Version 2.0.1 validation

Validation date: 2026-10-20. Dependencies are pinned in platformio.ini. Earlier runtime results are preserved in 2.0.0 validation.

Builds and packages

All six applications fit the factory partition. Packaged bootloader, partition and application bytes, chip-family manifests and SHA-256 checksums pass tests/release_test.py. C5 uses the correct 0x2000 bootloader location.

Connected hardware and web UI

Both connected XIAO ESP32-S3 boards were programmed with verified writes. Their existing NVS settings migrated to only Axon/deauth alerts, threshold 60/s and mode 0 with a 120-second cycle. On one board a custom mode and Ring opt-in survived a deliberate reset, proving that the migration does not repeat. Quiet defaults were restored after testing.

Both boards passed tests/device_http.py: all eight nightlight modes, all six alert patterns and expiry, invalid-write rejection, 120 status requests, contact requests, restored settings and delayed persistence. Both ended with zero dropped observations during these runs and approximately 127 KB free heap.

The real S3 HTTP UI passed mobile-width loading, saving and all four tabs in Edge/Chromium and WebKit without page errors. Mock UI tests also pass desktop and mobile layouts, settings import/export, system controls and buzzer controls in both engines with structuredClone and AbortSignal.timeout deliberately unavailable. A startup race was fixed so Online appears only after the initial settings have loaded.

Android and Apple probe hostnames resolve through the device DNS to 192.168.4.1; their HTTP probe paths redirect to the local UI. Unknown API paths remain 404. These checks are reproducible with tests/captive_portal_test.py. The owner confirmed that the updated UI now loads on their phone. The specific phone OS was not identified, so this does not claim separate physical tests on both Android and iOS.

Detection regression tests

Native tests pass isolated departures, retry copies, short bursts, moderate traffic, many one-off clients, repeated departures spread over multiple clients, BSSID isolation, protected/truncated frames and clock wrap. Sustained broadcast, single-target and constant-sequence non-retry floods trigger after three full windows. Optional BLE spam tests cover stable crowds, short bursts, protocol separation and sustained fresh-address churn. Selected device signatures and 100,000 deterministic fuzz inputs also pass.

Runtime stability

Both final-release S3 images completed a ten-minute serial capture with 20 health records each, no unexpected uptime reset, panic or brownout, and zero queue drops. Both remained on the quiet defaults with no ambient alert events in the HTTP checks. The earlier 2.0.0 twenty-minute run remains archived separately.

Raw radio observations and backups remain private. Sanitized results are in validation-results-2.0.1.json. This finite test does not guarantee indefinite uptime or validate every power supply and RF environment.

Physical limits

Only the two S3 boards were physically available. C3, C6, C5, ESP32 DevKit and S2 are build-verified, not physically validated. S2 has no BLE; C5 monitoring is 2.4 GHz only. No buzzer or known Axon camera was available for controlled testing. No over-the-air attack traffic was generated. Parser fixtures do not establish real-world detection sensitivity or guarantee zero false alarms.