WanderPlug Family — Decision Log
Running log of every keep/swap/drop decision across WanderPlug Standard + WanderPlug Pro. Citations per entry. UL 498 + Matter cert + reliability + survivor-advisory rigor > all else.
This document is the refinement of /tmp/draft-wanderplug-DECISIONS.md (local-LLM draft validated 78/100 — required strong refinement) into the full SOP v2.4 decision-log artifact.
---
Stage 0 — Feature-parity sweep (2026-04-25)
- Decision: 2-tier family (WanderPlug Standard $39 / WanderPlug Pro $69) with shared platform (ESP32-S3 host + CC2652R7 Thread radio + ACS37800 isolated kWh monitor + T9A latching relay + Murata BNX002 EMI filter + saffron status LED) + Pro-tier addition (NEMA 5-20R 20 A receptacle + dual USB-C PD passthrough with INA236 per-port shunts + USB-PD controller).
- Source: competitive audit vs TP-Link Kasa KP125M ($14, Matter-over-WiFi, no-cert-class energy reporting), Wyze Plug Outdoor ($15, cloud-required), Aqara Smart Plug US ($19, Matter-over-Zigbee gateway-required), Eve Energy 4th-gen ($40, Matter-over-Thread, premium energy reporting, no audit log / no covert mode), Belkin Wemo Smart Plug ($25, AppleHome native, no Matter), Lutron Caseta Plug-In Dimmer ($65, premium lighting-only). See
_COMPETITIVE-AUDIT-2026-04-25.md.
- Flags: TP-Link / Wyze have 5+ years of category-mainstream pedigree + brand recognition + retail distribution. We do NOT compete on shelf-price ($14 Kasa is uneconomic for us with a UL 498 cert + Ambassador wage in the BOM) — we compete on (a) UL 498 cert pedigree (most cheap plugs ship as UL 1097 or just FCC-only), (b) Matter-over-Thread native cert + interop, (c) real Allegro ACS37800 isolated kWh monitor (not sample-and-guess shunt), (d) survivor-aware audit log + covert mode + panic-wipe, (e) Ambassador-assembled + 60/30/10 social impact, (f) STL-open + 7-year parts (with relay refresh service path), (g) zero subscription / zero cloud account.
- Lead axes: Matter-over-Thread native · subscription-free / cloud-free · identity-aware covert mode + audit log + panic-wipe · open STLs · 7-year parts (with T9A relay refresh) · per-USB-port kWh on Pro · grant-funded plausibility (DOE BTO + state utility-rebate pools).
- Lag axes: brand recognition (Kasa / Wyze have decade scale at retail) · shelf-price competitiveness ($39 vs $14 Kasa Standard) · smartphone-first onboarding polish at first-launch (companion-app v1.0 has feature depth but not Kasa-decade-iterated UX) · NEMA 6-15 / 6-20 high-voltage receptacle variants (240 V appliance-class outlets — out of scope v1).
[rule: 60/30/10] [rule: dual-mode] [rule: zero-cloud]
---
Stage 1 — Intake + freeze (2026-04-25)
- Device IDs assigned:
WV-PLUG-STD, WV-PLUG-PRO.
- Revision frozen:
v1.0-candidate.
- Ship target locked: Standard 2027-Q2 (UL 498 + Matter HARD GATE) · Pro 2027-Q3 (+ UL 1310 USB-PD + USB-IF cert + Matter Energy Management cluster).
- Entity: Eisinger Holdings LLC (hardware margin); feeds 60/30/10 Community Pool per canonical split.
- No Blueprint reference bundle for WanderPlug. Spec dictated by UL 498 + Matter cert requirements + WanderVerse platform standards + survivor-aware advisory framework. Per task spec: NO Perplexity queries.
---
D-PLUG-001 — TE T9A relay 100 k-operation EOL vs WanderVerse 7-year parts (Stage 0 reconciliation)
- Context: A residential smart outlet relay is the binding wear-out component. T9A series 16 A latching relays are rated for >100 k mechanical operations at full inductive load. At a typical residential plug duty cycle (10–30 commanded flips per day if used heavily — phantom-load schedules, presence-detection, smart-home automations), 100 k operations equates to ~10–25 years. At light duty (1–3 flips per day — manual user toggles only), the relay outlasts everything else in the device. WanderVerse Standard 4 mandates 7-year parts at cost+10% via Ambassador network. The T9A relay creates a service question, not a conflict — but the question must be answered explicitly so we don't ship without an EOL story.
- Decision 2026-04-25: Ship with TE Connectivity T9A series 16 A 30 V latching relay (5-pin) as the primary. Operations counter implemented in firmware (incremented on every commanded flip; SE051-stored so it survives flash erase + tamper). EOL UX: at 80 k operations, app says "consider Ambassador refresh in next year"; at 95 k, on-device LED slow-pulse + app prompt "Ambassador refresh recommended"; at 100 k, firmware refuses commanded flips that aren't from a manual button-press and logs "EOL — Ambassador refresh required." Ambassador refresh = $25 service + new T9A relay → resets operations counter; refresh resets the 7-year-parts clock for the new relay. Relays stocked through year 7 from generation EOL; year 8+ uses published STL + community-self-repair channel.
- Rationale: the T9A 100 k-operation envelope is honest end-of-life, not surprise-failure. We instrument it in firmware, surface it in the companion app, and offer a service path that avoids the e-waste outcome that defines the smart-plug category. Standard 4's intent is "no orphaned parts; service path exists; community-self-repair at year 8" — fully honored.
- Cost impact: TE T9A ~$2.40 BOM × 1; Omron G5RL-K alt ~$2.10 BOM (qualified at DVT). Year-1-onward service revenue at $25 × ~5–15% of fleet per year amortizes the relay-life UX engineering investment + supports the Ambassador refresh program.
- Conflict resolution: documented in
WANDERPLUG-FAMILY-SPEC.md §5 + _MANIFEST.md §Hard gates. No precedent-conflict with other WanderVerse products. WanderCO's similar pattern (10-year primary cell vs 7-year-parts) was the reference; WanderPlug's is similar in shape but weaker in severity (relay is 10–25-year wear; cell is hard 10-year). [rule: 7yr-parts]
---
D-PLUG-002 — Saffron LED + matte cream anodized aluminum trim ring family-wide
- Context: WanderVerse Security Trio + WanderAlert + WanderCO + WanderDash standardize on saffron LEDs + matte cream anodized aluminum chassis as the family visual standard. WanderPlug needs to match this from a Decora-style trim ring constraint — outlet face must fit standard double-gang or single-gang Decora wall-plate covers.
- Decision: Cree CLM3C-AKA saffron LED (1 × indicator on the lower-left of the receptacle face); matte cream anodized aluminum Decora-style trim ring with saffron pinstripe outer border. State pattern:
- Standby: dim 1× LED pulse every 10 s ("alive")
- Relay closed (AC passthrough active): steady-on saffron
- Relay open: LED off (Standard mode) OR steady-on (covert mode — visual indistinguishable from relay-closed state)
- Pairing / commissioning: saffron rapid-pulse 5 Hz
- Fault / EOL warning: saffron slow-pulse 1 Hz
- Lifetime: Cree CLM3C-AKA at rated drive current >50,000 hr (~5.7 years continuous; far longer at typical detector duty cycles where LED is 24/7 standby pulse — calculated >10 yr at standby duty). Confirms 7-year parts commitment.
- Driver: TI TPS92518 multi-channel LED driver; reused from Security Trio + WanderAlert (single channel used for the single LED; remaining channels populated for Pro tier USB-C status indicators).
- Visual identity preserved: saffron LED + saffron pinstripe trim ring + Decora form factor. No exterior branding (per Standard 1 — Ambassador signature is interior only). [rule: saffron]
---
D-PLUG-003 — MCU choice: ESP32-S3 host across the family
- Context: WanderVerse Security Trio + WanderAlert + Bridge Mini + WanderCO standardize on ESP32-S3 (Espressif ESP32-S3-WROOM-1-N16R8 module). FAE relationship + FCC modular cert + community SDK + Matter SDK availability.
- Decision: ESP32-S3 host across both tiers. WiFi 6 + BLE 5.3 builtin (used for Matter-over-WiFi fallback + companion-app pairing via BLE + commissioning UX). 16 MB flash + 8 MB PSRAM provides headroom for Matter clusters + audit log encryption + future feature expansion.
- Power discussion: WanderPlug is mains-powered (no battery budget concern); ESP32-S3 active draw of ~150 mA at 240 MHz is irrelevant against the 1875 W AC budget. Deep-sleep optimization not required.
- Why not Nordic nRF52840? No technical advantage for WanderPlug's mains-powered use case; ESP32-S3 wins on Matter SDK + WiFi-fallback + WanderVerse standardization.
- Why not Espressif ESP32-C6? ESP32-C6 has integrated 802.15.4 (Thread/Zigbee) which would be a single-chip alternative to the ESP32-S3 + CC2652R7 split. Considered + rejected: ESP32-C6's 802.15.4 stack is newer + less mature than TI's CC2652R7 OpenThread implementation; certified Matter-over-Thread interop history is shorter; Apple Home + Google Home Thread border router compatibility data is less accumulated. WanderPlug's UL+Matter HARD GATE means we choose the more-mature Thread radio. v2 candidate revisits ESP32-C6 once 802.15.4 stack accumulates 1–2 years of field deployment.
- Why dual-MCU (ESP32-S3 host + CC2652R7 Thread radio)? Separation of concerns: ESP32-S3 runs application + Matter stack + audit log + WiFi fallback; CC2652R7 runs OpenThread + 802.15.4 PHY/MAC. Enables independent firmware update cadence + Thread radio recertification path without touching application firmware. Cost delta vs single-chip ~$2.50 BOM, justified by cert + supply-chain de-risk. [rule: dual-source]
---
D-PLUG-004 — Allegro ACS37800 isolated AC current/voltage/power monitor (NEW for parts library)
- Context: Most cheap smart plugs use a neutral-referenced ADC + shunt-resistor topology to estimate power. This works for ballpark wattage but has two problems: (a) galvanic isolation between AC mains and the MCU's ADC requires careful PCB + isolation discipline, and the cheap plugs typically just don't bother — UL 498 dielectric isolation gets handled at the relay only, leaving the ADC ground at line potential; (b) accuracy is poor at low currents (phantom-load detection, vampire-power, leak-current reporting all suffer at <5 W loads where shunt-resistor SNR is bad). Real isolated current/power monitor ICs exist; the WanderVerse standard for an outlet has to be one.
- Decision: Allegro ACS37800 isolated AC current/voltage/power monitor IC for both tiers. ±30 A range; 8 kSPS internal ADC; computes RMS voltage, RMS current, real power, apparent power, power factor, harmonic distortion; isolated to UL 60950-1 dielectric strength (3.0 kV RMS for 60 s); SPI digital output to ESP32-S3 host. Single-source-class (Allegro Microsystems), but with two qualified alternates: TI INA228 (high-side current sense — different topology; needs additional isolation) + Allegro ACS758 (different range, qualified for Pro USB-PD-stage current sense). The ACS37800 is the right choice for the AC-mains-side measurement on both tiers.
- NEW for parts library: Allegro ACS37800 added to
parts.db at this spec session — was not previously catalogued. Function class: sensor-current-isolated.
- Cost impact: Allegro ACS37800 ~$3.80 BOM at 1k volume. TI INA228 alt ~$3.20 BOM (but requires more isolation discipline + topology work). ACS758 ~$2.90 BOM (different range; reserved for Pro USB-PD-stage shunt).
- Cert path: Allegro publishes UL 60950-1 isolation-strength application notes; the ACS37800 carries reinforced isolation up to 3.0 kVrms — exceeds UL 498 requirement (1.5 kVrms typical for outlet-class dielectric tests). Per-product end-product cert at UL accredited lab; ~$25–35k bundled UL 498 + UL 1310 lab visit. [rule: dual-source]
---
D-PLUG-005 — TI CC2652R7 Thread radio (Matter-over-Thread native)
- Context: Matter is the smart-home standard for 2026+. Matter-over-Thread vs Matter-over-WiFi: Thread is the right choice for plugs / switches / sensors because it's mesh-capable + low-latency + low-power + designed for IoT; WiFi is fine but adds router-load + lower battery life on battery-powered devices (not relevant for WanderPlug since it's mains-powered, but the family standardization matters for WanderVerse Sensor + Switch + Lighting roadmap). All major Matter-over-Thread products (Nanoleaf, Eve, Aqara) use TI CC2652-series or Nordic nRF52840-series Thread radios. Apple Home + Google Home + SmartThings + Home Assistant all support Matter-over-Thread when a household has a Thread border router (HomePod mini, Apple TV 4K, Nest Hub 2nd-gen, SmartThings Hub V3+, Eero 6+, Home Assistant Yellow).
- Decision: TI CC2652R7 Thread/Zigbee SoC for the Thread radio role; ESP32-S3 host for application + Matter stack + WiFi-fallback. Native OpenThread + Matter SDK from TI's TI Smart Home reference. CC2652R7 has FCC modular cert passthrough; FCC ID can be reused.
- NEW for parts library: TI CC2652R7 added to
parts.db at this spec session. Function class: radio-thread.
- Cost impact: TI CC2652R7 ~$3.20 BOM at 1k volume. Single-source-class; alternate Nordic nRF52840 (different stack; would require firmware port) qualified at DVT but the TI implementation is preferred on Matter-over-Thread maturity.
- Why not ESP32-C6 single-chip? See D-PLUG-003 — Thread stack maturity is the deciding factor for v1; v2 candidate revisits.
- Why not Silicon Labs EFR32MG24? Equivalent capability; TI CC2652R7 chosen on FAE relationship + WanderVerse-platform-default-direction (TI is the WanderVerse default for analog + power; CC2652R7 reuses TI's FAE relationship). Silicon Labs alternative qualified at DVT. [rule: dual-source]
---
D-PLUG-006 — TE Connectivity T9A 16 A latching relay (with arc-suppression discipline)
- Context: The relay choice for a smart outlet is the wear-out budget binder. Two architectures: monostable (continuous coil current to hold contacts) vs latching (brief pulse to flip; mechanical hold; zero idle current). Monostable holds at ~30 mA × 30 V = ~1 W continuous → ~9 kWh / yr just to hold the relay open. On a 24/7 plug that's ~$1/yr in the US average residential rate. Energy-honest device cannot waste energy on its own coil. Latching relay is the right architecture.
- Decision: TE Connectivity T9A series 16 A 30 V DPDT latching relay (5-pin), zero-crossing-switched in firmware, with RC snubber arc-suppression network across each contact (0.022 µF + 100 Ω). Operations counter in firmware (SE051-stored).
- Why 16 A nominal for a 15 A outlet: UL 498 derate factor; 16 A relay sustains 15 A continuous duty + transient inrush margin without contact welding. For Pro tier 20 A NEMA 5-20R: T9A 16 A is rated; for sustained 20 A draw (uncommon but possible — high-end appliance plugged into Pro), Pro upgrades to T9A 20 A variant or alternates qualifies (Omron G5RL-K 20 A).
- Arc-suppression + EOL UX: RC snubber + zero-crossing-switching + operations-counter — see WANDERPLUG-FAMILY-SPEC §5 + this DECISIONS §D-PLUG-001 for full reconciliation discussion.
- NEW for parts library: TE T9A added to
parts.db at this spec session. Function class: relay-ac-latching. Alternate Omron G5RL-K + Panasonic ALD class qualified at DVT. [rule: dual-source]
---
D-PLUG-007 — Identity-aware audit log + covert remote-disable + panic-wipe (D-PLUG-008 expansion) — CONTROVERSIAL; advisory-panel gated
- Context: A smart outlet with a remotely-controllable relay is, by default, a useful primitive for both consumers and for adversaries. The DV / coercive-control use case is concrete: an adversary plugs a surveillance device (router that exfils traffic, AirTag-class tracker, hidden-camera power, monitoring software hub) into a household outlet; the survivor — possibly residing in a HAVEN safehouse, possibly still in shared housing — needs the ability to kill power to that device from a safe location, with forensic-friendly logging that survives the act of unplugging, with a panic-wipe option if the device is seized. Standard 0 (identity-aware) requires we accommodate this. A UL 498 listed outlet with a "covert remote-disable + audit log + panic-wipe" feature set is controversial in a way comparable to WanderCO's covert-mode framing (D-CO-008) — and gets the same advisory-panel gating.
- Decision: WanderPlug ships with audit log + covert mode + panic-wipe as a dual-confirmation, opt-in for covert-mode + default-on for audit-log + default-on for panic-wipe, advisory-panel-reviewed feature set:
- Audit log (default-on): every relay state change logs
timestamp · commanded_by (user|Matter|automation|button) · matter_fabric_source · RSSI · UL-cert-mode register state · audit_log_seq to local-only encrypted-at-rest flash. SE051 device-key encryption. Rolling 90 days default; configurable to 365 days. Exportable via companion app to paired phone as signed CSV. Never to WWP cloud, never to Matter fabric, never to any analytics endpoint.
- Covert mode (LED state-suppression on relay change) — opt-in: user must explicitly enable via companion app + sign in-app risk acknowledgment ("I understand that LED state-suppression means I cannot visually confirm relay state at-a-glance from across the room. I am enabling this mode for [DV/safehouse/coercive-control] reasons. WanderPlug will continue to: log every relay state change to the encrypted audit log; expose state via companion app; honor panic-wipe."). Default-off; survivor-pattern-eligible only (requires WWP-side review at order time).
- Panic-wipe (default-on): triple-press the side button within 3 s OR enter the duress-PIN via companion app. Result: audit log + commissioning data + Thread credentials + Matter fabric pairings erased; SE051 returns to factory-fresh commissionable state; relay returns to UL-default closed (AC passthrough). Forensic-friendly: before wipe, audit log + relay-state history exfiltrated to paired phone (encrypted signed CSV).
- Enforcement: dual layer.
1. Firmware: panic-wipe is a software setting; firmware enforces audit log encryption + immutability (append-only flash region; SE051 device-key signature on each entry). 2. Secure element (NXP SE051): device key for audit log encryption stored in SE051; cannot be extracted; if SE051 is tampered or replaced, audit log is unreadable + factory-zeroed on first boot post-tamper.
- Advisory panel review (Stage-10 RED gate):
- DV advocate panel (≥2 working DV advocates from HAVEN + national-DV-orgs)
- LGBTQ+ DV survivor panel (≥2 willing to consult under NDA, brokered through trauma-informed counsel)
- UL human-factors expert (≥1 — covert-mode framing review for a UL-listed life-safety-adjacent device)
- Veto rights apply to all external comms (web copy, datasheet, donor materials, grant submissions, training videos)
- Why this is controversial + acceptable: UL 498 does not directly regulate firmware behavior on a smart outlet; the cert covers electrical safety + dielectric isolation + receptacle dimensions. The covert-mode + audit-log + panic-wipe behavior is firmware policy, not UL-cert-policy. Acceptable when (a) advisory review certifies survivor benefit > misuse risk, (b) panic-wipe is forensic-friendly (data exfils to paired phone before erase, so survivor doesn't lose evidence), (c) audit log is encrypted at rest + cannot be silently tampered (SE051 + signed entries), (d) covert mode is default-off + opt-in with risk acknowledgment, (e) no public-facing API exposes audit log without paired-phone authentication.
- Marketing language gate: NEVER mentioned in promotional copy without survivor-advocate veto right. Documented in
_MANIFEST.md §Hard gates + WANDERPLUG-FAMILY-SPEC.md §15.
[rule: identity-aware]
---
D-PLUG-008 — Matter-over-Thread cert is a HARD GATE alongside UL 498
- Context: Matter cert (CSA-IoT) is a real cert — without it, devices cannot use the "Matter" logo, cannot interop with Matter fabrics in a way that the household commissioning UX recognizes, and cannot list as a Matter device in Apple Home / Google Home / SmartThings / Home Assistant. CSA-IoT cert involves: (a) device-class testing at an accredited cert lab; (b) interop testing in the Matter test suite; (c) annual CSA-IoT membership (~$4–7k/yr at startup tier); (d) per-product cert lab fee (~$8–12k); (e) commissioning credential (Device Attestation Certificate chain) baked into device at factory. Without CSA-IoT cert grant, WanderPlug cannot ship as a Matter device — only as a Matter-class WiFi device with mock commissioning, which defeats the entire Matter-native value proposition.
- Decision: Matter cert (CSA-IoT) is a HARD GATE alongside UL 498. Both required for sale in v1.0. Cert lab booking 2026-Q4 (engaged via CSA-IoT preferred lab list); cert grant target 2027-Q1 for Standard, 2027-Q2 for Pro.
- Why this is HARD: unlike a "Matter-class WiFi-only" workaround, real Matter cert is what unlocks the household-Apple-Home / household-Google-Home / household-SmartThings interop story. Without it, we ship a $39 plug that can ONLY be controlled via WanderVerse companion app + Hub admin — we lose the entire "works with any Matter fabric" pitch that is core to the v1 positioning vs Kasa / Wyze.
- Cost: ~$8–12k cert lab + ~$5k annual CSA-IoT membership + Device Attestation Certificate chain provisioning at factory (~$0.10/unit ongoing). v1 budget commitment: $20k upfront + $5k/yr ongoing.
- Risk: CSA-IoT cert pipeline congestion is real; v1.0 launch slip-risk if cert grant slips beyond 2027-Q1. Mitigation: Matter SDK selected from Espressif's Matter-Thread reference (mature; multi-vendor field-deployment); cert lab booked early; firmware feature-frozen at end of 2026-Q4.
---
D-PLUG-009 — Per-outlet kWh + cost reporting is local-only by default; opt-in Apple Home / Google Home / Hub admin telemetry
- Context: Energy data is sensitive in ways the average smart-plug vendor doesn't think about. Per-outlet kWh data reveals usage patterns (when occupants are home, when devices are powered, when sleep cycles begin and end). Aggregated across a household, energy data is a privacy-leakage surface comparable to "always-on microphone" data from voice assistants — different leakage modality, similar privacy-cost. Most cheap smart plugs upload energy data to the vendor cloud by default, with no opt-out path. WanderVerse zero-cloud rule applies.
- Decision: Per-outlet kWh + cost reporting is local-only by default. Three opt-in export channels available (user explicitly enables each):
1. Apple Home / Google Home native energy widgets (Matter Energy Management cluster — when CSA-IoT ratifies; v1 ships with extension if not ratified) — data flows to Apple HomeKit / Google Home native dashboards; subject to Apple / Google privacy policies (which are typically local-first for Apple Home; Google Home varies) 2. WanderNode Hub admin telemetry — per-outlet kWh / cost flows to household admin web UI on WanderNode Hub (free; runs on user-controlled hardware; no WWP cloud) 3. Local CSV export — user manually exports kWh history from companion app to paired phone as CSV; no upload anywhere
- Default state: all three opt-ins are OFF by default. WanderPlug measures, computes, displays in companion app, and stores history locally. Period.
- Rationale: privacy-first / zero-cloud is the WanderVerse standard. Apple Home's local-first energy framework is acceptable; Google Home's cloud-routed energy is opt-in only. Hub admin is user-owned hardware — fine. Anything beyond requires explicit user opt-in.
- Companion app behavior: kWh history visible only when user is BLE-paired or WiFi-paired to WanderPlug; no remote access without local-network presence (or via Matter fabric — which is itself local). [rule: zero-cloud]
---
D-PLUG-010 — No LoRa SX1262 / WanderAlert mesh participation in v1.0
- Context: WanderAlert family integrates LoRa SX1262 (915 MHz US / 868 MHz EU) for mesh participation across alarm + safety devices. WanderCO joins the mesh as a leaf node. The natural question is whether WanderPlug should join too — a smart outlet that participates in WanderAlert mesh could trigger relay-off on a CO event (e.g., kill power to space heater on CO alarm) or relay-off on a security-trio detection.
- Decision: WanderPlug v1.0 does NOT ship with LoRa SX1262 / WanderAlert mesh participation. v2 candidate.
- Rationale: (a) BOM impact — LoRa SX1262 + Taoglas FXP14 antenna + bulk caps add ~$5.50 BOM, pushing Standard tier from $39 to ~$45 retail to maintain margin — meaningful at this price point; (b) regulatory complexity — adding a LoRa intentional radiator to an AC-mains receptacle complicates UL 498 + FCC Part 15 cert pathway; (c) feature priority — Matter-over-Thread + UL 498 + per-outlet kWh + identity-aware are the killer-feature stack for v1; LoRa mesh is a "nice-to-have" cross-product story; (d) v2 product expansion — WanderPlug v2 (2028+) candidate adds LoRa for cross-product integration alongside outdoor / power-strip / global-plug-format expansion.
- What this means for v1: WanderPlug joins household Matter fabric; if user has a Matter-aware automation (e.g., Home Assistant automation that listens to WanderCO Matter events), the user can wire "WanderCO CO alarm → WanderPlug relay off on space-heater outlet" via Home Assistant or Apple Home automation. Cross-product integration happens at the Matter fabric layer in v1, not at the LoRa mesh layer.
---
Stage 2 — Component selection summary (2026-04-25)
Per BOM-platform.csv + BOM-modules.csv. Highlights:
| Function | Part | Reuse status |
|---|
| Host MCU (2-tier shared) | Espressif ESP32-S3-WROOM-1-N16R8 | Reused from Security Trio + WanderAlert + WanderCO + many (parts.db: compute-mcu, multi-product) |
| Thread radio | TI CC2652R7 | **NEW for parts library** |
| AC current/power monitor | Allegro ACS37800 | **NEW for parts library** |
| Saffron LED | Cree CLM3C-AKA saffron 605nm (1×) | Reused from Security Trio + WanderDash + WanderCO (parts.db: indicator-led) |
| LED driver | TI TPS92518 | Reused from Security Trio + WanderAlert |
| AC relay | TE Connectivity T9A 16A latching | **NEW for parts library** |
| EMI input filter | Murata BNX002 | **NEW for parts library** |
| Isolated AC-DC converter | RECOM RAC02-05SK / Mean Well IRM-03-5 | new (Vipcom IRM-class qualified at DVT) |
| Tamper switch | Omron D2F-01F | Reused from WanderAlert + WanderCO |
| Reset/pair button | Alps SKRH + recessed cap | Reused (button family) |
| AC fuse | Bel Fuse 5ET-2 (slow-blow 2A) | new mechanical |
| PMIC | TI TPS65086100 | Reused from WanderAlert + WanderCO (parts.db: power-pmic, 13 products) |
| Buck-boost | TI TPS63020 | Reused |
| Secure element | NXP SE051 | Reused from WanderBand + WanderAlert + Security Trio + WanderCO |
| Flash NOR | Macronix MX25R 8 MB / 16 MB | Reused |
| Antenna Thread | Taoglas FXP70 / TI CC-Antenna-DK2 | **NEW for parts library** |
| Antenna BLE/WiFi | via ESP32-S3 builtin chip antenna | Reused |
| Chassis Decora-trim cream anodized aluminum | Custom CNC + Type II anodize | NEW |
| Saffron pinstripe outer trim ring | Custom anodized aluminum | NEW (per hero image) |
Pro tier additional parts
| Function | Part | Reuse status |
|---|
| USB-C PD controller | Cypress CYPD3174 / TI TPS65987DDH | new |
| USB-C connectors (×2) | GCT USB4135 (vertical mid-mount) | new mechanical |
| USB-C PD per-port shunt (×2) | TI INA236 | **NEW for parts library** |
| USB-C ESD + power switch (×2) | Diodes Inc TPD3S014 | new |
See BOM-platform.csv, BOM-modules.csv, BOM-normalized.csv, SOURCING.csv for full part list + sourcing.
---
Stage 2b — Configurator axes (2026-04-25)
5 axes per tier. See CONFIGURATOR.md for full matrix. Summary:
- WanderPlug Standard: trim finish (cream / charcoal / brushed) · covert mode eligibility (default-off / survivor-pattern eligible — requires WWP review) · Matter fabric pre-commissioning (none / Apple Home pre-paired / Google Home / Home Assistant / SmartThings) · Ambassador signature · donor pairing
- WanderPlug Pro: all Standard axes + USB-PD wattage profile (default 30 W shared — alternative 20 W max per port if user wants per-port priority enforcement) + per-port USB-C kWh export (local-only / Apple Home / Hub admin)
---
Stage 3 — Compatibility (2026-04-25)
Resolved:
- Thread 2.4 GHz + WiFi 6 (2.4 + 5 GHz; ESP32-S3 builtin) + BLE 2.4 GHz: shared band on 2.4 GHz; coexistence handled via ESP32-S3 + CC2652R7 dual-radio TDM (Espressif framework + TI Thread coexistence guidelines). Verified at EVT.
- ESP32-S3 + ACS37800 over SPI + CC2652R7 over UART/SPI + SE051 over I²C + Macronix flash over QSPI: shared with per-peripheral isolation. Standard ESP32-S3 reference design.
- Allegro ACS37800 isolation between AC mains and digital SPI: 3.0 kVrms reinforced isolation; far exceeds UL 498 1.5 kVrms requirement.
- T9A relay zero-crossing switching: relay command issued by ESP32-S3 firmware when AC sine within ±2 V of zero crossing; verified by ACS37800 voltage measurement triggering the flip.
Deferred to Stage 5 (PCB layout):
- Thread antenna placement vs AC mains traces (RF interference + isolation discipline — Thread antenna must be ≥10 mm from any AC trace + grounded chassis-spreader)
- ACS37800 thermal coupling to chassis aluminum (heat-sinks the IC; verify at +50 °C ambient stress)
- USB-PD per-port shunt placement vs USB-C connector signal integrity (Pro)
---
Stage 4 — Sourcing (2026-04-25, framework only)
See SOURCING.csv. Live RFQs deferred until UL 498 + Matter cert lab engaged + engineering hire onboarded.
Critical dual-source flags:
- Allegro ACS37800 — single-source-class; alternates TI INA228 (different topology) + Allegro ACS758 (different range; Pro USB-PD-stage) qualified at DVT
- TE T9A relay — single-source-class; alternates Omron G5RL-K + Panasonic ALD class qualified at DVT
- Murata BNX002 EMI filter — single-source-class; alternates Murata BNX024 (different range) + TDK ZCAT-class qualified at DVT
- TI CC2652R7 — single-source-class; alternate Nordic nRF52840 (different stack; firmware port required) qualified at DVT
- ESP32-S3 module — Espressif primary; alternate Raytac MDBT50Q-S3 (FCC modular cert passthrough)
[rule: dual-source]
---
Stage 5 — DFM/DFA/DFT (2026-04-25)
See DFM-DFA-DFT.md. Critical:
- UL 498 dielectric test fixture (1500 VAC for 1 min between line/neutral and earth; no breakdown) — Ambassador Tier-2 fixture; ~$5–8k bench setup; SHARED with future receptacle / switch / lighting WanderVerse products
- T9A relay 100-cycle burn-in at full inductive load (verifies arc-suppression network + zero-crossing-switching firmware) — Ambassador Tier-2; ~$3–5k bench
- Allegro ACS37800 calibration at 5 / 10 / 15 A reference loads (±2 % accuracy per-unit) — Ambassador Tier-2; ~$2–4k calibrated load bench
- Matter commissioning round-trip with reference Thread border router + Matter fabric — Ambassador Tier-2; ~$2–3k reference setup
- Ambassador throughput: Standard 10 min · Pro 14 min.
---
Stage 6 — Thermal/EMC (2026-04-25)
See THERMAL-EMC.md. Operating range 0 to +50 °C (UL 498 standard ambient). Thread + WiFi + BLE coexistence handled per ESP32-S3 + CC2652R7 dual-radio reference. Relay arc-suppression + EMI input filter + isolated AC-DC + USB-PD (Pro) thermal envelope: chassis aluminum thermal mass dissipates 8–12 W sustained without throttling.
---
Stage 7 — Compliance (2026-04-25)
See COMPLIANCE.md.
Cert sequencing (target):
- UL 498 (residential receptacle) — initiated 2026-Q4, granted 2027-Q1
- UL 1310 / UL 60950-1 (USB-PD low-voltage on Pro) — bundled with UL 498 lab; 2027-Q1
- Matter cert (CSA-IoT) — initiated 2026-Q4, granted 2027-Q1 for Standard / 2027-Q2 for Pro
- FCC Part 15 — DVT 2027-Q1
- CE / UKCA + EN 60669-2-1 + LVD/EMC — bundle with FCC test data 2027-Q2
- CSA C22.2 No. 42 (Canadian) — bundled with UL 498 lab visit
- USB-IF cert (Pro) — DVT 2027-Q2
- RoHS / REACH — declared throughout
Total cert v1: ~$50–80k.
---
Stage 8 — Canonical BOM + GUIDE + STLs (2026-04-25)
Files produced. STL-OPEN-FILES/README.md documents CC BY-SA 4.0 release for every 3D-printable mechanical part:
- Wall-plate adapter (single-gang Decora; double-gang Decora; UK BS 1363 v1.2 candidate; EU Type F v1.2 candidate)
- Button cap variants (color options; tactile profile)
- Dust shroud (industrial / dusty-environment install)
- Ambassador-tag-holder (interior)
---
Stage 9 — HW/FW (2026-04-25)
WanderOS-Plug on Zephyr (ESP32-S3 host) + native CC2652R7 OpenThread + Matter SDK. Single firmware codebase for both tiers (Pro adds USB-PD controller + INA236 driver compile-time flag). UL 498 + Matter cert compliance = canonical test cases in CI. OTA discipline: signed images, A/B partitions, Matter-fabric OTA support + WiFi-fallback OTA.
---
Stage 10 — Gate (2026-04-25)
See GATE.md. Stage-10 blockers: 1. UL 498 cert granted (HARD GATE — any sale) 2. Matter cert (CSA-IoT) granted (HARD GATE — any sale + Matter-fabric joining) 3. Advisory review complete (DV advocate + LGBTQ+ DV survivor + UL human-factors expert panels) 4. UL 1310 / UL 60950-1 (USB-PD; Pro) — bundled 5. CSA C22.2 No. 42 (Canada) — bundled 6. CE / UKCA + EN 60669-2-1 + LVD/EMC — bundled 7. FCC Part 15 — accredited 8. USB-IF cert (Pro) — accredited 9. Identity-aware audit log + panic-wipe + covert-mode firmware lockout independent security audit
---
Grant-funding plausibility (decision context, not a commitment)
Recorded here so future grant submissions reference the same framing:
| Program | Why it fits | Range | Application timing |
|---|
| **DOE Building Technologies Office** | Energy-efficiency for low-income housing; phantom-load reduction maps to BTO Tools program | $25k-500k | 2027 application window |
| **HUD Healthy Homes** | Energy-efficiency intersection with Healthy Homes program criteria | $25k-2M | 2027 |
| **State utility-rebate programs (NY NYSERDA, MA Mass Save, CA CPUC, OR ETO, WA WSEO)** | Direct buy-side rebates for ENERGY STAR-class smart plugs | $5–25 / unit rebate | rolling — state-by-state ops |
| **VAWA housing transition pools** | DV-safehouse comms + safety upgrades | varies | rolling — through HAVEN partnership |
| **HUD HOPWA** | LGBTQ-housing energy-efficiency + safety upgrades | varies | annual |
| **EPA Environmental Justice grants (energy-burden reduction)** | Phantom-load + utility-cost transparency aligns with EJ40 framework | $50k-1M | 2027 |
WanderPlug is NOT a grant-funded product in the sense that we depend on grants to ship — the LLC pays for v1 cert from forecast hardware revenue. Grants are an accelerator for HAVEN-safehouse + LGBTQ-housing + Title-I-rural-housing donor-sponsored deployment + a de-risking layer on cert investment.
[rule: ambassador]
---
Critical open items (revalidated)
| Item | Severity | Action owner | Deadline |
|---|
| Engineering team hire (EE + FW + UL/Matter specialist; shared with WanderAlert + WanderCO + WanderSense pool) | red | Michael | NOW — 2026-Q3 start |
| UL 498 cert lab engagement (Intertek / TUV SUD / UL direct — bundled lab visit Standard + Pro) | red | cert team + Michael | 2026-Q4 |
| Matter cert lab engagement (CSA-IoT preferred lab list) | red | engineering + cert team | 2026-Q4 |
| Advisory panel formation (DV advocate + LGBTQ+ DV survivor + UL human-factors expert) | red | Michael + WanderSafe team + trauma-informed counsel | 2026-Q4 (pre-EVT) |
| Allegro ACS37800 + T9A relay + Murata BNX002 dual-source RFQs | yellow | engineering hire | 2027-Q1 |
| TI CC2652R7 + ESP32-S3 + Nordic nRF52840 alternate qualification | yellow | engineering hire | 2027-Q1 |
| EU bundle (CE LVD/EMC + EN 60669-2-1) cert lab booking | yellow | cert team | 2027-Q2 |
| HAVEN safehouse + LGBTQ-housing donor program legal structuring | yellow | counsel + Michael | 2027-Q1 |
| USB-IF cert (Pro) + USB-PD interop pilot | yellow | engineering | 2027-Q2 |
| Identity-aware audit log + panic-wipe firmware + secure-element role-token enforcement (independent security audit pre-PVT) | red | firmware + security review | 2027-Q1 |
| Matter Energy Management cluster ratification timeline tracking | yellow | engineering | continuous |
---
Non-goals (explicitly NOT shipping in v1)
- NEMA 6-15 / 6-20 / 14-30 240 V appliance-class outlets — not in v1; out of scope (different cert path; different product class)
- Dimmer / phase-control variants — out of scope (separate UL cert path UL 1472 dimmer-class)
- Three-prong grounded-only outlets without tamper-resistant face — v1 ships tamper-resistant per NEC Article 406.12 (child-safety jurisdictions require it)
- Outdoor / NEMA 3R-rated variants — v1 indoor only; v2 candidate adds outdoor variant
- UK BS 1363 / EU Type F (Schuko) global plug formats — v1 US only; v1.2 candidate adds international variants
- 4-outlet power-strip variants — v2 candidate
- PoE pass-through — categorically out of scope (different product class)
- AC-cellular-modem hybrid (e.g., outlet that backhauls Matter over cellular when WiFi is unreachable) — never (different cert path; different product)
- AI-routed energy-decision automation (e.g., LLM-driven phantom-load schedules) — never in v1 (deterministic phantom-load detection; LLMs in the energy-decision loop creates audit-trail and accountability problems)
- Subscription requirement for core energy reporting features — never (zero-cloud rule applied)
- Exporting energy data to vendor cloud / WWP cloud / any third-party analytics — never (D-PLUG-009 zero-cloud default)
- Per-outlet kWh data shared without explicit user opt-in — never (D-PLUG-009)