Thank you for sharing the information.
I bought a used 3m-50, and I have it cooling, trying to get wifi set up now. I have done a factory reset. When I follow the directions, I see an Ad Hoc network with no encryption named thermostat-xx-xx-xx. I can connect to it, and it hands out a DHCP address of 192.168.1.85 - which is NOT on the same subnet as the 192.168.10.x listed in the docs (assuming the normal mask). I have tried statically setting my computer to 192.168.10.23 (ie not .1 or anything else likely) and I can't access anything on port 80 at any address I've tried - 192.168.10.1 included. To me, the DHCP on the wrong subnet seems like it's trying to access the previous owner's wifi - except it only does this in provisioning mode.
1) Does the factory reset actually restart the thermostat like RESET does? If so, then nothing is happening at the end of the countdown. It just sits there at the 02 screen after the countdown elapses.
2) Are there variants which might be using another address?