Capability matrix

Capability	Owner	Transport	Needs	Data boundary	Notes
Nearby pairing and control	Android/device	BLE	Supported Android build, Bluetooth, device approval	Phone and device	One nearby BLE connection is supported
Local face/profile storage	Android	Local storage	Android app without an authenticated session	Phone	Local state is not cloud-synced without an account
Wi-Fi profile and policy control	Device/Android	BLE session, then device networking	Nearby authenticated session	Device settings	Wi-Fi availability and credentials depend on the environment
Cloud account and sync extensions	Frontend/backend	HTTPS API	Account, configured Supabase, backend startup dependencies	Account/backend/cloud services	Cloud mode needs configured backend services
Phone-assisted relay	Frontend/backend/device	Relay WebSocket, Redis, MQTT	Short-lived ticket, route lease, configured services	Relay sees routing metadata; payload handling follows protocol	Routes work through an active phone session
Remote Wi-Fi/device route	Backend/device	MQTT	Device Wi-Fi, broker identity, configured MQTT	Broker and device route	Not needed for local Android/device operation

Local device/Android operation needs no account, Supabase, Redis, MQTT, Cloudflare, or web management shell. Cloud and relay rows are optional.