The trade-offs, not just the answers.

Context

A relay must switch reliably in well under a second, for years, even with the router down. A full IP stack per node adds association delay, DHCP, and a reconnect storm on every AP reboot.

Decision

Decided: ESP-NOW. Single-digit-millisecond latency, works with the router down, and cheap in power. Reliability and ordering are handled at the gateway registry.

Options considered

• Wi-Fi + MQTT to a local broker
• ESP-NOW connectionless link
• Zigbee / Thread radio

Context

New nodes announce themselves with a discovery beacon. Silent auto-join is convenient but means devices appear on your network without your knowledge.

Decision

Decided: manual admission. New nodes surface in an Add / Ignore dialog on the touch UI. Slower by design — you approve every device on a screen you can physically touch.

Options considered

• Silent auto-join
• Manual Add / Ignore on the gateway screen

Context

With native USB-CDC, a full and undrained TX buffer blocks the main loop. Under two-node log volume the UI froze.

Decision

Decided: logging off by default. Diagnostics go through the CLI when you need them. Reliability beats observability when they conflict on the hot path.

Options considered

• Always-on per-frame serial logging
• Logging off by default, on-demand via CLI

Context

OTA must update a deployed fleet without ever bricking a node, and updates must be verifiable so a compromised channel can't push malicious firmware.

Current leaning

Open — leaning toward signed images with staged rollout and automatic rollback. Feedback welcome on key management and rollback triggers.

Options considered

• Pull from a signed HTTPS channel
• Push over the local BLE/Wi-Fi bridge
• Hybrid: signed image, staged rollout, automatic rollback

Context

The cloud must stay optional and never a runtime dependency. But what exactly should it back up, and how do we keep that promise auditable?

Current leaning

Open. Current leaning: opt-in, config-only, end-to-end encrypted, with a clear on-device indicator whenever a bridge is active.

Options considered

• Config-only backup
• Config + event history
• No cloud at all; local export only

Context

We intend to open the firmware. The questions are timing (now vs at beta) and which license best fits a hardware-adjacent, trust-first project.

Current leaning

Open. Leaning toward opening at beta once the security surface is stable. License still under discussion — weigh in on the Discord.

Options considered

• Permissive (MIT/Apache-2.0)
• Copyleft (GPL/MPL)
• Source-available