Room or Radio?

1. The number I believed

The first classifier identified three ESP32 transmitters at 99.7% accuracy over 7,497 windows on a chronological holdout. That figure carries a condition and should never travel without it: desk receiver alone. Once a second receiver's captures of the same sessions join the population, it falls to95.7% over 14,234 windows. The gap is cross-receiver generalization, not a harder set of devices.

The feature was subcarrier phase slope, which I attributed to quartz crystal sampling frequency offset. Phase slope is actually a composite — sampling frequency offset, packet-boundary timing offset, linear channel delay, and estimator error — and a single antenna cannot decouple them. The accuracy was real. The physical attribution was wrong.

2. The controls that broke it

In the original setup each beacon sat in a different room. Which radio is this?and where is this radio? were the same label, and nothing in the experiment could tell them apart.

Three tests separated them. Placing all three transmitters on one surface four feet apart collapsed between-device separation from 7.9σ to 0.2σ. Moving a single board to another room produced a 19.6σ shift against a 2.5–4.9σ background drift floor. And two receivers watching the same transmitter in the same instant disagreed by 6.79 standard deviations in between-unit SD — the median across 10-second, 1-minute and 5-minute bins — with near-zero correlation between them, often reporting opposite slope signs.

A property of a quartz crystal cannot change because a board crossed a doorway, and it cannot disagree between two listeners. The classifier was reading room geometry.

3. Eight nights

The replication ran three transmitters four feet apart on one surface, two distinct receiver architectures (ESP32-D0WD and ESP32-S3), across eight paired overnight captures — sixteen receiver-nights in total. All 69,688,145 raw rows were screened and 69,510,186 clean frames replayed through a deterministic, unwrap-free estimator at 1-second, 10-second, 1-minute and 5-minute aggregations.

Train and test split across whole nights, never across frames. Nearby CSI frames correlate strongly, so a random frame split rewards temporal interpolation and reports it as recognition.

4. What it actually measures

Within a single session, a fixed link stays recognizable: 88.4% on D0WD, 91.7% on S3, 94.3% fused. That result is exploratory — it was specified after the frozen tests, using a train-on-first-40%, discard-the-middle-20%, test-on-last-40% split, and it is labelled that way in the exit report rather than presented alongside the preregistered results.

A blind 30-minute held-out window across fourteen receiver-nights reached95.8% against a 33.3% chance baseline, with signatures shifting only 0.07σ across a 39-minute gap.

Across unseen nights the preregistered generalization test failed. Best channel-feature accuracy was 53.2% on D0WD and 64.3% on S3 — and "best" is doing work there, because a template carried to a different night averages 38.6–48.8%, with individual pairs ranging from near 0% to near 100%. Claimed-link verification reached an equal-error rate of 30.9% against a preregistered target of 15%, AUC 0.700 against a target of 0.90. Concatenating two receivers did not rescue it.

This is not a persistent device fingerprint. It is a high-resolution, short-lived measurement of a physical link.

5. The more interesting security question

A MAC address is spoofable in software in milliseconds. A physical propagation path is not. To imitate a link signature an attacker would have to reproduce the multipath seen by several distributed receivers, from an authorized location, orientation and environment, at the same time.

The eight nights do not show that spoofing is impossible — no cloned MACs, directional spoofers, channel emulators or relay attacks were ever run. What they show is that the link is concrete enough to be worth challenging. Any protocol built on it would need short-horizon enrollment, multi-receiver consensus, and randomized challenge-response, because passive CSI alone drifts over days.

6. What the project demonstrates

The transferable part isn't fitting lines to phase data. It's building an embedded instrument, discovering that a 99.7% metric answered the wrong question, and narrowing the claim until it matched what the hardware could actually support.

Thirty-five formal rejection tests killed twenty-nine distinct hypotheses. Fifteen of the thirty-five were scored against thresholds frozen before the test ran.Thirteen of the twenty-nine were my own working results, retired by controls I built specifically to permit that outcome. Results that went against me are published beside the ones that didn't.

7. What remains unisolated

• Adversarial resistance is unmeasured. Repeatability and separability were tested. Cloned MACs, directional spoofers, channel emulators and relay attacks were not.
• Space and hardware stay partly confounded. Four feet at 2.4 GHz is roughly ten wavelengths, and each beacon kept its own antenna and position.
• Packet-boundary timing offsets. Every capture carries an unknown detection offset that mimics a phase slope, and a single-antenna receiver cannot separate it from crystal drift.
• Receiver asymmetry. Gain control and analog front-end differences between the D0WD and S3 silicon were never isolated.
• The unit of analysis is three radios. 69.5 million frames buy statistical power over time, not over devices. Every multi-class number here is a three-class problem against a 33.3% baseline.