Network

Does security cost performance on the arena LAN?

Network: does security cost performance?

Link-layer WPA2 is effectively free. ESP32-C6 and the AP do AES in hardware — sub-microsecond per packet, a few bytes overhead. It adds no meaningful latency to 60 Hz UDP. Keep it on: an open SSID lets nearby devices steal airtime (contention/DoS), which does hurt latency.
Avoid application-layer TLS on the firehose. mbedTLS handshakes + per-packet MAC cost ESP32 CPU and latency, and are pointless on a trusted VLAN. Decision 2 means skip app-layer auth/TLS — not skip WPA2.

Net: VLAN + WPA2 + plain UDP/WS inside = the target closed boundary at the venue, with no meaningful performance drop. Not there yet: the current dev deployment still exposes public ports (RISK_AUDIT.md S1) — closing them is the Phase 1 exit. The real WiFi risk is 2.4 GHz airtime (ESP32-C6 is 2.4 GHz only): clean channel, WMM/QoS voice priority, power-save off, wired backbone, dual-AP split if 16 wands saturate.

Device setup is off the game plane. Wands and anchors expose a local HTTP admin UI (/) for WiFi and gateway URL. In the field, connect to the device’s temporary setup AP (LaserWands-Setup-XXXX) — no need to be on arena WiFi first. Factory reset reboots into the same flow.