WanderSwitch — Family Architecture Spec (v1.0-candidate)
Product family: WanderSwitch — in-wall smart light switch + dimmer (1-gang / 2-gang / 3-gang) with Matter-over-Thread, no neutral wire required. Direct replacement for Lutron Caseta dimmers + TP-Link Kasa Wi-Fi switches in the existing-home retrofit market. Revision: v1.0-candidate Date: 2026-04-25 SOP: v2.4
---
1. Why this exists
The smart-switch category is a thirty-year-old supply of devices that fail at one or more of four basic things: they require a neutral wire (which ~40% of US pre-1990 homes don't have at the switch box), they tie the household to a vendor cloud (Kasa goes dark when TP-Link servers do), they handle dimming with poor TRIAC waveform discipline (LED bulbs flicker, buzz, or refuse low-end dim), or they put a glowing wordmark on the wall plate.
The category has converged on Matter-over-Thread for interop in 2024-2025 — but the no-neutral incumbents (Lutron Caseta, Inovelli Blue, GE Cync) are either expensive, locked to a proprietary hub (Caseta requires Smart Bridge Pro), or have well-documented EMI / dimming-quality issues with modern LED loads. None of them treat the switch as a household-safety surface (covert duress, audit logging, identity-aware routing).
WanderSwitch is the WanderVerse in-wall control surface. It is UL 20 (general-use snap switches) + FCC Part 15 + Matter cert-gated because nothing else is sellable in this category, and it ships with no-neutral-required line-scavenging power topology so it drops into any existing US single-pole or three-way switch box without rewiring. Pro tier adds 3-gang dimmer + paddle combination (the "media-room replacement" SKU) and hub-grade Thread border-router participation, so a household that buys one Pro can use it to anchor a Thread mesh covering the entire WanderVerse fleet.
The product thesis: a Matter-native dimmer that drops into any switch box without a neutral, dims modern LED loads cleanly, never phones home, logs every state change locally, and offers a covert duress-tap pattern for survivor scenarios where reaching for a phone is not safe.
---
2. Product family overview
| Tier | Device ID | Form factor | Hero feature | Retail | Ship target |
|---|
| **WanderSwitch Std (1-gang)** | `WV-SW-1G` | Single-gang Decora-compatible wall switch + dimmer paddle | UL 20 listed; Matter-over-Thread; no-neutral required; clean TRIAC dimming for LED loads; saffron paddle-edge accent + saffron LED level indicator | **$59** | 2027-Q3 |
| **WanderSwitch Pro (3-gang)** | `WV-SW-3G` | Triple-gang Decora-compatible — 1× dimmer + 2× paddle switches; hub-grade Thread border-router | Standard + dual on/off paddles + Thread border-router for household fleet anchor + dedicated Cree saffron LED level + status indicator strip | **$129** | 2027-Q4 |
Hero image alignment
The hero render shows a flush-mount in-wall switch with a Decora-compatible paddle face, anodized matte cream aluminum bezel + paddle, with:
- Saffron paddle-edge accent — a 1.5 mm anodized saffron pinstripe along the leading edge of the paddle (visible only when wall plate is removed at install + service; the wall plate covers the bezel pinstripe in normal operation, leaving only the saffron LED level indicator visible)
- Saffron LED level indicator strip — 8 LEDs vertically embedded in the leading paddle edge, showing dimmer level (0-100%) at all times via segment count; on/off paddles show only on (full saffron) or off (one dim "alive" pulse every 10s)
- NO exterior wordmark — no "WanderSwitch", no "WanderVerse", no logo on the paddle, bezel, or wall plate. Identity is internal-only (etched Ambassador signature inside the back box per Standard 1)
- Recessed micro-button for Test / pair / Thread-router-restart (single tactile input behind a removable wall-plate corner cover)
The paddle, bezel, and wall plate share matte cream anodized aluminum across the family — same finish as WanderCO + WanderAlert + WanderDash. The 3-gang Pro tier uses a single wide bezel that integrates the dimmer paddle on the left + two on/off paddles on the right, so the visual identity is "one device, three controls" rather than three separate switches.
Visual identity preserved across the family: matte cream anodized paddle + bezel (matches WanderCO + WanderAlert + WanderDash + Security Trio aluminum surface), saffron LED level/status indicator (family-wide), no exterior wordmark (per task spec hard rule), recessed test button accessible via wall-plate corner cover.
---
3. Why no neutral required (the headline architectural call)
US wall switch boxes built before ~1990 typically do not carry a neutral wire — the switch sits on the line side of the load, and there is no return path for a switch's onboard electronics to draw operating current. Modern smart switches solve this in one of three ways:
1. Require a neutral (Kasa, Lutron Maestro standard) — eliminates the install market for ~40% of US homes; they install but won't power up 2. Leak current through the bulb when "off" (older no-neutral switches) — causes LED bulbs to glow / flicker / chatter when the switch is off because they're not getting zero current 3. Line-scavenging topology with leakage capture + buck-boost storage (Lutron Caseta, Inovelli Blue, our path) — actively switches the AC line at zero-cross to harvest a few mA of operating current during the AC half-cycle that's not powering the load, stored in a small electrolytic + buck-boost feeding the MCU rail
Decision: WanderSwitch uses line-scavenging topology with the STMicro L9961 line-scavenging IC + STMicro T1235H TRIAC for the dimmer and standard zero-cross relay switching for the on/off paddles. The L9961 captures ~5-15 mA from the AC line at zero-cross, charges a 470 µF electrolytic, and feeds the TI TPS65086100 PMIC + nRF52840 MCU through the buck-boost rail (the PMIC handles voltage profile variance from line scavenging the same way it handles LiSOCl2 cell voltage variance in WanderCO).
Trade: line-scavenging draws a small "always-on" current from the line even when the switched load is off. This is invisible to the user (~0.3 W standby per switch) but is the price of no-neutral operation. Documented as the no-neutral compatibility envelope in §6 + COMPATIBILITY.md §C.
LED-load compatibility envelope:
- ≥ 25 W resistive load → all LED brands compatible (low-end dim works clean to 5%)
- 5-25 W LED load → most LED brands compatible (low-end dim 10-15%; some sub-5W bulbs may flicker at <20%)
- < 5 W LED load (single sub-5W bulb on a single switch) → known marginal case; install guide recommends adding a Lutron LUT-MLC or equivalent dummy load module (or a second LED bulb in parallel, raising load above 5 W threshold)
This envelope is validated empirically across Philips Hue / Cree / GE Reveal / Sylvania / Feit / IKEA Tradfri / Lutron LED-engineered bulbs at DVT (see _VALIDATION-AND-SENSOR-EXPANSION.md §B for the test matrix). No-neutral validation is a HARD GATE before customer ship.
---
4. Identity-aware operation
Per Standard 0 (survivor / identity-aware modes), WanderSwitch ships with three identity-aware features by default. None are marketed as "panic features" — they are presented as advanced options in the companion app.
4.1 Covert duress-tap pattern (3 quick taps = silent panic mesh broadcast)
- Trigger: 3 paddle taps within 2 seconds (hold-up tap pattern; not a normal "double tap" or "quick double-tap on/off" UX — distinct from any standard paddle interaction)
- Behavior: the switch performs the requested on/off/dim state change normally (visible to anyone in the room as a normal switch press) AND broadcasts a Level 2 mesh alert to the household WanderAlert Base Station + paired phones over Thread + LoRa via WanderAlert Bridge if present
- What gets broadcast: silent mesh-originated
duress_tap event with timestamp, switch serial, and (if WanderAlert is paired) trigger-WanderAlert-Pager-vibrate. NO local audible. NO local visual signal. Anyone watching the switch sees a normal paddle press.
- Why this design: in DV scenarios, reaching for a phone or shouting into a smart speaker is dangerous. A duress pattern on a switch the abuser doesn't know is "smart" is plausibly deniable.
- Default state: DISABLED. User must opt in via companion app + sign in-app risk acknowledgment + provide trust contact list. Survivor-pattern eligibility flag stored in NXP SE051 secure element role token at Ambassador assembly time (matches WanderCO D-CO-008 dual-confirmation pattern).
- Advisory review (Stage-10 RED gate): DV advocate panel (≥2 working DV advocates from HAVEN + national-DV-orgs) + LGBTQ+ DV survivor panel (≥2 willing to consult under NDA) + UL human-factors expert (≥1 — covert-mode framing review for in-wall life-safety-adjacent product). Veto rights apply to all external comms.
- Marketing language gate: NEVER mentioned in promotional copy or datasheet without survivor-advocate veto right. Documented in
DECISIONS.md D-SW-008 + GATE.md Stage-10 blocker #4.
4.2 Local audit log of every state change
Every paddle press, dimmer-level adjustment, app-originated state change, and Thread/Matter-network-originated state change is logged locally to NOR flash with timestamp + originator + new state + (if app/network) authenticated user identifier.
- Storage: rolling 90-day log (~5000 events) in encrypted partition (SE051 device key)
- Access: companion app or WanderNode Hub admin web UI (read-only by default; export-as-CSV for legal/DV-protective-order documentation)
- Why: in gaslighting / coercive control scenarios, "did the lights actually turn on at 2 AM" becomes evidence. Local audit log gives the household admin (the survivor, in opt-in scenarios) deterministic provenance independent of abuser claims.
- Privacy: log NEVER leaves the device unless explicitly exported by user. NO telemetry, NO cloud sync, NO analytics endpoint.
4.3 No light-pattern telemetry leaving the device
- WanderSwitch does NOT send dimming patterns / on-off cycles / occupancy-derived patterns to any remote endpoint
- WanderSwitch does NOT participate in any "smart-home insights" / "energy savings analytics" / "occupancy heatmap" data product
- Companion app shows on-device state only; aggregated views are local-only
- Matter network announces device on/off + dim level (per Matter binding spec) only to local Matter fabric peers — never to a vendor cloud
- This is a category-defining identity-aware position: the abuser's pattern-of-life inference (when do they leave for work? when do they arrive home? when do they sleep?) cannot be pulled from a WanderVerse switch fleet
---
5. Architecture
5.1 Family platform (shared across both tiers)
| Block | Part | Notes |
|---|
| MCU module | Nordic nRF52840 (Thread + BLE 5.3) | Reused from bridge_full + router_pro_v2 + router_standard per parts.db; chosen over ESP32-S3 for low-power Thread + RAM headroom for line-scavenging duty cycles |
| MCU alternate (Pro Thread router) | TI CC2652R7 (Thread + BLE 5.3) | Dual-source per parts.db; Pro tier may ship CC2652R7 in a Thread-border-router-favored revision once Nordic vs TI Thread stack maturity is confirmed at DVT |
| TRIAC (dimmer phase control) | STMicro T1235H | Snubberless TRIAC; 12 A / 600 V; standard residential dimmer power-stage choice |
| Line-scavenging IC | STMicro L9961 | Captures operating current from AC line; output regulated to TPS65086100 input rail |
| Zero-cross detector | STMicro VIPER22A or equivalent + opto-isolator MOC3023 | Zero-cross detection for clean phase-cutting at TRIAC gate |
| Saffron LED level indicator | Cree CLM3C-AKA (saffron) | Per parts.db: 8 LEDs vertical strip on dimmer paddle edge; reused from bridge_full + router_standard + WanderCO |
| LED driver | TI TPS92518 | Per parts.db: multi-channel PWM; reused from security_trio + WanderAlert + WanderCO |
| Secure element | NXP SE051 | Role token + survivor-pattern flag + audit-log encryption key + Matter device-attestation cert; reused from medical_tricorder_family + security_trio |
| Flash NOR | Macronix MX25R 8 MB | Audit log + Matter cluster state + OTA |
| PMIC | TI TPS65086100 | Per parts.db: multi-rail; handles line-scavenging variance (analogous to WanderCO LiSOCl2 voltage profile handling); reused from WanderAlert + WanderCO |
| Test button | Alps SKRH + custom recessed cap | Reused from WanderAlert + WanderCO |
| Tamper switch | Omron D2F-01F | Reused from WanderAlert + WanderCO |
| Thread/BLE antenna | via nRF52840 chip antenna | Internal — RF-clearance zone per Nordic ref design |
5.2 WanderSwitch Pro (3-gang) — additions
| Block | Part | Notes |
|---|
| Thread border-router | Same nRF52840 with border-router firmware role | Pro tier ships with Thread border-router enabled (Standard ships Thread end-device only); no extra silicon; firmware role + cert path |
| Additional paddles | 2× Decora-compatible paddle assemblies | Same paddle tooling as Standard; 2× tactile switches |
| Status LED | Cree CLM3C-AKA (saffron) | Per parts.db: extra LED strip on the 2-gang side; same Cree CLM3C-AKA part |
| Larger PCBA | 4-layer custom 75 × 60 mm | Standard is 4-layer 35 × 60 mm |
| Thread router-grade Flash NOR | Macronix MX25R 16 MB | Larger to support border-router routing tables + child-device cert cache |
5.3 What WanderSwitch does NOT have
- No display. Status communicated via saffron LED level/status indicator.
- No Wi-Fi. Matter-over-Thread only. Wi-Fi removes interop; Thread is the family standard at v1. (Decision D-SW-002.)
- No camera. Categorically out of scope.
- No microphone. Same — privacy + survivor-aware position.
- No occupancy sensor. Not in v1; v1.1 candidate via PIR daughter card if user research surfaces demand.
- No proprietary hub requirement. Works directly on any Matter-over-Thread fabric (Apple Home, Google Home, Amazon Alexa, Home Assistant, SmartThings, WanderNode Hub).
- No vendor cloud. Ever. Per identity-aware §4.3.
---
6. Compatibility envelope (LED loads + box geometry)
6.1 Switch box geometry
- US standard single-gang in-wall switch box (NEMA WD 6 or equivalent): 2.875 × 2.000 × 2.500 in (typical depth)
- WanderSwitch Std fits all standard 2.000 in deep boxes + most 1.500 in shallow boxes
- WanderSwitch Pro 3-gang requires a 3-gang switch box (5.625 × 2.000 × 2.500 in typical) — verifiable at install via included paper template
- Wall plate: standard Decora-compatible cutout
6.2 Load type compatibility (validated empirically at DVT)
| Load type | Standard | Pro |
|---|
| Incandescent / halogen ≤300 W | green | green |
| LED dimmable ≥25 W (resistive eq.) | green | green |
| LED dimmable 5-25 W | green (most brands) | green (most brands) |
| LED dimmable < 5 W single bulb | yellow — install guide recommends parallel bulb or Lutron LUT-MLC dummy load | yellow — same |
| CFL dimmable | yellow — most brands flicker; use LED instead | yellow — same |
| Resistive heater (non-motor load ≤1500 W) | green via on/off paddle (non-dimmer) | green |
| Motor / fan load (PSC motor only) | yellow — Pro on/off paddle only; not on dimmer | yellow |
| Universal (electronic low-voltage / magnetic low-voltage transformers) | yellow — most ELV/MLV transformers compatible; verify per manufacturer | yellow |
6.3 Three-way / four-way wiring
- WanderSwitch supports three-way + four-way wiring via virtual three-way (Matter binding to a companion WanderSwitch) instead of physical three-way
- Physical three-way (with traveler wire) is supported on Pro tier on/off paddles only (not on dimmer paddle); Standard is single-pole only
- Virtual three-way: any Matter-binding-compatible switch (Caseta Smart Hub Pro, Inovelli Blue, etc.) can be paired across the Matter fabric
---
7. 3-tier alert escalation (mapped to WanderAlert / WanderCO family)
WanderSwitch is not a primary life-safety device — it does not detect CO, smoke, or flood. But it participates in the WanderVerse mesh as a leaf node + (Pro) Thread border-router, and it can originate identity-aware alerts.
Level 1 — Advisory
- Local trigger: state change anomaly (e.g., switch state changes 5+ times in 60 seconds — common abuser-coercion pattern); audit log review event from companion app
- Audible: none
- Visual: saffron LED status pulse (slow 1 Hz on dimmer paddle indicator)
- Mesh: Level 1 advisory to WanderNode Hub admin web UI; no propagation
- Use case: household admin reviews audit log; pattern not necessarily threatening but flagged for awareness
Level 2 — Warning (covert duress-tap pattern)
- Local trigger: 3 paddle taps within 2 seconds
- Audible: none (covert)
- Visual: none on the WanderSwitch itself (covert; the switch performs requested state change normally)
- Mesh: Level 2 mesh alert to WanderAlert Base Station + paired phones (silent vibrate) + (if installed) WanderAlert Pager vibrate; no neighbor-cabin propagation by default
- Use case: survivor in DV scenario triggers silent panic; WanderAlert response policy decides next step (call trust contact, escalate to 911, etc.)
Level 3 — Service / safety
- Local trigger: firmware integrity failure; SE051 attestation failure; line-scavenging fault detected (over-current, over-temperature on TRIAC); cert-mode register tampered
- Audible: none (in-wall; no siren)
- Visual: saffron LED full strip slow pulse (1 Hz) + red overlay (single CLM3C-AKA red co-located)
- Mesh: Level 1 advisory + WanderNode Hub admin web UI fault flag
- Use case: unit needs Ambassador service; user instructed via companion app to physically replace per service flow
---
8. Compliance summary (per `COMPLIANCE.md`)
| Cert | Status | Notes |
|---|
| **UL 20 (general-use snap switches)** | red blocker | HARD GATE — required for sale; no waiver. Cert ~$25-40k per tier (bundled lab visit) |
| **UL 1472 (solid-state dimming controls)** | yellow | Required for dimmer SKU; bundled with UL 20 lab visit; ~$15-25k delta |
| **FCC Part 15 B (unintentional radiator)** | red blocker | TRIAC dimming generates wide-spectrum EMI; requires Class B compliance; ~$8-12k cert |
| **FCC Part 15 C (Thread + BLE 2.4 GHz intentional radiator)** | green | nRF52840 module passthrough + per-product re-cert |
| **CSA C22.2 No. 42 (Canadian general-use switch)** | yellow | Bundled with UL 20 lab |
| **EN 60669-1 (European household switch)** | yellow | Required for EU sale; bundled with CE RED |
| **EN 60669-2-1 (electronic switch / dimmer)** | yellow | Required for EU dimmer sale |
| **CE RED + UKCA** | green | Bundled with FCC + EN test data |
| **Matter cert (CSA / Matter Alliance)** | red blocker | Required for "Matter-certified" claim; ~$15-25k cert + per-product attestation; HARD GATE |
| **Thread certification** | yellow | Bundled with Matter cert path |
| **RoHS / REACH** | green | declared |
| **Bluetooth SIG** | green | BLE 5.3 |
Total cert v1: ~$80-130k (UL 20 + UL 1472 + FCC + CE + Matter + Thread + Bluetooth SIG, both tiers bundled).
---
9. Manufacturing + service summary
Ambassador assembly (Standard 1)
- Tier-1 for both WanderSwitch SKUs (assembly + UL self-test verification + Matter device-attestation programming + paddle alignment)
- Per-unit Ambassador time:
- Standard: ~10 min/unit (~45 units / 8-hr day)
- Pro: ~16 min/unit (~28 units)
- Ambassador signature: etched aluminum tag inside back box (per family standard); paired to unit serial in WanderOS
Per-unit production tests
- 22 tests per unit (see
DFM-DFA-DFT.md)
- Includes UL 20 contact-resistance test, UL 1472 dimming-curve verification across reference LED loads (Philips Hue White, Cree TW Series, GE Reveal LED, Sylvania Smart+, Feit Smart, IKEA Tradfri), TRIAC zero-cross alignment verification, EMI pre-scan, Matter device-attestation cert programming, secure-element role-token write, line-scavenging current verification at 5/15/30/60/100 W resistive load, audit-log encryption key roll
7-year parts (no battery reconciliation needed — line-powered)
- Spare paddles + bezels stocked through year 7
- Spare TRIAC + L9961 + nRF52840 modules stocked through year 7
- Year 8: STL + schematic + firmware-source release CC BY-SA 4.0 (STLs) / CC BY-NC-SA 4.0 (firmware)
Service plan (per `SERVICE-FLOW.md`)
- 2-year standard warranty + extended warranty options
- DIY: paddle replacement, wall-plate replacement, app re-pair
- Ambassador send-back: TRIAC swap, board-level replacement (chassis/paddle preserved), Matter device-attestation cert renewal
- Factory: full refurb if substantial repair
---
10. Revenue + social-impact integration
60/30/10 Community Pool flow (Standard 5)
Per canonical revenue split:
- 60% → Ambassador wages
- 10% → PrideFund (Ambassador HYSA)
- 30% → WWP Community Pool (Layer 1 ops ≤65%, Layer 2 Ambassador-voted ≥35%)
Donor-sponsored kits (HAVEN safehouse + LGBTQ-housing)
- Donor channel for DV-safehouse + LGBTQ-housing nonprofit + Title-I rural-housing sponsorship — covert duress-tap pattern is the headline survivor feature
- Match: WWP grant-matches up to 1:1 from Community Pool
- Eligibility: 501(c)(3) DV shelters + LGBTQ-housing nonprofits + Native youth housing + Tribal-enrolled rural housing programs
Grant-fundable
- HUD CDBG (Community Development Block Grant) — household electrical retrofit programs
- VAWA housing transition pools (DV-safehouse + LGBTQ-housing covert duress capability)
- State weatherization assistance (some include lighting controls)
---
11. Feature inventory (Stage 0 sweep)
Hardware features
- UL 20 listed (HARD GATE — no shipping without it)
- UL 1472 listed (dimmer SKU — HARD GATE)
- Matter-over-Thread certified (HARD GATE)
- No-neutral required (line-scavenging topology — STMicro L9961 + T1235H TRIAC)
- Saffron paddle-edge accent + saffron LED level/status indicator strip — family-wide visual standard
- NO exterior wordmark (per task spec hard rule; identity is internal-only — etched Ambassador tag)
- 3-gang Pro = 1 dimmer + 2 paddles + Thread border-router
- Recessed test/pair button (behind wall-plate corner cover)
- Identity-aware: covert duress-tap pattern (3 quick taps within 2s); local 90-day audit log; no light-pattern telemetry leaves device
- 7-year parts (line-powered; no battery reconciliation)
- Ambassador-assembled
- CC BY-SA 4.0 STLs (paddle, bezel cover, wall-plate alternates)
Software features
- Nordic nRF52840 + Thread 1.3 + Matter 1.3 stack on Zephyr
- STMicro T1235H TRIAC phase-cutting controller with zero-cross alignment + adaptive LED-load profiling
- Matter device-attestation cert provisioned at Ambassador assembly via SE051
- Companion app: state, dim level, schedule, audit log review, covert duress opt-in (with WWP-side review at order time)
- WanderNode Hub admin web UI (fleet management, audit log review, identity-aware policy)
- Secure-element role token enforcement (NXP SE051) — covert-mode-eligible flag, audit-log encryption key, Matter DAC private key
- OTA via Matter OTA cluster (signed images, A/B partitions)
- Mesh participation as WanderAlert leaf node (Pro tier; Thread border-router)
- Local audit log (90-day rolling, encrypted, never-exported)
Operational features
- Household single-switch + multi-switch deployment (default 1 per room with controllable lighting)
- Donor-sponsored DV-safehouse / LGBTQ-housing kits (covert duress capability)
- WanderAlert Bridge integration: Thread + LoRa cross-bridge for duress-tap propagation when WanderAlert Base Station is present
---
12. Risk register
| # | Risk | Severity | Mitigation |
|---|
| 1 | UL 20 + UL 1472 cert delays beyond 2027-Q2 | red | Lab booking 2026-Q4; reference unit ready EVT |
| 2 | No-neutral line-scavenging fails LED-load compatibility for sub-5W LEDs | red | Validated empirically across 8 LED brands at DVT; install guide documents <5W edge case + LUT-MLC workaround |
| 3 | TRIAC EMI exceeds FCC Part 15 Class B | red | Snubber + ferrite + careful PCB layout per `THERMAL-EMC.md`; pre-scan at EVT; respin path budgeted |
| 4 | Covert duress-tap pattern rejected by survivor advisory | red | DV-advocate + LGBTQ+ DV-survivor + UL human-factors panel veto rights pre-EVT |
| 5 | Matter cert delay (CSA / Matter Alliance throughput) | yellow | Engage early 2026-Q4; allow 6-month cert window |
| 6 | Nordic nRF52840 supply | yellow | TI CC2652R7 dual-source qualified at DVT (per parts.db) |
| 7 | STMicro L9961 single-source for line scavenging | yellow | Alternate: discrete line-scavenging topology with custom controller (board respin if needed) |
| 8 | Engineering hire timeline slips | red | Shared EE/FW pool with WanderAlert + WanderCO + Security Trio |
| 9 | Thread border-router (Pro tier) interop with non-Apple/non-Google fabrics | yellow | Test against Apple Home + Google Home + Amazon Alexa + Home Assistant + SmartThings + WanderNode Hub at DVT |
| 10 | Identity-aware audit log subpoena risk in adversarial DV scenarios | yellow | Audit log encrypted with SE051 device key; export requires user consent; legal counsel review of subpoena response policy |
---
13. Conflict register
Resolved per DECISIONS.md D-SW-001 through D-SW-010. Key conflicts:
- D-SW-001: No-neutral required vs WanderVerse "always reliable" hardware standard — RESOLVED via line-scavenging topology with empirically-validated LED-load compatibility envelope; <5W edge case documented in install guide
- D-SW-002: Matter-over-Thread only (NO Wi-Fi) — explicit non-feature; documented for product positioning
- D-SW-005: STMicro T1235H TRIAC + L9961 line-scavenging IC — NEW for parts library; added at this spec session
- D-SW-008: Covert duress-tap pattern — controversial in a UL-listed product; advisory-panel-gated; opt-in only; WWP-side eligibility review
- D-SW-010: No exterior wordmark — explicit identity choice; differentiates from Lutron Caseta + Kasa + GE Cync (all of which display vendor logo on the wall plate or paddle)
No software conflicts with existing WanderVerse specs.
---
14. Marketing language gate
Words we DO use:
- "UL 20 + UL 1472 listed in-wall dimmer + paddle switch"
- "Matter-over-Thread certified"
- "No-neutral required (drops into pre-1990 switch boxes without rewiring)"
- "Local audit log; no light-pattern telemetry leaves your device"
- "Saffron paddle-edge accent + saffron LED level indicator (no exterior wordmark)"
- "Drop-in replacement for Lutron Caseta + Kasa Wi-Fi switches"
Words we do NOT use (per task spec hard rules):
- "next-generation", "comprehensive", "comprehensive", "sub-60-second", "proven", "significant"
- "Smarter than Lutron Caseta" — comparative claims need substantiation + invite reverse claims
- "Panic switch" — covert duress-tap is opt-in; never a marketed headline; survivor-advocate veto right
- "Spy switch" / "stealth switch" — explicitly NOT positioned as surveillance
- "Replaces your fire-alarm-control-panel" — out of scope
- "AI-powered dimming" — TRIAC dimming is deterministic; no LLM in the dimming loop
---
15. Ship discipline
- v1.0 launch: 2027-Q3 Standard → 2027-Q4 Pro — both gated by UL 20 + UL 1472 + Matter cert + advisory review
- v1.1 (3 months post-ship): companion app feature depth; first survivor-user-feedback integration; voice-pack expansion (English baseline → Spanish v1.0; expansion v1.1+); WanderNode Hub fleet-rule policy expansion
- v1.2 (6 months post-ship): PIR occupancy daughter card evaluation; 4-gang Mega Pro tier (4-channel dimmer for media-room scenarios); Matter Bridge to Z-Wave / Zigbee fabrics if user demand warrants
- v2 (2028-2029, conditional): Wi-Fi 6 backup interface for households without Thread infrastructure; integrated occupancy + ambient-light sensing; UL 1472 Class 2 (low-voltage transformer dimming) for ELV/MLV outdoor lighting
---
16. Ambassador + Community Pool integration
(verbatim from _TEMPLATES/_community-pool.md + _ambassador-signature.md + _seven-year-parts.md):
How the money flows
Every sale of a WanderSwitch SKU is divided three ways:
- 60% pays the Ambassador who assembled the unit — a living wage for skilled hardware-assembly work
- 10% seeds PrideFund — community-held HYSA accruing for Ambassador-voted initiatives
- 30% funds the WWP Community Pool — the 501(c)(3) nonprofit. Subject to 65/35 charter rule (Layer 1 ops ≤65%; Layer 2 Ambassador-voted ≥35%)
Ambassador signature mark
Every WanderSwitch unit carries an etched aluminum tag inside the back box (visible only at install + service):
- Ambassador ID (pseudo-random alphanumeric)
- Assembly date
- Unit serial number
- UL 20 + UL 1472 + Matter cert reference
- Firmware revision at first ship
At any board-level service event, a second signature is added beneath the first. Provenance accumulates.
Seven-year parts (no battery reconciliation needed — line-powered)
Every spare part for WanderSwitch is available for 7 years from generation EOL, via Ambassador network, at cost + 10%. Year 8: every manufacturing file is published (STLs CC BY-SA 4.0; firmware source CC BY-NC-SA 4.0; schematics + assembly instructions).
What "parts" includes:
- Mechanical (paddle, bezel, wall plate, back box clip, recessed button cap)
- All sub-boards + modules (TRIAC + L9961 line-scavenging board, MCU board, sensor PCBA)
- Saffron LED strip replacements (Cree CLM3C-AKA spares)
What "parts" does NOT include:
- Standard fasteners (M3 screws — sourceable from any aftermarket)
- Wall plate-mount Decora screws (industry-standard)
---
This spec is the source of truth for the WanderSwitch family. Companion docs (DECISIONS.md, BOM-platform.csv, BOM-modules.csv, BOM-normalized.csv, CONFIGURATOR.md, COMPATIBILITY.md, SOURCING.csv, DFM-DFA-DFT.md, THERMAL-EMC.md, COMPLIANCE.md, GUIDE.md, HW-FW.md, SERVICE-FLOW.md, GATE.md, STL-OPEN-FILES/README.md, _VALIDATION-AND-SENSOR-EXPANSION.md, _COMPETITIVE-AUDIT-2026-04-25.md, _MANIFEST.md) elaborate; this spec governs.