@Backflip - good to have that rounded out properly. So the complete picture for anyone landing on this thread:
Three distinct causes of E295/E299:
•
Speed sensor or magnet issues - poorly positioned, loose, or damaged sensor gives the anti-tuning algorithm exactly the kind of anomalous signal it was designed to catch
•
Wrong drivetrain configuration - chainring size or cassette type programmed incorrectly means the calculated transmission ratio doesn't match reality; the system flags it as possible manipulation
•
Actual tuning hardware - SpeedBox, MBIQ, BadAss, RedPad, PearTune, Planet3 mechanical tuning, etc. - these are what the algorithm exists to detect, and it will find them eventually
The cruel irony being that the anti-tuning system is, by design, indistinguishable from a poorly configured or poorly maintained drivetrain. Which is presumably why Shimano chose four E295 warnings before the fatal E299 - a one-strike system would be bricking bikes left, right, and centre over a slightly wobbly speed magnet.
Your point about purely software-based derestriction via eMax-Tuning being the only approach that sidesteps this entirely is well made - hardware signal manipulators are essentially gambling on the algorithm's tolerance, and that tolerance has limits.
Thanks for the thorough walkthrough on all of this - genuinely one of the clearer explanations of the E295→E299 chain I've seen. Tag me again any time.