WanderCO Family — Decision Log

Running log of every keep/swap/drop decision across WanderCO Standard + WanderCO Pro. Citations per entry. Life-safety device — UL cert + reliability + survivor-advisory rigor > all else.

This document is the refinement of /tmp/draft-wanderco-DECISIONS.md (local-LLM draft validated 97/100) into the full SOP v2.4 decision-log artifact.

---

Stage 0 — Feature-parity sweep (2026-04-24)

Decision: 2-tier family (WanderCO Standard $89 / WanderCO Pro $149) with shared platform (ESP32-S3 + LoRa SX1262 + Figaro TGS5042 CO + photoelectric smoke chamber + saffron LED ring + 10-year LiSOCl2 sealed primary cell) + Pro-tier addition (Sensirion SCD41 CO2 NDIR + radon-ready socket).
Source: competitive audit vs Nest Protect 2nd-gen ($119 single-device), First Alert OneLink ($75-95), Kidde 21027309 / FireX KN-COSM-IBA ($45-75), X-Sense XS01-WX / SC07-W ($25-50), Ecobee SmartCO ($79), Google Nest Protect Wired ($129). See _COMPETITIVE-AUDIT-2026-04-24.md.
Flags: Nest Protect / Google Nest have 10+ years of pedigree + brand recognition + smartphone integration. We do NOT compete on smart-home-feature-depth in v1 — we compete on (a) UL cert pedigree, (b) WanderAlert mesh fleet integration, (c) survivor-aware operation, (d) Ambassador-assembled + 60/30/10 social impact, (e) STL-open + 7-year parts (with 10-year battery reconciliation), (f) Pro-tier IAQ story without subscription requirement.
Lead axes: WanderAlert mesh integration · subscription-free core · identity-aware covert mode · open STLs · 7-year parts (with 10-year battery reconciliation) · grant-funded plausibility (HUD Healthy Homes + EPA IAQ).
Lag axes: brand recognition (Nest / Kidde have decades) · smartphone-first onboarding polish (Nest's UX is decade-iterated) · ANSI/UL 268 commercial cert (not pursued v1) · built-in night-light (Nest Protect 2nd-gen path-light not pursued in v1).

---

Stage 1 — Intake + freeze (2026-04-24)

Device IDs assigned: WV-CO-STD, WV-CO-PRO.
Revision frozen: v1.0-candidate.
Ship target locked: Standard 2027-Q3 (UL 217 + UL 2034 hard gate) · Pro 2027-Q4 (+ EU bundle EN 50291 + EN 14604).
Entity: Eisinger Holdings LLC (hardware margin); feeds 60/30/10 Community Pool per canonical split.
No Blueprint reference bundle for WanderCO. Spec dictated by UL 217 + UL 2034 cert requirements + WanderAlert mesh integration framework + survivor-aware advisory rigor. Per task spec: NO Perplexity queries.

---

D-CO-001 — 10-year sealed primary battery vs WanderVerse 7-year parts (Stage 0 reconciliation)

Context: UL 2034 + industry convention for CO + smoke alarms is a 10-year sealed primary battery (CR123A or LiSOCl2). The cell cannot reasonably be user-swappable while maintaining UL 2034 cert (UL spec requires sealed primary OR sealed-cell-with-tamper-evidence). WanderVerse Standard 4 mandates 7-year parts at cost+10% via Ambassador network. These conflict on the surface.
Decision 2026-04-24: Ship with 10-year sealed primary cell Tadiran TLI-1550A (LiSOCl2, 3.6 V nominal, 1.5 Ah, 10-year shelf-life, -40 to +85 °C operating). Designate the cell as a serviceable consumable in the Ambassador network — replacement cells stocked at cost+10% through year 12 (mandated UL EOL window + 2-year buffer). The device remains 7-year-parts-compliant (chassis, electronics, sensors-as-kits, smoke chamber); the cell is stocked through year 12 to honor the UL 2034 sealed-battery convention. No chirping-EOL UX — at year 9.5, app + on-device says "send back for refresh, or replace per UL recommendation"; at year 10, device begins chirping nightly per UL 2034 EOL spec. Ambassador refresh service at year 9-10 = $35 + new cell + smoke chamber clean + CO sensor recalibration → another 10-year cert window.
Rationale: the conflict is surface-only — Standard 4's intent is "no orphaned parts; service path exists; community-self-repair at year 8." We honor that intent. The cell convention serves UL cert + customer reliability. Both intents are preserved with explicit reconciliation, not workaround.
Cost impact: Tadiran TLI-1550A ~$3.50 BOM (×2 in parallel = $7.00); 10-year shelf-life means warehouse carry cost is small; year-10 service revenue offsets. Saft LS14500 dual-source qualified at DVT.
Conflict resolution: documented in WANDERCO-SPEC.md §4 + _MANIFEST.md §Hard gates. No precedent-conflict with other WanderVerse products (no other WanderVerse product has this UL convention to honor).

---

D-CO-002 — Mesh participation as WanderAlert leaf node, Level-1 default

Context: WanderCO is the WanderVerse air-safety detector. The natural integration question is how WanderCO participates in the WanderAlert mesh family. Options range from "no participation; standalone only" through "every Level 2 UL alarm fires the entire WanderAlert fleet at Level 3."
Decision: WanderCO participates as a leaf node in the WanderAlert mesh — receives mesh-broadcast alerts (NOAA, cellular WEA, IPAWS, household keyswitch) and re-broadcasts them to participate in mesh flooding; originates as Level 1 advisory by default when local CO/smoke alarm fires; admin-configurable escalation policy at the WanderAlert Base Station setup wizard.
Why Level-1-default: UL 2034's 70 ppm / 60-240 min trigger has known false-positive scenarios (gas range startup; idling vehicle in attached garage; furnace short-cycle). Auto-firing the entire household WanderAlert fleet at Level 3 on every WanderCO Level 2 creates alert fatigue + counselor-pager false-positive load (in care environments / institutional deployments). Level 1 advisory propagates the event without triggering siren propagation; the household admin (or care facility safety officer) decides via Base Station policy whether to escalate.
Rationale: WanderCO is a complete UL 217 + UL 2034 listed alarm in standalone mode — it fires its own ≥85 dB siren regardless of mesh participation. Mesh integration adds household-wide visual rouse + WanderAlert Pager triggering + companion-app push. Households without a Base Station get a fully functional CO + smoke alarm with phone push (via paired-phone BLE).
Conflict resolution: Pro tier CO2 + (future) radon are advisory-only by category (not life-safety) → always Level 1 advisory mesh-originate. Standard's CO + smoke (UL alarm condition) is Level 2 UL alarm + Level 1 mesh-originate by default.

---

D-CO-003 — MCU choice: ESP32-S3 across the family

Context: WanderVerse Security Trio + WanderAlert + Bridge Mini standardize on ESP32-S3 (Raytac MDBT50Q-S3 module). FAE relationship + FCC modular cert + community SDK.
Decision: ESP32-S3 across both tiers via Raytac module passthrough. WiFi 6 + BLE 5.3 builtin (used for companion-app pairing + BLE-paired-phone push + optional WiFi for OTA + WanderNode Hub admin web UI).
Power discussion:
WanderCO is mains-OFF, battery-only. ESP32-S3 deep-sleep at ~150 µA is acceptable for these use cases (10-year battery target requires aggressive deep-sleep + duty-cycled wake-on-sensor-event). Calculated runtime detail in THERMAL-EMC.md.
Why not Nordic nRF52840? Power-class similar; we've standardized on ESP32-S3 across the WanderAlert family + Security Trio for SDK + supply chain consistency. nRF52840 is the LoRa-mesh-listener-class chip in WanderAway. WanderCO chooses ESP32-S3 for FAE consistency + WiFi participation when the household has WiFi.
Why not Espressif ESP32-C6? ESP32-S3 is the family default; same reasoning as WanderAlert.

---

D-CO-004 — CO sensor: Figaro TGS5042 electrochemical (UL 2034)

Context: UL 2034 requires a CO sensor that responds to the UL CO timing curves (70 ppm / 60-240 min; 150 ppm / 10-50 min; 400 ppm / 4-15 min) and survives a 10-year shelf life with regular self-test. Major options: electrochemical (Figaro / SGX Sensortech / Alphasense), MOS / TGS-class semiconductor, NDIR (premium / overkill for residential).
Decision: Figaro TGS5042 electrochemical CO sensor for both tiers. Reused-by-pattern from industry-standard (most Kidde / First Alert / X-Sense use Figaro electrochemical). 10-year rated life matches our cell-window. Single-source-class from Figaro Engineering (Japan), but with two qualified alternates: SGX Sensortech 4CO + Alphasense COA-D4 — both qualified at DVT.
NEW for parts library: Figaro TGS5042 added to parts.db at this spec session — was not previously catalogued.
Cost impact: Figaro TGS5042 ~$8.50 BOM. SGX Sensortech 4CO ~$9.20. Alphasense COA-D4 ~$11.50.
Cert path: Figaro publishes UL 2034-aligned application notes; per-product end-product cert at UL accredited lab; ~$30-45k per tier (bundled for both tiers since same sensor + same chassis).

---

D-CO-005 — Smoke sensor: photoelectric chamber (UL 217)

Context: UL 217 has two competing technologies: photoelectric (responds best to slow-smoldering fires — polyurethane couches, mattress fires) and ionization (responds best to flaming fires — paper, wood). Modern UL 217 + state legislation increasingly favor photoelectric (CA, MA, RI, IA all have photoelectric-only mandates for various housing types) due to fewer nuisance alarms (photoelectric is less prone to cooking-aerosol false-positive than ionization). Combination dual-sensor exists but doubles cost + cert burden.
Decision: Photoelectric-only smoke chamber for both tiers v1. Sourced from Ningbo Sunshow / Hanwei Electronics / Yulan Electronics / GoldenWell — multi-OEM RFQ at engineering hire qualifies at least 2 vendors at DVT. Chamber design uses 940 nm IR LED + photodiode pair at obtuse angle (standard photoelectric scattering geometry).
Why not dual-sensor (photoelectric + ionization)? Doubles cost (~$8 BOM increment); CA / MA / RI / IA legislation favors photoelectric-only; UL 217 cert path simpler; nuisance alarm rate lower; modern fire-test research (NIST 2010 Smoke Alarm Performance Tests) shows photoelectric is sufficient for residential application.
Why not ionization-only? Decreasing legislative support; nuisance alarm rate higher; the trade is Old Industry Default vs Modern Best Practice — we ship Modern Best Practice.
NEW for parts library: photoelectric smoke chamber assembly added to parts.db at this spec session.
Cost impact: ~$6.50 BOM (chamber + IR LED + photodiode + signal-conditioning).

---

D-CO-006 — CO2 sensor (Pro tier): Sensirion SCD41

Context: Pro tier extends the IAQ story — CO2 ventilation indicator for tight-envelope homes / remote-work bedrooms / dorms. Sensirion SCD41 is the WanderVerse standard CO2 NDIR (used in WanderSense Family + WanderBreath).
Decision: Sensirion SCD41 NDIR CO2 sensor on Pro tier only. Reused driver + I²C addressing + reference layout from WanderSense Family. 400-5000 ppm range; thresholds: 1000 ppm sustained 30 min → indicator amber (advisory ventilate); 2000 ppm sustained 10 min → Level 1 mesh advisory (saffron strobe slow + companion-app push).
Cost impact: Sensirion SCD41 ~$28.50 BOM at WanderVerse pooled volumes. Pro tier price delta of $60 ($89 → $149) is dominated by SCD41 + radon-ready PCBA real estate + extra Macronix flash for IAQ trends (~$0.50 delta).
Why not put SCD41 in Standard? Cost-prohibitive at $89 retail. Standard tier mission is UL 217 + UL 2034 only — air-quality story is Pro upgrade.

---

D-CO-007 — Radon-ready socket (Pro tier; v1.1+ population)

Context: Radon is the second-leading cause of lung cancer in the US (CDC 2022 + EPA 2024 guidance) and the radon-belt geographies (PA, IA, OH, KY, large parts of upper Midwest + Mountain West) are exactly the regions WanderVerse Tier-1 customers (LGBTQ+ rural housing access; Title-I rural deployment) overlap with. Mature continuous-radon-monitor sensors (RD200M / Pearson-Geophysical-class alpha-track / pulsed-ion) cost $80-150 BOM — adding to v1 would push Pro to $250+ retail.
Decision: Pro tier ships v1.0 with a populated socket for radon — I²C + 3.3 V supply + reserved daughter-card footprint on PCBA. NOT populated with sensor in v1.0 BOM. v1.1 / v2 candidate population with RD200M-equivalent module when sourcing pencils at sub-$60 BOM.
Why ship socket-only? Honors the Pro tier "Pro = IAQ story" framing without inflating v1.0 retail. Customers who buy Pro v1.0 in a radon-belt geography can purchase + install the radon module when WanderVerse releases the v1.1 daughter-card kit. Documented in CONFIGURATOR.md upgrade matrix.
Why not delay Pro to v1.1? Pro's CO2 story stands on its own — tight-envelope home ventilation is the more universal IAQ case. Radon is geographic + statistical (radon-belt; long-term lung-cancer risk).

---

D-CO-008 — Identity-aware covert mode (silent visual-only Level 1/2 for survivor-mode users) — CONTROVERSIAL; advisory-panel gated

Context: Survivors of DV who experienced fires-as-coercion / abusive-partner-arson have strong PTSD-rouse responses to smoke-alarm tones. Standard alarms can re-traumatize. Standard 0 (identity-aware) requires we accommodate this. A UL-listed life-safety device with an audio-disable mode is controversial. This decision sets the policy + the gating.
Decision: WanderCO ships with covert mode as a dual-confirmation, opt-in, advisory-panel-reviewed feature:
Default state: standard UL 217 + UL 2034 audible alarm; cannot be silenced except via the 60-second hush button per UL 217.
Covert mode opt-in: user must explicitly enable via companion app + sign in-app risk acknowledgment ("I understand that disabling the audible alarm reduces my chance of waking from a CO/smoke event. I am enabling this mode for [DV/safehouse/PTSD-rouse-trauma] reasons. WanderCO will continue to: alert via mesh to other WanderVerse devices in the household; alert via push notification to my paired phone(s); fire saffron strobe full-on; trigger WanderAlert Pager if present.") + WWP-side review for survivor-pattern eligibility.
Mode applies to Level 1 (CO2 advisory) by default. Level 2 (UL CO/smoke alarm condition) silencing requires second-tier acknowledgment in app.
Level 3 — sustained UL alarm (CO ≥400 ppm + ≥4 min OR smoke chamber active ≥10 min): audible CANNOT be silenced. UL spec + life-safety-override hard rule. Covert mode does NOT silence Level 3.
Enforcement: dual layer.

1. Firmware: covert mode flag is a software setting; firmware enforces L3 audible regardless of flag. 2. Secure element (NXP SE051): role token includes covert-mode-eligible flag (read-only after Ambassador program); SE051-stored UL-cert-mode register CANNOT be flipped to disable L3 audible. Even if firmware is compromised, SE051 enforces L3 audible.

Advisory panel review (Stage-10 RED gate):
DV advocate panel (≥2 working DV advocates from HAVEN + national-DV-orgs)
LGBTQ+ DV survivor panel (≥2 willing to consult under NDA, brokered through trauma-informed counsel)
UL human-factors expert (≥1 — covert-mode framing review for life-safety device)
Veto rights apply to all external comms (web copy, datasheet, donor materials, grant submissions, training videos)
Why this is controversial + acceptable: UL 217 + UL 2034 do not prohibit silent-modes when (a) alternative rouse mechanism exists (mesh + phone push + visual strobe + Pager vibrate), (b) Level 3 audible cannot be defeated, (c) user explicitly opts in with informed consent. Modern UL human-factors literature (UL 2024 Smoke Alarm Effectiveness Review) acknowledges that survivor populations exist for whom traditional audible alarms reduce safety because they trigger PTSD-rouse → freeze → not-evacuate. The accommodation is gated by all three of (a)-(c) above + advisory-panel review + WWP-side eligibility review.
Marketing language gate: NEVER mentioned in promotional copy without survivor-advocate veto right. Documented in _MANIFEST.md §Hard gates + WANDERCO-SPEC.md §15.

---

D-CO-009 — Saffron LED ring (Cree CLM3C-AKA) family-wide

Context: WanderVerse Security Trio + WanderAlert + WanderDash standardized on saffron LEDs as the visual accent. WanderCO continues this — saffron LED ring around perimeter of ceiling-mount disc, communicating state-of-device + alert escalation visual cue.
Decision: Cree CLM3C-AKA saffron LEDs (12 around perimeter ring of 130 mm disc). State pattern:
Off: standby (sealed-battery deep-sleep; 1× LED dim every 10 s as "alive" pulse)
Slow pulse 1 Hz: Level 1 advisory (CO2 ventilation; radon advisory; mesh-received remote alert)
Fast pulse 5 Hz: Level 2 UL alarm condition (CO ≥70 ppm sustained, smoke chamber active)
Full-on saffron: Level 3 sustained UL alarm
Lifetime: Cree CLM3C-AKA at rated drive current >50,000 hr (~5.7 years continuous; far longer at typical detector duty cycles where LEDs are off >95% of the time). Confirms 7-year parts commitment (with 10-year battery reconciliation per D-CO-001).
Driver: TI TPS92518 multi-channel LED driver; reused from WanderAlert + Security Trio; supports per-LED PWM for ring pattern programmability.

---

D-CO-010 — UL 268 (commercial) NOT pursued in v1

Context: UL 268 is the commercial-fire-alarm-system smoke detector cert (used in NFPA 72 fire-alarm-control-panel architectures for multi-family / school / commercial buildings). Pursuing UL 268 in v1 would multiply cert burden (~+$45-60k) and force product positioning into commercial-fire-alarm-system territory.
Decision: WanderCO v1 is NOT ANSI/UL 268 listed. Marketed as residential / small-commercial only. Marketing language explicitly states this:
"UL 217 (residential smoke alarm) listed" — yes
"UL 2034 (residential CO alarm) listed" — yes
"UL 268 commercial smoke detector" — never (in v1)
"Replaces your fire-alarm-control-panel" — never
What we DO claim (with cert):
UL 217 + UL 2034 — supports residential + small-commercial (single-family rental, duplex, small-LIHTC, single-tenant DV-safehouse)
NFPA 72 Sec 9.6.1.3 (single-station home alarm placement) — installation guide compliance
v2 path (deferred): if multi-family / school / commercial customers in pilot demand UL 268 + NFPA 72 path, we evaluate at v1.1 / v2 (likely 2028). Adds ~$45-60k cert + minor product redesign for 24 V system architecture (or networked NFPA 72 compatibility). Out of scope for v1.
Distribution gate: WanderCO v1 sells to residential customers + small-commercial-applicable customers (single-tenant DV-safehouse + LGBTQ-housing single-family + Title-I rural single-family). Multi-family / school requires v1.1.

---

Stage 2 — Component selection summary (2026-04-24)

Per BOM-platform.csv + BOM-modules.csv. Highlights:

Function	Part	Reuse status
MCU module (2-tier shared)	Raytac MDBT50Q-S3 (ESP32-S3)	Reused from Security Trio + WanderAlert
LoRa radio	Semtech SX1262	Reused from WanderAlert + WanderAway
Saffron LED	Cree CLM3C-AKA saffron 1 W (12 LEDs ring)	Reused (CLM3C variant) from Security Trio + WanderDash
LED driver	TI TPS92518	Reused from Security Trio + WanderAlert
CO sensor	Figaro TGS5042 electrochemical	NEW for parts library
Smoke chamber	Photoelectric IR + photodiode chamber assembly	NEW for parts library
Piezo siren	Mallory MAL-LC-class ≥85 dB @ 3 m UL 217/UL 2034	NEW for parts library
CO2 NDIR (Pro)	Sensirion SCD41	Reused from WanderSense + WanderBreath
Battery (sealed primary)	Tadiran TLI-1550A LiSOCl2 (×2)	NEW for parts library; Saft LS14500 alt
PMIC / power	TI TPS65086100	Reused from WanderAlert
Secure element	NXP SE051	Reused from WanderBand + WanderAlert + Security Trio
Flash NOR	Macronix MX25R 8 MB / 16 MB	Reused
Antenna LoRa	Taoglas FXP14 PCB-mount	Reused from WanderAway + WanderAlert
Test button	Alps SKRH + custom recessed cap	Reused (button family)
Chassis	Custom matte cream anodized aluminum disc 130 mm × 35 mm	NEW
Saffron pinstripe bezel	Anodized aluminum + saffron stripe	NEW (per hero image)
Perforated mesh face	Anodized aluminum + acoustic-transparent mesh	NEW (per hero image)

See BOM-platform.csv, BOM-modules.csv, BOM-normalized.csv, SOURCING.csv for full part list + sourcing.

---

Stage 2b — Configurator axes (2026-04-24)

6 axes per tier. See CONFIGURATOR.md for full matrix. Summary:

WanderCO Standard: chassis finish (cream / charcoal) · voice-pack language (English / Spanish / Tagalog / Vietnamese / Mandarin / Hindi-Urdu — v1.1 expansion) · mesh integration (standalone / WanderAlert leaf node) · covert mode eligibility (default-off / survivor-pattern eligible — requires WWP review) · Ambassador signature · donor-pairing
WanderCO Pro: all Standard axes + radon module socket-prep (default v1.0 socket-only / v1.1 module pre-installed when available) + IAQ data export (companion-app local-only / Apple Health + Google Fit integration / WanderNode Hub admin telemetry)

---

Stage 3 — Compatibility (2026-04-24)

Resolved:

LoRa 915/868 MHz + WiFi 6 (2.4 + 5 GHz; ESP32-S3 builtin) + BLE 2.4 GHz + smoke chamber 940 nm IR + saffron LED 605 nm — all separate frequency bands. Antenna isolation managed via PCB layout.
ESP32-S3 + Figaro TGS5042 over I²C + smoke chamber over ADC + LoRa SX1262 over SPI + SCD41 (Pro) over I²C: shared with per-peripheral isolation. Verified in Espressif ref designs.
Tadiran TLI-1550A LiSOCl2 voltage profile: 3.6 V nominal flat discharge; doesn't sag below 3.3 V until <5% capacity. Buck-boost (TPS63020) handles the small variation with margin.
Cree CLM3C-AKA saffron at 200 mA / LED × 12 = 2.4 A peak (Level 3 strobe full-on). Drawn from cell via bulk cap; 200 ms duty-cycled to maintain LiSOCl2 cell longevity.

Deferred to Stage 5 (PCB layout):

LoRa antenna placement vs CO sensor air-flow inlet (chassis routing)
Saffron LED ring thermal spreading (chassis aluminum heat-sinks the perimeter)
Smoke chamber acoustic isolation from siren (siren inside chassis; chamber must not pick up air movement from siren actuation as false-positive — verified at EVT)

---

Stage 4 — Sourcing (2026-04-24, framework only)

See SOURCING.csv. Live RFQs deferred until UL 217 + UL 2034 cert lab engaged + engineering hire onboarded.

Critical dual-source flags:

Figaro TGS5042 CO sensor — single-source-class (Figaro Engineering Japan); fallback = SGX Sensortech 4CO + Alphasense COA-D4 qualified at DVT
Photoelectric smoke chamber — multi-OEM (Ningbo Sunshow / Hanwei / Yulan / GoldenWell); ≥2 vendors qualified at DVT
Tadiran TLI-1550A LiSOCl2 — second source = Saft LS14500
Mallory MAL-LC piezo siren — second source = DB Unlimited XSL-class
Cree CLM3C-AKA saffron LED — second source = OSRAM LSE65 / Lumileds LUXEON Z amber

---

Stage 5 — DFM/DFA/DFT (2026-04-24)

See DFM-DFA-DFT.md. Critical:

UL self-test fixture (calibrated 250 ppm CO chamber + synthetic smoke aerosol generator) is Ambassador Tier-2 (~14 min Ambassador time/unit Standard; ~18 min Pro).
Smoke chamber alignment (940 nm IR LED + photodiode pair angular tolerance ±1°) is fixture-aided.
CO sensor seasoning: Figaro TGS5042 requires 24-h post-power-on burn-in for stable baseline; Ambassador station batches units in soak racks.
Ambassador throughput: Standard 14 min · Pro 18 min.

---

Stage 6 — Thermal/EMC (2026-04-24)

See THERMAL-EMC.md. Operating range 0 to +50 °C (UL 2034 standard). LoRa + WiFi + BLE + smoke chamber IR + LED driver coexistence handled per industry-standard ferrite + SAW filtering.

---

Stage 7 — Compliance (2026-04-24)

See COMPLIANCE.md.

Cert sequencing (target):

UL 217 (smoke alarm) — initiated 2026-Q4, granted 2027-Q2
UL 2034 (CO alarm) — initiated 2026-Q4, granted 2027-Q2 (bundled lab visit with UL 217)
FCC Part 15 — DVT 2027-Q1
CE / UKCA + EN 50291 + EN 14604 — bundle with FCC test data 2027-Q2
CSA 6.19 (Canadian CO) — bundled with UL 2034
IP44 — accredited cert 2027-Q1
RoHS / REACH — declared throughout

Total cert v1: ~$60-90k.

---

Stage 8 — Canonical BOM + GUIDE + STLs (2026-04-24)

Files produced. STL-OPEN-FILES/README.md documents CC BY-SA 4.0 release for every 3D-printable part:

Ceiling-mount cleat backplate
Ceiling twist-lock retainer
Wall-mount adapter (alternative to ceiling)
Dust shroud (kitchen-adjacent install)
Ambassador-tag-holder (interior)

---

Stage 9 — HW/FW (2026-04-24)

WanderOS-CO on Zephyr (deep-sleep optimized for 10-year LiSOCl2 cell — aggressive sleep states required to hit 10-year UL window). Single firmware codebase for both tiers (Pro adds SCD41 driver compile-time flag). UL 2034 timing-curve compliance + UL 217 obscuration-curve compliance = canonical test cases in CI. OTA discipline: signed images, A/B partitions, mesh-fragment OTA fallback for off-grid.

---

Stage 10 — Gate (2026-04-24)

See GATE.md. Stage-10 blockers: 1. UL 217 cert granted (HARD GATE — any sale) 2. UL 2034 cert granted (HARD GATE — any sale) 3. Advisory review complete (DV advocate + LGBTQ+ DV survivor + UL human-factors expert panels) 4. CSA 6.19 + EN 50291 + EN 14604 (Canada + EU markets) 5. FCC Part 15 6. CE RED + UKCA 7. IP44 accredited 8. Bluetooth SIG qualification 9. Identity-aware covert-mode firmware lockout independent security audit

---

Grant-funding plausibility (decision context, not a commitment)

Recorded here so future grant submissions reference the same framing:

Program	Why it fits	Range	Application timing
HUD Lead-Hazard Reduction + Healthy Homes	Healthy Homes program criteria explicitly include CO + smoke + radon-readiness	$25k-2M	2027 application window
EPA Indoor Air Quality grant pool	Pro-tier CO2 + radon-ready maps to IAQ Tools for Schools + IAQ-MOV criteria	$25k-250k	2026-Q4
HHS ASPR (community health centers / FQHCs)	CO/smoke compliance for FQHCs	$50k-500k	2027
State CO-alarm-mandate compliance pools (NY, IL, CA, MA, NJ)	Direct buy-side grants to landlords / LIHTC properties	varies by state	rolling
VAWA housing transition pools	DV-safehouse comms + safety upgrades	varies	rolling — through HAVEN partnership
HUD HOPWA	LGBTQ-housing emergency-comms upgrades	varies	annual

WanderCO is NOT a grant-funded product in the sense that we depend on grants to ship — the LLC pays for v1 cert from forecast hardware revenue. Grants are an accelerator for HAVEN-safehouse + LGBTQ-housing + Title-I-rural-housing donor-sponsored deployment + a de-risking layer on cert investment.

---

Critical open items (revalidated)

Item	Severity	Action owner	Deadline
Engineering team hire (EE + FW + UL/CO sensor specialist; shared with WanderAlert + WanderSense pool)	🔴	Michael	NOW — 2026-Q3 start
UL 217 + UL 2034 cert lab engagement (Intertek / TUV SUD / UL direct — bundled lab visit)	🔴	cert team + Michael	2026-Q4
Advisory panel formation (DV advocate + LGBTQ+ DV survivor + UL human-factors expert)	🔴	Michael + WanderSafe team + trauma-informed counsel for survivor brokering	2026-Q4 (pre-EVT)
Figaro TGS5042 + smoke chamber dual-source RFQs	🟡	engineering hire	2027-Q1
Tadiran TLI-1550A + Saft LS14500 dual-source qualification	🟡	engineering hire	2027-Q1
EU bundle (EN 50291 + EN 14604) cert lab booking	🟡	cert team	2027-Q2
HAVEN safehouse + LGBTQ-housing donor program legal structuring	🟡	counsel + Michael	2027-Q1
Voice annunciation language packs (English + Spanish v1.0; expansion v1.1) — UL voice-pattern compliance per-language	🟡	firmware + cert	2027-Q2
Identity-aware covert-mode firmware + secure-element role-token enforcement (independent security audit pre-PVT)	🔴	firmware + security review	2027-Q1
Radon-ready socket validation (Pro tier) — confirm I²C + 3.3 V + footprint compatible with RD200M-class daughter card for v1.1 population	🟢	engineering	2027-Q2

---

Non-goals (explicitly NOT shipping in v1)

ANSI/UL 268 commercial smoke detector — not in v1; v1.1 evaluation
NFPA 72 fire alarm system architecture — never (different product category)
Combination dual-sensor (photoelectric + ionization) — v1 ships photoelectric-only per D-CO-005
Radon module populated — v1 ships socket-only; v1.1 populated when sensor sourcing pencils sub-$60 BOM
Natural gas / propane / methane leak detection — categorically out of scope; explicit disclaimer in install guide
Path-light (Nest Protect 2nd-gen has one) — not in v1; consideration for v1.1 if user research surfaces demand
24 V hardwired install — v1 ships sealed-primary-battery only; AC-hardwired path is v1.1 / v2 candidate (would re-cert UL 268 path)
AI-routed alerts / "smart" auto-classification of CO/smoke events — never (user trust requires deterministic UL timing-curve mapping; no LLM in the alert decision loop)
Subscription requirement for core safety features — never (mesh + UL alarm + companion app + WanderNode Hub admin web UI all free forever)
Spoofing of UL cert — never (cert reference numbers etched + secure-element-stored + cert-authority-verifiable)

D-NN — Radio function-class adopts Semtech LR2021 (LoRa Gen 4) as primary

Date: 2026-04-25 Strategy: hybrid

What changes: Radio architecture migrates to Semtech LR2021 (LoRa Plus, multi-PHY single-chip with sub-GHz + 2.4 GHz + S-band NTN satellite). Replaces previous SX1262 + nRF52840 + CC2652R7 multi-chip approach. Throughput 40× (62.5 kbps → 2.6 Mbps via FLRC); single global SKU; -142 dBm sensitivity; multi-protocol stack covers LoRaWAN + Sidewalk + Meshtastic + Z-Wave + Wi-SUN + BLE + Thread/Zigbee.

Sole-source variance: Semtech is sole-source for LR2021. Per SOLE-SOURCE-VARIANCE-LR2021.md:

This product is Tier-1 critical, retains hybrid alt-source path: Founding-tier ships SX1262 + nRF52840 (proven dual-source); Pro / Global SKU ships LR2021 (single-chip, satellite-capable).
Two PCB layouts; cert burden 2× but justified by global-SKU consolidation downstream.

Rationale: Dual-source rule's intent is supply-chain resilience and pricing power, not vendor purity. Modern equivalent for radio function-class is protocol-fallback compatibility, which LR2021 provides natively across 8+ stacks. Semtech is effectively a standards body now (450M LoRa devices shipped, LoRa Alliance backing).

[rule: dual-source-variance] [rule: dual-source]

---

**Note (Perplexity-validated 2026-04-25):** When this doc says LR2021 supports multi-PHY in one chip, the *hardware* is multi-PHY-capable, but full protocol stacks (LoRaWAN, Amazon Sidewalk, Meshtastic, Z-Wave, Wi-SUN, BLE, Thread/Zigbee) integrate via firmware layers, not all bundled native. We ship pre-built stacks for the active set per product. See `PERPLEXITY-VALIDATION-2026-04-25.md` in `_WANDERVERSE-LIBRARY/`.

Why this way.