Safety·

What the board can do today, and what the software refuses to claim.

Physical·

No servos, motors or cameras are attached. The LED matrix, the MCU, the Linux system and whatever the owner wires to the header pins are the whole body.
Header pins D2 to D13 can be switched by the owner, the dashboard and the agent at any time (PUT /api/pins/{pin}, q_pin). Every change is an SSE gpio event in the feed with who did it. What hangs on a pin is named in ~/.q/pins.json, never in the code: the API is about pins, not about one device. Loads draw from the 5V rail through a transistor, never from a pin (see the worked example in LED matrix & MCU).
Header pins D0 and D1 are the Linux to MCU UART and are refused by the firmware and by every layer above it.
The MCU helpers (arduino-flash, arduino-reset) can reflash or reset the microcontroller. q does not call them on its own.

The dashboard binds to loopback. Only the tunnel exposes it, and only behind the login gate.
/api/health is the single unauthenticated route and carries no personal data.

The board password, the owner token, model credentials and tunnel credentials never enter the repository or this site.
The repository is private and stays private.

Every capability on this site is marked verified only after it ran on the real board. Designs and plans are labelled as such.