Companion to civ-kit-spec-v0.5.md. One entry per decision: what was chosen, what was rejected, what it costs. Entries changed since v0.4 are marked.
Chosen: custom hardware — conditionally. Rejected: a rugged Android phone + Meshtastic node + solar bank + Kiwix + a local-LLM app, which delivers ~80% of the list more efficiently. Why anyway: replaceable cells and seals, e-paper at near-zero power, integrated AM/SW/UHF, a beacon that runs days on a 10% reserve, a named test profile, a decade of repairability with published firmware. Tradeoff: 2–3× the cost, ~2× energy per LLM token, every driver is yours. If those properties aren't the point, use the phone.
Prior art: Kiwix, Internet-in-a-Box, PrepperDisk-style Pi libraries, Meshtastic, LilyGO T-Deck Plus; Lewis Dartnell's The Knowledge (2014) for the reboot curriculum the Tier-0 list should be checked against; and the 2022 EA Forum proposal "Civilization Recovery Kits" — an open-source kit specification placed in libraries and museums with an offline Wikipedia and a hand-crank generator — this project's nearest cousin, which got as far as a post. The Civilization Recovery Protocol is the open half of this project for the reason that proposal was open: a standard nobody owns is the only one a stranger's hardware will ever speak.
Chosen: always-on MCU domain plus a hard-switched Linux domain. Rejected: one Linux SoC always on (36–48 Wh/day idle against ~6 from the panel); MCU only (no full-text search, no libzim). Tradeoff: two stacks, a UART protocol, boot latency, a duplicated Tier-0 corpus. Payoff: comms, lights, search, beacon and ledger survive on the built-in panel alone.
Chosen: RK3588S 16 GB default; Pi CM5 16 GB viable; decided by prototype measurements. Rejected: Qualcomm QCS6490 class, Jetson Orin Nano, Pi + Hailo-10H. Forecloses: RAM is soldered — 16 GB.
Chosen: layer 1 on Domain A (keyword search, playbooks, calculators); layer 2 on Domain B (full-text search, precomputed cited answer bank); layer 3 the LLM, rationed behind a battery-cost prompt. Rejected: LLM as front door; no LLM; fine-tuning on the corpus. Tradeoff: a frozen answer bank that can be wrong at scale (eval harness, medical review, mandatory source link), editorial work someone owns, three code paths. The frontier model's synthesis happens once at build time on mains power.
Chosen: Qwen3-4B Instruct, non-thinking. Rejected: 8B-class, Gemma 3n (licence; revisit if speech-in becomes primary), Phi-4-mini (multilingual). Re-evaluate at build time and yearly.
Chosen: SX1262 LoRa for everything private and structured; 1–2 W UHF module for live voice; BLE for pairing only. Rejected: Bluetooth as the family link (room range); voice over LoRa as the only voice path; Bluetooth headsets. Forecloses: transmitters mean certification if sold; region SKUs fixed at assembly.
Chosen: plastic-substrate monochrome e-paper, warm/red front light, no touch. Rejected: OLED, transflective TFT, touch, glass-substrate e-paper. Tradeoff: refresh, ghosting, sourcing, 0–50 °C ratings — hence cold mode. Forecloses: panel size fixes the enclosure.
Chosen: 2× 26650 LiFePO4 (alternative 3× 18650 LFP), decided before the frame is drawn. Rejected: 21700 Li-ion (replaced twice in ten years); pouch. Tradeoff: ~40% less capacity, cold performance, buck-boost, ~30 mm grip.
Chosen: the entire rear face (~110 cm²) plus a 10 W fold-out. Rejected: a rear face shared with a door, a grille, or — as of v0.5 — an antenna channel; a device-sized panel for the LLM; external only. Tradeoff: solar heat reaches the cells; the bay thermistor and excluding the rear face from the thermal path remain the mitigations. Nothing else is permitted on the back.
Chosen: 1 TB NVMe on Domain B, 64 GB industrial microSD on Domain A. Rejected: microSD only. Tradeoff: two media, two backup images, both consumables.
Chosen: ≤ 2 GB plain-text essentials plus playbooks and calculators on the MCU. Rejected: everything on Domain B. Calculators may compute doses because they are deterministic, reviewed and cite their formula; the LLM may not.
Chosen: fork Meshtastic. Rejected: a custom protocol. Tradeoff: GPL, ~230-byte packets, upstream drift, channel-utilisation rules that also cap beacon and ledger chatter.
Chosen: open firmware, hardware, corpus manifests, build scripts, cryptography and ledger code. Rejected: closed firmware. A device meant to outlive its maker can't depend on its maker.
Chosen: white flashlight with auto-step-down and lockouts, red night LED, warm/red front light, SOS strobe, remote strobe that overrides the lockout, a separate AA flashlight in the kit. Rejected: no light; an unconstrained high mode; a second white reading LED; letting the lockout block the remote strobe.
Chosen: IP68 defined as 1.5 m / 30 min (IP67 minimum); named MIL-STD-810H methods with pass criteria; replaceable seals with a kit; minimum openings — now three SMA jacks and no antenna feedthrough; conformal coating; SoM screwed to the frame. Rejected: "mil-spec" as a claim; potting; a fully sealed unit; IP68 without a defined depth; the eight-screw door. Colour is handled in D27.
Chosen: sealed 4-pin screw-lock analogue connector, on the port rail. Rejected: 3.5 mm jack; USB-C audio. Amended by D28: the headset lead is choke-coupled as an FM antenna when connected, as it was in v0.1 before the jack was removed.
Chosen: whisper.cpp → M2M-100 / OPUS-MT → Piper, LLM only as glue and fallback. Rejected: the LLM as translator; NLLB-200 (CC-BY-NC).
Chosen: flashlight-style bay in the frame with a one-O-ring end cap and a captive quarter-turn latch. Rejected: the rear door; a snap cover without an O-ring; screws on the cap. Tradeoff: contact bounce (springs, foam, capacitance on Domain A, Domain B allowed to brown out), ~30 mm grip, a latch with real tolerances. Latch placement (v0.5.2): the lever lies flush in a recess on the rear face just above the bottom edge. Rejected: a lever on the front-bottom (under the keyboard hand, and the one thing on the front that isn't a control) and a lever on the bottom face itself (the device stands on that edge, so a lever there is what it leans on). Cost: ~15 mm of array height. The first two renders put the latch on different faces because the spec had never said which.
Chosen: QWERTY for bare hands; PTT, Beacon, Light, Power and a ≥ 12 mm nav pad for gloves; every safety-relevant task reachable by nav pad alone, audited as a release gate. Rejected: claiming glove-usable keys; dropping the QWERTY; fewer oversized keys.
Chosen: SoM → pad → frame → side rails and top bezel; rear face excluded; thermistor throttling. Rejected: the rear shell as heatsink; fans or vents; running Domain B slower to dodge the problem. The thermal test runs in the production olive colour.
Chosen: LoRa stub top-left, UHF whip top-right, SAW filter on LoRa receive, a limiter on the BCST input, PTT interlock that also mutes broadcast audio, never two transmitters at once, frames queued during PTT. Rejected: a matched pair of identical stubs; separation alone; a shared multiband antenna with a diplexer. Added risk: a 10 m wire on the BCST jack is a large antenna a few centimetres from a 2 W transmitter; the limiter and the interlock are what keep the Si4732 front end alive, and step 7 of the prototype path tests exactly that.
Chosen: Beacon with a backing-off schedule and a beacon-only reserve; Locate in three degrading tiers; trust-list-gated commands; not a PLB. Rejected: UWB / SX1280 ranging; a 457 kHz avalanche-style transceiver; a fixed high-rate beacon; the word "emergency." A wiped device's beacon falls back to cleartext on Open.
Chosen: a mutual-credit ledger of bilaterally co-signed records, balances from zero to a community credit limit, hours as the default unit, replicated by union over the community channel, plus a signed market board with price history. Not money, and the UI never says so. Rejected: a minted token (consensus on a partitioned mesh; money-transmission and securities exposure); offline bearer e-cash (issuer, secure element, custodian); device-printed scrip (counterfeiting, currency-lookalike rules); a commodity-backed unit (a reserve and a custodian — allowed only as a unit of account); nothing at all. Tradeoff: social enforcement, no store of value, community-scale only, a regulatory perimeter that must be re-checked if any of "non-convertible, operator-less, fee-less, custody-less" ever changes. Forecloses: convertibility.
Chosen: four channel tiers on Meshtastic slots — Open, Community, Family (AES-256 shared, rotatable), Direct (X25519 + AES-CCM) — plus an Ed25519 signing identity per device; standard algorithms, published code; known limits stated in the manual. Rejected: custom cryptography; Signal-style forward secrecy for everything (breaks group broadcast, multiplies key state; revisit for Direct in v2); encrypting the UHF module (prohibited on Part 97, not permitted on Part 95); hiding metadata (breaks relay interop). Tradeoff: who-talks-to-whom is visible; a captured device exposes its channels until rotation; 8 slots cap community membership; export rules follow the crypto across borders.
Chosen: pairing cable (primary) and BLE PIN (secondary); family root key on a sealed paper card, never on a device; in-person vouch for community keys; lost device → drop keys → per-node rotation over Direct → optional signed remote wipe leaving a cleartext beacon; cold-boot-only PIN; panic wipe. Rejected: QR codes (no camera); typed keys (recovery only); broadcasting rotations on the old channel; a PIN on every wake; a wipe that kills the beacon.
Chosen: the styling the user selected from the renders. Rejected: the sand/light-grey shell adopted in v0.2 for solar heat gain. Why acceptable: the rear face is dark glass over cells regardless; colour only changes what the rails and bumpers absorb, a few degrees in full sun, bounded by the thermistors; olive restores night discretion. The thermal test is run in the production colour so the number is measured. Forecloses nothing.
Chosen: an internal ferrite-rod antenna in the top bezel for AM/LW; a third SMA jack (BCST), receive-only, behind a limiter, on the port rail; a 75 cm FM wire and a 10 m SW wire in the kit; the headset lead choke-coupled as an FM antenna when connected. No telescoping whip anywhere on the device.
Rejected (a) — the telescoping whip (v0.1–v0.4). It was there because the Si4732 needs an antenna and a whip is what pocket radios have. On this device it is the single most likely mechanical failure (bent rod, worn pivot), it needs an RF feedthrough that is one more seal, it took a channel out of the rear face that D9 reserves for the array, and it is poor physics for shortwave — a 1 m whip against a 10 m wire strung to a tree is not a contest. The v0.4 back render made all four problems visible at once.
Rejected (b) — sharing the UHF SMA through an RF switch. Saves an opening, adds a switch in the transmit path, and means a broadcast-mode wire hangs on the port that can be keyed at 2 W. The interlock could forbid it; the failure mode when it doesn't is a cooked Si4732 or a surprised user.
Rejected (c) — FM and SW on the LoRa or UHF stubs. Hopeless at 100 MHz and below; strong local FM stations might come through, shortwave would not.
Rejected (d) — no external broadcast antenna; ferrite only. AM/LW only. Shortwave is the band that carries news across continents when everything else is down, and it needs a wire.
Tradeoff accepted: a wire has to be strung, which is slower than pulling out a whip — the quick-start covers it, and the practice is standard for anyone who has used a shortwave set; a third SMA and cap; a limiter on the input; and the ferrite rod sits inside a metal-framed device under a solar array, which is a bad place for a ferrite antenna — it goes in the top bezel, clear of the frame, and prototype step 7 measures whether AM reception is acceptable there. If it isn't, the fallback is AM on the wire too, and the ferrite becomes a nice-to-have.
Forecloses: the BCST jack is a connector, so it is a seal; adding or moving it re-runs 512.6. The ferrite rod's bezel position competes with the flashlight, the speaker and the antenna mounts for the same 20 mm of top edge.
Chosen: left rail carries only PTT, Light, Beacon and Power; right rail carries only capped ports — USB-C, clip terminal, headset, expansion, BCST — in one vertical row. Back: array and the latch strip. Top: LoRa, flashlight, red LED, UHF. Bottom: end cap and lanyard. Left and right are the user's, facing the screen — the phone convention — because without saying whose, "left rail" flips between a front view and a rear view, which is exactly how the first two renders came out as mirror images of each other.
Rejected: v0.4's text, which put the ports on the left rail with the controls — eight items on one edge, a caps-and-buttons thicket where a gloved thumb has to find PTT in the dark. The v0.4 back render ignored the text and put the ports on the right; the render was correct and the text was wrong.
Tradeoff accepted: a right-handed user holding the device with the index finger on PTT has the port caps under the palm — acceptable because caps are flush and ports are used at rest, not while transmitting; left-handed users get the mirror problem on the controls, which every radio handheld also has.
Chosen: keep the multi-constellation GNSS receiver as a wasting asset with its degradation timeline printed in the manual; make the clock a navigation instrument (temperature-compensated RTC, ±2 ppm class) disciplined by a ladder of sources — GNSS, then shortwave time signals on the receiver the device already has, then lunar-distance sights; put the almanac in the device (ephemeris computed from astronomical models, sight reduction, lunar distance) and a plastic sextant in the kit; add an anchor-node tier to Locate so the community's own surveyed mesh nodes give ~100 m positions after the satellites are gone.
Rejected (a) — removing GNSS because it will fail. It fails slowly: two weeks of normal accuracy, months of graceful degradation, and four constellations that stop on four different days. The first six months after a collapse are when people are scattered and need finding most, and a $15 receiver that is off by default is the cheapest capability on the board for exactly that window.
Rejected (b) — any "citizen" satellite or ground-based positioning system. There is none and there cannot be one: satellite positioning needs atomic clocks in orbit and a daily ground segment; Loran-C was shut down in the US in 2010 and eLoran in the UK in 2015, and the eLoran systems still running are government-operated and would fail for the same reasons. A community can run a beacon; it cannot run a constellation.
Rejected (c) — time-of-flight ranging radios (UWB, SX1280) for the anchor tier. Metre-level accuracy, but another radio and antenna for a few hundred metres of range. Signal-strength trilateration from the existing LoRa nodes is coarse (~100 m in open ground, worse in buildings) and free.
Rejected (d) — a mechanical or crystal RTC of ordinary grade. A ±20 ppm RTC drifts a minute a month, which is ~25 km of longitude a month with no reference. The temperature-compensated part costs a dollar more and drifts a minute a year.
Tradeoff accepted: longitude still depends on time, as it did in 1750; the sextant is one more thing in the case and a skill the quick-start has to teach; the IMU sight along the rail is rough (±0.5°, tens of kilometres) and exists so a fix is possible with no sextant at all; the anchor tier needs a community that has surveyed its nodes, which is a chore the manual has to sell; and decoding the WWV/CHU time code automatically is a firmware item that may not make v1 — setting the clock by ear from the voice announcement works from day one.
Forecloses: the RTC choice is a board decision; the IMU's clinometer accuracy depends on the left rail being straight and the IMU's mounting being referenced to it, which is a frame-design constraint.
Chosen: Civilization Recovery Protocol for the open standard (§4–§6: channels, beacon and Locate behaviour, ledger records, vouches, playbook schema, time-source ladder); Civilization Seed Vault for the kit and product; CIV-SV-01 for the model. The Protocol is published as its own document once the ledger and channel model have survived the prototype's partition test.
Rejected (a) — one name for everything. A descriptive product name is weak to register and anyone can use it; if the community, the standard and the product all hang on that one name, the project's most valuable asset is the one it can least protect. Splitting them puts the community and the standard where they belong — in something nobody owns — and leaves the product with a name whose weakness no longer matters much.
Rejected (b) — "Civilization Recovery Protocol" as the product name. A device isn't a protocol. Named that way, the kit promises a procedure and delivers a box.
Rejected (c) — a closed protocol. A family's second device may be a phone; a community's anchor nodes may be someone else's hardware; a recovery standard that only one vendor's kit speaks is not a recovery standard. The 2022 EA "Civilization Recovery Kits" proposal made the same call for the same reason.
Rejected (d) — publishing the Protocol now. The ledger's union-merge and the channel rotation flow are the parts most likely to change under test; a v1 that has to be retracted costs more trust than a v1 that arrives late.
Tradeoff accepted: three names to keep straight on every page; an open standard invites competing implementations, which is the point and also the risk; the acronym is unusable (C-reactive protein sits in the library), so the Protocol is always written out; and the Protocol document is a real editorial job — an extraction that has to stand without any reference to the enclosure.