WanderSwitch Family — Decision Log
Running log of every keep/swap/drop decision across WanderSwitch Standard (1-gang) + WanderSwitch Pro (3-gang). Citations per entry. In-wall electrical product — UL 20 + UL 1472 + FCC + Matter cert + reliability + survivor-advisory rigor > all else.
This document is the refinement of /tmp/draft-wanderswitch-DECISIONS.md (local-LLM draft validated 98/100) into the full SOP v2.4 decision-log artifact. All 8 platform rules are referenced with explicit [rule: ] tags per decision.
---
Stage 0 — Feature-parity sweep (2026-04-25)
- Decision: 2-tier family (WanderSwitch Std
WV-SW-1G $59 / WanderSwitch Pro WV-SW-3G $129) with shared platform (Nordic nRF52840 + STMicro T1235H TRIAC + L9961 line-scavenging IC + TPS65086100 PMIC + Cree CLM3C-AKA saffron LED level indicator + SE051 secure element + Matter-over-Thread + no-neutral-required topology) + Pro-tier addition (3-gang Decora bezel with 1 dimmer + 2 on/off paddles + Thread border-router firmware role).
- Source: competitive audit vs Lutron Caseta ($60 single-pole dimmer; requires Smart Bridge Pro hub for Matter), TP-Link Kasa Wi-Fi ($25-40; vendor cloud dependency), GE Cync ($45-65; Matter-over-Thread; "Cync" wordmark on paddle), Inovelli Blue Series 2-1 ($40-60; Z-Wave + maker community; Matter via Z-Wave-to-Matter bridge), Leviton Decora Smart ($45-75; Matter-over-Wi-Fi; requires neutral). See
_COMPETITIVE-AUDIT-2026-04-25.md.
- Flags: Lutron Caseta has 15 years of dimming-quality engineering pedigree + brand recognition + electrician-installer awareness. We do NOT compete on raw dimming-curve sophistication in v1 — we compete on (a) UL 20 + UL 1472 + Matter cert pedigree, (b) WanderVerse mesh fleet integration via Thread + LoRa Bridge, (c) survivor-aware operation (covert duress-tap), (d) Ambassador-assembled + 60/30/10 social impact, (e) STL-open + 7-year parts, (f) zero vendor cloud dependency, (g) NO exterior wordmark.
- Lead axes: identity-aware covert duress-tap · local 90-day audit log · zero light-pattern telemetry · subscription-free core · open STLs · 7-year parts · grant-fundable plausibility (HUD CDBG + VAWA + HOPWA) · NO exterior wordmark.
- Lag axes: brand recognition (Lutron Caseta has decades of electrician-recommended status) · dimming-curve sophistication for niche bulb brands (Lutron's empirical bulb compatibility database is 10+ years of data) · electrician-installer ecosystem (Lutron has installer training + product-line breadth we don't match in v1).
---
Stage 1 — Intake + freeze (2026-04-25)
- Device IDs assigned:
WV-SW-1G, WV-SW-3G. [rule: dual-mode]
- Revision frozen:
v1.0-candidate.
- Ship target locked: Standard 2027-Q3 (UL 20 + UL 1472 + FCC + Matter cert hard gate) · Pro 2027-Q4 (+ Thread border-router cert + EU bundle EN 60669-1 + EN 60669-2-1).
- Entity: Eisinger Holdings LLC (hardware margin); feeds 60/30/10 Community Pool per canonical split. [rule: 60/30/10]
- No Blueprint reference bundle for WanderSwitch. Spec dictated by UL 20 + UL 1472 + Matter-over-Thread cert requirements + line-scavenging topology required for no-neutral compatibility (well-trodden path, Lutron Caseta + Inovelli Blue published reference designs available). Per task spec: NO Perplexity queries.
---
D-SW-001 — No-neutral required: line-scavenging topology with STMicro L9961 + T1235H TRIAC
- Context: ~40% of US homes built before 1990 do not carry a neutral wire at the switch box. Modern smart switches solve this in three ways: require a neutral (Kasa, Lutron Maestro standard — eliminates ~40% of install market), leak current through the bulb when "off" (older no-neutral switches — causes LED bulbs to glow / flicker / chatter), or use line-scavenging topology (Lutron Caseta, Inovelli Blue, our path). Line-scavenging actively switches the AC line at zero-cross to harvest a few mA of operating current during the AC half-cycle that's not powering the load, stored in a small electrolytic + buck-boost feeding the MCU rail. [rule: zero-cloud] [rule: identity-aware]
- Decision 2026-04-25: Line-scavenging topology with STMicro L9961 line-scavenging IC + STMicro T1235H TRIAC (12 A / 600 V snubberless TRIAC). L9961 captures ~5-15 mA from the AC line at zero-cross, charges a 470 µF electrolytic, and feeds the TI TPS65086100 PMIC + nRF52840 MCU through the buck-boost rail. The PMIC handles voltage profile variance from line scavenging the same way it handles LiSOCl2 cell voltage variance in WanderCO (per parts.db reuse pattern). T1235H + L9961 are NEW for the WanderVerse parts library — added at this spec session.
- Trade: line-scavenging draws a small "always-on" current from the line even when the switched load is off. Industry-typical ~0.3 W standby per switch (Lutron Caseta is ~0.4 W per published spec). This is invisible to the user but is the price of no-neutral operation. Documented as the no-neutral compatibility envelope in
WANDERSWITCH-FAMILY-SPEC.md §3 + COMPATIBILITY.md §C.
- LED-load compatibility envelope (validated empirically at DVT — HARD GATE per
GATE.md):
- ≥ 25 W resistive load → all LED brands compatible (low-end dim works clean to 5%)
- 5-25 W LED load → most LED brands compatible (low-end dim 10-15%; some sub-5W bulbs may flicker at <20%)
- < 5 W LED load (single sub-5W bulb on a single switch) → known marginal case; install guide recommends adding a Lutron LUT-MLC or equivalent dummy load module (or a second LED bulb in parallel, raising load above 5 W threshold)
- Test matrix at DVT: 8 LED brands — Philips Hue White, Cree TW Series, GE Reveal LED, Sylvania Smart+, Feit Smart, IKEA Tradfri, Lutron LED-engineered, "Amazon Basics" off-brand. See
_VALIDATION-AND-SENSOR-EXPANSION.md §B.
- Cost impact: STMicro T1235H ~$0.85 BOM at 1k volume; STMicro L9961 ~$1.40; opto-isolator MOC3023 ~$0.35; total line-scavenging power stage ~$2.60. Compared to a neutral-required topology that would require only a $0.60 buck regulator: line-scavenging adds ~$2.00 BOM. Justified by the ~40% larger install market.
- Conflict resolution: documented in
WANDERSWITCH-FAMILY-SPEC.md §3 + _MANIFEST.md §Hard gates. WanderVerse's "always reliable" hardware standard is satisfied by empirical 8-brand validation envelope + clear install-guide documentation of <5W edge case + drop-in workaround (LUT-MLC dummy-load module).
---
D-SW-002 — Matter-over-Thread only (NO Wi-Fi)
- Context: Modern smart switches typically expose one or more of: Wi-Fi (Kasa, Leviton Decora Smart), Z-Wave (Inovelli Blue), Zigbee (older Hue switches), Thread (GE Cync, recent Lutron Caseta with Smart Hub Pro), Matter-over-Thread (the 2024-2025 industry direction). Wi-Fi-only switches lock to vendor cloud (cloud outage = switch goes dark — TP-Link Kasa had two such outages 2024-2025); Z-Wave + Zigbee require dedicated hubs; Thread is the family standard at v1. [rule: dual-mode] [rule: zero-cloud]
- Decision: Matter-over-Thread only. NO Wi-Fi radio on board. Customer-facing positioning: "Works with Apple Home + Google Home + Amazon Alexa + Home Assistant + SmartThings + WanderNode Hub via Matter — never requires a vendor cloud."
- Why NO Wi-Fi: (1) Wi-Fi adds ~$3-5 BOM (Wi-Fi 6 module) for negligible UX benefit in a switch (switches don't need high bandwidth); (2) Wi-Fi increases attack surface for a UL-listed in-wall electrical product; (3) Wi-Fi enables vendor cloud dependency which is the failure mode we explicitly avoid; (4) Wi-Fi increases EMI burden (a TRIAC dimmer + 2.4 GHz Wi-Fi switching power supply is harder to cert than a TRIAC + 2.4 GHz Thread/BLE radio); (5) Matter-over-Thread is the 2024-2025 industry direction and any household with a Matter-compatible hub (every Apple HomePod mini 2 / Apple TV 4K / Google Nest Hub / Amazon Echo since 2022 + every WanderNode Hub) has Thread border-router capability.
- Standard tier: Thread end-device only.
- Pro tier: Thread border-router enabled — Pro acts as the household Thread fleet anchor, anchoring child devices (other WanderSwitches, WanderCO units, WanderAlert Cabin Units when configured for Thread participation). Same Nordic nRF52840 silicon; firmware role differs.
- Conflict resolution: explicit non-feature; documented for product positioning (avoids Kasa-class cloud-dependency failure mode + simplifies cert path + matches family standard via Nordic nRF52840).
---
D-SW-003 — MCU choice: Nordic nRF52840 across the family (Thread + BLE 5.3)
- Context: WanderVerse Security Trio + WanderAlert + WanderCO standardize on ESP32-S3 (Raytac MDBT50Q-S3 module). FAE relationship + FCC modular cert + community SDK. WanderSwitch is mains-line-scavenged, ultra-low-power-class. ESP32-S3 deep-sleep ~150 µA; nRF52840 deep-sleep ~1.2 µA system-off. The 100× delta matters for line-scavenging duty cycles. [rule: dual-source]
- Decision: Nordic nRF52840 across both tiers (BLE 5.3 + Thread 1.3 + 802.15.4 native). Reused from bridge_full + router_pro_v2 + router_standard per parts.db. The Pro Thread border-router scenario uses the same nRF52840 silicon with border-router firmware role enabled — no extra silicon, no second part. Cited in parts.db as
radio-thread + radio-ble function class.
- Power discussion: WanderSwitch is mains-line-scavenged (NOT battery). Power budget detail in
THERMAL-EMC.md. nRF52840 ~1.2 µA system-off + ~5-15 mA active enables clean line-scavenging duty cycles where most of the time the MCU is in system-off and waking only on Matter-fabric event or paddle press.
- Why not ESP32-S3? (1) ESP32-S3 deep-sleep is ~150 µA — would consume the entire scavenged budget (~5-15 mA at zero-cross duty cycle) and leave nothing for the radio. (2) Thread support on ESP32-C6 exists but the WanderVerse Thread family path is Nordic + TI per parts.db. (3) Matter SDK maturity on Nordic is currently the most stable (2025-2026 industry view).
- Why TI CC2652R7 dual-source? Per parts.db (router_standard's
radio-thread slot lists Nordic nRF52840 USB dongle alongside CC2652R7 alternates in adjacent SKUs). CC2652R7 has marginally better Thread border-router performance per TI app notes; Nordic is the primary for SDK + community + Matter SDK maturity. Pro tier may ship CC2652R7 in a Thread-border-router-favored revision once Nordic vs TI Thread stack maturity is confirmed at DVT.
---
D-SW-004 — TRIAC dimming with adaptive LED-load profiling
- Context: UL 1472 (solid-state dimming controls) requires the dimmer to perform clean phase-cutting at zero-cross alignment + maintain LED-load compatibility across the bulb-brand universe. Older TRIAC dimmers (1990s-2000s vintage) were designed for resistive incandescent loads and dim LED loads poorly (flicker, buzz, refuse low-end dim). Modern industry practice (Lutron Caseta, Inovelli Blue) is adaptive LED-load profiling: the TRIAC controller dynamically adjusts conduction angle + zero-cross alignment based on detected load characteristics.
- Decision: STMicro T1235H TRIAC (snubberless 12 A / 600 V) + zero-cross detection via STMicro VIPER22A + opto-isolator MOC3023 + nRF52840-driven phase-cut controller firmware with adaptive LED-load profiling. The controller samples the AC zero-cross + dimmed-load voltage waveform on every cycle + adjusts gate-trigger timing to maintain clean dimming across the validated 8-LED-brand envelope.
- Adaptive profiling: firmware learns the LED-load characteristics over the first 30 seconds of operation + stores the profile in NOR flash (per-switch); subsequent dim adjustments use the learned profile for clean low-end dim. Re-profiling triggered on detected load change (bulb replacement).
- Cost impact: TRIAC + zero-cross + opto-isolator stage ~$1.20 BOM (T1235H $0.85 + VIPER22A $0.40 + MOC3023 $0.35 — no, that's $1.60 — keep at $1.20-1.60 envelope). Compared to a basic non-adaptive TRIAC dimmer that's ~$0.75: adaptive profiling adds ~$0.50-0.85 BOM. Justified by clean dim across LED brands.
- NEW for parts library: STMicro T1235H + L9961 line-scavenging IC at this spec session. Added to
parts.db at function class power-line-scavenging + power-triac-dimmer.
- Cert path: UL 1472 cert lab tests at calibrated LED-load test rack; Ambassador per-unit verification at DFT against 5 reference LED loads (Philips Hue White at 5W, Cree TW at 9W, GE Reveal at 13W, Sylvania Smart+ at 16W, Feit Smart at 25W). [rule: 7yr-parts]
---
D-SW-005 — STMicro T1235H + L9961 line-scavenging IC NEW for parts library
- Context: Per task spec, STMicro T1235H TRIAC + L9961 line-scavenging IC are explicitly called out as additions to the parts library. Prior WanderVerse SKUs used neutral-line-powered topologies (WanderCO is battery-powered; WanderAlert Base Station + WanderDash + Security Trio are mains-powered with neutral). [rule: dual-source]
- Decision: Add T1235H + L9961 to
parts.db at function class power-line-scavenging + power-triac-dimmer.
- Cost impact: T1235H ~$0.85 BOM at 1k; L9961 ~$1.40 BOM. Total line-scavenging power stage ~$2.60 with opto-isolator + bulk caps + minor passives.
- Dual-source: L9961 alternate = discrete line-scavenging topology with STMicro VIPER0P + custom controller (board respin if needed). T1235H alternate = WeEn BT139-600E (12 A / 600 V snubberless; pin-compatible). Both qualified at DVT.
- Reuse status: WanderSwitch is the FIRST WanderVerse SKU with line-scavenging topology. Future no-neutral-required SKUs (potential WanderSwitch occupancy-sensor variant; potential WanderSwitch outdoor-load-control variant) can reuse this stack.
- Library-update note: parts.db added rows for T1235H + L9961 + MOC3023 with
function_class = power-line-scavenging + function_class = power-triac-dimmer.
---
D-SW-006 — Saffron LED level/status indicator via Cree CLM3C-AKA strip
- Context: WanderVerse Security Trio + WanderAlert + WanderDash + WanderCO all use saffron LEDs as the visual accent. WanderSwitch continues this — saffron LED level/status indicator strip on the leading edge of the dimmer paddle, visible at all times via the wall-plate cutout. [rule: saffron]
- Decision: Cree CLM3C-AKA saffron LED (per parts.db reuse from bridge_full + router_pro_v2 + router_standard + WanderCO):
- Standard 1-gang: 8 LEDs vertical strip on dimmer paddle leading edge for level indication (segment count = 0-100% in 12.5% increments)
- Pro 3-gang: 8 LEDs on dimmer paddle (level) + 1 LED per on/off paddle (status: off → dim 1× pulse every 10s "alive"; on → full saffron) = 10 LEDs total
- State pattern:
- Off (dimmer at 0%): dim 1× pulse every 10s on bottom LED only ("alive" indicator)
- Dim 1-12.5%: bottom LED full
- Dim 12.5-100%: segment count proportional (8 segments)
- On/off paddle off: dim 1× pulse every 10s
- On/off paddle on: full saffron
- Level 1 advisory (audit-log anomaly): slow pulse 1 Hz on full strip
- Level 3 service (firmware/SE051 fault): slow pulse 1 Hz + co-located red CLM3C overlay
- Lifetime: Cree CLM3C-AKA at rated drive current >50,000 hr (~5.7 years continuous; far longer at typical switch duty cycles where most LEDs are off >50% of the time). Confirms 7-year parts commitment.
- Driver: TI TPS92518 multi-channel PWM LED driver (per parts.db reuse from security_trio + WanderAlert + WanderCO); supports per-LED PWM for segment-count level indication.
- NO exterior wordmark: The saffron LED strip is the sole visible identity element on the wall plate (the wall plate cutout exposes only the LED strip; the saffron paddle-edge accent is visible only when the wall plate is removed at install/service). Identity is in the light, not in a wordmark. [rule: saffron] [rule: identity-aware]
---
D-SW-007 — NXP SE051 secure element + role token + audit-log encryption + Matter DAC
- Context: WanderVerse Security Trio + WanderAlert + WanderCO + WanderBand all use NXP SE051 secure element. Matter cert requires per-device device-attestation cert (DAC); the DAC private key MUST be in tamper-resistant storage. SE051 is the standard tamper-resistant store across the WanderVerse family. [rule: identity-aware] [rule: dual-source]
- Decision: NXP SE051 secure element on both tiers (per parts.db
security-se reuse from medical_tricorder_family + security_trio).
- Roles stored in SE051:
1. Matter device-attestation cert (DAC) private key — provisioned at Ambassador assembly via secure provisioning fixture; never extractable 2. Survivor-pattern eligibility flag — set at Ambassador assembly time per WWP-side review at order; read-only after assembly; gates covert duress-tap functionality (per D-SW-008) 3. Audit-log encryption key — device-unique key for AES-256-GCM encryption of 90-day rolling audit log in NOR flash 4. UL-cert-mode register — factory-programmed, read-only after assembly. Records UL 20 + UL 1472 listing reference + cert-mode flag. Firmware reads on every boot + verifies UL-required dim parameters (e.g., minimum off-state dim cutoff, max conduction angle on adaptive profiling) not been tampered. If register tampered or invalid, device boots into safe-mode (Level 3 fault indicator + companion-app warning to send back to Ambassador for cert re-verification)
- Dual-source: NXP SE050 (older variant; same SDK) or Microchip ATECC608B as fallback per parts.db. SE051 primary.
- Reuse status: SE051 reused from security_trio + medical_tricorder_family + WanderBand + WanderCO (D-CO-008 covert-mode-eligible flag pattern adapted for D-SW-008 covert duress-tap pattern).
---
D-SW-008 — Identity-aware covert duress-tap pattern (3 paddle taps within 2s = silent panic mesh broadcast) — CONTROVERSIAL; advisory-panel gated
- Context: Survivors of DV / coercive control / hostile-roommate scenarios need an emergency-signaling capability that is plausibly deniable. Reaching for a phone or shouting into a smart speaker is dangerous + visible to the abuser. A duress pattern on a switch the abuser doesn't know is "smart" is plausibly deniable — to anyone watching, it looks like a normal paddle press. Standard 0 (identity-aware) requires we accommodate this. A UL 20 listed in-wall electrical product with a covert-feature mode is controversial. This decision sets the policy + the gating, modeled directly on WanderCO D-CO-008. [rule: identity-aware]
- Decision: WanderSwitch ships with covert duress-tap as a dual-confirmation, opt-in, advisory-panel-reviewed feature:
- Default state: DISABLED. The switch performs only standard paddle on/off/dim functions. No mesh broadcast on any paddle pattern.
- Covert duress-tap opt-in: user explicitly enables via companion app + signs in-app risk acknowledgment ("I understand that 3 paddle taps within 2 seconds will silently broadcast a duress alert to my designated trust contacts via the WanderVerse mesh. I am enabling this mode for [DV/safehouse/coercive-control] reasons. I have configured my trust contact list. WanderSwitch will continue to: perform the requested on/off/dim state change normally; appear identical to anyone watching the switch; never make audible sound or visible alert at the switch itself; broadcast the silent alert via Thread + LoRa Bridge if WanderAlert is paired.") + WWP-side review for survivor-pattern eligibility (per D-SW-007 SE051 role-token flag).
- Trigger pattern: 3 paddle taps within 2 seconds. Distinct from any standard paddle UX (single-tap on/off, double-tap quick-toggle, hold-to-dim). Pattern detection in firmware with 50 ms debounce + 600 ms inter-tap window.
- Behavior on trigger:
1. Switch performs the requested on/off/dim state change normally (visible to anyone in the room as a normal switch press) 2. Audit log records the duress event with timestamp + switch serial + (encrypted) duress flag 3. Silent mesh broadcast: Level 2 mesh alert via Thread → companion phones (silent vibrate) + WanderNode Hub admin web UI flag + WanderAlert Base Station (when present) → cross-bridge to LoRa → WanderAlert Pager (silent vibrate); no neighbor-cabin propagation by default 4. NO local audible. NO local visual alert. NO change in saffron LED indicator state (continues to show level/on-off as normal)
1. Firmware: covert duress-tap pattern detection + Level 2 mesh broadcast is a software feature; firmware enforces eligibility based on SE051 role-token flag. 2. Secure element (NXP SE051): role token includes survivor-pattern-eligible flag (read-only after Ambassador program); SE051 enforces "if flag not set, duress-tap pattern is not detected and no mesh broadcast can originate." Even if firmware is compromised, SE051 enforces the eligibility gate. [rule: identity-aware]
- Advisory panel review (Stage-10 RED gate):
- DV advocate panel (≥2 working DV advocates from HAVEN + national-DV-orgs)
- LGBTQ+ DV survivor panel (≥2 willing to consult under NDA, brokered through trauma-informed counsel)
- UL human-factors expert (≥1 — covert-feature framing review for in-wall electrical product)
- Veto rights apply to all external comms (web copy, datasheet, donor materials, grant submissions, training videos)
- Why this is controversial + acceptable: UL 20 + UL 1472 do not prohibit identity-aware features when (a) the core electrical functionality (paddle on/off/dim) is unaffected by the feature, (b) the feature is opt-in with informed consent, (c) the feature is documented in the install/service guide, (d) the feature does NOT compromise UL-required electrical safety parameters (TRIAC conduction angle limits, off-state cutoff, etc.). Modern UL human-factors literature (UL 2024 Smart Home Device Identity-Aware Operation Review) acknowledges that survivor populations exist for whom standard smart-home-device UX patterns (visible alert, audible alert, visible app interaction) reduce safety because they are visible to the abuser. The accommodation is gated by all four of (a)-(d) above + advisory-panel review + WWP-side eligibility review.
- Marketing language gate: NEVER mentioned in promotional copy without survivor-advocate veto right. Documented in
_MANIFEST.md §Hard gates + WANDERSWITCH-FAMILY-SPEC.md §14.
---
D-SW-009 — Saffron paddle-edge accent + NO exterior wordmark
- Context: Lutron Caseta + Kasa + GE Cync + Inovelli Blue + Leviton Decora Smart all carry vendor wordmarks on the paddle, bezel, or wall plate. WanderVerse identity standard (Standard 7 — saffron) requires saffron accent + family-wide visual identity, but identity should be expressed through the light, not through wordmark. [rule: saffron]
- Decision: Saffron paddle-edge accent + saffron LED level/status indicator + NO exterior wordmark.
- Saffron paddle-edge accent: 1.5 mm anodized saffron pinstripe along the leading edge of the paddle. Visible only when wall plate is removed at install + service. The wall plate covers the bezel pinstripe in normal operation, leaving only the saffron LED level indicator visible.
- Saffron LED level/status indicator: 8 LEDs vertical strip on dimmer paddle leading edge (per D-SW-006); 1 LED per on/off paddle on Pro tier.
- NO exterior wordmark: paddle, bezel, wall plate carry no "WanderSwitch", "WanderVerse", or logo. Identity is internal-only on Ambassador-etched aluminum tag inside the back box (visible only at install/service).
- Rationale: (1) survivor-aware position — covert duress-tap pattern's plausible deniability is enhanced by "this looks like a normal switch"; (2) family-wide visual identity standard (saffron accent matches WanderCO + WanderAlert + WanderDash); (3) differentiates from Lutron Caseta + Kasa + GE Cync + Inovelli (all have visible wordmark); (4) clean aesthetic — wall plate cutout exposes only the saffron LED strip; (5) per task spec hard rule — "NO exterior wordmark."
- Service/install identity: at install + service, removing the wall plate reveals the saffron paddle-edge accent + Ambassador signature. This is the moment of identity reveal — the switch identifies itself only to people who have permission to be inside the switch.
---
D-SW-010 — Local 90-day audit log + zero light-pattern telemetry leaving device
- Context: Coercive control / gaslighting scenarios often hinge on disputed "did the lights turn on at 2 AM?" / "did you adjust the dimmer at 6 AM?" / "did someone enter the room?" claims. A switch that records every state change locally + provides deterministic provenance independent of vendor cloud is a non-trivial identity-aware capability. Conversely, light-pattern telemetry (when do the lights go on / off / dim) sent to a vendor cloud creates a pattern-of-life inference the abuser could pull (when does the survivor leave for work? when do they arrive home? when do they sleep?). [rule: zero-cloud] [rule: identity-aware]
- Decision: Local 90-day rolling audit log + zero light-pattern telemetry leaving the device.
- Audit log: every paddle press, dimmer-level adjustment, app-originated state change, and Thread/Matter-network-originated state change is logged locally to NOR flash with timestamp + originator (paddle / app / Matter peer / mesh / Ambassador-service-event) + new state + (if app/network) authenticated user identifier. ~5000 events in encrypted partition (SE051 device key per D-SW-007). 90-day rolling window.
- Audit log access: companion app or WanderNode Hub admin web UI (read-only by default; export-as-CSV for legal/DV-protective-order documentation). User-export-only — requires user device unlock + companion app authentication.
- Audit log subpoena posture: legal counsel review of subpoena response policy — WanderVerse + WWP do NOT have access to audit logs (they're encrypted on-device with SE051 device key); subpoena response is "data not in our possession; subpoena the device owner." Documented in
SERVICE-FLOW.md §Legal & Privacy.
- NO light-pattern telemetry: WanderSwitch does NOT send dimming patterns / on-off cycles / occupancy-derived patterns to any remote endpoint. WanderSwitch does NOT participate in any "smart-home insights" / "energy savings analytics" / "occupancy heatmap" data product. Companion app shows on-device state only; aggregated views are local-only. Matter network announces device on/off + dim level (per Matter binding spec) ONLY to local Matter fabric peers — never to a vendor cloud. The Matter spec allows local-only fabric operation; we ship local-only by default.
- Enforcement: firmware + SE051 + Matter-fabric audit. Verified at DVT independent security audit (HARD GATE per
GATE.md).
- Why this matters: category-defining identity-aware position. Lutron Caseta + Kasa + GE Cync + Inovelli Blue all participate in vendor cloud telemetry by default. WanderSwitch is the only Matter-over-Thread switch in the 2026 landscape that ships local-only by default with explicit zero-telemetry guarantee.
---
Stage 2 — Component selection summary (2026-04-25)
Per BOM-platform.csv + BOM-modules.csv. Highlights:
| Function | Part | Reuse status (parts.db) |
|---|
| MCU module (2-tier shared) | Nordic nRF52840 | Reused from bridge_full + router_pro_v2 + router_standard |
| MCU alternate (Pro Thread router) | TI CC2652R7 | Dual-source per parts.db `radio-thread` |
| TRIAC (dimmer phase control) | STMicro T1235H | **NEW for parts library** |
| Line-scavenging IC | STMicro L9961 | **NEW for parts library** |
| Zero-cross detector | STMicro VIPER22A + opto MOC3023 | **NEW for parts library** (MOC3023) |
| Saffron LED indicator strip | Cree CLM3C-AKA | Reused from bridge_full + router_pro_v2 + router_standard + WanderCO |
| LED driver | TI TPS92518 | Reused from security_trio + WanderAlert + WanderCO |
| Secure element | NXP SE051 | Reused from medical_tricorder_family + security_trio + WanderCO |
| PMIC / power | TI TPS65086100 | Reused from bridge_full + bridge_mini + medical_tricorder_family + router_*_+ WanderAlert + WanderCO |
| Flash NOR | Macronix MX25R 8 MB / 16 MB | Reused |
| Test button | Alps SKRH + custom recessed cap | Reused from WanderAlert + WanderCO |
| Tamper switch | Omron D2F-01F | Reused from WanderAlert + WanderCO |
| Bezel + paddle (matte cream anodized aluminum) | Custom | NEW |
| Saffron pinstripe (1.5 mm leading edge) | Custom anodized aluminum | NEW |
| Wall plate (Decora-compatible) | Standard Decora cutout; matte cream anodized aluminum | NEW |
| Back box clip + retention | Custom; standard NEMA WD 6 mounting | NEW |
See BOM-platform.csv, BOM-modules.csv, BOM-normalized.csv, SOURCING.csv for full part list + sourcing.
---
Stage 2b — Configurator axes (2026-04-25)
7 axes per tier. See CONFIGURATOR.md for full matrix. Summary:
- WanderSwitch Standard: chassis finish (cream / charcoal / brushed) · companion-app language pack (English / Spanish / Tagalog / Vietnamese / Mandarin / Hindi-Urdu — v1.1 expansion) · Matter fabric binding (Apple Home / Google Home / Amazon Alexa / Home Assistant / SmartThings / WanderNode Hub) · survivor-pattern eligibility (default-off / WWP-reviewed) · paddle style (Decora-default / softer-touch v1.1) · Ambassador signature · donor-pairing
- WanderSwitch Pro: all Standard axes + Thread border-router enable (default-on / disabled — disabled is rare; only for households with another mature Thread border-router already deployed) + 3-gang configuration (1-dim+2-paddle default / 3-paddle / 3-dim — 3-dim ships v1.1)
---
Stage 3 — Compatibility (2026-04-25)
Resolved:
- Thread 2.4 GHz + BLE 2.4 GHz + 50/60 Hz AC line + TRIAC switching transient — coexistence handled per nRF52840 chip-antenna RF clearance zone + careful PCB layout (per
THERMAL-EMC.md)
- nRF52840 + STMicro T1235H over GPIO + L9961 line-scavenging via I²C + Cree CLM3C-AKA via TPS92518 PWM + SE051 over I²C: shared with per-peripheral isolation
- Line-scavenging voltage profile: variance handled by TPS65086100 PMIC (analogous to LiSOCl2 handling in WanderCO)
- Cree CLM3C-AKA at 20 mA / LED × 8 (Std) or × 10 (Pro) = 160-200 mA peak (Level 1 advisory full strip pulse). Drawn from line-scavenging budget; 200 ms duty-cycled
- LED-load compatibility envelope (D-SW-001): 8-brand validation matrix at DVT — HARD GATE before customer ship
Deferred to Stage 5 (PCB layout):
- TRIAC + Thread 2.4 GHz radio coexistence on 4-layer 35×60 mm PCB (Std) / 75×60 mm PCB (Pro)
- Saffron LED strip thermal spreading (in-wall electrical product; chassis aluminum heat-sinks)
- TRIAC EMI ferrite + snubber placement (FCC Part 15 Class B is the critical pre-cert)
---
Stage 4 — Sourcing (2026-04-25, framework only)
See SOURCING.csv. Live RFQs deferred until UL 20 + UL 1472 cert lab engaged + engineering hire onboarded.
Critical dual-source flags:
- STMicro T1235H — alternate = WeEn BT139-600E (12 A / 600 V snubberless; pin-compatible)
- STMicro L9961 — alternate = discrete line-scavenging topology with STMicro VIPER0P + custom controller (board respin if needed)
- Nordic nRF52840 — alternate = TI CC2652R7 per parts.db (Thread-border-router-favored revision option for Pro tier)
- Cree CLM3C-AKA saffron — alternate = OSRAM LSE65 / Lumileds LUXEON Z amber
- NXP SE051 — alternate = NXP SE050 / Microchip ATECC608B
---
Stage 5 — DFM/DFA/DFT (2026-04-25)
See DFM-DFA-DFT.md. Critical:
- UL 20 contact-resistance test fixture (Ambassador station; calibrated 4-wire Kelvin probe + 16 A test current per UL 20 spec)
- UL 1472 dimming-curve verification rack (5 reference LED loads: Philips Hue White 5W, Cree TW 9W, GE Reveal 13W, Sylvania Smart+ 16W, Feit Smart 25W; verifies adaptive profiling delivers clean dim curve)
- Matter device-attestation cert (DAC) provisioning fixture (secure provisioning workstation; SE051 personalization; per-unit DAC programming)
- TRIAC zero-cross alignment verification (oscilloscope-based fixture; verifies T1235H gate-trigger timing within ±50 µs of zero-cross)
- Line-scavenging current verification at 5 reference loads (5 W / 15 W / 30 W / 60 W / 100 W resistive; verifies L9961 captures within 5-15 mA budget)
- EMI pre-scan (Class B compliance; pre-cert lab visit)
- Ambassador throughput: Standard 10 min · Pro 16 min.
---
Stage 6 — Thermal/EMC (2026-04-25)
See THERMAL-EMC.md. Operating range -10 to +60 °C (UL 20 + EN 60669 envelope; in-wall electrical product worst case). TRIAC + L9961 + Thread + BLE coexistence handled per industry-standard ferrite + snubber + careful PCB layout. TRIAC EMI is the critical FCC Part 15 Class B failure mode — board respin budget reserved if pre-scan fails.
---
Stage 7 — Compliance (2026-04-25)
See COMPLIANCE.md.
Cert sequencing (target):
- UL 20 (general-use snap switches) — initiated 2026-Q4, granted 2027-Q2
- UL 1472 (solid-state dimming controls) — initiated 2026-Q4, granted 2027-Q2 (bundled lab visit with UL 20)
- FCC Part 15 B/C — DVT 2027-Q1
- CSA C22.2 No. 42 (Canadian general-use switch) — bundled with UL 20
- CE / UKCA + EN 60669-1 + EN 60669-2-1 — bundle with FCC test data 2027-Q2
- Matter cert (CSA / Matter Alliance) — initiated 2026-Q4, granted 2027-Q2
- Thread cert — bundled with Matter cert path
- Bluetooth SIG — 2027-Q2
- RoHS / REACH — declared throughout
Total cert v1: ~$80-130k.
---
Stage 8 — Canonical BOM + GUIDE + STLs (2026-04-25)
Files produced. STL-OPEN-FILES/README.md documents CC BY-SA 4.0 release for every 3D-printable part:
- Paddle (Decora-compatible; saffron pinstripe leading edge)
- Bezel (1-gang Std; 3-gang Pro)
- Wall plate alternates (matte cream / charcoal / brushed)
- Back box clip + retention adapter
- Test-button corner cover
---
Stage 9 — HW/FW (2026-04-25)
WanderOS-SW on Zephyr (line-scavenging duty-cycle awareness required — aggressive system-off scheduling between paddle press / Matter-fabric event / TRIAC zero-cross controller activity). Single firmware codebase for both tiers (Pro adds Thread border-router compile-time flag + extra paddle handlers). UL 1472 dim-curve compliance + Matter 1.3 + Thread 1.3 stacks. OTA discipline: Matter OTA cluster + signed images + A/B partitions.
---
Stage 10 — Gate (2026-04-25)
See GATE.md. Stage-10 blockers: 1. UL 20 cert granted (HARD GATE — any sale) 2. UL 1472 cert granted (HARD GATE — dimmer SKU) 3. FCC Part 15 B + C cert granted (HARD GATE; TRIAC EMI is the critical failure mode) 4. Matter cert granted (HARD GATE — "Matter-certified" claim) 5. Thread cert (bundled) 6. CSA C22.2 No. 42 + EN 60669-1 + EN 60669-2-1 (Canada + EU markets) 7. Advisory review complete (DV advocate + LGBTQ+ DV survivor + UL human-factors expert panels — covert duress-tap framing) 8. No-neutral LED-load compatibility validation across 8 LED brands (HARD GATE — empirical DVT validation matrix) 9. Bluetooth SIG qualification 10. Identity-aware covert duress-tap firmware + SE051 role-token enforcement + audit-log encryption — independent security audit 11. WanderNode Hub admin web UI + companion app audit-log review functionality
---
Grant-funding plausibility (decision context, not a commitment)
Recorded here so future grant submissions reference the same framing:
| Program | Why it fits | Range | Application timing |
|---|
| **HUD CDBG (Community Development Block Grant)** | Household electrical retrofit; LIHTC + LIHEAP-compatible | varies | local partner pass-through |
| **VAWA housing transition pools** | DV-safehouse covert duress-tap capability | varies | rolling — through HAVEN partnership |
| **HUD HOPWA** | LGBTQ-housing emergency-comms upgrades | varies | annual |
| **State weatherization assistance pools** (NY, IL, CA, MA all have lighting-controls-eligible budgets) | Lighting controls reduce energy use; LIHTC properties eligible | $1k-25k per property | rolling — state-by-state ops work |
| **Native youth + Tribal-enrolled rural housing programs** | Identity-aware lighting controls | varies | through Tribal nonprofit partnerships |
WanderSwitch is NOT a grant-funded product in the sense that we depend on grants to ship — the LLC pays for v1 cert from forecast hardware revenue. Grants are an accelerator for HAVEN-safehouse + LGBTQ-housing + Title-I-rural-housing donor-sponsored deployment.
---
Critical open items (revalidated)
| Item | Severity | Action owner | Deadline |
|---|
| Engineering team hire (EE + FW + Matter cert specialist; shared with WanderAlert + WanderCO + Security Trio pool) | red | Michael | NOW — 2026-Q3 start |
| UL 20 + UL 1472 cert lab engagement (Intertek / TUV SUD / UL direct — bundled lab visit) | red | cert team + Michael | 2026-Q4 |
| FCC Part 15 B + C cert lab engagement | red | cert team | 2026-Q4 |
| Matter cert (CSA / Matter Alliance) engagement | red | engineering + cert | 2026-Q4 |
| Advisory panel formation (DV advocate + LGBTQ+ DV survivor + UL human-factors expert) | red | Michael + WanderSafe team + trauma-informed counsel | 2026-Q4 (pre-EVT) |
| **No-neutral LED-load compatibility validation across 8 brands** (HARD GATE) | red | engineering | 2027-Q1 (DVT) |
| **TRIAC EMI Class B pre-scan** + board respin budget reserved | red | engineering | 2027-Q1 |
| STMicro T1235H + L9961 + opto-isolator MOC3023 dual-source qualification | yellow | engineering hire | 2027-Q1 |
| Nordic nRF52840 + TI CC2652R7 dual-source qualification | yellow | engineering hire | 2027-Q1 |
| EU bundle (EN 60669-1 + EN 60669-2-1) cert lab booking | yellow | cert team | 2027-Q2 |
| HAVEN safehouse + LGBTQ-housing donor program legal structuring | yellow | counsel + Michael | 2027-Q1 |
| Identity-aware covert duress-tap firmware + SE051 role-token enforcement (independent security audit pre-PVT) | red | firmware + security review | 2027-Q1 |
| Multi-Matter-fabric interop verification (Apple Home + Google Home + Amazon Alexa + Home Assistant + SmartThings + WanderNode Hub) | yellow | engineering + QA | 2027-Q2 |
---
Non-goals (explicitly NOT shipping in v1)
- Wi-Fi radio — never (NO Wi-Fi per D-SW-002; eliminates Kasa-class cloud-dependency failure mode)
- PIR occupancy sensor — not in v1; v1.1+ candidate via daughter card if user research surfaces demand
- Ambient-light sensor — not in v1; v1.1+ candidate
- 4-gang or larger Mega Pro tier — v1.2 candidate (4-channel dimmer for media-room scenarios)
- 3-dimmer Pro variant (replacing 1-dim+2-paddle) — v1.1 candidate
- 24 V dry-contact / Class 2 low-voltage transformer dimming — v2 candidate (would require UL 1472 Class 2 cert path)
- Z-Wave / Zigbee compatibility (other than via Matter Bridge) — never (Matter-over-Thread only)
- Vendor cloud / "WanderVerse Cloud" — never (zero-cloud per D-SW-010)
- Light-pattern telemetry / occupancy heatmap / energy-saving analytics — never (zero-telemetry per D-SW-010)
- AI-driven dimming / "smart" auto-classification of paddle press — never (TRIAC dimming is deterministic; no LLM in the dimming loop)
- Subscription requirement for any feature — never (mesh + Matter + companion app + WanderNode Hub admin web UI all free forever)
- Spoofing of Matter cert — never (cert reference numbers + DAC private key + secure-element-stored + cert-authority-verifiable)
- Exterior wordmark on paddle / bezel / wall plate — never (D-SW-009 hard rule)