGET_SIGNAL_TOUCH,   LOW(GuiApp_OnTouch),       HIGH(GuiApp_OnTouch)
+  .db 0, OBJECT_SIGNAL_DESTROY, LOW(GuiApp_OnDestroy),     HIGH(GuiApp_OnDestroy)
   .db 0, 0, 0, 0  ; end of table
 
 
diff --git a/avr/modules/lcd2/gui2/base/imageview.asm b/avr/modules/lcd2/gui2/base/imageview.asm
index 5e7987d..bfc8636 100644
--- a/avr/modules/lcd2/gui2/base/imageview.asm
+++ b/avr/modules/lcd2/gui2/base/imageview.asm
@@ -22,6 +22,9 @@
 .equ IMAGEVIEW_SIZE                 =  IMAGEVIEW_OFFS_BEGIN+4
 
 
+.equ IMAGEVIEW_VALUE_BGCOL          = WIDGET_VALUE_NEXTFREE+0
+.equ IMAGEVIEW_VALUE_NEXTFREE       = WIDGET_VALUE_NEXTFREE+1
+
 
 
 ; ***************************************************************************
@@ -113,27 +116,6 @@ ImageView_SetRessourceId:
 
 
 
-; ---------------------------------------------------------------------------
-; @routine ImageView_SetBgCol @global
-;
-; @param Y address of widget
-; @param X color
-; @clobbers r16
-
-ImageView_SetBgCol:
-  std Y+IMAGEVIEW_OFFS_BGCOLOR_LO, xl
-  std Y+IMAGEVIEW_OFFS_BGCOLOR_HI, xh
-  ldd r16, Y+OBJECT_OFFS_FLAGS
-  ori r16, (1<<WIDGET_FLAGS_DIRTY_BIT)
-  std Y+OBJECT_OFFS_FLAGS, r16
-  ret
-; @end
-
-
-
-
-
-
 ; ---------------------------------------------------------------------------
 ; @routine ImageView_OnDraw @global
 ;
@@ -252,6 +234,26 @@ imageViewDraw_ret:
 
 
 
+; ---------------------------------------------------------------------------
+; @routine ImageView_OnSetBgCol @global
+;
+; @param Y address of widget
+; @param X new background color
+; @clobbers any, !Y
+
+ImageView_OnSetBgCol:
+  std Y+IMAGEVIEW_OFFS_BGCOLOR_LO, xl
+  std Y+IMAGEVIEW_OFFS_BGCOLOR_HI, xh
+  ldd r16, Y+OBJECT_OFFS_FLAGS
+  ori r16, (1<<WIDGET_FLAGS_DIRTY_BIT)
+  std Y+OBJECT_OFFS_FLAGS, r16
+  sec
+  ret
+; @end
+
+
+
+
 ; ---------------------------------------------------------------------------
 ; @routine imageViewGetRessource
 ;
@@ -342,6 +344,7 @@ ImageView_DefaultSignalmap:
   .db 0,                           WIDGET_SIGNAL_DRAW,     LOW(ImageView_OnDraw),             HIGH(ImageView_OnDraw)
   .db WIDGET_VALUE_DEFAULT_WIDTH,  WIDGET_SIGNAL_GETVALUE, LOW(ImageView_OnGetDefaultWidth),  HIGH(ImageView_OnGetDefaultWidth)
   .db WIDGET_VALUE_DEFAULT_HEIGHT, WIDGET_SIGNAL_GETVALUE, LOW(ImageView_OnGetDefaultHeight), HIGH(ImageView_OnGetDefaultHeight)
+  .db IMAGEVIEW_VALUE_BGCOL,       WIDGET_SIGNAL_SETVALUE, LOW(ImageView_OnSetBgCol),         HIGH(ImageView_OnSetBgCol)
 
   .db 0, 0, 0, 0  ; end of table
 
diff --git a/avr/modules/lcd2/gui2/base/mainwindow.asm b/avr/modules/lcd2/gui2/base/mainwindow.asm
index a8089c3..a5e2a45 100644
--- a/avr/modules/lcd2/gui2/base/mainwindow.asm
+++ b/avr/modules/lcd2/gui2/base/mainwindow.asm
@@ -19,6 +19,11 @@
 .equ MAINWINDOW_SIZE          =  MAINWINDOW_OFFS_BEGIN+0
 
 
+; index of sub-windows
+.equ MAINWINDOW_CHILDIDX_TITLE   = 0
+.equ MAINWINDOW_CHILDIDX_CONTENT = 1
+
+
 
 ; ***************************************************************************
 ; code
@@ -108,7 +113,7 @@ MainWindow_Init:
 ; @clobbers r16
 
 MainWindow_GetContentWidget:
-  ldi r16, 1                ; idx 0=title, 1=content
+  ldi r16, MAINWINDOW_CHILDIDX_CONTENT
   bigcall OBJ_GetChildAt
   ret
 ; @end
diff --git a/avr/modules/lcd2/gui2/base/valuelabel.asm b/avr/modules/lcd2/gui2/base/valuelabel.asm
index b2456ac..6147fb5 100644
--- a/avr/modules/lcd2/gui2/base/valuelabel.asm
+++ b/avr/modules/lcd2/gui2/base/valuelabel.asm
@@ -22,7 +22,7 @@
 
 
 .equ VLABEL_VALUE          = WIDGET_VALUE_NEXTFREE+0
-.equ VLABEL_VALUE_NEXTFREE = VLABEL_VALUE+1
+.equ VLABEL_VALUE_NEXTFREE = WIDGET_VALUE_NEXTFREE+1
 
 
 
@@ -93,6 +93,7 @@ ValueLabel_Init:
 ; @routine ValueLabel_OnSetValue @global
 ;
 ; @param Y address of widget
+; @param X new value
 ; @return CFLAG set if signal handled
 ; @clobbers r17
 
@@ -103,6 +104,7 @@ ValueLabel_OnSetValue:
   ldd r17, Y+OBJECT_OFFS_FLAGS
   ori r17, (1<<WIDGET_FLAGS_DIRTY_BIT)
   std Y+OBJECT_OFFS_FLAGS, r17
+
   sec
   ret
 ; @end
@@ -209,13 +211,17 @@ valueLabelWriteValue:
 ; @clobbers r8, r9, r10, r11, r12, r13, r14, r15, r16, r17, r18, r19, r20, r21, r22, r23, r24, r25
 
 valueLabelAlignTextXY:
-  rcall valueLabelCalcTextWidth   ; X=ptr to text in SDRAM, R13:R12=text width (r16, r17, r18)
-  rcall Widget_PackContentX       ; R5:R4=X (r17, r18, r19, r20, r21)
-
-  rcall Widget_GetCharHeight      ; R16=char height
-  mov r12, r16
-  clr r13
-  rcall Widget_PackContentY       ; R7:R6=Y (r17, r18, r19, r20, r21)
+  rcall valueLabelCalcTextWidth       ; X=ptr to text in SDRAM, R13:R12=text width (r16, r17, r18)
+  push xl
+    push xh
+      rcall Widget_PackContentX       ; R5:R4=X (r17, r18, r19, r20, r21)
+    
+      rcall Widget_GetCharHeight      ; R16=char height
+      mov r12, r16
+      clr r13
+      rcall Widget_PackContentY       ; R7:R6=Y (r17, r18, r19, r20, r21)
+    pop xh
+  pop xl
   ret
 ; @end
 
diff --git a/avr/modules/lcd2/gui2/base/widget.asm b/avr/modules/lcd2/gui2/base/widget.asm
index 414ba92..cbe686e 100644
--- a/avr/modules/lcd2/gui2/base/widget.asm
+++ b/avr/modules/lcd2/gui2/base/widget.asm
@@ -338,6 +338,22 @@ Widget_GetDefaultHeight_ret:
 ; @end
 
 
+; ---------------------------------------------------------------------------
+; @routine Widget_SetValue @global
+;
+; @param Y address of widget
+; @param r17 value id
+; @param X value to set
+; @return CFLAG set if value set, cleared on error
+; @clobbers any, !Y
+
+Widget_SetValue:
+  ldi r16, WIDGET_SIGNAL_SETVALUE
+  bigcall OBJ_HandleSignal
+  ret
+; @end
+
+
 
 ; ---------------------------------------------------------------------------
 ; @routine Widget_IsPointInRect @global
@@ -723,9 +739,9 @@ Widget_Clear:
   tst r16
   breq Widget_Clear_l1
   ; DEBUG
-  ldi r16, LOW(DISPLAY_COLOR_RED)
+  ldi r16, LOW(DISPLAY_COLOR_MAGENTA)
   mov r2, r16
-  ldi r16, HIGH(DISPLAY_COLOR_RED)
+  ldi r16, HIGH(DISPLAY_COLOR_MAGENTA)
   mov r3, r16
   bigcall Display_FillRect
   ret
diff --git a/avr/modules/network/msg/memstats-w.asm b/avr/modules/network/msg/memstats-w.asm
index 6a71ab3..fbfc580 100644
--- a/avr/modules/network/msg/memstats-w.asm
+++ b/avr/modules/network/msg/memstats-w.asm
@@ -41,14 +41,21 @@ NETMSG_MemStats_Write:
   st X+, r20
   st X+, r21
 .else
-  ldi r20, LOW(RAMEND)
-  ldi r21, HIGH(RAMEND)
-  in r17, SPL
-  sub r20, r17
-  st X+, r20
-  in r17, SPH
-  sbc r21, r17
-  st X+, r21
+  .ifdef MODULES_HEAP
+    lds r20, heapFree
+    lds r21, heapFree+1
+    st X+, r20
+    st X+, r21
+  .else
+    ldi r20, LOW(RAMEND)
+    ldi r21, HIGH(RAMEND)
+    in r17, SPL
+    sub r20, r17
+    st X+, r20
+    in r17, SPH
+    sbc r21, r17
+    st X+, r21
+  .endif
 .endif
   ; current buffers used
   lds r16, netBuffersUsed