Devices
Each card's controls are chosen by the hub from the device's capability flags — a switch gets a toggle, a colour bulb gets brightness + colour + warmth + scenes. (Demo fixtures; live actuation arrives behind operator-only sign-in next.)
Auto-pair — no more manual re-pairing
When a fixture drops to its open pairing mode, the hub re-onboards it on its own — the state machine nx_iot_provision_softap drives it end to end:
Never-brick by construction: the hub only ever pushes a reversible Wi-Fi credential — it has no firmware-write action at all, and the safety classifier defaults any un-reviewed action to blocked. A rejected push just leaves the device safe in pairing mode.
Self-healing — the blink loop, closed
The watchdog (nx_iot_watchdog) watches each device and, after a bounded run of missed heartbeats, declares it down; if it reverts to pairing it auto-re-provisions and re-anchors — same identity, no duplicate, no human:
Where it beats the app (measured, not waved)
| Axis | Smart Life / Kasa app | Nishi hub |
|---|---|---|
| Duplicate device rows on re-pair | one per re-pair | 0 — anchored by hardware id |
| Manual steps to re-pair a dropped light | several, by hand | 0 — auto re-provision |
| Works with the internet down | no (cloud) | yes — LAN-only |
| Brick risk on provisioning | trust the vendor | none by construction |
Each row is a property a sovereign gate proves (anchor duplicates_prevented, watchdog recover_count, provision never-brick alphabet) — not a marketing claim.
Backbone — from the hardware rung up
| Organ | Role | Gate |
|---|---|---|
nx_iot_anchor | WHO — stable identity, no duplicates | ✓ green |
nx_iot_classify | PROBE — vendor router | ✓ green |
nx_iot_capability | WHAT — which controls to show | ✓ green |
nx_iot_local_kasa | HOW — Kasa LAN protocol | ✓ green |
nx_iot_provision_softap | auto-pair state machine | ✓ green |
nx_iot_watchdog | self-heal / blink loop | ✓ green |
nx_iot_page | this control panel | ✓ live |
Honest scope: the controls are a live UI we iterate on; they don't actuate yet (operator-only sign-in + the Windows-native radio runner are the next rungs). The logic above is gate-proven offline; live LAN control follows.