WanderTag Family — Decision Log

Running log of every keep/swap/drop decision. Citations per entry. Anti-stalker safety > all else. A tracker that betrays its user — by enabling stalkers, by leaking location to platforms, by failing the disclosure protocol — is not shippable. We will delay launch indefinitely rather than ship a tag that hurts people.

---

Stage 0 — Feature-parity sweep (2026-04-24)

• Decision: 3-tier family (Tag Mini $39 / Tag Standard $89 / Tag Ultra $179) with shared Nordic + LoRa platform + tier-deltas for GPS, e-ink, eSIM cellular, IP68, solar, titanium chassis.
• Source: competitive audit vs Apple AirTag, Tile Pro, Chipolo One Spot, Samsung SmartTag2, Nut Mini, Pebblebee Tag, Eufy SmartTrack Card. See _COMPETITIVE-AUDIT-2026-04-24.md.
• Anti-pattern explicit: AirTag's stalking-disclosure pattern (positive: discoverable when separated; negative: original 3-day window was too long, anti-tracker scanning was iPhone-only, Android users couldn't detect for 18 months) and Apple Find My platform-lock (positive: massive coverage; negative: zero user control, default-broadcast, no opt-out, vendor-lock) are the explicit anti-patterns.
• Lead axes: privacy + no-platform-default + no-subscription baseline + Meshtastic-protocol baseline + identity-aware covert mode + Ambassador Signature + STL openness + repairability + 7-year parts + cross-platform DULT compliance from day 1 (vs AirTag's 18-month Android lag).
• Lag axes: raw network coverage (AirTag has ~1 billion iPhone scanners; we have a growing Meshtastic mesh + Apple/Google opt-in fallback), brand recognition, app polish.

---

Stage 1 — Intake + freeze (2026-04-24)

• Device IDs assigned: WV-TAG-MINI, WV-TAG-STD, WV-TAG-ULTRA.
• Revision frozen: v1.0-candidate.
• Ship target locked: Mini + Standard 2027-Q2 · Ultra 2027-Q3.
• Hero image (3 tiers, saffron accents, e-ink display showing N 38° on Standard / Ultra, integrated solar + cream rubber bumpers + carabiner on Ultra) is the chassis specification — proposed designs must match.
• Inheritance from WanderAway: Nordic nRF52840 + Raytac MDBT50Q-1MV2 module + Semtech SX1262 LoRa + u-blox MAX-M10S GNSS + ICM-42688-P IMU + Bosch BMP390 baro + TI BQ25180 charger + Keystone battery hardware + Taoglas antennas + Samsung 30Q cell + Macronix flash + Alps tactile buttons + GCT USB-C + Gore PMV-001 vent + McMaster T10 + brass insert. 18+ parts inherited unchanged from WanderAway BOM.
• Inheritance from WanderBand: e-ink driver pattern (IT8951) + BLE 5.3 stack.
• Inheritance from security_trio + WanderAir: TI BQ25180 charger continuity.

---

Stage 2 — Component selection (2026-04-24)

MCU — Nordic nRF52840 primary (across all 3 tiers)

• Reuse from WanderAway. Same Raytac MDBT50Q-1MV2 pre-certified module. Cert passthrough saves $20-40k per region.
• ARM Cortex-M4F @ 64 MHz, 256 KB RAM, 1 MB flash, 300 nA System-OFF standby, 5.3 mA TX, integrated BLE 5.3.
• Why not ESP32: power envelope wrong (deep-sleep ~10 µA but full-active 80-300 mA; we need <5 µA standby across 6-12 month operation on small Mini battery).
• Why not nRF52810 (cheaper): 192 KB flash insufficient for DULT rotating-key implementation + Apple Find My + Meshtastic + WanderVerse stack.
• Why not nRF5340: dual-core overkill for tag-class workload.
• Decision: Nordic nRF52840 (Raytac MDBT50Q-1MV2 pre-cert module) primary across all 3 tiers.

LoRa radio — Semtech SX1262 (all 3 tiers)

• Reuse from WanderAway. Industry-standard LoRa, 150 dB link budget, 22 dBm TX, -148 dBm sensitivity.
• Mini: SX1262 included from day 1 — this is what makes Mini a "no-subscription, no-platform" alternative to AirTag (community LoRa mesh participation via WanderStation + Meshtastic).
• 915 MHz US / 868 MHz EU separate SKUs.

GNSS — u-blox MAX-M10S (Standard + Ultra only)

• Reuse from WanderAway. L1 multi-constellation (GPS+GLONASS+Galileo+BeiDou), <2.5 m CEP, 25 mW tracking, 12 µA backup.
• Why not on Mini: keeps Mini under $39; Mini relies on BLE + LoRa proximity (last-seen-near-X via mesh). For most lost-keychain use cases, GNSS is overkill.
• Standard: 8.5 mm × 8.5 mm chip-antenna integrated GNSS (Taoglas AP.11E.07 patch).
• Ultra: same GNSS but with active-antenna upgrade (Taoglas AP.17H — better cold-start in canyon / urban).

Cellular eSIM — Quectel BG95-M3 (Standard + Ultra optional)

• LTE Cat-M1 + NB-IoT + GSM fallback + integrated GNSS redundancy. Reused from wandercar_family and matches _ESIM-MULTI-CARRIER.md.
• eUICC: GSMA SGP.22 Consumer RSP compliant. Default profile: Truphone IoT / 1NCE / Soracom IoT (global pay-as-you-go). User can swap via QR scan.
• Optional, opt-in only. Standard ships with cellular hardware fitted but eSIM disabled by default; user can activate in WanderOS app. Ultra ships with eSIM enabled (active in roam mode but no auto-data — user pays per-use).
• Why not BG77 (cheaper): no GSM fallback for legacy markets; same module footprint anyway.
• Why not nRF9160 (Nordic SIP): integrated MCU eliminates a part but also breaks our nRF52840 + cellular separation; we want cellular as a daughter-modem so non-cellular SKUs don't pay for the silicon.

IMU + baro + sensors

• ICM-42688-P (TDK InvenSense) — 6-axis IMU. Reused from WanderAway, WanderBand, wandercar_family. Used for fall/crash detection + motion-aware power management (sleep faster when stationary).
• Bosch BMP390 (Standard + Ultra only) — barometer + temperature. Used for GPS-denied altitude + tamper detection.
• Mini omits BMP390 — keeps cost under target.

Battery — chemistry + form factor per tier

• Mini: CR2032 coin cell, user-replaceable via twist-off back (no glue, no tools required). Target 12-month life @ once-daily BLE+LoRa beacon. Spare CR2032 included in box.
• Standard: 250 mAh LiPo (Varta or PKCELL CP1254A33-class), USB-C rechargeable. User-replaceable via T6 Torx back panel + JST connector. Target 30-day life @ active GNSS-aware tracking, 90+ day life @ stationary BLE-only.
• Ultra: 500 mAh LiPo + integrated 0.5 W monocrystalline solar cell (sapphire-glass covered). USB-C rechargeable. User-replaceable via T6 Torx + JST. Target 60+ day life @ active tracking; "indefinite ≥2 h direct sun / day" with solar.
• Charger IC: TI BQ25180 (Standard + Ultra) — reused from WanderAway, security_trio, wanderair_family. Linear USB-C charger; integrated battery protection.

Display

• Mini: single saffron LED (matches hero image). Bright red would imply alarm; saffron is calmer + part of family-mark palette.
• Standard: 1.0″ E Ink Carta 1.2 panel (200×200 px), driven by IT8951 controller. Low refresh rate is fine for compass + status. Always-on persistent without battery drain. Saffron-ringed status circle around panel.
• Ultra: 1.5″ E Ink Carta 1.2 panel (296×152 px), same IT8951 driver. Saffron backlight LED for night-readability + saffron status ring around panel.
• E-ink driver IT8951 reused from WanderBand pattern.

Buttons

• Mini: no buttons (proximity beacon only — pair via NFC tap to phone).
• Standard: 1 panic button (saffron ring, recessed under TPE cover, 3-second hold + 10-second cancel window) + 1 multi-function button (pair / mode select).
• Ultra: 2 buttons — panic + multi-function — same architecture as Standard, plus carabiner-clip-mounted release tab.

Chassis materials

• Mini: cream-anodized aluminum disc (Type II anodize, matte finish). Ambassador-milled or contract-CNC. Keychain hole drilled.
• Standard: slate-anodized aluminum (Type III hard anodize, matte finish). Larger volume justifies CNC + tumble + anodize batch process. Paracord hole drilled. Saffron LED ring is a separate light-pipe.
• Ultra: Grade 5 titanium chassis (CNC) with PVD diamond-like-carbon (DLC) charcoal-black coating. Cream silicone-rubber bumper overmold (corner shock dampers). Carabiner clip is removable (M3 flat-head + brass insert in chassis). Sapphire crystal over solar cell + e-ink display.
• Why titanium on Ultra: half the density of stainless, hypoallergenic, best PVD coating retention, premium-feel for the price tier. Matches hero image.

Anti-stalker disclosure subsystem

This is the safety-critical subsystem. Must be implemented bit-perfect to the Apple/Google DULT spec (December 2024 publication). All decisions documented for advisory-review audit trail.

• Disclosure beacon protocol: BLE 5.3 advertising packet at 1 Hz when separated from owner ≥30 minutes. Public address rotates among 1024 distinct identifiers per 24-hour cycle (DULT spec). Includes manufacturer ID + tracker-type byte + status flags (separated / near-owner / unknown-owner).
• Discovery from iOS: "Tracker Detect" iOS Find My anti-tracker scan picks up the device automatically. We register with Apple's MFi Find My program (separate from being part of the Find My network for opt-in Mode 2; you can be DULT-discoverable without participating in Find My network).
• Discovery from Android: Google Find My Device anti-tracker scan + AirGuard open-source app + Apple's Tracker Detect Android app all see the device. Cross-platform from day 1.
• Audible alert: Standard + Ultra have a 70 dB piezo buzzer that activates after 4 hours separated from owner (configurable in WanderOS app down to 1 hour or up to 8 hours, never disable-able except via covert mode). Mini does not have a buzzer due to cost — Mini relies on BLE-disclosure scan only.
• Visual alert: Standard + Ultra saffron LED + e-ink "Found me? I'm separated from my owner — tap NFC to learn how to disable me" message. Mini's saffron LED blinks when separated.
• NFC tap-to-disable: any NFC-equipped phone can tap the tag and reach a WanderVerse-hosted disable page (in plain web, no app required) that explains how to alert the tag's owner that an unknown tag was found, and how to disable the tag in 30 seconds via removing battery (Mini: pop CR2032; Standard / Ultra: T6 Torx back + JST). NO platform-lock; NO Apple-account required; NO Google-account required.

Identity-aware covert mode (survivor scenarios)

• Use case: survivor of intimate-partner violence wants to track their own belongings or person without disclosure beacons exposing their movement to a stalker who happens to be near. Trans / non-binary / queer travelers who carry a tag for personal safety in hostile regions.
• Hard gate: covert mode disables disclosure beacons. This creates real stalking-tracker liability if abused. Therefore:

1. Activation requires a video + audio acknowledgment recorded in the WanderOS app stating the user understands the legal liability (in CA/NY/OR/EU/UK, hiding a tracker on a non-consenting person is a criminal offense). 2. Acknowledgment is signed (cryptographic key derived from the user's WanderVerse identity), stored locally on the tag + a hashed audit-trail copy uploaded to the user's Wander encrypted personal store (E2E, never on a public server). 3. Covert mode auto-expires after 30 days. To renew, the user must re-record acknowledgment. 4. The companion app shows a persistent "covert mode active until [date]" banner that cannot be dismissed. 5. Each covert-mode activation is logged in user's WanderShield event log. 6. Survivor-advocacy expert review (NNEDV / NCADV / Project Safe Hands) is a Stage-10 BLOCKER before this mode ships.

Pre-shared trust contacts (max 8)

• Tag pairs to a person, not a platform.
• Tag's owner invites trust contacts via the companion app (email or phone). Each invitee must accept via verified link + 2FA code.
• Trust contacts can see tag's location when paired (Mode 1 BLE-direct) or via WanderStation mesh (Mode 3) or via opt-in Apple/Google Find My (Mode 2, if Mode 2 is enabled).
• No platform-lock: if the tag's owner deletes their WanderVerse account, the tag still works on BLE-direct + LoRa-direct pairing for the trust contacts.
• Max 8 contacts prevents abuse via mass-broadcast (the AirTag wide-net pattern).

Power / charging

• Mini: CR2032 only, no USB-C (cost + size). User-swap.
• Standard / Ultra: USB-C charging (5V 0.5A typical, max 1A). TI BQ25180 charger. Charging via captive USB-C cover (Standard: TPE plug-in cover; Ultra: TPE flap captive over USB-C, IP68-rated when seated).
• Ultra solar: 0.5 W Maxeon monocrystalline cell + sapphire crystal cover. MPPT charging via BQ25180's internal MPPT. Solar extends life "indefinite ≥2 h direct sun / day" — same architecture as WanderAway Ultra solar but smaller form factor.

Antennas

• LoRa: Mini: PCB trace antenna with µ-coax to chassis edge. Standard: chip antenna inside slate aluminum (small ground-plane, accept 4-5 dB worse vs external). Ultra: external blade antenna under chassis-edge dielectric window + chip antenna fallback.
• BLE 2.4 GHz: Taoglas WE.01 chip antenna (reused from WanderAway).
• GNSS L1: Taoglas AP.11E.07 active patch (Standard + Ultra; reused from WanderAway).
• Cellular (Standard / Ultra optional): dual-feed flex antenna (Taoglas TG.20 LTE Cat-M1 + NB-IoT bands) inside chassis with ferrite-isolated routing.
• Ground-plane isolation: aluminum + titanium chassis are EM-conductive; antennas are routed in dielectric windows on chassis edge. Detune is verified at PCB layout (Stage 5).

---

Stage 2b — Configurator axes (2026-04-24)

8 axes per tier (fewer than WanderAway because tags have less to configure). See CONFIGURATOR.md for full matrix.

Stage 3 — Compatibility (2026-04-24)

Resolved:

• BLE 2.4 GHz + LoRa 915/868 MHz + GNSS L1 1575 MHz + cellular LTE bands (B2/B4/B5/B12/B13/B25/B26/B66 LTE Cat-M1; NB-IoT B1/B2/B3/B5/B8/B12/B13/B18/B19/B20/B25/B26/B28; GSM 850/900/1800/1900) — all separate frequency bands.
• Aluminum chassis EM impact: tested in WanderBand with similar form factor; antenna detune ≤4 dB acceptable when chassis edge has dielectric window (Standard / Ultra) or PCB trace exits via keychain hole region (Mini).
• Iridium burst-current concern (from WanderAway) does NOT apply here — no satellite modem in WanderTag. Cellular peak ≤500 mA (BG95 typical) easily covered by 250-500 mAh LiPo + bulk cap.

Deferred to Stage 5 (PCB layout):

• Antenna placement near titanium chassis dielectric window (Ultra) — RF simulation needed.
• Sapphire-cover detune effect on GNSS L1 patch antenna (Ultra) — should be minimal but verify.

Stage 4 — Sourcing (2026-04-24)

Framework complete. See SOURCING.csv. Live RFQs deferred until Mini + Standard EVT.

Second-sources documented per preferred part. Long-lead flag on titanium PVD-DLC coating supplier (Ultra) — single-domestic-supplier currently.

Stage 5 — DFM/DFA/DFT (2026-04-24)

See DFM-DFA-DFT.md. Critical:

• Aluminum CNC + anodize batch process (Mini + Standard) is Ambassador Tier-1 capable but requires shared regional CNC + anodize pod (we don't expect every Ambassador to have a CNC).
• Titanium CNC + PVD-DLC (Ultra) requires a contract titanium-CNC partner + PVD coating partner. Ambassador Tier-2 final assembly + IP68 verification.

Stage 6 — Thermal / EMC (2026-04-24)

See THERMAL-EMC.md. -20 °C to +60 °C operating envelope (less aggressive than WanderAway because tags don't need -40°C). Solar charging temp gate (BQ25180 + LiPo charge limited 0-45°C per cell spec).

Stage 7 — Compliance (2026-04-24)

See COMPLIANCE.md. Anti-stalker DULT compliance is the primary gate, not just FCC/CE. State-level laws in CA / NY / OR (2024-2025) require tracker disclosure compliance for legal sale.

Stage 8 — Canonical BOM + GUIDE + STLs (2026-04-24)

Files produced. STL-OPEN-FILES/README.md documents CC BY-SA 4.0 release for every 3D-printable accessory.

Stage 9 — HW/FW (2026-04-24)

Zephyr RTOS on Nordic nRF52840. Firmware partitions: bootloader / DULT-disclosure (locked, no OTA without security review) / primary / secondary (A/B OTA) / Meshtastic interop / Apple Find My (opt-in) / Google Find My (opt-in) / storage.

DULT-disclosure firmware partition is locked to a published WanderVerse-signed key + periodic third-party audit — we do NOT update DULT firmware without survivor-advocacy review of the diff.

Stage 10 — Gate (2026-04-24)

See GATE.md + SERVICE-FLOW.md. Stage-10 RED blockers: anti-stalker advisory review (NNEDV/NCADV consultation) + identity-aware covert mode legal review + DULT cross-platform interop verification. None of these can be skipped or descoped.

---

Open decisions carried forward

1. NFC for tap-to-disable — Mini gets NFC tag (NTAG216, ~$0.30) for tap-to-pair + tap-to-disable. Standard + Ultra get same NFC tag PLUS active NFC controller (NXP NPM00) for richer tap interactions. Decision: include NTAG216 baseline, defer active NFC to v1.1. 2. Mini's missing piezo buzzer — DULT spec recommends audible alert. Cost analysis: piezo + amplifier adds ~$1.20 BOM; Mini margin pressure. Compromise: Mini emits a "high-frequency BLE-data audio chirp" via BLE-coded audio that DULT-compliant scanners decode (no piezo). Survivor-advocacy review will verify this is acceptable; if not, we add the piezo and absorb the margin hit. 3. Apple Find My opt-in vs default — current decision: opt-in. Some users will want default-on for the network coverage benefit. UX must NOT make opt-in feel punitive — clear "do you want to use Apple Find My to extend the search range?" prompt during pair setup, with explanation of trade-offs. 4. Color options for cream rubber bumpers (Ultra) — currently cream-only to match hero image. Consider expanding to forest-green / saffron / charcoal at v1.1. 5. Whether Tag Mini ships with Meshtastic-default or WanderVerse-native default firmware — current decision: Meshtastic-compatible default (open-protocol principle + existing community mesh). 6. Bulk discount for Mini 4-pack / 8-pack — keychain + luggage + bike + pet collar use case; consider $129 / 4-pack and $239 / 8-pack with shared trust-contact list. Defer to launch.

D-NN — Radio function-class adopts Semtech LR2021 (LoRa Gen 4) as primary

Date: 2026-04-25 Strategy: hybrid

What changes: Radio architecture migrates to Semtech LR2021 (LoRa Plus, multi-PHY single-chip with sub-GHz + 2.4 GHz + S-band NTN satellite). Replaces previous SX1262 + nRF52840 + CC2652R7 multi-chip approach. Throughput 40× (62.5 kbps → 2.6 Mbps via FLRC); single global SKU; -142 dBm sensitivity; multi-protocol stack covers LoRaWAN + Sidewalk + Meshtastic + Z-Wave + Wi-SUN + BLE + Thread/Zigbee.

Sole-source variance: Semtech is sole-source for LR2021. Per SOLE-SOURCE-VARIANCE-LR2021.md:

• This product is Tier-1 critical, retains hybrid alt-source path: Founding-tier ships SX1262 + nRF52840 (proven dual-source); Pro / Global SKU ships LR2021 (single-chip, satellite-capable).
• Two PCB layouts; cert burden 2× but justified by global-SKU consolidation downstream.

Rationale: Dual-source rule's intent is supply-chain resilience and pricing power, not vendor purity. Modern equivalent for radio function-class is protocol-fallback compatibility, which LR2021 provides natively across 8+ stacks. Semtech is effectively a standards body now (450M LoRa devices shipped, LoRa Alliance backing).

[rule: dual-source-variance] [rule: dual-source]

---

**Note (Perplexity-validated 2026-04-25):** When this doc says LR2021 supports multi-PHY in one chip, the *hardware* is multi-PHY-capable, but full protocol stacks (LoRaWAN, Amazon Sidewalk, Meshtastic, Z-Wave, Wi-SUN, BLE, Thread/Zigbee) integrate via firmware layers, not all bundled native. We ship pre-built stacks for the active set per product. See `PERPLEXITY-VALIDATION-2026-04-25.md` in `_WANDERVERSE-LIBRARY/`.