Nothing has shipped to anybody yet, so there are no version numbers on this page and no release dates. What's below is what actually changed in the code, and the numbers are measurements off the unit on my desk.
The device verifies the server against a CA compiled into its image, and the server refuses any connection that doesn't present a verified client certificate. The box generates its own key and only a certificate request ever leaves it, so no amount of access to the server side produces a private key a box would answer for. On the unit on my desk a full handshake measured 712 ms cold and a resumed one 25 ms.
Device certificates live 398 days, which is the CA/Browser Forum ceiling, and the device accepts a certificate frame on the connection it already has, so replacing one needs no re-pairing. Today the server pushes one when the CA changes. Renewing for age alone isn't automatic yet; a person starts that.
A box holds up to three trust anchors. A successor CA arrives cross-signed by the CA the fleet already trusts, and the device verifies that signature itself, offline, against its own trust set before it stores anything. The authorization is the old CA's private key rather than the connection, so somebody sitting in the middle of the socket can't produce one. It also refuses to drop its last anchor, because a box with no anchors refuses every server and there's no path back over the network.
Grays read blue on the glass and amber came out green, which is one fact, not two: the ST7789's backlight is red-deficient. A gamma curve can't fix a channel ratio, so the fix is two things judged on the bench. The panel's gamma registers are written from a table, and a per-channel white point trim (R100 G94 B86) is applied to every color on its way to the glass. The semantics row finally means what it says.
The tube and the panel brightness are per-device settings, owned by whoever owns the box, and no integration can set either one. Only the phosphor ramp moves. Every color that means something (alert, go, info) stays exactly where it is, because a color that carries meaning isn't a preference.
Claiming a box hands you a four digit PIN, shown once and good for three minutes. The box takes five wrong tries before it locks for two minutes, and the counter survives a power cycle. Both halves are built: the device draws the entry and lockout screens, and the server issues the challenge and judges the answer.
Passwords hash with argon2id. A TOTP code is spendable exactly once: the same code inside the same window is refused rather than accepted a second time. Every form that changes state carries a signed CSRF token, and a form without one doesn't get to act.
Ownership is set when the box is claimed and there's no edit afterward. Moving a box means revoking the claim and making a new one, which is the honest version of the operation anyway. A personal account is an organization with one member, so a box you claim for yourself is invisible to your company's admins, and its quorum is one, because there's one of you.
The audit chain detects edits, not deletions. It catches an entry altered in place. It can't catch a truncated tail, an omission, or a rewrite from genesis. That needs a head hash published somewhere outside the system, and there isn't one yet.
